2017-11-03 01:18:41 -07:00
|
|
|
// SPDX-License-Identifier: GPL-2.0
|
2005-04-16 15:20:36 -07:00
|
|
|
/*
|
|
|
|
* DMA memory management for framework level HCD code (hc_driver)
|
|
|
|
*
|
|
|
|
* This implementation plugs in through generic "usb_bus" level methods,
|
2014-01-03 22:54:41 -07:00
|
|
|
* and should work with all USB controllers, regardless of bus type.
|
2016-10-28 14:16:36 -07:00
|
|
|
*
|
|
|
|
* Released under the GPLv2 only.
|
2005-04-16 15:20:36 -07:00
|
|
|
*/
|
|
|
|
|
|
|
|
#include <linux/module.h>
|
|
|
|
#include <linux/kernel.h>
|
|
|
|
#include <linux/slab.h>
|
|
|
|
#include <linux/device.h>
|
|
|
|
#include <linux/mm.h>
|
2010-12-25 03:17:01 -07:00
|
|
|
#include <linux/io.h>
|
2005-04-16 15:20:36 -07:00
|
|
|
#include <linux/dma-mapping.h>
|
|
|
|
#include <linux/dmapool.h>
|
2019-05-29 03:28:40 -07:00
|
|
|
#include <linux/genalloc.h>
|
2005-04-16 15:20:36 -07:00
|
|
|
#include <linux/usb.h>
|
2010-04-24 14:21:52 -07:00
|
|
|
#include <linux/usb/hcd.h>
|
2005-04-16 15:20:36 -07:00
|
|
|
|
|
|
|
|
|
|
|
/*
|
|
|
|
* DMA-Coherent Buffers
|
|
|
|
*/
|
|
|
|
|
|
|
|
/* FIXME tune these based on pool statistics ... */
|
2014-12-05 07:13:54 -07:00
|
|
|
static size_t pool_max[HCD_BUFFER_POOLS] = {
|
|
|
|
32, 128, 512, 2048,
|
2005-04-16 15:20:36 -07:00
|
|
|
};
|
|
|
|
|
2014-12-05 07:13:54 -07:00
|
|
|
void __init usb_init_pool_max(void)
|
|
|
|
{
|
|
|
|
/*
|
|
|
|
* The pool_max values must never be smaller than
|
2023-06-12 08:31:51 -07:00
|
|
|
* ARCH_DMA_MINALIGN.
|
2014-12-05 07:13:54 -07:00
|
|
|
*/
|
2023-06-12 08:31:51 -07:00
|
|
|
if (ARCH_DMA_MINALIGN <= 32)
|
2014-12-05 07:13:54 -07:00
|
|
|
; /* Original value is okay */
|
2023-06-12 08:31:51 -07:00
|
|
|
else if (ARCH_DMA_MINALIGN <= 64)
|
2014-12-05 07:13:54 -07:00
|
|
|
pool_max[0] = 64;
|
2023-06-12 08:31:51 -07:00
|
|
|
else if (ARCH_DMA_MINALIGN <= 128)
|
2014-12-05 07:13:54 -07:00
|
|
|
pool_max[0] = 0; /* Don't use this pool */
|
|
|
|
else
|
|
|
|
BUILD_BUG(); /* We don't allow this */
|
|
|
|
}
|
2005-04-16 15:20:36 -07:00
|
|
|
|
|
|
|
/* SETUP primitives */
|
|
|
|
|
|
|
|
/**
|
|
|
|
* hcd_buffer_create - initialize buffer pools
|
|
|
|
* @hcd: the bus whose buffer pools are to be initialized
|
2020-10-19 03:06:41 -07:00
|
|
|
*
|
|
|
|
* Context: task context, might sleep
|
2005-04-16 15:20:36 -07:00
|
|
|
*
|
|
|
|
* Call this as part of initializing a host controller that uses the dma
|
|
|
|
* memory allocators. It initializes some pools of dma-coherent memory that
|
2013-08-02 11:10:04 -07:00
|
|
|
* will be shared by all drivers using that controller.
|
2005-04-16 15:20:36 -07:00
|
|
|
*
|
|
|
|
* Call hcd_buffer_destroy() to clean up after using those pools.
|
2013-08-02 11:10:04 -07:00
|
|
|
*
|
|
|
|
* Return: 0 if successful. A negative errno value otherwise.
|
2005-04-16 15:20:36 -07:00
|
|
|
*/
|
2007-01-25 03:17:41 -07:00
|
|
|
int hcd_buffer_create(struct usb_hcd *hcd)
|
2005-04-16 15:20:36 -07:00
|
|
|
{
|
2007-01-25 03:17:41 -07:00
|
|
|
char name[16];
|
2010-12-25 03:17:01 -07:00
|
|
|
int i, size;
|
2005-04-16 15:20:36 -07:00
|
|
|
|
2019-08-11 01:05:16 -07:00
|
|
|
if (hcd->localmem_pool || !hcd_uses_dma(hcd))
|
2005-11-28 10:29:23 -07:00
|
|
|
return 0;
|
|
|
|
|
2008-01-30 16:21:33 -07:00
|
|
|
for (i = 0; i < HCD_BUFFER_POOLS; i++) {
|
|
|
|
size = pool_max[i];
|
|
|
|
if (!size)
|
2005-04-16 15:20:36 -07:00
|
|
|
continue;
|
2015-04-29 03:49:33 -07:00
|
|
|
snprintf(name, sizeof(name), "buffer-%d", size);
|
2017-03-12 19:18:41 -07:00
|
|
|
hcd->pool[i] = dma_pool_create(name, hcd->self.sysdev,
|
2005-04-16 15:20:36 -07:00
|
|
|
size, size, 0);
|
2010-12-25 03:17:01 -07:00
|
|
|
if (!hcd->pool[i]) {
|
2007-01-25 03:17:41 -07:00
|
|
|
hcd_buffer_destroy(hcd);
|
2005-04-16 15:20:36 -07:00
|
|
|
return -ENOMEM;
|
|
|
|
}
|
|
|
|
}
|
|
|
|
return 0;
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
|
|
/**
|
|
|
|
* hcd_buffer_destroy - deallocate buffer pools
|
|
|
|
* @hcd: the bus whose buffer pools are to be destroyed
|
2020-10-19 03:06:41 -07:00
|
|
|
*
|
|
|
|
* Context: task context, might sleep
|
2005-04-16 15:20:36 -07:00
|
|
|
*
|
|
|
|
* This frees the buffer pools created by hcd_buffer_create().
|
|
|
|
*/
|
2007-01-25 03:17:41 -07:00
|
|
|
void hcd_buffer_destroy(struct usb_hcd *hcd)
|
2005-04-16 15:20:36 -07:00
|
|
|
{
|
2008-01-30 16:21:33 -07:00
|
|
|
int i;
|
2005-04-16 15:20:36 -07:00
|
|
|
|
2016-02-16 08:10:57 -07:00
|
|
|
if (!IS_ENABLED(CONFIG_HAS_DMA))
|
|
|
|
return;
|
|
|
|
|
2008-01-30 16:21:33 -07:00
|
|
|
for (i = 0; i < HCD_BUFFER_POOLS; i++) {
|
2018-08-05 21:28:08 -07:00
|
|
|
dma_pool_destroy(hcd->pool[i]);
|
|
|
|
hcd->pool[i] = NULL;
|
2005-04-16 15:20:36 -07:00
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
|
2006-12-06 21:33:19 -07:00
|
|
|
/* sometimes alloc/free could use kmalloc with GFP_DMA, for
|
2005-04-16 15:20:36 -07:00
|
|
|
* better sharing and to leverage mm/slab.c intelligence.
|
|
|
|
*/
|
|
|
|
|
2007-01-25 03:17:41 -07:00
|
|
|
void *hcd_buffer_alloc(
|
2010-12-25 03:17:01 -07:00
|
|
|
struct usb_bus *bus,
|
2005-04-16 15:20:36 -07:00
|
|
|
size_t size,
|
2005-10-21 00:21:58 -07:00
|
|
|
gfp_t mem_flags,
|
2005-04-16 15:20:36 -07:00
|
|
|
dma_addr_t *dma
|
|
|
|
)
|
|
|
|
{
|
2006-08-30 08:32:52 -07:00
|
|
|
struct usb_hcd *hcd = bus_to_hcd(bus);
|
2010-12-25 03:17:01 -07:00
|
|
|
int i;
|
2005-04-16 15:20:36 -07:00
|
|
|
|
2016-04-27 20:42:20 -07:00
|
|
|
if (size == 0)
|
|
|
|
return NULL;
|
|
|
|
|
2019-05-29 03:28:40 -07:00
|
|
|
if (hcd->localmem_pool)
|
|
|
|
return gen_pool_dma_alloc(hcd->localmem_pool, size, dma);
|
|
|
|
|
2005-04-16 15:20:36 -07:00
|
|
|
/* some USB hosts just use PIO */
|
2019-08-11 01:05:16 -07:00
|
|
|
if (!hcd_uses_dma(hcd)) {
|
2005-04-16 15:20:36 -07:00
|
|
|
*dma = ~(dma_addr_t) 0;
|
2007-01-25 03:17:41 -07:00
|
|
|
return kmalloc(size, mem_flags);
|
2005-04-16 15:20:36 -07:00
|
|
|
}
|
|
|
|
|
|
|
|
for (i = 0; i < HCD_BUFFER_POOLS; i++) {
|
2010-12-25 03:17:01 -07:00
|
|
|
if (size <= pool_max[i])
|
|
|
|
return dma_pool_alloc(hcd->pool[i], mem_flags, dma);
|
2005-04-16 15:20:36 -07:00
|
|
|
}
|
2017-03-12 19:18:41 -07:00
|
|
|
return dma_alloc_coherent(hcd->self.sysdev, size, dma, mem_flags);
|
2005-04-16 15:20:36 -07:00
|
|
|
}
|
|
|
|
|
2007-01-25 03:17:41 -07:00
|
|
|
void hcd_buffer_free(
|
2010-12-25 03:17:01 -07:00
|
|
|
struct usb_bus *bus,
|
2005-04-16 15:20:36 -07:00
|
|
|
size_t size,
|
2010-12-25 03:17:01 -07:00
|
|
|
void *addr,
|
2005-04-16 15:20:36 -07:00
|
|
|
dma_addr_t dma
|
|
|
|
)
|
|
|
|
{
|
2006-08-30 08:32:52 -07:00
|
|
|
struct usb_hcd *hcd = bus_to_hcd(bus);
|
2010-12-25 03:17:01 -07:00
|
|
|
int i;
|
2005-04-16 15:20:36 -07:00
|
|
|
|
|
|
|
if (!addr)
|
|
|
|
return;
|
|
|
|
|
2019-05-29 03:28:40 -07:00
|
|
|
if (hcd->localmem_pool) {
|
|
|
|
gen_pool_free(hcd->localmem_pool, (unsigned long)addr, size);
|
|
|
|
return;
|
|
|
|
}
|
|
|
|
|
2019-08-11 01:05:16 -07:00
|
|
|
if (!hcd_uses_dma(hcd)) {
|
2007-01-25 03:17:41 -07:00
|
|
|
kfree(addr);
|
2005-04-16 15:20:36 -07:00
|
|
|
return;
|
|
|
|
}
|
|
|
|
|
|
|
|
for (i = 0; i < HCD_BUFFER_POOLS; i++) {
|
2010-12-25 03:17:01 -07:00
|
|
|
if (size <= pool_max[i]) {
|
|
|
|
dma_pool_free(hcd->pool[i], addr, dma);
|
2005-04-16 15:20:36 -07:00
|
|
|
return;
|
|
|
|
}
|
|
|
|
}
|
2017-03-12 19:18:41 -07:00
|
|
|
dma_free_coherent(hcd->self.sysdev, size, addr, dma);
|
2005-04-16 15:20:36 -07:00
|
|
|
}
|
usb: usbfs: Enforce page requirements for mmap
The current implementation of usbdev_mmap uses usb_alloc_coherent to
allocate memory pages that will later be mapped into the user space.
Meanwhile, usb_alloc_coherent employs three different methods to
allocate memory, as outlined below:
* If hcd->localmem_pool is non-null, it uses gen_pool_dma_alloc to
allocate memory;
* If DMA is not available, it uses kmalloc to allocate memory;
* Otherwise, it uses dma_alloc_coherent.
However, it should be noted that gen_pool_dma_alloc does not guarantee
that the resulting memory will be page-aligned. Furthermore, trying to
map slab pages (i.e., memory allocated by kmalloc) into the user space
is not resonable and can lead to problems, such as a type confusion bug
when PAGE_TABLE_CHECK=y [1].
To address these issues, this patch introduces hcd_alloc_coherent_pages,
which addresses the above two problems. Specifically,
hcd_alloc_coherent_pages uses gen_pool_dma_alloc_align instead of
gen_pool_dma_alloc to ensure that the memory is page-aligned. To replace
kmalloc, hcd_alloc_coherent_pages directly allocates pages by calling
__get_free_pages.
Reported-by: syzbot+fcf1a817ceb50935ce99@syzkaller.appspotmail.comm
Closes: https://lore.kernel.org/lkml/000000000000258e5e05fae79fc1@google.com/ [1]
Fixes: f7d34b445abc ("USB: Add support for usbfs zerocopy.")
Fixes: ff2437befd8f ("usb: host: Fix excessive alignment restriction for local memory allocations")
Cc: stable@vger.kernel.org
Signed-off-by: Ruihan Li <lrh2000@pku.edu.cn>
Acked-by: Alan Stern <stern@rowland.harvard.edu>
Link: https://lore.kernel.org/r/20230515130958.32471-2-lrh2000@pku.edu.cn
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2023-05-15 06:09:55 -07:00
|
|
|
|
|
|
|
void *hcd_buffer_alloc_pages(struct usb_hcd *hcd,
|
|
|
|
size_t size, gfp_t mem_flags, dma_addr_t *dma)
|
|
|
|
{
|
|
|
|
if (size == 0)
|
|
|
|
return NULL;
|
|
|
|
|
|
|
|
if (hcd->localmem_pool)
|
|
|
|
return gen_pool_dma_alloc_align(hcd->localmem_pool,
|
|
|
|
size, dma, PAGE_SIZE);
|
|
|
|
|
|
|
|
/* some USB hosts just use PIO */
|
|
|
|
if (!hcd_uses_dma(hcd)) {
|
|
|
|
*dma = DMA_MAPPING_ERROR;
|
|
|
|
return (void *)__get_free_pages(mem_flags,
|
|
|
|
get_order(size));
|
|
|
|
}
|
|
|
|
|
|
|
|
return dma_alloc_coherent(hcd->self.sysdev,
|
|
|
|
size, dma, mem_flags);
|
|
|
|
}
|
|
|
|
|
|
|
|
void hcd_buffer_free_pages(struct usb_hcd *hcd,
|
|
|
|
size_t size, void *addr, dma_addr_t dma)
|
|
|
|
{
|
|
|
|
if (!addr)
|
|
|
|
return;
|
|
|
|
|
|
|
|
if (hcd->localmem_pool) {
|
|
|
|
gen_pool_free(hcd->localmem_pool,
|
|
|
|
(unsigned long)addr, size);
|
|
|
|
return;
|
|
|
|
}
|
|
|
|
|
|
|
|
if (!hcd_uses_dma(hcd)) {
|
|
|
|
free_pages((unsigned long)addr, get_order(size));
|
|
|
|
return;
|
|
|
|
}
|
|
|
|
|
|
|
|
dma_free_coherent(hcd->self.sysdev, size, addr, dma);
|
|
|
|
}
|