Linux kernel mirror (for testing)
git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
kernel
os
linux
Merge tag 'usb-6.4-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb
Pull USB fixes from Greg KH:
"Here are some USB driver and core fixes for 6.4-rc5. Most of these are
tiny driver fixes, including:
- udc driver bugfix
- f_fs gadget driver bugfix
- cdns3 driver bugfix
- typec bugfixes
But the "big" thing in here is a fix yet-again for how the USB buffers
are handled from userspace when dealing with DMA issues. The changes
were discussed a lot, and tested a lot, on the list, and acked by the
relevant mm maintainers and have been in linux-next all this past week
with no reported problems"
* tag 'usb-6.4-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb:
usb: typec: tps6598x: Fix broken polling mode after system suspend/resume
mm: page_table_check: Ensure user pages are not slab pages
mm: page_table_check: Make it dependent on EXCLUSIVE_SYSTEM_RAM
usb: usbfs: Use consistent mmap functions
usb: usbfs: Enforce page requirements for mmap
dt-bindings: usb: snps,dwc3: Fix "snps,hsphy_interface" type
usb: gadget: udc: fix NULL dereference in remove()
usb: gadget: f_fs: Add unbind event before functionfs_unbind
usb: cdns3: fix NCM gadget RX speed 20x slow than expection at iMX8QM
+111
-9
+1
-1
Documentation/devicetree/bindings/usb/snps,dwc3.yaml
+1
-1
Documentation/devicetree/bindings/usb/snps,dwc3.yaml
···
287
287
description:
288
288
High-Speed PHY interface selection between UTMI+ and ULPI when the
289
289
DWC_USB3_HSPHY_INTERFACE has value 3.
290
-
$ref: /schemas/types.yaml#/definitions/uint8
290
+
$ref: /schemas/types.yaml#/definitions/string
291
291
enum: [utmi, ulpi]
292
292
293
293
snps,quirk-frame-length-adjustment:
+19
Documentation/mm/page_table_check.rst
+19
Documentation/mm/page_table_check.rst
···
52
52
53
53
Optionally, build kernel with PAGE_TABLE_CHECK_ENFORCED in order to have page
54
54
table support without extra kernel parameter.
55
+
56
+
Implementation notes
57
+
====================
58
+
59
+
We specifically decided not to use VMA information in order to avoid relying on
60
+
MM states (except for limited "struct page" info). The page table check is a
61
+
separate from Linux-MM state machine that verifies that the user accessible
62
+
pages are not falsely shared.
63
+
64
+
PAGE_TABLE_CHECK depends on EXCLUSIVE_SYSTEM_RAM. The reason is that without
65
+
EXCLUSIVE_SYSTEM_RAM, users are allowed to map arbitrary physical memory
66
+
regions into the userspace via /dev/mem. At the same time, pages may change
67
+
their properties (e.g., from anonymous pages to named pages) while they are
68
+
still being mapped in the userspace, leading to "corruption" detected by the
69
+
page table check.
70
+
71
+
Even with EXCLUSIVE_SYSTEM_RAM, I/O pages may be still allowed to be mapped via
72
+
/dev/mem. However, these pages are always considered as named pages, so they
73
+
won't break the logic used in the page table check.
+13
drivers/usb/cdns3/cdns3-gadget.c
+13
drivers/usb/cdns3/cdns3-gadget.c
···
2097
2097
else
2098
2098
priv_ep->trb_burst_size = 16;
2099
2099
2100
+
/*
2101
+
* In versions preceding DEV_VER_V2, for example, iMX8QM, there exit the bugs
2102
+
* in the DMA. These bugs occur when the trb_burst_size exceeds 16 and the
2103
+
* address is not aligned to 128 Bytes (which is a product of the 64-bit AXI
2104
+
* and AXI maximum burst length of 16 or 0xF+1, dma_axi_ctrl0[3:0]). This
2105
+
* results in data corruption when it crosses the 4K border. The corruption
2106
+
* specifically occurs from the position (4K - (address & 0x7F)) to 4K.
2107
+
*
2108
+
* So force trb_burst_size to 16 at such platform.
2109
+
*/
2110
+
if (priv_dev->dev_ver < DEV_VER_V2)
2111
+
priv_ep->trb_burst_size = 16;
2112
+
2100
2113
mult = min_t(u8, mult, EP_CFG_MULT_MAX);
2101
2114
buffering = min_t(u8, buffering, EP_CFG_BUFFERING_MAX);
2102
2115
maxburst = min_t(u8, maxburst, EP_CFG_MAXBURST_MAX);
+41
drivers/usb/core/buffer.c
+41
drivers/usb/core/buffer.c
···
172
172
}
173
173
dma_free_coherent(hcd->self.sysdev, size, addr, dma);
174
174
}
175
+
176
+
void *hcd_buffer_alloc_pages(struct usb_hcd *hcd,
177
+
size_t size, gfp_t mem_flags, dma_addr_t *dma)
178
+
{
179
+
if (size == 0)
180
+
return NULL;
181
+
182
+
if (hcd->localmem_pool)
183
+
return gen_pool_dma_alloc_align(hcd->localmem_pool,
184
+
size, dma, PAGE_SIZE);
185
+
186
+
/* some USB hosts just use PIO */
187
+
if (!hcd_uses_dma(hcd)) {
188
+
*dma = DMA_MAPPING_ERROR;
189
+
return (void *)__get_free_pages(mem_flags,
190
+
get_order(size));
191
+
}
192
+
193
+
return dma_alloc_coherent(hcd->self.sysdev,
194
+
size, dma, mem_flags);
195
+
}
196
+
197
+
void hcd_buffer_free_pages(struct usb_hcd *hcd,
198
+
size_t size, void *addr, dma_addr_t dma)
199
+
{
200
+
if (!addr)
201
+
return;
202
+
203
+
if (hcd->localmem_pool) {
204
+
gen_pool_free(hcd->localmem_pool,
205
+
(unsigned long)addr, size);
206
+
return;
207
+
}
208
+
209
+
if (!hcd_uses_dma(hcd)) {
210
+
free_pages((unsigned long)addr, get_order(size));
211
+
return;
212
+
}
213
+
214
+
dma_free_coherent(hcd->self.sysdev, size, addr, dma);
215
+
}
+14
-6
drivers/usb/core/devio.c
+14
-6
drivers/usb/core/devio.c
···
186
186
static void dec_usb_memory_use_count(struct usb_memory *usbm, int *count)
187
187
{
188
188
struct usb_dev_state *ps = usbm->ps;
189
+
struct usb_hcd *hcd = bus_to_hcd(ps->dev->bus);
189
190
unsigned long flags;
190
191
191
192
spin_lock_irqsave(&ps->lock, flags);
···
195
194
list_del(&usbm->memlist);
196
195
spin_unlock_irqrestore(&ps->lock, flags);
197
196
198
-
usb_free_coherent(ps->dev, usbm->size, usbm->mem,
199
-
usbm->dma_handle);
197
+
hcd_buffer_free_pages(hcd, usbm->size,
198
+
usbm->mem, usbm->dma_handle);
200
199
usbfs_decrease_memory_usage(
201
200
usbm->size + sizeof(struct usb_memory));
202
201
kfree(usbm);
···
235
234
size_t size = vma->vm_end - vma->vm_start;
236
235
void *mem;
237
236
unsigned long flags;
238
-
dma_addr_t dma_handle;
237
+
dma_addr_t dma_handle = DMA_MAPPING_ERROR;
239
238
int ret;
240
239
241
240
ret = usbfs_increase_memory_usage(size + sizeof(struct usb_memory));
···
248
247
goto error_decrease_mem;
249
248
}
250
249
251
-
mem = usb_alloc_coherent(ps->dev, size, GFP_USER | __GFP_NOWARN,
252
-
&dma_handle);
250
+
mem = hcd_buffer_alloc_pages(hcd,
251
+
size, GFP_USER | __GFP_NOWARN, &dma_handle);
253
252
if (!mem) {
254
253
ret = -ENOMEM;
255
254
goto error_free_usbm;
···
265
264
usbm->vma_use_count = 1;
266
265
INIT_LIST_HEAD(&usbm->memlist);
267
266
268
-
if (hcd->localmem_pool || !hcd_uses_dma(hcd)) {
267
+
/*
268
+
* In DMA-unavailable cases, hcd_buffer_alloc_pages allocates
269
+
* normal pages and assigns DMA_MAPPING_ERROR to dma_handle. Check
270
+
* whether we are in such cases, and then use remap_pfn_range (or
271
+
* dma_mmap_coherent) to map normal (or DMA) pages into the user
272
+
* space, respectively.
273
+
*/
274
+
if (dma_handle == DMA_MAPPING_ERROR) {
269
275
if (remap_pfn_range(vma, vma->vm_start,
270
276
virt_to_phys(usbm->mem) >> PAGE_SHIFT,
271
277
size, vma->vm_page_prot) < 0) {
+1
-1
drivers/usb/gadget/function/f_fs.c
+1
-1
drivers/usb/gadget/function/f_fs.c
···
3535
3535
/* Drain any pending AIO completions */
3536
3536
drain_workqueue(ffs->io_completion_wq);
3537
3537
3538
+
ffs_event_add(ffs, FUNCTIONFS_UNBIND);
3538
3539
if (!--opts->refcnt)
3539
3540
functionfs_unbind(ffs);
3540
3541
···
3560
3559
func->function.ssp_descriptors = NULL;
3561
3560
func->interfaces_nums = NULL;
3562
3561
3563
-
ffs_event_add(ffs, FUNCTIONFS_UNBIND);
3564
3562
}
3565
3563
3566
3564
static struct usb_function *ffs_alloc(struct usb_function_instance *fi)
+3
drivers/usb/gadget/udc/amd5536udc_pci.c
+3
drivers/usb/gadget/udc/amd5536udc_pci.c
+1
-1
drivers/usb/typec/tipd/core.c
+1
-1
drivers/usb/typec/tipd/core.c
+6
include/linux/page-flags.h
+6
include/linux/page-flags.h
···
617
617
* Please note that, confusingly, "page_mapping" refers to the inode
618
618
* address_space which maps the page from disk; whereas "page_mapped"
619
619
* refers to user virtual address space into which the page is mapped.
620
+
*
621
+
* For slab pages, since slab reuses the bits in struct page to store its
622
+
* internal states, the page->mapping does not exist as such, nor do these
623
+
* flags below. So in order to avoid testing non-existent bits, please
624
+
* make sure that PageSlab(page) actually evaluates to false before calling
625
+
* the following functions (e.g., PageAnon). See mm/slab.h.
620
626
*/
621
627
#define PAGE_MAPPING_ANON 0x1
622
628
#define PAGE_MAPPING_MOVABLE 0x2
+5
include/linux/usb/hcd.h
+5
include/linux/usb/hcd.h
···
501
501
void hcd_buffer_free(struct usb_bus *bus, size_t size,
502
502
void *addr, dma_addr_t dma);
503
503
504
+
void *hcd_buffer_alloc_pages(struct usb_hcd *hcd,
505
+
size_t size, gfp_t mem_flags, dma_addr_t *dma);
506
+
void hcd_buffer_free_pages(struct usb_hcd *hcd,
507
+
size_t size, void *addr, dma_addr_t dma);
508
+
504
509
/* generic bus glue, needed for host controllers that don't use PCI */
505
510
extern irqreturn_t usb_hcd_irq(int irq, void *__hcd);
506
511
+1
mm/Kconfig.debug
+1
mm/Kconfig.debug
···
98
98
config PAGE_TABLE_CHECK
99
99
bool "Check for invalid mappings in user page tables"
100
100
depends on ARCH_SUPPORTS_PAGE_TABLE_CHECK
101
+
depends on EXCLUSIVE_SYSTEM_RAM
101
102
select PAGE_EXTENSION
102
103
help
103
104
Check that anonymous page is not being mapped twice with read write
+6
mm/page_table_check.c
+6
mm/page_table_check.c
···
71
71
72
72
page = pfn_to_page(pfn);
73
73
page_ext = page_ext_get(page);
74
+
75
+
BUG_ON(PageSlab(page));
74
76
anon = PageAnon(page);
75
77
76
78
for (i = 0; i < pgcnt; i++) {
···
109
107
110
108
page = pfn_to_page(pfn);
111
109
page_ext = page_ext_get(page);
110
+
111
+
BUG_ON(PageSlab(page));
112
112
anon = PageAnon(page);
113
113
114
114
for (i = 0; i < pgcnt; i++) {
···
136
132
{
137
133
struct page_ext *page_ext;
138
134
unsigned long i;
135
+
136
+
BUG_ON(PageSlab(page));
139
137
140
138
page_ext = page_ext_get(page);
141
139
BUG_ON(!page_ext);