+ "5273183b6362cad9584bdfb5dddb2df30e4f5477": "platform/x86/amd/hsmp: Add IOCTL_GET_TELEMETRY_DATA for metric table reads\n\nThe metric table needs to be delivered to userspace as a single\natomic snapshot, but the current sysfs metrics_bin path is a file\nread: userspace can read it in chunks and observe a torn snapshot\nif an SMU refresh happens between read() calls. The same path is\nalso bounded by PAGE_SIZE, so the ~13 KB table used by HSMP protocol\nversion 7 on Family 1Ah Model 50h-5Fh cannot be returned at all,\nregardless of how userspace reads it. Rather than extend sysfs to\nlift both restrictions, expose the metric table through the\nexisting HSMP character device using a new ioctl that always copies\nthe table in one shot.\n\nAdd struct hsmp_telemetry_data and HSMP_IOCTL_GET_TELEMETRY_DATA\nto the UAPI header. Under the surrounding #pragma pack(4), placing\nthe __u64 user pointer first gives a tight 16-byte layout that is\nidentical for 32- and 64-bit callers, and the trailing __u16\nreserved field is rejected with -EINVAL if non-zero so future\nkernels can repurpose it without breaking already-deployed\nuserspace. The command is encoded with _IOW because the kernel only\nreads the request struct; the snapshot travels through the user\npointer it carries.\n\nThe requested size may be anything from one byte up to the size\nfirmware reported for that socket's table. A short request returns\nthe leading bytes of the snapshot, so userspace built against an\nolder table layout keeps working on firmware that grew the table,\nmirroring the relaxed response_sz rule applied to HSMP messages\nearlier in this series. A request larger than the firmware table is\nrejected with -EINVAL rather than short-written, so a caller can\nnever mistake a partial copy for a full one.\n\nDispatch hsmp_ioctl() on the ioctl command: the existing message\nhandler is factored out as hsmp_ioctl_msg() for HSMP_IOCTL_CMD, and\nHSMP_IOCTL_GET_TELEMETRY_DATA goes to a new\nhsmp_ioctl_get_telemetry() helper.\n\n/dev/hsmp is a singleton character device that outlives an\nindividual socket unbind, so an ioctl issued on an already-open fd\ncan run concurrently with socket teardown. hsmp_sock_rwsem is the\ndriver's contract for that: the data plane takes it for read, and\nprobe and remove take it for write to drain the data plane before\nfreeing the socket array, unmapping the metric tables and\ndestroying the per-socket mutexes. hsmp_ioctl_get_telemetry() takes\nit for read across the socket lookup, the checks on that socket's\nmetric-table state and the table read itself, so none of that state\ncan be torn down underneath it. Without this the handler would\nsleep in its kvmalloc() holding no lock at all, and could resume\nwith a freed socket, locking a destroyed mutex and reading from an\nunmapped iomem region.\n\nThe lock is dropped before the copy_to_user(), because faulting in\nthe destination can block indefinitely on a userfaultfd-backed\nbuffer and would otherwise leave a socket unbind waiting for the\nwrite lock.\n\nSince hsmp_metric_tbl_read() reached the mailbox through\nhsmp_send_message(), which takes hsmp_sock_rwsem itself, calling it\nwith the lock already held would recursively take the read side and\ncan deadlock against a queued writer. Split out\nhsmp_metric_tbl_read_locked(), which asserts the lock and uses\nhsmp_send_message_locked(), and leave hsmp_metric_tbl_read() as a\nwrapper that takes the read lock for the sysfs callers. This also\nbrings the whole fill-and-copy under the rwsem for those callers,\nwhere the memcpy_fromio() previously ran outside it, and makes the\nlock order uniformly hsmp_sock_rwsem -> metric_read_lock ->\nhsmp_sem.\n\nThe user-controlled socket index in HSMP_IOCTL_GET_TELEMETRY_DATA is\nclamped with array_index_nospec() before indexing hsmp_pdev.sock[],\nmitigating Spectre v1 (CVE-2017-5753). Include linux/nospec.h, which\nthe file relied on getting transitively.\n\nCo-developed-by: Muthusamy Ramalingam <muthusamy.ramalingam@amd.com>\nSigned-off-by: Muthusamy Ramalingam <muthusamy.ramalingam@amd.com>\nSigned-off-by: Muralidhara M K <muralidhara.mk@amd.com>\nLink: https://patch.msgid.link/20260727141542.3370108-5-muralidhara.mk@amd.com\nReviewed-by: Ilpo J\u00e4rvinen <ilpo.jarvinen@linux.intel.com>\nSigned-off-by: Ilpo J\u00e4rvinen <ilpo.jarvinen@linux.intel.com>",
0 commit comments