Commit 4dba1fd3 authored by Dave Airlie's avatar Dave Airlie
Browse files

Merge tag 'drm-xe-fixes-2024-12-12' of https://gitlab.freedesktop.org/drm/xe/kernel into drm-fixes 



- Fix a KUNIT test error message (Mirsad Todorovac)
- Fix an invalidation fence PM ref leak (Daniele)
- Fix a register pool UAF (Lucas)

Signed-off-by: default avatarDave Airlie <airlied@redhat.com>

From: Thomas Hellstrom <thomas.hellstrom@linux.intel.com>
Link: https://patchwork.freedesktop.org/patch/msgid/Z1s5elHXOyeIHnE0@fedora
parents c98f9ab9 d7b02865

drivers/gpu/drm/xe/tests/xe_migrate.c

+2 −2
Original line number Diff line number Diff line
@@ -224,8 +224,8 @@ static void xe_migrate_sanity_test(struct xe_migrate *m, struct kunit *test) 
				    XE_BO_FLAG_VRAM_IF_DGFX(tile) |

				    XE_BO_FLAG_PINNED);

	if (IS_ERR(tiny)) {

		KUNIT_FAIL(test, "Failed to allocate fake pt: %li\n",

			   PTR_ERR(pt));

		KUNIT_FAIL(test, "Failed to allocate tiny fake pt: %li\n",

			   PTR_ERR(tiny));

		goto free_pt;

	}

drivers/gpu/drm/xe/xe_gt_tlb_invalidation.c

+8 −0
Original line number Diff line number Diff line
@@ -65,6 +65,14 @@ invalidation_fence_signal(struct xe_device *xe, struct xe_gt_tlb_invalidation_fe 
	__invalidation_fence_signal(xe, fence);

}



void xe_gt_tlb_invalidation_fence_signal(struct xe_gt_tlb_invalidation_fence *fence)

{

	if (WARN_ON_ONCE(!fence->gt))

		return;



	__invalidation_fence_signal(gt_to_xe(fence->gt), fence);

}



static void xe_gt_tlb_fence_timeout(struct work_struct *work)

{

	struct xe_gt *gt = container_of(work, struct xe_gt,

drivers/gpu/drm/xe/xe_gt_tlb_invalidation.h

+1 −0
Original line number Diff line number Diff line
@@ -28,6 +28,7 @@ int xe_guc_tlb_invalidation_done_handler(struct xe_guc *guc, u32 *msg, u32 len); 
void xe_gt_tlb_invalidation_fence_init(struct xe_gt *gt,

				       struct xe_gt_tlb_invalidation_fence *fence,

				       bool stack);

void xe_gt_tlb_invalidation_fence_signal(struct xe_gt_tlb_invalidation_fence *fence);



static inline void

xe_gt_tlb_invalidation_fence_wait(struct xe_gt_tlb_invalidation_fence *fence)

drivers/gpu/drm/xe/xe_pt.c

+1 −2
Original line number Diff line number Diff line
@@ -1333,8 +1333,7 @@ static void invalidation_fence_cb(struct dma_fence *fence, 
		queue_work(system_wq, &ifence->work);

	} else {

		ifence->base.base.error = ifence->fence->error;

		dma_fence_signal(&ifence->base.base);

		dma_fence_put(&ifence->base.base);

		xe_gt_tlb_invalidation_fence_signal(&ifence->base);

	}

	dma_fence_put(ifence->fence);

}

drivers/gpu/drm/xe/xe_reg_sr.c

+6 −25
Original line number Diff line number Diff line
@@ -27,46 +27,27 @@ 
#include "xe_reg_whitelist.h"

#include "xe_rtp_types.h"



#define XE_REG_SR_GROW_STEP_DEFAULT	16



static void reg_sr_fini(struct drm_device *drm, void *arg)

{

	struct xe_reg_sr *sr = arg;

	struct xe_reg_sr_entry *entry;

	unsigned long reg;



	xa_for_each(&sr->xa, reg, entry)

		kfree(entry);



	xa_destroy(&sr->xa);

	kfree(sr->pool.arr);

	memset(&sr->pool, 0, sizeof(sr->pool));

}



int xe_reg_sr_init(struct xe_reg_sr *sr, const char *name, struct xe_device *xe)

{

	xa_init(&sr->xa);

	memset(&sr->pool, 0, sizeof(sr->pool));

	sr->pool.grow_step = XE_REG_SR_GROW_STEP_DEFAULT;

	sr->name = name;



	return drmm_add_action_or_reset(&xe->drm, reg_sr_fini, sr);

}

EXPORT_SYMBOL_IF_KUNIT(xe_reg_sr_init);



static struct xe_reg_sr_entry *alloc_entry(struct xe_reg_sr *sr)

{

	if (sr->pool.used == sr->pool.allocated) {

		struct xe_reg_sr_entry *arr;



		arr = krealloc_array(sr->pool.arr,

				     ALIGN(sr->pool.allocated + 1, sr->pool.grow_step),

				     sizeof(*arr), GFP_KERNEL);

		if (!arr)

			return NULL;



		sr->pool.arr = arr;

		sr->pool.allocated += sr->pool.grow_step;

	}



	return &sr->pool.arr[sr->pool.used++];

}



static bool compatible_entries(const struct xe_reg_sr_entry *e1,

			       const struct xe_reg_sr_entry *e2)

{
@@ -112,7 +93,7 @@ int xe_reg_sr_add(struct xe_reg_sr *sr, 
		return 0;

	}



	pentry = alloc_entry(sr);

	pentry = kmalloc(sizeof(*pentry), GFP_KERNEL);

	if (!pentry) {

		ret = -ENOMEM;

		goto fail;