From mboxrd@z Thu Jan 1 00:00:00 1970 From: David Vrabel Subject: Re: [PATCH] xen/balloon: flush unused mappings before updating P2M table Date: Fri, 14 Mar 2014 18:05:50 +0000 Message-ID: <532344FE.7050407@citrix.com> References: <1394814064-9136-1-git-send-email-wei.liu2@citrix.com> Mime-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Return-path: Received: from mail6.bemta4.messagelabs.com ([85.158.143.247]) by lists.xen.org with esmtp (Exim 4.72) (envelope-from ) id 1WOWUw-0002x6-95 for xen-devel@lists.xenproject.org; Fri, 14 Mar 2014 18:06:22 +0000 In-Reply-To: <1394814064-9136-1-git-send-email-wei.liu2@citrix.com> List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Sender: xen-devel-bounces@lists.xen.org Errors-To: xen-devel-bounces@lists.xen.org To: Wei Liu Cc: xen-devel@lists.xenproject.org, Boris Ostrovsky , Tim Deegan List-Id: xen-devel@lists.xenproject.org On 14/03/14 16:21, Wei Liu wrote: > Xen balloon driver will update ballooned out pages' P2M entries to point > to scratch page for PV guests. In 24f69373e2 ("xen/balloon: don't alloc > page while non-preemptible", kmap_flush_unused was moved after the > update for P2M table. In that case for 32 bit PV guest we might end up > with > > P2M X -----> scratch_page > M2P Y -----> X (Y is mfn in unused kmap entry) > > When PVMMU is consulted, it gets confused and returns the wrong value. > Eventually the guest crashes. > > Move the flush before __set_phys_to_machine to fix this. The scrub_page() will immediately repopulate the kmap cache with the MFN about to be returned to Xen so this isn't the correct place. I don't understand your description of the problem so I cannot suggest a correct fix. What's consulting what? As an aside, I do think the flush_tlb_all() is unnecessary since Xen does that for us in the update_va_mapping hypercall. I think. Tim, can you confirm? David