1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
|
// SPDX-License-Identifier: MIT
/*
* Copyright(c) 2020 Intel Corporation.
*/
#include <linux/workqueue.h>
#include "intel_pxp.h"
#include "intel_pxp_irq.h"
#include "intel_pxp_session.h"
#include "intel_pxp_tee.h"
#include "gem/i915_gem_context.h"
#include "gt/intel_context.h"
#include "i915_drv.h"
/**
* DOC: PXP
*
* PXP (Protected Xe Path) is a feature available in Gen12 and newer platforms.
* It allows execution and flip to display of protected (i.e. encrypted)
* objects. The SW support is enabled via the CONFIG_DRM_I915_PXP kconfig.
*
* Objects can opt-in to PXP encryption at creation time via the
* I915_GEM_CREATE_EXT_PROTECTED_CONTENT create_ext flag. For objects to be
* correctly protected they must be used in conjunction with a context created
* with the I915_CONTEXT_PARAM_PROTECTED_CONTENT flag. See the documentation
* of those two uapi flags for details and restrictions.
*
* Protected objects are tied to a pxp session; currently we only support one
* session, which i915 manages and whose index is available in the uapi
* (I915_PROTECTED_CONTENT_DEFAULT_SESSION) for use in instructions targeting
* protected objects.
* The session is invalidated by the HW when certain events occur (e.g.
* suspend/resume). When this happens, all the objects that were used with the
* session are marked as invalid and all contexts marked as using protected
* content are banned. Any further attempt at using them in an execbuf call is
* rejected, while flips are converted to black frames.
*
* Some of the PXP setup operations are performed by the Management Engine,
* which is handled by the mei driver; communication between i915 and mei is
* performed via the mei_pxp component module.
*/
struct intel_gt *pxp_to_gt(const struct intel_pxp *pxp)
{
return container_of(pxp, struct intel_gt, pxp);
}
bool intel_pxp_is_enabled(const struct intel_pxp *pxp)
{
return pxp->ce;
}
bool intel_pxp_is_active(const struct intel_pxp *pxp)
{
return pxp->arb_is_valid;
}
/* KCR register definitions */
#define KCR_INIT _MMIO(0x320f0)
/* Setting KCR Init bit is required after system boot */
#define KCR_INIT_ALLOW_DISPLAY_ME_WRITES REG_BIT(14)
static void kcr_pxp_enable(struct intel_gt *gt)
{
intel_uncore_write(gt->uncore, KCR_INIT,
_MASKED_BIT_ENABLE(KCR_INIT_ALLOW_DISPLAY_ME_WRITES));
}
static void kcr_pxp_disable(struct intel_gt *gt)
{
intel_uncore_write(gt->uncore, KCR_INIT,
_MASKED_BIT_DISABLE(KCR_INIT_ALLOW_DISPLAY_ME_WRITES));
}
static int create_vcs_context(struct intel_pxp *pxp)
{
static struct lock_class_key pxp_lock;
struct intel_gt *gt = pxp_to_gt(pxp);
struct intel_engine_cs *engine;
struct intel_context *ce;
int i;
/*
* Find the first VCS engine present. We're guaranteed there is one
* if we're in this function due to the check in has_pxp
*/
for (i = 0, engine = NULL; !engine; i++)
engine = gt->engine_class[VIDEO_DECODE_CLASS][i];
GEM_BUG_ON(!engine || engine->class != VIDEO_DECODE_CLASS);
ce = intel_engine_create_pinned_context(engine, engine->gt->vm, SZ_4K,
I915_GEM_HWS_PXP_ADDR,
&pxp_lock, "pxp_context");
if (IS_ERR(ce)) {
drm_err(>->i915->drm, "failed to create VCS ctx for PXP\n");
return PTR_ERR(ce);
}
pxp->ce = ce;
return 0;
}
static void destroy_vcs_context(struct intel_pxp *pxp)
{
intel_engine_destroy_pinned_context(fetch_and_zero(&pxp->ce));
}
void intel_pxp_init(struct intel_pxp *pxp)
{
struct intel_gt *gt = pxp_to_gt(pxp);
int ret;
if (!HAS_PXP(gt->i915))
return;
mutex_init(&pxp->tee_mutex);
/*
* we'll use the completion to check if there is a termination pending,
* so we start it as completed and we reinit it when a termination
* is triggered.
*/
init_completion(&pxp->termination);
complete_all(&pxp->termination);
mutex_init(&pxp->arb_mutex);
INIT_WORK(&pxp->session_work, intel_pxp_session_work);
ret = create_vcs_context(pxp);
if (ret)
return;
ret = intel_pxp_tee_component_init(pxp);
if (ret)
goto out_context;
drm_info(>->i915->drm, "Protected Xe Path (PXP) protected content support initialized\n");
return;
out_context:
destroy_vcs_context(pxp);
}
void intel_pxp_fini(struct intel_pxp *pxp)
{
if (!intel_pxp_is_enabled(pxp))
return;
pxp->arb_is_valid = false;
intel_pxp_tee_component_fini(pxp);
destroy_vcs_context(pxp);
}
void intel_pxp_mark_termination_in_progress(struct intel_pxp *pxp)
{
pxp->arb_is_valid = false;
reinit_completion(&pxp->termination);
}
static void pxp_queue_termination(struct intel_pxp *pxp)
{
struct intel_gt *gt = pxp_to_gt(pxp);
/*
* We want to get the same effect as if we received a termination
* interrupt, so just pretend that we did.
*/
spin_lock_irq(>->irq_lock);
intel_pxp_mark_termination_in_progress(pxp);
pxp->session_events |= PXP_TERMINATION_REQUEST;
queue_work(system_unbound_wq, &pxp->session_work);
spin_unlock_irq(>->irq_lock);
}
static bool pxp_component_bound(struct intel_pxp *pxp)
{
bool bound = false;
mutex_lock(&pxp->tee_mutex);
if (pxp->pxp_component)
bound = true;
mutex_unlock(&pxp->tee_mutex);
return bound;
}
/*
* the arb session is restarted from the irq work when we receive the
* termination completion interrupt
*/
int intel_pxp_start(struct intel_pxp *pxp)
{
int ret = 0;
if (!intel_pxp_is_enabled(pxp))
return -ENODEV;
if (wait_for(pxp_component_bound(pxp), 250))
return -ENXIO;
mutex_lock(&pxp->arb_mutex);
if (pxp->arb_is_valid)
goto unlock;
pxp_queue_termination(pxp);
if (!wait_for_completion_timeout(&pxp->termination,
msecs_to_jiffies(250))) {
ret = -ETIMEDOUT;
goto unlock;
}
/* make sure the compiler doesn't optimize the double access */
barrier();
if (!pxp->arb_is_valid)
ret = -EIO;
unlock:
mutex_unlock(&pxp->arb_mutex);
return ret;
}
void intel_pxp_init_hw(struct intel_pxp *pxp)
{
kcr_pxp_enable(pxp_to_gt(pxp));
intel_pxp_irq_enable(pxp);
}
void intel_pxp_fini_hw(struct intel_pxp *pxp)
{
kcr_pxp_disable(pxp_to_gt(pxp));
intel_pxp_irq_disable(pxp);
}
int intel_pxp_key_check(struct intel_pxp *pxp,
struct drm_i915_gem_object *obj,
bool assign)
{
if (!intel_pxp_is_active(pxp))
return -ENODEV;
if (!i915_gem_object_is_protected(obj))
return -EINVAL;
GEM_BUG_ON(!pxp->key_instance);
/*
* If this is the first time we're using this object, it's not
* encrypted yet; it will be encrypted with the current key, so mark it
* as such. If the object is already encrypted, check instead if the
* used key is still valid.
*/
if (!obj->pxp_key_instance && assign)
obj->pxp_key_instance = pxp->key_instance;
if (obj->pxp_key_instance != pxp->key_instance)
return -ENOEXEC;
return 0;
}
void intel_pxp_invalidate(struct intel_pxp *pxp)
{
struct drm_i915_private *i915 = pxp_to_gt(pxp)->i915;
struct i915_gem_context *ctx, *cn;
/* ban all contexts marked as protected */
spin_lock_irq(&i915->gem.contexts.lock);
list_for_each_entry_safe(ctx, cn, &i915->gem.contexts.list, link) {
struct i915_gem_engines_iter it;
struct intel_context *ce;
if (!kref_get_unless_zero(&ctx->ref))
continue;
if (likely(!i915_gem_context_uses_protected_content(ctx))) {
i915_gem_context_put(ctx);
continue;
}
spin_unlock_irq(&i915->gem.contexts.lock);
/*
* By the time we get here we are either going to suspend with
* quiesced execution or the HW keys are already long gone and
* in this case it is worthless to attempt to close the context
* and wait for its execution. It will hang the GPU if it has
* not already. So, as a fast mitigation, we can ban the
* context as quick as we can. That might race with the
* execbuffer, but currently this is the best that can be done.
*/
for_each_gem_engine(ce, i915_gem_context_lock_engines(ctx), it)
intel_context_ban(ce, NULL);
i915_gem_context_unlock_engines(ctx);
/*
* The context has been banned, no need to keep the wakeref.
* This is safe from races because the only other place this
* is touched is context_release and we're holding a ctx ref
*/
if (ctx->pxp_wakeref) {
intel_runtime_pm_put(&i915->runtime_pm,
ctx->pxp_wakeref);
ctx->pxp_wakeref = 0;
}
spin_lock_irq(&i915->gem.contexts.lock);
list_safe_reset_next(ctx, cn, link);
i915_gem_context_put(ctx);
}
spin_unlock_irq(&i915->gem.contexts.lock);
}
|