Commit 95adee9a authored by Dave Airlie's avatar Dave Airlie
Browse files

Merge tag 'drm-intel-gt-next-2026-01-16' of... 

Merge tag 'drm-intel-gt-next-2026-01-16' of https://gitlab.freedesktop.org/drm/i915/kernel

 into drm-next

Driver Changes:

- Bump recommended GuC version for DG2 and MTL
- Fix for syzkaller found NULL deref in execbuf (Krzyssztof, Gangmin)

- Use designated initializers in debugfs code (Sebastian)
- Selftest and static checker fixes (Ard, Sk)

Signed-off-by: default avatarDave Airlie <airlied@redhat.com>
From: Joonas Lahtinen <joonas.lahtinen@linux.intel.com>
Link: https://patch.msgid.link/aWnzOx78S4Vh38QE@jlahtine-mobl
parents c098b1aa 9512d9fc

drivers/gpu/drm/i915/gem/i915_gem_execbuffer.c

+17 −20
Original line number Diff line number Diff line
@@ -951,13 +951,13 @@ static int eb_lookup_vmas(struct i915_execbuffer *eb) 
		vma = eb_lookup_vma(eb, eb->exec[i].handle);

		if (IS_ERR(vma)) {

			err = PTR_ERR(vma);

			goto err;

			return err;

		}



		err = eb_validate_vma(eb, &eb->exec[i], vma);

		if (unlikely(err)) {

			i915_vma_put(vma);

			goto err;

			return err;

		}



		err = eb_add_vma(eb, &current_batch, i, vma);
@@ -966,19 +966,8 @@ static int eb_lookup_vmas(struct i915_execbuffer *eb) 


		if (i915_gem_object_is_userptr(vma->obj)) {

			err = i915_gem_object_userptr_submit_init(vma->obj);

			if (err) {

				if (i + 1 < eb->buffer_count) {

					/*

					 * Execbuffer code expects last vma entry to be NULL,

					 * since we already initialized this entry,

					 * set the next value to NULL or we mess up

					 * cleanup handling.

					 */

					eb->vma[i + 1].vma = NULL;

				}



			if (err)

				return err;

			}



			eb->vma[i].flags |= __EXEC_OBJECT_USERPTR_INIT;

			eb->args->flags |= __EXEC_USERPTR_USED;
@@ -986,10 +975,6 @@ static int eb_lookup_vmas(struct i915_execbuffer *eb) 
	}



	return 0;



err:

	eb->vma[i].vma = NULL;

	return err;

}



static int eb_lock_vmas(struct i915_execbuffer *eb)
@@ -3375,7 +3360,8 @@ i915_gem_do_execbuffer(struct drm_device *dev, 


	eb.exec = exec;

	eb.vma = (struct eb_vma *)(exec + args->buffer_count + 1);

	eb.vma[0].vma = NULL;

	memset(eb.vma, 0, (args->buffer_count + 1) * sizeof(struct eb_vma));



	eb.batch_pool = NULL;



	eb.invalid_flags = __EXEC_OBJECT_UNKNOWN_FLAGS;
@@ -3584,7 +3570,18 @@ i915_gem_execbuffer2_ioctl(struct drm_device *dev, void *data, 
	if (err)

		return err;



	/* Allocate extra slots for use by the command parser */

	/*

	 * Allocate extra slots for use by the command parser.

	 *

	 * Note that this allocation handles two different arrays (the

	 * exec2_list array, and the eventual eb.vma array introduced in

	 * i915_gem_do_execbuffer()), that reside in virtually contiguous

	 * memory. Also note that the allocation intentionally doesn't fill the

	 * area with zeros, because the exec2_list part doesn't need to be, as

	 * it's immediately overwritten by user data a few lines below.

	 * However, the eb.vma part is explicitly zeroed later in

	 * i915_gem_do_execbuffer().

	 */

	exec2_list = kvmalloc_array(count + 2, eb_element_size(),

				    __GFP_NOWARN | GFP_KERNEL);

	if (exec2_list == NULL) {

drivers/gpu/drm/i915/gt/intel_gt_debugfs.c

+2 −2
Original line number Diff line number Diff line
@@ -75,8 +75,8 @@ DEFINE_INTEL_GT_DEBUGFS_ATTRIBUTE(steering); 
static void gt_debugfs_register(struct intel_gt *gt, struct dentry *root)

{

	static const struct intel_gt_debugfs_file files[] = {

		{ "reset", &reset_fops, NULL },

		{ "steering", &steering_fops },

		{ .name = "reset", .fops = &reset_fops },

		{ .name = "steering", .fops = &steering_fops },

	};



	intel_gt_debugfs_register_files(root, files, ARRAY_SIZE(files), gt);

drivers/gpu/drm/i915/gt/intel_gt_engines_debugfs.c

+1 −1
Original line number Diff line number Diff line
@@ -29,7 +29,7 @@ DEFINE_INTEL_GT_DEBUGFS_ATTRIBUTE(engines); 
void intel_gt_engines_debugfs_register(struct intel_gt *gt, struct dentry *root)

{

	static const struct intel_gt_debugfs_file files[] = {

		{ "engines", &engines_fops },

		{ .name = "engines", .fops = &engines_fops },

	};



	intel_gt_debugfs_register_files(root, files, ARRAY_SIZE(files), gt);

drivers/gpu/drm/i915/gt/intel_gt_pm_debugfs.c

+8 −7
Original line number Diff line number Diff line
@@ -588,13 +588,14 @@ DEFINE_SIMPLE_ATTRIBUTE(perf_limit_reasons_fops, perf_limit_reasons_get, 
void intel_gt_pm_debugfs_register(struct intel_gt *gt, struct dentry *root)

{

	static const struct intel_gt_debugfs_file files[] = {

		{ "drpc", &drpc_fops, NULL },

		{ "frequency", &frequency_fops, NULL },

		{ "forcewake", &fw_domains_fops, NULL },

		{ "forcewake_user", &forcewake_user_fops, NULL},

		{ "llc", &llc_fops, llc_eval },

		{ "rps_boost", &rps_boost_fops, rps_eval },

		{ "perf_limit_reasons", &perf_limit_reasons_fops, perf_limit_reasons_eval },

		{ .name = "drpc", .fops = &drpc_fops },

		{ .name = "frequency", .fops = &frequency_fops },

		{ .name = "forcewake", .fops = &fw_domains_fops },

		{ .name = "forcewake_user", .fops = &forcewake_user_fops},

		{ .name = "llc", .fops = &llc_fops, .eval = llc_eval },

		{ .name = "rps_boost", .fops = &rps_boost_fops, .eval = rps_eval },

		{ .name = "perf_limit_reasons", .fops = &perf_limit_reasons_fops,

		  .eval = perf_limit_reasons_eval },

	};



	intel_gt_debugfs_register_files(root, files, ARRAY_SIZE(files), gt);

drivers/gpu/drm/i915/gt/intel_sseu_debugfs.c

+2 −2
Original line number Diff line number Diff line
@@ -293,8 +293,8 @@ DEFINE_INTEL_GT_DEBUGFS_ATTRIBUTE(sseu_topology); 
void intel_sseu_debugfs_register(struct intel_gt *gt, struct dentry *root)

{

	static const struct intel_gt_debugfs_file files[] = {

		{ "sseu_status", &sseu_status_fops, NULL },

		{ "sseu_topology", &sseu_topology_fops, NULL },

		{ .name = "sseu_status", .fops = &sseu_status_fops },

		{ .name = "sseu_topology", .fops = &sseu_topology_fops },

	};



	intel_gt_debugfs_register_files(root, files, ARRAY_SIZE(files), gt);