On Tue, Sep 15, 2020 at 04:13:53PM +0200, Greg Kroah-Hartman wrote:
> From: Jordan Crouse <jcrouse@xxxxxxxxxxxxxx>
>
> [ Upstream commit 604234f33658cdd72f686be405a99646b397d0b3 ]
>
> a650 supports expanded apriv support that allows us to map critical buffers
> (ringbuffer and memstore) as as privileged to protect them from corruption.
>
> Cc: stable@xxxxxxxxxxxxxxx
> Signed-off-by: Jordan Crouse <jcrouse@xxxxxxxxxxxxxx>
> Signed-off-by: Rob Clark <robdclark@xxxxxxxxxxxx>
> Signed-off-by: Sasha Levin <sashal@xxxxxxxxxx>
Hi. A bug was reported in this patch with a fix just posted to the list [1].
Since the RPTR shadow is being disabled universally by f6828e0c4045 ("drm/msm:
Disable the RPTR shadow") that will address the security concern and we won't
need the extra protection from this patch. I suggest that you drop it for the
stable trees and we can merge the fix into 5.9 to re-enable APRIV for newer
kernels.
Jordan
> ---
> drivers/gpu/drm/msm/adreno/a6xx_gpu.c | 6 +++++-
> drivers/gpu/drm/msm/msm_gpu.c | 2 +-
> drivers/gpu/drm/msm/msm_gpu.h | 11 +++++++++++
> drivers/gpu/drm/msm/msm_ringbuffer.c | 4 ++--
> 4 files changed, 19 insertions(+), 4 deletions(-)
>
> diff --git a/drivers/gpu/drm/msm/adreno/a6xx_gpu.c b/drivers/gpu/drm/msm/adreno/a6xx_gpu.c
> index c3a81594f4fb7..ea073cd9d248e 100644
> --- a/drivers/gpu/drm/msm/adreno/a6xx_gpu.c
> +++ b/drivers/gpu/drm/msm/adreno/a6xx_gpu.c
> @@ -533,7 +533,8 @@ static int a6xx_hw_init(struct msm_gpu *gpu)
> A6XX_PROTECT_RDONLY(0x980, 0x4));
> gpu_write(gpu, REG_A6XX_CP_PROTECT(25), A6XX_PROTECT_RW(0xa630, 0x0));
>
> - if (adreno_is_a650(adreno_gpu)) {
> + /* Enable expanded apriv for targets that support it */
> + if (gpu->hw_apriv) {
> gpu_write(gpu, REG_A6XX_CP_APRIV_CNTL,
> (1 << 6) | (1 << 5) | (1 << 3) | (1 << 2) | (1 << 1));
> }
> @@ -908,6 +909,9 @@ struct msm_gpu *a6xx_gpu_init(struct drm_device *dev)
> adreno_gpu->registers = NULL;
> adreno_gpu->reg_offsets = a6xx_register_offsets;
>
> + if (adreno_is_a650(adreno_gpu))
> + adreno_gpu->base.hw_apriv = true;
> +
> ret = adreno_gpu_init(dev, pdev, adreno_gpu, &funcs, 1);
> if (ret) {
> a6xx_destroy(&(a6xx_gpu->base.base));
> diff --git a/drivers/gpu/drm/msm/msm_gpu.c b/drivers/gpu/drm/msm/msm_gpu.c
> index edd45f434ccd6..8653a2f7ae1c9 100644
> --- a/drivers/gpu/drm/msm/msm_gpu.c
> +++ b/drivers/gpu/drm/msm/msm_gpu.c
> @@ -932,7 +932,7 @@ int msm_gpu_init(struct drm_device *drm, struct platform_device *pdev,
>
> memptrs = msm_gem_kernel_new(drm,
> sizeof(struct msm_rbmemptrs) * nr_rings,
> - MSM_BO_UNCACHED, gpu->aspace, &gpu->memptrs_bo,
> + check_apriv(gpu, MSM_BO_UNCACHED), gpu->aspace, &gpu->memptrs_bo,
> &memptrs_iova);
>
> if (IS_ERR(memptrs)) {
> diff --git a/drivers/gpu/drm/msm/msm_gpu.h b/drivers/gpu/drm/msm/msm_gpu.h
> index ab8f0f9c9dc88..15254239e5ec6 100644
> --- a/drivers/gpu/drm/msm/msm_gpu.h
> +++ b/drivers/gpu/drm/msm/msm_gpu.h
> @@ -14,6 +14,7 @@
> #include "msm_drv.h"
> #include "msm_fence.h"
> #include "msm_ringbuffer.h"
> +#include "msm_gem.h"
>
> struct msm_gem_submit;
> struct msm_gpu_perfcntr;
> @@ -131,6 +132,8 @@ struct msm_gpu {
> } devfreq;
>
> struct msm_gpu_state *crashstate;
> + /* True if the hardware supports expanded apriv (a650 and newer) */
> + bool hw_apriv;
> };
>
> /* It turns out that all targets use the same ringbuffer size */
> @@ -319,4 +322,12 @@ static inline void msm_gpu_crashstate_put(struct msm_gpu *gpu)
> mutex_unlock(&gpu->dev->struct_mutex);
> }
>
> +/*
> + * Simple macro to semi-cleanly add the MAP_PRIV flag for targets that can
> + * support expanded privileges
> + */
> +#define check_apriv(gpu, flags) \
> + (((gpu)->hw_apriv ? MSM_BO_MAP_PRIV : 0) | (flags))
> +
> +
> #endif /* __MSM_GPU_H__ */
> diff --git a/drivers/gpu/drm/msm/msm_ringbuffer.c b/drivers/gpu/drm/msm/msm_ringbuffer.c
> index 39ecb5a18431e..935bf9b1d9418 100644
> --- a/drivers/gpu/drm/msm/msm_ringbuffer.c
> +++ b/drivers/gpu/drm/msm/msm_ringbuffer.c
> @@ -27,8 +27,8 @@ struct msm_ringbuffer *msm_ringbuffer_new(struct msm_gpu *gpu, int id,
> ring->id = id;
>
> ring->start = msm_gem_kernel_new(gpu->dev, MSM_GPU_RINGBUFFER_SZ,
> - MSM_BO_WC | MSM_BO_GPU_READONLY, gpu->aspace, &ring->bo,
> - &ring->iova);
> + check_apriv(gpu, MSM_BO_WC | MSM_BO_GPU_READONLY),
> + gpu->aspace, &ring->bo, &ring->iova);
>
> if (IS_ERR(ring->start)) {
> ret = PTR_ERR(ring->start);
> --
> 2.25.1
>
>
>
--
The Qualcomm Innovation Center, Inc. is a member of Code Aurora Forum,
a Linux Foundation Collaborative Project
