[RFC PATCH v5 14/16] KVM: guest_memfd: Enable shared host mappings for device providers

["Aneesh Kumar K.V (Arm)" <aneesh.kumar@kernel.org>]

Use the PFN provider mmap and fault handlers for shared device memory.
Apply device VMA flags and noncached, decrypted protections, retaining
the inode invalidate lock across PFN lookup and PTE insertion.

Private ranges remain inaccessible to host faults. Attribute conversion
revokes host mappings before making memory private.

Signed-off-by: Aneesh Kumar K.V (Arm) <aneesh.kumar@kernel.org>
---
 include/linux/guest_memfd.h |  4 +++-
 virt/kvm/guest_memfd.c      | 18 ++++++++++++++++--
 2 files changed, 19 insertions(+), 3 deletions(-)

diff --git a/include/linux/guest_memfd.h b/include/linux/guest_memfd.h
index 31cd5142e5f1..1fcce1240bb6 100644
--- a/include/linux/guest_memfd.h
+++ b/include/linux/guest_memfd.h
@@ -63,7 +63,9 @@ struct guest_memfd_handle {
  *          providers must not retain it.
  * @release: Release provider context and unpin any resources. Must not access
  *           the VM here; its file reference may be gone.
- * @device_memory: Memory is device MMIO rather than RAM.
+ * @device_memory: Memory is device MMIO rather than RAM. The core maps its
+ *                 userspace VMAs noncached and decrypted, with device flags.
+ *                 Shared userspace faults are resolved through @get_pfn
  * @prepare_memory_region: Optional check of a memory range and preparation
  *                         for access. Called after common file checks and
  *                         before publishing the memslot. Offset and size are
diff --git a/virt/kvm/guest_memfd.c b/virt/kvm/guest_memfd.c
index 1c90f59f480e..d3ae01aa6fe6 100644
--- a/virt/kvm/guest_memfd.c
+++ b/virt/kvm/guest_memfd.c
@@ -1053,6 +1053,8 @@ static vm_fault_t gmem_pfn_fault(struct inode *inode, void *provider,
 	if (r)
 		return gmem_fault_error(r);
 
+	if (gmem_provider_is_device(gi))
+		prot = pgprot_decrypted(pgprot_noncached(prot));
 	ret = vmf_insert_pfn_prot(vmf->vma, vmf->address, handle.pfn, prot);
 	gmem_unlock_handle(&handle);
 	gmem_put_handle(&handle);
@@ -1114,6 +1116,11 @@ static const struct vm_operations_struct kvm_gmem_vm_ops = {
 #endif
 };
 
+/* Device PFNs have fixed addresses and do not use NUMA allocation policy. */
+static const struct vm_operations_struct kvm_gmem_device_vm_ops = {
+	.fault = kvm_gmem_fault_user_mapping,
+};
+
 static int gmem_folio_mmap(struct inode *inode, void *provider,
 		struct vm_area_struct *vma)
 {
@@ -1124,8 +1131,15 @@ static int gmem_folio_mmap(struct inode *inode, void *provider,
 static int gmem_pfn_mmap(struct inode *inode, void *provider,
 		struct vm_area_struct *vma)
 {
-	vm_flags_set(vma, VM_PFNMAP);
-	vma->vm_ops = &kvm_gmem_vm_ops;
+	struct gmem_inode *gi = GMEM_I(inode);
+
+	/* Keep device memory protections in the VMA for mprotect(). */
+	if (gmem_provider_is_device(gi))
+		vma->vm_page_prot = pgprot_decrypted(pgprot_noncached(vma->vm_page_prot));
+
+	vm_flags_set(vma, VM_IO | VM_PFNMAP | VM_DONTEXPAND | VM_DONTDUMP);
+	vma->vm_ops = gmem_provider_is_device(gi) ? &kvm_gmem_device_vm_ops :
+						 &kvm_gmem_vm_ops;
 	return 0;
 }
 
-- 
2.43.0