Re: [PATCH 11/20] KVM: arm64: Add a range to pKVM ownership selftest

[Vincent Donnefort <vdonnefort@google.com>]

On Mon, Aug 03, 2026 at 10:48:48AM +0000, sashiko-bot@kernel.org wrote:
> Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
> - [High] The pKVM ownership selftest crashes the hypervisor during boot when testing block-granular ranges.
> --
> 
> --- Patch [11]: [PATCH 11/20] KVM: arm64: Add a range to pKVM ownership selftest ---
> commit e6586b2867cba4559d50173770f2de71da4f2380
> Author: Vincent Donnefort <vdonnefort@google.com>
> 
> KVM: arm64: Add a range to pKVM ownership selftest
> 
> Extends pkvm_ownership_selftest() with a nr_pages argument to test state
> transitions with both page-granular and block-granular ranges.
> 
> > diff --git a/arch/arm64/kvm/hyp/nvhe/mem_protect.c b/arch/arm64/kvm/hyp/nvhe/mem_protect.c
> > index a53600c853d4f..d5ee079a5d70d 100644
> > --- a/arch/arm64/kvm/hyp/nvhe/mem_protect.c
> > +++ b/arch/arm64/kvm/hyp/nvhe/mem_protect.c
> [ ... ]
> > @@ -1894,10 +1901,10 @@ int __pkvm_ownership_selftest(u64 pfn, u64 pgtable_pfn, unsigned long pgtable_nr
> >  
> >  	selftest_state.host = PKVM_PAGE_OWNED;
> >  	selftest_state.guest[0] = PKVM_POISON;
> >  	assert_transition_res(0,	__pkvm_host_force_reclaim_page_guest, phys);
> 
> [Severity: High]
> Will this crash the hypervisor during boot when testing block-granular ranges?
> 
> When the selftest executes with a block-level range via PMD_ORDER, this
> assertion expects __pkvm_host_force_reclaim_page_guest() to return 0. However,
> __pkvm_host_force_reclaim_page_guest() hardcodes PAGE_SIZE internally:
> 
> arch/arm64/kvm/hyp/nvhe/mem_protect.c:__pkvm_host_force_reclaim_page_guest() {
>     ...
>     ret = get_valid_guest_pte(vm, ipa, PAGE_SIZE, &pte, &pa);
>     ...
> }
> 
> Because the mapping installed for this run is block-granular,
> get_valid_guest_pte() will return -E2BIG. This causes assert_transition_res()
> to fail, which triggers a WARN_ON at EL2. Since WARN_ON expands to a fatal
> BRK instruction at EL2, this results in a hypervisor panic during boot.

There's an order issue. Both

  Handle huge mappings in __pkvm_vcpu_in_poison_fault()
  Handle huge mappings in __pkvm_host_force_reclaim_page_guest()

Should come before this patch.

-- 
Vincent

> 
> [ ... ]
> > diff --git a/arch/arm64/kvm/pkvm.c b/arch/arm64/kvm/pkvm.c
> > index a9645480d1648..4d41a16cd5962 100644
> > --- a/arch/arm64/kvm/pkvm.c
> > +++ b/arch/arm64/kvm/pkvm.c
> [ ... ]
> > @@ -274,17 +283,9 @@ void __init pkvm_ownership_selftest(void)
> >  	/* Memory for the VM page-table */
> >  	pgtable = __get_free_pages(GFP_KERNEL, pgtable_order);
> >  	if (!pgtable)
> > -		goto out;
> > -
> > -	/* Page whose ownership will be tested */
> > -	page = __get_free_page(GFP_KERNEL);
> > -	if (!page)
> > -		goto out;
> > +		return;
> >  
> > -	ret = kvm_call_hyp_nvhe(__pkvm_ownership_selftest, virt_to_pfn((void *)page),
> > -				virt_to_pfn((void *)pgtable), 1 << pgtable_order);
> > -out:
> > -	if (ret)
> > -		kvm_err("Failed to run %s (%ld)\n", __func__, ret);
> > +	__pkvm_ownership_selftest(0, pgtable, pgtable_order);
> > +	__pkvm_ownership_selftest(PMD_ORDER, pgtable, pgtable_order);
> >  
> >  	free_pages(pgtable, pgtable_order);
> > -	free_page(page);
> >  }
> 
> -- 
> Sashiko AI review · https://sashiko.dev/#/patchset/20260803100904.3563942-1-vdonnefort@google.com?part=11