-----Original Message-----
From: De Marchi, Lucas <lucas.demarchi@xxxxxxxxx>
Sent: Tuesday, April 26, 2022 10:42 PM
To: Srivatsa, Anusha <anusha.srivatsa@xxxxxxxxx>
Cc: intel-gfx@xxxxxxxxxxxxxxxxxxxxx; stable@xxxxxxxxxxxxxxx
Subject: Re: [PATCH] drm/i915/dmc: Add MMIO range restrictions
On Tue, Apr 26, 2022 at 05:35:09PM -0700, Anusha Srivatsa wrote:
Bspec has added some steps that check forDMC MMIO range before
programming them
v2: Fix for CI
v3: move register defines to .h (Anusha)
- Check MMIO restrictions per pipe
- Add MMIO restricton for v1 dmc header as well (Lucas)
BSpec: 49193
Cc: <stable@xxxxxxxxxxxxxxx>
Cc: Lucas De Marchi <lucas.demarchi@xxxxxxxxx>
Signed-off-by: Anusha Srivatsa <anusha.srivatsa@xxxxxxxxx>
---
drivers/gpu/drm/i915/display/intel_dmc.c | 48 ++++++++++++++++---
drivers/gpu/drm/i915/display/intel_dmc_regs.h | 31 ++++++++++++
2 files changed, 72 insertions(+), 7 deletions(-)
diff --git a/drivers/gpu/drm/i915/display/intel_dmc.c
b/drivers/gpu/drm/i915/display/intel_dmc.c
index 257cf662f9f4..ac7896835bfa 100644
--- a/drivers/gpu/drm/i915/display/intel_dmc.c
+++ b/drivers/gpu/drm/i915/display/intel_dmc.c
@@ -97,13 +97,6 @@ MODULE_FIRMWARE(SKL_DMC_PATH);
#define BXT_DMC_MAX_FW_SIZE 0x3000
MODULE_FIRMWARE(BXT_DMC_PATH);
-#define DMC_DEFAULT_FW_OFFSET 0xFFFFFFFF
-#define PACKAGE_MAX_FW_INFO_ENTRIES 20
-#define PACKAGE_V2_MAX_FW_INFO_ENTRIES 32
-#define DMC_V1_MAX_MMIO_COUNT 8
-#define DMC_V3_MAX_MMIO_COUNT 20
-#define DMC_V1_MMIO_START_RANGE 0x80000
-
struct intel_css_header {
/* 0x09 for DMC */
u32 module_type;
@@ -374,6 +367,43 @@ static void dmc_set_fw_offset(struct intel_dmc
*dmc,
}
}
+static bool dmc_mmio_addr_sanity_check(struct intel_dmc *dmc, const
u32 *mmioaddr,
+ u32 mmio_count, int header_ver, u8
dmc_id) {
+ struct drm_i915_private *i915 = container_of(dmc, typeof(*i915),
dmc);
+ int i;
+
+ if (header_ver == 1) {
+ for (i = 0; i < mmio_count; i++) {
+ if (mmioaddr[i] < DMC_MMIO_START_RANGE ||
mmioaddr[i] > DMC_MMIO_END_RANGE)
+ return false;
+ }
return missing here
+ }
+
+ /* Main DMC MMIO check */
+ if (dmc_id == DMC_FW_MAIN) {
+ for (i = 0; i < mmio_count; i++) {
+ if (mmioaddr[i] < TGL_DMC_MMIO_START(dmc_id)
|| mmioaddr[i] > TGL_DMC_MMIO_END(dmc_id))
+ return false;
+ }
+ }
+
+ /* Pipe DMC MMIO check */
+ if (IS_DG2(i915) || IS_ALDERLAKE_P(i915)) {
+ for (i = 0; i < mmio_count; i++) {
+ if (mmioaddr[i] < ADLP_PIPE_MMIO_START &&
mmioaddr[i] > ADLP_PIPE_MMIO_END)
+ return false;
+ }
for DG2, main should use TGL_DMC_MMIO_START? and then fail here
because of another missing return above?
+ } else if (IS_TIGERLAKE(i915) || IS_DG1(i915) ||
IS_ALDERLAKE_S(i915)) {
+ for (i = 0; i < mmio_count; i++) {
+ if (mmioaddr[i] < TGL_DMC_MMIO_START(dmc_id)
|| mmioaddr[i] > TGL_DMC_MMIO_END(dmc_id))
+ return false;
this is handling DMC_FW_MAIN twice.
Maybe something like this:
u32 start, end;
if (header_ver == 1) {
start = DMC_MMIO_START_RANGE;
end = DMC_MMIO_END_RANGE;
} else if (dmc_id == DMC_FW_MAIN || IS_TIGERLAKE(i915) ||
IS_DG1(i915) || IS_ALDERLAKE_S(i915)) {
start = TGL_DMC_MMIO_START(dmc_id);
end = TGL_DMC_MMIO_END(dmc_id);
} else if (IS_DG2(i915) || IS_ALDERLAKE_P(i915)) {
start = ADLP_PIPE_MMIO_START;
end = ADLP_PIPE_MMIO_END;
} else {
drm_warn(&i915->drm, "Unknown mmio range for sanity
check");
return false;
}
for (i = 0; i < mmio_count; i++)
if (mmioaddr[i] < start || mmioaddr[i] > end)
return false;
return true;
... untested, and may need tweaks depending on the answer to the question
above on what range to use for ADL-P/DG2 on main DMC.
+ }
+ }
+
+ return true;
+}
+
static u32 parse_dmc_fw_header(struct intel_dmc *dmc,
const struct intel_dmc_header_base
*dmc_header,
size_t rem_size, u8 dmc_id)
@@ -443,6 +473,10 @@ static u32 parse_dmc_fw_header(struct intel_dmc
*dmc,
return 0;
}
+ if (!dmc_mmio_addr_sanity_check(dmc, mmioaddr, mmio_count,
dmc_header->header_ver, dmc_id))
+ drm_err(&i915->drm, "DMC firmware has Wrong MMIO
Addresses\n");
+ return 0;
you don't like DMC and decided to fail it for all platforms?
