KVM: guest_memfd: Add INIT_SHARED flag, reject user page faults if not set

Add a guest_memfd flag to allow userspace to state that the underlying
memory should be configured to be initialized as shared, and reject user
page faults if the guest_memfd instance's memory isn't shared.  Because
KVM doesn't yet support in-place private<=>shared conversions, all
guest_memfd memory effectively follows the initial state.

Alternatively, KVM could deduce the initial state based on MMAP, which for
all intents and purposes is what KVM currently does.  However, implicitly
deriving the default state based on MMAP will result in a messy ABI when
support for in-place conversions is added.

For x86 CoCo VMs, which don't yet support MMAP, memory is currently private
by default (otherwise the memory would be unusable).  If MMAP implies
memory is shared by default, then the default state for CoCo VMs will vary
based on MMAP, and from userspace's perspective, will change when in-place
conversion support is added.  I.e. to maintain guest<=>host ABI, userspace
would need to immediately convert all memory from shared=>private, which
is both ugly and inefficient.  The inefficiency could be avoided by adding
a flag to state that memory is _private_ by default, irrespective of MMAP,
but that would lead to an equally messy and hard to document ABI.

Bite the bullet and immediately add a flag to control the default state so
that the effective behavior is explicit and straightforward.

Fixes: 3d3a04fad25a ("KVM: Allow and advertise support for host mmap() on guest_memfd files")
Cc: David Hildenbrand <david@redhat.com>
Reviewed-by: Fuad Tabba <tabba@google.com>
Tested-by: Fuad Tabba <tabba@google.com>
Reviewed-by: Ackerley Tng <ackerleytng@google.com>
Tested-by: Ackerley Tng <ackerleytng@google.com>
Reviewed-by: David Hildenbrand <david@redhat.com>
Link: https://lore.kernel.org/r/20251003232606.4070510-3-seanjc@google.com
Signed-off-by: Sean Christopherson <seanjc@google.com>

diff --git a/Documentation/virt/kvm/api.rst b/Documentation/virt/kvm/api.rst
index 7ba92f2ced3867459a8703dd9b39fb5c635cc611..754b662a453c31aaea10dd83751a1e97513a552b 100644 (file)
--- a/Documentation/virt/kvm/api.rst
+++ b/Documentation/virt/kvm/api.rst
@@ -6438,6 +6438,11 @@ specified via KVM_CREATE_GUEST_MEMFD.  Currently defined flags:
   ============================ ================================================
   GUEST_MEMFD_FLAG_MMAP        Enable using mmap() on the guest_memfd file
                                descriptor.
+  GUEST_MEMFD_FLAG_INIT_SHARED Make all memory in the file shared during
+                               KVM_CREATE_GUEST_MEMFD (memory files created
+                               without INIT_SHARED will be marked private).
+                               Shared memory can be faulted into host userspace
+                               page tables. Private memory cannot.
   ============================ ================================================
 
 When the KVM MMU performs a PFN lookup to service a guest fault and the backing

diff --git a/include/uapi/linux/kvm.h b/include/uapi/linux/kvm.h
index b1d52d0c56ec45c48a88e8955e9794082ca2e563..52f6000ab020840ef9b38e545a148ee2e99fd1cb 100644 (file)
--- a/include/uapi/linux/kvm.h
+++ b/include/uapi/linux/kvm.h
@@ -1599,7 +1599,8 @@ struct kvm_memory_attributes {
 #define KVM_MEMORY_ATTRIBUTE_PRIVATE           (1ULL << 3)
 
 #define KVM_CREATE_GUEST_MEMFD _IOWR(KVMIO,  0xd4, struct kvm_create_guest_memfd)
-#define GUEST_MEMFD_FLAG_MMAP  (1ULL << 0)
+#define GUEST_MEMFD_FLAG_MMAP          (1ULL << 0)
+#define GUEST_MEMFD_FLAG_INIT_SHARED   (1ULL << 1)
 
 struct kvm_create_guest_memfd {
        __u64 size;

diff --git a/tools/testing/selftests/kvm/guest_memfd_test.c b/tools/testing/selftests/kvm/guest_memfd_test.c
index 3e58bd49610446327322207fb78a277a8fcb53df..0de56ce3c4e256ae8e5800696cf1e8a03c2ec6d3 100644 (file)
--- a/tools/testing/selftests/kvm/guest_memfd_test.c
+++ b/tools/testing/selftests/kvm/guest_memfd_test.c
@@ -239,8 +239,9 @@ static void test_create_guest_memfd_multiple(struct kvm_vm *vm)
        close(fd1);
 }
 
-static void test_guest_memfd_flags(struct kvm_vm *vm, uint64_t valid_flags)
+static void test_guest_memfd_flags(struct kvm_vm *vm)
 {
+       uint64_t valid_flags = vm_check_cap(vm, KVM_CAP_GUEST_MEMFD_FLAGS);
        size_t page_size = getpagesize();
        uint64_t flag;
        int fd;
@@ -274,6 +275,10 @@ static void test_guest_memfd(unsigned long vm_type)
        vm = vm_create_barebones_type(vm_type);
        flags = vm_check_cap(vm, KVM_CAP_GUEST_MEMFD_FLAGS);
 
+       /* This test doesn't yet support testing mmap() on private memory. */
+       if (!(flags & GUEST_MEMFD_FLAG_INIT_SHARED))
+               flags &= ~GUEST_MEMFD_FLAG_MMAP;
+
        test_create_guest_memfd_multiple(vm);
        test_create_guest_memfd_invalid_sizes(vm, flags, page_size);
 
@@ -292,7 +297,7 @@ static void test_guest_memfd(unsigned long vm_type)
        test_fallocate(fd, page_size, total_size);
        test_invalid_punch_hole(fd, page_size, total_size);
 
-       test_guest_memfd_flags(vm, flags);
+       test_guest_memfd_flags(vm);
 
        close(fd);
        kvm_vm_free(vm);
@@ -334,9 +339,13 @@ static void test_guest_memfd_guest(void)
        TEST_ASSERT(vm_check_cap(vm, KVM_CAP_GUEST_MEMFD_FLAGS) & GUEST_MEMFD_FLAG_MMAP,
                    "Default VM type should support MMAP, supported flags = 0x%x",
                    vm_check_cap(vm, KVM_CAP_GUEST_MEMFD_FLAGS));
+       TEST_ASSERT(vm_check_cap(vm, KVM_CAP_GUEST_MEMFD_FLAGS) & GUEST_MEMFD_FLAG_INIT_SHARED,
+                   "Default VM type should support INIT_SHARED, supported flags = 0x%x",
+                   vm_check_cap(vm, KVM_CAP_GUEST_MEMFD_FLAGS));
 
        size = vm->page_size;
-       fd = vm_create_guest_memfd(vm, size, GUEST_MEMFD_FLAG_MMAP);
+       fd = vm_create_guest_memfd(vm, size, GUEST_MEMFD_FLAG_MMAP |
+                                            GUEST_MEMFD_FLAG_INIT_SHARED);
        vm_set_user_memory_region2(vm, slot, KVM_MEM_GUEST_MEMFD, gpa, size, NULL, fd, 0);
 
        mem = mmap(NULL, size, PROT_READ | PROT_WRITE, MAP_SHARED, fd, 0);

diff --git a/virt/kvm/guest_memfd.c b/virt/kvm/guest_memfd.c
index 94bafd6c558c5e5b4dec57fb930b65e915defbbb..cf3afba23a6be83d627bf29f353a9be70eecd4f2 100644 (file)
--- a/virt/kvm/guest_memfd.c
+++ b/virt/kvm/guest_memfd.c
@@ -328,6 +328,9 @@ static vm_fault_t kvm_gmem_fault_user_mapping(struct vm_fault *vmf)
        if (((loff_t)vmf->pgoff << PAGE_SHIFT) >= i_size_read(inode))
                return VM_FAULT_SIGBUS;
 
+       if (!((u64)inode->i_private & GUEST_MEMFD_FLAG_INIT_SHARED))
+               return VM_FAULT_SIGBUS;
+
        folio = kvm_gmem_get_folio(inode, vmf->pgoff);
        if (IS_ERR(folio)) {
                int err = PTR_ERR(folio);
@@ -525,7 +528,8 @@ int kvm_gmem_create(struct kvm *kvm, struct kvm_create_guest_memfd *args)
        u64 valid_flags = 0;
 
        if (kvm_arch_supports_gmem_mmap(kvm))
-               valid_flags |= GUEST_MEMFD_FLAG_MMAP;
+               valid_flags |= GUEST_MEMFD_FLAG_MMAP |
+                              GUEST_MEMFD_FLAG_INIT_SHARED;
 
        if (flags & ~valid_flags)
                return -EINVAL;

diff --git a/virt/kvm/kvm_main.c b/virt/kvm/kvm_main.c
index e3a268757621c6ffb2c21e70724a9944c888bb0b..5f644ca54af3530bc706512ad07ccf35d2780169 100644 (file)
--- a/virt/kvm/kvm_main.c
+++ b/virt/kvm/kvm_main.c
@@ -4930,7 +4930,8 @@ static int kvm_vm_ioctl_check_extension_generic(struct kvm *kvm, long arg)
                return 1;
        case KVM_CAP_GUEST_MEMFD_FLAGS:
                if (!kvm || kvm_arch_supports_gmem_mmap(kvm))
-                       return GUEST_MEMFD_FLAG_MMAP;
+                       return GUEST_MEMFD_FLAG_MMAP |
+                              GUEST_MEMFD_FLAG_INIT_SHARED;
 
                return 0;
 #endif