[PATCH] KVM: arm64: Reject guest_memfd memslots when the VM has MTE

[Fuad Tabba]

On Tue, 14 Jul 2026 at 14:15, Alexandru Elisei <alexandru.elisei at arm.com> wrote:
>
> Hi Fuad,
>
> On Tue, Jul 14, 2026 at 12:44:57PM +0100, Fuad Tabba wrote:
> > Hi Alex,
> >
> > On Tue, 14 Jul 2026 at 12:08, Alexandru Elisei <alexandru.elisei at arm.com> wrote:
> > >
> > > The user cannot use MTE on VMAs created by mapping a guest_memfd file,
> > > as arch_calc_vm_flag_bits() does not set VM_MTE_ALLOWED.
> > >
> > > When creating a guest_memfd backed memslot,
> > > kvm_arch_prepare_memory_region() rejects the memslot if MTE is enabled for
> > > the VM and if guest_memfd has been mapped in a VMA that intersects the
> > > memslot.
> > >
> > > However, the documentation for KVM_SET_USER_MEMORY_REGION2 explicitly
> >
> > nit: s/explicitely/explicitly/
>
> I think that's what I wrote :)

I fixed the quoted text (pressing enter right after the word)! :) The
original msg says `explicitely`

It's a nit anyway.

> >
> > > states that the only condition for userspace_addr is for it to be a legal
> > > userspace address, but the mapping is not required to be valid nor
> > > populated at memslot creation.
> > >
> > > If userspace sets userspace_addr to an address that hasn't been mapped, or
> > > if userspace_addr belongs to a VMA that isn't backed by the guest_memfd
> > > file, or if the VMA doesn't intersect the memslot, memslot creation is
> > > successful and KVM ends up with a VM with MTE and guest_memfd-backed
> > > memslots.
> > >
> > > Forbid guest_memfd memslots unconditionally when the VM has MTE to prevent
> > > this from happening.
> > >
> > > Signed-off-by: Alexandru Elisei <alexandru.elisei at arm.com>
> >
> > Is this worth a Fixes: tag?
>
> Fixes: 32e200bd6e44 ("KVM: arm64: Enable support for guest_memfd backed memory")
> ?

Yes, the author of that patch should have known better...

<snip>

> I can iterate through all the memslots and check that none are backed by a
> guest_memfd file when userspace enables the MTE capability.

Sgtm.

Cheers,
/fuad

> Will wait for a day or two to send v2.
>
> Thanks,
> Alex