Re: [PATCH v3 00/28] KVM: x86: Introduce memory protection attributes

[Paolo Bonzini <pbonzini@redhat.com>]

On 9/18/26 15:49, Paolo Bonzini wrote:
> [cover letter copied from v2 - sorry for the very quick turnaround
> but it's pointless to ask for reviews with the issues reported by
> sashiko]
> 
> This series introduces a mechanism to let userspace block read,
> write or execute access to individual GFNs via KVM's memory
> attribute mechanism, and have them reported via KVM_EXIT_MEMORY_FAULT.
> It is mostly the work of Nicolas Saenz Julienne, with my working
> consisting in reorganization, code cleanup, and using the recently
> revamped MMU code (ACC_* masks and kvm_page_format).
> 
> KVM needs to check the attributes anytime KVM takes GPAs as input for any
> action initiated by the guest; if the memory attributes are incompatible
> with such action, it should be stopped.  This means that there are quite
> a lot of cases to handle.  While some families of functions can be
> handled in one step, there are simply many places that do memory access.
> 
> Along the way, the patches fix some issues in the memory attributes code,
> that surfaced due to having more than one attribute.
> 
> Paolo

The remaining AI review issues 
(https://sashiko.dev/#/patchset/20260918135030.171564-2-pbonzini%40redhat.com) 
are simple or intentional with one exception:

- patch 21 - missing xas.xa_node == XAS_BOUNDS check, easy enough

- patch 26 - missing EFAULT returns from the emulator, need to look at 
it and write tests

- patch 28 - i think it should be fine, but it can also be fixed with 
cond_resched() if needed

- patch 31 - WRITE_ONCE can be used for completeness

If desired, patches 1 and 5 can be applied to stable and/or 7.2-rc.

Paolo

> 
> v2->v3 is just a bunch of sashiko fixes:
> - new patch "KVM: x86/hyperv: do not overwrite hc->ingpa for slow
>    SIGNAL_EVENT hypercall"
> - rewritten "KVM: apply nGPA->GPA translation to KVM_HC_CLOCK_PAIRING"
>    to handle cross-patch accesses
> - rewrite choice of KVM_FILTER_SHARED/KVM_FILTER_PRIVATE prior to
>    setting memory attributes; even though the previous version worked,
>    it relied on not having any attribute at all for has_private_mem VMs
> - fix WARN_ON_ONCE/WARN_ONCE confusion
> - fix loongarch compilation
> - new (not really satisfactory_ patch "KVM: Take memory protections into
>    account for __kvm_vcpu_map"
> - fix incorrect NOT in "KVM: x86/mmu: Do not prefetch sptes on gfns backed
>    by memory attributes"
> - do not use kvm_mmu_prepare_memory_fault_exit() for attribute exits on
>    PTEs
> - new patch "KVM: let kvm_arch_post_set_memory_attributes drop mmu_lock"
> - testcase fixes
> 
> Anish Moorthy (1):
>    KVM: Define and communicate KVM_EXIT_MEMORY_FAULT RWX flags to
>      userspace
> 
> Nicolas Saenz Julienne (12):
>    KVM: selftests: Take into account mixed memory fault flags
>    KVM: x86/mmu: Init memslot hugepage information for non-private_mem
>      VMs too
>    KVM: Introduce NR/NW/NX memory attributes
>    KVM: Include memory protections in result of gfn->hva conversion
>    KVM: Take memory protections into account for memory read/write/fetch
>    KVM: Encapsulate memattrs array into anonymous struct
>    KVM: Introduce a generation number for memory attributes
>    KVM: Take memory protections into account for accesses with cached
>      gfn->hva
>    KVM: pfncache: Fail to refresh if it contains memory protections
>    KVM: x86/mmu: Do not prefetch sptes on gfns backed by memory
>      attributes
>    KVM: x86/mmu: Take memory protection attributes into account during
>      faults
>    KVM: x86/mmu: Issue memory fault exit if walk failed due to memory
>      attribute
> 
> Paolo Bonzini (18):
>    KVM: x86/hyperv: do not overwrite hc->ingpa for slow SIGNAL_EVENT
>      hypercall
>    KVM: selftests: Test address translation for Hyper-V direct L2
>      hypercalls
>    KVM: apply nGPA->GPA translation to KVM_HC_CLOCK_PAIRING
>    KVM: x86: Introduce memory fault on invalid hypercalls reads/writes
>    KVM: selftests: test hypercall memory fault exits
>    KVM: x86/mmu: intersect writability from __kvm_faultin_pfn with
>      fault->map_writable
>    KVM: x86/mmu: Extend map_writable to a full ACC_* mask
>    KVM: pass kvm == NULL case to kvm_arch_has_private_mem
>    KVM: adjust for presence of more than one attribute
>    KVM: Introduce kvm_fetch_guest_page() and use it for x86
>    KVM: Take memory protections into account for __kvm_vcpu_map
>    KVM: loongarch: do full validity check on the gfn-to-hva cache
>    KVM: Introduce kvm_check_gen()/kvm_memslots_check_gen()
>    KVM: let kvm_arch_post_set_memory_attributes drop mmu_lock
>    KVM: x86/mmu: Obsolete all roots if memattr contains gPTEs
>    KVM: x86: selftests: Introduce memory protection attributes test
>    KVM: x86: selftests: Introduce memory attributes PTE test
>    KVM: x86: selftests: Introduce memory attributes side-channel tests
> 
>   Documentation/virt/kvm/api.rst                |  38 +-
>   arch/loongarch/kvm/vcpu.c                     |  12 +-
>   arch/x86/include/asm/kvm_host.h               |   4 +-
>   arch/x86/kvm/Kconfig                          |   4 +-
>   arch/x86/kvm/hyperv.c                         | 172 +++++--
>   arch/x86/kvm/mmu/mmu.c                        | 183 +++++--
>   arch/x86/kvm/mmu/mmu_internal.h               |  21 +-
>   arch/x86/kvm/mmu/mmutrace.h                   |  36 ++
>   arch/x86/kvm/mmu/paging_tmpl.h                |  25 +-
>   arch/x86/kvm/mmu/spte.c                       |  12 +-
>   arch/x86/kvm/mmu/spte.h                       |  13 +-
>   arch/x86/kvm/mmu/tdp_mmu.c                    |   2 +-
>   arch/x86/kvm/x86.c                            |  66 ++-
>   include/linux/kvm_host.h                      | 128 ++++-
>   include/linux/kvm_types.h                     |   6 +-
>   include/trace/events/kvm.h                    |  14 +-
>   include/uapi/linux/kvm.h                      |   7 +
>   tools/include/uapi/linux/kvm.h                |   3 +
>   tools/testing/selftests/kvm/Makefile.kvm      |   2 +
>   .../testing/selftests/kvm/include/kvm_util.h  |  32 +-
>   .../selftests/kvm/include/x86/processor.h     |   1 +
>   .../testing/selftests/kvm/lib/x86/processor.c |   5 +
>   .../testing/selftests/kvm/memory_attributes.c | 453 ++++++++++++++++++
>   tools/testing/selftests/kvm/x86/hcall_fault.c | 246 ++++++++++
>   .../testing/selftests/kvm/x86/hyperv_evmcs.c  |  16 +-
>   .../selftests/kvm/x86/hyperv_svm_test.c       |  15 +-
>   .../selftests/kvm/x86/memory_attributes.c     | 415 ++++++++++++++++
>   .../kvm/x86/private_mem_kvm_exits_test.c      |   6 +-
>   virt/kvm/kvm_main.c                           | 271 +++++++++--
>   virt/kvm/pfncache.c                           |  30 +-
>   30 files changed, 2027 insertions(+), 211 deletions(-)
>   create mode 100644 tools/testing/selftests/kvm/memory_attributes.c
>   create mode 100644 tools/testing/selftests/kvm/x86/hcall_fault.c
>   create mode 100644 tools/testing/selftests/kvm/x86/memory_attributes.c
>