bitkeeper revision 1.825.3.17 (40693a952A4uQatvbQf9p4edlPR6ww)

irq.c, sched.h, event_channel.c, Rules.mk:
  Fix a memory bug in new PIRQ code in Xen.

diff --git a/xen/arch/i386/Rules.mk b/xen/arch/i386/Rules.mk
index 146901102908e0145968d74f258d0b5856ef6382..7a72c837892a75b5ef1faba9602fd07e7ee3898a 100644 (file)
--- a/xen/arch/i386/Rules.mk
+++ b/xen/arch/i386/Rules.mk
@@ -7,8 +7,8 @@ LD := ld
 MONITOR_BASE := 0xFC500000
 # Bootloader should load monitor to this real address
 LOAD_BASE    := 0x00100000
-CFLAGS  := -nostdinc -fno-builtin -fno-common -fno-strict-aliasing 
-CFLAGS  += -iwithprefix include -O3 -Wall -Werror -DMONITOR_BASE=$(MONITOR_BASE)
+CFLAGS  := -nostdinc -fno-builtin -fno-common -fno-strict-aliasing -O3
+CFLAGS  += -iwithprefix include -Wall -Werror -DMONITOR_BASE=$(MONITOR_BASE)
 CFLAGS  += -fomit-frame-pointer -I$(BASEDIR)/include -D__KERNEL__ -DNDEBUG
 #CFLAGS  += -fomit-frame-pointer -I$(BASEDIR)/include -D__KERNEL__
 CFLAGS  += -Wno-pointer-arith -Wredundant-decls -m32

diff --git a/xen/arch/i386/irq.c b/xen/arch/i386/irq.c
index b280daf63f240948c332b8d66ca071f050f4c2b6..30735e0324933200c7dd3eeaea15f98185f5b0d8 100644 (file)
--- a/xen/arch/i386/irq.c
+++ b/xen/arch/i386/irq.c
@@ -995,7 +995,7 @@ int pirq_guest_bind(struct task_struct *p, int irq, int will_share)
     unsigned long flags;
     irq_desc_t *desc = &irq_desc[irq];
     irq_guest_action_t *action;
-    int rc;
+    int rc = 0;
 
     if ( !IS_PRIV(p) )
         return -EPERM;
@@ -1006,19 +1006,19 @@ int pirq_guest_bind(struct task_struct *p, int irq, int will_share)
 
     if ( !(desc->status & IRQ_GUEST) )
     {
-        rc = -EBUSY;
         if ( desc->action != NULL )
         {
             DPRINTK("Cannot bind IRQ %d to guest. In use by '%s'.\n",
                     irq, desc->action->name);
+            rc = -EBUSY;
             goto out;
         }
 
-        rc = -ENOMEM;
         action = kmalloc(sizeof(irq_guest_action_t), GFP_KERNEL);
         if ( (desc->action = (struct irqaction *)action) == NULL )
         {
             DPRINTK("Cannot bind IRQ %d to guest. Out of memory.\n", irq);
+            rc = -ENOMEM;
             goto out;
         }
 
@@ -1038,17 +1038,15 @@ int pirq_guest_bind(struct task_struct *p, int irq, int will_share)
         goto out;
     }
 
-    rc = -EBUSY;
     if ( action->nr_guests == IRQ_MAX_GUESTS )
     {
         DPRINTK("Cannot bind IRQ %d to guest. Already at max share.\n", irq);
+        rc = -EBUSY;
         goto out;
     }
 
     action->guest[action->nr_guests++] = p;
 
-    rc = 0;
-
  out:
     spin_unlock_irqrestore(&desc->lock, flags);
     return rc;

diff --git a/xen/common/event_channel.c b/xen/common/event_channel.c
index 3db38b763eaad91f1c07d222d87977998b01dd0a..216a794f5bff2585c19d8a38d882c530e32efd80 100644 (file)
--- a/xen/common/event_channel.c
+++ b/xen/common/event_channel.c
@@ -46,7 +46,7 @@ static int get_free_port(struct task_struct *p)
         if ( max == MAX_EVENT_CHANNELS )
             return -ENOSPC;
         
-        max = (max == 0) ? 4 : (max * 2);
+        max *= 2;
         
         chn = kmalloc(max * sizeof(event_channel_t), GFP_KERNEL);
         if ( unlikely(chn == NULL) )
@@ -287,10 +287,7 @@ static long __evtchn_close(struct task_struct *p1, int port1)
         if ( chn2[port2].u.remote.dom != p1 )
             BUG();
 
-        chn2[port2].state         = ECS_UNBOUND;
-        chn2[port2].u.remote.dom  = NULL;
-        chn2[port2].u.remote.port = 0xFFFF;
-
+        chn2[port2].state = ECS_UNBOUND;
         evtchn_set_exception(p2, port2);
 
         break;
@@ -299,10 +296,7 @@ static long __evtchn_close(struct task_struct *p1, int port1)
         BUG();
     }
 
-    chn1[port1].state         = ECS_FREE;
-    chn1[port1].u.remote.dom  = NULL;
-    chn1[port1].u.remote.port = 0xFFFF;
-    
+    chn1[port1].state = ECS_FREE;
     evtchn_set_exception(p1, port1);
 
  out:

diff --git a/xen/include/xen/sched.h b/xen/include/xen/sched.h
index 123b17773f3694f506dfca29594f15a23d0f7cbb..58ffffa5e26875a0b0ec2131baa9f0c66640d15a 100644 (file)
--- a/xen/include/xen/sched.h
+++ b/xen/include/xen/sched.h
@@ -164,9 +164,10 @@ struct task_struct
      * domain's event-channel spinlock. Read accesses can also synchronise on 
      * the lock, but races don't usually matter.
      */
-    u16 pirq_to_evtchn[128];
+#define NR_PIRQS 128 /* Put this somewhere sane! */
+    u16 pirq_to_evtchn[NR_PIRQS];
     u16 virq_to_evtchn[NR_VIRQS];
-    u32 pirq_mask[2];
+    u32 pirq_mask[NR_PIRQS/32];
 
     /* Physical I/O */
     spinlock_t       pcidev_lock;

diff --git a/xenolinux-2.4.25-sparse/arch/xen/kernel/irq.c b/xenolinux-2.4.25-sparse/arch/xen/kernel/irq.c
index abb2b398be8be70d0141206726cf8fa94b43709f..07dad7e8ca5db2015f9e376d8232f724e787d024 100644 (file)
--- a/xenolinux-2.4.25-sparse/arch/xen/kernel/irq.c
+++ b/xenolinux-2.4.25-sparse/arch/xen/kernel/irq.c
@@ -824,7 +824,7 @@ unsigned long probe_irq_on(void)
         * something may have generated an irq long ago and we want to
         * flush such a longstanding irq before considering it as spurious. 
         */
-       for (i = NR_IRQS-1; i > 0; i--)  {
+       for (i = NR_PIRQS-1; i > 0; i--)  {
                desc = irq_desc + i;
 
                spin_lock_irq(&desc->lock);
@@ -842,7 +842,7 @@ unsigned long probe_irq_on(void)
         * (we must startup again here because if a longstanding irq
         * happened in the previous stage, it may have masked itself)
         */
-       for (i = NR_IRQS-1; i > 0; i--) {
+       for (i = NR_PIRQS-1; i > 0; i--) {
                desc = irq_desc + i;
 
                spin_lock_irq(&desc->lock);
@@ -864,7 +864,7 @@ unsigned long probe_irq_on(void)
         * Now filter out any obviously spurious interrupts
         */
        val = 0;
-       for (i = 0; i < NR_IRQS; i++) {
+       for (i = 0; i < NR_PIRQS; i++) {
                irq_desc_t *desc = irq_desc + i;
                unsigned int status;
 
@@ -909,7 +909,7 @@ unsigned int probe_irq_mask(unsigned long val)
        unsigned int mask;
 
        mask = 0;
-       for (i = 0; i < NR_IRQS; i++) {
+       for (i = 0; i < NR_PIRQS; i++) {
                irq_desc_t *desc = irq_desc + i;
                unsigned int status;
 
@@ -959,7 +959,7 @@ int probe_irq_off(unsigned long val)
 
        nr_irqs = 0;
        irq_found = 0;
-       for (i = 0; i < NR_IRQS; i++) {
+       for (i = 0; i < NR_PIRQS; i++) {
                irq_desc_t *desc = irq_desc + i;
                unsigned int status;