soc: aspeed: Add BMC and host driver for PCIe BMC device
Subsystems (4)
v5 cover soc: aspeed: Add BMC and host driver for PCIe BMC device
This is the v5 for upstreaming the VUART over PCIe BMC device drivers. The initial drivers were taken from the ASPEED kernel SDK (master-v6.18) [1].
There are two drivers: a BMC-side driver and a host-side driver. Together they enable host<->BMC VUART communication via PCIe.
The virtual UART is an 8250-compatible register set. It is called 'virtual' because it is internally a simple FIFO.
On the AST2600, two VUARTs can be exposed over PCI via the PCI BMC device.
The host cannot access the BMC's memory. Only the exposed features are accessible. These are the KCS4 channel and 2 VUARTs. There is also some mailbox register functionality for a communication between the host and the BMC. More information can be found here [2].
Changes since v4 [3]:
- Squashed '8250' DT binding changes in one patch based on Krzysztof's review.
- Removed 'aspeed,sirq-polarity-sense' support on new 'aspeed,ast2600-vuart' compatible string as it's a deprecated property.
- Renamed 'syscon' to 'aspeed,scu-syscon' in '8250' DT binding.
- Cleanup in BMC driver:
- Changed bit 14 to RESERVED macro
- Changed macros ordering
- use FIELD_PREP macro
- Cleaned up of the host-side driver:
- Removed unused INTX. Only use MSI interrupt.
- Proper use of dev_err_probe.
- Use of 'module_pci_driver'.
- Used managed functions and simplified exit code.
- Changed the host side driver location:
- Now in driver/mfd/aspeed-pci-core.c
- Changed code to use MFD cells.
VUART are sub driver of the core driver.
This allows for easy expansion for KCS support.
- The core driver now only sets up MSI interrupts and instantiates the 8250 sub-driver.
The host driver will performs multiple functions. The AST2600 also supports LPC over PCI, with a specific KCS channel (KCS4). This host core driver should also be used to enable the IPMI automatically via this KCS channel.
Tested:
As with v4, VUART data flow and MSI interrupts have been verified as working on the test hardware.
BMC: Asus IPMI Kommando Card R1.01, AST2600 A3 running OpenBMC
Host: Linux kernel v7.0.0
This series only supports the AST2600; the AST2700 is not supported.
The findings regarding the MSI interrupt numbers are explained in the v4 cover letter [3].
As with v3 and v4, I would like to know whether I should add the 'lpc-io-reg' and 'lpc-interrupt' values to the vuart3 and vuart4 nodes directly in the 'aspeed-g6.dtsi'. The host driver is not capable of finding the vuart address on its own, so they are hardcoded to 0x3f8 and 0x2f8. It will not work with other addresses, so perhaps they should be in the .dtsi to ensure the correct configuration for the two vuart over PCI.
[1]: https://github.com/AspeedTech-BMC/linux/tree/aspeed-master-v6.18/drivers/soc/aspeed
[2]: https://lore.kernel.org/linux-aspeed/CAFi2wKYOAotiezepDqaR5PZDqDaPKKDfAEnpx5EHC0mL39hy6w@mail.gmail.com/
[3]: https://lore.kernel.org/linux-aspeed/[email protected]/
Grégoire Layet (6):
dt-bindings: serial: 8250: aspeed: add ast2600 and
aspeed,vuart-over-pci
serial: 8250_aspeed_vuart: add aspeed,ast2600-vuart compatible string
serial: 8250_aspeed_vuart: add VUART over PCI
soc: mfd: add ASPEED AST2600 PCIe BMC device driver
ARM: dts: aspeed: g6: Change vuart compatible string for ast2600
ARM: dts: aspeed: g6: add aspeed,vuart-over-pci prop to vuart3 and 4
.../devicetree/bindings/serial/8250.yaml | 42 +++++- MAINTAINERS | 6 + arch/arm/boot/dts/aspeed/aspeed-g6.dtsi | 12 +- drivers/mfd/Kconfig | 12 ++ drivers/mfd/Makefile | 2 + drivers/mfd/aspeed-pci-core.c | 120 ++++++++++++++++++ drivers/tty/serial/8250/8250_aspeed_vuart.c | 92 ++++++++++++++ 7 files changed, 280 insertions(+), 6 deletions(-) create mode 100644 drivers/mfd/aspeed-pci-core.c
base-commit: 253b1036b9163f23f7b18274a0d4e904ac8821c5 --
2.54.0
PATCH v5 1/6 dt-bindings: serial: 8250: aspeed: add ast2600 and aspeed,vuart-over-pci
The ASPEED AST2600 has 2 Virtual UARTs accessible over PCI. The ASPEED AST2600 can be used as a PCI device.
2 Virtual UART can be exposed to the host via this PCI device. These are 8250-compatible register sets and can be used to have UART communication between the PCI BMC and the host.
This boolean can be set to specify if a VUART is used over PCI. A VUART over PCI needs a syscon phandle. The syscon gives a regmap to the SCU, which is used to set the enable bits of the PCI device.
On the aspeed's chips, the clocks phandle already points at the SCU node. But deriving the regmap from the clock provider would misuse the clocks binding. An explicit syscon phandle states the dependency directly.
--- .../devicetree/bindings/serial/8250.yaml | 42 ++++++++++++++++++- 1 file changed, 40 insertions(+), 2 deletions(-)
Documentation/devicetree/bindings/serial/8250.yaml +40 -2
@@ -18,12 +18,34 @@ allOf: - aspeed,lpc-io-reg - required: - aspeed,lpc-interrupts + then: + properties: + compatible: + contains: + enum: + - aspeed,ast2500-vuart + - aspeed,ast2600-vuart + - if: + anyOf: - required: - aspeed,sirq-polarity-sense then: properties: compatible: const: aspeed,ast2500-vuart + - if: + required: + - aspeed,vuart-over-pci + then: + required: + - aspeed,scu-syscon + properties: + compatible: + contains: + const: aspeed,ast2600-vuart + else: + properties: + aspeed,scu-syscon: false - if: properties: compatible:
@@ -106,6 +128,9 @@ properties: - const: ns16850 - const: aspeed,ast2400-vuart - const: aspeed,ast2500-vuart + - items: + - const: aspeed,ast2600-vuart + - const: aspeed,ast2500-vuart - const: intel,xscale-uart - const: mrvl,pxa-uart - const: nuvoton,wpcm450-uart
@@ -297,7 +322,8 @@ properties: $ref: /schemas/types.yaml#/definitions/uint32-array maxItems: 1 description: | - The VUART LPC address. Only applicable to aspeed,ast2500-vuart. + The VUART LPC address. Only applicable to aspeed,ast2500-vuart and + aspeed,ast2600-vuart. aspeed,lpc-interrupts: $ref: /schemas/types.yaml#/definitions/uint32-array
@@ -306,7 +332,19 @@ properties: description: | A 2-cell property describing the VUART SIRQ number and SIRQ polarity (IRQ_TYPE_LEVEL_LOW or IRQ_TYPE_LEVEL_HIGH). Only - applicable to aspeed,ast2500-vuart. + applicable to aspeed,ast2500-vuart and aspeed,ast2600-vuart. + + aspeed,vuart-over-pci: + type: boolean + description: + Enable the VUART over the BMC PCI device. Only applicable to + aspeed,ast2600-vuart. + + aspeed,scu-syscon: + $ref: /schemas/types.yaml#/definitions/phandle + description: + Phandle to the SCU syscon, used to enable the VUART over the BMC PCI + device. Only applicable to aspeed,ast2600-vuart. required: - reg
Signature · 1 line
2.54.0
[email protected]
AI reviewRe: [PATCH v5 1/6] dt-bindings: serial: 8250: aspeed: add ast2600 and aspeed,vuart-over-pci
Sashiko has reviewed this patch and found no issues. It looks great!
Quoted 6 lines
The ASPEED AST2600 has 2 Virtual UARTs accessible over PCI. The ASPEED AST2600 can be used as a PCI device.
2 Virtual UART can be exposed to the host via this PCI device. These are 8250-compatible register sets and can be used to have UART communication between the PCI BMC and the host.
Quoted 8 lines
This boolean can be set to specify if a VUART is used over PCI. A VUART over PCI needs a syscon phandle. The syscon gives a regmap to the SCU, which is used to set the enable bits of the PCI device.
On the aspeed's chips, the clocks phandle already points at the SCU node. But deriving the regmap from the clock provider would misuse the clocks binding. An explicit syscon phandle states the dependency directly.Signed-off-by Grégoire Layet <[email protected]>
Sashiko has reviewed this patch and found no issues. It looks great!
Signature · 1 line
Sashiko AI review · https://sashiko.dev/#/patchset/[email protected]?part=1
Re: [PATCH v5 1/6] dt-bindings: serial: 8250: aspeed: add ast2600 and aspeed,vuart-over-pci
In reply to Grégoire LayetQuoted 13 lines · Grégoire Layet
The ASPEED AST2600 has 2 Virtual UARTs accessible over PCI. The ASPEED AST2600 can be used as a PCI device.
2 Virtual UART can be exposed to the host via this PCI device. These are 8250-compatible register sets and can be used to have UART communication between the PCI BMC and the host.This boolean can be set to specify if a VUART is used over PCI. A VUART over PCI needs a syscon phandle. The syscon gives a regmap to the SCU, which is used to set the enable bits of the PCI device.
On the aspeed's chips, the clocks phandle already points at the SCU node. But deriving the regmap from the clock provider would misuse the clocks binding. An explicit syscon phandle states the dependency directly.
Quoted 4 lines
Signed-off-by Grégoire Layet <[email protected]>--- .../devicetree/bindings/serial/8250.yaml | 42 ++++++++++++++++++- 1 file changed, 40 insertions(+), 2 deletions(-)
Best regards,
Krzysztof
PATCH v5 2/6 serial: 8250_aspeed_vuart: add aspeed,ast2600-vuart compatible string
In reply to Grégoire LayetMake the driver compatible with the ast2600-vuart. Enable specific configuration for the AST2600.
--- drivers/tty/serial/8250/8250_aspeed_vuart.c | 1 + 1 file changed, 1 insertion(+)
drivers/tty/serial/8250/8250_aspeed_vuart.c +1 -0
@@ -560,6 +560,7 @@ static void aspeed_vuart_remove(struct platform_device *pdev)static const struct of_device_id aspeed_vuart_table[] = { { .compatible ="aspeed,ast2400-vuart" }, { .compatible ="aspeed,ast2500-vuart" }, + { .compatible ="aspeed,ast2600-vuart" }, { }, };MODULE_DEVICE_TABLE (of, aspeed_vuart_table);
Signature · 1 line
2.54.0
[email protected]
AI reviewRe: [PATCH v5 2/6] serial: 8250_aspeed_vuart: add aspeed,ast2600-vuart compatible string
Thank you for your contribution! Sashiko AI review found 3 potential issue(s) to consider:
Thank you for your contribution! Sashiko AI review found 3 potential issue(s) to consider:
Pre-existing issues:
- [High] Probe error paths leak the registered 8250 port and timer, leading to a use-after-free when devres cleans up.
- [High] Early sysfs exposure in probe allows userspace to trigger a NULL pointer dereference before drvdata is set.
- [High] Late sysfs removal during device remove allows userspace to access unmapped IO memory.
--
--- Patch [2]: [PATCH v5 2/6] serial: 8250_aspeed_vuart: add aspeed,ast2600-vuart compatible string --- commit 513026908b64cd69b7d61f618f21a1466256a146
Author: Grégoire Layet <[email protected]>
serial: 8250_aspeed_vuart: add aspeed,ast2600-vuart compatible string
Make the driver compatible with the ast2600-vuart. Enable specific configuration for the AST2600.
drivers/tty/serial/8250/8250_aspeed_vuart.c static void aspeed_vuart_remove(struct platform_device *pdev) · line 563
Quoted 9 lines
drivers/tty/serial/8250/8250_aspeed_vuart.c +1
-0@@ -560,6 +560,7 @@ static void aspeed_vuart_remove(struct platform_device *pdev)static const struct of_device_id aspeed_vuart_table[] = { { .compatible ="aspeed,ast2400-vuart" }, { .compatible ="aspeed,ast2500-vuart" }, + { .compatible ="aspeed,ast2600-vuart" },
[Severity: High]
This isn't a bug introduced by this patch, but adding this compatible string exposes the AST2600 device to a pre-existing resource leak in the driver's probe error path:
drivers/tty/serial/8250/8250_aspeed_vuart.c:aspeed_vuart_probe() {
...
err_sysfs_remove:
sysfs_remove_group(&vuart->dev->kobj, &aspeed_vuart_attr_group);
return rc;
}The err_sysfs_remove error path fails to call serial8250_unregister_port() and timer_delete_sync() before returning an error, leaking resources that hold a dangling pointer to the devres-freed vuart structure.
Could this lead to a use-after-free when devres cleans up?
[Severity: High]
This is also a pre-existing issue, but there is a race condition with early sysfs exposure during probe:
drivers/tty/serial/8250/8250_aspeed_vuart.c:aspeed_vuart_probe() {
...
rc = sysfs_create_group(&vuart->dev->kobj, &aspeed_vuart_attr_group);
...
platform_set_drvdata(pdev, vuart);
...
}The sysfs group is created and exposed to userspace early in the probe function, creating a race window before platform_set_drvdata() is called at the end.
If userspace reads a sysfs attribute (like sirq) during this window, the handler will call dev_get_drvdata() and receive NULL. Can this allow userspace to trigger a NULL pointer dereference before drvdata is set?
[Severity: High]
This is a pre-existing issue as well, but there appears to be a use-after-unmap vulnerability in the remove function:
drivers/tty/serial/8250/8250_aspeed_vuart.c:aspeed_vuart_remove() {
...
serial8250_unregister_port(vuart->line);
sysfs_remove_group(&vuart->dev->kobj, &aspeed_vuart_attr_group);
}The underlying 8250 port is unregistered and unmapped before the sysfs interface is removed.
If userspace accesses a sysfs attribute concurrently in the window before the sysfs group is removed, can this result in an access violation on the now unmapped vuart->port->port.membase?
Quoted 3 lines
drivers/tty/serial/8250/8250_aspeed_vuart.c +0
-0{ }, };MODULE_DEVICE_TABLE (of, aspeed_vuart_table);
Signature · 1 line
Sashiko AI review · https://sashiko.dev/#/patchset/[email protected]?part=2
Re: [PATCH v5 2/6] serial: 8250_aspeed_vuart: add aspeed,ast2600-vuart compatible string
In reply to Grégoire LayetQuoted 2 lines · Grégoire Layet
Make the driver compatible with the ast2600-vuart. Enable specific configuration for the AST2600.
Signature · 1 line
Tan Siewert <[email protected]>
PATCH v5 3/6 serial: 8250_aspeed_vuart: add VUART over PCI
In reply to Grégoire LayetEnable the VUART over PCI for the AST2600. Activate it only if the 'aspeed,vuart-over-pci' property flag is set on an 'ast2600-vuart' compatible node.
The AST2600 has 2 VUART that are usable over PCI. These are already defined as the VUART3 and VUART4 in the 'aspeed-g6.dtsi'.
Sets the BMC PCI device enable bits, sets the PCI class code to unassgined/device specific, and configures MSI interrupts.
There is no disable function. Removing this driver should not disable the BMC PCI device, as other drivers could use it.
However, if all the drivers using it are removed, the
BMC PCI device will still be activated, which is not ideal. But in reality, this is not a use case for a BMC, the drivers will never be removed.
This is useful on PCIe BMC expansion cards that use the AST2600, such as the ASUS Kommando IPMI Expansion Card.
Register initialisation taken from ASPEED 6.18 Kernel SDK. Add return code checks to each register write. Simplify the code and add macros.
The ASPEED_SCUC24 regmap update is missing a macro for 'BIT(14)'. I was unable to determine the purpose of this bit. In the AST2600 A3 datasheet it is marked as 'reserved'. It is only used on the other revision. As I only have the AST2600A3, I was unable to try this code path. This BIT14 was set in the ASPEED SDK so I kept it.
I can remove it and the untested path if necessary.
---
Change from v4 to v5:
- Change bit 14 to RESERVED macro
- Changed ordering of macros
- use FIELD_PREP macro
--- drivers/tty/serial/8250/8250_aspeed_vuart.c | 91 +++++++++++++++++++++ 1 file changed, 91 insertions(+)
drivers/tty/serial/8250/8250_aspeed_vuart.c +91 -0
@@ -32,6 +32,28 @@#define ASPEED_VUART_DEFAULT_SIRQ 4#define ASPEED_VUART_DEFAULT_SIRQ_POLARITY IRQ_TYPE_LEVEL_LOW +#define ASPEED_SCU_SILICON_REVISION_ID 0x04 +#define AST2600A3_REVISION_ID 0x05030303 + +#define ASPEED_SCU_PCIE_CONF_CTRL 0xC20 +#define SCU_PCIE_CONF_BMC_DEV_EN BIT(8) +#define SCU_PCIE_CONF_BMC_DEV_EN_MMIO BIT(9) +#define SCU_PCIE_CONF_BMC_DEV_EN_MSI BIT(11) +#define SCU_PCIE_CONF_BMC_DEV_EN_IRQ BIT(13) +#define SCU_PCIE_CONF_BMC_DEV_EN_PCIE_BUS_MASTER BIT(14) +#define SCU_PCIE_CONF_BMC_DEV_EN_E2L BIT(15) +#define SCU_PCIE_CONF_BMC_DEV_EN_LPC_DECODE BIT(21) + +#define ASPEED_SCUC24 0xC24 +#define ASPEED_SCUC24_MSI_ROUTING_MASK GENMASK(11, 10) +#define ASPEED_SCUC24_MSI_ROUTING_PCIE2LPC_PCIDEV1 \ + FIELD_PREP(ASPEED_SCUC24_MSI_ROUTING_MASK, 2) +#define ASPEED_SCUC24_RESERVED_14 BIT(14) +#define ASPEED_SCUC24_PCIDEV1_INTX_MSI_SCU560_EN BIT(17) +#define ASPEED_SCUC24_PCIDEV1_INTX_MSI_HOST2BMC_EN BIT(18) + +#define ASPEED_SCU_BMC_DEV_CLASS 0xC68 +struct aspeed_vuart {struct device *dev;int line;
@@ -412,6 +434,66 @@ static int aspeed_vuart_map_irq_polarity(u32 dt) } } +static int aspeed_ast2600_vuart_over_pci_set_enabled (struct platform_device *pdev) +{ +struct device *dev = &pdev->dev; +u32 silicon_revision_id; +struct regmap *scu; +int rc; + +u32 pcie_config_ctl =SCU_PCIE_CONF_BMC_DEV_EN_IRQ | +SCU_PCIE_CONF_BMC_DEV_EN_MMIO | +SCU_PCIE_CONF_BMC_DEV_EN_MSI | +SCU_PCIE_CONF_BMC_DEV_EN_PCIE_BUS_MASTER | +SCU_PCIE_CONF_BMC_DEV_EN_E2L | +SCU_PCIE_CONF_BMC_DEV_EN_LPC_DECODE | +SCU_PCIE_CONF_BMC_DEV_EN ; + + scu =syscon_regmap_lookup_by_phandle (dev->of_node,"aspeed,scu-syscon" ); +if (IS_ERR (scu)) { +dev_err (dev,"failed to find SCU regmap\n" ); +return PTR_ERR (scu); + } + +/* update class code to be an Unassigned/device specific class device */ +if (regmap_write (scu,ASPEED_SCU_BMC_DEV_CLASS ,0xff000000 )) { +dev_err (dev,"could not set PCIe class code\n" ); +return -EIO ; + } + +if (regmap_update_bits (scu,ASPEED_SCU_PCIE_CONF_CTRL , + pcie_config_ctl, pcie_config_ctl)) { +dev_err (dev,"could not set PCIe configuration\n" ); +return -EIO ; + } + +if (regmap_read (scu,ASPEED_SCU_SILICON_REVISION_ID , &silicon_revision_id)) { +dev_err (dev,"could not read silicon revision\n" ); +return -EIO ; + } + +if (silicon_revision_id ==AST2600A3_REVISION_ID ) + rc =regmap_update_bits (scu,ASPEED_SCUC24 , +ASPEED_SCUC24_PCIDEV1_INTX_MSI_HOST2BMC_EN | +ASPEED_SCUC24_MSI_ROUTING_MASK , +ASPEED_SCUC24_PCIDEV1_INTX_MSI_HOST2BMC_EN | +ASPEED_SCUC24_MSI_ROUTING_PCIE2LPC_PCIDEV1 ); +else + rc =regmap_update_bits (scu,ASPEED_SCUC24 , +ASPEED_SCUC24_PCIDEV1_INTX_MSI_SCU560_EN | +ASPEED_SCUC24_RESERVED_14 | +ASPEED_SCUC24_MSI_ROUTING_MASK , +ASPEED_SCUC24_PCIDEV1_INTX_MSI_SCU560_EN | +ASPEED_SCUC24_RESERVED_14 | +ASPEED_SCUC24_MSI_ROUTING_PCIE2LPC_PCIDEV1 ); +if (rc) { +dev_err (dev,"could not set PCI device 1 MSI interrupt routing\n" ); +return -EIO ; + } + +return 0 ; +} +static int aspeed_vuart_probe (struct platform_device *pdev) {struct of_phandle_args sirq_polarity_sense_args;
@@ -540,6 +622,15 @@ static int aspeed_vuart_probe(struct platform_device *pdev)aspeed_vuart_set_host_tx_discard (vuart, true);platform_set_drvdata (pdev, vuart); +if (of_device_is_compatible (dev->of_node,"aspeed,ast2600-vuart" ) && +of_property_read_bool (dev->of_node,"aspeed,vuart-over-pci" )) { + rc =aspeed_ast2600_vuart_over_pci_set_enabled (pdev); +if (rc <0 ) { +dev_err_probe (dev, rc,"could not enable VUART over PCI\n" ); + goto err_sysfs_remove; + } + } +return 0 ; err_sysfs_remove:
Signature · 1 line
2.54.0
[email protected]
AI reviewRe: [PATCH v5 3/6] serial: 8250_aspeed_vuart: add VUART over PCI
Thank you for your contribution! Sashiko AI review found 3 potential issue(s) to consider:
Thank you for your contribution! Sashiko AI review found 3 potential issue(s) to consider:
New issues:
- [Low] The FIELD_PREP macro is used without explicitly including <linux/bitfield.h>.
Pre-existing issues:
- [High] Probe error paths fail to unregister the 8250 serial port and delete the unthrottle timer, leading to a Use-After-Free when devres frees the device memory.
- [High] Incorrect timer deletion ordering in aspeed_vuart_remove() allows the timer to be re-armed on a freed object.
--
--- Patch [3]: [PATCH v5 3/6] serial: 8250_aspeed_vuart: add VUART over PCI --- commit ff31cbc0cdc941ba791069ea924a94d8ad864389
Author: Grégoire Layet <[email protected]>
serial: 8250_aspeed_vuart: add VUART over PCI
Enable the VUART over PCI for the AST2600. Activate it only if the aspeed,vuart-over-pci property flag is set on an ast2600-vuart compatible node.
Quoted 12 lines
drivers/tty/serial/8250/8250_aspeed_vuart.c +4
-0@@ -32,6 +32,28 @@#define ASPEED_VUART_DEFAULT_SIRQ 4#define ASPEED_VUART_DEFAULT_SIRQ_POLARITY IRQ_TYPE_LEVEL_LOW +#define ASPEED_SCU_SILICON_REVISION_ID 0x04 +#define AST2600A3_REVISION_ID 0x05030303 + +#define ASPEED_SCU_PCIE_CONF_CTRL 0xC20
[ ... ]
drivers/tty/serial/8250/8250_aspeed_vuart.c line 50
Quoted 4 lines
drivers/tty/serial/8250/8250_aspeed_vuart.c +4
-0+#define ASPEED_SCUC24 0xC24 +#define ASPEED_SCUC24_MSI_ROUTING_MASK GENMASK(11, 10) +#define ASPEED_SCUC24_MSI_ROUTING_PCIE2LPC_PCIDEV1 \ + FIELD_PREP(ASPEED_SCUC24_MSI_ROUTING_MASK, 2)
[Severity: Low]
Does this file explicitly include <linux/bitfield.h> for the FIELD_PREP macro? It appears missing, which might cause build failures if implicit inclusions change in the future.
Quoted 3 lines
drivers/tty/serial/8250/8250_aspeed_vuart.c +3
-0+#define ASPEED_SCUC24_RESERVED_14 BIT(14) +#define ASPEED_SCUC24_PCIDEV1_INTX_MSI_SCU560_EN BIT(17) +#define ASPEED_SCUC24_PCIDEV1_INTX_MSI_HOST2BMC_EN BIT(18)
[ ... ]
drivers/tty/serial/8250/8250_aspeed_vuart.c static int aspeed_vuart_probe(struct platform_device *pdev) · line 630
Quoted 10 lines
drivers/tty/serial/8250/8250_aspeed_vuart.c +6
-0@@ -540,6 +622,15 @@ static int aspeed_vuart_probe(struct platform_device *pdev)aspeed_vuart_set_host_tx_discard (vuart, true);platform_set_drvdata (pdev, vuart); +if (of_device_is_compatible (dev->of_node,"aspeed,ast2600-vuart" ) && +of_property_read_bool (dev->of_node,"aspeed,vuart-over-pci" )) { + rc =aspeed_ast2600_vuart_over_pci_set_enabled (pdev); +if (rc <0 ) { +dev_err_probe (dev, rc,"could not enable VUART over PCI\n" ); + goto err_sysfs_remove;
[Severity: High]
This is a pre-existing issue, but adding this new error path exposes it further in aspeed_vuart_probe().
If we jump to err_sysfs_remove after the UART port has been registered via serial8250_register_8250_port(), does this path fail to unregister the port and delete the unthrottle timer?
Since the vuart structure is allocated with devm_kzalloc, returning an error here will cause devres to free the memory. Could this leave the 8250 subsystem with a registered port containing a dangling pointer to vuart in port.private_data?
drivers/tty/serial/8250/8250_aspeed_vuart.c
Quoted 9 lines
drivers/tty/serial/8250/8250_aspeed_vuart.c +3
-0+ } + } +return 0 ; err_sysfs_remove:drivers/tty/serial/8250/8250_aspeed_vuart.c +0
-0sysfs_remove_group (&vuart->dev->kobj, &aspeed_vuart_attr_group);return rc; }
While reviewing the lifecycle of the vuart object, I also noticed another related issue in aspeed_vuart_remove() which is not modified in this patch.
[Severity: High]
This isn't a bug introduced by this patch, but does the ordering in aspeed_vuart_remove() allow the unthrottle timer to be re-armed on a freed object?
Currently, timer_delete_sync(&vuart->unthrottle_timer) is called before serial8250_unregister_port(vuart->line). Since the serial port and its interrupt handler remain active during this window, could an interrupt arrive and trigger aspeed_vuart_handle_irq(), calling mod_timer() to re-arm the timer?
When aspeed_vuart_remove() completes, vuart is freed by devres, and the pending timer could subsequently execute and access the freed memory.
Signature · 1 line
Sashiko AI review · https://sashiko.dev/#/patchset/[email protected]?part=3
Re: [PATCH v5 3/6] serial: 8250_aspeed_vuart: add VUART over PCI
In reply to Grégoire LayetQuoted 8 lines · Grégoire Layet
Enable the VUART over PCI for the AST2600. Activate it only if the 'aspeed,vuart-over-pci' property flag is set on an 'ast2600-vuart' compatible node.
The AST2600 has 2 VUART that are usable over PCI. These are already defined as the VUART3 and VUART4 in the '
aspeed-g6.dtsi'.[...]
Signature · 1 line
Tan Siewert <[email protected]>
PATCH v5 4/6 soc: mfd: add ASPEED AST2600 PCIe BMC device driver
In reply to Grégoire LayetAdd support for UART over PCIe between ASPEED
AST2600 BMC and host.
This is the host-side driver.
Based on ASPEED 6.18 Kernel SDK and trimmed down
and changed to MFD driver.
The AST2600 has two 8250-compatible register set usable over PCIe. These act as two UARTs. As there is only a FIFO internally between both ends, they are called Virtual UARTs. This patch adds both VUARTs as plat_serial8250_port. This is the core driver in charge of setting up MSI interrupts. It doesn't bind the whole PCIe resource to allow each sub-driver to bind the needed addresses.
This is not added as a PCI 8250 UART device, but as a MFD driver, as this host driver can be expanded upon for IPMI over KCS. It can also be used in the future for custom BMC<->host communication with shared memory and doorbell.
This host module should be the entry point for setting up all features related to an AST2600 present on the PCI bus.
Notes on the implementation:
The host can't detect the VUART addresses, so they are forced to 0x3f8 and 0x2f8, as in the initial ASPEED driver.
The MSI vector index of VUART2 has been changed from 15 to 17. The index 15 used in the initial driver was not working.
Tested:
Data path in both direction is tested on both VUARTs.
--- MAINTAINERS | 6 ++ drivers/mfd/Kconfig | 12 ++++ drivers/mfd/Makefile | 2 + drivers/mfd/aspeed-pci-core.c | 120 ++++++++++++++++++++++++++++++++++ 4 files changed, 140 insertions(+) create mode 100644 drivers/mfd/aspeed-pci-core.c
MAINTAINERS +6 -0
@@ -4011,6 +4011,12 @@ S: Maintained F: Documentation/devicetree/bindings/crypto/aspeed,* F: drivers/crypto/aspeed/ +ASPEED PCI BMC DEVICE DRIVER +M: Grégoire Layet <[email protected]> +M: Tan Siewert <[email protected]> +S: Maintained +F: drivers/mfd/aspeed-pci-core.c + ASPEED PECI CONTROLLER M: Iwona Winiarska <[email protected]> L: [email protected] (moderated for non-subscribers)
drivers/mfd/Kconfig +12 -0
@@ -2573,5 +2573,17 @@ config MFD_MAX7360 additional drivers must be enabled in order to use the functionality of the device. +config MFD_ASPEED_PCI_BMC_DEVICE + tristate "ASPEED BMC PCIe device" + depends on PCI + select MFD_CORE + help + Host-side driver for the ASPEED AST2600 BMC PCIe device found on + BMC expansion cards. Exposes two 8250-compatible VUART + ports. + + If unsure, say N. Choose M here if this machine has an + AST2600-based BMC expansion card on its PCIe bus. + endmenu endif
drivers/mfd/Makefile +2 -0
@@ -303,3 +303,5 @@ obj-$(CONFIG_MFD_RSMU_SPI) += rsmu_spi.o rsmu_core.o obj-$(CONFIG_MFD_UPBOARD_FPGA) += upboard-fpga.o obj-$(CONFIG_MFD_LOONGSON_SE) += loongson-se.o + +obj-$(CONFIG_MFD_ASPEED_PCI_BMC_DEVICE) += aspeed-pci-core.o
drivers/mfd/aspeed-pci-core.c new file +120 -0
120 lines not on this page · raw message
Signature · 1 line
2.54.0
[email protected]
AI reviewRe: [PATCH v5 4/6] soc: mfd: add ASPEED AST2600 PCIe BMC device driver
Thank you for your contribution! Sashiko AI review found 2 potential issue(s) to consider: - [Medium] The driver violates MFD subsystem guidelines by using the MFD API for a single-function device…
Thank you for your contribution! Sashiko AI review found 2 potential issue(s) to consider:
- [Medium] The driver violates MFD subsystem guidelines by using the MFD API for a single-function device and dynamically generating its mfd_cell arrays.
- [Low] The commit message prefix and driver structure naming do not adhere to MFD subsystem standards.
--
--- Patch [4]: [PATCH v5 4/6] soc: mfd: add ASPEED AST2600 PCIe BMC device driver --- commit 7554e65cc1603a70fab3089c5b74e52105ba9e5b
Author: Grégoire Layet <[email protected]>
soc: mfd: add ASPEED AST2600 PCIe BMC device driver
Add support for UART over PCIe between ASPEED AST2600 BMC and host. This is the host-side driver.
Quoted 1 line
soc: mfd: add ASPEED AST2600 PCIe BMC device driver
[Severity: Low]
This isn't a bug, but does the commit message prefix and capitalization follow the MFD subsystem guidelines? The standard format expects
mfd: <Driver>: <Capitalized description>.
Quoted 6 lines
drivers/mfd/aspeed-pci-core.c new file +0
-0@@ -0,0 +1,120 @@
[ ... ]
drivers/mfd/aspeed-pci-core.c line 25
Quoted 7 lines
drivers/mfd/aspeed-pci-core.c new file +7
-0+static const unsigned int vuart_msi_index[ASPEED_BMC_VUART ] = {16 ,17 }; +static const u16 vuart_port_addr[ASPEED_BMC_VUART ] = {0x3f8 ,0x2f8 }; + +struct aspeed_pci_bmc_dev { +struct plat_serial8250_port uart[ASPEED_BMC_VUART +1 ]; +struct mfd_cell cell; +};
[Severity: Low]
This isn't a bug, but does this structure name follow the MFD naming conventions? The guidelines recommend avoiding generic suffixes like "dev" and instead preferring just the device name.
[ ... ]
Quoted 3 lines
drivers/mfd/aspeed-pci-core.c new file +3
-0+static int aspeed_pci_bmc_device_setup_vuart (struct pci_dev *pdev, +struct aspeed_pci_bmc_dev *pci_bmc_dev) +{
[ ... ]
Quoted 13 lines
drivers/mfd/aspeed-pci-core.c new file +13
-0+for (i =0 ; i <ASPEED_BMC_VUART ; i++) { + port = &pci_bmc_dev->uart[i]; + +/* ASPEED BMC device shift addresses by 2 to the left */ + vuart_ioport = vuart_port_addr[i] <<2 ; + + port->mapbase = bar + vuart_ioport; + port->uartclk =115200 *16 ; + port->irq =pci_irq_vector (pdev, vuart_msi_index[i]); + port->iotype =UPIO_MEM32 ; + port->type =PORT_16550A ; + port->flags |= (UPF_IOREMAP |UPF_FIXED_PORT |UPF_FIXED_TYPE ); + port->regshift =2 ;
drivers/mfd/aspeed-pci-core.c line 57
Quoted 10 lines
drivers/mfd/aspeed-pci-core.c new file +10
-0+ } + + pci_bmc_dev->cell = (struct mfd_cell ) { + .name ="serial8250" , + .platform_data = pci_bmc_dev->uart, + .pdata_size =sizeof (pci_bmc_dev->uart), + }; + +return 0 ; +}
[Severity: Medium]
Is it safe to generate the mfd_cell dynamically here? The MFD subsystem guidelines explicitly forbid creating local dynamic copies of mfd_cell arrays, requiring them to be static const instead to avoid memory safety hazards.
[ ... ]
Quoted 3 lines
drivers/mfd/aspeed-pci-core.c new file +3
-0+static int aspeed_pci_host_bmc_device_probe (struct pci_dev *pdev, +const struct pci_device_id *ent) +{
[ ... ]
drivers/mfd/aspeed-pci-core.c line 98
Quoted 6 lines
drivers/mfd/aspeed-pci-core.c new file +6
-0+aspeed_pci_bmc_device_setup_vuart (pdev, pci_bmc_dev); + +return devm_mfd_add_devices (dev,PLATFORM_DEVID_AUTO , + &pci_bmc_dev->cell,1 , &pdev->resource[1 ], +0 ,NULL ); +}
[Severity: Medium]
Should the MFD API be used here for a device with only a single function? The code registers only one child (serial8250), which violates the MFD subsystem rules that prohibit using the MFD API for single-function devices.
Signature · 1 line
Sashiko AI review · https://sashiko.dev/#/patchset/[email protected]?part=4
Re: [PATCH v5 4/6] soc: mfd: add ASPEED AST2600 PCIe BMC device driver
In reply to Grégoire LayetQuoted 6 lines
Add support for UART over PCIe between ASPEED
AST2600 BMC and host.
This is the host-side driver.Based on ASPEED 6.18 Kernel SDK and trimmed down
and changed to MFD driver.
This doesn't seem to be aligned (72/75 chars per line).
Quoted 129 lines
The AST2600 has two 8250-compatible register set usable over PCIe. These act as two UARTs. As there is only a FIFO internally between both ends, they are called Virtual UARTs. This patch adds both VUARTs as
plat_serial8250_port. This is the core driver in charge of setting up MSI interrupts. It doesn't bind the whole PCIe resource to allow each sub-driver to bind the needed addresses.This is not added as a PCI 8250 UART device, but as a MFD driver, as this host driver can be expanded upon for IPMI over KCS. It can also be used in the future for custom BMC<->host communication with shared memory and doorbell.
This host module should be the entry point for setting up all features related to an AST2600 present on the PCI bus.
Notes on the implementation:
The host can't detect the VUART addresses, so they are forced to0x3f8and0x2f8, as in the initial ASPEED driver.The MSI vector index of VUART2 has been changed from 15 to 17. The index 15 used in the initial driver was not working.
Tested:
Data path in both direction is tested on both VUARTs.Signed-off-by Jacky Chou <[email protected]>Signed-off-by aspeedyh <[email protected]>Signed-off-by Grégoire Layet <[email protected]>MAINTAINERS +6
-0@@ -4011,6 +4011,12 @@ S: Maintained F: Documentation/devicetree/bindings/crypto/aspeed,* F: drivers/crypto/aspeed/ +ASPEED PCI BMC DEVICE DRIVER +M: Grégoire Layet <[email protected]> +M: Tan Siewert <[email protected]> +S: Maintained +F: drivers/mfd/aspeed-pci-core.c + ASPEED PECI CONTROLLER M: Iwona Winiarska <[email protected]> L: [email protected] (moderated for non-subscribers)drivers/mfd/Kconfig +12
-0@@ -2573,5 +2573,17 @@ config MFD_MAX7360 additional drivers must be enabled in order to use the functionality of the device. +config MFD_ASPEED_PCI_BMC_DEVICE + tristate "ASPEED BMC PCIe device" + depends on PCI + select MFD_CORE + help + Host-side driver for the ASPEED AST2600 BMC PCIe device found on + BMC expansion cards. Exposes two 8250-compatible VUART + ports. + + If unsure, say N. Choose M here if this machine has an + AST2600-based BMC expansion card on its PCIe bus. + endmenu endifdrivers/mfd/Makefile +2
-0@@ -303,3 +303,5 @@ obj-$(CONFIG_MFD_RSMU_SPI) += rsmu_spi.o rsmu_core.o obj-$(CONFIG_MFD_UPBOARD_FPGA) += upboard-fpga.o obj-$(CONFIG_MFD_LOONGSON_SE) += loongson-se.o + +obj-$(CONFIG_MFD_ASPEED_PCI_BMC_DEVICE) += aspeed-pci-core.odrivers/mfd/aspeed-pci-core.c new file +44
-0@@ -0,0 +1,120 @@ +// SPDX-License-Identifier: GPL-2.0-or-later +// Copyright (C) ASPEED Technology Inc. + +#include <linux/init.h> +#include <linux/module.h> +#include <linux/kernel.h> +#include <linux/errno.h> +#include <linux/pci.h> +#include <linux/serial_8250.h> +#include <linux/mfd/core.h> + +#define ASPEED_BMC_MULTI_MSI 32 +#define ASPEED_BMC_PCI_DEVICE_ID 0x2402 +#define ASPEED_BMC_REVISION_AST2700 0x27 +#define ASPEED_BMC_VUART 2 + +#define DRIVER_NAME "ast2600-pci-core" + +static const unsigned int vuart_msi_index[ASPEED_BMC_VUART ] = {16 ,17 }; +static const u16 vuart_port_addr[ASPEED_BMC_VUART ] = {0x3f8 ,0x2f8 }; + +struct aspeed_pci_bmc_dev { +struct plat_serial8250_port uart[ASPEED_BMC_VUART +1 ]; +struct mfd_cell cell; +}; + +static int aspeed_pci_bmc_device_setup_vuart (struct pci_dev *pdev, +struct aspeed_pci_bmc_dev *pci_bmc_dev) +{ +resource_size_t bar =pci_resource_start (pdev,1 ); +struct plat_serial8250_port *port; +u16 vuart_ioport; +unsigned int i; + +for (i =0 ; i <ASPEED_BMC_VUART ; i++) { + port = &pci_bmc_dev->uart[i]; + +/* ASPEED BMC device shift addresses by 2 to the left */ + vuart_ioport = vuart_port_addr[i] <<2 ; + + port->mapbase = bar + vuart_ioport; + port->uartclk =115200 *16 ; + port->irq =pci_irq_vector (pdev, vuart_msi_index[i]); + port->iotype =UPIO_MEM32 ;
drivers/mfd/aspeed-pci-core.c line 54
Quoted 10 lines
drivers/mfd/aspeed-pci-core.c new file +10
-0+ port->type =PORT_16550A ; + port->flags |= (UPF_IOREMAP |UPF_FIXED_PORT |UPF_FIXED_TYPE ); + port->regshift =2 ; + } + + pci_bmc_dev->cell = (struct mfd_cell ) { + .name ="serial8250" , + .platform_data = pci_bmc_dev->uart, + .pdata_size =sizeof (pci_bmc_dev->uart), + };
In the commit message you're describing that the MFD driver will be used for setting up MSI interrupts:
Quoted 2 lines
It doesn't bind the whole PCIe resource to allow each sub-driver to bind the needed addresses.
But you're adding the UART devices here which now means that the core driver is doing more than MSI interrupt init.
Suggestion from my side would be to have an array of mfd_cell where you define which devices are part of the MFD, and your VUART lives in another driver. See ls2k-bmc-core for example.
Tan
Signature · 1 line
Tan Siewert <[email protected]>
Re: [PATCH v5 4/6] soc: mfd: add ASPEED AST2600 PCIe BMC device driver
Quoted 32 lines
Quoted 19 lines
drivers/mfd/aspeed-pci-core.c new file +19
-0+ +static int aspeed_pci_bmc_device_setup_vuart (struct pci_dev *pdev, +struct aspeed_pci_bmc_dev *pci_bmc_dev) +{ +resource_size_t bar =pci_resource_start (pdev,1 ); +struct plat_serial8250_port *port; +u16 vuart_ioport; +unsigned int i; + +for (i =0 ; i <ASPEED_BMC_VUART ; i++) { + port = &pci_bmc_dev->uart[i]; + +/* ASPEED BMC device shift addresses by 2 to the left */ + vuart_ioport = vuart_port_addr[i] <<2 ; + + port->mapbase = bar + vuart_ioport; + port->uartclk =115200 *16 ; + port->irq =pci_irq_vector (pdev, vuart_msi_index[i]); + port->iotype =UPIO_MEM32 ;drivers/mfd/aspeed-pci-core.c line 54
Quoted 10 lines
drivers/mfd/aspeed-pci-core.c new file +10
-0+ port->type =PORT_16550A ; + port->flags |= (UPF_IOREMAP |UPF_FIXED_PORT |UPF_FIXED_TYPE ); + port->regshift =2 ; + } + + pci_bmc_dev->cell = (struct mfd_cell ) { + .name ="serial8250" , + .platform_data = pci_bmc_dev->uart, + .pdata_size =sizeof (pci_bmc_dev->uart), + };In the commit message you're describing that the MFD driver will be used for setting up MSI interrupts:
Quoted 5 lines
Quoted 2 lines
It doesn't bind the whole PCIe resource to allow each sub-driver to bind the needed addresses.
But you're adding the UART devices here which now means that the core driver is doing more than MSI interrupt init.
I might have misunderstood but this is creating the UART device by using the 'serial8250' driver.
Quoted 1 line
the core driver is doing more than MSI interrupt init.
Yes, as the core driver should add the devices with the right drivers. I will add this in the commit message.
Quoted 2 lines
Suggestion from my side would be to have an array of
mfd_cellwhere you define which devices are part of the MFD,
There is already such an array, it is a one element array as only the VUART is done.
'struct mfd_cell cell; ' will become an real array when KCS will be added afterwards.
This is not an 2 cell array for the 2 VUART as the 'serial8250' manages the two VUART on its own.
From what I have researched, this was the way to add UART devices from an MFD driver.
Quoted 2 lines
and your VUART lives in another driver.
Seels2k-bmc-corefor example.
The UART already lives in another driver: the 'serial8250' driver.
Regards,
Grégoire
Re: [PATCH v5 4/6] soc: mfd: add ASPEED AST2600 PCIe BMC device driver
Quoted 5 lines · Grégoire Layet
Quoted 2 lines
But you're adding the UART devices here which now means that the core driver is doing more than MSI interrupt init.
I might have misunderstood but this is creating the UART device by using the 'serial8250' driver.
You're right :face_palm: I haven't had enough coffee when I reviewed it.
Sorry for the confusion!
Tan
PATCH v5 5/6 ARM: dts: aspeed: g6: Change vuart compatible string for ast2600
In reply to Grégoire LayetUse the ast2600 compatible string.
Make it more precise and enable specific ast2600 properties. Still use the ast2500 compatible string as a fallback.
--- arch/arm/boot/dts/aspeed/aspeed-g6.dtsi | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-)
arch/arm/boot/dts/aspeed/aspeed-g6.dtsi +4 -4
@@ -707,7 +707,7 @@ emmc: sdhci@1e750100 { }; vuart1: serial@1e787000 { - compatible = "aspeed,ast2500-vuart"; + compatible = "aspeed,ast2600-vuart", "aspeed,ast2500-vuart"; reg = <0x1e787000 0x40>; reg-shift = <2>; interrupts = <GIC_SPI 147 IRQ_TYPE_LEVEL_HIGH>;
@@ -717,7 +717,7 @@ vuart1: serial@1e787000 { }; vuart3: serial@1e787800 { - compatible = "aspeed,ast2500-vuart"; + compatible = "aspeed,ast2600-vuart", "aspeed,ast2500-vuart"; reg = <0x1e787800 0x40>; reg-shift = <2>; interrupts = <GIC_SPI 180 IRQ_TYPE_LEVEL_HIGH>;
@@ -727,7 +727,7 @@ vuart3: serial@1e787800 { }; vuart2: serial@1e788000 { - compatible = "aspeed,ast2500-vuart"; + compatible = "aspeed,ast2600-vuart", "aspeed,ast2500-vuart"; reg = <0x1e788000 0x40>; reg-shift = <2>; interrupts = <GIC_SPI 148 IRQ_TYPE_LEVEL_HIGH>;
@@ -737,7 +737,7 @@ vuart2: serial@1e788000 { }; vuart4: serial@1e788800 { - compatible = "aspeed,ast2500-vuart"; + compatible = "aspeed,ast2600-vuart", "aspeed,ast2500-vuart"; reg = <0x1e788800 0x40>; reg-shift = <2>; interrupts = <GIC_SPI 181 IRQ_TYPE_LEVEL_HIGH>;
Signature · 1 line
2.54.0
[email protected]
AI reviewRe: [PATCH v5 5/6] ARM: dts: aspeed: g6: Change vuart compatible string for ast2600
Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
Pre-existing issues:
- [High] Pre-existing probe error path fails to unregister 8250 port and timer, leading to a Use-After-Free. --
--- Patch [5]: [PATCH v5 5/6] ARM: dts: aspeed: g6: Change vuart compatible string for ast2600 --- commit 37accadaaa3a999dc66b41b5254b8c67bb2fec88
Author: Grégoire Layet <[email protected]>
ARM: dts: aspeed: g6: Change vuart compatible string for ast2600
Use the ast2600 compatible string to enable specific ast2600 properties, while keeping the ast2500 compatible string as a fallback.
arch/arm/boot/dts/aspeed/aspeed-g6.dtsi emmc: sdhci@1e750100 { · line 710
Quoted 10 lines
arch/arm/boot/dts/aspeed/aspeed-g6.dtsi +1
-1@@ -707,7 +707,7 @@ emmc: sdhci@1e750100 { }; vuart1: serial@1e787000 { - compatible = "aspeed,ast2500-vuart"; + compatible = "aspeed,ast2600-vuart", "aspeed,ast2500-vuart";
[Severity: High]
This is a pre-existing issue, but does enabling the ast2600-specific path expose a use-after-free during probe failure?
If the newly activated aspeed_ast2600_vuart_over_pci_set_enabled() fails in drivers/tty/serial/8250/8250_aspeed_vuart.c:aspeed_vuart_probe(), the code jumps to err_sysfs_remove:
drivers/tty/serial/8250/8250_aspeed_vuart.c:aspeed_vuart_probe() {
...
err_sysfs_remove:
sysfs_remove_group(&vuart->dev->kobj, &aspeed_vuart_attr_group);
return rc;
}This error path returns while leaving the 8250 port registered and the timer active. The devm-allocated vuart memory is subsequently freed, leaving a dangling pointer.
Should this error path also call serial8250_unregister_port() and timer_delete_sync() to prevent a use-after-free if userspace interacts with the lingering device?
Signature · 1 line
Sashiko AI review · https://sashiko.dev/#/patchset/[email protected]?part=5
Re: [PATCH v5 5/6] ARM: dts: aspeed: g6: Change vuart compatible string for ast2600
In reply to Grégoire LayetQuoted 3 lines · Grégoire Layet
Use the ast2600 compatible string.
Make it more precise and enable specific ast2600 properties. Still use the ast2500 compatible string as a fallback.
Signature · 1 line
Tan Siewert <[email protected]>
PATCH v5 6/6 ARM: dts: aspeed: g6: add aspeed,vuart-over-pci prop to vuart3 and 4
In reply to Grégoire LayetThe VUART 3 and 4 are VUART over PCI.
Set this flag to indicate this information.
Also set the syscon phandle.
--- arch/arm/boot/dts/aspeed/aspeed-g6.dtsi | 4 ++++ 1 file changed, 4 insertions(+)
arch/arm/boot/dts/aspeed/aspeed-g6.dtsi +4 -0
@@ -722,7 +722,9 @@ vuart3: serial@1e787800 { reg-shift = <2>; interrupts = <GIC_SPI 180 IRQ_TYPE_LEVEL_HIGH>; clocks = <&syscon ASPEED_CLK_APB2>; + aspeed,scu-syscon = <&syscon>; no-loopback-test; + aspeed,vuart-over-pci; status = "disabled"; };
@@ -742,7 +744,9 @@ vuart4: serial@1e788800 { reg-shift = <2>; interrupts = <GIC_SPI 181 IRQ_TYPE_LEVEL_HIGH>; clocks = <&syscon ASPEED_CLK_APB2>; + aspeed,scu-syscon = <&syscon>; no-loopback-test; + aspeed,vuart-over-pci; status = "disabled"; };
Signature · 1 line
2.54.0
[email protected]
AI reviewRe: [PATCH v5 6/6] ARM: dts: aspeed: g6: add aspeed,vuart-over-pci prop to vuart3 and 4
Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
Pre-existing issues:
- [High] Missing error cleanup in aspeed_vuart_probe leads to a dangling 8250 port and use-after-free on probe failure. --
--- Patch [6]: [PATCH v5 6/6] ARM: dts: aspeed: g6: add aspeed,vuart-over-pci prop to vuart3 and 4 --- commit 373b41ed9602ed016ca9e86ec139c751e10daac0
Author: Grégoire Layet <[email protected]>
ARM: dts: aspeed: g6: add aspeed,vuart-over-pci prop to vuart3 and 4
The VUART 3 and 4 are VUART over PCI.
Set this flag to indicate this information.
Also set the syscon phandle.
arch/arm/boot/dts/aspeed/aspeed-g6.dtsi vuart3: serial@1e787800 { · line 727
Quoted 11 lines
arch/arm/boot/dts/aspeed/aspeed-g6.dtsi +2
-0@@ -722,7 +722,9 @@ vuart3: serial@1e787800 { reg-shift = <2>; interrupts = <GIC_SPI 180 IRQ_TYPE_LEVEL_HIGH>; clocks = <&syscon ASPEED_CLK_APB2>; + aspeed,scu-syscon = <&syscon>; no-loopback-test; + aspeed,vuart-over-pci;
[Severity: High]
This is a pre-existing issue, but does enabling this property expose a missing error cleanup path in the driver?
If a probe failure occurs in drivers/tty/serial/8250/8250_aspeed_vuart.c after the port is registered (for example, if setting up the vuart-over-pci functionality fails), the error path skips unregistering the 8250 port:
aspeed_vuart_probe() {
...
err_sysfs_remove:
sysfs_remove_group(&vuart->dev->kobj, &aspeed_vuart_attr_group);
return rc;
}Does this leave the registered port alive while its private data is freed by the devres framework?
If the port later handles an interrupt via aspeed_vuart_handle_irq() or is accessed, could it dereference the freed memory and cause a use-after-free crash?
Would it be safer to ensure serial8250_unregister_port() is called in this error path?
Quoted 2 lines
arch/arm/boot/dts/aspeed/aspeed-g6.dtsi +0
-0status = "disabled"; };
[ ... ]
Signature · 1 line
Sashiko AI review · https://sashiko.dev/#/patchset/[email protected]?part=6
Re: [PATCH v5 6/6] ARM: dts: aspeed: g6: add aspeed,vuart-over-pci prop to vuart3 and 4
In reply to Grégoire LayetQuoted 11 lines
The VUART 3 and 4 are VUART over PCI.
Set this flag to indicate this information.
Also set the syscon phandle.Signed-off-by Grégoire Layet <[email protected]>arch/arm/boot/dts/aspeed/aspeed-g6.dtsi +0
-0
arch/arm/boot/dts/aspeed/aspeed-g6.dtsi vuart3: serial@1e787800 { · line 729
Quoted 8 lines
arch/arm/boot/dts/aspeed/aspeed-g6.dtsi +2
-0@@ -722,7 +722,9 @@ vuart3: serial@1e787800 { reg-shift = <2>; interrupts = <GIC_SPI 180 IRQ_TYPE_LEVEL_HIGH>; clocks = <&syscon ASPEED_CLK_APB2>; + aspeed,scu-syscon = <&syscon>; no-loopback-test; + aspeed,vuart-over-pci; status = "disabled"; };
dt-style check fails with:
arch/arm/boot/dts/aspeed/aspeed-g6.dtsi:723: [property-order] property 'interrupts' out of canonical order (should sort before 'reg-shift') arch/arm/boot/dts/aspeed/aspeed-g6.dtsi:724: [property-order] property 'clocks' out of canonical order (should sort before 'interrupts') arch/arm/boot/dts/aspeed/aspeed-g6.dtsi:726: [property-order] property 'no-loopback-test' out of canonical order (should sort before 'aspeed,scu-syscon') arch/arm/boot/dts/aspeed/aspeed-g6.dtsi:728: [required-blank-lines] "status" must be preceded by a blank line
arch/arm/boot/dts/aspeed/aspeed-g6.dtsi vuart4: serial@1e788800 { · line 752
Quoted 11 lines
arch/arm/boot/dts/aspeed/aspeed-g6.dtsi +2
-0@@ -742,7 +744,9 @@ vuart4: serial@1e788800 { reg-shift = <2>; interrupts = <GIC_SPI 181 IRQ_TYPE_LEVEL_HIGH>; clocks = <&syscon ASPEED_CLK_APB2>; + aspeed,scu-syscon = <&syscon>; no-loopback-test; + aspeed,vuart-over-pci; status = "disabled"; };
Same here:
arch/arm/boot/dts/aspeed/aspeed-g6.dtsi:742: [line-length] line exceeds 80 columns (92) arch/arm/boot/dts/aspeed/aspeed-g6.dtsi:745: [property-order] property 'interrupts' out of canonical order (should sort before 'reg-shift') arch/arm/boot/dts/aspeed/aspeed-g6.dtsi:746: [property-order] property 'clocks' out of canonical order (should sort before 'interrupts') arch/arm/boot/dts/aspeed/aspeed-g6.dtsi:748: [property-order] property 'no-loopback-test' out of canonical order (should sort before 'aspeed,scu-syscon') arch/arm/boot/dts/aspeed/aspeed-g6.dtsi:750: [required-blank-lines] "status" must be preceded by a blank line
Tan
Signature · 1 line
Tan Siewert <[email protected]>