From mboxrd@z Thu Jan 1 00:00:00 1970 From: Avi Kivity Subject: Re: [PATCH 00/13] KVM: MMU: fast page fault Date: Mon, 09 Apr 2012 16:20:40 +0300 Message-ID: <4F82E228.7050602@redhat.com> References: <4F742951.7080003@linux.vnet.ibm.com> <4F7436FB.9000004@redhat.com> <4F744A43.4060600@linux.vnet.ibm.com> <4F745C4F.4060404@redhat.com> <4F757A7C.6020109@linux.vnet.ibm.com> <4F7850EA.3080203@redhat.com> <4F7E1531.5020307@gmail.com> <4F7E7E1A.3000807@linux.vnet.ibm.com> Mime-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 7bit Cc: Xiao Guangrong , Marcelo Tosatti , LKML , KVM To: Xiao Guangrong Return-path: In-Reply-To: <4F7E7E1A.3000807@linux.vnet.ibm.com> Sender: linux-kernel-owner@vger.kernel.org List-Id: kvm.vger.kernel.org On 04/06/2012 08:24 AM, Xiao Guangrong wrote: > > Foolish me, i should be crazy. Sorry for my mistake. :( > > Unfortunately, it can not work, we can not get a stable gfn from gpte or > sp->gfns[]. For example: > > beginning: > Gpte = Gfn1 > gfn_to_pfn(Gfn1) = Pfn > Spte = Pfn > Gfn1 is write-free > Gfn2 is write-protected > > > VCPU 0 VCPU 1 VCPU 2 > > fault on gpte > fast page fault path: > set Spte.fast_pf > get Gfn1 from Gpte/sp->gfns[] > if (Gfn1 is writable) > Pfn is swapped out: > Spte = 0 > Gpte is modified to Gfn2, > and Pfn is realloced and remapped > to Gfn2, so: > Spte = Pfn > > fast page fault path: > set Spte.fast_pf > > cmpxchg Spte+w > OOPS!!! > happily make it writable, so gfn2 can be writable> > > It seems only a unique identification can prevent this. :( > Ouch. What about restricting this to role.direct=1? Then gfn is stable? -- error compiling committee.c: too many arguments to function