From: Paul Mackerras <paulus@samba.org> To: kvm@vger.kernel.org, kvm-ppc@vger.kernel.org Cc: Alexander Graf <agraf@suse.de> Subject: [PATCH 3/5] KVM: PPC: Book3S HV: Fix race in reading change bit when removing HPTE Date: Wed, 24 Jun 2015 21:18:05 +1000 [thread overview] Message-ID: <1435144687-8071-4-git-send-email-paulus@samba.org> (raw) In-Reply-To: <1435144687-8071-1-git-send-email-paulus@samba.org> The reference (R) and change (C) bits in a HPT entry can be set by hardware at any time up until the HPTE is invalidated and the TLB invalidation sequence has completed. This means that when removing a HPTE, we need to read the HPTE after the invalidation sequence has completed in order to obtain reliable values of R and C. The code in kvmppc_do_h_remove() used to do this. However, commit 6f22bd3265fb ("KVM: PPC: Book3S HV: Make HTAB code LE host aware") removed the read after invalidation as a side effect of other changes. This restores the read of the HPTE after invalidation. The user-visible effect of this bug would be that when migrating a guest, there is a small probability that a page modified by the guest and then unmapped by the guest might not get re-transmitted and thus the destination might end up with a stale copy of the page. Fixes: 6f22bd3265fb Cc: stable@vger.kernel.org # v3.17+ Signed-off-by: Paul Mackerras <paulus@samba.org> --- arch/powerpc/kvm/book3s_hv_rm_mmu.c | 18 ++++++++++++------ 1 file changed, 12 insertions(+), 6 deletions(-) diff --git a/arch/powerpc/kvm/book3s_hv_rm_mmu.c b/arch/powerpc/kvm/book3s_hv_rm_mmu.c index b027a89..c6d601c 100644 --- a/arch/powerpc/kvm/book3s_hv_rm_mmu.c +++ b/arch/powerpc/kvm/book3s_hv_rm_mmu.c @@ -421,14 +421,20 @@ long kvmppc_do_h_remove(struct kvm *kvm, unsigned long flags, rev = real_vmalloc_addr(&kvm->arch.revmap[pte_index]); v = pte & ~HPTE_V_HVLOCK; if (v & HPTE_V_VALID) { - u64 pte1; - - pte1 = be64_to_cpu(hpte[1]); hpte[0] &= ~cpu_to_be64(HPTE_V_VALID); - rb = compute_tlbie_rb(v, pte1, pte_index); + rb = compute_tlbie_rb(v, be64_to_cpu(hpte[1]), pte_index); do_tlbies(kvm, &rb, 1, global_invalidates(kvm, flags), true); - /* Read PTE low word after tlbie to get final R/C values */ - remove_revmap_chain(kvm, pte_index, rev, v, pte1); + /* + * The reference (R) and change (C) bits in a HPT + * entry can be set by hardware at any time up until + * the HPTE is invalidated and the TLB invalidation + * sequence has completed. This means that when + * removing a HPTE, we need to re-read the HPTE after + * the invalidation sequence has completed in order to + * obtain reliable values of R and C. + */ + remove_revmap_chain(kvm, pte_index, rev, v, + be64_to_cpu(hpte[1])); } r = rev->guest_rpte & ~HPTE_GR_RESERVED; note_hpte_modification(kvm, rev); -- 2.1.4
WARNING: multiple messages have this Message-ID (diff)
From: Paul Mackerras <paulus@samba.org> To: kvm@vger.kernel.org, kvm-ppc@vger.kernel.org Cc: Alexander Graf <agraf@suse.de> Subject: [PATCH 3/5] KVM: PPC: Book3S HV: Fix race in reading change bit when removing HPTE Date: Wed, 24 Jun 2015 11:18:05 +0000 [thread overview] Message-ID: <1435144687-8071-4-git-send-email-paulus@samba.org> (raw) In-Reply-To: <1435144687-8071-1-git-send-email-paulus@samba.org> The reference (R) and change (C) bits in a HPT entry can be set by hardware at any time up until the HPTE is invalidated and the TLB invalidation sequence has completed. This means that when removing a HPTE, we need to read the HPTE after the invalidation sequence has completed in order to obtain reliable values of R and C. The code in kvmppc_do_h_remove() used to do this. However, commit 6f22bd3265fb ("KVM: PPC: Book3S HV: Make HTAB code LE host aware") removed the read after invalidation as a side effect of other changes. This restores the read of the HPTE after invalidation. The user-visible effect of this bug would be that when migrating a guest, there is a small probability that a page modified by the guest and then unmapped by the guest might not get re-transmitted and thus the destination might end up with a stale copy of the page. Fixes: 6f22bd3265fb Cc: stable@vger.kernel.org # v3.17+ Signed-off-by: Paul Mackerras <paulus@samba.org> --- arch/powerpc/kvm/book3s_hv_rm_mmu.c | 18 ++++++++++++------ 1 file changed, 12 insertions(+), 6 deletions(-) diff --git a/arch/powerpc/kvm/book3s_hv_rm_mmu.c b/arch/powerpc/kvm/book3s_hv_rm_mmu.c index b027a89..c6d601c 100644 --- a/arch/powerpc/kvm/book3s_hv_rm_mmu.c +++ b/arch/powerpc/kvm/book3s_hv_rm_mmu.c @@ -421,14 +421,20 @@ long kvmppc_do_h_remove(struct kvm *kvm, unsigned long flags, rev = real_vmalloc_addr(&kvm->arch.revmap[pte_index]); v = pte & ~HPTE_V_HVLOCK; if (v & HPTE_V_VALID) { - u64 pte1; - - pte1 = be64_to_cpu(hpte[1]); hpte[0] &= ~cpu_to_be64(HPTE_V_VALID); - rb = compute_tlbie_rb(v, pte1, pte_index); + rb = compute_tlbie_rb(v, be64_to_cpu(hpte[1]), pte_index); do_tlbies(kvm, &rb, 1, global_invalidates(kvm, flags), true); - /* Read PTE low word after tlbie to get final R/C values */ - remove_revmap_chain(kvm, pte_index, rev, v, pte1); + /* + * The reference (R) and change (C) bits in a HPT + * entry can be set by hardware at any time up until + * the HPTE is invalidated and the TLB invalidation + * sequence has completed. This means that when + * removing a HPTE, we need to re-read the HPTE after + * the invalidation sequence has completed in order to + * obtain reliable values of R and C. + */ + remove_revmap_chain(kvm, pte_index, rev, v, + be64_to_cpu(hpte[1])); } r = rev->guest_rpte & ~HPTE_GR_RESERVED; note_hpte_modification(kvm, rev); -- 2.1.4
next prev parent reply other threads:[~2015-06-24 11:18 UTC|newest] Thread overview: 20+ messages / expand[flat|nested] mbox.gz Atom feed top 2015-06-24 11:18 [PATCH 0/5] PPC: Current patch queue for HV KVM Paul Mackerras 2015-06-24 11:18 ` Paul Mackerras 2015-06-24 11:18 ` [PATCH 1/5] KVM: PPC: Book3S HV: Make use of unused threads when running guests Paul Mackerras 2015-06-24 11:18 ` Paul Mackerras 2015-06-24 11:18 ` [PATCH 2/5] KVM: PPC: Book3S HV: Implement dynamic micro-threading on POWER8 Paul Mackerras 2015-06-24 11:18 ` Paul Mackerras 2015-06-30 9:35 ` Alexander Graf 2015-06-30 9:35 ` Alexander Graf 2015-06-30 11:41 ` [PATCH v2 " Paul Mackerras 2015-06-30 11:41 ` Paul Mackerras 2015-07-02 10:38 ` [PATCH v3] " Paul Mackerras 2015-07-02 10:38 ` Paul Mackerras 2015-06-24 11:18 ` Paul Mackerras [this message] 2015-06-24 11:18 ` [PATCH 3/5] KVM: PPC: Book3S HV: Fix race in reading change bit when removing HPTE Paul Mackerras 2015-06-24 11:18 ` [PATCH 4/5] KVM: PPC: Book3S HV: Fix bug in dirty page tracking Paul Mackerras 2015-06-24 11:18 ` Paul Mackerras 2015-06-24 11:18 ` [PATCH 5/5] KVM: PPC: Book3S HV: Implement H_CLEAR_REF and H_CLEAR_MOD Paul Mackerras 2015-06-24 11:18 ` Paul Mackerras 2015-07-01 13:49 ` [PATCH 0/5] PPC: Current patch queue for HV KVM Alexander Graf 2015-07-01 13:49 ` Alexander Graf
Reply instructions: You may reply publicly to this message via plain-text email using any one of the following methods: * Save the following mbox file, import it into your mail client, and reply-to-all from there: mbox Avoid top-posting and favor interleaved quoting: https://en.wikipedia.org/wiki/Posting_style#Interleaved_style * Reply using the --to, --cc, and --in-reply-to switches of git-send-email(1): git send-email \ --in-reply-to=1435144687-8071-4-git-send-email-paulus@samba.org \ --to=paulus@samba.org \ --cc=agraf@suse.de \ --cc=kvm-ppc@vger.kernel.org \ --cc=kvm@vger.kernel.org \ /path/to/YOUR_REPLY https://kernel.org/pub/software/scm/git/docs/git-send-email.html * If your mail client supports setting the In-Reply-To header via mailto: links, try the mailto: linkBe sure your reply has a Subject: header at the top and a blank line before the message body.
This is an external index of several public inboxes, see mirroring instructions on how to clone and mirror all data and code used by this external index.