Merge tag 'stable/for-linus-3.12-rc0-tag-three' of git://git.kernel.org/pub/scm/linux/kernel/git/xen/tip

Pull Xen balloon driver bug-fixes from Stefano Stabellini:
 - fix a preemption bug in xen/balloon.c;
 - remove an harmful BUG_ON in xen/balloon.c that can trigger in
   non-erroneous situations.

* tag 'stable/for-linus-3.12-rc0-tag-three' of git://git.kernel.org/pub/scm/linux/kernel/git/xen/tip:
  xen/balloon: remove BUG_ON in increase_reservation
  xen/balloon: ensure preemption is disabled when using a scratch page

1 files changed, 7 insertions, 6 deletions

diff --git a/drivers/xen/balloon.c b/drivers/xen/balloon.c
index 3101cf6daf56..a50c6e3a7cc4 100644
--- a/drivers/xen/balloon.c
+++ b/drivers/xen/balloon.c
@@ -349,8 +349,6 @@ static enum bp_state increase_reservation(unsigned long nr_pages)
                 BUG_ON(page == NULL);
 
                 pfn = page_to_pfn(page);
-                BUG_ON(!xen_feature(XENFEAT_auto_translated_physmap) &&
-                       phys_to_machine_mapping_valid(pfn));
 
                 set_phys_to_machine(pfn, frame_list[i]);
 
@@ -380,6 +378,7 @@ static enum bp_state decrease_reservation(unsigned long nr_pages, gfp_t gfp)
         enum bp_state state = BP_DONE;
         unsigned long  pfn, i;
         struct page   *page;
+        struct page   *scratch_page;
         int ret;
         struct xen_memory_reservation reservation = {
                 .address_bits = 0,
@@ -399,6 +398,8 @@ static enum bp_state decrease_reservation(unsigned long nr_pages, gfp_t gfp)
         if (nr_pages > ARRAY_SIZE(frame_list))
                 nr_pages = ARRAY_SIZE(frame_list);
 
+        scratch_page = get_balloon_scratch_page();
+
         for (i = 0; i < nr_pages; i++) {
                 page = alloc_page(gfp);
                 if (page == NULL) {
@@ -416,7 +417,7 @@ static enum bp_state decrease_reservation(unsigned long nr_pages, gfp_t gfp)
                 if (xen_pv_domain() && !PageHighMem(page)) {
                         ret = HYPERVISOR_update_va_mapping(
                                 (unsigned long)__va(pfn << PAGE_SHIFT),
-                                pfn_pte(page_to_pfn(__get_cpu_var(balloon_scratch_page)),
+                                pfn_pte(page_to_pfn(scratch_page),
                                         PAGE_KERNEL_RO), 0);
                         BUG_ON(ret);
                 }
@@ -432,14 +433,14 @@ static enum bp_state decrease_reservation(unsigned long nr_pages, gfp_t gfp)
                 pfn = mfn_to_pfn(frame_list[i]);
                 if (!xen_feature(XENFEAT_auto_translated_physmap)) {
                         unsigned long p;
-                        struct page *pg;
-                        pg = __get_cpu_var(balloon_scratch_page);
-                        p = page_to_pfn(pg);
+                        p = page_to_pfn(scratch_page);
                         __set_phys_to_machine(pfn, pfn_to_mfn(p));
                 }
                 balloon_append(pfn_to_page(pfn));
         }
 
+        put_balloon_scratch_page();
+
         set_xen_guest_handle(reservation.extent_start, frame_list);
         reservation.nr_extents   = nr_pages;
         ret = HYPERVISOR_memory_op(XENMEM_decrease_reservation, &reservation);