This is an archived copy of the Xen.org mailing list, which we have preserved to ensure that existing links to archives are not broken. The live archive, which contains the latest emails, can be found at http://lists.xen.org/
Home Products Support Community News


Re: [Xen-devel] [PATCH 06/12] xenpaging: update machine_to_phys_mapping[

To: Keir Fraser <keir@xxxxxxx>
Subject: Re: [Xen-devel] [PATCH 06/12] xenpaging: update machine_to_phys_mapping[] during page deallocation
From: Olaf Hering <olaf@xxxxxxxxx>
Date: Tue, 11 Jan 2011 12:00:22 +0100
Cc: xen-devel@xxxxxxxxxxxxxxxxxxx
Delivery-date: Tue, 11 Jan 2011 03:52:25 -0800
Dkim-signature: v=1; a=rsa-sha1; c=relaxed/relaxed; t=1294743625; l=2435; s=domk; d=aepfle.de; h=In-Reply-To:Content-Type:MIME-Version:References:Subject:Cc:To:From: Date:X-RZG-CLASS-ID:X-RZG-AUTH; bh=AKsquRMoXfDHEn1jnQcRVY7jj+Y=; b=kra3GgJ/8E4CorspZAIo/AEuYZbO/XGLXRCDzCRiTlB4z0t1dky8flv8fKp32wr9nr5 vJip+uVQNLgtllSSsu0SMTt6N0cmri3jM1cSGRq9680S/Zkctr/tEzD/ljs55XBUjdgXz 6AtHe7F6Z95zeW0eJwpHKXxl/5mx7I+0xTE=
Envelope-to: www-data@xxxxxxxxxxxxxxxxxxx
In-reply-to: <C951E354.29FA4%keir@xxxxxxx>
List-help: <mailto:xen-devel-request@lists.xensource.com?subject=help>
List-id: Xen developer discussion <xen-devel.lists.xensource.com>
List-post: <mailto:xen-devel@lists.xensource.com>
List-subscribe: <http://lists.xensource.com/mailman/listinfo/xen-devel>, <mailto:xen-devel-request@lists.xensource.com?subject=subscribe>
List-unsubscribe: <http://lists.xensource.com/mailman/listinfo/xen-devel>, <mailto:xen-devel-request@lists.xensource.com?subject=unsubscribe>
References: <20110110164347.726339637@xxxxxxxxx> <C951E354.29FA4%keir@xxxxxxx>
Sender: xen-devel-bounces@xxxxxxxxxxxxxxxxxxx
User-agent: Mutt/1.5.20 (2009-06-14)
On Tue, Jan 11, Keir Fraser wrote:

> Could we do this in free_heap_pages() instead? That definitely catches
> everything that gets placed in Xen's free pool.

Yes, this is a compile-tested patch.

The machine_to_phys_mapping[] array needs updating during page
deallocation.  If that page is allocated again, a call to
get_gpfn_from_mfn() will still return an old gfn from another guest.
This will cause trouble because this gfn number has no or different
meaning in the context of the current guest.

This happens when the entire guest ram is paged-out before
xen_vga_populate_vram() runs.  Then XENMEM_populate_physmap is called
with gfn 0xff000.  A new page is allocated with alloc_domheap_pages.
This new page does not have a gfn yet.  However, in
guest_physmap_add_entry() the passed mfn maps still to an old gfn
(perhaps from another old guest).  This old gfn is in paged-out state in
this guests context and has no mfn anymore.  As a result, the ASSERT()
triggers because p2m_is_ram() is true for p2m_ram_paging* types.
If the machine_to_phys_mapping[] array is updated properly, both loops
in guest_physmap_add_entry() turn into no-ops for the new page and the
mfn/gfn mapping will be done at the end of the function.

If XENMEM_add_to_physmap is used with XENMAPSPACE_gmfn,
get_gpfn_from_mfn() will return an appearently valid gfn.  As a result,
guest_physmap_remove_page() is called.  The ASSERT in p2m_remove_page
triggers because the passed mfn does not match the old mfn for the
passed gfn.

Signed-off-by: Olaf Hering <olaf@xxxxxxxxx>

    move from free_domheap_pages() to free_heap_pages() as suggested by Keir

 xen/common/page_alloc.c |    6 ++++++
 1 file changed, 6 insertions(+)

--- xen-unstable.hg-4.1.22697.orig/xen/common/page_alloc.c
+++ xen-unstable.hg-4.1.22697/xen/common/page_alloc.c
@@ -527,6 +527,7 @@ static int reserve_offlined_page(struct
 static void free_heap_pages(
     struct page_info *pg, unsigned int order)
+    unsigned long mfn;
     unsigned long mask;
     unsigned int i, node = phys_to_nid(page_to_maddr(pg)), tainted = 0;
     unsigned int zone = page_to_zone(pg);
@@ -536,6 +537,11 @@ static void free_heap_pages(
+    /* this page is not a gfn anymore */
+    mfn = page_to_mfn(pg);
+    for ( i = 0; i < (1 << order); i++ )
+        set_gpfn_from_mfn(mfn + i, INVALID_M2P_ENTRY);
     for ( i = 0; i < (1 << order); i++ )

Xen-devel mailing list

<Prev in Thread] Current Thread [Next in Thread>