Skip to content

Commit 6c2bf9c

Browse files
airliedairlied
committed
Merge tag 'drm-misc-fixes-2024-02-08' of git://anongit.freedesktop.org/drm/drm-misc into drm-fixes
A null pointer dereference fix for v3d, a TTM pool initialization fix, several fixes for nouveau around register size, DMA buffer leaks and API consistency, a multiple fixes for ivpu around MMU setup, initialization and firmware interactions. Signed-off-by: Dave Airlie <airlied@redhat.com> From: Maxime Ripard <mripard@redhat.com> Link: https://patchwork.freedesktop.org/patch/msgid/4wsi2i6kgkqdu7nzp4g7hxasbswnrmc5cakgf5zzvnix53u7lr@4rmp7hwblow3
2 parents d0399da + 5f8408a commit 6c2bf9c

9 files changed

Lines changed: 77 additions & 58 deletions

File tree

‎drivers/accel/ivpu/ivpu_drv.c‎

Lines changed: 2 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -480,9 +480,8 @@ static int ivpu_pci_init(struct ivpu_device *vdev)
480480
/* Clear any pending errors */
481481
pcie_capability_clear_word(pdev, PCI_EXP_DEVSTA, 0x3f);
482482

483-
/* VPU 37XX does not require 10m D3hot delay */
484-
if (ivpu_hw_gen(vdev) == IVPU_HW_37XX)
485-
pdev->d3hot_delay = 0;
483+
/* NPU does not require 10m D3hot delay */
484+
pdev->d3hot_delay = 0;
486485

487486
ret = pcim_enable_device(pdev);
488487
if (ret) {

‎drivers/accel/ivpu/ivpu_fw.c‎

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -222,7 +222,6 @@ ivpu_fw_init_wa(struct ivpu_device *vdev)
222222
const struct vpu_firmware_header *fw_hdr = (const void *)vdev->fw->file->data;
223223

224224
if (IVPU_FW_CHECK_API_VER_LT(vdev, fw_hdr, BOOT, 3, 17) ||
225-
(ivpu_hw_gen(vdev) > IVPU_HW_37XX) ||
226225
(ivpu_test_mode & IVPU_TEST_MODE_D0I3_MSG_DISABLE))
227226
vdev->wa.disable_d0i3_msg = true;
228227

‎drivers/accel/ivpu/ivpu_hw_37xx.c‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -525,7 +525,7 @@ static void ivpu_boot_no_snoop_enable(struct ivpu_device *vdev)
525525
u32 val = REGV_RD32(VPU_37XX_HOST_IF_TCU_PTW_OVERRIDES);
526526

527527
val = REG_SET_FLD(VPU_37XX_HOST_IF_TCU_PTW_OVERRIDES, NOSNOOP_OVERRIDE_EN, val);
528-
val = REG_SET_FLD(VPU_37XX_HOST_IF_TCU_PTW_OVERRIDES, AW_NOSNOOP_OVERRIDE, val);
528+
val = REG_CLR_FLD(VPU_37XX_HOST_IF_TCU_PTW_OVERRIDES, AW_NOSNOOP_OVERRIDE, val);
529529
val = REG_SET_FLD(VPU_37XX_HOST_IF_TCU_PTW_OVERRIDES, AR_NOSNOOP_OVERRIDE, val);
530530

531531
REGV_WR32(VPU_37XX_HOST_IF_TCU_PTW_OVERRIDES, val);

‎drivers/accel/ivpu/ivpu_hw_40xx.c‎

Lines changed: 1 addition & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -530,7 +530,7 @@ static void ivpu_boot_no_snoop_enable(struct ivpu_device *vdev)
530530
u32 val = REGV_RD32(VPU_40XX_HOST_IF_TCU_PTW_OVERRIDES);
531531

532532
val = REG_SET_FLD(VPU_40XX_HOST_IF_TCU_PTW_OVERRIDES, SNOOP_OVERRIDE_EN, val);
533-
val = REG_CLR_FLD(VPU_40XX_HOST_IF_TCU_PTW_OVERRIDES, AW_SNOOP_OVERRIDE, val);
533+
val = REG_SET_FLD(VPU_40XX_HOST_IF_TCU_PTW_OVERRIDES, AW_SNOOP_OVERRIDE, val);
534534
val = REG_CLR_FLD(VPU_40XX_HOST_IF_TCU_PTW_OVERRIDES, AR_SNOOP_OVERRIDE, val);
535535

536536
REGV_WR32(VPU_40XX_HOST_IF_TCU_PTW_OVERRIDES, val);
@@ -704,7 +704,6 @@ static int ivpu_hw_40xx_info_init(struct ivpu_device *vdev)
704704
{
705705
struct ivpu_hw_info *hw = vdev->hw;
706706
u32 tile_disable;
707-
u32 tile_enable;
708707
u32 fuse;
709708

710709
fuse = REGB_RD32(VPU_40XX_BUTTRESS_TILE_FUSE);
@@ -725,10 +724,6 @@ static int ivpu_hw_40xx_info_init(struct ivpu_device *vdev)
725724
else
726725
ivpu_dbg(vdev, MISC, "Fuse: All %d tiles enabled\n", TILE_MAX_NUM);
727726

728-
tile_enable = (~tile_disable) & TILE_MAX_MASK;
729-
730-
hw->sku = REG_SET_FLD_NUM(SKU, HW_ID, LNL_HW_ID, hw->sku);
731-
hw->sku = REG_SET_FLD_NUM(SKU, TILE, tile_enable, hw->sku);
732727
hw->tile_fuse = tile_disable;
733728
hw->pll.profiling_freq = PLL_PROFILING_FREQ_DEFAULT;
734729

‎drivers/accel/ivpu/ivpu_job.c‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -294,7 +294,7 @@ static int ivpu_job_signal_and_destroy(struct ivpu_device *vdev, u32 job_id, u32
294294
return -ENOENT;
295295

296296
if (job->file_priv->has_mmu_faults)
297-
job_status = VPU_JSM_STATUS_ABORTED;
297+
job_status = DRM_IVPU_JOB_STATUS_ABORTED;
298298

299299
job->bos[CMD_BUF_IDX]->job_status = job_status;
300300
dma_fence_signal(job->done_fence);
@@ -315,7 +315,7 @@ void ivpu_jobs_abort_all(struct ivpu_device *vdev)
315315
unsigned long id;
316316

317317
xa_for_each(&vdev->submitted_jobs_xa, id, job)
318-
ivpu_job_signal_and_destroy(vdev, id, VPU_JSM_STATUS_ABORTED);
318+
ivpu_job_signal_and_destroy(vdev, id, DRM_IVPU_JOB_STATUS_ABORTED);
319319
}
320320

321321
static int ivpu_job_submit(struct ivpu_job *job)

‎drivers/accel/ivpu/ivpu_mmu.c‎

Lines changed: 22 additions & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -72,10 +72,10 @@
7272

7373
#define IVPU_MMU_Q_COUNT_LOG2 4 /* 16 entries */
7474
#define IVPU_MMU_Q_COUNT ((u32)1 << IVPU_MMU_Q_COUNT_LOG2)
75-
#define IVPU_MMU_Q_WRAP_BIT (IVPU_MMU_Q_COUNT << 1)
76-
#define IVPU_MMU_Q_WRAP_MASK (IVPU_MMU_Q_WRAP_BIT - 1)
77-
#define IVPU_MMU_Q_IDX_MASK (IVPU_MMU_Q_COUNT - 1)
75+
#define IVPU_MMU_Q_WRAP_MASK GENMASK(IVPU_MMU_Q_COUNT_LOG2, 0)
76+
#define IVPU_MMU_Q_IDX_MASK (IVPU_MMU_Q_COUNT - 1)
7877
#define IVPU_MMU_Q_IDX(val) ((val) & IVPU_MMU_Q_IDX_MASK)
78+
#define IVPU_MMU_Q_WRP(val) ((val) & IVPU_MMU_Q_COUNT)
7979

8080
#define IVPU_MMU_CMDQ_CMD_SIZE 16
8181
#define IVPU_MMU_CMDQ_SIZE (IVPU_MMU_Q_COUNT * IVPU_MMU_CMDQ_CMD_SIZE)
@@ -475,20 +475,32 @@ static int ivpu_mmu_cmdq_wait_for_cons(struct ivpu_device *vdev)
475475
return 0;
476476
}
477477

478+
static bool ivpu_mmu_queue_is_full(struct ivpu_mmu_queue *q)
479+
{
480+
return ((IVPU_MMU_Q_IDX(q->prod) == IVPU_MMU_Q_IDX(q->cons)) &&
481+
(IVPU_MMU_Q_WRP(q->prod) != IVPU_MMU_Q_WRP(q->cons)));
482+
}
483+
484+
static bool ivpu_mmu_queue_is_empty(struct ivpu_mmu_queue *q)
485+
{
486+
return ((IVPU_MMU_Q_IDX(q->prod) == IVPU_MMU_Q_IDX(q->cons)) &&
487+
(IVPU_MMU_Q_WRP(q->prod) == IVPU_MMU_Q_WRP(q->cons)));
488+
}
489+
478490
static int ivpu_mmu_cmdq_cmd_write(struct ivpu_device *vdev, const char *name, u64 data0, u64 data1)
479491
{
480-
struct ivpu_mmu_queue *q = &vdev->mmu->cmdq;
481-
u64 *queue_buffer = q->base;
482-
int idx = IVPU_MMU_Q_IDX(q->prod) * (IVPU_MMU_CMDQ_CMD_SIZE / sizeof(*queue_buffer));
492+
struct ivpu_mmu_queue *cmdq = &vdev->mmu->cmdq;
493+
u64 *queue_buffer = cmdq->base;
494+
int idx = IVPU_MMU_Q_IDX(cmdq->prod) * (IVPU_MMU_CMDQ_CMD_SIZE / sizeof(*queue_buffer));
483495

484-
if (!CIRC_SPACE(IVPU_MMU_Q_IDX(q->prod), IVPU_MMU_Q_IDX(q->cons), IVPU_MMU_Q_COUNT)) {
496+
if (ivpu_mmu_queue_is_full(cmdq)) {
485497
ivpu_err(vdev, "Failed to write MMU CMD %s\n", name);
486498
return -EBUSY;
487499
}
488500

489501
queue_buffer[idx] = data0;
490502
queue_buffer[idx + 1] = data1;
491-
q->prod = (q->prod + 1) & IVPU_MMU_Q_WRAP_MASK;
503+
cmdq->prod = (cmdq->prod + 1) & IVPU_MMU_Q_WRAP_MASK;
492504

493505
ivpu_dbg(vdev, MMU, "CMD write: %s data: 0x%llx 0x%llx\n", name, data0, data1);
494506

@@ -560,7 +572,6 @@ static int ivpu_mmu_reset(struct ivpu_device *vdev)
560572
mmu->cmdq.cons = 0;
561573

562574
memset(mmu->evtq.base, 0, IVPU_MMU_EVTQ_SIZE);
563-
clflush_cache_range(mmu->evtq.base, IVPU_MMU_EVTQ_SIZE);
564575
mmu->evtq.prod = 0;
565576
mmu->evtq.cons = 0;
566577

@@ -874,14 +885,10 @@ static u32 *ivpu_mmu_get_event(struct ivpu_device *vdev)
874885
u32 *evt = evtq->base + (idx * IVPU_MMU_EVTQ_CMD_SIZE);
875886

876887
evtq->prod = REGV_RD32(IVPU_MMU_REG_EVTQ_PROD_SEC);
877-
if (!CIRC_CNT(IVPU_MMU_Q_IDX(evtq->prod), IVPU_MMU_Q_IDX(evtq->cons), IVPU_MMU_Q_COUNT))
888+
if (ivpu_mmu_queue_is_empty(evtq))
878889
return NULL;
879890

880-
clflush_cache_range(evt, IVPU_MMU_EVTQ_CMD_SIZE);
881-
882891
evtq->cons = (evtq->cons + 1) & IVPU_MMU_Q_WRAP_MASK;
883-
REGV_WR32(IVPU_MMU_REG_EVTQ_CONS_SEC, evtq->cons);
884-
885892
return evt;
886893
}
887894

@@ -902,6 +909,7 @@ void ivpu_mmu_irq_evtq_handler(struct ivpu_device *vdev)
902909
}
903910

904911
ivpu_mmu_user_context_mark_invalid(vdev, ssid);
912+
REGV_WR32(IVPU_MMU_REG_EVTQ_CONS_SEC, vdev->mmu->evtq.cons);
905913
}
906914
}
907915

‎drivers/gpu/drm/nouveau/include/nvkm/subdev/gsp.h‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -9,7 +9,7 @@
99
#define GSP_PAGE_SIZE BIT(GSP_PAGE_SHIFT)
1010

1111
struct nvkm_gsp_mem {
12-
u32 size;
12+
size_t size;
1313
void *data;
1414
dma_addr_t addr;
1515
};

‎drivers/gpu/drm/nouveau/nvkm/subdev/gsp/r535.c‎

Lines changed: 47 additions & 30 deletions
Original file line numberDiff line numberDiff line change
@@ -997,6 +997,32 @@ r535_gsp_rpc_get_gsp_static_info(struct nvkm_gsp *gsp)
997997
return 0;
998998
}
999999

1000+
static void
1001+
nvkm_gsp_mem_dtor(struct nvkm_gsp *gsp, struct nvkm_gsp_mem *mem)
1002+
{
1003+
if (mem->data) {
1004+
/*
1005+
* Poison the buffer to catch any unexpected access from
1006+
* GSP-RM if the buffer was prematurely freed.
1007+
*/
1008+
memset(mem->data, 0xFF, mem->size);
1009+
1010+
dma_free_coherent(gsp->subdev.device->dev, mem->size, mem->data, mem->addr);
1011+
memset(mem, 0, sizeof(*mem));
1012+
}
1013+
}
1014+
1015+
static int
1016+
nvkm_gsp_mem_ctor(struct nvkm_gsp *gsp, size_t size, struct nvkm_gsp_mem *mem)
1017+
{
1018+
mem->size = size;
1019+
mem->data = dma_alloc_coherent(gsp->subdev.device->dev, size, &mem->addr, GFP_KERNEL);
1020+
if (WARN_ON(!mem->data))
1021+
return -ENOMEM;
1022+
1023+
return 0;
1024+
}
1025+
10001026
static int
10011027
r535_gsp_postinit(struct nvkm_gsp *gsp)
10021028
{
@@ -1024,6 +1050,13 @@ r535_gsp_postinit(struct nvkm_gsp *gsp)
10241050

10251051
nvkm_inth_allow(&gsp->subdev.inth);
10261052
nvkm_wr32(device, 0x110004, 0x00000040);
1053+
1054+
/* Release the DMA buffers that were needed only for boot and init */
1055+
nvkm_gsp_mem_dtor(gsp, &gsp->boot.fw);
1056+
nvkm_gsp_mem_dtor(gsp, &gsp->libos);
1057+
nvkm_gsp_mem_dtor(gsp, &gsp->rmargs);
1058+
nvkm_gsp_mem_dtor(gsp, &gsp->wpr_meta);
1059+
10271060
return ret;
10281061
}
10291062

@@ -1532,27 +1565,6 @@ r535_gsp_msg_run_cpu_sequencer(void *priv, u32 fn, void *repv, u32 repc)
15321565
return 0;
15331566
}
15341567

1535-
static void
1536-
nvkm_gsp_mem_dtor(struct nvkm_gsp *gsp, struct nvkm_gsp_mem *mem)
1537-
{
1538-
if (mem->data) {
1539-
dma_free_coherent(gsp->subdev.device->dev, mem->size, mem->data, mem->addr);
1540-
mem->data = NULL;
1541-
}
1542-
}
1543-
1544-
static int
1545-
nvkm_gsp_mem_ctor(struct nvkm_gsp *gsp, u32 size, struct nvkm_gsp_mem *mem)
1546-
{
1547-
mem->size = size;
1548-
mem->data = dma_alloc_coherent(gsp->subdev.device->dev, size, &mem->addr, GFP_KERNEL);
1549-
if (WARN_ON(!mem->data))
1550-
return -ENOMEM;
1551-
1552-
return 0;
1553-
}
1554-
1555-
15561568
static int
15571569
r535_gsp_booter_unload(struct nvkm_gsp *gsp, u32 mbox0, u32 mbox1)
15581570
{
@@ -1938,20 +1950,20 @@ nvkm_gsp_radix3_dtor(struct nvkm_gsp *gsp, struct nvkm_gsp_radix3 *rx3)
19381950
* See kgspCreateRadix3_IMPL
19391951
*/
19401952
static int
1941-
nvkm_gsp_radix3_sg(struct nvkm_device *device, struct sg_table *sgt, u64 size,
1953+
nvkm_gsp_radix3_sg(struct nvkm_gsp *gsp, struct sg_table *sgt, u64 size,
19421954
struct nvkm_gsp_radix3 *rx3)
19431955
{
19441956
u64 addr;
19451957

19461958
for (int i = ARRAY_SIZE(rx3->mem) - 1; i >= 0; i--) {
19471959
u64 *ptes;
1948-
int idx;
1960+
size_t bufsize;
1961+
int ret, idx;
19491962

1950-
rx3->mem[i].size = ALIGN((size / GSP_PAGE_SIZE) * sizeof(u64), GSP_PAGE_SIZE);
1951-
rx3->mem[i].data = dma_alloc_coherent(device->dev, rx3->mem[i].size,
1952-
&rx3->mem[i].addr, GFP_KERNEL);
1953-
if (WARN_ON(!rx3->mem[i].data))
1954-
return -ENOMEM;
1963+
bufsize = ALIGN((size / GSP_PAGE_SIZE) * sizeof(u64), GSP_PAGE_SIZE);
1964+
ret = nvkm_gsp_mem_ctor(gsp, bufsize, &rx3->mem[i]);
1965+
if (ret)
1966+
return ret;
19551967

19561968
ptes = rx3->mem[i].data;
19571969
if (i == 2) {
@@ -1991,7 +2003,7 @@ r535_gsp_fini(struct nvkm_gsp *gsp, bool suspend)
19912003
if (ret)
19922004
return ret;
19932005

1994-
ret = nvkm_gsp_radix3_sg(gsp->subdev.device, &gsp->sr.sgt, len, &gsp->sr.radix3);
2006+
ret = nvkm_gsp_radix3_sg(gsp, &gsp->sr.sgt, len, &gsp->sr.radix3);
19952007
if (ret)
19962008
return ret;
19972009

@@ -2150,6 +2162,11 @@ r535_gsp_dtor(struct nvkm_gsp *gsp)
21502162
mutex_destroy(&gsp->cmdq.mutex);
21512163

21522164
r535_gsp_dtor_fws(gsp);
2165+
2166+
nvkm_gsp_mem_dtor(gsp, &gsp->shm.mem);
2167+
nvkm_gsp_mem_dtor(gsp, &gsp->loginit);
2168+
nvkm_gsp_mem_dtor(gsp, &gsp->logintr);
2169+
nvkm_gsp_mem_dtor(gsp, &gsp->logrm);
21532170
}
21542171

21552172
int
@@ -2194,7 +2211,7 @@ r535_gsp_oneinit(struct nvkm_gsp *gsp)
21942211
memcpy(gsp->sig.data, data, size);
21952212

21962213
/* Build radix3 page table for ELF image. */
2197-
ret = nvkm_gsp_radix3_sg(device, &gsp->fw.mem.sgt, gsp->fw.len, &gsp->radix3);
2214+
ret = nvkm_gsp_radix3_sg(gsp, &gsp->fw.mem.sgt, gsp->fw.len, &gsp->radix3);
21982215
if (ret)
21992216
return ret;
22002217

‎include/uapi/drm/ivpu_accel.h‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -305,6 +305,7 @@ struct drm_ivpu_submit {
305305

306306
/* drm_ivpu_bo_wait job status codes */
307307
#define DRM_IVPU_JOB_STATUS_SUCCESS 0
308+
#define DRM_IVPU_JOB_STATUS_ABORTED 256
308309

309310
/**
310311
* struct drm_ivpu_bo_wait - Wait for BO to become inactive

0 commit comments

Comments
 (0)