Commit 2370eba9 authored by Victor Zhao's avatar Victor Zhao Committed by Alex Deucher
Browse files

drm/amd/amdgpu:save psp ring wptr to avoid attack 



[Why]
When some tools performing psp mailbox attack, the readback value
of register can be a random value which may break psp.

[How]
Use a psp wptr cache machanism to aovid the change made by attack.

v2: unify change and add detailed reason

Signed-off-by: default avatarVictor Zhao <Victor.Zhao@amd.com>
Signed-off-by: default avatarJingwen Chen <Jingwen.Chen2@amd.com>
Reviewed-by: default avatarMonk Liu <monk.liu@amd.com>
Signed-off-by: default avatarAlex Deucher <alexander.deucher@amd.com>
parent c5699e2d

drivers/gpu/drm/amd/amdgpu/amdgpu_psp.h

+1 −0
Original line number Diff line number Diff line
@@ -76,6 +76,7 @@ struct psp_ring 
	uint64_t			ring_mem_mc_addr;

	void				*ring_mem_handle;

	uint32_t			ring_size;

	uint32_t			ring_wptr;

};



/* More registers may will be supported */

drivers/gpu/drm/amd/amdgpu/psp_v11_0.c

+2 −1
Original line number Diff line number Diff line
@@ -720,7 +720,7 @@ static uint32_t psp_v11_0_ring_get_wptr(struct psp_context *psp) 
	struct amdgpu_device *adev = psp->adev;



	if (amdgpu_sriov_vf(adev))

		data = RREG32_SOC15(MP0, 0, mmMP0_SMN_C2PMSG_102);

		data = psp->km_ring.ring_wptr;

	else

		data = RREG32_SOC15(MP0, 0, mmMP0_SMN_C2PMSG_67);
@@ -734,6 +734,7 @@ static void psp_v11_0_ring_set_wptr(struct psp_context *psp, uint32_t value) 
	if (amdgpu_sriov_vf(adev)) {

		WREG32_SOC15(MP0, 0, mmMP0_SMN_C2PMSG_102, value);

		WREG32_SOC15(MP0, 0, mmMP0_SMN_C2PMSG_101, GFX_CTRL_CMD_ID_CONSUME_CMD);

		psp->km_ring.ring_wptr = value;

	} else

		WREG32_SOC15(MP0, 0, mmMP0_SMN_C2PMSG_67, value);

}

drivers/gpu/drm/amd/amdgpu/psp_v3_1.c

+2 −1
Original line number Diff line number Diff line
@@ -379,7 +379,7 @@ static uint32_t psp_v3_1_ring_get_wptr(struct psp_context *psp) 
	struct amdgpu_device *adev = psp->adev;



	if (amdgpu_sriov_vf(adev))

		data = RREG32_SOC15(MP0, 0, mmMP0_SMN_C2PMSG_102);

		data = psp->km_ring.ring_wptr;

	else

		data = RREG32_SOC15(MP0, 0, mmMP0_SMN_C2PMSG_67);

	return data;
@@ -394,6 +394,7 @@ static void psp_v3_1_ring_set_wptr(struct psp_context *psp, uint32_t value) 
		/* send interrupt to PSP for SRIOV ring write pointer update */

		WREG32_SOC15(MP0, 0, mmMP0_SMN_C2PMSG_101,

			GFX_CTRL_CMD_ID_CONSUME_CMD);

		psp->km_ring.ring_wptr = value;

	} else

		WREG32_SOC15(MP0, 0, mmMP0_SMN_C2PMSG_67, value);

}