[PATCH] xen/x86: fix initial memory balloon target

[PATCH] xen/x86: fix initial memory balloon target

[Roger Pau Monne]

When adding extra memory regions as ballooned pages also adjust the balloon
target, otherwise when the balloon driver is started it will populate
memory to match the target value and consume all the extra memory regions
added.

This made the usage of the Xen `dom0_mem=,max:` command line parameter for
dom0 not work as expected, as the target won't be adjusted and when the
balloon is started it will populate memory straight to the 'max:' value.
It would equally affect domUs that have memory != maxmem.

Kernels built with CONFIG_XEN_UNPOPULATED_ALLOC are not affected, because
the extra memory regions are consumed by the unpopulated allocation driver,
and then balloon_add_regions() becomes a no-op.

Reported-by: John <jw@nuclearfallout.net>
Fixes: 87af633689ce ('x86/xen: fix balloon target initialization for PVH dom0')
Signed-off-by: Roger Pau Monné <roger.pau@citrix.com>
---
 drivers/xen/balloon.c | 13 ++++++++-----
 1 file changed, 8 insertions(+), 5 deletions(-)

diff --git a/drivers/xen/balloon.c b/drivers/xen/balloon.c
index 8c852807ba1c..2de37dcd7556 100644
--- a/drivers/xen/balloon.c
+++ b/drivers/xen/balloon.c
@@ -704,15 +704,18 @@ static int __init balloon_add_regions(void)
 
 		/*
 		 * Extra regions are accounted for in the physmap, but need
-		 * decreasing from current_pages to balloon down the initial
-		 * allocation, because they are already accounted for in
-		 * total_pages.
+		 * decreasing from current_pages and target_pages to balloon
+		 * down the initial allocation, because they are already
+		 * accounted for in total_pages.
 		 */
-		if (extra_pfn_end - start_pfn >= balloon_stats.current_pages) {
+		pages = extra_pfn_end - start_pfn;
+		if (pages >= balloon_stats.current_pages ||
+		    pages >= balloon_stats.target_pages) {
 			WARN(1, "Extra pages underflow current target");
 			return -ERANGE;
 		}
-		balloon_stats.current_pages -= extra_pfn_end - start_pfn;
+		balloon_stats.current_pages -= pages;
+		balloon_stats.target_pages -= pages;
 	}
 
 	return 0;
-- 
2.48.1

Re: [PATCH] xen/x86: fix initial memory balloon target

[Jürgen Groß]

[-- Attachment #1.1.1: Type: text/plain, Size: 1038 bytes --]

On 14.05.25 10:04, Roger Pau Monne wrote:
> When adding extra memory regions as ballooned pages also adjust the balloon
> target, otherwise when the balloon driver is started it will populate
> memory to match the target value and consume all the extra memory regions
> added.
> 
> This made the usage of the Xen `dom0_mem=,max:` command line parameter for
> dom0 not work as expected, as the target won't be adjusted and when the
> balloon is started it will populate memory straight to the 'max:' value.
> It would equally affect domUs that have memory != maxmem.
> 
> Kernels built with CONFIG_XEN_UNPOPULATED_ALLOC are not affected, because
> the extra memory regions are consumed by the unpopulated allocation driver,
> and then balloon_add_regions() becomes a no-op.
> 
> Reported-by: John <jw@nuclearfallout.net>
> Fixes: 87af633689ce ('x86/xen: fix balloon target initialization for PVH dom0')
> Signed-off-by: Roger Pau Monné <roger.pau@citrix.com>

Reviewed-by: Juergen Gross <jgross@suse.com>


Juergen

[-- Attachment #1.1.2: OpenPGP public key --]
[-- Type: application/pgp-keys, Size: 3743 bytes --]

[-- Attachment #2: OpenPGP digital signature --]
[-- Type: application/pgp-signature, Size: 495 bytes --]

Re: [PATCH] xen/x86: fix initial memory balloon target

[Marek Marczykowski-Górecki]

[-- Attachment #1: Type: text/plain, Size: 2406 bytes --]

On Wed, May 14, 2025 at 10:04:26AM +0200, Roger Pau Monne wrote:
> When adding extra memory regions as ballooned pages also adjust the balloon
> target, otherwise when the balloon driver is started it will populate
> memory to match the target value and consume all the extra memory regions
> added.
> 
> This made the usage of the Xen `dom0_mem=,max:` command line parameter for
> dom0 not work as expected, as the target won't be adjusted and when the
> balloon is started it will populate memory straight to the 'max:' value.
> It would equally affect domUs that have memory != maxmem.
> 
> Kernels built with CONFIG_XEN_UNPOPULATED_ALLOC are not affected, because
> the extra memory regions are consumed by the unpopulated allocation driver,
> and then balloon_add_regions() becomes a no-op.
> 
> Reported-by: John <jw@nuclearfallout.net>
> Fixes: 87af633689ce ('x86/xen: fix balloon target initialization for PVH dom0')
> Signed-off-by: Roger Pau Monné <roger.pau@citrix.com>

Tested-by: Marek Marczykowski-Górecki <marmarek@invisiblethingslab.com>

> ---
>  drivers/xen/balloon.c | 13 ++++++++-----
>  1 file changed, 8 insertions(+), 5 deletions(-)
> 
> diff --git a/drivers/xen/balloon.c b/drivers/xen/balloon.c
> index 8c852807ba1c..2de37dcd7556 100644
> --- a/drivers/xen/balloon.c
> +++ b/drivers/xen/balloon.c
> @@ -704,15 +704,18 @@ static int __init balloon_add_regions(void)
>  
>  		/*
>  		 * Extra regions are accounted for in the physmap, but need
> -		 * decreasing from current_pages to balloon down the initial
> -		 * allocation, because they are already accounted for in
> -		 * total_pages.
> +		 * decreasing from current_pages and target_pages to balloon
> +		 * down the initial allocation, because they are already
> +		 * accounted for in total_pages.
>  		 */
> -		if (extra_pfn_end - start_pfn >= balloon_stats.current_pages) {
> +		pages = extra_pfn_end - start_pfn;
> +		if (pages >= balloon_stats.current_pages ||
> +		    pages >= balloon_stats.target_pages) {
>  			WARN(1, "Extra pages underflow current target");
>  			return -ERANGE;
>  		}
> -		balloon_stats.current_pages -= extra_pfn_end - start_pfn;
> +		balloon_stats.current_pages -= pages;
> +		balloon_stats.target_pages -= pages;
>  	}
>  
>  	return 0;
> -- 
> 2.48.1
> 
> 

-- 
Best Regards,
Marek Marczykowski-Górecki
Invisible Things Lab

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 488 bytes --]

Re: [PATCH] xen/x86: fix initial memory balloon target

[Marek Marczykowski-Górecki]

[-- Attachment #1: Type: text/plain, Size: 1383 bytes --]

On Thu, May 15, 2025 at 11:01:24AM +0200, Marek Marczykowski-Górecki wrote:
> On Wed, May 14, 2025 at 10:04:26AM +0200, Roger Pau Monne wrote:
> > When adding extra memory regions as ballooned pages also adjust the balloon
> > target, otherwise when the balloon driver is started it will populate
> > memory to match the target value and consume all the extra memory regions
> > added.
> > 
> > This made the usage of the Xen `dom0_mem=,max:` command line parameter for
> > dom0 not work as expected, as the target won't be adjusted and when the
> > balloon is started it will populate memory straight to the 'max:' value.
> > It would equally affect domUs that have memory != maxmem.
> > 
> > Kernels built with CONFIG_XEN_UNPOPULATED_ALLOC are not affected, because
> > the extra memory regions are consumed by the unpopulated allocation driver,
> > and then balloon_add_regions() becomes a no-op.
> > 
> > Reported-by: John <jw@nuclearfallout.net>
> > Fixes: 87af633689ce ('x86/xen: fix balloon target initialization for PVH dom0')
> > Signed-off-by: Roger Pau Monné <roger.pau@citrix.com>
> 
> Tested-by: Marek Marczykowski-Górecki <marmarek@invisiblethingslab.com>

I think this wants Cc: stable, since the commit named in Fixes: got
backported too. Or is the Fixes tag enough?

-- 
Best Regards,
Marek Marczykowski-Górecki
Invisible Things Lab

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 488 bytes --]