<feed xmlns='http://www.w3.org/2005/Atom'>
<title>linux-toradex.git/drivers/gpu, branch v6.19-rc2</title>
<subtitle>Linux kernel for Apalis and Colibri modules</subtitle>
<link rel='alternate' type='text/html' href='https://git.toradex.cn/cgit/linux-toradex.git/'/>
<entry>
<title>Merge tag 'drm-xe-fixes-2025-12-19' of https://gitlab.freedesktop.org/drm/xe/kernel into drm-fixes</title>
<updated>2025-12-19T00:56:13+00:00</updated>
<author>
<name>Dave Airlie</name>
<email>airlied@redhat.com</email>
</author>
<published>2025-12-19T00:55:49+00:00</published>
<link rel='alternate' type='text/html' href='https://git.toradex.cn/cgit/linux-toradex.git/commit/?id=f66ac60dee28d092bc6a3af33a04147bfcb6ba30'/>
<id>f66ac60dee28d092bc6a3af33a04147bfcb6ba30</id>
<content type='text'>
UAPI Changes:
- Limit num_syncs to prevent oversized kernel allocations (Shuicheng)
- Disallow 0 OA property values (Ashutosh)
- Disallow 0 EU stall property values (Ashutosh)

Driver Changes:
- Fix kobject leak (Shuicheng)
- Workaround (Vinay)
- Loop variable reference fix (Matt Brost)
- Fix a CONFIG corner-case incorrect number of arguments (Arnd Bergmann)
- Skip reason prefix while emitting array (Raag)
- VF migration fix (Tomasz)
- Fix context in mei interrupt top half (Junxiao)
- Don't include the CCS metadata in the dma-buf sg-table (Thomas)
- VF queueing recovery work fix (Satyanarayana)
- Increase TDF timeout (Jagmeet)
- GT reset registers vs scheduler ordering fix (Jan)
- Adjust long-running workload timeslices (Matt Brost)
- Always set OA_OAGLBCTXCTRL_COUNTER_RESUME (Ashutosh)
- Fix a return value (Dan Carpenter)
- Drop preempt-fences when destroying imported dma-bufs (Thomas)
- Use usleep_range for accurate long-running workload timeslicing (Matthew)

Signed-off-by: Dave Airlie &lt;airlied@redhat.com&gt;

From: Thomas Hellstrom &lt;thomas.hellstrom@linux.intel.com&gt;
Link: https://patch.msgid.link/aUSMlQ4iruzm0NQR@fedora
</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
UAPI Changes:
- Limit num_syncs to prevent oversized kernel allocations (Shuicheng)
- Disallow 0 OA property values (Ashutosh)
- Disallow 0 EU stall property values (Ashutosh)

Driver Changes:
- Fix kobject leak (Shuicheng)
- Workaround (Vinay)
- Loop variable reference fix (Matt Brost)
- Fix a CONFIG corner-case incorrect number of arguments (Arnd Bergmann)
- Skip reason prefix while emitting array (Raag)
- VF migration fix (Tomasz)
- Fix context in mei interrupt top half (Junxiao)
- Don't include the CCS metadata in the dma-buf sg-table (Thomas)
- VF queueing recovery work fix (Satyanarayana)
- Increase TDF timeout (Jagmeet)
- GT reset registers vs scheduler ordering fix (Jan)
- Adjust long-running workload timeslices (Matt Brost)
- Always set OA_OAGLBCTXCTRL_COUNTER_RESUME (Ashutosh)
- Fix a return value (Dan Carpenter)
- Drop preempt-fences when destroying imported dma-bufs (Thomas)
- Use usleep_range for accurate long-running workload timeslicing (Matthew)

Signed-off-by: Dave Airlie &lt;airlied@redhat.com&gt;

From: Thomas Hellstrom &lt;thomas.hellstrom@linux.intel.com&gt;
Link: https://patch.msgid.link/aUSMlQ4iruzm0NQR@fedora
</pre>
</div>
</content>
</entry>
<entry>
<title>Merge tag 'drm-misc-fixes-2025-12-18' of https://gitlab.freedesktop.org/drm/misc/kernel into drm-fixes</title>
<updated>2025-12-18T21:38:18+00:00</updated>
<author>
<name>Dave Airlie</name>
<email>airlied@redhat.com</email>
</author>
<published>2025-12-18T21:32:21+00:00</published>
<link rel='alternate' type='text/html' href='https://git.toradex.cn/cgit/linux-toradex.git/commit/?id=77de4a273d3002bcca1e5b53907b1b350b1e22f7'/>
<id>77de4a273d3002bcca1e5b53907b1b350b1e22f7</id>
<content type='text'>
drm-misc-fixes for v6.19-rc2:
- Add -EDEADLK handling in drm unit tests.
- Plug DRM_IOCTL_GEM_CHANGE_HANDLE leak.
- Fix regression in sony-td4353-jdi.
- Kconfig fix for visionox-rm69299.
- Do not load amdxdna when running virtualized.

Signed-off-by: Dave Airlie &lt;airlied@redhat.com&gt;

From: Maarten Lankhorst &lt;maarten.lankhorst@linux.intel.com&gt;
Link: https://patch.msgid.link/21861d1b-54bf-4853-9c35-97abe3c5deba@linux.intel.com
</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
drm-misc-fixes for v6.19-rc2:
- Add -EDEADLK handling in drm unit tests.
- Plug DRM_IOCTL_GEM_CHANGE_HANDLE leak.
- Fix regression in sony-td4353-jdi.
- Kconfig fix for visionox-rm69299.
- Do not load amdxdna when running virtualized.

Signed-off-by: Dave Airlie &lt;airlied@redhat.com&gt;

From: Maarten Lankhorst &lt;maarten.lankhorst@linux.intel.com&gt;
Link: https://patch.msgid.link/21861d1b-54bf-4853-9c35-97abe3c5deba@linux.intel.com
</pre>
</div>
</content>
</entry>
<entry>
<title>drm/xe: Use usleep_range for accurate long-running workload timeslicing</title>
<updated>2025-12-18T17:25:42+00:00</updated>
<author>
<name>Matthew Brost</name>
<email>matthew.brost@intel.com</email>
</author>
<published>2025-12-12T18:28:42+00:00</published>
<link rel='alternate' type='text/html' href='https://git.toradex.cn/cgit/linux-toradex.git/commit/?id=80f9c601d9c4d26f00356c0a9c461650e7089273'/>
<id>80f9c601d9c4d26f00356c0a9c461650e7089273</id>
<content type='text'>
msleep is not very accurate in terms of how long it actually sleeps,
whereas usleep_range is precise. Replace the timeslice sleep for
long-running workloads with the more accurate usleep_range to avoid
jitter if the sleep period is less than 20ms.

Fixes: dd08ebf6c352 ("drm/xe: Introduce a new DRM driver for Intel GPUs")
Cc: stable@vger.kernel.org
Signed-off-by: Matthew Brost &lt;matthew.brost@intel.com&gt;
Reviewed-by: Thomas Hellström &lt;thomas.hellstrom@linux.intel.com&gt;
Link: https://patch.msgid.link/20251212182847.1683222-3-matthew.brost@intel.com
(cherry picked from commit ca415c4d4c17ad676a2c8981e1fcc432221dce79)
Signed-off-by: Thomas Hellström &lt;thomas.hellstrom@linux.intel.com&gt;
</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
msleep is not very accurate in terms of how long it actually sleeps,
whereas usleep_range is precise. Replace the timeslice sleep for
long-running workloads with the more accurate usleep_range to avoid
jitter if the sleep period is less than 20ms.

Fixes: dd08ebf6c352 ("drm/xe: Introduce a new DRM driver for Intel GPUs")
Cc: stable@vger.kernel.org
Signed-off-by: Matthew Brost &lt;matthew.brost@intel.com&gt;
Reviewed-by: Thomas Hellström &lt;thomas.hellstrom@linux.intel.com&gt;
Link: https://patch.msgid.link/20251212182847.1683222-3-matthew.brost@intel.com
(cherry picked from commit ca415c4d4c17ad676a2c8981e1fcc432221dce79)
Signed-off-by: Thomas Hellström &lt;thomas.hellstrom@linux.intel.com&gt;
</pre>
</div>
</content>
</entry>
<entry>
<title>drm/xe: Drop preempt-fences when destroying imported dma-bufs.</title>
<updated>2025-12-18T17:12:16+00:00</updated>
<author>
<name>Thomas Hellström</name>
<email>thomas.hellstrom@linux.intel.com</email>
</author>
<published>2025-12-17T09:34:41+00:00</published>
<link rel='alternate' type='text/html' href='https://git.toradex.cn/cgit/linux-toradex.git/commit/?id=fe3ccd24138fd391ae8e32289d492c85f67770fc'/>
<id>fe3ccd24138fd391ae8e32289d492c85f67770fc</id>
<content type='text'>
When imported dma-bufs are destroyed, TTM is not fully
individualizing the dma-resv, but it *is* copying the fences that
need to be waited for before declaring idle. So in the case where
the bo-&gt;resv != bo-&gt;_resv we can still drop the preempt-fences, but
make sure we do that on bo-&gt;_resv which contains the fence-pointer
copy.

In the case where the copying fails, bo-&gt;_resv will typically not
contain any fences pointers at all, so there will be nothing to
drop. In that case, TTM would have ensured all fences that would
have been copied are signaled, including any remaining preempt
fences.

Fixes: dd08ebf6c352 ("drm/xe: Introduce a new DRM driver for Intel GPUs")
Fixes: fa0af721bd1f ("drm/ttm: test private resv obj on release/destroy")
Cc: Matthew Brost &lt;matthew.brost@intel.com&gt;
Cc: &lt;stable@vger.kernel.org&gt; # v6.16+
Signed-off-by: Thomas Hellström &lt;thomas.hellstrom@linux.intel.com&gt;
Tested-by: Matthew Brost &lt;matthew.brost@intel.com&gt;
Reviewed-by: Matthew Brost &lt;matthew.brost@intel.com&gt;
Link: https://patch.msgid.link/20251217093441.5073-1-thomas.hellstrom@linux.intel.com
(cherry picked from commit 425fe550fb513b567bd6d01f397d274092a9c274)
Signed-off-by: Thomas Hellström &lt;thomas.hellstrom@linux.intel.com&gt;
</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
When imported dma-bufs are destroyed, TTM is not fully
individualizing the dma-resv, but it *is* copying the fences that
need to be waited for before declaring idle. So in the case where
the bo-&gt;resv != bo-&gt;_resv we can still drop the preempt-fences, but
make sure we do that on bo-&gt;_resv which contains the fence-pointer
copy.

In the case where the copying fails, bo-&gt;_resv will typically not
contain any fences pointers at all, so there will be nothing to
drop. In that case, TTM would have ensured all fences that would
have been copied are signaled, including any remaining preempt
fences.

Fixes: dd08ebf6c352 ("drm/xe: Introduce a new DRM driver for Intel GPUs")
Fixes: fa0af721bd1f ("drm/ttm: test private resv obj on release/destroy")
Cc: Matthew Brost &lt;matthew.brost@intel.com&gt;
Cc: &lt;stable@vger.kernel.org&gt; # v6.16+
Signed-off-by: Thomas Hellström &lt;thomas.hellstrom@linux.intel.com&gt;
Tested-by: Matthew Brost &lt;matthew.brost@intel.com&gt;
Reviewed-by: Matthew Brost &lt;matthew.brost@intel.com&gt;
Link: https://patch.msgid.link/20251217093441.5073-1-thomas.hellstrom@linux.intel.com
(cherry picked from commit 425fe550fb513b567bd6d01f397d274092a9c274)
Signed-off-by: Thomas Hellström &lt;thomas.hellstrom@linux.intel.com&gt;
</pre>
</div>
</content>
</entry>
<entry>
<title>drm/xe/eustall: Disallow 0 EU stall property values</title>
<updated>2025-12-18T17:12:09+00:00</updated>
<author>
<name>Ashutosh Dixit</name>
<email>ashutosh.dixit@intel.com</email>
</author>
<published>2025-12-12T06:18:50+00:00</published>
<link rel='alternate' type='text/html' href='https://git.toradex.cn/cgit/linux-toradex.git/commit/?id=3767ca4166ad42fa9e34269efeaf9f15995cd92d'/>
<id>3767ca4166ad42fa9e34269efeaf9f15995cd92d</id>
<content type='text'>
An EU stall property value of 0 is invalid and will cause a NPD.

Reported-by: Peter Senna Tschudin &lt;peter.senna@linux.intel.com&gt;
Closes: https://gitlab.freedesktop.org/drm/xe/kernel/-/issues/6453
Fixes: 1537ec85ebd7 ("drm/xe/uapi: Introduce API for EU stall sampling")
Cc: stable@vger.kernel.org
Signed-off-by: Ashutosh Dixit &lt;ashutosh.dixit@intel.com&gt;
Reviewed-by: Harish Chegondi &lt;harish.chegondi@intel.com&gt;
Link: https://patch.msgid.link/20251212061850.1565459-4-ashutosh.dixit@intel.com
(cherry picked from commit 5bf763e908bf795da4ad538d21c1ec41f8021f76)
Signed-off-by: Thomas Hellström &lt;thomas.hellstrom@linux.intel.com&gt;
</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
An EU stall property value of 0 is invalid and will cause a NPD.

Reported-by: Peter Senna Tschudin &lt;peter.senna@linux.intel.com&gt;
Closes: https://gitlab.freedesktop.org/drm/xe/kernel/-/issues/6453
Fixes: 1537ec85ebd7 ("drm/xe/uapi: Introduce API for EU stall sampling")
Cc: stable@vger.kernel.org
Signed-off-by: Ashutosh Dixit &lt;ashutosh.dixit@intel.com&gt;
Reviewed-by: Harish Chegondi &lt;harish.chegondi@intel.com&gt;
Link: https://patch.msgid.link/20251212061850.1565459-4-ashutosh.dixit@intel.com
(cherry picked from commit 5bf763e908bf795da4ad538d21c1ec41f8021f76)
Signed-off-by: Thomas Hellström &lt;thomas.hellstrom@linux.intel.com&gt;
</pre>
</div>
</content>
</entry>
<entry>
<title>drm/xe/oa: Disallow 0 OA property values</title>
<updated>2025-12-18T17:11:45+00:00</updated>
<author>
<name>Ashutosh Dixit</name>
<email>ashutosh.dixit@intel.com</email>
</author>
<published>2025-12-12T06:18:49+00:00</published>
<link rel='alternate' type='text/html' href='https://git.toradex.cn/cgit/linux-toradex.git/commit/?id=3595114bc31d1eb5e1996164c901485c1ffac6f7'/>
<id>3595114bc31d1eb5e1996164c901485c1ffac6f7</id>
<content type='text'>
An OA property value of 0 is invalid and will cause a NPD.

Reported-by: Peter Senna Tschudin &lt;peter.senna@linux.intel.com&gt;
Closes: https://gitlab.freedesktop.org/drm/xe/kernel/-/issues/6452
Fixes: cc4e6994d5a2 ("drm/xe/oa: Move functions up so they can be reused for config ioctl")
Cc: stable@vger.kernel.org
Signed-off-by: Ashutosh Dixit &lt;ashutosh.dixit@intel.com&gt;
Reviewed-by: Harish Chegondi &lt;harish.chegondi@intel.com&gt;
Link: https://patch.msgid.link/20251212061850.1565459-3-ashutosh.dixit@intel.com
(cherry picked from commit 7a100e6ddcc47c1f6ba7a19402de86ce24790621)
Signed-off-by: Thomas Hellström &lt;thomas.hellstrom@linux.intel.com&gt;
</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
An OA property value of 0 is invalid and will cause a NPD.

Reported-by: Peter Senna Tschudin &lt;peter.senna@linux.intel.com&gt;
Closes: https://gitlab.freedesktop.org/drm/xe/kernel/-/issues/6452
Fixes: cc4e6994d5a2 ("drm/xe/oa: Move functions up so they can be reused for config ioctl")
Cc: stable@vger.kernel.org
Signed-off-by: Ashutosh Dixit &lt;ashutosh.dixit@intel.com&gt;
Reviewed-by: Harish Chegondi &lt;harish.chegondi@intel.com&gt;
Link: https://patch.msgid.link/20251212061850.1565459-3-ashutosh.dixit@intel.com
(cherry picked from commit 7a100e6ddcc47c1f6ba7a19402de86ce24790621)
Signed-off-by: Thomas Hellström &lt;thomas.hellstrom@linux.intel.com&gt;
</pre>
</div>
</content>
</entry>
<entry>
<title>drm/xe/xe_sriov_vfio: Fix return value in xe_sriov_vfio_migration_supported()</title>
<updated>2025-12-18T17:11:32+00:00</updated>
<author>
<name>Dan Carpenter</name>
<email>dan.carpenter@linaro.org</email>
</author>
<published>2025-12-05T11:39:19+00:00</published>
<link rel='alternate' type='text/html' href='https://git.toradex.cn/cgit/linux-toradex.git/commit/?id=eb192bedf5908e63347c4923c5a1d58f9baef158'/>
<id>eb192bedf5908e63347c4923c5a1d58f9baef158</id>
<content type='text'>
The xe_sriov_vfio_migration_supported() function is type bool so
returning -EPERM means returning true.  Return false instead.

Fixes: bd45d46ffc8f ("drm/xe/pf: Export helpers for VFIO")
Signed-off-by: Dan Carpenter &lt;dan.carpenter@linaro.org&gt;
Reviewed-by: Michal Wajdeczko &lt;michal.wajdeczko@intel.com&gt;
Link: https://patch.msgid.link/aTLEZ4g-FD-iMQ2V@stanley.mountain
Signed-off-by: Michał Winiarski &lt;michal.winiarski@intel.com&gt;
(cherry picked from commit 0a2404c8f6a3a120f79c57ef8a3302c8e8bc34d9)
Signed-off-by: Thomas Hellström &lt;thomas.hellstrom@linux.intel.com&gt;
</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
The xe_sriov_vfio_migration_supported() function is type bool so
returning -EPERM means returning true.  Return false instead.

Fixes: bd45d46ffc8f ("drm/xe/pf: Export helpers for VFIO")
Signed-off-by: Dan Carpenter &lt;dan.carpenter@linaro.org&gt;
Reviewed-by: Michal Wajdeczko &lt;michal.wajdeczko@intel.com&gt;
Link: https://patch.msgid.link/aTLEZ4g-FD-iMQ2V@stanley.mountain
Signed-off-by: Michał Winiarski &lt;michal.winiarski@intel.com&gt;
(cherry picked from commit 0a2404c8f6a3a120f79c57ef8a3302c8e8bc34d9)
Signed-off-by: Thomas Hellström &lt;thomas.hellstrom@linux.intel.com&gt;
</pre>
</div>
</content>
</entry>
<entry>
<title>drm/xe/oa: Always set OAG_OAGLBCTXCTRL_COUNTER_RESUME</title>
<updated>2025-12-18T17:11:22+00:00</updated>
<author>
<name>Ashutosh Dixit</name>
<email>ashutosh.dixit@intel.com</email>
</author>
<published>2025-12-05T21:26:13+00:00</published>
<link rel='alternate' type='text/html' href='https://git.toradex.cn/cgit/linux-toradex.git/commit/?id=256edb267a9d0b5aef70e408e9fba4f930f9926e'/>
<id>256edb267a9d0b5aef70e408e9fba4f930f9926e</id>
<content type='text'>
Reports can be written out to the OA buffer using ways other than periodic
sampling. These include mmio trigger and context switches. To support these
use cases, when periodic sampling is not enabled,
OAG_OAGLBCTXCTRL_COUNTER_RESUME must be set.

Fixes: 1db9a9dc90ae ("drm/xe/oa: OA stream initialization (OAG)")
Signed-off-by: Ashutosh Dixit &lt;ashutosh.dixit@intel.com&gt;
Reviewed-by: Umesh Nerlige Ramappa &lt;umesh.nerlige.ramappa@intel.com&gt;
Link: https://patch.msgid.link/20251205212613.826224-4-ashutosh.dixit@intel.com
(cherry picked from commit 88d98e74adf3e20f678bb89581a5c3149fdbdeaa)
Signed-off-by: Thomas Hellström &lt;thomas.hellstrom@linux.intel.com&gt;
</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
Reports can be written out to the OA buffer using ways other than periodic
sampling. These include mmio trigger and context switches. To support these
use cases, when periodic sampling is not enabled,
OAG_OAGLBCTXCTRL_COUNTER_RESUME must be set.

Fixes: 1db9a9dc90ae ("drm/xe/oa: OA stream initialization (OAG)")
Signed-off-by: Ashutosh Dixit &lt;ashutosh.dixit@intel.com&gt;
Reviewed-by: Umesh Nerlige Ramappa &lt;umesh.nerlige.ramappa@intel.com&gt;
Link: https://patch.msgid.link/20251205212613.826224-4-ashutosh.dixit@intel.com
(cherry picked from commit 88d98e74adf3e20f678bb89581a5c3149fdbdeaa)
Signed-off-by: Thomas Hellström &lt;thomas.hellstrom@linux.intel.com&gt;
</pre>
</div>
</content>
</entry>
<entry>
<title>drm/xe: Adjust long-running workload timeslices to reasonable values</title>
<updated>2025-12-18T17:11:04+00:00</updated>
<author>
<name>Matthew Brost</name>
<email>matthew.brost@intel.com</email>
</author>
<published>2025-12-12T18:28:41+00:00</published>
<link rel='alternate' type='text/html' href='https://git.toradex.cn/cgit/linux-toradex.git/commit/?id=6f0f404bd289d79a260b634c5b3f4d330b13472c'/>
<id>6f0f404bd289d79a260b634c5b3f4d330b13472c</id>
<content type='text'>
A 10ms timeslice for long-running workloads is far too long and causes
significant jitter in benchmarks when the system is shared. Adjust the
value to 5ms for preempt-fencing VMs, as the resume step there is quite
costly as memory is moved around, and set it to zero for pagefault VMs,
since switching back to pagefault mode after dma-fence mode is
relatively fast.

Also change min_run_period_ms to 'unsiged int' type rather than 's64' as
only positive values make sense.

Fixes: dd08ebf6c352 ("drm/xe: Introduce a new DRM driver for Intel GPUs")
Cc: stable@vger.kernel.org
Signed-off-by: Matthew Brost &lt;matthew.brost@intel.com&gt;
Reviewed-by: Thomas Hellström &lt;thomas.hellstrom@linux.intel.com&gt;
Link: https://patch.msgid.link/20251212182847.1683222-2-matthew.brost@intel.com
(cherry picked from commit 33a5abd9a68394aa67f9618b20eee65ee8702ff4)
Signed-off-by: Thomas Hellström &lt;thomas.hellstrom@linux.intel.com&gt;
</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
A 10ms timeslice for long-running workloads is far too long and causes
significant jitter in benchmarks when the system is shared. Adjust the
value to 5ms for preempt-fencing VMs, as the resume step there is quite
costly as memory is moved around, and set it to zero for pagefault VMs,
since switching back to pagefault mode after dma-fence mode is
relatively fast.

Also change min_run_period_ms to 'unsiged int' type rather than 's64' as
only positive values make sense.

Fixes: dd08ebf6c352 ("drm/xe: Introduce a new DRM driver for Intel GPUs")
Cc: stable@vger.kernel.org
Signed-off-by: Matthew Brost &lt;matthew.brost@intel.com&gt;
Reviewed-by: Thomas Hellström &lt;thomas.hellstrom@linux.intel.com&gt;
Link: https://patch.msgid.link/20251212182847.1683222-2-matthew.brost@intel.com
(cherry picked from commit 33a5abd9a68394aa67f9618b20eee65ee8702ff4)
Signed-off-by: Thomas Hellström &lt;thomas.hellstrom@linux.intel.com&gt;
</pre>
</div>
</content>
</entry>
<entry>
<title>drm/xe/oa: Limit num_syncs to prevent oversized allocations</title>
<updated>2025-12-18T17:10:50+00:00</updated>
<author>
<name>Shuicheng Lin</name>
<email>shuicheng.lin@intel.com</email>
</author>
<published>2025-12-05T23:47:18+00:00</published>
<link rel='alternate' type='text/html' href='https://git.toradex.cn/cgit/linux-toradex.git/commit/?id=f8dd66bfb4e184c71bd26418a00546ebe7f5c17a'/>
<id>f8dd66bfb4e184c71bd26418a00546ebe7f5c17a</id>
<content type='text'>
The OA open parameters did not validate num_syncs, allowing
userspace to pass arbitrarily large values, potentially
leading to excessive allocations.

Add check to ensure that num_syncs does not exceed DRM_XE_MAX_SYNCS,
returning -EINVAL when the limit is violated.

v2: use XE_IOCTL_DBG() and drop duplicated check. (Ashutosh)

Fixes: c8507a25cebd ("drm/xe/oa/uapi: Define and parse OA sync properties")
Cc: Matthew Brost &lt;matthew.brost@intel.com&gt;
Cc: Ashutosh Dixit &lt;ashutosh.dixit@intel.com&gt;
Signed-off-by: Shuicheng Lin &lt;shuicheng.lin@intel.com&gt;
Reviewed-by: Ashutosh Dixit &lt;ashutosh.dixit@intel.com&gt;
Signed-off-by: Matthew Brost &lt;matthew.brost@intel.com&gt;
Link: https://patch.msgid.link/20251205234715.2476561-6-shuicheng.lin@intel.com
(cherry picked from commit e057b2d2b8d815df3858a87dffafa2af37e5945b)
Signed-off-by: Thomas Hellström &lt;thomas.hellstrom@linux.intel.com&gt;
</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
The OA open parameters did not validate num_syncs, allowing
userspace to pass arbitrarily large values, potentially
leading to excessive allocations.

Add check to ensure that num_syncs does not exceed DRM_XE_MAX_SYNCS,
returning -EINVAL when the limit is violated.

v2: use XE_IOCTL_DBG() and drop duplicated check. (Ashutosh)

Fixes: c8507a25cebd ("drm/xe/oa/uapi: Define and parse OA sync properties")
Cc: Matthew Brost &lt;matthew.brost@intel.com&gt;
Cc: Ashutosh Dixit &lt;ashutosh.dixit@intel.com&gt;
Signed-off-by: Shuicheng Lin &lt;shuicheng.lin@intel.com&gt;
Reviewed-by: Ashutosh Dixit &lt;ashutosh.dixit@intel.com&gt;
Signed-off-by: Matthew Brost &lt;matthew.brost@intel.com&gt;
Link: https://patch.msgid.link/20251205234715.2476561-6-shuicheng.lin@intel.com
(cherry picked from commit e057b2d2b8d815df3858a87dffafa2af37e5945b)
Signed-off-by: Thomas Hellström &lt;thomas.hellstrom@linux.intel.com&gt;
</pre>
</div>
</content>
</entry>
</feed>
