-----Original Message----- From: Thomas Zimmermann [mailto:tzimmermann@xxxxxxx] Sent: Tuesday, April 27, 2021 7:02 PM To: Kuo-Hsiang Chou <kuohsiang_chou@xxxxxxxxxxxxxx>; dri-devel@xxxxxxxxxxxxxxxxxxxxx; linux-kernel@xxxxxxxxxxxxxxx Subject: Re: [PATCH v5] drm/ast: Fixed CVE for DP501 Hi Thomas, Hi Am 21.04.21 um 10:58 schrieb KuoHsiang Chou: > [Bug][DP501] > If ASPEED P2A (PCI to AHB) bridge is disabled and disallowed for > CVE_2019_6260 item3, and then the monitor's EDID is unable read > through Parade DP501. > The reason is the DP501's FW is mapped to BMC addressing space rather > than Host addressing space. > The resolution is that using "pci_iomap_range()" maps to DP501's FW > that stored on the end of FB (Frame Buffer). > In this case, FrameBuffer reserves the last 2MB used for the image of > DP501. > Your patches are missing a short changelog, so that reviewers can see what changed between versions. Anyway, I merged your patch into drm-misc-next now. Thanks for the fix. Thanks, I must keep this rule about the short changelog. More generally speaking, the DP501 code needs a major refactoring. It's currently bolted onto the regular VGA connector code. It should rather be a separate connector or a DRM bridge. I always wanted to work on this, but don't have a device for testing. If I'd provide patches, would you be in a position to test them? NO, I can't. The patch was verified on AST2500+DP501 before, so the correctness of this patch is promised. But customer always requested to send the platform back after bug fixed. Now, no DP501 platform on my hand, but I try to convince custom to get the someone platform. Best Regards, Kuo-Hsiang Chou Best regards Thomas > Signed-off-by: KuoHsiang Chou <kuohsiang_chou@xxxxxxxxxxxxxx> > Reported-by: kernel test robot <lkp@xxxxxxxxx> > --- > drivers/gpu/drm/ast/ast_dp501.c | 139 +++++++++++++++++++++++--------- > drivers/gpu/drm/ast/ast_drv.h | 12 +++ > drivers/gpu/drm/ast/ast_main.c | 11 ++- > 3 files changed, 125 insertions(+), 37 deletions(-) > > diff --git a/drivers/gpu/drm/ast/ast_dp501.c > b/drivers/gpu/drm/ast/ast_dp501.c index 88121c0e0..cd93c44f2 100644 > --- a/drivers/gpu/drm/ast/ast_dp501.c > +++ b/drivers/gpu/drm/ast/ast_dp501.c > @@ -189,6 +189,9 @@ bool ast_backup_fw(struct drm_device *dev, u8 *addr, u32 size) > u32 i, data; > u32 boot_address; > > + if (ast->config_mode != ast_use_p2a) > + return false; > + > data = ast_mindwm(ast, 0x1e6e2100) & 0x01; > if (data) { > boot_address = get_fw_base(ast); > @@ -207,6 +210,9 @@ static bool ast_launch_m68k(struct drm_device *dev) > u8 *fw_addr = NULL; > u8 jreg; > > + if (ast->config_mode != ast_use_p2a) > + return false; > + > data = ast_mindwm(ast, 0x1e6e2100) & 0x01; > if (!data) { > > @@ -271,25 +277,55 @@ u8 ast_get_dp501_max_clk(struct drm_device *dev) > struct ast_private *ast = to_ast_private(dev); > u32 boot_address, offset, data; > u8 linkcap[4], linkrate, linklanes, maxclk = 0xff; > + u32 *plinkcap; > > - boot_address = get_fw_base(ast); > - > - /* validate FW version */ > - offset = 0xf000; > - data = ast_mindwm(ast, boot_address + offset); > - if ((data & 0xf0) != 0x10) /* version: 1x */ > - return maxclk; > - > - /* Read Link Capability */ > - offset = 0xf014; > - *(u32 *)linkcap = ast_mindwm(ast, boot_address + offset); > - if (linkcap[2] == 0) { > - linkrate = linkcap[0]; > - linklanes = linkcap[1]; > - data = (linkrate == 0x0a) ? (90 * linklanes) : (54 * linklanes); > - if (data > 0xff) > - data = 0xff; > - maxclk = (u8)data; > + if (ast->config_mode == ast_use_p2a) { > + boot_address = get_fw_base(ast); > + > + /* validate FW version */ > + offset = AST_DP501_GBL_VERSION; > + data = ast_mindwm(ast, boot_address + offset); > + if ((data & AST_DP501_FW_VERSION_MASK) != AST_DP501_FW_VERSION_1) /* version: 1x */ > + return maxclk; > + > + /* Read Link Capability */ > + offset = AST_DP501_LINKRATE; > + plinkcap = (u32 *)linkcap; > + *plinkcap = ast_mindwm(ast, boot_address + offset); > + if (linkcap[2] == 0) { > + linkrate = linkcap[0]; > + linklanes = linkcap[1]; > + data = (linkrate == 0x0a) ? (90 * linklanes) : (54 * linklanes); > + if (data > 0xff) > + data = 0xff; > + maxclk = (u8)data; > + } > + } else { > + if (!ast->dp501_fw_buf) > + return AST_DP501_DEFAULT_DCLK; /* 1024x768 as default */ > + > + /* dummy read */ > + offset = 0x0000; > + data = readl(ast->dp501_fw_buf + offset); > + > + /* validate FW version */ > + offset = AST_DP501_GBL_VERSION; > + data = readl(ast->dp501_fw_buf + offset); > + if ((data & AST_DP501_FW_VERSION_MASK) != AST_DP501_FW_VERSION_1) /* version: 1x */ > + return maxclk; > + > + /* Read Link Capability */ > + offset = AST_DP501_LINKRATE; > + plinkcap = (u32 *)linkcap; > + *plinkcap = readl(ast->dp501_fw_buf + offset); > + if (linkcap[2] == 0) { > + linkrate = linkcap[0]; > + linklanes = linkcap[1]; > + data = (linkrate == 0x0a) ? (90 * linklanes) : (54 * linklanes); > + if (data > 0xff) > + data = 0xff; > + maxclk = (u8)data; > + } > } > return maxclk; > } > @@ -298,26 +334,57 @@ bool ast_dp501_read_edid(struct drm_device *dev, u8 *ediddata) > { > struct ast_private *ast = to_ast_private(dev); > u32 i, boot_address, offset, data; > + u32 *pEDIDidx; > > - boot_address = get_fw_base(ast); > - > - /* validate FW version */ > - offset = 0xf000; > - data = ast_mindwm(ast, boot_address + offset); > - if ((data & 0xf0) != 0x10) > - return false; > - > - /* validate PnP Monitor */ > - offset = 0xf010; > - data = ast_mindwm(ast, boot_address + offset); > - if (!(data & 0x01)) > - return false; > + if (ast->config_mode == ast_use_p2a) { > + boot_address = get_fw_base(ast); > > - /* Read EDID */ > - offset = 0xf020; > - for (i = 0; i < 128; i += 4) { > - data = ast_mindwm(ast, boot_address + offset + i); > - *(u32 *)(ediddata + i) = data; > + /* validate FW version */ > + offset = AST_DP501_GBL_VERSION; > + data = ast_mindwm(ast, boot_address + offset); > + if ((data & AST_DP501_FW_VERSION_MASK) != AST_DP501_FW_VERSION_1) > + return false; > + > + /* validate PnP Monitor */ > + offset = AST_DP501_PNPMONITOR; > + data = ast_mindwm(ast, boot_address + offset); > + if (!(data & AST_DP501_PNP_CONNECTED)) > + return false; > + > + /* Read EDID */ > + offset = AST_DP501_EDID_DATA; > + for (i = 0; i < 128; i += 4) { > + data = ast_mindwm(ast, boot_address + offset + i); > + pEDIDidx = (u32 *)(ediddata + i); > + *pEDIDidx = data; > + } > + } else { > + if (!ast->dp501_fw_buf) > + return false; > + > + /* dummy read */ > + offset = 0x0000; > + data = readl(ast->dp501_fw_buf + offset); > + > + /* validate FW version */ > + offset = AST_DP501_GBL_VERSION; > + data = readl(ast->dp501_fw_buf + offset); > + if ((data & AST_DP501_FW_VERSION_MASK) != AST_DP501_FW_VERSION_1) > + return false; > + > + /* validate PnP Monitor */ > + offset = AST_DP501_PNPMONITOR; > + data = readl(ast->dp501_fw_buf + offset); > + if (!(data & AST_DP501_PNP_CONNECTED)) > + return false; > + > + /* Read EDID */ > + offset = AST_DP501_EDID_DATA; > + for (i = 0; i < 128; i += 4) { > + data = readl(ast->dp501_fw_buf + offset + i); > + pEDIDidx = (u32 *)(ediddata + i); > + *pEDIDidx = data; > + } > } > > return true; > diff --git a/drivers/gpu/drm/ast/ast_drv.h > b/drivers/gpu/drm/ast/ast_drv.h index e82ab8628..911f9f414 100644 > --- a/drivers/gpu/drm/ast/ast_drv.h > +++ b/drivers/gpu/drm/ast/ast_drv.h > @@ -150,6 +150,7 @@ struct ast_private { > > void __iomem *regs; > void __iomem *ioregs; > + void __iomem *dp501_fw_buf; > > enum ast_chip chip; > bool vga2_clone; > @@ -325,6 +326,17 @@ int ast_mode_config_init(struct ast_private *ast); > #define AST_MM_ALIGN_SHIFT 4 > #define AST_MM_ALIGN_MASK ((1 << AST_MM_ALIGN_SHIFT) - 1) > > +#define AST_DP501_FW_VERSION_MASK GENMASK(7, 4) > +#define AST_DP501_FW_VERSION_1 BIT(4) > +#define AST_DP501_PNP_CONNECTED BIT(1) > + > +#define AST_DP501_DEFAULT_DCLK 65 > + > +#define AST_DP501_GBL_VERSION 0xf000 > +#define AST_DP501_PNPMONITOR 0xf010 > +#define AST_DP501_LINKRATE 0xf014 > +#define AST_DP501_EDID_DATA 0xf020 > + > int ast_mm_init(struct ast_private *ast); > > /* ast post */ > diff --git a/drivers/gpu/drm/ast/ast_main.c > b/drivers/gpu/drm/ast/ast_main.c index 0ac3c2039..3976a2587 100644 > --- a/drivers/gpu/drm/ast/ast_main.c > +++ b/drivers/gpu/drm/ast/ast_main.c > @@ -99,7 +99,7 @@ static void ast_detect_config_mode(struct drm_device *dev, u32 *scu_rev) > if (!(jregd0 & 0x80) || !(jregd1 & 0x10)) { > /* Double check it's actually working */ > data = ast_read32(ast, 0xf004); > - if (data != 0xFFFFFFFF) { > + if ((data != 0xFFFFFFFF) && (data != 0x00)) { > /* P2A works, grab silicon revision */ > ast->config_mode = ast_use_p2a; > > @@ -411,6 +411,7 @@ struct ast_private *ast_device_create(const struct drm_driver *drv, > return ast; > dev = &ast->base; > > + dev->pdev = pdev; > pci_set_drvdata(pdev, dev); > > ast->regs = pci_iomap(pdev, 1, 0); > @@ -450,6 +451,14 @@ struct ast_private *ast_device_create(const > struct drm_driver *drv, > if (ret) > return ERR_PTR(ret); > > + /* map reserved buffer */ > + ast->dp501_fw_buf = NULL; > + if (dev->vram_mm->vram_size < pci_resource_len(dev->pdev, 0)) { > + ast->dp501_fw_buf = pci_iomap_range(dev->pdev, 0, dev->vram_mm->vram_size, 0); > + if (!ast->dp501_fw_buf) > + drm_info(dev, "failed to map reserved buffer!\n"); > + } > + > ret = ast_mode_config_init(ast); > if (ret) > return ERR_PTR(ret); > -- > 2.18.4 > > _______________________________________________ > dri-devel mailing list > dri-devel@xxxxxxxxxxxxxxxxxxxxx > https://lists.freedesktop.org/mailman/listinfo/dri-devel > -- Thomas Zimmermann Graphics Driver Developer SUSE Software Solutions Germany GmbH Maxfeldstr. 5, 90409 Nürnberg, Germany (HRB 36809, AG Nürnberg) Geschäftsführer: Felix Imendörffer _______________________________________________ dri-devel mailing list dri-devel@xxxxxxxxxxxxxxxxxxxxx https://lists.freedesktop.org/mailman/listinfo/dri-devel
