xen: arm: correctly handle removing a subset of a superpage mapping.

This can be exercised for example via ballooning which will remove 4K
regions from anywhere in the address space.

Reported-by: Julien Grall <julien.grall@linaro.org>
Signed-off-by: Ian Campbell <ian.campbell@citrix.com>
Acked-by: Julien Grall <julien.grall@linaro.org>

diff --git a/xen/arch/arm/p2m.c b/xen/arch/arm/p2m.c
index c3d63f08abdb5db799fc29b8b4804c54fc59a20e..2f855b5d5c44ec5d2986ca42d54a286a37338289 100644 (file)
--- a/xen/arch/arm/p2m.c
+++ b/xen/arch/arm/p2m.c
@@ -604,8 +604,33 @@ static int apply_one_level(struct domain *d,
             return P2M_ONE_PROGRESS_NOP;
         }
 
-        if ( level < 3 && p2m_table(orig_pte) )
-            return P2M_ONE_DESCEND;
+        if ( level < 3 )
+        {
+            if ( p2m_table(orig_pte) )
+                return P2M_ONE_DESCEND;
+
+            if ( op == REMOVE &&
+                 !is_mapping_aligned(*addr, end_gpaddr,
+                                     0, /* maddr doesn't matter for remove */
+                                     level_size) )
+            {
+                /*
+                 * Removing a mapping from the middle of a superpage. Shatter
+                 * and descend.
+                 */
+                *flush = true;
+                rc = p2m_create_table(d, entry,
+                                      level_shift - PAGE_SHIFT, flush_cache);
+                if ( rc < 0 )
+                    return rc;
+
+                p2m->stats.shattered[level]++;
+                p2m->stats.mappings[level]--;
+                p2m->stats.mappings[level+1] += LPAE_ENTRIES;
+
+                return P2M_ONE_DESCEND;
+            }
+        }
 
         *flush = true;