Commit fe2bf623 authored by Sean Christopherson's avatar Sean Christopherson
Browse files

KVM: guest_memfd: Add INIT_SHARED flag, reject user page faults if not set 



Add a guest_memfd flag to allow userspace to state that the underlying
memory should be configured to be initialized as shared, and reject user
page faults if the guest_memfd instance's memory isn't shared.  Because
KVM doesn't yet support in-place private<=>shared conversions, all
guest_memfd memory effectively follows the initial state.

Alternatively, KVM could deduce the initial state based on MMAP, which for
all intents and purposes is what KVM currently does.  However, implicitly
deriving the default state based on MMAP will result in a messy ABI when
support for in-place conversions is added.

For x86 CoCo VMs, which don't yet support MMAP, memory is currently private
by default (otherwise the memory would be unusable).  If MMAP implies
memory is shared by default, then the default state for CoCo VMs will vary
based on MMAP, and from userspace's perspective, will change when in-place
conversion support is added.  I.e. to maintain guest<=>host ABI, userspace
would need to immediately convert all memory from shared=>private, which
is both ugly and inefficient.  The inefficiency could be avoided by adding
a flag to state that memory is _private_ by default, irrespective of MMAP,
but that would lead to an equally messy and hard to document ABI.

Bite the bullet and immediately add a flag to control the default state so
that the effective behavior is explicit and straightforward.

Fixes: 3d3a04fa ("KVM: Allow and advertise support for host mmap() on guest_memfd files")
Cc: David Hildenbrand <david@redhat.com>
Reviewed-by: default avatarFuad Tabba <tabba@google.com>
Tested-by: default avatarFuad Tabba <tabba@google.com>
Reviewed-by: default avatarAckerley Tng <ackerleytng@google.com>
Tested-by: default avatarAckerley Tng <ackerleytng@google.com>
Reviewed-by: default avatarDavid Hildenbrand <david@redhat.com>
Link: https://lore.kernel.org/r/20251003232606.4070510-3-seanjc@google.com


Signed-off-by: default avatarSean Christopherson <seanjc@google.com>
parent d2042d8f

Documentation/virt/kvm/api.rst

+5 −0
Original line number Diff line number Diff line
@@ -6438,6 +6438,11 @@ specified via KVM_CREATE_GUEST_MEMFD. Currently defined flags: 
  ============================ ================================================

  GUEST_MEMFD_FLAG_MMAP        Enable using mmap() on the guest_memfd file

                               descriptor.

  GUEST_MEMFD_FLAG_INIT_SHARED Make all memory in the file shared during

                               KVM_CREATE_GUEST_MEMFD (memory files created

                               without INIT_SHARED will be marked private).

                               Shared memory can be faulted into host userspace

                               page tables. Private memory cannot.

  ============================ ================================================



When the KVM MMU performs a PFN lookup to service a guest fault and the backing

include/uapi/linux/kvm.h

+2 −1
Original line number Diff line number Diff line
@@ -1600,6 +1600,7 @@ struct kvm_memory_attributes { 


#define KVM_CREATE_GUEST_MEMFD	_IOWR(KVMIO,  0xd4, struct kvm_create_guest_memfd)

#define GUEST_MEMFD_FLAG_MMAP		(1ULL << 0)

#define GUEST_MEMFD_FLAG_INIT_SHARED	(1ULL << 1)



struct kvm_create_guest_memfd {

	__u64 size;

tools/testing/selftests/kvm/guest_memfd_test.c

+12 −3
Original line number Diff line number Diff line
@@ -239,8 +239,9 @@ static void test_create_guest_memfd_multiple(struct kvm_vm *vm) 
	close(fd1);

}



static void test_guest_memfd_flags(struct kvm_vm *vm, uint64_t valid_flags)

static void test_guest_memfd_flags(struct kvm_vm *vm)

{

	uint64_t valid_flags = vm_check_cap(vm, KVM_CAP_GUEST_MEMFD_FLAGS);

	size_t page_size = getpagesize();

	uint64_t flag;

	int fd;
@@ -274,6 +275,10 @@ static void test_guest_memfd(unsigned long vm_type) 
	vm = vm_create_barebones_type(vm_type);

	flags = vm_check_cap(vm, KVM_CAP_GUEST_MEMFD_FLAGS);



	/* This test doesn't yet support testing mmap() on private memory. */

	if (!(flags & GUEST_MEMFD_FLAG_INIT_SHARED))

		flags &= ~GUEST_MEMFD_FLAG_MMAP;



	test_create_guest_memfd_multiple(vm);

	test_create_guest_memfd_invalid_sizes(vm, flags, page_size);
@@ -292,7 +297,7 @@ static void test_guest_memfd(unsigned long vm_type) 
	test_fallocate(fd, page_size, total_size);

	test_invalid_punch_hole(fd, page_size, total_size);



	test_guest_memfd_flags(vm, flags);

	test_guest_memfd_flags(vm);



	close(fd);

	kvm_vm_free(vm);
@@ -334,9 +339,13 @@ static void test_guest_memfd_guest(void) 
	TEST_ASSERT(vm_check_cap(vm, KVM_CAP_GUEST_MEMFD_FLAGS) & GUEST_MEMFD_FLAG_MMAP,

		    "Default VM type should support MMAP, supported flags = 0x%x",

		    vm_check_cap(vm, KVM_CAP_GUEST_MEMFD_FLAGS));

	TEST_ASSERT(vm_check_cap(vm, KVM_CAP_GUEST_MEMFD_FLAGS) & GUEST_MEMFD_FLAG_INIT_SHARED,

		    "Default VM type should support INIT_SHARED, supported flags = 0x%x",

		    vm_check_cap(vm, KVM_CAP_GUEST_MEMFD_FLAGS));



	size = vm->page_size;

	fd = vm_create_guest_memfd(vm, size, GUEST_MEMFD_FLAG_MMAP);

	fd = vm_create_guest_memfd(vm, size, GUEST_MEMFD_FLAG_MMAP |

					     GUEST_MEMFD_FLAG_INIT_SHARED);

	vm_set_user_memory_region2(vm, slot, KVM_MEM_GUEST_MEMFD, gpa, size, NULL, fd, 0);



	mem = mmap(NULL, size, PROT_READ | PROT_WRITE, MAP_SHARED, fd, 0);

virt/kvm/guest_memfd.c

+5 −1
Original line number Diff line number Diff line
@@ -328,6 +328,9 @@ static vm_fault_t kvm_gmem_fault_user_mapping(struct vm_fault *vmf) 
	if (((loff_t)vmf->pgoff << PAGE_SHIFT) >= i_size_read(inode))

		return VM_FAULT_SIGBUS;



	if (!((u64)inode->i_private & GUEST_MEMFD_FLAG_INIT_SHARED))

		return VM_FAULT_SIGBUS;



	folio = kvm_gmem_get_folio(inode, vmf->pgoff);

	if (IS_ERR(folio)) {

		int err = PTR_ERR(folio);
@@ -525,7 +528,8 @@ int kvm_gmem_create(struct kvm *kvm, struct kvm_create_guest_memfd *args) 
	u64 valid_flags = 0;



	if (kvm_arch_supports_gmem_mmap(kvm))

		valid_flags |= GUEST_MEMFD_FLAG_MMAP;

		valid_flags |= GUEST_MEMFD_FLAG_MMAP |

			       GUEST_MEMFD_FLAG_INIT_SHARED;



	if (flags & ~valid_flags)

		return -EINVAL;

virt/kvm/kvm_main.c

+2 −1
Original line number Diff line number Diff line
@@ -4930,7 +4930,8 @@ static int kvm_vm_ioctl_check_extension_generic(struct kvm *kvm, long arg) 
		return 1;

	case KVM_CAP_GUEST_MEMFD_FLAGS:

		if (!kvm || kvm_arch_supports_gmem_mmap(kvm))

			return GUEST_MEMFD_FLAG_MMAP;

			return GUEST_MEMFD_FLAG_MMAP |

			       GUEST_MEMFD_FLAG_INIT_SHARED;



		return 0;

#endif