[PATCH 17/45] KVM: Introduce NR/NW/NX memory attributes
From: Paolo Bonzini
Date: Mon Nov 02 2026 - 16:12:40 EST
From: Nicolas Saenz Julienne <nsaenz@xxxxxxxxxx>
Introduce memory attributes to map guest physical memory regions as
non-readable, non-writable, and/or non-executable. Only a subset of flag
combinations is supported. Notably write and exec permissions require
read permission, and memory protection attributes are incompatible with
private memory.
As mentioned in 5a475554db1e ("KVM: Introduce per-page memory attributes",
2023-11-13), bits 0-2 of the memory attributes were reserved for RWX
protection; they are negated to support current memory attribute users
which use 0 to indicate no special treatment. Since 0 is not available,
a non-negated version of the flags would need an extra bit to express
no-access (R=0/W=0/X=0) mappings.
Unfortunately this precaution did not age too well; KVM now supports
MBEC/GMET and adding mode-based memory protections will require a
non-contiguous bit. But that's something left for later.
Different architectures may have different limitations on the set of
valid protections, for example execution-only and XU=0 mappings are
supported by Intel but not AMD processors[1]. So, add an architecture-specific
callback and add a basic implementation for x86.
[1] When adding support for MBEC/GMET, since NX would remain to mean no
execution at all, it is possible to use either an NXS bit or two
separate NXS/NXU bits in addition to NX. The former would only
support permissions that are available with either MBEC or GMET.
Signed-off-by: Nicolas Saenz Julienne <nsaenz@xxxxxxxxxx>
Signed-off-by: Paolo Bonzini <pbonzini@xxxxxxxxxx>
Link: https://patch.msgid.link/20260918135030.171564-14-pbonzini@xxxxxxxxxx
Signed-off-by: Paolo Bonzini <pbonzini@xxxxxxxxxx>
---
Documentation/virt/kvm/api.rst | 29 +++++++++++++--
arch/x86/include/asm/kvm_host.h | 1 +
arch/x86/kvm/Kconfig | 2 +-
arch/x86/kvm/mmu/mmu.c | 63 ++++++++++++++++++++++++---------
arch/x86/kvm/x86.c | 2 --
include/linux/kvm_host.h | 28 +++++++++++++++
include/uapi/linux/kvm.h | 3 ++
virt/kvm/kvm_main.c | 46 ++++++++++++++++++++----
8 files changed, 145 insertions(+), 29 deletions(-)
diff --git a/Documentation/virt/kvm/api.rst b/Documentation/virt/kvm/api.rst
index d0f91687bdb9..ac8cd51bdada 100644
--- a/Documentation/virt/kvm/api.rst
+++ b/Documentation/virt/kvm/api.rst
@@ -6445,15 +6445,38 @@ of guest physical memory.
__u64 flags;
};
+ #define KVM_MEMORY_ATTRIBUTE_NR (1ULL << 0)
+ #define KVM_MEMORY_ATTRIBUTE_NW (1ULL << 1)
+ #define KVM_MEMORY_ATTRIBUTE_NX (1ULL << 2)
#define KVM_MEMORY_ATTRIBUTE_PRIVATE (1ULL << 3)
The address and size must be page aligned. The supported attributes can be
retrieved via ioctl(KVM_CHECK_EXTENSION) on KVM_CAP_MEMORY_ATTRIBUTES. If
executed on a VM, KVM_CAP_MEMORY_ATTRIBUTES precisely returns the attributes
supported by that VM. If executed at system scope, KVM_CAP_MEMORY_ATTRIBUTES
-returns all attributes supported by KVM. The only attribute defined at this
-time is KVM_MEMORY_ATTRIBUTE_PRIVATE, which marks the associated gfn as being
-guest private memory.
+returns all attributes supported by KVM. The attribute defined at this
+time are:
+
+ - KVM_MEMORY_ATTRIBUTE_NR/NW/NX - Respectively marks the memory region as
+ non-read, non-write and/or non-exec. Note that write-only, exec-only
+ and write-exec mappings are not supported. When accesses to page are
+ denied by memory attributes, KVM **can** inform userspace through a
+ KVM_EXIT_MEMORY_FAULT exit, and userspace is allowed to restart the
+ VM after fixing the issue.
+
+ Note however that while KVM tries to report failures as
+ KVM_EXIT_MEMORY_FAULT in as many cases as possible, in some cases such
+ accesses are not recoverable. KVM can report these accesses in the same
+ way as accesses to unmapped regions, for example as KVM_EXIT_SHUTDOWN,
+ KVM_EXIT_INTERNAL_ERROR, inject exceptions, or even by returning -EIO.
+ For exit reasons other than KVM_EXIT_MEMORY_FAULT, resetting the
+ attribute does not guarantee that execution can safely resume.
+
+ These attributes must therefore not be used as a replacement for
+ userfaultfd.
+
+ - KVM_MEMORY_ATTRIBUTE_PRIVATE - Which marks the associated gfn as being guest
+ private memory.
Note, there is no "get" API. Userspace is responsible for explicitly tracking
the state of a gfn/page as needed.
diff --git a/arch/x86/include/asm/kvm_host.h b/arch/x86/include/asm/kvm_host.h
index 25256d59cfde..6a35fd384a74 100644
--- a/arch/x86/include/asm/kvm_host.h
+++ b/arch/x86/include/asm/kvm_host.h
@@ -1882,6 +1882,7 @@ enum kvm_intr_type {
#define kvm_arch_has_gmem_convert() (!!kvm_x86_ops.gmem_make_private)
#endif
+#define kvm_arch_has_memory_protection_attr(kvm) (!(kvm)->arch.has_private_mem)
#define kvm_arch_has_readonly_mem(kvm) (!(kvm)->arch.has_protected_state)
#ifdef CONFIG_X86_64
diff --git a/arch/x86/kvm/Kconfig b/arch/x86/kvm/Kconfig
index 1719059570fb..3cde8bc5ff01 100644
--- a/arch/x86/kvm/Kconfig
+++ b/arch/x86/kvm/Kconfig
@@ -44,6 +44,7 @@ config KVM_X86
select KVM_GENERIC_PRE_FAULT_MEMORY
select KVM_WERROR if WERROR
select KVM_GUEST_MEMFD if X86_64
+ select KVM_VM_MEMORY_ATTRIBUTES
config KVM
tristate "Kernel-based Virtual Machine (KVM) support"
@@ -79,7 +80,6 @@ config KVM_WERROR
config KVM_PRIVATE_MEMATTR_VM
bool "Enable per-VM PRIVATE vs. SHARED attributes (for CoCo VMs)"
depends on KVM_SW_PROTECTED_VM || KVM_INTEL_TDX || KVM_AMD_SEV
- select KVM_VM_MEMORY_ATTRIBUTES
default KVM_INTEL_TDX || KVM_AMD_SEV
help
Enable support for tracking PRIVATE vs. SHARED memory using per-VM
diff --git a/arch/x86/kvm/mmu/mmu.c b/arch/x86/kvm/mmu/mmu.c
index b89517794034..6348669bf882 100644
--- a/arch/x86/kvm/mmu/mmu.c
+++ b/arch/x86/kvm/mmu/mmu.c
@@ -8190,7 +8190,6 @@ void kvm_mmu_pre_destroy_vm(struct kvm *kvm)
vhost_task_stop(kvm->arch.nx_huge_page_recovery_thread);
}
-#ifdef CONFIG_KVM_VM_MEMORY_ATTRIBUTES
static bool hugepage_test_mixed(struct kvm_memory_slot *slot, gfn_t gfn,
int level)
{
@@ -8213,19 +8212,27 @@ bool kvm_arch_pre_set_vm_memory_attributes(struct kvm *kvm,
struct kvm_gfn_range *range)
{
struct kvm_memory_slot *slot = range->slot;
+ bool flush = false;
int level;
/*
- * Zap SPTEs even if the slot can't be mapped PRIVATE. KVM x86 only
- * supports KVM_MEMORY_ATTRIBUTE_PRIVATE, and so it *seems* like KVM
- * can simply ignore such slots. But if userspace is making memory
- * PRIVATE, then KVM must prevent the guest from accessing the memory
- * as shared. And if userspace is making memory SHARED and this point
- * is reached, then at least one page within the range was previously
- * PRIVATE, i.e. the slot's possible hugepage ranges are changing.
- * Zapping SPTEs in this case ensures KVM will reassess whether or not
- * a hugepage can be used for affected ranges.
+ * For KVM_MEMORY_ATTRIBUTE_PRIVATE:
+ * Zap SPTEs even if the slot can't be mapped PRIVATE. KVM x86 only
+ * supports KVM_MEMORY_ATTRIBUTE_PRIVATE, and so it *seems* like KVM
+ * can simply ignore such slots. But if userspace is making memory
+ * PRIVATE, then KVM must prevent the guest from accessing the memory
+ * as shared. And if userspace is making memory SHARED and this point
+ * is reached, then at least one page within the range was previously
+ * PRIVATE, i.e. the slot's possible hugepage ranges are changing.
+ * Zapping SPTEs in this case ensures KVM will reassess whether or not
+ * a hugepage can be used for affected ranges.
+ *
+ * For KVM_MEMORY_ATTRIBUTE_NR/NW/NX:
+ * Zap even when loosening restrictions R=>RW, which is not strictly
+ * necessary, but will allow KVM to reasses whether a hugepage can be
+ * used for the affected pages.
*/
+
if (WARN_ON_ONCE(range->end <= range->start))
return false;
@@ -8259,12 +8266,17 @@ bool kvm_arch_pre_set_vm_memory_attributes(struct kvm *kvm,
}
/* Unmap the old attribute page. */
- if (range->arg.attributes & KVM_MEMORY_ATTRIBUTE_PRIVATE)
- range->attr_filter = KVM_FILTER_SHARED;
- else
- range->attr_filter = KVM_FILTER_PRIVATE;
+ range->attr_filter = KVM_FILTER_SHARED;
+ if ((kvm_supported_vm_mem_attributes(kvm) & ~KVM_MEMORY_ATTRIBUTE_PRIVATE) ||
+ (range->arg.attributes & KVM_MEMORY_ATTRIBUTE_PRIVATE))
+ flush |= kvm_unmap_gfn_range(kvm, range);
- return kvm_unmap_gfn_range(kvm, range);
+ range->attr_filter = KVM_FILTER_PRIVATE;
+ if (kvm->arch.has_private_mem &&
+ !(range->arg.attributes & KVM_MEMORY_ATTRIBUTE_PRIVATE))
+ flush |= kvm_unmap_gfn_range(kvm, range);
+
+ return flush;
}
@@ -8386,4 +8398,23 @@ void kvm_mmu_init_memslot_memory_attributes(struct kvm *kvm,
}
}
}
-#endif
+
+/* The bits are flipped but remain in the same position. */
+#define KVM_PROT_READ KVM_MEMORY_ATTRIBUTE_NR
+#define KVM_PROT_WRITE KVM_MEMORY_ATTRIBUTE_NW
+#define KVM_PROT_EXEC KVM_MEMORY_ATTRIBUTE_NX
+
+bool kvm_arch_mem_attributes_supported_prot(struct kvm *kvm, unsigned long attrs)
+{
+ unsigned long prot = (attrs & KVM_MEMORY_ATTRIBUTE_PROT) ^ KVM_MEMORY_ATTRIBUTE_PROT;
+
+ /* Private memory and access permissions are incompatible */
+ if (attrs & KVM_MEMORY_ATTRIBUTE_PRIVATE)
+ return false;
+
+ /* For now do now support exec-only, even though EPT can handle it. */
+ if (prot && !(prot & KVM_PROT_READ))
+ return false;
+
+ return true;
+}
diff --git a/arch/x86/kvm/x86.c b/arch/x86/kvm/x86.c
index c7970bcfdc24..63d48ac4e1c6 100644
--- a/arch/x86/kvm/x86.c
+++ b/arch/x86/kvm/x86.c
@@ -10263,9 +10263,7 @@ static int kvm_alloc_memslot_metadata(struct kvm *kvm,
}
}
-#ifdef CONFIG_KVM_VM_MEMORY_ATTRIBUTES
kvm_mmu_init_memslot_memory_attributes(kvm, slot);
-#endif
if (kvm_page_track_create_memslot(kvm, slot, npages))
goto out_free;
diff --git a/include/linux/kvm_host.h b/include/linux/kvm_host.h
index 3d0293ebc864..8442fb29a1ee 100644
--- a/include/linux/kvm_host.h
+++ b/include/linux/kvm_host.h
@@ -726,6 +726,15 @@ static inline int kvm_arch_vcpu_memslots_id(struct kvm_vcpu *vcpu)
}
#endif
+#ifdef kvm_arch_has_memory_protection_attr
+bool kvm_arch_mem_attributes_supported_prot(struct kvm *kvm, unsigned long attrs);
+#else
+static inline bool kvm_arch_has_memory_protection_attr(struct kvm *kvm)
+{
+ return false;
+}
+#endif
+
#ifndef kvm_arch_has_readonly_mem
static inline bool kvm_arch_has_readonly_mem(struct kvm *kvm)
{
@@ -2577,12 +2586,31 @@ static inline bool kvm_memslot_is_gmem_only(const struct kvm_memory_slot *slot)
return slot->flags & KVM_MEMSLOT_GMEM_ONLY;
}
+#define KVM_MEMORY_ATTRIBUTE_PROT \
+ (KVM_MEMORY_ATTRIBUTE_NR | KVM_MEMORY_ATTRIBUTE_NW | KVM_MEMORY_ATTRIBUTE_NX)
+
+static inline bool kvm_mem_attributes_may_read(u64 attrs)
+{
+ return !(attrs & KVM_MEMORY_ATTRIBUTE_NR);
+}
+
+static inline bool kvm_mem_attributes_may_write(u64 attrs)
+{
+ return !(attrs & KVM_MEMORY_ATTRIBUTE_NW);
+}
+
+static inline bool kvm_mem_attributes_may_exec(u64 attrs)
+{
+ return !(attrs & KVM_MEMORY_ATTRIBUTE_NX);
+}
+
#ifdef CONFIG_KVM_VM_MEMORY_ATTRIBUTES
static inline unsigned long kvm_get_vm_memory_attributes(struct kvm *kvm, gfn_t gfn)
{
return xa_to_value(xa_load(&kvm->mem_attr_array, gfn));
}
+bool kvm_vm_mem_attributes_valid(struct kvm *kvm, unsigned long attrs);
bool kvm_range_has_vm_memory_attributes(struct kvm *kvm, gfn_t start, gfn_t end,
unsigned long mask, unsigned long attrs);
bool kvm_arch_pre_set_vm_memory_attributes(struct kvm *kvm,
diff --git a/include/uapi/linux/kvm.h b/include/uapi/linux/kvm.h
index 4e0bab3db95c..5cced8e4aa21 100644
--- a/include/uapi/linux/kvm.h
+++ b/include/uapi/linux/kvm.h
@@ -1673,6 +1673,9 @@ struct kvm_memory_attributes2 {
__u64 reserved[11];
};
+#define KVM_MEMORY_ATTRIBUTE_NR (1ULL << 0)
+#define KVM_MEMORY_ATTRIBUTE_NW (1ULL << 1)
+#define KVM_MEMORY_ATTRIBUTE_NX (1ULL << 2)
#define KVM_MEMORY_ATTRIBUTE_PRIVATE (1ULL << 3)
#define KVM_CREATE_GUEST_MEMFD _IOWR(KVMIO, 0xd4, struct kvm_create_guest_memfd)
diff --git a/virt/kvm/kvm_main.c b/virt/kvm/kvm_main.c
index 17341c689d11..717d7aec9a6c 100644
--- a/virt/kvm/kvm_main.c
+++ b/virt/kvm/kvm_main.c
@@ -2473,13 +2473,28 @@ static u64 kvm_supports_private_mem(struct kvm *kvm)
#define kvm_supports_private_mem(kvm) false
#endif
+
+#ifdef kvm_arch_has_memory_protection_attr
+static u64 kvm_supports_memory_protection_attr(struct kvm *kvm)
+{
+ return !kvm || kvm_arch_has_memory_protection_attr(kvm);
+}
+#else
+#define kvm_supports_private_mem(kvm) false
+#endif
+
#ifdef CONFIG_KVM_VM_MEMORY_ATTRIBUTES
u64 kvm_supported_vm_mem_attributes(struct kvm *kvm)
{
- if (gmem_in_place_conversion || !kvm_supports_private_mem(kvm))
- return 0;
+ u64 supported_attrs = 0;
- return KVM_MEMORY_ATTRIBUTE_PRIVATE;
+ if (kvm_supports_memory_protection_attr(kvm))
+ supported_attrs |= KVM_MEMORY_ATTRIBUTE_PROT;
+
+ if (!gmem_in_place_conversion && kvm_supports_private_mem(kvm))
+ supported_attrs |= KVM_MEMORY_ATTRIBUTE_PRIVATE;
+
+ return supported_attrs;
}
/*
@@ -2600,9 +2615,7 @@ static bool kvm_pre_set_vm_memory_attributes(struct kvm *kvm,
{
/*
* Unconditionally add the range to the invalidation set, regardless of
- * whether or not the arch callback actually needs to zap SPTEs. E.g.
- * if KVM supports RWX attributes in the future and the attributes are
- * going from R=>RW, zapping isn't strictly necessary. Unconditionally
+ * whether or not the arch callback actually needs to zap SPTEs. Always
* adding the range allows KVM to require that MMU invalidations add at
* least one range between begin() and end(), e.g. allows KVM to detect
* bugs where the add() is missed. Relaxing the rule *might* be safe,
@@ -2678,6 +2691,25 @@ static int kvm_set_vm_mem_attributes(struct kvm *kvm, gfn_t start, gfn_t end,
return r;
}
+
+bool __weak kvm_arch_mem_attributes_supported_prot(struct kvm *kvm, unsigned long attrs)
+{
+ WARN_ONCE(true, "KVM_MEMORY_ATTRIBUTE_PROT requires kvm_arch_mem_attributes_supported_prot()");
+ return false;
+}
+
+bool kvm_vm_mem_attributes_valid(struct kvm *kvm, unsigned long attrs)
+{
+ if (attrs & ~kvm_supported_vm_mem_attributes(kvm))
+ return false;
+
+ if ((attrs & KVM_MEMORY_ATTRIBUTE_PROT) &&
+ !kvm_arch_mem_attributes_supported_prot(kvm, attrs))
+ return false;
+
+ return true;
+}
+
static int kvm_vm_ioctl_set_mem_attributes(struct kvm *kvm,
struct kvm_memory_attributes *attrs)
{
@@ -2686,7 +2718,7 @@ static int kvm_vm_ioctl_set_mem_attributes(struct kvm *kvm,
/* flags is currently not used. */
if (attrs->flags)
return -EINVAL;
- if (attrs->attributes & ~kvm_supported_vm_mem_attributes(kvm))
+ if (!kvm_vm_mem_attributes_valid(kvm, attrs->attributes))
return -EINVAL;
if (attrs->size == 0 || attrs->address + attrs->size < attrs->address)
return -EINVAL;
--
2.52.0