drm/msm: gpu: Use the zap shader on 5XX if we can

The A5XX GPU powers on in "secure" mode.  In secure mode the GPU can
only render to buffers that are marked as secure and inaccessible
to the kernel and user through a series of hardware protections. In
practice secure mode is used to draw things like a UI on a secure
video frame.

In order to switch out of secure mode the GPU executes a special
shader that clears out the GMEM and other sensitve registers and
then writes a register. Because the kernel can't be trusted the
shader binary is signed and verified and programmed by the
trustzone using the PIL loader to upload the binary and access
to the special register is blocked with hardware protection.

So in summary, to do secure mode correctly you need 1) a friendly
trustzone, 2) PIL loader support and 3) a verified zap shader.

For targets without secure support there is an out: if the
trustzone doesn't support secure then there are no hardware
protections and we can freely write the SECVID_TRUST register from
the CPU. Unfortunately we don't have any good way to figure out
at runtime if the trustzone is secure or not so we use a cheat.
If there is a zap shader specified in the device tree for the
target, we assume that the trustzone is secure. No zap shader
definition means that the target is not secure. The downside
of course is that if you guess wrong you trigger a XPU violation
which usually ends up in a system crash but thats a problem
that shows up immediately.

Change-Id: Ic0dedbad8738ad1fac8a7bb8d76e1988aa49f2c8
Signed-off-by: Jordan Crouse <jcrouse@codeaurora.org>

0 files changed, 0 insertions, 0 deletions