From mboxrd@z Thu Jan  1 00:00:00 1970
From: Malcolm Crossley <malcolm.crossley@citrix.com>
Subject: [PATCH] [RFC] xen: Fix memory hotplug end limit test
 for updating compat M2P table
Date: Mon, 23 Apr 2012 19:07:23 +0100
Message-ID: <8470671d407f4f74b499.1335204443@malcolmc-Precision-WorkStation-T3500>
Mime-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: 7bit
Return-path: <xen-devel-bounces@lists.xen.org>
List-Unsubscribe: <http://lists.xen.org/cgi-bin/mailman/options/xen-devel>,
	<mailto:xen-devel-request@lists.xen.org?subject=unsubscribe>
List-Post: <mailto:xen-devel@lists.xen.org>
List-Help: <mailto:xen-devel-request@lists.xen.org?subject=help>
List-Subscribe: <http://lists.xen.org/cgi-bin/mailman/listinfo/xen-devel>,
	<mailto:xen-devel-request@lists.xen.org?subject=subscribe>
Sender: xen-devel-bounces@lists.xen.org
Errors-To: xen-devel-bounces@lists.xen.org
To: xen-devel@lists.xensource.com
Cc: tim@xen.org
List-Id: xen-devel@lists.xenproject.org

The memory hotplug code was masking the hotplugged memory start address and comparing to a shifted version of COMPAT MPT size but not doing the same for the end address.
This patch applies the same shifting and masking to the end address and reapplies the mask if the end address has been clamped.

diff -r 274e5accd62d -r 8470671d407f xen/arch/x86/x86_64/mm.c
--- a/xen/arch/x86/x86_64/mm.c
+++ b/xen/arch/x86/x86_64/mm.c
@@ -446,6 +446,8 @@ static int setup_compat_m2p_table(struct
     int err = 0;
 
     smap = info->spfn & (~((1UL << (L2_PAGETABLE_SHIFT - 2)) -1));
+    emap = ( (epfn + ((1UL << (L2_PAGETABLE_SHIFT - 2)) - 1 )) &
+                ~((1UL << (L2_PAGETABLE_SHIFT - 2)) - 1) );
 
     /*
      * Notice: For hot-added memory, only range below m2p_compat_vstart
@@ -454,11 +456,11 @@ static int setup_compat_m2p_table(struct
     if   ((smap > ((RDWR_COMPAT_MPT_VIRT_END - RDWR_COMPAT_MPT_VIRT_START) >> 2)) )
         return 0;
 
-    if (epfn > (RDWR_COMPAT_MPT_VIRT_END - RDWR_COMPAT_MPT_VIRT_START))
-        epfn = (RDWR_COMPAT_MPT_VIRT_END - RDWR_COMPAT_MPT_VIRT_START) >> 2;
-
-    emap = ( (epfn + ((1UL << (L2_PAGETABLE_SHIFT - 2)) - 1 )) &
-                ~((1UL << (L2_PAGETABLE_SHIFT - 2)) - 1) );
+    if (emap > ((RDWR_COMPAT_MPT_VIRT_END - RDWR_COMPAT_MPT_VIRT_START) >> 2))
+    {
+        emap = (RDWR_COMPAT_MPT_VIRT_END - RDWR_COMPAT_MPT_VIRT_START) >> 2;
+    	emap = emap & ~((1UL << (L2_PAGETABLE_SHIFT - 2)) - 1);
+    }
 
     va = HIRO_COMPAT_MPT_VIRT_START +
          smap * sizeof(*compat_machine_to_phys_mapping);