Re: [PATCH v9 08/25] KVM: arm64: iommu: Add memory pool

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [High] kvm: fatal EL2 panic on IOMMU pool exhaustion
--

commit 4301acf34cc06e2a4b1fab6b934f06ba07d48a9d
Author: Mostafa Saleh <smostafa@google.com>
Subject: KVM: arm64: iommu: Add memory pool

This patch reserves a memory pool for the IOMMU driver's shadow page tables
early during boot based on the kvm-arm.iommu_pgt_mem command line parameter.
The driver later allocates from and frees to this pool at runtime in
protected KVM mode.

> diff --git a/arch/arm64/kvm/hyp/nvhe/iommu.c b/arch/arm64/kvm/hyp/nvhe/iommu.c
> --- a/arch/arm64/kvm/hyp/nvhe/iommu.c
> +++ b/arch/arm64/kvm/hyp/nvhe/iommu.c
> @@ -115,6 +117,11 @@ int pkvm_iommu_init(void)
>  	    !pkvm_iommu_ops->host_stage2_idmap)
>  		return 0;
>  
> +	ret = hyp_pool_init(&iommu_pages_pool, hyp_virt_to_pfn(pool_base),
> +			    nr_pages, 0);
> +	if (ret)
> +		return ret;
> +
>  	ret = pkvm_iommu_ops->init();
>  	if (ret)
>  		return ret;

[Severity: High]
Will this trigger a fatal hypervisor panic if the host specifies an undersized
pool?

The size of the newly introduced iommu_pages_pool is directly controlled by
the host via the kvm-arm.iommu_pgt_mem command line parameter. If the
host-provided pool size is too small, pkvm_iommu_snapshot_host_stage2()
called immediately after this will exhaust the allocator and return -ENOMEM.

Because pkvm_iommu_init() wraps that call in a WARN_ON():

	return WARN_ON(pkvm_iommu_snapshot_host_stage2());

and WARN_ON() at EL2 in nVHE/pKVM expands to a fatal BRK instruction, this
exhaustion will crash the entire machine.

Could this be updated to propagate the error back to the host, instead of
treating hyp_alloc_pages() failure as a fatal invariant violation?

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20261015200903.2735565-1-smostafa@google.com?part=8