Matthew Auld
94c4aa2661
drm/xe/client: add missing bo locking in show_meminfo()
...
bo_meminfo() wants to inspect bo state like tt and the ttm resource,
however this state can change at any point leading to stuff like NPD and
UAF, if the bo lock is not held. Grab the bo lock when calling
bo_meminfo(), ensuring we drop any spinlocks first. In the case of
object_idr we now also need to hold a ref.
v2 (MattB)
- Also add xe_bo_assert_held()
Fixes: 0845233388matthew.auld@intel.com >
Cc: Himal Prasad Ghimiray <himal.prasad.ghimiray@intel.com >
Cc: Tejas Upadhyay <tejas.upadhyay@intel.com >
Cc: "Thomas Hellström" <thomas.hellstrom@linux.intel.com >
Cc: <stable@vger.kernel.org > # v6.8+
Reviewed-by: Matthew Brost <matthew.brost@intel.com >
Reviewed-by: Tejas Upadhyay <tejas.upadhyay@intel.com >
Link: https://patchwork.freedesktop.org/patch/msgid/20240911155527.178910-6-matthew.auld@intel.com
(cherry picked from commit 4f63d712farodrigo.vivi@intel.com >
2024-09-12 10:07:22 -04:00
Matthew Auld
9bd7ff293f
drm/xe/client: fix deadlock in show_meminfo()
...
There is a real deadlock as well as sleeping in atomic() bug in here, if
the bo put happens to be the last ref, since bo destruction wants to
grab the same spinlock and sleeping locks. Fix that by dropping the ref
using xe_bo_put_deferred(), and moving the final commit outside of the
lock. Dropping the lock around the put is tricky since the bo can go
out of scope and delete itself from the list, making it difficult to
navigate to the next list entry.
Fixes: 0845233388https://gitlab.freedesktop.org/drm/xe/kernel/-/issues/2727
Signed-off-by: Matthew Auld <matthew.auld@intel.com >
Cc: Himal Prasad Ghimiray <himal.prasad.ghimiray@intel.com >
Cc: Tejas Upadhyay <tejas.upadhyay@intel.com >
Cc: "Thomas Hellström" <thomas.hellstrom@linux.intel.com >
Cc: <stable@vger.kernel.org > # v6.8+
Reviewed-by: Matthew Brost <matthew.brost@intel.com >
Reviewed-by: Tejas Upadhyay <tejas.upadhyay@intel.com >
Link: https://patchwork.freedesktop.org/patch/msgid/20240911155527.178910-5-matthew.auld@intel.com
(cherry picked from commit 0083b8e6f1rodrigo.vivi@intel.com >
2024-09-12 10:07:18 -04:00
Ashutosh Dixit
a262cc8d55
drm/xe/oa: Enable Xe2+ PES disaggregation
...
Enable Xe2+ PES disaggregation (for OAG) to retrieve disaggregated metrics
when disaggregated data is needed. Userspace can select whether to receive
aggregated or disaggregated metrics via the particular OA configuration it
uses (programmed via DRM_XE_OBSERVATION_OP_ADD_CONFIG).
Bspec: 61101
Fixes: e936f885f1ashutosh.dixit@intel.com >
Reviewed-by: Lucas De Marchi <lucas.demarchi@intel.com >
Link: https://patchwork.freedesktop.org/patch/msgid/20240909165933.2638765-1-ashutosh.dixit@intel.com
Cc: stable@vger.kernel.org
(cherry picked from commit fb2551a0e9rodrigo.vivi@intel.com >
2024-09-12 10:07:15 -04:00
Jani Nikula
dd10595c32
drm/xe/display: fix compat IS_DISPLAY_STEP() range end
...
It's supposed to be an open range at the end like in i915. Fingers
crossed that nobody relies on this definition.
Fixes: 44e694958blucas.demarchi@intel.com >
Reviewed-by: Matt Roper <matthew.d.roper@intel.com >
Acked-by: Lucas De Marchi <lucas.demarchi@intel.com >
Link: https://patchwork.freedesktop.org/patch/msgid/fe8743770694e429f6902491cdb306c97bdf701a.1724180287.git.jani.nikula@intel.com
Signed-off-by: Jani Nikula <jani.nikula@intel.com >
(cherry picked from commit 453afb1a43rodrigo.vivi@intel.com >
2024-09-12 10:06:55 -04:00
Nirmoy Das
062d59eb96
drm/xe: Fix access_ok check in user_fence_create
...
Check size of the data not size of the pointer.
Reported-by: kernel test robot <lkp@intel.com >
Closes: https://lore.kernel.org/oe-kbuild-all/202407300421.IBkAja96-lkp@intel.com/
Fixes: ddeb7989a9matthew.auld@intel.com >
Cc: Matthew Brost <matthew.brost@intel.com >
Reviewed-by: Matthew Auld <matthew.auld@intel.com >
Reviewed-by: Tejas Upadhyay <tejas.upadhyay@intel.com >
Reviewed-by: Apoorva Singh <apoorva.singh@intel.com >
Link: https://patchwork.freedesktop.org/patch/msgid/20240806110722.28661-1-nirmoy.das@intel.com
Signed-off-by: Nirmoy Das <nirmoy.das@intel.com >
(cherry picked from commit e102b5ed6erodrigo.vivi@intel.com >
2024-09-12 10:06:30 -04:00
Matthew Brost
5e2d1d4dc1
drm/xe: Fix possible UAF in guc_exec_queue_process_msg
...
Store xe_device ahead of processing message as message can be free'd in
some cases.
v2:
- Including missing local changes
v3:
- Resend for CI
Reported-by: kernel test robot <lkp@intel.com >
Reported-by: Dan Carpenter <dan.carpenter@linaro.org >
Closes: https://lore.kernel.org/r/202407231445.rpisd1vA-lkp@intel.com/
Fixes: 55ea73aacfmatthew.brost@intel.com >
Reviewed-by: Himal Prasad Ghimiray <himal.prasad.ghimiray@intel.com >
Link: https://patchwork.freedesktop.org/patch/msgid/20240724164341.1848954-1-matthew.brost@intel.com
(cherry picked from commit 1a394b4f50rodrigo.vivi@intel.com >
2024-09-12 10:06:22 -04:00
Matthew Brost
572239f7f1
drm/xe: Remove fence check from send_tlb_invalidation
...
'fence' argument in send_tlb_invalidation cannot be NULL, remove
non-NULL check from send_tlb_invalidation.
Reported-by: kernel test robot <lkp@intel.com >
Reported-by: Dan Carpenter <dan.carpenter@linaro.org >
Closes: https://lore.kernel.org/r/202407231049.esig0Fkb-lkp@intel.com/
Fixes: 58bfe66744matthew.brost@intel.com >
Reviewed-by: Nirmoy Das <nirmoy.das@intel.com >
Link: https://patchwork.freedesktop.org/patch/msgid/20240723190714.1744653-1-matthew.brost@intel.com
Signed-off-by: Nirmoy Das <nirmoy.das@intel.com >
(cherry picked from commit 6482253e6erodrigo.vivi@intel.com >
2024-09-12 10:06:16 -04:00
Lucas De Marchi
a2655358cb
drm/xe/gt: Remove double include
...
The header generated/xe_wa_oob.h is included twice. Remove one.
Fixes: 27cb2b7feclkp@intel.com >
Closes: https://lore.kernel.org/r/202407052122.AzuWSPuo-lkp@intel.com/
Reviewed-by: Michal Wajdeczko <michal.wajdeczko@intel.com >
Link: https://patchwork.freedesktop.org/patch/msgid/20240708173301.1543871-1-lucas.demarchi@intel.com
Signed-off-by: Lucas De Marchi <lucas.demarchi@intel.com >
(cherry picked from commit 3d122660dcrodrigo.vivi@intel.com >
2024-09-12 10:06:02 -04:00
Rodrigo Vivi
4bfc9c553f
drm/xe/display: Avoid encoder_suspend at runtime suspend
...
Fix circular locking dependency on runtime suspend.
<4> [74.952215] ======================================================
<4> [74.952217] WARNING: possible circular locking dependency detected
<4> [74.952219] 6.10.0-rc7-xe #1 Not tainted
<4> [74.952221] ------------------------------------------------------
<4> [74.952223] kworker/7:1/82 is trying to acquire lock:
<4> [74.952226] ffff888120548488 (&dev->mode_config.mutex){+.+.}-{3:3}, at: drm_modeset_lock_all+0x40/0x1e0 [drm]
<4> [74.952260]
but task is already holding lock:
<4> [74.952262] ffffffffa0ae59c0 (xe_pm_runtime_lockdep_map){+.+.}-{0:0}, at: xe_pm_runtime_suspend+0x2f/0x340 [xe]
<4> [74.952322]
which lock already depends on the new lock.
The commit 'b1d90a86 ("drm/xe: Use the encoder suspend helper also used
by the i915 driver")' didn't do anything wrong. It actually fixed a
critical bug, because the encoder_suspend was never getting actually
called because it was returning if (has_display(xe)) instead of
if (!has_display(xe)). However, this ended up introducing the encoder
suspend calls in the runtime routines as well, causing the circular
locking dependency.
Closes: https://gitlab.freedesktop.org/drm/xe/kernel/-/issues/2304
Fixes: b1d90a862cimre.deak@intel.com >
Reviewed-by: Jonathan Cavitt <jonathan.cavitt@intel.com >
Link: https://patchwork.freedesktop.org/patch/msgid/20240830183507.298351-2-rodrigo.vivi@intel.com
Signed-off-by: Rodrigo Vivi <rodrigo.vivi@intel.com >
(cherry picked from commit 8da19441d0rodrigo.vivi@intel.com >
2024-09-04 12:24:47 -04:00
Imre Deak
880b398288
drm/xe: Suspend/resume user access only during system s/r
...
Enable/Disable user access only during system suspend/resume.
This should not happen during runtime s/r
v2: rebased
Reviewed-by: Arun R Murthy <arun.r.murthy@intel.com >
Signed-off-by: Imre Deak <imre.deak@intel.com >
Signed-off-by: Vinod Govindapillai <vinod.govindapillai@intel.com >
Link: https://patchwork.freedesktop.org/patch/msgid/20240823112148.327015-2-vinod.govindapillai@intel.com
(cherry picked from commit a64e7e5b05rodrigo.vivi@intel.com >
2024-09-04 12:24:37 -04:00
Maarten Lankhorst
269a3f6084
drm/xe/display: Match i915 driver suspend/resume sequences better
...
Suspend fbdev sooner, and disable user access before suspending to
prevent some races. I've noticed this when comparing xe suspend to
i915's.
Matches the following commits from i915:
24b412b1bf1ef28d86bebd738d859emaarten.lankhorst@linux.intel.com >
Cc: Imre Deak <imre.deak@intel.com >
Reviewed-by: Uma Shankar <uma.shankar@intel.com >
Link: https://patchwork.freedesktop.org/patch/msgid/20240806105044.596842-2-maarten.lankhorst@linux.intel.com
Signed-off-by: Maarten Lankhorst,,, <maarten.lankhorst@linux.intel.com >
(cherry picked from commit 492be2a070rodrigo.vivi@intel.com >
2024-09-04 12:24:07 -04:00
Rodrigo Vivi
82122d1f54
drm/xe: Add missing runtime reference to wedged upon gt_reset
...
Fixes this missed case:
xe 0000:00:02.0: [drm] Missing outer runtime PM protection
WARNING: CPU: 99 PID: 1455 at drivers/gpu/drm/xe/xe_pm.c:564 xe_pm_runtime_get_noresume+0x48/0x60 [xe]
Call Trace:
<TASK>
? show_regs+0x67/0x70
? __warn+0x94/0x1b0
? xe_pm_runtime_get_noresume+0x48/0x60 [xe]
? report_bug+0x1b7/0x1d0
? handle_bug+0x46/0x80
? exc_invalid_op+0x19/0x70
? asm_exc_invalid_op+0x1b/0x20
? xe_pm_runtime_get_noresume+0x48/0x60 [xe]
xe_device_declare_wedged+0x91/0x280 [xe]
gt_reset_worker+0xa2/0x250 [xe]
v2: Also move get and get the right Fixes tag (Himal, Brost)
Fixes: fb74b205cdhimal.prasad.ghimiray@intel.com >
Cc: Matthew Brost <matthew.brost@intel.com >
Reviewed-by: Jonathan Cavitt <jonathan.cavitt@intel.com >
Reviewed-by: Himal Prasad Ghimiray <himal.prasad.ghimiray@intel.com >
Link: https://patchwork.freedesktop.org/patch/msgid/20240830183507.298351-1-rodrigo.vivi@intel.com
Signed-off-by: Rodrigo Vivi <rodrigo.vivi@intel.com >
(cherry picked from commit bc947d9a8crodrigo.vivi@intel.com >
2024-09-04 12:16:40 -04:00
Matt Roper
fe13fd6833
drm/xe/pcode: Treat pcode as per-tile rather than per-GT
...
There's only one instance of the pcode per tile, and for GT-related
accesses both the primary and media GT share the same register
interface. Since Xe was using per-GT locking, the pcode mutex wasn't
actually protecting everything that it should since concurrent accesses
related to a tile's primary GT and media GT were possible.
Fixes: dd08ebf6c3matthew.d.roper@intel.com >
Reviewed-by: Lucas De Marchi <lucas.demarchi@intel.com >
Link: https://patchwork.freedesktop.org/patch/msgid/20240829220619.789159-5-matthew.d.roper@intel.com
(cherry picked from commit 3034cc8107rodrigo.vivi@intel.com >
2024-09-03 10:36:46 -04:00
Daniele Ceraolo Spurio
529bf8d111
drm/xe/gsc: Do not attempt to load the GSC multiple times
...
The GSC HW is only reset by driver FLR or D3cold entry. We don't support
the former at runtime, while the latter is only supported on DGFX, for
which we don't support GSC. Therefore, if GSC failed to load previously
there is no need to try again because the HW is stuck in the error state.
An assert has been added so that if we ever add DGFX support we'll know
we need to handle the D3 case.
v2: use "< 0" instead of "!= 0" in the FW state error check (Julia).
Fixes: dd0e89e5eddaniele.ceraolospurio@intel.com >
Cc: John Harrison <John.C.Harrison@Intel.com >
Cc: Alan Previn <alan.previn.teres.alexis@intel.com >
Cc: <stable@vger.kernel.org > # v6.8+
Reviewed-by: Julia Filipchuk <julia.filipchuk@intel.com >
Link: https://patchwork.freedesktop.org/patch/msgid/20240828215158.2743994-2-daniele.ceraolospurio@intel.com
(cherry picked from commit 2160f6f6e3rodrigo.vivi@intel.com >
2024-09-03 10:36:38 -04:00
Karthik Poosa
59d237c8a2
drm/xe/hwmon: Fix WRITE_I1 param from u32 to u16
...
WRITE_I1 sub-command of the POWER_SETUP pcode command accepts a u16
parameter instead of u32. This change prevents potential illegal
sub-command errors.
v2: Mask uval instead of changing the prototype. (Badal)
v3: Rephrase commit message. (Badal)
Signed-off-by: Karthik Poosa <karthik.poosa@intel.com >
Fixes: 92d44a422dbadal.nilawar@intel.com >
Link: https://patchwork.freedesktop.org/patch/msgid/20240827155301.183383-1-karthik.poosa@intel.com
Signed-off-by: Rodrigo Vivi <rodrigo.vivi@intel.com >
(cherry picked from commit a7f657097erodrigo.vivi@intel.com >
2024-08-29 09:44:00 -04:00
Matthew Brost
1eb52589a2
drm/xe: Invalidate media_gt TLBs
...
Testing on LNL has shown media TLBs need to be invalidated via the GuC,
update xe_vm_invalidate_vma appropriately.
v2: Fix 2 tile case
v3: Include missing local change
Fixes: 3330361543matthew.brost@intel.com >
Reviewed-by: Himal Prasad Ghimiray <himal.prasad.ghimiray@intel.com >
Link: https://patchwork.freedesktop.org/patch/msgid/20240820160129.986889-1-matthew.brost@intel.com
(cherry picked from commit 77cc3f6c58rodrigo.vivi@intel.com >
2024-08-27 09:31:28 -04:00
Matthew Brost
9e7f305636
drm/xe: Free job before xe_exec_queue_put
...
Free job depends on job->vm being valid, the last xe_exec_queue_put can
destroy the VM. Prevent UAF by freeing job before xe_exec_queue_put.
Fixes: dd08ebf6c3matthew.brost@intel.com >
Reviewed-by: Nirmoy Das <nirmoy.das@intel.com >
Reviewed-by: Jagmeet Randhawa <jagmeet.randhawa@intel.com >
Link: https://patchwork.freedesktop.org/patch/msgid/20240820202309.1260755-1-matthew.brost@intel.com
(cherry picked from commit 32a42c93b7rodrigo.vivi@intel.com >
2024-08-21 11:53:15 -04:00
Matthew Brost
dd3e840a33
drm/xe: Drop HW fence pointer to HW fence ctx
...
The HW fence ctx objects are not ref counted rather tied to the life of
an LRC object. HW fences reference the HW fence ctx, HW fences can
outlive LRCs thus resulting in UAF. Drop the HW fence pointer to HW
fence ctx rather just store what is needed directly in HW fence.
v2:
- Fix typo in commit (Ashutosh)
- Use snprintf (Ashutosh)
Fixes: dd08ebf6c3matthew.brost@intel.com >
Reviewed-by: Ashutosh Dixit <ashutosh.dixit@intel.com >
Link: https://patchwork.freedesktop.org/patch/msgid/20240815193522.16008-1-matthew.brost@intel.com
(cherry picked from commit 60db6f540arodrigo.vivi@intel.com >
2024-08-21 11:53:12 -04:00
Stuart Summers
a6f78359ac
drm/xe: Fix missing workqueue destroy in xe_gt_pagefault
...
On driver reload we never free up the memory for the pagefault and
access counter workqueues. Add those destroy calls here.
Fixes: dd08ebf6c3stuart.summers@intel.com >
Reviewed-by: Rodrigo Vivi <rodrigo.vivi@intel.com >
Signed-off-by: Matthew Brost <matthew.brost@intel.com >
Link: https://patchwork.freedesktop.org/patch/msgid/c9a951505271dc3a7aee76de7656679f69c11518.1723862633.git.stuart.summers@intel.com
(cherry picked from commit 7586fc52b1rodrigo.vivi@intel.com >
2024-08-21 11:53:02 -04:00
Daniele Ceraolo Spurio
a06a7b3429
drm/xe/uc: Use devm to register cleanup that includes exec_queues
...
Exec_queue cleanup requires HW access, so we need to use devm instead of
drmm for it.
Signed-off-by: Daniele Ceraolo Spurio <daniele.ceraolospurio@intel.com >
Cc: John Harrison <John.C.Harrison@Intel.com >
Cc: Alan Previn <alan.previn.teres.alexis@intel.com >
Reviewed-by: Matthew Brost <matthew.brost@intel.com >
Reviewed-by: Lucas De Marchi <lucas.demarchi@intel.com >
Reviewed-by: Matthew Auld <matthew.auld@intel.com >
Link: https://patchwork.freedesktop.org/patch/msgid/20240815230541.3828206-2-lucas.demarchi@intel.com
Signed-off-by: Lucas De Marchi <lucas.demarchi@intel.com >
(cherry picked from commit 5a891a0e69rodrigo.vivi@intel.com >
2024-08-19 13:38:42 -04:00
Daniele Ceraolo Spurio
8636a5c29b
drm/xe: use devm instead of drmm for managed bo
...
The BO cleanup touches the GGTT and therefore requires the HW to be
available, so we need to use devm instead of drmm.
Closes: https://gitlab.freedesktop.org/drm/xe/kernel/-/issues/1160
Signed-off-by: Daniele Ceraolo Spurio <daniele.ceraolospurio@intel.com >
Cc: Lucas De Marchi <lucas.demarchi@intel.com >
Cc: Matthew Auld <matthew.auld@intel.com >
Reviewed-by: Matthew Auld <matthew.auld@intel.com >
Reviewed-by: Lucas De Marchi <lucas.demarchi@intel.com >
Link: https://patchwork.freedesktop.org/patch/msgid/20240809231237.1503796-2-daniele.ceraolospurio@intel.com
Signed-off-by: Lucas De Marchi <lucas.demarchi@intel.com >
(cherry picked from commit 8d3a2d3d76rodrigo.vivi@intel.com >
2024-08-19 13:37:50 -04:00
Tejas Upadhyay
8776b0234e
drm/xe/xe2hpg: Add Wa_14021821874
...
Wa_14021821874 applies to xe2_hpg
V2(Himal):
- Use space after define
Cc: Matt Roper <matthew.d.roper@intel.com >
Reviewed-by: Himal Prasad Ghimiray <himal.prasad.ghimiray@intel.com >
Signed-off-by: Tejas Upadhyay <tejas.upadhyay@intel.com >
Reviewed-by: Matt Roper <matthew.d.roper@intel.com >
Signed-off-by: Matt Roper <matthew.d.roper@intel.com >
Link: https://patchwork.freedesktop.org/patch/msgid/20240812134117.813670-1-tejas.upadhyay@intel.com
(cherry picked from commit 21ff3a16e9rodrigo.vivi@intel.com >
2024-08-19 13:34:58 -04:00
Daniele Ceraolo Spurio
f5cb1275c8
drm/xe: fix WA 14018094691
...
This WA is applied while initializing the media GT, but it a primary
GT WA (because it modifies a register on the primary GT), so the XE_WA
macro is returning false even when the WA should be applied.
Fix this by using the primary GT in the macro.
Note that this WA only applies to PXP and we don't yet support that in
Xe, so there are no negative effects to this bug, which is why we didn't
see any errors in testing.
v2: use the primary GT in the macro instead of marking the WA as
platform-wide (Lucas, Matt).
Signed-off-by: Daniele Ceraolo Spurio <daniele.ceraolospurio@intel.com >
Cc: Matt Roper <matthew.d.roper@intel.com >
Cc: Lucas De Marchi <lucas.demarchi@intel.com >
Reviewed-by: Matt Roper <matthew.d.roper@intel.com >
Reviewed-by: Lucas De Marchi <lucas.demarchi@intel.com >
Link: https://patchwork.freedesktop.org/patch/msgid/20240807235333.1370915-1-daniele.ceraolospurio@intel.com
(cherry picked from commit e422c0bfd9rodrigo.vivi@intel.com >
2024-08-19 13:34:05 -04:00
Tejas Upadhyay
cbc6e98ab1
drm/xe/xe2: Add Wa_15015404425
...
Wa_15015404425 asks us to perform four "dummy" writes to a
non-existent register offset before every real register read.
Although the specific offset of the writes doesn't directly
matter, the workaround suggests offset 0x130030 as a good target
so that these writes will be easy to recognize and filter out in
debugging traces.
V5(MattR):
- Avoid negating an equality comparison
V4(MattR):
- Use writel and remove xe_reg usage
V3(MattR):
- Define dummy reg local to function
- Avoid tracing dummy writes
- Update commit message
V2:
- Add WA to 8/16/32bit reads also - MattR
- Corrected dummy reg address - MattR
- Use for loop to avoid mental pause - JaniN
Reviewed-by: Matt Roper <matthew.d.roper@intel.com >
Signed-off-by: Tejas Upadhyay <tejas.upadhyay@intel.com >
Signed-off-by: Matt Roper <matthew.d.roper@intel.com >
Link: https://patchwork.freedesktop.org/patch/msgid/20240709155606.2998941-1-tejas.upadhyay@intel.com
(cherry picked from commit 86c5b70a9crodrigo.vivi@intel.com >
2024-08-19 13:30:47 -04:00
Tejas Upadhyay
7e81285380
drm/xe/xe2: Make subsequent L2 flush sequential
...
Issuing the flush on top of an ongoing flush is not desirable.
Lets use lock to make it sequential.
Reviewed-by: Nirmoy Das <nirmoy.das@intel.com >
Signed-off-by: Tejas Upadhyay <tejas.upadhyay@intel.com >
Link: https://patchwork.freedesktop.org/patch/msgid/20240710052750.3031586-1-tejas.upadhyay@intel.com
Signed-off-by: Nirmoy Das <nirmoy.das@intel.com >
(cherry picked from commit 71733b8d7frodrigo.vivi@intel.com >
2024-08-19 13:30:47 -04:00
Bommu Krishnaiah
b196e6fcc7
drm/xe/xe2lpg: Extend workaround 14021402888
...
workaround 14021402888 also applies to Xe2_LPG.
Replicate the existing entry to one specific for Xe2_LPG.
Signed-off-by: Bommu Krishnaiah <krishnaiah.bommu@intel.com >
Cc: Tejas Upadhyay <tejas.upadhyay@intel.com >
Cc: Matt Roper <matthew.d.roper@intel.com >
Cc: Himal Prasad Ghimiray <himal.prasad.ghimiray@intel.com >
Reviewed-by: Matt Roper <matthew.d.roper@intel.com >
Link: https://patchwork.freedesktop.org/patch/msgid/20240703090754.1323647-1-krishnaiah.bommu@intel.com
Signed-off-by: Lucas De Marchi <lucas.demarchi@intel.com >
(cherry picked from commit 56ab698699rodrigo.vivi@intel.com >
2024-08-19 13:30:41 -04:00
Ngai-Mint Kwan
03a2dc84f5
drm/xe/xe2lpm: Extend Wa_16021639441
...
Wa_16021639441 applies to Xe2_LPM.
Signed-off-by: Ngai-Mint Kwan <ngai-mint.kwan@linux.intel.com >
Reviewed-by: Matt Roper <matthew.d.roper@intel.com >
Signed-off-by: Matt Roper <matthew.d.roper@intel.com >
Link: https://patchwork.freedesktop.org/patch/msgid/20240701184637.531794-1-ngai-mint.kwan@linux.intel.com
(cherry picked from commit 74e3076800rodrigo.vivi@intel.com >
2024-08-19 13:30:41 -04:00
Matthew Auld
27cb2b7fec
drm/xe/bmg: implement Wa_16023588340
...
This involves enabling l2 caching of host side memory access to VRAM
through the CPU BAR. The main fallout here is with display since VRAM
writes from CPU can now be cached in GPU l2, and display is never
coherent with caches, so needs various manual flushing. In the case of
fbc we disable it due to complications in getting this to work
correctly (in a later patch).
Signed-off-by: Matthew Auld <matthew.auld@intel.com >
Cc: Jonathan Cavitt <jonathan.cavitt@intel.com >
Cc: Matt Roper <matthew.d.roper@intel.com >
Cc: Lucas De Marchi <lucas.demarchi@intel.com >
Cc: Vinod Govindapillai <vinod.govindapillai@intel.com >
Reviewed-by: Jonathan Cavitt <jonathan.cavitt@intel.com >
Link: https://patchwork.freedesktop.org/patch/msgid/20240703124338.208220-3-matthew.auld@intel.com
(cherry picked from commit 01570b4469rodrigo.vivi@intel.com >
2024-08-19 13:30:41 -04:00
Maarten Lankhorst
ddf6492e0e
drm/xe/display: Make display suspend/resume work on discrete
...
We should unpin before evicting all memory, and repin after GT resume.
This way, we preserve the contents of the framebuffers, and won't hang
on resume due to migration engine not being restored yet.
Signed-off-by: Maarten Lankhorst <maarten.lankhorst@linux.intel.com >
Fixes: dd08ebf6c3stable@vger.kernel.org # v6.8+
Reviewed-by: Uma Shankar <uma.shankar@intel.com >
Link: https://patchwork.freedesktop.org/patch/msgid/20240806105044.596842-3-maarten.lankhorst@linux.intel.com
Signed-off-by: Maarten Lankhorst,,, <maarten.lankhorst@linux.intel.com >
(cherry picked from commit cb8f81c175rodrigo.vivi@intel.com >
2024-08-19 10:39:36 -04:00
Matthew Auld
730b72480e
drm/xe: prevent UAF around preempt fence
...
The fence lock is part of the queue, therefore in the current design
anything locking the fence should then also hold a ref to the queue to
prevent the queue from being freed.
However, currently it looks like we signal the fence and then drop the
queue ref, but if something is waiting on the fence, the waiter is
kicked to wake up at some later point, where upon waking up it first
grabs the lock before checking the fence state. But if we have already
dropped the queue ref, then the lock might already be freed as part of
the queue, leading to uaf.
To prevent this, move the fence lock into the fence itself so we don't
run into lifetime issues. Alternative might be to have device level
lock, or only release the queue in the fence release callback, however
that might require pushing to another worker to avoid locking issues.
Fixes: dd08ebf6c3https://gitlab.freedesktop.org/drm/xe/kernel/-/issues/2454
References: https://gitlab.freedesktop.org/drm/xe/kernel/-/issues/2342
References: https://gitlab.freedesktop.org/drm/xe/kernel/-/issues/2020
Signed-off-by: Matthew Auld <matthew.auld@intel.com >
Cc: Matthew Brost <matthew.brost@intel.com >
Cc: <stable@vger.kernel.org > # v6.8+
Reviewed-by: Matthew Brost <matthew.brost@intel.com >
Link: https://patchwork.freedesktop.org/patch/msgid/20240814110129.825847-2-matthew.auld@intel.com
(cherry picked from commit 7116c35aacrodrigo.vivi@intel.com >
2024-08-19 10:39:28 -04:00
Matthew Brost
15939ca77d
drm/xe: Fix tile fini sequence
...
Only set tile->mmio.regs to NULL if not the root tile in tile_fini. The
root tile mmio regs is setup ealier in MMIO init thus it should be set
to NULL in mmio_fini.
Fixes: dd08ebf6c3matthew.brost@intel.com >
Reviewed-by: Lucas De Marchi <lucas.demarchi@intel.com >
Reviewed-by: Himal Prasad Ghimiray <himal.prasad.ghimiray@intel.com >
Link: https://patchwork.freedesktop.org/patch/msgid/20240809232830.3302251-1-matthew.brost@intel.com
(cherry picked from commit 3396900aa2rodrigo.vivi@intel.com >
2024-08-19 10:39:11 -04:00
Matthew Brost
7090d7fc96
drm/xe: Move VM dma-resv lock from xe_exec_queue_create to __xe_exec_queue_init
...
The critical section which requires the VM dma-resv is the call
xe_lrc_create in __xe_exec_queue_init. Move this lock to
__xe_exec_queue_init holding it just around xe_lrc_create. Not only is
good practice, this also fixes a locking double of the VM dma-resv in
the error paths of __xe_exec_queue_init as xe_lrc_put tries to acquire
this too resulting in a deadlock.
Fixes: dd08ebf6c3maarten.lankhorst@linux.intel.com >
Signed-off-by: Matthew Brost <matthew.brost@intel.com >
Reviewed-by: Maarten Lankhorst <maarten.lankhorst@linux.intel.com >
Link: https://patchwork.freedesktop.org/patch/msgid/20240724152831.1848325-1-matthew.brost@intel.com
(cherry picked from commit 549dd786b6rodrigo.vivi@intel.com >
2024-08-19 10:39:04 -04:00
Ashutosh Dixit
c621f70539
drm/xe/observation: Drop empty sysctl table entry
...
An empty sysctl table entry was inadvertently left behind for observation
sysctl. The breaks on 6.11 with the following errors:
[ 219.654850] sysctl table check failed: dev/xe/(null) procname is null
[ 219.654862] sysctl table check failed: dev/xe/(null) No proc_handler
Drop the empty entry.
Fixes: 63347fe031https://gitlab.freedesktop.org/drm/xe/kernel/-/issues/2419
Signed-off-by: Ashutosh Dixit <ashutosh.dixit@intel.com >
Reviewed-by: Umesh Nerlige Ramappa <umesh.nerlige.ramappa@intel.com >
Link: https://patchwork.freedesktop.org/patch/msgid/20240805062057.3547560-1-ashutosh.dixit@intel.com
(cherry picked from commit be1dec570brodrigo.vivi@intel.com >
2024-08-19 10:38:58 -04:00
Lucas De Marchi
f4b2a0ae1a
drm/xe: Fix opregion leak
...
Being part o the display, ideally the setup and cleanup would be done by
display itself. However this is a bigger refactor that needs to be done
on both i915 and xe. For now, just fix the leak:
unreferenced object 0xffff8881a0300008 (size 192):
comm "modprobe", pid 4354, jiffies 4295647021
hex dump (first 32 bytes):
00 00 87 27 81 88 ff ff 18 80 9b 00 00 c9 ff ff ...'............
18 81 9b 00 00 c9 ff ff 00 00 00 00 00 00 00 00 ................
backtrace (crc 99260e31):
[<ffffffff823ce65b>] kmemleak_alloc+0x4b/0x80
[<ffffffff81493be2>] kmalloc_trace_noprof+0x312/0x3d0
[<ffffffffa1345679>] intel_opregion_setup+0x89/0x700 [xe]
[<ffffffffa125bfaf>] xe_display_init_noirq+0x2f/0x90 [xe]
[<ffffffffa1199ec3>] xe_device_probe+0x7a3/0xbf0 [xe]
[<ffffffffa11f3713>] xe_pci_probe+0x333/0x5b0 [xe]
[<ffffffff81af6be8>] local_pci_probe+0x48/0xb0
[<ffffffff81af8778>] pci_device_probe+0xc8/0x280
[<ffffffff81d09048>] really_probe+0xf8/0x390
[<ffffffff81d0937a>] __driver_probe_device+0x8a/0x170
[<ffffffff81d09503>] driver_probe_device+0x23/0xb0
[<ffffffff81d097b7>] __driver_attach+0xc7/0x190
[<ffffffff81d0628d>] bus_for_each_dev+0x7d/0xd0
[<ffffffff81d0851e>] driver_attach+0x1e/0x30
[<ffffffff81d07ac7>] bus_add_driver+0x117/0x250
Fixes: 44e694958brodrigo.vivi@intel.com >
Link: https://patchwork.freedesktop.org/patch/msgid/20240724215309.644423-1-lucas.demarchi@intel.com
Signed-off-by: Lucas De Marchi <lucas.demarchi@intel.com >
(cherry picked from commit 6f4e43a2f7rodrigo.vivi@intel.com >
2024-08-19 10:38:51 -04:00
Matthew Brost
f002702290
drm/xe: Hold a PM ref when GT TLB invalidations are inflight
...
Avoid GT TLB invalidation timeouts by holding a PM ref when
invalidations are inflight.
v2:
- Drop PM ref before signaling fence (CI)
v3:
- Move invalidation_fence_signal helper in tlb timeout to previous
patch (Matthew Auld)
Fixes: dd08ebf6c3rodrigo.vivi@intel.com >
Cc: Nirmoy Das <nirmoy.das@intel.com >
Signed-off-by: Matthew Brost <matthew.brost@intel.com >
Reviewed-by: Nirmoy Das <nirmoy.das@intel.com >
Link: https://patchwork.freedesktop.org/patch/msgid/20240719172905.1527927-4-matthew.brost@intel.com
(cherry picked from commit 0a382f9bc5rodrigo.vivi@intel.com >
2024-08-15 09:44:22 -04:00
Matthew Brost
58bfe66744
drm/xe: Drop xe_gt_tlb_invalidation_wait
...
Having two methods to wait on GT TLB invalidations is not ideal. Remove
xe_gt_tlb_invalidation_wait and only use GT TLB invalidation fences.
In addition to two methods being less than ideal, once GT TLB
invalidations are coalesced the seqno cannot be assigned during
xe_gt_tlb_invalidation_ggtt/range. Thus xe_gt_tlb_invalidation_wait
would not have a seqno to wait one. A fence however can be armed and
later signaled.
v3:
- Add explaination about coalescing to commit message
v4:
- Don't put dma fence if defined on stack (CI)
v5:
- Initialize ret to zero (CI)
v6:
- Use invalidation_fence_signal helper in tlb timeout (Matthew Auld)
Signed-off-by: Matthew Brost <matthew.brost@intel.com >
Reviewed-by: Nirmoy Das <nirmoy.das@intel.com >
Link: https://patchwork.freedesktop.org/patch/msgid/20240719172905.1527927-3-matthew.brost@intel.com
(cherry picked from commit 61ac035361rodrigo.vivi@intel.com >
2024-08-15 09:44:22 -04:00
Matthew Brost
90be4cc6f7
drm/xe: Add xe_gt_tlb_invalidation_fence_init helper
...
Other layers should not be touching struct xe_gt_tlb_invalidation_fence
directly, add helper for initialization.
v2:
- Add dma_fence_get and list init to xe_gt_tlb_invalidation_fence_init
Signed-off-by: Matthew Brost <matthew.brost@intel.com >
Reviewed-by: Nirmoy Das <nirmoy.das@intel.com >
Link: https://patchwork.freedesktop.org/patch/msgid/20240719172905.1527927-2-matthew.brost@intel.com
(cherry picked from commit a522b285c6rodrigo.vivi@intel.com >
2024-08-15 09:44:22 -04:00
Michal Wajdeczko
4f7652dcd3
drm/xe/pf: Fix VF config validation on multi-GT platforms
...
When validating VF config on the media GT, we may wrongly report
that VF is already partially configured on it, as we consider GGTT
and LMEM provisioning done on the primary GT (since both GGTT and
LMEM are tile-level resources, not a GT-level).
This will cause skipping a VF auto-provisioning on the media-GT and
in result will block a VF from successfully initialize that GT.
Fix that by considering GGTT and LMEM configurations only when
checking if a VF provisioning is complete, and omit GGTT and LMEM
when reporting empty/partial provisioning.
Fixes: 234670cea9michal.wajdeczko@intel.com >
Cc: Piotr Piórkowski <piotr.piorkowski@intel.com >
Reviewed-by: Jonathan Cavitt <jonathan.cavitt@intel.com >
Link: https://patchwork.freedesktop.org/patch/msgid/20240806180516.618-1-michal.wajdeczko@intel.com
(cherry picked from commit 5bdacb0907rodrigo.vivi@intel.com >
2024-08-15 09:44:22 -04:00
Matthew Brost
55ea73aacf
drm/xe: Build PM into GuC CT layer
...
Take PM ref when any G2H are outstanding, drop when none are
outstanding.
To safely ensure we have PM ref when in the GuC CT layer, a PM ref needs
to be held when scheduler messages are pending too.
v2:
- Add outer PM protections to xe_file_close (CI)
v3:
- Only take PM ref 0->1 and drop on 1->0 (Matthew Auld)
v4:
- Add assert to G2H increment function
v5:
- Rebase
v6:
- Declare xe as local variable in xe_file_close (CI)
Fixes: dd08ebf6c3matthew.auld@intel.com >
Cc: Rodrigo Vivi <rodrigo.vivi@intel.com >
Cc: Nirmoy Das <nirmoy.das@intel.com >
Signed-off-by: Matthew Brost <matthew.brost@intel.com >
Reviewed-by: Matthew Auld <matthew.auld@intel.com >
Reviewed-by: Nirmoy Das <nirmoy.das@intel.com >
Link: https://patchwork.freedesktop.org/patch/msgid/20240719172905.1527927-5-matthew.brost@intel.com
(cherry picked from commit d930c19fdfrodrigo.vivi@intel.com >
2024-08-15 09:44:22 -04:00
Michal Wajdeczko
64da63cd3f
drm/xe/vf: Fix register value lookup
...
We should use the number of actual entries stored in the runtime
register buffer, not the maximum number of entries that this buffer
can hold, otherwise bsearch() may fail and we may miss the data and
wrongly report unexpected access to some registers.
Fixes: 4edadc41a3michal.wajdeczko@intel.com >
Cc: Piotr Piórkowski <piotr.piorkowski@intel.com >
Cc: Matt Roper <matthew.d.roper@intel.com >
Reviewed-by: Matt Roper <matthew.d.roper@intel.com >
Link: https://patchwork.freedesktop.org/patch/msgid/20240718203155.486-1-michal.wajdeczko@intel.com
(cherry picked from commit ad16682db1rodrigo.vivi@intel.com >
2024-08-15 09:44:22 -04:00
Umesh Nerlige Ramappa
817c70e2ba
drm/xe: Fix use after free when client stats are captured
...
xe_file_close triggers an asynchronous queue cleanup and then frees up
the xef object. Since queue cleanup flushes all pending jobs and the KMD
stores client usage stats into the xef object after jobs are flushed, we
see a use-after-free for the xef object. Resolve this by taking a
reference to xef from xe_exec_queue.
While at it, revert an earlier change that contained a partial work
around for this issue.
v2:
- Take a ref to xef even for the VM bind queue (Matt)
- Squash patches relevant to that fix and work around (Lucas)
v3: Fix typo (Lucas)
Fixes: ce62827bc26109f24f87https://gitlab.freedesktop.org/drm/xe/kernel/issues/1908
Signed-off-by: Umesh Nerlige Ramappa <umesh.nerlige.ramappa@intel.com >
Reviewed-by: Matthew Brost <matthew.brost@intel.com >
Reviewed-by: Lucas De Marchi <lucas.demarchi@intel.com >
Link: https://patchwork.freedesktop.org/patch/msgid/20240718210548.3580382-5-umesh.nerlige.ramappa@intel.com
Signed-off-by: Lucas De Marchi <lucas.demarchi@intel.com >
(cherry picked from commit 2149ded630rodrigo.vivi@intel.com >
2024-08-15 09:44:22 -04:00
Umesh Nerlige Ramappa
6309f9b1fc
drm/xe: Take a ref to xe file when user creates a VM
...
Take a reference to xef when user creates the VM and put the reference
when user destroys the VM.
Signed-off-by: Umesh Nerlige Ramappa <umesh.nerlige.ramappa@intel.com >
Reviewed-by: Matthew Brost <matthew.brost@intel.com >
Reviewed-by: Lucas De Marchi <lucas.demarchi@intel.com >
Link: https://patchwork.freedesktop.org/patch/msgid/20240718210548.3580382-4-umesh.nerlige.ramappa@intel.com
Signed-off-by: Lucas De Marchi <lucas.demarchi@intel.com >
(cherry picked from commit a2387e6949rodrigo.vivi@intel.com >
2024-08-15 09:44:21 -04:00
Umesh Nerlige Ramappa
d28bb0120f
drm/xe: Add ref counting for xe_file
...
Add ref counting for xe_file.
v2:
- Add kernel doc for exported functions (Matt)
- Instead of xe_file_destroy, export the get/put helpers (Lucas)
v3: Fixup the kernel-doc format and description (Matt, Lucas)
Signed-off-by: Umesh Nerlige Ramappa <umesh.nerlige.ramappa@intel.com >
Reviewed-by: Matthew Brost <matthew.brost@intel.com >
Link: https://patchwork.freedesktop.org/patch/msgid/20240718210548.3580382-3-umesh.nerlige.ramappa@intel.com
Signed-off-by: Lucas De Marchi <lucas.demarchi@intel.com >
(cherry picked from commit ce8c161cbarodrigo.vivi@intel.com >
2024-08-15 09:44:21 -04:00
Umesh Nerlige Ramappa
e98a032c03
drm/xe: Move part of xe_file cleanup to a helper
...
In order to make xe_file ref counted, move destruction of xe_file
members to a helper.
v2: Move xe_vm_close_and_put back into xe_file_close (Matt)
Signed-off-by: Umesh Nerlige Ramappa <umesh.nerlige.ramappa@intel.com >
Reviewed-by: Matthew Brost <matthew.brost@intel.com >
Reviewed-by: Lucas De Marchi <lucas.demarchi@intel.com >
Link: https://patchwork.freedesktop.org/patch/msgid/20240718210548.3580382-2-umesh.nerlige.ramappa@intel.com
Signed-off-by: Lucas De Marchi <lucas.demarchi@intel.com >
(cherry picked from commit 3d0c4a62ccrodrigo.vivi@intel.com >
2024-08-15 09:44:21 -04:00
Matthew Brost
ddeb7989a9
drm/xe: Validate user fence during creation
...
Fail invalid addresses during user fence creation.
Fixes: dd08ebf6c3matthew.brost@intel.com >
Reviewed-by: Thomas Hellström <thomas.hellstrom@linux.intel.com >
Reviewed-by: Nirmoy Das <nirmoy.das@intel.com >
Link: https://patchwork.freedesktop.org/patch/msgid/20240717140429.1396820-1-matthew.brost@intel.com
(cherry picked from commit 0fde907da2rodrigo.vivi@intel.com >
2024-08-15 09:44:21 -04:00
Dave Airlie
fe0ce0d622
Merge tag 'drm-xe-fixes-2024-08-08' of https://gitlab.freedesktop.org/drm/xe/kernel into drm-fixes
...
- Fix off-by-one when processing RTP rules (Lucas)
- Use dma_fence_chain_free in chain fence unused as a sync (Brost)
- Fix PL1 disable flow in xe_hwmon_power_max_write (Karthik)
- Take ref to VM in delayed dump snapshot (Brost)
Signed-off-by: Dave Airlie <airlied@redhat.com >
From: Rodrigo Vivi <rodrigo.vivi@intel.com >
Link: https://patchwork.freedesktop.org/patch/msgid/ZrUGgVrgTJ_vF2PS@intel.com
2024-08-09 17:09:06 +10:00
Matthew Brost
642dfc9d59
drm/xe: Take ref to VM in delayed snapshot
...
Kernel BO's don't take a ref to the VM, we need the VM for the
delayed snapshot, so take a ref to the VM in delayed snapshot.
v2:
- Check for lrc_bo before taking a VM ref (CI)
- Check lrc_bo->vm before taking / dropping a VM ref (CI)
- Drop VM in xe_lrc_snapshot_free
v5:
- Fix commit message wording (Johnathan)
Fixes: 47058633d9maarten.lankhorst@linux.intel.com >
Signed-off-by: Matthew Brost <matthew.brost@intel.com >
Reviewed-by: Jonathan Cavitt <jonathan.cavitt@intel.com >
Link: https://patchwork.freedesktop.org/patch/msgid/20240801154118.2547543-2-matthew.brost@intel.com
(cherry picked from commit c3bc97d2f1rodrigo.vivi@intel.com >
2024-08-08 13:48:01 -04:00
Karthik Poosa
ac3191c5cf
drm/xe/hwmon: Fix PL1 disable flow in xe_hwmon_power_max_write
...
In xe_hwmon_power_max_write, for PL1 disable supported case, instead of
returning after PL1 disable, PL1 enable path was also being run.
Fixed it by returning after disable.
v2: Correct typo and grammar in commit message. (Jonathan)
Signed-off-by: Karthik Poosa <karthik.poosa@intel.com >
Fixes: fef6dd12b4jonathan.cavitt@intel.com >
Signed-off-by: Matt Roper <matthew.d.roper@intel.com >
Link: https://patchwork.freedesktop.org/patch/msgid/20240801112424.1841766-1-karthik.poosa@intel.com
(cherry picked from commit 146458645erodrigo.vivi@intel.com >
2024-08-08 13:48:01 -04:00
Matthew Brost
4f854a8b1b
drm/xe: Use dma_fence_chain_free in chain fence unused as a sync
...
A chain fence is uninitialized if not installed in a drm sync obj. Thus
if xe_sync_entry_cleanup is called and sync->chain_fence is non-NULL the
proper cleanup is dma_fence_chain_free rather than a dma-fence put.
Reported-by: Paulo Zanoni <paulo.r.zanoni@intel.com >
Closes: https://gitlab.freedesktop.org/drm/xe/kernel/-/issues/2411
Closes: https://gitlab.freedesktop.org/drm/xe/kernel/-/issues/2261
Fixes: dd08ebf6c3matthew.brost@intel.com >
Reviewed-by: Matthew Auld <matthew.auld@intel.com >
Link: https://patchwork.freedesktop.org/patch/msgid/20240727012216.2118276-1-matthew.brost@intel.com
(cherry picked from commit 7f7a2da3bfrodrigo.vivi@intel.com >
2024-08-08 13:48:01 -04:00
Lucas De Marchi
ae02c7b7fe
drm/xe/rtp: Fix off-by-one when processing rules
...
Gustavo noticed an odd "+ 2" in rtp_mark_active() while processing
rtp rules and pointed that it should be "+ 1". In fact, while processing
entries without actions (OOB workarounds), if the WA is activated and
has OR rules, it will also inadvertently activate the very next
workaround.
Test in a LNL B0 platform by moving 18024947630 on top of 16020292621,
makes the latter become active:
$ cat /sys/kernel/debug/dri/0/gt0/workarounds
...
OOB Workarounds
18024947630
16020292621
14018094691
16022287689
13011645652
22019338487_display
In future a kunit test will be added to cover the rtp checks for entries
without actions.
Fixes: fe19328b90gustavo.sousa@intel.com >
Reviewed-by: Gustavo Sousa <gustavo.sousa@intel.com >
Link: https://patchwork.freedesktop.org/patch/msgid/20240726064337.797576-6-lucas.demarchi@intel.com
Signed-off-by: Lucas De Marchi <lucas.demarchi@intel.com >
(cherry picked from commit fd6797ec50rodrigo.vivi@intel.com >
2024-08-08 13:48:01 -04:00
