On Thu, Aug 10, 2023, Yan Zhao wrote: > On Thu, Aug 10, 2023 at 07:21:03AM +0800, Yan Zhao wrote: > > > Reading the value after acquiring mmu_lock ensures that both vCPUs will see whatever > > > value "loses" the race, i.e. whatever written value is processed second ('Y' in the > > > above sequence). > > I suspect that vCPU0 may still generate a wrong SPTE if vCPU1 wrote 4 > > bytes while vCPU0 wrote 8 bytes, though the chances are very low. > > > This could happen in below sequence: > vCPU0 updates a PTE to AABBCCDD; > vCPU1 updates a PTE to EEFFGGHH in two writes. > (each character stands for a byte) > > vCPU0 vCPU1 > write AABBCCDD > write GGHH > detect 4 bytes write and hold on sync > sync SPTE w/ AABBGGHH > write EEFF > sync SPTE w/ EEFFGGHH > > > Do you think it worth below serialization work? No, because I don't see any KVM bugs with the above sequence. If the guest doesn't ensure *all* writes from vCPU0 and vCPU1 are fully serialized, then it is completely legal for hardware (KVM in this case) to consume AABBGGHH as a PTE. The only thing the guest shouldn't see is EEFFCCDD, but I don't see how that can happen.