Linux kernel mirror (for testing)
git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
kernel
os
linux
gpu: nova-core: gsp: fix UB in DmaGspMem pointer accessors
The DmaGspMem pointer accessor methods (gsp_write_ptr, gsp_read_ptr,
cpu_read_ptr, cpu_write_ptr, advance_cpu_read_ptr,
advance_cpu_write_ptr) dereference a raw pointer to DMA memory, creating
an intermediate reference before calling volatile read/write methods.
This is undefined behavior since DMA memory can be concurrently modified
by the device.
Fix this by moving the implementations into a gsp_mem module in fw.rs
that uses the dma_read!() / dma_write!() macros, making the original
methods on DmaGspMem thin forwarding wrappers.
An alternative approach would have been to wrap the shared memory in
Opaque, but that would have required even more unsafe code.
Since the gsp_mem module lives in fw.rs (to access firmware-specific
binding field names), GspMem, Msgq and their relevant fields are
temporarily widened to pub(super). This will be reverted once IoView
projections are available.
Cc: Gary Guo <gary@garyguo.net>
Closes: https://lore.kernel.org/nouveau/DGUT14ILG35P.1UMNRKU93JUM1@kernel.org/
Fixes: 75f6b1de8133 ("gpu: nova-core: gsp: Add GSP command queue bindings and handling")
Reviewed-by: Alexandre Courbot <acourbot@nvidia.com>
Link: https://patch.msgid.link/20260309225408.27714-1-dakr@kernel.org
[ Use pub(super) where possible; replace bitwise-and with modulo
operator analogous to [1]. - Danilo ]
Link: https://lore.kernel.org/all/20260129-nova-core-cmdq1-v3-1-2ede85493a27@nvidia.com/ [1]
Signed-off-by: Danilo Krummrich <dakr@kernel.org>
+84
-88
+15
-56
drivers/gpu/nova-core/gsp/cmdq.rs
+15
-56
drivers/gpu/nova-core/gsp/cmdq.rs
···
2
2
3
3
use core::{
4
4
cmp,
5
-
mem,
6
-
sync::atomic::{
7
-
fence,
8
-
Ordering, //
9
-
}, //
5
+
mem, //
10
6
};
11
7
12
8
use kernel::{
···
142
146
#[repr(C)]
143
147
// There is no struct defined for this in the open-gpu-kernel-source headers.
144
148
// Instead it is defined by code in `GspMsgQueuesInit()`.
145
-
struct Msgq {
149
+
// TODO: Revert to private once `IoView` projections replace the `gsp_mem` module.
150
+
pub(super) struct Msgq {
146
151
/// Header for sending messages, including the write pointer.
147
-
tx: MsgqTxHeader,
152
+
pub(super) tx: MsgqTxHeader,
148
153
/// Header for receiving messages, including the read pointer.
149
-
rx: MsgqRxHeader,
154
+
pub(super) rx: MsgqRxHeader,
150
155
/// The message queue proper.
151
156
msgq: MsgqData,
152
157
}
153
158
154
159
/// Structure shared between the driver and the GSP and containing the command and message queues.
155
160
#[repr(C)]
156
-
struct GspMem {
161
+
// TODO: Revert to private once `IoView` projections replace the `gsp_mem` module.
162
+
pub(super) struct GspMem {
157
163
/// Self-mapping page table entries.
158
164
ptes: PteArray<{ Self::PTE_ARRAY_SIZE }>,
159
165
/// CPU queue: the driver writes commands here, and the GSP reads them. It also contains the
160
166
/// write and read pointers that the CPU updates.
161
167
///
162
168
/// This member is read-only for the GSP.
163
-
cpuq: Msgq,
169
+
pub(super) cpuq: Msgq,
164
170
/// GSP queue: the GSP writes messages here, and the driver reads them. It also contains the
165
171
/// write and read pointers that the GSP updates.
166
172
///
167
173
/// This member is read-only for the driver.
168
-
gspq: Msgq,
174
+
pub(super) gspq: Msgq,
169
175
}
170
176
171
177
impl GspMem {
···
329
331
//
330
332
// - The returned value is between `0` and `MSGQ_NUM_PAGES`.
331
333
fn gsp_write_ptr(&self) -> u32 {
332
-
let gsp_mem = self.0.start_ptr();
333
-
334
-
// SAFETY:
335
-
// - The 'CoherentAllocation' contains at least one object.
336
-
// - By the invariants of `CoherentAllocation` the pointer is valid.
337
-
(unsafe { (*gsp_mem).gspq.tx.write_ptr() } % MSGQ_NUM_PAGES)
334
+
super::fw::gsp_mem::gsp_write_ptr(&self.0)
338
335
}
339
336
340
337
// Returns the index of the memory page the GSP will read the next command from.
···
338
345
//
339
346
// - The returned value is between `0` and `MSGQ_NUM_PAGES`.
340
347
fn gsp_read_ptr(&self) -> u32 {
341
-
let gsp_mem = self.0.start_ptr();
342
-
343
-
// SAFETY:
344
-
// - The 'CoherentAllocation' contains at least one object.
345
-
// - By the invariants of `CoherentAllocation` the pointer is valid.
346
-
(unsafe { (*gsp_mem).gspq.rx.read_ptr() } % MSGQ_NUM_PAGES)
348
+
super::fw::gsp_mem::gsp_read_ptr(&self.0)
347
349
}
348
350
349
351
// Returns the index of the memory page the CPU can read the next message from.
···
347
359
//
348
360
// - The returned value is between `0` and `MSGQ_NUM_PAGES`.
349
361
fn cpu_read_ptr(&self) -> u32 {
350
-
let gsp_mem = self.0.start_ptr();
351
-
352
-
// SAFETY:
353
-
// - The ['CoherentAllocation'] contains at least one object.
354
-
// - By the invariants of CoherentAllocation the pointer is valid.
355
-
(unsafe { (*gsp_mem).cpuq.rx.read_ptr() } % MSGQ_NUM_PAGES)
362
+
super::fw::gsp_mem::cpu_read_ptr(&self.0)
356
363
}
357
364
358
365
// Informs the GSP that it can send `elem_count` new pages into the message queue.
359
366
fn advance_cpu_read_ptr(&mut self, elem_count: u32) {
360
-
let rptr = self.cpu_read_ptr().wrapping_add(elem_count) % MSGQ_NUM_PAGES;
361
-
362
-
// Ensure read pointer is properly ordered.
363
-
fence(Ordering::SeqCst);
364
-
365
-
let gsp_mem = self.0.start_ptr_mut();
366
-
367
-
// SAFETY:
368
-
// - The 'CoherentAllocation' contains at least one object.
369
-
// - By the invariants of `CoherentAllocation` the pointer is valid.
370
-
unsafe { (*gsp_mem).cpuq.rx.set_read_ptr(rptr) };
367
+
super::fw::gsp_mem::advance_cpu_read_ptr(&self.0, elem_count)
371
368
}
372
369
373
370
// Returns the index of the memory page the CPU can write the next command to.
···
361
388
//
362
389
// - The returned value is between `0` and `MSGQ_NUM_PAGES`.
363
390
fn cpu_write_ptr(&self) -> u32 {
364
-
let gsp_mem = self.0.start_ptr();
365
-
366
-
// SAFETY:
367
-
// - The 'CoherentAllocation' contains at least one object.
368
-
// - By the invariants of `CoherentAllocation` the pointer is valid.
369
-
(unsafe { (*gsp_mem).cpuq.tx.write_ptr() } % MSGQ_NUM_PAGES)
391
+
super::fw::gsp_mem::cpu_write_ptr(&self.0)
370
392
}
371
393
372
394
// Informs the GSP that it can process `elem_count` new pages from the command queue.
373
395
fn advance_cpu_write_ptr(&mut self, elem_count: u32) {
374
-
let wptr = self.cpu_write_ptr().wrapping_add(elem_count) & MSGQ_NUM_PAGES;
375
-
let gsp_mem = self.0.start_ptr_mut();
376
-
377
-
// SAFETY:
378
-
// - The 'CoherentAllocation' contains at least one object.
379
-
// - By the invariants of `CoherentAllocation` the pointer is valid.
380
-
unsafe { (*gsp_mem).cpuq.tx.set_write_ptr(wptr) };
381
-
382
-
// Ensure all command data is visible before triggering the GSP read.
383
-
fence(Ordering::SeqCst);
396
+
super::fw::gsp_mem::advance_cpu_write_ptr(&self.0, elem_count)
384
397
}
385
398
}
386
399
+69
-32
drivers/gpu/nova-core/gsp/fw.rs
+69
-32
drivers/gpu/nova-core/gsp/fw.rs
···
40
40
},
41
41
};
42
42
43
+
// TODO: Replace with `IoView` projections once available; the `unwrap()` calls go away once we
44
+
// switch to the new `dma::Coherent` API.
45
+
pub(super) mod gsp_mem {
46
+
use core::sync::atomic::{
47
+
fence,
48
+
Ordering, //
49
+
};
50
+
51
+
use kernel::{
52
+
dma::CoherentAllocation,
53
+
dma_read,
54
+
dma_write,
55
+
prelude::*, //
56
+
};
57
+
58
+
use crate::gsp::cmdq::{
59
+
GspMem,
60
+
MSGQ_NUM_PAGES, //
61
+
};
62
+
63
+
pub(in crate::gsp) fn gsp_write_ptr(qs: &CoherentAllocation<GspMem>) -> u32 {
64
+
// PANIC: A `dma::CoherentAllocation` always contains at least one element.
65
+
|| -> Result<u32> { Ok(dma_read!(qs, [0]?.gspq.tx.0.writePtr) % MSGQ_NUM_PAGES) }().unwrap()
66
+
}
67
+
68
+
pub(in crate::gsp) fn gsp_read_ptr(qs: &CoherentAllocation<GspMem>) -> u32 {
69
+
// PANIC: A `dma::CoherentAllocation` always contains at least one element.
70
+
|| -> Result<u32> { Ok(dma_read!(qs, [0]?.gspq.rx.0.readPtr) % MSGQ_NUM_PAGES) }().unwrap()
71
+
}
72
+
73
+
pub(in crate::gsp) fn cpu_read_ptr(qs: &CoherentAllocation<GspMem>) -> u32 {
74
+
// PANIC: A `dma::CoherentAllocation` always contains at least one element.
75
+
|| -> Result<u32> { Ok(dma_read!(qs, [0]?.cpuq.rx.0.readPtr) % MSGQ_NUM_PAGES) }().unwrap()
76
+
}
77
+
78
+
pub(in crate::gsp) fn advance_cpu_read_ptr(qs: &CoherentAllocation<GspMem>, count: u32) {
79
+
let rptr = cpu_read_ptr(qs).wrapping_add(count) % MSGQ_NUM_PAGES;
80
+
81
+
// Ensure read pointer is properly ordered.
82
+
fence(Ordering::SeqCst);
83
+
84
+
// PANIC: A `dma::CoherentAllocation` always contains at least one element.
85
+
|| -> Result {
86
+
dma_write!(qs, [0]?.cpuq.rx.0.readPtr, rptr);
87
+
Ok(())
88
+
}()
89
+
.unwrap()
90
+
}
91
+
92
+
pub(in crate::gsp) fn cpu_write_ptr(qs: &CoherentAllocation<GspMem>) -> u32 {
93
+
// PANIC: A `dma::CoherentAllocation` always contains at least one element.
94
+
|| -> Result<u32> { Ok(dma_read!(qs, [0]?.cpuq.tx.0.writePtr) % MSGQ_NUM_PAGES) }().unwrap()
95
+
}
96
+
97
+
pub(in crate::gsp) fn advance_cpu_write_ptr(qs: &CoherentAllocation<GspMem>, count: u32) {
98
+
let wptr = cpu_write_ptr(qs).wrapping_add(count) % MSGQ_NUM_PAGES;
99
+
100
+
// PANIC: A `dma::CoherentAllocation` always contains at least one element.
101
+
|| -> Result {
102
+
dma_write!(qs, [0]?.cpuq.tx.0.writePtr, wptr);
103
+
Ok(())
104
+
}()
105
+
.unwrap();
106
+
107
+
// Ensure all command data is visible before triggering the GSP read.
108
+
fence(Ordering::SeqCst);
109
+
}
110
+
}
111
+
43
112
/// Empty type to group methods related to heap parameters for running the GSP firmware.
44
113
enum GspFwHeapParams {}
45
114
···
777
708
entryOff: num::usize_into_u32::<GSP_PAGE_SIZE>(),
778
709
})
779
710
}
780
-
781
-
/// Returns the value of the write pointer for this queue.
782
-
pub(crate) fn write_ptr(&self) -> u32 {
783
-
let ptr = core::ptr::from_ref(&self.0.writePtr);
784
-
785
-
// SAFETY: `ptr` is a valid pointer to a `u32`.
786
-
unsafe { ptr.read_volatile() }
787
-
}
788
-
789
-
/// Sets the value of the write pointer for this queue.
790
-
pub(crate) fn set_write_ptr(&mut self, val: u32) {
791
-
let ptr = core::ptr::from_mut(&mut self.0.writePtr);
792
-
793
-
// SAFETY: `ptr` is a valid pointer to a `u32`.
794
-
unsafe { ptr.write_volatile(val) }
795
-
}
796
711
}
797
712
798
713
// SAFETY: Padding is explicit and does not contain uninitialized data.
···
791
738
/// Creates a new RX queue header.
792
739
pub(crate) fn new() -> Self {
793
740
Self(Default::default())
794
-
}
795
-
796
-
/// Returns the value of the read pointer for this queue.
797
-
pub(crate) fn read_ptr(&self) -> u32 {
798
-
let ptr = core::ptr::from_ref(&self.0.readPtr);
799
-
800
-
// SAFETY: `ptr` is a valid pointer to a `u32`.
801
-
unsafe { ptr.read_volatile() }
802
-
}
803
-
804
-
/// Sets the value of the read pointer for this queue.
805
-
pub(crate) fn set_read_ptr(&mut self, val: u32) {
806
-
let ptr = core::ptr::from_mut(&mut self.0.readPtr);
807
-
808
-
// SAFETY: `ptr` is a valid pointer to a `u32`.
809
-
unsafe { ptr.write_volatile(val) }
810
741
}
811
742
}
812
743