Re: [PATCH V3] xen/balloon: flush persistent kmaps in correct position

[Wei Liu <wei.liu2@citrix.com>]

On Tue, Mar 18, 2014 at 05:40:55PM +0000, David Vrabel wrote:
[...]
> Wei, how about this?  I expanded the comment, left the tlb flush after
> changing the mappings, and shuffled a few bits around to avoid a few
> pfn/mfn/page conversions.
> 
> Can you test it, please?
> 

Yes, I tested it on 32-bit PV and it worked. I manually copied and
pasted the changes.

> Thanks.
> 
> 8<---------------------------------
> >From e0c38006cfd0395d500a66d2ab07dfd1327d140d Mon Sep 17 00:00:00 2001
> From: Wei Liu <wei.liu2@citrix.com>
> Date: Sat, 15 Mar 2014 16:11:47 +0000
> Subject: [PATCH] xen/balloon: flush persistent kmaps in correct position
> 
> Xen balloon driver will update ballooned out pages' P2M entries to point
> to scratch page for PV guests. In 24f69373e2 ("xen/balloon: don't alloc
> page while non-preemptible", kmap_flush_unused was moved after updating
> P2M table. In that case for 32 bit PV guest we might end up with
> 
>   P2M    X -----> S  (S is mfn of balloon scratch page)
>   M2P    Y -----> X  (Y is mfn in persistent kmap entry)
> 
> kmap_flush_unused() iterates through all the PTEs in the kmap address
> space, using pte_to_page() to obtain the page. If the p2m and the m2p
> are inconsistent the incorrect page is returned.  This will clear
> page->address on the wrong page which may cause subsequent oopses if
> that page is currently kmap'ed.
> 
> Move the flush back between get_page and __set_phys_to_machine to fix
> this.
> 
> Signed-off-by: Wei Liu <wei.liu2@citrix.com>
> Signed-off-by: David Vrabel <david.vrabel@citrix.com>
> Cc: stable@vger.kernel.org # 3.12+
> ---
>  drivers/xen/balloon.c |   24 ++++++++++++++++++------
>  1 files changed, 18 insertions(+), 6 deletions(-)
> 
> diff --git a/drivers/xen/balloon.c b/drivers/xen/balloon.c
> index 37d06ea..3e27d11 100644
> --- a/drivers/xen/balloon.c
> +++ b/drivers/xen/balloon.c
> @@ -399,12 +399,26 @@ static enum bp_state decrease_reservation(unsigned
> long nr_pages, gfp_t gfp)

FYI, This line was wrapped by your email client.

Wei