mirror of
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
synced 2026-08-09 06:14:34 +02:00
Pratyush Yadav (Google)andAndrew Morton
8a552d68a8
File seals are used on memfd for making shared memory communication with untrusted peers safer and simpler. Seals provide a guarantee that certain operations won't be allowed on the file such as writes or truncations. Maintaining these guarantees across a live update will help keeping such use cases secure. These guarantees will also be needed for IOMMUFD preservation with LUO. Normally when IOMMUFD maps a memfd, it pins all its pages to make sure any truncation operations on the memfd don't lead to IOMMUFD using freed memory. This doesn't work with LUO since the preserved memfd might have completely different pages after a live update, and mapping them back to the IOMMUFD will cause all sorts of problems. Using and preserving the seals allows IOMMUFD preservation logic to trust the memfd. Since the uABI defines seals as an int, preserve them by introducing a new u32 field. There are currently only 6 possible seals, so the extra bits are unused and provide room for future expansion. Since the seals are uABI, it is safe to use them directly in the ABI. While at it, also add a u32 flags field. It makes sure the struct is nicely aligned, and can be used later to support things like MFD_CLOEXEC. Since the serialization structure is changed, bump the version number to "memfd-v2". It is important to note that the memfd-v2 version only supports seals that existed when this version was defined. This set is defined by MEMFD_LUO_ALL_SEALS. Any new seal might bring a completely different semantic with it and the parser for memfd-v2 cannot be expected to deal with that. If there are any future seals added, they will need another version bump. Link: https://lkml.kernel.org/r/20260216185946.1215770-3-pratyush@kernel.org Signed-off-by: Pratyush Yadav (Google) <pratyush@kernel.org> Tested-by: Samiullah Khawaja <skhawaja@google.com> Cc: Alexander Graf <graf@amazon.com> Cc: Baolin Wang <baolin.wang@linux.alibaba.com> Cc: Hugh Dickins <hughd@google.com> Cc: Jason Gunthorpe <jgg@nvidia.com> Cc: Mike Rapoport (Microsoft) <rppt@kernel.org> Cc: Pasha Tatashin <pasha.tatashin@soleen.com> Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
94 lines
2.7 KiB
C
94 lines
2.7 KiB
C
/* SPDX-License-Identifier: GPL-2.0 */
|
|
|
|
/*
|
|
* Copyright (c) 2025, Google LLC.
|
|
* Pasha Tatashin <pasha.tatashin@soleen.com>
|
|
*
|
|
* Copyright (C) 2025 Amazon.com Inc. or its affiliates.
|
|
* Pratyush Yadav <ptyadav@amazon.de>
|
|
*/
|
|
|
|
#ifndef _LINUX_KHO_ABI_MEMFD_H
|
|
#define _LINUX_KHO_ABI_MEMFD_H
|
|
|
|
#include <linux/types.h>
|
|
#include <linux/kho/abi/kexec_handover.h>
|
|
|
|
/**
|
|
* DOC: memfd Live Update ABI
|
|
*
|
|
* memfd uses the ABI defined below for preserving its state across a kexec
|
|
* reboot using the LUO.
|
|
*
|
|
* The state is serialized into a packed structure `struct memfd_luo_ser`
|
|
* which is handed over to the next kernel via the KHO mechanism.
|
|
*
|
|
* This interface is a contract. Any modification to the structure layout
|
|
* constitutes a breaking change. Such changes require incrementing the
|
|
* version number in the MEMFD_LUO_FH_COMPATIBLE string.
|
|
*/
|
|
|
|
/**
|
|
* MEMFD_LUO_FOLIO_DIRTY - The folio is dirty.
|
|
*
|
|
* This flag indicates the folio contains data from user. A non-dirty folio is
|
|
* one that was allocated (say using fallocate(2)) but not written to.
|
|
*/
|
|
#define MEMFD_LUO_FOLIO_DIRTY BIT(0)
|
|
|
|
/**
|
|
* MEMFD_LUO_FOLIO_UPTODATE - The folio is up-to-date.
|
|
*
|
|
* An up-to-date folio has been zeroed out. shmem zeroes out folios on first
|
|
* use. This flag tracks which folios need zeroing.
|
|
*/
|
|
#define MEMFD_LUO_FOLIO_UPTODATE BIT(1)
|
|
|
|
/**
|
|
* struct memfd_luo_folio_ser - Serialized state of a single folio.
|
|
* @pfn: The page frame number of the folio.
|
|
* @flags: Flags to describe the state of the folio.
|
|
* @index: The page offset (pgoff_t) of the folio within the original file.
|
|
*/
|
|
struct memfd_luo_folio_ser {
|
|
u64 pfn:52;
|
|
u64 flags:12;
|
|
u64 index;
|
|
} __packed;
|
|
|
|
/*
|
|
* The set of seals this version supports preserving. If support for any new
|
|
* seals is needed, add it here and bump version.
|
|
*/
|
|
#define MEMFD_LUO_ALL_SEALS (F_SEAL_SEAL | \
|
|
F_SEAL_SHRINK | \
|
|
F_SEAL_GROW | \
|
|
F_SEAL_WRITE | \
|
|
F_SEAL_FUTURE_WRITE | \
|
|
F_SEAL_EXEC)
|
|
|
|
/**
|
|
* struct memfd_luo_ser - Main serialization structure for a memfd.
|
|
* @pos: The file's current position (f_pos).
|
|
* @size: The total size of the file in bytes (i_size).
|
|
* @seals: The seals present on the memfd. The seals are uABI so it is safe
|
|
* to directly use them in the ABI.
|
|
* @flags: Flags for the file. Unused flag bits must be set to 0.
|
|
* @nr_folios: Number of folios in the folios array.
|
|
* @folios: KHO vmalloc descriptor pointing to the array of
|
|
* struct memfd_luo_folio_ser.
|
|
*/
|
|
struct memfd_luo_ser {
|
|
u64 pos;
|
|
u64 size;
|
|
u32 seals;
|
|
u32 flags;
|
|
u64 nr_folios;
|
|
struct kho_vmalloc folios;
|
|
} __packed;
|
|
|
|
/* The compatibility string for memfd file handler */
|
|
#define MEMFD_LUO_FH_COMPATIBLE "memfd-v2"
|
|
|
|
#endif /* _LINUX_KHO_ABI_MEMFD_H */
|