Re: [PATCH v5 18/18] KVM: arm64: Alloc simple_buffer_page using pKVM hyp allocator

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [High] Infinite top-up loop in host due to uncoalescable order-0 donations for high-order `hyp_alloc()`.
--

commit a1f4f52ea836afa69ba85406471c09d62a9b1b7e
Author: Vincent Donnefort <vdonnefort@google.com>

KVM: arm64: Alloc simple_buffer_page using pKVM hyp allocator

In protected mode, transition the allocation of the simple_ring_buffer
structures from the host to the hypervisor using the new pKVM heap
allocator.

> diff --git a/arch/arm64/kvm/hyp/nvhe/trace.c b/arch/arm64/kvm/hyp/nvhe/trace.c
> index e34f9133e5d97..45322dec6201b 100644
> --- a/arch/arm64/kvm/hyp/nvhe/trace.c
> +++ b/arch/arm64/kvm/hyp/nvhe/trace.c
> @@ -62,18 +63,34 @@ static void __release_host_mem(void *start, u64 size)
[ ... ]
> -static int hyp_trace_buffer_load_bpage_backing(struct hyp_trace_buffer *trace_buffer,
> -					       struct hyp_trace_desc *desc)
> +static int hyp_trace_buffer_alloc_bpages(struct hyp_trace_buffer *trace_buffer,
> +					 struct hyp_trace_desc *desc)
>  {
> -	void *start = (void *)kern_hyp_va(desc->bpages_backing_start);
> -	size_t size = desc->bpages_backing_size;
> +	void *start;
> +	size_t size;
>  	int ret;
>  
> -	ret = __admit_host_mem(start, size);
> -	if (ret)
> -		return ret;
> +	if (is_protected_kvm_enabled()) {
> +		struct ring_buffer_desc *rb_desc;
> +		int cpu;
> +
> +		size = 0;
> +		for_each_ring_buffer_desc(rb_desc, cpu, &desc->trace_buffer_desc)
> +			size += rb_desc->nr_page_va * sizeof(struct simple_buffer_page);
> +
> +		start = hyp_alloc(size);
> +		if (!start)
> +			return hyp_alloc_errno();

[Severity: High]
When allocating the trace buffer pages in hyp_trace_buffer_alloc_bpages(),
size is calculated by summing the required pages for all CPUs. For a larger
trace buffer, this size easily exceeds a single page.

If hyp_alloc() fails to find a high-order contiguous block, it returns
-ENOMEM. The host intercepts this via pkvm_call_hyp_req(), donates the
requested number of pages, and retries the hypercall.

However, host-donated pages are inserted at order 0 and are not coalesced.
Because they are not coalesced, they cannot satisfy the high-order contiguous
allocation required by hyp_alloc(size).

Can this cause the hypercall to repeatedly fail with -ENOMEM, causing the
host to loop indefinitely inside pkvm_call_hyp_req() and hang the system?

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260901080941.997769-1-vdonnefort@google.com?part=18