kunmap_atomic() must zap the PTE to avoid dangling references

when attempting to free memory back to Xen. We can implement
something more efficient in future.

Also add debug print message if guest tries to free 'in use'
memory. We'll make it a real guest-visible error in future.

Signed-off-by: Keir Fraser <keir@xensource.com>

diff --git a/linux-2.6-xen-sparse/arch/i386/mm/highmem-xen.c b/linux-2.6-xen-sparse/arch/i386/mm/highmem-xen.c
index 2a9ce1c4f8339a6e47de6b68a9509cdc99f1f359..566219167d56a5505c0934906c3bdcfb0ef7d52c 100644 (file)
--- a/linux-2.6-xen-sparse/arch/i386/mm/highmem-xen.c
+++ b/linux-2.6-xen-sparse/arch/i386/mm/highmem-xen.c
@@ -79,6 +79,16 @@ void kunmap_atomic(void *kvaddr, enum km_type type)
         */
        pte_clear(&init_mm, vaddr, kmap_pte-idx);
        __flush_tlb_one(vaddr);
+#elif defined(CONFIG_XEN)
+       /*
+        * We must ensure there are no dangling pagetable references when
+        * returning memory to Xen (decrease_reservation).
+        * XXX TODO: We could make this faster by only zapping when
+        * kmap_flush_unused is called but that is trickier and more invasive.
+        */
+       unsigned long vaddr = (unsigned long) kvaddr & PAGE_MASK;
+       enum fixed_addresses idx = type + KM_TYPE_NR*smp_processor_id();
+       pte_clear(&init_mm, vaddr, kmap_pte-idx);
 #endif
 
        dec_preempt_count();

diff --git a/xen/common/memory.c b/xen/common/memory.c
index 1fd8466a4d5f444010a3e7848b7a68b29b82fc0b..cd041e85857f04f19f5d478374e0b25001944b78 100644 (file)
--- a/xen/common/memory.c
+++ b/xen/common/memory.c
@@ -170,6 +170,15 @@ guest_remove_page(
     if ( test_and_clear_bit(_PGC_allocated, &page->count_info) )
         put_page(page);
 
+    if ( unlikely((page->count_info & PGC_count_mask) != 1) )
+    {
+        /* We'll make this a guest-visible error in future, so take heed! */
+        DPRINTK("Dom%d freeing in-use page %lx (pseudophys %lx):"
+                " count=%x type=%lx\n",
+                d->domain_id, mfn, get_gpfn_from_mfn(mfn),
+                page->count_info, page->u.inuse.type_info);
+    }
+
     guest_physmap_remove_page(d, gmfn, mfn);
 
     put_page(page);