Mailing List Archive

# HG changeset patch
# User kaf24@firebug.cl.cam.ac.uk
# Node ID ae7f8b7e9aa24f3e4d3c38e9597cbafe131b89b6
# Parent 5baa96bedc13924e9ff4c04ebedcac4e8a0e4da4
Work aroudn swiotlb issue where a read-only host buffer is
mapped for DMA_BIDIRECTIONAL streaming access by certain
low-level drivers. This causes an unnecessary copy to the
host buffer that previously caused a fatal kernel page fault.

Signed-off-by: Keir Fraser <keir@xensource.com>

xen-unstable cset: b92ca87a2403d465e4d1087f8a7a43223b21bed8
committer: Robert Read <robert@xensource.com>

diff -r 5baa96bedc13 -r ae7f8b7e9aa2 linux-2.6-xen-sparse/arch/xen/i386/kernel/swiotlb.c
--- a/linux-2.6-xen-sparse/arch/xen/i386/kernel/swiotlb.c Thu Dec 15 19:57:27 2005
+++ b/linux-2.6-xen-sparse/arch/xen/i386/kernel/swiotlb.c Fri Dec 16 15:43:00 2005
@@ -24,6 +24,7 @@
#include <asm/io.h>
#include <asm/pci.h>
#include <asm/dma.h>
+#include <asm/uaccess.h>
#include <asm-xen/xen-public/memory.h>

#define OFFSET(val,align) ((unsigned long)((val) & ( (align) - 1)))
@@ -201,6 +202,12 @@
printk(KERN_INFO "Software IO TLB disabled\n");
}

+/*
+ * We use __copy_to_user to transfer to the host buffer because the buffer
+ * may be mapped read-only (e.g, in blkback driver) but lower-level
+ * drivers map the buffer for DMA_BIDIRECTIONAL access. This causes an
+ * unnecessary copy from the aperture to the host buffer, and a page fault.
+ */
static void
__sync_single(struct phys_addr buffer, char *dma_addr, size_t size, int dir)
{
@@ -214,9 +221,11 @@
kmp = kmap_atomic(buffer.page, KM_SWIOTLB);
dev = dma_addr + size - len;
host = kmp + buffer.offset;
- memcpy((dir == DMA_FROM_DEVICE) ? host : dev,
- (dir == DMA_FROM_DEVICE) ? dev : host,
- bytes);
+ if (dir == DMA_FROM_DEVICE) {
+ if (__copy_to_user(host, dev, bytes))
+ return; /* inaccessible */
+ } else
+ memcpy(dev, host, bytes);
kunmap_atomic(kmp, KM_SWIOTLB);
len -= bytes;
buffer.page++;
@@ -225,9 +234,10 @@
} else {
char *host = (char *)phys_to_virt(
page_to_pseudophys(buffer.page)) + buffer.offset;
- if (dir == DMA_FROM_DEVICE)
- memcpy(host, dma_addr, size);
- else if (dir == DMA_TO_DEVICE)
+ if (dir == DMA_FROM_DEVICE) {
+ if (__copy_to_user(host, dma_addr, size))
+ return; /* inaccessible */
+ } else if (dir == DMA_TO_DEVICE)
memcpy(dma_addr, host, size);
}
}

_______________________________________________
Xen-changelog mailing list
Xen-changelog@lists.xensource.com
http://lists.xensource.com/xen-changelog