Skip to content

Commit d8dcec1

Browse files
dvdgomezPlaidCat
authored andcommitted
drm/i915: fix TLB invalidation for Gen12 video and compute engines
jira LE-957 cve CVE-2022-4139 commit 04aa643 upstream-diff for_each_engine for loop structure in upstream differs greatly from ours. COMPUTE_CLASS not taken and removed from conditional. COMPUTE_CLASS introduced in commit 944823c. In case of Gen12 video and compute engines, TLB_INV registers are masked - to modify one bit, corresponding bit in upper half of the register must be enabled, otherwise nothing happens. CVE: CVE-2022-4139 Suggested-by: Chris Wilson <chris.p.wilson@intel.com> Signed-off-by: Andrzej Hajda <andrzej.hajda@intel.com> Acked-by: Daniel Vetter <daniel.vetter@ffwll.ch> Fixes: 7938d61 ("drm/i915: Flush TLBs before releasing backing store") Cc: stable@vger.kernel.org Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org> (cherry picked from commit 04aa643) Signed-off-by: David Gomez <dgomez@ciq.com>
1 parent cc25257 commit d8dcec1

File tree

1 file changed

+4
-0
lines changed

1 file changed

+4
-0
lines changed

drivers/gpu/drm/i915/gt/intel_gt.c

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -793,6 +793,10 @@ void intel_gt_invalidate_tlbs(struct intel_gt *gt)
793793
if (!i915_mmio_reg_offset(rb.reg))
794794
continue;
795795

796+
if (GRAPHICS_VER(i915) == 12 && (engine->class == VIDEO_DECODE_CLASS ||
797+
engine->class == VIDEO_ENHANCEMENT_CLASS))
798+
rb.bit = _MASKED_BIT_ENABLE(rb.bit);
799+
796800
intel_uncore_write_fw(uncore, rb.reg, rb.bit);
797801
if (__intel_wait_for_register_fw(uncore,
798802
rb.reg, rb.bit, 0,

0 commit comments

Comments
 (0)