[Xen-changelog] [xen-unstable] kunmap_atomic() must zap the PTE to avoid dangling references

[Xen patchbot-unstable <patchbot-unstable@xxxxxxxxxxxxxxxxxxx>]

# HG changeset patch
# User kfraser@xxxxxxxxxxxxxxxxxxxxxxx
# Node ID 4260eb8c08740de0000081c61a6237ffcb95b2d5
# Parent  5fa6c1723e08d6395fecc427f372d008006b2b4c
kunmap_atomic() must zap the PTE to avoid dangling references
when attempting to free memory back to Xen. We can implement
something more efficient in future.

Also add debug print message if guest tries to free 'in use'
memory. We'll make it a real guest-visible error in future.

Signed-off-by: Keir Fraser <keir@xxxxxxxxxxxxx>
---
 linux-2.6-xen-sparse/arch/i386/mm/highmem-xen.c |   10 ++++++++++
 xen/common/memory.c                             |    9 +++++++++
 2 files changed, 19 insertions(+)

diff -r 5fa6c1723e08 -r 4260eb8c0874 
linux-2.6-xen-sparse/arch/i386/mm/highmem-xen.c
--- a/linux-2.6-xen-sparse/arch/i386/mm/highmem-xen.c   Wed Jun 28 17:56:34 
2006 +0100
+++ b/linux-2.6-xen-sparse/arch/i386/mm/highmem-xen.c   Wed Jun 28 18:17:41 
2006 +0100
@@ -79,6 +79,16 @@ void kunmap_atomic(void *kvaddr, enum km
         */
        pte_clear(&init_mm, vaddr, kmap_pte-idx);
        __flush_tlb_one(vaddr);
+#elif defined(CONFIG_XEN)
+       /*
+        * We must ensure there are no dangling pagetable references when
+        * returning memory to Xen (decrease_reservation).
+        * XXX TODO: We could make this faster by only zapping when
+        * kmap_flush_unused is called but that is trickier and more invasive.
+        */
+       unsigned long vaddr = (unsigned long) kvaddr & PAGE_MASK;
+       enum fixed_addresses idx = type + KM_TYPE_NR*smp_processor_id();
+       pte_clear(&init_mm, vaddr, kmap_pte-idx);
 #endif
 
        dec_preempt_count();
diff -r 5fa6c1723e08 -r 4260eb8c0874 xen/common/memory.c
--- a/xen/common/memory.c       Wed Jun 28 17:56:34 2006 +0100
+++ b/xen/common/memory.c       Wed Jun 28 18:17:41 2006 +0100
@@ -169,6 +169,15 @@ guest_remove_page(
             
     if ( test_and_clear_bit(_PGC_allocated, &page->count_info) )
         put_page(page);
+
+    if ( unlikely((page->count_info & PGC_count_mask) != 1) )
+    {
+        /* We'll make this a guest-visible error in future, so take heed! */
+        DPRINTK("Dom%d freeing in-use page %lx (pseudophys %lx):"
+                " count=%x type=%lx\n",
+                d->domain_id, mfn, get_gpfn_from_mfn(mfn),
+                page->count_info, page->u.inuse.type_info);
+    }
 
     guest_physmap_remove_page(d, gmfn, mfn);
 

_______________________________________________
Xen-changelog mailing list
Xen-changelog@xxxxxxxxxxxxxxxxxxx
http://lists.xensource.com/xen-changelog