Commit 9f99a2f0 authored by Linus Torvalds's avatar Linus Torvalds
Browse files

Merge branch 'stable/bug-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/konrad/xen

* 'stable/bug-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/konrad/xen:
  xen/event: validate irq before get evtchn by irq
  xen/fb: fix potential memory leak
  xen/fb: fix xenfb suspend/resume race.
  xen: disable ACPI NUMA for PV guests
  xen/irq: Cleanup the find_unbound_irq
parents 8c8ae4e8 110e7c7e
......@@ -1174,6 +1174,15 @@ asmlinkage void __init xen_start_kernel(void)
xen_smp_init();
#ifdef CONFIG_ACPI_NUMA
/*
* The pages we from Xen are not related to machine pages, so
* any NUMA information the kernel tries to get from ACPI will
* be meaningless. Prevent it from trying.
*/
acpi_numa = -1;
#endif
pgd = (pgd_t *)xen_start_info->pt_base;
if (!xen_initial_domain())
......
......@@ -562,26 +562,24 @@ static void xenfb_init_shared_page(struct xenfb_info *info,
static int xenfb_connect_backend(struct xenbus_device *dev,
struct xenfb_info *info)
{
int ret, evtchn;
int ret, evtchn, irq;
struct xenbus_transaction xbt;
ret = xenbus_alloc_evtchn(dev, &evtchn);
if (ret)
return ret;
ret = bind_evtchn_to_irqhandler(evtchn, xenfb_event_handler,
irq = bind_evtchn_to_irqhandler(evtchn, xenfb_event_handler,
0, dev->devicetype, info);
if (ret < 0) {
if (irq < 0) {
xenbus_free_evtchn(dev, evtchn);
xenbus_dev_fatal(dev, ret, "bind_evtchn_to_irqhandler");
return ret;
return irq;
}
info->irq = ret;
again:
ret = xenbus_transaction_start(&xbt);
if (ret) {
xenbus_dev_fatal(dev, ret, "starting transaction");
return ret;
goto unbind_irq;
}
ret = xenbus_printf(xbt, dev->nodename, "page-ref", "%lu",
virt_to_mfn(info->page));
......@@ -603,20 +601,25 @@ static int xenfb_connect_backend(struct xenbus_device *dev,
if (ret == -EAGAIN)
goto again;
xenbus_dev_fatal(dev, ret, "completing transaction");
return ret;
goto unbind_irq;
}
xenbus_switch_state(dev, XenbusStateInitialised);
info->irq = irq;
return 0;
error_xenbus:
xenbus_transaction_end(xbt, 1);
xenbus_dev_fatal(dev, ret, "writing xenstore");
unbind_irq:
unbind_from_irqhandler(irq, info);
return ret;
}
static void xenfb_disconnect_backend(struct xenfb_info *info)
{
/* Prevent xenfb refresh */
info->update_wanted = 0;
if (info->irq >= 0)
unbind_from_irqhandler(info->irq, info);
info->irq = -1;
......
......@@ -170,6 +170,9 @@ static struct irq_info *info_for_irq(unsigned irq)
static unsigned int evtchn_from_irq(unsigned irq)
{
if (unlikely(WARN(irq < 0 || irq >= nr_irqs, "Invalid irq %d!\n", irq)))
return 0;
return info_for_irq(irq)->evtchn;
}
......@@ -405,15 +408,21 @@ static int find_unbound_irq(void)
{
struct irq_data *data;
int irq, res;
int start = get_nr_hw_irqs();
int bottom = get_nr_hw_irqs();
int top = nr_irqs-1;
if (start == nr_irqs)
if (bottom == nr_irqs)
goto no_irqs;
/* nr_irqs is a magic value. Must not use it.*/
for (irq = nr_irqs-1; irq > start; irq--) {
/* This loop starts from the top of IRQ space and goes down.
* We need this b/c if we have a PCI device in a Xen PV guest
* we do not have an IO-APIC (though the backend might have them)
* mapped in. To not have a collision of physical IRQs with the Xen
* event channels start at the top of the IRQ space for virtual IRQs.
*/
for (irq = top; irq > bottom; irq--) {
data = irq_get_irq_data(irq);
/* only 0->15 have init'd desc; handle irq > 16 */
/* only 15->0 have init'd desc; handle irq > 16 */
if (!data)
break;
if (data->chip == &no_irq_chip)
......@@ -424,7 +433,7 @@ static int find_unbound_irq(void)
return irq;
}
if (irq == start)
if (irq == bottom)
goto no_irqs;
res = irq_alloc_desc_at(irq, -1);
......
Markdown is supported
0% or .
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment