mirror of
				https://github.com/torvalds/linux.git
				synced 2025-11-04 10:40:15 +02:00 
			
		
		
		
	The bitfield dma_inuse is allocated of size dma_requests bits, thus a valid bit address is from 0 to (dma_requests - 1). When find_first_zero_bit() fails, it returns dma_requests as invalid address. Using such address for the following set_bit() is incorrect and, if dma_requests is a multiple of BITS_PER_LONG, it will cause a buffer overflow. Currently this driver is only used in DT stm32h743.dtsi where a safe value dma_requests=16 is not triggering the buffer overflow. Fixed by checking the return value of find_first_zero_bit() _before_ using it. Signed-off-by: Antonio Borneo <borneo.antonio@gmail.com> Signed-off-by: Pierre-Yves MORDRET <pierre-yves.mordret@st.com> Signed-off-by: Vinod Koul <vinod.koul@intel.com>
		
			
				
	
	
		
			327 lines
		
	
	
	
		
			8.8 KiB
		
	
	
	
		
			C
		
	
	
	
	
	
			
		
		
	
	
			327 lines
		
	
	
	
		
			8.8 KiB
		
	
	
	
		
			C
		
	
	
	
	
	
/*
 | 
						|
 *
 | 
						|
 * Copyright (C) STMicroelectronics SA 2017
 | 
						|
 * Author(s): M'boumba Cedric Madianga <cedric.madianga@gmail.com>
 | 
						|
 *            Pierre-Yves Mordret <pierre-yves.mordret@st.com>
 | 
						|
 *
 | 
						|
 * License terms: GPL V2.0.
 | 
						|
 *
 | 
						|
 * This program is free software; you can redistribute it and/or modify it
 | 
						|
 * under the terms of the GNU General Public License version 2 as published by
 | 
						|
 * the Free Software Foundation.
 | 
						|
 *
 | 
						|
 * This program is distributed in the hope that it will be useful, but
 | 
						|
 * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
 | 
						|
 * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more
 | 
						|
 * details.
 | 
						|
 *
 | 
						|
 * DMA Router driver for STM32 DMA MUX
 | 
						|
 *
 | 
						|
 * Based on TI DMA Crossbar driver
 | 
						|
 *
 | 
						|
 */
 | 
						|
 | 
						|
#include <linux/clk.h>
 | 
						|
#include <linux/delay.h>
 | 
						|
#include <linux/err.h>
 | 
						|
#include <linux/init.h>
 | 
						|
#include <linux/module.h>
 | 
						|
#include <linux/of_device.h>
 | 
						|
#include <linux/of_dma.h>
 | 
						|
#include <linux/reset.h>
 | 
						|
#include <linux/slab.h>
 | 
						|
#include <linux/spinlock.h>
 | 
						|
 | 
						|
#define STM32_DMAMUX_CCR(x)		(0x4 * (x))
 | 
						|
#define STM32_DMAMUX_MAX_DMA_REQUESTS	32
 | 
						|
#define STM32_DMAMUX_MAX_REQUESTS	255
 | 
						|
 | 
						|
struct stm32_dmamux {
 | 
						|
	u32 master;
 | 
						|
	u32 request;
 | 
						|
	u32 chan_id;
 | 
						|
};
 | 
						|
 | 
						|
struct stm32_dmamux_data {
 | 
						|
	struct dma_router dmarouter;
 | 
						|
	struct clk *clk;
 | 
						|
	struct reset_control *rst;
 | 
						|
	void __iomem *iomem;
 | 
						|
	u32 dma_requests; /* Number of DMA requests connected to DMAMUX */
 | 
						|
	u32 dmamux_requests; /* Number of DMA requests routed toward DMAs */
 | 
						|
	spinlock_t lock; /* Protects register access */
 | 
						|
	unsigned long *dma_inuse; /* Used DMA channel */
 | 
						|
	u32 dma_reqs[]; /* Number of DMA Request per DMA masters.
 | 
						|
			 *  [0] holds number of DMA Masters.
 | 
						|
			 *  To be kept at very end end of this structure
 | 
						|
			 */
 | 
						|
};
 | 
						|
 | 
						|
static inline u32 stm32_dmamux_read(void __iomem *iomem, u32 reg)
 | 
						|
{
 | 
						|
	return readl_relaxed(iomem + reg);
 | 
						|
}
 | 
						|
 | 
						|
static inline void stm32_dmamux_write(void __iomem *iomem, u32 reg, u32 val)
 | 
						|
{
 | 
						|
	writel_relaxed(val, iomem + reg);
 | 
						|
}
 | 
						|
 | 
						|
static void stm32_dmamux_free(struct device *dev, void *route_data)
 | 
						|
{
 | 
						|
	struct stm32_dmamux_data *dmamux = dev_get_drvdata(dev);
 | 
						|
	struct stm32_dmamux *mux = route_data;
 | 
						|
	unsigned long flags;
 | 
						|
 | 
						|
	/* Clear dma request */
 | 
						|
	spin_lock_irqsave(&dmamux->lock, flags);
 | 
						|
 | 
						|
	stm32_dmamux_write(dmamux->iomem, STM32_DMAMUX_CCR(mux->chan_id), 0);
 | 
						|
	clear_bit(mux->chan_id, dmamux->dma_inuse);
 | 
						|
 | 
						|
	if (!IS_ERR(dmamux->clk))
 | 
						|
		clk_disable(dmamux->clk);
 | 
						|
 | 
						|
	spin_unlock_irqrestore(&dmamux->lock, flags);
 | 
						|
 | 
						|
	dev_dbg(dev, "Unmapping DMAMUX(%u) to DMA%u(%u)\n",
 | 
						|
		mux->request, mux->master, mux->chan_id);
 | 
						|
 | 
						|
	kfree(mux);
 | 
						|
}
 | 
						|
 | 
						|
static void *stm32_dmamux_route_allocate(struct of_phandle_args *dma_spec,
 | 
						|
					 struct of_dma *ofdma)
 | 
						|
{
 | 
						|
	struct platform_device *pdev = of_find_device_by_node(ofdma->of_node);
 | 
						|
	struct stm32_dmamux_data *dmamux = platform_get_drvdata(pdev);
 | 
						|
	struct stm32_dmamux *mux;
 | 
						|
	u32 i, min, max;
 | 
						|
	int ret;
 | 
						|
	unsigned long flags;
 | 
						|
 | 
						|
	if (dma_spec->args_count != 3) {
 | 
						|
		dev_err(&pdev->dev, "invalid number of dma mux args\n");
 | 
						|
		return ERR_PTR(-EINVAL);
 | 
						|
	}
 | 
						|
 | 
						|
	if (dma_spec->args[0] > dmamux->dmamux_requests) {
 | 
						|
		dev_err(&pdev->dev, "invalid mux request number: %d\n",
 | 
						|
			dma_spec->args[0]);
 | 
						|
		return ERR_PTR(-EINVAL);
 | 
						|
	}
 | 
						|
 | 
						|
	mux = kzalloc(sizeof(*mux), GFP_KERNEL);
 | 
						|
	if (!mux)
 | 
						|
		return ERR_PTR(-ENOMEM);
 | 
						|
 | 
						|
	spin_lock_irqsave(&dmamux->lock, flags);
 | 
						|
	mux->chan_id = find_first_zero_bit(dmamux->dma_inuse,
 | 
						|
					   dmamux->dma_requests);
 | 
						|
 | 
						|
	if (mux->chan_id == dmamux->dma_requests) {
 | 
						|
		spin_unlock_irqrestore(&dmamux->lock, flags);
 | 
						|
		dev_err(&pdev->dev, "Run out of free DMA requests\n");
 | 
						|
		ret = -ENOMEM;
 | 
						|
		goto error_chan_id;
 | 
						|
	}
 | 
						|
	set_bit(mux->chan_id, dmamux->dma_inuse);
 | 
						|
	spin_unlock_irqrestore(&dmamux->lock, flags);
 | 
						|
 | 
						|
	/* Look for DMA Master */
 | 
						|
	for (i = 1, min = 0, max = dmamux->dma_reqs[i];
 | 
						|
	     i <= dmamux->dma_reqs[0];
 | 
						|
	     min += dmamux->dma_reqs[i], max += dmamux->dma_reqs[++i])
 | 
						|
		if (mux->chan_id < max)
 | 
						|
			break;
 | 
						|
	mux->master = i - 1;
 | 
						|
 | 
						|
	/* The of_node_put() will be done in of_dma_router_xlate function */
 | 
						|
	dma_spec->np = of_parse_phandle(ofdma->of_node, "dma-masters", i - 1);
 | 
						|
	if (!dma_spec->np) {
 | 
						|
		dev_err(&pdev->dev, "can't get dma master\n");
 | 
						|
		ret = -EINVAL;
 | 
						|
		goto error;
 | 
						|
	}
 | 
						|
 | 
						|
	/* Set dma request */
 | 
						|
	spin_lock_irqsave(&dmamux->lock, flags);
 | 
						|
	if (!IS_ERR(dmamux->clk)) {
 | 
						|
		ret = clk_enable(dmamux->clk);
 | 
						|
		if (ret < 0) {
 | 
						|
			spin_unlock_irqrestore(&dmamux->lock, flags);
 | 
						|
			dev_err(&pdev->dev, "clk_prep_enable issue: %d\n", ret);
 | 
						|
			goto error;
 | 
						|
		}
 | 
						|
	}
 | 
						|
	spin_unlock_irqrestore(&dmamux->lock, flags);
 | 
						|
 | 
						|
	mux->request = dma_spec->args[0];
 | 
						|
 | 
						|
	/*  craft DMA spec */
 | 
						|
	dma_spec->args[3] = dma_spec->args[2];
 | 
						|
	dma_spec->args[2] = dma_spec->args[1];
 | 
						|
	dma_spec->args[1] = 0;
 | 
						|
	dma_spec->args[0] = mux->chan_id - min;
 | 
						|
	dma_spec->args_count = 4;
 | 
						|
 | 
						|
	stm32_dmamux_write(dmamux->iomem, STM32_DMAMUX_CCR(mux->chan_id),
 | 
						|
			   mux->request);
 | 
						|
	dev_dbg(&pdev->dev, "Mapping DMAMUX(%u) to DMA%u(%u)\n",
 | 
						|
		mux->request, mux->master, mux->chan_id);
 | 
						|
 | 
						|
	return mux;
 | 
						|
 | 
						|
error:
 | 
						|
	clear_bit(mux->chan_id, dmamux->dma_inuse);
 | 
						|
 | 
						|
error_chan_id:
 | 
						|
	kfree(mux);
 | 
						|
	return ERR_PTR(ret);
 | 
						|
}
 | 
						|
 | 
						|
static const struct of_device_id stm32_stm32dma_master_match[] = {
 | 
						|
	{ .compatible = "st,stm32-dma", },
 | 
						|
	{},
 | 
						|
};
 | 
						|
 | 
						|
static int stm32_dmamux_probe(struct platform_device *pdev)
 | 
						|
{
 | 
						|
	struct device_node *node = pdev->dev.of_node;
 | 
						|
	const struct of_device_id *match;
 | 
						|
	struct device_node *dma_node;
 | 
						|
	struct stm32_dmamux_data *stm32_dmamux;
 | 
						|
	struct resource *res;
 | 
						|
	void __iomem *iomem;
 | 
						|
	int i, count, ret;
 | 
						|
	u32 dma_req;
 | 
						|
 | 
						|
	if (!node)
 | 
						|
		return -ENODEV;
 | 
						|
 | 
						|
	count = device_property_read_u32_array(&pdev->dev, "dma-masters",
 | 
						|
					       NULL, 0);
 | 
						|
	if (count < 0) {
 | 
						|
		dev_err(&pdev->dev, "Can't get DMA master(s) node\n");
 | 
						|
		return -ENODEV;
 | 
						|
	}
 | 
						|
 | 
						|
	stm32_dmamux = devm_kzalloc(&pdev->dev, sizeof(*stm32_dmamux) +
 | 
						|
				    sizeof(u32) * (count + 1), GFP_KERNEL);
 | 
						|
	if (!stm32_dmamux)
 | 
						|
		return -ENOMEM;
 | 
						|
 | 
						|
	dma_req = 0;
 | 
						|
	for (i = 1; i <= count; i++) {
 | 
						|
		dma_node = of_parse_phandle(node, "dma-masters", i - 1);
 | 
						|
 | 
						|
		match = of_match_node(stm32_stm32dma_master_match, dma_node);
 | 
						|
		if (!match) {
 | 
						|
			dev_err(&pdev->dev, "DMA master is not supported\n");
 | 
						|
			of_node_put(dma_node);
 | 
						|
			return -EINVAL;
 | 
						|
		}
 | 
						|
 | 
						|
		if (of_property_read_u32(dma_node, "dma-requests",
 | 
						|
					 &stm32_dmamux->dma_reqs[i])) {
 | 
						|
			dev_info(&pdev->dev,
 | 
						|
				 "Missing MUX output information, using %u.\n",
 | 
						|
				 STM32_DMAMUX_MAX_DMA_REQUESTS);
 | 
						|
			stm32_dmamux->dma_reqs[i] =
 | 
						|
				STM32_DMAMUX_MAX_DMA_REQUESTS;
 | 
						|
		}
 | 
						|
		dma_req += stm32_dmamux->dma_reqs[i];
 | 
						|
		of_node_put(dma_node);
 | 
						|
	}
 | 
						|
 | 
						|
	if (dma_req > STM32_DMAMUX_MAX_DMA_REQUESTS) {
 | 
						|
		dev_err(&pdev->dev, "Too many DMA Master Requests to manage\n");
 | 
						|
		return -ENODEV;
 | 
						|
	}
 | 
						|
 | 
						|
	stm32_dmamux->dma_requests = dma_req;
 | 
						|
	stm32_dmamux->dma_reqs[0] = count;
 | 
						|
	stm32_dmamux->dma_inuse = devm_kcalloc(&pdev->dev,
 | 
						|
					       BITS_TO_LONGS(dma_req),
 | 
						|
					       sizeof(unsigned long),
 | 
						|
					       GFP_KERNEL);
 | 
						|
	if (!stm32_dmamux->dma_inuse)
 | 
						|
		return -ENOMEM;
 | 
						|
 | 
						|
	if (device_property_read_u32(&pdev->dev, "dma-requests",
 | 
						|
				     &stm32_dmamux->dmamux_requests)) {
 | 
						|
		stm32_dmamux->dmamux_requests = STM32_DMAMUX_MAX_REQUESTS;
 | 
						|
		dev_warn(&pdev->dev, "DMAMUX defaulting on %u requests\n",
 | 
						|
			 stm32_dmamux->dmamux_requests);
 | 
						|
	}
 | 
						|
 | 
						|
	res = platform_get_resource(pdev, IORESOURCE_MEM, 0);
 | 
						|
	iomem = devm_ioremap_resource(&pdev->dev, res);
 | 
						|
	if (IS_ERR(iomem))
 | 
						|
		return PTR_ERR(iomem);
 | 
						|
 | 
						|
	spin_lock_init(&stm32_dmamux->lock);
 | 
						|
 | 
						|
	stm32_dmamux->clk = devm_clk_get(&pdev->dev, NULL);
 | 
						|
	if (IS_ERR(stm32_dmamux->clk)) {
 | 
						|
		ret = PTR_ERR(stm32_dmamux->clk);
 | 
						|
		if (ret == -EPROBE_DEFER)
 | 
						|
			dev_info(&pdev->dev, "Missing controller clock\n");
 | 
						|
		return ret;
 | 
						|
	}
 | 
						|
 | 
						|
	stm32_dmamux->rst = devm_reset_control_get(&pdev->dev, NULL);
 | 
						|
	if (!IS_ERR(stm32_dmamux->rst)) {
 | 
						|
		reset_control_assert(stm32_dmamux->rst);
 | 
						|
		udelay(2);
 | 
						|
		reset_control_deassert(stm32_dmamux->rst);
 | 
						|
	}
 | 
						|
 | 
						|
	stm32_dmamux->iomem = iomem;
 | 
						|
	stm32_dmamux->dmarouter.dev = &pdev->dev;
 | 
						|
	stm32_dmamux->dmarouter.route_free = stm32_dmamux_free;
 | 
						|
 | 
						|
	platform_set_drvdata(pdev, stm32_dmamux);
 | 
						|
 | 
						|
	if (!IS_ERR(stm32_dmamux->clk)) {
 | 
						|
		ret = clk_prepare_enable(stm32_dmamux->clk);
 | 
						|
		if (ret < 0) {
 | 
						|
			dev_err(&pdev->dev, "clk_prep_enable error: %d\n", ret);
 | 
						|
			return ret;
 | 
						|
		}
 | 
						|
	}
 | 
						|
 | 
						|
	/* Reset the dmamux */
 | 
						|
	for (i = 0; i < stm32_dmamux->dma_requests; i++)
 | 
						|
		stm32_dmamux_write(stm32_dmamux->iomem, STM32_DMAMUX_CCR(i), 0);
 | 
						|
 | 
						|
	if (!IS_ERR(stm32_dmamux->clk))
 | 
						|
		clk_disable(stm32_dmamux->clk);
 | 
						|
 | 
						|
	return of_dma_router_register(node, stm32_dmamux_route_allocate,
 | 
						|
				     &stm32_dmamux->dmarouter);
 | 
						|
}
 | 
						|
 | 
						|
static const struct of_device_id stm32_dmamux_match[] = {
 | 
						|
	{ .compatible = "st,stm32h7-dmamux" },
 | 
						|
	{},
 | 
						|
};
 | 
						|
 | 
						|
static struct platform_driver stm32_dmamux_driver = {
 | 
						|
	.probe	= stm32_dmamux_probe,
 | 
						|
	.driver = {
 | 
						|
		.name = "stm32-dmamux",
 | 
						|
		.of_match_table = stm32_dmamux_match,
 | 
						|
	},
 | 
						|
};
 | 
						|
 | 
						|
static int __init stm32_dmamux_init(void)
 | 
						|
{
 | 
						|
	return platform_driver_register(&stm32_dmamux_driver);
 | 
						|
}
 | 
						|
arch_initcall(stm32_dmamux_init);
 | 
						|
 | 
						|
MODULE_DESCRIPTION("DMA Router driver for STM32 DMA MUX");
 | 
						|
MODULE_AUTHOR("M'boumba Cedric Madianga <cedric.madianga@gmail.com>");
 | 
						|
MODULE_AUTHOR("Pierre-Yves Mordret <pierre-yves.mordret@st.com>");
 | 
						|
MODULE_LICENSE("GPL v2");
 |