1.1 --- a/xen/arch/ia64/vmx/mmio.c	Thu Nov 01 09:07:16 2007 -0600
     1.2 +++ b/xen/arch/ia64/vmx/mmio.c	Thu Nov 01 10:30:12 2007 -0600
     1.3 @@ -58,13 +58,14 @@ static int hvm_buffered_io_intercept(ior
     1.4      buffered_iopage_t *pg =
     1.5          (buffered_iopage_t *)(v->domain->arch.hvm_domain.buffered_io_va);
     1.6      buf_ioreq_t bp;
     1.7 -    int i;
     1.8 +    int i, qw = 0;
     1.9  
    1.10      /* Ensure buffered_iopage fits in a page */
    1.11      BUILD_BUG_ON(sizeof(buffered_iopage_t) > PAGE_SIZE);
    1.12  
    1.13 -    /* ignore READ ioreq_t! */
    1.14 -    if (p->dir == IOREQ_READ)
    1.15 +    /* ignore READ ioreq_t and anything buffered io can't deal with */
    1.16 +    if (p->dir == IOREQ_READ || p->addr > 0xFFFFFUL ||
    1.17 +        p->data_is_ptr || p->df || p->count != 1)
    1.18          return 0;
    1.19  
    1.20      for (i = 0; i < HVM_BUFFERED_IO_RANGE_NR; i++) {
    1.21 @@ -86,17 +87,23 @@ static int hvm_buffered_io_intercept(ior
    1.22      case 2:
    1.23          bp.size = 1;
    1.24          break;
    1.25 +    case 4:
    1.26 +        bp.size = 2;
    1.27 +        break;
    1.28 +    case 8:
    1.29 +        bp.size = 3;
    1.30 +        qw = 1;
    1.31 +        break;
    1.32      default:
    1.33 -	/* Could use quad word semantics, but it only appears
    1.34 -	 * to be useful for timeoffset data. */
    1.35 +        gdprintk(XENLOG_WARNING, "unexpected ioreq size:%"PRId64"\n", p->size);
    1.36          return 0;
    1.37      }
    1.38 -    bp.data = (uint16_t)p->data;
    1.39 -    bp.addr = (uint32_t)p->addr;
    1.40 +    bp.data = p->data;
    1.41 +    bp.addr = p->addr;
    1.42  
    1.43      spin_lock(&v->domain->arch.hvm_domain.buffered_io_lock);
    1.44  
    1.45 -    if (pg->write_pointer - pg->read_pointer == IOREQ_BUFFER_SLOT_NUM) {
    1.46 +    if (pg->write_pointer - pg->read_pointer >= IOREQ_BUFFER_SLOT_NUM - qw) {
    1.47          /* the queue is full.
    1.48           * send the iopacket through the normal path.
    1.49           * NOTE: The arithimetic operation could handle the situation for
    1.50 @@ -109,9 +116,15 @@ static int hvm_buffered_io_intercept(ior
    1.51      memcpy(&pg->buf_ioreq[pg->write_pointer % IOREQ_BUFFER_SLOT_NUM],
    1.52             &bp, sizeof(bp));
    1.53  
    1.54 +    if (qw) {
    1.55 +        bp.data = p->data >> 32;
    1.56 +        memcpy(&pg->buf_ioreq[(pg->write_pointer + 1) % IOREQ_BUFFER_SLOT_NUM],
    1.57 +               &bp, sizeof(bp));
    1.58 +    }
    1.59 +
    1.60      /* Make the ioreq_t visible before write_pointer */
    1.61      wmb();
    1.62 -    pg->write_pointer++;
    1.63 +    pg->write_pointer += qw ? 2 : 1;
    1.64  
    1.65      spin_unlock(&v->domain->arch.hvm_domain.buffered_io_lock);
    1.66