Commit 51eed9d4 authored by Dave Airlie's avatar Dave Airlie
Browse files

Merge tag 'drm-intel-next-fixes-2023-08-31' of... 

Merge tag 'drm-intel-next-fixes-2023-08-31' of git://anongit.freedesktop.org/drm/drm-intel

 into drm-next

- Mark requests for GuC virtual engines to avoid use-after-free (Andrzej).

Signed-off-by: default avatarDave Airlie <airlied@redhat.com>

From: Rodrigo Vivi <rodrigo.vivi@intel.com>
Link: https://patchwork.freedesktop.org/patch/msgid/ZPEGEeP2EwCtx9hM@intel.com
parents d9809d24 5eefc530

drivers/gpu/drm/i915/gt/intel_engine_types.h

+1 −0
Original line number Diff line number Diff line
@@ -58,6 +58,7 @@ struct i915_perf_group; 


typedef u32 intel_engine_mask_t;

#define ALL_ENGINES ((intel_engine_mask_t)~0ul)

#define VIRTUAL_ENGINES BIT(BITS_PER_TYPE(intel_engine_mask_t) - 1)



struct intel_hw_status_page {

	struct list_head timelines;

drivers/gpu/drm/i915/gt/uc/intel_guc_submission.c

+3 −0
Original line number Diff line number Diff line
@@ -5470,6 +5470,9 @@ guc_create_virtual(struct intel_engine_cs **siblings, unsigned int count, 


	ve->base.flags = I915_ENGINE_IS_VIRTUAL;



	BUILD_BUG_ON(ilog2(VIRTUAL_ENGINES) < I915_NUM_ENGINES);

	ve->base.mask = VIRTUAL_ENGINES;



	intel_context_init(&ve->context, &ve->base);



	for (n = 0; n < count; n++) {

drivers/gpu/drm/i915/i915_request.c

+2 −5
Original line number Diff line number Diff line
@@ -134,9 +134,7 @@ static void i915_fence_release(struct dma_fence *fence) 
	i915_sw_fence_fini(&rq->semaphore);



	/*

	 * Keep one request on each engine for reserved use under mempressure

	 * do not use with virtual engines as this really is only needed for

	 * kernel contexts.

	 * Keep one request on each engine for reserved use under mempressure.

	 *

	 * We do not hold a reference to the engine here and so have to be

	 * very careful in what rq->engine we poke. The virtual engine is
@@ -166,8 +164,7 @@ static void i915_fence_release(struct dma_fence *fence) 
	 * know that if the rq->execution_mask is a single bit, rq->engine

	 * can be a physical engine with the exact corresponding mask.

	 */

	if (!intel_engine_is_virtual(rq->engine) &&

	    is_power_of_2(rq->execution_mask) &&

	if (is_power_of_2(rq->execution_mask) &&

	    !cmpxchg(&rq->engine->request_pool, NULL, rq))

		return;