~tyhicks/ubuntu/+source/linux/+git/bionic:cves/CVE-2020-8832

Last commit made on 2020-02-11
Get this branch:
git clone -b cves/CVE-2020-8832 https://git.launchpad.net/~tyhicks/ubuntu/+source/linux/+git/bionic
Only Tyler Hicks can upload to this branch. If you are Tyler Hicks please log in for upload directions.

Branch merges

Branch information

Name:
cves/CVE-2020-8832
Repository:
lp:~tyhicks/ubuntu/+source/linux/+git/bionic

Recent commits

25df7fc... by Chris Wilson

drm/i915: Record the default hw state after reset upon load

BugLink: https://bugs.launchpad.net/bugs/1862840

Take a copy of the HW state after a reset upon module loading by
executing a context switch from a blank context to the kernel context,
thus saving the default hw state over the blank context image.
We can then use the default hw state to initialise any future context,
ensuring that each starts with the default view of hw state.

v2: Unmap our default state from the GTT after stealing it from the
context. This should stop us from accidentally overwriting it via the
GTT (and frees up some precious GTT space).

Testcase: igt/gem_ctx_isolation
Signed-off-by: Chris Wilson <email address hidden>
Cc: Ville Syrjälä <email address hidden>
Cc: Joonas Lahtinen <email address hidden>
Reviewed-by: Joonas Lahtinen <email address hidden>
Link: https://patchwork<email address hidden>

CVE-2020-8832

(backported from commit d2b4b97933f5adacfba42dc3b9200d0e21fbe2c4)
[tyhicks: Backport to 4.15:
 - The HAS_LOGICAL_RING_PREEMPTION() macro does not exist because we
   don't have commit a4598d17551a ("drm/i915: Rename helpers used for
   unwinding, use macro for can_preempt")]
Signed-off-by: Tyler Hicks <email address hidden>

759ca71... by Chris Wilson

drm/i915: Mark the context state as dirty/written

BugLink: https://bugs.launchpad.net/bugs/1862840

In the next few patches, we will want to both copy out of the context
image and write a valid image into a new context. To be completely safe,
we should then couple in our domain tracking to ensure that we don't
have any issues with stale data remaining in unwanted cachelines.

Historically, we omitted the .write=true from the call to set-gtt-domain
in i915_switch_context() in order to avoid a stall between every request
as we would want to wait for the previous context write from the gpu.
Since then, we limit the set-gtt-domain to only occur when we first bind
the vma, so once in use we will never stall, and we are sure to flush
the context following a load from swap.

Equally we never applied the lessons learnt from ringbuffer submission
to execlists; so time to apply the flush of the lrc after load as well.

Signed-off-by: Chris Wilson <email address hidden>
Cc: Joonas Lahtinen <email address hidden>
Acked-by: Joonas Lahtinen <email address hidden>
Reviewed-by: Mika Kuoppala <email address hidden>
Link: https://patchwork<email address hidden>

CVE-2020-8832

(cherry picked from commit f4e15af7e21861445821d5f09922ef7e695269a1)
Signed-off-by: Tyler Hicks <email address hidden>

43891b2... by Chris Wilson

drm/i915: Inline intel_modeset_gem_init()

BugLink: https://bugs.launchpad.net/bugs/1862840

intel_modeset_gem_init() now only sets up the legacy overlay, so let's
remove the function and call the setup directly during driver load. This
should help us find a better point in the initialisation sequence for it
later.

Signed-off-by: Chris Wilson <email address hidden>
Reviewed-by: Joonas Lahtinen <email address hidden>
Reviewed-by: Mika Kuoppala <email address hidden>
Link: https://patchwork<email address hidden>

CVE-2020-8832

(cherry picked from commit d378a3efb819e6d1992127122d957337571b4594)
Signed-off-by: Tyler Hicks <email address hidden>

ed6c02a... by Chris Wilson

drm/i915: Move intel_init_clock_gating() to i915_gem_init()

BugLink: https://bugs.launchpad.net/bugs/1862840

Despite its name intel_init_clock_gating applies both display clock gating
workarounds; GT mmio workarounds and the occasional GT power context
workaround. Worse, sometimes it includes a context register workaround
which we need to apply before we record the default HW state for all
contexts.

Signed-off-by: Chris Wilson <email address hidden>
Cc: Ville Syrjälä <email address hidden>
Cc: Joonas Lahtinen <email address hidden>
Reviewed-by: Ville Syrjälä <email address hidden>
Link: https://patchwork<email address hidden>

CVE-2020-8832

(cherry picked from commit cc6a818ad6bdb0d3008314cbd0fc9c9a2cd02695)
Signed-off-by: Tyler Hicks <email address hidden>

f375ec1... by Chris Wilson

drm/i915: Move GT powersaving init to i915_gem_init()

BugLink: https://bugs.launchpad.net/bugs/1862840

GT powersaving is tightly coupled to the request infrastructure. To
avoid complications with the order of initialisation in the next patch
(where we want to send requests to hw during GEM init) move the
powersaving initialisation into the purview of i915_gem_init().

Signed-off-by: Chris Wilson <email address hidden>
Cc: Ville Syrjälä <email address hidden>
Reviewed-by: Joonas Lahtinen <email address hidden>
Link: https://patchwork<email address hidden>

CVE-2020-8832

(cherry picked from commit f58d13d5717938d4dfcc82a2eeba0a6d7644f6e5)
Signed-off-by: Tyler Hicks <email address hidden>

4ec83cb... by Chris Wilson

drm/i915: Force the switch to the i915->kernel_context

BugLink: https://bugs.launchpad.net/bugs/1862840

In the next few patches, we will have a hard requirement that we emit a
context-switch to the perma-pinned i915->kernel_context (so that we can
save the HW state using that context-switch). As the first context
itself may be classed as a kernel context, we want to be explicit in our
comparison. For an extra-layer of finesse, we can check the last
unretired context on the engine; as well as the last retired context
when idle.

v2: verbose verbosity
v3: Always force the switch, even when the engine is idle, and update
the assert that this happens before suspend.

Signed-off-by: Chris Wilson <email address hidden>
Cc: Joonas Lahtinen <email address hidden>
Reviewed-by: Joonas Lahtinen <email address hidden> #v1
Reviewed-by: Mika Kuoppala <email address hidden>
Link: https://patchwork<email address hidden>

CVE-2020-8832

(cherry picked from commit ae6c4574782dbfebcbf1f7e3620bcaf58ceb69e3)
Signed-off-by: Tyler Hicks <email address hidden>

be58863... by Tvrtko Ursulin <email address hidden>

drm/i915: Define an engine class enum for the uABI

BugLink: https://bugs.launchpad.net/bugs/1862840

We want to be able to report back to userspace details about an engine's
class, and in return for userspace to be able to request actions
regarding certain classes of engines. To isolate the uABI from any
variations between hw generations, we define an abstract class for the
engines and internally map onto the hw.

v2: Remove MAX from the uABI; keep it internal if we need it, but don't
let userspace make the mistake of using it themselves.
v3: s/OTHER/INVALID/
  The use of OTHER is ill-defined, so remove it from the uABI as any
  future new type of engine can define a class to suit it. But keep a
  reserved value for an invalid class, so that we can always
  unambiguously express when something doesn't belong to the
  classification.

Signed-off-by: Tvrtko Ursulin <email address hidden>
Signed-off-by: Chris Wilson <email address hidden>
Cc: Lionel Landwerlin <email address hidden>
Reviewed-by: Joonas Lahtinen <email address hidden> #v2
Reviewed-by: Lionel Landwerlin <email address hidden>
Link: https://patchwork<email address hidden>

CVE-2020-8832

(cherry picked from commit 1803fcbca2e444f7972430c4dc1c3e98c6ee1bc9)
Signed-off-by: Tyler Hicks <email address hidden>

330cabd... by Chris Wilson

drm/i915: Use same test for eviction and submitting kernel context

BugLink: https://bugs.launchpad.net/bugs/1862840

During evict, we wish to idle the GPU if we see that the GGTT is full.
However, our test for idle in i915_gem_evict_something() and in
i915_gem_switch_to_kernel_context() do not match leading to
disappointment - we never believe that we are idle and keep trying to
flush the GGTT ad infinitum.

Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=103438
Signed-off-by: Chris Wilson <email address hidden>
Cc: Joonas Lahtinen <email address hidden>
Cc: Tvrtko Ursulin <email address hidden>
Cc: Mika Kuoppala <email address hidden>
Link: https://patchwork<email address hidden>
Reviewed-by: Joonas Lahtinen <email address hidden>

CVE-2020-8832

(cherry picked from commit 20ccd4d3f689ac14dce8632d76769be0ac952060)
Signed-off-by: Tyler Hicks <email address hidden>

a8c1e6a... by Marcelo Cerri

UBUNTU: Ubuntu-4.15.0-76.86

Signed-off-by: Marcelo Henrique Cerri <email address hidden>

cd39f26... by Marcelo Cerri

UBUNTU: link-to-tracker: update tracking bug

BugLink: https://bugs.launchpad.net/bugs/1860123
Properties: no-test-build
Signed-off-by: Marcelo Henrique Cerri <email address hidden>