Furquan Shaikh has submitted this change. ( https://review.coreboot.org/c/coreboot/+/51232 )
Change subject: soc/intel/tigerlake: Fix NULL being passed for response buffer ......................................................................
soc/intel/tigerlake: Fix NULL being passed for response buffer
`pmc_send_ipc_cmd()` expects the caller to pass in a pointer to a valid request and response buffer. However, early_tcss driver was passing in a NULL pointer for response buffer which would result in invalid access by `pmc_send_ipc_cmd()`.
Currently, the response buffer is not used in `update_tcss_mux()`. So, this change drops the passing of `rbuf` parameter to `send_pmc*` helpers and instead uses a local `rsp` variable in the respective functions. All the PMC functions used in early_tcss driver return some kind of response. These should be checked to return appropriate response code back to the caller. However, this needs to be done as a separate change.
Change-Id: I215af85feed60b6beee17f28e3d65daa9ad4ae69 Signed-off-by: Furquan Shaikh furquan@google.com Reviewed-on: https://review.coreboot.org/c/coreboot/+/51232 Tested-by: build bot (Jenkins) no-reply@coreboot.org Reviewed-by: Tim Wawrzynczak twawrzynczak@chromium.org --- M src/soc/intel/tigerlake/early_tcss.c 1 file changed, 14 insertions(+), 18 deletions(-)
Approvals: build bot (Jenkins): Verified Tim Wawrzynczak: Looks good to me, approved
diff --git a/src/soc/intel/tigerlake/early_tcss.c b/src/soc/intel/tigerlake/early_tcss.c index 3944f61..a2810b5 100644 --- a/src/soc/intel/tigerlake/early_tcss.c +++ b/src/soc/intel/tigerlake/early_tcss.c @@ -56,7 +56,6 @@ static int send_pmc_req(int cmd_type, const struct pmc_ipc_buffer *req, struct pmc_ipc_buffer *res, uint32_t size) { - uint32_t cmd_reg; uint32_t res_reg; int tries = 2; @@ -103,11 +102,11 @@ return -1; }
-static int send_pmc_connect_request(int port, struct tcss_mux mux_data, - struct pmc_ipc_buffer *res) +static int send_pmc_connect_request(int port, struct tcss_mux mux_data) { uint32_t cmd; struct pmc_ipc_buffer req = { 0 }; + struct pmc_ipc_buffer rsp;
cmd = tcss_make_conn_cmd( PMC_IPC_TCSS_CONN_REQ_RES, @@ -131,14 +130,14 @@ GET_TCSS_CD_FIELD(SBU, cmd), GET_TCSS_CD_FIELD(ACC, cmd));
- return send_pmc_req(CONNECT_REQ, &req, res, PMC_IPC_CONN_REQ_SIZE); + return send_pmc_req(CONNECT_REQ, &req, &rsp, PMC_IPC_CONN_REQ_SIZE); }
-static int send_pmc_safe_mode_request(int port, struct tcss_mux mux_data, - struct pmc_ipc_buffer *res) +static int send_pmc_safe_mode_request(int port, struct tcss_mux mux_data) { uint32_t cmd; struct pmc_ipc_buffer req = { 0 }; + struct pmc_ipc_buffer rsp;
cmd = tcss_make_safe_mode_cmd(PMC_IPC_TCSS_SAFE_MODE_REQ_RES, mux_data.usb3_port);
@@ -149,13 +148,13 @@ GET_TCSS_CD_FIELD(USAGE, cmd), GET_TCSS_CD_FIELD(USB3, cmd));
- return send_pmc_req(SAFE_REQ, &req, res, PMC_IPC_SAFE_REQ_SIZE); + return send_pmc_req(SAFE_REQ, &req, &rsp, PMC_IPC_SAFE_REQ_SIZE); }
static int send_pmc_dp_hpd_request(int port, struct tcss_mux mux_data) { - struct pmc_ipc_buffer *res = NULL; struct pmc_ipc_buffer req = { 0 }; + struct pmc_ipc_buffer rsp; uint32_t cmd;
cmd = tcss_make_hpd_mode_cmd( @@ -166,18 +165,16 @@
req.buf[0] = cmd;
- return send_pmc_req(HPD_REQ, &req, res, PMC_IPC_HPD_REQ_SIZE); - + return send_pmc_req(HPD_REQ, &req, &rsp, PMC_IPC_HPD_REQ_SIZE); }
-static int send_pmc_dp_mode_request(int port, struct tcss_mux mux_data, - struct pmc_ipc_buffer *res) +static int send_pmc_dp_mode_request(int port, struct tcss_mux mux_data) { uint32_t cmd; uint8_t dp_mode; int ret; - struct pmc_ipc_buffer req = { 0 }; + struct pmc_ipc_buffer rsp;
cmd = tcss_make_alt_mode_cmd_buf_0( PMC_IPC_TCSS_ALTMODE_REQ_RES, @@ -232,7 +229,7 @@
req.buf[1] = cmd;
- ret = send_pmc_req(DP_REQ, &req, res, PMC_IPC_ALT_REQ_SIZE); + ret = send_pmc_req(DP_REQ, &req, &rsp, PMC_IPC_ALT_REQ_SIZE); if (ret) return ret;
@@ -242,23 +239,22 @@
void update_tcss_mux(int port, struct tcss_mux mux_data) { - struct pmc_ipc_buffer *rbuf = NULL; int ret = 0;
/* check if mux has a DP device */ if (mux_data.dp) { - ret = send_pmc_connect_request(port, mux_data, rbuf); + ret = send_pmc_connect_request(port, mux_data); if (ret) { printk(BIOS_ERR, "Port %d connect request failed\n", port); return; } - ret = send_pmc_safe_mode_request(port, mux_data, rbuf); + ret = send_pmc_safe_mode_request(port, mux_data); if (ret) { printk(BIOS_ERR, "Port %d safe mode request failed\n", port); return; }
- ret = send_pmc_dp_mode_request(port, mux_data, rbuf); + ret = send_pmc_dp_mode_request(port, mux_data); }
if (ret)