Re: [PATCH v2 09/14] x86/mm: prepare destroy_perdomain_mapping() for per-vCPU perdomain areas

[George Dunlap <dunlapg@xxxxxxxxx>]

On Tue, Sep 8, 2026 at 4:36 PM Jan Beulich <jbeulich@xxxxxxxx> wrote:
>
> On 02.09.2026 11:43, George Dunlap wrote:
> > --- a/xen/arch/x86/mm.c
> > +++ b/xen/arch/x86/mm.c
> > @@ -6456,10 +6456,11 @@ void populate_perdomain_mapping(const struct vcpu 
> > *v, unsigned long va,
> >      local_irq_restore(irq_flags);
> >  }
> >
> > -void destroy_perdomain_mapping(struct domain *d, unsigned long va,
> > +void destroy_perdomain_mapping(const struct vcpu *v, unsigned long va,
> >                                 unsigned int nr)
> >  {
> >      const l3_pgentry_t *l3tab, *pl3e;
> > +    const struct domain *d = v->domain;
> >
> >      ASSERT(va >= PERDOMAIN_VIRT_START &&
> >             va < PERDOMAIN_VIRT_SLOT(PERDOMAIN_SLOTS));
> > @@ -6468,6 +6469,26 @@ void destroy_perdomain_mapping(struct domain *d, 
> > unsigned long va,
> >      if ( !d->arch.perdomain_l3_pg )
> >          return;
> >
> > +    if ( likely(this_cpu(pgtable_vcpu) == v) )
>
> Right now this looks to be relevant only to some of the call sites of
> pv_destroy_ldt(). I expect this is going to change down the road?

It doesn't look like it, actually; I suspect Roger just added it for
consistency's sake (all perdomain functions take a vcpu, so they can
all use the linear pagetable).

> > +    {
> > +        l1_pgentry_t *pl1e;
> > +
> > +        /*
> > +         * Fast path: v's page-tables are loaded on this pCPU, so the L1
> > +         * entries can be zapped using the recursive linear mappings.
> > +         */
> > +        pl1e = &__linear_l1_table[l1_linear_offset(va)];
> > +
> > +        for ( ; nr--; pl1e++ )
> > +        {
> > +            if ( perdomain_l1e_needs_freeing(*pl1e) )
> > +                free_domheap_page(l1e_get_page(*pl1e));
> > +            l1e_write(pl1e, l1e_empty());
> > +        }
> > +
> > +        return;
> > +    }
> > +
> >      l3tab = __map_domain_page(d->arch.perdomain_l3_pg);
> >      pl3e = l3tab + l3_table_offset(va);
>
> The slow path is resilient against an area never having been mapped. This
> fast path looks like it would crash on a missing L2 or L1 table. I.e. for
> domain cleanup (and error handling during domain creation) we'd
> implicitly rely on those never taking the fast path. May be worth making
> explicit in the description.

If we keep the fast path, it's probably worth making it resilient
against empty paths, just to save ourselves time in the future.

On the other hand, I'm not terribly attached to the fast path; it can
only really be used for the guest-driven LDT teardown, which isn't a
hot path.  I'm as happy to rip it out.

> > --- a/xen/arch/x86/pv/domain.c
> > +++ b/xen/arch/x86/pv/domain.c
> > @@ -319,8 +319,7 @@ static int pv_create_gdt_ldt_l1tab(struct vcpu *v)
> >
> >  static void pv_destroy_gdt_ldt_l1tab(struct vcpu *v)
> >  {
> > -    destroy_perdomain_mapping(v->domain, GDT_VIRT_START(v),
> > -                              1U << GDT_LDT_VCPU_SHIFT);
> > +    destroy_perdomain_mapping(v, GDT_VIRT_START(v), 1U << 
> > GDT_LDT_VCPU_SHIFT);
> >  }
>
> Considering what patch 08 does - is this explicit call really needed?
> There are no pages to free here, unlike ...
>
> > --- a/xen/arch/x86/x86_64/mm.c
> > +++ b/xen/arch/x86/x86_64/mm.c
> > @@ -738,7 +738,7 @@ int setup_compat_arg_xlat(struct vcpu *v)
> >
> >  void free_compat_arg_xlat(struct vcpu *v)
> >  {
> > -    destroy_perdomain_mapping(v->domain, ARG_XLAT_START(v),
> > +    destroy_perdomain_mapping(v, ARG_XLAT_START(v),
> >                                PFN_UP(COMPAT_ARG_XLAT_SIZE));
> >  }
>
> ... here. Then again even the freeing is taken care of by
> free_perdomain_mappings(), so even for this one the question arises
> whether it's actually needed.

It looks like this one is needed for the "undo_and_fail" path of
xen/arch/x86/pv/domain.c:switch_compat(); in theory the vcpu could
continue as a 64-bit vcpu afterwards.

But yes, given that we're allowing "free" to subsume "destroy", we
could just make that the policy, and drop a bunch of other redundant
calls as well.  Right now there's only the one, but by the end of the
series there are a handful more that we could refrain to add.

I'm inclined to drop the linear map use, and also drop
pv_destroy_gdt_l1tab().  Any thoughts?

 -George