111 lines
3.6 KiB
Diff
111 lines
3.6 KiB
Diff
From: Jon Bloomfield <jon.bloomfield@intel.com>
|
|
Date: Wed, 1 Aug 2018 09:33:59 -0700
|
|
Subject: drm/i915: Add support for mandatory cmdparsing
|
|
Bug-Debian-Security: https://security-tracker.debian.org/tracker/CVE-2019-0155
|
|
|
|
commit 311a50e76a33d1e029563c24b2ff6db0c02b5afe upstream.
|
|
|
|
The existing cmdparser for gen7 can be bypassed by specifying
|
|
batch_len=0 in the execbuf call. This is safe because bypassing
|
|
simply reduces the cmd-set available.
|
|
|
|
In a later patch we will introduce cmdparsing for gen9, as a
|
|
security measure, which must be strictly enforced since without
|
|
it we are vulnerable to DoS attacks.
|
|
|
|
Introduce the concept of 'required' cmd parsing that cannot be
|
|
bypassed by submitting zero-length bb's.
|
|
|
|
v2: rebase (Mika)
|
|
v2: rebase (Mika)
|
|
v3: fix conflict on engine flags (Mika)
|
|
|
|
Signed-off-by: Jon Bloomfield <jon.bloomfield@intel.com>
|
|
Cc: Tony Luck <tony.luck@intel.com>
|
|
Cc: Dave Airlie <airlied@redhat.com>
|
|
Cc: Takashi Iwai <tiwai@suse.de>
|
|
Cc: Tyler Hicks <tyhicks@canonical.com>
|
|
Signed-off-by: Mika Kuoppala <mika.kuoppala@linux.intel.com>
|
|
Reviewed-by: Chris Wilson <chris.p.wilson@intel.com>
|
|
---
|
|
drivers/gpu/drm/i915/i915_cmd_parser.c | 6 +++---
|
|
drivers/gpu/drm/i915/i915_gem_execbuffer.c | 3 ++-
|
|
drivers/gpu/drm/i915/intel_ringbuffer.h | 17 ++++++++++++-----
|
|
3 files changed, 17 insertions(+), 9 deletions(-)
|
|
|
|
--- a/drivers/gpu/drm/i915/i915_cmd_parser.c
|
|
+++ b/drivers/gpu/drm/i915/i915_cmd_parser.c
|
|
@@ -916,7 +916,7 @@ void intel_engine_init_cmd_parser(struct
|
|
return;
|
|
}
|
|
|
|
- engine->flags |= I915_ENGINE_NEEDS_CMD_PARSER;
|
|
+ engine->flags |= I915_ENGINE_USING_CMD_PARSER;
|
|
}
|
|
|
|
/**
|
|
@@ -928,7 +928,7 @@ void intel_engine_init_cmd_parser(struct
|
|
*/
|
|
void intel_engine_cleanup_cmd_parser(struct intel_engine_cs *engine)
|
|
{
|
|
- if (!intel_engine_needs_cmd_parser(engine))
|
|
+ if (!intel_engine_using_cmd_parser(engine))
|
|
return;
|
|
|
|
fini_hash_table(engine);
|
|
@@ -1317,7 +1317,7 @@ int i915_cmd_parser_get_version(struct d
|
|
|
|
/* If the command parser is not enabled, report 0 - unsupported */
|
|
for_each_engine(engine, dev_priv, id) {
|
|
- if (intel_engine_needs_cmd_parser(engine)) {
|
|
+ if (intel_engine_using_cmd_parser(engine)) {
|
|
active = true;
|
|
break;
|
|
}
|
|
--- a/drivers/gpu/drm/i915/i915_gem_execbuffer.c
|
|
+++ b/drivers/gpu/drm/i915/i915_gem_execbuffer.c
|
|
@@ -309,7 +309,8 @@ static inline u64 gen8_noncanonical_addr
|
|
|
|
static inline bool eb_use_cmdparser(const struct i915_execbuffer *eb)
|
|
{
|
|
- return intel_engine_needs_cmd_parser(eb->engine) && eb->batch_len;
|
|
+ return intel_engine_requires_cmd_parser(eb->engine) ||
|
|
+ (intel_engine_using_cmd_parser(eb->engine) && eb->batch_len);
|
|
}
|
|
|
|
static int eb_create(struct i915_execbuffer *eb)
|
|
--- a/drivers/gpu/drm/i915/intel_ringbuffer.h
|
|
+++ b/drivers/gpu/drm/i915/intel_ringbuffer.h
|
|
@@ -584,9 +584,10 @@ struct intel_engine_cs {
|
|
|
|
struct intel_engine_hangcheck hangcheck;
|
|
|
|
-#define I915_ENGINE_NEEDS_CMD_PARSER BIT(0)
|
|
-#define I915_ENGINE_SUPPORTS_STATS BIT(1)
|
|
-#define I915_ENGINE_HAS_PREEMPTION BIT(2)
|
|
+#define I915_ENGINE_USING_CMD_PARSER BIT(0)
|
|
+#define I915_ENGINE_SUPPORTS_STATS BIT(1)
|
|
+#define I915_ENGINE_HAS_PREEMPTION BIT(2)
|
|
+#define I915_ENGINE_REQUIRES_CMD_PARSER BIT(3)
|
|
unsigned int flags;
|
|
|
|
/*
|
|
@@ -647,9 +648,15 @@ struct intel_engine_cs {
|
|
};
|
|
|
|
static inline bool
|
|
-intel_engine_needs_cmd_parser(const struct intel_engine_cs *engine)
|
|
+intel_engine_using_cmd_parser(const struct intel_engine_cs *engine)
|
|
{
|
|
- return engine->flags & I915_ENGINE_NEEDS_CMD_PARSER;
|
|
+ return engine->flags & I915_ENGINE_USING_CMD_PARSER;
|
|
+}
|
|
+
|
|
+static inline bool
|
|
+intel_engine_requires_cmd_parser(const struct intel_engine_cs *engine)
|
|
+{
|
|
+ return engine->flags & I915_ENGINE_REQUIRES_CMD_PARSER;
|
|
}
|
|
|
|
static inline bool
|