[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index] [Xen-devel] [PATCH V4] xen/balloon: flush persistent kmaps in correct position
Xen balloon driver will update ballooned out pages' P2M entries to point to scratch page for PV guests. In 24f69373e2 ("xen/balloon: don't alloc page while non-preemptible", kmap_flush_unused was moved after updating P2M table. In that case for 32 bit PV guest we might end up with P2M X -----> S (S is mfn of balloon scratch page) M2P Y -----> X (Y is mfn in persistent kmap entry) kmap_flush_unused() iterates through all the PTEs in the kmap address space, using pte_to_page() to obtain the page. If the p2m and the m2p are inconsistent the incorrect page is returned. This will clear page->address on the wrong page which may cause subsequent oopses if that page is currently kmap'ed. Move the flush back between get_page and all other operations that look into p2m and m2p to fix this. Signed-off-by: Wei Liu <wei.liu2@xxxxxxxxxx> Cc: David Vrabel <david.vrabel@xxxxxxxxxx> Cc: Konrad Wilk <konrad.wilk@xxxxxxxxxx> Cc: Boris Ostrovsky <boris.ostrovsky@xxxxxxxxxx> Cc: stable@xxxxxxxxxxxxxxx # 3.12+ --- drivers/xen/balloon.c | 13 ++++++++----- 1 file changed, 8 insertions(+), 5 deletions(-) diff --git a/drivers/xen/balloon.c b/drivers/xen/balloon.c index 37d06ea..52a18bf 100644 --- a/drivers/xen/balloon.c +++ b/drivers/xen/balloon.c @@ -402,9 +402,16 @@ static enum bp_state decrease_reservation(unsigned long nr_pages, gfp_t gfp) pfn = page_to_pfn(page); frame_list[i] = pfn_to_mfn(pfn); + } - scrub_page(page); + /* Ensure that ballooned highmem pages don't have kmaps. */ + kmap_flush_unused(); + flush_tlb_all(); + for (i = 0; i < nr_pages; i++) { + pfn = mfn_to_pfn(frame_list[i]); + page = pfn_to_page(pfn); + scrub_page(page); #ifdef CONFIG_XEN_HAVE_PVMMU /* * Ballooned out frames are effectively replaced with @@ -432,10 +439,6 @@ static enum bp_state decrease_reservation(unsigned long nr_pages, gfp_t gfp) balloon_append(pfn_to_page(pfn)); } - /* Ensure that ballooned highmem pages don't have kmaps. */ - kmap_flush_unused(); - flush_tlb_all(); - set_xen_guest_handle(reservation.extent_start, frame_list); reservation.nr_extents = nr_pages; ret = HYPERVISOR_memory_op(XENMEM_decrease_reservation, &reservation); -- 1.7.10.4 _______________________________________________ Xen-devel mailing list Xen-devel@xxxxxxxxxxxxx http://lists.xen.org/xen-devel
|
Lists.xenproject.org is hosted with RackSpace, monitoring our |