[Xen-devel] [PATCH] xen: fix __set_phys_to_machine

[Wei Liu <wei.liu2@xxxxxxxxxx>]

In commit cd9151e2: xen/balloon: set a mapping for ballooned out pages
we have the ballooned out page's mapping set to a scratch page. When the
page is ballooned in again its P2M entry can be the MFN of the scratch
page, hitting the BUG_ONs in __set_phys_to_machine.

Signed-off-by: Wei Liu <wei.liu2@xxxxxxxxxx>
Cc: Stefano Stabellini <stefano.stabellini@xxxxxxxxxxxxx>
---
 arch/x86/xen/p2m.c    |   14 ++++++++++++--
 drivers/xen/balloon.c |    2 +-
 2 files changed, 13 insertions(+), 3 deletions(-)

diff --git a/arch/x86/xen/p2m.c b/arch/x86/xen/p2m.c
index 74672ee..4c11f6a 100644
--- a/arch/x86/xen/p2m.c
+++ b/arch/x86/xen/p2m.c
@@ -793,17 +793,27 @@ unsigned long __init set_phys_range_identity(unsigned 
long pfn_s,
        return pfn - pfn_s;
 }
 
+DECLARE_PER_CPU(struct page *, balloon_scratch_page);
 /* Try to install p2m mapping; fail if intermediate bits missing */
 bool __set_phys_to_machine(unsigned long pfn, unsigned long mfn)
 {
        unsigned topidx, mididx, idx;
+       unsigned long balloon_scratch_pfn;
+       unsigned long balloon_scratch_mfn;
+
+       balloon_scratch_pfn = page_to_pfn(__get_cpu_var(balloon_scratch_page));
+       balloon_scratch_mfn = pfn_to_mfn(balloon_scratch_pfn);
 
        if (unlikely(xen_feature(XENFEAT_auto_translated_physmap))) {
-               BUG_ON(pfn != mfn && mfn != INVALID_P2M_ENTRY);
+               BUG_ON(pfn != mfn &&
+                      pfn != balloon_scratch_mfn &&
+                      mfn != INVALID_P2M_ENTRY &&
+                      mfn != balloon_scratch_mfn);
                return true;
        }
        if (unlikely(pfn >= MAX_P2M_PFN)) {
-               BUG_ON(mfn != INVALID_P2M_ENTRY);
+               BUG_ON(mfn != INVALID_P2M_ENTRY &&
+                      mfn != balloon_scratch_mfn);
                return true;
        }
 
diff --git a/drivers/xen/balloon.c b/drivers/xen/balloon.c
index a3dc75d..89e2f3b 100644
--- a/drivers/xen/balloon.c
+++ b/drivers/xen/balloon.c
@@ -92,7 +92,7 @@ EXPORT_SYMBOL_GPL(balloon_stats);
 
 /* We increase/decrease in batches which fit in a page */
 static xen_pfn_t frame_list[PAGE_SIZE / sizeof(unsigned long)];
-static DEFINE_PER_CPU(struct page *, balloon_scratch_page);
+DEFINE_PER_CPU(struct page *, balloon_scratch_page);
 
 
 /* List of ballooned pages, threaded through the mem_map array. */
-- 
1.7.10.4


_______________________________________________
Xen-devel mailing list
Xen-devel@xxxxxxxxxxxxx
http://lists.xen.org/xen-devel