From mboxrd@z Thu Jan 1 00:00:00 1970 From: Noboru Iwamatsu Subject: Re: [PATCH] usbfront: do not assume sequentially mapped pages Date: Wed, 01 Apr 2009 15:05:36 +0900 Message-ID: <49D30430.7030700@jp.fujitsu.com> References: <18896.57087.861363.142669@mariner.uk.xensource.com> Mime-Version: 1.0 Content-Type: text/plain; charset=ISO-8859-1; format=flowed Content-Transfer-Encoding: 7bit Return-path: In-Reply-To: <18896.57087.861363.142669@mariner.uk.xensource.com> List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Sender: xen-devel-bounces@lists.xensource.com Errors-To: xen-devel-bounces@lists.xensource.com To: Ian.Jackson@eu.citrix.com Cc: xen-devel@lists.xensource.com List-Id: xen-devel@lists.xenproject.org Hi, Oh, I had a misunderstanding about the continuity of buffer pages. This caused webcam's image to corrupt. PVUSB applied to this change can work well with the following webcams. * Creative Labs: WebCam 3 USB (with ov511 driver) * Creative Labs: WebCam NX pro (with gspca driver) Now, Webcam works! Thanks, Noboru Ian Jackson wrote: > xenhcd_gnttab_map in usbfront-q.c looks up the mfn of the start of the > usb transfer buffer. But the buffer may span several pages, and the > current code simply increments the obtained mfn. Needless to say this > is an unwarranted assumption. It causes large transfers to be > corrupted and/or to overwrite other parts of memory. > > Signed-off-by: Ian Jackson > > diff -r 87c84f7dd850 drivers/xen/usbfront/usbfront-q.c > --- a/drivers/xen/usbfront/usbfront-q.c Fri Mar 20 09:00:58 2009 +0000 > +++ b/drivers/xen/usbfront/usbfront-q.c Fri Mar 27 17:53:12 2009 +0100 > @@ -106,12 +106,15 @@ static inline void xenhcd_gnttab_map(str > unsigned int bytes; > int i; > > - page = virt_to_page(addr); > - buffer_pfn = page_to_phys(page) >> PAGE_SHIFT; > - offset = offset_in_page(addr); > len = length; > > for(i = 0;i < nr_pages;i++){ > + BUG_ON(!len); > + > + page = virt_to_page(addr); > + buffer_pfn = page_to_phys(page) >> PAGE_SHIFT; > + offset = offset_in_page(addr); > + > bytes = PAGE_SIZE - offset; > if(bytes > len) > bytes = len; > @@ -123,9 +126,8 @@ static inline void xenhcd_gnttab_map(str > seg[i].offset = (uint16_t)offset; > seg[i].length = (uint16_t)bytes; > > - buffer_pfn++; > + addr += bytes; > len -= bytes; > - offset = 0; > } > } > > > _______________________________________________ > Xen-devel mailing list > Xen-devel@lists.xensource.com > http://lists.xensource.com/xen-devel