Re: [PATCH v2 11/18] KVM: arm64: Add a shrinker for pKVM

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [High] The pKVM memory shrinker is registered before pKVM is finalized, exposing 'pKVM-finalised-only' hypercalls to early execution which triggers a WARN_ON and potential boot panic.
--

commit 32c5640182999493c354bd3285732dfbfa3fd23d
Author: Vincent Donnefort <vdonnefort@google.com>

KVM: arm64: Add a shrinker for pKVM

Integrate the pKVM memory reclaim interface with the host's memory
management subsystem. This allows the host to automatically recover unused
memory fom the hypervisor's heap allocator when the host is under memory
pressure.

> diff --git a/arch/arm64/kvm/arm.c b/arch/arm64/kvm/arm.c
> --- a/arch/arm64/kvm/arm.c
> +++ b/arch/arm64/kvm/arm.c

[ ... ]

> @@ -2713,6 +2715,18 @@ static void pkvm_hyp_init_ptrauth(void)
>  	}
>  }
>  
> +static unsigned long
> +pkvm_shrinker_count(struct shrinker *shrink, struct shrink_control *sc)
> +{
> +	return pkvm_hyp_reclaimable(PKVM_TOPUP_HYP_ALLOC) ?: SHRINK_EMPTY;
> +}
> +
> +static unsigned long
> +pkvm_shrinker_scan(struct shrinker *shrink, struct shrink_control *sc)
> +{
> +	return pkvm_hyp_reclaim(PKVM_TOPUP_HYP_ALLOC, sc->nr_to_scan);
> +}
> +

[ ... ]

> @@ -2883,6 +2897,16 @@ static int __init init_hyp_mode(void)
>  			kvm_err("Failed to init hyp memory protection\n");
>  			goto out_err;
>  		}
> +
> +		pkvm_shrinker = shrinker_alloc(0, "pkvm");
> +		if (pkvm_shrinker) {
> +			pkvm_shrinker->count_objects = pkvm_shrinker_count;
> +			pkvm_shrinker->scan_objects = pkvm_shrinker_scan;
> +			shrinker_register(pkvm_shrinker);
> +		} else {
> +			kvm_err("Failed to register shrinker for pKVM\n");
> +		}
> +
>  	}
>  
>  	return 0;

[Severity: High]
Could registering the shrinker here expose pKVM-finalised-only hypercalls
to early execution?

Since init_hyp_mode() runs at device_initcall, the shrinker becomes globally
visible before pKVM is finalized at device_initcall_sync in finalize_pkvm().

If memory pressure triggers the shrinker in this window,
pkvm_shrinker_count() and pkvm_shrinker_scan() will invoke reclaim
hypercalls. Because pKVM is not yet finalized, the EL2 handler will reject
hypercalls beyond __KVM_HOST_SMCCC_FUNC_PKVM_ONLY with
SMCCC_RET_NOT_SUPPORTED.

Will this failure cause the host-side kvm_call_hyp_nvhe macro to trigger a
WARN_ON, potentially panicking the host if panic_on_warn is set?

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260706175415.2604046-1-vdonnefort@google.com?part=11