Hi Emerson I find the wall of text in the cover letter, commit messages and code comments extremely difficult to parse.
With AI, generating code is cheap, reviewing is expensive. I don't think anyone on the list can or should review a patch series like this. Please make sure you understand the code and deslop the AI-generated content before posting. After reading v1, I think I know what you try to solve, but I'm not going to accept a patch series like this. A lot of the patches don't seem to be related to the problem you want to solve. Thanks, Wei On Wed, Oct 07, 2026 at 04:07:38PM -0300, Emerson Busson wrote: > This series moves VMBus ring backing to the chunk allocator and keeps the > allocation, GPADL ownership, and mapping references together. It preserves > the exported four-argument interfaces while allowing the private allocation > paths to carry ownership and sharing policy. > > A review of the original vzalloc fallback noted that CCA and TDX guests > without a paravisor need direct-map page transitions. This revision uses > contiguous chunks for buffers that must be host-shared, transitions each > page through page_address(), and combines the chunks with vmap(). Ordinary > guest-private buffers retain vzalloc-style allocation. > > Allocation and compatibility > ---------------------------- > > Every ring allocation uses the chunk allocator. Ordinary guests and buffers > kept private by channel policy use vzalloc(). For host-shared buffers in an > encrypted or isolated guest, the allocator uses contiguous chunks and > transitions them page by page. Guest-memory encryption is selected > independently of Hyper-V isolation. > > Ring consumers select co_ring_buffer. External buffers and the legacy > allocator select co_external_memory. The exported allocator and caller- > decrypted GPADL prototypes retain four arguments throughout all fourteen > patches. UIO migration follows its release support. > > The address, page and chunk arrays, and embedded GPADL belong to one buffer. > The allocation extent, host-described GPADL extent, and retained allocation > extent remain distinct. Interior GPADL duplication preserves the existing > exported interfaces. Prepared owned buffers avoid repeat decryption, and > HV_GPADL_BUFFER_DECRYPTED is removed. > > Lifetime and host acknowledgement > --------------------------------- > > A host rescind alone does not prove GPADL revocation. For a known-live GPADL > whose channel identifier is still held, teardown posts a request and waits > for a matching GPADL_TORNDOWN message before clearing ownership. Synthetic > rescind notification cannot replace this acknowledgement. Unknown creates, > local removal, invalid identifiers, failed posting, and timeouts retain > ownership. > > Waiter removal shares the response-list lock with matching replies so a late > acknowledgement cannot use a freed waiter. Released owners retain pages > across mapping references and failed page-state restoration. Reclaimer > shutdown cancels pending timers under the owner lock and requeues only work > that was actually canceled; running callbacks drain through workqueue > destruction without re-executing freed embedded work. > > Sysfs mappings install no vm_ops and release the bridge pin on every setup > outcome. UIO mappings hold their pin through VMA close. Page, count, and > protection snapshots share the owner-lock boundary. New tests call the real > sysfs wrapper, insert actual PTEs, and check readable bytes and page > references through success and partial -EBUSY. They do not execute a full > kernfs syscall or full device destruction. > > The final four fixes use vzalloc() for guest-private requestor arrays and > bitmaps, kvzalloc_obj() for guest-private RNDIS descriptors, handle NULL > control requests on empty NetVSC completions, and use kvzalloc_obj()/kvfree() > for the large guest-private NetVSC device object. > > Qualification on the exact fourteen-patch series > ------------------------------------------------ > > The code mails are pinned by series/SHA256SUMS. Applying all fourteen to > 93f51579e7df248780214094418f205253383cc5 produces source tree > e6fe523ca92ce30ea7edb265b8a26bf20a867c47. > > The VMBus workflow builds x86_64 and arm64 with W=1 and C=2, passes sparse, > and passes all 69 linked x86_64 QEMU KUnit cases. The distinct WSL backport > passes all 26 of its KUnit cases. CoCo source invariants pass on both > architectures; these are necessary static checks, not confidential-hardware > qualification. > > Exact-source Hyper-V runtime, including controlled host rescind: > https://github.com/emersonbusson/WSL2-Linux-Kernel/actions/runs/37650468077 > > On both windows-2025 and windows-latest, the candidate passes 100 bind/unbind > cycles, bounded buddy fragmentation, channel rebind, UIO mapping teardown, > and the controlled host-origin NIC removal. Each report records > HYPERV_DRILL_HOST_RESCIND status=PASS, target_absent=yes, > matching_events=1. Both report zero splats and faults, restore the measured > kernel settings, and return lifecycle map accounting to the settled > operational > baseline. Captured owner accounting reports 722 created, zero unobserved > creates, 715 reclaimed, and seven still active; active owners are not > classified as leaks. Trace capture has no overruns or dropped events, and > the disposable VM, VHD, and switch cleanup passes. > > The baseline is an intentional negative control. It reproduces the expected > fragmented-allocation failure without guest faults; the workflow accepts > that exact signature as a passing control. It is not a candidate result. > > WSL backport runtime matrix: > https://github.com/emersonbusson/WSL2-Linux-Kernel/actions/runs/37645708153 > > That separate backport passes the actual Windows candidate matrix. Each > runner completes 64 commands with matching teardown acknowledgements, > zero unacknowledged requests, no backing or tail growth, and all six > shutdown checks. The shutdown retry path is covered by 40 local parser and > refusal regressions; the live candidate runs required zero retries. These > results qualify the WSL backport's measured ordinary behavior, not the > mainline mail series. > > Qualification limits > -------------------- > > The Hyper-V runtime uses the ordinary x86_64 vzalloc path. It does not > execute confidential chunk transitions. Full memory saturation, the > chunked CoCo fallback on hardware, SEV-SNP, TDX without a paravisor, Arm > CCA, and complete VMBus module unload and retained-owner destruction remain > unqualified. The exact mainline series has not been installed or booted on > the daily WSL host; the installed kernel and Windows WSL matrix are a separate > backport. The baseline is one intentional fragmentation negative control, > not a matched same-configuration diagnostic-count comparison for every patch. > No confidential-platform result is inferred from ordinary Hyper-V or static > checks. > > --- > Emerson Busson (14): > hv: vmbus: convert ring backing through the chunk allocator > hv: vmbus: validate chunk buffer allocation and cleanup > uio: hv_generic: describe buffers for owned allocation > hv: vmbus: add KUnit tests for GPADL post failure injection > hv: vmbus: add KUnit test for order-zero allocation fallback > hv: vmbus: cover all shared-page policy combinations > hv: vmbus: distinguish host rescind from local channel unload > hv: vmbus: retain backing until ownership and references clear > hv: use owned VMBus buffers in NetVSC and UIO > hv: vmbus: pin buffer pages across UIO mmap to close the reclaim race > hv: vmbus: vmalloc requestor metadata > hv: netvsc: allocate RNDIS request descriptors with kvzalloc_obj() > hv: netvsc: handle a NULL request address on empty completions > hv: netvsc: use kvzalloc for device state
