kernel.git/drivers/firmware/arm_scmi/base.c, branch linux-6.3.y

firmware: arm_scmi: Avoid using extended string-buffers sizes if not necessary

2022-06-10T16:55:29Z

Commit b260fccaebdc2 ("firmware: arm_scmi: Add SCMI v3.1 protocol extended names support") moved all the name string buffers to use the extended buffer size of 64 instead of the required 16 bytes. While that should be fine if the firmware terminates the string before 16 bytes, there is possibility of copying random data if the name is not NULL terminated by the firmware. SCMI base protocol agent_name/vendor_id/sub_vendor_id are defined by the specification as NULL-terminated ASCII strings up to 16-bytes in length. The underlying buffers and message descriptors are currently bigger than needed; resize them to fit only the strictly needed 16 bytes to avoid any possible leaks when reading data from the firmware. Change the size argument of strlcpy to use SCMI_SHORT_NAME_MAX_SIZE always when dealing with short domain names, so as to limit the possibility that an ill-formed non-NULL terminated short reply from the SCMI platform firmware can leak stale content laying in the underlying transport shared memory area. While at that, convert all strings handling routines to use the preferred strscpy. Link: https://lore.kernel.org/r/20220608095530.497879-1-cristian.marussi@arm.com Fixes: b260fccaebdc2 ("firmware: arm_scmi: Add SCMI v3.1 protocol extended names support") Signed-off-by: Cristian Marussi Signed-off-by: Sudeep Holla

firmware: arm_scmi: Relax base protocol sanity checks on the protocol list

2022-06-06T14:46:35Z

Even though malformed replies from firmware must be treated carefully to avoid memory corruption in the kernel, some out-of-spec SCMI replies can be tolerated to avoid breaking existing deployed system, as long as they won't cause memory issues. Relax the sanity checks on the recieved protocol list in the base protocol to avoid breaking one of the deployed platform whose firmware is not easily upgradable currently. Link: https://lore.kernel.org/r/20220523171559.472112-1-cristian.marussi@arm.com Cc: Etienne Carriere Cc: Sudeep Holla Reported-by: Nicolas Frattaroli Tested-By: Frank Wunderlich Acked-by: Michael Riesch Acked-by: Etienne Carriere Signed-off-by: Cristian Marussi Signed-off-by: Sudeep Holla

firmware: arm_scmi: Dynamically allocate implemented protocols array

2022-04-28T17:22:51Z

Move away from a statically allocated array for holding the current set of protocols implemented by the platform in favour of allocating it dynamically based on the number of protocols effectively advertised by the platform via BASE protocol exchanges. While at that, rectify the BASE_DISCOVER_LIST_PROTOCOLS loop iterations to terminate only when a number of protocols equal to the advertised ones has been received, instead of looping till the platform returns no more protocols descriptors. This new behaviour is better compliant with the specification and it has been tested to work equally well against an SCMI stack running on top of an official SCP firmware on a JUNO board. Link: https://lore.kernel.org/r/20220330150551.2573938-6-cristian.marussi@arm.com Signed-off-by: Cristian Marussi Signed-off-by: Sudeep Holla

firmware: arm_scmi: Validate BASE_DISCOVER_LIST_PROTOCOLS response

2022-04-28T17:22:50Z

Do not blindly trust SCMI platform response about list of implemented protocols, instead validate the reported length of the list of protocols against the real payload size of the message reply. Link: https://lore.kernel.org/r/20220330150551.2573938-5-cristian.marussi@arm.com Fixes: b6f20ff8bd94 ("firmware: arm_scmi: add common infrastructure and support for base protocol") Signed-off-by: Cristian Marussi [sudeep.holla: Added early break if loop_num_ret = 0 and simplified calc_list_sz calculation] Signed-off-by: Sudeep Holla

firmware: arm_scmi: Fix list protocols enumeration in the base protocol

2022-04-28T09:48:21Z

While enumerating protocols implemented by the SCMI platform using BASE_DISCOVER_LIST_PROTOCOLS, the number of returned protocols is currently validated in an improper way since the check employs a sum between unsigned integers that could overflow and cause the check itself to be silently bypassed if the returned value 'loop_num_ret' is big enough. Fix the validation avoiding the addition. Link: https://lore.kernel.org/r/20220330150551.2573938-4-cristian.marussi@arm.com Fixes: b6f20ff8bd94 ("firmware: arm_scmi: add common infrastructure and support for base protocol") Signed-off-by: Cristian Marussi Signed-off-by: Sudeep Holla

firmware: arm_scmi: Make protocols initialisation fail on basic errors

2022-04-28T09:47:19Z

Bail out of protocol initialisation routine early when basic information about protocol version and attributes could not be retrieved. Failing to act this way can lead to a successfully initialized SCMI protocol which is in fact not fully functional. Link: https://lore.kernel.org/r/20220330150551.2573938-3-cristian.marussi@arm.com Signed-off-by: Cristian Marussi Signed-off-by: Sudeep Holla

firmware: arm_scmi: Fix base agent discover response

2021-11-17T11:24:50Z

According to scmi specification, the response of the discover agent request is made of: - int32 status - uint32 agent_id - uint8 name[16] but the current implementation doesn't take into account the agent_id field and only allocates a rx buffer of SCMI_MAX_STR_SIZE length Allocate the correct length for rx buffer and copy the name from the correct offset in the response. While no error were returned until v5.15, v5.16-rc1 fails with virtio_scmi transport channel: | arm-scmi firmware:scmi0: SCMI Notifications - Core Enabled. | arm-scmi firmware:scmi0: SCMI Protocol v2.0 'Linaro:PMWG' Firmware version 0x2090000 | scmi-virtio virtio0: tx:used len 28 is larger than in buflen 24 Link: https://lore.kernel.org/r/20211117081856.9932-1-vincent.guittot@linaro.org Fixes: b6f20ff8bd94 ("firmware: arm_scmi: add common infrastructure and support for base protocol") Tested-by: Cristian Marussi Reviewed-by: Cristian Marussi Signed-off-by: Vincent Guittot Signed-off-by: Sudeep Holla

firmware: arm_scmi: Add protocol modularization support

2021-03-30T15:35:16Z

Extend SCMI protocols accounting mechanism to address possible module usage and add the support to possibly define new protocols as loadable modules. Keep the standard protocols built into the SCMI core. Link: https://lore.kernel.org/r/20210316124903.35011-38-cristian.marussi@arm.com Tested-by: Florian Fainelli Signed-off-by: Cristian Marussi Signed-off-by: Sudeep Holla

firmware: arm_scmi: Cleanup events registration transient code

2021-03-30T15:35:15Z

Remove all the events registration code used to ease the transition to the new interface based on protocol handles. Link: https://lore.kernel.org/r/20210316124903.35011-35-cristian.marussi@arm.com Tested-by: Florian Fainelli Signed-off-by: Cristian Marussi Signed-off-by: Sudeep Holla

firmware: arm_scmi: Port base protocol to new interface

2021-03-29T09:00:35Z

Port the SCMI base protocol to new protocol handles based interface. Link: https://lore.kernel.org/r/20210316124903.35011-11-cristian.marussi@arm.com Tested-by: Florian Fainelli Signed-off-by: Cristian Marussi Signed-off-by: Sudeep Holla