Re: [PATCH v9 3/3] of: Respect #{iommu,msi}-cells in maps

[Vijayanand Jitta <vijayanand.jitta@xxxxxxxxxxxxxxxx>]

On 3/1/2026 3:44 PM, Dmitry Baryshkov wrote:
> On Sun, Mar 01, 2026 at 02:04:21PM +0530, Vijayanand Jitta wrote:
>> From: Robin Murphy <robin.murphy@xxxxxxx>
>>
>> So far our parsing of {iommu,msi}-map properites has always blindly
>> assumed that the output specifiers will always have exactly 1 cell.
>> This typically does happen to be the case, but is not actually enforced
>> (and the PCI msi-map binding even explicitly states support for 0 or 1
>> cells) - as a result we've now ended up with dodgy DTs out in the field
>> which depend on this behaviour to map a 1-cell specifier for a 2-cell
>> provider, despite that being bogus per the bindings themselves.
>>
>> Since there is some potential use in being able to map at least single
>> input IDs to multi-cell output specifiers (and properly support 0-cell
>> outputs as well), add support for properly parsing and using the target
>> nodes' #cells values, albeit with the unfortunate complication of still
>> having to work around expectations of the old behaviour too.
>>
>> Since there are multi-cell output specifiers, the callers of of_map_id()
>> may need to get the exact cell output value for further processing.
>> Added support for that part --charan
>>
>> Signed-off-by: Robin Murphy <robin.murphy@xxxxxxx>
>> Signed-off-by: Charan Teja Kalla <charan.kalla@xxxxxxxxxxxxxxxx>
>> Signed-off-by: Vijayanand Jitta <vijayanand.jitta@xxxxxxxxxxxxxxxx>
>> ---
>>  drivers/iommu/of_iommu.c |   2 +-
>>  drivers/of/base.c        | 117 
>> +++++++++++++++++++++++++++++++++++++----------
>>  include/linux/of.h       |  16 +++----
>>  3 files changed, 102 insertions(+), 33 deletions(-)
>>
> 
>>  /**
>>   * of_map_id - Translate an ID through a downstream mapping.
>>   * @np: root complex device node.
>>   * @id: device ID to map.
>>   * @map_name: property name of the map to use.
>> + * @cells_name: property name of target specifier cells.
>>   * @map_mask_name: optional property name of the mask to use.
>>   * @arg: of_phandle_args structure,
>>   *  which includes:
>> @@ -2118,18 +2145,19 @@ int of_find_last_cache_level(unsigned int cpu)
>>   *
>>   * Return: 0 on success or a standard error code on failure.
>>   */
>> -int of_map_id(const struct device_node *np, u32 id,
>> -           const char *map_name, const char *map_mask_name,
>> -           struct of_phandle_args *arg)
>> +int of_map_id(const struct device_node *np, u32 id, const char *map_name,
>> +          const char *cells_name, const char *map_mask_name,
>> +          struct of_phandle_args *arg)
> 
> Some extra whitespace-related noise in here. Last line wasn't changed,
> so there is no need to touch it.
> 

Thanks for pointing this, Will fix it in next series.

>>  {
>>      u32 map_mask, masked_id;
>> -    int map_len;
>> +    int map_bytes, map_len, offset = 0;
>> +    bool bad_map = false;
>>      const __be32 *map = NULL;
>>  
>>      if (!np || !map_name || !arg)
>>              return -EINVAL;
>>  
>> -    map = of_get_property(np, map_name, &map_len);
>> +    map = of_get_property(np, map_name, &map_bytes);
>>      if (!map) {
>>              if (arg->np)
>>                      return -ENODEV;
>> @@ -2138,11 +2166,9 @@ int of_map_id(const struct device_node *np, u32 id,
>>              return 0;
>>      }
>>  
>> -    if (!map_len || map_len % (4 * sizeof(*map))) {
>> -            pr_err("%pOF: Error: Bad %s length: %d\n", np,
>> -                    map_name, map_len);
>> -            return -EINVAL;
>> -    }
>> +    if (map_bytes % sizeof(*map))
>> +            goto err_map_len;
>> +    map_len = map_bytes / sizeof(*map);
>>  
>>      /* The default is to select all bits. */
>>      map_mask = 0xffffffff;
>> @@ -2155,27 +2181,63 @@ int of_map_id(const struct device_node *np, u32 id,
>>              of_property_read_u32(np, map_mask_name, &map_mask);
>>  
>>      masked_id = map_mask & id;
>> -    for ( ; map_len > 0; map_len -= 4 * sizeof(*map), map += 4) {
>> +
>> +    while (offset < map_len) {
>>              struct device_node *phandle_node;
>> -            u32 id_base = be32_to_cpup(map + 0);
>> -            u32 phandle = be32_to_cpup(map + 1);
>> -            u32 out_base = be32_to_cpup(map + 2);
>> -            u32 id_len = be32_to_cpup(map + 3);
>> +            u32 id_base, phandle, id_len, id_off, cells = 0;
>> +            const __be32 *out_base;
>> +
>> +            if (map_len - offset < 2)
>> +                    goto err_map_len;
>> +
>> +            id_base = be32_to_cpup(map + offset);
>>  
>>              if (id_base & ~map_mask) {
>> -                    pr_err("%pOF: Invalid %s translation - %s-mask (0x%x) 
>> ignores id-base (0x%x)\n",
>> -                            np, map_name, map_name,
>> -                            map_mask, id_base);
>> +                    pr_err("%pOF: Invalid %s translation - %s (0x%x) 
>> ignores id-base (0x%x)\n",
>> +                           np, map_name, map_mask_name, map_mask, id_base);
>>                      return -EFAULT;
>>              }
>>  
>> -            if (masked_id < id_base || masked_id >= id_base + id_len)
>> -                    continue;
>> -
>> +            phandle = be32_to_cpup(map + offset + 1);
>>              phandle_node = of_find_node_by_phandle(phandle);
>>              if (!phandle_node)
>>                      return -ENODEV;
>>  
>> +            if (!bad_map && of_property_read_u32(phandle_node, cells_name, 
>> &cells)) {
>> +                    pr_err("%pOF: missing %s property\n", phandle_node, 
>> cells_name);
>> +                    return -EINVAL;
>> +            }
> 
> This will trigger the cells_name property check even if later we
> discover that we have a "bad" map. Is it intended / required?
> 

It’s intended. We need the cells value here because determining whether
a map is “bad” depends on it, as mentioned in description of of_check_bad_map
this is specifically for the case where the DT has an iommu-map pointing to
a 2‑cell IOMMU node but only provides 1 cell in the map entry.

>> +
>> +            if (map_len - offset < 3 + cells)
> 
> of_node_put(phandle_node);
> 
>> +                    goto err_map_len;
>> +
>> +            if (offset == 0 && cells == 2) {
> 
> ... if it's not required, then the bad_map check can be moved before the
> loop.
> 

Given that, the bad_map check can’t be moved before the loop, because we only
call of_check_bad_map() when cells == 2.

>> +                    bad_map = of_check_bad_map(map, map_len);
>> +                    if (bad_map) {
>> +                            pr_warn_once("%pOF: %s mismatches target %s, 
>> assuming extra cell of 0\n",
>> +                                         np, map_name, cells_name);
>> +                            cells = 1;
>> +                    }
>> +            }
>> +
>> +            out_base = map + offset + 2;
>> +            offset += 3 + cells;
>> +
>> +            id_len = be32_to_cpup(map + offset - 1);
>> +            if (id_len > 1 && cells > 1) {
>> +                    /*
>> +                     * With 1 output cell we reasonably assume its value
>> +                     * has a linear relationship to the input; with more,
>> +                     * we'd need help from the provider to know what to do.
>> +                     */
>> +                    pr_err("%pOF: Unsupported %s - cannot handle %d-ID 
>> range with %d-cell output specifier\n",
>> +                           np, map_name, id_len, cells);
>> +                    return -EINVAL;
>> +            }
>> +            id_off = masked_id - id_base;
>> +            if (masked_id < id_base || id_off >= id_len)
>> +                    continue;
>> +
>>              if (arg->np)
>>                      of_node_put(phandle_node);
>>              else
>> @@ -2184,11 +2246,14 @@ int of_map_id(const struct device_node *np, u32 id,
>>              if (arg->np != phandle_node)
>>                      continue;
>>  
>> -            arg->args[0] = masked_id - id_base + out_base;
>> +            for (int i = 0; i < cells; i++)
>> +                    arg->args[i] = (id_off + be32_to_cpu(out_base[i]));
>> +
>> +            arg->args_count = cells;
>>  
>>              pr_debug("%pOF: %s, using mask %08x, id-base: %08x, out-base: 
>> %08x, length: %08x, id: %08x -> %08x\n",
>> -                    np, map_name, map_mask, id_base, out_base,
>> -                    id_len, id, masked_id - id_base + out_base);
>> +                     np, map_name, map_mask, id_base, 
>> be32_to_cpup(out_base),
>> +                     id_len, id, id_off + be32_to_cpup(out_base));
> 
> Again, having whitespace changes doesn't simplify reviewing.
> 

Will fix this in next series.

Thanks,
Vijay
>>              return 0;
>>      }
>>  
>> @@ -2198,5 +2263,9 @@ int of_map_id(const struct device_node *np, u32 id,
>>      /* Bypasses translation */
>>      arg->args[0] = id;
>>      return 0;
>> +
>> +err_map_len:
>> +    pr_err("%pOF: Error: Bad %s length: %d\n", np, map_name, map_bytes);
>> +    return -EINVAL;
>>  }
>>  EXPORT_SYMBOL_GPL(of_map_id);
>