Skip to content

Commit f7e3a1b

Browse files
torvaldstorvalds
committed
Merge tag 'drm-fixes-2023-07-21' of git://anongit.freedesktop.org/drm/drm
Pull drm fixes from Dave Airlie: "Mostly amdgpu fixes, a couple of i915 fixes, some nouveau and then a few misc accel and other fixes. client: - memory leak fix dma-buf: - memory leak fix qaic: - bound check fixes - map_user_pages leak - int overflow fixes habanalabs: - debugfs stub helper nouveau: - aux event slot fixes - anx9805 cards fixes i915: - Add sentinel to xehp_oa_b_counters - Revert "drm/i915: use localized __diag_ignore_all() instead of per file" amdgpu: - More PCIe DPM fixes for Intel platforms - DCN3.0.1 fixes - Virtual display timer fix - Async flip fix - SMU13 clock reporting fixes - Add missing PSP firmware declaration - DP MST fix - DCN3.1.x fixes - Slab out of bounds fix" * tag 'drm-fixes-2023-07-21' of git://anongit.freedesktop.org/drm/drm: (31 commits) accel/habanalabs: add more debugfs stub helpers drm/nouveau/kms/nv50-: init hpd_irq_lock for PIOR DP drm/nouveau/disp: PIOR DP uses GPIO for HPD, not PMGR AUX interrupts drm/nouveau/i2c: fix number of aux event slots drm/amdgpu: use a macro to define no xcp partition case drm/amdgpu/vm: use the same xcp_id from root PD drm/amdgpu: fix slab-out-of-bounds issue in amdgpu_vm_pt_create drm/amdgpu: Allocate root PD on correct partition drm/amd/display: Keep PHY active for DP displays on DCN31 drm/amd/display: Prevent vtotal from being set to 0 drm/amd/display: Disable MPC split by default on special asic drm/amd/display: check TG is non-null before checking if enabled drm/amd/display: Add polling method to handle MST reply packet drm/amd/display: Clean up errors & warnings in amdgpu_dm.c drm/amdgpu: Allow the initramfs generator to include psp_13_0_6_ta drm/amdgpu/pm: make mclk consistent for smu 13.0.7 drm/amdgpu/pm: make gfxclock consistent for sienna cichlid drm/amd/display: only accept async flips for fast updates drm/amdgpu/vkms: relax timer deactivation by hrtimer_try_to_cancel drm/amd/display: add DCN301 specific logic for OTG programming ...
2 parents 12a5088 + 28801cc commit f7e3a1b

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

42 files changed

+612
-242
lines changed

‎drivers/accel/habanalabs/common/habanalabs.h

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -3980,6 +3980,15 @@ static inline void hl_debugfs_fini(void)
39803980
{
39813981
}
39823982

3983+
static inline int hl_debugfs_device_init(struct hl_device *hdev)
3984+
{
3985+
return 0;
3986+
}
3987+
3988+
static inline void hl_debugfs_device_fini(struct hl_device *hdev)
3989+
{
3990+
}
3991+
39833992
static inline void hl_debugfs_add_device(struct hl_device *hdev)
39843993
{
39853994
}

‎drivers/accel/qaic/qaic_control.c

Lines changed: 25 additions & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -14,6 +14,7 @@
1414
#include <linux/mm.h>
1515
#include <linux/moduleparam.h>
1616
#include <linux/mutex.h>
17+
#include <linux/overflow.h>
1718
#include <linux/pci.h>
1819
#include <linux/scatterlist.h>
1920
#include <linux/types.h>
@@ -366,7 +367,7 @@ static int encode_passthrough(struct qaic_device *qdev, void *trans, struct wrap
366367
if (in_trans->hdr.len % 8 != 0)
367368
return -EINVAL;
368369

369-
if (msg_hdr_len + in_trans->hdr.len > QAIC_MANAGE_EXT_MSG_LENGTH)
370+
if (size_add(msg_hdr_len, in_trans->hdr.len) > QAIC_MANAGE_EXT_MSG_LENGTH)
370371
return -ENOSPC;
371372

372373
trans_wrapper = add_wrapper(wrappers,
@@ -418,9 +419,12 @@ static int find_and_map_user_pages(struct qaic_device *qdev,
418419
}
419420

420421
ret = get_user_pages_fast(xfer_start_addr, nr_pages, 0, page_list);
421-
if (ret < 0 || ret != nr_pages) {
422-
ret = -EFAULT;
422+
if (ret < 0)
423423
goto free_page_list;
424+
if (ret != nr_pages) {
425+
nr_pages = ret;
426+
ret = -EFAULT;
427+
goto put_pages;
424428
}
425429

426430
sgt = kmalloc(sizeof(*sgt), GFP_KERNEL);
@@ -557,11 +561,8 @@ static int encode_dma(struct qaic_device *qdev, void *trans, struct wrapper_list
557561
msg = &wrapper->msg;
558562
msg_hdr_len = le32_to_cpu(msg->hdr.len);
559563

560-
if (msg_hdr_len > (UINT_MAX - QAIC_MANAGE_EXT_MSG_LENGTH))
561-
return -EINVAL;
562-
563564
/* There should be enough space to hold at least one ASP entry. */
564-
if (msg_hdr_len + sizeof(*out_trans) + sizeof(struct wire_addr_size_pair) >
565+
if (size_add(msg_hdr_len, sizeof(*out_trans) + sizeof(struct wire_addr_size_pair)) >
565566
QAIC_MANAGE_EXT_MSG_LENGTH)
566567
return -ENOMEM;
567568

@@ -634,7 +635,7 @@ static int encode_activate(struct qaic_device *qdev, void *trans, struct wrapper
634635
msg = &wrapper->msg;
635636
msg_hdr_len = le32_to_cpu(msg->hdr.len);
636637

637-
if (msg_hdr_len + sizeof(*out_trans) > QAIC_MANAGE_MAX_MSG_LENGTH)
638+
if (size_add(msg_hdr_len, sizeof(*out_trans)) > QAIC_MANAGE_MAX_MSG_LENGTH)
638639
return -ENOSPC;
639640

640641
if (!in_trans->queue_size)
@@ -718,7 +719,7 @@ static int encode_status(struct qaic_device *qdev, void *trans, struct wrapper_l
718719
msg = &wrapper->msg;
719720
msg_hdr_len = le32_to_cpu(msg->hdr.len);
720721

721-
if (msg_hdr_len + in_trans->hdr.len > QAIC_MANAGE_MAX_MSG_LENGTH)
722+
if (size_add(msg_hdr_len, in_trans->hdr.len) > QAIC_MANAGE_MAX_MSG_LENGTH)
722723
return -ENOSPC;
723724

724725
trans_wrapper = add_wrapper(wrappers, sizeof(*trans_wrapper));
@@ -748,7 +749,8 @@ static int encode_message(struct qaic_device *qdev, struct manage_msg *user_msg,
748749
int ret;
749750
int i;
750751

751-
if (!user_msg->count) {
752+
if (!user_msg->count ||
753+
user_msg->len < sizeof(*trans_hdr)) {
752754
ret = -EINVAL;
753755
goto out;
754756
}
@@ -765,12 +767,13 @@ static int encode_message(struct qaic_device *qdev, struct manage_msg *user_msg,
765767
}
766768

767769
for (i = 0; i < user_msg->count; ++i) {
768-
if (user_len >= user_msg->len) {
770+
if (user_len > user_msg->len - sizeof(*trans_hdr)) {
769771
ret = -EINVAL;
770772
break;
771773
}
772774
trans_hdr = (struct qaic_manage_trans_hdr *)(user_msg->data + user_len);
773-
if (user_len + trans_hdr->len > user_msg->len) {
775+
if (trans_hdr->len < sizeof(trans_hdr) ||
776+
size_add(user_len, trans_hdr->len) > user_msg->len) {
774777
ret = -EINVAL;
775778
break;
776779
}
@@ -953,15 +956,23 @@ static int decode_message(struct qaic_device *qdev, struct manage_msg *user_msg,
953956
int ret;
954957
int i;
955958

956-
if (msg_hdr_len > QAIC_MANAGE_MAX_MSG_LENGTH)
959+
if (msg_hdr_len < sizeof(*trans_hdr) ||
960+
msg_hdr_len > QAIC_MANAGE_MAX_MSG_LENGTH)
957961
return -EINVAL;
958962

959963
user_msg->len = 0;
960964
user_msg->count = le32_to_cpu(msg->hdr.count);
961965

962966
for (i = 0; i < user_msg->count; ++i) {
967+
u32 hdr_len;
968+
969+
if (msg_len > msg_hdr_len - sizeof(*trans_hdr))
970+
return -EINVAL;
971+
963972
trans_hdr = (struct wire_trans_hdr *)(msg->data + msg_len);
964-
if (msg_len + le32_to_cpu(trans_hdr->len) > msg_hdr_len)
973+
hdr_len = le32_to_cpu(trans_hdr->len);
974+
if (hdr_len < sizeof(*trans_hdr) ||
975+
size_add(msg_len, hdr_len) > msg_hdr_len)
965976
return -EINVAL;
966977

967978
switch (le32_to_cpu(trans_hdr->type)) {

‎drivers/dma-buf/dma-resv.c

Lines changed: 9 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -571,6 +571,7 @@ int dma_resv_get_fences(struct dma_resv *obj, enum dma_resv_usage usage,
571571
dma_resv_for_each_fence_unlocked(&cursor, fence) {
572572

573573
if (dma_resv_iter_is_restarted(&cursor)) {
574+
struct dma_fence **new_fences;
574575
unsigned int count;
575576

576577
while (*num_fences)
@@ -579,13 +580,17 @@ int dma_resv_get_fences(struct dma_resv *obj, enum dma_resv_usage usage,
579580
count = cursor.num_fences + 1;
580581

581582
/* Eventually re-allocate the array */
582-
*fences = krealloc_array(*fences, count,
583-
sizeof(void *),
584-
GFP_KERNEL);
585-
if (count && !*fences) {
583+
new_fences = krealloc_array(*fences, count,
584+
sizeof(void *),
585+
GFP_KERNEL);
586+
if (count && !new_fences) {
587+
kfree(*fences);
588+
*fences = NULL;
589+
*num_fences = 0;
586590
dma_resv_iter_end(&cursor);
587591
return -ENOMEM;
588592
}
593+
*fences = new_fences;
589594
}
590595

591596
(*fences)[(*num_fences)++] = dma_fence_get(fence);

‎drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd_gpuvm.c

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1709,7 +1709,8 @@ int amdgpu_amdkfd_gpuvm_alloc_memory_of_gpu(
17091709
alloc_flags |= (flags & KFD_IOC_ALLOC_MEM_FLAGS_PUBLIC) ?
17101710
AMDGPU_GEM_CREATE_CPU_ACCESS_REQUIRED : 0;
17111711
}
1712-
xcp_id = fpriv->xcp_id == ~0 ? 0 : fpriv->xcp_id;
1712+
xcp_id = fpriv->xcp_id == AMDGPU_XCP_NO_PARTITION ?
1713+
0 : fpriv->xcp_id;
17131714
} else if (flags & KFD_IOC_ALLOC_MEM_FLAGS_GTT) {
17141715
domain = alloc_domain = AMDGPU_GEM_DOMAIN_GTT;
17151716
alloc_flags = 0;

‎drivers/gpu/drm/amd/amdgpu/amdgpu_kms.c

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1229,13 +1229,13 @@ int amdgpu_driver_open_kms(struct drm_device *dev, struct drm_file *file_priv)
12291229
pasid = 0;
12301230
}
12311231

1232-
r = amdgpu_vm_init(adev, &fpriv->vm);
1232+
r = amdgpu_xcp_open_device(adev, fpriv, file_priv);
12331233
if (r)
12341234
goto error_pasid;
12351235

1236-
r = amdgpu_xcp_open_device(adev, fpriv, file_priv);
1236+
r = amdgpu_vm_init(adev, &fpriv->vm, fpriv->xcp_id);
12371237
if (r)
1238-
goto error_vm;
1238+
goto error_pasid;
12391239

12401240
r = amdgpu_vm_set_pasid(adev, &fpriv->vm, pasid);
12411241
if (r)

‎drivers/gpu/drm/amd/amdgpu/amdgpu_mes.c

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1382,7 +1382,7 @@ int amdgpu_mes_self_test(struct amdgpu_device *adev)
13821382
goto error_pasid;
13831383
}
13841384

1385-
r = amdgpu_vm_init(adev, vm);
1385+
r = amdgpu_vm_init(adev, vm, -1);
13861386
if (r) {
13871387
DRM_ERROR("failed to initialize vm\n");
13881388
goto error_pasid;

‎drivers/gpu/drm/amd/amdgpu/amdgpu_vkms.c

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -55,8 +55,9 @@ static enum hrtimer_restart amdgpu_vkms_vblank_simulate(struct hrtimer *timer)
5555
DRM_WARN("%s: vblank timer overrun\n", __func__);
5656

5757
ret = drm_crtc_handle_vblank(crtc);
58+
/* Don't queue timer again when vblank is disabled. */
5859
if (!ret)
59-
DRM_ERROR("amdgpu_vkms failure on handling vblank");
60+
return HRTIMER_NORESTART;
6061

6162
return HRTIMER_RESTART;
6263
}
@@ -81,7 +82,7 @@ static void amdgpu_vkms_disable_vblank(struct drm_crtc *crtc)
8182
{
8283
struct amdgpu_crtc *amdgpu_crtc = to_amdgpu_crtc(crtc);
8384

84-
hrtimer_cancel(&amdgpu_crtc->vblank_timer);
85+
hrtimer_try_to_cancel(&amdgpu_crtc->vblank_timer);
8586
}
8687

8788
static bool amdgpu_vkms_get_vblank_timestamp(struct drm_crtc *crtc,

‎drivers/gpu/drm/amd/amdgpu/amdgpu_vm.c

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -2121,13 +2121,14 @@ long amdgpu_vm_wait_idle(struct amdgpu_vm *vm, long timeout)
21212121
*
21222122
* @adev: amdgpu_device pointer
21232123
* @vm: requested vm
2124+
* @xcp_id: GPU partition selection id
21242125
*
21252126
* Init @vm fields.
21262127
*
21272128
* Returns:
21282129
* 0 for success, error for failure.
21292130
*/
2130-
int amdgpu_vm_init(struct amdgpu_device *adev, struct amdgpu_vm *vm)
2131+
int amdgpu_vm_init(struct amdgpu_device *adev, struct amdgpu_vm *vm, int32_t xcp_id)
21312132
{
21322133
struct amdgpu_bo *root_bo;
21332134
struct amdgpu_bo_vm *root;
@@ -2177,7 +2178,7 @@ int amdgpu_vm_init(struct amdgpu_device *adev, struct amdgpu_vm *vm)
21772178
vm->evicting = false;
21782179

21792180
r = amdgpu_vm_pt_create(adev, vm, adev->vm_manager.root_level,
2180-
false, &root);
2181+
false, &root, xcp_id);
21812182
if (r)
21822183
goto error_free_delayed;
21832184
root_bo = &root->bo;

‎drivers/gpu/drm/amd/amdgpu/amdgpu_vm.h

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -392,7 +392,7 @@ int amdgpu_vm_set_pasid(struct amdgpu_device *adev, struct amdgpu_vm *vm,
392392
u32 pasid);
393393

394394
long amdgpu_vm_wait_idle(struct amdgpu_vm *vm, long timeout);
395-
int amdgpu_vm_init(struct amdgpu_device *adev, struct amdgpu_vm *vm);
395+
int amdgpu_vm_init(struct amdgpu_device *adev, struct amdgpu_vm *vm, int32_t xcp_id);
396396
int amdgpu_vm_make_compute(struct amdgpu_device *adev, struct amdgpu_vm *vm);
397397
void amdgpu_vm_release_compute(struct amdgpu_device *adev, struct amdgpu_vm *vm);
398398
void amdgpu_vm_fini(struct amdgpu_device *adev, struct amdgpu_vm *vm);
@@ -475,7 +475,8 @@ void amdgpu_vm_get_memory(struct amdgpu_vm *vm,
475475
int amdgpu_vm_pt_clear(struct amdgpu_device *adev, struct amdgpu_vm *vm,
476476
struct amdgpu_bo_vm *vmbo, bool immediate);
477477
int amdgpu_vm_pt_create(struct amdgpu_device *adev, struct amdgpu_vm *vm,
478-
int level, bool immediate, struct amdgpu_bo_vm **vmbo);
478+
int level, bool immediate, struct amdgpu_bo_vm **vmbo,
479+
int32_t xcp_id);
479480
void amdgpu_vm_pt_free_root(struct amdgpu_device *adev, struct amdgpu_vm *vm);
480481
bool amdgpu_vm_pt_is_root_clean(struct amdgpu_device *adev,
481482
struct amdgpu_vm *vm);

‎drivers/gpu/drm/amd/amdgpu/amdgpu_vm_pt.c

Lines changed: 7 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -498,11 +498,12 @@ int amdgpu_vm_pt_clear(struct amdgpu_device *adev, struct amdgpu_vm *vm,
498498
* @level: the page table level
499499
* @immediate: use a immediate update
500500
* @vmbo: pointer to the buffer object pointer
501+
* @xcp_id: GPU partition id
501502
*/
502503
int amdgpu_vm_pt_create(struct amdgpu_device *adev, struct amdgpu_vm *vm,
503-
int level, bool immediate, struct amdgpu_bo_vm **vmbo)
504+
int level, bool immediate, struct amdgpu_bo_vm **vmbo,
505+
int32_t xcp_id)
504506
{
505-
struct amdgpu_fpriv *fpriv = container_of(vm, struct amdgpu_fpriv, vm);
506507
struct amdgpu_bo_param bp;
507508
struct amdgpu_bo *bo;
508509
struct dma_resv *resv;
@@ -535,7 +536,7 @@ int amdgpu_vm_pt_create(struct amdgpu_device *adev, struct amdgpu_vm *vm,
535536

536537
bp.type = ttm_bo_type_kernel;
537538
bp.no_wait_gpu = immediate;
538-
bp.xcp_id_plus1 = fpriv->xcp_id == ~0 ? 0 : fpriv->xcp_id + 1;
539+
bp.xcp_id_plus1 = xcp_id + 1;
539540

540541
if (vm->root.bo)
541542
bp.resv = vm->root.bo->tbo.base.resv;
@@ -561,7 +562,7 @@ int amdgpu_vm_pt_create(struct amdgpu_device *adev, struct amdgpu_vm *vm,
561562
bp.type = ttm_bo_type_kernel;
562563
bp.resv = bo->tbo.base.resv;
563564
bp.bo_ptr_size = sizeof(struct amdgpu_bo);
564-
bp.xcp_id_plus1 = fpriv->xcp_id == ~0 ? 0 : fpriv->xcp_id + 1;
565+
bp.xcp_id_plus1 = xcp_id + 1;
565566

566567
r = amdgpu_bo_create(adev, &bp, &(*vmbo)->shadow);
567568

@@ -606,7 +607,8 @@ static int amdgpu_vm_pt_alloc(struct amdgpu_device *adev,
606607
return 0;
607608

608609
amdgpu_vm_eviction_unlock(vm);
609-
r = amdgpu_vm_pt_create(adev, vm, cursor->level, immediate, &pt);
610+
r = amdgpu_vm_pt_create(adev, vm, cursor->level, immediate, &pt,
611+
vm->root.bo->xcp_id);
610612
amdgpu_vm_eviction_lock(vm);
611613
if (r)
612614
return r;

0 commit comments

Comments
 (0)