kvm, virt_kvm: add confidential APIs and refactor memory in separate module by will-j-wright · Pull Request #3737 · microsoft/openvmm

will-j-wright · 2026-06-12T22:37:50Z

Add bindings to the kvm crate to support upcoming SNP and CCA changes in virt_kvm. Refactor virt_kvm to move memory into its own module to support guestmemfd usage for SNP and CCA.

Note that the ARM CCA bindings are based on the v14 KVM patch series and is subject to change.

Taken from #3710 with review changes applied.

Add low-level KVM wrappers and constants needed for guest_memfd-backed confidential guests, including memory attributes, x86 SNP VM and launch ioctls, hypercall exits, and Arm CCA realm population support. Note that the ARM CCA bindings are based on the v14 KVM patch series and is subject to change.

Move the existing userspace KVM memory range state and partition memory mapping implementation out of lib.rs into memory.rs. This is a mechanical split that prepares the KVM memory path for guestmemfd support without changing behavior. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

github-actions · 2026-06-12T22:38:12Z

⚠️ Unsafe Code Detected

This PR modifies files containing unsafe Rust code. Extra scrutiny is required during review.

For more on why we check whole files, instead of just diffs, check out the Rustonomicon

Copilot

Pull request overview

Adds new KVM UAPI bindings and virt_kvm refactors needed to support upcoming confidential-VM work (AMD SEV-SNP on x86_64 and Arm CCA/Realm on aarch64), including guestmemfd-backed memory and new exit types.

Changes:

Introduces a dedicated virt_kvm::memory module that encapsulates slot tracking plus guestmemfd/private-memory attribute plumbing.
Extends the kvm crate with ioctls/capability checks for guestmemfd, memory attributes, SEV-SNP launch helpers, Arm RMI populate, and new exit decoding (hypercall/system-event/memory-fault).
Wires initial virt_kvm partition construction to track RAM ranges and handle new KVM exits on x86_64.

Reviewed changes

Copilot reviewed 5 out of 5 changed files in this pull request and generated 2 comments.

Show a summary per file

File	Description
vmm_core/virt_kvm/src/memory.rs	New memory-mapping module with guestmemfd classification, slot bookkeeping, and private-memory range helpers.
vmm_core/virt_kvm/src/lib.rs	Integrates the new memory module and extends `KvmError`/partition state for confidential-memory support.
vmm_core/virt_kvm/src/arch/x86_64/mod.rs	Initializes RAM range tracking and adds handling for KVM hypercall/system-event exits.
vmm_core/virt_kvm/src/arch/aarch64/mod.rs	Initializes RAM range tracking for future guestmemfd/CCA usage.
vm/kvm/src/lib.rs	Adds new ioctls/constants/APIs for private memory, guestmemfd, SEV-SNP/CCA-related operations, and new exit decoding.

github-actions · 2026-06-15T20:03:52Z

1 Petri tests failed (1 unstable)

jstarks · 2026-06-15T21:12:31Z

+    host_addr: *mut u8,
+    range: MemoryRange,
+    guest_memfd_offset: Option<u64>,
+    private_attributes_set: bool,


I'm pretty unclear on what this private_attributes_set thing is supposed to mean or do.

private_attributes_set tracks whether private-memory attributes were applied for the slot, so unmap can clear those attributes and private-range lookup can reject slots that are guestmemfd-backed but not currently private.

Should guestmemfd-backed imply the slot can service private ranges, or do we still need a separate state which means that private attributes are currently applied?

jstarks · 2026-06-15T21:20:56Z

+    file: File,
+    #[inspect(iter_by_index)]
+    ranges: Vec<KvmGuestMemfdRange>,
+    initial_private: bool,


I do not think we should have this initial_private concept.

Okay, should guestmemfd slots always start private, or should we decide some other way?

Add KVM guestmemfd memory-slot plumbing and neutral private-memory range helpers without enabling confidential VM launch behavior yet. Non-isolated KVM partitions continue to use userspace memory backing. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Copilot

Pull request overview

Copilot reviewed 5 out of 5 changed files in this pull request and generated 1 comment.

github-actions · 2026-06-15T23:50:28Z

1 Petri tests failed (1 unstable)

chris-oo and others added 2 commits June 12, 2026 21:29

will-j-wright requested a review from a team as a code owner June 12, 2026 22:37

Copilot AI review requested due to automatic review settings June 12, 2026 22:37

will-j-wright mentioned this pull request Jun 12, 2026

kvm, virt_kvm: add confidential APIs and refactor memory in separate module #3710

Closed

github-actions Bot added the unsafe Related to unsafe code label Jun 12, 2026

Copilot started reviewing on behalf of will-j-wright June 12, 2026 22:38 View session

Copilot AI reviewed Jun 12, 2026

View reviewed changes

Comment thread vmm_core/virt_kvm/src/memory.rs Outdated

Comment thread vmm_core/virt_kvm/src/memory.rs

jstarks reviewed Jun 12, 2026

View reviewed changes

Comment thread vm/kvm/src/lib.rs

jstarks reviewed Jun 12, 2026

View reviewed changes

Comment thread vm/kvm/src/lib.rs Outdated

jstarks reviewed Jun 12, 2026

View reviewed changes

Comment thread vm/kvm/src/lib.rs Outdated

will-j-wright force-pushed the snp-cca-pr05c-kvm-guestmemfd branch from 58ef6c1 to 2f0ee9b Compare June 15, 2026 18:48