Fix several flaws in guest_memfd related to MMAP support, the big one being
a lurking ABI mess due to MMAP implicitly inverting the initial private vs.
shared state of a gmem instance.
To solve that, add a guest_memfd flag, INIT_SHARED, to let userspace explicitly
state whether the underlying memory should default to private vs. shared.
As-is, the initial state is implicitly derived from the MMAP flag: guest_memfd
without MMAP is private, and with MMAP is shared. That implicit behavior
is going to create a mess of an ABI once in-place conversion support comes
along.
If the init state is implicit, then x86 CoCo VMs will end up with init state
that varies based on whether or not a guest_memfd instance is configured for
mmap() support. To avoid breaking guest<=>host ABI for CoCo VMs when utilizing
in-place conversion, i.e. MMAP, userspace would need to immediately convert all
memory from shared=>private. As a bonus, this allows for adding test coverage
that KVM rejects faults to private memory.
v2:
- Collect reviews.
- Improve documentation. [Fuad]
- s/DEFAULT_SHARED/INIT_SHARED. [Ackerley]
- Add TEST_EXPECT_SIGBUS() to simplify testing "bad" accesses. [Ackerley]
- Replace KVM_CAP_GUEST_MEMFD_MMAP with KVM_CAP_GUEST_MEMFD_FLAGS.
- Add more coverage for SIGBUS cases.
- Fix a benign (but lurking) bug where guest_memfd doesn't mark SHARED GPAs
for invalidation (only TDX looks at the invalidation filters, and TDX won't
support shared memory until in-place conversion comes along).
- Explicitly report several signals (debugging SIGBUS when I screwed up was
super annoying without the explicit TEST_FAIL()).
- Allow mmap() on private memory to avoid having to add more CAPs for it
(and because it'll allow for setting NUMA policy on private memory).
- Mark KVM_GUEST_MEMFD as depending on KVM_GENERIC_MMU_NOTIFIER (pre-existing
bug, but slightly more evident once arm64 support guest_memfd (s390 is the
only arch that doesn't select KVM_GENERIC_MMU_NOTIFIER)).
v1: https://lore.kernel.org/all/diqz4isiuddj.fsf@google.com
Ackerley Tng (1):
KVM: selftests: Add test coverage for guest_memfd without
GUEST_MEMFD_FLAG_MMAP
Sean Christopherson (12):
KVM: Rework KVM_CAP_GUEST_MEMFD_MMAP into KVM_CAP_GUEST_MEMFD_FLAGS
KVM: guest_memfd: Add INIT_SHARED flag, reject user page faults if not
set
KVM: guest_memfd: Invalidate SHARED GPAs if gmem supports INIT_SHARED
KVM: Explicitly mark KVM_GUEST_MEMFD as depending on
KVM_GENERIC_MMU_NOTIFIER
KVM: guest_memfd: Allow mmap() on guest_memfd for x86 VMs with private
memory
KVM: selftests: Stash the host page size in a global in the
guest_memfd test
KVM: selftests: Create a new guest_memfd for each testcase
KVM: selftests: Add wrappers for mmap() and munmap() to assert success
KVM: selftests: Isolate the guest_memfd Copy-on-Write negative
testcase
KVM: selftests: Add wrapper macro to handle and assert on expected
SIGBUS
KVM: selftests: Verify that faulting in private guest_memfd memory
fails
KVM: selftests: Verify that reads to inaccessible guest_memfd VMAs
SIGBUS
Documentation/virt/kvm/api.rst | 15 +-
arch/x86/kvm/x86.c | 7 +-
include/linux/kvm_host.h | 12 +-
include/uapi/linux/kvm.h | 5 +-
.../testing/selftests/kvm/guest_memfd_test.c | 175 ++++++++++--------
.../testing/selftests/kvm/include/kvm_util.h | 25 +++
.../testing/selftests/kvm/include/test_util.h | 19 ++
tools/testing/selftests/kvm/lib/kvm_util.c | 44 ++---
tools/testing/selftests/kvm/lib/test_util.c | 7 +
tools/testing/selftests/kvm/mmu_stress_test.c | 5 +-
.../selftests/kvm/s390/ucontrol_test.c | 16 +-
.../selftests/kvm/set_memory_region_test.c | 17 +-
virt/kvm/Kconfig | 1 +
virt/kvm/guest_memfd.c | 75 +++++---
virt/kvm/kvm_main.c | 4 +-
15 files changed, 259 insertions(+), 168 deletions(-)
base-commit: 6b36119b94d0b2bb8cea9d512017efafd461d6ac
--
2.51.0.618.g983fd99d29-goog