From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-1.web.codeaurora.org [10.30.226.201]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id DC1023BADA9; Thu, 10 Sep 2026 23:55:38 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=10.30.226.201 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1789084539; cv=none; b=AqSOdDvZQs9BHvq1cQ9tVsWl4M13aYY+y6RO6wBXhd+cD054X2PMaa1K6llzDkf9ZfkQuxwCNtl6nIxQjo33yAkYLsnXo+FwwiAQtQ0FxUjXtQiz1yPHj0iAq44LBEEBpBY+zJ8HDIFwETddDtfTWHjM4qqiB6cP9BoUvfgAP5U= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1789084539; c=relaxed/simple; bh=07bg5wm9NPNH7Z9soHiasshjg1qxD93bsnT0TJcLFMk=; h=From:Date:Subject:MIME-Version:Content-Type:Message-Id:References: In-Reply-To:To:Cc; b=jzp1ph0s3Pm2cfYxr+Wo+x16fK4SpepvgrNA13JnoKqKGnsR0KdCckK6X2BA7y9q5dOgZkYQ8WmnuJrBfPedYQZpOCBMlVbMoLLO6r1wJlfQHsdDDwgvpLp7lNb7uNyNGvBgf5H11Q0DryJP1/SLVKaS9caWyvi2fONaI2ispk4= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b=SVnW4/t1; arc=none smtp.client-ip=10.30.226.201 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b="SVnW4/t1" Received: by smtp.kernel.org (Postfix) with ESMTPS id 96860C4AF0C; Thu, 10 Sep 2026 23:55:38 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=k20201202; t=1789084538; bh=07bg5wm9NPNH7Z9soHiasshjg1qxD93bsnT0TJcLFMk=; h=From:Date:Subject:References:In-Reply-To:To:Cc:Reply-To:From; b=SVnW4/t1M49n0g8qFLprlrsNELL3XQb4W/oGQl8WMA271551pDJF9/OHB9OzH3T1A wHIzzssf7V1ytp/5Jc+J+TN655MQlBTSxqcVyckcLVR1Gm5BhBdbxK6EOcCVWH7li5 oqgG4TMMO5QMfMw2Fg3fobfjinZgQhnv8zjKelSZDzuSBFhsPNUOSu6zuX61++eUGc yQzBkOaYpai9r5PUULiG45+uIa4CCQE5OWiY0G27TDcQTYSUW9L9smOjcdhD7U4pU+ D55V0xISBLFr54G7DXCACk6jgiDpAQuwyPORJu5sxX8CWZM0lqE8UksM1xGaSjjrln SXyGCyzqzIxmw== Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id 79E60C88E41; Thu, 10 Sep 2026 23:55:38 +0000 (UTC) From: Ackerley Tng via B4 Relay Date: Thu, 10 Sep 2026 16:55:44 -0700 Subject: [PATCH v13 18/44] KVM: guest_memfd: Zero page while getting pfn Precedence: bulk X-Mailing-List: kvm@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: 7bit Message-Id: <20260910-gmem-inplace-conversion-v13-18-dd6fbf94f4e1@google.com> References: <20260910-gmem-inplace-conversion-v13-0-dd6fbf94f4e1@google.com> In-Reply-To: <20260910-gmem-inplace-conversion-v13-0-dd6fbf94f4e1@google.com> To: aik@amd.com, andrew.jones@linux.dev, binbin.wu@linux.intel.com, brauner@kernel.org, chao.p.peng@linux.intel.com, david@kernel.org, jmattson@google.com, jthoughton@google.com, michael.roth@amd.com, oupton@kernel.org, pankaj.gupta@amd.com, qperret@google.com, rick.p.edgecombe@intel.com, rientjes@google.com, shivankg@amd.com, steven.price@arm.com, willy@infradead.org, wyihan@google.com, yan.y.zhao@intel.com, forkloop@google.com, pratyush@kernel.org, suzuki.poulose@arm.com, aneesh.kumar@kernel.org, liam@infradead.org, Paolo Bonzini , Sean Christopherson , Thomas Gleixner , Ingo Molnar , Borislav Petkov , Dave Hansen , x86@kernel.org, "H. Peter Anvin" , Steven Rostedt , Masami Hiramatsu , Mathieu Desnoyers , Jonathan Corbet , Shuah Khan , Shuah Khan , Vishal Annapurve , Andrew Morton , Chris Li , Kairui Song , Kemeng Shi , Nhat Pham , Barry Song , Axel Rasmussen , Yuanchu Xie , Wei Xu , Youngjun Park , Qi Zheng , Shakeel Butt , Kiryl Shutsemau , Baoquan He , Jason Gunthorpe , John Hubbard , Peter Xu , tarunsahu@google.com, Randy Dunlap , Lorenzo Stoakes , Vlastimil Babka , Mike Rapoport , Suren Baghdasaryan , Michal Hocko , Jason Gunthorpe , Fuad Tabba , Vlastimil Babka , Baoquan He Cc: kvm@vger.kernel.org, linux-kernel@vger.kernel.org, linux-trace-kernel@vger.kernel.org, linux-doc@vger.kernel.org, linux-kselftest@vger.kernel.org, linux-mm@kvack.org, linux-coco@lists.linux.dev, Ackerley Tng , Xiaoyao Li X-Mailer: b4 0.14.3 X-Developer-Signature: v=1; a=ed25519-sha256; t=1789084533; l=3086; i=ackerleytng@google.com; s=20260225; h=from:subject:message-id; bh=UTds+uB88Pvv734MhYhg7cYOppWN0b7k4dN51AkvmNs=; b=cDtkvlZKqZf70bHLRjVFDSDzjoD3T8abnkfI3UpEMGEsChfY+iEpuyTNsIWJynXQQecW6gr7L qnjf/0Jpoo2AAK1FvM7Q2CWmfckf5/qlvGdaoEbZl3dy6+KWRRKsqKA X-Developer-Key: i=ackerleytng@google.com; a=ed25519; pk=sAZDYXdm6Iz8FHitpHeFlCMXwabodTm7p8/3/8xUxuU= X-Endpoint-Received: by B4 Relay for ackerleytng@google.com/20260225 with auth_id=649 X-Original-From: Ackerley Tng Reply-To: ackerleytng@google.com From: Ackerley Tng Move the folio initialization logic from kvm_gmem_get_pfn() into __kvm_gmem_get_pfn() to also zero pages if the page is to be used in kvm_gmem_populate(). With in-place conversion, the existing data in a guest_memfd page can be populated into guest memory through platform-specific ioctls. Without first zeroing the page obtained using __kvm_gmem_get_pfn(), it might contain uninitialized host memory, which would leak to the guest if the populate completes. guest_memfd pages are zeroed at most once in the page's entire lifetime with guest_memfd, and that is tracked using the uptodate flag. Zeroing the page in __kvm_gmem_get_pfn() is chosen over zeroing in kvm_gmem_get_folio() since other flows, such as a future write() syscall, can get a page, write to the page and then set page uptodate without zeroing. There may be some performance penalty due to redundant zeroing, but this would pale in comparison to the cost of actually assigning the page to the VM. This aligns with the concept of zeroing before first use - the other place where zeroing happens is in kvm_gmem_fault_user_mapping(). On populate failure, the page is not re-zeroed, since on SNP, if firmware rejects a CPUID page, the expected CPUID values provided by firmware are returned to userspace via page contents. More generally, page contents may be modified on populate failure. Don't mark the page uptodate again after populating, since the page would already be marked uptodate before the post_populate() call. Signed-off-by: Ackerley Tng Tested-by: Shivank Garg Reviewed-by: Fuad Tabba Reviewed-by: Xiaoyao Li Reviewed-by: Binbin Wu Reviewed-by: David Hildenbrand (Arm) --- virt/kvm/guest_memfd.c | 12 +++++------- 1 file changed, 5 insertions(+), 7 deletions(-) diff --git a/virt/kvm/guest_memfd.c b/virt/kvm/guest_memfd.c index f1c36e99cd3ce..5bbf9a5306c66 100644 --- a/virt/kvm/guest_memfd.c +++ b/virt/kvm/guest_memfd.c @@ -1104,6 +1104,11 @@ static struct folio *__kvm_gmem_get_pfn(struct file *file, return ERR_PTR(-EHWPOISON); } + if (!folio_test_uptodate(folio)) { + clear_highpage(folio_page(folio, 0)); + folio_mark_uptodate(folio); + } + *pfn = folio_file_pfn(folio, index); if (max_order) *max_order = 0; @@ -1132,11 +1137,6 @@ int kvm_gmem_get_pfn(struct kvm *kvm, struct kvm_memory_slot *slot, goto out; } - if (!folio_test_uptodate(folio)) { - clear_highpage(folio_page(folio, 0)); - folio_mark_uptodate(folio); - } - if (kvm_arch_has_gmem_convert() && kvm_gmem_is_private_mem(file_inode(file), index)) r = kvm_arch_gmem_make_private(kvm, gfn, *pfn, @@ -1178,8 +1178,6 @@ static long __kvm_gmem_populate(struct kvm *kvm, struct kvm_memory_slot *slot, } ret = post_populate(kvm, gfn, pfn, src_page, opaque); - if (!ret) - folio_mark_uptodate(folio); out_put_folio: folio_put(folio); -- 2.55.0.1007.g17ff1f9808-goog