From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail-dl1-f47.google.com (mail-dl1-f47.google.com [74.125.82.47]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 9166D40D570 for ; Wed, 24 Jun 2026 00:09:28 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=pass smtp.client-ip=74.125.82.47 ARC-Seal:i=2; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1782259769; cv=pass; b=oteIiDGZHP4IaEFryM36C+ulrQoxxWZXzuHMgzTifu2LIVBbyIogYn2Xc4iWPUiW6ouG7BiZ97vFg8yMyl8CC1Y7sssZ0RybgxKKogVMhdOnnwQ69Nigv2Tob/PzQRMfVXIwx+sr7/BWMeTvRnHtoVim2trw45KOFpnpciTlRK8= ARC-Message-Signature:i=2; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1782259769; c=relaxed/simple; bh=rQfqkBaw/xkmyQgEiFlC2Kezzoeugio7gq7U/cPAgVE=; h=From:In-Reply-To:References:MIME-Version:Date:Message-ID:Subject: To:Cc:Content-Type; b=NPB1FMLW8v3gHs7goyyVcQ28Nv8DCrjR+4qU5FdNxYyOf94yV9FWYS5+3LTNl4/NQKVEmGlW6L094l/xa1omDqC+4Czc6pAQLt4isNDhI+eeTXK2M9Z+Jha+YLxIlQCRH+UHXT/TR8I7RxPiHYT0M9OWXVcy8iK5s7/q22e4qPU= ARC-Authentication-Results:i=2; smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=google.com; spf=pass smtp.mailfrom=google.com; dkim=pass (2048-bit key) header.d=google.com header.i=@google.com header.b=veUsiC1C; arc=pass smtp.client-ip=74.125.82.47 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=google.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=google.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=google.com header.i=@google.com header.b="veUsiC1C" Received: by mail-dl1-f47.google.com with SMTP id a92af1059eb24-139b5e604b9so540339c88.0 for ; Tue, 23 Jun 2026 17:09:28 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1782259768; cv=none; d=google.com; s=arc-20240605; b=RCJ422f+TrDWsBCbNPY6KISgDD3aSLjKmGg0d5JGriobBO2X0lun92az7OlVu2m0tj BMih/lK15lHc4R+OoZessowbgezz52xILUuoOSJ/GG14sArJT6hCIypak3V3YHwL0W4K IW/1uWVX4P3fxjY/u5nmwE+bMkG9yqEizDtqMryOmdAOVgYmnm23/WexYMjg/CMvcRHk d/YyrV40elYAhNvpLXwXNDzonNzY9CMOGKO09Nope8xlFHQLYpAXE15V1s7paeNTyX99 EB7H7A0mGfWUMe7bo8PxqUxRmNxEBrnxFKUVTMG+6CEA0fNt/YJeb82OPILgH7VV5LuU 7FNw== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20240605; h=cc:to:subject:message-id:date:mime-version:references:in-reply-to :from:dkim-signature; bh=LOf9tviNFkAeKYv+XoLw2pXVKZU7weWckYUjDtw8Ax8=; fh=NM1Kzg4n2mgz3sK7rbl8gbYRUIMsofKMuWZBmvZbkhE=; b=jlJfye6UgnmYbijSac7iC9Ke7Lr8QF1bzLeXqdkbGaIVYPL/u0AHtWyU0pJhHcIfQj sulP8lK/ti5DhVDT7jjtf3WYk+ImNs3OjxOCt0GTrCT6d/+yJAgQTdwFmqYwJxL88K0k 6m1BpWt1s0ySqpQ0n9mWQyKHKWVlaDT7fGH94UlJORROMBMtBKmALUwqj2TG9erUh44E cLBWiZMMlb8F5ecDrRwbU9cB5ZrDzVTHCMuBtiiTydoj1e7cj1+847WkJnOmekJzrsWd Hk/4ffSbJRouXmNkO5Vh9zo8SB1C6DUIIhomrHkC3Ol6PEr4tR8tXR/MPrBcu961apv9 iClQ==; darn=vger.kernel.org ARC-Authentication-Results: i=1; mx.google.com; arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20251104; t=1782259768; x=1782864568; darn=vger.kernel.org; h=cc:to:subject:message-id:date:mime-version:references:in-reply-to :from:from:to:cc:subject:date:message-id:reply-to; bh=LOf9tviNFkAeKYv+XoLw2pXVKZU7weWckYUjDtw8Ax8=; b=veUsiC1C69EY+fW+phEEcbGGJR1QtHjfW0d5G1V91rsvTaqXDyiTLhXXS9KvXQDxcZ oWZfD4aPELOrcjBl0S4WaAofqhRsh7rEZ5pQO3FCfS3ra6aku162Pf0qCkXR+xXopq1O IQKeS/G6Yi915cxG1Q5coGJU9a+qvcY+2pF5iSXRniVzMo3wiX9bpO5siiQcu5hv10zG IRNmijyT3ZTFPax8idXSgIdxbUpbhO10FVExLS2PxXXeKQXDrr99e5Cw7mM91YAKYLN/ 5W7OT8L10Oa4D+7xzkF7MBH1sJvrlSEyXhHEhhSosvwz7SMH4/WDaSXCQlJ4lOg1Sf2i XC/g== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1782259768; x=1782864568; h=cc:to:subject:message-id:date:mime-version:references:in-reply-to :from:x-gm-gg:x-gm-message-state:from:to:cc:subject:date:message-id :reply-to; bh=LOf9tviNFkAeKYv+XoLw2pXVKZU7weWckYUjDtw8Ax8=; b=Nl/oPtYrrRP414LbFKQ/sWoH1O2PuulFD9sKjnOx2K81jgLdMtcRN45sMew4zyAR5/ +UhiLsRAxQDBYub16Vwo4b34pw2cYHFEyQjQvx2/sfe+MfC6wSS6uADwfh2hxlChvTdX CMhmAf8j3ZIKQ5kdv9H0OzgV61Dy55WaYrO8fyMNqORxIoSD202i216SzFvi0Hn4HR4y BLwRTlFWtf4RufPkzaxCsl/ZGqYSXCuq2mbKFbE7hdGxyQcNZnEjIyjsI01/l5kbh2hP kuWD6KjFm9EWeID6nDSwLrTIzwyZtrLg2YnuS5x/79CmaiLixaPX8Acyhak8pfEQLcl0 1hrA== X-Forwarded-Encrypted: i=1; AFNElJ8AE1rM0J7r8bFZrCi7IaxuQMUmkFyA6TFkK5pRp4ixPY/3bTdj8gdTCgt4LElh3TukYLc8CX13+ONP9lE=@vger.kernel.org X-Gm-Message-State: AOJu0Ywnu7jqBRg2G7TScDYZgskyoXGOPKlON60D1IfEd1fPgAR9mSJV qULxJAm3Jh18eIufUzXYoG0Itl01ROxGMnefpf/vaspuYtR9uSANDqvi5g7QajmX0cjCVCZcDvG mpnW52aeHZsjGJgdsef0pUDGftIgXLkxTvU6TQs4k X-Gm-Gg: AfdE7ckwjiIbcl0wwV+YiXYKOAiAWLSgnlzQAi909i8GN+YgkzzxjpgmTDsrRGn8S05 rWLe0VeMTmqWffWpYjlQTYbDKdtpS5E9AUPw1qqXCfCpfE38MZBSoHNKSALx0wKFjLDy/O8jIGm bb542wPDyl6t9qRZscaDXyu3yAUGQb9DG6321rHzyciLWHDoGR9vAJZdXl3qulZBzdZBEQ6uZ6I 8xDWI9zIgw3V13o1GNZLAPauGTkAccc2s+v3QpWK2bHcWy8CVfMKNcy+7gxzzVy4Y+huosaqPRT DIYfGwpYcz1kTtmwtxhc/7fN4f+RA7UJ9/bEvXKPK591/keoCi6zpw2wQUA= X-Received: by 2002:a05:7022:45a4:b0:127:3f2a:af21 with SMTP id a92af1059eb24-139c5cff378mr4117596c88.15.1782259766886; Tue, 23 Jun 2026 17:09:26 -0700 (PDT) Received: from 176938342045 named unknown by gmailapi.google.com with HTTPREST; Tue, 23 Jun 2026 17:09:25 -0700 Received: from 176938342045 named unknown by gmailapi.google.com with HTTPREST; Tue, 23 Jun 2026 17:09:25 -0700 From: Ackerley Tng In-Reply-To: References: <20260618-gmem-inplace-conversion-v8-0-9d2959357853@google.com> <20260618-gmem-inplace-conversion-v8-1-9d2959357853@google.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Date: Tue, 23 Jun 2026 17:09:25 -0700 X-Gm-Features: AVVi8Cdk7fD1H5RbfHSz0rAk7YN_q01NbBdLx3di9F5nnt4X6vdgAPFTH7tGEuQ Message-ID: Subject: Re: [PATCH v8 01/46] KVM: guest_memfd: Introduce per-gmem attributes, use to guard user mappings To: Sean Christopherson , Binbin Wu Cc: aik@amd.com, andrew.jones@linux.dev, brauner@kernel.org, chao.p.peng@linux.intel.com, david@kernel.org, jmattson@google.com, jthoughton@google.com, michael.roth@amd.com, oupton@kernel.org, pankaj.gupta@amd.com, qperret@google.com, rick.p.edgecombe@intel.com, rientjes@google.com, shivankg@amd.com, steven.price@arm.com, tabba@google.com, willy@infradead.org, wyihan@google.com, yan.y.zhao@intel.com, forkloop@google.com, pratyush@kernel.org, suzuki.poulose@arm.com, aneesh.kumar@kernel.org, liam@infradead.org, Paolo Bonzini , Thomas Gleixner , Ingo Molnar , Borislav Petkov , Dave Hansen , x86@kernel.org, "H. Peter Anvin" , Steven Rostedt , Masami Hiramatsu , Mathieu Desnoyers , Jonathan Corbet , Shuah Khan , Shuah Khan , Vishal Annapurve , Andrew Morton , Chris Li , Kairui Song , Kemeng Shi , Nhat Pham , Barry Song , Axel Rasmussen , Yuanchu Xie , Wei Xu , Youngjun Park , Qi Zheng , Shakeel Butt , Kiryl Shutsemau , Baoquan He , Jason Gunthorpe , Vlastimil Babka , kvm@vger.kernel.org, linux-kernel@vger.kernel.org, linux-trace-kernel@vger.kernel.org, linux-doc@vger.kernel.org, linux-kselftest@vger.kernel.org, linux-mm@kvack.org, linux-coco@lists.linux.dev Content-Type: text/plain; charset="UTF-8" Sean Christopherson writes: > On Mon, Jun 22, 2026, Binbin Wu wrote: >> On 6/19/2026 8:31 AM, Ackerley Tng via B4 Relay wrote: >> >> [...] >> >> > >> > +static u64 kvm_gmem_get_attributes(struct inode *inode, pgoff_t index) >> > +{ >> > + struct maple_tree *mt = &GMEM_I(inode)->attributes; >> > + void *entry = mtree_load(mt, index); >> > + >> > + return WARN_ON_ONCE(!entry) ? 0 : xa_to_value(entry); >> >> If the entry is unexpectedly missing, returning 0 means the attribute would >> be treated as shared. And then in kvm_gmem_fault_user_mapping(), it would >> allow the userspace to fault in the folio. >> >> Should gmem deny such edge case? > > After several bugs this year where a WARN_ON_ONCE() fired, but was entirely > insufficient to prevent true badness, I'm definitely senstive to making the "bad" > behavior as harmless as possible. > I guess both are indeed awkward. > However, in this case I think we're just hosed. If KVM treats the memory as > private, KVM will incorrectly do prepare(), incorrectly allow populate(), and > will caused missed invalidations (though I suppose __kvm_gmem_set_attributes() > "only" lies to userspace in that case). > > That said, assuming SHARED is definitely odd for cases where guest_memfd *can't* > hold shared memory. Ditto for assuming PRIVATE. What if we instead fall back to > the "init" state, e.g.? > > static u64 kvm_gmem_get_attributes(struct inode *inode, pgoff_t index) > { > struct maple_tree *mt = &GMEM_I(inode)->attributes; > void *entry = mtree_load(mt, index); > > if (WARN_ON_ONCE(!entry)) { > bool shared = GMEM_I(inode)->flags & GUEST_MEMFD_FLAG_INIT_SHARED; > > return shared ? 0 : KVM_MEMORY_ATTRIBUTE_PRIVATE; I was wondering if we should not only return the init state but also set the init state, but that would involve performing a conversion to the init state... Too complicated for an edge case. > } > > return xa_to_value(entry); > } Thanks Binbin and Sean!