Re: [PATCH v2 06/18] KVM: arm64: Add topup interface for the pKVM heap allocator

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 2 potential issue(s) to consider:

New issues:
- [Low] Unused static function `pkvm_hyp_topup` causes build failure.

Pre-existing issues:
- [High] `__pkvm_host_donate_hyp()` handles allocator failures with `WARN_ON()`, allowing userspace to trivially panic the hypervisor on memory exhaustion.
--

commit ed5697a7fc612043a616e5de99f36c231db3d5dd
Author: Vincent Donnefort <vdonnefort@google.com>

KVM: arm64: Add topup interface for the pKVM heap allocator

Introduce a host HVC interface and a host side helper to allow refilling
the pKVM heap allocator.

> diff --git a/arch/arm64/kvm/pkvm.c b/arch/arm64/kvm/pkvm.c
> index 8324a6a1bc48b..e2c8714e8ccc0 100644
> --- a/arch/arm64/kvm/pkvm.c
> +++ b/arch/arm64/kvm/pkvm.c
[ ... ]
> @@ -85,6 +85,33 @@ void __init kvm_hyp_reserve(void)
>  		 hyp_mem_base);
>  }
>  
> +static int pkvm_hyp_topup(enum pkvm_topup_id id, unsigned long nr_pages)
> +{
> +	struct kvm_hyp_memcache mc;
> +	struct arm_smccc_res res;

[Severity: Low]
Does this cause a build failure with CONFIG_WERROR=y?

This static function is added here but doesn't appear to be called anywhere
in this patch, which usually triggers a -Wunused-function warning. While it
may be used in a subsequent patch in the series, each patch should compile
independently to preserve git bisectability.

[Severity: High]
This is a pre-existing issue, but can host userspace crash the hypervisor
by exhausting EL2 memory?

In arch/arm64/kvm/hyp/nvhe/mem_protect.c:__pkvm_host_donate_hyp():

    WARN_ON(pkvm_create_mappings_locked(virt, virt + size, PAGE_HYP));
    WARN_ON(host_stage2_set_owner_locked(phys, size, PKVM_ID_HYP));

At EL2 in nVHE/pKVM, WARN_ON() expands to BRK and panics the hypervisor. If
pkvm_create_mappings_locked() requires a new page table level and the EL2
buddy allocator is exhausted, it returns -ENOMEM. 

By wrapping this in WARN_ON(), a fallible allocator outcome is transformed
into a fatal EL2 panic. This allows host userspace to trivially panic the
host kernel by exhausting EL2 memory, such as by creating numerous VMs.

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260706175415.2604046-1-vdonnefort@google.com?part=6