soc/intel/tigerlake: Fix NULL being passed for response buffer
`pmc_send_ipc_cmd()` expects the caller to pass in a pointer to a valid
request and response buffer. However, early_tcss driver was passing in
a NULL pointer for response buffer which would result in invalid
access by `pmc_send_ipc_cmd()`.
Currently, the response buffer is not used in `update_tcss_mux()`. So,
this change drops the passing of `rbuf` parameter to `send_pmc*`
helpers and instead uses a local `rsp` variable in the respective
functions. All the PMC functions used in early_tcss driver return some
kind of response. These should be checked to return appropriate
response code back to the caller. However, this needs to be done as a
separate change.
Change-Id: I215af85feed60b6beee17f28e3d65daa9ad4ae69
Signed-off-by: Furquan Shaikh <furquan@google.com>
Reviewed-on: https://review.coreboot.org/c/coreboot/+/51232
Tested-by: build bot (Jenkins) <no-reply@coreboot.org>
Reviewed-by: Tim Wawrzynczak <twawrzynczak@chromium.org>
diff --git a/src/soc/intel/tigerlake/early_tcss.c b/src/soc/intel/tigerlake/early_tcss.c
index 3944f61..a2810b5 100644
--- a/src/soc/intel/tigerlake/early_tcss.c
+++ b/src/soc/intel/tigerlake/early_tcss.c
@@ -56,7 +56,6 @@
static int send_pmc_req(int cmd_type, const struct pmc_ipc_buffer *req,
struct pmc_ipc_buffer *res, uint32_t size)
{
-
uint32_t cmd_reg;
uint32_t res_reg;
int tries = 2;
@@ -103,11 +102,11 @@
return -1;
}
-static int send_pmc_connect_request(int port, struct tcss_mux mux_data,
- struct pmc_ipc_buffer *res)
+static int send_pmc_connect_request(int port, struct tcss_mux mux_data)
{
uint32_t cmd;
struct pmc_ipc_buffer req = { 0 };
+ struct pmc_ipc_buffer rsp;
cmd = tcss_make_conn_cmd(
PMC_IPC_TCSS_CONN_REQ_RES,
@@ -131,14 +130,14 @@
GET_TCSS_CD_FIELD(SBU, cmd),
GET_TCSS_CD_FIELD(ACC, cmd));
- return send_pmc_req(CONNECT_REQ, &req, res, PMC_IPC_CONN_REQ_SIZE);
+ return send_pmc_req(CONNECT_REQ, &req, &rsp, PMC_IPC_CONN_REQ_SIZE);
}
-static int send_pmc_safe_mode_request(int port, struct tcss_mux mux_data,
- struct pmc_ipc_buffer *res)
+static int send_pmc_safe_mode_request(int port, struct tcss_mux mux_data)
{
uint32_t cmd;
struct pmc_ipc_buffer req = { 0 };
+ struct pmc_ipc_buffer rsp;
cmd = tcss_make_safe_mode_cmd(PMC_IPC_TCSS_SAFE_MODE_REQ_RES, mux_data.usb3_port);
@@ -149,13 +148,13 @@
GET_TCSS_CD_FIELD(USAGE, cmd),
GET_TCSS_CD_FIELD(USB3, cmd));
- return send_pmc_req(SAFE_REQ, &req, res, PMC_IPC_SAFE_REQ_SIZE);
+ return send_pmc_req(SAFE_REQ, &req, &rsp, PMC_IPC_SAFE_REQ_SIZE);
}
static int send_pmc_dp_hpd_request(int port, struct tcss_mux mux_data)
{
- struct pmc_ipc_buffer *res = NULL;
struct pmc_ipc_buffer req = { 0 };
+ struct pmc_ipc_buffer rsp;
uint32_t cmd;
cmd = tcss_make_hpd_mode_cmd(
@@ -166,18 +165,16 @@
req.buf[0] = cmd;
- return send_pmc_req(HPD_REQ, &req, res, PMC_IPC_HPD_REQ_SIZE);
-
+ return send_pmc_req(HPD_REQ, &req, &rsp, PMC_IPC_HPD_REQ_SIZE);
}
-static int send_pmc_dp_mode_request(int port, struct tcss_mux mux_data,
- struct pmc_ipc_buffer *res)
+static int send_pmc_dp_mode_request(int port, struct tcss_mux mux_data)
{
uint32_t cmd;
uint8_t dp_mode;
int ret;
-
struct pmc_ipc_buffer req = { 0 };
+ struct pmc_ipc_buffer rsp;
cmd = tcss_make_alt_mode_cmd_buf_0(
PMC_IPC_TCSS_ALTMODE_REQ_RES,
@@ -232,7 +229,7 @@
req.buf[1] = cmd;
- ret = send_pmc_req(DP_REQ, &req, res, PMC_IPC_ALT_REQ_SIZE);
+ ret = send_pmc_req(DP_REQ, &req, &rsp, PMC_IPC_ALT_REQ_SIZE);
if (ret)
return ret;
@@ -242,23 +239,22 @@
void update_tcss_mux(int port, struct tcss_mux mux_data)
{
- struct pmc_ipc_buffer *rbuf = NULL;
int ret = 0;
/* check if mux has a DP device */
if (mux_data.dp) {
- ret = send_pmc_connect_request(port, mux_data, rbuf);
+ ret = send_pmc_connect_request(port, mux_data);
if (ret) {
printk(BIOS_ERR, "Port %d connect request failed\n", port);
return;
}
- ret = send_pmc_safe_mode_request(port, mux_data, rbuf);
+ ret = send_pmc_safe_mode_request(port, mux_data);
if (ret) {
printk(BIOS_ERR, "Port %d safe mode request failed\n", port);
return;
}
- ret = send_pmc_dp_mode_request(port, mux_data, rbuf);
+ ret = send_pmc_dp_mode_request(port, mux_data);
}
if (ret)