From mboxrd@z Thu Jan  1 00:00:00 1970
From: "Jan Beulich" <jbeulich@novell.com>
Subject: Re: tracking of Xen heap pages shared with guest
Date: Fri, 14 Mar 2008 14:07:41 +0000
Message-ID: <47DA94BD.76E4.0078.0@novell.com>
References: <47DA8E83.76E4.0078.0@novell.com>
	<C40032AB.15032%keir.fraser@eu.citrix.com>
Mime-Version: 1.0
Content-Type: text/plain; charset=US-ASCII
Content-Transfer-Encoding: quoted-printable
Return-path: <xen-devel-bounces@lists.xensource.com>
In-Reply-To: <C40032AB.15032%keir.fraser@eu.citrix.com>
Content-Disposition: inline
List-Unsubscribe: <http://lists.xensource.com/cgi-bin/mailman/listinfo/xen-devel>,
	<mailto:xen-devel-request@lists.xensource.com?subject=unsubscribe>
List-Post: <mailto:xen-devel@lists.xensource.com>
List-Help: <mailto:xen-devel-request@lists.xensource.com?subject=help>
List-Subscribe: <http://lists.xensource.com/cgi-bin/mailman/listinfo/xen-devel>,
	<mailto:xen-devel-request@lists.xensource.com?subject=subscribe>
Sender: xen-devel-bounces@lists.xensource.com
Errors-To: xen-devel-bounces@lists.xensource.com
To: Keir Fraser <keir.fraser@eu.citrix.com>, xen-devel@lists.xensource.com
Cc: joserenato.santos@hp.com
List-Id: xen-devel@lists.xenproject.org

>>> Keir Fraser <keir.fraser@eu.citrix.com> 14.03.08 14:48 >>>
>On 14/3/08 13:41, "Jan Beulich" <jbeulich@novell.com> wrote:
>
>> Right, but the question was - what if the guest erroneously or
>> maliciously frees the page? If there's indeed no extra reference, then
>> the page (which Xen will continue to write to) may get assigned to a
>> different domain, including dom0, and hence the whole system could
>> get at risk.
>
>It cannot be freed by the guest. Note that free_domheap_pages() is a =
no-op
>for Xen-heap pages.

Ah, right. I keep getting confused by this special treatment of the Xen
heap.

>>> I'm no expert on xenoprof. I've cc'ed Renato.
>>>=20
>>> Wouldn't dom0 mappings bump the page reference count, and this would =
prevent
>>> the domU being destroyed (remember that non-empty domain page =
ownership
>>> lists hold a domain reference)?
>>=20
>> As I understand it, the pages get shared with dom0, so ownership also
>> transfers to dom0, which doesn't prevent the guest from being fully
>> destroyed.
>
>Point out the specific lines of code that you think are offending and =
I'll
>take a look.

Your above comment clarifies matters here, too - since
free_domheap_pages() only removes Xen heap pages from the owning
domain's list, they cannot get assigned for other purposes (and they
would simply get re-added to the list the next time they'd get passed
to share_xen_pages_with_guest()).

Thanks and sorry for the noise, Jan