Backend drivers shouldn't transistion to CLOSED unless the frontend is
CLOSED. If a backend does transition to CLOSED too soon then the
frontend may not see the CLOSING state and will not properly shutdown.
So, treat an unexpected backend CLOSED state the same as CLOSING.
Signed-off-by: David Vrabel <david.vrabel@citrix.com>
Signed-off-by: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>
* 'x86/platform' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: (9690 commits)
x86: Document x86_init.paging.pagetable_init()
x86: xen: Cleanup and remove x86_init.paging.pagetable_setup_done()
x86: Move paging_init() call to x86_init.paging.pagetable_init()
x86: Rename pagetable_setup_start() to pagetable_init()
x86: Remove base argument from x86_init.paging.pagetable_setup_start
Linux 3.6-rc5
HID: tpkbd: work even if the new Lenovo Keyboard driver is not configured
Remove user-triggerable BUG from mpol_to_str
xen/pciback: Fix proper FLR steps.
uml: fix compile error in deliver_alarm()
dj: memory scribble in logi_dj
Fix order of arguments to compat_put_time[spec|val]
xen: Use correct masking in xen_swiotlb_alloc_coherent.
xen: fix logical error in tlb flushing
xen/p2m: Fix one-off error in checking the P2M tree directory.
powerpc: Don't use __put_user() in patch_instruction
powerpc: Make sure IPI handlers see data written by IPI senders
powerpc: Restore correct DSCR in context switch
powerpc: Fix DSCR inheritance in copy_thread()
powerpc: Keep thread.dscr and thread.dscr_inherit in sync
...
We need to make sure that those parameters are setup to be correct.
As such the value of 0 is deemed invalid and we find that we
bail out. The hypervisor sets by default all of them to be zero
and when the hypercall is done does a simple:
a.value = d->arch.hvm_domain.params[a.index];
Which means that if the Xen toolstack forgot to setup the proper
HVM_PARAM_CONSOLE_EVTCHN (or the PFN one), we would get the
default value of 0 and use that.
CC: stable@kernel.org
Fixes-Oracle-Bug: 14091238
Signed-off-by: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>
We weren't resetting the parameter to be passed in to a
known default. Nor were we checking the return value of
hvm_get_parameter.
CC: stable@kernel.org
Signed-off-by: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>
All of the error paths are doing the same logic. In which
case we might as well collapse them in one path.
CC: stable@kernel.org
Acked-by: Stefano Stabellini <stefano.stabellini@eu.citrix.com>
Signed-off-by: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>
If kzalloc() returns a NULL here, we pass a NULL to
xencons_disconnect_backend() which will cause an Oops.
Also I removed the __GFP_ZERO while I was at it since kzalloc() implies
__GFP_ZERO.
CC: stable@kernel.org
Acked-by: Stefano Stabellini <stefano.stabellini@eu.citrix.com>
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>
Introduce a new config option HVC_XEN_FRONTEND to enable/disable the
xenbus based pv console frontend.
Signed-off-by: Stefano Stabellini <stefano.stabellini@eu.citrix.com>
Signed-off-by: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>
This patch implements support for multiple consoles:
consoles other than the first one are setup using the traditional xenbus
and grant-table based mechanism.
We use a list to keep track of the allocated consoles, we don't
expect too many of them anyway.
Changes in v3:
- call hvc_remove before removing the console from xenconsoles;
- do not lock xencons_lock twice in the destruction path;
- use the DEFINE_XENBUS_DRIVER macro.
Signed-off-by: Stefano Stabellini <stefano.stabellini@eu.citrix.com>
Signed-off-by: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>
This fixes a particular nasty racing problem found when using
Xen hypervisor with the console (hvc) output being routed to the
serial port and the serial port receiving data when
probe_irq_off(probe_irq_on) is running.
Specifically the bug manifests itself with:
[ 4.470693] BUG: unable to handle kernel NULL pointer dereference at 0000000000000008
[ 4.470693] IP: [<ffffffff810a8c65>] handle_IRQ_event+0xe/0xc9
..snip..
[ 4.470693] Call Trace:
[ 4.470693] <IRQ>
[ 4.470693] [<ffffffff810aa645>] handle_percpu_irq+0x3c/0x69
[ 4.470693] [<ffffffff8123cda7>] __xen_evtchn_do_upcall+0xfd/0x195
[ 4.470693] [<ffffffff810308cf>] ? xen_restore_fl_direct_end+0x0/0x1
[ 4.470693] [<ffffffff8123d873>] xen_evtchn_do_upcall+0x32/0x47
[ 4.470693] [<ffffffff81034dfe>] xen_do_hypervisor_callback+0x1e/0x30
[ 4.470693] <EOI>
[ 4.470693] [<ffffffff8100922a>] ? hypercall_page+0x22a/0x1000
[ 4.470693] [<ffffffff8100922a>] ? hypercall_page+0x22a/0x1000
[ 4.470693] [<ffffffff810301c5>] ? xen_force_evtchn_callback+0xd/0xf
[ 4.470693] [<ffffffff810308e2>] ? check_events+0x12/0x20
[ 4.470693] [<ffffffff81030889>] ? xen_irq_enable_direct_end+0x0/0x7
[ 4.470693] [<ffffffff810ab0a0>] ? probe_irq_on+0x8f/0x1d7
[ 4.470693] [<ffffffff812b105e>] ? serial8250_config_port+0x7b7/0x9e6
[ 4.470693] [<ffffffff812ad66c>] ? uart_add_one_port+0x11b/0x305
The bug is trigged by three actors working together:
A). serial_8250_config_port calling
probe_irq_off(probe_irq_on())
wherein all of the IRQ handlers are being started and shut off.
The functions utilize the sleep functions so the minimum time
they are run is 120 msec.
B). Xen hypervisor receiving on the serial line any character and
setting the bits in the event channel - during this 120 msec timeframe.
C). The hvc API makes a call to 'request_irq' (and hence setting desc->action
to a valid value), much much later - when user space opens
/dev/console (hvc_open). To make the console usable during bootup,
the Xen HVC implementation sets the IRQ chip (and correspondingly
the event channel) much earlier. The IRQ chip handler that is used
is the handle_percpu_irq (aaca49642b)
Back to the issue. When A) is being called it ends up calling the
xen_percpu_chip's chip->startup twice and chip->shutdown once. Those
are set to the default_startup and mask_irq (events.c) respectivly.
If (and this seems to depend on what serial concentrator you use), B)
gets data from the serial port it sets in the event channel a pending bit.
When A) calls chip->startup(), the masking of the pending bit, and
unmasking of the event channel mask, and also setting of the upcall_pending
flag is done (since there is data present on the event channel).
If before the 120 msec has elapsed, any IRQ handler (Xen IRQ has one
IRQ handler, which checks the event channels bitmap to figure which one
to call) is called we end up calling the handle_percpu_irq. The
handle_percpu_irq calls desc->action (which is NULL) and we blow up.
Caveats: I could only reproduce this on 2.6.32 pvops. I am not sure
why this is not showing up on 2.6.38 kernel.
The probe_irq_on/off has code to disable poking specific IRQ lines. This is
done by using the set_irq_noprobe() and then we do not have to
worry about the handle_percpu_irq being called before the IRQ action
handler has been installed.
Signed-off-by: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>
As requested by Arnd Bergmann, the hvc drivers are now
moved to the drivers/tty/hvc/ directory. The virtio_console.c driver
was also moved, as it required the hvc_console.h file to be able to be
built, and it really is a hvc driver.
Cc: Arnd Bergmann <arnd@arndb.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
David Vrabel