1 // SPDX-License-Identifier: MIT
3 * Copyright © 2016-2019 Intel Corporation
6 #include <linux/types.h>
8 #include "gt/intel_gt.h"
9 #include "intel_guc_reg.h"
10 #include "intel_huc.h"
13 #include <linux/device/bus.h>
14 #include <linux/mei_aux.h>
19 * The HuC is a dedicated microcontroller for usage in media HEVC (High
20 * Efficiency Video Coding) operations. Userspace can directly use the firmware
21 * capabilities by adding HuC specific commands to batch buffers.
23 * The kernel driver is only responsible for loading the HuC firmware and
24 * triggering its security authentication, which is performed by the GuC on
25 * older platforms and by the GSC on newer ones. For the GuC to correctly
26 * perform the authentication, the HuC binary must be loaded before the GuC one.
27 * Loading the HuC is optional; however, not using the HuC might negatively
28 * impact power usage and/or performance of media workloads, depending on the
30 * HuC must be reloaded on events that cause the WOPCM to lose its contents
31 * (S3/S4, FLR); GuC-authenticated HuC must also be reloaded on GuC/GT reset,
32 * while GSC-managed HuC will survive that.
34 * See https://github.com/intel/media-driver for the latest details on HuC
39 * DOC: HuC Memory Management
41 * Similarly to the GuC, the HuC can't do any memory allocations on its own,
42 * with the difference being that the allocations for HuC usage are handled by
43 * the userspace driver instead of the kernel one. The HuC accesses the memory
44 * via the PPGTT belonging to the context loaded on the VCS executing the
45 * HuC-specific commands.
49 * MEI-GSC load is an async process. The probing of the exposed aux device
50 * (see intel_gsc.c) usually happens a few seconds after i915 probe, depending
51 * on when the kernel schedules it. Unless something goes terribly wrong, we're
52 * guaranteed for this to happen during boot, so the big timeout is a safety net
53 * that we never expect to need.
54 * MEI-PXP + HuC load usually takes ~300ms, but if the GSC needs to be resumed
55 * and/or reset, this can take longer. Note that the kernel might schedule
56 * other work between the i915 init/resume and the MEI one, which can add to
59 #define GSC_INIT_TIMEOUT_MS 10000
60 #define PXP_INIT_TIMEOUT_MS 5000
62 static int sw_fence_dummy_notify(struct i915_sw_fence *sf,
63 enum i915_sw_fence_notify state)
68 static void __delayed_huc_load_complete(struct intel_huc *huc)
70 if (!i915_sw_fence_done(&huc->delayed_load.fence))
71 i915_sw_fence_complete(&huc->delayed_load.fence);
74 static void delayed_huc_load_complete(struct intel_huc *huc)
76 hrtimer_cancel(&huc->delayed_load.timer);
77 __delayed_huc_load_complete(huc);
80 static void __gsc_init_error(struct intel_huc *huc)
82 huc->delayed_load.status = INTEL_HUC_DELAYED_LOAD_ERROR;
83 __delayed_huc_load_complete(huc);
86 static void gsc_init_error(struct intel_huc *huc)
88 hrtimer_cancel(&huc->delayed_load.timer);
89 __gsc_init_error(huc);
92 static void gsc_init_done(struct intel_huc *huc)
94 hrtimer_cancel(&huc->delayed_load.timer);
96 /* MEI-GSC init is done, now we wait for MEI-PXP to bind */
97 huc->delayed_load.status = INTEL_HUC_WAITING_ON_PXP;
98 if (!i915_sw_fence_done(&huc->delayed_load.fence))
99 hrtimer_start(&huc->delayed_load.timer,
100 ms_to_ktime(PXP_INIT_TIMEOUT_MS),
104 static enum hrtimer_restart huc_delayed_load_timer_callback(struct hrtimer *hrtimer)
106 struct intel_huc *huc = container_of(hrtimer, struct intel_huc, delayed_load.timer);
108 if (!intel_huc_is_authenticated(huc)) {
109 if (huc->delayed_load.status == INTEL_HUC_WAITING_ON_GSC)
110 drm_notice(&huc_to_gt(huc)->i915->drm,
111 "timed out waiting for MEI GSC init to load HuC\n");
112 else if (huc->delayed_load.status == INTEL_HUC_WAITING_ON_PXP)
113 drm_notice(&huc_to_gt(huc)->i915->drm,
114 "timed out waiting for MEI PXP init to load HuC\n");
116 MISSING_CASE(huc->delayed_load.status);
118 __gsc_init_error(huc);
121 return HRTIMER_NORESTART;
124 static void huc_delayed_load_start(struct intel_huc *huc)
128 GEM_BUG_ON(intel_huc_is_authenticated(huc));
131 * On resume we don't have to wait for MEI-GSC to be re-probed, but we
132 * do need to wait for MEI-PXP to reset & re-bind
134 switch (huc->delayed_load.status) {
135 case INTEL_HUC_WAITING_ON_GSC:
136 delay = ms_to_ktime(GSC_INIT_TIMEOUT_MS);
138 case INTEL_HUC_WAITING_ON_PXP:
139 delay = ms_to_ktime(PXP_INIT_TIMEOUT_MS);
147 * This fence is always complete unless we're waiting for the
148 * GSC device to come up to load the HuC. We arm the fence here
149 * and complete it when we confirm that the HuC is loaded from
150 * the PXP bind callback.
152 GEM_BUG_ON(!i915_sw_fence_done(&huc->delayed_load.fence));
153 i915_sw_fence_fini(&huc->delayed_load.fence);
154 i915_sw_fence_reinit(&huc->delayed_load.fence);
155 i915_sw_fence_await(&huc->delayed_load.fence);
156 i915_sw_fence_commit(&huc->delayed_load.fence);
158 hrtimer_start(&huc->delayed_load.timer, delay, HRTIMER_MODE_REL);
161 static int gsc_notifier(struct notifier_block *nb, unsigned long action, void *data)
163 struct device *dev = data;
164 struct intel_huc *huc = container_of(nb, struct intel_huc, delayed_load.nb);
165 struct intel_gsc_intf *intf = &huc_to_gt(huc)->gsc.intf[0];
167 if (!intf->adev || &intf->adev->aux_dev.dev != dev)
171 case BUS_NOTIFY_BOUND_DRIVER: /* mei driver bound to aux device */
175 case BUS_NOTIFY_DRIVER_NOT_BOUND: /* mei driver fails to be bound */
176 case BUS_NOTIFY_UNBIND_DRIVER: /* mei driver about to be unbound */
177 drm_info(&huc_to_gt(huc)->i915->drm,
178 "mei driver not bound, disabling HuC load\n");
186 void intel_huc_register_gsc_notifier(struct intel_huc *huc, struct bus_type *bus)
190 if (!intel_huc_is_loaded_by_gsc(huc))
193 huc->delayed_load.nb.notifier_call = gsc_notifier;
194 ret = bus_register_notifier(bus, &huc->delayed_load.nb);
196 drm_err(&huc_to_gt(huc)->i915->drm,
197 "failed to register GSC notifier\n");
198 huc->delayed_load.nb.notifier_call = NULL;
203 void intel_huc_unregister_gsc_notifier(struct intel_huc *huc, struct bus_type *bus)
205 if (!huc->delayed_load.nb.notifier_call)
208 delayed_huc_load_complete(huc);
210 bus_unregister_notifier(bus, &huc->delayed_load.nb);
211 huc->delayed_load.nb.notifier_call = NULL;
214 static void delayed_huc_load_init(struct intel_huc *huc)
217 * Initialize fence to be complete as this is expected to be complete
218 * unless there is a delayed HuC load in progress.
220 i915_sw_fence_init(&huc->delayed_load.fence,
221 sw_fence_dummy_notify);
222 i915_sw_fence_commit(&huc->delayed_load.fence);
224 hrtimer_init(&huc->delayed_load.timer, CLOCK_MONOTONIC, HRTIMER_MODE_REL);
225 huc->delayed_load.timer.function = huc_delayed_load_timer_callback;
228 static void delayed_huc_load_fini(struct intel_huc *huc)
231 * the fence is initialized in init_early, so we need to clean it up
232 * even if HuC loading is off.
234 delayed_huc_load_complete(huc);
235 i915_sw_fence_fini(&huc->delayed_load.fence);
238 static bool vcs_supported(struct intel_gt *gt)
240 intel_engine_mask_t mask = gt->info.engine_mask;
243 * We reach here from i915_driver_early_probe for the primary GT before
244 * its engine mask is set, so we use the device info engine mask for it;
245 * this means we're not taking VCS fusing into account, but if the
246 * primary GT supports VCS engines we expect at least one of them to
247 * remain unfused so we're fine.
248 * For other GTs we expect the GT-specific mask to be set before we
249 * call this function.
251 GEM_BUG_ON(!gt_is_root(gt) && !gt->info.engine_mask);
254 mask = RUNTIME_INFO(gt->i915)->platform_engine_mask;
256 mask = gt->info.engine_mask;
258 return __ENGINE_INSTANCES_MASK(mask, VCS0, I915_MAX_VCS);
261 void intel_huc_init_early(struct intel_huc *huc)
263 struct drm_i915_private *i915 = huc_to_gt(huc)->i915;
264 struct intel_gt *gt = huc_to_gt(huc);
266 intel_uc_fw_init_early(&huc->fw, INTEL_UC_FW_TYPE_HUC);
269 * we always init the fence as already completed, even if HuC is not
270 * supported. This way we don't have to distinguish between HuC not
271 * supported/disabled or already loaded, and can focus on if the load
272 * is currently in progress (fence not complete) or not, which is what
273 * we care about for stalling userspace submissions.
275 delayed_huc_load_init(huc);
277 if (!vcs_supported(gt)) {
278 intel_uc_fw_change_status(&huc->fw, INTEL_UC_FIRMWARE_NOT_SUPPORTED);
282 if (GRAPHICS_VER(i915) >= 11) {
283 huc->status.reg = GEN11_HUC_KERNEL_LOAD_INFO;
284 huc->status.mask = HUC_LOAD_SUCCESSFUL;
285 huc->status.value = HUC_LOAD_SUCCESSFUL;
287 huc->status.reg = HUC_STATUS2;
288 huc->status.mask = HUC_FW_VERIFIED;
289 huc->status.value = HUC_FW_VERIFIED;
293 #define HUC_LOAD_MODE_STRING(x) (x ? "GSC" : "legacy")
294 static int check_huc_loading_mode(struct intel_huc *huc)
296 struct intel_gt *gt = huc_to_gt(huc);
297 bool fw_needs_gsc = intel_huc_is_loaded_by_gsc(huc);
298 bool hw_uses_gsc = false;
301 * The fuse for HuC load via GSC is only valid on platforms that have
304 if (HAS_GUC_DEPRIVILEGE(gt->i915))
305 hw_uses_gsc = intel_uncore_read(gt->uncore, GUC_SHIM_CONTROL2) &
308 if (fw_needs_gsc != hw_uses_gsc) {
309 drm_err(>->i915->drm,
310 "mismatch between HuC FW (%s) and HW (%s) load modes\n",
311 HUC_LOAD_MODE_STRING(fw_needs_gsc),
312 HUC_LOAD_MODE_STRING(hw_uses_gsc));
316 /* make sure we can access the GSC via the mei driver if we need it */
317 if (!(IS_ENABLED(CONFIG_INTEL_MEI_PXP) && IS_ENABLED(CONFIG_INTEL_MEI_GSC)) &&
319 drm_info(>->i915->drm,
320 "Can't load HuC due to missing MEI modules\n");
324 drm_dbg(>->i915->drm, "GSC loads huc=%s\n", str_yes_no(fw_needs_gsc));
329 int intel_huc_init(struct intel_huc *huc)
331 struct drm_i915_private *i915 = huc_to_gt(huc)->i915;
334 err = check_huc_loading_mode(huc);
338 err = intel_uc_fw_init(&huc->fw);
342 intel_uc_fw_change_status(&huc->fw, INTEL_UC_FIRMWARE_LOADABLE);
347 intel_uc_fw_change_status(&huc->fw, INTEL_UC_FIRMWARE_INIT_FAIL);
348 drm_info(&i915->drm, "HuC init failed with %d\n", err);
352 void intel_huc_fini(struct intel_huc *huc)
355 * the fence is initialized in init_early, so we need to clean it up
356 * even if HuC loading is off.
358 delayed_huc_load_fini(huc);
360 if (intel_uc_fw_is_loadable(&huc->fw))
361 intel_uc_fw_fini(&huc->fw);
364 void intel_huc_suspend(struct intel_huc *huc)
366 if (!intel_uc_fw_is_loadable(&huc->fw))
370 * in the unlikely case that we're suspending before the GSC has
371 * completed its loading sequence, just stop waiting. We'll restart
374 delayed_huc_load_complete(huc);
377 int intel_huc_wait_for_auth_complete(struct intel_huc *huc)
379 struct intel_gt *gt = huc_to_gt(huc);
382 ret = __intel_wait_for_register(gt->uncore,
388 /* mark the load process as complete even if the wait failed */
389 delayed_huc_load_complete(huc);
392 drm_err(>->i915->drm, "HuC: Firmware not verified %d\n", ret);
393 intel_uc_fw_change_status(&huc->fw, INTEL_UC_FIRMWARE_LOAD_FAIL);
397 intel_uc_fw_change_status(&huc->fw, INTEL_UC_FIRMWARE_RUNNING);
398 drm_info(>->i915->drm, "HuC authenticated\n");
403 * intel_huc_auth() - Authenticate HuC uCode
404 * @huc: intel_huc structure
406 * Called after HuC and GuC firmware loading during intel_uc_init_hw().
408 * This function invokes the GuC action to authenticate the HuC firmware,
409 * passing the offset of the RSA signature to intel_guc_auth_huc(). It then
410 * waits for up to 50ms for firmware verification ACK.
412 int intel_huc_auth(struct intel_huc *huc)
414 struct intel_gt *gt = huc_to_gt(huc);
415 struct intel_guc *guc = >->uc.guc;
418 if (!intel_uc_fw_is_loaded(&huc->fw))
421 /* GSC will do the auth */
422 if (intel_huc_is_loaded_by_gsc(huc))
425 ret = i915_inject_probe_error(gt->i915, -ENXIO);
429 GEM_BUG_ON(intel_uc_fw_is_running(&huc->fw));
431 ret = intel_guc_auth_huc(guc, intel_guc_ggtt_offset(guc, huc->fw.rsa_data));
433 DRM_ERROR("HuC: GuC did not ack Auth request %d\n", ret);
437 /* Check authentication status, it should be done by now */
438 ret = intel_huc_wait_for_auth_complete(huc);
445 i915_probe_error(gt->i915, "HuC: Authentication failed %d\n", ret);
449 bool intel_huc_is_authenticated(struct intel_huc *huc)
451 struct intel_gt *gt = huc_to_gt(huc);
452 intel_wakeref_t wakeref;
455 with_intel_runtime_pm(gt->uncore->rpm, wakeref)
456 status = intel_uncore_read(gt->uncore, huc->status.reg);
458 return (status & huc->status.mask) == huc->status.value;
462 * intel_huc_check_status() - check HuC status
463 * @huc: intel_huc structure
465 * This function reads status register to verify if HuC
466 * firmware was successfully loaded.
468 * The return values match what is expected for the I915_PARAM_HUC_STATUS
471 int intel_huc_check_status(struct intel_huc *huc)
473 switch (__intel_uc_fw_status(&huc->fw)) {
474 case INTEL_UC_FIRMWARE_NOT_SUPPORTED:
476 case INTEL_UC_FIRMWARE_DISABLED:
478 case INTEL_UC_FIRMWARE_MISSING:
480 case INTEL_UC_FIRMWARE_ERROR:
482 case INTEL_UC_FIRMWARE_INIT_FAIL:
484 case INTEL_UC_FIRMWARE_LOAD_FAIL:
490 return intel_huc_is_authenticated(huc);
493 static bool huc_has_delayed_load(struct intel_huc *huc)
495 return intel_huc_is_loaded_by_gsc(huc) &&
496 (huc->delayed_load.status != INTEL_HUC_DELAYED_LOAD_ERROR);
499 void intel_huc_update_auth_status(struct intel_huc *huc)
501 if (!intel_uc_fw_is_loadable(&huc->fw))
504 if (intel_huc_is_authenticated(huc))
505 intel_uc_fw_change_status(&huc->fw,
506 INTEL_UC_FIRMWARE_RUNNING);
507 else if (huc_has_delayed_load(huc))
508 huc_delayed_load_start(huc);
512 * intel_huc_load_status - dump information about HuC load status
514 * @p: the &drm_printer
516 * Pretty printer for HuC load status.
518 void intel_huc_load_status(struct intel_huc *huc, struct drm_printer *p)
520 struct intel_gt *gt = huc_to_gt(huc);
521 intel_wakeref_t wakeref;
523 if (!intel_huc_is_supported(huc)) {
524 drm_printf(p, "HuC not supported\n");
528 if (!intel_huc_is_wanted(huc)) {
529 drm_printf(p, "HuC disabled\n");
533 intel_uc_fw_dump(&huc->fw, p);
535 with_intel_runtime_pm(gt->uncore->rpm, wakeref)
536 drm_printf(p, "HuC status: 0x%08x\n",
537 intel_uncore_read(gt->uncore, huc->status.reg));