1 files changed, 152 insertions, 0 deletions
diff --git a/meta-amd-bsp/recipes-kernel/linux/linux-yocto-4.19.8/3230-drm-amdgpu-Implement-VRAM-wipe-on-release.patch b/meta-amd-bsp/recipes-kernel/linux/linux-yocto-4.19.8/3230-drm-amdgpu-Implement-VRAM-wipe-on-release.patch
new file mode 100644
index 00000000..f8c93779
--- /dev/null
+++ b/meta-amd-bsp/recipes-kernel/linux/linux-yocto-4.19.8/3230-drm-amdgpu-Implement-VRAM-wipe-on-release.patch
@@ -0,0 +1,152 @@
+From ab078e115c18e916aed4da927c4dec714e05a6af Mon Sep 17 00:00:00 2001
+From: Felix Kuehling <Felix.Kuehling@amd.com>
+Date: Tue, 9 Jul 2019 19:12:44 -0400
+Subject: [PATCH 3230/4256] drm/amdgpu: Implement VRAM wipe on release
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+Wipe VRAM memory containing sensitive data when moving or releasing
+BOs. Clearing the memory is pipelined to minimize any impact on
+subsequent memory allocation latency. Use of a poison value should
+help debug future use-after-free bugs.
+
+When moving BOs, the existing ttm_bo_pipelined_move ensures that the
+memory won't be reused before being wiped.
+
+When releasing BOs, the BO is fenced with the memory fill operation,
+which results in queuing the BO for a delayed delete.
+
+v2: Move amdgpu_amdkfd_unreserve_memory_limit into
+amdgpu_bo_release_notify so that KFD can use memory that's still
+being cleared in the background
+
+Signed-off-by: Felix Kuehling <Felix.Kuehling@amd.com>
+Reviewed-by: Christian König <christian.koenig@amd.com>
+---
+ drivers/gpu/drm/amd/amdgpu/amdgpu_object.c | 39 ++++++++++++++++++++--
+ drivers/gpu/drm/amd/amdgpu/amdgpu_object.h |  1 +
+ drivers/gpu/drm/amd/amdgpu/amdgpu_ttm.c    | 17 ++++++++++
+ drivers/gpu/drm/amd/amdgpu/amdgpu_ttm.h    |  2 ++
+ 4 files changed, 56 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_object.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_object.c
+index 495c5d33fc62..c983b386889c 100644
+--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_object.c
++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_object.c
+@@ -82,9 +82,6 @@ static void amdgpu_bo_destroy(struct ttm_buffer_object *tbo)
+ 	if (bo->pin_count > 0)
+ 		amdgpu_bo_subtract_pin_size(bo);
+ 
+-	if (bo->kfd_bo)
+-		amdgpu_amdkfd_unreserve_memory_limit(bo);
+-
+ 	amdgpu_bo_kunmap(bo);
+ 
+ 	if (bo->gem_base.import_attach)
+@@ -1253,6 +1250,42 @@ void amdgpu_bo_move_notify(struct ttm_buffer_object *bo,
+ 	trace_amdgpu_bo_move(abo, new_mem->mem_type, old_mem->mem_type);
+ }
+ 
++/**
++ * amdgpu_bo_move_notify - notification about a BO being released
++ * @bo: pointer to a buffer object
++ *
++ * Wipes VRAM buffers whose contents should not be leaked before the
++ * memory is released.
++ */
++void amdgpu_bo_release_notify(struct ttm_buffer_object *bo)
++{
++	struct dma_fence *fence = NULL;
++	struct amdgpu_bo *abo;
++	int r;
++
++	if (!amdgpu_bo_is_amdgpu_bo(bo))
++		return;
++
++	abo = ttm_to_amdgpu_bo(bo);
++
++	if (abo->kfd_bo)
++		amdgpu_amdkfd_unreserve_memory_limit(abo);
++
++	if (bo->mem.mem_type != TTM_PL_VRAM || !bo->mem.mm_node ||
++	    !(abo->flags & AMDGPU_GEM_CREATE_VRAM_WIPE_ON_RELEASE))
++		return;
++
++	reservation_object_lock(bo->resv, NULL);
++
++	r = amdgpu_fill_buffer(abo, AMDGPU_POISON, bo->resv, &fence);
++	if (!WARN_ON(r)) {
++		amdgpu_bo_fence(abo, fence, false);
++		dma_fence_put(fence);
++	}
++
++	reservation_object_unlock(bo->resv);
++}
++
+ /**
+  * amdgpu_bo_fault_reserve_notify - notification about a memory fault
+  * @bo: pointer to a buffer object
+diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_object.h b/drivers/gpu/drm/amd/amdgpu/amdgpu_object.h
+index 6658c2399223..aed30cc3f4ca 100644
+--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_object.h
++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_object.h
+@@ -269,6 +269,7 @@ int amdgpu_bo_get_metadata(struct amdgpu_bo *bo, void *buffer,
+ void amdgpu_bo_move_notify(struct ttm_buffer_object *bo,
+ 			   bool evict,
+ 			   struct ttm_mem_reg *new_mem);
++void amdgpu_bo_release_notify(struct ttm_buffer_object *bo);
+ int amdgpu_bo_fault_reserve_notify(struct ttm_buffer_object *bo);
+ void amdgpu_bo_fence(struct amdgpu_bo *bo, struct dma_fence *fence,
+ 		     bool shared);
+diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_ttm.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_ttm.c
+index ff0ab1521cde..5b21dae64755 100644
+--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_ttm.c
++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_ttm.c
+@@ -555,6 +555,22 @@ static int amdgpu_move_blit(struct ttm_buffer_object *bo,
+ 	if (r)
+ 		goto error;
+ 
++	/* clear the space being freed */
++	if (old_mem->mem_type == TTM_PL_VRAM &&
++	    (ttm_to_amdgpu_bo(bo)->flags &
++	     AMDGPU_GEM_CREATE_VRAM_WIPE_ON_RELEASE)) {
++		struct dma_fence *wipe_fence = NULL;
++
++		r = amdgpu_fill_buffer(ttm_to_amdgpu_bo(bo), AMDGPU_POISON,
++				       NULL, &wipe_fence);
++		if (r) {
++			goto error;
++		} else if (wipe_fence) {
++			dma_fence_put(fence);
++			fence = wipe_fence;
++		}
++	}
++
+ 	/* Always block for VM page tables before committing the new location */
+ 	if (bo->type == ttm_bo_type_kernel)
+ 		r = ttm_bo_move_accel_cleanup(bo, fence, true, new_mem);
+@@ -1741,6 +1757,7 @@ static struct ttm_bo_driver amdgpu_bo_driver = {
+ 	.move = &amdgpu_bo_move,
+ 	.verify_access = &amdgpu_verify_access,
+ 	.move_notify = &amdgpu_bo_move_notify,
++	.release_notify = &amdgpu_bo_release_notify,
+ 	.fault_reserve_notify = &amdgpu_bo_fault_reserve_notify,
+ 	.io_mem_reserve = &amdgpu_ttm_io_mem_reserve,
+ 	.io_mem_free = &amdgpu_ttm_io_mem_free,
+diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_ttm.h b/drivers/gpu/drm/amd/amdgpu/amdgpu_ttm.h
+index 6b93fcb0b12e..b92297987138 100644
+--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_ttm.h
++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_ttm.h
+@@ -42,6 +42,8 @@
+ #define AMDGPU_GTT_MAX_TRANSFER_SIZE	512
+ #define AMDGPU_GTT_NUM_TRANSFER_WINDOWS	2
+ 
++#define AMDGPU_POISON	0xd0bed0be
++
+ struct amdgpu_mman {
+ 	struct ttm_bo_global_ref        bo_global_ref;
+ 	struct drm_global_reference	mem_global_ref;
+-- 
+2.17.1
+