File xsa408.patch of Package xen.31431

x86/mm: correct TLB flush condition in _get_page_type()

When this logic was moved, it was moved across the point where nx is
updated to hold the new type for the page. IOW originally it was
equivalent to using x (and perhaps x would better have been used), but
now it isn't anymore. Switch to using x, which then brings things in
line again with the slightly earlier comment there (now) talking about
transitions _from_ writable.

I have to confess though that I cannot make a direct connection between
the reported observed behavior of guests leaving several pages around
with pending general references and the change here. Repeated testing,
nevertheless, confirms the reported issue is no longer there.

This is XSA-???.

Fixes: 8cc5036bc385 ("x86/pv: Fix ABAC cmpxchg() race in _get_page_type()")
Reported-by: Charles Arnold <carnold@suse.com>
Signed-off-by: Jan Beulich <jbeulich@suse.com>
---
Furthermore aren't we using ->tlbflush_timestamp there even when the
shadow_flags union member is active, i.e. for PGC_page_table pages? I
for one can't convince myself that this isn't possible with OOS active
(and {page,mfn}_oos_may_write() producing "true" for a page).

I'd be happy to update the description to actually connect things, as
long as someone can give some plausible explanation.

--- a/xen/arch/x86/mm.c
+++ b/xen/arch/x86/mm.c
@@ -3112,7 +3112,7 @@ static int _get_page_type(struct page_in
             if ( unlikely(!cpumask_empty(mask)) &&
                  /* Shadow mode: track only writable pages. */
                  (!shadow_mode_enabled(d) ||
-                  ((nx & PGT_type_mask) == PGT_writable_page)) )
+                  ((x & PGT_type_mask) == PGT_writable_page)) )
             {
                 perfc_incr(need_flush_tlb_flush);
                 flush_tlb_mask(mask);