1 files changed, 31 insertions, 1 deletions

diff --git a/drivers/xen/gntdev.c b/drivers/xen/gntdev.c
index 7b9b1d1b75a..3e3603f3524 100644
--- a/drivers/xen/gntdev.c
+++ b/drivers/xen/gntdev.c
@@ -83,6 +83,7 @@ struct grant_map {
         struct ioctl_gntdev_grant_ref *grants;
         struct gnttab_map_grant_ref   *map_ops;
         struct gnttab_unmap_grant_ref *unmap_ops;
+        struct gnttab_map_grant_ref   *kmap_ops;
         struct page **pages;
 };
 
@@ -116,10 +117,12 @@ static struct grant_map *gntdev_alloc_map(struct gntdev_priv *priv, int count)
         add->grants    = kzalloc(sizeof(add->grants[0])    * count, GFP_KERNEL);
         add->map_ops   = kzalloc(sizeof(add->map_ops[0])   * count, GFP_KERNEL);
         add->unmap_ops = kzalloc(sizeof(add->unmap_ops[0]) * count, GFP_KERNEL);
+        add->kmap_ops  = kzalloc(sizeof(add->kmap_ops[0])  * count, GFP_KERNEL);
         add->pages     = kzalloc(sizeof(add->pages[0])     * count, GFP_KERNEL);
         if (NULL == add->grants    ||
             NULL == add->map_ops   ||
             NULL == add->unmap_ops ||
+            NULL == add->kmap_ops  ||
             NULL == add->pages)
                 goto err;
 
@@ -129,6 +132,7 @@ static struct grant_map *gntdev_alloc_map(struct gntdev_priv *priv, int count)
         for (i = 0; i < count; i++) {
                 add->map_ops[i].handle = -1;
                 add->unmap_ops[i].handle = -1;
+                add->kmap_ops[i].handle = -1;
         }
 
         add->index = 0;
@@ -142,6 +146,7 @@ err:
         kfree(add->grants);
         kfree(add->map_ops);
         kfree(add->unmap_ops);
+        kfree(add->kmap_ops);
         kfree(add);
         return NULL;
 }
@@ -243,10 +248,35 @@ static int map_grant_pages(struct grant_map *map)
                         gnttab_set_unmap_op(&map->unmap_ops[i], addr,
                                 map->flags, -1 /* handle */);
                 }
+        } else {
+                /*
+                 * Setup the map_ops corresponding to the pte entries pointing
+                 * to the kernel linear addresses of the struct pages.
+                 * These ptes are completely different from the user ptes dealt
+                 * with find_grant_ptes.
+                 */
+                for (i = 0; i < map->count; i++) {
+                        unsigned level;
+                        unsigned long address = (unsigned long)
+                                pfn_to_kaddr(page_to_pfn(map->pages[i]));
+                        pte_t *ptep;
+                        u64 pte_maddr = 0;
+                        BUG_ON(PageHighMem(map->pages[i]));
+
+                        ptep = lookup_address(address, &level);
+                        pte_maddr = arbitrary_virt_to_machine(ptep).maddr;
+                        gnttab_set_map_op(&map->kmap_ops[i], pte_maddr,
+                                map->flags |
+                                GNTMAP_host_map |
+                                GNTMAP_contains_pte,
+                                map->grants[i].ref,
+                                map->grants[i].domid);
+                }
         }
 
         pr_debug("map %d+%d\n", map->index, map->count);
-        err = gnttab_map_refs(map->map_ops, map->pages, map->count);
+        err = gnttab_map_refs(map->map_ops, use_ptemod ? map->kmap_ops : NULL,
+                        map->pages, map->count);
         if (err)
                 return err;