From mboxrd@z Thu Jan 1 00:00:00 1970 From: Keir Fraser Subject: Re: tracking of Xen heap pages shared with guest Date: Fri, 14 Mar 2008 13:48:27 +0000 Message-ID: References: <47DA8E83.76E4.0078.0@novell.com> Mime-Version: 1.0 Content-Type: text/plain; charset="US-ASCII" Content-Transfer-Encoding: 7bit Return-path: In-Reply-To: <47DA8E83.76E4.0078.0@novell.com> List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Sender: xen-devel-bounces@lists.xensource.com Errors-To: xen-devel-bounces@lists.xensource.com To: Jan Beulich , xen-devel@lists.xensource.com Cc: joserenato.santos@hp.com List-Id: xen-devel@lists.xenproject.org On 14/3/08 13:41, "Jan Beulich" wrote: > Right, but the question was - what if the guest erroneously or > maliciously frees the page? If there's indeed no extra reference, then > the page (which Xen will continue to write to) may get assigned to a > different domain, including dom0, and hence the whole system could > get at risk. It cannot be freed by the guest. Note that free_domheap_pages() is a no-op for Xen-heap pages. >> I'm no expert on xenoprof. I've cc'ed Renato. >> >> Wouldn't dom0 mappings bump the page reference count, and this would prevent >> the domU being destroyed (remember that non-empty domain page ownership >> lists hold a domain reference)? > > As I understand it, the pages get shared with dom0, so ownership also > transfers to dom0, which doesn't prevent the guest from being fully > destroyed. Point out the specific lines of code that you think are offending and I'll take a look. -- Keir