KVM: PPC: Book3S HV: Don't lose hardware R/C bit updates in H_PROTECT

The hashed page table MMU in POWER processors can update the R
(reference) and C (change) bits in a HPTE at any time until the
HPTE has been invalidated and the TLB invalidation sequence has
completed.  In kvmppc_h_protect, which implements the H_PROTECT
hypercall, we read the HPTE, modify the second doubleword,
invalidate the HPTE in memory, do the TLB invalidation sequence,
and then write the modified value of the second doubleword back
to memory.  In doing so we could overwrite an R/C bit update done
by hardware between when we read the HPTE and when the TLB
invalidation completed.  To fix this we re-read the second
doubleword after the TLB invalidation and OR in the (possibly)
new values of R and C.  We can use an OR since hardware only ever
sets R and C, never clears them.

This race was found by code inspection.  In principle this bug could
cause occasional guest memory corruption under host memory pressure.

Fixes: a8606e20e41a ("KVM: PPC: Handle some PAPR hcalls in the kernel", 2011-06-29)
Cc: stable@vger.kernel.org # v3.19+
Signed-off-by: Paul Mackerras <paulus@ozlabs.org>

diff --git a/arch/powerpc/kvm/book3s_hv_rm_mmu.c b/arch/powerpc/kvm/book3s_hv_rm_mmu.c
index 65902e94f4bdd693a142f9409c99fc7ddc04d5e2..0e7fca413a5d8e9db2268384e3204feb65479057 100644 (file)
--- a/arch/powerpc/kvm/book3s_hv_rm_mmu.c
+++ b/arch/powerpc/kvm/book3s_hv_rm_mmu.c
@@ -671,6 +671,8 @@ long kvmppc_h_protect(struct kvm_vcpu *vcpu, unsigned long flags,
                                              HPTE_V_ABSENT);
                        do_tlbies(kvm, &rb, 1, global_invalidates(kvm, flags),
                                  true);
+                       /* Don't lose R/C bit updates done by hardware */
+                       r |= be64_to_cpu(hpte[1]) & (HPTE_R_R | HPTE_R_C);
                        hpte[1] = cpu_to_be64(r);
                }
        }