Commit 3659e33c authored Nov 14, 2022 by Andrzej Hajda Committed by Greg Kroah-Hartman Dec 08, 2022

drm/i915: fix TLB invalidation for Gen12 video and compute engines



commit 04aa64375f48a5d430b5550d9271f8428883e550 upstream.

In case of Gen12 video and compute engines, TLB_INV registers are masked -
to modify one bit, corresponding bit in upper half of the register must
be enabled, otherwise nothing happens.

CVE: CVE-2022-4139
Suggested-by: Chris Wilson <chris.p.wilson@intel.com>
Signed-off-by: Andrzej Hajda <andrzej.hajda@intel.com>
Acked-by: Daniel Vetter <daniel.vetter@ffwll.ch>
Fixes: 7938d61591d3 ("drm/i915: Flush TLBs before releasing backing store")
Cc: stable@vger.kernel.org
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

parent 0d1cad59

drivers/gpu/drm/i915/gt/intel_gt.c

+4 −0

Original line number	Original line	Diff line number	Diff line
	@@ -348,6 +348,10 @@ void intel_gt_invalidate_tlbs(struct intel_gt *gt)
	if (!i915_mmio_reg_offset(rb.reg))		if (!i915_mmio_reg_offset(rb.reg))
	continue;		continue;

			if (INTEL_GEN(i915) == 12 && (engine->class == VIDEO_DECODE_CLASS \|\|
			engine->class == VIDEO_ENHANCEMENT_CLASS))
			rb.bit = _MASKED_BIT_ENABLE(rb.bit);

	intel_uncore_write_fw(uncore, rb.reg, rb.bit);		intel_uncore_write_fw(uncore, rb.reg, rb.bit);
	}		}