From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail-qt1-f179.google.com (mail-qt1-f179.google.com [209.85.160.179]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 0E03F2E22BD for ; Fri, 19 Jun 2026 10:36:32 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=pass smtp.client-ip=209.85.160.179 ARC-Seal:i=2; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1781865395; cv=pass; b=o7NIrSiyvzRVUHzGeOMe+nDOnk91KQpftQNUg0B2lzxaRKduYtTCng5NWx6fVtq5FtOwDuRlGt3pLD6sJK77HItAcOF/jUGRaKz68nBJFVkQbYFB1fczd+/yZEsbcT22VxBavo6hka3YWr6BlbvCoVdg44Xg3KHfEkPn7oXNwtE= ARC-Message-Signature:i=2; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1781865395; c=relaxed/simple; bh=Kpv/JcmfGFx2o0miFAoqUveVveGjW/t0twGJIKckgXc=; h=MIME-Version:References:In-Reply-To:From:Date:Message-ID:Subject: To:Cc:Content-Type; b=JEoh5twXgF37se8HKkaaXRvqEcTbNOb2pKJ+P8jhtf6MzJD//cmlwOCpE9djc8QvGA+lSAGFPm06m4fqMLNIwPIfLnvdp/UfvSHr4BcBb8W3jeZruWnt5D3o4T/VPoASP5HQrQ1xHPAA4R/JTnrJVsBORWT+0T8nUDfGDZYAkmk= ARC-Authentication-Results:i=2; smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=google.com; spf=pass smtp.mailfrom=google.com; dkim=pass (2048-bit key) header.d=google.com header.i=@google.com header.b=WGAoUpmh; arc=pass smtp.client-ip=209.85.160.179 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=google.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=google.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=google.com header.i=@google.com header.b="WGAoUpmh" Received: by mail-qt1-f179.google.com with SMTP id d75a77b69052e-519ed52bcc6so130971cf.0 for ; Fri, 19 Jun 2026 03:36:32 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1781865392; cv=none; d=google.com; s=arc-20260327; b=P6jpk44ivSunhWjCuhhP22S9UAFfu/VRvcGZmnVbYf6sWtv+xsrqgCnzTrocxH97v7 +LmjbKXQU6e7dX7pi2klJ+Mw8XyLM8BMHkhWrVO6PWrSo7F/vlP3RD6yv7x7kfA00ecq Bl3kvVMruNJbCDXTm1ywBmcyiNfW3fRn9kyG1N5IrJToIU/+VhrZdzE9Nm3eCOgFpnpA ux/+KGMgCliRep/uXNUJ4CUUMvr0NA06O+/fPGNLbkS8ylWAZKnNqTQcgHJNBn8DuC3W 4peRNGtUxQ+wkmq3/3f36r8EuCKT4+RnG6sPqes4/MtFkCnXF1rilgeyoSOfUHFnN3ru zbZg== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20260327; h=cc:to:subject:message-id:date:from:in-reply-to:references :mime-version:dkim-signature; bh=YuuXVoQ2ecZDLg/Pv4tnmec6MwmZ/WlSis1mzF80Zmw=; fh=z/V/J3Oawe40ZZLmTJfYQbHfDURWAjWrWgfo1JR5Po0=; b=pLoiCUPdVctaD1PA7B9V7S6g4THDcEn1B3pISoKfbL7UHxkPL9d870As9jXLvXQ5Ky 99in8hDHeetksIaL6+4A7hJc2jcs/KPKkOLE2uT6aLtB/2UpCbYH1LHZX5r99yZFFPOS uQkfOsK2QdqjUsTrpQfKsF2IXbMzSDVScRgbXpfbjyEuXp9fNRiB31p3Drht9N6NqCrt yTZpONoF9RdDrnxgKRWrvuwIhImjo2JeYUNdb0NFkYAndpFI/QqJsg918fvcF/j8/LQH Bx1Is+9A7IN4yR0dLmtXGyQ1aLmQrI+8zPnyUj0KSM2hXW6PfaSChBYq1Pz9jXmas3p1 yEWg==; darn=vger.kernel.org ARC-Authentication-Results: i=1; mx.google.com; arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20251104; t=1781865392; x=1782470192; darn=vger.kernel.org; h=content-type:cc:to:subject:message-id:date:from:in-reply-to :references:mime-version:from:to:cc:subject:date:message-id:reply-to :content-type; bh=YuuXVoQ2ecZDLg/Pv4tnmec6MwmZ/WlSis1mzF80Zmw=; b=WGAoUpmhQ+IxkfmaF8P6q+6M+AipZQrlXcmwjrGopuJ5XlQyVVX4eqBvL9VZ1BGeex IKPW1ZuMiyGky0Ob3hbgfSk0Ro3gYtPjykGTu+ohOAVKoEBhZkwkAL1OGJ19inww/LZV aRFdTtiwlmbgjN06XGq59ve/+Ohf8vivTKzTgwYd9jLtXYRcNexRIXlWVY0vr79vlY/g VPUKPpAq8286MgEtaXYZVAwqbeZr9qaeH0rACLR0w/eqOA0/oKelBb4g8r8oBYxtYn2v 0KGW+laRi9T8eH9Gf4PcLqyTy3QB2UukHfrh92uFDWdNsbSgkYo5LMfRHqcgvODWdZLE uqwQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1781865392; x=1782470192; h=content-type:cc:to:subject:message-id:date:from:in-reply-to :references:mime-version:x-gm-gg:x-gm-message-state:from:to:cc :subject:date:message-id:reply-to:content-type; bh=YuuXVoQ2ecZDLg/Pv4tnmec6MwmZ/WlSis1mzF80Zmw=; b=KxsIJ5Jg7HlHt9M/nBHrN/cqkgMpnEsikVs2tgqbC9xfUgk5N6yPNBK5TxE3rW5VB4 0bUOP0NvtTv8yDARhqT2RQlJaio97nOLJPjyBS3f8ysWLHhFqCGU06mwzQQmhSc+ZHR8 sks8Sf+6sVtiMtudE1T1FIkYvHpV2ogh50hYH2/VeXkD9MMQWephxX3ch1S2TXsXoxAk EUZ/bvFhzB+u2vsgNhHPDmeBBLBTsu94t3yO4IoXKMDfLXdfsQAYJ8KPfPdA//QeB9sk IWRTzKrxAYBM0NZ6t6TRHT8t90un7Y18Trf/83nIEQ6xwPfwnSKvVaoGN1Dj5mFNXrXm 0/1g== X-Forwarded-Encrypted: i=1; AFNElJ/b8dmcZW9R1xWS/P8vUVfDQl2zegEn9ReaQTp/l+0zXbhhLft35djpKWvj7iheT6CRz8PzTUTyhmKwTWI=@vger.kernel.org X-Gm-Message-State: AOJu0YwKfMdUp9Q/n2pOc4jxLOIIdmUrJ2Lp5g5eIHfUKXZHlj5dFcdE d2mDT3MqEci5c6qJKzOQLuKkunA6AzgS2X5PJfscZeKd3BKzQD+tQQZPz+ypTF85RcYGiIMmhrW WOQYCx44exwOMG+O9Hm3dfuftKboPsOjELKJDfSEH X-Gm-Gg: AfdE7cnszmQ29kwdsWdn8+Zk6UBiOACJ1yFw3bqXT1J/SIcsQkF/UlFnDRiM+5um0WH ZrPzMRZIDxx49Axs3pr3nDQp8nyX2VefXKzynNACVUpThj5N9bEWmgp+92T7zUajdodzdsdt8NB 7qFlTDqg5XWo8azobQBkLMJBJ/RM5AgJRp8HcKlEz8loIe9N7lsuo+73+x+pfWSoa6dBZxGTBsr /DGjS0jkHTF1FLfstIfo2lujkBDTa2ITzqlI676UsFuGYUczukRZKMNxfuipG84XU2c+VAFVw== X-Received: by 2002:a05:622a:82:b0:50f:ce97:3b84 with SMTP id d75a77b69052e-519e48867afmr7169791cf.6.1781865391025; Fri, 19 Jun 2026 03:36:31 -0700 (PDT) Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 References: <20260618-gmem-inplace-conversion-v8-0-9d2959357853@google.com> <20260618-gmem-inplace-conversion-v8-17-9d2959357853@google.com> In-Reply-To: <20260618-gmem-inplace-conversion-v8-17-9d2959357853@google.com> From: Fuad Tabba Date: Fri, 19 Jun 2026 11:35:54 +0100 X-Gm-Features: AVVi8CcjKXQn8ypCrAeWLOhyWs6z3Z6iNQ-s7Ah4piPeXrrDDhzORiMG-WJ9jpU Message-ID: Subject: Re: [PATCH v8 17/46] KVM: guest_memfd: Advertise KVM_SET_MEMORY_ATTRIBUTES2 ioctl To: ackerleytng@google.com Cc: aik@amd.com, andrew.jones@linux.dev, binbin.wu@linux.intel.com, brauner@kernel.org, chao.p.peng@linux.intel.com, david@kernel.org, jmattson@google.com, jthoughton@google.com, michael.roth@amd.com, oupton@kernel.org, pankaj.gupta@amd.com, qperret@google.com, rick.p.edgecombe@intel.com, rientjes@google.com, shivankg@amd.com, steven.price@arm.com, willy@infradead.org, wyihan@google.com, yan.y.zhao@intel.com, forkloop@google.com, pratyush@kernel.org, suzuki.poulose@arm.com, aneesh.kumar@kernel.org, liam@infradead.org, Paolo Bonzini , Sean Christopherson , Thomas Gleixner , Ingo Molnar , Borislav Petkov , Dave Hansen , x86@kernel.org, "H. Peter Anvin" , Steven Rostedt , Masami Hiramatsu , Mathieu Desnoyers , Jonathan Corbet , Shuah Khan , Shuah Khan , Vishal Annapurve , Andrew Morton , Chris Li , Kairui Song , Kemeng Shi , Nhat Pham , Barry Song , Axel Rasmussen , Yuanchu Xie , Wei Xu , Youngjun Park , Qi Zheng , Shakeel Butt , Kiryl Shutsemau , Baoquan He , Jason Gunthorpe , Vlastimil Babka , kvm@vger.kernel.org, linux-kernel@vger.kernel.org, linux-trace-kernel@vger.kernel.org, linux-doc@vger.kernel.org, linux-kselftest@vger.kernel.org, linux-mm@kvack.org, linux-coco@lists.linux.dev Content-Type: text/plain; charset="UTF-8" On Fri, 19 Jun 2026 at 01:31, Ackerley Tng via B4 Relay wrote: > > From: Ackerley Tng > > Introduce KVM_CAP_GUEST_MEMFD_MEMORY_ATTRIBUTES to advertise the > availability of the KVM_SET_MEMORY_ATTRIBUTES2 ioctl. > > KVM_SET_MEMORY_ATTRIBUTES2 is a guest_memfd-scoped version of the existing > KVM_SET_MEMORY_ATTRIBUTES VM ioctl. It allows userspace to manage memory > attributes, such as KVM_MEMORY_ATTRIBUTE_PRIVATE, directly on a guest_memfd > file descriptor. > > This new version uses struct kvm_memory_attributes2, which adds an > error_offset field to the output. This allows KVM to return the specific > offset that triggered an error, which is especially useful for handling > EAGAIN results caused by transient page reference counts during attribute > conversions. > > Update the KVM API documentation to define the new ioctl and its behavior, > and add the necessary UAPI definitions and capability checks. > > Suggested-by: Sean Christopherson > Suggested-by: Michael Roth > Signed-off-by: Ackerley Tng Reviewed-by: Fuad Tabba Cheers, /fuad > --- > Documentation/virt/kvm/api.rst | 78 +++++++++++++++++++++++++++++++++++++++++- > include/uapi/linux/kvm.h | 2 ++ > virt/kvm/kvm_main.c | 23 +++++++++---- > 3 files changed, 95 insertions(+), 8 deletions(-) > > diff --git a/Documentation/virt/kvm/api.rst b/Documentation/virt/kvm/api.rst > index a833d90845b95..73878f34f6d2e 100644 > --- a/Documentation/virt/kvm/api.rst > +++ b/Documentation/virt/kvm/api.rst > @@ -117,7 +117,7 @@ description: > x86 includes both i386 and x86_64. > > Type: > - system, vm, or vcpu. > + system, vm, vcpu or guest_memfd. > > Parameters: > what parameters are accepted by the ioctl. > @@ -6373,6 +6373,8 @@ S390: > Returns -EINVAL if the VM has the KVM_VM_S390_UCONTROL flag set. > Returns -EINVAL if called on a protected VM. > > +.. _KVM_SET_MEMORY_ATTRIBUTES: > + > 4.141 KVM_SET_MEMORY_ATTRIBUTES > ------------------------------- > > @@ -6566,6 +6568,80 @@ KVM_S390_KEYOP_SSKE > Sets the storage key for the guest address ``guest_addr`` to the key > specified in ``key``, returning the previous value in ``key``. > > +4.145 KVM_SET_MEMORY_ATTRIBUTES2 > +--------------------------------- > + > +:Capability: KVM_CAP_GUEST_MEMFD_MEMORY_ATTRIBUTES > +:Architectures: all > +:Type: guest_memfd ioctl > +:Parameters: struct kvm_memory_attributes2 (in/out) > +:Returns: 0 on success, <0 on error > + > +Errors: > + > + ========== =============================================================== > + EINVAL The specified `offset` or `size` were invalid (e.g. not > + page aligned, causes an overflow, or size is zero). > + EFAULT The parameter address was invalid. > + EAGAIN Some page within requested range had unexpected refcounts. The > + offset of the page will be returned in `error_offset`. > + ENOMEM Ran out of memory trying to track private/shared state > + ========== =============================================================== > + > +KVM_SET_MEMORY_ATTRIBUTES2 is an extension to > +KVM_SET_MEMORY_ATTRIBUTES that supports returning (writing) values to > +userspace. The original (pre-extension) fields are shared with > +KVM_SET_MEMORY_ATTRIBUTES identically. > + > +Attribute values are shared with KVM_SET_MEMORY_ATTRIBUTES. > + > +:: > + > + struct kvm_memory_attributes2 { > + /* in */ > + union { > + __u64 address; > + __u64 offset; > + }; > + __u64 size; > + __u64 attributes; > + __u64 flags; > + /* out */ > + __u64 error_offset; > + __u64 reserved[11]; > + }; > + > + #define KVM_MEMORY_ATTRIBUTE_PRIVATE (1ULL << 3) > + > +Set attributes for a range of offsets within a guest_memfd to > +KVM_MEMORY_ATTRIBUTE_PRIVATE to limit the specified guest_memfd backed > +memory range for guest_use. Even if KVM_CAP_GUEST_MEMFD_MMAP is > +supported, after a successful call to set > +KVM_MEMORY_ATTRIBUTE_PRIVATE, the requested range will not be mappable > +into host userspace and will only be mappable by the guest. > + > +To allow the range to be mappable into host userspace again, call > +KVM_SET_MEMORY_ATTRIBUTES2 on the guest_memfd again with > +KVM_MEMORY_ATTRIBUTE_PRIVATE unset. > + > +KVM does not directly manipulate the memory contents of pages during > +attribute updates. However, the process of setting these attributes, > +which includes operations such as unmapping pages from the host or > +stage-2 page tables, may result in side effects on memory contents > +that vary across different trusted firmware implementations. > + > +If this ioctl returns -EAGAIN, the offset of the page with unexpected > +refcounts will be returned in `error_offset`. This can occur if there > +are transient refcounts on the pages, taken by other parts of the > +kernel. > + > +Userspace is expected to figure out how to remove all known refcounts > +on the shared pages, such as refcounts taken by get_user_pages(), and > +try the ioctl again. A possible source of these long term refcounts is > +if the guest_memfd memory was pinned in IOMMU page tables. > + > +See also: :ref: `KVM_SET_MEMORY_ATTRIBUTES`. > + > .. _kvm_run: > > 5. The kvm_run structure > diff --git a/include/uapi/linux/kvm.h b/include/uapi/linux/kvm.h > index 876c0429f9d4e..129d6f6303251 100644 > --- a/include/uapi/linux/kvm.h > +++ b/include/uapi/linux/kvm.h > @@ -997,6 +997,7 @@ struct kvm_enable_cap { > #define KVM_CAP_S390_KEYOP 247 > #define KVM_CAP_S390_VSIE_ESAMODE 248 > #define KVM_CAP_S390_HPAGE_2G 249 > +#define KVM_CAP_GUEST_MEMFD_MEMORY_ATTRIBUTES 250 > > struct kvm_irq_routing_irqchip { > __u32 irqchip; > @@ -1649,6 +1650,7 @@ struct kvm_memory_attributes { > __u64 flags; > }; > > +/* Available with KVM_CAP_GUEST_MEMFD_MEMORY_ATTRIBUTES */ > #define KVM_SET_MEMORY_ATTRIBUTES2 _IOWR(KVMIO, 0xd2, struct kvm_memory_attributes2) > > struct kvm_memory_attributes2 { > diff --git a/virt/kvm/kvm_main.c b/virt/kvm/kvm_main.c > index a08b518cdb175..044486f128c37 100644 > --- a/virt/kvm/kvm_main.c > +++ b/virt/kvm/kvm_main.c > @@ -2434,18 +2434,22 @@ static int kvm_vm_ioctl_clear_dirty_log(struct kvm *kvm, > } > #endif /* CONFIG_KVM_GENERIC_DIRTYLOG_READ_PROTECT */ > > +#ifdef kvm_arch_has_private_mem > +static u64 kvm_supports_private_mem(struct kvm *kvm) > +{ > + return !kvm || kvm_arch_has_private_mem(kvm); > +} > +#else > +#define kvm_supports_private_mem(kvm) false > +#endif > + > #ifdef CONFIG_KVM_VM_MEMORY_ATTRIBUTES > static u64 kvm_supported_vm_mem_attributes(struct kvm *kvm) > { > -#ifdef kvm_arch_has_private_mem > - if (gmem_in_place_conversion) > + if (gmem_in_place_conversion || !kvm_supports_private_mem(kvm)) > return 0; > > - if (!kvm || kvm_arch_has_private_mem(kvm)) > - return KVM_MEMORY_ATTRIBUTE_PRIVATE; > -#endif > - > - return 0; > + return KVM_MEMORY_ATTRIBUTE_PRIVATE; > } > > /* > @@ -4969,6 +4973,11 @@ static int kvm_vm_ioctl_check_extension_generic(struct kvm *kvm, long arg) > return 1; > case KVM_CAP_GUEST_MEMFD_FLAGS: > return kvm_gmem_get_supported_flags(kvm); > + case KVM_CAP_GUEST_MEMFD_MEMORY_ATTRIBUTES: > + if (!gmem_in_place_conversion || !kvm_supports_private_mem(kvm)) > + return 0; > + > + return KVM_MEMORY_ATTRIBUTE_PRIVATE; > #endif > default: > break; > > -- > 2.55.0.rc0.738.g0c8ab3ebcc-goog > >