Backport bugfix for AMD SMN.
Naveen Naidu (1): PCI: Add PCI_ERROR_RESPONSE and related definitions
Yazen Ghannam (1): x86/amd_nb: Check for invalid SMN reads
arch/x86/kernel/amd_nb.c | 9 ++++++++- include/linux/pci.h | 9 +++++++++ 2 files changed, 17 insertions(+), 1 deletion(-)
From: Naveen Naidu naveennaidu479@gmail.com
stable inclusion from stable-v4.19.317 commit 4c003aef56d5642aefd4d11ee9d7e6755d4c1a6e category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/IAMTH9 CVE: NA
Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=...
--------------------------------
[ Upstream commit 57bdeef4716689d9b0e3571034d65cf420f6efcd ]
A config or MMIO read from a PCI device that doesn't exist or doesn't respond causes a PCI error. There's no real data to return to satisfy the CPU read, so most hardware fabricates ~0 data.
Add a PCI_ERROR_RESPONSE definition for that and use it where appropriate to make these checks consistent and easier to find.
Also add helper definitions PCI_SET_ERROR_RESPONSE() and PCI_POSSIBLE_ERROR() to make the code more readable.
Suggested-by: Bjorn Helgaas bhelgaas@google.com Link: https://lore.kernel.org/r/55563bf4dfc5d3fdc96695373c659d099bf175b1.163724371... Signed-off-by: Naveen Naidu naveennaidu479@gmail.com Signed-off-by: Bjorn Helgaas bhelgaas@google.com Reviewed-by: Pali Rohár pali@kernel.org Stable-dep-of: c625dabbf1c4 ("x86/amd_nb: Check for invalid SMN reads") Signed-off-by: Sasha Levin sashal@kernel.org Signed-off-by: Wei Li liwei391@huawei.com --- include/linux/pci.h | 9 +++++++++ 1 file changed, 9 insertions(+)
diff --git a/include/linux/pci.h b/include/linux/pci.h index f4bc2a7122f4c..27903ebaa1f40 100644 --- a/include/linux/pci.h +++ b/include/linux/pci.h @@ -124,6 +124,15 @@ enum pci_interrupt_pin { /* The number of legacy PCI INTx interrupts */ #define PCI_NUM_INTX 4
+/* + * Reading from a device that doesn't respond typically returns ~0. A + * successful read from a device may also return ~0, so you need additional + * information to reliably identify errors. + */ +#define PCI_ERROR_RESPONSE (~0ULL) +#define PCI_SET_ERROR_RESPONSE(val) (*(val) = ((typeof(*(val))) PCI_ERROR_RESPONSE)) +#define PCI_POSSIBLE_ERROR(val) ((val) == ((typeof(val)) PCI_ERROR_RESPONSE)) + /* * pci_power_t values must match the bits in the Capabilities PME_Support * and Control/Status PowerState fields in the Power Management capability.
From: Yazen Ghannam yazen.ghannam@amd.com
stable inclusion from stable-v4.19.317 commit d4e52b36c73f44d2b5f41d0cd3f57b3d2efbf180 category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/IAMTH9 CVE: NA
Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=...
--------------------------------
[ Upstream commit c625dabbf1c4a8e77e4734014f2fde7aa9071a1f ]
AMD Zen-based systems use a System Management Network (SMN) that provides access to implementation-specific registers.
SMN accesses are done indirectly through an index/data pair in PCI config space. The PCI config access may fail and return an error code. This would prevent the "read" value from being updated.
However, the PCI config access may succeed, but the return value may be invalid. This is in similar fashion to PCI bad reads, i.e. return all bits set.
Most systems will return 0 for SMN addresses that are not accessible. This is in line with AMD convention that unavailable registers are Read-as-Zero/Writes-Ignored.
However, some systems will return a "PCI Error Response" instead. This value, along with an error code of 0 from the PCI config access, will confuse callers of the amd_smn_read() function.
Check for this condition, clear the return value, and set a proper error code.
Fixes: ddfe43cdc0da ("x86/amd_nb: Add SMN and Indirect Data Fabric access for AMD Fam17h") Signed-off-by: Yazen Ghannam yazen.ghannam@amd.com Signed-off-by: Borislav Petkov (AMD) bp@alien8.de Cc: stable@vger.kernel.org Link: https://lore.kernel.org/r/20230403164244.471141-1-yazen.ghannam@amd.com Signed-off-by: Sasha Levin sashal@kernel.org Signed-off-by: Wei Li liwei391@huawei.com --- arch/x86/kernel/amd_nb.c | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-)
diff --git a/arch/x86/kernel/amd_nb.c b/arch/x86/kernel/amd_nb.c index 6e6f57b6b16b6..3df6e4f5cc203 100644 --- a/arch/x86/kernel/amd_nb.c +++ b/arch/x86/kernel/amd_nb.c @@ -173,7 +173,14 @@ static int __amd_smn_rw(u16 node, u32 address, u32 *value, bool write)
int amd_smn_read(u16 node, u32 address, u32 *value) { - return __amd_smn_rw(node, address, value, false); + int err = __amd_smn_rw(node, address, value, false); + + if (PCI_POSSIBLE_ERROR(*value)) { + err = -ENODEV; + *value = 0; + } + + return err; } EXPORT_SYMBOL_GPL(amd_smn_read);
反馈： 您发送到kernel@openeuler.org的补丁/补丁集，已成功转换为PR！ PR链接地址： https://gitee.com/openeuler/kernel/pulls/11186 邮件列表地址：https://mailweb.openeuler.org/hyperkitty/list/kernel@openeuler.org/message/N...
FeedBack: The patch(es) which you have sent to kernel@openeuler.org mailing list has been converted to a pull request successfully! Pull request link: https://gitee.com/openeuler/kernel/pulls/11186 Mailing list address: https://mailweb.openeuler.org/hyperkitty/list/kernel@openeuler.org/message/N...
-
patchwork bot -
Wei Li