github-mirror/linux
1
0
Fork 0
mirror of https://github.com/torvalds/linux.git synced 2026-09-25 17:42:03 +02:00
Code Issues Actions Packages Projects Releases Wiki Activity Graph

platform/x86/amd/hsmp: Gate the data plane on a fully initialized socket

Browse Source 
hsmp_parse_acpi_table() published sock->dev before hsmp_read_acpi_crs()
had mapped virt_base_addr.  sock->dev is the readiness gate for the
lock-free data plane, so on a multi-socket system - where socket 0
exposes /dev/hsmp before later sockets finish probing - an ioctl aimed
at a socket still in bring-up could pass the gate and dereference a NULL
virt_base_addr.

Publish sock->dev last with smp_store_release() once virt_base_addr, the
mailbox offsets and the semaphore are initialized, and read it with
smp_load_acquire() in hsmp_send_message() so a non-NULL dev guarantees
the rest of the socket state is visible.

Signed-off-by: Muralidhara M K <muralidhara.mk@amd.com>
Link: https://patch.msgid.link/20260629155634.1807598-5-muralidhara.mk@amd.com
Reviewed-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
This commit is contained in:
Muralidhara M K 2026-06-29 21:26:34 +05:30 committed by Ilpo Järvinen
parent b558cbed39
commit e5e511f5d9
No known key found for this signature in database
GPG Key ID: 59AC4F6153E5CE31
2 changed files with 29 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

18
drivers/platform/x86/amd/hsmp/acpi.c
View File

@ -224,7 +224,6 @@ static int hsmp_parse_acpi_table(struct device *dev, u16 sock_ind)
int ret;
sock->sock_ind = sock_ind;
sock->dev = dev;
sock->amd_hsmp_rdwr = amd_hsmp_acpi_rdwr;
sema_init(&sock->hsmp_sem, 1);
@ -237,7 +236,22 @@ static int hsmp_parse_acpi_table(struct device *dev, u16 sock_ind)
return ret;
/* Read mailbox offsets from DSD table */
return hsmp_read_acpi_dsd(dev, sock);
ret = hsmp_read_acpi_dsd(dev, sock);
if (ret)
return ret;
/*
* Publish sock->dev last. hsmp_send_message() uses it (via
* smp_load_acquire()) as the readiness gate for the lock-free data
* plane, so it must become visible only after virt_base_addr, the
* mailbox offsets and the semaphore are fully initialized. On a
* multi-socket system socket 0 exposes /dev/hsmp before later sockets
* finish probing, so without this an ioctl aimed at a socket still in
* bring-up could pass the gate and dereference a NULL virt_base_addr.
*/
smp_store_release(&sock->dev, dev);
return 0;
}
static ssize_t hsmp_metric_tbl_acpi_read(struct file *filp, struct kobject *kobj,

13
drivers/platform/x86/amd/hsmp/hsmp.c
View File

@ -223,6 +223,19 @@ int hsmp_send_message(struct hsmp_message *msg)
sock_ind = array_index_nospec(msg->sock_ind, hsmp_pdev.num_sockets);
sock = &hsmp_pdev.sock[sock_ind];
/*
* A slot exists for every possible socket, but it is only usable once
* that socket has actually been probed. Reject messages aimed at a
* socket that was never brought up or is still in bring-up, so we never
* operate on a zero-initialized semaphore or an unmapped mailbox. A
* non-NULL dev also guarantees virt_base_addr, the mailbox offsets and
* the semaphore are visible.
*
* Pairs with smp_store_release(&sock->dev) in hsmp_parse_acpi_table().
*/
if (!smp_load_acquire(&sock->dev))
return -ENODEV;
ret = down_interruptible(&sock->hsmp_sem);
if (ret < 0)
return ret;