Re: xen.git branch reorg / success with 2.6.30-rc3 pv_ops dom0

[Jeremy Fitzhardinge <jeremy@goop.org>]

Ian Campbell wrote:
> I wonder how this interacts with the logic in
> arch/x86/xen/mmu.c:xen_pin_page() which holds the lock while waiting for
> the (deferred) pin multicall to occur? Hmm, no this is about the
> PagePinned flag on the struct page which is out of date WRT the actual
> pinned status as Xen sees it -- we update the PagePinned flag early in
> xen_pin_page() long before Xen the pin hypercall so this window is the
> other way round to what would be needed to trigger this bug.
>   

Yes, it looks like you could get a bad mapping here.  An obvious fix 
would be to defer clearing the pinned flag in the page struct until 
after the hypercall has issued.  That would make the racy 
kmap_atomic_pte map RO, which would be fine unless it actually tries to 
modify it (but I can't imagine it would do that unlocked).

    J