Re: [PATCH 02/20] KVM: selftests: Bump the minimum GPA for page tables to 0x200000

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [High] Bumping the minimum page table GPA to 0x200000 causes the guest page tables to overlap with hardcoded VGIC redistributor addresses on ARM64, and drastically reduces available memory in memslot 0 leading to resource exhaustion.
--

commit bc2cd59874dd84e95239e4f7e4f0e21c3c8f7507
Author: Sean Christopherson <seanjc@google.com>

KVM: selftests: Bump the minimum GPA for page tables to 0x200000

Bump the selftests minimum GPA for page tables to 0x200000 so LoongArch
can use vm_alloc_page_table() natively instead of an open coded equivalent.

> diff --git a/tools/testing/selftests/kvm/include/kvm_util.h b/tools/testing/selftests/kvm/include/kvm_util.h
> index 5a7a455b53875..70906a0d1003c 100644
> --- a/tools/testing/selftests/kvm/include/kvm_util.h
> +++ b/tools/testing/selftests/kvm/include/kvm_util.h
> @@ -175,7 +175,7 @@ static inline struct userspace_mem_region *vm_get_mem_region(struct kvm_vm *vm,
>  
>  /* Minimum allocated guest virtual and physical addresses */
>  #define KVM_UTIL_MIN_VADDR		0x2000
> -#define KVM_GUEST_PAGE_TABLE_MIN_PADDR	0x180000
> +#define KVM_GUEST_PAGE_TABLE_MIN_PADDR	0x200000

[Severity: High]
Does bumping the minimum GPA to 0x200000 cause the guest page tables to overlap
with the VGIC redistributor on ARM64?

In tools/testing/selftests/kvm/arm64/vgic_init.c:subtest_v3_redist_regions(),
the redistributor is hardcoded to be placed at the same address:

    addr = REDIST_REGION_ATTR_ADDR(2, 0x200000, 0, 0);
    kvm_device_attr_set(v->gic_fd, KVM_DEV_ARM_VGIC_GRP_ADDR,
                        KVM_VGIC_V3_ADDR_TYPE_REDIST_REGION, &addr);

Because KVM maps the redistributor over memory, wouldn't the hardware MMU's
stage-1 page table walk attempt to read page table entries from an emulated IO
region?

This seems like it would cause a stage-2 fault that KVM cannot handle for a
stage-1 page table walk, leading to an infinite exception loop.

Additionally, does starting allocations at 0x200000 severely reduce the
available memory in memslot 0?

In tools/testing/selftests/kvm/lib/kvm_util.c:vm_nr_pages_required(), memslot 0
is sized to be just slightly larger than 2MB:

    nr_pages = 512;
    
    /* Account for the per-vCPU stacks on behalf of the test. */
    nr_pages += nr_runnable_vcpus * DEFAULT_STACK_PGS;

It seems like this leaves only a few pages for page tables. If a test has
multiple vCPUs, wouldn't it exhaust this tiny pool and trigger the abort in
tools/testing/selftests/kvm/lib/kvm_util.c:____vm_phy_pages_alloc()?

    enomem:
        fprintf(stderr, "No guest physical page available, min_gpa: 0x%lx "
                "page_size: 0x%x memslot: %u\n",
                min_gpa, vm->page_size, memslot);
        fputs("---- vm dump ----\n", stderr);
        vm_dump(stderr, vm, 2);
        abort();

>  
>  #define DEFAULT_GUEST_STACK_VADDR_MIN	0xab6000
>  #define DEFAULT_STACK_PGS		5

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260826230511.972824-1-seanjc@google.com?part=2