Re: [PATCH v4 18/18] KVM: guest_memfd: Combine .gmem_prepare()+.gmem_invalidate() into .gmem_convert()

[Fuad Tabba]

On Thu, 9 Jul 2026 at 21:50, Sean Christopherson <seanjc@xxxxxxxxxx> wrote:
>
> Smush guest_memfd's prepare() and invalidate() hooks into a common
> convert() flow, as they are effectively two sides of the same coin: they're
> invoked when private/shared memory is about to made accessible visible to
> the guest/host.  I.e. prepare() is really "make private", and invalidate()
> is really "make shared".

That holds for SNP, where both paths end in rmp_make_shared(). It doesn't hold
for pKVM: conversion has to preserve the page (same physical page, no
encryption, which is the point of in-place conversion for us), while teardown
has to scrub it, so that a malicious host can't read a newly reclaimed guest
page.


> Using a single API fixes the wart where invalidate() isn't actually doing
> invalidation, avoids adding yet another gmem Kconfig, avoids having to come
> up with a name to describe the "make shared" behavior, and will yield more
> intuitive code when in-place conversion comes along.
>
> No functional change intended.
>
> Signed-off-by: Sean Christopherson <seanjc@xxxxxxxxxx>
> ---
>  arch/x86/include/asm/kvm-x86-ops.h |  5 ++---
>  arch/x86/include/asm/kvm_host.h    |  7 +++----
>  arch/x86/kvm/Kconfig               |  2 +-
>  arch/x86/kvm/svm/sev.c             | 21 ++++++++++++++++++---
>  arch/x86/kvm/svm/svm.c             |  3 +--
>  arch/x86/kvm/svm/svm.h             |  5 ++---
>  arch/x86/kvm/x86.c                 | 15 ++++-----------
>  include/linux/kvm_host.h           |  7 +++----
>  virt/kvm/Kconfig                   |  2 +-
>  virt/kvm/guest_memfd.c             | 25 ++++++++++++-------------
>  10 files changed, 47 insertions(+), 45 deletions(-)
>
> diff --git a/arch/x86/include/asm/kvm-x86-ops.h b/arch/x86/include/asm/kvm-x86-ops.h
> index 736129db272a..6091987860bd 100644
> --- a/arch/x86/include/asm/kvm-x86-ops.h
> +++ b/arch/x86/include/asm/kvm-x86-ops.h
> @@ -146,10 +146,9 @@ KVM_X86_OP(vcpu_deliver_sipi_vector)
>  KVM_X86_OP_OPTIONAL_RET0(vcpu_get_apicv_inhibit_reasons);
>  KVM_X86_OP_OPTIONAL(get_untagged_addr)
>  KVM_X86_OP_OPTIONAL(alloc_apic_backing_page)
> -#ifdef CONFIG_HAVE_KVM_ARCH_GMEM_PREPARE
> -KVM_X86_OP_OPTIONAL_RET0(gmem_prepare)
> +#ifdef CONFIG_HAVE_KVM_ARCH_GMEM_CONVERT
> +KVM_X86_OP_OPTIONAL_RET0(gmem_convert)
>  #endif
> -KVM_X86_OP_OPTIONAL(gmem_invalidate)
>  #ifdef CONFIG_HAVE_KVM_ARCH_GMEM_INVALIDATE
>  KVM_X86_OP_OPTIONAL(gmem_invalidate_range)
>  #endif
> diff --git a/arch/x86/include/asm/kvm_host.h b/arch/x86/include/asm/kvm_host.h
> index 3e34435f7e4e..3b4311048926 100644
> --- a/arch/x86/include/asm/kvm_host.h
> +++ b/arch/x86/include/asm/kvm_host.h
> @@ -1903,11 +1903,10 @@ struct kvm_x86_ops {
>
>         gva_t (*get_untagged_addr)(struct kvm_vcpu *vcpu, gva_t gva, unsigned int flags);
>         void *(*alloc_apic_backing_page)(struct kvm_vcpu *vcpu);
> -#ifdef CONFIG_HAVE_KVM_ARCH_GMEM_PREPARE
> -       int (*gmem_prepare)(struct kvm *kvm, gpa_t gpa, kvm_pfn_t pfn,
> -                           kvm_pfn_t nr_pages, int max_order);
> +#ifdef CONFIG_HAVE_KVM_ARCH_GMEM_CONVERT
> +       int (*gmem_convert)(struct kvm *kvm, gpa_t gpa, kvm_pfn_t pfn,
> +                           kvm_pfn_t nr_pages, int max_order, bool to_private);
>  #endif
> -       void (*gmem_invalidate)(kvm_pfn_t start, kvm_pfn_t end);
>  #ifdef CONFIG_HAVE_KVM_ARCH_GMEM_INVALIDATE
>         void (*gmem_invalidate_range)(struct kvm *kvm, struct kvm_gfn_range *range);
>  #endif
> diff --git a/arch/x86/kvm/Kconfig b/arch/x86/kvm/Kconfig
> index 801bf9e520db..52e75d83a4d2 100644
> --- a/arch/x86/kvm/Kconfig
> +++ b/arch/x86/kvm/Kconfig
> @@ -160,7 +160,7 @@ config KVM_AMD_SEV
>         depends on CRYPTO_DEV_SP_PSP && !(KVM_AMD=y && CRYPTO_DEV_CCP_DD=m)
>         select ARCH_HAS_CC_PLATFORM
>         select KVM_GENERIC_MEMORY_ATTRIBUTES
> -       select HAVE_KVM_ARCH_GMEM_PREPARE
> +       select HAVE_KVM_ARCH_GMEM_CONVERT
>         select HAVE_KVM_ARCH_GMEM_INVALIDATE
>         select HAVE_KVM_ARCH_GMEM_POPULATE
>         help
> diff --git a/arch/x86/kvm/svm/sev.c b/arch/x86/kvm/svm/sev.c
> index 3e7792afbab4..b7f0d688f699 100644
> --- a/arch/x86/kvm/svm/sev.c
> +++ b/arch/x86/kvm/svm/sev.c
> @@ -5112,8 +5112,8 @@ static bool is_large_rmp_possible(struct kvm *kvm, kvm_pfn_t pfn, int order)
>         return false;
>  }
>
> -int sev_gmem_prepare(struct kvm *kvm, gpa_t gpa, kvm_pfn_t pfn,
> -                    kvm_pfn_t nr_pages, int max_order)
> +static int sev_gmem_make_private(struct kvm *kvm, gpa_t gpa, kvm_pfn_t pfn,
> +                                kvm_pfn_t nr_pages, int max_order)
>  {
>         struct kvm_sev_info *sev = to_kvm_sev_info(kvm);
>         gfn_t gfn = gpa_to_gfn(gpa);
> @@ -5164,8 +5164,9 @@ int sev_gmem_prepare(struct kvm *kvm, gpa_t gpa, kvm_pfn_t pfn,
>         return 0;
>  }
>
> -void sev_gmem_invalidate(kvm_pfn_t start, kvm_pfn_t end)
> +static void sev_gmem_make_shared(kvm_pfn_t start, kvm_pfn_t nr_pages)
>  {
> +       kvm_pfn_t end = start + nr_pages;
>         kvm_pfn_t pfn;
>
>         if (!cc_platform_has(CC_ATTR_HOST_SEV_SNP))
> @@ -5227,6 +5228,20 @@ void sev_gmem_invalidate(kvm_pfn_t start, kvm_pfn_t end)
>         }
>  }
>
> +int sev_gmem_convert(struct kvm *kvm, gpa_t gpa, kvm_pfn_t pfn,
> +                    kvm_pfn_t nr_pages, int order, bool to_private)
> +{
> +       if (to_private) {
> +               if (WARN_ON_ONCE(!kvm || gpa == INVALID_GPA))
> +                       return -EIO;
> +
> +               return sev_gmem_make_private(kvm, gpa, pfn, nr_pages, order);
> +       }
> +
> +       sev_gmem_make_shared(pfn, nr_pages);

free_folio is the only to_private=false caller today, but the cover
letter sketches the other one, a private->shared conversion through
kvm_gmem_make_shared(inode, start, end). Once that lands both reach
the hook with to_private=false, and as far as I can tell, the only
thing separating them is kvm == NULL / INVALID_GPA. That isn't
documented as a contract, and nothing in-tree reads it on that branch
(the kvm/gpa check is under if (to_private), and
sev_gmem_make_shared() doesn't take a kvm at all), so nothing would
catch it regressing. The sketch is also inode-scoped, so I'm not sure
the conversion path passes a non-NULL kvm at all; if it doesn't, the
two aren't distinguishable.

> +       return 0;
> +}
> +
>  void sev_gmem_invalidate_range(struct kvm *kvm, struct kvm_gfn_range *range)
>  {
>         struct kvm_vcpu *vcpu;
> diff --git a/arch/x86/kvm/svm/svm.c b/arch/x86/kvm/svm/svm.c
> index dd51df74c2dc..f462ac9bbc93 100644
> --- a/arch/x86/kvm/svm/svm.c
> +++ b/arch/x86/kvm/svm/svm.c
> @@ -5450,8 +5450,7 @@ struct kvm_x86_ops svm_x86_ops __initdata = {
>         .vm_copy_enc_context_from = sev_vm_copy_enc_context_from,
>         .vm_move_enc_context_from = sev_vm_move_enc_context_from,
>
> -       .gmem_prepare = sev_gmem_prepare,
> -       .gmem_invalidate = sev_gmem_invalidate,
> +       .gmem_convert = sev_gmem_convert,
>         .gmem_invalidate_range = sev_gmem_invalidate_range,
>         .gmem_max_mapping_level = sev_gmem_max_mapping_level,
>  #endif
> diff --git a/arch/x86/kvm/svm/svm.h b/arch/x86/kvm/svm/svm.h
> index 45a9e2d5417c..aa12e6a80e83 100644
> --- a/arch/x86/kvm/svm/svm.h
> +++ b/arch/x86/kvm/svm/svm.h
> @@ -1009,9 +1009,8 @@ int sev_cpu_init(struct svm_cpu_data *sd);
>  int sev_dev_get_attr(u32 group, u64 attr, u64 *val);
>  extern unsigned int max_sev_asid;
>  void sev_handle_rmp_fault(struct kvm_vcpu *vcpu, gpa_t gpa, u64 error_code);
> -int sev_gmem_prepare(struct kvm *kvm, gpa_t gpa, kvm_pfn_t pfn,
> -                    kvm_pfn_t nr_pages, int max_order);
> -void sev_gmem_invalidate(kvm_pfn_t start, kvm_pfn_t end);
> +int sev_gmem_convert(struct kvm *kvm, gpa_t gpa, kvm_pfn_t pfn,
> +                    kvm_pfn_t nr_pages, int max_order, bool to_private);
>  void sev_gmem_invalidate_range(struct kvm *kvm, struct kvm_gfn_range *range);
>  int sev_gmem_max_mapping_level(struct kvm *kvm, kvm_pfn_t pfn, bool is_private);
>  struct vmcb_save_area *sev_decrypt_vmsa(struct kvm_vcpu *vcpu);
> diff --git a/arch/x86/kvm/x86.c b/arch/x86/kvm/x86.c
> index a167f42bb1af..f51303ff3a1e 100644
> --- a/arch/x86/kvm/x86.c
> +++ b/arch/x86/kvm/x86.c
> @@ -10589,18 +10589,11 @@ bool kvm_arch_supports_gmem_init_shared(struct kvm *kvm)
>         return !kvm_arch_has_private_mem(kvm);
>  }
>
> -#ifdef CONFIG_HAVE_KVM_ARCH_GMEM_PREPARE
> -int kvm_arch_gmem_prepare(struct kvm *kvm, gpa_t gpa, kvm_pfn_t pfn,
> -                         kvm_pfn_t nr_pages, int max_order)
> +#ifdef CONFIG_HAVE_KVM_ARCH_GMEM_CONVERT
> +int kvm_arch_gmem_convert(struct kvm *kvm, gpa_t gpa, kvm_pfn_t pfn,
> +                         kvm_pfn_t nr_pages, int max_order, bool to_private)
>  {
> -       return kvm_x86_call(gmem_prepare)(kvm, gpa, pfn, nr_pages, max_order);
> -}
> -#endif
> -
> -#ifdef CONFIG_HAVE_KVM_ARCH_GMEM_INVALIDATE
> -void kvm_arch_gmem_invalidate(kvm_pfn_t start, kvm_pfn_t end)
> -{
> -       kvm_x86_call(gmem_invalidate)(start, end);
> +       return kvm_x86_call(gmem_convert)(kvm, gpa, pfn, nr_pages, max_order, to_private);
>  }
>  void kvm_arch_gmem_invalidate_range(struct kvm *kvm, struct kvm_gfn_range *range)
>  {
> diff --git a/include/linux/kvm_host.h b/include/linux/kvm_host.h
> index 469c22b551ee..eb5a3349381c 100644
> --- a/include/linux/kvm_host.h
> +++ b/include/linux/kvm_host.h
> @@ -2572,9 +2572,9 @@ static inline int kvm_gmem_get_pfn(struct kvm *kvm,
>  }
>  #endif /* CONFIG_KVM_GUEST_MEMFD */
>
> -#ifdef CONFIG_HAVE_KVM_ARCH_GMEM_PREPARE
> -int kvm_arch_gmem_prepare(struct kvm *kvm, gpa_t gpa, kvm_pfn_t pfn,
> -                         kvm_pfn_t nr_pages, int max_order);
> +#ifdef CONFIG_HAVE_KVM_ARCH_GMEM_CONVERT
> +int kvm_arch_gmem_convert(struct kvm *kvm, gpa_t gpa, kvm_pfn_t pfn,
> +                         kvm_pfn_t nr_pages, int max_order, bool to_private);
>  #endif
>
>  #ifdef CONFIG_HAVE_KVM_ARCH_GMEM_POPULATE
> @@ -2608,7 +2608,6 @@ long kvm_gmem_populate(struct kvm *kvm, gfn_t start_gfn, void __user *src,
>  #endif
>
>  #ifdef CONFIG_HAVE_KVM_ARCH_GMEM_INVALIDATE
> -void kvm_arch_gmem_invalidate(kvm_pfn_t start, kvm_pfn_t end);
>  void kvm_arch_gmem_invalidate_range(struct kvm *kvm, struct kvm_gfn_range *range);
>  #endif
>
> diff --git a/virt/kvm/Kconfig b/virt/kvm/Kconfig
> index 794976b88c6f..53803c5777a4 100644
> --- a/virt/kvm/Kconfig
> +++ b/virt/kvm/Kconfig
> @@ -107,7 +107,7 @@ config KVM_GUEST_MEMFD
>         select XARRAY_MULTI
>         bool
>
> -config HAVE_KVM_ARCH_GMEM_PREPARE
> +config HAVE_KVM_ARCH_GMEM_CONVERT
>         bool
>         depends on KVM_GUEST_MEMFD
>
> diff --git a/virt/kvm/guest_memfd.c b/virt/kvm/guest_memfd.c
> index 4082cde3f3fc..d780ea0494d2 100644
> --- a/virt/kvm/guest_memfd.c
> +++ b/virt/kvm/guest_memfd.c
> @@ -66,10 +66,10 @@ static pgoff_t kvm_gmem_get_index(struct kvm_memory_slot *slot, gfn_t gfn)
>   * On successful return the guest sees a zero page so as to avoid
>   * leaking host data and the up-to-date flag is set.
>   */
> -static int kvm_gmem_prepare_folio(struct kvm *kvm, struct kvm_memory_slot *slot,
> -                                 gfn_t gfn, struct folio *folio)
> +static int kvm_gmem_make_private(struct kvm *kvm, struct kvm_memory_slot *slot,
> +                                gfn_t gfn, struct folio *folio)
>  {
> -#ifdef CONFIG_HAVE_KVM_ARCH_GMEM_PREPARE
> +#ifdef CONFIG_HAVE_KVM_ARCH_GMEM_CONVERT
>         unsigned long nr_pages = folio_nr_pages(folio);
>         pgoff_t index;
>
> @@ -90,9 +90,9 @@ static int kvm_gmem_prepare_folio(struct kvm *kvm, struct kvm_memory_slot *slot,
>         gfn = ALIGN_DOWN(gfn, nr_pages);
>         index = kvm_gmem_get_index(slot, gfn);
>
> -       return kvm_arch_gmem_prepare(kvm, gfn_to_gpa(gfn),
> +       return kvm_arch_gmem_convert(kvm, gfn_to_gpa(gfn),
>                                      folio_file_pfn(folio, index), nr_pages,
> -                                    folio_order(folio));
> +                                    folio_order(folio), true);
>  #else
>         return 0;
>  #endif
> @@ -517,14 +517,13 @@ static int kvm_gmem_error_folio(struct address_space *mapping, struct folio *fol
>         return MF_DELAYED;
>  }
>
> -#ifdef CONFIG_HAVE_KVM_ARCH_GMEM_INVALIDATE
> +#ifdef CONFIG_HAVE_KVM_ARCH_GMEM_CONVERT
>  static void kvm_gmem_free_folio(struct folio *folio)

The Kconfig now couples them too: an arch can't take teardown without also
taking conversion. pKVM wants teardown and not conversion, so that's a problem
for us today, not only once the second caller lands.

This is the same ground as v8 15/46, which ended with the two split under
separate Kconfigs. Suzuki confirmed CCA disables both; pKVM wants teardown only,
since our conversions are guest-initiated and EL2 has already done the
transition by the time the host runs the generic path [1].

I'd rather keep the free path on its own callback. If you want a single hook,
passing the caller explicitly instead of leaving it implied by kvm would work
too. Merging the two conversion directions is a genuine cleanup, it's the free
path I'd like to keep separate.

Thanks,
/fuad

[1] https://lore.kernel.org/all/CA+EHjTwLRzrq0vY0-OosENJ2Gkknerux53aVBj0zGRQUkRQP=A@xxxxxxxxxxxxxx/

>  {
> -       struct page *page = folio_page(folio, 0);
> -       kvm_pfn_t pfn = page_to_pfn(page);
> -       int order = folio_order(folio);
> -
> -       kvm_arch_gmem_invalidate(pfn, pfn + (1ul << order));
> +       WARN_ON_ONCE(kvm_arch_gmem_convert(NULL, INVALID_GPA,
> +                                          folio_file_pfn(folio, 0),
> +                                          folio_nr_pages(folio),
> +                                          folio_order(folio), false));
>  }
>  #endif
>
> @@ -532,7 +531,7 @@ static const struct address_space_operations kvm_gmem_aops = {
>         .dirty_folio = noop_dirty_folio,
>         .migrate_folio  = kvm_gmem_migrate_folio,
>         .error_remove_folio = kvm_gmem_error_folio,
> -#ifdef CONFIG_HAVE_KVM_ARCH_GMEM_INVALIDATE
> +#ifdef CONFIG_HAVE_KVM_ARCH_GMEM_CONVERT
>         .free_folio = kvm_gmem_free_folio,
>  #endif
>  };
> @@ -802,7 +801,7 @@ int kvm_gmem_get_pfn(struct kvm *kvm, struct kvm_memory_slot *slot,
>                 folio_mark_uptodate(folio);
>         }
>
> -       r = kvm_gmem_prepare_folio(kvm, slot, gfn, folio);
> +       r = kvm_gmem_make_private(kvm, slot, gfn, folio);
>
>         folio_unlock(folio);
>
> --
> 2.55.0.795.g602f6c329a-goog
>