Driver Changes:

- Fix usefafter-free when provisioning VF (Matthew Auld)
 - Suppress rpm warning on false positive (Rodrigo)
 - Fix memleak on ioctl error path (Dafna)
 - Fix use-after-free while inserting ggtt (Michal Wajdeczko)
 - Add Wa_15016589081 workaround (Tejas)
 - Fix error path on suspend (Maarten)
 -----BEGIN PGP SIGNATURE-----
 
 iQJNBAABCAA3FiEE6rM8lpABPHM5FqyDm6KlpjDL6lMFAmbjddoZHGx1Y2FzLmRl
 bWFyY2hpQGludGVsLmNvbQAKCRCboqWmMMvqUy/DD/9ghjhqAFAnLQyXJ5OdYwSo
 KGQ4EBD52KGMZhBZwSwXXnhgwdz3s9OG6WZXZ9R3ZZOo22OyXkGZlScnTbteNU67
 AARQEtveTmxPPe3Ggxrx87HqrbiveCBmdom5eggLcb2Hh6T1Z3bgbCXYnjpHEedy
 SnKYsxC6ReJJfB0r1Cl2MSiJ8vCQ0vFgKz7HH0RZeXomZ3lpsR9XtDLAktFYpU7H
 zJZ1om8hMLl7W7XXK6piPyB4VOkzeNjhxd8Hol9BZ9FiOcGlVQoG/icXISL2Kb83
 1Bx2HHc7wu0IcFqsCRrkKzZudcgylGyaZkO6aPus3BNRY3bDUh9kcVM0jUkd6mvp
 rpTMOBS/pjS2SJl+4VMzgEYsyxb0LbJLjxPMbnsm0rL3FAeuCgch1jImKVbnKzge
 Xp9v5k+UtlLJjtCUwBjfFQe1nioduMp1OixNuI3TaXQz6T6aknfyjalH+vQVa4b8
 uBMVdqSg2LJp3RgCFYMxIUFjLK3nlxK62tN/Ivge2aWU74hmGl/IDpozEvjr6bxQ
 oIwTJUIKU/SHBqd7RSP2npI2yACnXUP888Ydgrnf9BH3Ff3y7ZPqcThl8AVulYLp
 VCXlCzmbFoXsdde3CQfq6GtlLd5/FCBqZiZLoGigGLpOSrH4ajqpENbkg8cPZexA
 g7yoONJwYVWoU75rmv3B0w==
 =fkHk
 -----END PGP SIGNATURE-----

Merge tag 'drm-xe-next-fixes-2024-09-12' of https://gitlab.freedesktop.org/drm/xe/kernel into drm-next

Driver Changes:
- Fix usefafter-free when provisioning VF (Matthew Auld)
- Suppress rpm warning on false positive (Rodrigo)
- Fix memleak on ioctl error path (Dafna)
- Fix use-after-free while inserting ggtt (Michal Wajdeczko)
- Add Wa_15016589081 workaround (Tejas)
- Fix error path on suspend (Maarten)

Signed-off-by: Dave Airlie <airlied@redhat.com>

From: Lucas De Marchi <lucas.demarchi@intel.com>
Link: https://patchwork.freedesktop.org/patch/msgid/az6xs2z6zj3brq2h5wgaaoxwnqktrwbvxoyckrz7gbywsso734@a6v7gytqbcd6

drivers/gpu/drm/xe/regs/xe_gt_regs.h

@@ -105,6 +105,7 @@
 
 #define CHICKEN_RASTER_1			XE_REG_MCR(0x6204, XE_REG_OPTION_MASKED)
 #define   DIS_SF_ROUND_NEAREST_EVEN		REG_BIT(8)
+#define   DIS_CLIP_NEGATIVE_BOUNDING_BOX	REG_BIT(6)
 
 #define CHICKEN_RASTER_2			XE_REG_MCR(0x6208, XE_REG_OPTION_MASKED)
 #define   TBIMR_FAST_CLIP			REG_BIT(5)

drivers/gpu/drm/xe/xe_exec_queue.c

@@ -223,8 +223,10 @@ struct xe_exec_queue *xe_exec_queue_create_bind(struct xe_device *xe,
 							   gt->usm.reserved_bcs_instance,
 							   false);
 
-		if (!hwe)
+		if (!hwe) {
+			xe_vm_put(migrate_vm);
 			return ERR_PTR(-EINVAL);
+		}
 
 		q = xe_exec_queue_create(xe, migrate_vm,
 					 BIT(hwe->logical_instance), 1, hwe,

drivers/gpu/drm/xe/xe_ggtt.c

@@ -619,16 +619,19 @@ static int __xe_ggtt_insert_bo_at(struct xe_ggtt *ggtt, struct xe_bo *bo,
 	bo->ggtt_node = xe_ggtt_node_init(ggtt);
 	if (IS_ERR(bo->ggtt_node)) {
 		err = PTR_ERR(bo->ggtt_node);
+		bo->ggtt_node = NULL;
 		goto out;
 	}
 
 	mutex_lock(&ggtt->lock);
 	err = drm_mm_insert_node_in_range(&ggtt->mm, &bo->ggtt_node->base, bo->size,
 					  alignment, 0, start, end, 0);
-	if (err)
+	if (err) {
 		xe_ggtt_node_fini(bo->ggtt_node);
-	else
+		bo->ggtt_node = NULL;
+	} else {
 		xe_ggtt_map_bo(ggtt, bo);
+	}
 	mutex_unlock(&ggtt->lock);
 
 	if (!err && bo->flags & XE_BO_FLAG_GGTT_INVALIDATE)

drivers/gpu/drm/xe/xe_gt_sriov_pf_config.c

@@ -399,7 +399,7 @@ static void pf_release_vf_config_ggtt(struct xe_gt *gt, struct xe_gt_sriov_confi
 static int pf_provision_vf_ggtt(struct xe_gt *gt, unsigned int vfid, u64 size)
 {
 	struct xe_gt_sriov_config *config = pf_pick_vf_config(gt, vfid);
-	struct xe_ggtt_node *node = config->ggtt_region;
+	struct xe_ggtt_node *node;
 	struct xe_tile *tile = gt_to_tile(gt);
 	struct xe_ggtt *ggtt = tile->mem.ggtt;
 	u64 alignment = pf_get_ggtt_alignment(gt);
@@ -411,14 +411,14 @@ static int pf_provision_vf_ggtt(struct xe_gt *gt, unsigned int vfid, u64 size)
 
 	size = round_up(size, alignment);
 
-	if (xe_ggtt_node_allocated(node)) {
+	if (xe_ggtt_node_allocated(config->ggtt_region)) {
 		err = pf_distribute_config_ggtt(tile, vfid, 0, 0);
 		if (unlikely(err))
 			return err;
 
-		pf_release_ggtt(tile, node);
+		pf_release_vf_config_ggtt(gt, config);
 	}
-	xe_gt_assert(gt, !xe_ggtt_node_allocated(node));
+	xe_gt_assert(gt, !xe_ggtt_node_allocated(config->ggtt_region));
 
 	if (!size)
 		return 0;

drivers/gpu/drm/xe/xe_pm.c

@@ -416,7 +416,7 @@ int xe_pm_runtime_suspend(struct xe_device *xe)
 		xe_display_pm_suspend_late(xe);
 out:
 	if (err)
-		xe_display_pm_resume(xe, true);
+		xe_display_pm_runtime_resume(xe);
 	xe_rpm_lockmap_release(xe);
 	xe_pm_write_callback_task(xe, NULL);
 	return err;
@@ -595,6 +595,22 @@ bool xe_pm_runtime_get_if_in_use(struct xe_device *xe)
 	return pm_runtime_get_if_in_use(xe->drm.dev) > 0;
 }
 
+/*
+ * Very unreliable! Should only be used to suppress the false positive case
+ * in the missing outer rpm protection warning.
+ */
+static bool xe_pm_suspending_or_resuming(struct xe_device *xe)
+{
+#ifdef CONFIG_PM
+	struct device *dev = xe->drm.dev;
+
+	return dev->power.runtime_status == RPM_SUSPENDING ||
+		dev->power.runtime_status == RPM_RESUMING;
+#else
+	return false;
+#endif
+}
+
 /**
  * xe_pm_runtime_get_noresume - Bump runtime PM usage counter without resuming
  * @xe: xe device instance
@@ -611,8 +627,11 @@ void xe_pm_runtime_get_noresume(struct xe_device *xe)
 
 	ref = xe_pm_runtime_get_if_in_use(xe);
 
-	if (drm_WARN(&xe->drm, !ref, "Missing outer runtime PM protection\n"))
+	if (!ref) {
 		pm_runtime_get_noresume(xe->drm.dev);
+		drm_WARN(&xe->drm, !xe_pm_suspending_or_resuming(xe),
+			 "Missing outer runtime PM protection\n");
+	}
 }
 
 /**

drivers/gpu/drm/xe/xe_wa.c

@@ -733,6 +733,10 @@ static const struct xe_rtp_entry_sr lrc_was[] = {
 			     DIS_PARTIAL_AUTOSTRIP |
 			     DIS_AUTOSTRIP))
 	},
+	{ XE_RTP_NAME("15016589081"),
+	  XE_RTP_RULES(GRAPHICS_VERSION(2001), ENGINE_CLASS(RENDER)),
+	  XE_RTP_ACTIONS(SET(CHICKEN_RASTER_1, DIS_CLIP_NEGATIVE_BOUNDING_BOX))
+	},
 
 	{}
 };