diff options
| author | Marcelo Tosatti <mtosatti@redhat.com> | 2010-10-22 14:18:17 -0200 |
|---|---|---|
| committer | Avi Kivity <avi@redhat.com> | 2011-01-12 11:23:39 +0200 |
| commit | 7905d9a5ad7a83f1c1c00559839857ab90afbdfc (patch) | |
| tree | 13cec1f9eebcc01928381105cb628e09e195ad0b | |
| parent | 982c25658c066fbbeb42e44a6a8fcd59ae008837 (diff) | |
| download | talos-op-linux-7905d9a5ad7a83f1c1c00559839857ab90afbdfc.tar.gz talos-op-linux-7905d9a5ad7a83f1c1c00559839857ab90afbdfc.zip | |
KVM: MMU: flush TLBs on writable -> read-only spte overwrite
This can happen in the following scenario:
vcpu0 vcpu1
read fault
gup(.write=0)
gup(.write=1)
reuse swap cache, no COW
set writable spte
use writable spte
set read-only spte
Signed-off-by: Marcelo Tosatti <mtosatti@redhat.com>
Signed-off-by: Avi Kivity <avi@redhat.com>
| -rw-r--r-- | arch/x86/kvm/mmu.c | 10 |
1 files changed, 10 insertions, 0 deletions
diff --git a/arch/x86/kvm/mmu.c b/arch/x86/kvm/mmu.c index 11b9102f4113..99433943170c 100644 --- a/arch/x86/kvm/mmu.c +++ b/arch/x86/kvm/mmu.c @@ -2069,6 +2069,16 @@ static void mmu_set_spte(struct kvm_vcpu *vcpu, u64 *sptep, spte_to_pfn(*sptep), pfn); drop_spte(vcpu->kvm, sptep, shadow_trap_nonpresent_pte); kvm_flush_remote_tlbs(vcpu->kvm); + /* + * If we overwrite a writable spte with a read-only one, + * drop it and flush remote TLBs. Otherwise rmap_write_protect + * will find a read-only spte, even though the writable spte + * might be cached on a CPU's TLB. + */ + } else if (is_writable_pte(*sptep) && + (!(pte_access & ACC_WRITE_MASK) || !dirty)) { + drop_spte(vcpu->kvm, sptep, shadow_trap_nonpresent_pte); + kvm_flush_remote_tlbs(vcpu->kvm); } else was_rmapped = 1; } |
