mirror of
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
synced 2025-01-09 22:50:41 +00:00
8cb92dc730
Distinguish between xe_pt and the xe_pt_dir subclass when allocating and freeing. Also use a fixed-size array for the xe_pt_dir page entries to make life easier for dynamic range- checkers. Finally rename the page-directory child pointer array to "children". While no functional change, this fixes ubsan splats similar to: [ 51.463021] ------------[ cut here ]------------ [ 51.463022] UBSAN: array-index-out-of-bounds in drivers/gpu/drm/xe/xe_pt.c:47:9 [ 51.463023] index 0 is out of range for type 'xe_ptw *[*]' [ 51.463024] CPU: 5 PID: 2778 Comm: xe_vm Tainted: G U 6.8.0-rc1+ #218 [ 51.463026] Hardware name: ASUS System Product Name/PRIME B560M-A AC, BIOS 2001 02/01/2023 [ 51.463027] Call Trace: [ 51.463028] <TASK> [ 51.463029] dump_stack_lvl+0x47/0x60 [ 51.463030] __ubsan_handle_out_of_bounds+0x95/0xd0 [ 51.463032] xe_pt_destroy+0xa5/0x150 [xe] [ 51.463088] __xe_pt_unbind_vma+0x36c/0x9b0 [xe] [ 51.463144] xe_vm_unbind+0xd8/0x580 [xe] [ 51.463204] ? drm_exec_prepare_obj+0x3f/0x60 [drm_exec] [ 51.463208] __xe_vma_op_execute+0x5da/0x910 [xe] [ 51.463268] ? __drm_gpuvm_sm_unmap+0x1cb/0x220 [drm_gpuvm] [ 51.463272] ? radix_tree_node_alloc.constprop.0+0x89/0xc0 [ 51.463275] ? drm_gpuva_it_remove+0x1f3/0x2a0 [drm_gpuvm] [ 51.463279] ? drm_gpuva_remove+0x2f/0xc0 [drm_gpuvm] [ 51.463283] xe_vm_bind_ioctl+0x1a55/0x20b0 [xe] [ 51.463344] ? __pfx_xe_vm_bind_ioctl+0x10/0x10 [xe] [ 51.463414] drm_ioctl_kernel+0xb6/0x120 [ 51.463416] drm_ioctl+0x287/0x4e0 [ 51.463418] ? __pfx_xe_vm_bind_ioctl+0x10/0x10 [xe] [ 51.463481] __x64_sys_ioctl+0x94/0xd0 [ 51.463484] do_syscall_64+0x86/0x170 [ 51.463486] ? syscall_exit_to_user_mode+0x7d/0x200 [ 51.463488] ? do_syscall_64+0x96/0x170 [ 51.463490] ? do_syscall_64+0x96/0x170 [ 51.463492] entry_SYSCALL_64_after_hwframe+0x6e/0x76 [ 51.463494] RIP: 0033:0x7f246bfe817d [ 51.463498] Code: 04 25 28 00 00 00 48 89 45 c8 31 c0 48 8d 45 10 c7 45 b0 10 00 00 00 48 89 45 b8 48 8d 45 d0 48 89 45 c0 b8 10 00 00 00 0f 05 <89> c2 3d 00 f0 ff ff 77 1a 48 8b 45 c8 64 48 2b 04 25 28 00 00 00 [ 51.463501] RSP: 002b:00007ffc1bd19ad0 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 51.463502] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00007f246bfe817d [ 51.463504] RDX: 00007ffc1bd19b60 RSI: 0000000040886445 RDI: 0000000000000003 [ 51.463505] RBP: 00007ffc1bd19b20 R08: 0000000000000000 R09: 0000000000000000 [ 51.463506] R10: 0000000000000000 R11: 0000000000000246 R12: 00007ffc1bd19b60 [ 51.463508] R13: 0000000040886445 R14: 0000000000000003 R15: 0000000000010000 [ 51.463510] </TASK> [ 51.463517] ---[ end trace ]--- v2 - Fix kerneldoc warning (Matthew Brost) Fixes: dd08ebf6c352 ("drm/xe: Introduce a new DRM driver for Intel GPUs") Cc: Rodrigo Vivi <rodrigo.vivi@intel.com> Cc: Matthew Brost <matthew.brost@intel.com> Signed-off-by: Thomas Hellström <thomas.hellstrom@linux.intel.com> Reviewed-by: Matthew Brost <matthew.brost@intel.com> Link: https://patchwork.freedesktop.org/patch/msgid/20240209112655.4872-1-thomas.hellstrom@linux.intel.com (cherry picked from commit 157261c58b283f5c83e3f9087eca63be8d591ab8) Signed-off-by: Thomas Hellström <thomas.hellstrom@linux.intel.com>
161 lines
5.1 KiB
C
161 lines
5.1 KiB
C
// SPDX-License-Identifier: GPL-2.0-only
|
|
/*
|
|
* Copyright © 2022 Intel Corporation
|
|
*/
|
|
#include "xe_pt_walk.h"
|
|
|
|
/**
|
|
* DOC: GPU page-table tree walking.
|
|
* The utilities in this file are similar to the CPU page-table walk
|
|
* utilities in mm/pagewalk.c. The main difference is that we distinguish
|
|
* the various levels of a page-table tree with an unsigned integer rather
|
|
* than by name. 0 is the lowest level, and page-tables with level 0 can
|
|
* not be directories pointing to lower levels, whereas all other levels
|
|
* can. The user of the utilities determines the highest level.
|
|
*
|
|
* Nomenclature:
|
|
* Each struct xe_ptw, regardless of level is referred to as a page table, and
|
|
* multiple page tables typically form a page table tree with page tables at
|
|
* intermediate levels being page directories pointing at page tables at lower
|
|
* levels. A shared page table for a given address range is a page-table which
|
|
* is neither fully within nor fully outside the address range and that can
|
|
* thus be shared by two or more address ranges.
|
|
*
|
|
* Please keep this code generic so that it can used as a drm-wide page-
|
|
* table walker should other drivers find use for it.
|
|
*/
|
|
static u64 xe_pt_addr_end(u64 addr, u64 end, unsigned int level,
|
|
const struct xe_pt_walk *walk)
|
|
{
|
|
u64 size = 1ull << walk->shifts[level];
|
|
u64 tmp = round_up(addr + 1, size);
|
|
|
|
return min_t(u64, tmp, end);
|
|
}
|
|
|
|
static bool xe_pt_next(pgoff_t *offset, u64 *addr, u64 next, u64 end,
|
|
unsigned int level, const struct xe_pt_walk *walk)
|
|
{
|
|
pgoff_t step = 1;
|
|
|
|
/* Shared pt walk skips to the last pagetable */
|
|
if (unlikely(walk->shared_pt_mode)) {
|
|
unsigned int shift = walk->shifts[level];
|
|
u64 skip_to = round_down(end, 1ull << shift);
|
|
|
|
if (skip_to > next) {
|
|
step += (skip_to - next) >> shift;
|
|
next = skip_to;
|
|
}
|
|
}
|
|
|
|
*addr = next;
|
|
*offset += step;
|
|
|
|
return next != end;
|
|
}
|
|
|
|
/**
|
|
* xe_pt_walk_range() - Walk a range of a gpu page table tree with callbacks
|
|
* for each page-table entry in all levels.
|
|
* @parent: The root page table for walk start.
|
|
* @level: The root page table level.
|
|
* @addr: Virtual address start.
|
|
* @end: Virtual address end + 1.
|
|
* @walk: Walk info.
|
|
*
|
|
* Similar to the CPU page-table walker, this is a helper to walk
|
|
* a gpu page table and call a provided callback function for each entry.
|
|
*
|
|
* Return: 0 on success, negative error code on error. The error is
|
|
* propagated from the callback and on error the walk is terminated.
|
|
*/
|
|
int xe_pt_walk_range(struct xe_ptw *parent, unsigned int level,
|
|
u64 addr, u64 end, struct xe_pt_walk *walk)
|
|
{
|
|
pgoff_t offset = xe_pt_offset(addr, level, walk);
|
|
struct xe_ptw **entries = parent->children ? parent->children : NULL;
|
|
const struct xe_pt_walk_ops *ops = walk->ops;
|
|
enum page_walk_action action;
|
|
struct xe_ptw *child;
|
|
int err = 0;
|
|
u64 next;
|
|
|
|
do {
|
|
next = xe_pt_addr_end(addr, end, level, walk);
|
|
if (walk->shared_pt_mode && xe_pt_covers(addr, next, level,
|
|
walk))
|
|
continue;
|
|
again:
|
|
action = ACTION_SUBTREE;
|
|
child = entries ? entries[offset] : NULL;
|
|
err = ops->pt_entry(parent, offset, level, addr, next,
|
|
&child, &action, walk);
|
|
if (err)
|
|
break;
|
|
|
|
/* Probably not needed yet for gpu pagetable walk. */
|
|
if (unlikely(action == ACTION_AGAIN))
|
|
goto again;
|
|
|
|
if (likely(!level || !child || action == ACTION_CONTINUE))
|
|
continue;
|
|
|
|
err = xe_pt_walk_range(child, level - 1, addr, next, walk);
|
|
|
|
if (!err && ops->pt_post_descend)
|
|
err = ops->pt_post_descend(parent, offset, level, addr,
|
|
next, &child, &action, walk);
|
|
if (err)
|
|
break;
|
|
|
|
} while (xe_pt_next(&offset, &addr, next, end, level, walk));
|
|
|
|
return err;
|
|
}
|
|
|
|
/**
|
|
* xe_pt_walk_shared() - Walk shared page tables of a page-table tree.
|
|
* @parent: Root page table directory.
|
|
* @level: Level of the root.
|
|
* @addr: Start address.
|
|
* @end: Last address + 1.
|
|
* @walk: Walk info.
|
|
*
|
|
* This function is similar to xe_pt_walk_range() but it skips page tables
|
|
* that are private to the range. Since the root (or @parent) page table is
|
|
* typically also a shared page table this function is different in that it
|
|
* calls the pt_entry callback and the post_descend callback also for the
|
|
* root. The root can be detected in the callbacks by checking whether
|
|
* parent == *child.
|
|
* Walking only the shared page tables is common for unbind-type operations
|
|
* where the page-table entries for an address range are cleared or detached
|
|
* from the main page-table tree.
|
|
*
|
|
* Return: 0 on success, negative error code on error: If a callback
|
|
* returns an error, the walk will be terminated and the error returned by
|
|
* this function.
|
|
*/
|
|
int xe_pt_walk_shared(struct xe_ptw *parent, unsigned int level,
|
|
u64 addr, u64 end, struct xe_pt_walk *walk)
|
|
{
|
|
const struct xe_pt_walk_ops *ops = walk->ops;
|
|
enum page_walk_action action = ACTION_SUBTREE;
|
|
struct xe_ptw *child = parent;
|
|
int err;
|
|
|
|
walk->shared_pt_mode = true;
|
|
err = walk->ops->pt_entry(parent, 0, level + 1, addr, end,
|
|
&child, &action, walk);
|
|
|
|
if (err || action != ACTION_SUBTREE)
|
|
return err;
|
|
|
|
err = xe_pt_walk_range(parent, level, addr, end, walk);
|
|
if (!err && ops->pt_post_descend) {
|
|
err = ops->pt_post_descend(parent, 0, level + 1, addr, end,
|
|
&child, &action, walk);
|
|
}
|
|
return err;
|
|
}
|