aboutsummaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
authorDavid Vrabel <david.vrabel@citrix.com>2013-09-11 13:45:44 -0400
committerStefano Stabellini <stefano.stabellini@eu.citrix.com>2013-09-11 13:52:58 -0400
commit2bad07ce28a0f61c1e776f99aa05f85e4e689e24 (patch)
treeb13abf74f1f22eaf3d71e5c399c599f72fd77c82
parentc3b7cb1fd8c1513be99fb3cfb7f39c5116d80dac (diff)
xen/balloon: ensure preemption is disabled when using a scratch page
In decrease_reservation(), if the kernel is preempted between updating the mapping and updating the p2m then they may end up using different scratch pages. Use get_balloon_scratch_page() and put_balloon_scratch_page() which use get_cpu_var() and put_cpu_var() to correctly disable preemption. Signed-off-by: David Vrabel <david.vrabel@citrix.com> Signed-off-by: Stefano Stabellini <stefano.stabellini@eu.citrix.com> Tested-by: Sander Eikelenboom <linux@eikelenboom.it>
-rw-r--r--drivers/xen/balloon.c11
1 files changed, 7 insertions, 4 deletions
diff --git a/drivers/xen/balloon.c b/drivers/xen/balloon.c
index 3101cf6daf56..4a43bc31ed3c 100644
--- a/drivers/xen/balloon.c
+++ b/drivers/xen/balloon.c
@@ -380,6 +380,7 @@ static enum bp_state decrease_reservation(unsigned long nr_pages, gfp_t gfp)
380 enum bp_state state = BP_DONE; 380 enum bp_state state = BP_DONE;
381 unsigned long pfn, i; 381 unsigned long pfn, i;
382 struct page *page; 382 struct page *page;
383 struct page *scratch_page;
383 int ret; 384 int ret;
384 struct xen_memory_reservation reservation = { 385 struct xen_memory_reservation reservation = {
385 .address_bits = 0, 386 .address_bits = 0,
@@ -399,6 +400,8 @@ static enum bp_state decrease_reservation(unsigned long nr_pages, gfp_t gfp)
399 if (nr_pages > ARRAY_SIZE(frame_list)) 400 if (nr_pages > ARRAY_SIZE(frame_list))
400 nr_pages = ARRAY_SIZE(frame_list); 401 nr_pages = ARRAY_SIZE(frame_list);
401 402
403 scratch_page = get_balloon_scratch_page();
404
402 for (i = 0; i < nr_pages; i++) { 405 for (i = 0; i < nr_pages; i++) {
403 page = alloc_page(gfp); 406 page = alloc_page(gfp);
404 if (page == NULL) { 407 if (page == NULL) {
@@ -416,7 +419,7 @@ static enum bp_state decrease_reservation(unsigned long nr_pages, gfp_t gfp)
416 if (xen_pv_domain() && !PageHighMem(page)) { 419 if (xen_pv_domain() && !PageHighMem(page)) {
417 ret = HYPERVISOR_update_va_mapping( 420 ret = HYPERVISOR_update_va_mapping(
418 (unsigned long)__va(pfn << PAGE_SHIFT), 421 (unsigned long)__va(pfn << PAGE_SHIFT),
419 pfn_pte(page_to_pfn(__get_cpu_var(balloon_scratch_page)), 422 pfn_pte(page_to_pfn(scratch_page),
420 PAGE_KERNEL_RO), 0); 423 PAGE_KERNEL_RO), 0);
421 BUG_ON(ret); 424 BUG_ON(ret);
422 } 425 }
@@ -432,14 +435,14 @@ static enum bp_state decrease_reservation(unsigned long nr_pages, gfp_t gfp)
432 pfn = mfn_to_pfn(frame_list[i]); 435 pfn = mfn_to_pfn(frame_list[i]);
433 if (!xen_feature(XENFEAT_auto_translated_physmap)) { 436 if (!xen_feature(XENFEAT_auto_translated_physmap)) {
434 unsigned long p; 437 unsigned long p;
435 struct page *pg; 438 p = page_to_pfn(scratch_page);
436 pg = __get_cpu_var(balloon_scratch_page);
437 p = page_to_pfn(pg);
438 __set_phys_to_machine(pfn, pfn_to_mfn(p)); 439 __set_phys_to_machine(pfn, pfn_to_mfn(p));
439 } 440 }
440 balloon_append(pfn_to_page(pfn)); 441 balloon_append(pfn_to_page(pfn));
441 } 442 }
442 443
444 put_balloon_scratch_page();
445
443 set_xen_guest_handle(reservation.extent_start, frame_list); 446 set_xen_guest_handle(reservation.extent_start, frame_list);
444 reservation.nr_extents = nr_pages; 447 reservation.nr_extents = nr_pages;
445 ret = HYPERVISOR_memory_op(XENMEM_decrease_reservation, &reservation); 448 ret = HYPERVISOR_memory_op(XENMEM_decrease_reservation, &reservation);