[Xen-changelog] Flush writable pagetable state before emulating a PT

[Xen patchbot -unstable <patchbot-unstable@xxxxxxxxxxxxxxxxxxx>]

# HG changeset patch
# User kaf24@xxxxxxxxxxxxxxxxxxxx
# Node ID 4f03592bc7f5b4bca5744cee298607dde2576ff6
# Parent  090e44133d40247bc3ccbb565b644d02fdac6829
Flush writable pagetable state before emulating a PT
update. Avoids possibility of updating a PTE temporarily
marked writable by ptwr batching logic, which can corrupt
page reference counts. Aiee!

Signed-off-by: Keir Fraser <keir@xxxxxxxxxxxxx>

diff -r 090e44133d40 -r 4f03592bc7f5 xen/arch/x86/mm.c
--- a/xen/arch/x86/mm.c Mon Nov 14 17:13:38 2005
+++ b/xen/arch/x86/mm.c Mon Nov 14 17:27:11 2005
@@ -3358,6 +3358,13 @@
     return EXCRET_fault_fixed;
 
  emulate:
+    /*
+     * Cleaning up avoids emulating an update to a PTE that is temporarily
+     * marked writable (_PAGE_RW) by the batched ptwr logic. If this were
+     * performance critical then the check could compare addr against l1va's in
+     * ptwr_emulated_update(). Without this flush we can corrupt page refcnts!
+     */
+    cleanup_writable_pagetable(d);
     if ( x86_emulate_memop(guest_cpu_user_regs(), addr,
                            &ptwr_mem_emulator, BITS_PER_LONG/8) )
         return 0;

_______________________________________________
Xen-changelog mailing list
Xen-changelog@xxxxxxxxxxxxxxxxxxx
http://lists.xensource.com/xen-changelog