Commit 82fd5ee9 authored by Linus Torvalds's avatar Linus Torvalds
Browse files

Merge tag 'for-linus-6.8-rc1-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/xen/tip 

Pull xen updates from Juergen Gross:

 - update some Xen PV interface related headers

 - fix some kernel-doc comments in the xenbus driver

 - fix the Xen gntdev driver to not access the struct page of pages
   imported from a DMA-buf

* tag 'for-linus-6.8-rc1-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/xen/tip:
  xen/gntdev: Fix the abuse of underlying struct page in DMA-buf import
  xen/xenbus: client: fix kernel-doc comments
  xen: update PV-device interface headers
parents 09d1c6a8 2d2db7d4

drivers/xen/gntdev-dmabuf.c

+25 −25
Original line number Diff line number Diff line
@@ -11,6 +11,7 @@ 
#include <linux/kernel.h>

#include <linux/errno.h>

#include <linux/dma-buf.h>

#include <linux/dma-direct.h>

#include <linux/slab.h>

#include <linux/types.h>

#include <linux/uaccess.h>
@@ -50,7 +51,7 @@ struct gntdev_dmabuf { 


	/* Number of pages this buffer has. */

	int nr_pages;

	/* Pages of this buffer. */

	/* Pages of this buffer (only for dma-buf export). */

	struct page **pages;

};
@@ -484,7 +485,7 @@ static int dmabuf_exp_from_refs(struct gntdev_priv *priv, int flags, 
/* DMA buffer import support. */



static int

dmabuf_imp_grant_foreign_access(struct page **pages, u32 *refs,

dmabuf_imp_grant_foreign_access(unsigned long *gfns, u32 *refs,

				int count, int domid)

{

	grant_ref_t priv_gref_head;
@@ -507,7 +508,7 @@ dmabuf_imp_grant_foreign_access(struct page **pages, u32 *refs, 
		}



		gnttab_grant_foreign_access_ref(cur_ref, domid,

						xen_page_to_gfn(pages[i]), 0);

						gfns[i], 0);

		refs[i] = cur_ref;

	}
@@ -529,7 +530,6 @@ static void dmabuf_imp_end_foreign_access(u32 *refs, int count) 


static void dmabuf_imp_free_storage(struct gntdev_dmabuf *gntdev_dmabuf)

{

	kfree(gntdev_dmabuf->pages);

	kfree(gntdev_dmabuf->u.imp.refs);

	kfree(gntdev_dmabuf);

}
@@ -549,12 +549,6 @@ static struct gntdev_dmabuf *dmabuf_imp_alloc_storage(int count) 
	if (!gntdev_dmabuf->u.imp.refs)

		goto fail;



	gntdev_dmabuf->pages = kcalloc(count,

				       sizeof(gntdev_dmabuf->pages[0]),

				       GFP_KERNEL);

	if (!gntdev_dmabuf->pages)

		goto fail;



	gntdev_dmabuf->nr_pages = count;



	for (i = 0; i < count; i++)
@@ -576,7 +570,8 @@ dmabuf_imp_to_refs(struct gntdev_dmabuf_priv *priv, struct device *dev, 
	struct dma_buf *dma_buf;

	struct dma_buf_attachment *attach;

	struct sg_table *sgt;

	struct sg_page_iter sg_iter;

	struct sg_dma_page_iter sg_iter;

	unsigned long *gfns;

	int i;



	dma_buf = dma_buf_get(fd);
@@ -624,26 +619,31 @@ dmabuf_imp_to_refs(struct gntdev_dmabuf_priv *priv, struct device *dev, 


	gntdev_dmabuf->u.imp.sgt = sgt;



	/* Now convert sgt to array of pages and check for page validity. */

	i = 0;

	for_each_sgtable_page(sgt, &sg_iter, 0) {

		struct page *page = sg_page_iter_page(&sg_iter);

		/*

		 * Check if page is valid: this can happen if we are given

		 * a page from VRAM or other resources which are not backed

		 * by a struct page.

		 */

		if (!pfn_valid(page_to_pfn(page))) {

			ret = ERR_PTR(-EINVAL);

	gfns = kcalloc(count, sizeof(*gfns), GFP_KERNEL);

	if (!gfns) {

		ret = ERR_PTR(-ENOMEM);

		goto fail_unmap;

	}



		gntdev_dmabuf->pages[i++] = page;

	/*

	 * Now convert sgt to array of gfns without accessing underlying pages.

	 * It is not allowed to access the underlying struct page of an sg table

	 * exported by DMA-buf, but since we deal with special Xen dma device here

	 * (not a normal physical one) look at the dma addresses in the sg table

	 * and then calculate gfns directly from them.

	 */

	i = 0;

	for_each_sgtable_dma_page(sgt, &sg_iter, 0) {

		dma_addr_t addr = sg_page_iter_dma_address(&sg_iter);

		unsigned long pfn = bfn_to_pfn(XEN_PFN_DOWN(dma_to_phys(dev, addr)));



		gfns[i++] = pfn_to_gfn(pfn);

	}



	ret = ERR_PTR(dmabuf_imp_grant_foreign_access(gntdev_dmabuf->pages,

	ret = ERR_PTR(dmabuf_imp_grant_foreign_access(gfns,

						      gntdev_dmabuf->u.imp.refs,

						      count, domid));

	kfree(gfns);

	if (IS_ERR(ret))

		goto fail_end_access;

drivers/xen/xenbus/xenbus_client.c

+34 −25
Original line number Diff line number Diff line
@@ -119,11 +119,13 @@ EXPORT_SYMBOL_GPL(xenbus_strstate); 
 * @callback: callback to register

 *

 * Register a @watch on the given path, using the given xenbus_watch structure

 * for storage, and the given @callback function as the callback.  Return 0 on

 * success, or -errno on error.  On success, the given @path will be saved as

 * @watch->node, and remains the caller's to free.  On error, @watch->node will

 * for storage, and the given @callback function as the callback.  On success,

 * the given @path will be saved as @watch->node, and remains the

 * caller's to free.  On error, @watch->node will

 * be NULL, the device will switch to %XenbusStateClosing, and the error will

 * be saved in the store.

 *

 * Returns: %0 on success or -errno on error

 */

int xenbus_watch_path(struct xenbus_device *dev, const char *path,

		      struct xenbus_watch *watch,
@@ -160,12 +162,14 @@ EXPORT_SYMBOL_GPL(xenbus_watch_path); 
 * @pathfmt: format of path to watch

 *

 * Register a watch on the given @path, using the given xenbus_watch

 * structure for storage, and the given @callback function as the callback.

 * Return 0 on success, or -errno on error.  On success, the watched path

 * (@path/@path2) will be saved as @watch->node, and becomes the caller's to

 * kfree().  On error, watch->node will be NULL, so the caller has nothing to

 * structure for storage, and the given @callback function as the

 * callback.  On success, the watched path (@path/@path2) will be saved

 * as @watch->node, and becomes the caller's to kfree().

 * On error, watch->node will be NULL, so the caller has nothing to

 * free, the device will switch to %XenbusStateClosing, and the error will be

 * saved in the store.

 *

 * Returns: %0 on success or -errno on error

 */

int xenbus_watch_pathfmt(struct xenbus_device *dev,

			 struct xenbus_watch *watch,
@@ -255,13 +259,15 @@ __xenbus_switch_state(struct xenbus_device *dev, 
}



/**

 * xenbus_switch_state

 * xenbus_switch_state - save the new state of a driver

 * @dev: xenbus device

 * @state: new state

 *

 * Advertise in the store a change of the given driver to the given new_state.

 * Return 0 on success, or -errno on error.  On error, the device will switch

 * to XenbusStateClosing, and the error will be saved in the store.

 * On error, the device will switch to XenbusStateClosing, and the error

 * will be saved in the store.

 *

 * Returns: %0 on success or -errno on error

 */

int xenbus_switch_state(struct xenbus_device *dev, enum xenbus_state state)

{
@@ -305,7 +311,7 @@ static void xenbus_va_dev_error(struct xenbus_device *dev, int err, 
}



/**

 * xenbus_dev_error

 * xenbus_dev_error - place an error message into the store

 * @dev: xenbus device

 * @err: error to report

 * @fmt: error message format
@@ -324,7 +330,7 @@ void xenbus_dev_error(struct xenbus_device *dev, int err, const char *fmt, ...) 
EXPORT_SYMBOL_GPL(xenbus_dev_error);



/**

 * xenbus_dev_fatal

 * xenbus_dev_fatal - put an error messages into the store and then shutdown

 * @dev: xenbus device

 * @err: error to report

 * @fmt: error message format
@@ -346,7 +352,7 @@ void xenbus_dev_fatal(struct xenbus_device *dev, int err, const char *fmt, ...) 
}

EXPORT_SYMBOL_GPL(xenbus_dev_fatal);



/**

/*

 * Equivalent to xenbus_dev_fatal(dev, err, fmt, args), but helps

 * avoiding recursion within xenbus_switch_state.

 */
@@ -453,7 +459,7 @@ void xenbus_teardown_ring(void **vaddr, unsigned int nr_pages, 
}

EXPORT_SYMBOL_GPL(xenbus_teardown_ring);



/**

/*

 * Allocate an event channel for the given xenbus_device, assigning the newly

 * created local port to *port.  Return 0 on success, or -errno on error.  On

 * error, the device will switch to XenbusStateClosing, and the error will be
@@ -479,7 +485,7 @@ int xenbus_alloc_evtchn(struct xenbus_device *dev, evtchn_port_t *port) 
EXPORT_SYMBOL_GPL(xenbus_alloc_evtchn);





/**

/*

 * Free an existing event channel. Returns 0 on success or -errno on error.

 */

int xenbus_free_evtchn(struct xenbus_device *dev, evtchn_port_t port)
@@ -499,7 +505,7 @@ EXPORT_SYMBOL_GPL(xenbus_free_evtchn); 




/**

 * xenbus_map_ring_valloc

 * xenbus_map_ring_valloc - allocate & map pages of VA space

 * @dev: xenbus device

 * @gnt_refs: grant reference array

 * @nr_grefs: number of grant references
@@ -507,10 +513,11 @@ EXPORT_SYMBOL_GPL(xenbus_free_evtchn); 
 *

 * Map @nr_grefs pages of memory into this domain from another

 * domain's grant table.  xenbus_map_ring_valloc allocates @nr_grefs

 * pages of virtual address space, maps the pages to that address, and

 * sets *vaddr to that address.  Returns 0 on success, and -errno on

 * error. If an error is returned, device will switch to

 * pages of virtual address space, maps the pages to that address, and sets

 * *vaddr to that address.  If an error is returned, device will switch to

 * XenbusStateClosing and the error message will be saved in XenStore.

 *

 * Returns: %0 on success or -errno on error

 */

int xenbus_map_ring_valloc(struct xenbus_device *dev, grant_ref_t *gnt_refs,

			   unsigned int nr_grefs, void **vaddr)
@@ -599,14 +606,15 @@ static int __xenbus_map_ring(struct xenbus_device *dev, 
}



/**

 * xenbus_unmap_ring

 * xenbus_unmap_ring - unmap memory from another domain

 * @dev: xenbus device

 * @handles: grant handle array

 * @nr_handles: number of handles in the array

 * @vaddrs: addresses to unmap

 *

 * Unmap memory in this domain that was imported from another domain.

 * Returns 0 on success and returns GNTST_* on error

 *

 * Returns: %0 on success or GNTST_* on error

 * (see xen/include/interface/grant_table.h).

 */

static int xenbus_unmap_ring(struct xenbus_device *dev, grant_handle_t *handles,
@@ -712,7 +720,7 @@ static int xenbus_map_ring_hvm(struct xenbus_device *dev, 
}



/**

 * xenbus_unmap_ring_vfree

 * xenbus_unmap_ring_vfree - unmap a page of memory from another domain

 * @dev: xenbus device

 * @vaddr: addr to unmap

 *
@@ -720,7 +728,8 @@ static int xenbus_map_ring_hvm(struct xenbus_device *dev, 
 * Unmap a page of memory in this domain that was imported from another domain.

 * Use xenbus_unmap_ring_vfree if you mapped in your memory with

 * xenbus_map_ring_valloc (it will free the virtual address space).

 * Returns 0 on success and returns GNTST_* on error

 *

 * Returns: %0 on success or GNTST_* on error

 * (see xen/include/interface/grant_table.h).

 */

int xenbus_unmap_ring_vfree(struct xenbus_device *dev, void *vaddr)
@@ -916,10 +925,10 @@ static int xenbus_unmap_ring_hvm(struct xenbus_device *dev, void *vaddr) 
}



/**

 * xenbus_read_driver_state

 * xenbus_read_driver_state - read state from a store path

 * @path: path for driver

 *

 * Return the state of the driver rooted at the given store path, or

 * Returns: the state of the driver rooted at the given store path, or

 * XenbusStateUnknown if no state can be read.

 */

enum xenbus_state xenbus_read_driver_state(const char *path)

include/xen/interface/io/displif.h

+1 −1
Original line number Diff line number Diff line
@@ -537,7 +537,7 @@ struct xendispl_dbuf_create_req { 


struct xendispl_page_directory {

	grant_ref_t gref_dir_next_page;

	grant_ref_t gref[1]; /* Variable length */

	grant_ref_t gref[];

};



/*

include/xen/interface/io/ring.h

+1 −1
Original line number Diff line number Diff line
@@ -95,7 +95,7 @@ struct __name##_sring { \ 
    RING_IDX req_prod, req_event;                                       \

    RING_IDX rsp_prod, rsp_event;                                       \

    uint8_t __pad[48];                                                  \

    union __name##_sring_entry ring[1]; /* variable-length */           \

    union __name##_sring_entry ring[];                                  \

};                                                                      \

                                                                        \

/* "Front" end's private variables */                                   \

include/xen/interface/io/sndif.h

+1 −1
Original line number Diff line number Diff line
@@ -659,7 +659,7 @@ struct xensnd_open_req { 


struct xensnd_page_directory {

	grant_ref_t gref_dir_next_page;

	grant_ref_t gref[1]; /* Variable length */

	grant_ref_t gref[];

};



/*