Kernel KVM virtualization development
 help / color / mirror / Atom feed
* [PATCH] KVM: Fix wallclock version writing race
@ 2010-05-04 12:02 Avi Kivity
  2010-05-04 16:21 ` Avi Kivity
  2010-05-04 16:23 ` Glauber Costa
  0 siblings, 2 replies; 3+ messages in thread
From: Avi Kivity @ 2010-05-04 12:02 UTC (permalink / raw)
  To: Glauber Costa, Marcelo Tosatti; +Cc: kvm

Wallclock writing uses an unprotected global variable to hold the version;
this can cause one guest to interfere with another if both write their
wallclock at the same time.

Signed-off-by: Avi Kivity <avi@redhat.com>
---
 arch/x86/kvm/x86.c |   12 ++++++++++--
 1 files changed, 10 insertions(+), 2 deletions(-)

diff --git a/arch/x86/kvm/x86.c b/arch/x86/kvm/x86.c
index f6f8dad..c3152d7 100644
--- a/arch/x86/kvm/x86.c
+++ b/arch/x86/kvm/x86.c
@@ -754,14 +754,22 @@ static int do_set_msr(struct kvm_vcpu *vcpu, unsigned index, u64 *data)
 
 static void kvm_write_wall_clock(struct kvm *kvm, gpa_t wall_clock)
 {
-	static int version;
+	int version;
+	int r;
 	struct pvclock_wall_clock wc;
 	struct timespec boot;
 
 	if (!wall_clock)
 		return;
 
-	version++;
+	r = kvm_read_guest(kvm, wall_clock, &version, sizeof(version));
+	if (r)
+		return;
+
+	if (version & 1)
+		++version;  /* first time write, random junk */
+
+	++version;
 
 	kvm_write_guest(kvm, wall_clock, &version, sizeof(version));
 
-- 
1.7.0.4


^ permalink raw reply related	[flat|nested] 3+ messages in thread

* Re: [PATCH] KVM: Fix wallclock version writing race
  2010-05-04 12:02 [PATCH] KVM: Fix wallclock version writing race Avi Kivity
@ 2010-05-04 16:21 ` Avi Kivity
  2010-05-04 16:23 ` Glauber Costa
  1 sibling, 0 replies; 3+ messages in thread
From: Avi Kivity @ 2010-05-04 16:21 UTC (permalink / raw)
  To: Glauber Costa, Marcelo Tosatti; +Cc: kvm, Naphtali Sprei

On 05/04/2010 03:02 PM, Avi Kivity wrote:
> Wallclock writing uses an unprotected global variable to hold the version;
> this can cause one guest to interfere with another if both write their
> wallclock at the same time.
>
> Signed-off-by: Avi Kivity<avi@redhat.com>
>    

This was pointed out by Naphtali.

> diff --git a/arch/x86/kvm/x86.c b/arch/x86/kvm/x86.c
> index f6f8dad..c3152d7 100644
> --- a/arch/x86/kvm/x86.c
> +++ b/arch/x86/kvm/x86.c
> @@ -754,14 +754,22 @@ static int do_set_msr(struct kvm_vcpu *vcpu, unsigned index, u64 *data)
>
>   static void kvm_write_wall_clock(struct kvm *kvm, gpa_t wall_clock)
>   {
> -	static int version;
> +	int version;
> +	int r;
>   	struct pvclock_wall_clock wc;
>   	struct timespec boot;
>
>   	if (!wall_clock)
>   		return;
>
> -	version++;
> +	r = kvm_read_guest(kvm, wall_clock,&version, sizeof(version));
> +	if (r)
> +		return;
> +
> +	if (version&  1)
> +		++version;  /* first time write, random junk */
> +
> +	++version;
>
>   	kvm_write_guest(kvm, wall_clock,&version, sizeof(version));
>
>    


-- 
error compiling committee.c: too many arguments to function


^ permalink raw reply	[flat|nested] 3+ messages in thread

* Re: [PATCH] KVM: Fix wallclock version writing race
  2010-05-04 12:02 [PATCH] KVM: Fix wallclock version writing race Avi Kivity
  2010-05-04 16:21 ` Avi Kivity
@ 2010-05-04 16:23 ` Glauber Costa
  1 sibling, 0 replies; 3+ messages in thread
From: Glauber Costa @ 2010-05-04 16:23 UTC (permalink / raw)
  To: Avi Kivity; +Cc: Marcelo Tosatti, kvm

On Tue, May 04, 2010 at 03:02:24PM +0300, Avi Kivity wrote:
> Wallclock writing uses an unprotected global variable to hold the version;
> this can cause one guest to interfere with another if both write their
> wallclock at the same time.
> 
makes sense to me.

ACK.



^ permalink raw reply	[flat|nested] 3+ messages in thread

end of thread, other threads:[~2010-05-04 16:23 UTC | newest]

Thread overview: 3+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2010-05-04 12:02 [PATCH] KVM: Fix wallclock version writing race Avi Kivity
2010-05-04 16:21 ` Avi Kivity
2010-05-04 16:23 ` Glauber Costa

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox