This series introduces a mechanism to let userspace block read,
write or execute access to individual GFNs via KVM's memory
attribute mechanism, and have them reported via KVM_EXIT_MEMORY_FAULT.
It is mostly the work of Nicolas Saenz Julienne, with a bit of patch
reorganization and code cleanup on my side (and especially using the
revamped ACC_* mask in Linux 7.2).

The reason why it's so large is because  KVM needs to should check the
attributes anytime KVM takes GPAs as input for any action initiated by
the guest; if the memory attributes are incompatible with such action,
it should be stopped.  For more information see
https://lore.kernel.org/kvm/D3MJJCTNY7OM.WOB5W8AVBH9G@amazon.com/.

There are several bits missing:

- hypercall handling for non-HyperV hypercalls is untested.  Xen
  hypercalls are not a big deal (at least for me...) because userspace
  can always avoid using this feature together with Xen emulation,
  but KVM_HC_CLOCK_PAIRING can write to memory.  It should at least
  be tested!

- nested virtualization is untested and there is a known hole
  in patch 21

- MBEC/GMET support should be added too, I have taken it into account
  when rebasing Nicolas's work but haven't written the code yet

- the split between arch-independent and arch-dependent code in
  the tests can be improved.

- the pvclock test fails

The original idea for posting this was to let Sashiko loose on it.
Unfortunately, it probably won't be able to apply the patches :(
because they are based on kvm/next, so here it is in all its glory
for humans only.

Paolo

Anish Moorthy (1):
  KVM: Define and communicate KVM_EXIT_MEMORY_FAULT RWX flags to
    userspace

Nicolas Saenz Julienne (19):
  KVM: selftests: Take into account mixed memory fault flags
  KVM: x86: hyperv: Introduce memory fault on hcalls with bad ingpas
  KVM: x86: Avoid warning when installing non-private memory attributes
  KVM: x86/mmu: Init memslot hugepage information for non-private_mem VMs too
  KVM: Introduce NR/NW/NX memory attributes
  KVM: Include memory protections in result of gfn->hva conversion
  KVM: Take memory protections into account in kvm_read/write_guest()
  KVM: Encapsulate memattrs array into anonymous struct
  KVM: Introduce a generation number for memory attributes
  KVM: Take memory protections into account for accesses with cached gfn->hva
  KVM: pfncache: Fail to refresh if it contains memory protections
  KVM: x86/mmu: Take memory protection attributes into account during faults
  KVM: x86/mmu: Issue memory fault exit if walk failed due to memory attribute
  KVM: x86/mmu: Do not update accessed/dirty if guest PTE is read-only
  KVM: x86/mmu: Do not prefetch sptes on gfns backed by memory attributes
  KVM: x86/mmu: Obsolete all roots if memattr contains gPTEs
  KVM: x86: selftests: Introduce memory attributes test
  KVM: x86: selftests: Introduce memory attributes PTE test
  KVM: x86: selftests: Introduce memory attributes side-channel tests

Paolo Bonzini (4):
  KVM: x86/mmu: intersect writability from __kvm_faultin_pfn with
    fault->map_writable
  KVM: x86/mmu: Extend map_writable to a full ACC_* mask
  KVM: pass kvm == NULL case to kvm_arch_has_private_mem
  KVM: Introduce kvm_check_gen()/kvm_memslots_check_gen()

 Documentation/virt/kvm/api.rst                |  19 +-
 arch/x86/include/asm/kvm_host.h               |   4 +-
 arch/x86/kvm/Kconfig                          |   4 +-
 arch/x86/kvm/hyperv.c                         |  32 ++
 arch/x86/kvm/mmu/mmu.c                        | 193 ++++++--
 arch/x86/kvm/mmu/mmu_internal.h               |  21 +-
 arch/x86/kvm/mmu/mmutrace.h                   |  29 ++
 arch/x86/kvm/mmu/paging_tmpl.h                |  25 +-
 arch/x86/kvm/mmu/spte.c                       |  12 +-
 arch/x86/kvm/mmu/spte.h                       |  13 +-
 arch/x86/kvm/mmu/tdp_mmu.c                    |   2 +-
 arch/x86/kvm/x86.c                            |  19 +-
 include/linux/kvm_host.h                      | 124 ++++-
 include/linux/kvm_types.h                     |   6 +-
 include/trace/events/kvm.h                    |  14 +-
 include/uapi/linux/kvm.h                      |   7 +
 tools/include/uapi/linux/kvm.h                |   3 +
 tools/testing/selftests/kvm/Makefile.kvm      |   1 +
 .../testing/selftests/kvm/include/kvm_util.h  |  33 +-
 .../selftests/kvm/include/x86/processor.h     |   1 +
 .../testing/selftests/kvm/lib/x86/processor.c |   5 +
 .../testing/selftests/kvm/memory_attributes.c | 457 ++++++++++++++++++
 .../selftests/kvm/x86/memory_attributes.c     | 385 +++++++++++++++
 .../kvm/x86/private_mem_kvm_exits_test.c      |   6 +-
 virt/kvm/kvm_main.c                           | 224 +++++++--
 virt/kvm/pfncache.c                           |  30 +-
 26 files changed, 1529 insertions(+), 140 deletions(-)
 create mode 100644 tools/testing/selftests/kvm/memory_attributes.c
 create mode 100644 tools/testing/selftests/kvm/x86/memory_attributes.c

-- 
2.52.0

On Thu Jul 16, 2026 at 8:14 PM CEST, Paolo Bonzini wrote:
> CAUTION: This email originated from outside of the organization. Do not click links or open attachments unless you can confirm the sender and know the content is safe.
>
> This series introduces a mechanism to let userspace block read,
> write or execute access to individual GFNs via KVM's memory
> attribute mechanism, and have them reported via KVM_EXIT_MEMORY_FAULT.
> It is mostly the work of Nicolas Saenz Julienne, with a bit of patch
> reorganization and code cleanup on my side (and especially using the
> revamped ACC_* mask in Linux 7.2).
>
> The reason why it's so large is because  KVM needs to should check the
> attributes anytime KVM takes GPAs as input for any action initiated by
> the guest; if the memory attributes are incompatible with such action,
> it should be stopped.  For more information see
> https://lore.kernel.org/kvm/D3MJJCTNY7OM.WOB5W8AVBH9G@amazon.com/.
>
> There are several bits missing:
>
> - hypercall handling for non-HyperV hypercalls is untested.  Xen
>   hypercalls are not a big deal (at least for me...) because userspace
>   can always avoid using this feature together with Xen emulation,
>   but KVM_HC_CLOCK_PAIRING can write to memory.  It should at least
>   be tested!
>
> - nested virtualization is untested and there is a known hole
>   in patch 21
>
> - MBEC/GMET support should be added too, I have taken it into account
>   when rebasing Nicolas's work but haven't written the code yet
>
> - the split between arch-independent and arch-dependent code in
>   the tests can be improved.
>
> - the pvclock test fails
>

Hi Paolo, thanks for having a go at this! Two small commments.

I never got to look into the interaction between RWX memattrs and
instruction emulation. There is a lot of operations that end up reading
guest memory. I fear we might have to intercept all these, and it will
not be pretty as they happen deep within the emulator framework.

Do we really want to support this on non-TDP configs? I had a hard time
finding and fixing sidechannels in shadow-paging, and I'm pretty sure I
missed some. On the other hand, I can't picture any real-world scenario
where a user would need to use RWX memattrs with TDP disabled.

Nicolas