Commit 9de57a93 authored by Kishon Vijay Abraham I's avatar Kishon Vijay Abraham I Committed by Heyuan Wang
Browse files

PCI: keystone: Add workaround for Errata #i2037 (AM65x SR 1.0) 

stable inclusion
from stable-v5.10.226
commit ebbdbbc580c1695dec283d0ba6448729dc993246
category: bugfix
bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAVU7T
CVE: CVE-2024-47667

Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=ebbdbbc580c1

--------------------------------

[ Upstream commit 86f271f22bbb6391410a07e08d6ca3757fda01fa ]

Errata #i2037 in AM65x/DRA80xM Processors Silicon Revision 1.0
(SPRZ452D_July 2018_Revised December 2019 [1]) mentions when an
inbound PCIe TLP spans more than two internal AXI 128-byte bursts,
the bus may corrupt the packet payload and the corrupt data may
cause associated applications or the processor to hang.

The workaround for Errata #i2037 is to limit the maximum read
request size and maximum payload size to 128 bytes. Add workaround
for Errata #i2037 here.

The errata and workaround is applicable only to AM65x SR 1.0 and
later versions of the silicon will have this fixed.

[1] -> https://www.ti.com/lit/er/sprz452i/sprz452i.pdf

Link: https://lore.kernel.org/linux-pci/16e1fcae-1ea7-46be-b157-096e05661b15@siemens.com


Signed-off-by: default avatarKishon Vijay Abraham I <kishon@ti.com>
Signed-off-by: default avatarAchal Verma <a-verma1@ti.com>
Signed-off-by: default avatarVignesh Raghavendra <vigneshr@ti.com>
Signed-off-by: default avatarJan Kiszka <jan.kiszka@siemens.com>
Signed-off-by: default avatarKrzysztof Wilczyński <kwilczynski@kernel.org>
Reviewed-by: default avatarSiddharth Vadapalli <s-vadapalli@ti.com>
Signed-off-by: default avatarSasha Levin <sashal@kernel.org>
Signed-off-by: default avatarHeyuan Wang <wangheyuan2@h-partners.com>
parent 7fd59ddb

drivers/pci/controller/dwc/pci-keystone.c

+43 −1
Original line number Diff line number Diff line
@@ -35,6 +35,11 @@ 
#define PCIE_DEVICEID_SHIFT	16



/* Application registers */

#define PID				0x000

#define RTL				GENMASK(15, 11)

#define RTL_SHIFT			11

#define AM6_PCI_PG1_RTL_VER		0x15



#define CMD_STATUS			0x004

#define LTSSM_EN_VAL		        BIT(0)

#define OB_XLAT_EN_VAL		        BIT(1)
@@ -105,6 +110,8 @@ 


#define to_keystone_pcie(x)		dev_get_drvdata((x)->dev)



#define PCI_DEVICE_ID_TI_AM654X		0xb00c



struct ks_pcie_of_data {

	enum dw_pcie_device_mode mode;

	const struct dw_pcie_host_ops *host_ops;
@@ -544,7 +551,11 @@ static int ks_pcie_start_link(struct dw_pcie *pci) 
static void ks_pcie_quirk(struct pci_dev *dev)

{

	struct pci_bus *bus = dev->bus;

	struct keystone_pcie *ks_pcie;

	struct device *bridge_dev;

	struct pci_dev *bridge;

	u32 val;



	static const struct pci_device_id rc_pci_devids[] = {

		{ PCI_DEVICE(PCI_VENDOR_ID_TI, PCIE_RC_K2HK),

		 .class = PCI_CLASS_BRIDGE_PCI << 8, .class_mask = ~0, },
@@ -556,6 +567,11 @@ static void ks_pcie_quirk(struct pci_dev *dev) 
		 .class = PCI_CLASS_BRIDGE_PCI << 8, .class_mask = ~0, },

		{ 0, },

	};

	static const struct pci_device_id am6_pci_devids[] = {

		{ PCI_DEVICE(PCI_VENDOR_ID_TI, PCI_DEVICE_ID_TI_AM654X),

		 .class = PCI_CLASS_BRIDGE_PCI << 8, .class_mask = ~0, },

		{ 0, },

	};



	if (pci_is_root_bus(bus))

		bridge = dev;
@@ -577,10 +593,36 @@ static void ks_pcie_quirk(struct pci_dev *dev) 
	 */

	if (pci_match_id(rc_pci_devids, bridge)) {

		if (pcie_get_readrq(dev) > 256) {

			dev_info(&dev->dev, "limiting MRRS to 256\n");

			dev_info(&dev->dev, "limiting MRRS to 256 bytes\n");

			pcie_set_readrq(dev, 256);

		}

	}



	/*

	 * Memory transactions fail with PCI controller in AM654 PG1.0

	 * when MRRS is set to more than 128 bytes. Force the MRRS to

	 * 128 bytes in all downstream devices.

	 */

	if (pci_match_id(am6_pci_devids, bridge)) {

		bridge_dev = pci_get_host_bridge_device(dev);

		if (!bridge_dev && !bridge_dev->parent)

			return;



		ks_pcie = dev_get_drvdata(bridge_dev->parent);

		if (!ks_pcie)

			return;



		val = ks_pcie_app_readl(ks_pcie, PID);

		val &= RTL;

		val >>= RTL_SHIFT;

		if (val != AM6_PCI_PG1_RTL_VER)

			return;



		if (pcie_get_readrq(dev) > 128) {

			dev_info(&dev->dev, "limiting MRRS to 128 bytes\n");

			pcie_set_readrq(dev, 128);

		}

	}

}

DECLARE_PCI_FIXUP_ENABLE(PCI_ANY_ID, PCI_ANY_ID, ks_pcie_quirk);