| Message ID | 20161116054328.ik74cdnkvd37yxej@oak.ozlabs.ibm.com |
|---|---|
| State | Accepted |
| Headers | show |
On Wed, Nov 16, 2016 at 04:43:28PM +1100, Paul Mackerras wrote: > The hashed page table MMU in POWER processors can update the R > (reference) and C (change) bits in a HPTE at any time until the > HPTE has been invalidated and the TLB invalidation sequence has > completed. In kvmppc_h_protect, which implements the H_PROTECT > hypercall, we read the HPTE, modify the second doubleword, > invalidate the HPTE in memory, do the TLB invalidation sequence, > and then write the modified value of the second doubleword back > to memory. In doing so we could overwrite an R/C bit update done > by hardware between when we read the HPTE and when the TLB > invalidation completed. To fix this we re-read the second > doubleword after the TLB invalidation and OR in the (possibly) > new values of R and C. We can use an OR since hardware only ever > sets R and C, never clears them. > > This race was found by code inspection. In principle this bug could > cause occasional guest memory corruption under host memory pressure. > > Fixes: a8606e20e41a ("KVM: PPC: Handle some PAPR hcalls in the kernel", 2011-06-29) > Cc: stable@vger.kernel.org # v3.19+ > Signed-off-by: Paul Mackerras <paulus@ozlabs.org> Applied to kvm-ppc-next. Paul. -- To unsubscribe from this list: send the line "unsubscribe kvm-ppc" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html
diff --git a/arch/powerpc/kvm/book3s_hv_rm_mmu.c b/arch/powerpc/kvm/book3s_hv_rm_mmu.c index 752451f3..02786b3 100644 --- a/arch/powerpc/kvm/book3s_hv_rm_mmu.c +++ b/arch/powerpc/kvm/book3s_hv_rm_mmu.c @@ -670,6 +670,8 @@ long kvmppc_h_protect(struct kvm_vcpu *vcpu, unsigned long flags, HPTE_V_ABSENT); do_tlbies(kvm, &rb, 1, global_invalidates(kvm, flags), true); + /* Don't lose R/C bit updates done by hardware */ + r |= be64_to_cpu(hpte[1]) & (HPTE_R_R | HPTE_R_C); hpte[1] = cpu_to_be64(r); } }
The hashed page table MMU in POWER processors can update the R (reference) and C (change) bits in a HPTE at any time until the HPTE has been invalidated and the TLB invalidation sequence has completed. In kvmppc_h_protect, which implements the H_PROTECT hypercall, we read the HPTE, modify the second doubleword, invalidate the HPTE in memory, do the TLB invalidation sequence, and then write the modified value of the second doubleword back to memory. In doing so we could overwrite an R/C bit update done by hardware between when we read the HPTE and when the TLB invalidation completed. To fix this we re-read the second doubleword after the TLB invalidation and OR in the (possibly) new values of R and C. We can use an OR since hardware only ever sets R and C, never clears them. This race was found by code inspection. In principle this bug could cause occasional guest memory corruption under host memory pressure. Fixes: a8606e20e41a ("KVM: PPC: Handle some PAPR hcalls in the kernel", 2011-06-29) Cc: stable@vger.kernel.org # v3.19+ Signed-off-by: Paul Mackerras <paulus@ozlabs.org> --- arch/powerpc/kvm/book3s_hv_rm_mmu.c | 2 ++ 1 file changed, 2 insertions(+)