On Tue, Sep 15, 2020 at 04:14:08PM +0200, Greg Kroah-Hartman wrote:
From: Jordan Crouse jcrouse@codeaurora.org
[ Upstream commit 604234f33658cdd72f686be405a99646b397d0b3 ]
a650 supports expanded apriv support that allows us to map critical buffers (ringbuffer and memstore) as as privileged to protect them from corruption.
Cc: stable@vger.kernel.org Signed-off-by: Jordan Crouse jcrouse@codeaurora.org Signed-off-by: Rob Clark robdclark@chromium.org Signed-off-by: Sasha Levin sashal@kernel.org
Hi. A bug was reported in this patch with a fix just posted to the list [1]. Since the RPTR shadow is being disabled universally by f6828e0c4045 ("drm/msm: Disable the RPTR shadow") that will address the security concern and we won't need the extra protection from this patch. I suggest that you drop it for the stable trees and we can merge the fix into 5.9 to re-enable APRIV for newer kernels.
[1] https://lists.freedesktop.org/archives/freedreno/2020-September/008376.html
Jordan
drivers/gpu/drm/msm/adreno/a6xx_gpu.c | 6 +++++- drivers/gpu/drm/msm/msm_gpu.c | 2 +- drivers/gpu/drm/msm/msm_gpu.h | 11 +++++++++++ drivers/gpu/drm/msm/msm_ringbuffer.c | 4 ++-- 4 files changed, 19 insertions(+), 4 deletions(-)
diff --git a/drivers/gpu/drm/msm/adreno/a6xx_gpu.c b/drivers/gpu/drm/msm/adreno/a6xx_gpu.c index b7dc350d96fc8..ee99cdeb449ca 100644 --- a/drivers/gpu/drm/msm/adreno/a6xx_gpu.c +++ b/drivers/gpu/drm/msm/adreno/a6xx_gpu.c @@ -541,7 +541,8 @@ static int a6xx_hw_init(struct msm_gpu *gpu) A6XX_PROTECT_RDONLY(0x980, 0x4)); gpu_write(gpu, REG_A6XX_CP_PROTECT(25), A6XX_PROTECT_RW(0xa630, 0x0));
- if (adreno_is_a650(adreno_gpu)) {
- /* Enable expanded apriv for targets that support it */
- if (gpu->hw_apriv) { gpu_write(gpu, REG_A6XX_CP_APRIV_CNTL, (1 << 6) | (1 << 5) | (1 << 3) | (1 << 2) | (1 << 1)); }
@@ -926,6 +927,9 @@ struct msm_gpu *a6xx_gpu_init(struct drm_device *dev) adreno_gpu->registers = NULL; adreno_gpu->reg_offsets = a6xx_register_offsets;
- if (adreno_is_a650(adreno_gpu))
adreno_gpu->base.hw_apriv = true;- ret = adreno_gpu_init(dev, pdev, adreno_gpu, &funcs, 1); if (ret) { a6xx_destroy(&(a6xx_gpu->base.base));
diff --git a/drivers/gpu/drm/msm/msm_gpu.c b/drivers/gpu/drm/msm/msm_gpu.c index a22d306223068..9b839d6f4692a 100644 --- a/drivers/gpu/drm/msm/msm_gpu.c +++ b/drivers/gpu/drm/msm/msm_gpu.c @@ -905,7 +905,7 @@ int msm_gpu_init(struct drm_device *drm, struct platform_device *pdev, memptrs = msm_gem_kernel_new(drm, sizeof(struct msm_rbmemptrs) * nr_rings,
MSM_BO_UNCACHED, gpu->aspace, &gpu->memptrs_bo,
check_apriv(gpu, MSM_BO_UNCACHED), gpu->aspace, &gpu->memptrs_bo,if (IS_ERR(memptrs)) { diff --git a/drivers/gpu/drm/msm/msm_gpu.h b/drivers/gpu/drm/msm/msm_gpu.h index 429cb40f79315..f22e0f67ba40e 100644 --- a/drivers/gpu/drm/msm/msm_gpu.h +++ b/drivers/gpu/drm/msm/msm_gpu.h @@ -14,6 +14,7 @@ #include "msm_drv.h" #include "msm_fence.h" #include "msm_ringbuffer.h" +#include "msm_gem.h" struct msm_gem_submit; struct msm_gpu_perfcntr; @@ -138,6 +139,8 @@ struct msm_gpu { } devfreq; struct msm_gpu_state *crashstate;
- /* True if the hardware supports expanded apriv (a650 and newer) */
- bool hw_apriv;
}; /* It turns out that all targets use the same ringbuffer size */ @@ -326,4 +329,12 @@ static inline void msm_gpu_crashstate_put(struct msm_gpu *gpu) mutex_unlock(&gpu->dev->struct_mutex); } +/*
- Simple macro to semi-cleanly add the MAP_PRIV flag for targets that can
- support expanded privileges
- */
+#define check_apriv(gpu, flags) \
- (((gpu)->hw_apriv ? MSM_BO_MAP_PRIV : 0) | (flags))
#endif /* __MSM_GPU_H__ */ diff --git a/drivers/gpu/drm/msm/msm_ringbuffer.c b/drivers/gpu/drm/msm/msm_ringbuffer.c index 39ecb5a18431e..935bf9b1d9418 100644 --- a/drivers/gpu/drm/msm/msm_ringbuffer.c +++ b/drivers/gpu/drm/msm/msm_ringbuffer.c @@ -27,8 +27,8 @@ struct msm_ringbuffer *msm_ringbuffer_new(struct msm_gpu *gpu, int id, ring->id = id; ring->start = msm_gem_kernel_new(gpu->dev, MSM_GPU_RINGBUFFER_SZ,
MSM_BO_WC | MSM_BO_GPU_READONLY, gpu->aspace, &ring->bo,&ring->iova);
check_apriv(gpu, MSM_BO_WC | MSM_BO_GPU_READONLY),gpu->aspace, &ring->bo, &ring->iova);if (IS_ERR(ring->start)) { ret = PTR_ERR(ring->start); -- 2.25.1