From: Sasha Levin <sashal@kernel.org>
To: linux-kernel@vger.kernel.org, stable@vger.kernel.org
Cc: Victor Zhao <Victor.Zhao@amd.com>,
Jingwen Chen <Jingwen.Chen2@amd.com>, Monk Liu <monk.liu@amd.com>,
Alex Deucher <alexander.deucher@amd.com>,
Sasha Levin <sashal@kernel.org>,
amd-gfx@lists.freedesktop.org, dri-devel@lists.freedesktop.org
Subject: [PATCH AUTOSEL 5.12 45/49] drm/amd/amdgpu:save psp ring wptr to avoid attack
Date: Mon, 7 Jun 2021 12:12:11 -0400 [thread overview]
Message-ID: <20210607161215.3583176-45-sashal@kernel.org> (raw)
In-Reply-To: <20210607161215.3583176-1-sashal@kernel.org>
From: Victor Zhao <Victor.Zhao@amd.com>
[ Upstream commit 2370eba9f552eaae3d8aa1f70b8e9eec5c560f9e ]
[Why]
When some tools performing psp mailbox attack, the readback value
of register can be a random value which may break psp.
[How]
Use a psp wptr cache machanism to aovid the change made by attack.
v2: unify change and add detailed reason
Signed-off-by: Victor Zhao <Victor.Zhao@amd.com>
Signed-off-by: Jingwen Chen <Jingwen.Chen2@amd.com>
Reviewed-by: Monk Liu <monk.liu@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/gpu/drm/amd/amdgpu/amdgpu_psp.h | 1 +
drivers/gpu/drm/amd/amdgpu/psp_v11_0.c | 3 ++-
drivers/gpu/drm/amd/amdgpu/psp_v3_1.c | 3 ++-
3 files changed, 5 insertions(+), 2 deletions(-)
diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_psp.h b/drivers/gpu/drm/amd/amdgpu/amdgpu_psp.h
index cb50ba445f8c..0fd62a8e68c2 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_psp.h
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_psp.h
@@ -76,6 +76,7 @@ struct psp_ring
uint64_t ring_mem_mc_addr;
void *ring_mem_handle;
uint32_t ring_size;
+ uint32_t ring_wptr;
};
/* More registers may will be supported */
diff --git a/drivers/gpu/drm/amd/amdgpu/psp_v11_0.c b/drivers/gpu/drm/amd/amdgpu/psp_v11_0.c
index c325d6f53a71..d39735a89a25 100644
--- a/drivers/gpu/drm/amd/amdgpu/psp_v11_0.c
+++ b/drivers/gpu/drm/amd/amdgpu/psp_v11_0.c
@@ -720,7 +720,7 @@ static uint32_t psp_v11_0_ring_get_wptr(struct psp_context *psp)
struct amdgpu_device *adev = psp->adev;
if (amdgpu_sriov_vf(adev))
- data = RREG32_SOC15(MP0, 0, mmMP0_SMN_C2PMSG_102);
+ data = psp->km_ring.ring_wptr;
else
data = RREG32_SOC15(MP0, 0, mmMP0_SMN_C2PMSG_67);
@@ -734,6 +734,7 @@ static void psp_v11_0_ring_set_wptr(struct psp_context *psp, uint32_t value)
if (amdgpu_sriov_vf(adev)) {
WREG32_SOC15(MP0, 0, mmMP0_SMN_C2PMSG_102, value);
WREG32_SOC15(MP0, 0, mmMP0_SMN_C2PMSG_101, GFX_CTRL_CMD_ID_CONSUME_CMD);
+ psp->km_ring.ring_wptr = value;
} else
WREG32_SOC15(MP0, 0, mmMP0_SMN_C2PMSG_67, value);
}
diff --git a/drivers/gpu/drm/amd/amdgpu/psp_v3_1.c b/drivers/gpu/drm/amd/amdgpu/psp_v3_1.c
index f2e725f72d2f..908664a5774b 100644
--- a/drivers/gpu/drm/amd/amdgpu/psp_v3_1.c
+++ b/drivers/gpu/drm/amd/amdgpu/psp_v3_1.c
@@ -379,7 +379,7 @@ static uint32_t psp_v3_1_ring_get_wptr(struct psp_context *psp)
struct amdgpu_device *adev = psp->adev;
if (amdgpu_sriov_vf(adev))
- data = RREG32_SOC15(MP0, 0, mmMP0_SMN_C2PMSG_102);
+ data = psp->km_ring.ring_wptr;
else
data = RREG32_SOC15(MP0, 0, mmMP0_SMN_C2PMSG_67);
return data;
@@ -394,6 +394,7 @@ static void psp_v3_1_ring_set_wptr(struct psp_context *psp, uint32_t value)
/* send interrupt to PSP for SRIOV ring write pointer update */
WREG32_SOC15(MP0, 0, mmMP0_SMN_C2PMSG_101,
GFX_CTRL_CMD_ID_CONSUME_CMD);
+ psp->km_ring.ring_wptr = value;
} else
WREG32_SOC15(MP0, 0, mmMP0_SMN_C2PMSG_67, value);
}
--
2.30.2
next prev parent reply other threads:[~2021-06-07 16:15 UTC|newest]
Thread overview: 49+ messages / expand[flat|nested] mbox.gz Atom feed top
2021-06-07 16:11 [PATCH AUTOSEL 5.12 01/49] net: ieee802154: fix null deref in parse dev addr Sasha Levin
2021-06-07 16:11 ` [PATCH AUTOSEL 5.12 02/49] HID: asus: Filter keyboard EC for old ROG keyboard Sasha Levin
2021-06-07 16:11 ` [PATCH AUTOSEL 5.12 03/49] HID: quirks: Set INCREMENT_USAGE_ON_DUPLICATE for Saitek X65 Sasha Levin
2021-06-07 16:11 ` [PATCH AUTOSEL 5.12 04/49] HID: quirks: Add HID_QUIRK_NO_INIT_REPORTS quirk for Dell K15A keyboard-dock Sasha Levin
2021-06-07 16:11 ` [PATCH AUTOSEL 5.12 05/49] HID: a4tech: use A4_2WHEEL_MOUSE_HACK_B8 for A4TECH NB-95 Sasha Levin
2021-06-07 16:11 ` [PATCH AUTOSEL 5.12 06/49] HID: hid-input: add mapping for emoji picker key Sasha Levin
2021-06-07 16:11 ` [PATCH AUTOSEL 5.12 07/49] HID: hid-sensor-hub: Return error for hid_set_field() failure Sasha Levin
2021-06-07 16:11 ` [PATCH AUTOSEL 5.12 08/49] HID: asus: filter G713/G733 key event to prevent shutdown Sasha Levin
2021-06-07 16:11 ` [PATCH AUTOSEL 5.12 09/49] HID: quirks: Add quirk for Lenovo optical mouse Sasha Levin
2021-06-07 16:11 ` [PATCH AUTOSEL 5.12 10/49] HID: multitouch: set Stylus suffix for Stylus-application devices, too Sasha Levin
2021-06-07 16:11 ` [PATCH AUTOSEL 5.12 11/49] HID: Add BUS_VIRTUAL to hid_connect logging Sasha Levin
2021-06-07 16:11 ` [PATCH AUTOSEL 5.12 12/49] HID: usbhid: fix info leak in hid_submit_ctrl Sasha Levin
2021-06-07 16:11 ` [PATCH AUTOSEL 5.12 13/49] mt76: mt7921: fix max aggregation subframes setting Sasha Levin
2021-06-07 16:11 ` [PATCH AUTOSEL 5.12 14/49] drm/tegra: sor: Do not leak runtime PM reference Sasha Levin
2021-06-07 16:11 ` [PATCH AUTOSEL 5.12 15/49] gpu: host1x: Split up client initalization and registration Sasha Levin
2021-06-07 16:11 ` [PATCH AUTOSEL 5.12 16/49] drm/tegra: sor: Fully initialize SOR before registration Sasha Levin
2021-06-07 16:11 ` [PATCH AUTOSEL 5.12 17/49] hwmon/pmbus: (q54sj108a2) The PMBUS_MFR_ID is actually 6 chars instead of 5 Sasha Levin
2021-06-07 16:11 ` [PATCH AUTOSEL 5.12 18/49] ARM: OMAP1: Fix use of possibly uninitialized irq variable Sasha Levin
2021-06-07 16:11 ` [PATCH AUTOSEL 5.12 19/49] ARM: OMAP2+: Fix build warning when mmc_omap is not built Sasha Levin
2021-06-07 16:11 ` [PATCH AUTOSEL 5.12 20/49] gfs2: Prevent direct-I/O write fallback errors from getting lost Sasha Levin
2021-06-07 16:11 ` [PATCH AUTOSEL 5.12 21/49] gfs2: fix a deadlock on withdraw-during-mount Sasha Levin
2021-06-07 16:11 ` [PATCH AUTOSEL 5.12 22/49] gfs2: Clean up revokes on normal withdraws Sasha Levin
2021-06-07 16:11 ` [PATCH AUTOSEL 5.12 23/49] HID: multitouch: Disable event reporting on suspend on the Asus T101HA touchpad Sasha Levin
2021-06-07 16:11 ` [PATCH AUTOSEL 5.12 24/49] HID: gt683r: add missing MODULE_DEVICE_TABLE Sasha Levin
2021-06-07 16:11 ` [PATCH AUTOSEL 5.12 25/49] HID: intel-ish-hid: ipc: Add Alder Lake device IDs Sasha Levin
2021-06-07 16:11 ` [PATCH AUTOSEL 5.12 26/49] riscv: Use -mno-relax when using lld linker Sasha Levin
2021-06-07 16:11 ` [PATCH AUTOSEL 5.12 27/49] ALSA: hda: Add AlderLake-M PCI ID Sasha Levin
2021-06-07 16:11 ` [PATCH AUTOSEL 5.12 28/49] mt76: mt7921: remove leftover 80+80 HE capability Sasha Levin
2021-06-07 16:11 ` [PATCH AUTOSEL 5.12 29/49] gfs2: Fix use-after-free in gfs2_glock_shrink_scan Sasha Levin
2021-06-07 16:11 ` [PATCH AUTOSEL 5.12 30/49] Bluetooth: use correct lock to prevent UAF of hdev object Sasha Levin
2021-06-07 16:11 ` [PATCH AUTOSEL 5.12 31/49] scsi: target: core: Fix warning on realtime kernels Sasha Levin
2021-06-07 16:11 ` [PATCH AUTOSEL 5.12 32/49] ethernet: myri10ge: Fix missing error code in myri10ge_probe() Sasha Levin
2021-06-07 16:11 ` [PATCH AUTOSEL 5.12 33/49] scsi: qedf: Do not put host in qedf_vport_create() unconditionally Sasha Levin
2021-06-07 16:12 ` [PATCH AUTOSEL 5.12 34/49] Bluetooth: Add a new USB ID for RTL8822CE Sasha Levin
2021-06-07 16:12 ` [PATCH AUTOSEL 5.12 35/49] scsi: scsi_devinfo: Add blacklist entry for HPE OPEN-V Sasha Levin
2021-06-07 16:12 ` [PATCH AUTOSEL 5.12 36/49] nvme-loop: reset queue count to 1 in nvme_loop_destroy_io_queues() Sasha Levin
2021-06-07 16:12 ` [PATCH AUTOSEL 5.12 37/49] nvme-loop: clear NVME_LOOP_Q_LIVE when nvme_loop_configure_admin_queue() fails Sasha Levin
2021-06-07 16:12 ` [PATCH AUTOSEL 5.12 38/49] nvme-loop: check for NVME_LOOP_Q_LIVE in nvme_loop_destroy_admin_queue() Sasha Levin
2021-06-07 16:12 ` [PATCH AUTOSEL 5.12 39/49] nvme-loop: do not warn for deleted controllers during reset Sasha Levin
2021-06-07 16:12 ` [PATCH AUTOSEL 5.12 40/49] net: ipconfig: Don't override command-line hostnames or domains Sasha Levin
2021-06-07 16:12 ` [PATCH AUTOSEL 5.12 41/49] drm/amd/display: Allow bandwidth validation for 0 streams Sasha Levin
2021-06-07 16:12 ` [PATCH AUTOSEL 5.12 42/49] drm/amdgpu: refine amdgpu_fru_get_product_info Sasha Levin
2021-06-07 16:12 ` [PATCH AUTOSEL 5.12 43/49] drm/amd/display: Fix overlay validation by considering cursors Sasha Levin
2021-06-07 16:12 ` [PATCH AUTOSEL 5.12 44/49] drm/amd/display: Fix potential memory leak in DMUB hw_init Sasha Levin
2021-06-07 16:12 ` Sasha Levin [this message]
2021-06-07 16:12 ` [PATCH AUTOSEL 5.12 46/49] rtnetlink: Fix missing error code in rtnl_bridge_notify() Sasha Levin
2021-06-07 16:12 ` [PATCH AUTOSEL 5.12 47/49] net/x25: Return the correct errno code Sasha Levin
2021-06-07 16:12 ` [PATCH AUTOSEL 5.12 48/49] net: " Sasha Levin
2021-06-07 16:12 ` [PATCH AUTOSEL 5.12 49/49] fib: " Sasha Levin
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20210607161215.3583176-45-sashal@kernel.org \
--to=sashal@kernel.org \
--cc=Jingwen.Chen2@amd.com \
--cc=Victor.Zhao@amd.com \
--cc=alexander.deucher@amd.com \
--cc=amd-gfx@lists.freedesktop.org \
--cc=dri-devel@lists.freedesktop.org \
--cc=linux-kernel@vger.kernel.org \
--cc=monk.liu@amd.com \
--cc=stable@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).