From 9e97fb0d613cfec88179616859f50cc8939ca2b3 Mon Sep 17 00:00:00 2001
From: "kaf24@scramble.cl.cam.ac.uk" <kaf24@scramble.cl.cam.ac.uk>
Date: Tue, 13 Jul 2004 14:16:56 +0000
Subject: [PATCH] bitkeeper revision 1.1071.1.2
 (40f3eed8kdZ959gB_ZYkHRPFFEGkKg)

Fix domain death to stop all CPUs running over the defunct page tables.
---
 xen/arch/x86/domain.c    |  8 ++------
 xen/arch/x86/x86_32/mm.c | 16 ++++++++++++++++
 xen/common/kernel.c      |  1 -
 xen/include/asm-x86/mm.h |  6 ++++++
 4 files changed, 24 insertions(+), 7 deletions(-)

diff --git a/xen/arch/x86/domain.c b/xen/arch/x86/domain.c
index 5d8fd06980..83eea289aa 100644
--- a/xen/arch/x86/domain.c
+++ b/xen/arch/x86/domain.c
@@ -445,12 +445,8 @@ void domain_relinquish_memory(struct domain *d)
     struct pfn_info  *page;
     unsigned long     x, y;
 
-    /*
-     * If we're executing the idle task then we may still be running over the 
-     * dead domain's page tables. We'd better fix that before freeing them!
-     */
-    if ( is_idle_task(current) )
-        write_ptbase(&current->mm);
+    /* Ensure that noone is running over the dead domain's page tables. */
+    synchronise_pagetables(~0UL);
 
     /* Exit shadow mode before deconstructing final guest page table. */
     shadow_mode_disable(d);
diff --git a/xen/arch/x86/x86_32/mm.c b/xen/arch/x86/x86_32/mm.c
index d034240b41..d350689071 100644
--- a/xen/arch/x86/x86_32/mm.c
+++ b/xen/arch/x86/x86_32/mm.c
@@ -129,6 +129,22 @@ void __init zap_low_mappings(void)
 }
 
 
+/*
+ * Allows shooting down of borrowed page-table use on specific CPUs.
+ * Specifically, we borrow page tables when running the idle domain.
+ */
+static void __synchronise_pagetables(void *mask)
+{
+    struct domain *d = current;
+    if ( ((unsigned long)mask & (1<<d->processor)) && is_idle_task(d) )
+        write_ptbase(&d->mm);
+}
+void synchronise_pagetables(unsigned long cpu_mask)
+{
+    __synchronise_pagetables((void *)cpu_mask);
+    smp_call_function(__synchronise_pagetables, (void *)cpu_mask, 1, 1);
+}
+
 long do_stack_switch(unsigned long ss, unsigned long esp)
 {
     int nr = smp_processor_id();
diff --git a/xen/common/kernel.c b/xen/common/kernel.c
index 2f99bbee43..a2fbd45dac 100644
--- a/xen/common/kernel.c
+++ b/xen/common/kernel.c
@@ -225,7 +225,6 @@ void cmain(unsigned long magic, multiboot_info_t *mbi)
 
     init_frametable((void *)FRAMETABLE_VIRT_START, max_page);
 
-
 #elif defined(__x86_64__)
 
     init_frametable(__va(xenheap_phys_end), max_page);
diff --git a/xen/include/asm-x86/mm.h b/xen/include/asm-x86/mm.h
index 0586562c62..b8a4c5e496 100644
--- a/xen/include/asm-x86/mm.h
+++ b/xen/include/asm-x86/mm.h
@@ -276,6 +276,12 @@ static inline int get_page_and_type(struct pfn_info *page,
 
 int check_descriptor(unsigned long a, unsigned long b);
 
+/*
+ * Use currently-executing domain's pagetables on the specified CPUs.
+ * i.e., stop borrowing someone else's tables if you are the idle domain.
+ */
+void synchronise_pagetables(unsigned long cpu_mask);
+
 /*
  * The MPT (machine->physical mapping table) is an array of word-sized
  * values, indexed on machine frame number. It is expected that guest OSes
-- 
2.30.2