From mboxrd@z Thu Jan 1 00:00:00 1970 From: Marcelo Tosatti Subject: Re: [PATCH for 3.3] KVM: Fix write protection race during dirty logging Date: Wed, 8 Feb 2012 14:38:07 -0200 Message-ID: <20120208163807.GA5020@amt.cnet> References: <20120205204241.54f16069c7f10ac7524c55ec@gmail.com> Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii Cc: avi@redhat.com, kvm@vger.kernel.org To: Takuya Yoshikawa Return-path: Received: from mx1.redhat.com ([209.132.183.28]:19735 "EHLO mx1.redhat.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1755661Ab2BHQmS (ORCPT ); Wed, 8 Feb 2012 11:42:18 -0500 Content-Disposition: inline In-Reply-To: <20120205204241.54f16069c7f10ac7524c55ec@gmail.com> Sender: kvm-owner@vger.kernel.org List-ID: On Sun, Feb 05, 2012 at 08:42:41PM +0900, Takuya Yoshikawa wrote: > From: Takuya Yoshikawa > > This patch fixes a race introduced by: > > commit 95d4c16ce78cb6b7549a09159c409d52ddd18dae > KVM: Optimize dirty logging by rmap_write_protect() > > During protecting pages for dirty logging, other threads may also try > to protect a page in mmu_sync_children() or kvm_mmu_get_page(). > > In such a case, because get_dirty_log releases mmu_lock before flushing > TLB's, the following race condition can happen: > > A (get_dirty_log) B (another thread) > > lock(mmu_lock) > clear pte.w > unlock(mmu_lock) > lock(mmu_lock) > pte.w is already cleared > unlock(mmu_lock) > skip TLB flush > return > ... > TLB flush > > Though thread B assumes the page has already been protected when it > returns, the remaining TLB entry will break that assumption. > > This patch fixes this problem by making get_dirty_log hold the mmu_lock > until it flushes the TLB's. > > Signed-off-by: Takuya Yoshikawa > --- > arch/x86/kvm/x86.c | 11 +++++------ > 1 files changed, 5 insertions(+), 6 deletions(-) Applied, thanks. Please don't forget the invalidate_page fix.