diff mbox series

[2/4] drm/i915/perf: Whitelist OA report trigger registers

Message ID 20200724001901.35662-3-umesh.nerlige.ramappa@intel.com (mailing list archive)
State New, archived
Headers show
Series Allow privileged user to map the OA buffer | expand

Commit Message

Umesh Nerlige Ramappa July 24, 2020, 12:18 a.m. UTC
From: Piotr Maciejewski <piotr.maciejewski@intel.com>

OA reports can be triggered into the OA buffer by writing into the
OAREPORTTRIG registers. Whitelist the registers to allow user to trigger
reports.

v2:
- Move related change to this patch (Lionel)
- Bump up perf revision (Lionel)

v3: Pardon whitelisted registers for selftest (Umesh)
v4: Document supported gens for the feature (Lionel)

Signed-off-by: Piotr Maciejewski <piotr.maciejewski@intel.com>
Signed-off-by: Umesh Nerlige Ramappa <umesh.nerlige.ramappa@intel.com>
Reviewed-by: Lionel Landwerlin <lionel.g.landwerlin@intel.com>
---
 drivers/gpu/drm/i915/gt/intel_workarounds.c   | 26 +++++++++++++++++++
 .../gpu/drm/i915/gt/selftest_workarounds.c    |  8 ++++++
 drivers/gpu/drm/i915/i915_perf.c              | 11 +++++---
 3 files changed, 42 insertions(+), 3 deletions(-)

Comments

Chris Wilson July 24, 2020, 9:26 a.m. UTC | #1
Quoting Umesh Nerlige Ramappa (2020-07-24 01:18:59)
> From: Piotr Maciejewski <piotr.maciejewski@intel.com>
> 
> OA reports can be triggered into the OA buffer by writing into the
> OAREPORTTRIG registers. Whitelist the registers to allow user to trigger
> reports.
> 
> v2:
> - Move related change to this patch (Lionel)
> - Bump up perf revision (Lionel)
> 
> v3: Pardon whitelisted registers for selftest (Umesh)
> v4: Document supported gens for the feature (Lionel)
> 
> Signed-off-by: Piotr Maciejewski <piotr.maciejewski@intel.com>
> Signed-off-by: Umesh Nerlige Ramappa <umesh.nerlige.ramappa@intel.com>
> Reviewed-by: Lionel Landwerlin <lionel.g.landwerlin@intel.com>
> ---
>  drivers/gpu/drm/i915/gt/intel_workarounds.c   | 26 +++++++++++++++++++
>  .../gpu/drm/i915/gt/selftest_workarounds.c    |  8 ++++++
>  drivers/gpu/drm/i915/i915_perf.c              | 11 +++++---
>  3 files changed, 42 insertions(+), 3 deletions(-)
> 
> diff --git a/drivers/gpu/drm/i915/gt/intel_workarounds.c b/drivers/gpu/drm/i915/gt/intel_workarounds.c
> index cef1c122696f..a72ebfd115e5 100644
> --- a/drivers/gpu/drm/i915/gt/intel_workarounds.c
> +++ b/drivers/gpu/drm/i915/gt/intel_workarounds.c
> @@ -1387,6 +1387,20 @@ whitelist_reg(struct i915_wa_list *wal, i915_reg_t reg)
>         whitelist_reg_ext(wal, reg, RING_FORCE_TO_NONPRIV_ACCESS_RW);
>  }
>  
> +static void gen9_whitelist_build_performance_counters(struct i915_wa_list *w)
> +{
> +       /* OA buffer trigger report 2/6 used by performance query */
> +       whitelist_reg(w, OAREPORTTRIG2);
> +       whitelist_reg(w, OAREPORTTRIG6);

The other question is: are you sure these are per-context registers?
> +}
> +
> +static void gen12_whitelist_build_performance_counters(struct i915_wa_list *w)
> +{
> +       /* OA buffer trigger report 2/6 used by performance query */
> +       whitelist_reg(w, GEN12_OAG_OAREPORTTRIG2);
> +       whitelist_reg(w, GEN12_OAG_OAREPORTTRIG6);
> +}
> +
>  static void gen9_whitelist_build(struct i915_wa_list *w)
>  {
>         /* WaVFEStateAfterPipeControlwithMediaStateClear:skl,bxt,glk,cfl */
> @@ -1400,6 +1414,9 @@ static void gen9_whitelist_build(struct i915_wa_list *w)
>  
>         /* WaSendPushConstantsFromMMIO:skl,bxt */
>         whitelist_reg(w, COMMON_SLICE_CHICKEN2);
> +
> +       /* Performance counters support */
> +       gen9_whitelist_build_performance_counters(w);
>  }
>  
>  static void skl_whitelist_build(struct intel_engine_cs *engine)
> @@ -1493,6 +1510,9 @@ static void cnl_whitelist_build(struct intel_engine_cs *engine)
>  
>         /* WaEnablePreemptionGranularityControlByUMD:cnl */
>         whitelist_reg(w, GEN8_CS_CHICKEN1);
> +
> +       /* Performance counters support */
> +       gen9_whitelist_build_performance_counters(w);
>  }
>  
>  static void icl_whitelist_build(struct intel_engine_cs *engine)
> @@ -1522,6 +1542,9 @@ static void icl_whitelist_build(struct intel_engine_cs *engine)
>                 whitelist_reg_ext(w, PS_INVOCATION_COUNT,
>                                   RING_FORCE_TO_NONPRIV_ACCESS_RD |
>                                   RING_FORCE_TO_NONPRIV_RANGE_4);
> +
> +               /* Performance counters support */
> +               gen9_whitelist_build_performance_counters(w);
>                 break;
>  
>         case VIDEO_DECODE_CLASS:
> @@ -1572,6 +1595,9 @@ static void tgl_whitelist_build(struct intel_engine_cs *engine)
>  
>                 /* Wa_1806527549:tgl */
>                 whitelist_reg(w, HIZ_CHICKEN);
> +
> +               /* Performance counters support */
> +               gen12_whitelist_build_performance_counters(w);
>                 break;
>         default:
>                 whitelist_reg_ext(w,
> diff --git a/drivers/gpu/drm/i915/gt/selftest_workarounds.c b/drivers/gpu/drm/i915/gt/selftest_workarounds.c
> index febc9e6692ba..3b1d3dbcd477 100644
> --- a/drivers/gpu/drm/i915/gt/selftest_workarounds.c
> +++ b/drivers/gpu/drm/i915/gt/selftest_workarounds.c
> @@ -934,6 +934,10 @@ static bool pardon_reg(struct drm_i915_private *i915, i915_reg_t reg)
>         static const struct regmask pardon[] = {
>                 { GEN9_CTX_PREEMPT_REG, INTEL_GEN_MASK(9, 9) },
>                 { GEN8_L3SQCREG4, INTEL_GEN_MASK(9, 9) },
> +               { OAREPORTTRIG2, INTEL_GEN_MASK(8, 11) },
> +               { OAREPORTTRIG6, INTEL_GEN_MASK(8, 11) },
> +               { GEN12_OAG_OAREPORTTRIG2, INTEL_GEN_MASK(12, 12) },
> +               { GEN12_OAG_OAREPORTTRIG6, INTEL_GEN_MASK(12, 12) },

Because we are not making the mistake of exposing more globals, and the
pardon is a list of our past sins, not an excuse for more.
-Chris
---------------------------------------------------------------------
Intel Corporation (UK) Limited
Registered No. 1134945 (England)
Registered Office: Pipers Way, Swindon SN3 1RJ
VAT No: 860 2173 47

This e-mail and any attachments may contain confidential material for
the sole use of the intended recipient(s). Any review or distribution
by others is strictly prohibited. If you are not the intended
recipient, please contact the sender and delete all copies.
Lionel Landwerlin July 24, 2020, 10:07 a.m. UTC | #2
On 24/07/2020 12:26, Chris Wilson wrote:
> Quoting Umesh Nerlige Ramappa (2020-07-24 01:18:59)
>> From: Piotr Maciejewski <piotr.maciejewski@intel.com>
>>
>> OA reports can be triggered into the OA buffer by writing into the
>> OAREPORTTRIG registers. Whitelist the registers to allow user to trigger
>> reports.
>>
>> v2:
>> - Move related change to this patch (Lionel)
>> - Bump up perf revision (Lionel)
>>
>> v3: Pardon whitelisted registers for selftest (Umesh)
>> v4: Document supported gens for the feature (Lionel)
>>
>> Signed-off-by: Piotr Maciejewski <piotr.maciejewski@intel.com>
>> Signed-off-by: Umesh Nerlige Ramappa <umesh.nerlige.ramappa@intel.com>
>> Reviewed-by: Lionel Landwerlin <lionel.g.landwerlin@intel.com>
>> ---
>>   drivers/gpu/drm/i915/gt/intel_workarounds.c   | 26 +++++++++++++++++++
>>   .../gpu/drm/i915/gt/selftest_workarounds.c    |  8 ++++++
>>   drivers/gpu/drm/i915/i915_perf.c              | 11 +++++---
>>   3 files changed, 42 insertions(+), 3 deletions(-)
>>
>> diff --git a/drivers/gpu/drm/i915/gt/intel_workarounds.c b/drivers/gpu/drm/i915/gt/intel_workarounds.c
>> index cef1c122696f..a72ebfd115e5 100644
>> --- a/drivers/gpu/drm/i915/gt/intel_workarounds.c
>> +++ b/drivers/gpu/drm/i915/gt/intel_workarounds.c
>> @@ -1387,6 +1387,20 @@ whitelist_reg(struct i915_wa_list *wal, i915_reg_t reg)
>>          whitelist_reg_ext(wal, reg, RING_FORCE_TO_NONPRIV_ACCESS_RW);
>>   }
>>   
>> +static void gen9_whitelist_build_performance_counters(struct i915_wa_list *w)
>> +{
>> +       /* OA buffer trigger report 2/6 used by performance query */
>> +       whitelist_reg(w, OAREPORTTRIG2);
>> +       whitelist_reg(w, OAREPORTTRIG6);
> The other question is: are you sure these are per-context registers?
All the registers exposed in this series are global.
>> +}
>> +
>> +static void gen12_whitelist_build_performance_counters(struct i915_wa_list *w)
>> +{
>> +       /* OA buffer trigger report 2/6 used by performance query */
>> +       whitelist_reg(w, GEN12_OAG_OAREPORTTRIG2);
>> +       whitelist_reg(w, GEN12_OAG_OAREPORTTRIG6);
>> +}
>> +
>>   static void gen9_whitelist_build(struct i915_wa_list *w)
>>   {
>>          /* WaVFEStateAfterPipeControlwithMediaStateClear:skl,bxt,glk,cfl */
>> @@ -1400,6 +1414,9 @@ static void gen9_whitelist_build(struct i915_wa_list *w)
>>   
>>          /* WaSendPushConstantsFromMMIO:skl,bxt */
>>          whitelist_reg(w, COMMON_SLICE_CHICKEN2);
>> +
>> +       /* Performance counters support */
>> +       gen9_whitelist_build_performance_counters(w);
>>   }
>>   
>>   static void skl_whitelist_build(struct intel_engine_cs *engine)
>> @@ -1493,6 +1510,9 @@ static void cnl_whitelist_build(struct intel_engine_cs *engine)
>>   
>>          /* WaEnablePreemptionGranularityControlByUMD:cnl */
>>          whitelist_reg(w, GEN8_CS_CHICKEN1);
>> +
>> +       /* Performance counters support */
>> +       gen9_whitelist_build_performance_counters(w);
>>   }
>>   
>>   static void icl_whitelist_build(struct intel_engine_cs *engine)
>> @@ -1522,6 +1542,9 @@ static void icl_whitelist_build(struct intel_engine_cs *engine)
>>                  whitelist_reg_ext(w, PS_INVOCATION_COUNT,
>>                                    RING_FORCE_TO_NONPRIV_ACCESS_RD |
>>                                    RING_FORCE_TO_NONPRIV_RANGE_4);
>> +
>> +               /* Performance counters support */
>> +               gen9_whitelist_build_performance_counters(w);
>>                  break;
>>   
>>          case VIDEO_DECODE_CLASS:
>> @@ -1572,6 +1595,9 @@ static void tgl_whitelist_build(struct intel_engine_cs *engine)
>>   
>>                  /* Wa_1806527549:tgl */
>>                  whitelist_reg(w, HIZ_CHICKEN);
>> +
>> +               /* Performance counters support */
>> +               gen12_whitelist_build_performance_counters(w);
>>                  break;
>>          default:
>>                  whitelist_reg_ext(w,
>> diff --git a/drivers/gpu/drm/i915/gt/selftest_workarounds.c b/drivers/gpu/drm/i915/gt/selftest_workarounds.c
>> index febc9e6692ba..3b1d3dbcd477 100644
>> --- a/drivers/gpu/drm/i915/gt/selftest_workarounds.c
>> +++ b/drivers/gpu/drm/i915/gt/selftest_workarounds.c
>> @@ -934,6 +934,10 @@ static bool pardon_reg(struct drm_i915_private *i915, i915_reg_t reg)
>>          static const struct regmask pardon[] = {
>>                  { GEN9_CTX_PREEMPT_REG, INTEL_GEN_MASK(9, 9) },
>>                  { GEN8_L3SQCREG4, INTEL_GEN_MASK(9, 9) },
>> +               { OAREPORTTRIG2, INTEL_GEN_MASK(8, 11) },
>> +               { OAREPORTTRIG6, INTEL_GEN_MASK(8, 11) },
>> +               { GEN12_OAG_OAREPORTTRIG2, INTEL_GEN_MASK(12, 12) },
>> +               { GEN12_OAG_OAREPORTTRIG6, INTEL_GEN_MASK(12, 12) },
> Because we are not making the mistake of exposing more globals, and the
> pardon is a list of our past sins, not an excuse for more.

I'm afraid the HW design leave us no choice on Gen12 :(


-Lionel
Chris Wilson July 24, 2020, 10:19 a.m. UTC | #3
Quoting Lionel Landwerlin (2020-07-24 11:07:18)
> On 24/07/2020 12:26, Chris Wilson wrote:
> > Quoting Umesh Nerlige Ramappa (2020-07-24 01:18:59)
> >> diff --git a/drivers/gpu/drm/i915/gt/selftest_workarounds.c b/drivers/gpu/drm/i915/gt/selftest_workarounds.c
> >> index febc9e6692ba..3b1d3dbcd477 100644
> >> --- a/drivers/gpu/drm/i915/gt/selftest_workarounds.c
> >> +++ b/drivers/gpu/drm/i915/gt/selftest_workarounds.c
> >> @@ -934,6 +934,10 @@ static bool pardon_reg(struct drm_i915_private *i915, i915_reg_t reg)
> >>          static const struct regmask pardon[] = {
> >>                  { GEN9_CTX_PREEMPT_REG, INTEL_GEN_MASK(9, 9) },
> >>                  { GEN8_L3SQCREG4, INTEL_GEN_MASK(9, 9) },
> >> +               { OAREPORTTRIG2, INTEL_GEN_MASK(8, 11) },
> >> +               { OAREPORTTRIG6, INTEL_GEN_MASK(8, 11) },
> >> +               { GEN12_OAG_OAREPORTTRIG2, INTEL_GEN_MASK(12, 12) },
> >> +               { GEN12_OAG_OAREPORTTRIG6, INTEL_GEN_MASK(12, 12) },
> > Because we are not making the mistake of exposing more globals, and the
> > pardon is a list of our past sins, not an excuse for more.
> 
> I'm afraid the HW design leave us no choice on Gen12 :(

The question then is how much mischief can a client get up to if they
subvert the OA of the privileged user. It's a privilege escalation hole,
but is there anything dangerous behind it? Or is it just going to disturb
the data being fed to the privileged client... (Which seems scary enough.)
-Chris
---------------------------------------------------------------------
Intel Corporation (UK) Limited
Registered No. 1134945 (England)
Registered Office: Pipers Way, Swindon SN3 1RJ
VAT No: 860 2173 47

This e-mail and any attachments may contain confidential material for
the sole use of the intended recipient(s). Any review or distribution
by others is strictly prohibited. If you are not the intended
recipient, please contact the sender and delete all copies.
Chris Wilson July 24, 2020, 10:23 a.m. UTC | #4
Quoting Chris Wilson (2020-07-24 11:19:05)
> Quoting Lionel Landwerlin (2020-07-24 11:07:18)
> > On 24/07/2020 12:26, Chris Wilson wrote:
> > > Quoting Umesh Nerlige Ramappa (2020-07-24 01:18:59)
> > >> diff --git a/drivers/gpu/drm/i915/gt/selftest_workarounds.c b/drivers/gpu/drm/i915/gt/selftest_workarounds.c
> > >> index febc9e6692ba..3b1d3dbcd477 100644
> > >> --- a/drivers/gpu/drm/i915/gt/selftest_workarounds.c
> > >> +++ b/drivers/gpu/drm/i915/gt/selftest_workarounds.c
> > >> @@ -934,6 +934,10 @@ static bool pardon_reg(struct drm_i915_private *i915, i915_reg_t reg)
> > >>          static const struct regmask pardon[] = {
> > >>                  { GEN9_CTX_PREEMPT_REG, INTEL_GEN_MASK(9, 9) },
> > >>                  { GEN8_L3SQCREG4, INTEL_GEN_MASK(9, 9) },
> > >> +               { OAREPORTTRIG2, INTEL_GEN_MASK(8, 11) },
> > >> +               { OAREPORTTRIG6, INTEL_GEN_MASK(8, 11) },
> > >> +               { GEN12_OAG_OAREPORTTRIG2, INTEL_GEN_MASK(12, 12) },
> > >> +               { GEN12_OAG_OAREPORTTRIG6, INTEL_GEN_MASK(12, 12) },
> > > Because we are not making the mistake of exposing more globals, and the
> > > pardon is a list of our past sins, not an excuse for more.
> > 
> > I'm afraid the HW design leave us no choice on Gen12 :(
> 
> The question then is how much mischief can a client get up to if they
> subvert the OA of the privileged user. It's a privilege escalation hole,
> but is there anything dangerous behind it? Or is it just going to disturb
> the data being fed to the privileged client... (Which seems scary enough.)

The other angle is whether the RING_NONPRIV are context saved; I have
vague memories of seeing them in the context image. If they are, we can
add them the to privileged OA client. We still need to respect the
hard limit on the number, but that would close the hole.
-Chris
---------------------------------------------------------------------
Intel Corporation (UK) Limited
Registered No. 1134945 (England)
Registered Office: Pipers Way, Swindon SN3 1RJ
VAT No: 860 2173 47

This e-mail and any attachments may contain confidential material for
the sole use of the intended recipient(s). Any review or distribution
by others is strictly prohibited. If you are not the intended
recipient, please contact the sender and delete all copies.
Lionel Landwerlin July 24, 2020, 10:31 a.m. UTC | #5
On 24/07/2020 13:19, Chris Wilson wrote:
> Quoting Lionel Landwerlin (2020-07-24 11:07:18)
>> On 24/07/2020 12:26, Chris Wilson wrote:
>>> Quoting Umesh Nerlige Ramappa (2020-07-24 01:18:59)
>>>> diff --git a/drivers/gpu/drm/i915/gt/selftest_workarounds.c b/drivers/gpu/drm/i915/gt/selftest_workarounds.c
>>>> index febc9e6692ba..3b1d3dbcd477 100644
>>>> --- a/drivers/gpu/drm/i915/gt/selftest_workarounds.c
>>>> +++ b/drivers/gpu/drm/i915/gt/selftest_workarounds.c
>>>> @@ -934,6 +934,10 @@ static bool pardon_reg(struct drm_i915_private *i915, i915_reg_t reg)
>>>>           static const struct regmask pardon[] = {
>>>>                   { GEN9_CTX_PREEMPT_REG, INTEL_GEN_MASK(9, 9) },
>>>>                   { GEN8_L3SQCREG4, INTEL_GEN_MASK(9, 9) },
>>>> +               { OAREPORTTRIG2, INTEL_GEN_MASK(8, 11) },
>>>> +               { OAREPORTTRIG6, INTEL_GEN_MASK(8, 11) },
>>>> +               { GEN12_OAG_OAREPORTTRIG2, INTEL_GEN_MASK(12, 12) },
>>>> +               { GEN12_OAG_OAREPORTTRIG6, INTEL_GEN_MASK(12, 12) },
>>> Because we are not making the mistake of exposing more globals, and the
>>> pardon is a list of our past sins, not an excuse for more.
>> I'm afraid the HW design leave us no choice on Gen12 :(
> The question then is how much mischief can a client get up to if they
> subvert the OA of the privileged user. It's a privilege escalation hole,
> but is there anything dangerous behind it? Or is it just going to disturb
> the data being fed to the privileged client... (Which seems scary enough.)
> -Chris

The trigger registers will allow any other application to generate 
reports in the global OA buffer.

If you've built your OA report parsing correctly, this shouldn't be a 
problem because you'll filter on context ID prior to the reason of the 
report being recorded.

That's a downside of this patch, that's also a feature because you can 
use this to monitor particular chunks of work in a global timeline of OA 
reports for multiple applications.


-Lionel
Lionel Landwerlin July 24, 2020, 10:33 a.m. UTC | #6
On 24/07/2020 13:23, Chris Wilson wrote:
> Quoting Chris Wilson (2020-07-24 11:19:05)
>> Quoting Lionel Landwerlin (2020-07-24 11:07:18)
>>> On 24/07/2020 12:26, Chris Wilson wrote:
>>>> Quoting Umesh Nerlige Ramappa (2020-07-24 01:18:59)
>>>>> diff --git a/drivers/gpu/drm/i915/gt/selftest_workarounds.c b/drivers/gpu/drm/i915/gt/selftest_workarounds.c
>>>>> index febc9e6692ba..3b1d3dbcd477 100644
>>>>> --- a/drivers/gpu/drm/i915/gt/selftest_workarounds.c
>>>>> +++ b/drivers/gpu/drm/i915/gt/selftest_workarounds.c
>>>>> @@ -934,6 +934,10 @@ static bool pardon_reg(struct drm_i915_private *i915, i915_reg_t reg)
>>>>>           static const struct regmask pardon[] = {
>>>>>                   { GEN9_CTX_PREEMPT_REG, INTEL_GEN_MASK(9, 9) },
>>>>>                   { GEN8_L3SQCREG4, INTEL_GEN_MASK(9, 9) },
>>>>> +               { OAREPORTTRIG2, INTEL_GEN_MASK(8, 11) },
>>>>> +               { OAREPORTTRIG6, INTEL_GEN_MASK(8, 11) },
>>>>> +               { GEN12_OAG_OAREPORTTRIG2, INTEL_GEN_MASK(12, 12) },
>>>>> +               { GEN12_OAG_OAREPORTTRIG6, INTEL_GEN_MASK(12, 12) },
>>>> Because we are not making the mistake of exposing more globals, and the
>>>> pardon is a list of our past sins, not an excuse for more.
>>> I'm afraid the HW design leave us no choice on Gen12 :(
>> The question then is how much mischief can a client get up to if they
>> subvert the OA of the privileged user. It's a privilege escalation hole,
>> but is there anything dangerous behind it? Or is it just going to disturb
>> the data being fed to the privileged client... (Which seems scary enough.)
> The other angle is whether the RING_NONPRIV are context saved; I have
> vague memories of seeing them in the context image. If they are, we can
> add them the to privileged OA client. We still need to respect the
> hard limit on the number, but that would close the hole.
> -Chris

I couldn't find how to do this whitelisting per context. If that's 
possible, that's probably what we should do.


-Lionel
Chris Wilson July 24, 2020, 11:27 a.m. UTC | #7
Quoting Lionel Landwerlin (2020-07-24 11:33:38)
> On 24/07/2020 13:23, Chris Wilson wrote:
> > Quoting Chris Wilson (2020-07-24 11:19:05)
> >> Quoting Lionel Landwerlin (2020-07-24 11:07:18)
> >>> On 24/07/2020 12:26, Chris Wilson wrote:
> >>>> Quoting Umesh Nerlige Ramappa (2020-07-24 01:18:59)
> >>>>> diff --git a/drivers/gpu/drm/i915/gt/selftest_workarounds.c b/drivers/gpu/drm/i915/gt/selftest_workarounds.c
> >>>>> index febc9e6692ba..3b1d3dbcd477 100644
> >>>>> --- a/drivers/gpu/drm/i915/gt/selftest_workarounds.c
> >>>>> +++ b/drivers/gpu/drm/i915/gt/selftest_workarounds.c
> >>>>> @@ -934,6 +934,10 @@ static bool pardon_reg(struct drm_i915_private *i915, i915_reg_t reg)
> >>>>>           static const struct regmask pardon[] = {
> >>>>>                   { GEN9_CTX_PREEMPT_REG, INTEL_GEN_MASK(9, 9) },
> >>>>>                   { GEN8_L3SQCREG4, INTEL_GEN_MASK(9, 9) },
> >>>>> +               { OAREPORTTRIG2, INTEL_GEN_MASK(8, 11) },
> >>>>> +               { OAREPORTTRIG6, INTEL_GEN_MASK(8, 11) },
> >>>>> +               { GEN12_OAG_OAREPORTTRIG2, INTEL_GEN_MASK(12, 12) },
> >>>>> +               { GEN12_OAG_OAREPORTTRIG6, INTEL_GEN_MASK(12, 12) },
> >>>> Because we are not making the mistake of exposing more globals, and the
> >>>> pardon is a list of our past sins, not an excuse for more.
> >>> I'm afraid the HW design leave us no choice on Gen12 :(
> >> The question then is how much mischief can a client get up to if they
> >> subvert the OA of the privileged user. It's a privilege escalation hole,
> >> but is there anything dangerous behind it? Or is it just going to disturb
> >> the data being fed to the privileged client... (Which seems scary enough.)
> > The other angle is whether the RING_NONPRIV are context saved; I have
> > vague memories of seeing them in the context image. If they are, we can
> > add them the to privileged OA client. We still need to respect the
> > hard limit on the number, but that would close the hole.
> 
> I couldn't find how to do this whitelisting per context. If that's 
> possible, that's probably what we should do.

I've had do luck in finding them in the context image either. Figment of
my imagination, or wishful thinking.
-Chris
---------------------------------------------------------------------
Intel Corporation (UK) Limited
Registered No. 1134945 (England)
Registered Office: Pipers Way, Swindon SN3 1RJ
VAT No: 860 2173 47

This e-mail and any attachments may contain confidential material for
the sole use of the intended recipient(s). Any review or distribution
by others is strictly prohibited. If you are not the intended
recipient, please contact the sender and delete all copies.
diff mbox series

Patch

diff --git a/drivers/gpu/drm/i915/gt/intel_workarounds.c b/drivers/gpu/drm/i915/gt/intel_workarounds.c
index cef1c122696f..a72ebfd115e5 100644
--- a/drivers/gpu/drm/i915/gt/intel_workarounds.c
+++ b/drivers/gpu/drm/i915/gt/intel_workarounds.c
@@ -1387,6 +1387,20 @@  whitelist_reg(struct i915_wa_list *wal, i915_reg_t reg)
 	whitelist_reg_ext(wal, reg, RING_FORCE_TO_NONPRIV_ACCESS_RW);
 }
 
+static void gen9_whitelist_build_performance_counters(struct i915_wa_list *w)
+{
+	/* OA buffer trigger report 2/6 used by performance query */
+	whitelist_reg(w, OAREPORTTRIG2);
+	whitelist_reg(w, OAREPORTTRIG6);
+}
+
+static void gen12_whitelist_build_performance_counters(struct i915_wa_list *w)
+{
+	/* OA buffer trigger report 2/6 used by performance query */
+	whitelist_reg(w, GEN12_OAG_OAREPORTTRIG2);
+	whitelist_reg(w, GEN12_OAG_OAREPORTTRIG6);
+}
+
 static void gen9_whitelist_build(struct i915_wa_list *w)
 {
 	/* WaVFEStateAfterPipeControlwithMediaStateClear:skl,bxt,glk,cfl */
@@ -1400,6 +1414,9 @@  static void gen9_whitelist_build(struct i915_wa_list *w)
 
 	/* WaSendPushConstantsFromMMIO:skl,bxt */
 	whitelist_reg(w, COMMON_SLICE_CHICKEN2);
+
+	/* Performance counters support */
+	gen9_whitelist_build_performance_counters(w);
 }
 
 static void skl_whitelist_build(struct intel_engine_cs *engine)
@@ -1493,6 +1510,9 @@  static void cnl_whitelist_build(struct intel_engine_cs *engine)
 
 	/* WaEnablePreemptionGranularityControlByUMD:cnl */
 	whitelist_reg(w, GEN8_CS_CHICKEN1);
+
+	/* Performance counters support */
+	gen9_whitelist_build_performance_counters(w);
 }
 
 static void icl_whitelist_build(struct intel_engine_cs *engine)
@@ -1522,6 +1542,9 @@  static void icl_whitelist_build(struct intel_engine_cs *engine)
 		whitelist_reg_ext(w, PS_INVOCATION_COUNT,
 				  RING_FORCE_TO_NONPRIV_ACCESS_RD |
 				  RING_FORCE_TO_NONPRIV_RANGE_4);
+
+		/* Performance counters support */
+		gen9_whitelist_build_performance_counters(w);
 		break;
 
 	case VIDEO_DECODE_CLASS:
@@ -1572,6 +1595,9 @@  static void tgl_whitelist_build(struct intel_engine_cs *engine)
 
 		/* Wa_1806527549:tgl */
 		whitelist_reg(w, HIZ_CHICKEN);
+
+		/* Performance counters support */
+		gen12_whitelist_build_performance_counters(w);
 		break;
 	default:
 		whitelist_reg_ext(w,
diff --git a/drivers/gpu/drm/i915/gt/selftest_workarounds.c b/drivers/gpu/drm/i915/gt/selftest_workarounds.c
index febc9e6692ba..3b1d3dbcd477 100644
--- a/drivers/gpu/drm/i915/gt/selftest_workarounds.c
+++ b/drivers/gpu/drm/i915/gt/selftest_workarounds.c
@@ -934,6 +934,10 @@  static bool pardon_reg(struct drm_i915_private *i915, i915_reg_t reg)
 	static const struct regmask pardon[] = {
 		{ GEN9_CTX_PREEMPT_REG, INTEL_GEN_MASK(9, 9) },
 		{ GEN8_L3SQCREG4, INTEL_GEN_MASK(9, 9) },
+		{ OAREPORTTRIG2, INTEL_GEN_MASK(8, 11) },
+		{ OAREPORTTRIG6, INTEL_GEN_MASK(8, 11) },
+		{ GEN12_OAG_OAREPORTTRIG2, INTEL_GEN_MASK(12, 12) },
+		{ GEN12_OAG_OAREPORTTRIG6, INTEL_GEN_MASK(12, 12) },
 	};
 
 	return find_reg(i915, reg, pardon, ARRAY_SIZE(pardon));
@@ -956,6 +960,10 @@  static bool writeonly_reg(struct drm_i915_private *i915, i915_reg_t reg)
 	/* Some registers do not seem to behave and our writes unreadable */
 	static const struct regmask wo[] = {
 		{ GEN9_SLICE_COMMON_ECO_CHICKEN1, INTEL_GEN_MASK(9, 9) },
+		{ OAREPORTTRIG2, INTEL_GEN_MASK(8, 11) },
+		{ OAREPORTTRIG6, INTEL_GEN_MASK(8, 11) },
+		{ GEN12_OAG_OAREPORTTRIG2, INTEL_GEN_MASK(12, 12) },
+		{ GEN12_OAG_OAREPORTTRIG6, INTEL_GEN_MASK(12, 12) },
 	};
 
 	return find_reg(i915, reg, wo, ARRAY_SIZE(wo));
diff --git a/drivers/gpu/drm/i915/i915_perf.c b/drivers/gpu/drm/i915/i915_perf.c
index fe408c327d3c..30f6aeb819aa 100644
--- a/drivers/gpu/drm/i915/i915_perf.c
+++ b/drivers/gpu/drm/i915/i915_perf.c
@@ -1448,7 +1448,8 @@  static void gen8_init_oa_buffer(struct i915_perf_stream *stream)
 	 *  bit."
 	 */
 	intel_uncore_write(uncore, GEN8_OABUFFER, gtt_offset |
-		   OABUFFER_SIZE_16M | GEN8_OABUFFER_MEM_SELECT_GGTT);
+			   OABUFFER_SIZE_16M | GEN8_OABUFFER_MEM_SELECT_GGTT |
+			   GEN7_OABUFFER_EDGE_TRIGGER);
 	intel_uncore_write(uncore, GEN8_OATAILPTR, gtt_offset & GEN8_OATAILPTR_MASK);
 
 	/* Mark that we need updated tail pointers to read from... */
@@ -1501,7 +1502,8 @@  static void gen12_init_oa_buffer(struct i915_perf_stream *stream)
 	 *  bit."
 	 */
 	intel_uncore_write(uncore, GEN12_OAG_OABUFFER, gtt_offset |
-			   OABUFFER_SIZE_16M | GEN8_OABUFFER_MEM_SELECT_GGTT);
+			   OABUFFER_SIZE_16M | GEN8_OABUFFER_MEM_SELECT_GGTT |
+			   GEN7_OABUFFER_EDGE_TRIGGER);
 	intel_uncore_write(uncore, GEN12_OAG_OATAILPTR,
 			   gtt_offset & GEN12_OAG_OATAILPTR_MASK);
 
@@ -4445,8 +4447,11 @@  int i915_perf_ioctl_version(void)
 	 *
 	 * 5: Add DRM_I915_PERF_PROP_POLL_OA_PERIOD parameter that controls the
 	 *    interval for the hrtimer used to check for OA data.
+	 *
+	 * 6: Whitelist OATRIGGER registers to allow user to trigger reports
+	 *    into the OA buffer. This applies only to gen8+.
 	 */
-	return 5;
+	return 6;
 }
 
 #if IS_ENABLED(CONFIG_DRM_I915_SELFTEST)