ALSA: dice: fix kernel NULL pointer dereference due to invalid calculation for array...
[linux/fpc-iii.git] / drivers / dax / device.c
blob38377970740489111a3e88e1001d2d1d0a772a90
1 /*
2 * Copyright(c) 2016 - 2017 Intel Corporation. All rights reserved.
4 * This program is free software; you can redistribute it and/or modify
5 * it under the terms of version 2 of the GNU General Public License as
6 * published by the Free Software Foundation.
8 * This program is distributed in the hope that it will be useful, but
9 * WITHOUT ANY WARRANTY; without even the implied warranty of
10 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
11 * General Public License for more details.
13 #include <linux/pagemap.h>
14 #include <linux/module.h>
15 #include <linux/device.h>
16 #include <linux/pfn_t.h>
17 #include <linux/cdev.h>
18 #include <linux/slab.h>
19 #include <linux/dax.h>
20 #include <linux/fs.h>
21 #include <linux/mm.h>
22 #include <linux/mman.h>
23 #include "dax-private.h"
24 #include "dax.h"
26 static struct class *dax_class;
29 * Rely on the fact that drvdata is set before the attributes are
30 * registered, and that the attributes are unregistered before drvdata
31 * is cleared to assume that drvdata is always valid.
33 static ssize_t id_show(struct device *dev,
34 struct device_attribute *attr, char *buf)
36 struct dax_region *dax_region = dev_get_drvdata(dev);
38 return sprintf(buf, "%d\n", dax_region->id);
40 static DEVICE_ATTR_RO(id);
42 static ssize_t region_size_show(struct device *dev,
43 struct device_attribute *attr, char *buf)
45 struct dax_region *dax_region = dev_get_drvdata(dev);
47 return sprintf(buf, "%llu\n", (unsigned long long)
48 resource_size(&dax_region->res));
50 static struct device_attribute dev_attr_region_size = __ATTR(size, 0444,
51 region_size_show, NULL);
53 static ssize_t align_show(struct device *dev,
54 struct device_attribute *attr, char *buf)
56 struct dax_region *dax_region = dev_get_drvdata(dev);
58 return sprintf(buf, "%u\n", dax_region->align);
60 static DEVICE_ATTR_RO(align);
62 static struct attribute *dax_region_attributes[] = {
63 &dev_attr_region_size.attr,
64 &dev_attr_align.attr,
65 &dev_attr_id.attr,
66 NULL,
69 static const struct attribute_group dax_region_attribute_group = {
70 .name = "dax_region",
71 .attrs = dax_region_attributes,
74 static const struct attribute_group *dax_region_attribute_groups[] = {
75 &dax_region_attribute_group,
76 NULL,
79 static void dax_region_free(struct kref *kref)
81 struct dax_region *dax_region;
83 dax_region = container_of(kref, struct dax_region, kref);
84 kfree(dax_region);
87 void dax_region_put(struct dax_region *dax_region)
89 kref_put(&dax_region->kref, dax_region_free);
91 EXPORT_SYMBOL_GPL(dax_region_put);
93 static void dax_region_unregister(void *region)
95 struct dax_region *dax_region = region;
97 sysfs_remove_groups(&dax_region->dev->kobj,
98 dax_region_attribute_groups);
99 dax_region_put(dax_region);
102 struct dax_region *alloc_dax_region(struct device *parent, int region_id,
103 struct resource *res, unsigned int align, void *addr,
104 unsigned long pfn_flags)
106 struct dax_region *dax_region;
109 * The DAX core assumes that it can store its private data in
110 * parent->driver_data. This WARN is a reminder / safeguard for
111 * developers of device-dax drivers.
113 if (dev_get_drvdata(parent)) {
114 dev_WARN(parent, "dax core failed to setup private data\n");
115 return NULL;
118 if (!IS_ALIGNED(res->start, align)
119 || !IS_ALIGNED(resource_size(res), align))
120 return NULL;
122 dax_region = kzalloc(sizeof(*dax_region), GFP_KERNEL);
123 if (!dax_region)
124 return NULL;
126 dev_set_drvdata(parent, dax_region);
127 memcpy(&dax_region->res, res, sizeof(*res));
128 dax_region->pfn_flags = pfn_flags;
129 kref_init(&dax_region->kref);
130 dax_region->id = region_id;
131 ida_init(&dax_region->ida);
132 dax_region->align = align;
133 dax_region->dev = parent;
134 dax_region->base = addr;
135 if (sysfs_create_groups(&parent->kobj, dax_region_attribute_groups)) {
136 kfree(dax_region);
137 return NULL;
140 kref_get(&dax_region->kref);
141 if (devm_add_action_or_reset(parent, dax_region_unregister, dax_region))
142 return NULL;
143 return dax_region;
145 EXPORT_SYMBOL_GPL(alloc_dax_region);
147 static struct dev_dax *to_dev_dax(struct device *dev)
149 return container_of(dev, struct dev_dax, dev);
152 static ssize_t size_show(struct device *dev,
153 struct device_attribute *attr, char *buf)
155 struct dev_dax *dev_dax = to_dev_dax(dev);
156 unsigned long long size = 0;
157 int i;
159 for (i = 0; i < dev_dax->num_resources; i++)
160 size += resource_size(&dev_dax->res[i]);
162 return sprintf(buf, "%llu\n", size);
164 static DEVICE_ATTR_RO(size);
166 static struct attribute *dev_dax_attributes[] = {
167 &dev_attr_size.attr,
168 NULL,
171 static const struct attribute_group dev_dax_attribute_group = {
172 .attrs = dev_dax_attributes,
175 static const struct attribute_group *dax_attribute_groups[] = {
176 &dev_dax_attribute_group,
177 NULL,
180 static int check_vma(struct dev_dax *dev_dax, struct vm_area_struct *vma,
181 const char *func)
183 struct dax_region *dax_region = dev_dax->region;
184 struct device *dev = &dev_dax->dev;
185 unsigned long mask;
187 if (!dax_alive(dev_dax->dax_dev))
188 return -ENXIO;
190 /* prevent private mappings from being established */
191 if ((vma->vm_flags & VM_MAYSHARE) != VM_MAYSHARE) {
192 dev_info(dev, "%s: %s: fail, attempted private mapping\n",
193 current->comm, func);
194 return -EINVAL;
197 mask = dax_region->align - 1;
198 if (vma->vm_start & mask || vma->vm_end & mask) {
199 dev_info(dev, "%s: %s: fail, unaligned vma (%#lx - %#lx, %#lx)\n",
200 current->comm, func, vma->vm_start, vma->vm_end,
201 mask);
202 return -EINVAL;
205 if ((dax_region->pfn_flags & (PFN_DEV|PFN_MAP)) == PFN_DEV
206 && (vma->vm_flags & VM_DONTCOPY) == 0) {
207 dev_info(dev, "%s: %s: fail, dax range requires MADV_DONTFORK\n",
208 current->comm, func);
209 return -EINVAL;
212 if (!vma_is_dax(vma)) {
213 dev_info(dev, "%s: %s: fail, vma is not DAX capable\n",
214 current->comm, func);
215 return -EINVAL;
218 return 0;
221 /* see "strong" declaration in tools/testing/nvdimm/dax-dev.c */
222 __weak phys_addr_t dax_pgoff_to_phys(struct dev_dax *dev_dax, pgoff_t pgoff,
223 unsigned long size)
225 struct resource *res;
226 /* gcc-4.6.3-nolibc for i386 complains that this is uninitialized */
227 phys_addr_t uninitialized_var(phys);
228 int i;
230 for (i = 0; i < dev_dax->num_resources; i++) {
231 res = &dev_dax->res[i];
232 phys = pgoff * PAGE_SIZE + res->start;
233 if (phys >= res->start && phys <= res->end)
234 break;
235 pgoff -= PHYS_PFN(resource_size(res));
238 if (i < dev_dax->num_resources) {
239 res = &dev_dax->res[i];
240 if (phys + size - 1 <= res->end)
241 return phys;
244 return -1;
247 static int __dev_dax_pte_fault(struct dev_dax *dev_dax, struct vm_fault *vmf)
249 struct device *dev = &dev_dax->dev;
250 struct dax_region *dax_region;
251 int rc = VM_FAULT_SIGBUS;
252 phys_addr_t phys;
253 pfn_t pfn;
254 unsigned int fault_size = PAGE_SIZE;
256 if (check_vma(dev_dax, vmf->vma, __func__))
257 return VM_FAULT_SIGBUS;
259 dax_region = dev_dax->region;
260 if (dax_region->align > PAGE_SIZE) {
261 dev_dbg(dev, "%s: alignment (%#x) > fault size (%#x)\n",
262 __func__, dax_region->align, fault_size);
263 return VM_FAULT_SIGBUS;
266 if (fault_size != dax_region->align)
267 return VM_FAULT_SIGBUS;
269 phys = dax_pgoff_to_phys(dev_dax, vmf->pgoff, PAGE_SIZE);
270 if (phys == -1) {
271 dev_dbg(dev, "%s: pgoff_to_phys(%#lx) failed\n", __func__,
272 vmf->pgoff);
273 return VM_FAULT_SIGBUS;
276 pfn = phys_to_pfn_t(phys, dax_region->pfn_flags);
278 rc = vm_insert_mixed(vmf->vma, vmf->address, pfn);
280 if (rc == -ENOMEM)
281 return VM_FAULT_OOM;
282 if (rc < 0 && rc != -EBUSY)
283 return VM_FAULT_SIGBUS;
285 return VM_FAULT_NOPAGE;
288 static int __dev_dax_pmd_fault(struct dev_dax *dev_dax, struct vm_fault *vmf)
290 unsigned long pmd_addr = vmf->address & PMD_MASK;
291 struct device *dev = &dev_dax->dev;
292 struct dax_region *dax_region;
293 phys_addr_t phys;
294 pgoff_t pgoff;
295 pfn_t pfn;
296 unsigned int fault_size = PMD_SIZE;
298 if (check_vma(dev_dax, vmf->vma, __func__))
299 return VM_FAULT_SIGBUS;
301 dax_region = dev_dax->region;
302 if (dax_region->align > PMD_SIZE) {
303 dev_dbg(dev, "%s: alignment (%#x) > fault size (%#x)\n",
304 __func__, dax_region->align, fault_size);
305 return VM_FAULT_SIGBUS;
308 /* dax pmd mappings require pfn_t_devmap() */
309 if ((dax_region->pfn_flags & (PFN_DEV|PFN_MAP)) != (PFN_DEV|PFN_MAP)) {
310 dev_dbg(dev, "%s: region lacks devmap flags\n", __func__);
311 return VM_FAULT_SIGBUS;
314 if (fault_size < dax_region->align)
315 return VM_FAULT_SIGBUS;
316 else if (fault_size > dax_region->align)
317 return VM_FAULT_FALLBACK;
319 /* if we are outside of the VMA */
320 if (pmd_addr < vmf->vma->vm_start ||
321 (pmd_addr + PMD_SIZE) > vmf->vma->vm_end)
322 return VM_FAULT_SIGBUS;
324 pgoff = linear_page_index(vmf->vma, pmd_addr);
325 phys = dax_pgoff_to_phys(dev_dax, pgoff, PMD_SIZE);
326 if (phys == -1) {
327 dev_dbg(dev, "%s: pgoff_to_phys(%#lx) failed\n", __func__,
328 pgoff);
329 return VM_FAULT_SIGBUS;
332 pfn = phys_to_pfn_t(phys, dax_region->pfn_flags);
334 return vmf_insert_pfn_pmd(vmf->vma, vmf->address, vmf->pmd, pfn,
335 vmf->flags & FAULT_FLAG_WRITE);
338 #ifdef CONFIG_HAVE_ARCH_TRANSPARENT_HUGEPAGE_PUD
339 static int __dev_dax_pud_fault(struct dev_dax *dev_dax, struct vm_fault *vmf)
341 unsigned long pud_addr = vmf->address & PUD_MASK;
342 struct device *dev = &dev_dax->dev;
343 struct dax_region *dax_region;
344 phys_addr_t phys;
345 pgoff_t pgoff;
346 pfn_t pfn;
347 unsigned int fault_size = PUD_SIZE;
350 if (check_vma(dev_dax, vmf->vma, __func__))
351 return VM_FAULT_SIGBUS;
353 dax_region = dev_dax->region;
354 if (dax_region->align > PUD_SIZE) {
355 dev_dbg(dev, "%s: alignment (%#x) > fault size (%#x)\n",
356 __func__, dax_region->align, fault_size);
357 return VM_FAULT_SIGBUS;
360 /* dax pud mappings require pfn_t_devmap() */
361 if ((dax_region->pfn_flags & (PFN_DEV|PFN_MAP)) != (PFN_DEV|PFN_MAP)) {
362 dev_dbg(dev, "%s: region lacks devmap flags\n", __func__);
363 return VM_FAULT_SIGBUS;
366 if (fault_size < dax_region->align)
367 return VM_FAULT_SIGBUS;
368 else if (fault_size > dax_region->align)
369 return VM_FAULT_FALLBACK;
371 /* if we are outside of the VMA */
372 if (pud_addr < vmf->vma->vm_start ||
373 (pud_addr + PUD_SIZE) > vmf->vma->vm_end)
374 return VM_FAULT_SIGBUS;
376 pgoff = linear_page_index(vmf->vma, pud_addr);
377 phys = dax_pgoff_to_phys(dev_dax, pgoff, PUD_SIZE);
378 if (phys == -1) {
379 dev_dbg(dev, "%s: pgoff_to_phys(%#lx) failed\n", __func__,
380 pgoff);
381 return VM_FAULT_SIGBUS;
384 pfn = phys_to_pfn_t(phys, dax_region->pfn_flags);
386 return vmf_insert_pfn_pud(vmf->vma, vmf->address, vmf->pud, pfn,
387 vmf->flags & FAULT_FLAG_WRITE);
389 #else
390 static int __dev_dax_pud_fault(struct dev_dax *dev_dax, struct vm_fault *vmf)
392 return VM_FAULT_FALLBACK;
394 #endif /* !CONFIG_HAVE_ARCH_TRANSPARENT_HUGEPAGE_PUD */
396 static int dev_dax_huge_fault(struct vm_fault *vmf,
397 enum page_entry_size pe_size)
399 int rc, id;
400 struct file *filp = vmf->vma->vm_file;
401 struct dev_dax *dev_dax = filp->private_data;
403 dev_dbg(&dev_dax->dev, "%s: %s: %s (%#lx - %#lx) size = %d\n", __func__,
404 current->comm, (vmf->flags & FAULT_FLAG_WRITE)
405 ? "write" : "read",
406 vmf->vma->vm_start, vmf->vma->vm_end, pe_size);
408 id = dax_read_lock();
409 switch (pe_size) {
410 case PE_SIZE_PTE:
411 rc = __dev_dax_pte_fault(dev_dax, vmf);
412 break;
413 case PE_SIZE_PMD:
414 rc = __dev_dax_pmd_fault(dev_dax, vmf);
415 break;
416 case PE_SIZE_PUD:
417 rc = __dev_dax_pud_fault(dev_dax, vmf);
418 break;
419 default:
420 rc = VM_FAULT_SIGBUS;
422 dax_read_unlock(id);
424 return rc;
427 static int dev_dax_fault(struct vm_fault *vmf)
429 return dev_dax_huge_fault(vmf, PE_SIZE_PTE);
432 static int dev_dax_split(struct vm_area_struct *vma, unsigned long addr)
434 struct file *filp = vma->vm_file;
435 struct dev_dax *dev_dax = filp->private_data;
436 struct dax_region *dax_region = dev_dax->region;
438 if (!IS_ALIGNED(addr, dax_region->align))
439 return -EINVAL;
440 return 0;
443 static const struct vm_operations_struct dax_vm_ops = {
444 .fault = dev_dax_fault,
445 .huge_fault = dev_dax_huge_fault,
446 .split = dev_dax_split,
449 static int dax_mmap(struct file *filp, struct vm_area_struct *vma)
451 struct dev_dax *dev_dax = filp->private_data;
452 int rc, id;
454 dev_dbg(&dev_dax->dev, "%s\n", __func__);
457 * We lock to check dax_dev liveness and will re-check at
458 * fault time.
460 id = dax_read_lock();
461 rc = check_vma(dev_dax, vma, __func__);
462 dax_read_unlock(id);
463 if (rc)
464 return rc;
466 vma->vm_ops = &dax_vm_ops;
467 vma->vm_flags |= VM_MIXEDMAP | VM_HUGEPAGE;
468 return 0;
471 /* return an unmapped area aligned to the dax region specified alignment */
472 static unsigned long dax_get_unmapped_area(struct file *filp,
473 unsigned long addr, unsigned long len, unsigned long pgoff,
474 unsigned long flags)
476 unsigned long off, off_end, off_align, len_align, addr_align, align;
477 struct dev_dax *dev_dax = filp ? filp->private_data : NULL;
478 struct dax_region *dax_region;
480 if (!dev_dax || addr)
481 goto out;
483 dax_region = dev_dax->region;
484 align = dax_region->align;
485 off = pgoff << PAGE_SHIFT;
486 off_end = off + len;
487 off_align = round_up(off, align);
489 if ((off_end <= off_align) || ((off_end - off_align) < align))
490 goto out;
492 len_align = len + align;
493 if ((off + len_align) < off)
494 goto out;
496 addr_align = current->mm->get_unmapped_area(filp, addr, len_align,
497 pgoff, flags);
498 if (!IS_ERR_VALUE(addr_align)) {
499 addr_align += (off - addr_align) & (align - 1);
500 return addr_align;
502 out:
503 return current->mm->get_unmapped_area(filp, addr, len, pgoff, flags);
506 static int dax_open(struct inode *inode, struct file *filp)
508 struct dax_device *dax_dev = inode_dax(inode);
509 struct inode *__dax_inode = dax_inode(dax_dev);
510 struct dev_dax *dev_dax = dax_get_private(dax_dev);
512 dev_dbg(&dev_dax->dev, "%s\n", __func__);
513 inode->i_mapping = __dax_inode->i_mapping;
514 inode->i_mapping->host = __dax_inode;
515 filp->f_mapping = inode->i_mapping;
516 filp->f_wb_err = filemap_sample_wb_err(filp->f_mapping);
517 filp->private_data = dev_dax;
518 inode->i_flags = S_DAX;
520 return 0;
523 static int dax_release(struct inode *inode, struct file *filp)
525 struct dev_dax *dev_dax = filp->private_data;
527 dev_dbg(&dev_dax->dev, "%s\n", __func__);
528 return 0;
531 static const struct file_operations dax_fops = {
532 .llseek = noop_llseek,
533 .owner = THIS_MODULE,
534 .open = dax_open,
535 .release = dax_release,
536 .get_unmapped_area = dax_get_unmapped_area,
537 .mmap = dax_mmap,
538 .mmap_supported_flags = MAP_SYNC,
541 static void dev_dax_release(struct device *dev)
543 struct dev_dax *dev_dax = to_dev_dax(dev);
544 struct dax_region *dax_region = dev_dax->region;
545 struct dax_device *dax_dev = dev_dax->dax_dev;
547 if (dev_dax->id >= 0)
548 ida_simple_remove(&dax_region->ida, dev_dax->id);
549 dax_region_put(dax_region);
550 put_dax(dax_dev);
551 kfree(dev_dax);
554 static void kill_dev_dax(struct dev_dax *dev_dax)
556 struct dax_device *dax_dev = dev_dax->dax_dev;
557 struct inode *inode = dax_inode(dax_dev);
559 kill_dax(dax_dev);
560 unmap_mapping_range(inode->i_mapping, 0, 0, 1);
563 static void unregister_dev_dax(void *dev)
565 struct dev_dax *dev_dax = to_dev_dax(dev);
566 struct dax_device *dax_dev = dev_dax->dax_dev;
567 struct inode *inode = dax_inode(dax_dev);
568 struct cdev *cdev = inode->i_cdev;
570 dev_dbg(dev, "%s\n", __func__);
572 kill_dev_dax(dev_dax);
573 cdev_device_del(cdev, dev);
574 put_device(dev);
577 struct dev_dax *devm_create_dev_dax(struct dax_region *dax_region,
578 int id, struct resource *res, int count)
580 struct device *parent = dax_region->dev;
581 struct dax_device *dax_dev;
582 struct dev_dax *dev_dax;
583 struct inode *inode;
584 struct device *dev;
585 struct cdev *cdev;
586 int rc, i;
588 if (!count)
589 return ERR_PTR(-EINVAL);
591 dev_dax = kzalloc(sizeof(*dev_dax) + sizeof(*res) * count, GFP_KERNEL);
592 if (!dev_dax)
593 return ERR_PTR(-ENOMEM);
595 for (i = 0; i < count; i++) {
596 if (!IS_ALIGNED(res[i].start, dax_region->align)
597 || !IS_ALIGNED(resource_size(&res[i]),
598 dax_region->align)) {
599 rc = -EINVAL;
600 break;
602 dev_dax->res[i].start = res[i].start;
603 dev_dax->res[i].end = res[i].end;
606 if (i < count)
607 goto err_id;
609 if (id < 0) {
610 id = ida_simple_get(&dax_region->ida, 0, 0, GFP_KERNEL);
611 dev_dax->id = id;
612 if (id < 0) {
613 rc = id;
614 goto err_id;
616 } else {
617 /* region provider owns @id lifetime */
618 dev_dax->id = -1;
622 * No 'host' or dax_operations since there is no access to this
623 * device outside of mmap of the resulting character device.
625 dax_dev = alloc_dax(dev_dax, NULL, NULL);
626 if (!dax_dev) {
627 rc = -ENOMEM;
628 goto err_dax;
631 /* from here on we're committed to teardown via dax_dev_release() */
632 dev = &dev_dax->dev;
633 device_initialize(dev);
635 inode = dax_inode(dax_dev);
636 cdev = inode->i_cdev;
637 cdev_init(cdev, &dax_fops);
638 cdev->owner = parent->driver->owner;
640 dev_dax->num_resources = count;
641 dev_dax->dax_dev = dax_dev;
642 dev_dax->region = dax_region;
643 kref_get(&dax_region->kref);
645 dev->devt = inode->i_rdev;
646 dev->class = dax_class;
647 dev->parent = parent;
648 dev->groups = dax_attribute_groups;
649 dev->release = dev_dax_release;
650 dev_set_name(dev, "dax%d.%d", dax_region->id, id);
652 rc = cdev_device_add(cdev, dev);
653 if (rc) {
654 kill_dev_dax(dev_dax);
655 put_device(dev);
656 return ERR_PTR(rc);
659 rc = devm_add_action_or_reset(dax_region->dev, unregister_dev_dax, dev);
660 if (rc)
661 return ERR_PTR(rc);
663 return dev_dax;
665 err_dax:
666 if (dev_dax->id >= 0)
667 ida_simple_remove(&dax_region->ida, dev_dax->id);
668 err_id:
669 kfree(dev_dax);
671 return ERR_PTR(rc);
673 EXPORT_SYMBOL_GPL(devm_create_dev_dax);
675 static int __init dax_init(void)
677 dax_class = class_create(THIS_MODULE, "dax");
678 return PTR_ERR_OR_ZERO(dax_class);
681 static void __exit dax_exit(void)
683 class_destroy(dax_class);
686 MODULE_AUTHOR("Intel Corporation");
687 MODULE_LICENSE("GPL v2");
688 subsys_initcall(dax_init);
689 module_exit(dax_exit);