linux-stable.git/drivers/lguest, branch linux-2.6.26.y

x86: fix NULL pointer deref in __switch_to

2008-06-20T11:26:18+00:00

I am able to reproduce the oops reported by Simon in __switch_to() with
lguest.

My debug showed that there is at least one lguest specific
issue (which should be present in 2.6.25 and before aswell) and it got
exposed with a kernel oops with the recent fpu dynamic allocation patches.

In addition to the previous possible scenario (with fpu_counter), in the
presence of lguest, it is possible that the cpu's TS bit it still set and the
lguest launcher task's thread_info has TS_USEDFPU still set.

This is because of the way the lguest launcher handling the guest's TS bit.
(look at lguest_set_ts() in lguest_arch_run_guest()). This can result
in a DNA fault while doing unlazy_fpu() in __switch_to(). This will
end up causing a DNA fault in the context of new process thats
getting context switched in (as opossed to handling DNA fault in the context
of lguest launcher/helper process).

This is wrong in both pre and post 2.6.25 kernels. In the recent
2.6.26-rc series, this is showing up as NULL pointer dereferences or
sleeping function called from atomic context(__switch_to()), as
we free and dynamically allocate the FPU context for the newly
created threads. Older kernels might show some FPU corruption for processes
running inside of lguest.

With the appended patch, my test system is running for more than 50 mins
now. So atleast some of your oops (hopefully all!) should get fixed.
Please give it a try. I will spend more time with this fix tomorrow.

Reported-by: Simon Holm Thøgersen 
Reported-by: Patrick McHardy 
Signed-off-by: Suresh Siddha 
Signed-off-by: Ingo Molnar

virtio: set device index in common code.

2008-05-30T05:09:42+00:00

Anthony Liguori points out that three different transports use the virtio code,
but each one keeps its own counter to set the virtio_device's index field.  In
theory (though not in current practice) this means that names could be
duplicated, and that risk grows as more transports are created.

So we move the selection of the unique virtio_device.index into the common code
in virtio.c, which has the side-benefit of removing duplicate code.

The only complexity is that lguest and S/390 use the index to uniquely identify
the device in case of catastrophic failure before register_virtio_device() is
called: now we use the offset within the descriptor page as a unique identifier
for the printks.

Signed-off-by: Rusty Russell 
Cc: Christian Borntraeger 
Cc: Martin Schwidefsky 
Cc: Carsten Otte 
Cc: Heiko Carstens 
Cc: Chris Lalancette 
Cc: Anthony Liguori

lguest: use ioremap_cache, not ioremap

2008-05-30T05:09:41+00:00

Thanks to Jon Corbet & LWN.  Only took me a day to join the dots.

Host->Guest netcat before (with unnecessily large receive buffers):
1073741824 bytes (1.1 GB) copied, 24.7528 seconds, 43.4 MB/s

After:
1073741824 bytes (1.1 GB) copied, 17.6369 seconds, 60.9 MB/s

Signed-off-by: Rusty Russell

lguest: make Launcher see device status updates

2008-05-02T11:50:54+00:00

This brings us closer to Real Life, where we'd examine the device
features once it's set the DRIVER_OK status bit.

Signed-off-by: Rusty Russell

lguest: remove bogus NULL cpu check

2008-05-02T11:50:52+00:00

If lg isn't NULL, and cpu_id is sane, &lg->cpus[cpu_id] can't be NULL.

Signed-off-by: Rusty Russell

lguest: avoid using NR_CPUS as a bounds check.

2008-05-02T11:50:51+00:00

NR_CPUS (being a host number) is an arbitrary limit for the Guest.
Using the array size directly (which currently happes to be NR_CPUS)
is more futureproof.

Signed-off-by: Rusty Russell

virtio: explicit advertisement of driver features

2008-05-02T11:50:50+00:00

A recent proposed feature addition to the virtio block driver revealed
some flaws in the API: in particular, we assume that feature
negotiation is complete once a driver's probe function returns.

There is nothing in the API to require this, however, and even I
didn't notice when it was violated.

So instead, we require the driver to specify what features it supports
in a table, we can then move the feature negotiation into the virtio
core.  The intersection of device and driver features are presented in
a new 'features' bitmap in the struct virtio_device.

Note that this highlights the difference between Linux unsigned-long
bitmaps where each unsigned long is in native endian, and a
straight-forward little-endian array of bytes.

Drivers can still remove feature bits in their probe routine if they
really have to.

API changes:
- dev->config->feature() no longer gets and acks a feature.
- drivers should advertise their features in the 'feature_table' field
- use virtio_has_feature() for extra sanity when checking feature bits

Signed-off-by: Rusty Russell

drivers: Remove unnecessary inclusions of asm/semaphore.h

2008-04-19T02:16:32+00:00

None of these files use any of the functionality promised by
asm/semaphore.h.  It's possible that they rely on it dragging in some
unrelated header file, but I can't build all these files, so we'll have
fix any build failures as they come up.

Signed-off-by: Matthew Wilcox

misc __user misannotations (pointless casts to long)

2008-03-30T21:20:23+00:00

Signed-off-by: Al Viro 
Signed-off-by: Linus Torvalds

lguest: comment documentation update.

2008-03-28T00:05:54+00:00

Took some cycles to re-read the Lguest Journey end-to-end, fix some
rot and tighten some phrases.

Only comments change.  No new jokes, but a couple of recycled old jokes.

Signed-off-by: Rusty Russell