linux-kernel - Re: [RFC PATCH 6/8] kvm: gmem: Temporarily restore direct map entries when needed

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <74e92b31-e48d-484f-b819-ef7f07faad63@redhat.com>
Date: Thu, 11 Jul 2024 08:25:39 +0200
From: Paolo Bonzini <pbonzini@...hat.com>
To: Patrick Roy <roypat@...zon.co.uk>, seanjc@...gle.com,
 akpm@...ux-foundation.org, dwmw@...zon.co.uk, rppt@...nel.org,
 david@...hat.com
Cc: tglx@...utronix.de, mingo@...hat.com, bp@...en8.de,
 dave.hansen@...ux.intel.com, x86@...nel.org, hpa@...or.com,
 willy@...radead.org, graf@...zon.com, derekmn@...zon.com,
 kalyazin@...zon.com, kvm@...r.kernel.org, linux-kernel@...r.kernel.org,
 linux-mm@...ck.org, dmatlack@...gle.com, tabba@...gle.com,
 chao.p.peng@...ux.intel.com, xmarcalx@...zon.co.uk
Subject: Re: [RFC PATCH 6/8] kvm: gmem: Temporarily restore direct map entries
 when needed

On 7/9/24 15:20, Patrick Roy wrote:
> If KVM_GMEM_NO_DIRECT_MAP is set, and KVM tries to internally access
> guest-private memory inside kvm_{read,write}_guest, or via a
> gfn_to_pfn_cache, temporarily restore the direct map entry.
> 
> To avoid race conditions between two threads restoring or zapping direct
> map entries for the same page and potentially interfering with each
> other (e.g. unfortune interweavings of map->read->unmap in the form of
> map(A)->map(B)->read(A)->unmap(A)->read(B) [BOOM]), the following
> invariant is upheld in this patch:
> 
> - Only a single gfn_to_pfn_cache can exist for any given pfn, and

I think this is not ensured.  You can however use 
set_page_private()/page_private() to count the number of references.

Paolo

> - All non-gfn_to_pfn_cache code paths that temporarily restore direct
>    map entries complete the entire map->access->unmap critical section
> while holding the folio lock.