Paolo Bonzini reached for a blunt instrument. The Red Hat engineer and longtime KVM maintainer took one look at the sprawling kvm_mmu structure that had ballooned over 16 years of feature additions and called it what it was. A god data structure. One that tried to do everything. Describe page-table formats. Walk guest memory. Build shadow pages. Handle nested virtualization. Check reserved bits. Enforce permissions. The list went on.
So he brought out the chainsaw.
The resulting patch series landed in KVM’s next Git branch this week. It splits the monolithic kvm_mmu into three focused pieces. The work targets the Linux 7.3 merge window that opens in late August. Phoronix first reported the development on July 26, 2026, hours after Bonzini merged the kvm-chainsaw branch.
The change looks small on paper. Net nine lines removed. Yet it untangles years of conditional logic, misnamed fields and duplicated code paths that had grown around the original structure. Developers who maintain KVM for cloud providers, enterprise hypervisors and security research now face cleaner entry points for future additions. That matters. Because the demands on KVM keep rising.
Bonzini laid out the problem in the merge commit itself. “The kvm_mmu is a ‘god data structure’ that includes three different tasks: describing the guest page table’s format, walking the guest page tables and building the page tables,” he wrote. The existing nested_mmu was only partially used. Some fields overlapped between guest and host page tables while others did not. Permission checks for shadow page table entries, for instance, had diverged into simplified helpers such as is_executable_pte(). The whole arrangement invited mistakes.
The new design creates kvm_pagewalk for traversal duties. Each virtual CPU gets two instances: gva_walk for guest virtual addresses and ngpa_walk for nested guest physical addresses. No more swapping walk_mmu pointers between root_mmu and nested_mmu depending on whether an L1 or L2 guest runs. The walker stays fixed. kvm_mmu keeps its role in building shadow pages but now delegates walking to the appropriate helper. And kvm_page_format handles operations on existing page table entries, folding permission_mask logic into the pre-existing rsvd_bits_validate structure.
Both the walker and the builder carry their own page-format descriptor. The arrangement mirrors how the old kvm_mmu kept separate reserved-bit validators for guest and shadow PTEs. Repetition becomes intentional. Clarity replaces confusion.
One immediate payoff addresses naming headaches that had lingered since nested virtualization arrived. The original nested_mmu predated the later guest_mmu concept and claimed the obvious label. Comments that read “Exempt nested MMUs” actually referred to guest_mmu behavior. The split removes that source of error. Bonzini noted that renaming guest_mmu might follow, though the earlier RFC produced divided opinions on the best scheme.
But the cleanup does more than tidy comments. The final patch in the series adapts the permission_fault machinery so it can test shadow PTEs against a struct kvm_page_fault. That opens the door to SPTEs where the execute-disable bit differs between supervisor and user modes. KVM previously lacked support for such entries. Memory attributes can now expose the capability. New features arrive with less risk of breaking existing walks or builders.
The timing feels deliberate. Linux 7.3 arrives at a moment when KVM faces fresh scrutiny. Just weeks earlier, security researchers disclosed a 16-year-old use-after-free in the hypervisor’s shadow MMU code. Tracked as CVE-2026-53359 and nicknamed Januscape, the flaw allowed guest virtual machines to corrupt host page-table state on both Intel and AMD systems. The Hacker News detailed the bug and its fixes on July 6, 2026. Stable kernels incorporated patches by July 4. Downstream distributions continue rolling them out.
That vulnerability lived in the very code the chainsaw now reorganizes. The overlap is hard to ignore. A cleaner architecture should make similar defects easier to spot and harder to introduce. At minimum it reduces the surface where a single structure held too many responsibilities.
Industry reaction arrived quickly on X. The Phoronix account posted the news and drew engagement from kernel watchers. One Japanese-language account summarized the split and noted that mechanical code movement in the series made partial use of large language models. Bonzini himself had apparently disclosed the detail. The post highlighted that overall line count barely changed while the new structure paves the way for extensions.
Such admissions matter to maintainers. They signal that even veteran contributors now reach for automated assistance on tedious refactors. The kernel community has debated LLM-generated patches for months. Here the tool stayed in its lane: moving code, not inventing logic. The human review still drove the architectural shift.
Look closer at the code and the payoff appears in reduced branching. Previously a single kvm_mmu pointer might point at root_mmu or nested_mmu. Walkers, format descriptors and permission handlers all consulted flags to decide which behavior to apply. The new layout makes the choice explicit at allocation time. gva_walk always walks guest virtual addresses. ngpa_walk always walks nested guest physical addresses. Builders compose from these primitives rather than mutate a shared god object.
That composition model scales. Future work on shadow paging, confidential computing or new instruction-set extensions can target one component without auditing the other two. Memory attributes for XS/XU differentiation offer the first real test. If the mechanism proves sound, similar attribute-driven permission models could follow for other page-table quirks.
KVM’s centrality in the cloud only raises the stakes. Major hyperscalers run millions of virtual CPUs atop it. Each performance regression or security regression ripples across tenants. A structure that invited confusion no longer feels tolerable. The chainsaw arrives as preventive maintenance on the hypervisor’s foundation.
Developers following the x86 KVM tree will see the branch appear in linux-next shortly. The merge window for 7.3 opens in the second half of August. Barring last-minute objections the patches should ride into mainline with the rest of the KVM pull request. Then comes the long stabilization cycle. Real-world testing in everything from laptop virt to massive cloud fleets will decide whether the split delivers the hoped-for clarity.
Yet even before widespread deployment the work carries symbolic weight. It shows the kernel’s virtualization layer can still confront its own technical debt. Sixteen years is a long time for any data structure to accumulate responsibilities. Bonzini chose to act before the next wave of features made the tangle permanent.
The god is dead. Three focused structs now stand in its place. The code already reads clearer. And the door stands open for whatever KVM must support next.
WebProNews is an iEntry Publication