linux-toradex.git/drivers/xen/gntdev.c, branch v3.2.2

xen-gntdev: integer overflow in gntdev_alloc_map()

2011-11-16T17:13:46+00:00

The multiplications here can overflow resulting in smaller buffer
sizes than expected.  "count" comes from a copy_from_user().

Signed-off-by: Dan Carpenter 
Signed-off-by: Konrad Rzeszutek Wilk

Merge branch 'stable/cleanups-3.2' of git://git.kernel.org/pub/scm/linux/kernel/git/konrad/xen

2011-11-07T04:13:34+00:00

* 'stable/cleanups-3.2' of git://git.kernel.org/pub/scm/linux/kernel/git/konrad/xen:
  xen: use static initializers in xen-balloon.c
  Xen: fix braces and tabs coding style issue in xenbus_probe.c
  Xen: fix braces coding style issue in xenbus_probe.h
  Xen: fix whitespaces,tabs coding style issue in drivers/xen/pci.c
  Xen: fix braces coding style issue in gntdev.c and grant-table.c
  Xen: fix whitespaces,tabs coding style issue in drivers/xen/events.c
  Xen: fix whitespaces,tabs coding style issue in drivers/xen/balloon.c

Fix up trivial whitespace-conflicts in
 drivers/xen/{balloon.c,pci.c,xenbus/xenbus_probe.c}

xen/gntdev: Fix sleep-inside-spinlock

2011-10-14T14:02:10+00:00

BUG: sleeping function called from invalid context at /local/scratch/dariof/linux/kernel/mutex.c:271
in_atomic(): 1, irqs_disabled(): 0, pid: 3256, name: qemu-dm
1 lock held by qemu-dm/3256:
 #0:  (&(&priv->lock)->rlock){......}, at: [] gntdev_ioctl+0x2bd/0x4d5
Pid: 3256, comm: qemu-dm Tainted: G        W   3.1.0-rc8+ #5
Call Trace:
 [] __might_sleep+0x131/0x135
 [] mutex_lock_nested+0x25/0x45
 [] free_xenballooned_pages+0x20/0xb1
 [] gntdev_put_map+0xa8/0xdb
 [] ? _raw_spin_lock+0x71/0x7a
 [] ? gntdev_ioctl+0x2bd/0x4d5
 [] gntdev_ioctl+0x31f/0x4d5
 [] ? check_events+0x12/0x20
 [] do_vfs_ioctl+0x488/0x4d7
 [] ? xen_restore_fl_direct_reloc+0x4/0x4
 [] ? lock_release+0x21c/0x229
 [] ? rcu_read_unlock+0x21/0x32
 [] sys_ioctl+0x47/0x6a
 [] system_call_fastpath+0x16/0x1b

gntdev_put_map tries to acquire a mutex when freeing pages back to the
xenballoon pool, so it cannot be called with a spinlock held. In
gntdev_release, the spinlock is not needed as we are freeing the
structure later; in the ioctl, only the list manipulation needs to be
under the lock.

Reported-and-Tested-By: Dario Faggioli 
Signed-off-by: Daniel De Graaf 
Signed-off-by: Konrad Rzeszutek Wilk

xen: modify kernel mappings corresponding to granted pages

2011-09-29T14:32:58+00:00

If we want to use granted pages for AIO, changing the mappings of a user
vma and the corresponding p2m is not enough, we also need to update the
kernel mappings accordingly.
Currently this is only needed for pages that are created for user usages
through /dev/xen/gntdev. As in, pages that have been in use by the
kernel and use the P2M will not need this special mapping.
However there are no guarantees that in the future the kernel won't
start accessing pages through the 1:1 even for internal usage.

In order to avoid the complexity of dealing with highmem, we allocated
the pages lowmem.
We issue a HYPERVISOR_grant_table_op right away in
m2p_add_override and we remove the mappings using another
HYPERVISOR_grant_table_op in m2p_remove_override.
Considering that m2p_add_override and m2p_remove_override are called
once per page we use multicalls and hypercall batching.

Use the kmap_op pointer directly as argument to do the mapping as it is
guaranteed to be present up until the unmapping is done.
Before issuing any unmapping multicalls, we need to make sure that the
mapping has already being done, because we need the kmap->handle to be
set correctly.

Signed-off-by: Stefano Stabellini 
[v1: Removed GRANT_FRAME_BIT usage]
Signed-off-by: Konrad Rzeszutek Wilk

xen: add an "highmem" parameter to alloc_xenballooned_pages

2011-09-29T13:56:52+00:00

Add an highmem parameter to alloc_xenballooned_pages, to allow callers to
request lowmem or highmem pages.

Fix the code style of free_xenballooned_pages' prototype.

Signed-off-by: Stefano Stabellini 
Signed-off-by: Konrad Rzeszutek Wilk

Xen: fix braces coding style issue in gntdev.c and grant-table.c

2011-07-26T17:31:58+00:00

This is a patch to the gntdev.c and grant-table.c files that fixed up
braces errors found by the checkpatch.pl tools.

Signed-off-by: Ruslan Pisarev 
Signed-off-by: Konrad Rzeszutek Wilk

Merge branches 'stable/backend.base.v3' and 'stable/gntalloc.v7' of git://git.kernel.org/pub/scm/linux/kernel/git/konrad/xen

2011-05-19T23:14:25+00:00

* 'stable/backend.base.v3' of git://git.kernel.org/pub/scm/linux/kernel/git/konrad/xen:
  xen/pci: Fix compiler error when CONFIG_XEN_PRIVILEGED_GUEST is not set.
  xen/p2m: Add EXPORT_SYMBOL_GPL to the M2P override functions.
  xen/p2m/m2p/gnttab: Support GNTMAP_host_map in the M2P override.
  xen/irq: The Xen hypervisor cleans up the PIRQs if the other domain forgot.
  xen/irq: Export 'xen_pirq_from_irq' function.
  xen/irq: Add support to check if IRQ line is shared with other domains.
  xen/irq: Check if the PCI device is owned by a domain different than DOMID_SELF.
  xen/pci: Add xen_[find|register|unregister]_device_domain_owner functions.

* 'stable/gntalloc.v7' of git://git.kernel.org/pub/scm/linux/kernel/git/konrad/xen:
  xen/gntdev,gntalloc: Remove unneeded VM flags

xen-gntdev: unlock on error path in gntdev_mmap()

2011-03-24T14:32:45+00:00

We should unlock here and also decrement the number of &map->users.

Signed-off-by: Dan Carpenter 
Signed-off-by: Konrad Rzeszutek Wilk

xen-gntdev: return -EFAULT on copy_to_user failure

2011-03-24T14:32:44+00:00

copy_to_user() returns the amount of data remaining to be copied.  We
want to return a negative error code here.  The upper layers just
call WARN_ON() if we return non-zero so this doesn't change the
behavior.  But returning -EFAULT is still cleaner.

Signed-off-by: Dan Carpenter 
Signed-off-by: Konrad Rzeszutek Wilk

xen-gntdev: Use ballooned pages for grant mappings

2011-03-16T14:05:36+00:00

Grant mappings cause the PFN<->MFN mapping to be lost on the pages used
for the mapping. Instead of leaking memory, use pages that have already
been ballooned out and so have no valid mapping. This removes the need
for the bad-page leak workaround as pages are repopulated by the balloon
driver.

Acked-by: Ian Campbell 
Signed-off-by: Daniel De Graaf 
Signed-off-by: Konrad Rzeszutek Wilk