Re: [PATCH 2/2] xen/mm: do not assign pages to a domain until they are scrubbed

[Jan Beulich <jbeulich@xxxxxxxx>]

On 25.03.2026 17:26, Roger Pau Monné wrote:
> On Wed, Mar 25, 2026 at 03:56:05PM +0100, Jan Beulich wrote:
>> On 25.03.2026 11:08, Roger Pau Monne wrote:
>>> ---
>>> I've attempted various different ways to solve this, but they all ended up
>>> being impossible.
>>>
>>>  * Prevent non-scrubbed pages from getting extra refcounts (iow: make
>>>    get_page() fail for them).  This seemed nice, but the cleanup using
>>>    put_page_alloc_ref() was impossible as non-scrubbed pages would return
>>>    failure in get_page(), and so I couldn't take the extra reference ahead
>>>    of calling put_page_alloc_ref().
>>
>> A special-case variant of get_page() could be introduced, but maybe that
>> would still be overly fragile.
> 
> It seemed too much complexity (and risk), just to deal with this
> scenario.
> 
>> When we discussed this, what I had proposed didn't require use of get_page()
>> though. assign_pages() would install two general references (plus one type
>> ref for PGT_writable) in this special case. To free, you'd call
>> put_page_alloc_ref() followed by put_page_and_type().
> 
> Doesn't that risk under flowing the page counter if there's a parallel
> call to decrease_reservation() against this MFN before?
> 
> How would the freeing done in populate_physmap() (in case of
> concurrent calls) know whether already scrubbed pages have had it's
> PGC_allocated bit dropped?

In that case put_page_alloc_ref() simply does nothing. That's why we have
this wrapper: To avoid open-coding the same check in many places.

Jan