diff options
author | David Vrabel <david.vrabel@citrix.com> | 2013-09-11 13:45:44 -0400 |
---|---|---|
committer | Stefano Stabellini <stefano.stabellini@eu.citrix.com> | 2013-09-11 13:52:58 -0400 |
commit | 2bad07ce28a0f61c1e776f99aa05f85e4e689e24 (patch) | |
tree | b13abf74f1f22eaf3d71e5c399c599f72fd77c82 | |
parent | c3b7cb1fd8c1513be99fb3cfb7f39c5116d80dac (diff) |
xen/balloon: ensure preemption is disabled when using a scratch page
In decrease_reservation(), if the kernel is preempted between updating
the mapping and updating the p2m then they may end up using different
scratch pages.
Use get_balloon_scratch_page() and put_balloon_scratch_page() which use
get_cpu_var() and put_cpu_var() to correctly disable preemption.
Signed-off-by: David Vrabel <david.vrabel@citrix.com>
Signed-off-by: Stefano Stabellini <stefano.stabellini@eu.citrix.com>
Tested-by: Sander Eikelenboom <linux@eikelenboom.it>
-rw-r--r-- | drivers/xen/balloon.c | 11 |
1 files changed, 7 insertions, 4 deletions
diff --git a/drivers/xen/balloon.c b/drivers/xen/balloon.c index 3101cf6daf56..4a43bc31ed3c 100644 --- a/drivers/xen/balloon.c +++ b/drivers/xen/balloon.c | |||
@@ -380,6 +380,7 @@ static enum bp_state decrease_reservation(unsigned long nr_pages, gfp_t gfp) | |||
380 | enum bp_state state = BP_DONE; | 380 | enum bp_state state = BP_DONE; |
381 | unsigned long pfn, i; | 381 | unsigned long pfn, i; |
382 | struct page *page; | 382 | struct page *page; |
383 | struct page *scratch_page; | ||
383 | int ret; | 384 | int ret; |
384 | struct xen_memory_reservation reservation = { | 385 | struct xen_memory_reservation reservation = { |
385 | .address_bits = 0, | 386 | .address_bits = 0, |
@@ -399,6 +400,8 @@ static enum bp_state decrease_reservation(unsigned long nr_pages, gfp_t gfp) | |||
399 | if (nr_pages > ARRAY_SIZE(frame_list)) | 400 | if (nr_pages > ARRAY_SIZE(frame_list)) |
400 | nr_pages = ARRAY_SIZE(frame_list); | 401 | nr_pages = ARRAY_SIZE(frame_list); |
401 | 402 | ||
403 | scratch_page = get_balloon_scratch_page(); | ||
404 | |||
402 | for (i = 0; i < nr_pages; i++) { | 405 | for (i = 0; i < nr_pages; i++) { |
403 | page = alloc_page(gfp); | 406 | page = alloc_page(gfp); |
404 | if (page == NULL) { | 407 | if (page == NULL) { |
@@ -416,7 +419,7 @@ static enum bp_state decrease_reservation(unsigned long nr_pages, gfp_t gfp) | |||
416 | if (xen_pv_domain() && !PageHighMem(page)) { | 419 | if (xen_pv_domain() && !PageHighMem(page)) { |
417 | ret = HYPERVISOR_update_va_mapping( | 420 | ret = HYPERVISOR_update_va_mapping( |
418 | (unsigned long)__va(pfn << PAGE_SHIFT), | 421 | (unsigned long)__va(pfn << PAGE_SHIFT), |
419 | pfn_pte(page_to_pfn(__get_cpu_var(balloon_scratch_page)), | 422 | pfn_pte(page_to_pfn(scratch_page), |
420 | PAGE_KERNEL_RO), 0); | 423 | PAGE_KERNEL_RO), 0); |
421 | BUG_ON(ret); | 424 | BUG_ON(ret); |
422 | } | 425 | } |
@@ -432,14 +435,14 @@ static enum bp_state decrease_reservation(unsigned long nr_pages, gfp_t gfp) | |||
432 | pfn = mfn_to_pfn(frame_list[i]); | 435 | pfn = mfn_to_pfn(frame_list[i]); |
433 | if (!xen_feature(XENFEAT_auto_translated_physmap)) { | 436 | if (!xen_feature(XENFEAT_auto_translated_physmap)) { |
434 | unsigned long p; | 437 | unsigned long p; |
435 | struct page *pg; | 438 | p = page_to_pfn(scratch_page); |
436 | pg = __get_cpu_var(balloon_scratch_page); | ||
437 | p = page_to_pfn(pg); | ||
438 | __set_phys_to_machine(pfn, pfn_to_mfn(p)); | 439 | __set_phys_to_machine(pfn, pfn_to_mfn(p)); |
439 | } | 440 | } |
440 | balloon_append(pfn_to_page(pfn)); | 441 | balloon_append(pfn_to_page(pfn)); |
441 | } | 442 | } |
442 | 443 | ||
444 | put_balloon_scratch_page(); | ||
445 | |||
443 | set_xen_guest_handle(reservation.extent_start, frame_list); | 446 | set_xen_guest_handle(reservation.extent_start, frame_list); |
444 | reservation.nr_extents = nr_pages; | 447 | reservation.nr_extents = nr_pages; |
445 | ret = HYPERVISOR_memory_op(XENMEM_decrease_reservation, &reservation); | 448 | ret = HYPERVISOR_memory_op(XENMEM_decrease_reservation, &reservation); |