From owner-svn-src-user@FreeBSD.ORG  Tue Sep 21 23:25:38 2010
Return-Path: <owner-svn-src-user@FreeBSD.ORG>
Delivered-To: svn-src-user@freebsd.org
Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:4f8:fff6::34])
	by hub.freebsd.org (Postfix) with ESMTP id CFCBD106564A;
	Tue, 21 Sep 2010 23:25:38 +0000 (UTC)
	(envelope-from weongyo@FreeBSD.org)
Received: from svn.freebsd.org (svn.freebsd.org [IPv6:2001:4f8:fff6::2c])
	by mx1.freebsd.org (Postfix) with ESMTP id BF2E78FC13;
	Tue, 21 Sep 2010 23:25:38 +0000 (UTC)
Received: from svn.freebsd.org (localhost [127.0.0.1])
	by svn.freebsd.org (8.14.3/8.14.3) with ESMTP id o8LNPcLw009816;
	Tue, 21 Sep 2010 23:25:38 GMT (envelope-from weongyo@svn.freebsd.org)
Received: (from weongyo@localhost)
	by svn.freebsd.org (8.14.3/8.14.3/Submit) id o8LNPcbO009813;
	Tue, 21 Sep 2010 23:25:38 GMT (envelope-from weongyo@svn.freebsd.org)
Message-Id: <201009212325.o8LNPcbO009813@svn.freebsd.org>
From: Weongyo Jeong <weongyo@FreeBSD.org>
Date: Tue, 21 Sep 2010 23:25:38 +0000 (UTC)
To: src-committers@freebsd.org, svn-src-user@freebsd.org
X-SVN-Group: user
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
Cc: 
Subject: svn commit: r212982 - user/weongyo/usb/sys/dev/usb
X-BeenThere: svn-src-user@freebsd.org
X-Mailman-Version: 2.1.5
Precedence: list
List-Id: "SVN commit messages for the experimental &quot; user&quot;
	src tree" <svn-src-user.freebsd.org>
List-Unsubscribe: <http://lists.freebsd.org/mailman/listinfo/svn-src-user>,
	<mailto:svn-src-user-request@freebsd.org?subject=unsubscribe>
List-Archive: <http://lists.freebsd.org/pipermail/svn-src-user>
List-Post: <mailto:svn-src-user@freebsd.org>
List-Help: <mailto:svn-src-user-request@freebsd.org?subject=help>
List-Subscribe: <http://lists.freebsd.org/mailman/listinfo/svn-src-user>,
	<mailto:svn-src-user-request@freebsd.org?subject=subscribe>
X-List-Received-Date: Tue, 21 Sep 2010 23:25:38 -0000

Author: weongyo
Date: Tue Sep 21 23:25:38 2010
New Revision: 212982
URL: http://svn.freebsd.org/changeset/base/212982

Log:
  Records the length of DMA physical buffer also that it looks handling
  the DMA segments is completely wrong because there are no any places to
  check the DMA buffer length in USB stack.  It means some physical
  address are overwrited by invalid USB transfers.

Modified:
  user/weongyo/usb/sys/dev/usb/usb_busdma.c
  user/weongyo/usb/sys/dev/usb/usb_busdma.h

Modified: user/weongyo/usb/sys/dev/usb/usb_busdma.c
==============================================================================
--- user/weongyo/usb/sys/dev/usb/usb_busdma.c	Tue Sep 21 23:08:12 2010	(r212981)
+++ user/weongyo/usb/sys/dev/usb/usb_busdma.c	Tue Sep 21 23:25:38 2010	(r212982)
@@ -434,6 +434,7 @@ usb_pc_common_mem_cb(void *arg, bus_dma_
 
 	pg = pc->pages;
 	pg->physaddr = segs[0].ds_addr & ~(USB_PAGE_SIZE - 1);
+	pg->physlen = segs[0].ds_len;
 	rem = segs[0].ds_addr & (USB_PAGE_SIZE - 1);
 	pc->page_offset_buf = rem;
 	pc->page_offset_end += rem;
@@ -447,8 +448,10 @@ usb_pc_common_mem_cb(void *arg, bus_dma_
 		goto done;
 	}
 #endif
-	for (i = 1; i < nseg; i++)
+	for (i = 1; i < nseg; i++) {
 		pg[i].physaddr = segs[i].ds_addr & ~(USB_PAGE_SIZE - 1);
+		pg[i].physlen = segs[i].ds_len;
+	}
 done:
 	uptag->dma_error = (error ? 1 : 0);
 	if (isload)

Modified: user/weongyo/usb/sys/dev/usb/usb_busdma.h
==============================================================================
--- user/weongyo/usb/sys/dev/usb/usb_busdma.h	Tue Sep 21 23:08:12 2010	(r212981)
+++ user/weongyo/usb/sys/dev/usb/usb_busdma.h	Tue Sep 21 23:25:38 2010	(r212982)
@@ -61,6 +61,7 @@ typedef void (usb_dma_callback_t)(struct
 struct usb_page {
 #if USB_HAVE_BUSDMA
 	bus_addr_t physaddr;
+	bus_size_t physlen;
 	void   *buffer;			/* non Kernel Virtual Address */
 #endif
 };