* [PATCH] early: usb: xhci-dbc: Handle out of bounds xhci-xdbc capability
@ 2026-07-20 19:12 Umang Jain
2026-08-19 5:09 ` Umang Jain
0 siblings, 1 reply; 2+ messages in thread
From: Umang Jain @ 2026-07-20 19:12 UTC (permalink / raw)
To: Greg Kroah-Hartman, Lucas De Marchi, Mathias Nyman
Cc: linux-usb, linux-kernel, kernel-dev, Umang Jain
Currently, the early xhci-dbc assumes that the extended capability
can be mapped within the fixed boot time mappings dictated by
NR_FIX_BTMAPS.
This patch iterates over the PCI BAR address size to find and map
xhci-xdbc capability which could be out-of-bounds otherwise,
in xdbc_map_pci_mmio(). The iterations map the maximum allowed
boot time mappings (fixmap size) at a time and search for xhci-xdbc
capability offset, till the end of the bar address size.
This brings the need to track the early_ioremap() mapped size separately
hence, introduce additional struct member xhci_base_length in
struct xdbc_state.
Signed-off-by: Umang Jain <uajain@igalia.com>
---
Link to earlier RFC:
https://lore.kernel.org/all/20260604144122.962236-1-uajain@igalia.com/
---
drivers/usb/early/xhci-dbc.c | 94 +++++++++++++++++++++++++++++++++---
drivers/usb/early/xhci-dbc.h | 1 +
2 files changed, 87 insertions(+), 8 deletions(-)
diff --git a/drivers/usb/early/xhci-dbc.c b/drivers/usb/early/xhci-dbc.c
index 41118bba9197..5e540b6bf962 100644
--- a/drivers/usb/early/xhci-dbc.c
+++ b/drivers/usb/early/xhci-dbc.c
@@ -35,10 +35,23 @@ static bool early_console_keep;
static inline void xdbc_trace(const char *fmt, ...) { }
#endif /* XDBC_TRACE */
+/* Size of xHCI debug capability structure */
+#define XDBC_MAPPING_SIZE 56
+
+enum xdbc_capability_flags {
+ XDBC_CAP_FLAG_NONE = 0,
+ XDBC_CAP_FLAG_LEGACY = 1 << 0,
+ XDBC_CAP_FLAG_PROTOCOL = 1 << 1,
+ XDBC_CAP_FLAG_DEBUG = 1 << 2,
+};
+
static void __iomem * __init xdbc_map_pci_mmio(u32 bus, u32 dev, u32 func)
{
- u64 val64, sz64, mask64;
+ u64 val64, sz64, mask64, fixmap_size, mapped_size;
+ enum xdbc_capability_flags cap_flags = XDBC_CAP_FLAG_NONE;
+ bool found_all_caps = false;
void __iomem *base;
+ int offset;
u32 val, sz;
u8 byte;
@@ -85,7 +98,72 @@ static void __iomem * __init xdbc_map_pci_mmio(u32 bus, u32 dev, u32 func)
xdbc.xhci_start = val64;
xdbc.xhci_length = sz64;
- base = early_ioremap(val64, sz64);
+
+ fixmap_size = NR_FIX_BTMAPS << PAGE_SHIFT;
+ if (sz64 < fixmap_size) {
+ xdbc.xhci_base_length = sz64;
+ return early_ioremap(val64, sz64);
+ }
+
+ /*
+ * Base address size is greater than fixed size boot mappings,
+ * hence iterate over the region one fixmap_size at a time,
+ * starting with XHCI_EXP_CAPS_DEBUG capability.
+ */
+ base = early_ioremap(val64, fixmap_size);
+ offset = xhci_find_next_ext_cap(base, 0, 0);
+ mapped_size = fixmap_size;
+
+ while (mapped_size <= sz64) {
+ val = readl(base + offset);
+ switch (XHCI_EXT_CAPS_ID(val)) {
+ case XHCI_EXT_CAPS_DEBUG:
+ if (offset + XDBC_MAPPING_SIZE > fixmap_size) {
+ early_iounmap(base, fixmap_size);
+ base = early_ioremap(val64 + offset, XDBC_MAPPING_SIZE);
+
+ mapped_size += offset;
+ cap_flags = XDBC_CAP_FLAG_NONE;
+ }
+ cap_flags |= XDBC_CAP_FLAG_DEBUG;
+ break;
+ case XHCI_EXT_CAPS_PROTOCOL:
+ cap_flags |= XDBC_CAP_FLAG_PROTOCOL;
+ break;
+ case XHCI_EXT_CAPS_LEGACY:
+ cap_flags |= XDBC_CAP_FLAG_LEGACY;
+ break;
+ }
+
+ if ((cap_flags & XDBC_CAP_FLAG_DEBUG) &&
+ (cap_flags & XDBC_CAP_FLAG_PROTOCOL) &&
+ (cap_flags & XDBC_CAP_FLAG_LEGACY)) {
+ found_all_caps = true;
+ break;
+ }
+
+ /*
+ * Find offset to next xhci-ext capability, remap if the offset
+ * is out of bounds of the already mapped region.
+ */
+ offset = xhci_find_next_ext_cap(base, offset, 0);
+ if (!offset) {
+ early_iounmap(base, fixmap_size);
+ base = early_ioremap(val64 + mapped_size, fixmap_size);
+ mapped_size += fixmap_size;
+
+ offset = xhci_find_next_ext_cap(base, 0, 0);
+ cap_flags = XDBC_CAP_FLAG_NONE;
+
+ }
+ }
+
+ if (found_all_caps) {
+ xdbc.xhci_base_length = fixmap_size;
+ } else {
+ xdbc.xhci_base_length = 0;
+ base = NULL;
+ }
return base;
}
@@ -643,9 +721,9 @@ int __init early_xdbc_parse_parameter(char *s, int keep_early)
offset = xhci_find_next_ext_cap(xdbc.xhci_base, 0, XHCI_EXT_CAPS_DEBUG);
if (!offset) {
pr_notice("xhci host doesn't support debug capability\n");
- early_iounmap(xdbc.xhci_base, xdbc.xhci_length);
+ early_iounmap(xdbc.xhci_base, xdbc.xhci_base_length);
xdbc.xhci_base = NULL;
- xdbc.xhci_length = 0;
+ xdbc.xhci_base_length = 0;
return -ENODEV;
}
@@ -682,9 +760,9 @@ int __init early_xdbc_setup_hardware(void)
xdbc.table_base = NULL;
xdbc.out_buf = NULL;
- early_iounmap(xdbc.xhci_base, xdbc.xhci_length);
+ early_iounmap(xdbc.xhci_base, xdbc.xhci_base_length);
xdbc.xhci_base = NULL;
- xdbc.xhci_length = 0;
+ xdbc.xhci_base_length = 0;
}
return ret;
@@ -987,7 +1065,7 @@ static int __init xdbc_init(void)
}
raw_spin_lock_irqsave(&xdbc.lock, flags);
- early_iounmap(xdbc.xhci_base, xdbc.xhci_length);
+ early_iounmap(xdbc.xhci_base, xdbc.xhci_base_length);
xdbc.xhci_base = base;
offset = xhci_find_next_ext_cap(xdbc.xhci_base, 0, XHCI_EXT_CAPS_DEBUG);
xdbc.xdbc_reg = (struct xdbc_regs __iomem *)(xdbc.xhci_base + offset);
@@ -1004,7 +1082,7 @@ static int __init xdbc_init(void)
memblock_phys_free(xdbc.table_dma, PAGE_SIZE);
memblock_phys_free(xdbc.out_dma, PAGE_SIZE);
writel(0, &xdbc.xdbc_reg->control);
- early_iounmap(xdbc.xhci_base, xdbc.xhci_length);
+ early_iounmap(xdbc.xhci_base, xdbc.xhci_base_length);
return ret;
}
diff --git a/drivers/usb/early/xhci-dbc.h b/drivers/usb/early/xhci-dbc.h
index 8b4d71de45fc..e2aefb796084 100644
--- a/drivers/usb/early/xhci-dbc.h
+++ b/drivers/usb/early/xhci-dbc.h
@@ -144,6 +144,7 @@ struct xdbc_state {
u32 dev;
u32 func;
void __iomem *xhci_base;
+ size_t xhci_base_length;
u64 xhci_start;
size_t xhci_length;
int port_number;
--
2.55.0
^ permalink raw reply related [flat|nested] 2+ messages in thread
* Re: [PATCH] early: usb: xhci-dbc: Handle out of bounds xhci-xdbc capability
2026-07-20 19:12 [PATCH] early: usb: xhci-dbc: Handle out of bounds xhci-xdbc capability Umang Jain
@ 2026-08-19 5:09 ` Umang Jain
0 siblings, 0 replies; 2+ messages in thread
From: Umang Jain @ 2026-08-19 5:09 UTC (permalink / raw)
To: Umang Jain via Kernel-dev
Cc: Greg Kroah-Hartman, Lucas De Marchi, Mathias Nyman, linux-usb,
linux-kernel
Hello,
Gentle ping for review feedback.
On 2026-07-20 19:12, Umang Jain via Kernel-dev wrote:
> Currently, the early xhci-dbc assumes that the extended capability
> can be mapped within the fixed boot time mappings dictated by
> NR_FIX_BTMAPS.
>
> This patch iterates over the PCI BAR address size to find and map
> xhci-xdbc capability which could be out-of-bounds otherwise,
> in xdbc_map_pci_mmio(). The iterations map the maximum allowed
> boot time mappings (fixmap size) at a time and search for xhci-xdbc
> capability offset, till the end of the bar address size.
>
> This brings the need to track the early_ioremap() mapped size separately
> hence, introduce additional struct member xhci_base_length in
> struct xdbc_state.
>
> Signed-off-by: Umang Jain <uajain@igalia.com>
> ---
> Link to earlier RFC:
> https://lore.kernel.org/all/20260604144122.962236-1-uajain@igalia.com/
> ---
> drivers/usb/early/xhci-dbc.c | 94 +++++++++++++++++++++++++++++++++---
> drivers/usb/early/xhci-dbc.h | 1 +
> 2 files changed, 87 insertions(+), 8 deletions(-)
>
> diff --git a/drivers/usb/early/xhci-dbc.c b/drivers/usb/early/xhci-dbc.c
> index 41118bba9197..5e540b6bf962 100644
> --- a/drivers/usb/early/xhci-dbc.c
> +++ b/drivers/usb/early/xhci-dbc.c
> @@ -35,10 +35,23 @@ static bool early_console_keep;
> static inline void xdbc_trace(const char *fmt, ...) { }
> #endif /* XDBC_TRACE */
>
> +/* Size of xHCI debug capability structure */
> +#define XDBC_MAPPING_SIZE 56
> +
> +enum xdbc_capability_flags {
> + XDBC_CAP_FLAG_NONE = 0,
> + XDBC_CAP_FLAG_LEGACY = 1 << 0,
> + XDBC_CAP_FLAG_PROTOCOL = 1 << 1,
> + XDBC_CAP_FLAG_DEBUG = 1 << 2,
> +};
> +
> static void __iomem * __init xdbc_map_pci_mmio(u32 bus, u32 dev, u32 func)
> {
> - u64 val64, sz64, mask64;
> + u64 val64, sz64, mask64, fixmap_size, mapped_size;
> + enum xdbc_capability_flags cap_flags = XDBC_CAP_FLAG_NONE;
> + bool found_all_caps = false;
> void __iomem *base;
> + int offset;
> u32 val, sz;
> u8 byte;
>
> @@ -85,7 +98,72 @@ static void __iomem * __init xdbc_map_pci_mmio(u32 bus, u32 dev, u32 func)
>
> xdbc.xhci_start = val64;
> xdbc.xhci_length = sz64;
> - base = early_ioremap(val64, sz64);
> +
> + fixmap_size = NR_FIX_BTMAPS << PAGE_SHIFT;
> + if (sz64 < fixmap_size) {
> + xdbc.xhci_base_length = sz64;
> + return early_ioremap(val64, sz64);
> + }
> +
> + /*
> + * Base address size is greater than fixed size boot mappings,
> + * hence iterate over the region one fixmap_size at a time,
> + * starting with XHCI_EXP_CAPS_DEBUG capability.
> + */
> + base = early_ioremap(val64, fixmap_size);
> + offset = xhci_find_next_ext_cap(base, 0, 0);
> + mapped_size = fixmap_size;
> +
> + while (mapped_size <= sz64) {
> + val = readl(base + offset);
> + switch (XHCI_EXT_CAPS_ID(val)) {
> + case XHCI_EXT_CAPS_DEBUG:
> + if (offset + XDBC_MAPPING_SIZE > fixmap_size) {
> + early_iounmap(base, fixmap_size);
> + base = early_ioremap(val64 + offset, XDBC_MAPPING_SIZE);
> +
> + mapped_size += offset;
> + cap_flags = XDBC_CAP_FLAG_NONE;
> + }
> + cap_flags |= XDBC_CAP_FLAG_DEBUG;
> + break;
> + case XHCI_EXT_CAPS_PROTOCOL:
> + cap_flags |= XDBC_CAP_FLAG_PROTOCOL;
> + break;
> + case XHCI_EXT_CAPS_LEGACY:
> + cap_flags |= XDBC_CAP_FLAG_LEGACY;
> + break;
> + }
> +
> + if ((cap_flags & XDBC_CAP_FLAG_DEBUG) &&
> + (cap_flags & XDBC_CAP_FLAG_PROTOCOL) &&
> + (cap_flags & XDBC_CAP_FLAG_LEGACY)) {
> + found_all_caps = true;
> + break;
> + }
> +
> + /*
> + * Find offset to next xhci-ext capability, remap if the offset
> + * is out of bounds of the already mapped region.
> + */
> + offset = xhci_find_next_ext_cap(base, offset, 0);
> + if (!offset) {
> + early_iounmap(base, fixmap_size);
> + base = early_ioremap(val64 + mapped_size, fixmap_size);
> + mapped_size += fixmap_size;
> +
> + offset = xhci_find_next_ext_cap(base, 0, 0);
> + cap_flags = XDBC_CAP_FLAG_NONE;
> +
> + }
> + }
> +
> + if (found_all_caps) {
> + xdbc.xhci_base_length = fixmap_size;
> + } else {
> + xdbc.xhci_base_length = 0;
> + base = NULL;
> + }
>
> return base;
> }
> @@ -643,9 +721,9 @@ int __init early_xdbc_parse_parameter(char *s, int keep_early)
> offset = xhci_find_next_ext_cap(xdbc.xhci_base, 0, XHCI_EXT_CAPS_DEBUG);
> if (!offset) {
> pr_notice("xhci host doesn't support debug capability\n");
> - early_iounmap(xdbc.xhci_base, xdbc.xhci_length);
> + early_iounmap(xdbc.xhci_base, xdbc.xhci_base_length);
> xdbc.xhci_base = NULL;
> - xdbc.xhci_length = 0;
> + xdbc.xhci_base_length = 0;
>
> return -ENODEV;
> }
> @@ -682,9 +760,9 @@ int __init early_xdbc_setup_hardware(void)
> xdbc.table_base = NULL;
> xdbc.out_buf = NULL;
>
> - early_iounmap(xdbc.xhci_base, xdbc.xhci_length);
> + early_iounmap(xdbc.xhci_base, xdbc.xhci_base_length);
> xdbc.xhci_base = NULL;
> - xdbc.xhci_length = 0;
> + xdbc.xhci_base_length = 0;
> }
>
> return ret;
> @@ -987,7 +1065,7 @@ static int __init xdbc_init(void)
> }
>
> raw_spin_lock_irqsave(&xdbc.lock, flags);
> - early_iounmap(xdbc.xhci_base, xdbc.xhci_length);
> + early_iounmap(xdbc.xhci_base, xdbc.xhci_base_length);
> xdbc.xhci_base = base;
> offset = xhci_find_next_ext_cap(xdbc.xhci_base, 0, XHCI_EXT_CAPS_DEBUG);
> xdbc.xdbc_reg = (struct xdbc_regs __iomem *)(xdbc.xhci_base + offset);
> @@ -1004,7 +1082,7 @@ static int __init xdbc_init(void)
> memblock_phys_free(xdbc.table_dma, PAGE_SIZE);
> memblock_phys_free(xdbc.out_dma, PAGE_SIZE);
> writel(0, &xdbc.xdbc_reg->control);
> - early_iounmap(xdbc.xhci_base, xdbc.xhci_length);
> + early_iounmap(xdbc.xhci_base, xdbc.xhci_base_length);
>
> return ret;
> }
> diff --git a/drivers/usb/early/xhci-dbc.h b/drivers/usb/early/xhci-dbc.h
> index 8b4d71de45fc..e2aefb796084 100644
> --- a/drivers/usb/early/xhci-dbc.h
> +++ b/drivers/usb/early/xhci-dbc.h
> @@ -144,6 +144,7 @@ struct xdbc_state {
> u32 dev;
> u32 func;
> void __iomem *xhci_base;
> + size_t xhci_base_length;
> u64 xhci_start;
> size_t xhci_length;
> int port_number;
^ permalink raw reply [flat|nested] 2+ messages in thread
end of thread, other threads:[~2026-08-19 5:09 UTC | newest]
Thread overview: 2+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2026-07-20 19:12 [PATCH] early: usb: xhci-dbc: Handle out of bounds xhci-xdbc capability Umang Jain
2026-08-19 5:09 ` Umang Jain
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).