Fix swiotlb_sync_single_range()

If the swiotlb maps a multi-slab region, swiotlb_sync_single_range() can be
invoked to sync a sub-region which does not include the first slab.
Unfortunately io_tlb_orig_addr[] is only initialised for the first slab,
and hence the call to sync_single() will read a garbage orig_addr in this
case.

This patch fixes the issue by initialising all mapped slabs in
io_tlb_orig_addr[].  It also correctly adjusts the buffer pointer in
sync_single() to handle the case that the given dma_addr is not aligned on
a slab boundary.

Signed-off-by: Keir Fraser <keir.fraser@cl.cam.ac.uk>
Cc: "Luck, Tony" <tony.luck@intel.com>
Acked-by: Andi Kleen <ak@suse.de>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

1 files changed, 4 insertions, 1 deletions

diff --git a/lib/swiotlb.c b/lib/swiotlb.c
index 10c13ad0d82d..a7381d55663a 100644
--- a/lib/swiotlb.c
+++ b/lib/swiotlb.c
@@ -357,7 +357,8 @@ map_single(struct device *hwdev, char *buffer, size_t size, int dir)
          * This is needed when we sync the memory.  Then we sync the buffer if
          * needed.
          */
-        io_tlb_orig_addr[index] = buffer;
+        for (i = 0; i < nslots; i++)
+                io_tlb_orig_addr[index+i] = buffer + (i << IO_TLB_SHIFT);
         if (dir == DMA_TO_DEVICE || dir == DMA_BIDIRECTIONAL)
                 memcpy(dma_addr, buffer, size);
 
@@ -418,6 +419,8 @@ sync_single(struct device *hwdev, char *dma_addr, size_t size,
         int index = (dma_addr - io_tlb_start) >> IO_TLB_SHIFT;
         char *buffer = io_tlb_orig_addr[index];
 
+        buffer += ((unsigned long)dma_addr & ((1 << IO_TLB_SHIFT) - 1));
+
         switch (target) {
         case SYNC_FOR_CPU:
                 if (likely(dir == DMA_FROM_DEVICE || dir == DMA_BIDIRECTIONAL))