Declare memory attributes to map memory regions as non-readable, non-writable, and/or non-executable. The attributes are negated for the following reasons: - Setting a 0 memory attribute (attr->attributes == 0) shouldn't introduce any access restrictions. For example, when moving from private to shared mappings in context of confidential computing. - In practice, with negated attributes, a non-private RWX memory attribute is analogous to a delete operation. It's a nice outcome, as it forces remapping the region with huge-pages, doing the right thing for use-cases that have short-lived access restricted regions like Hyper-V's VSM. - A non-negated version of the flags has no way of expressing non-access mapping (NR/NW/NX) without having to introduce an extra flag (since 0 isn't available). Signed-off-by: Nicolas Saenz Julienne <nsaenz@xxxxxxxxxx> --- Documentation/virt/kvm/api.rst | 14 +++++++++++--- include/linux/kvm_host.h | 22 +++++++++++++++++++++- include/uapi/linux/kvm.h | 3 +++ virt/kvm/kvm_main.c | 32 +++++++++++++++++++++++++++++--- 4 files changed, 64 insertions(+), 7 deletions(-) diff --git a/Documentation/virt/kvm/api.rst b/Documentation/virt/kvm/api.rst index 18ddea9c4c58a..6d3bc5092ea63 100644 --- a/Documentation/virt/kvm/api.rst +++ b/Documentation/virt/kvm/api.rst @@ -6313,15 +6313,23 @@ of guest physical memory. __u64 flags; }; + #define KVM_MEMORY_ATTRIBUTE_NR (1ULL << 0) + #define KVM_MEMORY_ATTRIBUTE_NW (1ULL << 1) + #define KVM_MEMORY_ATTRIBUTE_NX (1ULL << 2) #define KVM_MEMORY_ATTRIBUTE_PRIVATE (1ULL << 3) The address and size must be page aligned. The supported attributes can be retrieved via ioctl(KVM_CHECK_EXTENSION) on KVM_CAP_MEMORY_ATTRIBUTES. If executed on a VM, KVM_CAP_MEMORY_ATTRIBUTES precisely returns the attributes supported by that VM. If executed at system scope, KVM_CAP_MEMORY_ATTRIBUTES -returns all attributes supported by KVM. The only attribute defined at this -time is KVM_MEMORY_ATTRIBUTE_PRIVATE, which marks the associated gfn as being -guest private memory. +returns all attributes supported by KVM. The attribute defined at this +time are: + + - KVM_MEMORY_ATTRIBUTE_NR/NW/NX - Respectively marks the memory region as + non-read, non-write and/or non-exec. Note that write-only, exec-only and + write-exec mappings are not supported. + - KVM_MEMORY_ATTRIBUTE_PRIVATE - Which marks the associated gfn as being guest + private memory. Note, there is no "get" API. Userspace is responsible for explicitly tracking the state of a gfn/page as needed. diff --git a/include/linux/kvm_host.h b/include/linux/kvm_host.h index 9250bf1c4db15..85378345e8e77 100644 --- a/include/linux/kvm_host.h +++ b/include/linux/kvm_host.h @@ -2411,6 +2411,21 @@ static inline void kvm_prepare_memory_fault_exit(struct kvm_vcpu *vcpu, vcpu->run->memory_fault.flags |= KVM_MEMORY_EXIT_FLAG_PRIVATE; } +static inline bool kvm_mem_attributes_may_read(u64 attrs) +{ + return !(attrs & KVM_MEMORY_ATTRIBUTE_NR); +} + +static inline bool kvm_mem_attributes_may_write(u64 attrs) +{ + return !(attrs & KVM_MEMORY_ATTRIBUTE_NW); +} + +static inline bool kvm_mem_attributes_may_exec(u64 attrs) +{ + return !(attrs & KVM_MEMORY_ATTRIBUTE_NX); +} + #ifdef CONFIG_KVM_GENERIC_MEMORY_ATTRIBUTES static inline unsigned long kvm_get_memory_attributes(struct kvm *kvm, gfn_t gfn) { @@ -2423,7 +2438,7 @@ bool kvm_arch_pre_set_memory_attributes(struct kvm *kvm, struct kvm_gfn_range *range); bool kvm_arch_post_set_memory_attributes(struct kvm *kvm, struct kvm_gfn_range *range); - +bool kvm_mem_attributes_valid(struct kvm *kvm, unsigned long attrs); static inline bool kvm_memory_attributes_in_use(struct kvm *kvm) { return !xa_empty(&kvm->mem_attr_array); @@ -2435,6 +2450,11 @@ static inline bool kvm_mem_is_private(struct kvm *kvm, gfn_t gfn) kvm_get_memory_attributes(kvm, gfn) & KVM_MEMORY_ATTRIBUTE_PRIVATE; } #else +static inline bool kvm_mem_attributes_valid(struct kvm *kvm, + unsigned long attrs) +{ + return false; +} static inline bool kvm_memory_attributes_in_use(struct kvm *kvm) { return false; diff --git a/include/uapi/linux/kvm.h b/include/uapi/linux/kvm.h index 516d39910f9ab..26d4477dae8c6 100644 --- a/include/uapi/linux/kvm.h +++ b/include/uapi/linux/kvm.h @@ -1550,6 +1550,9 @@ struct kvm_memory_attributes { __u64 flags; }; +#define KVM_MEMORY_ATTRIBUTE_NR (1ULL << 0) +#define KVM_MEMORY_ATTRIBUTE_NW (1ULL << 1) +#define KVM_MEMORY_ATTRIBUTE_NX (1ULL << 2) #define KVM_MEMORY_ATTRIBUTE_PRIVATE (1ULL << 3) #define KVM_CREATE_GUEST_MEMFD _IOWR(KVMIO, 0xd4, struct kvm_create_guest_memfd) diff --git a/virt/kvm/kvm_main.c b/virt/kvm/kvm_main.c index 63c4b6739edee..bd27fc01e9715 100644 --- a/virt/kvm/kvm_main.c +++ b/virt/kvm/kvm_main.c @@ -2430,10 +2430,14 @@ bool kvm_range_has_memory_attributes(struct kvm *kvm, gfn_t start, gfn_t end, static u64 kvm_supported_mem_attributes(struct kvm *kvm) { + u64 supported_attrs = KVM_MEMORY_ATTRIBUTE_NR | + KVM_MEMORY_ATTRIBUTE_NW | + KVM_MEMORY_ATTRIBUTE_NX; + if (!kvm || kvm_arch_has_private_mem(kvm)) - return KVM_MEMORY_ATTRIBUTE_PRIVATE; + supported_attrs |= KVM_MEMORY_ATTRIBUTE_PRIVATE; - return 0; + return supported_attrs; } static __always_inline void kvm_handle_gfn_range(struct kvm *kvm, @@ -2557,6 +2561,28 @@ static int kvm_vm_set_mem_attributes(struct kvm *kvm, gfn_t start, gfn_t end, return r; } + +bool kvm_mem_attributes_valid(struct kvm *kvm, unsigned long attrs) +{ + bool may_read = kvm_mem_attributes_may_read(attrs); + bool may_write = kvm_mem_attributes_may_write(attrs); + bool may_exec = kvm_mem_attributes_may_exec(attrs); + bool priv = attrs & KVM_MEMORY_ATTRIBUTE_PRIVATE; + + if (attrs & ~kvm_supported_mem_attributes(kvm)) + return false; + + /* Private memory and access permissions are incompatible */ + if (priv && (!may_read || !may_write || !may_exec)) + return false; + + /* Write and exec mappings require read access */ + if ((may_write || may_exec) && !may_read) + return false; + + return true; +} + static int kvm_vm_ioctl_set_mem_attributes(struct kvm *kvm, struct kvm_memory_attributes *attrs) { @@ -2565,7 +2591,7 @@ static int kvm_vm_ioctl_set_mem_attributes(struct kvm *kvm, /* flags is currently not used. */ if (attrs->flags) return -EINVAL; - if (attrs->attributes & ~kvm_supported_mem_attributes(kvm)) + if (!kvm_mem_attributes_valid(kvm, attrs->attributes)) return -EINVAL; if (attrs->size == 0 || attrs->address + attrs->size < attrs->address) return -EINVAL; -- 2.40.1