Re: [RFC PATCH 0/5] drm/panthor: Protected mode support for Mali CSF GPUs

Boris Brezillon
2025-02-03T09:26:55Z

On Thu, 30 Jan 2025 17:15:24 +0100
Simona Vetter <simona.vetter@ffwll.ch> wrote:

> On Thu, Jan 30, 2025 at 01:08:56PM +0000, Florent Tomasin wrote:
> > Hi,
> >
> > This is a patch series covering the support for protected mode execution in
> > Mali Panthor CSF kernel driver.
> >
> > The Mali CSF GPUs come with the support for protected mode execution at the
> > HW level. This feature requires two main changes in the kernel driver:
> >
> > 1) Configure the GPU with a protected buffer. The system must provide a DMA
> > heap from which the driver can allocate a protected buffer.
> > It can be a carved-out memory or dynamically allocated protected memory region.
> > Some system includes a trusted FW which is in charge of the protected memory.
> > Since this problem is integration specific, the Mali Panthor CSF kernel
> > driver must import the protected memory from a device specific exporter.
> >
> > 2) Handle enter and exit of the GPU HW from normal to protected mode of execution.
> > FW sends a request for protected mode entry to the kernel driver.
> > The acknowledgment of that request is a scheduling decision. Effectively,
> > protected mode execution should not overrule normal mode of execution.
> > A fair distribution of execution time will guaranty the overall performance
> > of the device, including the UI (usually executing in normal mode),
> > will not regress when a protected mode job is submitted by an application.
> >
> >
> > Background
> > ----------
> >
> > Current Mali Panthor CSF driver does not allow a user space application to
> > execute protected jobs on the GPU. This use case is quite common on end-user-device.
> > A user may want to watch a video or render content that is under a "Digital Right
> > Management" protection, or launch an application with user private data.
> >
> > 1) User-space:
> >
> > In order for an application to execute protected jobs on a Mali CSF GPU the
> > user space application must submit jobs to the GPU within a "protected regions"
> > (range of commands to execute in protected mode).
> >
> > Find here an example of a command buffer that contains protected commands:
> >
> > ```
> > <--- Normal mode ---><--- Protected mode ---><--- Normal mode --->
> > +-------------------------------------------------------------------------+
> > | ... | CMD_0 | ... | CMD_N | PROT_REGION | CMD_N+1 | ... | CMD_N+M | ... |
> > +-------------------------------------------------------------------------+
> > ```
> >
> > The PROT_REGION command acts as a barrier to notify the HW of upcoming
> > protected jobs. It also defines the number of commands to execute in protected
> > mode.
> >
> > The Mesa definition of the opcode can be found here:
> >
> > https://gitlab.freedesktop.org/mesa/mesa/-/blob/main/src/panfrost/lib/genxml/v10.xml?ref_type=heads#L763
>
> Is there also something around that implements egl_ext_protected_context
> or similar in mesa?

I'll be looking at a mesa implementation for EGL_EXT_protected_content
in the coming weeks. I'll probably get back to reviewing the panthor
implementation when I have something working in mesa.

> I think that's the minimal bar all the protected gpu
> workload kernel support patches cleared thus far, since usually getting
> the actual video code stuff published seems to be impossible.