From: Vijayanand Jitta <vijayanand.jitta@oss•qualcomm.com>
To: "Nipun Gupta" <nipun.gupta@amd•com>,
"Nikhil Agarwal" <nikhil.agarwal@amd•com>,
"Joerg Roedel" <joro@8bytes•org>, "Will Deacon" <will@kernel•org>,
"Robin Murphy" <robin.murphy@arm•com>,
"Lorenzo Pieralisi" <lpieralisi@kernel•org>,
"Marc Zyngier" <maz@kernel•org>,
"Thomas Gleixner" <tglx@kernel•org>,
"Rob Herring" <robh@kernel•org>,
"Saravana Kannan" <saravanak@kernel•org>,
"Richard Zhu" <hongxing.zhu@nxp•com>,
"Lucas Stach" <l.stach@pengutronix•de>,
"Krzysztof Wilczyński" <kwilczynski@kernel•org>,
"Manivannan Sadhasivam" <mani@kernel•org>,
"Bjorn Helgaas" <bhelgaas@google•com>,
"Frank Li" <Frank.Li@nxp•com>,
"Sascha Hauer" <s.hauer@pengutronix•de>,
"Pengutronix Kernel Team" <kernel@pengutronix•de>,
"Fabio Estevam" <festevam@gmail•com>,
"Juergen Gross" <jgross@suse•com>,
"Stefano Stabellini" <sstabellini@kernel•org>,
"Oleksandr Tyshchenko" <oleksandr_tyshchenko@epam•com>
Cc: linux-arm-msm@vger•kernel.org, linux-kernel@vger•kernel.org,
iommu@lists•linux.dev, linux-arm-kernel@lists•infradead.org,
devicetree@vger•kernel.org, linux-pci@vger•kernel.org,
imx@lists•linux.dev, xen-devel@lists•xenproject.org,
Vijayanand Jitta <vijayanand.jitta@oss•qualcomm.com>,
Charan Teja Kalla <charan.kalla@oss•qualcomm.com>,
Dmitry Baryshkov <dmitry.baryshkov@oss•qualcomm.com>
Subject: [PATCH v16 0/3] of: parsing of multi #{iommu,msi}-cells in maps
Date: Wed, 03 Jun 2026 12:43:11 +0530 [thread overview]
Message-ID: <20260603-parse_iommu_cells-v16-0-dc509dacb19a@oss.qualcomm.com> (raw)
So far our parsing of {iommu,msi}-map properties has always blindly
assumed that the output specifiers will always have exactly 1 cell.
This typically does happen to be the case, but is not actually enforced
(and the PCI msi-map binding even explicitly states support for 0 or 1
cells) - as a result we've now ended up with dodgy DTs out in the field
which depend on this behaviour to map a 1-cell specifier for a 2-cell
provider, despite that being bogus per the bindings themselves.
Since there is some potential use[1] in being able to map at least
single input IDs to multi-cell output specifiers (and properly support
0-cell outputs as well), add support for properly parsing and using the
target nodes' #cells values, albeit with the unfortunate complication of
still having to work around expectations of the old behaviour too.
-- Robin.
Unlike single #{}-cell, it is complex to establish a linear relation
between input 'id' and output specifier for multi-cell properties, thus
it is always expected that len never going to be > 1.
These changes have been tested on QEMU for the arm64 architecture and
on the glymur platform [3].
Since, this would also need update in dt-schema, raised PR[2] for the
same.
[1] https://lore.kernel.org/all/20250627-video_cb-v3-0-51e18c0ffbce@quicinc.com/
[2] PR for iommu-map dtschema: https://github.com/devicetree-org/dt-schema/pull/184
[3] https://lore.kernel.org/all/20260515-glymur-v6-5-f6a99cb43a24@oss.qualcomm.com/
V16:
- Patch 2: Fix potential NULL pointer dereference in of_msi_xlate()
when msi_np is NULL. Guard the of_check_msi_parent() call with
"if (msi_np && ...)" to handle the case where the caller passes
NULL for msi_np, as documented. Reported by Sashiko [1].
- Patch 2: Fix OF node refcount leak in of_msi_map_get_device_domain():
np was never released after of_msi_xlate() transferred ownership.
- Patch 3: Default to 1-cell output specifier when the target node
lacks the #iommu-cells/#msi-cells property, for backward
compatibility with controllers that predate the property
(e.g. arm,gic-v2m-frame). Reported by Sashiko [1].
- Patch 3: Add !cells_name to the initial parameter guard in
of_map_id() to prevent a crash if cells_name is NULL.
Reported by Sashiko [1].
[1] https://sashiko.dev/#/patchset/20260520-parse_iommu_cells-v15-0-b5f99ad4e7e8@oss.qualcomm.com
Link to V15:
https://lore.kernel.org/all/20260520-parse_iommu_cells-v15-0-b5f99ad4e7e8@oss.qualcomm.com/
V15:
Address Sashiko AI review comments on v14:
Patch 2:
- [Critical] pci-imx6: pass &msi_filter (not NULL) to of_map_msi_id()
so that of_map_id() returns -ENODEV when msi-map is absent, preventing
the '!err_m && !msi_spec.np' path from incorrectly returning -EINVAL
- [High] of_map_id(): explicitly set arg->np = NULL before any bypass
path so callers can safely call of_node_put(arg->np) on all return paths
- [Medium] of_msi_xlate(): pass msi_np directly to of_map_msi_id() and
of_check_msi_parent() (removing the local_np/np indirection), and use
'break' (not 'continue') when msi_spec.np is NULL so that msi-parent
bindings are still checked when msi-map is present but has no match
- Guard 'id_out = msi_spec.args[0]' with 'args_count > 0' in
of_msi_xlate() to correctly handle 0-cell MSI output specifiers
- Use of_node_get() + unconditional of_node_put() in of_msi_xlate()
for clearer reference ownership
Patch 3:
- [Critical] of_map_id(): add 'cells > MAX_PHANDLE_ARGS' check before
using cells as an array index to prevent stack buffer overflow
- [High] of_map_id(): the MAX_PHANDLE_ARGS bound on cells also prevents
integer overflow in the '3 + cells' length check
- [High] of_map_id(): fix misleading bad-map workaround message from
"assuming extra cell of 0" to "treating as 1-cell output" to accurately
describe the actual behavior
- [Medium] of_msi_xlate(): guard 'id_out = msi_spec.args[0]' with
'args_count > 0' to preserve id_in for 0-cell MSI output specifiers
Link to v14:
https://patch.msgid.link/20260424-parse_iommu_cells-v14-0-fd02f11b6c38@oss.qualcomm.com
V14:
- Updated Patch 2 ("of: Factor arguments passed to of_map_id() into a struct") to
fix below two issues in of_msi_xlate() that were introduced by the API refactoring:
1) The refactoring changed of_map_id()'s dual-purpose **target parameter to
an explicit filter_np parameter. In of_msi_xlate(), this caused
of_map_msi_id() to return 0 (pass-through) instead of -ENODEV when a node
has no msi-map, terminating the device hierarchy walk prematurely before
reaching the root complex node that has the msi-map. This broke MSI
allocation for PCIe endpoint devices (e.g., wcn7850 Wi-Fi on ARM64).
2) Additionally, fsl_mc_get_msi_id() passes msi_np == NULL to of_msi_xlate(),
which would dereference NULL with the new API.
Link to v13:
https://patch.msgid.link/20260408-parse_iommu_cells-v13-0-fa921e92661b@oss.qualcomm.com
V13:
- Fix bad_map handling in of_map_id(): 'cells' is re-initialized to 0
on each loop iteration, so the !bad_map guard was insufficient, cells
stayed 0 for all entries after the first. Fix by explicitly setting
cells=1 when bad_map is true on every iteration.
- Collected Acked-by from Frank Li.
Link to v12:
https://patch.msgid.link/20260331-parse_iommu_cells-v12-0-decfd305eea9@oss.qualcomm.com
V12:
- Call of_node_put() unconditionally in imx_pcie_add_lut_by_rid()
thereby addressing comments from Bjorn Helgaas.
Link to v11:
https://lore.kernel.org/r/20260325-parse_iommu_cells-v11-0-1fefa5c0e82c@oss.qualcomm.com
V11:
- Added explicit filter_np parameter to of_map_id() and of_map_msi_id()
per Dmitry Baryshkov's review feedback, making the filter explicit
instead of overloading arg->np as both input filter and output parameter.
- Removed of_node_put() from inside of_map_id(), making the caller responsible
for reference management. Updated of_msi_xlate() to properly handle reference counting.
- Collected ACKed by tags, and fixed minor typos.
Link to v10:
https://lore.kernel.org/r/20260309-parse_iommu_cells-v10-0-c62fcaa5a1d8@oss.qualcomm.com
V10:
- Move of_map_iommu_id()/of_map_msi_id() from include/linux/of.h to
drivers/of/base.c as out-of-line helpers per feedback from Marc Zyngier
and Rob Herring.
- Add kernel-doc to document both helpers for discoverability and
usage clarity.
- Fix of_map_msi_id() wrapper and all its callers (cdx_msi.c,
irq-gic-its-msi-parent.c, drivers/of/irq.c) to correctly use the new
struct of_phandle_args-based API with proper of_node_put() handling
as per feeback from Dmitry.
Link to v9:
https://lore.kernel.org/r/20260301-parse_iommu_cells-v9-0-4d1bceecc5e1@oss.qualcomm.com
V9:
- Updated TO/CC list based on feedback to include all relevant
maintainers.
- No functional changes to the patches themselves.
Link to V8:
https://lore.kernel.org/all/20260226074245.3098486-1-vijayanand.jitta@oss.qualcomm.com/
V8:
- Removed mentions of of_map_args from commit message to match code.
Link to V7:
https://lore.kernel.org/all/20260210101157.2145113-1-vijayanand.jitta@oss.qualcomm.com/
V7:
- Removed of_map_id_args structure and replaced it with
of_phandle_args as suggested by Dmitry.
Link to V6:
https://lore.kernel.org/all/20260121055400.937856-1-vijayanand.jitta@oss.qualcomm.com/
V6:
- Fixed build error reported by kernel test bot.
Link to V5:
https://lore.kernel.org/all/20260118181125.1436036-1-vijayanand.jitta@oss.qualcomm.com/
V5:
- Fixed Build Warnings.
- Raised PR for iommu-map dtschema: https://github.com/devicetree-org/dt-schema/pull/184
Link to V4:
https://lore.kernel.org/all/20251231114257.2382820-1-vijayanand.jitta@oss.qualcomm.com/
V4:
- Added Reviewed-by tag.
- Resolved warnings reported by kernel test bot, minor code
reorganization.
Link to V3:
https://lore.kernel.org/all/20251221213602.2413124-1-vijayanand.jitta@oss.qualcomm.com/
V3:
- Added Reviewed-by tag.
- Updated of_map_id_args struct as a wrapper to of_phandle_args and
added comment description as suggested by Rob Herring.
Link to V2:
https://lore.kernel.org/all/20251204095530.8627-1-vijayanand.jitta@oss.qualcomm.com/
V2:
- Incorporated the patches from Robin that does the clean implementation.
- Dropped the patches the were adding multi-map support from this series
as suggested.
V1:
https://lore.kernel.org/all/cover.1762235099.git.charan.kalla@oss.qualcomm.com/
RFC:
https://lore.kernel.org/all/20250928171718.436440-1-charan.kalla@oss.qualcomm.com/#r
Signed-off-by: Vijayanand Jitta <vijayanand.jitta@oss•qualcomm.com>
---
To: Nipun Gupta <nipun.gupta@amd•com>
To: Nikhil Agarwal <nikhil.agarwal@amd•com>
To: Joerg Roedel <joro@8bytes•org>
To: Will Deacon <will@kernel•org>
To: Robin Murphy <robin.murphy@arm•com>
To: Lorenzo Pieralisi <lpieralisi@kernel•org>
To: Marc Zyngier <maz@kernel•org>
To: Thomas Gleixner <tglx@kernel•org>
To: Rob Herring <robh@kernel•org>
To: Saravana Kannan <saravanak@kernel•org>
To: Richard Zhu <hongxing.zhu@nxp•com>
To: Lucas Stach <l.stach@pengutronix•de>
To: Krzysztof Wilczy\u0144ski <kwilczynski@kernel•org>
To: Manivannan Sadhasivam <mani@kernel•org>
To: Bjorn Helgaas <bhelgaas@google•com>
To: Frank Li <Frank.Li@nxp•com>
To: Sascha Hauer <s.hauer@pengutronix•de>
To: Pengutronix Kernel Team <kernel@pengutronix•de>
To: Fabio Estevam <festevam@gmail•com>
To: Juergen Gross <jgross@suse•com>
To: Stefano Stabellini <sstabellini@kernel•org>
To: Oleksandr Tyshchenko <oleksandr_tyshchenko@epam•com>
Cc: linux-arm-msm@vger•kernel.org
Cc: linux-kernel@vger•kernel.org
Cc: iommu@lists•linux.dev
Cc: linux-arm-kernel@lists•infradead.org
Cc: devicetree@vger•kernel.org
Cc: linux-pci@vger•kernel.org
Cc: imx@lists•linux.dev
Cc: xen-devel@lists•xenproject.org
---
To: Nipun Gupta <nipun.gupta@amd•com>
To: Nikhil Agarwal <nikhil.agarwal@amd•com>
To: Joerg Roedel <joro@8bytes•org>
To: Will Deacon <will@kernel•org>
To: Robin Murphy <robin.murphy@arm•com>
To: Lorenzo Pieralisi <lpieralisi@kernel•org>
To: Marc Zyngier <maz@kernel•org>
To: Thomas Gleixner <tglx@kernel•org>
To: Rob Herring <robh@kernel•org>
To: Saravana Kannan <saravanak@kernel•org>
To: Richard Zhu <hongxing.zhu@nxp•com>
To: Lucas Stach <l.stach@pengutronix•de>
To: Krzysztof Wilczy\u0144ski <kwilczynski@kernel•org>
To: Manivannan Sadhasivam <mani@kernel•org>
To: Bjorn Helgaas <bhelgaas@google•com>
To: Frank Li <Frank.Li@nxp•com>
To: Sascha Hauer <s.hauer@pengutronix•de>
To: Pengutronix Kernel Team <kernel@pengutronix•de>
To: Fabio Estevam <festevam@gmail•com>
To: Juergen Gross <jgross@suse•com>
To: Stefano Stabellini <sstabellini@kernel•org>
To: Oleksandr Tyshchenko <oleksandr_tyshchenko@epam•com>
Cc: linux-arm-msm@vger•kernel.org
Cc: linux-kernel@vger•kernel.org
Cc: iommu@lists•linux.dev
Cc: linux-arm-kernel@lists•infradead.org
Cc: devicetree@vger•kernel.org
Cc: linux-pci@vger•kernel.org
Cc: imx@lists•linux.dev
Cc: xen-devel@lists•xenproject.org
---
Charan Teja Kalla (1):
of: Factor arguments passed to of_map_id() into a struct
Robin Murphy (2):
of: Add convenience wrappers for of_map_id()
of: Respect #{iommu,msi}-cells in maps
drivers/cdx/cdx_msi.c | 10 +-
drivers/iommu/of_iommu.c | 6 +-
drivers/irqchip/irq-gic-its-msi-parent.c | 10 +-
drivers/of/base.c | 227 +++++++++++++++++++++++++------
drivers/of/irq.c | 25 +++-
drivers/pci/controller/dwc/pci-imx6.c | 55 ++++----
drivers/pci/controller/pcie-apple.c | 6 +-
drivers/xen/grant-dma-ops.c | 5 +-
include/linux/of.h | 32 ++++-
9 files changed, 277 insertions(+), 99 deletions(-)
---
base-commit: e98d21c170b01ddef366f023bbfcf6b31509fa83
change-id: 20260301-parse_iommu_cells-1c33768aebba
Best regards,
--
Vijayanand Jitta <vijayanand.jitta@oss•qualcomm.com>
---
Charan Teja Kalla (1):
of: Factor arguments passed to of_map_id() into a struct
Robin Murphy (2):
of: Add convenience wrappers for of_map_id()
of: Respect #{iommu,msi}-cells in maps
drivers/cdx/cdx_msi.c | 10 +-
drivers/iommu/of_iommu.c | 6 +-
drivers/irqchip/irq-gic-its-msi-parent.c | 10 +-
drivers/of/base.c | 227 +++++++++++++++++++++++++------
drivers/of/irq.c | 32 +++--
drivers/pci/controller/dwc/pci-imx6.c | 55 ++++----
drivers/pci/controller/pcie-apple.c | 6 +-
drivers/xen/grant-dma-ops.c | 5 +-
include/linux/of.h | 32 ++++-
9 files changed, 282 insertions(+), 101 deletions(-)
---
base-commit: cdf5682bcd98422242d95c4e6c10f9c38bcf56c7
change-id: 20260301-parse_iommu_cells-1c33768aebba
Best regards,
--
Vijayanand Jitta <vijayanand.jitta@oss•qualcomm.com>
next reply other threads:[~2026-06-03 7:14 UTC|newest]
Thread overview: 4+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-06-03 7:13 Vijayanand Jitta [this message]
2026-06-03 7:13 ` [PATCH v16 1/3] of: Add convenience wrappers for of_map_id() Vijayanand Jitta
2026-06-03 7:13 ` [PATCH v16 2/3] of: Factor arguments passed to of_map_id() into a struct Vijayanand Jitta
2026-06-03 7:13 ` [PATCH v16 3/3] of: Respect #{iommu,msi}-cells in maps Vijayanand Jitta
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20260603-parse_iommu_cells-v16-0-dc509dacb19a@oss.qualcomm.com \
--to=vijayanand.jitta@oss$(echo .)qualcomm.com \
--cc=Frank.Li@nxp$(echo .)com \
--cc=bhelgaas@google$(echo .)com \
--cc=charan.kalla@oss$(echo .)qualcomm.com \
--cc=devicetree@vger$(echo .)kernel.org \
--cc=dmitry.baryshkov@oss$(echo .)qualcomm.com \
--cc=festevam@gmail$(echo .)com \
--cc=hongxing.zhu@nxp$(echo .)com \
--cc=imx@lists$(echo .)linux.dev \
--cc=iommu@lists$(echo .)linux.dev \
--cc=jgross@suse$(echo .)com \
--cc=joro@8bytes$(echo .)org \
--cc=kernel@pengutronix$(echo .)de \
--cc=kwilczynski@kernel$(echo .)org \
--cc=l.stach@pengutronix$(echo .)de \
--cc=linux-arm-kernel@lists$(echo .)infradead.org \
--cc=linux-arm-msm@vger$(echo .)kernel.org \
--cc=linux-kernel@vger$(echo .)kernel.org \
--cc=linux-pci@vger$(echo .)kernel.org \
--cc=lpieralisi@kernel$(echo .)org \
--cc=mani@kernel$(echo .)org \
--cc=maz@kernel$(echo .)org \
--cc=nikhil.agarwal@amd$(echo .)com \
--cc=nipun.gupta@amd$(echo .)com \
--cc=oleksandr_tyshchenko@epam$(echo .)com \
--cc=robh@kernel$(echo .)org \
--cc=robin.murphy@arm$(echo .)com \
--cc=s.hauer@pengutronix$(echo .)de \
--cc=saravanak@kernel$(echo .)org \
--cc=sstabellini@kernel$(echo .)org \
--cc=tglx@kernel$(echo .)org \
--cc=will@kernel$(echo .)org \
--cc=xen-devel@lists$(echo .)xenproject.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox