From 1a897d7d24d6419a56aa0dbb2e82a905fd08f111 Mon Sep 17 00:00:00 2001 From: Simone Date: Sun, 9 Aug 2026 09:49:08 +0200 Subject: [PATCH] i2c-imc-skylake: guard branch - verify the ECAM page before trusting it A miscomputed page would send every engine write to some other function's config space - the exact failure mode the ECAM path exists to remove. Require word 0 to read back as 8086:2085 before using the mapping; otherwise fall back to config cycles. --- i2c-imc-skylake.c | 17 +++++++++++++++++ 1 file changed, 17 insertions(+) diff --git a/i2c-imc-skylake.c b/i2c-imc-skylake.c index 9f533ec..b79b2ee 100644 --- a/i2c-imc-skylake.c +++ b/i2c-imc-skylake.c @@ -276,6 +276,23 @@ static void __iomem *imc_map_ecam(struct pci_dev *pdev) } acpi_put_table(&mcfg->header); + if (!map) + return NULL; + + /* + * A wrong page here would make every engine write land on some other + * function - the exact failure mode this path exists to remove. + * Word 0 is the one register whose value is known in advance; require + * it before trusting the mapping with writes. + */ + if (readl(map) != (PCU_DEVICE << 16 | PCI_VENDOR_ID_INTEL)) { + dev_warn(&pdev->dev, + "ECAM page does not identify as %04x:%04x; not using it\n", + PCI_VENDOR_ID_INTEL, PCU_DEVICE); + devm_iounmap(&pdev->dev, map); + return NULL; + } + return map; }