From patchwork Tue Aug 21 09:46:39 2012 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Xiao Guangrong X-Patchwork-Id: 1353551 Return-Path: X-Original-To: patchwork-kvm@patchwork.kernel.org Delivered-To: patchwork-process-083081@patchwork1.kernel.org Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by patchwork1.kernel.org (Postfix) with ESMTP id 2E2EA3FC81 for ; Tue, 21 Aug 2012 09:47:18 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1756055Ab2HUJrP (ORCPT ); Tue, 21 Aug 2012 05:47:15 -0400 Received: from e28smtp01.in.ibm.com ([122.248.162.1]:41368 "EHLO e28smtp01.in.ibm.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1754986Ab2HUJrN (ORCPT ); Tue, 21 Aug 2012 05:47:13 -0400 Received: from /spool/local by e28smtp01.in.ibm.com with IBM ESMTP SMTP Gateway: Authorized Use Only! Violators will be prosecuted for from ; Tue, 21 Aug 2012 15:17:09 +0530 Received: from d28relay05.in.ibm.com (9.184.220.62) by e28smtp01.in.ibm.com (192.168.1.131) with IBM ESMTP SMTP Gateway: Authorized Use Only! Violators will be prosecuted; Tue, 21 Aug 2012 15:16:55 +0530 Received: from d28av04.in.ibm.com (d28av04.in.ibm.com [9.184.220.66]) by d28relay05.in.ibm.com (8.13.8/8.13.8/NCO v10.0) with ESMTP id q7L9ksKW24182878; Tue, 21 Aug 2012 15:16:54 +0530 Received: from d28av04.in.ibm.com (loopback [127.0.0.1]) by d28av04.in.ibm.com (8.14.4/8.13.1/NCO v10.0 AVout) with ESMTP id q7L9krnp005942; Tue, 21 Aug 2012 19:46:54 +1000 Received: from localhost.localdomain ([9.123.236.99]) by d28av04.in.ibm.com (8.14.4/8.13.1/NCO v10.0 AVin) with ESMTP id q7L9ko0j005773; Tue, 21 Aug 2012 19:46:51 +1000 Message-ID: <503358FF.3030009@linux.vnet.ibm.com> Date: Tue, 21 Aug 2012 17:46:39 +0800 From: Xiao Guangrong User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:14.0) Gecko/20120717 Thunderbird/14.0 MIME-Version: 1.0 To: Andrew Morton , Avi Kivity , Marcelo Tosatti , Andrea Arcangeli , LKML , KVM , Linux Memory Management List Subject: [PATCH] mm: mmu_notifier: fix inconsistent memory between secondary MMU and host x-cbid: 12082109-4790-0000-0000-00000439BABC Sender: kvm-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: kvm@vger.kernel.org There has a bug in set_pte_at_notify which always set the pte to the new page before release the old page in secondary MMU, at this time, the process will access on the new page, but the secondary MMU still access on the old page, the memory is inconsistent between them Below scenario shows the bug more clearly: at the beginning: *p = 0, and p is write-protected by KSM or shared with parent process CPU 0 CPU 1 write 1 to p to trigger COW, set_pte_at_notify will be called: *pte = new_page + W; /* The W bit of pte is set */ *p = 1; /* pte is valid, so no #PF */ return back to secondary MMU, then the secondary MMU read p, but get: *p == 0; /* * !!!!!! * the host has already set p to 1, but the secondary * MMU still get the old value 0 */ call mmu_notifier_change_pte to release old page in secondary MMU We can fix it by release old page first, then set the pte to the new page. Note, the new page will be firstly used in secondary MMU before it is mapped into the page table of the process, but this is safe because it is protected by the page table lock, there is no race to change the pte Signed-off-by: Xiao Guangrong --- include/linux/mmu_notifier.h | 2 +- 1 files changed, 1 insertions(+), 1 deletions(-) diff --git a/include/linux/mmu_notifier.h b/include/linux/mmu_notifier.h index 1d1b1e1..8c7435a 100644 --- a/include/linux/mmu_notifier.h +++ b/include/linux/mmu_notifier.h @@ -317,8 +317,8 @@ static inline void mmu_notifier_mm_destroy(struct mm_struct *mm) unsigned long ___address = __address; \ pte_t ___pte = __pte; \ \ - set_pte_at(___mm, ___address, __ptep, ___pte); \ mmu_notifier_change_pte(___mm, ___address, ___pte); \ + set_pte_at(___mm, ___address, __ptep, ___pte); \ }) #else /* CONFIG_MMU_NOTIFIER */