Received-SPF: pass (google.com: domain of linux-kernel+bounces-91256-linux.lists.archive=gmail.com@vger.kernel.org designates 2604:1380:40f1:3f00::1 as permitted sender) client-ip=2604:1380:40f1:3f00::1;
From: Armin Wolf <W_Armin@gmx.de>
To: Shyam-sundar.S-k@amd.com
Cc: hdegoede@redhat.com,
	ilpo.jarvinen@linux.intel.com,
	platform-driver-x86@vger.kernel.org,
	linux-kernel@vger.kernel.org
Subject: [PATCH v3 0/4] platform/x86/amd/pmf: Fix policy binary handling
Date: Mon,  4 Mar 2024 21:50:01 +0100
Message-Id: <20240304205005.10078-1-W_Armin@gmx.de>
Precedence: bulk
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
UI-OutboundReport: notjunk:1;M01:P0:uAhTHImG3x8=;1T20MSu35SJ6JnV/foM13kLVkec
 1RD0rSEoxYzDynbcNENGx+5Kk1A+7t0xwBTzfWuMSkemqULNMqaPVNqXwX7ee3pg/JzEZVHTX
 BfeQ/zaJfFq9WLw3No6clXk8cPAtfwlqC4l36ZZYzQSqqB5BOkCmMYhKkisNnQH9HpfzoVNdy
 R/aHqiHNruWpuZNsvd+OcFlniDqAMblsMnnGb9J38YS0G2BmoWzBls1UM4mA9wC3kStpINdqO
 rPn4O4U9eBy3Kqce7nFCvPHiwTcBsEgg66ZKgHYIOTyWjDmdxMKk33Wnrhabgqta6Gm5Dik+S
 XIvb4njeYJirqmD3naY6yWgJlRZalFd7sbxo4cCfANBaDj4uc+s6GXJw/pNwvsUuA975RJPaW
 c/xmAcrBOTiVy9JA+F6uN9MrifSK7c/0CzU+CoaZl6GvJW7Vh4uNrI7uY5OK/xY4yb1maOiGE
 gokdvZY6lWITg2MPFhLo422EuxVhqZ8VvMJn1E8GfY24XvqvFCYwp4MauDqJGel9rkkCufKS6
 p9XkCkelE5XUH9YOTXSACRNTjyqGAM7OOMfQXFZ+L0XTpTIz3EZTB+c7j02SQNdxyxB+rYeK0
 8vxnxSt/C23qXzkZoIo7Vnz0DZmdcW4rWynd9XY+EoanY4nByDJ2gjqJ1gQKTLZHq26fqn4sj
 ppY6s+f939nS2cvF4I4NjSdEpxq1NDP0HTgMDIs3xD1pJyjectIC/t5RGbh4CZCAbc00tQFV1
 MlOdlM3L30whZZTCyyq+ib+zCtaU06WbNQFtWSBbNSpPEkSvfqzSbsT7iEYghO+hJ1Jh1qvkW
 w6vZ7Tw1QEvsGwYTlhSsd6lvydxWwe4FtGH9HdDUf8tiI=

This patch series fixes various issues inside the policy binary
handling code.
The first patch makes sure that a valid error code is returned upon
failing to start the policy engine, while the second patch drops the
usage of readl() on non-io memory.
The last two patches fix a possible out-of-bounds memory access when
parsing the policy binary header.

All patches are compile-tested only.

Changes since v2:
- add patches 1 and 3

Changes since v1:
- get the full dword instead of only 8 bits when reading the header
- check if the policy buffer also has enough room for storing the length

Armin Wolf (4):
  platform/x86/amd/pmf: Fix return value of
    amd_pmf_start_policy_engine()
  platform/x86/amd/pmf: Do not use readl() for policy buffer access
  platform/x86/amd/pmf: Use struct for cookie header
  platform/x86/amd/pmf: Fix possible out-of-bound memory accesses

 drivers/platform/x86/amd/pmf/pmf.h    |  6 +++++-
 drivers/platform/x86/amd/pmf/tee-if.c | 21 +++++++++++++--------
 2 files changed, 18 insertions(+), 9 deletions(-)

=2D-
2.39.2