linux-kernel - [PATCH v2 00/13] KVM: guest_memfd: MMAP and related fixes

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <20251003232606.4070510-1-seanjc@google.com>
Date: Fri,  3 Oct 2025 16:25:53 -0700
From: Sean Christopherson <seanjc@...gle.com>
To: Paolo Bonzini <pbonzini@...hat.com>, Sean Christopherson <seanjc@...gle.com>, 
	Christian Borntraeger <borntraeger@...ux.ibm.com>, Janosch Frank <frankja@...ux.ibm.com>, 
	Claudio Imbrenda <imbrenda@...ux.ibm.com>
Cc: kvm@...r.kernel.org, linux-kernel@...r.kernel.org, 
	David Hildenbrand <david@...hat.com>, Fuad Tabba <tabba@...gle.com>, 
	Ackerley Tng <ackerleytng@...gle.com>
Subject: [PATCH v2 00/13] KVM: guest_memfd: MMAP and related fixes

Fix several flaws in guest_memfd related to MMAP support, the big one being
a lurking ABI mess due to MMAP implicitly inverting the initial private vs.
shared state of a gmem instance.

To solve that, add a guest_memfd flag, INIT_SHARED, to let userspace explicitly
state whether the underlying memory should default to private vs. shared.
As-is, the initial state is implicitly derived from the MMAP flag: guest_memfd
without MMAP is private, and with MMAP is shared.  That implicit behavior
is going to create a mess of an ABI once in-place conversion support comes
along.

If the init state is implicit, then x86 CoCo VMs will end up with init state
that varies based on whether or not a guest_memfd instance is configured for
mmap() support.  To avoid breaking guest<=>host ABI for CoCo VMs when utilizing
in-place conversion, i.e. MMAP, userspace would need to immediately convert all
memory from shared=>private.  As a bonus, this allows for adding test coverage
that KVM rejects faults to private memory.

v2:
 - Collect reviews.
 - Improve documentation. [Fuad]
 - s/DEFAULT_SHARED/INIT_SHARED. [Ackerley]
 - Add TEST_EXPECT_SIGBUS() to simplify testing "bad" accesses. [Ackerley]
 - Replace KVM_CAP_GUEST_MEMFD_MMAP with KVM_CAP_GUEST_MEMFD_FLAGS.
 - Add more coverage for SIGBUS cases.
 - Fix a benign (but lurking) bug where guest_memfd doesn't mark SHARED GPAs
   for invalidation (only TDX looks at the invalidation filters, and TDX won't
   support shared memory until in-place conversion comes along).
 - Explicitly report several signals (debugging SIGBUS when I screwed up was
   super annoying without the explicit TEST_FAIL()).
 - Allow mmap() on private memory to avoid having to add more CAPs for it
   (and because it'll allow for setting NUMA policy on private memory).
 - Mark KVM_GUEST_MEMFD as depending on KVM_GENERIC_MMU_NOTIFIER (pre-existing
   bug, but slightly more evident once arm64 support guest_memfd (s390 is the
   only arch that doesn't select KVM_GENERIC_MMU_NOTIFIER)).

v1: https://lore.kernel.org/all/diqz4isiuddj.fsf@google.com

Ackerley Tng (1):
  KVM: selftests: Add test coverage for guest_memfd without
    GUEST_MEMFD_FLAG_MMAP

Sean Christopherson (12):
  KVM: Rework KVM_CAP_GUEST_MEMFD_MMAP into KVM_CAP_GUEST_MEMFD_FLAGS
  KVM: guest_memfd: Add INIT_SHARED flag, reject user page faults if not
    set
  KVM: guest_memfd: Invalidate SHARED GPAs if gmem supports INIT_SHARED
  KVM: Explicitly mark KVM_GUEST_MEMFD as depending on
    KVM_GENERIC_MMU_NOTIFIER
  KVM: guest_memfd: Allow mmap() on guest_memfd for x86 VMs with private
    memory
  KVM: selftests: Stash the host page size in a global in the
    guest_memfd test
  KVM: selftests: Create a new guest_memfd for each testcase
  KVM: selftests: Add wrappers for mmap() and munmap() to assert success
  KVM: selftests: Isolate the guest_memfd Copy-on-Write negative
    testcase
  KVM: selftests: Add wrapper macro to handle and assert on expected
    SIGBUS
  KVM: selftests: Verify that faulting in private guest_memfd memory
    fails
  KVM: selftests: Verify that reads to inaccessible guest_memfd VMAs
    SIGBUS

 Documentation/virt/kvm/api.rst                |  15 +-
 arch/x86/kvm/x86.c                            |   7 +-
 include/linux/kvm_host.h                      |  12 +-
 include/uapi/linux/kvm.h                      |   5 +-
 .../testing/selftests/kvm/guest_memfd_test.c  | 175 ++++++++++--------
 .../testing/selftests/kvm/include/kvm_util.h  |  25 +++
 .../testing/selftests/kvm/include/test_util.h |  19 ++
 tools/testing/selftests/kvm/lib/kvm_util.c    |  44 ++---
 tools/testing/selftests/kvm/lib/test_util.c   |   7 +
 tools/testing/selftests/kvm/mmu_stress_test.c |   5 +-
 .../selftests/kvm/s390/ucontrol_test.c        |  16 +-
 .../selftests/kvm/set_memory_region_test.c    |  17 +-
 virt/kvm/Kconfig                              |   1 +
 virt/kvm/guest_memfd.c                        |  75 +++++---
 virt/kvm/kvm_main.c                           |   4 +-
 15 files changed, 259 insertions(+), 168 deletions(-)


base-commit: 6b36119b94d0b2bb8cea9d512017efafd461d6ac
-- 
2.51.0.618.g983fd99d29-goog