Skip to content

Commit 5b272bf

Browse files
airliedairlied
committed
Merge tag 'drm-xe-fixes-2024-10-03' of https://gitlab.freedesktop.org/drm/xe/kernel into drm-fixes
Driver Changes: - Restore pci state on resume (Rodrigo Vivi) - Fix locking on submission, queue and vm (Matthew Auld, Matthew Brost) - Fix UAF on queue destruction (Matthew Auld) - Fix resource release on freq init error path (He Lugang) - Use rw_semaphore to reduce contention on ASID->VM lookup (Matthew Brost) - Fix steering for media on Xe2_HPM (Gustavo Sousa) - Tuning updates to Xe2 (Gustavo Sousa) - Resume TDR after GT reset to prevent jobs running forever (Matthew Brost) - Move id allocation to avoid userspace using a guessed number to trigger UAF (Matthew Auld, Matthew Brost) - Fix OA stream close preventing pbatch buffers to complete (José) - Fix NPD when migrating memory on LNL (Zhanjun Dong) - Fix memory leak when aborting binds (Matthew Brost) Signed-off-by: Dave Airlie <[email protected]> From: Lucas De Marchi <[email protected]> Link: https://patchwork.freedesktop.org/patch/msgid/2fiv63yanlal5mpw3mxtotte6yvkvtex74c7mkjxca4bazlyja@o4iejcfragxy
2 parents 240ebf1 + a6f3b25 commit 5b272bf

19 files changed

+159
-64
lines changed

‎drivers/gpu/drm/xe/regs/xe_gt_regs.h

Lines changed: 11 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -169,6 +169,8 @@
169169
#define XEHP_SLICE_COMMON_ECO_CHICKEN1 XE_REG_MCR(0x731c, XE_REG_OPTION_MASKED)
170170
#define MSC_MSAA_REODER_BUF_BYPASS_DISABLE REG_BIT(14)
171171

172+
#define XE2LPM_CCCHKNREG1 XE_REG(0x82a8)
173+
172174
#define VF_PREEMPTION XE_REG(0x83a4, XE_REG_OPTION_MASKED)
173175
#define PREEMPTION_VERTEX_COUNT REG_GENMASK(15, 0)
174176

@@ -378,6 +380,9 @@
378380
#define L3SQCREG3 XE_REG_MCR(0xb108)
379381
#define COMPPWOVERFETCHEN REG_BIT(28)
380382

383+
#define SCRATCH3_LBCF XE_REG_MCR(0xb154)
384+
#define RWFLUSHALLEN REG_BIT(17)
385+
381386
#define XEHP_L3SQCREG5 XE_REG_MCR(0xb158)
382387
#define L3_PWM_TIMER_INIT_VAL_MASK REG_GENMASK(9, 0)
383388

@@ -391,6 +396,12 @@
391396
#define SCRATCH1LPFC XE_REG(0xb474)
392397
#define EN_L3_RW_CCS_CACHE_FLUSH REG_BIT(0)
393398

399+
#define XE2LPM_L3SQCREG2 XE_REG_MCR(0xb604)
400+
401+
#define XE2LPM_L3SQCREG3 XE_REG_MCR(0xb608)
402+
403+
#define XE2LPM_SCRATCH3_LBCF XE_REG_MCR(0xb654)
404+
394405
#define XE2LPM_L3SQCREG5 XE_REG_MCR(0xb658)
395406

396407
#define XE2_TDF_CTRL XE_REG(0xb418)

‎drivers/gpu/drm/xe/xe_bo.c

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -680,8 +680,8 @@ static int xe_bo_move(struct ttm_buffer_object *ttm_bo, bool evict,
680680
tt_has_data = ttm && (ttm_tt_is_populated(ttm) ||
681681
(ttm->page_flags & TTM_TT_FLAG_SWAPPED));
682682

683-
move_lacks_source = handle_system_ccs ? (!bo->ccs_cleared) :
684-
(!mem_type_is_vram(old_mem_type) && !tt_has_data);
683+
move_lacks_source = !old_mem || (handle_system_ccs ? (!bo->ccs_cleared) :
684+
(!mem_type_is_vram(old_mem_type) && !tt_has_data));
685685

686686
needs_clear = (ttm && ttm->page_flags & TTM_TT_FLAG_ZERO_ALLOC) ||
687687
(!ttm && ttm_bo->type == ttm_bo_type_device);

‎drivers/gpu/drm/xe/xe_device.c

Lines changed: 6 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -171,10 +171,8 @@ static void xe_file_close(struct drm_device *dev, struct drm_file *file)
171171
xe_exec_queue_kill(q);
172172
xe_exec_queue_put(q);
173173
}
174-
mutex_lock(&xef->vm.lock);
175174
xa_for_each(&xef->vm.xa, idx, vm)
176175
xe_vm_close_and_put(vm);
177-
mutex_unlock(&xef->vm.lock);
178176

179177
xe_file_put(xef);
180178

@@ -298,6 +296,9 @@ static void xe_device_destroy(struct drm_device *dev, void *dummy)
298296
if (xe->unordered_wq)
299297
destroy_workqueue(xe->unordered_wq);
300298

299+
if (xe->destroy_wq)
300+
destroy_workqueue(xe->destroy_wq);
301+
301302
ttm_device_fini(&xe->ttm);
302303
}
303304

@@ -336,9 +337,7 @@ struct xe_device *xe_device_create(struct pci_dev *pdev,
336337

337338
init_waitqueue_head(&xe->ufence_wq);
338339

339-
err = drmm_mutex_init(&xe->drm, &xe->usm.lock);
340-
if (err)
341-
goto err;
340+
init_rwsem(&xe->usm.lock);
342341

343342
xa_init_flags(&xe->usm.asid_to_vm, XA_FLAGS_ALLOC);
344343

@@ -363,8 +362,9 @@ struct xe_device *xe_device_create(struct pci_dev *pdev,
363362
xe->preempt_fence_wq = alloc_ordered_workqueue("xe-preempt-fence-wq", 0);
364363
xe->ordered_wq = alloc_ordered_workqueue("xe-ordered-wq", 0);
365364
xe->unordered_wq = alloc_workqueue("xe-unordered-wq", 0, 0);
365+
xe->destroy_wq = alloc_workqueue("xe-destroy-wq", 0, 0);
366366
if (!xe->ordered_wq || !xe->unordered_wq ||
367-
!xe->preempt_fence_wq) {
367+
!xe->preempt_fence_wq || !xe->destroy_wq) {
368368
/*
369369
* Cleanup done in xe_device_destroy via
370370
* drmm_add_action_or_reset register above

‎drivers/gpu/drm/xe/xe_device_types.h

Lines changed: 15 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -369,7 +369,7 @@ struct xe_device {
369369
/** @usm.next_asid: next ASID, used to cyclical alloc asids */
370370
u32 next_asid;
371371
/** @usm.lock: protects UM state */
372-
struct mutex lock;
372+
struct rw_semaphore lock;
373373
} usm;
374374

375375
/** @pinned: pinned BO state */
@@ -396,6 +396,9 @@ struct xe_device {
396396
/** @unordered_wq: used to serialize unordered work, mostly display */
397397
struct workqueue_struct *unordered_wq;
398398

399+
/** @destroy_wq: used to serialize user destroy work, like queue */
400+
struct workqueue_struct *destroy_wq;
401+
399402
/** @tiles: device tiles */
400403
struct xe_tile tiles[XE_MAX_TILES_PER_DEVICE];
401404

@@ -567,15 +570,23 @@ struct xe_file {
567570
struct {
568571
/** @vm.xe: xarray to store VMs */
569572
struct xarray xa;
570-
/** @vm.lock: protects file VM state */
573+
/**
574+
* @vm.lock: Protects VM lookup + reference and removal a from
575+
* file xarray. Not an intended to be an outer lock which does
576+
* thing while being held.
577+
*/
571578
struct mutex lock;
572579
} vm;
573580

574581
/** @exec_queue: Submission exec queue state for file */
575582
struct {
576-
/** @exec_queue.xe: xarray to store engines */
583+
/** @exec_queue.xa: xarray to store exece queues */
577584
struct xarray xa;
578-
/** @exec_queue.lock: protects file engine state */
585+
/**
586+
* @exec_queue.lock: Protects exec queue lookup + reference and
587+
* removal a frommfile xarray. Not an intended to be an outer
588+
* lock which does thing while being held.
589+
*/
579590
struct mutex lock;
580591
} exec_queue;
581592

‎drivers/gpu/drm/xe/xe_drm_client.c

Lines changed: 8 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -283,8 +283,15 @@ static void show_run_ticks(struct drm_printer *p, struct drm_file *file)
283283

284284
/* Accumulate all the exec queues from this client */
285285
mutex_lock(&xef->exec_queue.lock);
286-
xa_for_each(&xef->exec_queue.xa, i, q)
286+
xa_for_each(&xef->exec_queue.xa, i, q) {
287+
xe_exec_queue_get(q);
288+
mutex_unlock(&xef->exec_queue.lock);
289+
287290
xe_exec_queue_update_run_ticks(q);
291+
292+
mutex_lock(&xef->exec_queue.lock);
293+
xe_exec_queue_put(q);
294+
}
288295
mutex_unlock(&xef->exec_queue.lock);
289296

290297
/* Get the total GPU cycles */

‎drivers/gpu/drm/xe/xe_exec_queue.c

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -635,14 +635,14 @@ int xe_exec_queue_create_ioctl(struct drm_device *dev, void *data,
635635
}
636636
}
637637

638-
mutex_lock(&xef->exec_queue.lock);
638+
q->xef = xe_file_get(xef);
639+
640+
/* user id alloc must always be last in ioctl to prevent UAF */
639641
err = xa_alloc(&xef->exec_queue.xa, &id, q, xa_limit_32b, GFP_KERNEL);
640-
mutex_unlock(&xef->exec_queue.lock);
641642
if (err)
642643
goto kill_exec_queue;
643644

644645
args->exec_queue_id = id;
645-
q->xef = xe_file_get(xef);
646646

647647
return 0;
648648

‎drivers/gpu/drm/xe/xe_gpu_scheduler.c

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -90,6 +90,11 @@ void xe_sched_submission_stop(struct xe_gpu_scheduler *sched)
9090
cancel_work_sync(&sched->work_process_msg);
9191
}
9292

93+
void xe_sched_submission_resume_tdr(struct xe_gpu_scheduler *sched)
94+
{
95+
drm_sched_resume_timeout(&sched->base, sched->base.timeout);
96+
}
97+
9398
void xe_sched_add_msg(struct xe_gpu_scheduler *sched,
9499
struct xe_sched_msg *msg)
95100
{

‎drivers/gpu/drm/xe/xe_gpu_scheduler.h

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -22,6 +22,8 @@ void xe_sched_fini(struct xe_gpu_scheduler *sched);
2222
void xe_sched_submission_start(struct xe_gpu_scheduler *sched);
2323
void xe_sched_submission_stop(struct xe_gpu_scheduler *sched);
2424

25+
void xe_sched_submission_resume_tdr(struct xe_gpu_scheduler *sched);
26+
2527
void xe_sched_add_msg(struct xe_gpu_scheduler *sched,
2628
struct xe_sched_msg *msg);
2729
void xe_sched_add_msg_locked(struct xe_gpu_scheduler *sched,

‎drivers/gpu/drm/xe/xe_gt_freq.c

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -237,11 +237,11 @@ int xe_gt_freq_init(struct xe_gt *gt)
237237
if (!gt->freq)
238238
return -ENOMEM;
239239

240-
err = devm_add_action(xe->drm.dev, freq_fini, gt->freq);
240+
err = sysfs_create_files(gt->freq, freq_attrs);
241241
if (err)
242242
return err;
243243

244-
err = sysfs_create_files(gt->freq, freq_attrs);
244+
err = devm_add_action_or_reset(xe->drm.dev, freq_fini, gt->freq);
245245
if (err)
246246
return err;
247247

‎drivers/gpu/drm/xe/xe_gt_mcr.c

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -439,7 +439,7 @@ void xe_gt_mcr_init(struct xe_gt *gt)
439439
if (gt->info.type == XE_GT_TYPE_MEDIA) {
440440
drm_WARN_ON(&xe->drm, MEDIA_VER(xe) < 13);
441441

442-
if (MEDIA_VER(xe) >= 20) {
442+
if (MEDIA_VERx100(xe) >= 1301) {
443443
gt->steering[OADDRM].ranges = xe2lpm_gpmxmt_steering_table;
444444
gt->steering[INSTANCE0].ranges = xe2lpm_instance0_steering_table;
445445
} else {

0 commit comments

Comments
 (0)