From: Akeem G Abodunrin akeem.g.abodunrin@intel.com

commit bc8a76a152c5f9ef3b48104154a65a68a8b76946 upstream.

Intel ID: PSIRT-TA-201910-001 CVEID: CVE-2019-14615

Intel GPU Hardware prior to Gen11 does not clear EU state during a context switch. This can result in information leakage between contexts.

For Gen8 and Gen9, hardware provides a mechanism for fast cleardown of the EU state, by issuing a PIPE_CONTROL with bit 27 set. We can use this in a context batch buffer to explicitly cleardown the state on every context switch.

As this workaround is already in place for gen8, we can borrow the code verbatim for Gen9.

Signed-off-by: Mika Kuoppala mika.kuoppala@linux.intel.com Signed-off-by: Akeem G Abodunrin akeem.g.abodunrin@intel.com Cc: Kumar Valsan Prathap prathap.kumar.valsan@intel.com Cc: Chris Wilson chris.p.wilson@intel.com Cc: Balestrieri Francesco francesco.balestrieri@intel.com Cc: Bloomfield Jon jon.bloomfield@intel.com Cc: Dutt Sudeep sudeep.dutt@intel.com Signed-off-by: Greg Kroah-Hartman gregkh@linuxfoundation.org Signed-off-by: Yang Yingliang yangyingliang@huawei.com --- drivers/gpu/drm/i915/intel_lrc.c | 9 +++++++++ 1 file changed, 9 insertions(+)

diff --git a/drivers/gpu/drm/i915/intel_lrc.c b/drivers/gpu/drm/i915/intel_lrc.c index 6937ef0b..13e97fa 100644 --- a/drivers/gpu/drm/i915/intel_lrc.c +++ b/drivers/gpu/drm/i915/intel_lrc.c @@ -1562,6 +1562,15 @@ static u32 *gen9_init_indirectctx_bb(struct intel_engine_cs *engine, u32 *batch) /* WaFlushCoherentL3CacheLinesAtContextSwitch:skl,bxt,glk */ batch = gen8_emit_flush_coherentl3_wa(engine, batch);

+ /* WaClearSlmSpaceAtContextSwitch:skl,bxt,kbl,glk,cfl */ + batch = gen8_emit_pipe_control(batch, + PIPE_CONTROL_FLUSH_L3 | + PIPE_CONTROL_GLOBAL_GTT_IVB | + PIPE_CONTROL_CS_STALL | + PIPE_CONTROL_QW_WRITE, + i915_ggtt_offset(engine->scratch) + + 2 * CACHELINE_BYTES); + batch = emit_lri(batch, lri, ARRAY_SIZE(lri));

/* WaClearSlmSpaceAtContextSwitch:kbl */