[PATCH 0/3] KVM: Kconfig fixes for the VM-wide private memory attribute

[PATCH 0/3] KVM: Kconfig fixes for the VM-wide private memory attribute

[Paolo Bonzini]

A late review of the guest_memfd attributes changes...

With Linux 7.4 the "private" memory attribute was moved from the VM
to the individual guest_memfd file descriptor.  The old semantics are
available for backwards compatibility via CONFIG_KVM_VM_MEMORY_ATTRIBUTES,
and disabled by default.

This change has two problems: first, it ties support for VM memory
attributes entirely to a backwards compatibility symbol for distros.
Second, it is incompatible with all released versions of QEMU (and
perhaps most other VMMs?), thus the default is arguably not the
right one.

Fix the first problem, by making CONFIG_KVM_VM_MEMORY_ATTRIBUTES an
internal configuration symbol that is the equivalent of the old
CONFIG_KVM_GENERIC_MEMORY_ATTRIBUTES, and use a more descriptive name
for the private memory attribute.  Fix the second by changing the
default to y if either SEV or TDX are enabled; leaving it n for
CONFIG_KVM_SW_PROTECTED_VM as it is only useful for selftests.

The last patch is a simple code cleanup to remove the static call
and module parameter overhead when the VM-level attribute is absent.

Thanks,

Paolo

Paolo Bonzini (3):
  KVM: split CONFIG_KVM_PRIVATE_MEMATTR_VM out of
    KVM_VM_MEMORY_ATTRIBUTES
  KVM: x86: leave the legacy private attribute in for TDX and SEV
  KVM: compile out all !gmem_in_place_conversion code unless
    CONFIG_KVM_PRIVATE_MEMATTR_VM

 Documentation/admin-guide/kernel-parameters.txt |  4 ++--
 arch/x86/kvm/Kconfig                            |  6 ++++--
 include/linux/kvm_host.h                        | 13 ++++++-------
 virt/kvm/Kconfig                                |  3 +++
 virt/kvm/kvm_main.c                             | 15 ++++++++-------
 5 files changed, 23 insertions(+), 18 deletions(-)

-- 
2.52.0

[PATCH 1/3] KVM: split CONFIG_KVM_PRIVATE_MEMATTR_VM out of KVM_VM_MEMORY_ATTRIBUTES

[Paolo Bonzini]

With Linux 7.4 the "private" memory attribute was moved from the VM
to the individual guest_memfd file descriptor.  The old semantics are
available for backwards compatibility via CONFIG_KVM_VM_MEMORY_ATTRIBUTES.

However, this ties support for VM memory attributes entirely to
a backwards compatibility symbol, which is a problem when adding
VM memory attributes other than PRIVATE.  Thus, make
CONFIG_KVM_VM_MEMORY_ATTRIBUTES the equivalent of the old
CONFIG_KVM_GENERIC_MEMORY_ATTRIBUTES, and use a more descriptive name
for the private memory attribute.  Do this now, instead of waiting
for more attributes to come, before distros start adjusting
their build configuration.

Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---
 Documentation/admin-guide/kernel-parameters.txt | 4 ++--
 arch/x86/kvm/Kconfig                            | 3 ++-
 include/linux/kvm_host.h                        | 4 +++-
 virt/kvm/Kconfig                                | 3 +++
 virt/kvm/kvm_main.c                             | 6 +++---
 5 files changed, 13 insertions(+), 7 deletions(-)

diff --git a/Documentation/admin-guide/kernel-parameters.txt b/Documentation/admin-guide/kernel-parameters.txt
index 410a3eed3a3d..42ff19defe16 100644
--- a/Documentation/admin-guide/kernel-parameters.txt
+++ b/Documentation/admin-guide/kernel-parameters.txt
@@ -3178,8 +3178,8 @@ Kernel parameters
 			userspace VMM design.
 
 			Note, this parameter is only available when
-			CONFIG_KVM_VM_MEMORY_ATTRIBUTES=y. When
-			CONFIG_KVM_VM_MEMORY_ATTRIBUTES is not set, in-place
+			CONFIG_KVM_PRIVATE_MEMATTR_VM=y. When
+			CONFIG_KVM_PRIVATE_MEMATTR_VM is not set, in-place
 			conversion is enabled (and cannot be disabled) if KVM
 			is built with private memory support.
 
diff --git a/arch/x86/kvm/Kconfig b/arch/x86/kvm/Kconfig
index 796d33f629d3..01a683a9042a 100644
--- a/arch/x86/kvm/Kconfig
+++ b/arch/x86/kvm/Kconfig
@@ -76,9 +76,10 @@ config KVM_WERROR
 
 	  If in doubt, say "N".
 
-config KVM_VM_MEMORY_ATTRIBUTES
+config KVM_PRIVATE_MEMATTR_VM
 	bool "Enable per-VM PRIVATE vs. SHARED attributes (for CoCo VMs)"
 	depends on KVM_SW_PROTECTED_VM || KVM_INTEL_TDX || KVM_AMD_SEV
+	select KVM_VM_MEMORY_ATTRIBUTES
 	help
 	  Enable support for tracking PRIVATE vs. SHARED memory using per-VM
 	  memory attributes.  Using per-VM attributes is deprecated in favor of
diff --git a/include/linux/kvm_host.h b/include/linux/kvm_host.h
index 4d4e76a50d77..09c57d31d153 100644
--- a/include/linux/kvm_host.h
+++ b/include/linux/kvm_host.h
@@ -2582,12 +2582,14 @@ bool kvm_arch_pre_set_vm_memory_attributes(struct kvm *kvm,
 					   struct kvm_gfn_range *range);
 bool kvm_arch_post_set_vm_memory_attributes(struct kvm *kvm,
 					    struct kvm_gfn_range *range);
+#endif  /* CONFIG_KVM_VM_MEMORY_ATTRIBUTES */
 
+#ifdef CONFIG_KVM_PRIVATE_MEMATTR_VM
 static inline bool kvm_vm_is_private_gfn(struct kvm *kvm, gfn_t gfn)
 {
 	return kvm_get_vm_memory_attributes(kvm, gfn) & KVM_MEMORY_ATTRIBUTE_PRIVATE;
 }
-#endif  /* CONFIG_KVM_VM_MEMORY_ATTRIBUTES */
+#endif  /* CONFIG_KVM_PRIVATE_MEMATTR_VM */
 
 #ifdef kvm_arch_has_private_mem
 extern bool gmem_in_place_conversion;
diff --git a/virt/kvm/Kconfig b/virt/kvm/Kconfig
index c5bfaa1f7749..99c9969e77a4 100644
--- a/virt/kvm/Kconfig
+++ b/virt/kvm/Kconfig
@@ -101,3 +101,6 @@ config HAVE_KVM_ARCH_GMEM_INVALIDATE
 config HAVE_KVM_ARCH_GMEM_POPULATE
        bool
        depends on KVM_GUEST_MEMFD
+
+config KVM_VM_MEMORY_ATTRIBUTES
+       bool
diff --git a/virt/kvm/kvm_main.c b/virt/kvm/kvm_main.c
index a97aa5b92616..3e35766f5c7e 100644
--- a/virt/kvm/kvm_main.c
+++ b/virt/kvm/kvm_main.c
@@ -105,8 +105,8 @@ static bool __ro_after_init allow_unsafe_mappings;
 module_param(allow_unsafe_mappings, bool, 0444);
 
 #ifdef kvm_arch_has_private_mem
-bool __ro_after_init gmem_in_place_conversion = !IS_ENABLED(CONFIG_KVM_VM_MEMORY_ATTRIBUTES);
-#ifdef CONFIG_KVM_VM_MEMORY_ATTRIBUTES
+bool __ro_after_init gmem_in_place_conversion = !IS_ENABLED(CONFIG_KVM_PRIVATE_MEMATTR_VM);
+#ifdef CONFIG_KVM_PRIVATE_MEMATTR_VM
 module_param(gmem_in_place_conversion, bool, 0444);
 #endif
 EXPORT_SYMBOL_FOR_KVM_INTERNAL(gmem_in_place_conversion);
@@ -2713,7 +2713,7 @@ static void kvm_init_memory_attributes(void)
 {
 	if (gmem_in_place_conversion)
 		static_call_update(__kvm_is_private_gfn, kvm_gmem_is_private_gfn);
-#ifdef CONFIG_KVM_VM_MEMORY_ATTRIBUTES
+#ifdef CONFIG_KVM_PRIVATE_MEMATTR_VM
 	else
 		static_call_update(__kvm_is_private_gfn, kvm_vm_is_private_gfn);
 #endif
-- 
2.52.0

[PATCH 2/3] KVM: x86: leave the legacy private attribute in for TDX and SEV

[Paolo Bonzini]

As of today, and presumably as of Linux 7.4's release date, there
is hardly any VMM that supports guest_memfd attributes.  Support the
legacy VM attribute for private memory if SEV or TDX are requested;
default it to disabled if only the software-protected VM is requested,
since it is only used by guest_memfd selftests.

While in-place conversion is the best option, it is way too
early to enable it by default.

Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---
 arch/x86/kvm/Kconfig | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/arch/x86/kvm/Kconfig b/arch/x86/kvm/Kconfig
index 01a683a9042a..4f7d75ec8c40 100644
--- a/arch/x86/kvm/Kconfig
+++ b/arch/x86/kvm/Kconfig
@@ -80,6 +80,7 @@ config KVM_PRIVATE_MEMATTR_VM
 	bool "Enable per-VM PRIVATE vs. SHARED attributes (for CoCo VMs)"
 	depends on KVM_SW_PROTECTED_VM || KVM_INTEL_TDX || KVM_AMD_SEV
 	select KVM_VM_MEMORY_ATTRIBUTES
+	default KVM_INTEL_TDX || KVM_AMD_SEV
 	help
 	  Enable support for tracking PRIVATE vs. SHARED memory using per-VM
 	  memory attributes.  Using per-VM attributes is deprecated in favor of
@@ -87,7 +88,7 @@ config KVM_PRIVATE_MEMATTR_VM
 	  CoCo VMs using a VMM that doesn't support guest_memfd memory
 	  attributes.
 
-	  If unsure, say N.
+	  If unsure, say "Y".
 
 config KVM_SW_PROTECTED_VM
 	bool "Enable support for KVM software-protected VMs"
-- 
2.52.0

[PATCH 3/3] KVM: always make in-place conversion a compile-time constant when possible

[Paolo Bonzini]

Remove the unnecessary static call indirection and make
gmem_in_place_conversion a constant if CONFIG_KVM_PRIVATE_MEMATTR_VM
is false.

Require that CONFIG_KVM_PRIVATE_MEMATTR_VM is y only if
kvm_arch_has_private_mem is also defined.  This way, the three
possible cases can be expressed without nested #ifs.

Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---
 include/linux/kvm_host.h | 13 +++++--------
 virt/kvm/kvm_main.c      | 13 +++++++------
 2 files changed, 12 insertions(+), 14 deletions(-)

diff --git a/include/linux/kvm_host.h b/include/linux/kvm_host.h
index 09c57d31d153..e7fc94e2910a 100644
--- a/include/linux/kvm_host.h
+++ b/include/linux/kvm_host.h
@@ -2585,15 +2585,7 @@ bool kvm_arch_post_set_vm_memory_attributes(struct kvm *kvm,
 #endif  /* CONFIG_KVM_VM_MEMORY_ATTRIBUTES */
 
 #ifdef CONFIG_KVM_PRIVATE_MEMATTR_VM
-static inline bool kvm_vm_is_private_gfn(struct kvm *kvm, gfn_t gfn)
-{
-	return kvm_get_vm_memory_attributes(kvm, gfn) & KVM_MEMORY_ATTRIBUTE_PRIVATE;
-}
-#endif  /* CONFIG_KVM_PRIVATE_MEMATTR_VM */
-
-#ifdef kvm_arch_has_private_mem
 extern bool gmem_in_place_conversion;
-
 typedef bool (kvm_is_private_gfn_t)(struct kvm *kvm, gfn_t gfn);
 DECLARE_STATIC_CALL(__kvm_is_private_gfn, kvm_is_private_gfn_t);
 
@@ -2601,6 +2593,11 @@ static inline bool kvm_is_private_gfn(struct kvm *kvm, gfn_t gfn)
 {
 	return static_call(__kvm_is_private_gfn)(kvm, gfn);
 }
+
+#elif defined kvm_arch_has_private_mem
+#define gmem_in_place_conversion true
+#define kvm_is_private_gfn kvm_gmem_is_private_gfn
+
 #else
 #define gmem_in_place_conversion false
 
diff --git a/virt/kvm/kvm_main.c b/virt/kvm/kvm_main.c
index 3e35766f5c7e..a356a29be985 100644
--- a/virt/kvm/kvm_main.c
+++ b/virt/kvm/kvm_main.c
@@ -104,11 +104,9 @@ EXPORT_SYMBOL_FOR_KVM_INTERNAL(halt_poll_ns_shrink);
 static bool __ro_after_init allow_unsafe_mappings;
 module_param(allow_unsafe_mappings, bool, 0444);
 
-#ifdef kvm_arch_has_private_mem
-bool __ro_after_init gmem_in_place_conversion = !IS_ENABLED(CONFIG_KVM_PRIVATE_MEMATTR_VM);
 #ifdef CONFIG_KVM_PRIVATE_MEMATTR_VM
+bool __ro_after_init gmem_in_place_conversion = false;
 module_param(gmem_in_place_conversion, bool, 0444);
-#endif
 EXPORT_SYMBOL_FOR_KVM_INTERNAL(gmem_in_place_conversion);
 #endif
 
@@ -2705,18 +2703,21 @@ static int kvm_vm_ioctl_set_mem_attributes(struct kvm *kvm,
 }
 #endif /* CONFIG_KVM_VM_MEMORY_ATTRIBUTES */
 
-#ifdef kvm_arch_has_private_mem
+#ifdef CONFIG_KVM_PRIVATE_MEMATTR_VM
 DEFINE_STATIC_CALL_RET0(__kvm_is_private_gfn, kvm_is_private_gfn_t);
 EXPORT_STATIC_CALL_GPL(__kvm_is_private_gfn);
 
+static bool kvm_vm_is_private_gfn(struct kvm *kvm, gfn_t gfn)
+{
+	return kvm_get_vm_memory_attributes(kvm, gfn) & KVM_MEMORY_ATTRIBUTE_PRIVATE;
+}
+
 static void kvm_init_memory_attributes(void)
 {
 	if (gmem_in_place_conversion)
 		static_call_update(__kvm_is_private_gfn, kvm_gmem_is_private_gfn);
-#ifdef CONFIG_KVM_PRIVATE_MEMATTR_VM
 	else
 		static_call_update(__kvm_is_private_gfn, kvm_vm_is_private_gfn);
-#endif
 }
 #else
 static void kvm_init_memory_attributes(void) { }
-- 
2.52.0