kevin/linux
1
Fork 0
Code

- Remove a double include (Lucas)

Browse Source 
- Fix null checks and UAF (Brost)
 - Fix access_ok check in user_fence_create (Nirmoy)
 - Fix compat IS_DISPLAY_STEP() range (Jani)
 - OA fix (Ashutosh)
 - Fixes in show_meminfo (Auld)
 -----BEGIN PGP SIGNATURE-----
 
 iQEzBAABCAAdFiEEbSBwaO7dZQkcLOKj+mJfZA7rE8oFAmbi/gkACgkQ+mJfZA7r
 E8pUvAf7Bk9XRNp4yXGPQB6xXohH6Z3KiuOTtkApGgbhpUvi24ZQqyoNqghY+rRf
 vcUUudufkwNv7GRhoQ9xLdM8+5wuK6BfhBjpSA58lz1CdwcmpYZKKwMUdoEXroY/
 G7d1BVAV3T0i1L3KtBudanPdtp0jBTS1KmELwv1D9yM2eBQNdAmU4m/KaR84zFBa
 IJe+eQjAm6o7gk5XFJfb+FrnN5ForlC8KJfWksy5d4jiVrbi5RFZOZCdeCwDTPTe
 gIORBRnKtFF7jyABjNoMU6b30/iFyUU3gxF+RQcrxbk6vNDuI0oixGuE/z8n6vFT
 +i3jG4sJ4d+HC/9LXZKvrIlA5q0rVg==
 =1RYw
 -----END PGP SIGNATURE-----

Merge tag 'drm-xe-fixes-2024-09-12' of https://gitlab.freedesktop.org/drm/xe/kernel into drm-fixes

- Remove a double include (Lucas)
- Fix null checks and UAF (Brost)
- Fix access_ok check in user_fence_create (Nirmoy)
- Fix compat IS_DISPLAY_STEP() range (Jani)
- OA fix (Ashutosh)
- Fixes in show_meminfo (Auld)

Signed-off-by: Dave Airlie <airlied@redhat.com>

From: Rodrigo Vivi <rodrigo.vivi@intel.com>
Link: https://patchwork.freedesktop.org/patch/msgid/ZuL-sORu54zfz1Lf@intel.com
This commit is contained in:
Dave Airlie 2024-09-13 15:18:15 +10:00
commit 135be1dc46
8 changed files with 53 additions and 10 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
drivers/gpu/drm/xe/compat-i915-headers/i915_drv.h
View File

@ -83,7 +83,7 @@ static inline struct drm_i915_private *kdev_to_i915(struct device *kdev)
#define HAS_GMD_ID(xe) GRAPHICS_VERx100(xe) >= 1270
/* Workarounds not handled yet */
#define IS_DISPLAY_STEP(xe, first, last) ({u8 __step = (xe)->info.step.display; first <= __step && __step <= last; })
#define IS_DISPLAY_STEP(xe, first, last) ({u8 __step = (xe)->info.step.display; first <= __step && __step < last; })
#define IS_LP(xe) (0)
#define IS_GEN9_LP(xe) (0)

1
drivers/gpu/drm/xe/regs/xe_oa_regs.h
View File

@ -52,6 +52,7 @@
#define OAG_OABUFFER_MEMORY_SELECT REG_BIT(0) /* 0: PPGTT, 1: GGTT */
#define OAG_OACONTROL XE_REG(0xdaf4)
#define OAG_OACONTROL_OA_PES_DISAG_EN REG_GENMASK(27, 22)
#define OAG_OACONTROL_OA_CCS_SELECT_MASK REG_GENMASK(18, 16)
#define OAG_OACONTROL_OA_COUNTER_SEL_MASK REG_GENMASK(4, 2)
#define OAG_OACONTROL_OA_COUNTER_ENABLE REG_BIT(0)

41
drivers/gpu/drm/xe/xe_drm_client.c
View File

@ -10,6 +10,7 @@
#include <linux/slab.h>
#include <linux/types.h>
#include "xe_assert.h"
#include "xe_bo.h"
#include "xe_bo_types.h"
#include "xe_device_types.h"
@ -151,10 +152,13 @@ void xe_drm_client_add_bo(struct xe_drm_client *client,
*/
void xe_drm_client_remove_bo(struct xe_bo *bo)
{
struct xe_device *xe = ttm_to_xe_device(bo->ttm.bdev);
struct xe_drm_client *client = bo->client;
xe_assert(xe, !kref_read(&bo->ttm.base.refcount));
spin_lock(&client->bos_lock);
list_del(&bo->client_link);
list_del_init(&bo->client_link);
spin_unlock(&client->bos_lock);
xe_drm_client_put(client);
@ -166,6 +170,8 @@ static void bo_meminfo(struct xe_bo *bo,
u64 sz = bo->size;
u32 mem_type;
xe_bo_assert_held(bo);
if (bo->placement.placement)
mem_type = bo->placement.placement->mem_type;
else
@ -196,6 +202,7 @@ static void show_meminfo(struct drm_printer *p, struct drm_file *file)
struct xe_drm_client *client;
struct drm_gem_object *obj;
struct xe_bo *bo;
LLIST_HEAD(deferred);
unsigned int id;
u32 mem_type;
@ -206,7 +213,20 @@ static void show_meminfo(struct drm_printer *p, struct drm_file *file)
idr_for_each_entry(&file->object_idr, obj, id) {
struct xe_bo *bo = gem_to_xe_bo(obj);
if (dma_resv_trylock(bo->ttm.base.resv)) {
bo_meminfo(bo, stats);
xe_bo_unlock(bo);
} else {
xe_bo_get(bo);
spin_unlock(&file->table_lock);
xe_bo_lock(bo, false);
bo_meminfo(bo, stats);
xe_bo_unlock(bo);
xe_bo_put(bo);
spin_lock(&file->table_lock);
}
}
spin_unlock(&file->table_lock);
@ -215,11 +235,28 @@ static void show_meminfo(struct drm_printer *p, struct drm_file *file)
list_for_each_entry(bo, &client->bos_list, client_link) {
if (!kref_get_unless_zero(&bo->ttm.base.refcount))
continue;
if (dma_resv_trylock(bo->ttm.base.resv)) {
bo_meminfo(bo, stats);
xe_bo_put(bo);
xe_bo_unlock(bo);
} else {
spin_unlock(&client->bos_lock);
xe_bo_lock(bo, false);
bo_meminfo(bo, stats);
xe_bo_unlock(bo);
spin_lock(&client->bos_lock);
/* The bo ref will prevent this bo from being removed from the list */
xe_assert(xef->xe, !list_empty(&bo->client_link));
}
xe_bo_put_deferred(bo, &deferred);
}
spin_unlock(&client->bos_lock);
xe_bo_put_commit(&deferred);
for (mem_type = XE_PL_SYSTEM; mem_type < TTM_NUM_MEM_TYPES; ++mem_type) {
if (!xe_mem_type_to_name[mem_type])
continue;

1
drivers/gpu/drm/xe/xe_gt.c
View File

@ -9,7 +9,6 @@
#include <drm/drm_managed.h>
#include <drm/xe_drm.h>
#include <generated/xe_wa_oob.h>
#include <generated/xe_wa_oob.h>

4
drivers/gpu/drm/xe/xe_gt_tlb_invalidation.c
View File

@ -182,7 +182,7 @@ static int send_tlb_invalidation(struct xe_guc *guc,
action[1] = seqno;
ret = xe_guc_ct_send_locked(&guc->ct, action, len,
G2H_LEN_DW_TLB_INVALIDATE, 1);
if (!ret && fence) {
if (!ret) {
spin_lock_irq(&gt->tlb_invalidation.pending_lock);
/*
* We haven't actually published the TLB fence as per
@ -203,7 +203,7 @@ static int send_tlb_invalidation(struct xe_guc *guc,
tlb_timeout_jiffies(gt));
}
spin_unlock_irq(&gt->tlb_invalidation.pending_lock);
} else if (ret < 0 && fence) {
} else if (ret < 0) {
__invalidation_fence_signal(xe, fence);
}
if (!ret) {

4
drivers/gpu/drm/xe/xe_guc_submit.c
View File

@ -1375,6 +1375,8 @@ static void __guc_exec_queue_process_msg_resume(struct xe_sched_msg *msg)
static void guc_exec_queue_process_msg(struct xe_sched_msg *msg)
{
struct xe_device *xe = guc_to_xe(exec_queue_to_guc(msg->private_data));
trace_xe_sched_msg_recv(msg);
switch (msg->opcode) {
@ -1394,7 +1396,7 @@ static void guc_exec_queue_process_msg(struct xe_sched_msg *msg)
XE_WARN_ON("Unknown message type");
}
xe_pm_runtime_put(guc_to_xe(exec_queue_to_guc(msg->private_data)));
xe_pm_runtime_put(xe);
}
static const struct drm_sched_backend_ops drm_sched_ops = {

4
drivers/gpu/drm/xe/xe_oa.c
View File

@ -440,6 +440,10 @@ static void xe_oa_enable(struct xe_oa_stream *stream)
val = __format_to_oactrl(format, regs->oa_ctrl_counter_select_mask) |
__oa_ccs_select(stream) | OAG_OACONTROL_OA_COUNTER_ENABLE;
if (GRAPHICS_VER(stream->oa->xe) >= 20 &&
stream->hwe->oa_unit->type == DRM_XE_OA_UNIT_TYPE_OAG)
val |= OAG_OACONTROL_OA_PES_DISAG_EN;
xe_mmio_write32(stream->gt, regs->oa_ctrl, val);
}

2
drivers/gpu/drm/xe/xe_sync.c
View File

@ -55,7 +55,7 @@ static struct xe_user_fence *user_fence_create(struct xe_device *xe, u64 addr,
struct xe_user_fence *ufence;
u64 __user *ptr = u64_to_user_ptr(addr);
if (!access_ok(ptr, sizeof(ptr)))
if (!access_ok(ptr, sizeof(*ptr)))
return ERR_PTR(-EFAULT);
ufence = kmalloc(sizeof(*ufence), GFP_KERNEL);