From mboxrd@z Thu Jan 1 00:00:00 1970 From: Marcelo Tosatti Subject: Re: KVM: MMU: avoid creation of unreachable pages in the shadow Date: Tue, 25 Nov 2008 16:54:28 +0100 Message-ID: <20081125155428.GA17250@dmt.cnet> References: <20081125143310.GA11578@dmt.cnet> <492C438F.70203@gmail.com> Mime-Version: 1.0 Content-Type: multipart/mixed; boundary="PEIAKu/WMn1b1Hv9" Cc: Avi Kivity , kvm-devel To: John Rousseau Return-path: Received: from mx2.redhat.com ([66.187.237.31]:49816 "EHLO mx2.redhat.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1751189AbYKYS4s (ORCPT ); Tue, 25 Nov 2008 13:56:48 -0500 Content-Disposition: inline In-Reply-To: <492C438F.70203@gmail.com> Sender: kvm-owner@vger.kernel.org List-ID: --PEIAKu/WMn1b1Hv9 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline On Tue, Nov 25, 2008 at 01:27:27PM -0500, John Rousseau wrote: > Marcelo Tosatti wrote: >> It is possible for a shadow page to have a parent link >> pointing to a freed page. When zapping a high level table, >> kvm_mmu_page_unlink_children fails to remove the parent_pte link. >> For that to happen, the child must be unreachable via the shadow tree, >> which can happen in shadow_walk_entry if the guest pte was >> modified in between walk() and fetch(). Remove the parent pte >> reference in such case. >> >> Possible cause for oops in bug #2217430. > > I'll apply this to the code that I'm testing, but with my change to > 2.6.27, kvm-79 and Avi's patch from bug #2217430, I haven't seen the > problem again. I still have been testing with oos_shadow=0, which I'll > get rid of now. John, Please use the attached patch in addition (and drop Avi's). What is the application set you use to reproduce these issues (that you mentioned in the bugtrack) ? Thanks --PEIAKu/WMn1b1Hv9 Content-Type: text/plain; charset=us-ascii Content-Disposition: attachment; filename="kvm-mmu-self-ref-pte.patch" diff --git a/arch/x86/kvm/mmu.c b/arch/x86/kvm/mmu.c index 0813a08..8904e8a 100644 --- a/arch/x86/kvm/mmu.c +++ b/arch/x86/kvm/mmu.c @@ -1046,13 +1046,13 @@ static int kvm_sync_page(struct kvm_vcpu *vcpu, struct kvm_mmu_page *sp) } rmap_write_protect(vcpu->kvm, sp->gfn); + kvm_unlink_unsync_page(vcpu->kvm, sp); if (vcpu->arch.mmu.sync_page(vcpu, sp)) { kvm_mmu_zap_page(vcpu->kvm, sp); return 1; } kvm_mmu_flush_tlb(vcpu); - kvm_unlink_unsync_page(vcpu->kvm, sp); return 0; } --PEIAKu/WMn1b1Hv9--