[patch 0/2] madvise(MADV_DONTFORK) guest mem if !mmu_notifiers

[patch 0/2] madvise(MADV_DONTFORK) guest mem if !mmu_notifiers

[Marcelo Tosatti]

fork'ing inside qemu can create stale shadow entries without mmu 
notifiers.

-- 

[patch 1/2] libkvm: add kvm_has_sync_mmu

[Marcelo Tosatti]

[-- Attachment #1: sync-mmu --]
[-- Type: text/plain, Size: 1327 bytes --]

From: Anthony Liguori <aliguori@us.ibm.com>

This patch adds a kvm_has_sync_mmu routine to libkvm.  This allows
userspace to query the existence of mmu notifiers which is important for
ballooning since madvise() is not safe from userspace without it.

Signed-off-by: Anthony Liguori <aliguori@us.ibm.com>
Signed-off-by: Marcelo Tosatti <mtosatti@redhat.com>

Index: kvm-userspace.tip/libkvm/libkvm.c
===================================================================
--- kvm-userspace.tip.orig/libkvm/libkvm.c
+++ kvm-userspace.tip/libkvm/libkvm.c
@@ -1053,6 +1053,15 @@ int kvm_pit_in_kernel(kvm_context_t kvm)
 	return kvm->pit_in_kernel;
 }
 
+int kvm_has_sync_mmu(kvm_context_t kvm)
+{
+        int r = 0;
+#ifdef KVM_CAP_SYNC_MMU
+        r = ioctl(kvm->fd, KVM_CHECK_EXTENSION, KVM_CAP_SYNC_MMU);
+#endif
+        return r;
+}
+
 int kvm_init_coalesced_mmio(kvm_context_t kvm)
 {
 	int r = 0;
Index: kvm-userspace.tip/libkvm/libkvm.h
===================================================================
--- kvm-userspace.tip.orig/libkvm/libkvm.h
+++ kvm-userspace.tip/libkvm/libkvm.h
@@ -528,6 +528,8 @@ int kvm_dirty_pages_log_reset(kvm_contex
  */
 int kvm_irqchip_in_kernel(kvm_context_t kvm);
 
+int kvm_has_sync_mmu(kvm_context_t kvm);
+
 #ifdef KVM_CAP_IRQCHIP
 /*!
  * \brief Dump in kernel IRQCHIP contents

-- 

[patch 2/2] qemu: kvm: mark guest mapping as MADV_DONTFORK

[Marcelo Tosatti]

[-- Attachment #1: kvm-setup-mem --]
[-- Type: text/plain, Size: 2720 bytes --]

When qemu fork's (ssh migration, qemu-nbd, slirp), the guest memory
mapping becomes shared and write-protected by parent and child, until
execve switches to a new mm.

Since kernel commit 7885a4fbebcbae1f8594445a46aefb9d97353594,
get_user_pages with force=1 parameter will break COW during this window,
leaving stale shadow mappings that point to the previously shared page.

Fix this by madvising the range as MADV_DONTFORK, if mmu notifiers are
disabled.

Signed-off-by: Marcelo Tosatti <mtosatti@redhat.com>

Index: kvm-userspace.tip/qemu/qemu-kvm.c
===================================================================
--- kvm-userspace.tip.orig/qemu/qemu-kvm.c
+++ kvm-userspace.tip/qemu/qemu-kvm.c
@@ -25,6 +25,7 @@ int kvm_pit = 1;
 #include <pthread.h>
 #include <sys/utsname.h>
 #include <sys/syscall.h>
+#include <sys/mman.h>
 
 #define bool _Bool
 #define false 0
@@ -812,6 +813,19 @@ void kvm_cpu_register_physical_memory(ta
     }
 }
 
+int kvm_setup_guest_memory(void *area, unsigned long size)
+{
+    int ret = 0;
+
+    if (kvm_enabled() && !kvm_has_sync_mmu(kvm_context))
+        ret = madvise(area, size, MADV_DONTFORK);
+
+    if (ret)
+        perror ("madvise");
+
+    return ret;
+}
+
 int kvm_qemu_check_extension(int ext)
 {
     return kvm_check_extension(kvm_context, ext);
Index: kvm-userspace.tip/qemu/qemu-kvm.h
===================================================================
--- kvm-userspace.tip.orig/qemu/qemu-kvm.h
+++ kvm-userspace.tip/qemu/qemu-kvm.h
@@ -45,6 +45,7 @@ void *kvm_cpu_create_phys_mem(target_phy
 
 void kvm_cpu_destroy_phys_mem(target_phys_addr_t start_addr,
 			      unsigned long size);
+int kvm_setup_guest_memory(void *area, unsigned long size);
 
 int kvm_arch_qemu_create_context(void);
 
Index: kvm-userspace.tip/qemu/vl.c
===================================================================
--- kvm-userspace.tip.orig/qemu/vl.c
+++ kvm-userspace.tip/qemu/vl.c
@@ -8890,7 +8890,7 @@ static int gethugepagesize(void)
     return hugepagesize;
 }
 
-void *alloc_mem_area(unsigned long memory, const char *path)
+void *alloc_mem_area(size_t memory, unsigned long *len, const char *path)
 {
     char *filename;
     void *area;
@@ -8929,18 +8929,23 @@ void *alloc_mem_area(unsigned long memor
 	return NULL;
     }
 
+    *len = memory;
     return area;
 }
 
 void *qemu_alloc_physram(unsigned long memory)
 {
     void *area = NULL;
+    unsigned long map_len = memory;
 
     if (mem_path)
-	area = alloc_mem_area(memory, mem_path);
+	area = alloc_mem_area(memory, &map_len, mem_path);
     if (!area)
 	area = qemu_vmalloc(memory);
-
+#ifdef USE_KVM
+    if (kvm_setup_guest_memory(area, map_len))
+        area = NULL;
+#endif
     return area;
 }
 

-- 

Re: [patch 0/2] madvise(MADV_DONTFORK) guest mem if !mmu_notifiers

[Avi Kivity]

Marcelo Tosatti wrote:
> fork'ing inside qemu can create stale shadow entries without mmu 
> notifiers.
>
>   

Applied both.  Thanks.

-- 
error compiling committee.c: too many arguments to function