linux-kernel - Re: [PATCH 1/5] KVM: x86: avoid atomic operations on APICv vmentry

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Sun, 16 Oct 2016 05:29:24 +0300
From:   "Michael S. Tsirkin" <mst@...hat.com>
To:     Paolo Bonzini <pbonzini@...hat.com>
Cc:     Nadav Amit <nadav.amit@...il.com>,
        LKML <linux-kernel@...r.kernel.org>, KVM <kvm@...r.kernel.org>,
        Radim Krčmář <rkrcmar@...hat.com>,
        Yang Zhang <yang.zhang.wz@...il.com>,
        feng wu <feng.wu@...el.com>,
        "Paul E. McKenney" <paulmck@...ux.vnet.ibm.com>,
        Jonathan Corbet <corbet@....net>
Subject: Re: [PATCH 1/5] KVM: x86: avoid atomic operations on APICv vmentry

On Sat, Oct 15, 2016 at 03:47:45AM -0400, Paolo Bonzini wrote:
> 
> > > On Oct 14, 2016, at 11:56 AM, Paolo Bonzini <pbonzini@...hat.com> wrote:
> > >>> 
> > >>> 	for (i = 0; i <= 7; i++) {
> > >>> -		pir_val = xchg(&pir[i], 0);
> > >>> -		if (pir_val)
> > >>> +		pir_val = READ_ONCE(pir[i]);
> > >> 
> > >> Out of curiosity, do you really need this READ_ONCE?
> > > 
> > > The answer can only be "depends on the compiler's whims". :)
> > > If you think of READ_ONCE as a C11 relaxed atomic load, then yes.
> > 
> > Hm.. So the idea is to make the code "race-free” in the sense
> > that every concurrent memory access is done using READ_ONCE/WRITE_ONCE?
> > 
> > If that is the case, I think there are many other cases that need to be
> > changed, for example apic->irr_pending and vcpu->arch.pv.pv_unhalted.
> 
> There is no documentation for this in the kernel tree unfortunately.
> But yes, I think we should do that.  Using READ_ONCE/WRITE_ONCE around
> memory barriers is a start.
> 
> Paolo

I'm beginning to think that if a value is always (maybe except for init
where we don't much care about the code size anyway) accessed through
*_ONCE macros, we should just mark it volatile and be done with it. The
code will look cleaner, and there will be less space for errors
like forgetting *_ONCE macros.

Would such code (where all accesses are done through
READ_ONCE/WRITE_ONCE otherwise) be an exception to
volatile-considered-harmful.txt rules?

Cc Paul and Jonathan (for volatile-considered-harmful.txt).


-- 
MST