Subject: Fix shared entry status for grant copy operation on paged-out gfn
From: Andres Lagar-Cavilla andres@lagarcavilla.org Wed Aug 22 22:27:50 2012 +0100
Date: Wed Aug 22 22:27:50 2012 +0100:
Git: 8aed1f12c4c087c5b31cbee8636b3d2d25efb363

The unwind path was not clearing the shared entry status bits. This
was BSOD-ing guests on network activity under certain configurations.

Also:
 * sed the fixup method name to signal it's related to grant copy.
 * use atomic clear flag ops during fixup.

Signed-off-by: Andres Lagar-Cavilla <andres@lagarcavilla.org>
Committed-by: Keir Fraser <keir@xen.org>

Index: xen-4.0.3-testing/xen/common/grant_table.c
===================================================================
--- xen-4.0.3-testing.orig/xen/common/grant_table.c
+++ xen-4.0.3-testing/xen/common/grant_table.c
@@ -1724,14 +1724,14 @@ __release_grant_for_copy(
    under the domain's grant table lock. */
 /* Only safe on transitive grants.  Even then, note that we don't
    attempt to drop any pin on the referent grant. */
-static void __fixup_status_for_pin(const struct active_grant_entry *act,
+static void __fixup_status_for_copy_pin(const struct active_grant_entry *act,
                                    uint16_t *status)
 {
     if ( !(act->pin & GNTPIN_hstw_mask) )
-        *status &= ~GTF_writing;
+        gnttab_clear_flag(_GTF_writing, status);
 
     if ( !(act->pin & GNTPIN_hstr_mask) )
-        *status &= ~GTF_reading;
+        gnttab_clear_flag(_GTF_reading, status);
 }
 
 /* Grab a frame number from a grant entry and update the flags and pin
@@ -1810,7 +1810,7 @@ __acquire_grant_for_copy(
         if ( sha2 && (shah->flags & GTF_type_mask) == GTF_transitive )
         {
             if ( !allow_transitive )
-                PIN_FAIL(unlock_out, GNTST_general_error,
+                PIN_FAIL(unlock_out_clear, GNTST_general_error,
                          "transitive grant when transitivity not allowed\n");
 
             trans_domid = sha2->transitive.trans_domid;
@@ -1818,7 +1818,7 @@ __acquire_grant_for_copy(
             barrier(); /* Stop the compiler from re-loading
                           trans_domid from shared memory */
             if ( trans_domid == rd->domain_id )
-                PIN_FAIL(unlock_out, GNTST_general_error,
+                PIN_FAIL(unlock_out_clear, GNTST_general_error,
                          "transitive grants cannot be self-referential\n");
 
             /* We allow the trans_domid == ld->domain_id case, which
@@ -1831,7 +1831,7 @@ __acquire_grant_for_copy(
             /* We need to leave the rrd locked during the grant copy */
             td = rcu_lock_domain_by_id(trans_domid);
             if ( td == NULL )
-                PIN_FAIL(unlock_out, GNTST_general_error,
+                PIN_FAIL(unlock_out_clear, GNTST_general_error,
                          "transitive grant referenced bad domain %d\n",
                          trans_domid);
             spin_unlock(&rd->grant_table->lock);
@@ -1843,7 +1843,7 @@ __acquire_grant_for_copy(
 
             spin_lock(&rd->grant_table->lock);
             if ( rc != GNTST_okay ) {
-                __fixup_status_for_pin(act, status);
+                __fixup_status_for_copy_pin(act, status);
                 rcu_unlock_domain(td);
                 spin_unlock(&rd->grant_table->lock);
                 return rc;
@@ -1855,7 +1855,7 @@ __acquire_grant_for_copy(
                and try again. */
             if ( act->pin != old_pin )
             {
-                __fixup_status_for_pin(act, status);
+                __fixup_status_for_copy_pin(act, status);
                 rcu_unlock_domain(td);
                 spin_unlock(&rd->grant_table->lock);
                 return __acquire_grant_for_copy(rd, gref, ld, readonly,
@@ -1924,6 +1924,17 @@ __acquire_grant_for_copy(
     *length = act->length;
     *frame = act->frame;
 
+    spin_unlock(&rd->grant_table->lock);
+    return rc;
+
+ unlock_out_clear:
+    if ( !(readonly) &&
+         !(act->pin & GNTPIN_hstw_mask) )
+        gnttab_clear_flag(_GTF_writing, status);
+
+    if ( !act->pin )
+        gnttab_clear_flag(_GTF_reading, status);
+
  unlock_out:
     spin_unlock(&rd->grant_table->lock);
     return rc;
