d/freebsd-skq
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Strengthen the sanity checking of busdma tag parameters.

Browse Source 
It turns out an alignment of zero can lead to an endless loop in the
vm reservations code, so specifically disallow that.  The manpage says
hardware which can do dma at any address should use a value of one, which
hints at the forbiddeness of zero without exactly saying it.  Several
other conditions which could lead to insanity in working with the tag are
also checked now.

Every existing call to bus_dma_tag_create() (about 680 of them) was
eyeballed for violations of these things, and two alignment=0 glitches
were fixed.  It's possible something was missed, but overall this
shouldn't lead to any arm users suddenly experiencing failures.
This commit is contained in:
Ian Lepore 2014-11-06 19:14:58 +00:00
parent 4465557ac2
commit 77f4973eec
1 changed files with 10 additions and 7 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

17
sys/arm/arm/busdma_machdep-v6.c
View File

@ -64,6 +64,8 @@ __FBSDID("$FreeBSD$");
#include <machine/cpufunc.h>
#include <machine/md_var.h>
#define IS_POWER_OF_2(val) (((val) & ((val) - 1)) == 0)
#define MAX_BPAGES 64
#define MAX_DMA_SEGMENTS 4096
#define BUS_DMA_EXCL_BOUNCE BUS_DMA_BUS2
@ -466,17 +468,18 @@ bus_dma_tag_create(bus_dma_tag_t parent, bus_size_t alignment,
parent = arm_root_dma_tag;
#endif
/* Basic sanity checking */
if (boundary != 0 && boundary < maxsegsz)
maxsegsz = boundary;
/* Basic sanity checking. */
KASSERT(boundary == 0 || IS_POWER_OF_2(boundary),
("dma tag boundary %lu, must be a power of 2", boundary));
KASSERT(boundary == 0 || boundary >= maxsegsz,
("dma tag boundary %lu is < maxsegsz %lu\n", boundary, maxsegsz));
KASSERT(alignment != 0 && IS_POWER_OF_2(alignment),
("dma tag alignment %lu, must be non-zero power of 2", alignment));
KASSERT(maxsegsz != 0, ("dma tag maxsegsz must not be zero"));
/* Return a NULL tag on failure */
*dmat = NULL;
if (maxsegsz == 0) {
return (EINVAL);
}
newtag = (bus_dma_tag_t)malloc(sizeof(*newtag), M_DEVBUF,
M_ZERO | M_NOWAIT);
if (newtag == NULL) {