diff options
author | Dean Nelson <dcn@sgi.com> | 2006-08-08 16:03:29 -0400 |
---|---|---|
committer | Tony Luck <tony.luck@intel.com> | 2006-08-08 16:28:52 -0400 |
commit | 7682a4c624e0011b5f3e8dd3021dc54961260d97 (patch) | |
tree | f57ecd8f805a4df701812d3f7456da48bcdf63ac /arch/ia64/sn/kernel/xpc_main.c | |
parent | 9f737633e6ee54fc174282d49b2559bd2208391d (diff) |
[IA64-SGI] Silent data corruption caused by XPC V2.
Jack Steiner identified a problem where XPC can cause a silent
data corruption. On module load, the placement may cause the
xpc_remote_copy_buffer to span two physical pages. DMA transfers are
done to the start virtual address translated to physical.
This patch changes the buffer from a statically allocated buffer to a
kmalloc'd buffer. Dean Nelson reviewed this before posting. I have
tested it in the configuration that was showing the memory corruption
and verified it works. I also added a BUG_ON statement to help catch
this if a similar situation is encountered.
Signed-off-by: Robin Holt <holt@sgi.com>
Signed-off-by: Dean Nelson <dcn@sgi.com>
Signed-off-by: Jack Steiner <steiner@sgi.com>
Signed-off-by: Tony Luck <tony.luck@intel.com>
Diffstat (limited to 'arch/ia64/sn/kernel/xpc_main.c')
-rw-r--r-- | arch/ia64/sn/kernel/xpc_main.c | 28 |
1 files changed, 16 insertions, 12 deletions
diff --git a/arch/ia64/sn/kernel/xpc_main.c b/arch/ia64/sn/kernel/xpc_main.c index 5e8e59efb347..4d026f9dd98b 100644 --- a/arch/ia64/sn/kernel/xpc_main.c +++ b/arch/ia64/sn/kernel/xpc_main.c | |||
@@ -1052,6 +1052,8 @@ xpc_do_exit(enum xpc_retval reason) | |||
1052 | if (xpc_sysctl) { | 1052 | if (xpc_sysctl) { |
1053 | unregister_sysctl_table(xpc_sysctl); | 1053 | unregister_sysctl_table(xpc_sysctl); |
1054 | } | 1054 | } |
1055 | |||
1056 | kfree(xpc_remote_copy_buffer_base); | ||
1055 | } | 1057 | } |
1056 | 1058 | ||
1057 | 1059 | ||
@@ -1212,24 +1214,20 @@ xpc_init(void) | |||
1212 | partid_t partid; | 1214 | partid_t partid; |
1213 | struct xpc_partition *part; | 1215 | struct xpc_partition *part; |
1214 | pid_t pid; | 1216 | pid_t pid; |
1217 | size_t buf_size; | ||
1215 | 1218 | ||
1216 | 1219 | ||
1217 | if (!ia64_platform_is("sn2")) { | 1220 | if (!ia64_platform_is("sn2")) { |
1218 | return -ENODEV; | 1221 | return -ENODEV; |
1219 | } | 1222 | } |
1220 | 1223 | ||
1221 | /* | 1224 | |
1222 | * xpc_remote_copy_buffer is used as a temporary buffer for bte_copy'ng | 1225 | buf_size = max(XPC_RP_VARS_SIZE, |
1223 | * various portions of a partition's reserved page. Its size is based | 1226 | XPC_RP_HEADER_SIZE + XP_NASID_MASK_BYTES); |
1224 | * on the size of the reserved page header and part_nasids mask. So we | 1227 | xpc_remote_copy_buffer = xpc_kmalloc_cacheline_aligned(buf_size, |
1225 | * need to ensure that the other items will fit as well. | 1228 | GFP_KERNEL, &xpc_remote_copy_buffer_base); |
1226 | */ | 1229 | if (xpc_remote_copy_buffer == NULL) |
1227 | if (XPC_RP_VARS_SIZE > XPC_RP_HEADER_SIZE + XP_NASID_MASK_BYTES) { | 1230 | return -ENOMEM; |
1228 | dev_err(xpc_part, "xpc_remote_copy_buffer is not big enough\n"); | ||
1229 | return -EPERM; | ||
1230 | } | ||
1231 | DBUG_ON((u64) xpc_remote_copy_buffer != | ||
1232 | L1_CACHE_ALIGN((u64) xpc_remote_copy_buffer)); | ||
1233 | 1231 | ||
1234 | snprintf(xpc_part->bus_id, BUS_ID_SIZE, "part"); | 1232 | snprintf(xpc_part->bus_id, BUS_ID_SIZE, "part"); |
1235 | snprintf(xpc_chan->bus_id, BUS_ID_SIZE, "chan"); | 1233 | snprintf(xpc_chan->bus_id, BUS_ID_SIZE, "chan"); |
@@ -1293,6 +1291,8 @@ xpc_init(void) | |||
1293 | if (xpc_sysctl) { | 1291 | if (xpc_sysctl) { |
1294 | unregister_sysctl_table(xpc_sysctl); | 1292 | unregister_sysctl_table(xpc_sysctl); |
1295 | } | 1293 | } |
1294 | |||
1295 | kfree(xpc_remote_copy_buffer_base); | ||
1296 | return -EBUSY; | 1296 | return -EBUSY; |
1297 | } | 1297 | } |
1298 | 1298 | ||
@@ -1311,6 +1311,8 @@ xpc_init(void) | |||
1311 | if (xpc_sysctl) { | 1311 | if (xpc_sysctl) { |
1312 | unregister_sysctl_table(xpc_sysctl); | 1312 | unregister_sysctl_table(xpc_sysctl); |
1313 | } | 1313 | } |
1314 | |||
1315 | kfree(xpc_remote_copy_buffer_base); | ||
1314 | return -EBUSY; | 1316 | return -EBUSY; |
1315 | } | 1317 | } |
1316 | 1318 | ||
@@ -1362,6 +1364,8 @@ xpc_init(void) | |||
1362 | if (xpc_sysctl) { | 1364 | if (xpc_sysctl) { |
1363 | unregister_sysctl_table(xpc_sysctl); | 1365 | unregister_sysctl_table(xpc_sysctl); |
1364 | } | 1366 | } |
1367 | |||
1368 | kfree(xpc_remote_copy_buffer_base); | ||
1365 | return -EBUSY; | 1369 | return -EBUSY; |
1366 | } | 1370 | } |
1367 | 1371 | ||