Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 114d4f70 authored by Brad Volkin's avatar Brad Volkin Committed by Daniel Vetter
Browse files

drm/i915: Reject commands that would store to global HWS page 



PIPE_CONTROL and MI_FLUSH_DW have bits that would write to the
hardware status page. The driver stores request tracking info
there, so don't let userspace overwrite it.

v2: trailing comma fix, rebased

Signed-off-by: default avatarBrad Volkin <bradley.d.volkin@intel.com>
Reviewed-by: default avatarJani Nikula <jani.nikula@intel.com>
Signed-off-by: default avatarDaniel Vetter <daniel.vetter@ffwll.ch>
parent d4d48035

drivers/gpu/drm/i915/i915_cmd_parser.c

+23 −1
Original line number Diff line number Diff line
@@ -193,7 +193,8 @@ static const struct drm_i915_cmd_descriptor render_cmds[] = { 
	      },

	      {

			.offset = 1,

		        .mask = PIPE_CONTROL_GLOBAL_GTT_IVB,

		        .mask = (PIPE_CONTROL_GLOBAL_GTT_IVB |

				 PIPE_CONTROL_STORE_DATA_INDEX),

			.expected = 0,

			.condition_offset = 1,

			.condition_mask = PIPE_CONTROL_POST_SYNC_OP_MASK,
@@ -242,6 +243,13 @@ static const struct drm_i915_cmd_descriptor video_cmds[] = { 
			.expected = 0,

			.condition_offset = 0,

			.condition_mask = MI_FLUSH_DW_OP_MASK,

	      },

	      {

			.offset = 0,

			.mask = MI_FLUSH_DW_STORE_INDEX,

			.expected = 0,

			.condition_offset = 0,

			.condition_mask = MI_FLUSH_DW_OP_MASK,

	      }},						       ),

	CMD(  MI_CONDITIONAL_BATCH_BUFFER_END,  SMI,   !F,  0xFF,   B,

	      .bits = {{
@@ -278,6 +286,13 @@ static const struct drm_i915_cmd_descriptor vecs_cmds[] = { 
			.expected = 0,

			.condition_offset = 0,

			.condition_mask = MI_FLUSH_DW_OP_MASK,

	      },

	      {

			.offset = 0,

			.mask = MI_FLUSH_DW_STORE_INDEX,

			.expected = 0,

			.condition_offset = 0,

			.condition_mask = MI_FLUSH_DW_OP_MASK,

	      }},						       ),

	CMD(  MI_CONDITIONAL_BATCH_BUFFER_END,  SMI,   !F,  0xFF,   B,

	      .bits = {{
@@ -308,6 +323,13 @@ static const struct drm_i915_cmd_descriptor blt_cmds[] = { 
			.expected = 0,

			.condition_offset = 0,

			.condition_mask = MI_FLUSH_DW_OP_MASK,

	      },

	      {

			.offset = 0,

			.mask = MI_FLUSH_DW_STORE_INDEX,

			.expected = 0,

			.condition_offset = 0,

			.condition_mask = MI_FLUSH_DW_OP_MASK,

	      }},						       ),

	CMD(  COLOR_BLT,                        S2D,   !F,  0x3F,   S  ),

	CMD(  SRC_COPY_BLT,                     S2D,   !F,  0x3F,   S  ),

drivers/gpu/drm/i915/i915_reg.h

+1 −0
Original line number Diff line number Diff line
@@ -336,6 +336,7 @@ 
#define GFX_OP_PIPE_CONTROL(len)	((0x3<<29)|(0x3<<27)|(0x2<<24)|(len-2))

#define   PIPE_CONTROL_GLOBAL_GTT_IVB			(1<<24) /* gen7+ */

#define   PIPE_CONTROL_MMIO_WRITE			(1<<23)

#define   PIPE_CONTROL_STORE_DATA_INDEX			(1<<21)

#define   PIPE_CONTROL_CS_STALL				(1<<20)

#define   PIPE_CONTROL_TLB_INVALIDATE			(1<<18)

#define   PIPE_CONTROL_QW_WRITE				(1<<14)