Re: [PATCH v9 3/3] of: Respect #{iommu,msi}-cells in maps

[Dmitry Baryshkov <dmitry.baryshkov@xxxxxxxxxxxxxxxx>]

On Sun, Mar 01, 2026 at 02:04:21PM +0530, Vijayanand Jitta wrote:
> From: Robin Murphy <robin.murphy@xxxxxxx>
> 
> So far our parsing of {iommu,msi}-map properites has always blindly
> assumed that the output specifiers will always have exactly 1 cell.
> This typically does happen to be the case, but is not actually enforced
> (and the PCI msi-map binding even explicitly states support for 0 or 1
> cells) - as a result we've now ended up with dodgy DTs out in the field
> which depend on this behaviour to map a 1-cell specifier for a 2-cell
> provider, despite that being bogus per the bindings themselves.
> 
> Since there is some potential use in being able to map at least single
> input IDs to multi-cell output specifiers (and properly support 0-cell
> outputs as well), add support for properly parsing and using the target
> nodes' #cells values, albeit with the unfortunate complication of still
> having to work around expectations of the old behaviour too.
> 
> Since there are multi-cell output specifiers, the callers of of_map_id()
> may need to get the exact cell output value for further processing.
> Added support for that part --charan
> 
> Signed-off-by: Robin Murphy <robin.murphy@xxxxxxx>
> Signed-off-by: Charan Teja Kalla <charan.kalla@xxxxxxxxxxxxxxxx>
> Signed-off-by: Vijayanand Jitta <vijayanand.jitta@xxxxxxxxxxxxxxxx>
> ---
>  drivers/iommu/of_iommu.c |   2 +-
>  drivers/of/base.c        | 117 
> +++++++++++++++++++++++++++++++++++++----------
>  include/linux/of.h       |  16 +++----
>  3 files changed, 102 insertions(+), 33 deletions(-)
> 

>  /**
>   * of_map_id - Translate an ID through a downstream mapping.
>   * @np: root complex device node.
>   * @id: device ID to map.
>   * @map_name: property name of the map to use.
> + * @cells_name: property name of target specifier cells.
>   * @map_mask_name: optional property name of the mask to use.
>   * @arg: of_phandle_args structure,
>   *   which includes:
> @@ -2118,18 +2145,19 @@ int of_find_last_cache_level(unsigned int cpu)
>   *
>   * Return: 0 on success or a standard error code on failure.
>   */
> -int of_map_id(const struct device_node *np, u32 id,
> -            const char *map_name, const char *map_mask_name,
> -            struct of_phandle_args *arg)
> +int of_map_id(const struct device_node *np, u32 id, const char *map_name,
> +           const char *cells_name, const char *map_mask_name,
> +           struct of_phandle_args *arg)

Some extra whitespace-related noise in here. Last line wasn't changed,
so there is no need to touch it.

>  {
>       u32 map_mask, masked_id;
> -     int map_len;
> +     int map_bytes, map_len, offset = 0;
> +     bool bad_map = false;
>       const __be32 *map = NULL;
>  
>       if (!np || !map_name || !arg)
>               return -EINVAL;
>  
> -     map = of_get_property(np, map_name, &map_len);
> +     map = of_get_property(np, map_name, &map_bytes);
>       if (!map) {
>               if (arg->np)
>                       return -ENODEV;
> @@ -2138,11 +2166,9 @@ int of_map_id(const struct device_node *np, u32 id,
>               return 0;
>       }
>  
> -     if (!map_len || map_len % (4 * sizeof(*map))) {
> -             pr_err("%pOF: Error: Bad %s length: %d\n", np,
> -                     map_name, map_len);
> -             return -EINVAL;
> -     }
> +     if (map_bytes % sizeof(*map))
> +             goto err_map_len;
> +     map_len = map_bytes / sizeof(*map);
>  
>       /* The default is to select all bits. */
>       map_mask = 0xffffffff;
> @@ -2155,27 +2181,63 @@ int of_map_id(const struct device_node *np, u32 id,
>               of_property_read_u32(np, map_mask_name, &map_mask);
>  
>       masked_id = map_mask & id;
> -     for ( ; map_len > 0; map_len -= 4 * sizeof(*map), map += 4) {
> +
> +     while (offset < map_len) {
>               struct device_node *phandle_node;
> -             u32 id_base = be32_to_cpup(map + 0);
> -             u32 phandle = be32_to_cpup(map + 1);
> -             u32 out_base = be32_to_cpup(map + 2);
> -             u32 id_len = be32_to_cpup(map + 3);
> +             u32 id_base, phandle, id_len, id_off, cells = 0;
> +             const __be32 *out_base;
> +
> +             if (map_len - offset < 2)
> +                     goto err_map_len;
> +
> +             id_base = be32_to_cpup(map + offset);
>  
>               if (id_base & ~map_mask) {
> -                     pr_err("%pOF: Invalid %s translation - %s-mask (0x%x) 
> ignores id-base (0x%x)\n",
> -                             np, map_name, map_name,
> -                             map_mask, id_base);
> +                     pr_err("%pOF: Invalid %s translation - %s (0x%x) 
> ignores id-base (0x%x)\n",
> +                            np, map_name, map_mask_name, map_mask, id_base);
>                       return -EFAULT;
>               }
>  
> -             if (masked_id < id_base || masked_id >= id_base + id_len)
> -                     continue;
> -
> +             phandle = be32_to_cpup(map + offset + 1);
>               phandle_node = of_find_node_by_phandle(phandle);
>               if (!phandle_node)
>                       return -ENODEV;
>  
> +             if (!bad_map && of_property_read_u32(phandle_node, cells_name, 
> &cells)) {
> +                     pr_err("%pOF: missing %s property\n", phandle_node, 
> cells_name);
> +                     return -EINVAL;
> +             }

This will trigger the cells_name property check even if later we
discover that we have a "bad" map. Is it intended / required?

> +
> +             if (map_len - offset < 3 + cells)

of_node_put(phandle_node);

> +                     goto err_map_len;
> +
> +             if (offset == 0 && cells == 2) {

... if it's not required, then the bad_map check can be moved before the
loop.

> +                     bad_map = of_check_bad_map(map, map_len);
> +                     if (bad_map) {
> +                             pr_warn_once("%pOF: %s mismatches target %s, 
> assuming extra cell of 0\n",
> +                                          np, map_name, cells_name);
> +                             cells = 1;
> +                     }
> +             }
> +
> +             out_base = map + offset + 2;
> +             offset += 3 + cells;
> +
> +             id_len = be32_to_cpup(map + offset - 1);
> +             if (id_len > 1 && cells > 1) {
> +                     /*
> +                      * With 1 output cell we reasonably assume its value
> +                      * has a linear relationship to the input; with more,
> +                      * we'd need help from the provider to know what to do.
> +                      */
> +                     pr_err("%pOF: Unsupported %s - cannot handle %d-ID 
> range with %d-cell output specifier\n",
> +                            np, map_name, id_len, cells);
> +                     return -EINVAL;
> +             }
> +             id_off = masked_id - id_base;
> +             if (masked_id < id_base || id_off >= id_len)
> +                     continue;
> +
>               if (arg->np)
>                       of_node_put(phandle_node);
>               else
> @@ -2184,11 +2246,14 @@ int of_map_id(const struct device_node *np, u32 id,
>               if (arg->np != phandle_node)
>                       continue;
>  
> -             arg->args[0] = masked_id - id_base + out_base;
> +             for (int i = 0; i < cells; i++)
> +                     arg->args[i] = (id_off + be32_to_cpu(out_base[i]));
> +
> +             arg->args_count = cells;
>  
>               pr_debug("%pOF: %s, using mask %08x, id-base: %08x, out-base: 
> %08x, length: %08x, id: %08x -> %08x\n",
> -                     np, map_name, map_mask, id_base, out_base,
> -                     id_len, id, masked_id - id_base + out_base);
> +                      np, map_name, map_mask, id_base, 
> be32_to_cpup(out_base),
> +                      id_len, id, id_off + be32_to_cpup(out_base));

Again, having whitespace changes doesn't simplify reviewing.

>               return 0;
>       }
>  
> @@ -2198,5 +2263,9 @@ int of_map_id(const struct device_node *np, u32 id,
>       /* Bypasses translation */
>       arg->args[0] = id;
>       return 0;
> +
> +err_map_len:
> +     pr_err("%pOF: Error: Bad %s length: %d\n", np, map_name, map_bytes);
> +     return -EINVAL;
>  }
>  EXPORT_SYMBOL_GPL(of_map_id);

-- 
With best wishes
Dmitry