Skip to content

Commit 485442c

Browse files
airliedairlied
committed
Merge tag 'drm-xe-fixes-2025-04-10' of https://gitlab.freedesktop.org/drm/xe/kernel into drm-fixes
Driver Changes: - Add another BMG PCI ID - Fix UAFs on migration paths - Fix shift-out-of-bounds access on TLB invalidation - Ensure ccs_mode is correctly set on gt reset - Extend some HW workarounds to Xe3 - Fix PM runtime get/put on sysfs files - Fix u64 division on 32b - Fix flickering due to missing L3 invalidations - Fix missing error code return Signed-off-by: Dave Airlie <airlied@redhat.com> From: Lucas De Marchi <lucas.demarchi@intel.com> Link: https://lore.kernel.org/r/unq5j26aejbrjz5nuvmdtcgupyix5bacpoahod4bdohlvwrney@kekimsi5ossx
2 parents 927cec6 + 88ecb66 commit 485442c

10 files changed

Lines changed: 90 additions & 73 deletions

File tree

‎drivers/gpu/drm/xe/instructions/xe_gpu_commands.h‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -41,6 +41,7 @@
4141

4242
#define GFX_OP_PIPE_CONTROL(len) ((0x3<<29)|(0x3<<27)|(0x2<<24)|((len)-2))
4343

44+
#define PIPE_CONTROL0_L3_READ_ONLY_CACHE_INVALIDATE BIT(10) /* gen12 */
4445
#define PIPE_CONTROL0_HDC_PIPELINE_FLUSH BIT(9) /* gen12 */
4546

4647
#define PIPE_CONTROL_COMMAND_CACHE_INVALIDATE (1<<29)

‎drivers/gpu/drm/xe/xe_gt_tlb_invalidation.c‎

Lines changed: 10 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -322,6 +322,13 @@ int xe_gt_tlb_invalidation_ggtt(struct xe_gt *gt)
322322
return 0;
323323
}
324324

325+
/*
326+
* Ensure that roundup_pow_of_two(length) doesn't overflow.
327+
* Note that roundup_pow_of_two() operates on unsigned long,
328+
* not on u64.
329+
*/
330+
#define MAX_RANGE_TLB_INVALIDATION_LENGTH (rounddown_pow_of_two(ULONG_MAX))
331+
325332
/**
326333
* xe_gt_tlb_invalidation_range - Issue a TLB invalidation on this GT for an
327334
* address range
@@ -346,6 +353,7 @@ int xe_gt_tlb_invalidation_range(struct xe_gt *gt,
346353
struct xe_device *xe = gt_to_xe(gt);
347354
#define MAX_TLB_INVALIDATION_LEN 7
348355
u32 action[MAX_TLB_INVALIDATION_LEN];
356+
u64 length = end - start;
349357
int len = 0;
350358

351359
xe_gt_assert(gt, fence);
@@ -358,11 +366,11 @@ int xe_gt_tlb_invalidation_range(struct xe_gt *gt,
358366

359367
action[len++] = XE_GUC_ACTION_TLB_INVALIDATION;
360368
action[len++] = 0; /* seqno, replaced in send_tlb_invalidation */
361-
if (!xe->info.has_range_tlb_invalidation) {
369+
if (!xe->info.has_range_tlb_invalidation ||
370+
length > MAX_RANGE_TLB_INVALIDATION_LENGTH) {
362371
action[len++] = MAKE_INVAL_OP(XE_GUC_TLB_INVAL_FULL);
363372
} else {
364373
u64 orig_start = start;
365-
u64 length = end - start;
366374
u64 align;
367375

368376
if (length < SZ_4K)

‎drivers/gpu/drm/xe/xe_guc_pc.c‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1070,6 +1070,7 @@ int xe_guc_pc_start(struct xe_guc_pc *pc)
10701070
if (wait_for_pc_state(pc, SLPC_GLOBAL_STATE_RUNNING,
10711071
SLPC_RESET_EXTENDED_TIMEOUT_MS)) {
10721072
xe_gt_err(gt, "GuC PC Start failed: Dynamic GT frequency control and GT sleep states are now disabled.\n");
1073+
ret = -EIO;
10731074
goto out;
10741075
}
10751076

‎drivers/gpu/drm/xe/xe_hw_engine.c‎

Lines changed: 6 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -389,12 +389,6 @@ xe_hw_engine_setup_default_lrc_state(struct xe_hw_engine *hwe)
389389
blit_cctl_val,
390390
XE_RTP_ACTION_FLAG(ENGINE_BASE)))
391391
},
392-
/* Use Fixed slice CCS mode */
393-
{ XE_RTP_NAME("RCU_MODE_FIXED_SLICE_CCS_MODE"),
394-
XE_RTP_RULES(FUNC(xe_hw_engine_match_fixed_cslice_mode)),
395-
XE_RTP_ACTIONS(FIELD_SET(RCU_MODE, RCU_MODE_FIXED_SLICE_CCS_MODE,
396-
RCU_MODE_FIXED_SLICE_CCS_MODE))
397-
},
398392
/* Disable WMTP if HW doesn't support it */
399393
{ XE_RTP_NAME("DISABLE_WMTP_ON_UNSUPPORTED_HW"),
400394
XE_RTP_RULES(FUNC(xe_rtp_cfeg_wmtp_disabled)),
@@ -461,6 +455,12 @@ hw_engine_setup_default_state(struct xe_hw_engine *hwe)
461455
XE_RTP_ACTIONS(SET(CSFE_CHICKEN1(0), CS_PRIORITY_MEM_READ,
462456
XE_RTP_ACTION_FLAG(ENGINE_BASE)))
463457
},
458+
/* Use Fixed slice CCS mode */
459+
{ XE_RTP_NAME("RCU_MODE_FIXED_SLICE_CCS_MODE"),
460+
XE_RTP_RULES(FUNC(xe_hw_engine_match_fixed_cslice_mode)),
461+
XE_RTP_ACTIONS(FIELD_SET(RCU_MODE, RCU_MODE_FIXED_SLICE_CCS_MODE,
462+
RCU_MODE_FIXED_SLICE_CCS_MODE))
463+
},
464464
};
465465

466466
xe_rtp_process_to_sr(&ctx, engine_entries, ARRAY_SIZE(engine_entries), &hwe->reg_sr);

‎drivers/gpu/drm/xe/xe_hw_engine_class_sysfs.c‎

Lines changed: 52 additions & 56 deletions
Original file line numberDiff line numberDiff line change
@@ -32,14 +32,61 @@ bool xe_hw_engine_timeout_in_range(u64 timeout, u64 min, u64 max)
3232
return timeout >= min && timeout <= max;
3333
}
3434

35-
static void kobj_xe_hw_engine_release(struct kobject *kobj)
35+
static void xe_hw_engine_sysfs_kobj_release(struct kobject *kobj)
3636
{
3737
kfree(kobj);
3838
}
3939

40+
static ssize_t xe_hw_engine_class_sysfs_attr_show(struct kobject *kobj,
41+
struct attribute *attr,
42+
char *buf)
43+
{
44+
struct xe_device *xe = kobj_to_xe(kobj);
45+
struct kobj_attribute *kattr;
46+
ssize_t ret = -EIO;
47+
48+
kattr = container_of(attr, struct kobj_attribute, attr);
49+
if (kattr->show) {
50+
xe_pm_runtime_get(xe);
51+
ret = kattr->show(kobj, kattr, buf);
52+
xe_pm_runtime_put(xe);
53+
}
54+
55+
return ret;
56+
}
57+
58+
static ssize_t xe_hw_engine_class_sysfs_attr_store(struct kobject *kobj,
59+
struct attribute *attr,
60+
const char *buf,
61+
size_t count)
62+
{
63+
struct xe_device *xe = kobj_to_xe(kobj);
64+
struct kobj_attribute *kattr;
65+
ssize_t ret = -EIO;
66+
67+
kattr = container_of(attr, struct kobj_attribute, attr);
68+
if (kattr->store) {
69+
xe_pm_runtime_get(xe);
70+
ret = kattr->store(kobj, kattr, buf, count);
71+
xe_pm_runtime_put(xe);
72+
}
73+
74+
return ret;
75+
}
76+
77+
static const struct sysfs_ops xe_hw_engine_class_sysfs_ops = {
78+
.show = xe_hw_engine_class_sysfs_attr_show,
79+
.store = xe_hw_engine_class_sysfs_attr_store,
80+
};
81+
4082
static const struct kobj_type kobj_xe_hw_engine_type = {
41-
.release = kobj_xe_hw_engine_release,
42-
.sysfs_ops = &kobj_sysfs_ops
83+
.release = xe_hw_engine_sysfs_kobj_release,
84+
.sysfs_ops = &xe_hw_engine_class_sysfs_ops,
85+
};
86+
87+
static const struct kobj_type kobj_xe_hw_engine_type_def = {
88+
.release = xe_hw_engine_sysfs_kobj_release,
89+
.sysfs_ops = &kobj_sysfs_ops,
4390
};
4491

4592
static ssize_t job_timeout_max_store(struct kobject *kobj,
@@ -543,7 +590,7 @@ static int xe_add_hw_engine_class_defaults(struct xe_device *xe,
543590
if (!kobj)
544591
return -ENOMEM;
545592

546-
kobject_init(kobj, &kobj_xe_hw_engine_type);
593+
kobject_init(kobj, &kobj_xe_hw_engine_type_def);
547594
err = kobject_add(kobj, parent, "%s", ".defaults");
548595
if (err)
549596
goto err_object;
@@ -559,57 +606,6 @@ static int xe_add_hw_engine_class_defaults(struct xe_device *xe,
559606
return err;
560607
}
561608

562-
static void xe_hw_engine_sysfs_kobj_release(struct kobject *kobj)
563-
{
564-
kfree(kobj);
565-
}
566-
567-
static ssize_t xe_hw_engine_class_sysfs_attr_show(struct kobject *kobj,
568-
struct attribute *attr,
569-
char *buf)
570-
{
571-
struct xe_device *xe = kobj_to_xe(kobj);
572-
struct kobj_attribute *kattr;
573-
ssize_t ret = -EIO;
574-
575-
kattr = container_of(attr, struct kobj_attribute, attr);
576-
if (kattr->show) {
577-
xe_pm_runtime_get(xe);
578-
ret = kattr->show(kobj, kattr, buf);
579-
xe_pm_runtime_put(xe);
580-
}
581-
582-
return ret;
583-
}
584-
585-
static ssize_t xe_hw_engine_class_sysfs_attr_store(struct kobject *kobj,
586-
struct attribute *attr,
587-
const char *buf,
588-
size_t count)
589-
{
590-
struct xe_device *xe = kobj_to_xe(kobj);
591-
struct kobj_attribute *kattr;
592-
ssize_t ret = -EIO;
593-
594-
kattr = container_of(attr, struct kobj_attribute, attr);
595-
if (kattr->store) {
596-
xe_pm_runtime_get(xe);
597-
ret = kattr->store(kobj, kattr, buf, count);
598-
xe_pm_runtime_put(xe);
599-
}
600-
601-
return ret;
602-
}
603-
604-
static const struct sysfs_ops xe_hw_engine_class_sysfs_ops = {
605-
.show = xe_hw_engine_class_sysfs_attr_show,
606-
.store = xe_hw_engine_class_sysfs_attr_store,
607-
};
608-
609-
static const struct kobj_type xe_hw_engine_sysfs_kobj_type = {
610-
.release = xe_hw_engine_sysfs_kobj_release,
611-
.sysfs_ops = &xe_hw_engine_class_sysfs_ops,
612-
};
613609

614610
static void hw_engine_class_sysfs_fini(void *arg)
615611
{
@@ -640,7 +636,7 @@ int xe_hw_engine_class_sysfs_init(struct xe_gt *gt)
640636
if (!kobj)
641637
return -ENOMEM;
642638

643-
kobject_init(kobj, &xe_hw_engine_sysfs_kobj_type);
639+
kobject_init(kobj, &kobj_xe_hw_engine_type);
644640

645641
err = kobject_add(kobj, gt->sysfs, "engines");
646642
if (err)

‎drivers/gpu/drm/xe/xe_migrate.c‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1177,7 +1177,7 @@ struct dma_fence *xe_migrate_clear(struct xe_migrate *m,
11771177
err_sync:
11781178
/* Sync partial copies if any. FIXME: job_mutex? */
11791179
if (fence) {
1180-
dma_fence_wait(m->fence, false);
1180+
dma_fence_wait(fence, false);
11811181
dma_fence_put(fence);
11821182
}
11831183

@@ -1547,7 +1547,7 @@ void xe_migrate_wait(struct xe_migrate *m)
15471547
static u32 pte_update_cmd_size(u64 size)
15481548
{
15491549
u32 num_dword;
1550-
u64 entries = DIV_ROUND_UP(size, XE_PAGE_SIZE);
1550+
u64 entries = DIV_U64_ROUND_UP(size, XE_PAGE_SIZE);
15511551

15521552
XE_WARN_ON(size > MAX_PREEMPTDISABLE_TRANSFER);
15531553
/*
@@ -1558,7 +1558,7 @@ static u32 pte_update_cmd_size(u64 size)
15581558
* 2 dword for the page table's physical location
15591559
* 2*n dword for value of pte to fill (each pte entry is 2 dwords)
15601560
*/
1561-
num_dword = (1 + 2) * DIV_ROUND_UP(entries, 0x1ff);
1561+
num_dword = (1 + 2) * DIV_U64_ROUND_UP(entries, 0x1ff);
15621562
num_dword += entries * 2;
15631563

15641564
return num_dword;

‎drivers/gpu/drm/xe/xe_ring_ops.c‎

Lines changed: 9 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -137,7 +137,8 @@ emit_pipe_control(u32 *dw, int i, u32 bit_group_0, u32 bit_group_1, u32 offset,
137137
static int emit_pipe_invalidate(u32 mask_flags, bool invalidate_tlb, u32 *dw,
138138
int i)
139139
{
140-
u32 flags = PIPE_CONTROL_CS_STALL |
140+
u32 flags0 = 0;
141+
u32 flags1 = PIPE_CONTROL_CS_STALL |
141142
PIPE_CONTROL_COMMAND_CACHE_INVALIDATE |
142143
PIPE_CONTROL_INSTRUCTION_CACHE_INVALIDATE |
143144
PIPE_CONTROL_TEXTURE_CACHE_INVALIDATE |
@@ -148,11 +149,15 @@ static int emit_pipe_invalidate(u32 mask_flags, bool invalidate_tlb, u32 *dw,
148149
PIPE_CONTROL_STORE_DATA_INDEX;
149150

150151
if (invalidate_tlb)
151-
flags |= PIPE_CONTROL_TLB_INVALIDATE;
152+
flags1 |= PIPE_CONTROL_TLB_INVALIDATE;
152153

153-
flags &= ~mask_flags;
154+
flags1 &= ~mask_flags;
154155

155-
return emit_pipe_control(dw, i, 0, flags, LRC_PPHWSP_FLUSH_INVAL_SCRATCH_ADDR, 0);
156+
if (flags1 & PIPE_CONTROL_VF_CACHE_INVALIDATE)
157+
flags0 |= PIPE_CONTROL0_L3_READ_ONLY_CACHE_INVALIDATE;
158+
159+
return emit_pipe_control(dw, i, flags0, flags1,
160+
LRC_PPHWSP_FLUSH_INVAL_SCRATCH_ADDR, 0);
156161
}
157162

158163
static int emit_store_imm_ppgtt_posted(u64 addr, u64 value,

‎drivers/gpu/drm/xe/xe_svm.c‎

Lines changed: 5 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -696,11 +696,14 @@ static int xe_svm_alloc_vram(struct xe_vm *vm, struct xe_tile *tile,
696696
list_for_each_entry(block, blocks, link)
697697
block->private = vr;
698698

699+
xe_bo_get(bo);
699700
err = drm_gpusvm_migrate_to_devmem(&vm->svm.gpusvm, &range->base,
700701
&bo->devmem_allocation, ctx);
701-
xe_bo_unlock(bo);
702702
if (err)
703-
xe_bo_put(bo); /* Creation ref */
703+
xe_svm_devmem_release(&bo->devmem_allocation);
704+
705+
xe_bo_unlock(bo);
706+
xe_bo_put(bo);
704707

705708
unlock:
706709
mmap_read_unlock(mm);

‎drivers/gpu/drm/xe/xe_wa_oob.rules‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -32,8 +32,10 @@
3232
GRAPHICS_VERSION(3001)
3333
14022293748 GRAPHICS_VERSION(2001)
3434
GRAPHICS_VERSION(2004)
35+
GRAPHICS_VERSION_RANGE(3000, 3001)
3536
22019794406 GRAPHICS_VERSION(2001)
3637
GRAPHICS_VERSION(2004)
38+
GRAPHICS_VERSION_RANGE(3000, 3001)
3739
22019338487 MEDIA_VERSION(2000)
3840
GRAPHICS_VERSION(2001)
3941
MEDIA_VERSION(3000), MEDIA_STEP(A0, B0), FUNC(xe_rtp_match_not_sriov_vf)

‎include/drm/intel/pciids.h‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -850,6 +850,7 @@
850850
MACRO__(0xE20C, ## __VA_ARGS__), \
851851
MACRO__(0xE20D, ## __VA_ARGS__), \
852852
MACRO__(0xE210, ## __VA_ARGS__), \
853+
MACRO__(0xE211, ## __VA_ARGS__), \
853854
MACRO__(0xE212, ## __VA_ARGS__), \
854855
MACRO__(0xE215, ## __VA_ARGS__), \
855856
MACRO__(0xE216, ## __VA_ARGS__)

0 commit comments

Comments
 (0)