Re: [RFC PATCH 00/24] KVM: x86: Introduce memory protection attributes

[Saenz Julienne, Nicolas]

On Thu Jul 16, 2026 at 8:14 PM CEST, Paolo Bonzini wrote:
> CAUTION: This email originated from outside of the organization. Do not click links or open attachments unless you can confirm the sender and know the content is safe.
>
> This series introduces a mechanism to let userspace block read,
> write or execute access to individual GFNs via KVM's memory
> attribute mechanism, and have them reported via KVM_EXIT_MEMORY_FAULT.
> It is mostly the work of Nicolas Saenz Julienne, with a bit of patch
> reorganization and code cleanup on my side (and especially using the
> revamped ACC_* mask in Linux 7.2).
>
> The reason why it's so large is because  KVM needs to should check the
> attributes anytime KVM takes GPAs as input for any action initiated by
> the guest; if the memory attributes are incompatible with such action,
> it should be stopped.  For more information see
> https://lore.kernel.org/kvm/D3MJJCTNY7OM.WOB5W8AVBH9G@xxxxxxxxxx/.
>
> There are several bits missing:
>
> - hypercall handling for non-HyperV hypercalls is untested.  Xen
>   hypercalls are not a big deal (at least for me...) because userspace
>   can always avoid using this feature together with Xen emulation,
>   but KVM_HC_CLOCK_PAIRING can write to memory.  It should at least
>   be tested!
>
> - nested virtualization is untested and there is a known hole
>   in patch 21
>
> - MBEC/GMET support should be added too, I have taken it into account
>   when rebasing Nicolas's work but haven't written the code yet
>
> - the split between arch-independent and arch-dependent code in
>   the tests can be improved.
>
> - the pvclock test fails
>

Hi Paolo, thanks for having a go at this! Two small commments.

I never got to look into the interaction between RWX memattrs and
instruction emulation. There is a lot of operations that end up reading
guest memory. I fear we might have to intercept all these, and it will
not be pretty as they happen deep within the emulator framework.

Do we really want to support this on non-TDP configs? I had a hard time
finding and fixing sidechannels in shadow-paging, and I'm pretty sure I
missed some. On the other hand, I can't picture any real-world scenario
where a user would need to use RWX memattrs with TDP disabled.

Nicolas