From patchwork Wed Jan 31 09:07:35 2018 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Alexander Graf X-Patchwork-Id: 10193563 Return-Path: Received: from mail.wl.linuxfoundation.org (pdx-wl-mail.web.codeaurora.org [172.30.200.125]) by pdx-korg-patchwork.web.codeaurora.org (Postfix) with ESMTP id 9AC0660595 for ; Wed, 31 Jan 2018 09:07:49 +0000 (UTC) Received: from mail.wl.linuxfoundation.org (localhost [127.0.0.1]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id 952A61FF66 for ; Wed, 31 Jan 2018 09:07:49 +0000 (UTC) Received: by mail.wl.linuxfoundation.org (Postfix, from userid 486) id 89B1D28138; Wed, 31 Jan 2018 09:07:49 +0000 (UTC) X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on pdx-wl-mail.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-6.9 required=2.0 tests=BAYES_00,RCVD_IN_DNSWL_HI autolearn=ham version=3.3.1 Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id C53371FF66 for ; Wed, 31 Jan 2018 09:07:48 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1752324AbeAaJHo (ORCPT ); Wed, 31 Jan 2018 04:07:44 -0500 Received: from mx2.suse.de ([195.135.220.15]:54091 "EHLO mx2.suse.de" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1751320AbeAaJHi (ORCPT ); Wed, 31 Jan 2018 04:07:38 -0500 X-Virus-Scanned: by amavisd-new at test-mx.suse.de Received: from relay1.suse.de (charybdis-ext.suse.de [195.135.220.254]) by mx2.suse.de (Postfix) with ESMTP id A589BABB1; Wed, 31 Jan 2018 09:07:36 +0000 (UTC) Subject: Re: [PATCH] KVM: PPC: Book3S PR: close a race window when SVCPU pointer is hold before kvmppc_copy_from_svcpu() To: wei.guo.simon@gmail.com, kvm-ppc@vger.kernel.org Cc: kvm@vger.kernel.org, linuxppc-dev@lists.ozlabs.org, Paul Mackerras References: <1517372604-21405-1-git-send-email-wei.guo.simon@gmail.com> From: Alexander Graf Message-ID: <1b9a0861-6368-9a84-4d6e-cc9f05ef1be5@suse.de> Date: Wed, 31 Jan 2018 10:07:35 +0100 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.13; rv:52.0) Gecko/20100101 Thunderbird/52.5.2 MIME-Version: 1.0 In-Reply-To: <1517372604-21405-1-git-send-email-wei.guo.simon@gmail.com> Content-Language: en-US Sender: kvm-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: kvm@vger.kernel.org X-Virus-Scanned: ClamAV using ClamSMTP On 31.01.18 05:23, wei.guo.simon@gmail.com wrote: > From: Simon Guo > > commit 40fdd8c88c4a ("KVM: PPC: Book3S: PR: Make svcpu -> vcpu store > preempt savvy") and commit 3d3319b45eea ("KVM: PPC: Book3S: PR: Enable > interrupts earlier") is trying to turns on preemption early when > return into highmem guest exit handler. > > However there is a race window in following example at > arch/powerpc/kvm/book3s_interrupts.S: > > highmem guest exit handler: > ... > 195 GET_SHADOW_VCPU(r4) > 196 bl FUNC(kvmppc_copy_from_svcpu) > ... > 239 bl FUNC(kvmppc_handle_exit_pr) > > If there comes a preemption between line 195 and 196, line 196 > may hold an invalid SVCPU reference with following sequence: > 1) Qemu task T1 runs at GET_SHADOW_VCPU(r4) at line 195, on CPU A. > 2) T1 is preempted and switch out CPU A. As a result, it checks > CPU A's svcpu->in_use (=1 at present) and flush cpu A's svcpu to > T1's vcpu. > 3) Another task T2 switches into CPU A and it may update CPU A's > svcpu->in_use into 1. > 4) T1 is scheduled into CPU B. But it still holds CPU A's svcpu > reference as R4. Then it executes kvmppc_copy_from_svcpu() with > R4 and it will corrupt T1's VCPU with T2's content. T2's VCPU > will also be impacted. > > This patch moves the svcpu->in_use into VCPU so that the vcpus > sharing the same svcpu can work properly and fix the above case. > > Signed-off-by: Simon Guo To me the description above sounds like what we really need to do is move the preempt_disable() before GET_SHADOW_VCPU(). Or alternative put GET_SHADOW_VCPU into kvmppc_copy_from_svcpu(). I guess along those lines we should also update the comment above GET_SHADOW_VCPU() that says interrupts are disabled ;). I would really like to keep the fact that the svcpu is currently used as close to the svcpu as possible. Does the untested patch below work for you? Because TB breaks whitespace, I've also uploaded it to github: https://github.com/agraf/linux-2.6/commit/2469804ed37b41167e9d97f4d72da24cdcb9f959 Alex From: Alexander Graf Date: Wed, 31 Jan 2018 09:48:09 +0100 Subject: [PATCH] KVM: PPC: Fix svcpu copying with preemption enabled When copying between the vcpu and svcpu, we may get scheduled away onto a different host CPU which in turn means our svcpu pointer may change. That means we need to atomically copy to and from the svcpu with preemption disabled, so that all code around it always sees a coherent state. Reported-by: Simon Guo Fixes: 3d3319b45eea ("KVM: PPC: Book3S: PR: Enable interrupts earlier") Signed-off-by: Alexander Graf to_book3s(vcpu)->slb_shadow_max = svcpu->slb_max; @@ -143,9 +143,16 @@ static void kvmppc_core_vcpu_put_pr(struct kvm_vcpu *vcpu) } /* Copy data needed by real-mode code from vcpu to shadow vcpu */ -void kvmppc_copy_to_svcpu(struct kvmppc_book3s_shadow_vcpu *svcpu, - struct kvm_vcpu *vcpu) +void kvmppc_copy_to_svcpu(struct kvm_vcpu *vcpu) { + struct kvmppc_book3s_shadow_vcpu *svcpu; + + /* On preemption the svcpu pointer may change, so disable it */ + preempt_disable(); + + /* We need to make sure we fetch the svcpu with preemption disabled */ + svcpu = current->thread.kvm_shadow_vcpu; + svcpu->gpr[0] = vcpu->arch.gpr[0]; svcpu->gpr[1] = vcpu->arch.gpr[1]; svcpu->gpr[2] = vcpu->arch.gpr[2]; @@ -177,18 +184,24 @@ void kvmppc_copy_to_svcpu(struct kvmppc_book3s_shadow_vcpu *svcpu, if (cpu_has_feature(CPU_FTR_ARCH_207S)) vcpu->arch.entry_ic = mfspr(SPRN_IC); svcpu->in_use = true; + + preempt_enable(); } /* Copy data touched by real-mode code from shadow vcpu back to vcpu */ -void kvmppc_copy_from_svcpu(struct kvm_vcpu *vcpu, - struct kvmppc_book3s_shadow_vcpu *svcpu) +void kvmppc_copy_from_svcpu(struct kvm_vcpu *vcpu) { + struct kvmppc_book3s_shadow_vcpu *svcpu; + /* * vcpu_put would just call us again because in_use hasn't * been updated yet. */ preempt_disable(); + /* We need to make sure we fetch the svcpu with preemption disabled */ + svcpu = current->thread.kvm_shadow_vcpu; + /* * Maybe we were already preempted and synced the svcpu from * our preempt notifiers. Don't bother touching this svcpu then. diff --git a/arch/powerpc/include/asm/kvm_book3s.h b/arch/powerpc/include/asm/kvm_book3s.h index 9a667007bff8..376ae803b69c 100644 --- a/arch/powerpc/include/asm/kvm_book3s.h +++ b/arch/powerpc/include/asm/kvm_book3s.h @@ -249,10 +249,8 @@ extern int kvmppc_h_pr(struct kvm_vcpu *vcpu, unsigned long cmd); extern void kvmppc_pr_init_default_hcalls(struct kvm *kvm); extern int kvmppc_hcall_impl_pr(unsigned long cmd); extern int kvmppc_hcall_impl_hv_realmode(unsigned long cmd); -extern void kvmppc_copy_to_svcpu(struct kvmppc_book3s_shadow_vcpu *svcpu, - struct kvm_vcpu *vcpu); -extern void kvmppc_copy_from_svcpu(struct kvm_vcpu *vcpu, - struct kvmppc_book3s_shadow_vcpu *svcpu); +extern void kvmppc_copy_to_svcpu(struct kvm_vcpu *vcpu); +extern void kvmppc_copy_from_svcpu(struct kvm_vcpu *vcpu); extern int kvm_irq_bypass; static inline struct kvmppc_vcpu_book3s *to_book3s(struct kvm_vcpu *vcpu) diff --git a/arch/powerpc/kvm/book3s_interrupts.S b/arch/powerpc/kvm/book3s_interrupts.S index 901e6fe00c39..c18e845019ec 100644 --- a/arch/powerpc/kvm/book3s_interrupts.S +++ b/arch/powerpc/kvm/book3s_interrupts.S @@ -96,7 +96,7 @@ kvm_start_entry: kvm_start_lightweight: /* Copy registers into shadow vcpu so we can access them in real mode */ - GET_SHADOW_VCPU(r3) + mr r3, r4 bl FUNC(kvmppc_copy_to_svcpu) nop REST_GPR(4, r1) @@ -165,9 +165,7 @@ after_sprg3_load: stw r12, VCPU_TRAP(r3) /* Transfer reg values from shadow vcpu back to vcpu struct */ - /* On 64-bit, interrupts are still off at this point */ - GET_SHADOW_VCPU(r4) bl FUNC(kvmppc_copy_from_svcpu) nop diff --git a/arch/powerpc/kvm/book3s_pr.c b/arch/powerpc/kvm/book3s_pr.c index 7deaeeb14b93..f5c7797a38d7 100644 --- a/arch/powerpc/kvm/book3s_pr.c +++ b/arch/powerpc/kvm/book3s_pr.c @@ -121,7 +121,7 @@ static void kvmppc_core_vcpu_put_pr(struct kvm_vcpu *vcpu) #ifdef CONFIG_PPC_BOOK3S_64 struct kvmppc_book3s_shadow_vcpu *svcpu = svcpu_get(vcpu); if (svcpu->in_use) { - kvmppc_copy_from_svcpu(vcpu, svcpu); + kvmppc_copy_from_svcpu(vcpu); } memcpy(to_book3s(vcpu)->slb_shadow, svcpu->slb, sizeof(svcpu->slb));