[PATCH v4 00/45] KVM: x86: Introduce memory protection attributes

[Paolo Bonzini <pbonzini@redhat.com>]

This series introduces a mechanism to let userspace block read,
write or execute access to individual GFNs via KVM's memory
attribute mechanism, and have them reported via KVM_EXIT_MEMORY_FAULT.

KVM needs to check the attributes anytime KVM takes GPAs as input for any
action initiated by the guest; if the memory attributes are incompatible
with such action, it should be stopped.  This means that there are quite
a lot of cases to handle, and while in most cases they occur before
committing to the execution of an instructions (for example, page walks),
there are other cases where a full implementation of attributes would
basically require an implementation of transactional memory accesses:
notably (from inevitable to where I finally drew the line) nested
virtualization, emulation, SMM switch, task switch.  In the worst case,
the processor might have executed the instruction before issuing a
trap-like vmexit - and if the instruction length is not provided and
the instruction is not accessible, there's no practical alternative
to returning -EIO and marking the VM as dead.

For this reason, documentation now clarifies that invalid accesses may not be
recoverable and may be reported in the same way as MMIO.

Along the way, the patches fix some issues in the memory attributes code,
that surfaced due to having more than one attribute.  Still, no matter
how careful I tried to be, I'm ready for the absolute massacre that
Sashiko will make of this stuff.

Paolo

v3->v4:
- New patch "KVM: nVMX/nSVM: check unconditionally whether CR3 is valid"
- New patch "KVM: x86/emulate: Check TSS busy-bit writes during task switches"
- Rebase on top of new VM memory attributes code
- Use kvm_check_gen in Longarch
- New patches to surface memory faults from the emulator and from nested
  GPA translation (15, 29-36, 38-39)
- Clarify in the docs that memory faults in some cases may not be recoverable

Anish Moorthy (1):
  KVM: Define and communicate KVM_EXIT_MEMORY_FAULT RWX flags to
    userspace

Nicolas Saenz Julienne (11):
  KVM: selftests: Take into account mixed memory fault flags
  KVM: x86/mmu: Init memslot hugepage information for non-private_mem
    VMs too
  KVM: Introduce NR/NW/NX memory attributes
  KVM: Include memory protections in result of gfn->hva conversion
  KVM: Take memory protections into account for memory read/write/fetch
  KVM: Encapsulate memattrs array into anonymous struct
  KVM: Introduce a generation number for memory attributes
  KVM: Take memory protections into account for accesses with cached
    gfn->hva
  KVM: pfncache: Fail to refresh if it contains memory protections
  KVM: x86/mmu: Do not prefetch sptes on gfns backed by memory
    attributes
  KVM: x86/mmu: Take memory protection attributes into account during
    faults

Paolo Bonzini (33):
  KVM: nVMX/nSVM: check unconditionally whether CR3 is valid
  KVM: x86/hyperv: do not overwrite hc->ingpa for SIGNAL_EVENT hypercall
  KVM: x86: apply nGPA->GPA translation to KVM_HC_CLOCK_PAIRING
  KVM: x86/emulate: Check TSS busy-bit writes during task switches
  KVM: loongarch: do full validity check on the gfn-to-hva cache
  KVM: selftests: Test address translation for Hyper-V direct L2
    hypercalls
  selftests: kvm: drop TEST_ASSERT_SUPPORTED_ATTRIBUTES
  KVM: x86: Introduce memory fault on invalid hypercalls reads/writes
  KVM: selftests: test hypercall memory fault exits
  KVM: x86/mmu: intersect writability from __kvm_faultin_pfn with
    fault->map_writable
  KVM: x86/mmu: Extend map_writable to a full ACC_* mask
  KVM: VMX: return error from kvm_set_cr*
  KVM: adjust for presence of more than one attribute
  KVM: Introduce kvm_fetch_guest_page() and use it for x86
  KVM: Take memory protections into account for __kvm_vcpu_map
  KVM: Introduce kvm_check_gen()/kvm_memslots_check_gen()
  KVM: x86/emulate: change return value of emulator_io_permitted to int
  KVM: x86/emulate: Propagate memory faults to userspace
  KVM: x86: "Handle" failed decode when skipping instructions
  KVM: vmx/sgx: make return value of sgx_gva_to_gpa consistent with its
    callers
  KVM: x86: Allow page fault fixup to return errors
  KVM: x86/mmu: Adjust gva_to_gpa to allow returning an error
  KVM: x86/mmu: Propagate errors from nested GPA translation
  KVM: x86: Propagate memory faults through load_pdptrs()
  KVM: x86/mmu: Issue memory fault exit if walk failed due to memory
    attribute
  KVM: x86: mark VM as dead after KVM_SET_SREGS fails to load PDPTRs
  KVM: VMX: mark VM dead on shadow VMCS or eVMCS access failures
  KVM: let kvm_arch_post_set_memory_attributes drop mmu_lock
  KVM: x86/mmu: Obsolete all roots if memattr contains gPTEs
  KVM: x86: selftests: Introduce memory protection attributes test
  KVM: x86: selftests: Introduce memory attributes PTE test
  KVM: x86: selftests: Introduce memory attributes side-channel tests
  KVM: x86: split out parts of load_pdptrs

 Documentation/virt/kvm/api.rst                |  57 ++-
 arch/loongarch/kvm/vcpu.c                     |  12 +-
 arch/x86/include/asm/kvm_host.h               |  18 +-
 arch/x86/kvm/Kconfig                          |   2 +-
 arch/x86/kvm/emulate.c                        |  82 +++-
 arch/x86/kvm/hyperv.c                         | 174 +++++--
 arch/x86/kvm/kvm_emulate.h                    |   3 +
 arch/x86/kvm/mmu.h                            |  28 +-
 arch/x86/kvm/mmu/mmu.c                        | 200 +++++++--
 arch/x86/kvm/mmu/mmu_internal.h               |  21 +-
 arch/x86/kvm/mmu/mmutrace.h                   |  36 ++
 arch/x86/kvm/mmu/paging_tmpl.h                |  63 ++-
 arch/x86/kvm/mmu/spte.c                       |  12 +-
 arch/x86/kvm/mmu/spte.h                       |  13 +-
 arch/x86/kvm/mmu/tdp_mmu.c                    |   2 +-
 arch/x86/kvm/regs.c                           | 103 +++--
 arch/x86/kvm/regs.h                           |   9 +
 arch/x86/kvm/svm/nested.c                     |  51 +--
 arch/x86/kvm/svm/svm.c                        |  19 +-
 arch/x86/kvm/vmx/hyperv.c                     |   7 +-
 arch/x86/kvm/vmx/nested.c                     |  53 ++-
 arch/x86/kvm/vmx/sgx.c                        |  35 +-
 arch/x86/kvm/vmx/vmx.c                        |  59 ++-
 arch/x86/kvm/x86.c                            | 204 ++++++---
 arch/x86/kvm/x86.h                            |   2 +-
 include/linux/kvm_host.h                      | 133 +++++-
 include/linux/kvm_types.h                     |   6 +-
 include/trace/events/kvm.h                    |  14 +-
 include/uapi/linux/kvm.h                      |   7 +
 tools/include/uapi/linux/kvm.h                |   3 +
 tools/testing/selftests/kvm/Makefile.kvm      |   2 +
 .../testing/selftests/kvm/include/kvm_util.h  |  37 +-
 .../selftests/kvm/include/x86/processor.h     |   1 +
 .../testing/selftests/kvm/lib/x86/processor.c |   5 +
 .../testing/selftests/kvm/memory_attributes.c | 424 ++++++++++++++++++
 tools/testing/selftests/kvm/x86/hcall_fault.c | 246 ++++++++++
 .../testing/selftests/kvm/x86/hyperv_evmcs.c  |  16 +-
 .../selftests/kvm/x86/hyperv_svm_test.c       |  15 +-
 .../selftests/kvm/x86/memory_attributes.c     | 415 +++++++++++++++++
 .../kvm/x86/private_mem_kvm_exits_test.c      |   5 +-
 virt/kvm/kvm_main.c                           | 315 +++++++++++--
 virt/kvm/pfncache.c                           |  30 +-
 42 files changed, 2498 insertions(+), 441 deletions(-)
 create mode 100644 tools/testing/selftests/kvm/memory_attributes.c
 create mode 100644 tools/testing/selftests/kvm/x86/hcall_fault.c
 create mode 100644 tools/testing/selftests/kvm/x86/memory_attributes.c

-- 
2.52.0