x86/mm: drop gfn ref before calling handle_mmio()

Otherwise we get a deadlock between the p2m lock and the event lock,
which handle_mmio() acquires.

Signed-off-by: Tim Deegan <tim@xen.org>
Acked-by: Andres Lagar-Cavilla <andres@lagarcavilla.org>

diff --git a/xen/arch/x86/hvm/hvm.c b/xen/arch/x86/hvm/hvm.c
index df4326cce6dad34e79a63e38c7f026339125c4d4..85b18a604e1373087892930298a1ddb1e9f77a83 100644 (file)
--- a/xen/arch/x86/hvm/hvm.c
+++ b/xen/arch/x86/hvm/hvm.c
@@ -1324,10 +1324,11 @@ int hvm_hap_nested_page_fault(unsigned long gpa,
     if ( (p2mt == p2m_mmio_dm) || 
          (access_w && (p2mt == p2m_ram_ro)) )
     {
+        put_gfn(p2m->domain, gfn);
         if ( !handle_mmio() )
             hvm_inject_exception(TRAP_gp_fault, 0, 0);
         rc = 1;
-        goto out_put_gfn;
+        goto out;
     }
 
 #ifdef __x86_64__
@@ -1379,6 +1380,7 @@ int hvm_hap_nested_page_fault(unsigned long gpa,
 
 out_put_gfn:
     put_gfn(p2m->domain, gfn);
+out:
     if ( paged )
         p2m_mem_paging_populate(v->domain, gfn);
     if ( req_ptr )