This api allow user mode to create protected buffers and to mark contexts as making use of such objects. Only when using contexts marked in such a way is the execution guaranteed to work as expected. Contexts can only be marked as using protected content at creation time (i.e. the parameter is immutable) and they must be both bannable and not recoverable. Given that the protected session gets invalidated on suspend, contexts created this way hold a runtime pm wakeref until they're either destroyed or invalidated. All protected objects and contexts will be considered invalid when the PXP session is destroyed and all new submissions using them will be rejected. All intel contexts within the invalidated gem contexts will be marked banned. Userspace can detect that an invalidation has occurred via the RESET_STATS ioctl, where we report it the same way as a ban due to a hang. v5: squash patches, rebase on proto_ctx, update kerneldoc v6: rebase on obj create_ext changes v7: Use session counter to check if an object it valid, hold wakeref in context, don't add a new flag to RESET_STATS (Daniel) v8: don't increase guilty count for contexts banned during pxp invalidation (Rodrigo) v9: better comments, avoid wakeref put race between pxp_inval and context_close, add usage examples (Rodrigo) v10: modify internal set/get-protected-context functions to not return -ENODEV when setting PXP param to false or getting param when running on pxp-unsupported hw or getting param when i915 was built with CONFIG_PXP off
Showing the changes to include/uapi (1 of 14 files). Show all
Unified · Split
| @@ -1846,6 +1846,55 @@ struct drm_i915_gem_context_param { · 1845 unmodified lines | ||
| 1846 | 1846 | * attempted to use it, never re-use this context param number. |
| 1847 | 1847 | */ |
| 1848 | 1848 | #define I915_CONTEXT_PARAM_RINGSIZE 0xc |
| 1849 | + | |
| 1850 | +/* | |
| 1851 | + * I915_CONTEXT_PARAM_PROTECTED_CONTENT: | |
| 1852 | + * | |
| 1853 | + * Mark that the context makes use of protected content, which will result | |
| 1854 | + * in the context being invalidated when the protected content session is. | |
| 1855 | + * Given that the protected content session is killed on suspend, the device | |
| 1856 | + * is kept awake for the lifetime of a protected context, so the user should | |
| 1857 | + * make sure to dispose of them once done. | |
| 1858 | + * This flag can only be set at context creation time and, when set to true, | |
| 1859 | + * must be preceded by an explicit setting of I915_CONTEXT_PARAM_RECOVERABLE | |
| 1860 | + * to false. This flag can't be set to true in conjunction with setting the | |
| 1861 | + * I915_CONTEXT_PARAM_BANNABLE flag to false. Creation example: | |
| 1862 | + * | |
| 1863 | + * .. code-block:: C | |
| 1864 | + * | |
| 1865 | + * struct drm_i915_gem_context_create_ext_setparam p_protected = { | |
| 1866 | + * .base = { | |
| 1867 | + * .name = I915_CONTEXT_CREATE_EXT_SETPARAM, | |
| 1868 | + * }, | |
| 1869 | + * .param = { | |
| 1870 | + * .param = I915_CONTEXT_PARAM_PROTECTED_CONTENT, | |
| 1871 | + * .value = 1, | |
| 1872 | + * } | |
| 1873 | + * }; | |
| 1874 | + * struct drm_i915_gem_context_create_ext_setparam p_norecover = { | |
| 1875 | + * .base = { | |
| 1876 | + * .name = I915_CONTEXT_CREATE_EXT_SETPARAM, | |
| 1877 | + * .next_extension = to_user_pointer(&p_protected), | |
| 1878 | + * }, | |
| 1879 | + * .param = { | |
| 1880 | + * .param = I915_CONTEXT_PARAM_RECOVERABLE, | |
| 1881 | + * .value = 0, | |
| 1882 | + * } | |
| 1883 | + * }; | |
| 1884 | + * struct drm_i915_gem_context_create_ext create = { | |
| 1885 | + * .flags = I915_CONTEXT_CREATE_FLAGS_USE_EXTENSIONS, | |
| 1886 | + * .extensions = to_user_pointer(&p_norecover); | |
| 1887 | + * }; | |
| 1888 | + * | |
| 1889 | + * ctx_id = gem_context_create_ext(drm_fd, &create); | |
| 1890 | + * | |
| 1891 | + * In addition to the normal failure cases, setting this flag during context | |
| 1892 | + * creation can result in the following errors: | |
| 1893 | + * | |
| 1894 | + * -ENODEV: feature not available | |
| 1895 | + * -EPERM: trying to mark a recoverable or not bannable context as protected | |
| 1896 | + */ | |
| 1897 | +#define I915_CONTEXT_PARAM_PROTECTED_CONTENT 0xd | |
| 1849 | 1898 | /* Must be kept compact -- no holes and well documented */ |
| 1850 | 1899 | |
| 1851 | 1900 | __u64 value; |
| @@ -2979,8 +3028,12 @@ struct drm_i915_gem_create_ext { · 1127 unmodified lines | ||
| 2979 | 3028 | * |
| 2980 | 3029 | * For I915_GEM_CREATE_EXT_MEMORY_REGIONS usage see |
| 2981 | 3030 | * struct drm_i915_gem_create_ext_memory_regions. |
| 3031 | + * | |
| 3032 | + * For I915_GEM_CREATE_EXT_PROTECTED_CONTENT usage see | |
| 3033 | + * struct drm_i915_gem_create_ext_protected_content. | |
| 2982 | 3034 | */ |
| 2983 | 3035 | #define I915_GEM_CREATE_EXT_MEMORY_REGIONS 0 |
| 3036 | +#define I915_GEM_CREATE_EXT_PROTECTED_CONTENT 1 | |
| 2984 | 3037 | __u64 extensions; |
| 2985 | 3038 | }; |
| 2986 | 3039 | |
| @@ -3038,6 +3091,47 @@ struct drm_i915_gem_create_ext_memory_regions { · 51 unmodified lines | ||
| 3038 | 3091 | __u64 regions; |
| 3039 | 3092 | }; |
| 3040 | 3093 | |
| 3094 | +/** | |
| 3095 | + * struct drm_i915_gem_create_ext_protected_content - The | |
| 3096 | + * I915_OBJECT_PARAM_PROTECTED_CONTENT extension. | |
| 3097 | + * | |
| 3098 | + * If this extension is provided, buffer contents are expected to be protected | |
| 3099 | + * by PXP encryption and require decryption for scan out and processing. This | |
| 3100 | + * is only possible on platforms that have PXP enabled, on all other scenarios | |
| 3101 | + * using this extension will cause the ioctl to fail and return -ENODEV. The | |
| 3102 | + * flags parameter is reserved for future expansion and must currently be set | |
| 3103 | + * to zero. | |
| 3104 | + * | |
| 3105 | + * The buffer contents are considered invalid after a PXP session teardown. | |
| 3106 | + * | |
| 3107 | + * The encryption is guaranteed to be processed correctly only if the object | |
| 3108 | + * is submitted with a context created using the | |
| 3109 | + * I915_CONTEXT_PARAM_PROTECTED_CONTENT flag. This will also enable extra checks | |
| 3110 | + * at submission time on the validity of the objects involved. | |
| 3111 | + * | |
| 3112 | + * Below is an example on how to create a protected object: | |
| 3113 | + * | |
| 3114 | + * .. code-block:: C | |
| 3115 | + * | |
| 3116 | + * struct drm_i915_gem_create_ext_protected_content protected_ext = { | |
| 3117 | + * .base = { .name = I915_GEM_CREATE_EXT_PROTECTED_CONTENT }, | |
| 3118 | + * .flags = 0, | |
| 3119 | + * }; | |
| 3120 | + * struct drm_i915_gem_create_ext create_ext = { | |
| 3121 | + * .size = PAGE_SIZE, | |
| 3122 | + * .extensions = (uintptr_t)&protected_ext, | |
| 3123 | + * }; | |
| 3124 | + * | |
| 3125 | + * int err = ioctl(fd, DRM_IOCTL_I915_GEM_CREATE_EXT, &create_ext); | |
| 3126 | + * if (err) ... | |
| 3127 | + */ | |
| 3128 | +struct drm_i915_gem_create_ext_protected_content { | |
| 3129 | + /** @base: Extension link. See struct i915_user_extension. */ | |
| 3130 | + struct i915_user_extension base; | |
| 3131 | + /** @flags: reserved for future usage, currently MBZ */ | |
| 3132 | + __u32 flags; | |
| 3133 | +}; | |
| 3134 | + | |
| 3041 | 3135 | /* ID of the protected content session managed by i915 when PXP is active */ |
| 3042 | 3136 | #define I915_PROTECTED_CONTENT_DEFAULT_SESSION 0xf |
| 3043 | 3137 | |