ia64/xen-unstable

changeset 7853:fa99d895bb18

This fixes the following scenerio:
1) gmfn X is L2 table, and a shadow for it is set.
2) A write to page X, and the same page would be L1 table
also.(Something like the linear page table) But the shadow for L1 table
is not set.

The code path will be shadow_fault -> l1pte_write_fault. Because X is L2
table, so shadow_mark_va_out_of_sync is called , this function will
allocate a OO entry for this table, and set the writable_pl1e to -1.
Also it alloc a L1 shadow for X through shadow_map_l1_into_current_l2.
When allocating, free_out_of_sync_state will be called to free all OO
entry. However, since the OO entry allocated on
shadow_mark_va_out_of_sync has the writable_pl1e to -1, this OO entry
will never be released.

Signed-off-by: Yunhong Jiang <yunhong.jiang@intel.com>
author kaf24@firebug.cl.cam.ac.uk
date Wed Nov 16 11:41:14 2005 +0100 (2005-11-16)
parents 1df8b53bdd37
children fb50fba1895c
files xen/arch/x86/shadow.c xen/arch/x86/shadow32.c
line diff
     1.1 --- a/xen/arch/x86/shadow.c	Wed Nov 16 11:39:38 2005 +0100
     1.2 +++ b/xen/arch/x86/shadow.c	Wed Nov 16 11:41:14 2005 +0100
     1.3 @@ -873,7 +873,7 @@ shadow_make_snapshot(
     1.4  }
     1.5  
     1.6  static struct out_of_sync_entry *
     1.7 -mark_mfn_out_of_sync(struct vcpu *v, unsigned long gpfn,
     1.8 +__mark_mfn_out_of_sync(struct vcpu *v, unsigned long gpfn,
     1.9                               unsigned long mfn)
    1.10  {
    1.11      struct domain *d = v->domain;
    1.12 @@ -909,7 +909,6 @@ mark_mfn_out_of_sync(struct vcpu *v, uns
    1.13      entry->v = v;
    1.14      entry->gpfn = gpfn;
    1.15      entry->gmfn = mfn;
    1.16 -    entry->snapshot_mfn = shadow_make_snapshot(d, gpfn, mfn);
    1.17      entry->writable_pl1e = -1;
    1.18  
    1.19  #if 0 // this code has not been updated for 32pae & 64 bit modes
    1.20 @@ -923,20 +922,34 @@ mark_mfn_out_of_sync(struct vcpu *v, uns
    1.21      //
    1.22      get_page(page, d);
    1.23  
    1.24 +    return entry;
    1.25 +}
    1.26 +
    1.27 +static struct out_of_sync_entry *
    1.28 +mark_mfn_out_of_sync(struct vcpu *v, unsigned long gpfn,
    1.29 +                             unsigned long mfn)
    1.30 +{
    1.31 +    struct out_of_sync_entry *entry =
    1.32 +        __mark_mfn_out_of_sync(v, gpfn, mfn);
    1.33 +    struct domain *d = v->domain;
    1.34 +
    1.35 +    entry->snapshot_mfn = shadow_make_snapshot(d, gpfn, mfn);
    1.36      // Add to the out-of-sync list
    1.37      //
    1.38      entry->next = d->arch.out_of_sync;
    1.39      d->arch.out_of_sync = entry;
    1.40  
    1.41      return entry;
    1.42 +
    1.43  }
    1.44  
    1.45  static void shadow_mark_va_out_of_sync(
    1.46      struct vcpu *v, unsigned long gpfn, unsigned long mfn, unsigned long va)
    1.47  {
    1.48      struct out_of_sync_entry *entry =
    1.49 -        shadow_mark_mfn_out_of_sync(v, gpfn, mfn);
    1.50 +        __mark_mfn_out_of_sync(v, gpfn, mfn);
    1.51      l2_pgentry_t sl2e;
    1.52 +    struct domain *d = v->domain;
    1.53  
    1.54  #if CONFIG_PAGING_LEVELS >= 4
    1.55      {
    1.56 @@ -971,6 +984,7 @@ static void shadow_mark_va_out_of_sync(
    1.57      }
    1.58      ASSERT(l2e_get_flags(sl2e) & _PAGE_PRESENT);
    1.59  
    1.60 +    entry->snapshot_mfn = shadow_make_snapshot(d, gpfn, mfn);
    1.61      // NB: this is stored as a machine address.
    1.62      entry->writable_pl1e =
    1.63          l2e_get_paddr(sl2e) | (sizeof(l1_pgentry_t) * l1_table_offset(va));
    1.64 @@ -983,6 +997,11 @@ static void shadow_mark_va_out_of_sync(
    1.65      if ( !get_shadow_ref(l2e_get_pfn(sl2e)) )
    1.66          BUG();
    1.67  
    1.68 +    // Add to the out-of-sync list
    1.69 +    //
    1.70 +    entry->next = d->arch.out_of_sync;
    1.71 +    d->arch.out_of_sync = entry;
    1.72 +
    1.73      FSH_LOG("mark_out_of_sync(va=%lx -> writable_pl1e=%lx)",
    1.74              va, entry->writable_pl1e);
    1.75  }
     2.1 --- a/xen/arch/x86/shadow32.c	Wed Nov 16 11:39:38 2005 +0100
     2.2 +++ b/xen/arch/x86/shadow32.c	Wed Nov 16 11:41:14 2005 +0100
     2.3 @@ -1826,7 +1826,7 @@ shadow_free_snapshot(struct domain *d, s
     2.4  }
     2.5  
     2.6  struct out_of_sync_entry *
     2.7 -shadow_mark_mfn_out_of_sync(struct vcpu *v, unsigned long gpfn,
     2.8 +__shadow_mark_mfn_out_of_sync(struct vcpu *v, unsigned long gpfn,
     2.9                               unsigned long mfn)
    2.10  {
    2.11      struct domain *d = v->domain;
    2.12 @@ -1862,7 +1862,6 @@ shadow_mark_mfn_out_of_sync(struct vcpu 
    2.13      entry->v = v;
    2.14      entry->gpfn = gpfn;
    2.15      entry->gmfn = mfn;
    2.16 -    entry->snapshot_mfn = shadow_make_snapshot(d, gpfn, mfn);
    2.17      entry->writable_pl1e = -1;
    2.18  
    2.19  #if SHADOW_DEBUG
    2.20 @@ -1874,6 +1873,18 @@ shadow_mark_mfn_out_of_sync(struct vcpu 
    2.21      //
    2.22      get_page(page, d);
    2.23  
    2.24 +    return entry;
    2.25 +}
    2.26 +
    2.27 +struct out_of_sync_entry *
    2.28 +shadow_mark_mfn_out_of_sync(struct vcpu *v, unsigned long gpfn,
    2.29 +                             unsigned long mfn)
    2.30 +{
    2.31 +    struct out_of_sync_entry *entry =
    2.32 +      __shadow_mark_mfn_out_of_sync(v, gpfn, mfn);
    2.33 +    struct domain *d = v->domain;
    2.34 +
    2.35 +    entry->snapshot_mfn = shadow_make_snapshot(d, gpfn, mfn);
    2.36      // Add to the out-of-sync list
    2.37      //
    2.38      entry->next = d->arch.out_of_sync;
    2.39 @@ -1886,8 +1897,9 @@ void shadow_mark_va_out_of_sync(
    2.40      struct vcpu *v, unsigned long gpfn, unsigned long mfn, unsigned long va)
    2.41  {
    2.42      struct out_of_sync_entry *entry =
    2.43 -        shadow_mark_mfn_out_of_sync(v, gpfn, mfn);
    2.44 +        __shadow_mark_mfn_out_of_sync(v, gpfn, mfn);
    2.45      l2_pgentry_t sl2e;
    2.46 +    struct domain *d = v->domain;
    2.47  
    2.48      // We need the address of shadow PTE that maps @va.
    2.49      // It might not exist yet.  Make sure it's there.
    2.50 @@ -1902,6 +1914,7 @@ void shadow_mark_va_out_of_sync(
    2.51      }
    2.52      ASSERT(l2e_get_flags(sl2e) & _PAGE_PRESENT);
    2.53  
    2.54 +    entry->snapshot_mfn = shadow_make_snapshot(d, gpfn, mfn);
    2.55      // NB: this is stored as a machine address.
    2.56      entry->writable_pl1e =
    2.57          l2e_get_paddr(sl2e) | (sizeof(l1_pgentry_t) * l1_table_offset(va));
    2.58 @@ -1914,6 +1927,11 @@ void shadow_mark_va_out_of_sync(
    2.59      if ( !get_shadow_ref(l2e_get_pfn(sl2e)) )
    2.60          BUG();
    2.61  
    2.62 +    // Add to the out-of-sync list
    2.63 +    //
    2.64 +    entry->next = d->arch.out_of_sync;
    2.65 +    d->arch.out_of_sync = entry;
    2.66 +
    2.67      FSH_LOG("mark_out_of_sync(va=%lx -> writable_pl1e=%lx)",
    2.68              va, entry->writable_pl1e);
    2.69  }