Merge tag 'stable/for-linus-4.0-rc1-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/xen/tip

Pull xen bugfixes from David Vrabel:
 "Xen regression and bug fixes for 4.0-rc1

   - Fix two regressions introduced in 4.0-rc1 affecting PV/PVH guests
     in certain configurations.

   - Prevent pvscsi frontends bypassing backend checks.

   - Allow privcmd hypercalls to be preempted even on kernel with
     voluntary preemption.  This fixes soft-lockups with long running
     toolstack hypercalls (e.g., when creating/destroying large
     domains)"

* tag 'stable/for-linus-4.0-rc1-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/xen/tip:
  x86/xen: Initialize cr4 shadow for 64-bit PV(H) guests
  xen-scsiback: mark pvscsi frontend request consumed only after last read
  x86/xen: allow privcmd hypercalls to be preempted
  x86/xen: Make sure X2APIC_ENABLE bit of MSR_IA32_APICBASE is not set

4 files changed, 53 insertions, 9 deletions

diff --git a/drivers/xen/Makefile b/drivers/xen/Makefile
index 2140398a2a8c..2ccd3592d41f 100644
--- a/drivers/xen/Makefile
+++ b/drivers/xen/Makefile
@@ -2,7 +2,7 @@ ifeq ($(filter y, $(CONFIG_ARM) $(CONFIG_ARM64)),)
 obj-$(CONFIG_HOTPLUG_CPU)               += cpu_hotplug.o
 endif
 obj-$(CONFIG_X86)                       += fallback.o
-obj-y   += grant-table.o features.o balloon.o manage.o
+obj-y   += grant-table.o features.o balloon.o manage.o preempt.o
 obj-y   += events/
 obj-y   += xenbus/
 
diff --git a/drivers/xen/preempt.c b/drivers/xen/preempt.c
new file mode 100644
index 000000000000..a1800c150839
--- /dev/null
+++ b/drivers/xen/preempt.c
@@ -0,0 +1,44 @@
+/*
+ * Preemptible hypercalls
+ *
+ * Copyright (C) 2014 Citrix Systems R&D ltd.
+ *
+ * This source code is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU General Public License as
+ * published by the Free Software Foundation; either version 2 of the
+ * License, or (at your option) any later version.
+ */
+
+#include <linux/sched.h>
+#include <xen/xen-ops.h>
+
+#ifndef CONFIG_PREEMPT
+
+/*
+ * Some hypercalls issued by the toolstack can take many 10s of
+ * seconds. Allow tasks running hypercalls via the privcmd driver to
+ * be voluntarily preempted even if full kernel preemption is
+ * disabled.
+ *
+ * Such preemptible hypercalls are bracketed by
+ * xen_preemptible_hcall_begin() and xen_preemptible_hcall_end()
+ * calls.
+ */
+
+DEFINE_PER_CPU(bool, xen_in_preemptible_hcall);
+EXPORT_SYMBOL_GPL(xen_in_preemptible_hcall);
+
+asmlinkage __visible void xen_maybe_preempt_hcall(void)
+{
+        if (unlikely(__this_cpu_read(xen_in_preemptible_hcall)
+                     && should_resched())) {
+                /*
+                 * Clear flag as we may be rescheduled on a different
+                 * cpu.
+                 */
+                __this_cpu_write(xen_in_preemptible_hcall, false);
+                _cond_resched();
+                __this_cpu_write(xen_in_preemptible_hcall, true);
+        }
+}
+#endif /* CONFIG_PREEMPT */
diff --git a/drivers/xen/privcmd.c b/drivers/xen/privcmd.c
index 569a13b9e856..59ac71c4a043 100644
--- a/drivers/xen/privcmd.c
+++ b/drivers/xen/privcmd.c
@@ -56,10 +56,12 @@ static long privcmd_ioctl_hypercall(void __user *udata)
         if (copy_from_user(&hypercall, udata, sizeof(hypercall)))
                 return -EFAULT;
 
+        xen_preemptible_hcall_begin();
         ret = privcmd_call(hypercall.op,
                            hypercall.arg[0], hypercall.arg[1],
                            hypercall.arg[2], hypercall.arg[3],
                            hypercall.arg[4]);
+        xen_preemptible_hcall_end();
 
         return ret;
 }
diff --git a/drivers/xen/xen-scsiback.c b/drivers/xen/xen-scsiback.c
index 61653a03a8f5..9faca6a60bb0 100644
--- a/drivers/xen/xen-scsiback.c
+++ b/drivers/xen/xen-scsiback.c
@@ -709,12 +709,11 @@ static int prepare_pending_reqs(struct vscsibk_info *info,
 static int scsiback_do_cmd_fn(struct vscsibk_info *info)
 {
         struct vscsiif_back_ring *ring = &info->ring;
-        struct vscsiif_request *ring_req;
+        struct vscsiif_request ring_req;
         struct vscsibk_pend *pending_req;
         RING_IDX rc, rp;
         int err, more_to_do;
         uint32_t result;
-        uint8_t act;
 
         rc = ring->req_cons;
         rp = ring->sring->req_prod;
@@ -735,11 +734,10 @@ static int scsiback_do_cmd_fn(struct vscsibk_info *info)
                 if (!pending_req)
                         return 1;
 
-                ring_req = RING_GET_REQUEST(ring, rc);
+                ring_req = *RING_GET_REQUEST(ring, rc);
                 ring->req_cons = ++rc;
 
-                act = ring_req->act;
-                err = prepare_pending_reqs(info, ring_req, pending_req);
+                err = prepare_pending_reqs(info, &ring_req, pending_req);
                 if (err) {
                         switch (err) {
                         case -ENODEV:
@@ -755,9 +753,9 @@ static int scsiback_do_cmd_fn(struct vscsibk_info *info)
                         return 1;
                 }
 
-                switch (act) {
+                switch (ring_req.act) {
                 case VSCSIIF_ACT_SCSI_CDB:
-                        if (scsiback_gnttab_data_map(ring_req, pending_req)) {
+                        if (scsiback_gnttab_data_map(&ring_req, pending_req)) {
                                 scsiback_fast_flush_area(pending_req);
                                 scsiback_do_resp_with_sense(NULL,
                                         DRIVER_ERROR << 24, 0, pending_req);
@@ -768,7 +766,7 @@ static int scsiback_do_cmd_fn(struct vscsibk_info *info)
                         break;
                 case VSCSIIF_ACT_SCSI_ABORT:
                         scsiback_device_action(pending_req, TMR_ABORT_TASK,
-                                ring_req->ref_rqid);
+                                ring_req.ref_rqid);
                         break;
                 case VSCSIIF_ACT_SCSI_RESET:
                         scsiback_device_action(pending_req, TMR_LUN_RESET, 0);