From patchwork Thu May 23 08:24:20 2019 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Lucas De Marchi X-Patchwork-Id: 10957087 Return-Path: Received: from mail.wl.linuxfoundation.org (pdx-wl-mail.web.codeaurora.org [172.30.200.125]) by pdx-korg-patchwork-2.web.codeaurora.org (Postfix) with ESMTP id 41B5D76 for ; Thu, 23 May 2019 08:24:49 +0000 (UTC) Received: from mail.wl.linuxfoundation.org (localhost [127.0.0.1]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id 1B44E2836F for ; Thu, 23 May 2019 08:24:49 +0000 (UTC) Received: by mail.wl.linuxfoundation.org (Postfix, from userid 486) id 0FE7F283AF; Thu, 23 May 2019 08:24:49 +0000 (UTC) X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on pdx-wl-mail.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-5.2 required=2.0 tests=BAYES_00,MAILING_LIST_MULTI, RCVD_IN_DNSWL_MED autolearn=ham version=3.3.1 Received: from gabe.freedesktop.org (gabe.freedesktop.org [131.252.210.177]) (using TLSv1.2 with cipher DHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.wl.linuxfoundation.org (Postfix) with ESMTPS id C1302283A2 for ; Thu, 23 May 2019 08:24:48 +0000 (UTC) Received: from gabe.freedesktop.org (localhost [127.0.0.1]) by gabe.freedesktop.org (Postfix) with ESMTP id 4EF0D89CF8; Thu, 23 May 2019 08:24:48 +0000 (UTC) X-Original-To: intel-gfx@lists.freedesktop.org Delivered-To: intel-gfx@lists.freedesktop.org Received: from mga14.intel.com (mga14.intel.com [192.55.52.115]) by gabe.freedesktop.org (Postfix) with ESMTPS id 21CAC89CE1 for ; Thu, 23 May 2019 08:24:31 +0000 (UTC) X-Amp-Result: SKIPPED(no attachment in message) X-Amp-File-Uploaded: False Received: from orsmga001.jf.intel.com ([10.7.209.18]) by fmsmga103.fm.intel.com with ESMTP/TLS/DHE-RSA-AES256-GCM-SHA384; 23 May 2019 01:24:30 -0700 X-ExtLoop1: 1 Received: from igivoni-mobl.amr.corp.intel.com (HELO ldmartin-desk.amr.corp.intel.com) ([10.255.88.102]) by orsmga001.jf.intel.com with ESMTP; 23 May 2019 01:24:30 -0700 From: Lucas De Marchi To: intel-gfx@lists.freedesktop.org Date: Thu, 23 May 2019 01:24:20 -0700 Message-Id: <20190523082420.10352-10-lucas.demarchi@intel.com> X-Mailer: git-send-email 2.21.0 In-Reply-To: <20190523082420.10352-1-lucas.demarchi@intel.com> References: <20190523082420.10352-1-lucas.demarchi@intel.com> MIME-Version: 1.0 Subject: [Intel-gfx] [PATCH 10/10] drm/i915/dmc: protect against loading wrong firmware X-BeenThere: intel-gfx@lists.freedesktop.org X-Mailman-Version: 2.1.23 Precedence: list List-Id: Intel graphics driver community testing & development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Cc: Lucas De Marchi Errors-To: intel-gfx-bounces@lists.freedesktop.org Sender: "Intel-gfx" X-Virus-Scanned: ClamAV using ClamSMTP In intel_package_header version 2 there's a new field in the fw_info table that must be 0, otherwise it's not the correct DMC firmware. Add a check for version 2 or later. Signed-off-by: Lucas De Marchi Reviewed-by: Rodrigo Vivi --- drivers/gpu/drm/i915/intel_csr.c | 14 +++++++++++--- 1 file changed, 11 insertions(+), 3 deletions(-) diff --git a/drivers/gpu/drm/i915/intel_csr.c b/drivers/gpu/drm/i915/intel_csr.c index b7181ca6c8f5..d4996dcf596c 100644 --- a/drivers/gpu/drm/i915/intel_csr.c +++ b/drivers/gpu/drm/i915/intel_csr.c @@ -120,7 +120,10 @@ struct intel_css_header { } __packed; struct intel_fw_info { - u16 reserved1; + u8 reserved1; + + /* reserved on package_header version 1, must be 0 on version 2 */ + u8 dmc_id; /* Stepping (A, B, C, ..., *). * is a wildcard */ char stepping; @@ -325,12 +328,16 @@ void intel_csr_load_program(struct drm_i915_private *dev_priv) */ static u32 find_dmc_fw_offset(const struct intel_fw_info *fw_info, unsigned int num_entries, - const struct stepping_info *si) + const struct stepping_info *si, + u8 package_ver) { u32 dmc_offset = CSR_DEFAULT_FW_OFFSET; unsigned int i; for (i = 0; i < num_entries; i++) { + if (package_ver > 1 && fw_info[i].dmc_id != 0) + continue; + if (fw_info[i].substepping == '*' && si->stepping == fw_info[i].stepping) { dmc_offset = fw_info[i].offset; @@ -501,7 +508,8 @@ parse_csr_fw_package(struct intel_csr *csr, fw_info = (const struct intel_fw_info *) ((u8 *)package_header + sizeof(*package_header)); - dmc_offset = find_dmc_fw_offset(fw_info, num_entries, si); + dmc_offset = find_dmc_fw_offset(fw_info, num_entries, si, + package_header->header_ver); if (dmc_offset == CSR_DEFAULT_FW_OFFSET) { DRM_ERROR("DMC firmware not supported for %c stepping\n", si->stepping);