linux-kernel - Re: [PATCH v2 3/6] KVM: MMU: fix page dirty tracking lost while sync page

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <4C473DB3.7040405@redhat.com>
Date:	Wed, 21 Jul 2010 21:34:27 +0300
From:	Avi Kivity <avi@...hat.com>
To:	Xiao Guangrong <xiaoguangrong@...fujitsu.com>
CC:	Marcelo Tosatti <mtosatti@...hat.com>,
	LKML <linux-kernel@...r.kernel.org>,
	KVM list <kvm@...r.kernel.org>
Subject: Re: [PATCH v2 3/6] KVM: MMU: fix page dirty tracking lost while sync
 page

On 07/16/2010 06:25 AM, Xiao Guangrong wrote:
> In sync-page path, if spte.writable is changed, it will lose page dirty
> tracking, for example:
>
> assume spte.writable = 0 in a unsync-page, when it's synced, it map spte
> to writable(that is spte.writable = 1), later guest write spte.gfn, it means
> spte.gfn is dirty, then guest changed this mapping to read-only, after it's
> synced,  spte.writable = 0
>
> So, when host release the spte, it detect spte.writable = 0 and not mark page
> dirty
>
>    

Subtle, good catch.

>   set_pte:
> +	if (is_writable_pte(*sptep)&&  !is_writable_pte(spte))
> +		kvm_set_pfn_dirty(pfn);
>   	update_spte(sptep, spte);
>    

I think this has to be done after the tlb flush, otherwise we have

   set_pfn_dirty
   (some other cpu) write out page, mark as clean
   (some other vcpu writes through stale tlb entry)
   update_spte
   tlb flush

but perhaps mmu notifiers protect us here, if the cleaner wants to write 
out the page it has to clear the dirty bit in sptes as well, and that 
will block on mmu_lock.

Later on we can use the dirty bit instead of writeable bit, except on 
EPT.  But let's start with your fix.

-- 
I have a truly marvellous patch that fixes the bug which this
signature is too narrow to contain.

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/