Linux-ARM-Kernel Archive on lore.kernel.org
 help / color / Atom feed
From: Sasha Levin <sashal@kernel.org>
To: linux-kernel@vger.kernel.org, stable@vger.kernel.org
Cc: Sasha Levin <sashal@kernel.org>,
	Lorenzo Pieralisi <lorenzo.pieralisi@arm.com>,
	Catalin Marinas <catalin.marinas@arm.com>,
	Pankaj Bansal <pankaj.bansal@nxp.com>,
	Hanjun Guo <guohanjun@huawei.com>,
	Robin Murphy <robin.murphy@arm.com>,
	linux-acpi@vger.kernel.org, Sudeep Holla <sudeep.holla@arm.com>,
	Will Deacon <will@kernel.org>,
	linux-arm-kernel@lists.infradead.org
Subject: [PATCH AUTOSEL 4.19 186/252] ACPI/IORT: Fix 'Number of IDs' handling in iort_id_map()
Date: Fri, 14 Feb 2020 11:10:41 -0500
Message-ID: <20200214161147.15842-186-sashal@kernel.org> (raw)
In-Reply-To: <20200214161147.15842-1-sashal@kernel.org>

From: Hanjun Guo <guohanjun@huawei.com>

[ Upstream commit 3c23b83a88d00383e1d498cfa515249aa2fe0238 ]

The IORT specification [0] (Section 3, table 4, page 9) defines the
'Number of IDs' as 'The number of IDs in the range minus one'.

However, the IORT ID mapping function iort_id_map() treats the 'Number
of IDs' field as if it were the full IDs mapping count, with the
following check in place to detect out of boundary input IDs:

InputID >= Input base + Number of IDs

This check is flawed in that it considers the 'Number of IDs' field as
the full number of IDs mapping and disregards the 'minus one' from
the IDs count.

The correct check in iort_id_map() should be implemented as:

InputID > Input base + Number of IDs

this implements the specification correctly but unfortunately it breaks
existing firmwares that erroneously set the 'Number of IDs' as the full
IDs mapping count rather than IDs mapping count minus one.

e.g.

PCI hostbridge mapping entry 1:
Input base:  0x1000
ID Count:    0x100
Output base: 0x1000
Output reference: 0xC4  //ITS reference

PCI hostbridge mapping entry 2:
Input base:  0x1100
ID Count:    0x100
Output base: 0x2000
Output reference: 0xD4  //ITS reference

Two mapping entries which the second entry's Input base = the first
entry's Input base + ID count, so for InputID 0x1100 and with the
correct InputID check in place in iort_id_map() the kernel would map
the InputID to ITS 0xC4 not 0xD4 as it would be expected.

Therefore, to keep supporting existing flawed firmwares, introduce a
workaround that instructs the kernel to use the old InputID range check
logic in iort_id_map(), so that we can support both firmwares written
with the flawed 'Number of IDs' logic and the correct one as defined in
the specifications.

[0]: http://infocenter.arm.com/help/topic/com.arm.doc.den0049d/DEN0049D_IO_Remapping_Table.pdf

Reported-by: Pankaj Bansal <pankaj.bansal@nxp.com>
Link: https://lore.kernel.org/linux-acpi/20191215203303.29811-1-pankaj.bansal@nxp.com/
Signed-off-by: Hanjun Guo <guohanjun@huawei.com>
Signed-off-by: Lorenzo Pieralisi <lorenzo.pieralisi@arm.com>
Cc: Pankaj Bansal <pankaj.bansal@nxp.com>
Cc: Will Deacon <will@kernel.org>
Cc: Sudeep Holla <sudeep.holla@arm.com>
Cc: Catalin Marinas <catalin.marinas@arm.com>
Cc: Robin Murphy <robin.murphy@arm.com>
Signed-off-by: Will Deacon <will@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/acpi/arm64/iort.c | 57 +++++++++++++++++++++++++++++++++++++--
 1 file changed, 55 insertions(+), 2 deletions(-)

diff --git a/drivers/acpi/arm64/iort.c b/drivers/acpi/arm64/iort.c
index e11b5da6f828f..7d86468300b78 100644
--- a/drivers/acpi/arm64/iort.c
+++ b/drivers/acpi/arm64/iort.c
@@ -306,6 +306,59 @@ static acpi_status iort_match_node_callback(struct acpi_iort_node *node,
 	return status;
 }
 
+struct iort_workaround_oem_info {
+	char oem_id[ACPI_OEM_ID_SIZE + 1];
+	char oem_table_id[ACPI_OEM_TABLE_ID_SIZE + 1];
+	u32 oem_revision;
+};
+
+static bool apply_id_count_workaround;
+
+static struct iort_workaround_oem_info wa_info[] __initdata = {
+	{
+		.oem_id		= "HISI  ",
+		.oem_table_id	= "HIP07   ",
+		.oem_revision	= 0,
+	}, {
+		.oem_id		= "HISI  ",
+		.oem_table_id	= "HIP08   ",
+		.oem_revision	= 0,
+	}
+};
+
+static void __init
+iort_check_id_count_workaround(struct acpi_table_header *tbl)
+{
+	int i;
+
+	for (i = 0; i < ARRAY_SIZE(wa_info); i++) {
+		if (!memcmp(wa_info[i].oem_id, tbl->oem_id, ACPI_OEM_ID_SIZE) &&
+		    !memcmp(wa_info[i].oem_table_id, tbl->oem_table_id, ACPI_OEM_TABLE_ID_SIZE) &&
+		    wa_info[i].oem_revision == tbl->oem_revision) {
+			apply_id_count_workaround = true;
+			pr_warn(FW_BUG "ID count for ID mapping entry is wrong, applying workaround\n");
+			break;
+		}
+	}
+}
+
+static inline u32 iort_get_map_max(struct acpi_iort_id_mapping *map)
+{
+	u32 map_max = map->input_base + map->id_count;
+
+	/*
+	 * The IORT specification revision D (Section 3, table 4, page 9) says
+	 * Number of IDs = The number of IDs in the range minus one, but the
+	 * IORT code ignored the "minus one", and some firmware did that too,
+	 * so apply a workaround here to keep compatible with both the spec
+	 * compliant and non-spec compliant firmwares.
+	 */
+	if (apply_id_count_workaround)
+		map_max--;
+
+	return map_max;
+}
+
 static int iort_id_map(struct acpi_iort_id_mapping *map, u8 type, u32 rid_in,
 		       u32 *rid_out)
 {
@@ -322,8 +375,7 @@ static int iort_id_map(struct acpi_iort_id_mapping *map, u8 type, u32 rid_in,
 		return -ENXIO;
 	}
 
-	if (rid_in < map->input_base ||
-	    (rid_in >= map->input_base + map->id_count))
+	if (rid_in < map->input_base || rid_in > iort_get_map_max(map))
 		return -ENXIO;
 
 	*rid_out = map->output_base + (rid_in - map->input_base);
@@ -1542,5 +1594,6 @@ void __init acpi_iort_init(void)
 		return;
 	}
 
+	iort_check_id_count_workaround(iort_table);
 	iort_init_platform_devices();
 }
-- 
2.20.1


_______________________________________________
linux-arm-kernel mailing list
linux-arm-kernel@lists.infradead.org
http://lists.infradead.org/mailman/listinfo/linux-arm-kernel

  parent reply index

Thread overview: 29+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
     [not found] <20200214161147.15842-1-sashal@kernel.org>
2020-02-14 16:07 ` [PATCH AUTOSEL 4.19 004/252] soc: fsl: qe: change return type of cpm_muram_alloc() to s32 Sasha Levin
2020-02-14 16:08 ` [PATCH AUTOSEL 4.19 028/252] arm64: cpufeature: Fix the type of no FP/SIMD capability Sasha Levin
2020-02-14 16:08 ` [PATCH AUTOSEL 4.19 032/252] clocksource/drivers/bcm2835_timer: Fix memory leak of timer Sasha Levin
2020-02-14 16:08 ` [PATCH AUTOSEL 4.19 037/252] scsi: ufs: Fix ufshcd_probe_hba() reture value in case ufshcd_scsi_add_wlus() fails Sasha Levin
2020-02-14 16:08 ` [PATCH AUTOSEL 4.19 044/252] ARM: 8952/1: Disable kmemleak on XIP kernels Sasha Levin
2020-02-14 16:08 ` [PATCH AUTOSEL 4.19 081/252] arm64: dts: allwinner: H6: Add PMU mode Sasha Levin
2020-02-14 16:08 ` [PATCH AUTOSEL 4.19 082/252] arm: dts: allwinner: H3: Add PMU node Sasha Levin
2020-02-14 16:08 ` [PATCH AUTOSEL 4.19 083/252] ARM: dts: at91: Reenable UART TX pull-ups Sasha Levin
2020-02-14 16:09 ` [PATCH AUTOSEL 4.19 088/252] ARM: dts: imx6: rdu2: Disable WP for USDHC2 and USDHC3 Sasha Levin
2020-02-14 16:09 ` [PATCH AUTOSEL 4.19 089/252] ARM: dts: imx6: rdu2: Limit USBH1 to Full Speed Sasha Levin
2020-02-14 16:09 ` [PATCH AUTOSEL 4.19 091/252] PCI: iproc: Apply quirk_paxc_bridge() for module as well as built-in Sasha Levin
2020-02-14 16:09 ` [PATCH AUTOSEL 4.19 102/252] Revert "tty/serial: atmel: fix out of range clock divider handling" Sasha Levin
2020-02-14 16:09 ` [PATCH AUTOSEL 4.19 113/252] drm/mediatek: handle events when enabling/disabling crtc Sasha Levin
2020-02-14 16:09 ` [PATCH AUTOSEL 4.19 118/252] dmaengine: imx-sdma: Fix memory leak Sasha Levin
2020-02-14 16:09 ` [PATCH AUTOSEL 4.19 125/252] reset: uniphier: Add SCSSI reset control for each channel Sasha Levin
2020-02-14 16:09 ` [PATCH AUTOSEL 4.19 127/252] clk: sunxi-ng: add mux and pll notifiers for A64 CPU clock Sasha Levin
2020-02-14 16:09 ` [PATCH AUTOSEL 4.19 129/252] clk: uniphier: Add SCSSI clock gate for each channel Sasha Levin
2020-02-14 16:09 ` [PATCH AUTOSEL 4.19 137/252] soc: fsl: qe: remove set but not used variable 'mm_gc' Sasha Levin
2020-02-14 16:09 ` [PATCH AUTOSEL 4.19 139/252] crypto: atmel-sha - fix error handling when setting hmac key Sasha Levin
2020-02-14 16:09 ` [PATCH AUTOSEL 4.19 140/252] ARM: dts: stm32: Add power-supply for DSI panel on stm32f469-disco Sasha Levin
2020-02-14 16:09 ` [PATCH AUTOSEL 4.19 143/252] iommu/arm-smmu-v3: Populate VMID field for CMDQ_OP_TLBI_NH_VA Sasha Levin
2020-02-14 16:10 ` [PATCH AUTOSEL 4.19 148/252] ARM: dts: at91: sama5d3: fix maximum peripheral clock rates Sasha Levin
2020-02-14 16:10 ` [PATCH AUTOSEL 4.19 149/252] ARM: dts: at91: sama5d3: define clock rate range for tcb1 Sasha Levin
2020-02-14 16:10 ` [PATCH AUTOSEL 4.19 155/252] ASoC: atmel: fix build error with CONFIG_SND_ATMEL_SOC_DMA=m Sasha Levin
2020-02-14 16:10 ` [PATCH AUTOSEL 4.19 165/252] arm64: ptrace: nofpsimd: Fail FP/SIMD regset operations Sasha Levin
2020-02-14 16:10 ` [PATCH AUTOSEL 4.19 177/252] iommu/arm-smmu-v3: Use WRITE_ONCE() when changing validity of an STE Sasha Levin
2020-02-14 16:10 ` [PATCH AUTOSEL 4.19 181/252] arm64: fix alternatives with LLVM's integrated assembler Sasha Levin
2020-02-14 16:10 ` Sasha Levin [this message]
2020-02-14 16:11 ` [PATCH AUTOSEL 4.19 218/252] ARM: 8951/1: Fix Kexec compilation issue Sasha Levin

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20200214161147.15842-186-sashal@kernel.org \
    --to=sashal@kernel.org \
    --cc=catalin.marinas@arm.com \
    --cc=guohanjun@huawei.com \
    --cc=linux-acpi@vger.kernel.org \
    --cc=linux-arm-kernel@lists.infradead.org \
    --cc=linux-kernel@vger.kernel.org \
    --cc=lorenzo.pieralisi@arm.com \
    --cc=pankaj.bansal@nxp.com \
    --cc=robin.murphy@arm.com \
    --cc=stable@vger.kernel.org \
    --cc=sudeep.holla@arm.com \
    --cc=will@kernel.org \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link

Linux-ARM-Kernel Archive on lore.kernel.org

Archives are clonable:
	git clone --mirror https://lore.kernel.org/linux-arm-kernel/0 linux-arm-kernel/git/0.git
	git clone --mirror https://lore.kernel.org/linux-arm-kernel/1 linux-arm-kernel/git/1.git

	# If you have public-inbox 1.1+ installed, you may
	# initialize and index your mirror using the following commands:
	public-inbox-init -V2 linux-arm-kernel linux-arm-kernel/ https://lore.kernel.org/linux-arm-kernel \
		linux-arm-kernel@lists.infradead.org
	public-inbox-index linux-arm-kernel

Example config snippet for mirrors

Newsgroup available over NNTP:
	nntp://nntp.lore.kernel.org/org.infradead.lists.linux-arm-kernel


AGPL code for this site: git clone https://public-inbox.org/public-inbox.git