From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from bombadil.infradead.org (bombadil.infradead.org [198.137.202.133]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.lore.kernel.org (Postfix) with ESMTPS id DE13FC5DF70 for ; Tue, 18 Aug 2026 09:16:21 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=lists.infradead.org; s=bombadil.20210309; h=Sender:List-Subscribe:List-Help :List-Post:List-Archive:List-Unsubscribe:List-Id:Content-Type:Cc:To:From: Subject:Message-ID:References:Mime-Version:In-Reply-To:Date:Reply-To: Content-Transfer-Encoding:Content-ID:Content-Description:Resent-Date: Resent-From:Resent-Sender:Resent-To:Resent-Cc:Resent-Message-ID:List-Owner; bh=k8WNGrZX+hjlSdnhW34q1ZcSrRlLRd8OoKfIun9uixY=; b=XHyzv1hR016gYESB1lBaIklZRS jkuaA/gYd6NlU9KK8reykvwlUFxgma6hqqm4RDGvsqMuZe/FzdIKbVCbpIWZKpmVHEx8tH3QIiKq5 IyFF+CNCr5t2UOf8m0gNGa4PpXpQ4/AbDtidMpcy+OONgaCe53OJ0bf2IPGwU+KpvjWRdmYII3McH yHdBsmMMUVXgTDGB2y6qoeDDjWjo9oA4Az31/BCLmiffB2Vz6fUjnqYLcCY8IzSj/tPgkqpCYTWLM 2RBtcKcY7bTDqkbQjWb7QE+OJRsNw/4opfzzBKnR/KerO01N422oTcsaCEIHA/18/MYIopsWY4H2E 5BhiTpvQ==; Received: from localhost ([::1] helo=bombadil.infradead.org) by bombadil.infradead.org with esmtp (Exim 4.99.1 #2 (Red Hat Linux)) id 1wwFva-00000007aIp-2Od6; Tue, 18 Aug 2026 09:16:14 +0000 Received: from mail-pf1-x445.google.com ([2607:f8b0:4864:20::445]) by bombadil.infradead.org with esmtps (Exim 4.99.1 #2 (Red Hat Linux)) id 1wwFvT-00000007aEN-1V2s for linux-arm-kernel@lists.infradead.org; Tue, 18 Aug 2026 09:16:08 +0000 Received: by mail-pf1-x445.google.com with SMTP id d2e1a72fcca58-84e4ef9a74aso8025428b3a.1 for ; Tue, 18 Aug 2026 02:16:06 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20251104; t=1787044566; x=1787649366; darn=lists.infradead.org; h=content-type:cc:to:from:subject:message-id:references:mime-version :in-reply-to:date:from:to:cc:subject:date:message-id:reply-to :content-type; bh=k8WNGrZX+hjlSdnhW34q1ZcSrRlLRd8OoKfIun9uixY=; b=kl73dcFRo0hxzM52nJGXCY8PMLC6ORqACuRDLgJGQNbpjVpTY8b5Fy+ph3URHfafyC 5nWX2t+DayQ1ePXH8+sNQTASi6FSs1MOO5wugvOn0rdVCpdpgKUlJPoQM+Ea9DThhZBO JPoSCNIAyo0yC7uQrxZg6fR7n7CWnGTbfoWvLR3/bKZNTDLSVxOP8j+G1MGDdb+Q7vYP Ol1plOeG8PnT/QGbsB/ENPlhrjTqC0c2OA+NylAcWpPXo/qh++BYFMXvjxvD7VfqBuJX Igpz8+eAq3h9S5uicPFd2IxHRtS17P+xZOoin3PuDxRrM8LsC1nChYnDeaz9XnaGEw88 Jq4w== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1787044566; x=1787649366; h=content-type:cc:to:from:subject:message-id:references:mime-version :in-reply-to:date:x-gm-message-state:from:to:cc:subject:date :message-id:reply-to:content-type; bh=k8WNGrZX+hjlSdnhW34q1ZcSrRlLRd8OoKfIun9uixY=; b=YJEFtXCy7M0559FX7R/5uQE2Q40tO2HK3B8DfbmLS9rJZ2Hyp3iYKuJFQzsWdFP1aX Kq9ouLIzFUdrI7+nd5v+hJSDhv8bPADJYgA56pxeasUJ8SBX0Ep5NxcDEMk2hjJYYEA2 IZXkEEiUY1KPrMVntckcS9RzCnviNQFhK7GdGD/k7wLevUqwMLZRWNNa+Voz2igpfIpI XULWBffP3ZD7xAFe2D3f5sww+v2XAiR/Hd24xPZtzLBv7Rk3nZUTsezhX6hcRDS1MZDS mgedkwfTbnfJrSbpRb34vUsRKYpDbcEcaGvMd2QaOGnEaXqfjIjrw3sINRKxICDqG/Rc sOfg== X-Forwarded-Encrypted: i=1; AHgh+Ro68lgQEvKSosKKhInU0V7XWE+IN0s1iQbDw/0SR+1Z8z9tMFbV0WAuo+7RJSV7WMxcOpSvjTVBw5Fpbdb/1Lc9@lists.infradead.org X-Gm-Message-State: AOJu0YwFui5SCBTFrA4eu65jUOVJBrYFuJ7CtzVQEhUzNP/vCptBNIJY N2anvN5oYqoe6L1xB82Y500Ykm+qtqdOMFWcwZaf5VQq7tYsyduo6tZwtwck52sqcRoSTZbllzc 0jc5qvlwXo+QMZa1u/NWWxeuIiQ== X-Received: from pgar27.prod.google.com ([2002:a05:6a02:2e9b:b0:c9e:2db2:a2cf]) (user=ackerleytng job=prod-delivery.src-stubby-dispatcher) by 2002:a05:6a21:9d84:b0:3c3:bbe6:95c7 with SMTP id adf61e73a8af0-3cc71c57b6cmr42337079637.17.1787044565764; Tue, 18 Aug 2026 02:16:05 -0700 (PDT) Date: Tue, 18 Aug 2026 09:15:55 +0000 In-Reply-To: <20260818-gmem-no-return-page-v2-0-5298f42d49bb@google.com> Mime-Version: 1.0 References: <20260818-gmem-no-return-page-v2-0-5298f42d49bb@google.com> X-Developer-Key: i=ackerleytng@google.com; a=ed25519; pk=sAZDYXdm6Iz8FHitpHeFlCMXwabodTm7p8/3/8xUxuU= X-Developer-Signature: v=1; a=ed25519-sha256; t=1787044557; l=7550; i=ackerleytng@google.com; s=20260225; h=from:subject:message-id; bh=RNStHwu6ieacAYEnMn7/3gq/7NJJQ1KRNJugMUE32xM=; b=SRWVS1YnkzbusdD23laTjDq6lw3cgThTG7x/5lRPjxg2aZnzn3huhMER8r42Tv3YVr+kuGE3U mZ9CzNyj2NFCq5w150/6XXA4e4tzMt53i6D8Q/4vh6tli54166j/Rqe X-Mailer: b4 0.16.0 Message-ID: <20260818-gmem-no-return-page-v2-4-5298f42d49bb@google.com> Subject: [PATCH v2 4/4] KVM: guest_memfd: Stop returning struct page from PFN lookup From: Ackerley Tng To: Sean Christopherson , Paolo Bonzini , Thomas Gleixner , Ingo Molnar , Borislav Petkov , Dave Hansen , x86@kernel.org, "H. Peter Anvin" , Ashish Kalra , Michael Roth , Brijesh Singh , Marc Zyngier , Oliver Upton , Joey Gouly , Steffen Eiden , Suzuki K Poulose , Zenghui Yu , Catalin Marinas , Will Deacon , David Hildenbrand , Fuad Tabba , Yan Zhao , "Edgecombe, Rick P" , Vishal Annapurve Cc: kvm@vger.kernel.org, linux-kernel@vger.kernel.org, linux-arm-kernel@lists.infradead.org, kvmarm@lists.linux.dev, Ackerley Tng Content-Type: text/plain; charset="utf-8" X-CRM114-Version: 20100106-BlameMichelson ( TRE 0.9.0 (BSD) ) MR-646709E3 X-CRM114-CacheID: sfid-20260818_021607_419492_499696D9 X-CRM114-Status: GOOD ( 17.44 ) X-BeenThere: linux-arm-kernel@lists.infradead.org X-Mailman-Version: 2.1.34 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: "linux-arm-kernel" Errors-To: linux-arm-kernel-bounces+linux-arm-kernel=archiver.kernel.org@lists.infradead.org From: Sean Christopherson KVM currently expects guest_memfd PFN lookups to return a refcounted struct page, which callers hold across fault handling. Holding a page reference across fault handling is problematic for guest_memfd. In-place memory conversions between confidential computing shared and private states inspect folio refcounts to ensure exclusive ownership by guest_memfd. A concurrent guest page fault taking a reference on the folio causes conversions to fail due to an elevated refcount. guest_memfd already notifies KVM of page invalidations, so callers within KVM only need to respect the MMU invalidation protocol to safely rely on guest_memfd for page presence. Furthermore, removing struct page from the guest_memfd PFN lookup moves KVM closer toward supporting memory backends that are not backed by struct page. Drop the folio reference immediately before returning from the guest_memfd PFN lookup, and stop returning the struct page pointer. For ARM, initialize the local page pointer to NULL so that the shared cleanup path that releases fault-in pages safely no-ops for guest_memfd. For x86, no additional changes are required in the MMU fault path because the page fault tracking structure is zero-initialized at the start of page fault handling, ensuring the refcounted page pointer is already NULL. Reported-by: Yan Zhao Closes: https://lore.kernel.org/all/anZ4W9o5pTWIEgMY@yzhao56-desk.sh.intel.com/ Signed-off-by: Sean Christopherson Co-developed-by: Yan Zhao Signed-off-by: Yan Zhao Co-developed-by: Ackerley Tng Signed-off-by: Ackerley Tng --- arch/arm64/kvm/mmu.c | 4 ++-- arch/arm64/kvm/nested.c | 4 ++-- arch/x86/kvm/mmu/mmu.c | 2 +- arch/x86/kvm/svm/sev.c | 8 ++------ include/linux/kvm_host.h | 6 ++---- virt/kvm/guest_memfd.c | 9 ++------- 6 files changed, 11 insertions(+), 22 deletions(-) diff --git a/arch/arm64/kvm/mmu.c b/arch/arm64/kvm/mmu.c index 6c941aaa10c63..e5d637a5ec558 100644 --- a/arch/arm64/kvm/mmu.c +++ b/arch/arm64/kvm/mmu.c @@ -1613,7 +1613,7 @@ static int gmem_abort(const struct kvm_s2_fault_desc *s2fd) enum kvm_pgtable_prot prot = KVM_PGTABLE_PROT_R; struct kvm_pgtable *pgt = s2fd->vcpu->arch.hw_mmu->pgt; unsigned long mmu_seq; - struct page *page; + struct page *page = NULL; struct kvm *kvm = s2fd->vcpu->kvm; void *memcache = NULL; kvm_pfn_t pfn; @@ -1641,7 +1641,7 @@ static int gmem_abort(const struct kvm_s2_fault_desc *s2fd) /* Pairs with the smp_wmb() in kvm_mmu_invalidate_end(). */ smp_rmb(); - ret = kvm_gmem_get_pfn(kvm, s2fd->memslot, gfn, &pfn, &page, NULL); + ret = kvm_gmem_get_pfn(kvm, s2fd->memslot, gfn, &pfn, NULL); if (ret) { kvm_prepare_memory_fault_exit(s2fd->vcpu, s2fd->fault_ipa, PAGE_SIZE, write_fault, exec_fault, false); diff --git a/arch/arm64/kvm/nested.c b/arch/arm64/kvm/nested.c index fb54f6dad995c..43523bb17621a 100644 --- a/arch/arm64/kvm/nested.c +++ b/arch/arm64/kvm/nested.c @@ -1360,7 +1360,7 @@ static int kvm_translate_vncr(struct kvm_vcpu *vcpu, bool *is_gmem) bool write_fault, writable; unsigned long mmu_seq; struct vncr_tlb *vt; - struct page *page; + struct page *page = NULL; u64 va, pfn, gfn; int ret; @@ -1411,7 +1411,7 @@ static int kvm_translate_vncr(struct kvm_vcpu *vcpu, bool *is_gmem) if (is_error_noslot_pfn(pfn) || (write_fault && !writable)) return -EFAULT; } else { - ret = kvm_gmem_get_pfn(vcpu->kvm, memslot, gfn, &pfn, &page, NULL); + ret = kvm_gmem_get_pfn(vcpu->kvm, memslot, gfn, &pfn, NULL); if (ret) { kvm_prepare_memory_fault_exit(vcpu, vt->wr.pa, PAGE_SIZE, write_fault, false, false); diff --git a/arch/x86/kvm/mmu/mmu.c b/arch/x86/kvm/mmu/mmu.c index c519e8e8d646f..129d403308051 100644 --- a/arch/x86/kvm/mmu/mmu.c +++ b/arch/x86/kvm/mmu/mmu.c @@ -4604,7 +4604,7 @@ static int kvm_mmu_faultin_pfn_gmem(struct kvm_vcpu *vcpu, } r = kvm_gmem_get_pfn(vcpu->kvm, fault->slot, fault->gfn, &fault->pfn, - &fault->refcounted_page, &max_order); + &max_order); if (r) { kvm_mmu_prepare_memory_fault_exit(vcpu, fault); return r; diff --git a/arch/x86/kvm/svm/sev.c b/arch/x86/kvm/svm/sev.c index d3d620bc04dce..32db979daaaf0 100644 --- a/arch/x86/kvm/svm/sev.c +++ b/arch/x86/kvm/svm/sev.c @@ -4016,7 +4016,6 @@ static void __sev_snp_reload_vmsa(struct kvm_vcpu *vcpu, gpa_t gpa) struct kvm *kvm = vcpu->kvm; gfn_t gfn = gpa_to_gfn(gpa); unsigned long mmu_seq; - struct page *page; kvm_pfn_t pfn; lockdep_assert_held(&svm->sev_es.snp_vmsa_mutex); @@ -4060,9 +4059,8 @@ static void __sev_snp_reload_vmsa(struct kvm_vcpu *vcpu, gpa_t gpa) * The new VMSA will be private memory guest memory, so retrieve the * PFN from the gmem backend. */ - if (kvm_gmem_get_pfn(vcpu->kvm, slot, gfn, &pfn, &page, NULL)) + if (kvm_gmem_get_pfn(vcpu->kvm, slot, gfn, &pfn, NULL)) return; - kvm_release_page_clean(page); read_lock(&kvm->mmu_lock); /* @@ -5003,7 +5001,6 @@ void sev_handle_rmp_fault(struct kvm_vcpu *vcpu, gpa_t gpa, u64 error_code) struct kvm *kvm = vcpu->kvm; int order, rmp_level, ret; unsigned long mmu_seq; - struct page *page; bool assigned; kvm_pfn_t pfn; gfn_t gfn; @@ -5033,13 +5030,12 @@ void sev_handle_rmp_fault(struct kvm_vcpu *vcpu, gpa_t gpa, u64 error_code) mmu_seq = kvm->mmu_invalidate_seq; smp_rmb(); - ret = kvm_gmem_get_pfn(kvm, slot, gfn, &pfn, &page, &order); + ret = kvm_gmem_get_pfn(kvm, slot, gfn, &pfn, &order); if (ret) { pr_warn_ratelimited("SEV: Unexpected RMP fault, no backing page for private GPA 0x%llx\n", gpa); return; } - kvm_release_page_unused(page); ret = snp_lookup_rmpentry(pfn, &assigned, &rmp_level); if (ret || !assigned) { diff --git a/include/linux/kvm_host.h b/include/linux/kvm_host.h index 03bfc92864b6e..502465119ca0c 100644 --- a/include/linux/kvm_host.h +++ b/include/linux/kvm_host.h @@ -2586,13 +2586,11 @@ static inline bool kvm_mem_is_private(struct kvm *kvm, gfn_t gfn) #ifdef CONFIG_KVM_GUEST_MEMFD int kvm_gmem_get_pfn(struct kvm *kvm, struct kvm_memory_slot *slot, - gfn_t gfn, kvm_pfn_t *pfn, struct page **page, - int *max_order); + gfn_t gfn, kvm_pfn_t *pfn, int *max_order); #else static inline int kvm_gmem_get_pfn(struct kvm *kvm, struct kvm_memory_slot *slot, gfn_t gfn, - kvm_pfn_t *pfn, struct page **page, - int *max_order) + kvm_pfn_t *pfn, int *max_order) { KVM_BUG_ON(1, kvm); return -EIO; diff --git a/virt/kvm/guest_memfd.c b/virt/kvm/guest_memfd.c index b596486d184ca..589762140c3ef 100644 --- a/virt/kvm/guest_memfd.c +++ b/virt/kvm/guest_memfd.c @@ -751,8 +751,7 @@ static struct folio *__kvm_gmem_get_pfn(struct file *file, } int kvm_gmem_get_pfn(struct kvm *kvm, struct kvm_memory_slot *slot, - gfn_t gfn, kvm_pfn_t *pfn, struct page **page, - int *max_order) + gfn_t gfn, kvm_pfn_t *pfn, int *max_order) { pgoff_t index = kvm_gmem_get_index(slot, gfn); struct folio *folio; @@ -780,11 +779,7 @@ int kvm_gmem_get_pfn(struct kvm *kvm, struct kvm_memory_slot *slot, #endif folio_unlock(folio); - - if (!r) - *page = folio_file_page(folio, index); - else - folio_put(folio); + folio_put(folio); return r; } -- 2.55.0.699.gb54405d56f-goog