7 files changed, 53 insertions, 36 deletions

diff --git a/arch/x86/include/asm/xen/page.h b/arch/x86/include/asm/xen/page.h
index 123e669bf363..790ce08e41f2 100644
--- a/arch/x86/include/asm/xen/page.h
+++ b/arch/x86/include/asm/xen/page.h
@@ -9,7 +9,7 @@
 #include <linux/mm.h>
 #include <linux/device.h>
 
-#include <linux/uaccess.h>
+#include <asm/extable.h>
 #include <asm/page.h>
 #include <asm/pgtable.h>
 
@@ -93,12 +93,39 @@ clear_foreign_p2m_mapping(struct gnttab_unmap_grant_ref *unmap_ops,
  */
 static inline int xen_safe_write_ulong(unsigned long *addr, unsigned long val)
 {
-        return __put_user(val, (unsigned long __user *)addr);
+        int ret = 0;
+
+        asm volatile("1: mov %[val], %[ptr]\n"
+                     "2:\n"
+                     ".section .fixup, \"ax\"\n"
+                     "3: sub $1, %[ret]\n"
+                     "   jmp 2b\n"
+                     ".previous\n"
+                     _ASM_EXTABLE(1b, 3b)
+                     : [ret] "+r" (ret), [ptr] "=m" (*addr)
+                     : [val] "r" (val));
+
+        return ret;
 }
 
-static inline int xen_safe_read_ulong(unsigned long *addr, unsigned long *val)
+static inline int xen_safe_read_ulong(const unsigned long *addr,
+                                      unsigned long *val)
 {
-        return __get_user(*val, (unsigned long __user *)addr);
+        int ret = 0;
+        unsigned long rval = ~0ul;
+
+        asm volatile("1: mov %[ptr], %[rval]\n"
+                     "2:\n"
+                     ".section .fixup, \"ax\"\n"
+                     "3: sub $1, %[ret]\n"
+                     "   jmp 2b\n"
+                     ".previous\n"
+                     _ASM_EXTABLE(1b, 3b)
+                     : [ret] "+r" (ret), [rval] "+r" (rval)
+                     : [ptr] "m" (*addr));
+        *val = rval;
+
+        return ret;
 }
 
 #ifdef CONFIG_XEN_PV
diff --git a/arch/x86/xen/p2m.c b/arch/x86/xen/p2m.c
index b06731705529..055e37e43541 100644
--- a/arch/x86/xen/p2m.c
+++ b/arch/x86/xen/p2m.c
@@ -656,8 +656,7 @@ bool __set_phys_to_machine(unsigned long pfn, unsigned long mfn)
 
         /*
          * The interface requires atomic updates on p2m elements.
-         * xen_safe_write_ulong() is using __put_user which does an atomic
-         * store via asm().
+         * xen_safe_write_ulong() is using an atomic store via asm().
          */
         if (likely(!xen_safe_write_ulong(xen_p2m_addr + pfn, mfn)))
                 return true;
diff --git a/arch/x86/xen/spinlock.c b/arch/x86/xen/spinlock.c
index 441c88262169..1c8a8816a402 100644
--- a/arch/x86/xen/spinlock.c
+++ b/arch/x86/xen/spinlock.c
@@ -9,6 +9,7 @@
 #include <linux/log2.h>
 #include <linux/gfp.h>
 #include <linux/slab.h>
+#include <linux/atomic.h>
 
 #include <asm/paravirt.h>
 #include <asm/qspinlock.h>
@@ -21,6 +22,7 @@
 
 static DEFINE_PER_CPU(int, lock_kicker_irq) = -1;
 static DEFINE_PER_CPU(char *, irq_name);
+static DEFINE_PER_CPU(atomic_t, xen_qlock_wait_nest);
 static bool xen_pvspin = true;
 
 static void xen_qlock_kick(int cpu)
@@ -39,25 +41,25 @@ static void xen_qlock_kick(int cpu)
  */
 static void xen_qlock_wait(u8 *byte, u8 val)
 {
-        unsigned long flags;
         int irq = __this_cpu_read(lock_kicker_irq);
+        atomic_t *nest_cnt = this_cpu_ptr(&xen_qlock_wait_nest);
 
         /* If kicker interrupts not initialized yet, just spin */
         if (irq == -1 || in_nmi())
                 return;
 
-        /* Guard against reentry. */
-        local_irq_save(flags);
+        /* Detect reentry. */
+        atomic_inc(nest_cnt);
 
-        /* If irq pending already clear it. */
-        if (xen_test_irq_pending(irq)) {
+        /* If irq pending already and no nested call clear it. */
+        if (atomic_read(nest_cnt) == 1 && xen_test_irq_pending(irq)) {
                 xen_clear_irq_pending(irq);
         } else if (READ_ONCE(*byte) == val) {
                 /* Block until irq becomes pending (or a spurious wakeup) */
                 xen_poll_irq(irq);
         }
 
-        local_irq_restore(flags);
+        atomic_dec(nest_cnt);
 }
 
 static irqreturn_t dummy_handler(int irq, void *dev_id)
diff --git a/drivers/block/xen-blkfront.c b/drivers/block/xen-blkfront.c
index 56452cabce5b..0ed4b200fa58 100644
--- a/drivers/block/xen-blkfront.c
+++ b/drivers/block/xen-blkfront.c
@@ -1919,6 +1919,7 @@ static int negotiate_mq(struct blkfront_info *info)
                               GFP_KERNEL);
         if (!info->rinfo) {
                 xenbus_dev_fatal(info->xbdev, -ENOMEM, "allocating ring_info structure");
+                info->nr_rings = 0;
                 return -ENOMEM;
         }
 
diff --git a/drivers/xen/grant-table.c b/drivers/xen/grant-table.c
index f15f89df1f36..7ea6fb6a2e5d 100644
--- a/drivers/xen/grant-table.c
+++ b/drivers/xen/grant-table.c
@@ -914,7 +914,7 @@ int gnttab_dma_free_pages(struct gnttab_dma_alloc_args *args)
 
         ret = xenmem_reservation_increase(args->nr_pages, args->frames);
         if (ret != args->nr_pages) {
-                pr_debug("Failed to decrease reservation for DMA buffer\n");
+                pr_debug("Failed to increase reservation for DMA buffer\n");
                 ret = -EFAULT;
         } else {
                 ret = 0;
diff --git a/drivers/xen/privcmd-buf.c b/drivers/xen/privcmd-buf.c
index df1ed37c3269..de01a6d0059d 100644
--- a/drivers/xen/privcmd-buf.c
+++ b/drivers/xen/privcmd-buf.c
@@ -21,15 +21,9 @@
 
 MODULE_LICENSE("GPL");
 
-static unsigned int limit = 64;
-module_param(limit, uint, 0644);
-MODULE_PARM_DESC(limit, "Maximum number of pages that may be allocated by "
-                        "the privcmd-buf device per open file");
-
 struct privcmd_buf_private {
         struct mutex lock;
         struct list_head list;
-        unsigned int allocated;
 };
 
 struct privcmd_buf_vma_private {
@@ -60,13 +54,10 @@ static void privcmd_buf_vmapriv_free(struct privcmd_buf_vma_private *vma_priv)
 {
         unsigned int i;
 
-        vma_priv->file_priv->allocated -= vma_priv->n_pages;
-
         list_del(&vma_priv->list);
 
         for (i = 0; i < vma_priv->n_pages; i++)
-                if (vma_priv->pages[i])
-                        __free_page(vma_priv->pages[i]);
+                __free_page(vma_priv->pages[i]);
 
         kfree(vma_priv);
 }
@@ -146,8 +137,7 @@ static int privcmd_buf_mmap(struct file *file, struct vm_area_struct *vma)
         unsigned int i;
         int ret = 0;
 
-        if (!(vma->vm_flags & VM_SHARED) || count > limit ||
-            file_priv->allocated + count > limit)
+        if (!(vma->vm_flags & VM_SHARED))
                 return -EINVAL;
 
         vma_priv = kzalloc(sizeof(*vma_priv) + count * sizeof(void *),
@@ -155,19 +145,15 @@ static int privcmd_buf_mmap(struct file *file, struct vm_area_struct *vma)
         if (!vma_priv)
                 return -ENOMEM;
 
-        vma_priv->n_pages = count;
-        count = 0;
-        for (i = 0; i < vma_priv->n_pages; i++) {
+        for (i = 0; i < count; i++) {
                 vma_priv->pages[i] = alloc_page(GFP_KERNEL | __GFP_ZERO);
                 if (!vma_priv->pages[i])
                         break;
-                count++;
+                vma_priv->n_pages++;
         }
 
         mutex_lock(&file_priv->lock);
 
-        file_priv->allocated += count;
-
         vma_priv->file_priv = file_priv;
         vma_priv->users = 1;
 
diff --git a/include/xen/xen-ops.h b/include/xen/xen-ops.h
index 18803ff76e27..4969817124a8 100644
--- a/include/xen/xen-ops.h
+++ b/include/xen/xen-ops.h
@@ -42,16 +42,12 @@ int xen_setup_shutdown_event(void);
 
 extern unsigned long *xen_contiguous_bitmap;
 
-#ifdef CONFIG_XEN_PV
+#if defined(CONFIG_XEN_PV) || defined(CONFIG_ARM) || defined(CONFIG_ARM64)
 int xen_create_contiguous_region(phys_addr_t pstart, unsigned int order,
                                 unsigned int address_bits,
                                 dma_addr_t *dma_handle);
 
 void xen_destroy_contiguous_region(phys_addr_t pstart, unsigned int order);
-
-int xen_remap_pfn(struct vm_area_struct *vma, unsigned long addr,
-                  xen_pfn_t *pfn, int nr, int *err_ptr, pgprot_t prot,
-                  unsigned int domid, bool no_translate, struct page **pages);
 #else
 static inline int xen_create_contiguous_region(phys_addr_t pstart,
                                                unsigned int order,
@@ -63,7 +59,13 @@ static inline int xen_create_contiguous_region(phys_addr_t pstart,
 
 static inline void xen_destroy_contiguous_region(phys_addr_t pstart,
                                                  unsigned int order) { }
+#endif
 
+#if defined(CONFIG_XEN_PV)
+int xen_remap_pfn(struct vm_area_struct *vma, unsigned long addr,
+                  xen_pfn_t *pfn, int nr, int *err_ptr, pgprot_t prot,
+                  unsigned int domid, bool no_translate, struct page **pages);
+#else
 static inline int xen_remap_pfn(struct vm_area_struct *vma, unsigned long addr,
                                 xen_pfn_t *pfn, int nr, int *err_ptr,
                                 pgprot_t prot,  unsigned int domid,