Commit c0f83d16 authored by Marek Szyprowski's avatar Marek Szyprowski Committed by Alex Deucher
Browse files

drm/prime: fix extracting of the DMA addresses from a scatterlist



Scatterlist elements contains both pages and DMA addresses, but one
should not assume 1:1 relation between them. The sg->length is the size
of the physical memory chunk described by the sg->page, while
sg_dma_len(sg) is the size of the DMA (IO virtual) chunk described by
the sg_dma_address(sg).

The proper way of extracting both: pages and DMA addresses of the whole
buffer described by a scatterlist it to iterate independently over the
sg->pages/sg->length and sg_dma_address(sg)/sg_dma_len(sg) entries.

Fixes: 42e67b47 ("drm/prime: use dma length macro when mapping sg")
Signed-off-by: default avatarMarek Szyprowski <m.szyprowski@samsung.com>
Reviewed-by: default avatarAlex Deucher <alexander.deucher@amd.com>
Signed-off-by: default avatarAlex Deucher <alexander.deucher@amd.com>
Link: https://patchwork.freedesktop.org/patch/msgid/20200327162126.29705-1-m.szyprowski@samsung.com
Cc: stable@vger.kernel.org
parent cc46c033
Loading
Loading
Loading
Loading
+25 −12
Original line number Diff line number Diff line
@@ -962,27 +962,40 @@ int drm_prime_sg_to_page_addr_arrays(struct sg_table *sgt, struct page **pages,
	unsigned count;
	struct scatterlist *sg;
	struct page *page;
	u32 len, index;
	u32 page_len, page_index;
	dma_addr_t addr;
	u32 dma_len, dma_index;

	index = 0;
	/*
	 * Scatterlist elements contains both pages and DMA addresses, but
	 * one shoud not assume 1:1 relation between them. The sg->length is
	 * the size of the physical memory chunk described by the sg->page,
	 * while sg_dma_len(sg) is the size of the DMA (IO virtual) chunk
	 * described by the sg_dma_address(sg).
	 */
	page_index = 0;
	dma_index = 0;
	for_each_sg(sgt->sgl, sg, sgt->nents, count) {
		len = sg_dma_len(sg);
		page_len = sg->length;
		page = sg_page(sg);
		dma_len = sg_dma_len(sg);
		addr = sg_dma_address(sg);

		while (len > 0) {
			if (WARN_ON(index >= max_entries))
		while (pages && page_len > 0) {
			if (WARN_ON(page_index >= max_entries))
				return -1;
			if (pages)
				pages[index] = page;
			if (addrs)
				addrs[index] = addr;

			pages[page_index] = page;
			page++;
			page_len -= PAGE_SIZE;
			page_index++;
		}
		while (addrs && dma_len > 0) {
			if (WARN_ON(dma_index >= max_entries))
				return -1;
			addrs[dma_index] = addr;
			addr += PAGE_SIZE;
			len -= PAGE_SIZE;
			index++;
			dma_len -= PAGE_SIZE;
			dma_index++;
		}
	}
	return 0;