linux-kernel - Re: [PATCH v2] drm/msm/a6xx+: Don't let IB

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <CAF6AEGuneF8Yi0ViA4ActvmGL7aOFT75jNBN=YZf37YyoBkCFA@mail.gmail.com>
Date: Fri, 14 Mar 2025 14:08:46 -0700
From: Rob Clark <robdclark@...il.com>
To: Akhil P Oommen <quic_akhilpo@...cinc.com>
Cc: dri-devel@...ts.freedesktop.org, linux-arm-msm@...r.kernel.org, 
	freedreno@...ts.freedesktop.org, Rob Clark <robdclark@...omium.org>, 
	Connor Abbott <cwabbott0@...il.com>, Sean Paul <sean@...rly.run>, 
	Konrad Dybcio <konradybcio@...nel.org>, Abhinav Kumar <quic_abhinavk@...cinc.com>, 
	Dmitry Baryshkov <lumag@...nel.org>, Marijn Suijten <marijn.suijten@...ainline.org>, 
	David Airlie <airlied@...il.com>, Simona Vetter <simona@...ll.ch>, 
	Jordan Crouse <jordan@...micpenguin.net>, Jonathan Marek <jonathan@...ek.ca>, 
	open list <linux-kernel@...r.kernel.org>
Subject: Re: [PATCH v2] drm/msm/a6xx+: Don't let IB_SIZE overflow

On Fri, Mar 14, 2025 at 1:07 PM Akhil P Oommen <quic_akhilpo@...cinc.com> wrote:
>
> On 3/15/2025 12:04 AM, Rob Clark wrote:
> > From: Rob Clark <robdclark@...omium.org>
> >
> > IB_SIZE is only b0..b19.  Starting with a6xx gen3, additional fields
> > were added above the IB_SIZE.  Accidentially setting them can cause
> > badness.  Fix this by properly defining the CP_INDIRECT_BUFFER packet
> > and using the generated builder macro to ensure unintended bits are not
> > set.
> >
> > v2: add missing type attribute for IB_BASE
> >
> > Reported-by: Connor Abbott <cwabbott0@...il.com>
> > Fixes: a83366ef19ea ("drm/msm/a6xx: add A640/A650 to gpulist")
> > Signed-off-by: Rob Clark <robdclark@...omium.org>
> > ---
> > Backport notes, prior to commit ae22a94997b8 ("drm/msm: import A2xx-A4xx
> > XML display registers database"), just open code, ie:
> >
> >    OUT_RING(ring, submit->cmd[i].size & 0xfffff);
> >
> > Prior to commit af66706accdf ("drm/msm/a6xx: Add skeleton A7xx
> > support"), a7xx_submit() did not exist so that hunk can be dropped.
> >
> >  drivers/gpu/drm/msm/adreno/a6xx_gpu.c               | 8 ++++----
> >  drivers/gpu/drm/msm/registers/adreno/adreno_pm4.xml | 7 +++++++
> >  2 files changed, 11 insertions(+), 4 deletions(-)
> >
> > diff --git a/drivers/gpu/drm/msm/adreno/a6xx_gpu.c b/drivers/gpu/drm/msm/adreno/a6xx_gpu.c
> > index d3978cfa3f20..ea52b7d0b212 100644
> > --- a/drivers/gpu/drm/msm/adreno/a6xx_gpu.c
> > +++ b/drivers/gpu/drm/msm/adreno/a6xx_gpu.c
> > @@ -245,10 +245,10 @@ static void a6xx_submit(struct msm_gpu *gpu, struct msm_gem_submit *submit)
> >                               break;
> >                       fallthrough;
> >               case MSM_SUBMIT_CMD_BUF:
> > -                     OUT_PKT7(ring, CP_INDIRECT_BUFFER_PFE, 3);
> > +                     OUT_PKT7(ring, CP_INDIRECT_BUFFER, 3);
> >                       OUT_RING(ring, lower_32_bits(submit->cmd[i].iova));
> >                       OUT_RING(ring, upper_32_bits(submit->cmd[i].iova));
> > -                     OUT_RING(ring, submit->cmd[i].size);
> > +                     OUT_RING(ring, A5XX_CP_INDIRECT_BUFFER_3_IB_SIZE(submit->cmd[i].size));
> >                       ibs++;
> >                       break;
> >               }
> > @@ -382,10 +382,10 @@ static void a7xx_submit(struct msm_gpu *gpu, struct msm_gem_submit *submit)
> >                               break;
> >                       fallthrough;
> >               case MSM_SUBMIT_CMD_BUF:
> > -                     OUT_PKT7(ring, CP_INDIRECT_BUFFER_PFE, 3);
> > +                     OUT_PKT7(ring, CP_INDIRECT_BUFFER, 3);
> >                       OUT_RING(ring, lower_32_bits(submit->cmd[i].iova));
> >                       OUT_RING(ring, upper_32_bits(submit->cmd[i].iova));
> > -                     OUT_RING(ring, submit->cmd[i].size);
> > +                     OUT_RING(ring, A5XX_CP_INDIRECT_BUFFER_3_IB_SIZE(submit->cmd[i].size));
> >                       ibs++;
> >                       break;
> >               }
> > diff --git a/drivers/gpu/drm/msm/registers/adreno/adreno_pm4.xml b/drivers/gpu/drm/msm/registers/adreno/adreno_pm4.xml
> > index 55a35182858c..a71bc6f16cbf 100644
> > --- a/drivers/gpu/drm/msm/registers/adreno/adreno_pm4.xml
> > +++ b/drivers/gpu/drm/msm/registers/adreno/adreno_pm4.xml
> > @@ -2259,5 +2259,12 @@ opcode: CP_LOAD_STATE4 (30) (4 dwords)
> >       </reg32>
> >  </domain>
> >
> > +<domain name="CP_INDIRECT_BUFFER" width="32" varset="chip" prefix="chip" variants="A5XX-">
> > +     <reg64 offset="0" name="IB_BASE" type="address"/>
> > +     <reg32 offset="3" name="3">
>
> Why is the offset 3 here? It looks to me that it doesn't match the code
> above.

oh, bad copy/pasta.. it should be 2 (dword offset)

BR,
-R

> -Akhil.
>
> > +             <bitfield name="IB_SIZE" low="0" high="19"/>
> > +     </reg32>
> > +</domain>
> > +
> >  </database>
> >
>