linux-kernel - Re: [PATCH 5.4 131/132] drm/msm: Enable expanded apriv support for a650

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Tue, 15 Sep 2020 10:03:19 -0600
From:   Jordan Crouse <jcrouse@...eaurora.org>
To:     Greg Kroah-Hartman <gregkh@...uxfoundation.org>
Cc:     linux-kernel@...r.kernel.org, stable@...r.kernel.org,
        Rob Clark <robdclark@...omium.org>,
        Sasha Levin <sashal@...nel.org>
Subject: Re: [PATCH 5.4 131/132] drm/msm: Enable expanded apriv support for
 a650

On Tue, Sep 15, 2020 at 04:13:53PM +0200, Greg Kroah-Hartman wrote:
> From: Jordan Crouse <jcrouse@...eaurora.org>
> 
> [ Upstream commit 604234f33658cdd72f686be405a99646b397d0b3 ]
> 
> a650 supports expanded apriv support that allows us to map critical buffers
> (ringbuffer and memstore) as as privileged to protect them from corruption.
> 
> Cc: stable@...r.kernel.org
> Signed-off-by: Jordan Crouse <jcrouse@...eaurora.org>
> Signed-off-by: Rob Clark <robdclark@...omium.org>
> Signed-off-by: Sasha Levin <sashal@...nel.org>

Hi. A bug was reported in this patch with a fix just posted to the list [1].
Since the RPTR shadow is being disabled universally by f6828e0c4045 ("drm/msm:
Disable the RPTR shadow") that will address the security concern and we won't
need the extra protection from this patch. I suggest that you drop it for the
stable trees and we can merge the fix into 5.9 to re-enable APRIV for newer
kernels.

Jordan
> ---
>  drivers/gpu/drm/msm/adreno/a6xx_gpu.c |  6 +++++-
>  drivers/gpu/drm/msm/msm_gpu.c         |  2 +-
>  drivers/gpu/drm/msm/msm_gpu.h         | 11 +++++++++++
>  drivers/gpu/drm/msm/msm_ringbuffer.c  |  4 ++--
>  4 files changed, 19 insertions(+), 4 deletions(-)
> 
> diff --git a/drivers/gpu/drm/msm/adreno/a6xx_gpu.c b/drivers/gpu/drm/msm/adreno/a6xx_gpu.c
> index c3a81594f4fb7..ea073cd9d248e 100644
> --- a/drivers/gpu/drm/msm/adreno/a6xx_gpu.c
> +++ b/drivers/gpu/drm/msm/adreno/a6xx_gpu.c
> @@ -533,7 +533,8 @@ static int a6xx_hw_init(struct msm_gpu *gpu)
>  			A6XX_PROTECT_RDONLY(0x980, 0x4));
>  	gpu_write(gpu, REG_A6XX_CP_PROTECT(25), A6XX_PROTECT_RW(0xa630, 0x0));
>  
> -	if (adreno_is_a650(adreno_gpu)) {
> +	/* Enable expanded apriv for targets that support it */
> +	if (gpu->hw_apriv) {
>  		gpu_write(gpu, REG_A6XX_CP_APRIV_CNTL,
>  			(1 << 6) | (1 << 5) | (1 << 3) | (1 << 2) | (1 << 1));
>  	}
> @@ -908,6 +909,9 @@ struct msm_gpu *a6xx_gpu_init(struct drm_device *dev)
>  	adreno_gpu->registers = NULL;
>  	adreno_gpu->reg_offsets = a6xx_register_offsets;
>  
> +	if (adreno_is_a650(adreno_gpu))
> +		adreno_gpu->base.hw_apriv = true;
> +
>  	ret = adreno_gpu_init(dev, pdev, adreno_gpu, &funcs, 1);
>  	if (ret) {
>  		a6xx_destroy(&(a6xx_gpu->base.base));
> diff --git a/drivers/gpu/drm/msm/msm_gpu.c b/drivers/gpu/drm/msm/msm_gpu.c
> index edd45f434ccd6..8653a2f7ae1c9 100644
> --- a/drivers/gpu/drm/msm/msm_gpu.c
> +++ b/drivers/gpu/drm/msm/msm_gpu.c
> @@ -932,7 +932,7 @@ int msm_gpu_init(struct drm_device *drm, struct platform_device *pdev,
>  
>  	memptrs = msm_gem_kernel_new(drm,
>  		sizeof(struct msm_rbmemptrs) * nr_rings,
> -		MSM_BO_UNCACHED, gpu->aspace, &gpu->memptrs_bo,
> +		check_apriv(gpu, MSM_BO_UNCACHED), gpu->aspace, &gpu->memptrs_bo,
>  		&memptrs_iova);
>  
>  	if (IS_ERR(memptrs)) {
> diff --git a/drivers/gpu/drm/msm/msm_gpu.h b/drivers/gpu/drm/msm/msm_gpu.h
> index ab8f0f9c9dc88..15254239e5ec6 100644
> --- a/drivers/gpu/drm/msm/msm_gpu.h
> +++ b/drivers/gpu/drm/msm/msm_gpu.h
> @@ -14,6 +14,7 @@
>  #include "msm_drv.h"
>  #include "msm_fence.h"
>  #include "msm_ringbuffer.h"
> +#include "msm_gem.h"
>  
>  struct msm_gem_submit;
>  struct msm_gpu_perfcntr;
> @@ -131,6 +132,8 @@ struct msm_gpu {
>  	} devfreq;
>  
>  	struct msm_gpu_state *crashstate;
> +	/* True if the hardware supports expanded apriv (a650 and newer) */
> +	bool hw_apriv;
>  };
>  
>  /* It turns out that all targets use the same ringbuffer size */
> @@ -319,4 +322,12 @@ static inline void msm_gpu_crashstate_put(struct msm_gpu *gpu)
>  	mutex_unlock(&gpu->dev->struct_mutex);
>  }
>  
> +/*
> + * Simple macro to semi-cleanly add the MAP_PRIV flag for targets that can
> + * support expanded privileges
> + */
> +#define check_apriv(gpu, flags) \
> +	(((gpu)->hw_apriv ? MSM_BO_MAP_PRIV : 0) | (flags))
> +
> +
>  #endif /* __MSM_GPU_H__ */
> diff --git a/drivers/gpu/drm/msm/msm_ringbuffer.c b/drivers/gpu/drm/msm/msm_ringbuffer.c
> index 39ecb5a18431e..935bf9b1d9418 100644
> --- a/drivers/gpu/drm/msm/msm_ringbuffer.c
> +++ b/drivers/gpu/drm/msm/msm_ringbuffer.c
> @@ -27,8 +27,8 @@ struct msm_ringbuffer *msm_ringbuffer_new(struct msm_gpu *gpu, int id,
>  	ring->id = id;
>  
>  	ring->start = msm_gem_kernel_new(gpu->dev, MSM_GPU_RINGBUFFER_SZ,
> -		MSM_BO_WC | MSM_BO_GPU_READONLY, gpu->aspace, &ring->bo,
> -		&ring->iova);
> +		check_apriv(gpu, MSM_BO_WC | MSM_BO_GPU_READONLY),
> +		gpu->aspace, &ring->bo, &ring->iova);
>  
>  	if (IS_ERR(ring->start)) {
>  		ret = PTR_ERR(ring->start);
> -- 
> 2.25.1
> 
> 
> 

-- 
The Qualcomm Innovation Center, Inc. is a member of Code Aurora Forum,
a Linux Foundation Collaborative Project