On Thu, Oct 23, 2025 at 08:14:04AM -0700, Sean Christopherson wrote: > On Thu, Oct 23, 2025, Yan Zhao wrote: > > On Thu, Oct 16, 2025 at 05:32:37PM -0700, Sean Christopherson wrote: > > > Unconditionally assert that mmu_lock is held for write when removing S-EPT > > > entries, not just when removing S-EPT entries triggers certain conditions, > > > e.g. needs to do TDH_MEM_TRACK or kick vCPUs out of the guest. > > > Conditionally asserting implies that it's safe to hold mmu_lock for read > > > when those paths aren't hit, which is simply not true, as KVM doesn't > > > support removing S-EPT entries under read-lock. > > > > > > Only two paths lead to remove_external_spte(), and both paths asserts that > > > mmu_lock is held for write (tdp_mmu_set_spte() via lockdep, and > > > handle_removed_pt() via KVM_BUG_ON()). > > > > > > Deliberately leave lockdep assertions in the "no vCPUs" helpers to > > > document > > > that wait_for_sept_zap is guarded by holding mmu_lock for write. > > > > > > Signed-off-by: Sean Christopherson <[email protected]> > > > --- > > > arch/x86/kvm/vmx/tdx.c | 4 ++-- > > > 1 file changed, 2 insertions(+), 2 deletions(-) > > > > > > diff --git a/arch/x86/kvm/vmx/tdx.c b/arch/x86/kvm/vmx/tdx.c > > > index e517ad3d5f4f..f6782b0ffa98 100644 > > > --- a/arch/x86/kvm/vmx/tdx.c > > > +++ b/arch/x86/kvm/vmx/tdx.c > > > @@ -1711,8 +1711,6 @@ static void tdx_track(struct kvm *kvm) > > > if (unlikely(kvm_tdx->state != TD_STATE_RUNNABLE)) > > > return; > > > > > > - lockdep_assert_held_write(&kvm->mmu_lock); > > Could we also deliberately leave lockdep assertion for tdx_track()? > > Can do. > > > This is because if we allow removing S-EPT entries while holding mmu_lock > > for > > read in future, tdx_track() needs to be protected by a separate spinlock to > > ensure serialization of tdh_mem_track() and vCPUs kick-off (kicking off > > vCPUs > > must follow each tdh_mem_track() to unblock the next tdh_mem_track()). > > Does this look/sound right? LGTM. Thanks!
> From: Sean Christopherson <[email protected]> > Date: Thu, 28 Aug 2025 17:06:17 -0700 > Subject: [PATCH] KVM: TDX: Assert that mmu_lock is held for write when > removing S-EPT entries > > Unconditionally assert that mmu_lock is held for write when removing S-EPT > entries, not just when removing S-EPT entries triggers certain conditions, > e.g. needs to do TDH_MEM_TRACK or kick vCPUs out of the guest. > Conditionally asserting implies that it's safe to hold mmu_lock for read > when those paths aren't hit, which is simply not true, as KVM doesn't > support removing S-EPT entries under read-lock. > > Only two paths lead to remove_external_spte(), and both paths asserts that > mmu_lock is held for write (tdp_mmu_set_spte() via lockdep, and > handle_removed_pt() via KVM_BUG_ON()). > > Deliberately leave lockdep assertions in the "no vCPUs" helpers to document > that wait_for_sept_zap is guarded by holding mmu_lock for write, and keep > the conditional assert in tdx_track() as well, but with a comment to help > explain why holding mmu_lock for write matters (above and beyond why > tdx_sept_remove_private_spte()'s requirements). > > Signed-off-by: Sean Christopherson <[email protected]> > --- > arch/x86/kvm/vmx/tdx.c | 7 +++++++ > 1 file changed, 7 insertions(+) > > diff --git a/arch/x86/kvm/vmx/tdx.c b/arch/x86/kvm/vmx/tdx.c > index dca9e2561270..899051c64faa 100644 > --- a/arch/x86/kvm/vmx/tdx.c > +++ b/arch/x86/kvm/vmx/tdx.c > @@ -1715,6 +1715,11 @@ static void tdx_track(struct kvm *kvm) > if (unlikely(kvm_tdx->state != TD_STATE_RUNNABLE)) > return; > > + /* > + * The full sequence of TDH.MEM.TRACK and forcing vCPUs out of guest > + * mode must be serialized, as TDH.MEM.TRACK will fail if the previous > + * tracking epoch hasn't completed. > + */ > lockdep_assert_held_write(&kvm->mmu_lock); > > err = tdh_mem_track(&kvm_tdx->td); > @@ -1762,6 +1767,8 @@ static void tdx_sept_remove_private_spte(struct kvm > *kvm, gfn_t gfn, > gpa_t gpa = gfn_to_gpa(gfn); > u64 err, entry, level_state; > > + lockdep_assert_held_write(&kvm->mmu_lock); > + > /* > * HKID is released after all private pages have been removed, and set > * before any might be populated. Warn if zapping is attempted when > > base-commit: 69564844a116861ebea4396894005c8b4e48f870 > --
