accel/ivpu: Use effective buffer size for zero terminator

Use the effective written size instead of original size as index for zero
termination. If the input from user-space is to larger and the inp

accel/ivpu: Use effective buffer size for zero terminator

Use the effective written size instead of original size as index for zero
termination. If the input from user-space is to larger and the input is
truncated, the original size is out-of-bound.
Since there is an upfront size check here, the change is for consistency.

Signed-off-by: Markus Burri <[email protected]>
Reviewed-by: Jacek Lawrynowicz <[email protected]>
Signed-off-by: Jacek Lawrynowicz <[email protected]>
Link: https://lore.kernel.org/r/[email protected]

show more ...

accel/ivpu: Correct mutex unlock order in job submission

The mutex unlock for vdev->submitted_jobs_lock was incorrectly placed
before unlocking file_priv->lock. Change order of unlocks to avoid pote

accel/ivpu: Correct mutex unlock order in job submission

The mutex unlock for vdev->submitted_jobs_lock was incorrectly placed
before unlocking file_priv->lock. Change order of unlocks to avoid potential
race conditions.

Fixes: 5bbccadaf33e ("accel/ivpu: Abort all jobs after command queue unregister")
Signed-off-by: Karol Wachowski <[email protected]>
Reviewed-by: Jeff Hugo <[email protected]>
Signed-off-by: Jacek Lawrynowicz <[email protected]>
Link: https://lore.kernel.org/r/[email protected]

show more ...

accel/ivpu: Fix pm related deadlocks in cmdq ioctls

Fix deadlocks in ivpu_cmdq_create_ioctl() and ivpu_cmdq_destroy_ioctl()
related to runtime suspend.

Runtime suspend acquires file_priv->lock mute

accel/ivpu: Fix pm related deadlocks in cmdq ioctls

Fix deadlocks in ivpu_cmdq_create_ioctl() and ivpu_cmdq_destroy_ioctl()
related to runtime suspend.

Runtime suspend acquires file_priv->lock mutex by calling
ivpu_cmdq_reset_all_contexts(). The same lock is acquired in the cmdq
ioctls. If one of the cmdq ioctls is called while runtime suspend is in
progress, it can lead to a deadlock.

Call stacks from example deadlock below.

Runtime suspend thread:
[ 3443.179717] Call Trace:
[ 3443.179724] __schedule+0x4b6/0x16b0
[ 3443.179732] ? __mod_timer+0x27d/0x3a0
[ 3443.179738] schedule+0x2f/0x140
[ 3443.179741] schedule_preempt_disabled+0x19/0x30
[ 3443.179743] __mutex_lock.constprop.0+0x335/0x7d0
[ 3443.179745] ? xas_find+0x1ed/0x260
[ 3443.179747] ? xa_find+0x8e/0xf0
[ 3443.179749] __mutex_lock_slowpath+0x13/0x20
[ 3443.179751] mutex_lock+0x41/0x60
[ 3443.179757] ivpu_cmdq_reset_all_contexts+0x82/0x150 [intel_vpu a9bd091a97f28f0235f161316b29f8234f437295]
[ 3443.179786] ivpu_pm_runtime_suspend_cb+0x1f1/0x3f0 [intel_vpu a9bd091a97f28f0235f161316b29f8234f437295]
[ 3443.179850] pci_pm_runtime_suspend+0x6e/0x1f0
[ 3443.179870] ? __pfx_pci_pm_runtime_suspend+0x10/0x10
[ 3443.179886] __rpm_callback+0x48/0x130
[ 3443.179899] rpm_callback+0x64/0x70
[ 3443.179911] rpm_suspend+0x12c/0x630
[ 3443.179922] ? __schedule+0x4be/0x16b0
[ 3443.179941] pm_runtime_work+0xca/0xf0
[ 3443.179955] process_one_work+0x188/0x3d0
[ 3443.179971] worker_thread+0x2b9/0x3c0
[ 3443.179984] kthread+0xfb/0x220
[ 3443.180001] ? __pfx_worker_thread+0x10/0x10
[ 3443.180013] ? __pfx_kthread+0x10/0x10
[ 3443.180029] ret_from_fork+0x47/0x70
[ 3443.180044] ? __pfx_kthread+0x10/0x10
[ 3443.180059] ret_from_fork_asm+0x1a/0x30

User space thread:
[ 3443.180128] Call Trace:
[ 3443.180138] __schedule+0x4b6/0x16b0
[ 3443.180159] schedule+0x2f/0x140
[ 3443.180163] rpm_resume+0x1a7/0x6a0
[ 3443.180165] ? __pfx_autoremove_wake_function+0x10/0x10
[ 3443.180169] __pm_runtime_resume+0x56/0x90
[ 3443.180171] ivpu_rpm_get+0x28/0xb0 [intel_vpu a9bd091a97f28f0235f161316b29f8234f437295]
[ 3443.180181] ivpu_ipc_send_receive+0x6d/0x120 [intel_vpu a9bd091a97f28f0235f161316b29f8234f437295]
[ 3443.180193] ? free_frozen_pages+0x395/0x670
[ 3443.180199] ? __free_pages+0xa7/0xc0
[ 3443.180202] ivpu_jsm_hws_destroy_cmdq+0x76/0xf0 [intel_vpu a9bd091a97f28f0235f161316b29f8234f437295]
[ 3443.180213] ? locks_dispose_list+0x6c/0xa0
[ 3443.180219] ? kmem_cache_free+0x342/0x470
[ 3443.180222] ? vm_area_free+0x19/0x30
[ 3443.180225] ? xas_load+0x17/0xf0
[ 3443.180229] ? xa_load+0x72/0xb0
[ 3443.180230] ivpu_cmdq_unregister.isra.0+0xb1/0x100 [intel_vpu a9bd091a97f28f0235f161316b29f8234f437295]
[ 3443.180241] ivpu_cmdq_destroy_ioctl+0x8d/0x130 [intel_vpu a9bd091a97f28f0235f161316b29f8234f437295]
[ 3443.180251] ? __pfx_ivpu_cmdq_destroy_ioctl+0x10/0x10 [intel_vpu a9bd091a97f28f0235f161316b29f8234f437295]
[ 3443.180260] drm_ioctl_kernel+0xb3/0x110
[ 3443.180265] drm_ioctl+0x2ca/0x580
[ 3443.180266] ? __pfx_ivpu_cmdq_destroy_ioctl+0x10/0x10 [intel_vpu a9bd091a97f28f0235f161316b29f8234f437295]
[ 3443.180275] ? __fput+0x1ae/0x2f0
[ 3443.180279] ? kmem_cache_free+0x342/0x470
[ 3443.180282] __x64_sys_ioctl+0xa9/0xe0
[ 3443.180286] x64_sys_call+0x13b7/0x26f0
[ 3443.180289] do_syscall_64+0x62/0x180
[ 3443.180291] entry_SYSCALL_64_after_hwframe+0x71/0x79

Fixes: 465a3914b254 ("accel/ivpu: Add API for command queue create/destroy/submit")
Reviewed-by: Jeff Hugo <[email protected]>
Signed-off-by: Jacek Lawrynowicz <[email protected]>
Link: https://lore.kernel.org/r/[email protected]

show more ...

accel/ivpu: Increase state dump msg timeout

Increase JMS message state dump command timeout to 100 ms. On some
platforms, the FW may take a bit longer than 50 ms to dump its state
to the log buffer

accel/ivpu: Increase state dump msg timeout

Increase JMS message state dump command timeout to 100 ms. On some
platforms, the FW may take a bit longer than 50 ms to dump its state
to the log buffer and we don't want to miss any debug info during TDR.

Fixes: 5e162f872d7a ("accel/ivpu: Add FW state dump on TDR")
Cc: [email protected] # v6.13+
Reviewed-by: Jeff Hugo <[email protected]>
Signed-off-by: Jacek Lawrynowicz <[email protected]>
Link: https://lore.kernel.org/r/[email protected]

show more ...

accel/ivpu: Fix the D0i2 disable test mode

Correct setup of D0i2 disable which was
by mistake set up to value 1 and use BIT(1) instead.

Fixes: 011529fe8112 ("accel/ivpu: Implement D0i2 disable test

accel/ivpu: Fix the D0i2 disable test mode

Correct setup of D0i2 disable which was
by mistake set up to value 1 and use BIT(1) instead.

Fixes: 011529fe8112 ("accel/ivpu: Implement D0i2 disable test mode")
Signed-off-by: Andrzej Kacprowski <[email protected]>
Signed-off-by: Maciej Falkowski <[email protected]>
Reviewed-by: Jeff Hugo <[email protected]>
Signed-off-by: Jacek Lawrynowicz <[email protected]>
Link: https://lore.kernel.org/r/[email protected]

show more ...

accel/ivpu: Correct DCT interrupt handling

Fix improper use of dct_active_percent field in DCT interrupt handler
causing DCT to never get enabled. Set dct_active_percent internally before
IPC to ens

accel/ivpu: Correct DCT interrupt handling

Fix improper use of dct_active_percent field in DCT interrupt handler
causing DCT to never get enabled. Set dct_active_percent internally before
IPC to ensure correct driver value even if IPC fails.
Set default DCT value to 30 accordingly to HW architecture specification.

Fixes: a19bffb10c46 ("accel/ivpu: Implement DCT handling")
Signed-off-by: Karol Wachowski <[email protected]>
Signed-off-by: Maciej Falkowski <[email protected]>
Reviewed-by: Jeff Hugo <[email protected]>
Signed-off-by: Jacek Lawrynowicz <[email protected]>
Link: https://lore.kernel.org/r/[email protected]

show more ...

accel/ivpu: Add cmdq_id to job related logs

Add tracking of command queue ID in JOB debug message to improve
debugging capabilities.

Signed-off-by: Karol Wachowski <[email protected]>
Signe

accel/ivpu: Add cmdq_id to job related logs

Add tracking of command queue ID in JOB debug message to improve
debugging capabilities.

Signed-off-by: Karol Wachowski <[email protected]>
Signed-off-by: Maciej Falkowski <[email protected]>
Reviewed-by: Lizhi Hou <[email protected]>
Reviewed-by: Jeff Hugo <[email protected]>
Signed-off-by: Jacek Lawrynowicz <[email protected]>
Link: https://lore.kernel.org/r/[email protected]

show more ...

accel/ivpu: Show NPU frequency in sysfs

Add sysfs files that show maximum and current
frequency of the NPU's data processing unit.
New sysfs entries:
- npu_max_frequency_mhz
- npu_current_frequency_

accel/ivpu: Show NPU frequency in sysfs

Add sysfs files that show maximum and current
frequency of the NPU's data processing unit.
New sysfs entries:
- npu_max_frequency_mhz
- npu_current_frequency_mhz

Signed-off-by: Andrzej Kacprowski <[email protected]>
Signed-off-by: Maciej Falkowski <[email protected]>
Reviewed-by: Jacek Lawrynowicz <[email protected]>
Signed-off-by: Jacek Lawrynowicz <[email protected]>
Link: https://lore.kernel.org/r/[email protected]

show more ...

accel/ivpu: Fix the NPU's DPU frequency calculation

Fix the frequency returned to the user space by
the DRM_IVPU_PARAM_CORE_CLOCK_RATE GET_PARAM IOCTL.
The kernel driver returned CPU frequency for M

accel/ivpu: Fix the NPU's DPU frequency calculation

Fix the frequency returned to the user space by
the DRM_IVPU_PARAM_CORE_CLOCK_RATE GET_PARAM IOCTL.
The kernel driver returned CPU frequency for MTL and bare
PLL frequency for LNL - this was inconsistent and incorrect
for both platforms. With this fix the driver returns maximum
frequency of the NPU data processing unit (DPU) for all HW
generations. This is what user space always expected.

Also do not set CPU frequency in boot params - the firmware
does not use frequency passed from the driver, it was only
used by the early pre-production firmware.
With that we can remove CPU frequency calculation code.

Show NPU frequency in FREQ_CHANGE interrupt when frequency
tracking is enabled.

Fixes: 8a27ad81f7d3 ("accel/ivpu: Split IP and buttress code")
Cc: [email protected] # v6.11+
Signed-off-by: Andrzej Kacprowski <[email protected]>
Signed-off-by: Maciej Falkowski <[email protected]>
Reviewed-by: Jeff Hugo <[email protected]>
Signed-off-by: Jacek Lawrynowicz <[email protected]>
Link: https://lore.kernel.org/r/[email protected]

show more ...

accel/ivpu: Update FW Boot API to version 3.28.3

Update firmware Boot API to 3.28.3 version and
adjust driver to API changes for preemption buffers.

Use new preemption buffer size fields from FW he

accel/ivpu: Update FW Boot API to version 3.28.3

Update firmware Boot API to 3.28.3 version and
adjust driver to API changes for preemption buffers.

Use new preemption buffer size fields from FW header added to
firmware boot API for preemption buffers allocations,
if those new fields are zeroed, use old values instead.

Signed-off-by: Karol Wachowski <[email protected]>
Signed-off-by: Maciej Falkowski <[email protected]>
Reviewed-by: Jeff Hugo <[email protected]>
Signed-off-by: Jacek Lawrynowicz <[email protected]>
Link: https://lore.kernel.org/r/[email protected]

show more ...

accel/ivpu: Flush pending jobs of device's workqueues

Use flush_work() instead of cancel_work_sync() for driver IRQ
workqueues to guarantee that remaining pending work
will be handled.

This resolve

accel/ivpu: Flush pending jobs of device's workqueues

Use flush_work() instead of cancel_work_sync() for driver IRQ
workqueues to guarantee that remaining pending work
will be handled.

This resolves two issues that were encountered where a driver was left
in an incorrect state as the bottom-half was canceled:

1. Cancelling context-abort of a job that is still executing and
is causing translation faults which is going to cause additional TDRs

2. Cancelling bottom-half of a DCT (duty-cycle throttling) request
which will cause a device to not be adjusted to an external frequency
request.

Fixes: bc3e5f48b7ee ("accel/ivpu: Use workqueue for IRQ handling")
Signed-off-by: Maciej Falkowski <[email protected]>
Reviewed-by: Lizhi Hou <[email protected]>
Reviewed-by: Jeff Hugo <[email protected]>
Signed-off-by: Jacek Lawrynowicz <[email protected]>
Link: https://lore.kernel.org/r/[email protected]

show more ...

treewide: Switch/rename to timer_delete[_sync]()

timer_delete[_sync]() replaces del_timer[_sync](). Convert the whole tree
over and remove the historical wrapper inlines.

Conversion was done with c

treewide: Switch/rename to timer_delete[_sync]()

timer_delete[_sync]() replaces del_timer[_sync](). Convert the whole tree
over and remove the historical wrapper inlines.

Conversion was done with coccinelle plus manual fixups where necessary.

Signed-off-by: Thomas Gleixner <[email protected]>
Signed-off-by: Ingo Molnar <[email protected]>

show more ...

accel/ivpu: Fix PM related deadlocks in MS IOCTLs

Prevent runtime resume/suspend while MS IOCTLs are in progress.
Failed suspend will call ivpu_ms_cleanup() that would try to acquire
file_priv->ms_l

accel/ivpu: Fix PM related deadlocks in MS IOCTLs

Prevent runtime resume/suspend while MS IOCTLs are in progress.
Failed suspend will call ivpu_ms_cleanup() that would try to acquire
file_priv->ms_lock, which is already held by the IOCTLs.

Fixes: cdfad4db7756 ("accel/ivpu: Add NPU profiling support")
Cc: [email protected] # v6.11+
Signed-off-by: Maciej Falkowski <[email protected]>
Reviewed-by: Lizhi Hou <[email protected]>
Signed-off-by: Jacek Lawrynowicz <[email protected]>
Link: https://lore.kernel.org/r/[email protected]

show more ...

accel/ivpu: Fix deadlock in ivpu_ms_cleanup()

Fix deadlock in ivpu_ms_cleanup() by preventing runtime resume after
file_priv->ms_lock is acquired.

During a failure in runtime resume, a cold boot is

accel/ivpu: Fix deadlock in ivpu_ms_cleanup()

Fix deadlock in ivpu_ms_cleanup() by preventing runtime resume after
file_priv->ms_lock is acquired.

During a failure in runtime resume, a cold boot is executed, which
calls ivpu_ms_cleanup_all(). This function calls ivpu_ms_cleanup()
that acquires file_priv->ms_lock and causes the deadlock.

Fixes: cdfad4db7756 ("accel/ivpu: Add NPU profiling support")
Cc: [email protected] # v6.11+
Signed-off-by: Maciej Falkowski <[email protected]>
Reviewed-by: Lizhi Hou <[email protected]>
Signed-off-by: Jacek Lawrynowicz <[email protected]>
Link: https://lore.kernel.org/r/[email protected]

show more ...

accel/ivpu: Fix warning in ivpu_ipc_send_receive_internal()

Warn if device is suspended only when runtime PM is enabled.
Runtime PM is disabled during reset/recovery and it is not an error
to use iv

accel/ivpu: Fix warning in ivpu_ipc_send_receive_internal()

Warn if device is suspended only when runtime PM is enabled.
Runtime PM is disabled during reset/recovery and it is not an error
to use ivpu_ipc_send_receive_internal() in such cases.

Fixes: 5eaa49741119 ("accel/ivpu: Prevent recovery invocation during probe and resume")
Cc: [email protected] # v6.13+
Signed-off-by: Maciej Falkowski <[email protected]>
Reviewed-by: Lizhi Hou <[email protected]>
Signed-off-by: Jacek Lawrynowicz <[email protected]>
Link: https://lore.kernel.org/r/[email protected]

show more ...

accel/habanalabs: convert timeouts to secs_to_jiffies()

Commit b35108a51cf7 ("jiffies: Define secs_to_jiffies()") introduced
secs_to_jiffies(). As the value here is a multiple of 1000, use
secs_to_

accel/habanalabs: convert timeouts to secs_to_jiffies()

Commit b35108a51cf7 ("jiffies: Define secs_to_jiffies()") introduced
secs_to_jiffies(). As the value here is a multiple of 1000, use
secs_to_jiffies() instead of msecs_to_jiffies() to avoid the
multiplication

This is converted using scripts/coccinelle/misc/secs_to_jiffies.cocci with
the following Coccinelle rules:

@depends on patch@
expression E;
@@

-msecs_to_jiffies
+secs_to_jiffies
(E
- * \( 1000 \| MSEC_PER_SEC \)
)

Link: https://lkml.kernel.org/r/20250225-converge-secs-to-jiffies-part-two-v3-3-a43967e36c88@linux.microsoft.com
Signed-off-by: Easwar Hariharan <[email protected]>
Cc: Carlos Maiolino <[email protected]>
Cc: Carlos Maiolino <[email protected]>
Cc: Chris Mason <[email protected]>
Cc: Christoph Hellwig <[email protected]>
Cc: Damien Le Maol <[email protected]>
Cc: "Darrick J. Wong" <[email protected]>
Cc: David Sterba <[email protected]>
Cc: Dick Kennedy <[email protected]>
Cc: Dongsheng Yang <[email protected]>
Cc: Fabio Estevam <[email protected]>
Cc: Frank Li <[email protected]>
Cc: Hans de Goede <[email protected]>
Cc: Henrique de Moraes Holschuh <[email protected]>
Cc: Ilpo Jarvinen <[email protected]>
Cc: Ilya Dryomov <[email protected]>
Cc: James Bottomley <[email protected]>
Cc: James Smart <[email protected]>
Cc: Jaroslav Kysela <[email protected]>
Cc: Jason Gunthorpe <[email protected]>
Cc: Jens Axboe <[email protected]>
Cc: Josef Bacik <[email protected]>
Cc: Julia Lawall <[email protected]>
Cc: Kalesh Anakkur Purayil <[email protected]>
Cc: Keith Busch <[email protected]>
Cc: Leon Romanovsky <[email protected]>
Cc: Marc Kleine-Budde <[email protected]>
Cc: Mark Brown <[email protected]>
Cc: "Martin K. Petersen" <[email protected]>
Cc: Nicolas Palix <[email protected]>
Cc: Niklas Cassel <[email protected]>
Cc: Oded Gabbay <[email protected]>
Cc: Sagi Grimberg <[email protected]>
Cc: Sascha Hauer <[email protected]>
Cc: Sebastian Reichel <[email protected]>
Cc: Selvin Thyparampil Xavier <[email protected]>
Cc: Shawn Guo <[email protected]>
Cc: Shyam-sundar S-k <[email protected]>
Cc: Takashi Iwai <[email protected]>
Cc: Takashi Iwai <[email protected]>
Cc: Xiubo Li <[email protected]>
Signed-off-by: Andrew Morton <[email protected]>

show more ...

accel/qaic: Fix integer overflow in qaic_validate_req()

These are u64 variables that come from the user via
qaic_attach_slice_bo_ioctl(). Use check_add_overflow() to ensure that
the math doesn't ha

accel/qaic: Fix integer overflow in qaic_validate_req()

These are u64 variables that come from the user via
qaic_attach_slice_bo_ioctl(). Use check_add_overflow() to ensure that
the math doesn't have an integer wrapping bug.

Cc: [email protected]
Fixes: ff13be830333 ("accel/qaic: Add datapath")
Signed-off-by: Dan Carpenter <[email protected]>
Reviewed-by: Jeff Hugo <[email protected]>
Signed-off-by: Jeff Hugo <[email protected]>
Link: https://patchwork.freedesktop.org/patch/msgid/[email protected]

show more ...

accel/qaic: Fix possible data corruption in BOs > 2G

When slicing a BO, we need to iterate through the BO's sgt to find the
right pieces to construct the slice. Some of the data types chosen for
thi

accel/qaic: Fix possible data corruption in BOs > 2G

When slicing a BO, we need to iterate through the BO's sgt to find the
right pieces to construct the slice. Some of the data types chosen for
this process are incorrectly too small, and can overflow. This can
result in the incorrect slice construction, which can lead to data
corruption in workload execution.

The device can only handle 32-bit sized transfers, and the scatterlist
struct only supports 32-bit buffer sizes, so our upper limit for an
individual transfer is an unsigned int. Using an int is incorrect due to
the reservation of the sign bit. Upgrade the length of a scatterlist
entry and the offsets into a scatterlist entry to unsigned int for a
correct representation.

While each transfer may be limited to 32-bits, the overall BO may exceed
that size. For counting the total length of the BO, we need a type that
can represent the largest allocation possible on the system. That is the
definition of size_t, so use it.

Fixes: ff13be830333 ("accel/qaic: Add datapath")
Signed-off-by: Jeffrey Hugo <[email protected]>
Signed-off-by: Jeff Hugo <[email protected]>
Reviewed-by: Lizhi Hou <[email protected]>
Reviewed-by: Troy Hanson <[email protected]>
Reviewed-by: Youssef Samir <[email protected]>
Link: https://patchwork.freedesktop.org/patch/msgid/[email protected]

show more ...

accel/amdxdna: Check interrupt register before mailbox_rx_worker exits

There is a timeout failure been found during stress tests. If the firmware
generates a mailbox response right after driver clea

accel/amdxdna: Check interrupt register before mailbox_rx_worker exits

There is a timeout failure been found during stress tests. If the firmware
generates a mailbox response right after driver clears the mailbox channel
interrupt register, the hardware will not generate an interrupt for the
response. This causes the unexpected mailbox command timeout.

To handle this failure, driver checks the interrupt register before
exiting mailbox_rx_worker(). If there is a new response, driver goes back
to process it.

Signed-off-by: Lizhi Hou <[email protected]>
Reviewed-by: Jacek Lawrynowicz <[email protected]>
Signed-off-by: Mario Limonciello <[email protected]>
Link: https://patchwork.freedesktop.org/patch/msgid/[email protected]

show more ...

accel/habanalabs: constify 'struct bin_attribute'

The sysfs core now allows instances of 'struct bin_attribute' to be
moved into read-only memory. Make use of that to protect them against
accidental

accel/habanalabs: constify 'struct bin_attribute'

The sysfs core now allows instances of 'struct bin_attribute' to be
moved into read-only memory. Make use of that to protect them against
accidental or malicious modifications.

Signed-off-by: Thomas Weißschuh <[email protected]>
Reviewed-by: Jani Nikula <[email protected]>
Link: https://lore.kernel.org/r/20241216-sysfs-const-bin_attr-habanalabs-v1-1-b35463197efb@weissschuh.net
Signed-off-by: Greg Kroah-Hartman <[email protected]>

show more ...