Re: [PATCH v3 15/18] x86/mm: flush owned pages before reuse with the sparse directmap view

[Jan Beulich <jbeulich@xxxxxxxx>]

On 14.10.2026 17:34, George Dunlap wrote:
> On Thu, Oct 8, 2026 at 8:00 PM Roger Pau Monné <roger@xxxxxxxxxxxxxx> wrote:
>>
>> On Wed, Oct 07, 2026 at 11:40:48AM +0100, George Dunlap wrote:
>>> Since d7bf1b8ea275 ("x86/mm: limit deferred TLB flushing to PV domain
>>> support") a page freed by its owner is flushed from TLBs before it is
>>> handed out again only in builds with PV support, on the premise that PV
>>> domains, with their (limited) control over the host MMU and over when
>>> flushes happen, are the only ones to leave stale entries behind.
>>>
>>> Xen's transient mappings of domain pages are another source.  The
>>> mapcache zaps a slot when it is unmapped but defers the flush: the
>>> slot's translation can stay in the TLB of the CPU which used it until
>>> that CPU next flushes, by which time the page may have been freed and
>>> handed to another domain.  Before "x86/hvm: introduce per-vCPU
>>> mapcache for vCPU-PT domains", only PV vCPUs use the mapcache, so the
>>> PV condition covers it.  Now that the vCPUs of an HVM domain with
>>> per-vCPU page-tables have one as well.
>>>
>>> While the full directmap is loaded in every context, stale transient
>>> mappings only map what's already mapped in the full directmap.  On the
>>> sparse view of the directmap, a stale translation of a page handed to
>>> another domain would keep it reachable from a context which has
>>> nothing to do with it.
>>
>> But if it's handed to another domain, then it also hasn't gone through
>> a free cycle, which is what pg->u.free.need_tlbflush covers?
> 
> Sorry, the wording there is a bit imprecise; it should be "a stale
> translation of a page *freed and then* handed to another domain".
> 
> Apart from things like steal_page(), which doesn't apply to HVM guests
> AFAIK, there isn't any way to hand a page to another domain, is there?

I think you're right that there isn't any. However, there is that plan
of Stefano's to make steal_page() work for HVM. Their main target is
PVH Dom0 iirc, so that may still be okay-ish for the purposes here.

Jan