xen: deal with stale cr3 values when unpinning pagetables

When a pagetable is no longer in use, it must be unpinned so that its
pages can be freed.  However, this is only possible if there are no
stray uses of the pagetable.  The code currently deals with all the
usual cases, but there's a rare case where a vcpu is changing cr3, but
is doing so lazily, and the change hasn't actually happened by the time
the pagetable is unpinned, even though it appears to have been completed.

This change adds a second per-cpu cr3 variable - xen_current_cr3 -
which tracks the actual state of the vcpu cr3.  It is only updated once
the actual hypercall to set cr3 has been completed.  Other processors
wishing to unpin a pagetable can check other vcpu's xen_current_cr3
values to see if any cross-cpu IPIs are needed to clean things up.

[ Stable folks: 2.6.23 bugfix ]

Signed-off-by: Jeremy Fitzhardinge <jeremy@xensource.com>
Cc: Stable Kernel <stable@kernel.org>

1 files changed, 26 insertions, 3 deletions

diff --git a/arch/x86/xen/mmu.c b/arch/x86/xen/mmu.c
index c4a391f88980..72f08ab43a4d 100644
--- a/arch/x86/xen/mmu.c
+++ b/arch/x86/xen/mmu.c
@@ -514,20 +514,43 @@ static void drop_other_mm_ref(void *info)
 
         if (__get_cpu_var(cpu_tlbstate).active_mm == mm)
                 leave_mm(smp_processor_id());
+
+        /* If this cpu still has a stale cr3 reference, then make sure
+           it has been flushed. */
+        if (x86_read_percpu(xen_current_cr3) == __pa(mm->pgd)) {
+                load_cr3(swapper_pg_dir);
+                arch_flush_lazy_cpu_mode();
+        }
 }
 
 static void drop_mm_ref(struct mm_struct *mm)
 {
+        cpumask_t mask;
+        unsigned cpu;
+
         if (current->active_mm == mm) {
                 if (current->mm == mm)
                         load_cr3(swapper_pg_dir);
                 else
                         leave_mm(smp_processor_id());
+                arch_flush_lazy_cpu_mode();
+        }
+
+        /* Get the "official" set of cpus referring to our pagetable. */
+        mask = mm->cpu_vm_mask;
+
+        /* It's possible that a vcpu may have a stale reference to our
+           cr3, because its in lazy mode, and it hasn't yet flushed
+           its set of pending hypercalls yet.  In this case, we can
+           look at its actual current cr3 value, and force it to flush
+           if needed. */
+        for_each_online_cpu(cpu) {
+                if (per_cpu(xen_current_cr3, cpu) == __pa(mm->pgd))
+                        cpu_set(cpu, mask);
         }
 
-        if (!cpus_empty(mm->cpu_vm_mask))
-                xen_smp_call_function_mask(mm->cpu_vm_mask, drop_other_mm_ref,
-                                           mm, 1);
+        if (!cpus_empty(mask))
+                xen_smp_call_function_mask(mask, drop_other_mm_ref, mm, 1);
 }
 #else
 static void drop_mm_ref(struct mm_struct *mm)