5 files changed, 64 insertions, 17 deletions

diff --git a/arch/x86/mm/ioremap.c b/arch/x86/mm/ioremap.c
index 3a4baf95e24d..caac7d5699a7 100644
--- a/arch/x86/mm/ioremap.c
+++ b/arch/x86/mm/ioremap.c
@@ -336,6 +336,35 @@ void iounmap(volatile void __iomem *addr)
 }
 EXPORT_SYMBOL(iounmap);
 
+/*
+ * Convert a physical pointer to a virtual kernel pointer for /dev/mem
+ * access
+ */
+void *xlate_dev_mem_ptr(unsigned long phys)
+{
+        void *addr;
+        unsigned long start = phys & PAGE_MASK;
+
+        /* If page is RAM, we can use __va. Otherwise ioremap and unmap. */
+        if (page_is_ram(start >> PAGE_SHIFT))
+                return __va(phys);
+
+        addr = (void *)ioremap(start, PAGE_SIZE);
+        if (addr)
+                addr = (void *)((unsigned long)addr | (phys & ~PAGE_MASK));
+
+        return addr;
+}
+
+void unxlate_dev_mem_ptr(unsigned long phys, void *addr)
+{
+        if (page_is_ram(phys >> PAGE_SHIFT))
+                return;
+
+        iounmap((void __iomem *)((unsigned long)addr & PAGE_MASK));
+        return;
+}
+
 #ifdef CONFIG_X86_32
 
 int __initdata early_ioremap_debug;
diff --git a/drivers/char/mem.c b/drivers/char/mem.c
index 964ff3b1cff4..83495885ada0 100644
--- a/drivers/char/mem.c
+++ b/drivers/char/mem.c
@@ -134,6 +134,10 @@ static inline int range_is_allowed(unsigned long pfn, unsigned long size)
 }
 #endif
 
+void __attribute__((weak)) unxlate_dev_mem_ptr(unsigned long phys, void *addr)
+{
+}
+
 /*
  * This funcion reads the *physical* memory. The f_pos points directly to the 
  * memory location. 
@@ -176,17 +180,25 @@ static ssize_t read_mem(struct file * file, char __user * buf,
 
                 sz = min_t(unsigned long, sz, count);
 
+                if (!range_is_allowed(p >> PAGE_SHIFT, count))
+                        return -EPERM;
+
                 /*
                  * On ia64 if a page has been mapped somewhere as
                  * uncached, then it must also be accessed uncached
                  * by the kernel or data corruption may occur
                  */
                 ptr = xlate_dev_mem_ptr(p);
+                if (!ptr)
+                        return -EFAULT;
 
-                if (!range_is_allowed(p >> PAGE_SHIFT, count))
-                        return -EPERM;
-                if (copy_to_user(buf, ptr, sz))
+                if (copy_to_user(buf, ptr, sz)) {
+                        unxlate_dev_mem_ptr(p, ptr);
                         return -EFAULT;
+                }
+
+                unxlate_dev_mem_ptr(p, ptr);
+
                 buf += sz;
                 p += sz;
                 count -= sz;
@@ -235,22 +247,32 @@ static ssize_t write_mem(struct file * file, const char __user * buf,
 
                 sz = min_t(unsigned long, sz, count);
 
+                if (!range_is_allowed(p >> PAGE_SHIFT, sz))
+                        return -EPERM;
+
                 /*
                  * On ia64 if a page has been mapped somewhere as
                  * uncached, then it must also be accessed uncached
                  * by the kernel or data corruption may occur
                  */
                 ptr = xlate_dev_mem_ptr(p);
+                if (!ptr) {
+                        if (written)
+                                break;
+                        return -EFAULT;
+                }
 
-                if (!range_is_allowed(p >> PAGE_SHIFT, sz))
-                        return -EPERM;
                 copied = copy_from_user(ptr, buf, sz);
                 if (copied) {
                         written += sz - copied;
+                        unxlate_dev_mem_ptr(p, ptr);
                         if (written)
                                 break;
                         return -EFAULT;
                 }
+
+                unxlate_dev_mem_ptr(p, ptr);
+
                 buf += sz;
                 p += sz;
                 count -= sz;
diff --git a/include/asm-x86/io.h b/include/asm-x86/io.h
index 7b292d386713..d5b11f60dbd0 100644
--- a/include/asm-x86/io.h
+++ b/include/asm-x86/io.h
@@ -1,3 +1,6 @@
+#ifndef _ASM_X86_IO_H
+#define _ASM_X86_IO_H
+
 #define ARCH_HAS_IOREMAP_WC
 
 #ifdef CONFIG_X86_32
@@ -5,7 +8,12 @@
 #else
 # include "io_64.h"
 #endif
+
+extern void *xlate_dev_mem_ptr(unsigned long phys);
+extern void unxlate_dev_mem_ptr(unsigned long phys, void *addr);
+
 extern int ioremap_change_attr(unsigned long vaddr, unsigned long size,
                                 unsigned long prot_val);
 extern void __iomem *ioremap_wc(unsigned long offset, unsigned long size);
 
+#endif /* _ASM_X86_IO_H */
diff --git a/include/asm-x86/io_32.h b/include/asm-x86/io_32.h
index 509045f5fda2..6e73467a4fb1 100644
--- a/include/asm-x86/io_32.h
+++ b/include/asm-x86/io_32.h
@@ -49,12 +49,6 @@
 #include <linux/vmalloc.h>
 
 /*
- * Convert a physical pointer to a virtual kernel pointer for /dev/mem
- * access
- */
-#define xlate_dev_mem_ptr(p)    __va(p)
-
-/*
  * Convert a virtual cached pointer to an uncached pointer
  */
 #define xlate_dev_kmem_ptr(p)   p
diff --git a/include/asm-x86/io_64.h b/include/asm-x86/io_64.h
index c2f5eef47b88..0930bedf9e4d 100644
--- a/include/asm-x86/io_64.h
+++ b/include/asm-x86/io_64.h
@@ -308,12 +308,6 @@ extern int iommu_bio_merge;
 #define BIO_VMERGE_BOUNDARY iommu_bio_merge
 
 /*
- * Convert a physical pointer to a virtual kernel pointer for /dev/mem
- * access
- */
-#define xlate_dev_mem_ptr(p)    __va(p)
-
-/*
  * Convert a virtual cached pointer to an uncached pointer
  */
 #define xlate_dev_kmem_ptr(p)   p