Commit graph

1229 commits

Author SHA1 Message Date
Asahi Lina
7ad099a5b6 m1n1.trace.agx: Add exploit mitigation
Signed-off-by: Asahi Lina <lina@asahilina.net>
2023-03-06 15:15:17 +09:00
Asahi Lina
6d3e594903 m1n1.hv: Fix read-only or write-only hooks
Signed-off-by: Asahi Lina <lina@asahilina.net>
2023-03-06 15:15:17 +09:00
Asahi Lina
5cacbdc501 m1n1.fw.agx.initdata: Define buffer manager ctl fields better
Signed-off-by: Asahi Lina <lina@asahilina.net>
2023-03-06 15:15:17 +09:00
Asahi Lina
90f4957725 experiments/agx_xtest.py: Here be exploits!
Signed-off-by: Asahi Lina <lina@asahilina.net>
2023-03-06 15:15:17 +09:00
Asahi Lina
3548d4d210 m1n1.fw.ags.microsequence: Add more ops
Signed-off-by: Asahi Lina <lina@asahilina.net>
2023-03-06 15:15:17 +09:00
Asahi Lina
e8377889d2 m1n1.proxyutils: Add 13.0 beta5/6 versions
Signed-off-by: Asahi Lina <lina@asahilina.net>
2023-03-06 15:15:17 +09:00
Asahi Lina
c35168bb88 m1n1.hw.uat: Gracefully handle inaccessible page tables
Signed-off-by: Asahi Lina <lina@asahilina.net>
2023-03-06 15:15:17 +09:00
Asahi Lina
b063fde19a m1n1.hw.uat: Support block maps
Signed-off-by: Asahi Lina <lina@asahilina.net>
2023-03-06 15:15:17 +09:00
Asahi Lina
bfaf358f82 m1n1.agx.render: Add microsequence hooks
Signed-off-by: Asahi Lina <lina@asahilina.net>
2023-03-06 15:15:17 +09:00
Asahi Lina
e49c90a314 m1n1.agx.context: Add GPUMicroSequence.cur_addr()
This requires that we pre-allocate the buffer

Signed-off-by: Asahi Lina <lina@asahilina.net>
2023-03-06 15:15:17 +09:00
Asahi Lina
586be52ec5 m1n1.trace.agx: Log structure UAT permissions as meta
Signed-off-by: Asahi Lina <lina@asahilina.net>
2023-03-06 15:15:17 +09:00
Asahi Lina
b4c687ce13 m1n1.hw.uat: Add ioperm()
Signed-off-by: Asahi Lina <lina@asahilina.net>
2023-03-06 15:15:17 +09:00
Asahi Lina
cc1284f264 hv/trace_agx_defer.py: Exclude context ID 1 (compositor)
Signed-off-by: Asahi Lina <lina@asahilina.net>
2023-03-06 15:15:17 +09:00
Asahi Lina
9a8da80e8d m1n1.trace.agx: Add exclude_context_id option
Signed-off-by: Asahi Lina <lina@asahilina.net>
2023-03-06 15:15:17 +09:00
Asahi Lina
9e93bd70e4 m1n1.fw.agx: More compute and blit stuff
Signed-off-by: Asahi Lina <lina@asahilina.net>
2023-03-06 15:15:17 +09:00
Asahi Lina
074892377c m1n1.fw.agx: Fix some more sequence number-ish field names
Signed-off-by: Asahi Lina <lina@asahilina.net>
2023-03-06 15:15:17 +09:00
Asahi Lina
b7fb8d98d8 m1n1.agx: Increase available VM size and reduce usage
Signed-off-by: Asahi Lina <lina@asahilina.net>
2023-03-06 15:15:17 +09:00
Asahi Lina
25813d91b4 m1n1.trace.agx: Disable RegionC tracing
The atomic stuff breaks with Linux right now...

Signed-off-by: Asahi Lina <lina@asahilina.net>
2023-03-06 15:15:17 +09:00
Asahi Lina
3e572aba4a m1n1.fw.dcp.ipc: Add compression info struct
Signed-off-by: Asahi Lina <lina@asahilina.net>
2023-03-06 15:15:17 +09:00
Asahi Lina
813c545509 m1n1.fw.agx: Compute struct fixes for 13.2
Assuming these apply at 13.0b4 too...

Signed-off-by: Asahi Lina <lina@asahilina.net>
2023-03-06 15:15:17 +09:00
Asahi Lina
f01a62b7a1 m1n1.fw.agx.cmdqueue: Misc fixes
Signed-off-by: Asahi Lina <lina@asahilina.net>
2023-03-06 15:15:17 +09:00
Asahi Lina
1400b50157 m1n1.fw.agx: Initial 13.2 structure changes
Signed-off-by: Asahi Lina <lina@asahilina.net>
2023-03-06 15:15:17 +09:00
Asahi Lina
e22d2fe049 m1n1.hw.agx: Fix fault status register fields
Signed-off-by: Asahi Lina <lina@asahilina.net>
2023-03-06 15:15:17 +09:00
Asahi Lina
e7dee84c3a m1n1.trace.agx: Misc TA/3D dump changes
Signed-off-by: Asahi Lina <lina@asahilina.net>
2023-03-06 15:15:17 +09:00
Asahi Lina
7e49d104ea m1n1.trace.agx: Add compute tracing
Signed-off-by: Asahi Lina <lina@asahilina.net>
2023-03-06 15:15:17 +09:00
Asahi Lina
8fba6118ce m1n1.fw.agx: Add missing compute stuff
Signed-off-by: Asahi Lina <lina@asahilina.net>
2023-03-06 15:15:17 +09:00
Asahi Lina
89e3fcb2ab m1n1.trace.agx: Fix delayed ring buffer fetches
This should solve the issue where we see commands that the GPU has
already processed.

Signed-off-by: Asahi Lina <lina@asahilina.net>
2023-03-06 15:15:17 +09:00
Asahi Lina
37f9c5149c m1n1.proxyutils/constructutils: Add missing versions
Signed-off-by: Asahi Lina <lina@asahilina.net>
2023-03-06 15:15:17 +09:00
Asahi Lina
3117cdef99 m1n1.fw.agx: Fixes for 13.0b4 support
Found while adding 13.2, but almost certainly mistakes from back when we
did 13.0b4.

Signed-off-by: Asahi Lina <lina@asahilina.net>
2023-03-06 15:15:17 +09:00
Asahi Lina
91e0809063 m1n1.fw.agx: Misc initdata/etc fixes
Signed-off-by: Asahi Lina <lina@asahilina.net>
2023-03-06 15:15:17 +09:00
Janne Grunau
5f3bd50b4a experiments/dart_dump.py: Fix register dump after 183991ca19
Fixes: 183991ca19 ("m1n1.hw.dart: Hide all DART variants behind common interface")
Signed-off-by: Janne Grunau <j@jannau.net>
2023-02-02 09:50:56 +09:00
Janne Grunau
2b4ed4abbf hv/trace_cd3217: Add tracing for TI/Apple cd3217 USB type C controller
Interface (as used by macOS) is simple enough to skip register
definitions.

Signed-off-by: Janne Grunau <j@jannau.net>
2023-01-28 10:49:04 +09:00
Janne Grunau
6f4c53279e hv/trace_dcp.py: Add support for for M2
Signed-off-by: Janne Grunau <j@jannau.net>
2023-01-28 10:48:46 +09:00
Janne Grunau
aaa04cfaba m1n1.trace.asc: Support tracing of a DART SID != 0
Required for DCP on M2.

Signed-off-by: Janne Grunau <j@jannau.net>
2023-01-28 10:48:46 +09:00
Janne Grunau
f8964ed0f9 m1n1.fw.asc: Increase DVA size to 36-bits
A single TTBR covers 36-bit address space with 16k pages. Necessary for
DCP on M2.

Signed-off-by: Janne Grunau <j@jannau.net>
2023-01-28 10:48:46 +09:00
Janne Grunau
39f933ec1f m1n1.fw.dcp.dcpep: DCPEp_SetShmem allows to query Shmem
When used with FLAG = 0, IOMFB replies with the current Shmem IOVA. It
is NULL on the first call and keeps the last set value. Updating it
seems to work without issues after shutdown.

Signed-off-by: Janne Grunau <j@jannau.net>
2023-01-28 10:48:46 +09:00
Janne Grunau
5631aaa74a experiments/scaler.py: Use unified DART implementation
Untested if that makes this work on M1 systems which use dart8020 for
the scaler.

Signed-off-by: Janne Grunau <j@jannau.net>
2023-01-28 10:48:46 +09:00
Janne Grunau
68bba35263 experiments/aes.py: Simplify by using unified DART
Signed-off-by: Janne Grunau <j@jannau.net>
2023-01-28 10:48:46 +09:00
Janne Grunau
183991ca19 m1n1.hw.dart: Hide all DART variants behind common interface
Allows m1n1 experiments and tracers not to care about the DART variant.
Required to trace and experiment with DCP sanely on M1 and M2.

Signed-off-by: Janne Grunau <j@jannau.net>
2023-01-28 10:48:46 +09:00
Janne Grunau
1fc26dbb1a hv/trace_dcp: Disable Disp0/DCP iboot EP tracing
Its usage in m1n1 it is incompatible with the generic EPICEp tracing.

Signed-off-by: Janne Grunau <j@jannau.net>
2023-01-28 10:48:46 +09:00
Janne Grunau
bf73c1416a m1n1.fw.asc.ioreporting: Support IOP provided buffers
SMC provides buffer from its MMIO space. Since the macOS 13 SMC firmware
the firmware crashes when ACK-ing a GetBuf which provided a buffer.

Signed-off-by: Janne Grunau <j@jannau.net>
2023-01-28 10:46:45 +09:00
Hector Martin
46f2811351 m1n1.fw.dcp.iboot: Identify colorspace values
Signed-off-by: Hector Martin <marcan@marcan.st>
2023-01-22 23:57:41 +09:00
Asahi Lina
3d28ac4d6f tools/chainload.py: Properly sleep DCP when chainloading macOS
Signed-off-by: Asahi Lina <lina@asahilina.net>
2023-01-20 18:18:13 +09:00
Asahi Lina
7a92257d30 m1n1.agx.render: Change heap size to 0x200
This seems to be the AGX value

Signed-off-by: Asahi Lina <lina@asahilina.net>
2023-01-20 18:18:13 +09:00
Asahi Lina
e774b5c521 m1n1.trace.agx: Log hook writes
Signed-off-by: Asahi Lina <lina@asahilina.net>
2023-01-20 18:18:13 +09:00
Asahi Lina
8e77f8f49f m1n1.fw.agx.channels: Do not require contiguous pages for channel state
Signed-off-by: Asahi Lina <lina@asahilina.net>
2023-01-20 18:18:13 +09:00
Martin Povišer
2cb6cb46ca tools/run_guest.py: Add -v option for attaching 9P virtio exports
Signed-off-by: Martin Povišer <povik@cutebit.org>
2023-01-13 17:25:25 +09:00
Martin Povišer
93c20e9395 m1n1.hv: Allocate virtio resources if unspecified
Signed-off-by: Martin Povišer <povik@cutebit.org>
2023-01-13 17:25:25 +09:00
Martin Povišer
020d86a23f m1n1.utils: Fix len() overflow in RangeMap
This is to fix

  OverflowError: Python int too large to convert to C ssize_t

in case the upper bound of a range is 1<<64.

Signed-off-by: Martin Povišer <povik@cutebit.org>
2023-01-13 17:25:25 +09:00
Martin Povišer
c760e02388 hv: Insert attached virtios into ADT
Signed-off-by: Martin Povišer <povik@cutebit.org>
2023-01-13 17:25:25 +09:00