From da503fa60b84d5945deb3ab74efdd0bec61df4a1 Mon Sep 17 00:00:00 2001 From: Jan Beulich Date: Wed, 18 Jun 2008 09:28:00 +0100 Subject: agp: two-stage page destruction issue besides it apparently being useful only in 2.6.24 (the changes in 2.6.25 really mean that it could be converted back to a single-stage mechanism), I'm seeing an issue in Xen Dom0 kernels, which is caused by the calling of gart_to_virt() in the second stage invocations of the destroy function. I think that besides this being a real issue with Xen (where unmap_page_from_agp() is not just a page table attribute change), this also is invalid from a theoretical perspective: One should not assume that gart_to_virt() is still valid after unmapping a page. So minimally (keeping the 2-stage mechanism) a patch like the one below would be needed. Jan Signed-off-by: Dave Airlie --- drivers/char/agp/generic.c | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) (limited to 'drivers/char/agp/generic.c') diff --git a/drivers/char/agp/generic.c b/drivers/char/agp/generic.c index 7fc0c99a3a5..b6650a63197 100644 --- a/drivers/char/agp/generic.c +++ b/drivers/char/agp/generic.c @@ -202,10 +202,13 @@ void agp_free_memory(struct agp_memory *curr) } if (curr->page_count != 0) { for (i = 0; i < curr->page_count; i++) { - curr->bridge->driver->agp_destroy_page(gart_to_virt(curr->memory[i]), AGP_PAGE_DESTROY_UNMAP); + curr->memory[i] = (unsigned long)gart_to_virt(curr->memory[i]); + curr->bridge->driver->agp_destroy_page((void *)curr->memory[i], + AGP_PAGE_DESTROY_UNMAP); } for (i = 0; i < curr->page_count; i++) { - curr->bridge->driver->agp_destroy_page(gart_to_virt(curr->memory[i]), AGP_PAGE_DESTROY_FREE); + curr->bridge->driver->agp_destroy_page((void *)curr->memory[i], + AGP_PAGE_DESTROY_FREE); } } agp_free_key(curr->key); -- cgit v1.2.3