Re: [PATCH v3 01/14] KVM: Allow architectures to disallow pre-fault

[Sean Christopherson <seanjc@google.com>]

On Tue, Sep 22, 2026, Lorenzo Stoakes (ARM) wrote:
> On Tue, Sep 22, 2026 at 10:36:49AM -0700, Sean Christopherson wrote:
> > On Tue, Sep 22, 2026, Lorenzo Stoakes (ARM) wrote:
> > > On Tue, Sep 22, 2026 at 10:23:43AM -0700, Sean Christopherson wrote:
> > > > Rather than have kvm_arch_vcpu_allow_pre_fault_memory(), what if we add a more
> > > > generic kvm_is_vcpu_loadable()?  That way we don't need to worry as much about
> > > > the return value, the connection to vcpu_load() is obvious, and we don't need to
> > > > add another pre-check if future (or cleaned-up existing?) ioctls want to do
> > > > vcpu_load() in common code.
> > >
> > > ...this is exactly what I started out with.
> > >
> > > But then you are in a pickle, because _really_ you need to do that check in
> > > vcpu_load(). Which is a void function. Which is called by every single
> > > architecture all over the place.
> > >
> > > So you'd have actually no way of signalling the error back.
> > >
> > > Of course those places are arch code and you could say 'arches should know
> > > better and if they call it it's fine not to call the arch 'can you load'
> > > function.
> >
> > Yes, that's my vote.  It'd be easy enough to clarify that "rule" with a comment
> > in linux/kvm_host.h.
> 
> I note you dodge the actually difficult question of what this wrapper function
> would look like ;)

Oh, I was thinking we wouldn't bother with a wrapper.  Because I agree that
providing a complement to vcpu_load() would get all kinds of messy.  Though we
could harden vcpu_load() with a WARN_ON_ONCE(), which in practice would prevent
the vast majority of violations from making it to a final kernel release. 

> > > Instead you can make the predicate 'don't prefault on a not-yet-initialised
> > > vCPU' which is pretty sensible I think, have a specific place to put it and
> > > all's well with the world.
> >
> > But look at it from an x86 perspective.  Pretty much everyone will look at this
> > and expect:
> >
> >   bool kvm_arch_vcpu_allow_pre_fault_memory(struct kvm_vcpu *vcpu)
> >   {
> > 	return vcpu->kvm->arch.pre_fault_allowed;
> >   }
> 
> I'm not sure I really get your point here at all? :)
> 
> Why would it matter what people who are too lazy to go check the implementation
> assume about an arch hook?

Because I don't hate the people that contribute to KVM, and want to make it as
easy as possible for them to not make mistakes?