linux-kernel - Re: [PATCH] PCI: rockchip: Fix register number offset to program IO outbound ATU

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Thu, 12 Dec 2019 15:29:36 -0600
From:   Bjorn Helgaas <helgaas@...nel.org>
To:     Enric Balletbo i Serra <enric.balletbo@...labora.com>
Cc:     linux-kernel@...r.kernel.org,
        Collabora Kernel ML <kernel@...labora.com>,
        Andrew Murray <andrew.murray@....com>,
        Heiko Stuebner <heiko@...ech.de>,
        Lorenzo Pieralisi <lorenzo.pieralisi@....com>,
        linux-rockchip@...ts.infradead.org,
        Shawn Lin <shawn.lin@...k-chips.com>, groeck@...omium.org,
        bleung@...omium.org, dtor@...omium.org, gwendal@...omium.org,
        Rob Herring <robh@...nel.org>, linux-pci@...r.kernel.org,
        linux-arm-kernel@...ts.infradead.org,
        Vicente Bergas <vicencb@...il.com>
Subject: Re: [PATCH] PCI: rockchip: Fix register number offset to program IO
 outbound ATU

[+cc Vicente]

On Wed, Dec 11, 2019 at 10:34:50AM +0100, Enric Balletbo i Serra wrote:
> Since commit '62240a88004b ("PCI: rockchip: Drop storing driver private
> outbound resource data)' the offset calculation is wrong to access the
> register number to program the IO outbound ATU. The offset should be
> based on the IORESOURCE_MEM resource size instead of the IORESOURCE_IO
> size.
>
> ...

> Fixes: 62240a88004b ("PCI: rockchip: Drop storing driver private outbound resource data)
> Reported-by: Enric Balletbo i Serra <enric.balletbo@...labora.com>
> Suggested-by: Lorenzo Pieralisi <lorenzo.pieralisi@....com>
> Signed-off-by: Enric Balletbo i Serra <enric.balletbo@...labora.com>

Thanks, I applied this with Vicente's reported-by and tested-by and
Andrew's ack to for-linus for v5.5.

I'm confused about "msg_bus_addr".  It is computed as
"entry->res->start - entry->offset + <other stuff>".  A struct
resource contains a CPU physical address, and adding entry->offset
gets you a PCI bus address.  But later rockchip_pcie_probe() calls
devm_ioremap(rockchip->msg_bus_addr), which expects a CPU physical
address.  So it looks like we're passing a PCI bus address when we
should be passing a CPU physical address.  What am I missing?

For the future, I do think we should consider:

  - Renaming rockchip_pcie_prog_ob_atu() and
    rockchip_pcie_prog_ib_atu() so they match
    dw_pcie_prog_outbound_atu() and dw_pcie_prog_inbound_atu().

  - Changing the rockchip_pcie_prog_ob_atu() and
    rockchip_pcie_prog_ib_atu() interfaces so they take a 64-bit
    pci_addr/cpu_addr instead of 32-bit lower_addr and upper_addr,
    also to follow the dw examples.

  - Renaming the rockchip_pcie_cfg_atu() local "offset" to "index" or
    similar since it's a register number, not a memory or I/O space
    offset.

  - Reworking the rockchip_pcie_cfg_atu() loops.  Currently there are
    three different ways to compute the register number.  The
    msg_bus_addr computation is split between the top and bottom of
    the function and uses "reg_no" left over from the IO loop and
    "offset" left from the memory loop.  Maybe something like this:

      rockchip_pcie_prog_inbound_atu(rockchip, 2, 32 - 1, 0);

      atu_idx = 1;

      mem = resource_list_first_type(&bridge->windows, IORESOURCE_MEM);
      mem_entries = resource_size(mem->res) >> 20;
      mem_pci_addr = mem->res->start - mem->offset;
      for (i = 0; i < mem_entries; i++, atu_idx++)
        rockchip_pcie_prog_outbound_atu(rockchip, atu_idx,
                                        AXI_WRAPPER_MEM_WRITE, 20 - 1,
                                        mem_pci_addr + (i << 20));

      io = resource_list_first_type(&bridge->windows, IORESOURCE_IO);
      io_entries = resource_size(entry->res) >> 20;
      io_pci_addr = io->res->start - io->offset;
      for (i = 0; i < io_entries; i++, atu_idx++)
        rockchip_pcie_prog_outbound_atu(rockchip, atu_idx,
                                        AXI_WRAPPER_IO_WRITE, 20 - 1,
                                        io_pci_addr + (i << 20));

      rockchip_pcie_prog_outbound_atu(rockchip, atu_idx,
                                      AXI_WRAPPER_NOR_MSG, 20 - 1, 0);
      rockchip->msg_bus_addr = mem_pci_addr +
        (mem_entries + io_entries) << 20);

> ---
> 
>  drivers/pci/controller/pcie-rockchip-host.c | 4 +++-
>  1 file changed, 3 insertions(+), 1 deletion(-)
> 
> diff --git a/drivers/pci/controller/pcie-rockchip-host.c b/drivers/pci/controller/pcie-rockchip-host.c
> index d9b63bfa5dd7..94af6f5828a3 100644
> --- a/drivers/pci/controller/pcie-rockchip-host.c
> +++ b/drivers/pci/controller/pcie-rockchip-host.c
> @@ -834,10 +834,12 @@ static int rockchip_pcie_cfg_atu(struct rockchip_pcie *rockchip)
>  	if (!entry)
>  		return -ENODEV;
>  
> +	/* store the register number offset to program RC io outbound ATU */
> +	offset = size >> 20;
> +
>  	size = resource_size(entry->res);
>  	pci_addr = entry->res->start - entry->offset;
>  
> -	offset = size >> 20;
>  	for (reg_no = 0; reg_no < (size >> 20); reg_no++) {
>  		err = rockchip_pcie_prog_ob_atu(rockchip,
>  						reg_no + 1 + offset,
> -- 
> 2.20.1
>