Commit f89f8c6b authored by Andrey Grodzovsky's avatar Andrey Grodzovsky
Browse files

drm/amdgpu: Guard against write accesses after device removal 



This should prevent writing to memory or IO ranges possibly
already allocated for other uses after our device is removed.

v5:
Protect more places wher memcopy_to/form_io takes place
Protect IB submissions

v6: Switch to !drm_dev_enter instead of scoping entire code
with brackets.

v7:
Drop guard of HW ring commands emission protection since they
are in GART and not in MMIO.

Signed-off-by: default avatarAndrey Grodzovsky <andrey.grodzovsky@amd.com>
Reviewed-by: default avatarAlex Deucher <alexander.deucher@amd.com>
Link: https://patchwork.freedesktop.org/patch/msgid/20210512142648.666476-10-andrey.grodzovsky@amd.com
parent 35bba831

drivers/gpu/drm/amd/amdgpu/amdgpu_device.c

+9 −1
Original line number Diff line number Diff line
@@ -71,6 +71,8 @@ 
#include <drm/task_barrier.h>

#include <linux/pm_runtime.h>



#include <drm/drm_drv.h>



MODULE_FIRMWARE("amdgpu/vega10_gpu_info.bin");

MODULE_FIRMWARE("amdgpu/vega12_gpu_info.bin");

MODULE_FIRMWARE("amdgpu/raven_gpu_info.bin");
@@ -281,7 +283,10 @@ void amdgpu_device_vram_access(struct amdgpu_device *adev, loff_t pos, 
	unsigned long flags;

	uint32_t hi = ~0;

	uint64_t last;

	int idx;



	if (!drm_dev_enter(&adev->ddev, &idx))

		return;



#ifdef CONFIG_64BIT

	last = min(pos + size, adev->gmc.visible_vram_size);
@@ -300,7 +305,7 @@ void amdgpu_device_vram_access(struct amdgpu_device *adev, loff_t pos, 
		}



		if (count == size)

			return;

			goto exit;



		pos += count;

		buf += count / 4;
@@ -323,6 +328,9 @@ void amdgpu_device_vram_access(struct amdgpu_device *adev, loff_t pos, 
			*buf++ = RREG32_NO_KIQ(mmMM_DATA);

	}

	spin_unlock_irqrestore(&adev->mmio_idx_lock, flags);



exit:

	drm_dev_exit(idx);

}



/*

drivers/gpu/drm/amd/amdgpu/amdgpu_gmc.c

+9 −0
Original line number Diff line number Diff line
@@ -31,6 +31,8 @@ 
#include "amdgpu_ras.h"

#include "amdgpu_xgmi.h"



#include <drm/drm_drv.h>



/**

 * amdgpu_gmc_pdb0_alloc - allocate vram for pdb0

 *
@@ -151,6 +153,10 @@ int amdgpu_gmc_set_pte_pde(struct amdgpu_device *adev, void *cpu_pt_addr, 
{

	void __iomem *ptr = (void *)cpu_pt_addr;

	uint64_t value;

	int idx;



	if (!drm_dev_enter(&adev->ddev, &idx))

		return 0;



	/*

	 * The following is for PTE only. GART does not have PDEs.
@@ -158,6 +164,9 @@ int amdgpu_gmc_set_pte_pde(struct amdgpu_device *adev, void *cpu_pt_addr, 
	value = addr & 0x0000FFFFFFFFF000ULL;

	value |= flags;

	writeq(value, ptr + (gpu_page_idx * 8));



	drm_dev_exit(idx);



	return 0;

}

drivers/gpu/drm/amd/amdgpu/amdgpu_psp.c

+40 −24
Original line number Diff line number Diff line
@@ -25,6 +25,7 @@ 


#include <linux/firmware.h>

#include <linux/dma-mapping.h>

#include <drm/drm_drv.h>



#include "amdgpu.h"

#include "amdgpu_psp.h"
@@ -39,6 +40,8 @@ 
#include "amdgpu_ras.h"

#include "amdgpu_securedisplay.h"



#include <drm/drm_drv.h>



static int psp_sysfs_init(struct amdgpu_device *adev);

static void psp_sysfs_fini(struct amdgpu_device *adev);
@@ -253,7 +256,7 @@ psp_cmd_submit_buf(struct psp_context *psp, 
		   struct psp_gfx_cmd_resp *cmd, uint64_t fence_mc_addr)

{

	int ret;

	int index;

	int index, idx;

	int timeout = 20000;

	bool ras_intr = false;

	bool skip_unsupport = false;
@@ -261,6 +264,9 @@ psp_cmd_submit_buf(struct psp_context *psp, 
	if (psp->adev->in_pci_err_recovery)

		return 0;



	if (!drm_dev_enter(&psp->adev->ddev, &idx))

		return 0;



	mutex_lock(&psp->mutex);



	memset(psp->cmd_buf_mem, 0, PSP_CMD_BUFFER_SIZE);
@@ -271,8 +277,7 @@ psp_cmd_submit_buf(struct psp_context *psp, 
	ret = psp_ring_cmd_submit(psp, psp->cmd_buf_mc_addr, fence_mc_addr, index);

	if (ret) {

		atomic_dec(&psp->fence_value);

		mutex_unlock(&psp->mutex);

		return ret;

		goto exit;

	}



	amdgpu_asic_invalidate_hdp(psp->adev, NULL);
@@ -312,8 +317,8 @@ psp_cmd_submit_buf(struct psp_context *psp, 
			 psp->cmd_buf_mem->cmd_id,

			 psp->cmd_buf_mem->resp.status);

		if (!timeout) {

			mutex_unlock(&psp->mutex);

			return -EINVAL;

			ret = -EINVAL;

			goto exit;

		}

	}
@@ -321,8 +326,10 @@ psp_cmd_submit_buf(struct psp_context *psp, 
		ucode->tmr_mc_addr_lo = psp->cmd_buf_mem->resp.fw_addr_lo;

		ucode->tmr_mc_addr_hi = psp->cmd_buf_mem->resp.fw_addr_hi;

	}

	mutex_unlock(&psp->mutex);



exit:

	mutex_unlock(&psp->mutex);

	drm_dev_exit(idx);

	return ret;

}
@@ -366,8 +373,7 @@ static int psp_load_toc(struct psp_context *psp, 
	if (!cmd)

		return -ENOMEM;

	/* Copy toc to psp firmware private buffer */

	memset(psp->fw_pri_buf, 0, PSP_1_MEG);

	memcpy(psp->fw_pri_buf, psp->toc_start_addr, psp->toc_bin_size);

	psp_copy_fw(psp, psp->toc_start_addr, psp->toc_bin_size);



	psp_prep_load_toc_cmd_buf(cmd, psp->fw_pri_mc_addr, psp->toc_bin_size);
@@ -621,8 +627,7 @@ static int psp_asd_load(struct psp_context *psp) 
	if (!cmd)

		return -ENOMEM;



	memset(psp->fw_pri_buf, 0, PSP_1_MEG);

	memcpy(psp->fw_pri_buf, psp->asd_start_addr, psp->asd_ucode_size);

	psp_copy_fw(psp, psp->asd_start_addr, psp->asd_ucode_size);



	psp_prep_asd_load_cmd_buf(cmd, psp->fw_pri_mc_addr,

				  psp->asd_ucode_size);
@@ -777,8 +782,7 @@ static int psp_xgmi_load(struct psp_context *psp) 
	if (!cmd)

		return -ENOMEM;



	memset(psp->fw_pri_buf, 0, PSP_1_MEG);

	memcpy(psp->fw_pri_buf, psp->ta_xgmi_start_addr, psp->ta_xgmi_ucode_size);

	psp_copy_fw(psp, psp->ta_xgmi_start_addr, psp->ta_xgmi_ucode_size);



	psp_prep_ta_load_cmd_buf(cmd,

				 psp->fw_pri_mc_addr,
@@ -1034,8 +1038,7 @@ static int psp_ras_load(struct psp_context *psp) 
	if (!cmd)

		return -ENOMEM;



	memset(psp->fw_pri_buf, 0, PSP_1_MEG);

	memcpy(psp->fw_pri_buf, psp->ta_ras_start_addr, psp->ta_ras_ucode_size);

	psp_copy_fw(psp, psp->ta_ras_start_addr, psp->ta_ras_ucode_size);



	psp_prep_ta_load_cmd_buf(cmd,

				 psp->fw_pri_mc_addr,
@@ -1271,8 +1274,7 @@ static int psp_hdcp_load(struct psp_context *psp) 
	if (!cmd)

		return -ENOMEM;



	memset(psp->fw_pri_buf, 0, PSP_1_MEG);

	memcpy(psp->fw_pri_buf, psp->ta_hdcp_start_addr,

	psp_copy_fw(psp, psp->ta_hdcp_start_addr,

		    psp->ta_hdcp_ucode_size);



	psp_prep_ta_load_cmd_buf(cmd,
@@ -1423,8 +1425,7 @@ static int psp_dtm_load(struct psp_context *psp) 
	if (!cmd)

		return -ENOMEM;



	memset(psp->fw_pri_buf, 0, PSP_1_MEG);

	memcpy(psp->fw_pri_buf, psp->ta_dtm_start_addr, psp->ta_dtm_ucode_size);

	psp_copy_fw(psp, psp->ta_dtm_start_addr, psp->ta_dtm_ucode_size);



	psp_prep_ta_load_cmd_buf(cmd,

				 psp->fw_pri_mc_addr,
@@ -1569,8 +1570,7 @@ static int psp_rap_load(struct psp_context *psp) 
	if (!cmd)

		return -ENOMEM;



	memset(psp->fw_pri_buf, 0, PSP_1_MEG);

	memcpy(psp->fw_pri_buf, psp->ta_rap_start_addr, psp->ta_rap_ucode_size);

	psp_copy_fw(psp, psp->ta_rap_start_addr, psp->ta_rap_ucode_size);



	psp_prep_ta_load_cmd_buf(cmd,

				 psp->fw_pri_mc_addr,
@@ -3018,7 +3018,7 @@ static ssize_t psp_usbc_pd_fw_sysfs_write(struct device *dev, 
	struct amdgpu_device *adev = drm_to_adev(ddev);

	void *cpu_addr;

	dma_addr_t dma_addr;

	int ret;

	int ret, idx;

	char fw_name[100];

	const struct firmware *usbc_pd_fw;
@@ -3027,6 +3027,9 @@ static ssize_t psp_usbc_pd_fw_sysfs_write(struct device *dev, 
		return -EBUSY;

	}



	if (!drm_dev_enter(ddev, &idx))

		return -ENODEV;



	snprintf(fw_name, sizeof(fw_name), "amdgpu/%s", buf);

	ret = request_firmware(&usbc_pd_fw, fw_name, adev->dev);

	if (ret)
@@ -3058,16 +3061,29 @@ static ssize_t psp_usbc_pd_fw_sysfs_write(struct device *dev, 
rel_buf:

	dma_free_coherent(adev->dev, usbc_pd_fw->size, cpu_addr, dma_addr);

	release_firmware(usbc_pd_fw);



fail:

	if (ret) {

		DRM_ERROR("Failed to load USBC PD FW, err = %d", ret);

		return ret;

		count = ret;

	}



	drm_dev_exit(idx);

	return count;

}



void psp_copy_fw(struct psp_context *psp, uint8_t *start_addr, uint32_t bin_size)

{

	int idx;



	if (!drm_dev_enter(&psp->adev->ddev, &idx))

		return;



	memset(psp->fw_pri_buf, 0, PSP_1_MEG);

	memcpy(psp->fw_pri_buf, start_addr, bin_size);



	drm_dev_exit(idx);

}



static DEVICE_ATTR(usbc_pd_fw, S_IRUGO | S_IWUSR,

		   psp_usbc_pd_fw_sysfs_read,

		   psp_usbc_pd_fw_sysfs_write);

drivers/gpu/drm/amd/amdgpu/amdgpu_psp.h

+2 −0
Original line number Diff line number Diff line
@@ -423,4 +423,6 @@ int psp_get_fw_attestation_records_addr(struct psp_context *psp, 


int psp_load_fw_list(struct psp_context *psp,

		     struct amdgpu_firmware_info **ucode_list, int ucode_count);

void psp_copy_fw(struct psp_context *psp, uint8_t *start_addr, uint32_t bin_size);



#endif

drivers/gpu/drm/amd/amdgpu/amdgpu_uvd.c

+21 −10
Original line number Diff line number Diff line
@@ -32,6 +32,7 @@ 
#include <linux/module.h>



#include <drm/drm.h>

#include <drm/drm_drv.h>



#include "amdgpu.h"

#include "amdgpu_pm.h"
@@ -375,7 +376,7 @@ int amdgpu_uvd_suspend(struct amdgpu_device *adev) 
{

	unsigned size;

	void *ptr;

	int i, j;

	int i, j, idx;

	bool in_ras_intr = amdgpu_ras_intr_triggered();



	cancel_delayed_work_sync(&adev->uvd.idle_work);
@@ -403,11 +404,15 @@ int amdgpu_uvd_suspend(struct amdgpu_device *adev) 
		if (!adev->uvd.inst[j].saved_bo)

			return -ENOMEM;



		if (drm_dev_enter(&adev->ddev, &idx)) {

			/* re-write 0 since err_event_athub will corrupt VCPU buffer */

			if (in_ras_intr)

				memset(adev->uvd.inst[j].saved_bo, 0, size);

			else

				memcpy_fromio(adev->uvd.inst[j].saved_bo, ptr, size);



			drm_dev_exit(idx);

		}

	}



	if (in_ras_intr)
@@ -420,7 +425,7 @@ int amdgpu_uvd_resume(struct amdgpu_device *adev) 
{

	unsigned size;

	void *ptr;

	int i;

	int i, idx;



	for (i = 0; i < adev->uvd.num_uvd_inst; i++) {

		if (adev->uvd.harvest_config & (1 << i))
@@ -432,7 +437,10 @@ int amdgpu_uvd_resume(struct amdgpu_device *adev) 
		ptr = adev->uvd.inst[i].cpu_addr;



		if (adev->uvd.inst[i].saved_bo != NULL) {

			if (drm_dev_enter(&adev->ddev, &idx)) {

				memcpy_toio(ptr, adev->uvd.inst[i].saved_bo, size);

				drm_dev_exit(idx);

			}

			kvfree(adev->uvd.inst[i].saved_bo);

			adev->uvd.inst[i].saved_bo = NULL;

		} else {
@@ -442,8 +450,11 @@ int amdgpu_uvd_resume(struct amdgpu_device *adev) 
			hdr = (const struct common_firmware_header *)adev->uvd.fw->data;

			if (adev->firmware.load_type != AMDGPU_FW_LOAD_PSP) {

				offset = le32_to_cpu(hdr->ucode_array_offset_bytes);

				if (drm_dev_enter(&adev->ddev, &idx)) {

					memcpy_toio(adev->uvd.inst[i].cpu_addr, adev->uvd.fw->data + offset,

						    le32_to_cpu(hdr->ucode_size_bytes));

					drm_dev_exit(idx);

				}

				size -= le32_to_cpu(hdr->ucode_size_bytes);

				ptr += le32_to_cpu(hdr->ucode_size_bytes);

			}