Fwd: Question regarding the behavior of guest_physmap_remove_page on x86

[Julien Grall <julien.grall@citrix.com>]

(Resending with this time xen-devel in CC)

Hi,

On ARM, it's possible to fail when removing a page from the P2M. It's
happening if we are trying to shatter a superpage and we don't have
memory to allocate the table. Therefore the mapping won't be removed
from the P2M.

However on ARM (and until recently on x86 [1]), the function
guest_physmap_remove_page is not supposed to return an error. So we
would free the page even if we fail to remove the page. This will end up
to re-use the page by someone else even though the mapping is still
present in the P2M.

I looked to the x86 version and I'm not sure how the function is
behaving. Maybe an x86 maintainers could give me insight here.

I'm thinking to fix the problem by checking the return of
guest_physmap_remove_page to avoid the page being reallocate to someone
else (see for instance guest_remove_page in xen/common/memory.c). Is it
a sensible way to fix it?

Regards,

[1] 5ae03990 "xen/vtd: create RMRR mapping"

-- 
Julien Grall