From da503fa60b84d5945deb3ab74efdd0bec61df4a1 Mon Sep 17 00:00:00 2001
From: Jan Beulich <jbeulich@novell.com>
Date: Wed, 18 Jun 2008 09:28:00 +0100
Subject: agp: two-stage page destruction issue

besides it apparently being useful only in 2.6.24 (the changes in 2.6.25
really mean that it could be converted back to a single-stage mechanism),
I'm seeing an issue in Xen Dom0 kernels, which is caused by the calling
of gart_to_virt() in the second stage invocations of the destroy function.
I think that besides this being a real issue with Xen (where
unmap_page_from_agp() is not just a page table attribute change), this
also is invalid from a theoretical perspective: One should not assume that
gart_to_virt() is still valid after unmapping a page. So minimally (keeping
the 2-stage mechanism) a patch like the one below would be needed.

Jan

Signed-off-by: Dave Airlie <airlied@redhat.com>
---
 drivers/char/agp/backend.c | 16 ++++++++--------
 1 file changed, 8 insertions(+), 8 deletions(-)

(limited to 'drivers/char/agp/backend.c')

diff --git a/drivers/char/agp/backend.c b/drivers/char/agp/backend.c
index b1bdd015165..1ec87104e68 100644
--- a/drivers/char/agp/backend.c
+++ b/drivers/char/agp/backend.c
@@ -188,10 +188,10 @@ static int agp_backend_initialize(struct agp_bridge_data *bridge)
 
 err_out:
 	if (bridge->driver->needs_scratch_page) {
-		bridge->driver->agp_destroy_page(gart_to_virt(bridge->scratch_page_real),
-						 AGP_PAGE_DESTROY_UNMAP);
-		bridge->driver->agp_destroy_page(gart_to_virt(bridge->scratch_page_real),
-						 AGP_PAGE_DESTROY_FREE);
+		void *va = gart_to_virt(bridge->scratch_page_real);
+
+		bridge->driver->agp_destroy_page(va, AGP_PAGE_DESTROY_UNMAP);
+		bridge->driver->agp_destroy_page(va, AGP_PAGE_DESTROY_FREE);
 	}
 	if (got_gatt)
 		bridge->driver->free_gatt_table(bridge);
@@ -215,10 +215,10 @@ static void agp_backend_cleanup(struct agp_bridge_data *bridge)
 
 	if (bridge->driver->agp_destroy_page &&
 	    bridge->driver->needs_scratch_page) {
-		bridge->driver->agp_destroy_page(gart_to_virt(bridge->scratch_page_real),
-						 AGP_PAGE_DESTROY_UNMAP);
-		bridge->driver->agp_destroy_page(gart_to_virt(bridge->scratch_page_real),
-						 AGP_PAGE_DESTROY_FREE);
+		void *va = gart_to_virt(bridge->scratch_page_real);
+
+		bridge->driver->agp_destroy_page(va, AGP_PAGE_DESTROY_UNMAP);
+		bridge->driver->agp_destroy_page(va, AGP_PAGE_DESTROY_FREE);
 	}
 }
 
-- 
cgit v1.2.3