hak5
/
openwrt
mirror of https://github.com/hak5/openwrt.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

brcm2708: fix DMA leaks in bcm2835-mmc 

Add patches from https://github.com/raspberrypi/linux/pull/3164

Signed-off-by: Álvaro Fernández Rojas <noltari@gmail.com>
master
Álvaro Fernández Rojas 2019-08-27 15:19:26 +02:00
parent 2340c646e6
commit 2876709fb7
2 changed files with 79 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

46
target/linux/brcm2708/patches-4.19/951-0001-Add-missing-dma_unmap_sg-calls-to-free-relevant-swio.patch Normal file
View File

@ -0,0 +1,46 @@
From 51487e55ceabd24572bdd12ed7fd45e20676f399 Mon Sep 17 00:00:00 2001
From: Yaroslav Rosomakho <yaroslavros@gmail.com>
Date: Fri, 23 Aug 2019 11:05:51 +0200
Subject: [PATCH 1/2] Add missing dma_unmap_sg calls to free relevant swiotlb
bounce buffers. This prevents DMA leaks.
Signed-off-by: Yaroslav Rosomakho <yaroslavros@gmail.com>
---
drivers/mmc/host/bcm2835-mmc.c | 15 +++++++++------
1 file changed, 9 insertions(+), 6 deletions(-)
--- a/drivers/mmc/host/bcm2835-mmc.c
+++ b/drivers/mmc/host/bcm2835-mmc.c
@@ -344,16 +344,17 @@ static void bcm2835_mmc_dma_complete(voi
host->use_dma = false;
- if (host->data && !(host->data->flags & MMC_DATA_WRITE)) {
- /* otherwise handled in SDHCI IRQ */
+ if (host->data) {
dma_chan = host->dma_chan_rxtx;
- dir_data = DMA_FROM_DEVICE;
-
+ if (host->data->flags & MMC_DATA_WRITE)
+ dir_data = DMA_TO_DEVICE;
+ else
+ dir_data = DMA_FROM_DEVICE;
dma_unmap_sg(dma_chan->device->dev,
host->data->sg, host->data->sg_len,
dir_data);
-
- bcm2835_mmc_finish_data(host);
+ if (! (host->data->flags & MMC_DATA_WRITE))
+ bcm2835_mmc_finish_data(host);
} else if (host->wait_for_dma) {
host->wait_for_dma = false;
tasklet_schedule(&host->finish_tasklet);
@@ -539,6 +540,8 @@ static void bcm2835_mmc_transfer_dma(str
spin_unlock_irqrestore(&host->lock, flags);
dmaengine_submit(desc);
dma_async_issue_pending(dma_chan);
+ } else {
+ dma_unmap_sg(dma_chan->device->dev, host->data->sg, len, dir_data);
}
}

33
target/linux/brcm2708/patches-4.19/952-0002-Limit-max_req_size-under-arm64-or-any-other-platform.patch Normal file
View File

@ -0,0 +1,33 @@
From ea1ecb2257bef3cc0b23c08364436103141999c7 Mon Sep 17 00:00:00 2001
From: Yaroslav Rosomakho <yaroslavros@gmail.com>
Date: Fri, 23 Aug 2019 11:02:22 +0200
Subject: [PATCH 2/2] Limit max_req_size under arm64 (or any other platform
that uses swiotlb) to prevent potential buffer overflow due to bouncing.
Signed-off-by: Yaroslav Rosomakho <yaroslavros@gmail.com>
---
drivers/mmc/host/bcm2835-mmc.c | 6 +++++-
1 file changed, 5 insertions(+), 1 deletion(-)
--- a/drivers/mmc/host/bcm2835-mmc.c
+++ b/drivers/mmc/host/bcm2835-mmc.c
@@ -38,6 +38,7 @@
#include <linux/dmaengine.h>
#include <linux/dma-mapping.h>
#include <linux/of_dma.h>
+#include <linux/swiotlb.h>
#include "sdhci.h"
@@ -1377,7 +1378,10 @@ static int bcm2835_mmc_add_host(struct b
}
#endif
mmc->max_segs = 128;
- mmc->max_req_size = 524288;
+ if (swiotlb_max_segment())
+ mmc->max_req_size = (1 << IO_TLB_SHIFT) * IO_TLB_SEGSIZE;
+ else
+ mmc->max_req_size = 524288;
mmc->max_seg_size = mmc->max_req_size;
mmc->max_blk_size = 512;
mmc->max_blk_count = 65535;