[PATCH v15 01/10] x86/shadow: add preemption support to shadow_blow_tables()

[Jan Beulich <jbeulich@xxxxxxxx>]

From: Roger Pau Monné <roger.pau@xxxxxxxxxx>

The use of shadow_blow_tables() in the domain teardown path (added for
XSA-410) actually requires preemption support itself for security
reasons, specially as the pages freed by shadow_blow_tables() are not
returned to the shadow page pool, but instead freed to the hypervisor.

Note that we require flushing the TLB when a need for preemption arises
on the 2nd pass, or else we risk returning to guest context with stale
TLB entries. (There's no similar need on the 1st pass, as per
_shadow_prealloc().) While preemption will be enabled only when tearing
down domains (and hence flushing has become meaningless by that point),
keep the function structured to no bypass the flush, just in case.

Signed-off-by: Roger Pau Monné <roger.pau@xxxxxxxxxx>
Signed-off-by: Jan Beulich <jbeulich@xxxxxxxx>
Acked-by: Tim Deegan <tim@xxxxxxx>
---
Changes since v12:
 - Re-base.

Changes since v11:
 - Re-base in particular past the XSA-410 series.

Changes since v9:
 - Extend a comment. Commit message adjustments.

Changes since v8:
 - Use difference, not sum, of total and free pages to determine whether
   progress was made.
 - Check for preemption on every iteration of the 2nd pass, as long as
   some progress was made.
 - Don't "goto out" on the 1st pass, to skip the TLB flush.

Changes since v6:
 - Rearrange order of preemption condition checks.
 - Only avoid shadow_blow_tables() when the domain is dead (ie: all
   vCPUs are stopped).

Changes since v5:
 - Add comment, remove no functional change.
 - Do not check for preemption on every loop.

Changes since v4:
 - New in this version.

--- a/xen/arch/x86/mm/shadow/common.c
+++ b/xen/arch/x86/mm/shadow/common.c
@@ -454,12 +454,23 @@ bool shadow_prealloc(struct domain *d, u
 
 /* Deliberately free all the memory we can: this will tear down all of
  * this domain's shadows */
-void shadow_blow_tables(struct domain *d)
+void shadow_blow_tables(struct domain *d, bool *preempted)
 {
     struct page_info *sp, *t;
     struct vcpu *v;
     mfn_t smfn;
     int i;
+    unsigned int done = 0;
+
+    /*
+     * When the domain is dying a call to shadow_blow_tables() will be
+     * performed from the teardown path with preemption support, ignore any
+     * other calls as we want to do the final teardown with preemption support.
+     * Teardown of shadow related data can only be avoided when all domain
+     * vCPUs are stopped.
+     */
+    if ( unlikely(d->is_dying) && !preempted )
+        return;
 
     /* Nothing to do when there are no vcpus yet. */
     if ( !d->vcpu[0] )
@@ -470,17 +481,46 @@ void shadow_blow_tables(struct domain *d
     {
         smfn = page_to_mfn(sp);
         sh_unpin(d, smfn);
+        if ( preempted && !(++done & 0xff) && general_preempt_check() )
+        {
+            *preempted = true;
+            return;
+        }
     }
 
     /* Second pass: unhook entries of in-use shadows */
     for_each_vcpu(d, v)
         for ( i = 0; i < ARRAY_SIZE(v->arch.paging.shadow.shadow_table); i++ )
             if ( !pagetable_is_null(v->arch.paging.shadow.shadow_table[i]) )
+            {
+                unsigned int num = d->arch.paging.total_pages -
+                                   d->arch.paging.free_pages;
+
                 shadow_unhook_mappings(
                     d,
                     pagetable_get_mfn(v->arch.paging.shadow.shadow_table[i]),
                     0);
 
+                /*
+                 * Make sure we are making progress before yielding: if domain
+                 * is dying progress will be seen by total_pages decreasing, if
+                 * not dying free_pages will increase.  In any case the gap
+                 * between both will shrink.
+                 *
+                 * Note that with the paging lock held the values used in the
+                 * calculation are safe from being altered by other hypercalls.
+                 */
+                if ( preempted &&
+                     (num != d->arch.paging.total_pages -
+                             d->arch.paging.free_pages) &&
+                     general_preempt_check() )
+                {
+                    *preempted = true;
+                    goto out;
+                }
+            }
+
+ out:
     /* Make sure everyone sees the unshadowings */
     guest_flush_tlb_mask(d, d->dirty_cpumask);
 }
@@ -490,7 +530,7 @@ void shadow_blow_tables_per_domain(struc
     if ( shadow_mode_enabled(d) && domain_vcpu(d, 0) )
     {
         paging_lock(d);
-        shadow_blow_tables(d);
+        shadow_blow_tables(d, NULL);
         paging_unlock(d);
     }
 }
@@ -2254,7 +2294,9 @@ void shadow_teardown(struct domain *d, b
      * in-use pages, as _shadow_prealloc() will no longer try to reclaim pages
      * because the domain is dying.
      */
-    shadow_blow_tables(d);
+    shadow_blow_tables(d, preempted);
+    if ( preempted && *preempted )
+        goto out;
 
 #if (SHADOW_OPTIMIZATIONS & (SHOPT_VIRTUAL_TLB|SHOPT_OUT_OF_SYNC))
     /* Free the virtual-TLB array attached to each vcpu */
@@ -2492,7 +2534,7 @@ static int cf_check sh_enable_log_dirty(
         /* This domain already has some shadows: need to clear them out
          * of the way to make sure that all references to guest memory are
          * properly write-protected */
-        shadow_blow_tables(d);
+        shadow_blow_tables(d, NULL);
     }
 
 #if (SHADOW_OPTIMIZATIONS & SHOPT_LINUX_L3_TOPLEVEL)
@@ -2530,7 +2572,7 @@ static void cf_check sh_clean_dirty_bitm
     /* Need to revoke write access to the domain's pages again.
      * In future, we'll have a less heavy-handed approach to this,
      * but for now, we just unshadow everything except Xen. */
-    shadow_blow_tables(d);
+    shadow_blow_tables(d, NULL);
     paging_unlock(d);
 }
 
--- a/xen/arch/x86/mm/shadow/hvm.c
+++ b/xen/arch/x86/mm/shadow/hvm.c
@@ -979,7 +979,7 @@ sh_write_p2m_entry_post(struct p2m_domai
        again), so it doesn't matter too much. */
     if ( d->arch.paging.shadow.has_fast_mmio_entries )
     {
-        shadow_blow_tables(d);
+        shadow_blow_tables(d, NULL);
         d->arch.paging.shadow.has_fast_mmio_entries = false;
     }
 }
@@ -1049,7 +1049,7 @@ int shadow_track_dirty_vram(struct domai
          * Throw away all the shadows rather than walking through them
          * up to nr times getting rid of mappings of each pfn.
          */
-        shadow_blow_tables(d);
+        shadow_blow_tables(d, NULL);
 
         gdprintk(XENLOG_INFO, "tracking VRAM %lx - %lx\n", begin_pfn, end_pfn);
 
--- a/xen/arch/x86/mm/shadow/private.h
+++ b/xen/arch/x86/mm/shadow/private.h
@@ -471,7 +471,7 @@ mfn_t oos_snapshot_lookup(struct domain
 #endif /* (SHADOW_OPTIMIZATIONS & SHOPT_OUT_OF_SYNC) */
 
 /* Deliberately free all the memory we can: tear down all of d's shadows. */
-void shadow_blow_tables(struct domain *d);
+void shadow_blow_tables(struct domain *d, bool *preempted);
 
 /*
  * Remove all mappings of a guest frame from the shadow tables.