Unverified Commit aa5390b9 authored by openeuler-ci-bot's avatar openeuler-ci-bot Committed by Gitee
Browse files

!10352 fix CVE-2024-40976 

Merge Pull Request from: @ci-robot 
 
PR sync from: Jinjiang Tu <tujinjiang@huawei.com>
https://mailweb.openeuler.org/hyperkitty/list/kernel@openeuler.org/message/TCRY3T5EAA55DIWQIJK3XYSWNNMU4JPO/ 
fix CVE-2024-40976.

Erico Nunes (2):
  drm/lima: add mask irq callback to gp and pp
  drm/lima: mask irqs in timeout path before hard reset


-- 
2.25.1
 
https://gitee.com/src-openeuler/kernel/issues/IACV6I 
 
Link:https://gitee.com/openeuler/kernel/pulls/10352

 

Reviewed-by: default avatarYang Yingliang <yangyingliang@huawei.com>
Signed-off-by: default avatarYang Yingliang <yangyingliang@huawei.com>
parents 1f5fe404 6c011a5c

drivers/gpu/drm/lima/lima_bcast.c

+12 −0
Original line number Diff line number Diff line
@@ -43,6 +43,18 @@ void lima_bcast_suspend(struct lima_ip *ip) 


}



int lima_bcast_mask_irq(struct lima_ip *ip)

{

	bcast_write(LIMA_BCAST_BROADCAST_MASK, 0);

	bcast_write(LIMA_BCAST_INTERRUPT_MASK, 0);

	return 0;

}



int lima_bcast_reset(struct lima_ip *ip)

{

	return lima_bcast_hw_init(ip);

}



int lima_bcast_init(struct lima_ip *ip)

{

	int i;

drivers/gpu/drm/lima/lima_bcast.h

+3 −0
Original line number Diff line number Diff line
@@ -13,4 +13,7 @@ void lima_bcast_fini(struct lima_ip *ip); 


void lima_bcast_enable(struct lima_device *dev, int num_pp);



int lima_bcast_mask_irq(struct lima_ip *ip);

int lima_bcast_reset(struct lima_ip *ip);



#endif

drivers/gpu/drm/lima/lima_gp.c

+8 −0
Original line number Diff line number Diff line
@@ -212,6 +212,13 @@ static void lima_gp_task_mmu_error(struct lima_sched_pipe *pipe) 
	lima_sched_pipe_task_done(pipe);

}



static void lima_gp_task_mask_irq(struct lima_sched_pipe *pipe)

{

	struct lima_ip *ip = pipe->processor[0];



	gp_write(LIMA_GP_INT_MASK, 0);

}



static int lima_gp_task_recover(struct lima_sched_pipe *pipe)

{

	struct lima_ip *ip = pipe->processor[0];
@@ -344,6 +351,7 @@ int lima_gp_pipe_init(struct lima_device *dev) 
	pipe->task_error = lima_gp_task_error;

	pipe->task_mmu_error = lima_gp_task_mmu_error;

	pipe->task_recover = lima_gp_task_recover;

	pipe->task_mask_irq = lima_gp_task_mask_irq;



	return 0;

}

drivers/gpu/drm/lima/lima_pp.c

+18 −0
Original line number Diff line number Diff line
@@ -408,6 +408,9 @@ static void lima_pp_task_error(struct lima_sched_pipe *pipe) 


		lima_pp_hard_reset(ip);

	}



	if (pipe->bcast_processor)

		lima_bcast_reset(pipe->bcast_processor);

}



static void lima_pp_task_mmu_error(struct lima_sched_pipe *pipe)
@@ -416,6 +419,20 @@ static void lima_pp_task_mmu_error(struct lima_sched_pipe *pipe) 
		lima_sched_pipe_task_done(pipe);

}



static void lima_pp_task_mask_irq(struct lima_sched_pipe *pipe)

{

	int i;



	for (i = 0; i < pipe->num_processor; i++) {

		struct lima_ip *ip = pipe->processor[i];



		pp_write(LIMA_PP_INT_MASK, 0);

	}



	if (pipe->bcast_processor)

		lima_bcast_mask_irq(pipe->bcast_processor);

}



static struct kmem_cache *lima_pp_task_slab;

static int lima_pp_task_slab_refcnt;
@@ -447,6 +464,7 @@ int lima_pp_pipe_init(struct lima_device *dev) 
	pipe->task_fini = lima_pp_task_fini;

	pipe->task_error = lima_pp_task_error;

	pipe->task_mmu_error = lima_pp_task_mmu_error;

	pipe->task_mask_irq = lima_pp_task_mask_irq;



	return 0;

}

drivers/gpu/drm/lima/lima_sched.c

+7 −0
Original line number Diff line number Diff line
@@ -419,6 +419,13 @@ static void lima_sched_timedout_job(struct drm_sched_job *job) 
	struct lima_sched_task *task = to_lima_task(job);

	struct lima_device *ldev = pipe->ldev;



	/*

	 * The task might still finish while this timeout handler runs.

	 * To prevent a race condition on its completion, mask all irqs

	 * on the running core until the next hard reset completes.

	 */

	pipe->task_mask_irq(pipe);



	if (!pipe->error)

		DRM_ERROR("lima job timeout\n");