linux-kernel - Re: [PATCH v2] KVM: x86: Preserve TDP MMU roots until they are explicitly invalidated

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <CALzav=f=TFoqpR5tPDPOujoO6Gix-+zL-sZyyZK27qJvGPP9dg@mail.gmail.com>
Date:   Fri, 21 Apr 2023 16:12:48 -0700
From:   David Matlack <dmatlack@...gle.com>
To:     Sean Christopherson <seanjc@...gle.com>
Cc:     Paolo Bonzini <pbonzini@...hat.com>, kvm@...r.kernel.org,
        linux-kernel@...r.kernel.org,
        Jeremi Piotrowski <jpiotrowski@...ux.microsoft.com>,
        Ben Gardon <bgardon@...gle.com>
Subject: Re: [PATCH v2] KVM: x86: Preserve TDP MMU roots until they are
 explicitly invalidated

On Fri, Apr 21, 2023 at 2:49 PM Sean Christopherson <seanjc@...gle.com> wrote:
>
>  void kvm_tdp_mmu_invalidate_all_roots(struct kvm *kvm)
>  {
>         struct kvm_mmu_page *root;
>
> -       lockdep_assert_held_write(&kvm->mmu_lock);
> -       list_for_each_entry(root, &kvm->arch.tdp_mmu_roots, link) {
> -               if (!root->role.invalid &&
> -                   !WARN_ON_ONCE(!kvm_tdp_mmu_get_root(root))) {
> +       /*
> +        * Note!  mmu_lock isn't held when destroying the VM!  There can't be
> +        * other references to @kvm, i.e. nothing else can invalidate roots,
> +        * but walking the list of roots does need to be guarded against roots
> +        * being deleted by the asynchronous zap worker.
> +        */
> +       rcu_read_lock();
> +
> +       list_for_each_entry_rcu(root, &kvm->arch.tdp_mmu_roots, link) {

I see that roots are removed from the list with list_del_rcu(), so I
agree this should be safe.

KVM could, alternatively, acquire the mmu_lock in
kvm_mmu_uninit_tdp_mmu(), which would let us keep the lockdep
assertion and drop the rcu_read_lock() + comment. That might be worth
it in case someone accidentally adds a call to
kvm_tdp_mmu_invalidate_all_roots() without mmu_lock outside of VM
teardown. kvm_mmu_uninit_tdp_mmu() is not a particularly performance
sensitive path and adding the mmu_lock wouldn't add much overhead
anyway (it would block for at most a few milliseconds waiting for the
async work to reschedule).