Re: [PATCH v3 00/28] KVM: x86: Introduce memory protection attributes
From: Paolo Bonzini
Date: Fri Sep 18 2026 - 11:58:16 EST
On 9/18/26 15:49, Paolo Bonzini wrote:
[cover letter copied from v2 - sorry for the very quick turnaround
but it's pointless to ask for reviews with the issues reported by
sashiko]
This series introduces a mechanism to let userspace block read,
write or execute access to individual GFNs via KVM's memory
attribute mechanism, and have them reported via KVM_EXIT_MEMORY_FAULT.
It is mostly the work of Nicolas Saenz Julienne, with my working
consisting in reorganization, code cleanup, and using the recently
revamped MMU code (ACC_* masks and kvm_page_format).
KVM needs to check the attributes anytime KVM takes GPAs as input for any
action initiated by the guest; if the memory attributes are incompatible
with such action, it should be stopped. This means that there are quite
a lot of cases to handle. While some families of functions can be
handled in one step, there are simply many places that do memory access.
Along the way, the patches fix some issues in the memory attributes code,
that surfaced due to having more than one attribute.
Paolo
The remaining AI review issues (https://sashiko.dev/#/patchset/20260918135030.171564-2-pbonzini%40redhat.com) are simple or intentional with one exception:
- patch 21 - missing xas.xa_node == XAS_BOUNDS check, easy enough
- patch 26 - missing EFAULT returns from the emulator, need to look at it and write tests
- patch 28 - i think it should be fine, but it can also be fixed with cond_resched() if needed
- patch 31 - WRITE_ONCE can be used for completeness
If desired, patches 1 and 5 can be applied to stable and/or 7.2-rc.
Paolo
v2->v3 is just a bunch of sashiko fixes:
- new patch "KVM: x86/hyperv: do not overwrite hc->ingpa for slow
SIGNAL_EVENT hypercall"
- rewritten "KVM: apply nGPA->GPA translation to KVM_HC_CLOCK_PAIRING"
to handle cross-patch accesses
- rewrite choice of KVM_FILTER_SHARED/KVM_FILTER_PRIVATE prior to
setting memory attributes; even though the previous version worked,
it relied on not having any attribute at all for has_private_mem VMs
- fix WARN_ON_ONCE/WARN_ONCE confusion
- fix loongarch compilation
- new (not really satisfactory_ patch "KVM: Take memory protections into
account for __kvm_vcpu_map"
- fix incorrect NOT in "KVM: x86/mmu: Do not prefetch sptes on gfns backed
by memory attributes"
- do not use kvm_mmu_prepare_memory_fault_exit() for attribute exits on
PTEs
- new patch "KVM: let kvm_arch_post_set_memory_attributes drop mmu_lock"
- testcase fixes
Anish Moorthy (1):
KVM: Define and communicate KVM_EXIT_MEMORY_FAULT RWX flags to
userspace
Nicolas Saenz Julienne (12):
KVM: selftests: Take into account mixed memory fault flags
KVM: x86/mmu: Init memslot hugepage information for non-private_mem
VMs too
KVM: Introduce NR/NW/NX memory attributes
KVM: Include memory protections in result of gfn->hva conversion
KVM: Take memory protections into account for memory read/write/fetch
KVM: Encapsulate memattrs array into anonymous struct
KVM: Introduce a generation number for memory attributes
KVM: Take memory protections into account for accesses with cached
gfn->hva
KVM: pfncache: Fail to refresh if it contains memory protections
KVM: x86/mmu: Do not prefetch sptes on gfns backed by memory
attributes
KVM: x86/mmu: Take memory protection attributes into account during
faults
KVM: x86/mmu: Issue memory fault exit if walk failed due to memory
attribute
Paolo Bonzini (18):
KVM: x86/hyperv: do not overwrite hc->ingpa for slow SIGNAL_EVENT
hypercall
KVM: selftests: Test address translation for Hyper-V direct L2
hypercalls
KVM: apply nGPA->GPA translation to KVM_HC_CLOCK_PAIRING
KVM: x86: Introduce memory fault on invalid hypercalls reads/writes
KVM: selftests: test hypercall memory fault exits
KVM: x86/mmu: intersect writability from __kvm_faultin_pfn with
fault->map_writable
KVM: x86/mmu: Extend map_writable to a full ACC_* mask
KVM: pass kvm == NULL case to kvm_arch_has_private_mem
KVM: adjust for presence of more than one attribute
KVM: Introduce kvm_fetch_guest_page() and use it for x86
KVM: Take memory protections into account for __kvm_vcpu_map
KVM: loongarch: do full validity check on the gfn-to-hva cache
KVM: Introduce kvm_check_gen()/kvm_memslots_check_gen()
KVM: let kvm_arch_post_set_memory_attributes drop mmu_lock
KVM: x86/mmu: Obsolete all roots if memattr contains gPTEs
KVM: x86: selftests: Introduce memory protection attributes test
KVM: x86: selftests: Introduce memory attributes PTE test
KVM: x86: selftests: Introduce memory attributes side-channel tests
Documentation/virt/kvm/api.rst | 38 +-
arch/loongarch/kvm/vcpu.c | 12 +-
arch/x86/include/asm/kvm_host.h | 4 +-
arch/x86/kvm/Kconfig | 4 +-
arch/x86/kvm/hyperv.c | 172 +++++--
arch/x86/kvm/mmu/mmu.c | 183 +++++--
arch/x86/kvm/mmu/mmu_internal.h | 21 +-
arch/x86/kvm/mmu/mmutrace.h | 36 ++
arch/x86/kvm/mmu/paging_tmpl.h | 25 +-
arch/x86/kvm/mmu/spte.c | 12 +-
arch/x86/kvm/mmu/spte.h | 13 +-
arch/x86/kvm/mmu/tdp_mmu.c | 2 +-
arch/x86/kvm/x86.c | 66 ++-
include/linux/kvm_host.h | 128 ++++-
include/linux/kvm_types.h | 6 +-
include/trace/events/kvm.h | 14 +-
include/uapi/linux/kvm.h | 7 +
tools/include/uapi/linux/kvm.h | 3 +
tools/testing/selftests/kvm/Makefile.kvm | 2 +
.../testing/selftests/kvm/include/kvm_util.h | 32 +-
.../selftests/kvm/include/x86/processor.h | 1 +
.../testing/selftests/kvm/lib/x86/processor.c | 5 +
.../testing/selftests/kvm/memory_attributes.c | 453 ++++++++++++++++++
tools/testing/selftests/kvm/x86/hcall_fault.c | 246 ++++++++++
.../testing/selftests/kvm/x86/hyperv_evmcs.c | 16 +-
.../selftests/kvm/x86/hyperv_svm_test.c | 15 +-
.../selftests/kvm/x86/memory_attributes.c | 415 ++++++++++++++++
.../kvm/x86/private_mem_kvm_exits_test.c | 6 +-
virt/kvm/kvm_main.c | 271 +++++++++--
virt/kvm/pfncache.c | 30 +-
30 files changed, 2027 insertions(+), 211 deletions(-)
create mode 100644 tools/testing/selftests/kvm/memory_attributes.c
create mode 100644 tools/testing/selftests/kvm/x86/hcall_fault.c
create mode 100644 tools/testing/selftests/kvm/x86/memory_attributes.c