1 files changed, 36 insertions, 15 deletions

diff --git a/drivers/net/xen-netback/hash.c b/drivers/net/xen-netback/hash.c
index 3c4c58b9fe76..0ccb021f1e78 100644
--- a/drivers/net/xen-netback/hash.c
+++ b/drivers/net/xen-netback/hash.c
@@ -324,7 +324,8 @@ u32 xenvif_set_hash_mapping_size(struct xenvif *vif, u32 size)
                 return XEN_NETIF_CTRL_STATUS_INVALID_PARAMETER;
 
         vif->hash.size = size;
-        memset(vif->hash.mapping, 0, sizeof(u32) * size);
+        memset(vif->hash.mapping[vif->hash.mapping_sel], 0,
+               sizeof(u32) * size);
 
         return XEN_NETIF_CTRL_STATUS_SUCCESS;
 }
@@ -332,31 +333,49 @@ u32 xenvif_set_hash_mapping_size(struct xenvif *vif, u32 size)
 u32 xenvif_set_hash_mapping(struct xenvif *vif, u32 gref, u32 len,
                             u32 off)
 {
-        u32 *mapping = &vif->hash.mapping[off];
-        struct gnttab_copy copy_op = {
+        u32 *mapping = vif->hash.mapping[!vif->hash.mapping_sel];
+        unsigned int nr = 1;
+        struct gnttab_copy copy_op[2] = {{
                 .source.u.ref = gref,
                 .source.domid = vif->domid,
-                .dest.u.gmfn = virt_to_gfn(mapping),
                 .dest.domid = DOMID_SELF,
-                .dest.offset = xen_offset_in_page(mapping),
-                .len = len * sizeof(u32),
+                .len = len * sizeof(*mapping),
                 .flags = GNTCOPY_source_gref
-        };
+        }};
 
-        if ((off + len > vif->hash.size) || copy_op.len > XEN_PAGE_SIZE)
+        if ((off + len < off) || (off + len > vif->hash.size) ||
+            len > XEN_PAGE_SIZE / sizeof(*mapping))
                 return XEN_NETIF_CTRL_STATUS_INVALID_PARAMETER;
 
-        while (len-- != 0)
-                if (mapping[off++] >= vif->num_queues)
-                        return XEN_NETIF_CTRL_STATUS_INVALID_PARAMETER;
+        copy_op[0].dest.u.gmfn = virt_to_gfn(mapping + off);
+        copy_op[0].dest.offset = xen_offset_in_page(mapping + off);
+        if (copy_op[0].dest.offset + copy_op[0].len > XEN_PAGE_SIZE) {
+                copy_op[1] = copy_op[0];
+                copy_op[1].source.offset = XEN_PAGE_SIZE - copy_op[0].dest.offset;
+                copy_op[1].dest.u.gmfn = virt_to_gfn(mapping + off + len);
+                copy_op[1].dest.offset = 0;
+                copy_op[1].len = copy_op[0].len - copy_op[1].source.offset;
+                copy_op[0].len = copy_op[1].source.offset;
+                nr = 2;
+        }
 
-        if (copy_op.len != 0) {
-                gnttab_batch_copy(&copy_op, 1);
+        memcpy(mapping, vif->hash.mapping[vif->hash.mapping_sel],
+               vif->hash.size * sizeof(*mapping));
 
-                if (copy_op.status != GNTST_okay)
+        if (copy_op[0].len != 0) {
+                gnttab_batch_copy(copy_op, nr);
+
+                if (copy_op[0].status != GNTST_okay ||
+                    copy_op[nr - 1].status != GNTST_okay)
                         return XEN_NETIF_CTRL_STATUS_INVALID_PARAMETER;
         }
 
+        while (len-- != 0)
+                if (mapping[off++] >= vif->num_queues)
+                        return XEN_NETIF_CTRL_STATUS_INVALID_PARAMETER;
+
+        vif->hash.mapping_sel = !vif->hash.mapping_sel;
+
         return XEN_NETIF_CTRL_STATUS_SUCCESS;
 }
 
@@ -408,6 +427,8 @@ void xenvif_dump_hash_info(struct xenvif *vif, struct seq_file *m)
         }
 
         if (vif->hash.size != 0) {
+                const u32 *mapping = vif->hash.mapping[vif->hash.mapping_sel];
+
                 seq_puts(m, "\nHash Mapping:\n");
 
                 for (i = 0; i < vif->hash.size; ) {
@@ -420,7 +441,7 @@ void xenvif_dump_hash_info(struct xenvif *vif, struct seq_file *m)
                         seq_printf(m, "[%4u - %4u]: ", i, i + n - 1);
 
                         for (j = 0; j < n; j++, i++)
-                                seq_printf(m, "%4u ", vif->hash.mapping[i]);
+                                seq_printf(m, "%4u ", mapping[i]);
 
                         seq_puts(m, "\n");
                 }