linux-kernel - Re: [tip:x86/platform] x86/hyper-v: Use hypercall for remote TLB flush

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20170810192742.GJ6524@worktop.programming.kicks-ass.net>
Date:   Thu, 10 Aug 2017 21:27:42 +0200
From:   Peter Zijlstra <peterz@...radead.org>
To:     Jork Loeser <Jork.Loeser@...rosoft.com>
Cc:     KY Srinivasan <kys@...rosoft.com>,
        Simon Xiao <sixiao@...rosoft.com>,
        Haiyang Zhang <haiyangz@...rosoft.com>,
        Stephen Hemminger <sthemmin@...rosoft.com>,
        "torvalds@...ux-foundation.org" <torvalds@...ux-foundation.org>,
        "luto@...nel.org" <luto@...nel.org>,
        "hpa@...or.com" <hpa@...or.com>,
        "vkuznets@...hat.com" <vkuznets@...hat.com>,
        "linux-kernel@...r.kernel.org" <linux-kernel@...r.kernel.org>,
        "rostedt@...dmis.org" <rostedt@...dmis.org>,
        "andy.shevchenko@...il.com" <andy.shevchenko@...il.com>,
        "tglx@...utronix.de" <tglx@...utronix.de>,
        "mingo@...nel.org" <mingo@...nel.org>,
        "linux-tip-commits@...r.kernel.org" 
        <linux-tip-commits@...r.kernel.org>
Subject: Re: [tip:x86/platform] x86/hyper-v: Use hypercall for remote TLB
 flush

On Thu, Aug 10, 2017 at 07:08:22PM +0000, Jork Loeser wrote:

> > > Subject: Re: [tip:x86/platform] x86/hyper-v: Use hypercall for remote TLB flush
> 
> > > Hold on.. if we don't IPI for TLB invalidation. What serializes our
> > > software page table walkers like fast_gup() ?
> > 
> > Hypervisor may implement this functionality via an IPI.
> > 
> > K. Y
> 
> HvFlushVirtualAddressList() states:
> This call guarantees that by the time control returns back to the
> caller, the observable effects of all flushes on the specified virtual
> processors have occurred.
> 
> HvFlushVirtualAddressListEx() refers to HvFlushVirtualAddressList() as adding sparse target VP lists.
> 
> Is this enough of a guarantee, or do you see other races?

That's nowhere near enough. We need the remote CPU to have completed any
guest IF section that was in progress at the time of the call.

So if a host IPI can interrupt a guest while the guest has IF cleared,
and we then process the host IPI -- clear the TLBs -- before resuming the
guest, which still has IF cleared, we've got a problem.

Because at that point, our software page-table walker, that relies on IF
being clear to guarantee the page-tables exist, because it holds off the
TLB invalidate and thereby the freeing of the pages, gets its pages
ripped out from under it.