1.1 --- a/xen/common/grant_table.c	Thu Dec 06 13:39:19 2007 +0000
     1.2 +++ b/xen/common/grant_table.c	Thu Dec 06 13:56:00 2007 +0000
     1.3 @@ -1031,6 +1031,7 @@ gnttab_transfer(
     1.4      grant_entry_t *sha;
     1.5      struct gnttab_transfer gop;
     1.6      unsigned long mfn;
     1.7 +    unsigned int max_bitsize;
     1.8  
     1.9      for ( i = 0; i < count; i++ )
    1.10      {
    1.11 @@ -1081,24 +1082,27 @@ gnttab_transfer(
    1.12  
    1.13          if ( xsm_grant_transfer(d, e) )
    1.14          {
    1.15 +            gop.status = GNTST_permission_denied;
    1.16          unlock_and_copyback:
    1.17              rcu_unlock_domain(e);
    1.18              page->count_info &= ~(PGC_count_mask|PGC_allocated);
    1.19              free_domheap_page(page);
    1.20 -            gop.status = GNTST_permission_denied;
    1.21              goto copyback;
    1.22          }
    1.23  
    1.24 -        if ( (1UL << domain_clamp_alloc_bitsize(e, BITS_PER_LONG-1)) <= mfn )
    1.25 +        max_bitsize = domain_clamp_alloc_bitsize(
    1.26 +            e, BITS_PER_LONG+PAGE_SHIFT-1);
    1.27 +        if ( (1UL << (max_bitsize - PAGE_SHIFT)) <= mfn )
    1.28          {
    1.29              struct page_info *new_page;
    1.30              void *sp, *dp;
    1.31  
    1.32 -            new_page = alloc_domheap_pages(
    1.33 -                NULL, 0, 
    1.34 -                MEMF_bits(domain_clamp_alloc_bitsize(e, BITS_PER_LONG-1)));
    1.35 +            new_page = alloc_domheap_pages(NULL, 0, MEMF_bits(max_bitsize));
    1.36              if ( new_page == NULL )
    1.37 +            {
    1.38 +                gop.status = GNTST_address_too_big;
    1.39                  goto unlock_and_copyback;
    1.40 +            }
    1.41  
    1.42              sp = map_domain_page(mfn);
    1.43              dp = map_domain_page(page_to_mfn(new_page));

     2.1 --- a/xen/common/memory.c	Thu Dec 06 13:39:19 2007 +0000
     2.2 +++ b/xen/common/memory.c	Thu Dec 06 13:56:00 2007 +0000
     2.3 @@ -342,7 +342,7 @@ static long memory_exchange(XEN_GUEST_HA
     2.4      d = current->domain;
     2.5  
     2.6      memflags |= MEMF_bits(domain_clamp_alloc_bitsize(
     2.7 -        d, exch.out.address_bits ? : BITS_PER_LONG));
     2.8 +        d, exch.out.address_bits ? : (BITS_PER_LONG+PAGE_SHIFT)));
     2.9  
    2.10      cpu = select_local_cpu(d);
    2.11  

     3.1 --- a/xen/common/page_alloc.c	Thu Dec 06 13:39:19 2007 +0000
     3.2 +++ b/xen/common/page_alloc.c	Thu Dec 06 13:56:00 2007 +0000
     3.3 @@ -786,7 +786,7 @@ struct page_info *__alloc_domheap_pages(
     3.4  
     3.5      ASSERT(!in_irq());
     3.6  
     3.7 -    bits = domain_clamp_alloc_bitsize(d, bits ? : BITS_PER_LONG);
     3.8 +    bits = domain_clamp_alloc_bitsize(d, bits ? : (BITS_PER_LONG+PAGE_SHIFT));
     3.9      if ( bits <= (PAGE_SHIFT + 1) )
    3.10          return NULL;
    3.11  

     4.1 --- a/xen/include/public/grant_table.h	Thu Dec 06 13:39:19 2007 +0000
     4.2 +++ b/xen/include/public/grant_table.h	Thu Dec 06 13:56:00 2007 +0000
     4.3 @@ -400,7 +400,8 @@ DEFINE_XEN_GUEST_HANDLE(gnttab_unmap_and
     4.4  #define GNTST_no_device_space  (-7) /* Out of space in I/O MMU.              */
     4.5  #define GNTST_permission_denied (-8) /* Not enough privilege for operation.  */
     4.6  #define GNTST_bad_page         (-9) /* Specified page was invalid for op.    */
     4.7 -#define GNTST_bad_copy_arg    (-10) /* copy arguments cross page boundary */
     4.8 +#define GNTST_bad_copy_arg    (-10) /* copy arguments cross page boundary.   */
     4.9 +#define GNTST_address_too_big (-11) /* transfer page address too large.      */
    4.10  
    4.11  #define GNTTABOP_error_msgs {                   \
    4.12      "okay",                                     \
    4.13 @@ -413,7 +414,8 @@ DEFINE_XEN_GUEST_HANDLE(gnttab_unmap_and
    4.14      "no spare translation slot in the I/O MMU", \
    4.15      "permission denied",                        \
    4.16      "bad page",                                 \
    4.17 -    "copy arguments cross page boundary"        \
    4.18 +    "copy arguments cross page boundary",       \
    4.19 +    "page address size too large"               \
    4.20  }
    4.21  
    4.22  #endif /* __XEN_PUBLIC_GRANT_TABLE_H__ */