From mboxrd@z Thu Jan  1 00:00:00 1970
From: "Jan Beulich" <JBeulich@suse.com>
Subject: Re: [PATCH] x86/HVM: honor p2m_ram_ro in
 hvm_map_guest_frame_rw()
Date: Fri, 24 Jul 2015 04:37:25 -0600
Message-ID: <55B231850200007800095110@prv-mh.provo.novell.com>
References: <55B224660200007800095083@prv-mh.provo.novell.com>
	<20150724102647.GB30594@zion.uk.xensource.com>
Mime-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: 7bit
Return-path: <xen-devel-bounces@lists.xen.org>
Received: from mail6.bemta14.messagelabs.com ([193.109.254.103])
	by lists.xen.org with esmtp (Exim 4.72)
	(envelope-from <JBeulich@suse.com>) id 1ZIaM5-0005Ym-Mt
	for xen-devel@lists.xenproject.org; Fri, 24 Jul 2015 10:37:29 +0000
In-Reply-To: <20150724102647.GB30594@zion.uk.xensource.com>
Content-Disposition: inline
List-Unsubscribe: <http://lists.xen.org/cgi-bin/mailman/options/xen-devel>,
	<mailto:xen-devel-request@lists.xen.org?subject=unsubscribe>
List-Post: <mailto:xen-devel@lists.xen.org>
List-Help: <mailto:xen-devel-request@lists.xen.org?subject=help>
List-Subscribe: <http://lists.xen.org/cgi-bin/mailman/listinfo/xen-devel>,
	<mailto:xen-devel-request@lists.xen.org?subject=subscribe>
Sender: xen-devel-bounces@lists.xen.org
Errors-To: xen-devel-bounces@lists.xen.org
To: Wei Liu <wei.liu2@citrix.com>
Cc: KevinTian <kevin.tian@intel.com>, Keir Fraser <keir@xen.org>, suravee.suthikulpanit@amd.com, AndrewCooper <andrew.cooper3@citrix.com>, EddieDong <eddie.dong@intel.com>, Aravind Gopalakrishnan <aravind.gopalakrishnan@amd.com>, Jun Nakajima <jun.nakajima@intel.com>, xen-devel <xen-devel@lists.xenproject.org>, Boris Ostrovsky <boris.ostrovsky@oracle.com>
List-Id: xen-devel@lists.xenproject.org

>>> On 24.07.15 at 12:26, <wei.liu2@citrix.com> wrote:
> On Fri, Jul 24, 2015 at 03:41:26AM -0600, Jan Beulich wrote:
>> @@ -3618,7 +3618,12 @@ static void *__hvm_map_guest_frame(unsig
>>      }
>>  
>>      if ( writable )
> 
> I don't claim I know this piece of code, but checking the pointer but
> not the content looks suspicious.
> 
>> -        paging_mark_dirty(d, page_to_mfn(page));
>> +    {
>> +        if ( !p2m_is_discard_write(p2mt) )
>> +            paging_mark_dirty(d, page_to_mfn(page));
>> +        else
>> +            *writable = 0;
> 
> You then set *writable here, which makes it even more suspicious.

Why? A caller _wanting_ a writable mapping passes non-NULL as
the pointer argument (pre-initialized to point to a variable holding
TRUE aka 1). Upon return the variable will have got set to FALSE
aka 0 if the page shouldn't be written to.

Jan