Re: [PATCH 02/24] KVM: Define and communicate KVM_EXIT_MEMORY_FAULT RWX flags to userspace

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 2 potential issue(s) to consider:

New issues:
- [Low] The newly introduced KVM_MEMORY_EXIT_FLAG_* UAPI flags are not synced to the tools/ directory.

Pre-existing issues:
- [High] ARM64 page fault handlers incorrectly report guest_memfd memory faults as shared by passing `is_private=false` to `kvm_prepare_memory_fault_exit`.
--

--- Patch [2]: [PATCH 02/24] KVM: Define and communicate KVM_EXIT_MEMORY_FAULT RWX flags to userspace ---
commit 2373c31f86321f944cc2fad5b744fcd833b349a9
Author: Anish Moorthy <amoorthy@google.com>

KVM: Define and communicate KVM_EXIT_MEMORY_FAULT RWX flags to userspace

kvm_prepare_memory_fault_exit() already takes parameters describing the
RWX-ness of the relevant access but doesn't actually do anything with
them. Define and use the flags necessary to pass this information on to
userspace.

Link: https://lore.kernel.org/kvm/ZR4N8cwzTMDanPUY@google.com/

> diff --git a/include/linux/kvm_host.h b/include/linux/kvm_host.h
> index ab8cfaec82d31..2278b17f2f289 100644
> --- a/include/linux/kvm_host.h
> +++ b/include/linux/kvm_host.h
[ ... ]
> @@ -2519,8 +2519,15 @@ static inline void kvm_prepare_memory_fault_exit(struct kvm_vcpu *vcpu,
>  	vcpu->run->memory_fault.gpa = gpa;
>  	vcpu->run->memory_fault.size = size;
>  
> -	/* RWX flags are not (yet) defined or communicated to userspace. */
>  	vcpu->run->memory_fault.flags = 0;
> +
> +	if (is_write)
> +		vcpu->run->memory_fault.flags |= KVM_MEMORY_EXIT_FLAG_WRITE;
> +	else if (is_exec)
> +		vcpu->run->memory_fault.flags |= KVM_MEMORY_EXIT_FLAG_EXEC;
> +	else
> +		vcpu->run->memory_fault.flags |= KVM_MEMORY_EXIT_FLAG_READ;
> +
>  	if (is_private)
>  		vcpu->run->memory_fault.flags |= KVM_MEMORY_EXIT_FLAG_PRIVATE;

[Severity: High]
This isn't a regression introduced by this patch, but does the ARM64 code
pass the incorrect is_private value for guest_memfd faults?

Looking at arch/arm64/kvm/mmu.c:gmem_abort(), KVM calls this with false for
a failure originating from kvm_gmem_get_pfn() on a private memory slot:

		kvm_prepare_memory_fault_exit(s2fd->vcpu, s2fd->fault_ipa, PAGE_SIZE,
					      write_fault, exec_fault, false);

Similarly in arch/arm64/kvm/nested.c:kvm_translate_vncr():

			kvm_prepare_memory_fault_exit(vcpu, vt->wr.pa, PAGE_SIZE,
					      write_fault, false, false);

Will this cause userspace to receive a KVM_EXIT_MEMORY_FAULT for a private
memory access with the KVM_MEMORY_EXIT_FLAG_PRIVATE bit incorrectly cleared?

>  }
> diff --git a/include/uapi/linux/kvm.h b/include/uapi/linux/kvm.h
> index 419011097fa8e..720b1ffe880b2 100644
> --- a/include/uapi/linux/kvm.h
> +++ b/include/uapi/linux/kvm.h
> @@ -457,6 +457,9 @@ struct kvm_run {
>  		} notify;
>  		/* KVM_EXIT_MEMORY_FAULT */
>  		struct {
> +#define KVM_MEMORY_EXIT_FLAG_READ       (1ULL << 0)
> +#define KVM_MEMORY_EXIT_FLAG_WRITE      (1ULL << 1)
> +#define KVM_MEMORY_EXIT_FLAG_EXEC       (1ULL << 2)

[Severity: Low]
Are these new flags missing from tools/include/uapi/linux/kvm.h?

Could this regression cause compilation errors or missing macros for tools
that rely on the in-tree tools/ copy of the UAPI headers?

>  #define KVM_MEMORY_EXIT_FLAG_PRIVATE	(1ULL << 3)
>  			__u64 flags;
>  			__u64 gpa;

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260716181456.402786-1-pbonzini@redhat.com?part=2