UBUNTU: SAUCE: drm/i915: Add support for mandatory cmdparsing

CVE-2019-0155

The existing cmdparser for gen7 can be bypassed by specifying
batch_len=0 in the execbuf call. This is safe because bypassing
simply reduces the cmd-set available.

In a later patch we will introduce cmdparsing for gen9, as a
security measure, which must be strictly enforced since without
it we are vulnerable to DoS attacks.

Introduce the concept of 'required' cmd parsing that cannot be
bypassed by submitting zero-length bb's.

v2: rebase (Mika)
v2: rebase (Mika)
v3: fix conflict on engine flags (Mika)

Signed-off-by: Jon Bloomfield <jon.bloomfield@intel.com>
Cc: Joonas Lahtinen <joonas.lahtinen@intel.com>
Cc: Rodrigo Vivi <rodrigo.vivi@intel.com>
Signed-off-by: Mika Kuoppala <mika.kuoppala@linux.intel.com>
[tyhicks: Backport to 5.0
 - The intel_engine_types.h changes needed to be rerouted to
   intel_ringbuffer.h
 - Adjust flags list due to missing flags
 - Adjust context in for loop in i915_cmd_parser_get_version()
 - i915_gem_execbuffer.c is higher up one directory level]
Signed-off-by: Tyler Hicks <tyhicks@canonical.com>
Acked-by: Timo Aaltonen <tjaalton@ubuntu.com>
Signed-off-by: Stefan Bader <stefan.bader@canonical.com>

diff --git a/drivers/gpu/drm/i915/i915_cmd_parser.c b/drivers/gpu/drm/i915/i915_cmd_parser.c
index 59d1432ecbbfc133b6fe0d67e9437301788a14da..5fa6a68e03cdc81ac2538806e7f48767c791b9ea 100644 (file)
--- a/drivers/gpu/drm/i915/i915_cmd_parser.c
+++ b/drivers/gpu/drm/i915/i915_cmd_parser.c
@@ -916,7 +916,7 @@ void intel_engine_init_cmd_parser(struct intel_engine_cs *engine)
                return;
        }
 
-       engine->flags |= I915_ENGINE_NEEDS_CMD_PARSER;
+       engine->flags |= I915_ENGINE_USING_CMD_PARSER;
 }
 
 /**
@@ -928,7 +928,7 @@ void intel_engine_init_cmd_parser(struct intel_engine_cs *engine)
  */
 void intel_engine_cleanup_cmd_parser(struct intel_engine_cs *engine)
 {
-       if (!intel_engine_needs_cmd_parser(engine))
+       if (!intel_engine_using_cmd_parser(engine))
                return;
 
        fini_hash_table(engine);
@@ -1317,7 +1317,7 @@ int i915_cmd_parser_get_version(struct drm_i915_private *dev_priv)
 
        /* If the command parser is not enabled, report 0 - unsupported */
        for_each_engine(engine, dev_priv, id) {
-               if (intel_engine_needs_cmd_parser(engine)) {
+               if (intel_engine_using_cmd_parser(engine)) {
                        active = true;
                        break;
                }

diff --git a/drivers/gpu/drm/i915/i915_gem_execbuffer.c b/drivers/gpu/drm/i915/i915_gem_execbuffer.c
index 0d03c74b59bf9711478d51cf2ed5bef96ce75b33..ea33d9f6531d25ca3f62cbe0655cdf43d4043259 100644 (file)
--- a/drivers/gpu/drm/i915/i915_gem_execbuffer.c
+++ b/drivers/gpu/drm/i915/i915_gem_execbuffer.c
@@ -311,7 +311,8 @@ static inline u64 gen8_noncanonical_addr(u64 address)
 
 static inline bool eb_use_cmdparser(const struct i915_execbuffer *eb)
 {
-       return intel_engine_needs_cmd_parser(eb->engine) && eb->batch_len;
+       return intel_engine_requires_cmd_parser(eb->engine) ||
+               (intel_engine_using_cmd_parser(eb->engine) && eb->batch_len);
 }
 
 static int eb_create(struct i915_execbuffer *eb)

diff --git a/drivers/gpu/drm/i915/intel_ringbuffer.h b/drivers/gpu/drm/i915/intel_ringbuffer.h
index a1a7cc29fdd1a5e8131e0b70f8bc40189006cefb..9d70ddd63ffc590a0d68a7747a395f52befcb166 100644 (file)
--- a/drivers/gpu/drm/i915/intel_ringbuffer.h
+++ b/drivers/gpu/drm/i915/intel_ringbuffer.h
@@ -583,9 +583,10 @@ struct intel_engine_cs {
 
        struct intel_engine_hangcheck hangcheck;
 
-#define I915_ENGINE_NEEDS_CMD_PARSER BIT(0)
+#define I915_ENGINE_USING_CMD_PARSER BIT(0)
 #define I915_ENGINE_SUPPORTS_STATS   BIT(1)
 #define I915_ENGINE_HAS_PREEMPTION   BIT(2)
+#define I915_ENGINE_REQUIRES_CMD_PARSER BIT(3)
        unsigned int flags;
 
        /*
@@ -646,9 +647,15 @@ struct intel_engine_cs {
 };
 
 static inline bool
-intel_engine_needs_cmd_parser(const struct intel_engine_cs *engine)
+intel_engine_using_cmd_parser(const struct intel_engine_cs *engine)
 {
-       return engine->flags & I915_ENGINE_NEEDS_CMD_PARSER;
+       return engine->flags & I915_ENGINE_USING_CMD_PARSER;
+}
+
+static inline bool
+intel_engine_requires_cmd_parser(const struct intel_engine_cs *engine)
+{
+       return engine->flags & I915_ENGINE_REQUIRES_CMD_PARSER;
 }
 
 static inline bool