[PATCH] xen/swiotlb: Check the segment boundary in range_straddles_page_boundary()

[Lin Liu <lin.liu01@xxxxxxxxxx>]

The block layer applies a device's DMA segment boundary to
pseudo-physical addresses, but in a Xen PV domain the bus address is the
machine address.  A range that is contiguous in both spaces can still
cross the boundary in machine space and reach the device.  AHCI declares
a 4 GiB boundary, and controllers that do not carry across it (e.g.
Marvell 88SE9230) then DMA the tail of the transfer 4 GiB too low.

Make range_straddles_page_boundary() also reject a contiguous range that
crosses the device's segment boundary in bus space, so all its callers
cover it.  Streaming mappings are bounced; coherent allocations are
already naturally aligned via range_requires_alignment().

Signed-off-by: Lin Liu <lin.liu01@xxxxxxxxxx>
---
 drivers/xen/swiotlb-xen.c | 16 +++++++++++-----
 1 file changed, 11 insertions(+), 5 deletions(-)

diff --git a/drivers/xen/swiotlb-xen.c b/drivers/xen/swiotlb-xen.c
index e2538824e..181f8cef2 100644
--- a/drivers/xen/swiotlb-xen.c
+++ b/drivers/xen/swiotlb-xen.c
@@ -82,10 +82,13 @@ static inline bool range_requires_alignment(phys_addr_t p, 
size_t size)
        return IS_ALIGNED(p, algn) && !IS_ALIGNED(bus_addr, algn);
 }
 
-static inline int range_straddles_page_boundary(phys_addr_t p, size_t size)
+static inline int range_straddles_page_boundary(struct device *dev,
+                                               phys_addr_t p, size_t size)
 {
        unsigned long next_bfn, xen_pfn = XEN_PFN_DOWN(p);
        unsigned int i, nr_pages = XEN_PFN_UP(xen_offset_in_page(p) + size);
+       unsigned long mask;
+       dma_addr_t dma;
 
        next_bfn = pfn_to_bfn(xen_pfn);
 
@@ -93,7 +96,10 @@ static inline int range_straddles_page_boundary(phys_addr_t 
p, size_t size)
                if (pfn_to_bfn(++xen_pfn) != ++next_bfn)
                        return 1;
 
-       return 0;
+       /* Contiguous, but may cross the segment boundary in bus space */
+       mask = dma_get_seg_boundary(dev);
+       dma = xen_phys_to_dma(dev, p);
+       return size - 1 <= mask && ((dma ^ (dma + size - 1)) & ~mask);
 }
 
 static struct io_tlb_pool *xen_swiotlb_find_pool(struct device *dev,
@@ -158,7 +164,7 @@ xen_swiotlb_alloc_coherent(struct device *dev, size_t size,
 
        *dma_handle = xen_phys_to_dma(dev, phys);
        if (*dma_handle + size - 1 > dma_mask ||
-           range_straddles_page_boundary(phys, size) ||
+           range_straddles_page_boundary(dev, phys, size) ||
            range_requires_alignment(phys, size)) {
                if (xen_create_contiguous_region(phys, order, fls64(dma_mask),
                                dma_handle) != 0)
@@ -185,7 +191,7 @@ xen_swiotlb_free_coherent(struct device *dev, size_t size, 
void *vaddr,
        size = ALIGN(size, XEN_PAGE_SIZE);
 
        if (WARN_ON_ONCE(dma_handle + size - 1 > dev->coherent_dma_mask) ||
-           WARN_ON_ONCE(range_straddles_page_boundary(phys, size) ||
+           WARN_ON_ONCE(range_straddles_page_boundary(dev, phys, size) ||
                         range_requires_alignment(phys, size)))
                return;
 
@@ -233,7 +239,7 @@ static dma_addr_t xen_swiotlb_map_phys(struct device *dev, 
phys_addr_t phys,
         */
        if (dma_capable(dev, dev_addr, size, true, attrs) &&
            !dma_kmalloc_needs_bounce(dev, size, dir) &&
-           !range_straddles_page_boundary(phys, size) &&
+           !range_straddles_page_boundary(dev, phys, size) &&
                !xen_arch_need_swiotlb(dev, phys, dev_addr) &&
                !is_swiotlb_force_bounce(dev))
                goto done;

base-commit: 7e1392a42ea288d70a266f6553fe06f57f8647ea
-- 
2.52.0