AMD General
Hi @Nicolas Bouchinet
Thank you for the review.
The commit message references v1 behavior and is no longer accurate. Writes are
already blocked, the existing debugfs_locked_down() in fs/debugfs/file.c
handles writes when FMODE_WRITE is set, the early-return guard fails and
security_locked_down(LOCKDOWN_DEBUGFS) blocks the open under [integrity].
The patch addresses only the read path. Here is why reads are not blocked by
debugfs_locked_down():
static int debugfs_locked_down(struct inode *inode,
struct file *filp,
const struct file_operations *real_fops)
{
if ((inode->i_mode & 07777 & ~0444) == 0 &&
!(filp->f_mode & FMODE_WRITE) &&
(!real_fops || (!real_fops->unlocked_ioctl &&
!real_fops->compat_ioctl &&
!real_fops->mmap)))
return 0;
if (security_locked_down(LOCKDOWN_DEBUGFS))
return -EPERM;
return 0;
}
For a read-only open of amdgpu_regs (mode 0400, no ioctl, no mmap):
1) (0400 & 07777 & ~0444) == 0 → true - any mode with no bits set outside the
0444 mask (e.g. 0400, 0440, 0444) 0400 satisfies that.
2) !(filp->f_mode & FMODE_WRITE) → true for a read-only open.
3) No unlocked_ioctl, compat_ioctl, or mmap in amdgpu_debugfs_regs_fops → true.
All three conditions hold, so debugfs_locked_down() returns 0 and the read open
proceeds. The read handler then calls RREG32, a direct hardware MMIO read, with
no further lockdown check. That is the gap which this patch is addressing.
Thanks & Regards
Asad
-----Original Message-----
From: Nicolas Bouchinet <[email protected]>
Sent: Monday, June 8, 2026 2:34 PM
To: Kamal, Asad <[email protected]>
Cc: [email protected]; Lazar, Lijo <[email protected]>; Zhang,
Hawking <[email protected]>; Ma, Le <[email protected]>; Zhang, Morris
<[email protected]>; Deucher, Alexander <[email protected]>; Wang,
Yang(Kevin) <[email protected]>; StDenis, Tom <[email protected]>
Subject: Re: [PATCH v3] drm/amdgpu: Gate debugfs MMIO access on kernel lockdown
[Some people who received this message don't often get email from
[email protected]. Learn why this is important at
https://aka.ms/LearnAboutSenderIdentification ]
On Wed, Jun 03, 2026 at 07:44:59PM +0800, Asad Kamal wrote:
> amdgpu_regs, amdgpu_regs2, and related debugfs nodes allow arbitrary
> MMIO read/write via RREG32/WREG32 without checking
> security_locked_down(). On kernel_lockdown=integrity systems this
> bypasses the same restrictions as /dev/mem and PCI config space sysfs.
>
> Check LOCKDOWN_PCI_ACCESS (matching pci-sysfs) at the entry of every
> debugfs handler that performs direct register access.
>
> v2: Use consistent check as per previous check to use
> LOCKDOWN_DEBUGFS(Lijo)
>
> v3: Do not create any entry from amdgpu_debugfs_regs_init() if
> LOCKDOWN_PCI_ACCESS is active and log once. (Lijo)
>
> Signed-off-by: Asad Kamal <[email protected]>
> ---
> drivers/gpu/drm/amd/amdgpu/amdgpu_debugfs.c | 7 +++++++
> 1 file changed, 7 insertions(+)
>
> diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_debugfs.c
> b/drivers/gpu/drm/amd/amdgpu/amdgpu_debugfs.c
> index 0ce6e2e4342c..5c4d4ff001ea 100644
> --- a/drivers/gpu/drm/amd/amdgpu/amdgpu_debugfs.c
> +++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_debugfs.c
> @@ -26,6 +26,7 @@
> #include <linux/kthread.h>
> #include <linux/pci.h>
> #include <linux/uaccess.h>
> +#include <linux/security.h>
> #include <linux/pm_runtime.h>
>
> #include "amdgpu.h"
> @@ -1739,6 +1740,12 @@ int amdgpu_debugfs_regs_init(struct amdgpu_device
> *adev)
> struct dentry *ent, *root = minor->debugfs_root;
> unsigned int i;
>
> + if (security_locked_down(LOCKDOWN_PCI_ACCESS)) {
> + drm_info(adev_to_drm(adev),
> + "amdgpu: HW debugfs nodes disabled (kernel
> lockdown)\n");
> + return 0;
> + }
> +
> for (i = 0; i < ARRAY_SIZE(debugfs_regs); i++) {
> ent = debugfs_create_file(debugfs_regs_names[i],
> S_IFREG | 0400, root,
> --
> 2.46.0
>
Hi,
Lockdown denies opening of debugfs files but those with the following
conditions :
- The file must only be opened for reading.
- The file must have mode 00444.
- The file must not have ioctl methods fops.
- The file must not have mmap fops.
I might be missing something, but how are you able to write in those ?
Best regards,
Nicolas
