dummy/linux-stable-mirror
1
0
Fork 1
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ synced 2025-04-19 20:58:31 +09:00
Code Issues Packages Projects Releases Wiki Activity

Driver Changes:

Browse Source 
- Add another BMG PCI ID
 - Fix UAFs on migration paths
 - Fix shift-out-of-bounds access on TLB invalidation
 - Ensure ccs_mode is correctly set on gt reset
 - Extend some HW workarounds to Xe3
 - Fix PM runtime get/put on sysfs files
 - Fix u64 division on 32b
 - Fix flickering due to missing L3 invalidations
 - Fix missing error code return
 -----BEGIN PGP SIGNATURE-----
 
 iQJNBAABCAA3FiEE6rM8lpABPHM5FqyDm6KlpjDL6lMFAmf4MkEZHGx1Y2FzLmRl
 bWFyY2hpQGludGVsLmNvbQAKCRCboqWmMMvqU9/MD/0f3AuktvqG/YfNFdSAIJnY
 +antVUX0CH2qU6acwVuX6RD+HzyD6fkaMEjL0yg//v4hLkoLrrTGwdWM4HWx7bQW
 2Eks1F3yTp6RJBBoQlz1M4VMl1oh7wTEbL8OC38zUc37eAyeoJCaItx3Y0ujG2cW
 cZoJ2TJ+tjtOafiOP5UHCu4zDYYYrBUYdv9HwE6Ydn5qr6UH/Qb+C4B9Ak/rIUkG
 7D7ItUM0N6Hg8/+VkYa4V/cLfgJTXZX/IztCE3VkcP4xPIdo+sEJZq1aVyEsF+ef
 0ME1dQ1OGWEhBtKmwNHuTpusTuNJwQHxOr2LQVYOvU1l0NeTmspVylBOQrc2DdVA
 bzP14xFs38CsKkWm1h2hz3rmTbNQN8Lu9j9Vjt4SmxicyAMOOMqUIiE6pFlHXYU6
 wnLtos46LHPFdRcvzfXgLDpheQ5RCTCbmr0zRFIKQ367T81DoOVeM6kx9+DKAsRQ
 fgai5TC8ck5U4Wp0l9kzD0RjfhTKOfhzvN5nscfOa+Ipx6/P9J47V1xiBhEWjvLO
 YgrNzJcTvqLuVnw0nOcqgHEaO6fvA5rm0vkF3qQSPQj4/9B8E+HD5iOrXt9/Ds4G
 tktDLHikOXgSP7TJv6EM5dQ3A/QIQFVAJHPpRAIVRhPAY/rmoy+yjkDpNvVvMZId
 xzg8xxL6LNjx4n4ie24IkQ==
 =Un32
 -----END PGP SIGNATURE-----

Merge tag 'drm-xe-fixes-2025-04-10' of https://gitlab.freedesktop.org/drm/xe/kernel into drm-fixes

Driver Changes:
- Add another BMG PCI ID
- Fix UAFs on migration paths
- Fix shift-out-of-bounds access on TLB invalidation
- Ensure ccs_mode is correctly set on gt reset
- Extend some HW workarounds to Xe3
- Fix PM runtime get/put on sysfs files
- Fix u64 division on 32b
- Fix flickering due to missing L3 invalidations
- Fix missing error code return

Signed-off-by: Dave Airlie <airlied@redhat.com>

From: Lucas De Marchi <lucas.demarchi@intel.com>
Link: https://lore.kernel.org/r/unq5j26aejbrjz5nuvmdtcgupyix5bacpoahod4bdohlvwrney@kekimsi5ossx
This commit is contained in:
Dave Airlie 2025-04-11 09:11:04 +10:00
commit 485442c6a5
10 changed files with 90 additions and 73 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

1
drivers/gpu/drm/xe/instructions/xe_gpu_commands.h
View File

@ -41,6 +41,7 @@
#define GFX_OP_PIPE_CONTROL(len) ((0x3<<29)|(0x3<<27)|(0x2<<24)|((len)-2))
#define PIPE_CONTROL0_L3_READ_ONLY_CACHE_INVALIDATE BIT(10) /* gen12 */
#define PIPE_CONTROL0_HDC_PIPELINE_FLUSH BIT(9) /* gen12 */
#define PIPE_CONTROL_COMMAND_CACHE_INVALIDATE (1<<29)

12
drivers/gpu/drm/xe/xe_gt_tlb_invalidation.c
View File

@ -322,6 +322,13 @@ int xe_gt_tlb_invalidation_ggtt(struct xe_gt *gt)
return 0;
}
/*
* Ensure that roundup_pow_of_two(length) doesn't overflow.
* Note that roundup_pow_of_two() operates on unsigned long,
* not on u64.
*/
#define MAX_RANGE_TLB_INVALIDATION_LENGTH (rounddown_pow_of_two(ULONG_MAX))
/**
* xe_gt_tlb_invalidation_range - Issue a TLB invalidation on this GT for an
* address range
@ -346,6 +353,7 @@ int xe_gt_tlb_invalidation_range(struct xe_gt *gt,
struct xe_device *xe = gt_to_xe(gt);
#define MAX_TLB_INVALIDATION_LEN 7
u32 action[MAX_TLB_INVALIDATION_LEN];
u64 length = end - start;
int len = 0;
xe_gt_assert(gt, fence);
@ -358,11 +366,11 @@ int xe_gt_tlb_invalidation_range(struct xe_gt *gt,
action[len++] = XE_GUC_ACTION_TLB_INVALIDATION;
action[len++] = 0; /* seqno, replaced in send_tlb_invalidation */
if (!xe->info.has_range_tlb_invalidation) {
if (!xe->info.has_range_tlb_invalidation ||
length > MAX_RANGE_TLB_INVALIDATION_LENGTH) {
action[len++] = MAKE_INVAL_OP(XE_GUC_TLB_INVAL_FULL);
} else {
u64 orig_start = start;
u64 length = end - start;
u64 align;
if (length < SZ_4K)

1
drivers/gpu/drm/xe/xe_guc_pc.c
View File

@ -1070,6 +1070,7 @@ int xe_guc_pc_start(struct xe_guc_pc *pc)
if (wait_for_pc_state(pc, SLPC_GLOBAL_STATE_RUNNING,
SLPC_RESET_EXTENDED_TIMEOUT_MS)) {
xe_gt_err(gt, "GuC PC Start failed: Dynamic GT frequency control and GT sleep states are now disabled.\n");
ret = -EIO;
goto out;
}

12
drivers/gpu/drm/xe/xe_hw_engine.c
View File

@ -389,12 +389,6 @@ xe_hw_engine_setup_default_lrc_state(struct xe_hw_engine *hwe)
blit_cctl_val,
XE_RTP_ACTION_FLAG(ENGINE_BASE)))
},
/* Use Fixed slice CCS mode */
{ XE_RTP_NAME("RCU_MODE_FIXED_SLICE_CCS_MODE"),
XE_RTP_RULES(FUNC(xe_hw_engine_match_fixed_cslice_mode)),
XE_RTP_ACTIONS(FIELD_SET(RCU_MODE, RCU_MODE_FIXED_SLICE_CCS_MODE,
RCU_MODE_FIXED_SLICE_CCS_MODE))
},
/* Disable WMTP if HW doesn't support it */
{ XE_RTP_NAME("DISABLE_WMTP_ON_UNSUPPORTED_HW"),
XE_RTP_RULES(FUNC(xe_rtp_cfeg_wmtp_disabled)),
@ -461,6 +455,12 @@ hw_engine_setup_default_state(struct xe_hw_engine *hwe)
XE_RTP_ACTIONS(SET(CSFE_CHICKEN1(0), CS_PRIORITY_MEM_READ,
XE_RTP_ACTION_FLAG(ENGINE_BASE)))
},
/* Use Fixed slice CCS mode */
{ XE_RTP_NAME("RCU_MODE_FIXED_SLICE_CCS_MODE"),
XE_RTP_RULES(FUNC(xe_hw_engine_match_fixed_cslice_mode)),
XE_RTP_ACTIONS(FIELD_SET(RCU_MODE, RCU_MODE_FIXED_SLICE_CCS_MODE,
RCU_MODE_FIXED_SLICE_CCS_MODE))
},
};
xe_rtp_process_to_sr(&ctx, engine_entries, ARRAY_SIZE(engine_entries), &hwe->reg_sr);

108
drivers/gpu/drm/xe/xe_hw_engine_class_sysfs.c
View File

@ -32,14 +32,61 @@ bool xe_hw_engine_timeout_in_range(u64 timeout, u64 min, u64 max)
return timeout >= min && timeout <= max;
}
static void kobj_xe_hw_engine_release(struct kobject *kobj)
static void xe_hw_engine_sysfs_kobj_release(struct kobject *kobj)
{
kfree(kobj);
}
static ssize_t xe_hw_engine_class_sysfs_attr_show(struct kobject *kobj,
struct attribute *attr,
char *buf)
{
struct xe_device *xe = kobj_to_xe(kobj);
struct kobj_attribute *kattr;
ssize_t ret = -EIO;
kattr = container_of(attr, struct kobj_attribute, attr);
if (kattr->show) {
xe_pm_runtime_get(xe);
ret = kattr->show(kobj, kattr, buf);
xe_pm_runtime_put(xe);
}
return ret;
}
static ssize_t xe_hw_engine_class_sysfs_attr_store(struct kobject *kobj,
struct attribute *attr,
const char *buf,
size_t count)
{
struct xe_device *xe = kobj_to_xe(kobj);
struct kobj_attribute *kattr;
ssize_t ret = -EIO;
kattr = container_of(attr, struct kobj_attribute, attr);
if (kattr->store) {
xe_pm_runtime_get(xe);
ret = kattr->store(kobj, kattr, buf, count);
xe_pm_runtime_put(xe);
}
return ret;
}
static const struct sysfs_ops xe_hw_engine_class_sysfs_ops = {
.show = xe_hw_engine_class_sysfs_attr_show,
.store = xe_hw_engine_class_sysfs_attr_store,
};
static const struct kobj_type kobj_xe_hw_engine_type = {
.release = kobj_xe_hw_engine_release,
.sysfs_ops = &kobj_sysfs_ops
.release = xe_hw_engine_sysfs_kobj_release,
.sysfs_ops = &xe_hw_engine_class_sysfs_ops,
};
static const struct kobj_type kobj_xe_hw_engine_type_def = {
.release = xe_hw_engine_sysfs_kobj_release,
.sysfs_ops = &kobj_sysfs_ops,
};
static ssize_t job_timeout_max_store(struct kobject *kobj,
@ -543,7 +590,7 @@ static int xe_add_hw_engine_class_defaults(struct xe_device *xe,
if (!kobj)
return -ENOMEM;
kobject_init(kobj, &kobj_xe_hw_engine_type);
kobject_init(kobj, &kobj_xe_hw_engine_type_def);
err = kobject_add(kobj, parent, "%s", ".defaults");
if (err)
goto err_object;
@ -559,57 +606,6 @@ err_object:
return err;
}
static void xe_hw_engine_sysfs_kobj_release(struct kobject *kobj)
{
kfree(kobj);
}
static ssize_t xe_hw_engine_class_sysfs_attr_show(struct kobject *kobj,
struct attribute *attr,
char *buf)
{
struct xe_device *xe = kobj_to_xe(kobj);
struct kobj_attribute *kattr;
ssize_t ret = -EIO;
kattr = container_of(attr, struct kobj_attribute, attr);
if (kattr->show) {
xe_pm_runtime_get(xe);
ret = kattr->show(kobj, kattr, buf);
xe_pm_runtime_put(xe);
}
return ret;
}
static ssize_t xe_hw_engine_class_sysfs_attr_store(struct kobject *kobj,
struct attribute *attr,
const char *buf,
size_t count)
{
struct xe_device *xe = kobj_to_xe(kobj);
struct kobj_attribute *kattr;
ssize_t ret = -EIO;
kattr = container_of(attr, struct kobj_attribute, attr);
if (kattr->store) {
xe_pm_runtime_get(xe);
ret = kattr->store(kobj, kattr, buf, count);
xe_pm_runtime_put(xe);
}
return ret;
}
static const struct sysfs_ops xe_hw_engine_class_sysfs_ops = {
.show = xe_hw_engine_class_sysfs_attr_show,
.store = xe_hw_engine_class_sysfs_attr_store,
};
static const struct kobj_type xe_hw_engine_sysfs_kobj_type = {
.release = xe_hw_engine_sysfs_kobj_release,
.sysfs_ops = &xe_hw_engine_class_sysfs_ops,
};
static void hw_engine_class_sysfs_fini(void *arg)
{
@ -640,7 +636,7 @@ int xe_hw_engine_class_sysfs_init(struct xe_gt *gt)
if (!kobj)
return -ENOMEM;
kobject_init(kobj, &xe_hw_engine_sysfs_kobj_type);
kobject_init(kobj, &kobj_xe_hw_engine_type);
err = kobject_add(kobj, gt->sysfs, "engines");
if (err)

6
drivers/gpu/drm/xe/xe_migrate.c
View File

@ -1177,7 +1177,7 @@ err:
err_sync:
/* Sync partial copies if any. FIXME: job_mutex? */
if (fence) {
dma_fence_wait(m->fence, false);
dma_fence_wait(fence, false);
dma_fence_put(fence);
}
@ -1547,7 +1547,7 @@ void xe_migrate_wait(struct xe_migrate *m)
static u32 pte_update_cmd_size(u64 size)
{
u32 num_dword;
u64 entries = DIV_ROUND_UP(size, XE_PAGE_SIZE);
u64 entries = DIV_U64_ROUND_UP(size, XE_PAGE_SIZE);
XE_WARN_ON(size > MAX_PREEMPTDISABLE_TRANSFER);
/*
@ -1558,7 +1558,7 @@ static u32 pte_update_cmd_size(u64 size)
* 2 dword for the page table's physical location
* 2*n dword for value of pte to fill (each pte entry is 2 dwords)
*/
num_dword = (1 + 2) * DIV_ROUND_UP(entries, 0x1ff);
num_dword = (1 + 2) * DIV_U64_ROUND_UP(entries, 0x1ff);
num_dword += entries * 2;
return num_dword;

13
drivers/gpu/drm/xe/xe_ring_ops.c
View File

@ -137,7 +137,8 @@ emit_pipe_control(u32 *dw, int i, u32 bit_group_0, u32 bit_group_1, u32 offset,
static int emit_pipe_invalidate(u32 mask_flags, bool invalidate_tlb, u32 *dw,
int i)
{
u32 flags = PIPE_CONTROL_CS_STALL |
u32 flags0 = 0;
u32 flags1 = PIPE_CONTROL_CS_STALL |
PIPE_CONTROL_COMMAND_CACHE_INVALIDATE |
PIPE_CONTROL_INSTRUCTION_CACHE_INVALIDATE |
PIPE_CONTROL_TEXTURE_CACHE_INVALIDATE |
@ -148,11 +149,15 @@ static int emit_pipe_invalidate(u32 mask_flags, bool invalidate_tlb, u32 *dw,
PIPE_CONTROL_STORE_DATA_INDEX;
if (invalidate_tlb)
flags |= PIPE_CONTROL_TLB_INVALIDATE;
flags1 |= PIPE_CONTROL_TLB_INVALIDATE;
flags &= ~mask_flags;
flags1 &= ~mask_flags;
return emit_pipe_control(dw, i, 0, flags, LRC_PPHWSP_FLUSH_INVAL_SCRATCH_ADDR, 0);
if (flags1 & PIPE_CONTROL_VF_CACHE_INVALIDATE)
flags0 |= PIPE_CONTROL0_L3_READ_ONLY_CACHE_INVALIDATE;
return emit_pipe_control(dw, i, flags0, flags1,
LRC_PPHWSP_FLUSH_INVAL_SCRATCH_ADDR, 0);
}
static int emit_store_imm_ppgtt_posted(u64 addr, u64 value,

7
drivers/gpu/drm/xe/xe_svm.c
View File

@ -696,11 +696,14 @@ retry:
list_for_each_entry(block, blocks, link)
block->private = vr;
xe_bo_get(bo);
err = drm_gpusvm_migrate_to_devmem(&vm->svm.gpusvm, &range->base,
&bo->devmem_allocation, ctx);
xe_bo_unlock(bo);
if (err)
xe_bo_put(bo); /* Creation ref */
xe_svm_devmem_release(&bo->devmem_allocation);
xe_bo_unlock(bo);
xe_bo_put(bo);
unlock:
mmap_read_unlock(mm);

2
drivers/gpu/drm/xe/xe_wa_oob.rules
View File

@ -32,8 +32,10 @@
GRAPHICS_VERSION(3001)
14022293748 GRAPHICS_VERSION(2001)
GRAPHICS_VERSION(2004)
GRAPHICS_VERSION_RANGE(3000, 3001)
22019794406 GRAPHICS_VERSION(2001)
GRAPHICS_VERSION(2004)
GRAPHICS_VERSION_RANGE(3000, 3001)
22019338487 MEDIA_VERSION(2000)
GRAPHICS_VERSION(2001)
MEDIA_VERSION(3000), MEDIA_STEP(A0, B0), FUNC(xe_rtp_match_not_sriov_vf)

1
include/drm/intel/pciids.h
View File

@ -850,6 +850,7 @@
MACRO__(0xE20C, ## __VA_ARGS__), \
MACRO__(0xE20D, ## __VA_ARGS__), \
MACRO__(0xE210, ## __VA_ARGS__), \
MACRO__(0xE211, ## __VA_ARGS__), \
MACRO__(0xE212, ## __VA_ARGS__), \
MACRO__(0xE215, ## __VA_ARGS__), \
MACRO__(0xE216, ## __VA_ARGS__)