Backmerge i915 security patches from commit 'ea0b163b13ff' into drm-next

+5

drivers/gpu/drm/i915/gem/i915_gem_context.c

··· 236 236 free_engines(rcu_access_pointer(ctx->engines)); 237 237 mutex_destroy(&ctx->engines_mutex); 238 238 239 + kfree(ctx->jump_whitelist); 240 + 239 241 if (ctx->timeline) 240 242 intel_timeline_put(ctx->timeline); 241 243 ··· 528 526 529 527 for (i = 0; i < ARRAY_SIZE(ctx->hang_timestamp); i++) 530 528 ctx->hang_timestamp[i] = jiffies - CONTEXT_FAST_HANG_JIFFIES; 529 + 530 + ctx->jump_whitelist = NULL; 531 + ctx->jump_whitelist_cmds = 0; 531 532 532 533 spin_lock(&i915->gem.contexts.lock); 533 534 list_add_tail(&ctx->link, &i915->gem.contexts.list);

+7

drivers/gpu/drm/i915/gem/i915_gem_context_types.h

··· 176 176 * per vm, which may be one per context or shared with the global GTT) 177 177 */ 178 178 struct radix_tree_root handles_vma; 179 + 180 + /** jump_whitelist: Bit array for tracking cmds during cmdparsing 181 + * Guarded by struct_mutex 182 + */ 183 + unsigned long *jump_whitelist; 184 + /** jump_whitelist_cmds: No of cmd slots available */ 185 + u32 jump_whitelist_cmds; 179 186 }; 180 187 181 188 #endif /* __I915_GEM_CONTEXT_TYPES_H__ */

+80 -31

drivers/gpu/drm/i915/gem/i915_gem_execbuffer.c

··· 298 298 299 299 static inline bool eb_use_cmdparser(const struct i915_execbuffer *eb) 300 300 { 301 - return intel_engine_needs_cmd_parser(eb->engine) && eb->batch_len; 301 + return intel_engine_requires_cmd_parser(eb->engine) || 302 + (intel_engine_using_cmd_parser(eb->engine) && 303 + eb->args->batch_len); 302 304 } 303 305 304 306 static int eb_create(struct i915_execbuffer *eb) ··· 1992 1990 return 0; 1993 1991 } 1994 1992 1995 - static struct i915_vma *eb_parse(struct i915_execbuffer *eb, bool is_master) 1993 + static struct i915_vma * 1994 + shadow_batch_pin(struct i915_execbuffer *eb, struct drm_i915_gem_object *obj) 1995 + { 1996 + struct drm_i915_private *dev_priv = eb->i915; 1997 + struct i915_vma * const vma = *eb->vma; 1998 + struct i915_address_space *vm; 1999 + u64 flags; 2000 + 2001 + /* 2002 + * PPGTT backed shadow buffers must be mapped RO, to prevent 2003 + * post-scan tampering 2004 + */ 2005 + if (CMDPARSER_USES_GGTT(dev_priv)) { 2006 + flags = PIN_GLOBAL; 2007 + vm = &dev_priv->ggtt.vm; 2008 + } else if (vma->vm->has_read_only) { 2009 + flags = PIN_USER; 2010 + vm = vma->vm; 2011 + i915_gem_object_set_readonly(obj); 2012 + } else { 2013 + DRM_DEBUG("Cannot prevent post-scan tampering without RO capable vm\n"); 2014 + return ERR_PTR(-EINVAL); 2015 + } 2016 + 2017 + return i915_gem_object_pin(obj, vm, NULL, 0, 0, flags); 2018 + } 2019 + 2020 + static struct i915_vma *eb_parse(struct i915_execbuffer *eb) 1996 2021 { 1997 2022 struct intel_engine_pool_node *pool; 1998 2023 struct i915_vma *vma; 2024 + u64 batch_start; 2025 + u64 shadow_batch_start; 1999 2026 int err; 2000 2027 2001 2028 pool = intel_engine_get_pool(eb->engine, eb->batch_len); 2002 2029 if (IS_ERR(pool)) 2003 2030 return ERR_CAST(pool); 2004 2031 2005 - err = intel_engine_cmd_parser(eb->engine, 2032 + vma = shadow_batch_pin(eb, pool->obj); 2033 + if (IS_ERR(vma)) 2034 + goto err; 2035 + 2036 + batch_start = gen8_canonical_addr(eb->batch->node.start) + 2037 + eb->batch_start_offset; 2038 + 2039 + shadow_batch_start = gen8_canonical_addr(vma->node.start); 2040 + 2041 + err = intel_engine_cmd_parser(eb->gem_context, 2042 + eb->engine, 2006 2043 eb->batch->obj, 2007 - pool->obj, 2044 + batch_start, 2008 2045 eb->batch_start_offset, 2009 2046 eb->batch_len, 2010 - is_master); 2047 + pool->obj, 2048 + shadow_batch_start); 2049 + 2011 2050 if (err) { 2012 - if (err == -EACCES) /* unhandled chained batch */ 2051 + i915_vma_unpin(vma); 2052 + 2053 + /* 2054 + * Unsafe GGTT-backed buffers can still be submitted safely 2055 + * as non-secure. 2056 + * For PPGTT backing however, we have no choice but to forcibly 2057 + * reject unsafe buffers 2058 + */ 2059 + if (CMDPARSER_USES_GGTT(eb->i915) && (err == -EACCES)) 2060 + /* Execute original buffer non-secure */ 2013 2061 vma = NULL; 2014 2062 else 2015 2063 vma = ERR_PTR(err); 2016 2064 goto err; 2017 2065 } 2018 2066 2019 - vma = i915_gem_object_ggtt_pin(pool->obj, NULL, 0, 0, 0); 2020 - if (IS_ERR(vma)) 2021 - goto err; 2022 - 2023 2067 eb->vma[eb->buffer_count] = i915_vma_get(vma); 2024 2068 eb->flags[eb->buffer_count] = 2025 2069 __EXEC_OBJECT_HAS_PIN | __EXEC_OBJECT_HAS_REF; 2026 2070 vma->exec_flags = &eb->flags[eb->buffer_count]; 2027 2071 eb->buffer_count++; 2072 + 2073 + eb->batch_start_offset = 0; 2074 + eb->batch = vma; 2075 + 2076 + if (CMDPARSER_USES_GGTT(eb->i915)) 2077 + eb->batch_flags |= I915_DISPATCH_SECURE; 2078 + 2079 + /* eb->batch_len unchanged */ 2028 2080 2029 2081 vma->private = pool; 2030 2082 return vma; ··· 2486 2430 struct drm_i915_gem_exec_object2 *exec, 2487 2431 struct drm_syncobj **fences) 2488 2432 { 2433 + struct drm_i915_private *i915 = to_i915(dev); 2489 2434 struct i915_execbuffer eb; 2490 2435 struct dma_fence *in_fence = NULL; 2491 2436 struct dma_fence *exec_fence = NULL; ··· 2498 2441 BUILD_BUG_ON(__EXEC_OBJECT_INTERNAL_FLAGS & 2499 2442 ~__EXEC_OBJECT_UNKNOWN_FLAGS); 2500 2443 2501 - eb.i915 = to_i915(dev); 2444 + eb.i915 = i915; 2502 2445 eb.file = file; 2503 2446 eb.args = args; 2504 2447 if (DBG_FORCE_RELOC || !(args->flags & I915_EXEC_NO_RELOC)) ··· 2518 2461 2519 2462 eb.batch_flags = 0; 2520 2463 if (args->flags & I915_EXEC_SECURE) { 2464 + if (INTEL_GEN(i915) >= 11) 2465 + return -ENODEV; 2466 + 2467 + /* Return -EPERM to trigger fallback code on old binaries. */ 2468 + if (!HAS_SECURE_BATCHES(i915)) 2469 + return -EPERM; 2470 + 2521 2471 if (!drm_is_current_master(file) || !capable(CAP_SYS_ADMIN)) 2522 - return -EPERM; 2472 + return -EPERM; 2523 2473 2524 2474 eb.batch_flags |= I915_DISPATCH_SECURE; 2525 2475 } ··· 2603 2539 goto err_vma; 2604 2540 } 2605 2541 2542 + if (eb.batch_len == 0) 2543 + eb.batch_len = eb.batch->size - eb.batch_start_offset; 2544 + 2606 2545 if (eb_use_cmdparser(&eb)) { 2607 2546 struct i915_vma *vma; 2608 2547 2609 - vma = eb_parse(&eb, drm_is_current_master(file)); 2548 + vma = eb_parse(&eb); 2610 2549 if (IS_ERR(vma)) { 2611 2550 err = PTR_ERR(vma); 2612 2551 goto err_vma; 2613 2552 } 2614 - 2615 - if (vma) { 2616 - /* 2617 - * Batch parsed and accepted: 2618 - * 2619 - * Set the DISPATCH_SECURE bit to remove the NON_SECURE 2620 - * bit from MI_BATCH_BUFFER_START commands issued in 2621 - * the dispatch_execbuffer implementations. We 2622 - * specifically don't want that set on batches the 2623 - * command parser has accepted. 2624 - */ 2625 - eb.batch_flags |= I915_DISPATCH_SECURE; 2626 - eb.batch_start_offset = 0; 2627 - eb.batch = vma; 2628 - } 2629 2553 } 2630 - 2631 - if (eb.batch_len == 0) 2632 - eb.batch_len = eb.batch->size - eb.batch_start_offset; 2633 2554 2634 2555 /* 2635 2556 * snb/ivb/vlv conflate the "batch in ppgtt" bit with the "non-secure

+10 -3

drivers/gpu/drm/i915/gt/intel_engine_types.h

··· 454 454 /* status_notifier: list of callbacks for context-switch changes */ 455 455 struct atomic_notifier_head context_status_notifier; 456 456 457 - #define I915_ENGINE_NEEDS_CMD_PARSER BIT(0) 457 + #define I915_ENGINE_USING_CMD_PARSER BIT(0) 458 458 #define I915_ENGINE_SUPPORTS_STATS BIT(1) 459 459 #define I915_ENGINE_HAS_PREEMPTION BIT(2) 460 460 #define I915_ENGINE_HAS_SEMAPHORES BIT(3) 461 461 #define I915_ENGINE_NEEDS_BREADCRUMB_TASKLET BIT(4) 462 462 #define I915_ENGINE_IS_VIRTUAL BIT(5) 463 463 #define I915_ENGINE_HAS_RELATIVE_MMIO BIT(6) 464 + #define I915_ENGINE_REQUIRES_CMD_PARSER BIT(7) 464 465 unsigned int flags; 465 466 466 467 /* ··· 529 528 }; 530 529 531 530 static inline bool 532 - intel_engine_needs_cmd_parser(const struct intel_engine_cs *engine) 531 + intel_engine_using_cmd_parser(const struct intel_engine_cs *engine) 533 532 { 534 - return engine->flags & I915_ENGINE_NEEDS_CMD_PARSER; 533 + return engine->flags & I915_ENGINE_USING_CMD_PARSER; 534 + } 535 + 536 + static inline bool 537 + intel_engine_requires_cmd_parser(const struct intel_engine_cs *engine) 538 + { 539 + return engine->flags & I915_ENGINE_REQUIRES_CMD_PARSER; 535 540 } 536 541 537 542 static inline bool

+308 -131

drivers/gpu/drm/i915/i915_cmd_parser.c

··· 53 53 * granting userspace undue privileges. There are three categories of privilege. 54 54 * 55 55 * First, commands which are explicitly defined as privileged or which should 56 - * only be used by the kernel driver. The parser generally rejects such 57 - * commands, though it may allow some from the drm master process. 56 + * only be used by the kernel driver. The parser rejects such commands 58 57 * 59 58 * Second, commands which access registers. To support correct/enhanced 60 59 * userspace functionality, particularly certain OpenGL extensions, the parser 61 - * provides a whitelist of registers which userspace may safely access (for both 62 - * normal and drm master processes). 60 + * provides a whitelist of registers which userspace may safely access 63 61 * 64 62 * Third, commands which access privileged memory (i.e. GGTT, HWS page, etc). 65 63 * The parser always rejects such commands. ··· 82 84 * in the per-engine command tables. 83 85 * 84 86 * Other command table entries map fairly directly to high level categories 85 - * mentioned above: rejected, master-only, register whitelist. The parser 86 - * implements a number of checks, including the privileged memory checks, via a 87 - * general bitmasking mechanism. 87 + * mentioned above: rejected, register whitelist. The parser implements a number 88 + * of checks, including the privileged memory checks, via a general bitmasking 89 + * mechanism. 88 90 */ 89 91 90 92 /* ··· 102 104 * CMD_DESC_REJECT: The command is never allowed 103 105 * CMD_DESC_REGISTER: The command should be checked against the 104 106 * register whitelist for the appropriate ring 105 - * CMD_DESC_MASTER: The command is allowed if the submitting process 106 - * is the DRM master 107 107 */ 108 108 u32 flags; 109 109 #define CMD_DESC_FIXED (1<<0) ··· 109 113 #define CMD_DESC_REJECT (1<<2) 110 114 #define CMD_DESC_REGISTER (1<<3) 111 115 #define CMD_DESC_BITMASK (1<<4) 112 - #define CMD_DESC_MASTER (1<<5) 113 116 114 117 /* 115 118 * The command's unique identification bits and the bitmask to get them. ··· 189 194 #define CMD(op, opm, f, lm, fl, ...) \ 190 195 { \ 191 196 .flags = (fl) | ((f) ? CMD_DESC_FIXED : 0), \ 192 - .cmd = { (op), ~0u << (opm) }, \ 197 + .cmd = { (op & ~0u << (opm)), ~0u << (opm) }, \ 193 198 .length = { (lm) }, \ 194 199 __VA_ARGS__ \ 195 200 } ··· 204 209 #define R CMD_DESC_REJECT 205 210 #define W CMD_DESC_REGISTER 206 211 #define B CMD_DESC_BITMASK 207 - #define M CMD_DESC_MASTER 208 212 209 213 /* Command Mask Fixed Len Action 210 214 ---------------------------------------------------------- */ 211 - static const struct drm_i915_cmd_descriptor common_cmds[] = { 215 + static const struct drm_i915_cmd_descriptor gen7_common_cmds[] = { 212 216 CMD( MI_NOOP, SMI, F, 1, S ), 213 217 CMD( MI_USER_INTERRUPT, SMI, F, 1, R ), 214 - CMD( MI_WAIT_FOR_EVENT, SMI, F, 1, M ), 218 + CMD( MI_WAIT_FOR_EVENT, SMI, F, 1, R ), 215 219 CMD( MI_ARB_CHECK, SMI, F, 1, S ), 216 220 CMD( MI_REPORT_HEAD, SMI, F, 1, S ), 217 221 CMD( MI_SUSPEND_FLUSH, SMI, F, 1, S ), ··· 240 246 CMD( MI_BATCH_BUFFER_START, SMI, !F, 0xFF, S ), 241 247 }; 242 248 243 - static const struct drm_i915_cmd_descriptor render_cmds[] = { 249 + static const struct drm_i915_cmd_descriptor gen7_render_cmds[] = { 244 250 CMD( MI_FLUSH, SMI, F, 1, S ), 245 251 CMD( MI_ARB_ON_OFF, SMI, F, 1, R ), 246 252 CMD( MI_PREDICATE, SMI, F, 1, S ), ··· 307 313 CMD( MI_URB_ATOMIC_ALLOC, SMI, F, 1, S ), 308 314 CMD( MI_SET_APPID, SMI, F, 1, S ), 309 315 CMD( MI_RS_CONTEXT, SMI, F, 1, S ), 310 - CMD( MI_LOAD_SCAN_LINES_INCL, SMI, !F, 0x3F, M ), 316 + CMD( MI_LOAD_SCAN_LINES_INCL, SMI, !F, 0x3F, R ), 311 317 CMD( MI_LOAD_SCAN_LINES_EXCL, SMI, !F, 0x3F, R ), 312 318 CMD( MI_LOAD_REGISTER_REG, SMI, !F, 0xFF, W, 313 319 .reg = { .offset = 1, .mask = 0x007FFFFC, .step = 1 } ), ··· 324 330 CMD( GFX_OP_3DSTATE_BINDING_TABLE_EDIT_PS, S3D, !F, 0x1FF, S ), 325 331 }; 326 332 327 - static const struct drm_i915_cmd_descriptor video_cmds[] = { 333 + static const struct drm_i915_cmd_descriptor gen7_video_cmds[] = { 328 334 CMD( MI_ARB_ON_OFF, SMI, F, 1, R ), 329 335 CMD( MI_SET_APPID, SMI, F, 1, S ), 330 336 CMD( MI_STORE_DWORD_IMM, SMI, !F, 0xFF, B, ··· 368 374 CMD( MFX_WAIT, SMFX, F, 1, S ), 369 375 }; 370 376 371 - static const struct drm_i915_cmd_descriptor vecs_cmds[] = { 377 + static const struct drm_i915_cmd_descriptor gen7_vecs_cmds[] = { 372 378 CMD( MI_ARB_ON_OFF, SMI, F, 1, R ), 373 379 CMD( MI_SET_APPID, SMI, F, 1, S ), 374 380 CMD( MI_STORE_DWORD_IMM, SMI, !F, 0xFF, B, ··· 406 412 }}, ), 407 413 }; 408 414 409 - static const struct drm_i915_cmd_descriptor blt_cmds[] = { 415 + static const struct drm_i915_cmd_descriptor gen7_blt_cmds[] = { 410 416 CMD( MI_DISPLAY_FLIP, SMI, !F, 0xFF, R ), 411 417 CMD( MI_STORE_DWORD_IMM, SMI, !F, 0x3FF, B, 412 418 .bits = {{ ··· 440 446 }; 441 447 442 448 static const struct drm_i915_cmd_descriptor hsw_blt_cmds[] = { 443 - CMD( MI_LOAD_SCAN_LINES_INCL, SMI, !F, 0x3F, M ), 449 + CMD( MI_LOAD_SCAN_LINES_INCL, SMI, !F, 0x3F, R ), 444 450 CMD( MI_LOAD_SCAN_LINES_EXCL, SMI, !F, 0x3F, R ), 451 + }; 452 + 453 + /* 454 + * For Gen9 we can still rely on the h/w to enforce cmd security, and only 455 + * need to re-enforce the register access checks. We therefore only need to 456 + * teach the cmdparser how to find the end of each command, and identify 457 + * register accesses. The table doesn't need to reject any commands, and so 458 + * the only commands listed here are: 459 + * 1) Those that touch registers 460 + * 2) Those that do not have the default 8-bit length 461 + * 462 + * Note that the default MI length mask chosen for this table is 0xFF, not 463 + * the 0x3F used on older devices. This is because the vast majority of MI 464 + * cmds on Gen9 use a standard 8-bit Length field. 465 + * All the Gen9 blitter instructions are standard 0xFF length mask, and 466 + * none allow access to non-general registers, so in fact no BLT cmds are 467 + * included in the table at all. 468 + * 469 + */ 470 + static const struct drm_i915_cmd_descriptor gen9_blt_cmds[] = { 471 + CMD( MI_NOOP, SMI, F, 1, S ), 472 + CMD( MI_USER_INTERRUPT, SMI, F, 1, S ), 473 + CMD( MI_WAIT_FOR_EVENT, SMI, F, 1, S ), 474 + CMD( MI_FLUSH, SMI, F, 1, S ), 475 + CMD( MI_ARB_CHECK, SMI, F, 1, S ), 476 + CMD( MI_REPORT_HEAD, SMI, F, 1, S ), 477 + CMD( MI_ARB_ON_OFF, SMI, F, 1, S ), 478 + CMD( MI_SUSPEND_FLUSH, SMI, F, 1, S ), 479 + CMD( MI_LOAD_SCAN_LINES_INCL, SMI, !F, 0x3F, S ), 480 + CMD( MI_LOAD_SCAN_LINES_EXCL, SMI, !F, 0x3F, S ), 481 + CMD( MI_STORE_DWORD_IMM, SMI, !F, 0x3FF, S ), 482 + CMD( MI_LOAD_REGISTER_IMM(1), SMI, !F, 0xFF, W, 483 + .reg = { .offset = 1, .mask = 0x007FFFFC, .step = 2 } ), 484 + CMD( MI_UPDATE_GTT, SMI, !F, 0x3FF, S ), 485 + CMD( MI_STORE_REGISTER_MEM_GEN8, SMI, F, 4, W, 486 + .reg = { .offset = 1, .mask = 0x007FFFFC } ), 487 + CMD( MI_FLUSH_DW, SMI, !F, 0x3F, S ), 488 + CMD( MI_LOAD_REGISTER_MEM_GEN8, SMI, F, 4, W, 489 + .reg = { .offset = 1, .mask = 0x007FFFFC } ), 490 + CMD( MI_LOAD_REGISTER_REG, SMI, !F, 0xFF, W, 491 + .reg = { .offset = 1, .mask = 0x007FFFFC, .step = 1 } ), 492 + 493 + /* 494 + * We allow BB_START but apply further checks. We just sanitize the 495 + * basic fields here. 496 + */ 497 + #define MI_BB_START_OPERAND_MASK GENMASK(SMI-1, 0) 498 + #define MI_BB_START_OPERAND_EXPECT (MI_BATCH_PPGTT_HSW | 1) 499 + CMD( MI_BATCH_BUFFER_START_GEN8, SMI, !F, 0xFF, B, 500 + .bits = {{ 501 + .offset = 0, 502 + .mask = MI_BB_START_OPERAND_MASK, 503 + .expected = MI_BB_START_OPERAND_EXPECT, 504 + }}, ), 445 505 }; 446 506 447 507 static const struct drm_i915_cmd_descriptor noop_desc = ··· 511 463 #undef R 512 464 #undef W 513 465 #undef B 514 - #undef M 515 466 516 - static const struct drm_i915_cmd_table gen7_render_cmds[] = { 517 - { common_cmds, ARRAY_SIZE(common_cmds) }, 518 - { render_cmds, ARRAY_SIZE(render_cmds) }, 467 + static const struct drm_i915_cmd_table gen7_render_cmd_table[] = { 468 + { gen7_common_cmds, ARRAY_SIZE(gen7_common_cmds) }, 469 + { gen7_render_cmds, ARRAY_SIZE(gen7_render_cmds) }, 519 470 }; 520 471 521 - static const struct drm_i915_cmd_table hsw_render_ring_cmds[] = { 522 - { common_cmds, ARRAY_SIZE(common_cmds) }, 523 - { render_cmds, ARRAY_SIZE(render_cmds) }, 472 + static const struct drm_i915_cmd_table hsw_render_ring_cmd_table[] = { 473 + { gen7_common_cmds, ARRAY_SIZE(gen7_common_cmds) }, 474 + { gen7_render_cmds, ARRAY_SIZE(gen7_render_cmds) }, 524 475 { hsw_render_cmds, ARRAY_SIZE(hsw_render_cmds) }, 525 476 }; 526 477 527 - static const struct drm_i915_cmd_table gen7_video_cmds[] = { 528 - { common_cmds, ARRAY_SIZE(common_cmds) }, 529 - { video_cmds, ARRAY_SIZE(video_cmds) }, 478 + static const struct drm_i915_cmd_table gen7_video_cmd_table[] = { 479 + { gen7_common_cmds, ARRAY_SIZE(gen7_common_cmds) }, 480 + { gen7_video_cmds, ARRAY_SIZE(gen7_video_cmds) }, 530 481 }; 531 482 532 - static const struct drm_i915_cmd_table hsw_vebox_cmds[] = { 533 - { common_cmds, ARRAY_SIZE(common_cmds) }, 534 - { vecs_cmds, ARRAY_SIZE(vecs_cmds) }, 483 + static const struct drm_i915_cmd_table hsw_vebox_cmd_table[] = { 484 + { gen7_common_cmds, ARRAY_SIZE(gen7_common_cmds) }, 485 + { gen7_vecs_cmds, ARRAY_SIZE(gen7_vecs_cmds) }, 535 486 }; 536 487 537 - static const struct drm_i915_cmd_table gen7_blt_cmds[] = { 538 - { common_cmds, ARRAY_SIZE(common_cmds) }, 539 - { blt_cmds, ARRAY_SIZE(blt_cmds) }, 488 + static const struct drm_i915_cmd_table gen7_blt_cmd_table[] = { 489 + { gen7_common_cmds, ARRAY_SIZE(gen7_common_cmds) }, 490 + { gen7_blt_cmds, ARRAY_SIZE(gen7_blt_cmds) }, 540 491 }; 541 492 542 - static const struct drm_i915_cmd_table hsw_blt_ring_cmds[] = { 543 - { common_cmds, ARRAY_SIZE(common_cmds) }, 544 - { blt_cmds, ARRAY_SIZE(blt_cmds) }, 493 + static const struct drm_i915_cmd_table hsw_blt_ring_cmd_table[] = { 494 + { gen7_common_cmds, ARRAY_SIZE(gen7_common_cmds) }, 495 + { gen7_blt_cmds, ARRAY_SIZE(gen7_blt_cmds) }, 545 496 { hsw_blt_cmds, ARRAY_SIZE(hsw_blt_cmds) }, 546 497 }; 498 + 499 + static const struct drm_i915_cmd_table gen9_blt_cmd_table[] = { 500 + { gen9_blt_cmds, ARRAY_SIZE(gen9_blt_cmds) }, 501 + }; 502 + 547 503 548 504 /* 549 505 * Register whitelists, sorted by increasing register offset. ··· 664 612 REG64_IDX(RING_TIMESTAMP, BLT_RING_BASE), 665 613 }; 666 614 667 - static const struct drm_i915_reg_descriptor ivb_master_regs[] = { 668 - REG32(FORCEWAKE_MT), 669 - REG32(DERRMR), 670 - REG32(GEN7_PIPE_DE_LOAD_SL(PIPE_A)), 671 - REG32(GEN7_PIPE_DE_LOAD_SL(PIPE_B)), 672 - REG32(GEN7_PIPE_DE_LOAD_SL(PIPE_C)), 673 - }; 674 - 675 - static const struct drm_i915_reg_descriptor hsw_master_regs[] = { 676 - REG32(FORCEWAKE_MT), 677 - REG32(DERRMR), 615 + static const struct drm_i915_reg_descriptor gen9_blt_regs[] = { 616 + REG64_IDX(RING_TIMESTAMP, RENDER_RING_BASE), 617 + REG64_IDX(RING_TIMESTAMP, BSD_RING_BASE), 618 + REG32(BCS_SWCTRL), 619 + REG64_IDX(RING_TIMESTAMP, BLT_RING_BASE), 620 + REG64_IDX(BCS_GPR, 0), 621 + REG64_IDX(BCS_GPR, 1), 622 + REG64_IDX(BCS_GPR, 2), 623 + REG64_IDX(BCS_GPR, 3), 624 + REG64_IDX(BCS_GPR, 4), 625 + REG64_IDX(BCS_GPR, 5), 626 + REG64_IDX(BCS_GPR, 6), 627 + REG64_IDX(BCS_GPR, 7), 628 + REG64_IDX(BCS_GPR, 8), 629 + REG64_IDX(BCS_GPR, 9), 630 + REG64_IDX(BCS_GPR, 10), 631 + REG64_IDX(BCS_GPR, 11), 632 + REG64_IDX(BCS_GPR, 12), 633 + REG64_IDX(BCS_GPR, 13), 634 + REG64_IDX(BCS_GPR, 14), 635 + REG64_IDX(BCS_GPR, 15), 678 636 }; 679 637 680 638 #undef REG64 ··· 693 631 struct drm_i915_reg_table { 694 632 const struct drm_i915_reg_descriptor *regs; 695 633 int num_regs; 696 - bool master; 697 634 }; 698 635 699 636 static const struct drm_i915_reg_table ivb_render_reg_tables[] = { 700 - { gen7_render_regs, ARRAY_SIZE(gen7_render_regs), false }, 701 - { ivb_master_regs, ARRAY_SIZE(ivb_master_regs), true }, 637 + { gen7_render_regs, ARRAY_SIZE(gen7_render_regs) }, 702 638 }; 703 639 704 640 static const struct drm_i915_reg_table ivb_blt_reg_tables[] = { 705 - { gen7_blt_regs, ARRAY_SIZE(gen7_blt_regs), false }, 706 - { ivb_master_regs, ARRAY_SIZE(ivb_master_regs), true }, 641 + { gen7_blt_regs, ARRAY_SIZE(gen7_blt_regs) }, 707 642 }; 708 643 709 644 static const struct drm_i915_reg_table hsw_render_reg_tables[] = { 710 - { gen7_render_regs, ARRAY_SIZE(gen7_render_regs), false }, 711 - { hsw_render_regs, ARRAY_SIZE(hsw_render_regs), false }, 712 - { hsw_master_regs, ARRAY_SIZE(hsw_master_regs), true }, 645 + { gen7_render_regs, ARRAY_SIZE(gen7_render_regs) }, 646 + { hsw_render_regs, ARRAY_SIZE(hsw_render_regs) }, 713 647 }; 714 648 715 649 static const struct drm_i915_reg_table hsw_blt_reg_tables[] = { 716 - { gen7_blt_regs, ARRAY_SIZE(gen7_blt_regs), false }, 717 - { hsw_master_regs, ARRAY_SIZE(hsw_master_regs), true }, 650 + { gen7_blt_regs, ARRAY_SIZE(gen7_blt_regs) }, 651 + }; 652 + 653 + static const struct drm_i915_reg_table gen9_blt_reg_tables[] = { 654 + { gen9_blt_regs, ARRAY_SIZE(gen9_blt_regs) }, 718 655 }; 719 656 720 657 static u32 gen7_render_get_cmd_length_mask(u32 cmd_header) ··· 765 704 if (client == INSTR_MI_CLIENT) 766 705 return 0x3F; 767 706 else if (client == INSTR_BC_CLIENT) 707 + return 0xFF; 708 + 709 + DRM_DEBUG_DRIVER("CMD: Abnormal blt cmd length! 0x%08X\n", cmd_header); 710 + return 0; 711 + } 712 + 713 + static u32 gen9_blt_get_cmd_length_mask(u32 cmd_header) 714 + { 715 + u32 client = cmd_header >> INSTR_CLIENT_SHIFT; 716 + 717 + if (client == INSTR_MI_CLIENT || client == INSTR_BC_CLIENT) 768 718 return 0xFF; 769 719 770 720 DRM_DEBUG_DRIVER("CMD: Abnormal blt cmd length! 0x%08X\n", cmd_header); ··· 939 867 int cmd_table_count; 940 868 int ret; 941 869 942 - if (!IS_GEN(engine->i915, 7)) 870 + if (!IS_GEN(engine->i915, 7) && !(IS_GEN(engine->i915, 9) && 871 + engine->class == COPY_ENGINE_CLASS)) 943 872 return; 944 873 945 874 switch (engine->class) { 946 875 case RENDER_CLASS: 947 876 if (IS_HASWELL(engine->i915)) { 948 - cmd_tables = hsw_render_ring_cmds; 877 + cmd_tables = hsw_render_ring_cmd_table; 949 878 cmd_table_count = 950 - ARRAY_SIZE(hsw_render_ring_cmds); 879 + ARRAY_SIZE(hsw_render_ring_cmd_table); 951 880 } else { 952 - cmd_tables = gen7_render_cmds; 953 - cmd_table_count = ARRAY_SIZE(gen7_render_cmds); 881 + cmd_tables = gen7_render_cmd_table; 882 + cmd_table_count = ARRAY_SIZE(gen7_render_cmd_table); 954 883 } 955 884 956 885 if (IS_HASWELL(engine->i915)) { ··· 961 888 engine->reg_tables = ivb_render_reg_tables; 962 889 engine->reg_table_count = ARRAY_SIZE(ivb_render_reg_tables); 963 890 } 964 - 965 891 engine->get_cmd_length_mask = gen7_render_get_cmd_length_mask; 966 892 break; 967 893 case VIDEO_DECODE_CLASS: 968 - cmd_tables = gen7_video_cmds; 969 - cmd_table_count = ARRAY_SIZE(gen7_video_cmds); 894 + cmd_tables = gen7_video_cmd_table; 895 + cmd_table_count = ARRAY_SIZE(gen7_video_cmd_table); 970 896 engine->get_cmd_length_mask = gen7_bsd_get_cmd_length_mask; 971 897 break; 972 898 case COPY_ENGINE_CLASS: 973 - if (IS_HASWELL(engine->i915)) { 974 - cmd_tables = hsw_blt_ring_cmds; 975 - cmd_table_count = ARRAY_SIZE(hsw_blt_ring_cmds); 899 + engine->get_cmd_length_mask = gen7_blt_get_cmd_length_mask; 900 + if (IS_GEN(engine->i915, 9)) { 901 + cmd_tables = gen9_blt_cmd_table; 902 + cmd_table_count = ARRAY_SIZE(gen9_blt_cmd_table); 903 + engine->get_cmd_length_mask = 904 + gen9_blt_get_cmd_length_mask; 905 + 906 + /* BCS Engine unsafe without parser */ 907 + engine->flags |= I915_ENGINE_REQUIRES_CMD_PARSER; 908 + } else if (IS_HASWELL(engine->i915)) { 909 + cmd_tables = hsw_blt_ring_cmd_table; 910 + cmd_table_count = ARRAY_SIZE(hsw_blt_ring_cmd_table); 976 911 } else { 977 - cmd_tables = gen7_blt_cmds; 978 - cmd_table_count = ARRAY_SIZE(gen7_blt_cmds); 912 + cmd_tables = gen7_blt_cmd_table; 913 + cmd_table_count = ARRAY_SIZE(gen7_blt_cmd_table); 979 914 } 980 915 981 - if (IS_HASWELL(engine->i915)) { 916 + if (IS_GEN(engine->i915, 9)) { 917 + engine->reg_tables = gen9_blt_reg_tables; 918 + engine->reg_table_count = 919 + ARRAY_SIZE(gen9_blt_reg_tables); 920 + } else if (IS_HASWELL(engine->i915)) { 982 921 engine->reg_tables = hsw_blt_reg_tables; 983 922 engine->reg_table_count = ARRAY_SIZE(hsw_blt_reg_tables); 984 923 } else { 985 924 engine->reg_tables = ivb_blt_reg_tables; 986 925 engine->reg_table_count = ARRAY_SIZE(ivb_blt_reg_tables); 987 926 } 988 - 989 - engine->get_cmd_length_mask = gen7_blt_get_cmd_length_mask; 990 927 break; 991 928 case VIDEO_ENHANCEMENT_CLASS: 992 - cmd_tables = hsw_vebox_cmds; 993 - cmd_table_count = ARRAY_SIZE(hsw_vebox_cmds); 929 + cmd_tables = hsw_vebox_cmd_table; 930 + cmd_table_count = ARRAY_SIZE(hsw_vebox_cmd_table); 994 931 /* VECS can use the same length_mask function as VCS */ 995 932 engine->get_cmd_length_mask = gen7_bsd_get_cmd_length_mask; 996 933 break; ··· 1026 943 return; 1027 944 } 1028 945 1029 - engine->flags |= I915_ENGINE_NEEDS_CMD_PARSER; 946 + engine->flags |= I915_ENGINE_USING_CMD_PARSER; 1030 947 } 1031 948 1032 949 /** ··· 1038 955 */ 1039 956 void intel_engine_cleanup_cmd_parser(struct intel_engine_cs *engine) 1040 957 { 1041 - if (!intel_engine_needs_cmd_parser(engine)) 958 + if (!intel_engine_using_cmd_parser(engine)) 1042 959 return; 1043 960 1044 961 fini_hash_table(engine); ··· 1112 1029 } 1113 1030 1114 1031 static const struct drm_i915_reg_descriptor * 1115 - find_reg(const struct intel_engine_cs *engine, bool is_master, u32 addr) 1032 + find_reg(const struct intel_engine_cs *engine, u32 addr) 1116 1033 { 1117 1034 const struct drm_i915_reg_table *table = engine->reg_tables; 1035 + const struct drm_i915_reg_descriptor *reg = NULL; 1118 1036 int count = engine->reg_table_count; 1119 1037 1120 - for (; count > 0; ++table, --count) { 1121 - if (!table->master || is_master) { 1122 - const struct drm_i915_reg_descriptor *reg; 1038 + for (; !reg && (count > 0); ++table, --count) 1039 + reg = __find_reg(table->regs, table->num_regs, addr); 1123 1040 1124 - reg = __find_reg(table->regs, table->num_regs, addr); 1125 - if (reg != NULL) 1126 - return reg; 1127 - } 1128 - } 1129 - 1130 - return NULL; 1041 + return reg; 1131 1042 } 1132 1043 1133 1044 /* Returns a vmap'd pointer to dst_obj, which the caller must unmap */ ··· 1205 1128 1206 1129 static bool check_cmd(const struct intel_engine_cs *engine, 1207 1130 const struct drm_i915_cmd_descriptor *desc, 1208 - const u32 *cmd, u32 length, 1209 - const bool is_master) 1131 + const u32 *cmd, u32 length) 1210 1132 { 1211 1133 if (desc->flags & CMD_DESC_SKIP) 1212 1134 return true; 1213 1135 1214 1136 if (desc->flags & CMD_DESC_REJECT) { 1215 1137 DRM_DEBUG_DRIVER("CMD: Rejected command: 0x%08X\n", *cmd); 1216 - return false; 1217 - } 1218 - 1219 - if ((desc->flags & CMD_DESC_MASTER) && !is_master) { 1220 - DRM_DEBUG_DRIVER("CMD: Rejected master-only command: 0x%08X\n", 1221 - *cmd); 1222 1138 return false; 1223 1139 } 1224 1140 ··· 1228 1158 offset += step) { 1229 1159 const u32 reg_addr = cmd[offset] & desc->reg.mask; 1230 1160 const struct drm_i915_reg_descriptor *reg = 1231 - find_reg(engine, is_master, reg_addr); 1161 + find_reg(engine, reg_addr); 1232 1162 1233 1163 if (!reg) { 1234 1164 DRM_DEBUG_DRIVER("CMD: Rejected register 0x%08X in command: 0x%08X (%s)\n", ··· 1306 1236 return true; 1307 1237 } 1308 1238 1239 + static int check_bbstart(const struct i915_gem_context *ctx, 1240 + u32 *cmd, u32 offset, u32 length, 1241 + u32 batch_len, 1242 + u64 batch_start, 1243 + u64 shadow_batch_start) 1244 + { 1245 + u64 jump_offset, jump_target; 1246 + u32 target_cmd_offset, target_cmd_index; 1247 + 1248 + /* For igt compatibility on older platforms */ 1249 + if (CMDPARSER_USES_GGTT(ctx->i915)) { 1250 + DRM_DEBUG("CMD: Rejecting BB_START for ggtt based submission\n"); 1251 + return -EACCES; 1252 + } 1253 + 1254 + if (length != 3) { 1255 + DRM_DEBUG("CMD: Recursive BB_START with bad length(%u)\n", 1256 + length); 1257 + return -EINVAL; 1258 + } 1259 + 1260 + jump_target = *(u64*)(cmd+1); 1261 + jump_offset = jump_target - batch_start; 1262 + 1263 + /* 1264 + * Any underflow of jump_target is guaranteed to be outside the range 1265 + * of a u32, so >= test catches both too large and too small 1266 + */ 1267 + if (jump_offset >= batch_len) { 1268 + DRM_DEBUG("CMD: BB_START to 0x%llx jumps out of BB\n", 1269 + jump_target); 1270 + return -EINVAL; 1271 + } 1272 + 1273 + /* 1274 + * This cannot overflow a u32 because we already checked jump_offset 1275 + * is within the BB, and the batch_len is a u32 1276 + */ 1277 + target_cmd_offset = lower_32_bits(jump_offset); 1278 + target_cmd_index = target_cmd_offset / sizeof(u32); 1279 + 1280 + *(u64*)(cmd + 1) = shadow_batch_start + target_cmd_offset; 1281 + 1282 + if (target_cmd_index == offset) 1283 + return 0; 1284 + 1285 + if (ctx->jump_whitelist_cmds <= target_cmd_index) { 1286 + DRM_DEBUG("CMD: Rejecting BB_START - truncated whitelist array\n"); 1287 + return -EINVAL; 1288 + } else if (!test_bit(target_cmd_index, ctx->jump_whitelist)) { 1289 + DRM_DEBUG("CMD: BB_START to 0x%llx not a previously executed cmd\n", 1290 + jump_target); 1291 + return -EINVAL; 1292 + } 1293 + 1294 + return 0; 1295 + } 1296 + 1297 + static void init_whitelist(struct i915_gem_context *ctx, u32 batch_len) 1298 + { 1299 + const u32 batch_cmds = DIV_ROUND_UP(batch_len, sizeof(u32)); 1300 + const u32 exact_size = BITS_TO_LONGS(batch_cmds); 1301 + u32 next_size = BITS_TO_LONGS(roundup_pow_of_two(batch_cmds)); 1302 + unsigned long *next_whitelist; 1303 + 1304 + if (CMDPARSER_USES_GGTT(ctx->i915)) 1305 + return; 1306 + 1307 + if (batch_cmds <= ctx->jump_whitelist_cmds) { 1308 + bitmap_zero(ctx->jump_whitelist, batch_cmds); 1309 + return; 1310 + } 1311 + 1312 + again: 1313 + next_whitelist = kcalloc(next_size, sizeof(long), GFP_KERNEL); 1314 + if (next_whitelist) { 1315 + kfree(ctx->jump_whitelist); 1316 + ctx->jump_whitelist = next_whitelist; 1317 + ctx->jump_whitelist_cmds = 1318 + next_size * BITS_PER_BYTE * sizeof(long); 1319 + return; 1320 + } 1321 + 1322 + if (next_size > exact_size) { 1323 + next_size = exact_size; 1324 + goto again; 1325 + } 1326 + 1327 + DRM_DEBUG("CMD: Failed to extend whitelist. BB_START may be disallowed\n"); 1328 + bitmap_zero(ctx->jump_whitelist, ctx->jump_whitelist_cmds); 1329 + 1330 + return; 1331 + } 1332 + 1309 1333 #define LENGTH_BIAS 2 1310 1334 1311 1335 /** 1312 1336 * i915_parse_cmds() - parse a submitted batch buffer for privilege violations 1337 + * @ctx: the context in which the batch is to execute 1313 1338 * @engine: the engine on which the batch is to execute 1314 1339 * @batch_obj: the batch buffer in question 1315 - * @shadow_batch_obj: copy of the batch buffer in question 1340 + * @batch_start: Canonical base address of batch 1316 1341 * @batch_start_offset: byte offset in the batch at which execution starts 1317 1342 * @batch_len: length of the commands in batch_obj 1318 - * @is_master: is the submitting process the drm master? 1343 + * @shadow_batch_obj: copy of the batch buffer in question 1344 + * @shadow_batch_start: Canonical base address of shadow_batch_obj 1319 1345 * 1320 1346 * Parses the specified batch buffer looking for privilege violations as 1321 1347 * described in the overview. ··· 1419 1253 * Return: non-zero if the parser finds violations or otherwise fails; -EACCES 1420 1254 * if the batch appears legal but should use hardware parsing 1421 1255 */ 1422 - int intel_engine_cmd_parser(struct intel_engine_cs *engine, 1256 + 1257 + int intel_engine_cmd_parser(struct i915_gem_context *ctx, 1258 + struct intel_engine_cs *engine, 1423 1259 struct drm_i915_gem_object *batch_obj, 1424 - struct drm_i915_gem_object *shadow_batch_obj, 1260 + u64 batch_start, 1425 1261 u32 batch_start_offset, 1426 1262 u32 batch_len, 1427 - bool is_master) 1263 + struct drm_i915_gem_object *shadow_batch_obj, 1264 + u64 shadow_batch_start) 1428 1265 { 1429 - u32 *cmd, *batch_end; 1266 + u32 *cmd, *batch_end, offset = 0; 1430 1267 struct drm_i915_cmd_descriptor default_desc = noop_desc; 1431 1268 const struct drm_i915_cmd_descriptor *desc = &default_desc; 1432 1269 bool needs_clflush_after = false; ··· 1443 1274 return PTR_ERR(cmd); 1444 1275 } 1445 1276 1277 + init_whitelist(ctx, batch_len); 1278 + 1446 1279 /* 1447 1280 * We use the batch length as size because the shadow object is as 1448 1281 * large or larger and copy_batch() will write MI_NOPs to the extra ··· 1454 1283 do { 1455 1284 u32 length; 1456 1285 1457 - if (*cmd == MI_BATCH_BUFFER_END) { 1458 - if (needs_clflush_after) { 1459 - void *ptr = page_mask_bits(shadow_batch_obj->mm.mapping); 1460 - drm_clflush_virt_range(ptr, 1461 - (void *)(cmd + 1) - ptr); 1462 - } 1286 + if (*cmd == MI_BATCH_BUFFER_END) 1463 1287 break; 1464 - } 1465 1288 1466 1289 desc = find_cmd(engine, *cmd, desc, &default_desc); 1467 1290 if (!desc) { 1468 1291 DRM_DEBUG_DRIVER("CMD: Unrecognized command: 0x%08X\n", 1469 1292 *cmd); 1470 1293 ret = -EINVAL; 1471 - break; 1472 - } 1473 - 1474 - /* 1475 - * If the batch buffer contains a chained batch, return an 1476 - * error that tells the caller to abort and dispatch the 1477 - * workload as a non-secure batch. 1478 - */ 1479 - if (desc->cmd.value == MI_BATCH_BUFFER_START) { 1480 - ret = -EACCES; 1481 - break; 1294 + goto err; 1482 1295 } 1483 1296 1484 1297 if (desc->flags & CMD_DESC_FIXED) ··· 1476 1321 length, 1477 1322 batch_end - cmd); 1478 1323 ret = -EINVAL; 1324 + goto err; 1325 + } 1326 + 1327 + if (!check_cmd(engine, desc, cmd, length)) { 1328 + ret = -EACCES; 1329 + goto err; 1330 + } 1331 + 1332 + if (desc->cmd.value == MI_BATCH_BUFFER_START) { 1333 + ret = check_bbstart(ctx, cmd, offset, length, 1334 + batch_len, batch_start, 1335 + shadow_batch_start); 1336 + 1337 + if (ret) 1338 + goto err; 1479 1339 break; 1480 1340 } 1481 1341 1482 - if (!check_cmd(engine, desc, cmd, length, is_master)) { 1483 - ret = -EACCES; 1484 - break; 1485 - } 1342 + if (ctx->jump_whitelist_cmds > offset) 1343 + set_bit(offset, ctx->jump_whitelist); 1486 1344 1487 1345 cmd += length; 1346 + offset += length; 1488 1347 if (cmd >= batch_end) { 1489 1348 DRM_DEBUG_DRIVER("CMD: Got to the end of the buffer w/o a BBE cmd!\n"); 1490 1349 ret = -EINVAL; 1491 - break; 1350 + goto err; 1492 1351 } 1493 1352 } while (1); 1494 1353 1354 + if (needs_clflush_after) { 1355 + void *ptr = page_mask_bits(shadow_batch_obj->mm.mapping); 1356 + 1357 + drm_clflush_virt_range(ptr, (void *)(cmd + 1) - ptr); 1358 + } 1359 + 1360 + err: 1495 1361 i915_gem_object_unpin_map(shadow_batch_obj); 1496 1362 return ret; 1497 1363 } ··· 1533 1357 1534 1358 /* If the command parser is not enabled, report 0 - unsupported */ 1535 1359 for_each_uabi_engine(engine, dev_priv) { 1536 - if (intel_engine_needs_cmd_parser(engine)) { 1360 + if (intel_engine_using_cmd_parser(engine)) { 1537 1361 active = true; 1538 1362 break; 1539 1363 } ··· 1558 1382 * the parser enabled. 1559 1383 * 9. Don't whitelist or handle oacontrol specially, as ownership 1560 1384 * for oacontrol state is moving to i915-perf. 1385 + * 10. Support for Gen9 BCS Parsing 1561 1386 */ 1562 - return 9; 1387 + return 10; 1563 1388 }

+20 -3

drivers/gpu/drm/i915/i915_drv.h

··· 1614 1614 #define VEBOX_MASK(dev_priv) \ 1615 1615 ENGINE_INSTANCES_MASK(dev_priv, VECS0, I915_MAX_VECS) 1616 1616 1617 + /* 1618 + * The Gen7 cmdparser copies the scanned buffer to the ggtt for execution 1619 + * All later gens can run the final buffer from the ppgtt 1620 + */ 1621 + #define CMDPARSER_USES_GGTT(dev_priv) IS_GEN(dev_priv, 7) 1622 + 1617 1623 #define HAS_LLC(dev_priv) (INTEL_INFO(dev_priv)->has_llc) 1618 1624 #define HAS_SNOOP(dev_priv) (INTEL_INFO(dev_priv)->has_snoop) 1619 1625 #define HAS_EDRAM(dev_priv) ((dev_priv)->edram_size_mb) 1626 + #define HAS_SECURE_BATCHES(dev_priv) (INTEL_GEN(dev_priv) < 6) 1620 1627 #define HAS_WT(dev_priv) ((IS_HASWELL(dev_priv) || \ 1621 1628 IS_BROADWELL(dev_priv)) && HAS_EDRAM(dev_priv)) 1622 1629 ··· 1843 1836 unsigned long flags); 1844 1837 #define I915_GEM_OBJECT_UNBIND_ACTIVE BIT(0) 1845 1838 1839 + struct i915_vma * __must_check 1840 + i915_gem_object_pin(struct drm_i915_gem_object *obj, 1841 + struct i915_address_space *vm, 1842 + const struct i915_ggtt_view *view, 1843 + u64 size, 1844 + u64 alignment, 1845 + u64 flags); 1846 + 1846 1847 void i915_gem_runtime_suspend(struct drm_i915_private *dev_priv); 1847 1848 1848 1849 static inline int __must_check ··· 1956 1941 int i915_cmd_parser_get_version(struct drm_i915_private *dev_priv); 1957 1942 void intel_engine_init_cmd_parser(struct intel_engine_cs *engine); 1958 1943 void intel_engine_cleanup_cmd_parser(struct intel_engine_cs *engine); 1959 - int intel_engine_cmd_parser(struct intel_engine_cs *engine, 1944 + int intel_engine_cmd_parser(struct i915_gem_context *cxt, 1945 + struct intel_engine_cs *engine, 1960 1946 struct drm_i915_gem_object *batch_obj, 1961 - struct drm_i915_gem_object *shadow_batch_obj, 1947 + u64 user_batch_start, 1962 1948 u32 batch_start_offset, 1963 1949 u32 batch_len, 1964 - bool is_master); 1950 + struct drm_i915_gem_object *shadow_batch_obj, 1951 + u64 shadow_batch_start); 1965 1952 1966 1953 /* intel_device_info.c */ 1967 1954 static inline struct intel_device_info *

+15 -1

drivers/gpu/drm/i915/i915_gem.c

··· 893 893 { 894 894 struct drm_i915_private *dev_priv = to_i915(obj->base.dev); 895 895 struct i915_address_space *vm = &dev_priv->ggtt.vm; 896 + 897 + return i915_gem_object_pin(obj, vm, view, size, alignment, 898 + flags | PIN_GLOBAL); 899 + } 900 + 901 + struct i915_vma * 902 + i915_gem_object_pin(struct drm_i915_gem_object *obj, 903 + struct i915_address_space *vm, 904 + const struct i915_ggtt_view *view, 905 + u64 size, 906 + u64 alignment, 907 + u64 flags) 908 + { 909 + struct drm_i915_private *dev_priv = to_i915(obj->base.dev); 896 910 struct i915_vma *vma; 897 911 int ret; 898 912 ··· 972 958 return ERR_PTR(ret); 973 959 } 974 960 975 - ret = i915_vma_pin(vma, size, alignment, flags | PIN_GLOBAL); 961 + ret = i915_vma_pin(vma, size, alignment, flags); 976 962 if (ret) 977 963 return ERR_PTR(ret); 978 964

+1 -1

drivers/gpu/drm/i915/i915_getparam.c

··· 63 63 value = !!(i915->caps.scheduler & I915_SCHEDULER_CAP_SEMAPHORES); 64 64 break; 65 65 case I915_PARAM_HAS_SECURE_BATCHES: 66 - value = capable(CAP_SYS_ADMIN); 66 + value = HAS_SECURE_BATCHES(i915) && capable(CAP_SYS_ADMIN); 67 67 break; 68 68 case I915_PARAM_CMD_PARSER_VERSION: 69 69 value = i915_cmd_parser_get_version(i915);

+8

drivers/gpu/drm/i915/i915_reg.h

··· 562 562 */ 563 563 #define BCS_SWCTRL _MMIO(0x22200) 564 564 565 + /* There are 16 GPR registers */ 566 + #define BCS_GPR(n) _MMIO(0x22600 + (n) * 8) 567 + #define BCS_GPR_UDW(n) _MMIO(0x22600 + (n) * 8 + 4) 568 + 565 569 #define GPGPU_THREADS_DISPATCHED _MMIO(0x2290) 566 570 #define GPGPU_THREADS_DISPATCHED_UDW _MMIO(0x2290 + 4) 567 571 #define HS_INVOCATION_COUNT _MMIO(0x2300) ··· 7358 7354 #define TGL_DMC_DEBUG_DC6_COUNT _MMIO(0x101088) 7359 7355 7360 7356 #define DMC_DEBUG3 _MMIO(0x101090) 7357 + 7358 + /* Display Internal Timeout Register */ 7359 + #define RM_TIMEOUT _MMIO(0x42060) 7360 + #define MMIO_TIMEOUT_US(us) ((us) << 0) 7361 7361 7362 7362 /* interrupts */ 7363 7363 #define DE_MASTER_IRQ_CONTROL (1 << 31)

+8

drivers/gpu/drm/i915/intel_pm.c

··· 107 107 */ 108 108 I915_WRITE(GEN9_CLKGATE_DIS_0, I915_READ(GEN9_CLKGATE_DIS_0) | 109 109 PWM1_GATING_DIS | PWM2_GATING_DIS); 110 + 111 + /* 112 + * Lower the display internal timeout. 113 + * This is needed to avoid any hard hangs when DSI port PLL 114 + * is off and a MMIO access is attempted by any privilege 115 + * application, using batch buffers or any other means. 116 + */ 117 + I915_WRITE(RM_TIMEOUT, MMIO_TIMEOUT_US(950)); 110 118 } 111 119 112 120 static void glk_init_clock_gating(struct drm_i915_private *dev_priv)

Configure Feed

Configure Feed