Skip to content

L
linux
Switch branch/tag
  1. 12 Jun, 2023 1 commit
  3. 10 Jun, 2023 1 commit
    • Nirmoy Das's avatar
      drm/i915: Fix a VMA UAF for multi-gt platform · f56fe3e9
      Nirmoy Das authored 
      Ensure correct handling of closed VMAs on multi-gt platforms to prevent
Use-After-Free. Currently, when GT0 goes idle, closed VMAs that are
exclusively added to GT0's closed_vma link (gt->closed_vma) and
subsequently freed by i915_vma_parked(), which assumes the entire GPU is
idle. However, on platforms with multiple GTs, such as MTL, GT1 may
remain active while GT0 is idle. This causes GT0 to mistakenly consider
the closed VMAs in its closed_vma list as unnecessary, potentially
leading to Use-After-Free issues if a job for GT1 attempts to access a
freed VMA.

Although we do take a wakeref for GT0 but it happens later, after
evaluating VMAs. To mitigate this, it is necessary to hold a GT0 wakeref
early.

v2: Use gt id to detect multi-tile(Andi)
    Fix the incorrect error path.
v3: Add more comment(Andi)
    Use the new gt var when possible(Andrzej)

Cc: Joonas Lahtinen <joonas.lahtinen@linux.intel.com>
Cc: Rodrigo Vivi <rodrigo.vivi@intel.com>
Cc: Tvrtko Ursulin <tvrtko.ursulin@linux.intel.com>
Cc: Thomas Hellström <thomas.hellstrom@linux.intel.com>
Cc: Chris Wilson <chris.p.wilson@intel.com>
Cc: Andi Shyti <andi.shyti@linux.intel.com>
Cc: Andrzej Hajda <andrzej.hajda@intel.com>
Cc: Sushma Venkatesh Reddy <sushma.venkatesh.reddy@intel.com>
Signed-off-by: default avatarNirmoy Das <nirmoy.das@intel.com>
Tested-by: default avatarAndi Shyti <andi.shyti@linux.intel.com>
Reviewed-by: default avatarAndi Shyti <andi.shyti@linux.intel.com>
Reviewed-by: default avatarAndrzej Hajda <andrzej.hajda@intel.com>
Tested-by: default avatarSushma Venkatesh Reddy <sushma.venkatesh.reddy@intel.com>
Link: https://patchwork.freedesktop.org/patch/msgid/20230608110103.777594-1-andi.shyti@linux.intel.com
      f56fe3e9
  5. 08 Jun, 2023 1 commit
  7. 07 Jun, 2023 3 commits
  9. 06 Jun, 2023 5 commits
  11. 05 Jun, 2023 9 commits
  13. 02 Jun, 2023 5 commits
    • Nathan Chancellor's avatar
      drm/i915/pxp: Fix size_t format specifier in gsccs_send_message() · 5c315434
      Nathan Chancellor authored 
      When building ARCH=i386 allmodconfig, the following warning occurs:

  In file included from include/linux/device.h:15,
                   from include/linux/node.h:18,
                   from include/linux/cpu.h:17,
                   from include/linux/static_call.h:135,
                   from arch/x86/include/asm/perf_event.h:5,
                   from include/linux/perf_event.h:25,
                   from drivers/gpu/drm/i915/i915_pmu.h:11,
                   from drivers/gpu/drm/i915/gt/intel_engine_types.h:21,
                   from drivers/gpu/drm/i915/gt/intel_context_types.h:18,
                   from drivers/gpu/drm/i915/gem/i915_gem_context_types.h:20,
                   from drivers/gpu/drm/i915/i915_request.h:34,
                   from drivers/gpu/drm/i915/i915_active.h:13,
                   from drivers/gpu/drm/i915/gt/intel_context.h:13,
                   from drivers/gpu/drm/i915/pxp/intel_pxp_gsccs.c:8:
  drivers/gpu/drm/i915/pxp/intel_pxp_gsccs.c: In function 'gsccs_send_message':
  include/drm/drm_print.h:456:39: error: format '%ld' expects argument of type 'long int', but argument 4 has type 'size_t' {aka 'unsigned int'} [-Werror=format=]
    456 |         dev_##level##type((drm)->dev, "[drm] " fmt, ##__VA_ARGS__)
        |                                       ^~~~~~~~
  include/linux/dev_printk.h:110:30: note: in definition of macro 'dev_printk_index_wrap'
    110 |                 _p_func(dev, fmt, ##__VA_ARGS__);                       \
        |                              ^~~
  include/linux/dev_printk.h:146:61: note: in expansion of macro 'dev_fmt'
    146 |         dev_printk_index_wrap(_dev_warn, KERN_WARNING, dev, dev_fmt(fmt), ##__VA_ARGS__)
        |                                                             ^~~~~~~
  include/drm/drm_print.h:456:9: note: in expansion of macro 'dev_warn'
    456 |         dev_##level##type((drm)->dev, "[drm] " fmt, ##__VA_ARGS__)
        |         ^~~~
  include/drm/drm_print.h:466:9: note: in expansion of macro '__drm_printk'
    466 |         __drm_printk((drm), warn,, fmt, ##__VA_ARGS__)
        |         ^~~~~~~~~~~~
  drivers/gpu/drm/i915/pxp/intel_pxp_gsccs.c:146:17: note: in expansion of macro 'drm_warn'
    146 |                 drm_warn(&i915->drm, "caller with insufficient PXP reply size %u (%ld)\n",
        |                 ^~~~~~~~
  cc1: all warnings being treated as errors

Use the '%zu' format specifier, as the variable is a 'size_t'.

Fixes: dc9ac125 ("drm/i915/pxp: Add GSC-CS backend to send GSC fw messages")
Signed-off-by: default avatarNathan Chancellor <nathan@kernel.org>
Reviewed-by: default avatarAndi Shyti <andi.shyti@linux.intel.com>
Signed-off-by: default avatarJani Nikula <jani.nikula@intel.com>
Link: https://patchwork.freedesktop.org/patch/msgid/20230530-i915-pxp-size_t-wformat-v1-1-9631081e2e5b@kernel.org
      5c315434
    • Andrzej Hajda's avatar
      drm/i915/gt: limit lmem allocation size to succeed on SmallBars · 4d4de1cb
      Andrzej Hajda authored 
      In case system is short on mappable memory (256MB on SmallBar) allocation
of two 1GB buffers will fail.

Closes: https://gitlab.freedesktop.org/drm/intel/-/issues/8300Signed-off-by: default avatarAndrzej Hajda <andrzej.hajda@intel.com>
Reviewed-by: default avatarAndi Shyti <andi.shyti@linux.intel.com>
Link: https://patchwork.freedesktop.org/patch/msgid/20230601144450.792228-1-andrzej.hajda@intel.com
      4d4de1cb
    • Dave Airlie's avatar
      Merge tag 'drm-misc-next-2023-06-01' of git://anongit.freedesktop.org/drm/drm-misc into drm-next · 2e149283
      Dave Airlie authored 
      drm-misc-next for v6.5:

UAPI Changes:

Cross-subsystem Changes:

 * fbdev:
   * Add Kconfig options and initializer macros for file I/O, convert
     DRM fbdev emulation

Core Changes:

 * Unify handling of struct file_operations.show_fdinfo

 * Use .probe in all i2c code (interface cleanup)

 * TTM:
   * Remove unused code

Driver Changes:

 * amdgpu:
   * Use shared show_fdinfo code
   * Fix building without procfs

 * bridge:
   * display-conenctor: Add support for external power supply
   * samsung-dsim: Fix enabling; Support variable clocking
   * tc358767: Fixes
   * ti-sn65dsi83: Fix enabling

 * msm:
   * Use shared show_fdinfo code

 * msxfb:
   * Add support for i.MX93 LCDIF

 * panel:
   * Add support for Ampire AM-800480L1TMQW-T00H plus DT bindings
   * panel-edp: Convert .remove to return void

 * stm:
   * dsi: Use devm_ helper
   * ltdc: Fix potential invalid pointer deref
Signed-off-by: default avatarDave Airlie <airlied@redhat.com>

From: Thomas Zimmermann <tzimmermann@suse.de>
Link: https://patchwork.freedesktop.org/patch/msgid/20230601112246.GA10882@linux-uq9g
      2e149283
    • Nathan Chancellor's avatar
      drm/i915/gt: Fix parameter in gmch_ggtt_insert_{entries, page}() · 1baeef6c
      Nathan Chancellor authored 
      When building with clang's -Wincompatible-function-pointer-types-strict,
the following warnings occur:

  drivers/gpu/drm/i915/gt/intel_ggtt_gmch.c:102:23: error: incompatible function pointer types assigning to 'void (*)(struct i915_address_space *, dma_addr_t, u64, unsigned int, u32)' (aka 'void (*)(struct i915_address_space *, unsigned int, unsigned long long, unsigned int, unsigned int)') from 'void (struct i915_address_space *, dma_addr_t, u64, enum i915_cache_level, u32)' (aka 'void (struct i915_address_space *, unsigned int, unsigned long long, enum i915_cache_level, unsigned int)') [-Werror,-Wincompatible-function-pointer-types-strict]
          ggtt->vm.insert_page = gmch_ggtt_insert_page;
                               ^ ~~~~~~~~~~~~~~~~~~~~~
  drivers/gpu/drm/i915/gt/intel_ggtt_gmch.c:103:26: error: incompatible function pointer types assigning to 'void (*)(struct i915_address_space *, struct i915_vma_resource *, unsigned int, u32)' (aka 'void (*)(struct i915_address_space *, struct i915_vma_resource *, unsigned int, unsigned int)') from 'void (struct i915_address_space *, struct i915_vma_resource *, enum i915_cache_level, u32)' (aka 'void (struct i915_address_space *, struct i915_vma_resource *, enum i915_cache_level, unsigned int)') [-Werror, -Wincompatible-function-pointer-types-strict]
          ggtt->vm.insert_entries = gmch_ggtt_insert_entries;
                                  ^ ~~~~~~~~~~~~~~~~~~~~~~~~
  2 errors generated.

The warning is pointing out that while 'enum i915_cache_level' and
'unsigned int' are ABI compatible, these indirect calls will fail
clang's kernel Control Flow Integrity (kCFI) checks, as the callback's
signature does not exactly match the prototype's signature.

To fix this, replace the cache_level parameter with pat_index, as was
done in other places within i915 where there is no difference between
cache_level and pat_index on certain generations.

Fixes: 9275277d ("drm/i915: use pat_index instead of cache_level")
Signed-off-by: default avatarNathan Chancellor <nathan@kernel.org>
Reviewed-by: default avatarAndi Shyti <andi.shyti@linux.intel.com>
Reviewed-by: default avatarFei Yang <fei.yang@intel.com>
Signed-off-by: default avatarAndi Shyti <andi.shyti@linux.intel.com>
Link: https://patchwork.freedesktop.org/patch/msgid/20230530-i915-gt-cache_level-wincompatible-function-pointer-types-strict-v1-2-54501d598229@kernel.org
      1baeef6c
    • Nathan Chancellor's avatar
      drm/i915/gt: Fix second parameter type of pre-gen8 pte_encode callbacks · 4722e2eb
      Nathan Chancellor authored 
      When booting a kernel compiled with CONFIG_CFI_CLANG (kCFI), there is a
CFI failure in ggtt_probe_common() when trying to call hsw_pte_encode()
via an indirect call:

  [    5.030027] CFI failure at ggtt_probe_common+0xd1/0x130 [i915] (target: hsw_pte_encode+0x0/0x30 [i915]; expected type: 0xf5c1d0fc)

With kCFI, indirect calls are validated against their expected type
versus actual type and failures occur when the two types do not match.

clang's -Wincompatible-function-pointer-types-strict can catch this at
compile time but it is not enabled for the kernel yet:

  drivers/gpu/drm/i915/gt/intel_ggtt.c:1155:23: error: incompatible function pointer types assigning to 'u64 (*)(dma_addr_t, unsigned int, u32)' (aka 'unsigned long long (*)(unsigned int, unsigned int, unsigned int)') from 'u64 (dma_addr_t,
  enum i915_cache_level, u32)' (aka 'unsigned long long (unsigned int, enum i915_cache_level, unsigned int)') [-Werror,-Wincompatible-function-pointer-types-strict]
                  ggtt->vm.pte_encode = iris_pte_encode;
                                      ^ ~~~~~~~~~~~~~~~
  drivers/gpu/drm/i915/gt/intel_ggtt.c:1157:23: error: incompatible function pointer types assigning to 'u64 (*)(dma_addr_t, unsigned int, u32)' (aka 'unsigned long long (*)(unsigned int, unsigned int, unsigned int)') from 'u64 (dma_addr_t,
  enum i915_cache_level, u32)' (aka 'unsigned long long (unsigned int, enum i915_cache_level, unsigned int)') [-Werror,-Wincompatible-function-pointer-types-strict]
                  ggtt->vm.pte_encode = hsw_pte_encode;
                                      ^ ~~~~~~~~~~~~~~
  drivers/gpu/drm/i915/gt/intel_ggtt.c:1159:23: error: incompatible function pointer types assigning to 'u64 (*)(dma_addr_t, unsigned int, u32)' (aka 'unsigned long long (*)(unsigned int, unsigned int, unsigned int)') from 'u64 (dma_addr_t,
  enum i915_cache_level, u32)' (aka 'unsigned long long (unsigned int, enum i915_cache_level, unsigned int)') [-Werror,-Wincompatible-function-pointer-types-strict]
                  ggtt->vm.pte_encode = byt_pte_encode;
                                      ^ ~~~~~~~~~~~~~~
  drivers/gpu/drm/i915/gt/intel_ggtt.c:1161:23: error: incompatible function pointer types assigning to 'u64 (*)(dma_addr_t, unsigned int, u32)' (aka 'unsigned long long (*)(unsigned int, unsigned int, unsigned int)') from 'u64 (dma_addr_t,
  enum i915_cache_level, u32)' (aka 'unsigned long long (unsigned int, enum i915_cache_level, unsigned int)') [-Werror,-Wincompatible-function-pointer-types-strict]
                  ggtt->vm.pte_encode = ivb_pte_encode;
                                      ^ ~~~~~~~~~~~~~~
  drivers/gpu/drm/i915/gt/intel_ggtt.c:1163:23: error: incompatible function pointer types assigning to 'u64 (*)(dma_addr_t, unsigned int, u32)' (aka 'unsigned long long (*)(unsigned int, unsigned int, unsigned int)') from 'u64 (dma_addr_t,
  enum i915_cache_level, u32)' (aka 'unsigned long long (unsigned int, enum i915_cache_level, unsigned int)') [-Werror,-Wincompatible-function-pointer-types-strict]
                  ggtt->vm.pte_encode = snb_pte_encode;
                                      ^ ~~~~~~~~~~~~~~
  5 errors generated.

In this case, the pre-gen8 pte_encode functions have a second parameter
type of 'enum i915_cache_level' whereas the function pointer prototype
in 'struct i915_address_space' expects a second parameter type of
'unsigned int'.

Update the second parameter of the callbacks and the comment above them
noting that these statements are still valid, which matches other
functions and files, to clear up the kCFI failures at run time.

Fixes: 9275277d ("drm/i915: use pat_index instead of cache_level")
Signed-off-by: default avatarNathan Chancellor <nathan@kernel.org>
Reviewed-by: default avatarAndi Shyti <andi.shyti@linux.intel.com>
Reviewed-by: default avatarFei Yang <fei.yang@intel.com>
Signed-off-by: default avatarAndi Shyti <andi.shyti@linux.intel.com>
Link: https://patchwork.freedesktop.org/patch/msgid/20230530-i915-gt-cache_level-wincompatible-function-pointer-types-strict-v1-1-54501d598229@kernel.org
      4722e2eb
  15. 01 Jun, 2023 15 commits
GitLab Nexedi Edition | About GitLab | About Nexedi | 沪ICP备2021021310号-2 | 沪ICP备2021021310号-7