From: Thomas Zimmermann <tzimmermann@suse.de>
To: KuoHsiang Chou <kuohsiang_chou@aspeedtech.com>,
dri-devel@lists.freedesktop.org, linux-kernel@vger.kernel.org
Cc: airlied@linux.ie, jenmin_yuan@aspeedtech.com,
arc_sung@aspeedtech.com, airlied@redhat.com
Subject: Re: [PATCH v5] drm/ast: Fixed CVE for DP501
Date: Tue, 27 Apr 2021 13:01:41 +0200 [thread overview]
Message-ID: <2662b502-edbe-b79b-b458-dbabafe6ca3c@suse.de> (raw)
In-Reply-To: <20210421085859.17761-1-kuohsiang_chou@aspeedtech.com>
[-- Attachment #1.1.1: Type: text/plain, Size: 9674 bytes --]
Hi
Am 21.04.21 um 10:58 schrieb KuoHsiang Chou:
> [Bug][DP501]
> If ASPEED P2A (PCI to AHB) bridge is disabled and disallowed for
> CVE_2019_6260 item3, and then the monitor's EDID is unable read through
> Parade DP501.
> The reason is the DP501's FW is mapped to BMC addressing space rather
> than Host addressing space.
> The resolution is that using "pci_iomap_range()" maps to DP501's FW that
> stored on the end of FB (Frame Buffer).
> In this case, FrameBuffer reserves the last 2MB used for the image of
> DP501.
>
Your patches are missing a short changelog, so that reviewers can see
what changed between versions. Anyway, I merged your patch into
drm-misc-next now. Thanks for the fix.
More generally speaking, the DP501 code needs a major refactoring. It's
currently bolted onto the regular VGA connector code. It should rather
be a separate connector or a DRM bridge. I always wanted to work on
this, but don't have a device for testing. If I'd provide patches, would
you be in a position to test them?
Best regards
Thomas
> Signed-off-by: KuoHsiang Chou <kuohsiang_chou@aspeedtech.com>
> Reported-by: kernel test robot <lkp@intel.com>
> ---
> drivers/gpu/drm/ast/ast_dp501.c | 139 +++++++++++++++++++++++---------
> drivers/gpu/drm/ast/ast_drv.h | 12 +++
> drivers/gpu/drm/ast/ast_main.c | 11 ++-
> 3 files changed, 125 insertions(+), 37 deletions(-)
>
> diff --git a/drivers/gpu/drm/ast/ast_dp501.c b/drivers/gpu/drm/ast/ast_dp501.c
> index 88121c0e0..cd93c44f2 100644
> --- a/drivers/gpu/drm/ast/ast_dp501.c
> +++ b/drivers/gpu/drm/ast/ast_dp501.c
> @@ -189,6 +189,9 @@ bool ast_backup_fw(struct drm_device *dev, u8 *addr, u32 size)
> u32 i, data;
> u32 boot_address;
>
> + if (ast->config_mode != ast_use_p2a)
> + return false;
> +
> data = ast_mindwm(ast, 0x1e6e2100) & 0x01;
> if (data) {
> boot_address = get_fw_base(ast);
> @@ -207,6 +210,9 @@ static bool ast_launch_m68k(struct drm_device *dev)
> u8 *fw_addr = NULL;
> u8 jreg;
>
> + if (ast->config_mode != ast_use_p2a)
> + return false;
> +
> data = ast_mindwm(ast, 0x1e6e2100) & 0x01;
> if (!data) {
>
> @@ -271,25 +277,55 @@ u8 ast_get_dp501_max_clk(struct drm_device *dev)
> struct ast_private *ast = to_ast_private(dev);
> u32 boot_address, offset, data;
> u8 linkcap[4], linkrate, linklanes, maxclk = 0xff;
> + u32 *plinkcap;
>
> - boot_address = get_fw_base(ast);
> -
> - /* validate FW version */
> - offset = 0xf000;
> - data = ast_mindwm(ast, boot_address + offset);
> - if ((data & 0xf0) != 0x10) /* version: 1x */
> - return maxclk;
> -
> - /* Read Link Capability */
> - offset = 0xf014;
> - *(u32 *)linkcap = ast_mindwm(ast, boot_address + offset);
> - if (linkcap[2] == 0) {
> - linkrate = linkcap[0];
> - linklanes = linkcap[1];
> - data = (linkrate == 0x0a) ? (90 * linklanes) : (54 * linklanes);
> - if (data > 0xff)
> - data = 0xff;
> - maxclk = (u8)data;
> + if (ast->config_mode == ast_use_p2a) {
> + boot_address = get_fw_base(ast);
> +
> + /* validate FW version */
> + offset = AST_DP501_GBL_VERSION;
> + data = ast_mindwm(ast, boot_address + offset);
> + if ((data & AST_DP501_FW_VERSION_MASK) != AST_DP501_FW_VERSION_1) /* version: 1x */
> + return maxclk;
> +
> + /* Read Link Capability */
> + offset = AST_DP501_LINKRATE;
> + plinkcap = (u32 *)linkcap;
> + *plinkcap = ast_mindwm(ast, boot_address + offset);
> + if (linkcap[2] == 0) {
> + linkrate = linkcap[0];
> + linklanes = linkcap[1];
> + data = (linkrate == 0x0a) ? (90 * linklanes) : (54 * linklanes);
> + if (data > 0xff)
> + data = 0xff;
> + maxclk = (u8)data;
> + }
> + } else {
> + if (!ast->dp501_fw_buf)
> + return AST_DP501_DEFAULT_DCLK; /* 1024x768 as default */
> +
> + /* dummy read */
> + offset = 0x0000;
> + data = readl(ast->dp501_fw_buf + offset);
> +
> + /* validate FW version */
> + offset = AST_DP501_GBL_VERSION;
> + data = readl(ast->dp501_fw_buf + offset);
> + if ((data & AST_DP501_FW_VERSION_MASK) != AST_DP501_FW_VERSION_1) /* version: 1x */
> + return maxclk;
> +
> + /* Read Link Capability */
> + offset = AST_DP501_LINKRATE;
> + plinkcap = (u32 *)linkcap;
> + *plinkcap = readl(ast->dp501_fw_buf + offset);
> + if (linkcap[2] == 0) {
> + linkrate = linkcap[0];
> + linklanes = linkcap[1];
> + data = (linkrate == 0x0a) ? (90 * linklanes) : (54 * linklanes);
> + if (data > 0xff)
> + data = 0xff;
> + maxclk = (u8)data;
> + }
> }
> return maxclk;
> }
> @@ -298,26 +334,57 @@ bool ast_dp501_read_edid(struct drm_device *dev, u8 *ediddata)
> {
> struct ast_private *ast = to_ast_private(dev);
> u32 i, boot_address, offset, data;
> + u32 *pEDIDidx;
>
> - boot_address = get_fw_base(ast);
> -
> - /* validate FW version */
> - offset = 0xf000;
> - data = ast_mindwm(ast, boot_address + offset);
> - if ((data & 0xf0) != 0x10)
> - return false;
> -
> - /* validate PnP Monitor */
> - offset = 0xf010;
> - data = ast_mindwm(ast, boot_address + offset);
> - if (!(data & 0x01))
> - return false;
> + if (ast->config_mode == ast_use_p2a) {
> + boot_address = get_fw_base(ast);
>
> - /* Read EDID */
> - offset = 0xf020;
> - for (i = 0; i < 128; i += 4) {
> - data = ast_mindwm(ast, boot_address + offset + i);
> - *(u32 *)(ediddata + i) = data;
> + /* validate FW version */
> + offset = AST_DP501_GBL_VERSION;
> + data = ast_mindwm(ast, boot_address + offset);
> + if ((data & AST_DP501_FW_VERSION_MASK) != AST_DP501_FW_VERSION_1)
> + return false;
> +
> + /* validate PnP Monitor */
> + offset = AST_DP501_PNPMONITOR;
> + data = ast_mindwm(ast, boot_address + offset);
> + if (!(data & AST_DP501_PNP_CONNECTED))
> + return false;
> +
> + /* Read EDID */
> + offset = AST_DP501_EDID_DATA;
> + for (i = 0; i < 128; i += 4) {
> + data = ast_mindwm(ast, boot_address + offset + i);
> + pEDIDidx = (u32 *)(ediddata + i);
> + *pEDIDidx = data;
> + }
> + } else {
> + if (!ast->dp501_fw_buf)
> + return false;
> +
> + /* dummy read */
> + offset = 0x0000;
> + data = readl(ast->dp501_fw_buf + offset);
> +
> + /* validate FW version */
> + offset = AST_DP501_GBL_VERSION;
> + data = readl(ast->dp501_fw_buf + offset);
> + if ((data & AST_DP501_FW_VERSION_MASK) != AST_DP501_FW_VERSION_1)
> + return false;
> +
> + /* validate PnP Monitor */
> + offset = AST_DP501_PNPMONITOR;
> + data = readl(ast->dp501_fw_buf + offset);
> + if (!(data & AST_DP501_PNP_CONNECTED))
> + return false;
> +
> + /* Read EDID */
> + offset = AST_DP501_EDID_DATA;
> + for (i = 0; i < 128; i += 4) {
> + data = readl(ast->dp501_fw_buf + offset + i);
> + pEDIDidx = (u32 *)(ediddata + i);
> + *pEDIDidx = data;
> + }
> }
>
> return true;
> diff --git a/drivers/gpu/drm/ast/ast_drv.h b/drivers/gpu/drm/ast/ast_drv.h
> index e82ab8628..911f9f414 100644
> --- a/drivers/gpu/drm/ast/ast_drv.h
> +++ b/drivers/gpu/drm/ast/ast_drv.h
> @@ -150,6 +150,7 @@ struct ast_private {
>
> void __iomem *regs;
> void __iomem *ioregs;
> + void __iomem *dp501_fw_buf;
>
> enum ast_chip chip;
> bool vga2_clone;
> @@ -325,6 +326,17 @@ int ast_mode_config_init(struct ast_private *ast);
> #define AST_MM_ALIGN_SHIFT 4
> #define AST_MM_ALIGN_MASK ((1 << AST_MM_ALIGN_SHIFT) - 1)
>
> +#define AST_DP501_FW_VERSION_MASK GENMASK(7, 4)
> +#define AST_DP501_FW_VERSION_1 BIT(4)
> +#define AST_DP501_PNP_CONNECTED BIT(1)
> +
> +#define AST_DP501_DEFAULT_DCLK 65
> +
> +#define AST_DP501_GBL_VERSION 0xf000
> +#define AST_DP501_PNPMONITOR 0xf010
> +#define AST_DP501_LINKRATE 0xf014
> +#define AST_DP501_EDID_DATA 0xf020
> +
> int ast_mm_init(struct ast_private *ast);
>
> /* ast post */
> diff --git a/drivers/gpu/drm/ast/ast_main.c b/drivers/gpu/drm/ast/ast_main.c
> index 0ac3c2039..3976a2587 100644
> --- a/drivers/gpu/drm/ast/ast_main.c
> +++ b/drivers/gpu/drm/ast/ast_main.c
> @@ -99,7 +99,7 @@ static void ast_detect_config_mode(struct drm_device *dev, u32 *scu_rev)
> if (!(jregd0 & 0x80) || !(jregd1 & 0x10)) {
> /* Double check it's actually working */
> data = ast_read32(ast, 0xf004);
> - if (data != 0xFFFFFFFF) {
> + if ((data != 0xFFFFFFFF) && (data != 0x00)) {
> /* P2A works, grab silicon revision */
> ast->config_mode = ast_use_p2a;
>
> @@ -411,6 +411,7 @@ struct ast_private *ast_device_create(const struct drm_driver *drv,
> return ast;
> dev = &ast->base;
>
> + dev->pdev = pdev;
> pci_set_drvdata(pdev, dev);
>
> ast->regs = pci_iomap(pdev, 1, 0);
> @@ -450,6 +451,14 @@ struct ast_private *ast_device_create(const struct
drm_driver *drv,
> if (ret)
> return ERR_PTR(ret);
>
> + /* map reserved buffer */
> + ast->dp501_fw_buf = NULL;
> + if (dev->vram_mm->vram_size < pci_resource_len(dev->pdev, 0)) {
> + ast->dp501_fw_buf = pci_iomap_range(dev->pdev, 0, dev->vram_mm->vram_size, 0);
> + if (!ast->dp501_fw_buf)
> + drm_info(dev, "failed to map reserved buffer!\n");
> + }
> +
> ret = ast_mode_config_init(ast);
> if (ret)
> return ERR_PTR(ret);
> --
> 2.18.4
>
> _______________________________________________
> dri-devel mailing list
> dri-devel@lists.freedesktop.org
> https://lists.freedesktop.org/mailman/listinfo/dri-devel
>
--
Thomas Zimmermann
Graphics Driver Developer
SUSE Software Solutions Germany GmbH
Maxfeldstr. 5, 90409 Nürnberg, Germany
(HRB 36809, AG Nürnberg)
Geschäftsführer: Felix Imendörffer
[-- Attachment #1.2: OpenPGP digital signature --]
[-- Type: application/pgp-signature, Size: 840 bytes --]
[-- Attachment #2: Type: text/plain, Size: 160 bytes --]
_______________________________________________
dri-devel mailing list
dri-devel@lists.freedesktop.org
https://lists.freedesktop.org/mailman/listinfo/dri-devel
next prev parent reply other threads:[~2021-04-27 11:01 UTC|newest]
Thread overview: 21+ messages / expand[flat|nested] mbox.gz Atom feed top
2021-01-18 8:57 [PATCH] drm/ast: Update the sequence of Clearing Fast-reset KuoHsiang Chou
2021-01-21 7:55 ` Thomas Zimmermann
2021-01-21 8:42 ` Kuo-Hsiang Chou
2021-03-19 9:23 ` [PATCH V3] drm/ast: Disable fast reset after DRAM initial KuoHsiang Chou
2021-03-29 9:17 ` Thomas Zimmermann
2021-03-31 6:56 ` Kuo-Hsiang Chou
2021-03-31 7:20 ` Thomas Zimmermann
2021-04-08 9:30 ` [PATCH v4] drm/ast: Fixed CVE for DP501 KuoHsiang Chou
2021-04-12 7:45 ` Thomas Zimmermann
2021-04-21 8:58 ` [PATCH v5] " KuoHsiang Chou
2021-04-27 11:01 ` Thomas Zimmermann [this message]
2021-04-29 9:21 ` Kuo-Hsiang Chou
2021-08-03 8:58 ` Thomas Zimmermann
2021-08-04 2:20 ` Kuo-Hsiang Chou
2021-05-07 9:27 ` [PATCH v4] drm/ast: Disable fast reset after DRAM initial KuoHsiang Chou
2021-05-26 10:24 ` Kuo-Hsiang Chou
2021-06-21 11:06 ` Kuo-Hsiang Chou
2021-06-21 12:46 ` Thomas Zimmermann
2021-06-23 8:02 ` Thomas Zimmermann
2021-07-09 8:09 ` [PATCH v5] " KuoHsiang Chou
2021-07-20 8:49 ` Thomas Zimmermann
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=2662b502-edbe-b79b-b458-dbabafe6ca3c@suse.de \
--to=tzimmermann@suse.de \
--cc=airlied@linux.ie \
--cc=airlied@redhat.com \
--cc=arc_sung@aspeedtech.com \
--cc=dri-devel@lists.freedesktop.org \
--cc=jenmin_yuan@aspeedtech.com \
--cc=kuohsiang_chou@aspeedtech.com \
--cc=linux-kernel@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).