linux/drivers
akshatzen 95652f98b1 scsi: pm80xx: Check main config table address
The driver initializes main configuration, general status, inbound queue
and outbound queue table addresses based on a value read from
MSGU_SCRATCH_PAD_0 register.

We should validate these addresses before dereferencing them.

Adds two validations:

 1. Check if main configuration table offset lies within the pcibar
    mapped

 2. Check if first dword of main configuration table reads "PMCS"

There are two calls to init_pci_device_addresses() done during
pm8001_pci_probe() in this sequence:

 1. First inside chip_soft_rst, where if init_pci_device_addresses fails we
    will go ahead assuming MPI state is not ready and reset the device as
    long as bootloader is okay.  This gives chance to second call of
    init_pci_device_addresses to set up the addresses after reset.

 2. The second call is via pm80xx_chip_init, after soft reset is done and
    firmware is checked to be ready. Once that is done we are safe to go
    ahead and initialize default table values and use them.

Tests:

 1. Enabled debugging logs and observed no issues during initialization,
    with a controller with no issues:

    pm80xx0:: pm8001_setup_msix 1034: pci_alloc_irq_vectors request ret:64 no of intr 64
    pm80xx0:: init_pci_device_addresses 917: Scratchpad 0 Offset: 0x2000 value 0x40002000
    pm80xx0:: init_pci_device_addresses 925: Scratchpad 0 PCI BAR: 0
    pm80xx0:: init_pci_device_addresses 952: VALID main config signature 0x53434d50
    pm80xx0:: init_pci_device_addresses 975: GST OFFSET 0xc4
    pm80xx0:: init_pci_device_addresses 978: INBND OFFSET 0x20000128
    pm80xx0:: init_pci_device_addresses 981: OBND OFFSET 0x24000928
    pm80xx0:: init_pci_device_addresses 984: IVT OFFSET 0x8001408
    pm80xx0:: init_pci_device_addresses 987: PSPA OFFSET 0x8001608
    pm80xx0:: init_pci_device_addresses 991: addr - main cfg (ptrval) general status (ptrval)
    pm80xx0:: init_pci_device_addresses 995: addr - inbnd (ptrval) obnd (ptrval)
    pm80xx0:: init_pci_device_addresses 999: addr - pspa (ptrval) ivt (ptrval)
    pm80xx0:: pm80xx_chip_soft_rst 1446: reset register before write : 0x0
    pm80xx0:: pm80xx_chip_soft_rst 1478: reset register after write 0x40
    pm80xx0:: pm80xx_chip_soft_rst 1544: SPCv soft reset Complete
    pm80xx0:: init_pci_device_addresses 917: Scratchpad 0 Offset: 0x2000 value 0x40002000
    pm80xx0:: init_pci_device_addresses 925: Scratchpad 0 PCI BAR: 0
    pm80xx0:: init_pci_device_addresses 952: VALID main config signature 0x53434d50
    pm80xx0:: init_pci_device_addresses 975: GST OFFSET 0xc4
    pm80xx0:: init_pci_device_addresses 978: INBND OFFSET 0x20000128
    pm80xx0:: init_pci_device_addresses 981: OBND OFFSET 0x24000928
    pm80xx0:: init_pci_device_addresses 984: IVT OFFSET 0x8001408
    pm80xx0:: init_pci_device_addresses 987: PSPA OFFSET 0x8001608
    pm80xx0:: init_pci_device_addresses 991: addr - main cfg (ptrval) general status (ptrval)
    pm80xx0:: init_pci_device_addresses 995: addr - inbnd (ptrval) obnd (ptrval)
    pm80xx0:: init_pci_device_addresses 999: addr - pspa (ptrval) ivt (ptrval)
    pm80xx0:: pm80xx_chip_init 1329: MPI initialize successful!

 2. Tested controller with firmware known to have initialization issue and
    observed no crashes with this fix:

    pm80xx 0000:01:00.0: pm80xx: driver version 0.1.38
    pm80xx 0000:01:00.0: Removing from 1:1 domain
    pm80xx 0000:01:00.0: Requesting non-1:1 mappings
    pm80xx0:: init_pci_device_addresses 948: BAD main config signature 0x0
    pm80xx0:: mpi_uninit_check 1365: Failed to init pci addresses
    pm80xx0:: pm80xx_chip_soft_rst 1435: MPI state is not ready scratch:0:8:62a01000:0
    pm80xx0:: pm80xx_chip_soft_rst 1518: Firmware is not ready!
    pm80xx0:: pm80xx_chip_soft_rst 1532: iButton Feature is not Available!!!
    pm80xx0:: pm80xx_chip_init 1301: Firmware is not ready!
    pm80xx0:: pm8001_pci_probe 1215: chip_init failed [ret: -16]
    pm80xx: probe of 0000:01:00.0 failed with error -16
    pm80xx 0000:07:00.0: pm80xx: driver version 0.1.38
    pm80xx 0000:07:00.0: Removing from 1:1 domain
    pm80xx 0000:07:00.0: Requesting non-1:1 mappings
    scsi host6: pm80xx
    pm80xx1:: pm8001_setup_sgpio 5568: failed sgpio_req timeout
    pm80xx1:: mpi_phy_start_resp 3447: phy start resp status:0x0, phyid:0x0
    pm80xx 0000:08:00.0: pm80xx: driver version 0.1.38
    pm80xx 0000:08:00.0: Removing from 1:1 domain
    pm80xx 0000:08:00.0: Requesting non-1:1 mappings

 3. Without this fix we observe crash on the same controller:

    pm80xx 0000:01:00.0: pm80xx: driver version 0.1.38
    pm80xx 0000:01:00.0: Removing from 1:1 domain
    pm80xx 0000:01:00.0: Requesting non-1:1 mappings
    [<ffffffffc0451b3b>] pm80xx_chip_soft_rst+0x6b/0x4c0 [pm80xx]
    [<ffffffffc043a933>] pm8001_pci_probe+0xa43/0x1630 [pm80xx]
    RIP: 0010:pm80xx_chip_soft_rst+0x71/0x4c0 [pm80xx]
    [<ffffffffc0451b3b>] ? pm80xx_chip_soft_rst+0x6b/0x4c0 [pm80xx]
    [<ffffffffc043a933>] pm8001_pci_probe+0xa43/0x1630 [pm80xx]
    pm80xx0:: mpi_uninit_check 1339: TIMEOUT:IBDB value/=2
    pm80xx0:: pm80xx_chip_soft_rst 1387: MPI state is not ready scratch:0:8:62a01000:0
    pm80xx0:: pm80xx_chip_soft_rst 1470: Firmware is not ready!
    pm80xx0:: pm80xx_chip_soft_rst 1484: iButton Feature is not Available!!!
    pm80xx0:: pm80xx_chip_init 1266: Firmware is not ready!
    pm80xx0:: pm8001_pci_probe 1207: chip_init failed [ret: -16]
    pm80xx: probe of 0000:01:00.0 failed with error -16

Link: https://lore.kernel.org/r/20210109123849.17098-4-Viswas.G@microchip.com
Acked-by: Jack Wang <jinpu.wang@cloud.ionos.com>
Signed-off-by: akshatzen <akshatzen@google.com>
Signed-off-by: Viswas G <Viswas.G@microchip.com>
Signed-off-by: Ruksar Devadi <Ruksar.devadi@microchip.com>
Signed-off-by: Radha Ramachandran <radha@google.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
2021-01-13 00:02:01 -05:00
..
accessibility speakup: fix uninitialized flush_lock 2020-12-09 15:38:13 +01:00
acpi libnvdimm for 5.11 2020-12-24 12:18:11 -08:00
amba
android Merge branch 'exec-for-v5.11' of git://git.kernel.org/pub/scm/linux/kernel/git/ebiederm/user-namespace 2020-12-15 19:29:43 -08:00
ata
atm
auxdisplay
base Power management updates for 5.11-rc1 2020-12-15 16:30:31 -08:00
bcma
block block-5.11-2020-12-23 2020-12-24 12:28:35 -08:00
bluetooth
bus ARM: SoC drivers for v5.11 2020-12-16 16:38:41 -08:00
cdrom cdrom: Reset sector_size back it is not 2048. 2020-12-12 11:12:25 -07:00
char UAPI Changes: 2020-12-18 12:38:28 -08:00
clk The core framework got some nice improvements this time around. We gained the 2020-12-21 10:39:37 -08:00
clocksource asm-generic: cross-architecture timer cleanup 2020-12-16 00:07:17 -08:00
connector net/connector: Add const qualifier to cb_id 2020-12-16 11:06:49 -08:00
counter
cpufreq cpufreq: intel_pstate: Fix fast-switch fallback path 2020-12-30 18:22:17 +01:00
cpuidle ARM: SoC drivers for v5.11 2020-12-16 16:38:41 -08:00
crypto Merge branch 'linus' of git://git.kernel.org/pub/scm/linux/kernel/git/herbert/crypto-2.6 2020-12-27 09:14:32 -08:00
dax libnvdimm for 5.11 2020-12-24 12:18:11 -08:00
dca
devfreq Merge branches 'pm-devfreq' and 'pm-tools' 2020-12-15 15:27:16 +01:00
dio
dma dmaengine updates for v5.11-rc1 2020-12-17 12:52:23 -08:00
dma-buf drm fixes for 5.11-rc1 2020-12-24 12:14:29 -08:00
edac Merge branch 'akpm' (patches from Andrew) 2020-12-15 12:53:37 -08:00
eisa
extcon extcon: max77693: Fix modalias string 2020-12-11 17:18:10 +09:00
firewire
firmware EFI updates collected by Ard Biesheuvel: 2020-12-24 12:40:07 -08:00
fpga
fsi hwmon patches for v5.11 2020-12-15 16:06:14 -08:00
gnss
gpio This is the bulk of the GPIO changes for the v5.11 kernel cycle: 2020-12-17 18:07:20 -08:00
gpu drm/amd/display: avoid uninitialized variable warning 2020-12-25 15:41:13 -08:00
greybus
hid Merge branch 'for-5.11/wacom' into for-linus 2020-12-16 11:44:38 +01:00
hsi
hv hyperv-next for 5.11 2020-12-16 11:49:46 -08:00
hwmon hwmon: (k10temp) Remove support for displaying voltage and current on Zen CPUs 2020-12-22 08:18:36 -08:00
hwspinlock hwspinlock: sirf: Remove the redundant 'of_match_ptr' 2020-12-10 13:34:40 -06:00
hwtracing Char / Misc driver updates for 5.11-rc1 2020-12-15 14:10:09 -08:00
i2c Power management updates for 5.11-rc1 2020-12-15 16:30:31 -08:00
i3c i3c/master/mipi-i3c-hci: quiet maybe-unused variable warning 2020-12-17 10:31:30 +01:00
ide SCSI fixes on 20210101 2021-01-01 12:58:07 -08:00
idle intel_idle: add SnowRidge C-state table 2020-12-30 18:25:34 +01:00
iio Staging / IIO driver patches for 5.11-rc1 2020-12-15 14:18:40 -08:00
infiniband block/rnbd-clt: Does not request pdu to rtrs-clt 2020-12-16 14:56:09 -07:00
input Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/dtor/input 2020-12-15 16:18:23 -08:00
interconnect ARM: device tree updates for 5.11 2020-12-16 16:27:35 -08:00
iommu IOMMU updates for 5.11 2020-12-16 13:58:47 -08:00
ipack
irqchip ARM: 2020-12-20 10:44:05 -08:00
isdn
leds
lightnvm drivers/lightnvm: fix a null-ptr-deref bug in pblk-core.c 2020-12-08 10:02:45 -07:00
macintosh
mailbox mailbox: arm_mhuv2: Add driver 2020-12-09 19:26:02 -06:00
mcb
md Revert WQ_SYSFS change that broke reencryption (and all other 2020-12-28 13:32:16 -08:00
media ARM: SoC drivers for v5.11 2020-12-16 16:38:41 -08:00
memory Merge tag 'memory-controller-drv-tegra-5.11-3' of git://git.kernel.org/pub/scm/linux/kernel/git/krzk/linux-mem-ctrl into arm/drivers 2020-12-09 00:40:02 +01:00
memstick
message SCSI misc on 20201216 2020-12-16 13:34:31 -08:00
mfd mfd: ab8500-debugfs: Remove extraneous seq_putc 2020-12-26 09:19:49 -08:00
misc powerpc updates for 5.11 2020-12-17 13:34:25 -08:00
mmc MMC core: 2020-12-15 15:57:25 -08:00
most
mtd This pull request contains changes for JFFS2, UBI and UBIFS: 2020-12-17 17:46:34 -08:00
mux
net A treewide cleanup of interrupt descriptor (ab)use with all sorts of racy 2020-12-24 13:50:23 -08:00
nfc nfc: s3fwrn5: Remove unused NCI prop commands 2020-12-16 13:09:35 -08:00
ntb Big fix for IDT NTB and Intel NTB LTR management support 2020-12-27 09:22:55 -08:00
nubus
nvdimm libnvdimm/label: Return -ENXIO for no slot in __blk_label_update 2020-12-16 16:53:00 -08:00
nvme RDMA 5.11 pull request 2020-12-16 13:42:26 -08:00
nvmem
of Driver core updates for 5.11-rc1 2020-12-15 14:02:26 -08:00
opp opp: Call the missing clk_put() on error 2020-12-28 10:56:22 +05:30
oprofile
parisc
parport
pci pci-v5.11-fixes-1 2020-12-25 20:17:40 -08:00
pcmcia Merge branch 'pcmcia-next' of git://git.kernel.org/pub/scm/linux/kernel/git/brodo/linux 2020-12-19 12:50:10 -08:00
perf perf/imx_ddr: Add system PMU identifier for userspace 2020-12-09 14:14:02 +00:00
phy Char / Misc driver updates for 5.11-rc1 2020-12-15 14:10:09 -08:00
pinctrl A treewide cleanup of interrupt descriptor (ab)use with all sorts of racy 2020-12-24 13:50:23 -08:00
platform chrome platform changes for 5.11 2020-12-23 15:06:22 -08:00
pnp
power power: supply: Fix a typo in warning message 2020-12-13 01:00:10 +01:00
powercap Merge branches 'pm-sleep', 'pm-acpi', 'pm-domains' and 'powercap' 2020-12-15 15:26:14 +01:00
pps
ps3 powerpc/ps3: use dma_mapping_error() 2020-12-15 22:50:12 +11:00
ptp ptp: clockmatrix: deprecate firmware older than 4.8.7 2020-12-09 15:00:55 -08:00
pwm pwm: Changes for v5.11-rc1 2020-12-19 11:51:32 -08:00
rapidio rapidio: remove unused rio_get_asm() and rio_get_device() 2020-12-15 22:46:18 -08:00
ras
regulator Merge remote-tracking branch 'regulator/for-5.11' into regulator-next 2020-12-11 17:48:32 +00:00
remoteproc ARM: SoC drivers for v5.11 2020-12-16 16:38:41 -08:00
reset ARM: SoC drivers for v5.11 2020-12-16 16:38:41 -08:00
rpmsg
rtc RTC for 5.11 2020-12-20 10:12:06 -08:00
s390 block-5.11-2020-12-23 2020-12-24 12:28:35 -08:00
sbus
scsi scsi: pm80xx: Check main config table address 2021-01-13 00:02:01 -05:00
sfi
sh
siox siox: Make remove callback return void 2020-12-10 16:17:15 +01:00
slimbus slimbus: qcom: fix potential NULL dereference in qcom_slim_prg_slew() 2020-12-10 16:23:56 +01:00
soc OpenRISC updates for 5.11 2020-12-17 13:41:27 -08:00
soundwire
spi Merge remote-tracking branch 'spi/for-5.11' into spi-next 2020-12-11 17:49:01 +00:00
spmi spmi: Add driver shutdown support 2020-12-10 10:45:36 +01:00
ssb
staging UAPI Changes: 2020-12-18 12:38:28 -08:00
target SCSI misc on 20201216 2020-12-16 13:34:31 -08:00
tc
tee ARM: SoC drivers for v5.11 2020-12-16 16:38:41 -08:00
thermal - Add Alder Lake support ACPI ids (Srinivas Pandruvada) 2020-12-18 12:19:37 -08:00
thunderbolt
tty OpenRISC updates for 5.11 2020-12-17 13:41:27 -08:00
uio uio: uio_hv_generic: use devm_kzalloc() for private data alloc 2020-12-09 19:59:00 +01:00
usb powerpc updates for 5.11 2020-12-17 13:34:25 -08:00
vdpa virtio,vdpa: features, cleanups, fixes 2020-12-24 12:06:46 -08:00
vfio ARM: 2020-12-20 10:44:05 -08:00
vhost virtio,vdpa: features, cleanups, fixes 2020-12-24 12:06:46 -08:00
video UAPI Changes: 2020-12-18 12:38:28 -08:00
virt
virtio virtio,vdpa: features, cleanups, fixes 2020-12-24 12:06:46 -08:00
visorbus
vlynq
vme vme: switch from 'pci_' to 'dma_' API 2020-12-09 19:44:34 +01:00
w1
watchdog linux-watchdog 5.11-rc1 tag 2020-12-23 15:01:49 -08:00
xen A treewide cleanup of interrupt descriptor (ab)use with all sorts of racy 2020-12-24 13:50:23 -08:00
zorro
Kconfig
Makefile asm-generic: cross-architecture timer cleanup 2020-12-16 00:07:17 -08:00