From: Sasha Levin <sashal@kernel.org>
To: linux-kernel@vger.kernel.org, stable@vger.kernel.org
Cc: Victor Zhao <Victor.Zhao@amd.com>,
Jingwen Chen <Jingwen.Chen2@amd.com>, Monk Liu <monk.liu@amd.com>,
Alex Deucher <alexander.deucher@amd.com>,
Sasha Levin <sashal@kernel.org>,
amd-gfx@lists.freedesktop.org, dri-devel@lists.freedesktop.org
Subject: [PATCH AUTOSEL 5.10 35/39] drm/amd/amdgpu:save psp ring wptr to avoid attack
Date: Mon, 7 Jun 2021 12:13:14 -0400 [thread overview]
Message-ID: <20210607161318.3583636-35-sashal@kernel.org> (raw)
In-Reply-To: <20210607161318.3583636-1-sashal@kernel.org>
From: Victor Zhao <Victor.Zhao@amd.com>
[ Upstream commit 2370eba9f552eaae3d8aa1f70b8e9eec5c560f9e ]
[Why]
When some tools performing psp mailbox attack, the readback value
of register can be a random value which may break psp.
[How]
Use a psp wptr cache machanism to aovid the change made by attack.
v2: unify change and add detailed reason
Signed-off-by: Victor Zhao <Victor.Zhao@amd.com>
Signed-off-by: Jingwen Chen <Jingwen.Chen2@amd.com>
Reviewed-by: Monk Liu <monk.liu@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/gpu/drm/amd/amdgpu/amdgpu_psp.h | 1 +
drivers/gpu/drm/amd/amdgpu/psp_v11_0.c | 3 ++-
drivers/gpu/drm/amd/amdgpu/psp_v3_1.c | 3 ++-
3 files changed, 5 insertions(+), 2 deletions(-)
diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_psp.h b/drivers/gpu/drm/amd/amdgpu/amdgpu_psp.h
index 919d2fb7427b..60b7563f4c05 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_psp.h
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_psp.h
@@ -73,6 +73,7 @@ struct psp_ring
uint64_t ring_mem_mc_addr;
void *ring_mem_handle;
uint32_t ring_size;
+ uint32_t ring_wptr;
};
/* More registers may will be supported */
diff --git a/drivers/gpu/drm/amd/amdgpu/psp_v11_0.c b/drivers/gpu/drm/amd/amdgpu/psp_v11_0.c
index 6c5d9612abcb..cb764b554552 100644
--- a/drivers/gpu/drm/amd/amdgpu/psp_v11_0.c
+++ b/drivers/gpu/drm/amd/amdgpu/psp_v11_0.c
@@ -732,7 +732,7 @@ static uint32_t psp_v11_0_ring_get_wptr(struct psp_context *psp)
struct amdgpu_device *adev = psp->adev;
if (amdgpu_sriov_vf(adev))
- data = RREG32_SOC15(MP0, 0, mmMP0_SMN_C2PMSG_102);
+ data = psp->km_ring.ring_wptr;
else
data = RREG32_SOC15(MP0, 0, mmMP0_SMN_C2PMSG_67);
@@ -746,6 +746,7 @@ static void psp_v11_0_ring_set_wptr(struct psp_context *psp, uint32_t value)
if (amdgpu_sriov_vf(adev)) {
WREG32_SOC15(MP0, 0, mmMP0_SMN_C2PMSG_102, value);
WREG32_SOC15(MP0, 0, mmMP0_SMN_C2PMSG_101, GFX_CTRL_CMD_ID_CONSUME_CMD);
+ psp->km_ring.ring_wptr = value;
} else
WREG32_SOC15(MP0, 0, mmMP0_SMN_C2PMSG_67, value);
}
diff --git a/drivers/gpu/drm/amd/amdgpu/psp_v3_1.c b/drivers/gpu/drm/amd/amdgpu/psp_v3_1.c
index f2e725f72d2f..908664a5774b 100644
--- a/drivers/gpu/drm/amd/amdgpu/psp_v3_1.c
+++ b/drivers/gpu/drm/amd/amdgpu/psp_v3_1.c
@@ -379,7 +379,7 @@ static uint32_t psp_v3_1_ring_get_wptr(struct psp_context *psp)
struct amdgpu_device *adev = psp->adev;
if (amdgpu_sriov_vf(adev))
- data = RREG32_SOC15(MP0, 0, mmMP0_SMN_C2PMSG_102);
+ data = psp->km_ring.ring_wptr;
else
data = RREG32_SOC15(MP0, 0, mmMP0_SMN_C2PMSG_67);
return data;
@@ -394,6 +394,7 @@ static void psp_v3_1_ring_set_wptr(struct psp_context *psp, uint32_t value)
/* send interrupt to PSP for SRIOV ring write pointer update */
WREG32_SOC15(MP0, 0, mmMP0_SMN_C2PMSG_101,
GFX_CTRL_CMD_ID_CONSUME_CMD);
+ psp->km_ring.ring_wptr = value;
} else
WREG32_SOC15(MP0, 0, mmMP0_SMN_C2PMSG_67, value);
}
--
2.30.2
next prev parent reply other threads:[~2021-06-07 16:18 UTC|newest]
Thread overview: 39+ messages / expand[flat|nested] mbox.gz Atom feed top
2021-06-07 16:12 [PATCH AUTOSEL 5.10 01/39] net: ieee802154: fix null deref in parse dev addr Sasha Levin
2021-06-07 16:12 ` [PATCH AUTOSEL 5.10 02/39] HID: quirks: Set INCREMENT_USAGE_ON_DUPLICATE for Saitek X65 Sasha Levin
2021-06-07 16:12 ` [PATCH AUTOSEL 5.10 03/39] HID: a4tech: use A4_2WHEEL_MOUSE_HACK_B8 for A4TECH NB-95 Sasha Levin
2021-06-07 16:12 ` [PATCH AUTOSEL 5.10 04/39] HID: hid-input: add mapping for emoji picker key Sasha Levin
2021-06-07 16:12 ` [PATCH AUTOSEL 5.10 05/39] HID: hid-sensor-hub: Return error for hid_set_field() failure Sasha Levin
2021-06-07 16:12 ` [PATCH AUTOSEL 5.10 06/39] HID: quirks: Add quirk for Lenovo optical mouse Sasha Levin
2021-06-07 16:12 ` [PATCH AUTOSEL 5.10 07/39] HID: multitouch: set Stylus suffix for Stylus-application devices, too Sasha Levin
2021-06-07 16:12 ` [PATCH AUTOSEL 5.10 08/39] HID: Add BUS_VIRTUAL to hid_connect logging Sasha Levin
2021-06-07 16:12 ` [PATCH AUTOSEL 5.10 09/39] HID: usbhid: fix info leak in hid_submit_ctrl Sasha Levin
2021-06-07 16:12 ` [PATCH AUTOSEL 5.10 10/39] drm/tegra: sor: Do not leak runtime PM reference Sasha Levin
2021-06-07 16:12 ` [PATCH AUTOSEL 5.10 11/39] gpu: host1x: Split up client initalization and registration Sasha Levin
2021-06-07 16:12 ` [PATCH AUTOSEL 5.10 12/39] drm/tegra: sor: Fully initialize SOR before registration Sasha Levin
2021-06-07 16:12 ` [PATCH AUTOSEL 5.10 13/39] ARM: OMAP1: Fix use of possibly uninitialized irq variable Sasha Levin
2021-06-07 16:12 ` [PATCH AUTOSEL 5.10 14/39] ARM: OMAP2+: Fix build warning when mmc_omap is not built Sasha Levin
2021-06-07 16:12 ` [PATCH AUTOSEL 5.10 15/39] gfs2: Prevent direct-I/O write fallback errors from getting lost Sasha Levin
2021-06-07 16:12 ` [PATCH AUTOSEL 5.10 16/39] gfs2: fix a deadlock on withdraw-during-mount Sasha Levin
2021-06-07 16:12 ` [PATCH AUTOSEL 5.10 17/39] HID: gt683r: add missing MODULE_DEVICE_TABLE Sasha Levin
2021-06-07 16:12 ` [PATCH AUTOSEL 5.10 18/39] riscv: Use -mno-relax when using lld linker Sasha Levin
2021-06-07 16:12 ` [PATCH AUTOSEL 5.10 19/39] gfs2: Fix use-after-free in gfs2_glock_shrink_scan Sasha Levin
2021-06-07 16:12 ` [PATCH AUTOSEL 5.10 20/39] Bluetooth: use correct lock to prevent UAF of hdev object Sasha Levin
2021-06-07 16:13 ` [PATCH AUTOSEL 5.10 21/39] scsi: target: core: Fix warning on realtime kernels Sasha Levin
2021-06-07 16:13 ` [PATCH AUTOSEL 5.10 22/39] ethernet: myri10ge: Fix missing error code in myri10ge_probe() Sasha Levin
2021-06-07 16:13 ` [PATCH AUTOSEL 5.10 23/39] scsi: qedf: Do not put host in qedf_vport_create() unconditionally Sasha Levin
2021-06-07 16:13 ` [PATCH AUTOSEL 5.10 24/39] Bluetooth: Add a new USB ID for RTL8822CE Sasha Levin
2021-06-07 16:13 ` [PATCH AUTOSEL 5.10 25/39] scsi: scsi_devinfo: Add blacklist entry for HPE OPEN-V Sasha Levin
2021-06-07 16:13 ` [PATCH AUTOSEL 5.10 26/39] nvme-loop: reset queue count to 1 in nvme_loop_destroy_io_queues() Sasha Levin
2021-06-07 16:13 ` [PATCH AUTOSEL 5.10 27/39] nvme-loop: clear NVME_LOOP_Q_LIVE when nvme_loop_configure_admin_queue() fails Sasha Levin
2021-06-07 16:13 ` [PATCH AUTOSEL 5.10 28/39] nvme-loop: check for NVME_LOOP_Q_LIVE in nvme_loop_destroy_admin_queue() Sasha Levin
2021-06-07 16:13 ` [PATCH AUTOSEL 5.10 29/39] nvme-loop: do not warn for deleted controllers during reset Sasha Levin
2021-06-07 16:13 ` [PATCH AUTOSEL 5.10 30/39] net: ipconfig: Don't override command-line hostnames or domains Sasha Levin
2021-06-07 16:13 ` [PATCH AUTOSEL 5.10 31/39] drm/amd/display: Allow bandwidth validation for 0 streams Sasha Levin
2021-06-07 16:13 ` [PATCH AUTOSEL 5.10 32/39] drm/amdgpu: refine amdgpu_fru_get_product_info Sasha Levin
2021-06-07 16:13 ` [PATCH AUTOSEL 5.10 33/39] drm/amd/display: Fix overlay validation by considering cursors Sasha Levin
2021-06-07 16:13 ` [PATCH AUTOSEL 5.10 34/39] drm/amd/display: Fix potential memory leak in DMUB hw_init Sasha Levin
2021-06-07 16:13 ` Sasha Levin [this message]
2021-06-07 16:13 ` [PATCH AUTOSEL 5.10 36/39] rtnetlink: Fix missing error code in rtnl_bridge_notify() Sasha Levin
2021-06-07 16:13 ` [PATCH AUTOSEL 5.10 37/39] net/x25: Return the correct errno code Sasha Levin
2021-06-07 16:13 ` [PATCH AUTOSEL 5.10 38/39] net: " Sasha Levin
2021-06-07 16:13 ` [PATCH AUTOSEL 5.10 39/39] fib: " Sasha Levin
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20210607161318.3583636-35-sashal@kernel.org \
--to=sashal@kernel.org \
--cc=Jingwen.Chen2@amd.com \
--cc=Victor.Zhao@amd.com \
--cc=alexander.deucher@amd.com \
--cc=amd-gfx@lists.freedesktop.org \
--cc=dri-devel@lists.freedesktop.org \
--cc=linux-kernel@vger.kernel.org \
--cc=monk.liu@amd.com \
--cc=stable@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).