Re: [PATCH 07/20] KVM: arm64: Add a range to __pkvm_host_donate_guest()

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [High] Incomplete support for block mappings causes memory leaks and hypervisor panics on guest teardown and page reclaim.
--

--- Patch [7]: [PATCH 07/20] KVM: arm64: Add a range to __pkvm_host_donate_guest() ---
commit f5b9f10172162184655bd754092954f6d293a934
Author: Vincent Donnefort <[email protected]>

KVM: arm64: Add a range to __pkvm_host_donate_guest()

This commit updates the __pkvm_host_donate_guest() hypercall to accept a
nr_pages argument, enabling it to map block-sized pages (e.g., PMD_SIZE) in
both the guest and host stage-2 page tables. It also updates various selftest
and pkvm mappings to pass the new argument.

> diff --git a/arch/arm64/kvm/hyp/nvhe/mem_protect.c b/arch/arm64/kvm/hyp/nvhe/mem_protect.c
> index 3118941a11a7d..9ea448895c15e 100644
> --- a/arch/arm64/kvm/hyp/nvhe/mem_protect.c
> +++ b/arch/arm64/kvm/hyp/nvhe/mem_protect.c
[ ... ]
> @@ -1422,22 +1422,30 @@ static int __guest_check_pgtable_memcache(struct pkvm_hyp_vcpu *vcpu)
>  	return 0;
>  }
>  
> -int __pkvm_host_donate_guest(u64 pfn, u64 gfn, struct pkvm_hyp_vcpu *vcpu)
> +int __pkvm_host_donate_guest(u64 pfn, u64 gfn, u64 nr_pages, struct pkvm_hyp_vcpu *vcpu)
>  {
>  	struct pkvm_hyp_vm *vm = pkvm_hyp_vcpu_to_hyp_vm(vcpu);
>  	u64 phys = hyp_pfn_to_phys(pfn);
>  	u64 ipa = hyp_pfn_to_phys(gfn);
> +	u64 size;
>  	u64 meta;
>  	int ret;
>  
> +	if (!pfn_range_is_valid(pfn, nr_pages))
> +		return -EINVAL;
> +
> +	ret = __guest_check_transition_size(phys, ipa, nr_pages, &size);

[Severity: High]
Does this code safely handle block mappings on reclaim?

If __pkvm_host_donate_guest() installs a block mapping (when nr_pages = 512),
wouldn't __pkvm_host_reclaim_page_guest() fail to reclaim it because
get_valid_guest_pte() explicitly rejects block mappings?

arch/arm64/kvm/hyp/nvhe/mem_protect.c:get_valid_guest_pte() {
    ...
	if (level != KVM_PGTABLE_LAST_LEVEL)
		return -E2BIG;
    ...
}

Similarly, wouldn't a hardware poison event calling
__pkvm_host_force_reclaim_page_guest() trigger a fatal hypervisor panic
when reading the block-level annotation, due to the WARN_ON in
host_stage2_get_guest_info()?

arch/arm64/kvm/hyp/nvhe/mem_protect.c:host_stage2_get_guest_info() {
    ...
	ret = kvm_pgtable_get_leaf(&host_mmu.pgt, phys, &pte, &level);
    ...
	if (WARN_ON(level != KVM_PGTABLE_LAST_LEVEL))
		return -EINVAL;
    ...
}

> +	if (ret)
> +		return ret;
> +
>  	host_lock_component();
>  	guest_lock_component(vm);
>  
[ ... ]

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/[email protected]?part=7