Re: [PATCH v2 09/14] x86/mm: prepare destroy_perdomain_mapping() for per-vCPU perdomain areas

[Jan Beulich <jbeulich@suse.com>]

On 02.09.2026 11:43, George Dunlap wrote:
> --- a/xen/arch/x86/mm.c
> +++ b/xen/arch/x86/mm.c
> @@ -6456,10 +6456,11 @@ void populate_perdomain_mapping(const struct vcpu *v, unsigned long va,
>      local_irq_restore(irq_flags);
>  }
>  
> -void destroy_perdomain_mapping(struct domain *d, unsigned long va,
> +void destroy_perdomain_mapping(const struct vcpu *v, unsigned long va,
>                                 unsigned int nr)
>  {
>      const l3_pgentry_t *l3tab, *pl3e;
> +    const struct domain *d = v->domain;
>  
>      ASSERT(va >= PERDOMAIN_VIRT_START &&
>             va < PERDOMAIN_VIRT_SLOT(PERDOMAIN_SLOTS));
> @@ -6468,6 +6469,26 @@ void destroy_perdomain_mapping(struct domain *d, unsigned long va,
>      if ( !d->arch.perdomain_l3_pg )
>          return;
>  
> +    if ( likely(this_cpu(pgtable_vcpu) == v) )

Right now this looks to be relevant only to some of the call sites of
pv_destroy_ldt(). I expect this is going to change down the road?

> +    {
> +        l1_pgentry_t *pl1e;
> +
> +        /*
> +         * Fast path: v's page-tables are loaded on this pCPU, so the L1
> +         * entries can be zapped using the recursive linear mappings.
> +         */
> +        pl1e = &__linear_l1_table[l1_linear_offset(va)];
> +
> +        for ( ; nr--; pl1e++ )
> +        {
> +            if ( perdomain_l1e_needs_freeing(*pl1e) )
> +                free_domheap_page(l1e_get_page(*pl1e));
> +            l1e_write(pl1e, l1e_empty());
> +        }
> +
> +        return;
> +    }
> +
>      l3tab = __map_domain_page(d->arch.perdomain_l3_pg);
>      pl3e = l3tab + l3_table_offset(va);

The slow path is resilient against an area never having been mapped. This
fast path looks like it would crash on a missing L2 or L1 table. I.e. for
domain cleanup (and error handling during domain creation) we'd
implicitly rely on those never taking the fast path. May be worth making
explicit in the description.

> --- a/xen/arch/x86/pv/domain.c
> +++ b/xen/arch/x86/pv/domain.c
> @@ -319,8 +319,7 @@ static int pv_create_gdt_ldt_l1tab(struct vcpu *v)
>  
>  static void pv_destroy_gdt_ldt_l1tab(struct vcpu *v)
>  {
> -    destroy_perdomain_mapping(v->domain, GDT_VIRT_START(v),
> -                              1U << GDT_LDT_VCPU_SHIFT);
> +    destroy_perdomain_mapping(v, GDT_VIRT_START(v), 1U << GDT_LDT_VCPU_SHIFT);
>  }

Considering what patch 08 does - is this explicit call really needed?
There are no pages to free here, unlike ...

> --- a/xen/arch/x86/x86_64/mm.c
> +++ b/xen/arch/x86/x86_64/mm.c
> @@ -738,7 +738,7 @@ int setup_compat_arg_xlat(struct vcpu *v)
>  
>  void free_compat_arg_xlat(struct vcpu *v)
>  {
> -    destroy_perdomain_mapping(v->domain, ARG_XLAT_START(v),
> +    destroy_perdomain_mapping(v, ARG_XLAT_START(v),
>                                PFN_UP(COMPAT_ARG_XLAT_SIZE));
>  }

... here. Then again even the freeing is taken care of by
free_perdomain_mappings(), so even for this one the question arises
whether it's actually needed.

Jan