Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) client-ip=23.128.96.18;
Date:   Wed, 26 May 2021 15:44:37 +0000
From:   Sean Christopherson <seanjc@google.com>
To:     Maxim Levitsky <mlevitsk@redhat.com>
Cc:     Paolo Bonzini <pbonzini@redhat.com>,
        Ben Gardon <bgardon@google.com>,
        Jim Mattson <jmattson@google.com>,
        Junaid Shahid <junaids@google.com>,
        Peter Xu <peterx@redhat.com>,
        LKML <linux-kernel@vger.kernel.org>, kvm <kvm@vger.kernel.org>
Subject: Re: Writable module parameters in KVM
Message-ID: <YK5s5SUQh69a19/F@google.com>
References: <CANgfPd_Pq2MkRUZiJynh7zkNuKE5oFGRjKeCjmgYP4vwvfMc1g@mail.gmail.com>
 <35fe7a86-d808-00e9-a6aa-e77b731bd4bf@redhat.com>
 <2fd417c59f40bd10a3446f9ed4be434e17e9a64f.camel@redhat.com>
MIME-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
In-Reply-To: <2fd417c59f40bd10a3446f9ed4be434e17e9a64f.camel@redhat.com>
Precedence: bulk

On Wed, May 26, 2021, Maxim Levitsky wrote:
> On Wed, 2021-05-26 at 12:49 +0200, Paolo Bonzini wrote:
> > On 26/05/21 01:45, Ben Gardon wrote:
> > > At Google we have an informal practice of adding sysctls to control some 
> > > KVM features. Usually these just act as simple "chicken bits" which 
> > > allow us to turn off a feature without having to stall a kernel rollout 
> > > if some feature causes problems. (Sysctls were used for reasons specific 
> > > to Google infrastructure, not because they're necessarily better.)
> > > 
> > > We'd like to get rid of this divergence with upstream by converting the 
> > > sysctls to writable module parameters, but I'm not sure what the general 
> > > guidance is on writable module parameters. Looking through KVM, it seems 
> > > like we have several writable parameters, but they're mostly read-only.
> > 
> > Sure, making them writable is okay.  Most KVM parameters are read-only 
> > because it's much simpler (the usecase for introducing them was simply 
> > "test what would happen on old processors").  What are these features 
> > that you'd like to control?

My $0.02 is that most parameters should remain read-only, and making a param
writable (new or existing) must come with strong justification for taking on the
extra complexity.

I absolutely agree that making select params writable adds a ton of value, e.g.
being able to switch to/from the TDP MMU without reloading KVM saves a lot of
time when testing, toggling forced flush/sync on PGD reuse is extremely valuable
for triage and/or mitigation, etc...  But writable params should either bring a
lot of value and/or add near-zero complexity.

> > > I also don't see central documentation of the module parameters. They're 
> > > mentioned in the documentation for other features, but don't have their 
> > > own section / file. Should they?
> > 
> > They probably should, yes.
> > 
> > Paolo
> > 
> I vote (because I have fun with my win98 once in a while), to make 'npt'
> writable, since that is the only way to make it run on KVM on AMD.

For posterity, "that" refers to disabling NPT, not making 'npt' writable :-)

Making 'npt' writable is probably feasible ('ept' would be beyond messy), but I
strongly prefer to keep it read-only.  The direct impacts on the MMU and SVM
aren't too bad, but NPT is required for SEV and VLS, affects kvm_cpu_caps, etc...
And, no offense to win98, there's isn't a strong use case because outside of
personal usage, the host admin/VMM doesn't know that the guest will be running a
broken kernel.

> My personal itch only though!
> 
> Best regards,
> 	Maxim Levitsky
>