All of lore.kernel.org
 help / color / mirror / Atom feed
From: Joerg Roedel <joro@8bytes.org>
To: Qian Cai <cai@lca.pw>
Cc: iommu@lists.linux-foundation.org, linux-kernel@vger.kernel.org
Subject: Re: [RFC PATCH] iommu/amd: fix a race in fetch_pte()
Date: Wed, 8 Apr 2020 16:19:15 +0200	[thread overview]
Message-ID: <20200408141915.GJ3103@8bytes.org> (raw)
In-Reply-To: <7664E2E7-04D4-44C3-AB7E-A4334CDEC373@lca.pw>

Hi Qian,

On Tue, Apr 07, 2020 at 11:36:05AM -0400, Qian Cai wrote:
> After further testing, the change along is insufficient. What I am chasing right
> now is the swap device will go offline after heavy memory pressure below. The
> symptom is similar to what we have in the commit,
> 
> 754265bcab78 (“iommu/amd: Fix race in increase_address_space()”)
> 
> Apparently, it is no possible to take the domain->lock in fetch_pte() because it
> could sleep.

Thanks a lot for finding and tracking down another race in the AMD IOMMU
page-table code.  The domain->lock is a spin-lock and taking it can't
sleep. But fetch_pte() is a fast-path and must not take any locks.

I think the best fix is to update the pt_root and mode of the domain
atomically by storing the mode in the lower 12 bits of pt_root. This way
they are stored together and can be read/write atomically.

Regards,

	Joerg

_______________________________________________
iommu mailing list
iommu@lists.linux-foundation.org
https://lists.linuxfoundation.org/mailman/listinfo/iommu

WARNING: multiple messages have this Message-ID (diff)
From: Joerg Roedel <joro@8bytes.org>
To: Qian Cai <cai@lca.pw>
Cc: iommu@lists.linux-foundation.org, linux-kernel@vger.kernel.org
Subject: Re: [RFC PATCH] iommu/amd: fix a race in fetch_pte()
Date: Wed, 8 Apr 2020 16:19:15 +0200	[thread overview]
Message-ID: <20200408141915.GJ3103@8bytes.org> (raw)
In-Reply-To: <7664E2E7-04D4-44C3-AB7E-A4334CDEC373@lca.pw>

Hi Qian,

On Tue, Apr 07, 2020 at 11:36:05AM -0400, Qian Cai wrote:
> After further testing, the change along is insufficient. What I am chasing right
> now is the swap device will go offline after heavy memory pressure below. The
> symptom is similar to what we have in the commit,
> 
> 754265bcab78 (“iommu/amd: Fix race in increase_address_space()”)
> 
> Apparently, it is no possible to take the domain->lock in fetch_pte() because it
> could sleep.

Thanks a lot for finding and tracking down another race in the AMD IOMMU
page-table code.  The domain->lock is a spin-lock and taking it can't
sleep. But fetch_pte() is a fast-path and must not take any locks.

I think the best fix is to update the pt_root and mode of the domain
atomically by storing the mode in the lower 12 bits of pt_root. This way
they are stored together and can be read/write atomically.

Regards,

	Joerg


  reply	other threads:[~2020-04-08 14:19 UTC|newest]

Thread overview: 32+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2020-04-07  2:12 [RFC PATCH] iommu/amd: fix a race in fetch_pte() Qian Cai
2020-04-07  2:12 ` Qian Cai
2020-04-07 15:36 ` Qian Cai
2020-04-07 15:36   ` Qian Cai
2020-04-08 14:19   ` Joerg Roedel [this message]
2020-04-08 14:19     ` Joerg Roedel
2020-04-14  1:36     ` Qian Cai
2020-04-14  1:36       ` Qian Cai
2020-04-17  1:42       ` Qian Cai
2020-04-17  1:42         ` Qian Cai
2020-04-18 12:10         ` Joerg Roedel
2020-04-18 12:10           ` Joerg Roedel
2020-04-18 13:01           ` Qian Cai
2020-04-18 13:01             ` Qian Cai
2020-04-18 18:34             ` Joerg Roedel
2020-04-18 18:34               ` Joerg Roedel
2020-04-20  2:07               ` Qian Cai
2020-04-20  2:07                 ` Qian Cai
2020-04-20 13:26               ` Qian Cai
2020-04-20 13:26                 ` Qian Cai
2020-04-29  8:47                 ` Joerg Roedel
2020-04-29  8:47                   ` Joerg Roedel
2020-04-29 11:20                 ` Joerg Roedel
2020-04-29 11:20                   ` Joerg Roedel
2020-04-30  1:04                   ` Qian Cai
2020-04-30  1:04                     ` Qian Cai
2020-05-03 13:04                   ` Qian Cai
2020-05-03 13:04                     ` Qian Cai
2020-05-03 18:39                     ` Joerg Roedel
2020-05-03 18:39                       ` Joerg Roedel
2020-05-03 19:12                       ` Qian Cai
2020-05-03 19:12                         ` Qian Cai

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20200408141915.GJ3103@8bytes.org \
    --to=joro@8bytes.org \
    --cc=cai@lca.pw \
    --cc=iommu@lists.linux-foundation.org \
    --cc=linux-kernel@vger.kernel.org \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body. 
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.