From 9458a9a1df1a4c719e24512394d548c1fc7abd22 Mon Sep 17 00:00:00 2001 From: Paolo Bonzini Date: Tue, 6 Feb 2018 18:37:39 +0100 Subject: memory: fix race between TCG and accesses to dirty bitmap There is a race between TCG and accesses to the dirty log: vCPU thread reader thread ----------------------- ----------------------- TLB check -> slow path notdirty_mem_write write to RAM set dirty flag clear dirty flag TLB check -> fast path read memory write to RAM Fortunately, in order to fix it, no change is required to the vCPU thread. However, the reader thread must delay the read after the vCPU thread has finished the write. This can be approximated conservatively by run_on_cpu, which waits for the end of the current translation block. A similar technique is used by KVM, which has to do a synchronous TLB flush after doing a test-and-clear of the dirty-page flags. Reported-by: Dr. David Alan Gilbert Signed-off-by: Paolo Bonzini --- include/exec/memory.h | 12 ++++++++++++ 1 file changed, 12 insertions(+) (limited to 'include/exec') diff --git a/include/exec/memory.h b/include/exec/memory.h index d99eb25d2e..fddc2ff48a 100644 --- a/include/exec/memory.h +++ b/include/exec/memory.h @@ -425,6 +425,7 @@ struct MemoryListener { void (*log_clear)(MemoryListener *listener, MemoryRegionSection *section); void (*log_global_start)(MemoryListener *listener); void (*log_global_stop)(MemoryListener *listener); + void (*log_global_after_sync)(MemoryListener *listener); void (*eventfd_add)(MemoryListener *listener, MemoryRegionSection *section, bool match_data, uint64_t data, EventNotifier *e); void (*eventfd_del)(MemoryListener *listener, MemoryRegionSection *section, @@ -1687,6 +1688,17 @@ MemoryRegionSection memory_region_find(MemoryRegion *mr, */ void memory_global_dirty_log_sync(void); +/** + * memory_global_dirty_log_sync: synchronize the dirty log for all memory + * + * Synchronizes the vCPUs with a thread that is reading the dirty bitmap. + * This function must be called after the dirty log bitmap is cleared, and + * before dirty guest memory pages are read. If you are using + * #DirtyBitmapSnapshot, memory_region_snapshot_and_clear_dirty() takes + * care of doing this. + */ +void memory_global_after_dirty_log_sync(void); + /** * memory_region_transaction_begin: Start a transaction. * -- cgit v1.2.3-55-g7522