linux-stable/drivers/gpu/drm/xe/xe_pt_walk.c
Thomas Hellström 8cb92dc730 drm/xe/pt: Allow for stricter type- and range checking
Distinguish between xe_pt and the xe_pt_dir subclass when
allocating and freeing. Also use a fixed-size array for the
xe_pt_dir page entries to make life easier for dynamic range-
checkers. Finally rename the page-directory child pointer array
to "children".

While no functional change, this fixes ubsan splats similar to:

[   51.463021] ------------[ cut here ]------------
[   51.463022] UBSAN: array-index-out-of-bounds in drivers/gpu/drm/xe/xe_pt.c:47:9
[   51.463023] index 0 is out of range for type 'xe_ptw *[*]'
[   51.463024] CPU: 5 PID: 2778 Comm: xe_vm Tainted: G     U             6.8.0-rc1+ #218
[   51.463026] Hardware name: ASUS System Product Name/PRIME B560M-A AC, BIOS 2001 02/01/2023
[   51.463027] Call Trace:
[   51.463028]  <TASK>
[   51.463029]  dump_stack_lvl+0x47/0x60
[   51.463030]  __ubsan_handle_out_of_bounds+0x95/0xd0
[   51.463032]  xe_pt_destroy+0xa5/0x150 [xe]
[   51.463088]  __xe_pt_unbind_vma+0x36c/0x9b0 [xe]
[   51.463144]  xe_vm_unbind+0xd8/0x580 [xe]
[   51.463204]  ? drm_exec_prepare_obj+0x3f/0x60 [drm_exec]
[   51.463208]  __xe_vma_op_execute+0x5da/0x910 [xe]
[   51.463268]  ? __drm_gpuvm_sm_unmap+0x1cb/0x220 [drm_gpuvm]
[   51.463272]  ? radix_tree_node_alloc.constprop.0+0x89/0xc0
[   51.463275]  ? drm_gpuva_it_remove+0x1f3/0x2a0 [drm_gpuvm]
[   51.463279]  ? drm_gpuva_remove+0x2f/0xc0 [drm_gpuvm]
[   51.463283]  xe_vm_bind_ioctl+0x1a55/0x20b0 [xe]
[   51.463344]  ? __pfx_xe_vm_bind_ioctl+0x10/0x10 [xe]
[   51.463414]  drm_ioctl_kernel+0xb6/0x120
[   51.463416]  drm_ioctl+0x287/0x4e0
[   51.463418]  ? __pfx_xe_vm_bind_ioctl+0x10/0x10 [xe]
[   51.463481]  __x64_sys_ioctl+0x94/0xd0
[   51.463484]  do_syscall_64+0x86/0x170
[   51.463486]  ? syscall_exit_to_user_mode+0x7d/0x200
[   51.463488]  ? do_syscall_64+0x96/0x170
[   51.463490]  ? do_syscall_64+0x96/0x170
[   51.463492]  entry_SYSCALL_64_after_hwframe+0x6e/0x76
[   51.463494] RIP: 0033:0x7f246bfe817d
[   51.463498] Code: 04 25 28 00 00 00 48 89 45 c8 31 c0 48 8d 45 10 c7 45 b0 10 00 00 00 48 89 45 b8 48 8d 45 d0 48 89 45 c0 b8 10 00 00 00 0f 05 <89> c2 3d 00 f0 ff ff 77 1a 48 8b 45 c8 64 48 2b 04 25 28 00 00 00
[   51.463501] RSP: 002b:00007ffc1bd19ad0 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
[   51.463502] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00007f246bfe817d
[   51.463504] RDX: 00007ffc1bd19b60 RSI: 0000000040886445 RDI: 0000000000000003
[   51.463505] RBP: 00007ffc1bd19b20 R08: 0000000000000000 R09: 0000000000000000
[   51.463506] R10: 0000000000000000 R11: 0000000000000246 R12: 00007ffc1bd19b60
[   51.463508] R13: 0000000040886445 R14: 0000000000000003 R15: 0000000000010000
[   51.463510]  </TASK>
[   51.463517] ---[ end trace ]---

v2
- Fix kerneldoc warning (Matthew Brost)

Fixes: dd08ebf6c352 ("drm/xe: Introduce a new DRM driver for Intel GPUs")
Cc: Rodrigo Vivi <rodrigo.vivi@intel.com>
Cc: Matthew Brost <matthew.brost@intel.com>
Signed-off-by: Thomas Hellström <thomas.hellstrom@linux.intel.com>
Reviewed-by: Matthew Brost <matthew.brost@intel.com>
Link: https://patchwork.freedesktop.org/patch/msgid/20240209112655.4872-1-thomas.hellstrom@linux.intel.com
(cherry picked from commit 157261c58b283f5c83e3f9087eca63be8d591ab8)
Signed-off-by: Thomas Hellström <thomas.hellstrom@linux.intel.com>
2024-02-15 09:53:18 +01:00

161 lines
5.1 KiB
C

// SPDX-License-Identifier: GPL-2.0-only
/*
* Copyright © 2022 Intel Corporation
*/
#include "xe_pt_walk.h"
/**
* DOC: GPU page-table tree walking.
* The utilities in this file are similar to the CPU page-table walk
* utilities in mm/pagewalk.c. The main difference is that we distinguish
* the various levels of a page-table tree with an unsigned integer rather
* than by name. 0 is the lowest level, and page-tables with level 0 can
* not be directories pointing to lower levels, whereas all other levels
* can. The user of the utilities determines the highest level.
*
* Nomenclature:
* Each struct xe_ptw, regardless of level is referred to as a page table, and
* multiple page tables typically form a page table tree with page tables at
* intermediate levels being page directories pointing at page tables at lower
* levels. A shared page table for a given address range is a page-table which
* is neither fully within nor fully outside the address range and that can
* thus be shared by two or more address ranges.
*
* Please keep this code generic so that it can used as a drm-wide page-
* table walker should other drivers find use for it.
*/
static u64 xe_pt_addr_end(u64 addr, u64 end, unsigned int level,
const struct xe_pt_walk *walk)
{
u64 size = 1ull << walk->shifts[level];
u64 tmp = round_up(addr + 1, size);
return min_t(u64, tmp, end);
}
static bool xe_pt_next(pgoff_t *offset, u64 *addr, u64 next, u64 end,
unsigned int level, const struct xe_pt_walk *walk)
{
pgoff_t step = 1;
/* Shared pt walk skips to the last pagetable */
if (unlikely(walk->shared_pt_mode)) {
unsigned int shift = walk->shifts[level];
u64 skip_to = round_down(end, 1ull << shift);
if (skip_to > next) {
step += (skip_to - next) >> shift;
next = skip_to;
}
}
*addr = next;
*offset += step;
return next != end;
}
/**
* xe_pt_walk_range() - Walk a range of a gpu page table tree with callbacks
* for each page-table entry in all levels.
* @parent: The root page table for walk start.
* @level: The root page table level.
* @addr: Virtual address start.
* @end: Virtual address end + 1.
* @walk: Walk info.
*
* Similar to the CPU page-table walker, this is a helper to walk
* a gpu page table and call a provided callback function for each entry.
*
* Return: 0 on success, negative error code on error. The error is
* propagated from the callback and on error the walk is terminated.
*/
int xe_pt_walk_range(struct xe_ptw *parent, unsigned int level,
u64 addr, u64 end, struct xe_pt_walk *walk)
{
pgoff_t offset = xe_pt_offset(addr, level, walk);
struct xe_ptw **entries = parent->children ? parent->children : NULL;
const struct xe_pt_walk_ops *ops = walk->ops;
enum page_walk_action action;
struct xe_ptw *child;
int err = 0;
u64 next;
do {
next = xe_pt_addr_end(addr, end, level, walk);
if (walk->shared_pt_mode && xe_pt_covers(addr, next, level,
walk))
continue;
again:
action = ACTION_SUBTREE;
child = entries ? entries[offset] : NULL;
err = ops->pt_entry(parent, offset, level, addr, next,
&child, &action, walk);
if (err)
break;
/* Probably not needed yet for gpu pagetable walk. */
if (unlikely(action == ACTION_AGAIN))
goto again;
if (likely(!level || !child || action == ACTION_CONTINUE))
continue;
err = xe_pt_walk_range(child, level - 1, addr, next, walk);
if (!err && ops->pt_post_descend)
err = ops->pt_post_descend(parent, offset, level, addr,
next, &child, &action, walk);
if (err)
break;
} while (xe_pt_next(&offset, &addr, next, end, level, walk));
return err;
}
/**
* xe_pt_walk_shared() - Walk shared page tables of a page-table tree.
* @parent: Root page table directory.
* @level: Level of the root.
* @addr: Start address.
* @end: Last address + 1.
* @walk: Walk info.
*
* This function is similar to xe_pt_walk_range() but it skips page tables
* that are private to the range. Since the root (or @parent) page table is
* typically also a shared page table this function is different in that it
* calls the pt_entry callback and the post_descend callback also for the
* root. The root can be detected in the callbacks by checking whether
* parent == *child.
* Walking only the shared page tables is common for unbind-type operations
* where the page-table entries for an address range are cleared or detached
* from the main page-table tree.
*
* Return: 0 on success, negative error code on error: If a callback
* returns an error, the walk will be terminated and the error returned by
* this function.
*/
int xe_pt_walk_shared(struct xe_ptw *parent, unsigned int level,
u64 addr, u64 end, struct xe_pt_walk *walk)
{
const struct xe_pt_walk_ops *ops = walk->ops;
enum page_walk_action action = ACTION_SUBTREE;
struct xe_ptw *child = parent;
int err;
walk->shared_pt_mode = true;
err = walk->ops->pt_entry(parent, 0, level + 1, addr, end,
&child, &action, walk);
if (err || action != ACTION_SUBTREE)
return err;
err = xe_pt_walk_range(parent, level, addr, end, walk);
if (!err && ops->pt_post_descend) {
err = ops->pt_post_descend(parent, 0, level + 1, addr, end,
&child, &action, walk);
}
return err;
}