| Message ID | 20200915140702.187099911@linuxfoundation.org |
|---|---|
| State | New |
| Headers | show |
| Series | None | expand |
On Tue, Sep 15, 2020 at 04:14:08PM +0200, Greg Kroah-Hartman wrote: > From: Jordan Crouse <jcrouse@codeaurora.org> > > [ Upstream commit 604234f33658cdd72f686be405a99646b397d0b3 ] > > a650 supports expanded apriv support that allows us to map critical buffers > (ringbuffer and memstore) as as privileged to protect them from corruption. > > Cc: stable@vger.kernel.org > Signed-off-by: Jordan Crouse <jcrouse@codeaurora.org> > Signed-off-by: Rob Clark <robdclark@chromium.org> > Signed-off-by: Sasha Levin <sashal@kernel.org> Hi. A bug was reported in this patch with a fix just posted to the list [1]. Since the RPTR shadow is being disabled universally by f6828e0c4045 ("drm/msm: Disable the RPTR shadow") that will address the security concern and we won't need the extra protection from this patch. I suggest that you drop it for the stable trees and we can merge the fix into 5.9 to re-enable APRIV for newer kernels. [1] https://lists.freedesktop.org/archives/freedreno/2020-September/008376.html Jordan > --- > drivers/gpu/drm/msm/adreno/a6xx_gpu.c | 6 +++++- > drivers/gpu/drm/msm/msm_gpu.c | 2 +- > drivers/gpu/drm/msm/msm_gpu.h | 11 +++++++++++ > drivers/gpu/drm/msm/msm_ringbuffer.c | 4 ++-- > 4 files changed, 19 insertions(+), 4 deletions(-) > > diff --git a/drivers/gpu/drm/msm/adreno/a6xx_gpu.c b/drivers/gpu/drm/msm/adreno/a6xx_gpu.c > index b7dc350d96fc8..ee99cdeb449ca 100644 > --- a/drivers/gpu/drm/msm/adreno/a6xx_gpu.c > +++ b/drivers/gpu/drm/msm/adreno/a6xx_gpu.c > @@ -541,7 +541,8 @@ static int a6xx_hw_init(struct msm_gpu *gpu) > A6XX_PROTECT_RDONLY(0x980, 0x4)); > gpu_write(gpu, REG_A6XX_CP_PROTECT(25), A6XX_PROTECT_RW(0xa630, 0x0)); > > - if (adreno_is_a650(adreno_gpu)) { > + /* Enable expanded apriv for targets that support it */ > + if (gpu->hw_apriv) { > gpu_write(gpu, REG_A6XX_CP_APRIV_CNTL, > (1 << 6) | (1 << 5) | (1 << 3) | (1 << 2) | (1 << 1)); > } > @@ -926,6 +927,9 @@ struct msm_gpu *a6xx_gpu_init(struct drm_device *dev) > adreno_gpu->registers = NULL; > adreno_gpu->reg_offsets = a6xx_register_offsets; > > + if (adreno_is_a650(adreno_gpu)) > + adreno_gpu->base.hw_apriv = true; > + > ret = adreno_gpu_init(dev, pdev, adreno_gpu, &funcs, 1); > if (ret) { > a6xx_destroy(&(a6xx_gpu->base.base)); > diff --git a/drivers/gpu/drm/msm/msm_gpu.c b/drivers/gpu/drm/msm/msm_gpu.c > index a22d306223068..9b839d6f4692a 100644 > --- a/drivers/gpu/drm/msm/msm_gpu.c > +++ b/drivers/gpu/drm/msm/msm_gpu.c > @@ -905,7 +905,7 @@ int msm_gpu_init(struct drm_device *drm, struct platform_device *pdev, > > memptrs = msm_gem_kernel_new(drm, > sizeof(struct msm_rbmemptrs) * nr_rings, > - MSM_BO_UNCACHED, gpu->aspace, &gpu->memptrs_bo, > + check_apriv(gpu, MSM_BO_UNCACHED), gpu->aspace, &gpu->memptrs_bo, > &memptrs_iova); > > if (IS_ERR(memptrs)) { > diff --git a/drivers/gpu/drm/msm/msm_gpu.h b/drivers/gpu/drm/msm/msm_gpu.h > index 429cb40f79315..f22e0f67ba40e 100644 > --- a/drivers/gpu/drm/msm/msm_gpu.h > +++ b/drivers/gpu/drm/msm/msm_gpu.h > @@ -14,6 +14,7 @@ > #include "msm_drv.h" > #include "msm_fence.h" > #include "msm_ringbuffer.h" > +#include "msm_gem.h" > > struct msm_gem_submit; > struct msm_gpu_perfcntr; > @@ -138,6 +139,8 @@ struct msm_gpu { > } devfreq; > > struct msm_gpu_state *crashstate; > + /* True if the hardware supports expanded apriv (a650 and newer) */ > + bool hw_apriv; > }; > > /* It turns out that all targets use the same ringbuffer size */ > @@ -326,4 +329,12 @@ static inline void msm_gpu_crashstate_put(struct msm_gpu *gpu) > mutex_unlock(&gpu->dev->struct_mutex); > } > > +/* > + * Simple macro to semi-cleanly add the MAP_PRIV flag for targets that can > + * support expanded privileges > + */ > +#define check_apriv(gpu, flags) \ > + (((gpu)->hw_apriv ? MSM_BO_MAP_PRIV : 0) | (flags)) > + > + > #endif /* __MSM_GPU_H__ */ > diff --git a/drivers/gpu/drm/msm/msm_ringbuffer.c b/drivers/gpu/drm/msm/msm_ringbuffer.c > index 39ecb5a18431e..935bf9b1d9418 100644 > --- a/drivers/gpu/drm/msm/msm_ringbuffer.c > +++ b/drivers/gpu/drm/msm/msm_ringbuffer.c > @@ -27,8 +27,8 @@ struct msm_ringbuffer *msm_ringbuffer_new(struct msm_gpu *gpu, int id, > ring->id = id; > > ring->start = msm_gem_kernel_new(gpu->dev, MSM_GPU_RINGBUFFER_SZ, > - MSM_BO_WC | MSM_BO_GPU_READONLY, gpu->aspace, &ring->bo, > - &ring->iova); > + check_apriv(gpu, MSM_BO_WC | MSM_BO_GPU_READONLY), > + gpu->aspace, &ring->bo, &ring->iova); > > if (IS_ERR(ring->start)) { > ret = PTR_ERR(ring->start); > -- > 2.25.1 > > >
diff --git a/drivers/gpu/drm/msm/adreno/a6xx_gpu.c b/drivers/gpu/drm/msm/adreno/a6xx_gpu.c index b7dc350d96fc8..ee99cdeb449ca 100644 --- a/drivers/gpu/drm/msm/adreno/a6xx_gpu.c +++ b/drivers/gpu/drm/msm/adreno/a6xx_gpu.c @@ -541,7 +541,8 @@ static int a6xx_hw_init(struct msm_gpu *gpu) A6XX_PROTECT_RDONLY(0x980, 0x4)); gpu_write(gpu, REG_A6XX_CP_PROTECT(25), A6XX_PROTECT_RW(0xa630, 0x0)); - if (adreno_is_a650(adreno_gpu)) { + /* Enable expanded apriv for targets that support it */ + if (gpu->hw_apriv) { gpu_write(gpu, REG_A6XX_CP_APRIV_CNTL, (1 << 6) | (1 << 5) | (1 << 3) | (1 << 2) | (1 << 1)); } @@ -926,6 +927,9 @@ struct msm_gpu *a6xx_gpu_init(struct drm_device *dev) adreno_gpu->registers = NULL; adreno_gpu->reg_offsets = a6xx_register_offsets; + if (adreno_is_a650(adreno_gpu)) + adreno_gpu->base.hw_apriv = true; + ret = adreno_gpu_init(dev, pdev, adreno_gpu, &funcs, 1); if (ret) { a6xx_destroy(&(a6xx_gpu->base.base)); diff --git a/drivers/gpu/drm/msm/msm_gpu.c b/drivers/gpu/drm/msm/msm_gpu.c index a22d306223068..9b839d6f4692a 100644 --- a/drivers/gpu/drm/msm/msm_gpu.c +++ b/drivers/gpu/drm/msm/msm_gpu.c @@ -905,7 +905,7 @@ int msm_gpu_init(struct drm_device *drm, struct platform_device *pdev, memptrs = msm_gem_kernel_new(drm, sizeof(struct msm_rbmemptrs) * nr_rings, - MSM_BO_UNCACHED, gpu->aspace, &gpu->memptrs_bo, + check_apriv(gpu, MSM_BO_UNCACHED), gpu->aspace, &gpu->memptrs_bo, &memptrs_iova); if (IS_ERR(memptrs)) { diff --git a/drivers/gpu/drm/msm/msm_gpu.h b/drivers/gpu/drm/msm/msm_gpu.h index 429cb40f79315..f22e0f67ba40e 100644 --- a/drivers/gpu/drm/msm/msm_gpu.h +++ b/drivers/gpu/drm/msm/msm_gpu.h @@ -14,6 +14,7 @@ #include "msm_drv.h" #include "msm_fence.h" #include "msm_ringbuffer.h" +#include "msm_gem.h" struct msm_gem_submit; struct msm_gpu_perfcntr; @@ -138,6 +139,8 @@ struct msm_gpu { } devfreq; struct msm_gpu_state *crashstate; + /* True if the hardware supports expanded apriv (a650 and newer) */ + bool hw_apriv; }; /* It turns out that all targets use the same ringbuffer size */ @@ -326,4 +329,12 @@ static inline void msm_gpu_crashstate_put(struct msm_gpu *gpu) mutex_unlock(&gpu->dev->struct_mutex); } +/* + * Simple macro to semi-cleanly add the MAP_PRIV flag for targets that can + * support expanded privileges + */ +#define check_apriv(gpu, flags) \ + (((gpu)->hw_apriv ? MSM_BO_MAP_PRIV : 0) | (flags)) + + #endif /* __MSM_GPU_H__ */ diff --git a/drivers/gpu/drm/msm/msm_ringbuffer.c b/drivers/gpu/drm/msm/msm_ringbuffer.c index 39ecb5a18431e..935bf9b1d9418 100644 --- a/drivers/gpu/drm/msm/msm_ringbuffer.c +++ b/drivers/gpu/drm/msm/msm_ringbuffer.c @@ -27,8 +27,8 @@ struct msm_ringbuffer *msm_ringbuffer_new(struct msm_gpu *gpu, int id, ring->id = id; ring->start = msm_gem_kernel_new(gpu->dev, MSM_GPU_RINGBUFFER_SZ, - MSM_BO_WC | MSM_BO_GPU_READONLY, gpu->aspace, &ring->bo, - &ring->iova); + check_apriv(gpu, MSM_BO_WC | MSM_BO_GPU_READONLY), + gpu->aspace, &ring->bo, &ring->iova); if (IS_ERR(ring->start)) { ret = PTR_ERR(ring->start);