aboutsummaryrefslogtreecommitdiffstats
path: root/arch/powerpc
diff options
context:
space:
mode:
authorJake Moilanen <moilanen@austin.ibm.com>2006-01-30 22:51:54 -0500
committerPaul Mackerras <paulus@samba.org>2006-02-07 05:28:38 -0500
commita958a2648602aaa8f98aeb3c1c914f1b8096bfdc (patch)
tree9cb3390ce32ae3292a5bcffe72b0acbab0920957 /arch/powerpc
parentcdc3ee8f2061bafe7593bab0096a0e711408b0f9 (diff)
[PATCH] powerpc: IOMMU SG paranoia
This addresses two items, which are unlikely to be hit if we trust drivers. The first is moving a memory barrier below where the vmerged SG count is passed back, but before the list is set to end. If those instructions were reordered, there could be an issue in iommu_unmap_sg(). The second is making sure we terminate the list on the failure case of iommu_map_sg(). If a driver does not look at the failure return code, it could pass a ill-formed SG list to iommu_unmap_sg(). Signed-off-by: Jake Moilanen <moilanen@austin.ibm.com> Acked-by: Olof Johansson <olof@lixom.net> Signed-off-by: Paul Mackerras <paulus@samba.org>
Diffstat (limited to 'arch/powerpc')
-rw-r--r--arch/powerpc/kernel/iommu.c9
1 files changed, 6 insertions, 3 deletions
diff --git a/arch/powerpc/kernel/iommu.c b/arch/powerpc/kernel/iommu.c
index 4d9b4388918b..946f3219fd29 100644
--- a/arch/powerpc/kernel/iommu.c
+++ b/arch/powerpc/kernel/iommu.c
@@ -334,9 +334,6 @@ int iommu_map_sg(struct device *dev, struct iommu_table *tbl,
334 334
335 spin_unlock_irqrestore(&(tbl->it_lock), flags); 335 spin_unlock_irqrestore(&(tbl->it_lock), flags);
336 336
337 /* Make sure updates are seen by hardware */
338 mb();
339
340 DBG("mapped %d elements:\n", outcount); 337 DBG("mapped %d elements:\n", outcount);
341 338
342 /* For the sake of iommu_unmap_sg, we clear out the length in the 339 /* For the sake of iommu_unmap_sg, we clear out the length in the
@@ -347,6 +344,10 @@ int iommu_map_sg(struct device *dev, struct iommu_table *tbl,
347 outs->dma_address = DMA_ERROR_CODE; 344 outs->dma_address = DMA_ERROR_CODE;
348 outs->dma_length = 0; 345 outs->dma_length = 0;
349 } 346 }
347
348 /* Make sure updates are seen by hardware */
349 mb();
350
350 return outcount; 351 return outcount;
351 352
352 failure: 353 failure:
@@ -358,6 +359,8 @@ int iommu_map_sg(struct device *dev, struct iommu_table *tbl,
358 npages = (PAGE_ALIGN(s->dma_address + s->dma_length) - vaddr) 359 npages = (PAGE_ALIGN(s->dma_address + s->dma_length) - vaddr)
359 >> PAGE_SHIFT; 360 >> PAGE_SHIFT;
360 __iommu_free(tbl, vaddr, npages); 361 __iommu_free(tbl, vaddr, npages);
362 s->dma_address = DMA_ERROR_CODE;
363 s->dma_length = 0;
361 } 364 }
362 } 365 }
363 spin_unlock_irqrestore(&(tbl->it_lock), flags); 366 spin_unlock_irqrestore(&(tbl->it_lock), flags);