linux-kernel - Re: [PATCH v3 4/8] KVM: Add a module param to allow enabling virtualization when KVM is loaded

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <7e12a22947bdaf7fb4693000c5dbcf24a20e6326.camel@intel.com>
Date: Fri, 2 Aug 2024 12:02:02 +0000
From: "Huang, Kai" <kai.huang@...el.com>
To: "pbonzini@...hat.com" <pbonzini@...hat.com>, "seanjc@...gle.com"
	<seanjc@...gle.com>
CC: "kvm@...r.kernel.org" <kvm@...r.kernel.org>,
	"linux-kernel@...r.kernel.org" <linux-kernel@...r.kernel.org>, "Gao, Chao"
	<chao.gao@...el.com>
Subject: Re: [PATCH v3 4/8] KVM: Add a module param to allow enabling
 virtualization when KVM is loaded

> +static void kvm_uninit_virtualization(void)
> +{
> +	if (enable_virt_at_load)
> +		kvm_disable_virtualization();
> +
> +	WARN_ON(kvm_usage_count);
> +}
> 

Hi Sean,

The above "WARN_ON(kvm_usage_count);" assumes the
kvm_uninit_virtualization() is the last call of
kvm_disable_virtualization(), and it is called ...

> @@ -6433,6 +6468,8 @@ void kvm_exit(void)
>  	 */
>  	misc_deregister(&kvm_dev);
>  
> +	kvm_uninit_virtualization();
> +
> 

... from kvm_exit().

Accordingly, kvm_init_virtualization() is called in kvm_init().

For TDX, we want to "explicitly call kvm_enable_virtualization() +
initializing TDX module" before kvm_init() in vt_init(), since kvm_init()
is supposed to be the last step after initializing TDX.

In the exit path, accordingly, for TDX we want to call kvm_exit() first,
and then "do TDX cleanup staff + explicitly call
kvm_disable_virtualizaation()".

This will trigger the above "WARN_ON(kvm_usage_count);" when
enable_virt_at_load is true, because kvm_uninit_virtualization() isn't
the last call of kvm_disable_virtualization().

To resolve, I think one way is we can move kvm_init_virtualization() out
of kvm_init(), but I am not sure whether there's another common place
that kvm_init_virtualization() can be called for all ARCHs.

Do you have any comments?