From bbc60c18ed17df75270da504bbd8f7bc4a52d43d Mon Sep 17 00:00:00 2001 From: Michael Abd-El-Malek Date: Fri, 4 Apr 2008 02:33:48 -0700 Subject: xen: fix grant table bug fix memory corruption and crash due to mis-sized grant table. A PV OS has two grant table data structures: the grant table itself and a free list. The free list is composed of an array of pages, which grow dynamically as the guest OS requires more grants. While the grant table contains 8-byte entries, the free list contains 4-byte entries. So we have half as many pages in the free list than in the grant table. There was a bug in the free list allocation code. The free list was indexed as if it was the same size as the grant table. But it's only half as large. So memory got corrupted, and I was seeing crashes in the slab allocator later on. Taken from: http://xenbits.xensource.com/linux-2.6.18-xen.hg?rev/4018c0da3360 Signed-off-by: Michael Abd-El-Malek Signed-off-by: Mark McLoughlin Signed-off-by: Jeremy Fitzhardinge Signed-off-by: Ingo Molnar --- drivers/xen/grant-table.c | 16 ++++++++++------ 1 file changed, 10 insertions(+), 6 deletions(-) (limited to 'drivers') diff --git a/drivers/xen/grant-table.c b/drivers/xen/grant-table.c index ea94dbabf9a..d85dc6d41c2 100644 --- a/drivers/xen/grant-table.c +++ b/drivers/xen/grant-table.c @@ -381,11 +381,15 @@ EXPORT_SYMBOL_GPL(gnttab_cancel_free_callback); static int grow_gnttab_list(unsigned int more_frames) { unsigned int new_nr_grant_frames, extra_entries, i; + unsigned int nr_glist_frames, new_nr_glist_frames; new_nr_grant_frames = nr_grant_frames + more_frames; extra_entries = more_frames * GREFS_PER_GRANT_FRAME; - for (i = nr_grant_frames; i < new_nr_grant_frames; i++) { + nr_glist_frames = (nr_grant_frames * GREFS_PER_GRANT_FRAME + RPP - 1) / RPP; + new_nr_glist_frames = + (new_nr_grant_frames * GREFS_PER_GRANT_FRAME + RPP - 1) / RPP; + for (i = nr_glist_frames; i < new_nr_glist_frames; i++) { gnttab_list[i] = (grant_ref_t *)__get_free_page(GFP_ATOMIC); if (!gnttab_list[i]) goto grow_nomem; @@ -407,7 +411,7 @@ static int grow_gnttab_list(unsigned int more_frames) return 0; grow_nomem: - for ( ; i >= nr_grant_frames; i--) + for ( ; i >= nr_glist_frames; i--) free_page((unsigned long) gnttab_list[i]); return -ENOMEM; } @@ -530,7 +534,7 @@ static int gnttab_expand(unsigned int req_entries) static int __devinit gnttab_init(void) { int i; - unsigned int max_nr_glist_frames; + unsigned int max_nr_glist_frames, nr_glist_frames; unsigned int nr_init_grefs; if (!is_running_on_xen()) @@ -543,15 +547,15 @@ static int __devinit gnttab_init(void) * grant reference free list on the current hypervisor. */ max_nr_glist_frames = (boot_max_nr_grant_frames * - GREFS_PER_GRANT_FRAME / - (PAGE_SIZE / sizeof(grant_ref_t))); + GREFS_PER_GRANT_FRAME / RPP); gnttab_list = kmalloc(max_nr_glist_frames * sizeof(grant_ref_t *), GFP_KERNEL); if (gnttab_list == NULL) return -ENOMEM; - for (i = 0; i < nr_grant_frames; i++) { + nr_glist_frames = (nr_grant_frames * GREFS_PER_GRANT_FRAME + RPP - 1) / RPP; + for (i = 0; i < nr_glist_frames; i++) { gnttab_list[i] = (grant_ref_t *)__get_free_page(GFP_KERNEL); if (gnttab_list[i] == NULL) goto ini_nomem; -- cgit v1.2.3 From 5761d64b277c287a7520b868c32d656ef03374b4 Mon Sep 17 00:00:00 2001 From: Thomas Gleixner Date: Fri, 4 Apr 2008 16:26:10 +0200 Subject: x86: revert assign IRQs to hpet timer The commits: commit 37a47db8d7f0f38dac5acf5a13abbc8f401707fa Author: Balaji Rao Date: Wed Jan 30 13:30:03 2008 +0100 x86: assign IRQs to HPET timers, fix and commit e3f37a54f690d3e64995ea7ecea08c5ab3070faf Author: Balaji Rao Date: Wed Jan 30 13:30:03 2008 +0100 x86: assign IRQs to HPET timers have been identified to cause a regression on some platforms due to the assignement of legacy IRQs which makes the legacy devices connected to those IRQs disfunctional. Revert them. This fixes http://bugzilla.kernel.org/show_bug.cgi?id=10382 Signed-off-by: Thomas Gleixner Signed-off-by: Ingo Molnar --- drivers/char/hpet.c | 51 +++++++-------------------------------------------- 1 file changed, 7 insertions(+), 44 deletions(-) (limited to 'drivers') diff --git a/drivers/char/hpet.c b/drivers/char/hpet.c index 465ad35ed38..1399971be68 100644 --- a/drivers/char/hpet.c +++ b/drivers/char/hpet.c @@ -731,14 +731,14 @@ static unsigned long hpet_calibrate(struct hpets *hpetp) int hpet_alloc(struct hpet_data *hdp) { - u64 cap, mcfg, hpet_config; + u64 cap, mcfg; struct hpet_dev *devp; - u32 i, ntimer, irq; + u32 i, ntimer; struct hpets *hpetp; size_t siz; struct hpet __iomem *hpet; static struct hpets *last = NULL; - unsigned long period, irq_bitmap; + unsigned long period; unsigned long long temp; /* @@ -765,47 +765,11 @@ int hpet_alloc(struct hpet_data *hdp) hpetp->hp_hpet_phys = hdp->hd_phys_address; hpetp->hp_ntimer = hdp->hd_nirqs; - hpet = hpetp->hp_hpet; - - /* Assign IRQs statically for legacy devices */ - hpetp->hp_dev[0].hd_hdwirq = hdp->hd_irq[0]; - hpetp->hp_dev[1].hd_hdwirq = hdp->hd_irq[1]; - - /* Assign IRQs dynamically for the others */ - for (i = 2, devp = &hpetp->hp_dev[2]; i < hdp->hd_nirqs; i++, devp++) { - struct hpet_timer __iomem *timer; - timer = &hpet->hpet_timers[devp - hpetp->hp_dev]; + for (i = 0; i < hdp->hd_nirqs; i++) + hpetp->hp_dev[i].hd_hdwirq = hdp->hd_irq[i]; - /* Check if there's already an IRQ assigned to the timer */ - if (hdp->hd_irq[i]) { - hpetp->hp_dev[i].hd_hdwirq = hdp->hd_irq[i]; - continue; - } - - hpet_config = readq(&timer->hpet_config); - irq_bitmap = (hpet_config & Tn_INT_ROUTE_CAP_MASK) - >> Tn_INT_ROUTE_CAP_SHIFT; - if (!irq_bitmap) - irq = 0; /* No valid IRQ Assignable */ - else { - irq = find_first_bit(&irq_bitmap, 32); - do { - hpet_config |= irq << Tn_INT_ROUTE_CNF_SHIFT; - writeq(hpet_config, &timer->hpet_config); - - /* - * Verify whether we have written a valid - * IRQ number by reading it back again - */ - hpet_config = readq(&timer->hpet_config); - if (irq == (hpet_config & Tn_INT_ROUTE_CNF_MASK) - >> Tn_INT_ROUTE_CNF_SHIFT) - break; /* Success */ - } while ((irq = (find_next_bit(&irq_bitmap, 32, irq)))); - } - hpetp->hp_dev[i].hd_hdwirq = irq; - } + hpet = hpetp->hp_hpet; cap = readq(&hpet->hpet_cap); @@ -836,8 +800,7 @@ int hpet_alloc(struct hpet_data *hdp) hpetp->hp_which, hdp->hd_phys_address, hpetp->hp_ntimer > 1 ? "s" : ""); for (i = 0; i < hpetp->hp_ntimer; i++) - printk("%s %d", i > 0 ? "," : "", - hpetp->hp_dev[i].hd_hdwirq); + printk("%s %d", i > 0 ? "," : "", hdp->hd_irq[i]); printk("\n"); printk(KERN_INFO "hpet%u: %u %d-bit timers, %Lu Hz\n", -- cgit v1.2.3