From patchwork Thu Aug 15 08:19:17 2024 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Massimiliano Pellizzer X-Patchwork-Id: 1972687 Return-Path: X-Original-To: incoming@patchwork.ozlabs.org Delivered-To: patchwork-incoming@legolas.ozlabs.org Authentication-Results: legolas.ozlabs.org; spf=pass (sender SPF authorized) smtp.mailfrom=lists.ubuntu.com (client-ip=185.125.189.65; helo=lists.ubuntu.com; envelope-from=kernel-team-bounces@lists.ubuntu.com; receiver=patchwork.ozlabs.org) Received: from lists.ubuntu.com (lists.ubuntu.com [185.125.189.65]) (using TLSv1.2 with cipher ECDHE-ECDSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by legolas.ozlabs.org (Postfix) with ESMTPS id 4WkyjR56MCz1yYl for ; Thu, 15 Aug 2024 18:20:11 +1000 (AEST) Received: from localhost ([127.0.0.1] helo=lists.ubuntu.com) by lists.ubuntu.com with esmtp (Exim 4.86_2) (envelope-from ) id 1seViH-0005yV-Uf; Thu, 15 Aug 2024 08:20:05 +0000 Received: from smtp-relay-internal-1.internal ([10.131.114.114] helo=smtp-relay-internal-1.canonical.com) by lists.ubuntu.com with esmtps (TLS1.2:ECDHE_RSA_AES_128_GCM_SHA256:128) (Exim 4.86_2) (envelope-from ) id 1seViB-0005tx-Cm for kernel-team@lists.ubuntu.com; Thu, 15 Aug 2024 08:19:59 +0000 Received: from mail-ej1-f69.google.com (mail-ej1-f69.google.com [209.85.218.69]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by smtp-relay-internal-1.canonical.com (Postfix) with ESMTPS id 3DECB3F162 for ; Thu, 15 Aug 2024 08:19:59 +0000 (UTC) Received: by mail-ej1-f69.google.com with SMTP id a640c23a62f3a-a7d63fbf4afso81359566b.2 for ; Thu, 15 Aug 2024 01:19:59 -0700 (PDT) X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1723709998; x=1724314798; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:x-gm-message-state:from:to:cc :subject:date:message-id:reply-to; bh=uRW4c3f95JqukmlyFrjk71TTTaNjJE0ZO3Ck8ef87yM=; b=l1uOAdC0MrO38L3MOuirygxF/3aI9UjjHn3pSULoyrC59UMNfj/KzAjpk83tBgua4c 3EDDoe8c4BHkOb+IOtg0MDwnakq24E7u3vlXcCPwY5Ib99dUYhpHars4cSmDMtwJ1sCg 5YF15au3Q/8XSABNC6LiKbKjCKIMufCGxB8nnSNJ7xMRfpYiN0/GrMydTDcAMatp3MMd 5HhAjYu5VCBejwEhMThw5NRYq7oxn0nqNVggjyuMe+GO/m4ImahIkTq9wVIjWi0FTijr qpKStlxBg/5+ViHhSy1oGVcKxlq0rjIkSkBzX5IHZFxtieZPj+6kDSGypqAmptcJssuz +2sA== X-Gm-Message-State: AOJu0YwAUmL/D4IQw9E/coWHXgA2ockG8iX+wir6gSJ4olDE1HCtZpZJ 9wFtcXwVhydR0TV6SMDjOK/9BllEgliFm209CSp7n4s1ZOu0Zyl8kmm0rhUr4ekYa++r/8ckmW8 SBGh11ISuD6v1nRWlfBBB0+gj4qE5m/dr62eMnO/e7X+P6nVVqAaMECryx4/HRIaDm0fohoSri6 LSCwmy60vTBQ== X-Received: by 2002:a17:907:f15e:b0:a7a:a3f7:389d with SMTP id a640c23a62f3a-a8366d6aadbmr381089666b.31.1723709998591; Thu, 15 Aug 2024 01:19:58 -0700 (PDT) X-Google-Smtp-Source: AGHT+IE6A+OC9IuQb1rXOGJo7lELW7yttqz0+h1u8eEJsUpmrUh8Q+H1Tp0IETQh9eBxnrpCR22xoA== X-Received: by 2002:a17:907:f15e:b0:a7a:a3f7:389d with SMTP id a640c23a62f3a-a8366d6aadbmr381087266b.31.1723709998037; Thu, 15 Aug 2024 01:19:58 -0700 (PDT) Received: from framework-canonical.buildd (host-87-2-18-190.retail.telecomitalia.it. [87.2.18.190]) by smtp.gmail.com with ESMTPSA id a640c23a62f3a-a83838cef1esm64396366b.48.2024.08.15.01.19.57 for (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Thu, 15 Aug 2024 01:19:57 -0700 (PDT) From: Massimiliano Pellizzer To: kernel-team@lists.ubuntu.com Subject: [SRU][F][PATCH v2 1/3] mmc: mmci_sdmmc: Rename sdmmc_priv struct to sdmmc_idma Date: Thu, 15 Aug 2024 10:19:17 +0200 Message-ID: <20240815081951.10261-2-massimiliano.pellizzer@canonical.com> X-Mailer: git-send-email 2.43.0 In-Reply-To: <20240815081951.10261-1-massimiliano.pellizzer@canonical.com> References: <20240815081951.10261-1-massimiliano.pellizzer@canonical.com> MIME-Version: 1.0 X-BeenThere: kernel-team@lists.ubuntu.com X-Mailman-Version: 2.1.20 Precedence: list List-Id: Kernel team discussions List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: kernel-team-bounces@lists.ubuntu.com Sender: "kernel-team" From: Ludovic Barre This patch renames sdmmc_priv struct to sdmmc_idma which is assigned to host->dma_priv. Signed-off-by: Ludovic Barre Link: https://lore.kernel.org/r/20200128090636.13689-3-ludovic.barre@st.com Signed-off-by: Ulf Hansson (cherry picked from commit bdbf9faf5f2e6bb0c0243350428c908ac85c16b2) CVE-2024-26787 Signed-off-by: Massimiliano Pellizzer --- drivers/mmc/host/mmci_stm32_sdmmc.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/drivers/mmc/host/mmci_stm32_sdmmc.c b/drivers/mmc/host/mmci_stm32_sdmmc.c index 3bb59d670220..aa8c0ab9efd1 100644 --- a/drivers/mmc/host/mmci_stm32_sdmmc.c +++ b/drivers/mmc/host/mmci_stm32_sdmmc.c @@ -20,7 +20,7 @@ struct sdmmc_lli_desc { u32 idmasize; }; -struct sdmmc_priv { +struct sdmmc_idma { dma_addr_t sg_dma; void *sg_cpu; }; @@ -92,7 +92,7 @@ static void sdmmc_idma_unprep_data(struct mmci_host *host, static int sdmmc_idma_setup(struct mmci_host *host) { - struct sdmmc_priv *idma; + struct sdmmc_idma *idma; idma = devm_kzalloc(mmc_dev(host->mmc), sizeof(*idma), GFP_KERNEL); if (!idma) @@ -123,7 +123,7 @@ static int sdmmc_idma_setup(struct mmci_host *host) static int sdmmc_idma_start(struct mmci_host *host, unsigned int *datactrl) { - struct sdmmc_priv *idma = host->dma_priv; + struct sdmmc_idma *idma = host->dma_priv; struct sdmmc_lli_desc *desc = (struct sdmmc_lli_desc *)idma->sg_cpu; struct mmc_data *data = host->data; struct scatterlist *sg; From patchwork Thu Aug 15 08:19:18 2024 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Massimiliano Pellizzer X-Patchwork-Id: 1972684 Return-Path: X-Original-To: incoming@patchwork.ozlabs.org Delivered-To: patchwork-incoming@legolas.ozlabs.org Authentication-Results: legolas.ozlabs.org; spf=pass (sender SPF authorized) smtp.mailfrom=lists.ubuntu.com (client-ip=185.125.189.65; helo=lists.ubuntu.com; envelope-from=kernel-team-bounces@lists.ubuntu.com; receiver=patchwork.ozlabs.org) Received: from lists.ubuntu.com (lists.ubuntu.com [185.125.189.65]) (using TLSv1.2 with cipher ECDHE-ECDSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by legolas.ozlabs.org (Postfix) with ESMTPS id 4WkyjP3Rn6z1yfL for ; Thu, 15 Aug 2024 18:20:09 +1000 (AEST) Received: from localhost ([127.0.0.1] helo=lists.ubuntu.com) by lists.ubuntu.com with esmtp (Exim 4.86_2) (envelope-from ) id 1seViE-0005va-9B; Thu, 15 Aug 2024 08:20:02 +0000 Received: from smtp-relay-internal-1.internal ([10.131.114.114] helo=smtp-relay-internal-1.canonical.com) by lists.ubuntu.com with esmtps (TLS1.2:ECDHE_RSA_AES_128_GCM_SHA256:128) (Exim 4.86_2) (envelope-from ) id 1seViC-0005uL-2F for kernel-team@lists.ubuntu.com; Thu, 15 Aug 2024 08:20:00 +0000 Received: from mail-ej1-f72.google.com (mail-ej1-f72.google.com [209.85.218.72]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by smtp-relay-internal-1.canonical.com (Postfix) with ESMTPS id E71293F162 for ; Thu, 15 Aug 2024 08:19:59 +0000 (UTC) Received: by mail-ej1-f72.google.com with SMTP id a640c23a62f3a-a7a97665b8bso72381466b.2 for ; Thu, 15 Aug 2024 01:19:59 -0700 (PDT) X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1723709999; x=1724314799; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:x-gm-message-state:from:to:cc :subject:date:message-id:reply-to; bh=mkNH7nE+9COFKdAvI7ZEVZPGAg+2IIqpf8xc1Vx3Qrc=; b=MpoonaAvlWPdByJEFJ7Fj50rTLbee5Qa8XbFn/MdBpb9guUarNjHDXbZbtesxE5t4Q DNt14SKpBBtLIvvVhxwfz9lbzcdhA9hrRYC4EvEj3+wV59HmbdUApa1sW56OUW2R2OQ6 quTRQUAkqM3NWatrxs/GxbV5T4KkVlRQ7eTy5UU7NVNTIpO+/NUU3qRGMwtJWNV4JvJk 5bFaLxe4YXvm0M1iCgwncWDm53NiarvYM8tNtlpgADOXP9cfqBPf62LKU7sSrAknP9Iv pmhfAV+sSYSOz9DXJjCo8KimAQcE3OlBrpIRrg18VYwM8VJKZ5AAMsAmpHPqIfQDfaOO kzDg== X-Gm-Message-State: AOJu0Yx5VMn5IuKtkwocC5WTsHAaK2IBKcFtORpcUTy6HrkZOgb96s9y babOq41mgT5+1MNgLzYufPSbi6VieGl4t3kd1bsZfpY6agTiHbqBUZLnvO0VPkFwvc5BeAvX2xX KMwUMkKtvyNBznx/M9gItZF0WScj1/b31KQXuWZk6HFlXI0HQqUKb22gUDqoxkQjKeqg7pr10VZ RYQD+VRp+8Ng== X-Received: by 2002:a17:907:a0c8:b0:a80:f81c:fd75 with SMTP id a640c23a62f3a-a83663f73e1mr279107466b.0.1723709999185; Thu, 15 Aug 2024 01:19:59 -0700 (PDT) X-Google-Smtp-Source: AGHT+IF1yLgYFMvGJNITrV8dZbnMbgX88p47dFVtBWA7qGETFlT+ZA0NEa6HPpv2Ctc/1OYgkIei5A== X-Received: by 2002:a17:907:a0c8:b0:a80:f81c:fd75 with SMTP id a640c23a62f3a-a83663f73e1mr279106666b.0.1723709998699; Thu, 15 Aug 2024 01:19:58 -0700 (PDT) Received: from framework-canonical.buildd (host-87-2-18-190.retail.telecomitalia.it. [87.2.18.190]) by smtp.gmail.com with ESMTPSA id a640c23a62f3a-a83838cef1esm64396366b.48.2024.08.15.01.19.58 for (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Thu, 15 Aug 2024 01:19:58 -0700 (PDT) From: Massimiliano Pellizzer To: kernel-team@lists.ubuntu.com Subject: [SRU][F][PATCH v2 2/3] mmc: mmci: stm32: use a buffer for unaligned DMA requests Date: Thu, 15 Aug 2024 10:19:18 +0200 Message-ID: <20240815081951.10261-3-massimiliano.pellizzer@canonical.com> X-Mailer: git-send-email 2.43.0 In-Reply-To: <20240815081951.10261-1-massimiliano.pellizzer@canonical.com> References: <20240815081951.10261-1-massimiliano.pellizzer@canonical.com> MIME-Version: 1.0 X-BeenThere: kernel-team@lists.ubuntu.com X-Mailman-Version: 2.1.20 Precedence: list List-Id: Kernel team discussions List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: kernel-team-bounces@lists.ubuntu.com Sender: "kernel-team" From: Yann Gautier [ Upstream commit 970dc9c11a17994ab878016b536612ab00d1441d ] In SDIO mode, the sg list for requests can be unaligned with what the STM32 SDMMC internal DMA can support. In that case, instead of failing, use a temporary bounce buffer to copy from/to the sg list. This buffer is limited to 1MB. But for that we need to also limit max_req_size to 1MB. It has not shown any throughput penalties for SD-cards or eMMC. Signed-off-by: Yann Gautier Link: https://lore.kernel.org/r/20220328145114.334577-1-yann.gautier@foss.st.com Signed-off-by: Ulf Hansson Stable-dep-of: 6b1ba3f9040b ("mmc: mmci: stm32: fix DMA API overlapping mappings warning") Signed-off-by: Sasha Levin (cherry picked from commit 287093040fc5cda96d25f70a5aa83c975a149c04 linux-5.15.y) CVE-2024-26787 Signed-off-by: Massimiliano Pellizzer --- drivers/mmc/host/mmci_stm32_sdmmc.c | 88 +++++++++++++++++++++++------ 1 file changed, 71 insertions(+), 17 deletions(-) diff --git a/drivers/mmc/host/mmci_stm32_sdmmc.c b/drivers/mmc/host/mmci_stm32_sdmmc.c index aa8c0ab9efd1..cab3a52879ba 100644 --- a/drivers/mmc/host/mmci_stm32_sdmmc.c +++ b/drivers/mmc/host/mmci_stm32_sdmmc.c @@ -23,11 +23,16 @@ struct sdmmc_lli_desc { struct sdmmc_idma { dma_addr_t sg_dma; void *sg_cpu; + dma_addr_t bounce_dma_addr; + void *bounce_buf; + bool use_bounce_buffer; }; int sdmmc_idma_validate_data(struct mmci_host *host, struct mmc_data *data) { + struct sdmmc_idma *idma = host->dma_priv; + struct device *dev = mmc_dev(host->mmc); struct scatterlist *sg; int i; @@ -35,41 +40,69 @@ int sdmmc_idma_validate_data(struct mmci_host *host, * idma has constraints on idmabase & idmasize for each element * excepted the last element which has no constraint on idmasize */ + idma->use_bounce_buffer = false; for_each_sg(data->sg, sg, data->sg_len - 1, i) { if (!IS_ALIGNED(sg->offset, sizeof(u32)) || !IS_ALIGNED(sg->length, SDMMC_IDMA_BURST)) { - dev_err(mmc_dev(host->mmc), + dev_dbg(mmc_dev(host->mmc), "unaligned scatterlist: ofst:%x length:%d\n", data->sg->offset, data->sg->length); - return -EINVAL; + goto use_bounce_buffer; } } if (!IS_ALIGNED(sg->offset, sizeof(u32))) { - dev_err(mmc_dev(host->mmc), + dev_dbg(mmc_dev(host->mmc), "unaligned last scatterlist: ofst:%x length:%d\n", data->sg->offset, data->sg->length); - return -EINVAL; + goto use_bounce_buffer; + } + + return 0; + +use_bounce_buffer: + if (!idma->bounce_buf) { + idma->bounce_buf = dmam_alloc_coherent(dev, + host->mmc->max_req_size, + &idma->bounce_dma_addr, + GFP_KERNEL); + if (!idma->bounce_buf) { + dev_err(dev, "Unable to map allocate DMA bounce buffer.\n"); + return -ENOMEM; + } } + idma->use_bounce_buffer = true; + return 0; } static int _sdmmc_idma_prep_data(struct mmci_host *host, struct mmc_data *data) { - int n_elem; + struct sdmmc_idma *idma = host->dma_priv; - n_elem = dma_map_sg(mmc_dev(host->mmc), - data->sg, - data->sg_len, - mmc_get_dma_dir(data)); + if (idma->use_bounce_buffer) { + if (data->flags & MMC_DATA_WRITE) { + unsigned int xfer_bytes = data->blksz * data->blocks; - if (!n_elem) { - dev_err(mmc_dev(host->mmc), "dma_map_sg failed\n"); - return -EINVAL; - } + sg_copy_to_buffer(data->sg, data->sg_len, + idma->bounce_buf, xfer_bytes); + dma_wmb(); + } + } else { + int n_elem; + n_elem = dma_map_sg(mmc_dev(host->mmc), + data->sg, + data->sg_len, + mmc_get_dma_dir(data)); + + if (!n_elem) { + dev_err(mmc_dev(host->mmc), "dma_map_sg failed\n"); + return -EINVAL; + } + } return 0; } @@ -86,8 +119,19 @@ static int sdmmc_idma_prep_data(struct mmci_host *host, static void sdmmc_idma_unprep_data(struct mmci_host *host, struct mmc_data *data, int err) { - dma_unmap_sg(mmc_dev(host->mmc), data->sg, data->sg_len, - mmc_get_dma_dir(data)); + struct sdmmc_idma *idma = host->dma_priv; + + if (idma->use_bounce_buffer) { + if (data->flags & MMC_DATA_READ) { + unsigned int xfer_bytes = data->blksz * data->blocks; + + sg_copy_from_buffer(data->sg, data->sg_len, + idma->bounce_buf, xfer_bytes); + } + } else { + dma_unmap_sg(mmc_dev(host->mmc), data->sg, data->sg_len, + mmc_get_dma_dir(data)); + } } static int sdmmc_idma_setup(struct mmci_host *host) @@ -112,6 +156,8 @@ static int sdmmc_idma_setup(struct mmci_host *host) host->mmc->max_segs = SDMMC_LLI_BUF_LEN / sizeof(struct sdmmc_lli_desc); host->mmc->max_seg_size = host->variant->stm32_idmabsize_mask; + + host->mmc->max_req_size = SZ_1M; } else { host->mmc->max_segs = 1; host->mmc->max_seg_size = host->mmc->max_req_size; @@ -129,8 +175,16 @@ static int sdmmc_idma_start(struct mmci_host *host, unsigned int *datactrl) struct scatterlist *sg; int i; - if (!host->variant->dma_lli || data->sg_len == 1) { - writel_relaxed(sg_dma_address(data->sg), + if (!host->variant->dma_lli || data->sg_len == 1 || + idma->use_bounce_buffer) { + u32 dma_addr; + + if (idma->use_bounce_buffer) + dma_addr = idma->bounce_dma_addr; + else + dma_addr = sg_dma_address(data->sg); + + writel_relaxed(dma_addr, host->base + MMCI_STM32_IDMABASE0R); writel_relaxed(MMCI_STM32_IDMAEN, host->base + MMCI_STM32_IDMACTRLR); From patchwork Thu Aug 15 08:19:19 2024 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Massimiliano Pellizzer X-Patchwork-Id: 1972686 Return-Path: X-Original-To: incoming@patchwork.ozlabs.org Delivered-To: patchwork-incoming@legolas.ozlabs.org Authentication-Results: legolas.ozlabs.org; spf=pass (sender SPF authorized) smtp.mailfrom=lists.ubuntu.com (client-ip=185.125.189.65; helo=lists.ubuntu.com; envelope-from=kernel-team-bounces@lists.ubuntu.com; receiver=patchwork.ozlabs.org) Received: from lists.ubuntu.com (lists.ubuntu.com [185.125.189.65]) (using TLSv1.2 with cipher ECDHE-ECDSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by legolas.ozlabs.org (Postfix) with ESMTPS id 4WkyjP4BQgz1yfP for ; Thu, 15 Aug 2024 18:20:09 +1000 (AEST) Received: from localhost ([127.0.0.1] helo=lists.ubuntu.com) by lists.ubuntu.com with esmtp (Exim 4.86_2) (envelope-from ) id 1seViF-0005wN-5e; Thu, 15 Aug 2024 08:20:03 +0000 Received: from smtp-relay-internal-0.internal ([10.131.114.225] helo=smtp-relay-internal-0.canonical.com) by lists.ubuntu.com with esmtps (TLS1.2:ECDHE_RSA_AES_128_GCM_SHA256:128) (Exim 4.86_2) (envelope-from ) id 1seViD-0005up-G9 for kernel-team@lists.ubuntu.com; Thu, 15 Aug 2024 08:20:01 +0000 Received: from mail-lf1-f71.google.com (mail-lf1-f71.google.com [209.85.167.71]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by smtp-relay-internal-0.canonical.com (Postfix) with ESMTPS id 250D43F1E5 for ; Thu, 15 Aug 2024 08:20:01 +0000 (UTC) Received: by mail-lf1-f71.google.com with SMTP id 2adb3069b0e04-52f00bde29dso813364e87.3 for ; Thu, 15 Aug 2024 01:20:01 -0700 (PDT) X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1723710000; x=1724314800; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:x-gm-message-state:from:to:cc :subject:date:message-id:reply-to; bh=l6PjzDaXZZdhYYB8MXM9c8o18LYJSiPOrvM6/XeG54Y=; b=OicA0ANR3VdkWzJchStMgC2OMxf0CZsZiV5o72TBPbpL5NJFwgWszzLe1kURCT4B2B mFJxEG84lPRznV1u+hQrN0+dnZjqVwC8VQGmJY/Qpm+/FxMUXolLsVYLSY2OXLwgsXqW j/QT3dEhr3i1TXCws994EFrEazeS9fpgAMkZi4Si7PJXbFwNLZX1FS5VFQLOBEGYMvbI GRVXLCzzNZ0it15cZRBp7bA3vCyUcaPc3yYHh0RVxhmXyRcf4s0jY1FjT1dcE64vW9qg XWruZpkW+8jYiYgjyPzTeKyE8oKLzNOsC2cN2trvQ/hYXHvp4wf2WSw/LMIWWaFS0PwV S45A== X-Gm-Message-State: AOJu0YxSvIbsZJNWD4Xm89DOjF8WKht9YeI9zMHmvX3QjGBNYdSqGFl1 h6BRSfotfReppFjyssBpbEQiCyMb6PVSBBAz8AbFb3c+A+Em2zyh2OBKgyzHCA45FhQZzb4gDvc fBuMtcD/tLK37T3dNCi97aaWY1Inw1zcKUZc8CcYSeYgUBWMQ79yRE/Qc26MeDZx9cwfQPLM7Sw 1ModpYUShiHg== X-Received: by 2002:a05:6512:334e:b0:533:77d:115f with SMTP id 2adb3069b0e04-533077d11edmr1491716e87.56.1723710000085; Thu, 15 Aug 2024 01:20:00 -0700 (PDT) X-Google-Smtp-Source: AGHT+IEuM8ynYNw/2TKY+0PHBZpK1ci+TwyhYi+KEDwPG/kmkHoO5goHPYLaXMLShxu3GDPwsjm45g== X-Received: by 2002:a05:6512:334e:b0:533:77d:115f with SMTP id 2adb3069b0e04-533077d11edmr1491696e87.56.1723709999442; Thu, 15 Aug 2024 01:19:59 -0700 (PDT) Received: from framework-canonical.buildd (host-87-2-18-190.retail.telecomitalia.it. [87.2.18.190]) by smtp.gmail.com with ESMTPSA id a640c23a62f3a-a83838cef1esm64396366b.48.2024.08.15.01.19.58 for (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Thu, 15 Aug 2024 01:19:59 -0700 (PDT) From: Massimiliano Pellizzer To: kernel-team@lists.ubuntu.com Subject: [SRU][F][PATCH v2 3/3] mmc: mmci: stm32: fix DMA API overlapping mappings warning Date: Thu, 15 Aug 2024 10:19:19 +0200 Message-ID: <20240815081951.10261-4-massimiliano.pellizzer@canonical.com> X-Mailer: git-send-email 2.43.0 In-Reply-To: <20240815081951.10261-1-massimiliano.pellizzer@canonical.com> References: <20240815081951.10261-1-massimiliano.pellizzer@canonical.com> MIME-Version: 1.0 X-BeenThere: kernel-team@lists.ubuntu.com X-Mailman-Version: 2.1.20 Precedence: list List-Id: Kernel team discussions List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: kernel-team-bounces@lists.ubuntu.com Sender: "kernel-team" From: Christophe Kerello [ Upstream commit 6b1ba3f9040be5efc4396d86c9752cdc564730be ] Turning on CONFIG_DMA_API_DEBUG_SG results in the following warning: DMA-API: mmci-pl18x 48220000.mmc: cacheline tracking EEXIST, overlapping mappings aren't supported WARNING: CPU: 1 PID: 51 at kernel/dma/debug.c:568 add_dma_entry+0x234/0x2f4 Modules linked in: CPU: 1 PID: 51 Comm: kworker/1:2 Not tainted 6.1.28 #1 Hardware name: STMicroelectronics STM32MP257F-EV1 Evaluation Board (DT) Workqueue: events_freezable mmc_rescan Call trace: add_dma_entry+0x234/0x2f4 debug_dma_map_sg+0x198/0x350 __dma_map_sg_attrs+0xa0/0x110 dma_map_sg_attrs+0x10/0x2c sdmmc_idma_prep_data+0x80/0xc0 mmci_prep_data+0x38/0x84 mmci_start_data+0x108/0x2dc mmci_request+0xe4/0x190 __mmc_start_request+0x68/0x140 mmc_start_request+0x94/0xc0 mmc_wait_for_req+0x70/0x100 mmc_send_tuning+0x108/0x1ac sdmmc_execute_tuning+0x14c/0x210 mmc_execute_tuning+0x48/0xec mmc_sd_init_uhs_card.part.0+0x208/0x464 mmc_sd_init_card+0x318/0x89c mmc_attach_sd+0xe4/0x180 mmc_rescan+0x244/0x320 DMA API debug brings to light leaking dma-mappings as dma_map_sg and dma_unmap_sg are not correctly balanced. If an error occurs in mmci_cmd_irq function, only mmci_dma_error function is called and as this API is not managed on stm32 variant, dma_unmap_sg is never called in this error path. Signed-off-by: Christophe Kerello Fixes: 46b723dd867d ("mmc: mmci: add stm32 sdmmc variant") Cc: stable@vger.kernel.org Link: https://lore.kernel.org/r/20240207143951.938144-1-christophe.kerello@foss.st.com Signed-off-by: Ulf Hansson Signed-off-by: Sasha Levin (cherry picked from commit 5ae5060e17a3fc38e54c3e5bd8abd6b1d5bfae7c linux-5.15.y) CVE-2024-26787 Signed-off-by: Massimiliano Pellizzer --- drivers/mmc/host/mmci_stm32_sdmmc.c | 24 ++++++++++++++++++++++++ 1 file changed, 24 insertions(+) diff --git a/drivers/mmc/host/mmci_stm32_sdmmc.c b/drivers/mmc/host/mmci_stm32_sdmmc.c index cab3a52879ba..dd525468d49a 100644 --- a/drivers/mmc/host/mmci_stm32_sdmmc.c +++ b/drivers/mmc/host/mmci_stm32_sdmmc.c @@ -175,6 +175,8 @@ static int sdmmc_idma_start(struct mmci_host *host, unsigned int *datactrl) struct scatterlist *sg; int i; + host->dma_in_progress = true; + if (!host->variant->dma_lli || data->sg_len == 1 || idma->use_bounce_buffer) { u32 dma_addr; @@ -213,9 +215,30 @@ static int sdmmc_idma_start(struct mmci_host *host, unsigned int *datactrl) return 0; } +static void sdmmc_idma_error(struct mmci_host *host) +{ + struct mmc_data *data = host->data; + struct sdmmc_idma *idma = host->dma_priv; + + if (!dma_inprogress(host)) + return; + + writel_relaxed(0, host->base + MMCI_STM32_IDMACTRLR); + host->dma_in_progress = false; + data->host_cookie = 0; + + if (!idma->use_bounce_buffer) + dma_unmap_sg(mmc_dev(host->mmc), data->sg, data->sg_len, + mmc_get_dma_dir(data)); +} + static void sdmmc_idma_finalize(struct mmci_host *host, struct mmc_data *data) { + if (!dma_inprogress(host)) + return; + writel_relaxed(0, host->base + MMCI_STM32_IDMACTRLR); + host->dma_in_progress = false; if (!data->host_cookie) sdmmc_idma_unprep_data(host, data, 0); @@ -347,6 +370,7 @@ static struct mmci_host_ops sdmmc_variant_ops = { .dma_setup = sdmmc_idma_setup, .dma_start = sdmmc_idma_start, .dma_finalize = sdmmc_idma_finalize, + .dma_error = sdmmc_idma_error, .set_clkreg = mmci_sdmmc_set_clkreg, .set_pwrreg = mmci_sdmmc_set_pwrreg, };