2017-11-03 08:18:41 +00:00
|
|
|
// SPDX-License-Identifier: GPL-2.0
|
2005-04-16 22:20:36 +00:00
|
|
|
/*
|
|
|
|
* DMA memory management for framework level HCD code (hc_driver)
|
|
|
|
*
|
|
|
|
* This implementation plugs in through generic "usb_bus" level methods,
|
2014-01-04 05:54:41 +00:00
|
|
|
* and should work with all USB controllers, regardless of bus type.
|
2016-10-28 21:16:36 +00:00
|
|
|
*
|
|
|
|
* Released under the GPLv2 only.
|
2005-04-16 22:20:36 +00:00
|
|
|
*/
|
|
|
|
|
|
|
|
#include <linux/module.h>
|
|
|
|
#include <linux/kernel.h>
|
|
|
|
#include <linux/slab.h>
|
|
|
|
#include <linux/device.h>
|
|
|
|
#include <linux/mm.h>
|
2010-12-25 10:17:01 +00:00
|
|
|
#include <linux/io.h>
|
2005-04-16 22:20:36 +00:00
|
|
|
#include <linux/dma-mapping.h>
|
|
|
|
#include <linux/dmapool.h>
|
2019-05-29 10:28:40 +00:00
|
|
|
#include <linux/genalloc.h>
|
2005-04-16 22:20:36 +00:00
|
|
|
#include <linux/usb.h>
|
2010-04-24 21:21:52 +00:00
|
|
|
#include <linux/usb/hcd.h>
|
2005-04-16 22:20:36 +00:00
|
|
|
|
|
|
|
|
|
|
|
/*
|
|
|
|
* DMA-Coherent Buffers
|
|
|
|
*/
|
|
|
|
|
|
|
|
/* FIXME tune these based on pool statistics ... */
|
2014-12-05 14:13:54 +00:00
|
|
|
static size_t pool_max[HCD_BUFFER_POOLS] = {
|
|
|
|
32, 128, 512, 2048,
|
2005-04-16 22:20:36 +00:00
|
|
|
};
|
|
|
|
|
2014-12-05 14:13:54 +00:00
|
|
|
void __init usb_init_pool_max(void)
|
|
|
|
{
|
|
|
|
/*
|
|
|
|
* The pool_max values must never be smaller than
|
2023-06-12 15:31:51 +00:00
|
|
|
* ARCH_DMA_MINALIGN.
|
2014-12-05 14:13:54 +00:00
|
|
|
*/
|
2023-06-12 15:31:51 +00:00
|
|
|
if (ARCH_DMA_MINALIGN <= 32)
|
2014-12-05 14:13:54 +00:00
|
|
|
; /* Original value is okay */
|
2023-06-12 15:31:51 +00:00
|
|
|
else if (ARCH_DMA_MINALIGN <= 64)
|
2014-12-05 14:13:54 +00:00
|
|
|
pool_max[0] = 64;
|
2023-06-12 15:31:51 +00:00
|
|
|
else if (ARCH_DMA_MINALIGN <= 128)
|
2014-12-05 14:13:54 +00:00
|
|
|
pool_max[0] = 0; /* Don't use this pool */
|
|
|
|
else
|
|
|
|
BUILD_BUG(); /* We don't allow this */
|
|
|
|
}
|
2005-04-16 22:20:36 +00:00
|
|
|
|
|
|
|
/* SETUP primitives */
|
|
|
|
|
|
|
|
/**
|
|
|
|
* hcd_buffer_create - initialize buffer pools
|
|
|
|
* @hcd: the bus whose buffer pools are to be initialized
|
2020-10-19 10:06:41 +00:00
|
|
|
*
|
|
|
|
* Context: task context, might sleep
|
2005-04-16 22:20:36 +00:00
|
|
|
*
|
|
|
|
* Call this as part of initializing a host controller that uses the dma
|
|
|
|
* memory allocators. It initializes some pools of dma-coherent memory that
|
2013-08-02 18:10:04 +00:00
|
|
|
* will be shared by all drivers using that controller.
|
2005-04-16 22:20:36 +00:00
|
|
|
*
|
|
|
|
* Call hcd_buffer_destroy() to clean up after using those pools.
|
2013-08-02 18:10:04 +00:00
|
|
|
*
|
|
|
|
* Return: 0 if successful. A negative errno value otherwise.
|
2005-04-16 22:20:36 +00:00
|
|
|
*/
|
2007-01-25 10:17:41 +00:00
|
|
|
int hcd_buffer_create(struct usb_hcd *hcd)
|
2005-04-16 22:20:36 +00:00
|
|
|
{
|
2007-01-25 10:17:41 +00:00
|
|
|
char name[16];
|
2010-12-25 10:17:01 +00:00
|
|
|
int i, size;
|
2005-04-16 22:20:36 +00:00
|
|
|
|
2019-08-11 08:05:16 +00:00
|
|
|
if (hcd->localmem_pool || !hcd_uses_dma(hcd))
|
2005-11-28 17:29:23 +00:00
|
|
|
return 0;
|
|
|
|
|
2008-01-30 23:21:33 +00:00
|
|
|
for (i = 0; i < HCD_BUFFER_POOLS; i++) {
|
|
|
|
size = pool_max[i];
|
|
|
|
if (!size)
|
2005-04-16 22:20:36 +00:00
|
|
|
continue;
|
2015-04-29 10:49:33 +00:00
|
|
|
snprintf(name, sizeof(name), "buffer-%d", size);
|
2017-03-13 02:18:41 +00:00
|
|
|
hcd->pool[i] = dma_pool_create(name, hcd->self.sysdev,
|
2005-04-16 22:20:36 +00:00
|
|
|
size, size, 0);
|
2010-12-25 10:17:01 +00:00
|
|
|
if (!hcd->pool[i]) {
|
2007-01-25 10:17:41 +00:00
|
|
|
hcd_buffer_destroy(hcd);
|
2005-04-16 22:20:36 +00:00
|
|
|
return -ENOMEM;
|
|
|
|
}
|
|
|
|
}
|
|
|
|
return 0;
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
|
|
/**
|
|
|
|
* hcd_buffer_destroy - deallocate buffer pools
|
|
|
|
* @hcd: the bus whose buffer pools are to be destroyed
|
2020-10-19 10:06:41 +00:00
|
|
|
*
|
|
|
|
* Context: task context, might sleep
|
2005-04-16 22:20:36 +00:00
|
|
|
*
|
|
|
|
* This frees the buffer pools created by hcd_buffer_create().
|
|
|
|
*/
|
2007-01-25 10:17:41 +00:00
|
|
|
void hcd_buffer_destroy(struct usb_hcd *hcd)
|
2005-04-16 22:20:36 +00:00
|
|
|
{
|
2008-01-30 23:21:33 +00:00
|
|
|
int i;
|
2005-04-16 22:20:36 +00:00
|
|
|
|
2016-02-16 15:10:57 +00:00
|
|
|
if (!IS_ENABLED(CONFIG_HAS_DMA))
|
|
|
|
return;
|
|
|
|
|
2008-01-30 23:21:33 +00:00
|
|
|
for (i = 0; i < HCD_BUFFER_POOLS; i++) {
|
2018-08-06 04:28:08 +00:00
|
|
|
dma_pool_destroy(hcd->pool[i]);
|
|
|
|
hcd->pool[i] = NULL;
|
2005-04-16 22:20:36 +00:00
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
|
2006-12-07 04:33:19 +00:00
|
|
|
/* sometimes alloc/free could use kmalloc with GFP_DMA, for
|
2005-04-16 22:20:36 +00:00
|
|
|
* better sharing and to leverage mm/slab.c intelligence.
|
|
|
|
*/
|
|
|
|
|
2007-01-25 10:17:41 +00:00
|
|
|
void *hcd_buffer_alloc(
|
2010-12-25 10:17:01 +00:00
|
|
|
struct usb_bus *bus,
|
2005-04-16 22:20:36 +00:00
|
|
|
size_t size,
|
2005-10-21 07:21:58 +00:00
|
|
|
gfp_t mem_flags,
|
2005-04-16 22:20:36 +00:00
|
|
|
dma_addr_t *dma
|
|
|
|
)
|
|
|
|
{
|
2006-08-30 15:32:52 +00:00
|
|
|
struct usb_hcd *hcd = bus_to_hcd(bus);
|
2010-12-25 10:17:01 +00:00
|
|
|
int i;
|
2005-04-16 22:20:36 +00:00
|
|
|
|
2016-04-28 03:42:20 +00:00
|
|
|
if (size == 0)
|
|
|
|
return NULL;
|
|
|
|
|
2019-05-29 10:28:40 +00:00
|
|
|
if (hcd->localmem_pool)
|
|
|
|
return gen_pool_dma_alloc(hcd->localmem_pool, size, dma);
|
|
|
|
|
2005-04-16 22:20:36 +00:00
|
|
|
/* some USB hosts just use PIO */
|
2019-08-11 08:05:16 +00:00
|
|
|
if (!hcd_uses_dma(hcd)) {
|
2005-04-16 22:20:36 +00:00
|
|
|
*dma = ~(dma_addr_t) 0;
|
2007-01-25 10:17:41 +00:00
|
|
|
return kmalloc(size, mem_flags);
|
2005-04-16 22:20:36 +00:00
|
|
|
}
|
|
|
|
|
|
|
|
for (i = 0; i < HCD_BUFFER_POOLS; i++) {
|
2010-12-25 10:17:01 +00:00
|
|
|
if (size <= pool_max[i])
|
|
|
|
return dma_pool_alloc(hcd->pool[i], mem_flags, dma);
|
2005-04-16 22:20:36 +00:00
|
|
|
}
|
2017-03-13 02:18:41 +00:00
|
|
|
return dma_alloc_coherent(hcd->self.sysdev, size, dma, mem_flags);
|
2005-04-16 22:20:36 +00:00
|
|
|
}
|
|
|
|
|
2007-01-25 10:17:41 +00:00
|
|
|
void hcd_buffer_free(
|
2010-12-25 10:17:01 +00:00
|
|
|
struct usb_bus *bus,
|
2005-04-16 22:20:36 +00:00
|
|
|
size_t size,
|
2010-12-25 10:17:01 +00:00
|
|
|
void *addr,
|
2005-04-16 22:20:36 +00:00
|
|
|
dma_addr_t dma
|
|
|
|
)
|
|
|
|
{
|
2006-08-30 15:32:52 +00:00
|
|
|
struct usb_hcd *hcd = bus_to_hcd(bus);
|
2010-12-25 10:17:01 +00:00
|
|
|
int i;
|
2005-04-16 22:20:36 +00:00
|
|
|
|
|
|
|
if (!addr)
|
|
|
|
return;
|
|
|
|
|
2019-05-29 10:28:40 +00:00
|
|
|
if (hcd->localmem_pool) {
|
|
|
|
gen_pool_free(hcd->localmem_pool, (unsigned long)addr, size);
|
|
|
|
return;
|
|
|
|
}
|
|
|
|
|
2019-08-11 08:05:16 +00:00
|
|
|
if (!hcd_uses_dma(hcd)) {
|
2007-01-25 10:17:41 +00:00
|
|
|
kfree(addr);
|
2005-04-16 22:20:36 +00:00
|
|
|
return;
|
|
|
|
}
|
|
|
|
|
|
|
|
for (i = 0; i < HCD_BUFFER_POOLS; i++) {
|
2010-12-25 10:17:01 +00:00
|
|
|
if (size <= pool_max[i]) {
|
|
|
|
dma_pool_free(hcd->pool[i], addr, dma);
|
2005-04-16 22:20:36 +00:00
|
|
|
return;
|
|
|
|
}
|
|
|
|
}
|
2017-03-13 02:18:41 +00:00
|
|
|
dma_free_coherent(hcd->self.sysdev, size, addr, dma);
|
2005-04-16 22:20:36 +00:00
|
|
|
}
|
usb: usbfs: Enforce page requirements for mmap
JIRA: https://issues.redhat.com/browse/RHEL-13058
commit 0143d148d1e882fb1538dc9974c94d63961719b9
Author: Ruihan Li <lrh2000@pku.edu.cn>
Date: Mon, 15 May 2023 21:09:55 +0800
The current implementation of usbdev_mmap uses usb_alloc_coherent to
allocate memory pages that will later be mapped into the user space.
Meanwhile, usb_alloc_coherent employs three different methods to
allocate memory, as outlined below:
* If hcd->localmem_pool is non-null, it uses gen_pool_dma_alloc to
allocate memory;
* If DMA is not available, it uses kmalloc to allocate memory;
* Otherwise, it uses dma_alloc_coherent.
However, it should be noted that gen_pool_dma_alloc does not guarantee
that the resulting memory will be page-aligned. Furthermore, trying to
map slab pages (i.e., memory allocated by kmalloc) into the user space
is not resonable and can lead to problems, such as a type confusion bug
when PAGE_TABLE_CHECK=y [1].
To address these issues, this patch introduces hcd_alloc_coherent_pages,
which addresses the above two problems. Specifically,
hcd_alloc_coherent_pages uses gen_pool_dma_alloc_align instead of
gen_pool_dma_alloc to ensure that the memory is page-aligned. To replace
kmalloc, hcd_alloc_coherent_pages directly allocates pages by calling
__get_free_pages.
Reported-by: syzbot+fcf1a817ceb50935ce99@syzkaller.appspotmail.comm
Closes: https://lore.kernel.org/lkml/000000000000258e5e05fae79fc1@google.com/ [1]
Fixes: f7d34b445abc ("USB: Add support for usbfs zerocopy.")
Fixes: ff2437befd8f ("usb: host: Fix excessive alignment restriction for local memory allocations")
Cc: stable@vger.kernel.org
Signed-off-by: Ruihan Li <lrh2000@pku.edu.cn>
Acked-by: Alan Stern <stern@rowland.harvard.edu>
Link: https://lore.kernel.org/r/20230515130958.32471-2-lrh2000@pku.edu.cn
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Desnes Nunes <desnesn@redhat.com>
2023-10-27 13:39:52 +00:00
|
|
|
|
|
|
|
void *hcd_buffer_alloc_pages(struct usb_hcd *hcd,
|
|
|
|
size_t size, gfp_t mem_flags, dma_addr_t *dma)
|
|
|
|
{
|
|
|
|
if (size == 0)
|
|
|
|
return NULL;
|
|
|
|
|
|
|
|
if (hcd->localmem_pool)
|
|
|
|
return gen_pool_dma_alloc_align(hcd->localmem_pool,
|
|
|
|
size, dma, PAGE_SIZE);
|
|
|
|
|
|
|
|
/* some USB hosts just use PIO */
|
|
|
|
if (!hcd_uses_dma(hcd)) {
|
|
|
|
*dma = DMA_MAPPING_ERROR;
|
|
|
|
return (void *)__get_free_pages(mem_flags,
|
|
|
|
get_order(size));
|
|
|
|
}
|
|
|
|
|
|
|
|
return dma_alloc_coherent(hcd->self.sysdev,
|
|
|
|
size, dma, mem_flags);
|
|
|
|
}
|
|
|
|
|
|
|
|
void hcd_buffer_free_pages(struct usb_hcd *hcd,
|
|
|
|
size_t size, void *addr, dma_addr_t dma)
|
|
|
|
{
|
|
|
|
if (!addr)
|
|
|
|
return;
|
|
|
|
|
|
|
|
if (hcd->localmem_pool) {
|
|
|
|
gen_pool_free(hcd->localmem_pool,
|
|
|
|
(unsigned long)addr, size);
|
|
|
|
return;
|
|
|
|
}
|
|
|
|
|
|
|
|
if (!hcd_uses_dma(hcd)) {
|
|
|
|
free_pages((unsigned long)addr, get_order(size));
|
|
|
|
return;
|
|
|
|
}
|
|
|
|
|
|
|
|
dma_free_coherent(hcd->self.sysdev, size, addr, dma);
|
|
|
|
}
|