From mboxrd@z Thu Jan 1 00:00:00 1970 Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.remote-ip=100.103.45.18 ARC-Seal: i=1; d=subspace.kernel.org; s=arc20261015; a=rsa-sha256; cv=none; t=1794045819; b=TkZ5gLmQJbjssp6Dap0xfSJy3FqaJJTPKkS5qDf5MF78tYMpd/CfNhohrvLrd4Ji4VhV 3wHCAxizR4t9v6BJ9la1KBLrfll0OhV1GtXSthb4DoUsY84rlRs1oiIst9BXPk7ZWcyH1 U/C+H2iLfsySElVSa7CM2AWEhWhMBEksV5wPktGa8lKgEaw0AmSAwtkCWNiLRZcxexoRA jO2gUdHMTzMNc9aKBijx1apHl75OBglrSam4NtFIgqS+oXiFgUUfRABl6RJb8ViZaLFG3 5HKNrjQQ2juE5iIxtw0fB3iMbYSPpynb74YkVmWYyC5n2OrPXhpHH7oy7XGuw1DMr5A== ARC-Message-Signature: i=1; d=subspace.kernel.org; s=arc20261015; a=rsa-sha256; c=relaxed/relaxed; t=1794045819; h=Received:DKIM-Signature:From:To:Cc:Subject:Date:Message-ID:X-Mailer: MIME-Version:Content-Type:Content-Transfer-Encoding; bh=bczSPxQBDRYJpWPFXpD6wftM4qFGRO6N0vJYag+Z26Y=; b=1qvDqR36CRRSaNvHwZe4Hr2YVeemPF/a5FNHxWmc4Svx3v5TKeA3XDf/kvtT/QTL90xR JQKqCCfM3B0QYRN7LQrHNb1tjLDUbkVXBdTdKohCi8U+TT14khtVwsFagfhXGMsogVpZZ 15SEtinbv3n805oxpfAZBkyaTyH6oskcDA4ZnEmOtynguNaptX//lyff81AgeKtHgxF0D UKVydHMp1FPr5dJbdtpBxWwjWOirWXnppSU0JHx4vY/8XWQ7TcHCwopoZztZMHV6oVB+Z 2pyA4iLPqB1seN+GMRUg5LpUHM84XQlDUrhYzvVxJ666q3NZ+xLxqD0n0fBpxU5tdmQ== ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dkim=pass header.d=kernel.org header.i=@kernel.org header.a=rsa-sha256 header.s=k20260515 header.b=Q8VZ2XtX; arc=none smtp.remote-ip=100.103.45.18 Received: from smtp.kernel.org (quasi.space.kernel.org [100.103.45.18]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature ECDSA (prime256v1)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 718DD606A326 for ; Sat, 7 Nov 2026 10:03:39 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.a=rsa-sha256 header.s=k20260515 header.b=Q8VZ2XtX Received: by smtp.kernel.org (Postfix) with ESMTPSA id 732AD1F0089F; Sat, 7 Nov 2026 10:03:38 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=kernel.org; s=k20260515; t=1794045819; bh=bczSPxQBDRYJpWPFXpD6wftM4qFGRO6N0vJYag+Z26Y=; h=From:To:Cc:Subject:Date; b=Q8VZ2XtXnmartrr9wQvecl5rgPxlwKgdSaV75H48v3YELE1PR6rsSAf5gYLU2xWOv 1oZEU7r+x492sVqZGc5IzuAl3rgqO2UPqMAWLcWwkRqX71hrU7jxBVQPtdKOlXe1A8 0sgedeb1nyrC/BGDx6RqIcT1ie2lX/9rio/6GrzV/InZpMIqlfi6D98Sawr4l7yTZa /CVAYbfw1YfbzkNqhkhxo9F0hqLiFLjVSkSrt5I31tILuQNGH1sKfnzIoSco3RbQrL qFtmTNr4e5Pm85IOizJuhgJH4jVBGpqGalqL4VF+m+fX5mG4Jl6ZQ7lTyHibd5cUCY 4g4A8kY10powA== From: Sasha Levin To: tilak.tirumalesh.tangudu@intel.com, vinay.belgaumkar@intel.com, matthew.d.roper@intel.com Cc: stable@vger.kernel.org Subject: FAILED: patch "[PATCH] drm/xe: harden adjust_idledly() against divide-by-zero and overflow" failed to apply to 7.3-stable tree Date: Sat, 7 Nov 2026 05:03:37 -0500 Message-ID: <20261107050337-failed-7.3-d864065ea25e@kernel.org> X-Mailer: git-send-email 2.53.0 X-Mailing-List: stable@vger.kernel.org List-Id: List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The patch below does not apply to the 7.3-stable tree. If someone wants it applied there, or to any other stable or longterm tree, then please email the backport, including the original git commit id to . To reproduce the conflict and resubmit, you may use the following commands: git fetch https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ linux-7.3.y git checkout FETCH_HEAD git cherry-pick -x d864065ea25e9d12897c175de9176ce46677e176 # git commit -s git send-email --to '' --in-reply-to '20261107050337-failed-7.3-d864065ea25e@kernel.org' --subject-prefix 'PATCH 7.3.y' 'HEAD^..' Thanks, Sasha ------------------ original commit in Linus's tree ------------------ >From d864065ea25e9d12897c175de9176ce46677e176 Mon Sep 17 00:00:00 2001 From: Tangudu Tilak Tirumalesh Date: Wed, 16 Sep 2026 15:35:44 +0530 Subject: [PATCH] drm/xe: harden adjust_idledly() against divide-by-zero and overflow adjust_idledly() has several corner-case issues flagged during review: 1. If xe_gt_clock_init() failed to recognise the crystal clock, gt->info.timestamp_base is 0, which makes idledly_units_ps also 0. The subsequent DIV_ROUND_CLOSEST(..., idledly_units_ps) is then a divide-by-zero and panics the kernel. 2. The tick-to-ns conversions are done in u32: idledly * idledly_units_ps, (maxcnt - 1) * 1000 Both overflow u32 before DIV_ROUND_CLOSEST() sees them. 3. If IDLE_WAIT_TIME reads back as 0, maxcnt evaluates to 0 and the maxcnt - 1 clamp wraps to 0xFFFFFFFF in u32. 4. The register only stores whole ticks, so the clamped ns value has to be converted to ticks and back. DIV_ROUND_CLOSEST() can round that conversion up past maxcnt: maxcnt = 640 ns, one tick = 666664 ps clamp: maxcnt - 1 = 639 ns ns -> ticks: 639000 / 666664 = 0.958 -> rounds to 1 tick tick -> ns: 1 * 666664 / 1000 = 667 ns 667 ns is programmed into RING_IDLEDLY, but 667 >= maxcnt (640), so xe_gt_WARN_ON() fires again on every subsequent init. Return early if timestamp_base is 0 (the unknown-crystal path). Do the conversions in u64 via the *_ULL() helpers so they cannot wrap. Clamp with a floor (DIV_ROUND_DOWN_ULL) so the programmed delay stays strictly below maxcnt, and guard the maxcnt == 0 case with a zero delay while still writing RING_IDLEDLY so INHIBIT_SWITCH_UNTIL_PREEMPTED is cleared. v2: Drop the redundant warn on the timestamp_base == 0 path; xe_gt_clock_init() already warns on an unrecognised crystal clock. Keep the early return to avoid the divide-by-zero. - Vinay v3: Field-mask the RING_IDLEDLY write with REG_FIELD_PREP(IDLE_DELAY, ...) instead of writing the raw tick count, which could clobber INHIBIT_SWITCH_UNTIL_PREEMPTED and reserved bits. Split the inhibit-switch clear from the maxcnt clamp so a set inhibit bit no longer forces a needless delay overwrite when the delay itself is already valid. Use gt_to_xe(gt) instead of gt_to_xe(hwe->gt). Fixes: d2de4410a88f ("drm/xe: Apply Wa_16023105232") Cc: stable@vger.kernel.org Assisted-by: GitHub_Copilot:claude-opus-4.8 Signed-off-by: Tangudu Tilak Tirumalesh Reviewed-by: Vinay Belgaumkar Link: https://patch.msgid.link/20260916100545.779894-2-tilak.tirumalesh.tangudu@intel.com Signed-off-by: Matt Roper --- drivers/gpu/drm/xe/xe_hw_engine.c | 27 +++++++++++++++++++++------ 1 file changed, 21 insertions(+), 6 deletions(-) diff --git a/drivers/gpu/drm/xe/xe_hw_engine.c b/drivers/gpu/drm/xe/xe_hw_engine.c index 010499766fce2..d868af8e33019 100644 --- a/drivers/gpu/drm/xe/xe_hw_engine.c +++ b/drivers/gpu/drm/xe/xe_hw_engine.c @@ -592,22 +592,37 @@ static void adjust_idledly(struct xe_hw_engine *hwe) u32 idledly_units_ps = 8 * gt->info.timestamp_base; u32 maxcnt_units_ns = 640; bool inhibit_switch = 0; + bool wa_applied = false; + + if (!IS_SRIOV_VF(gt_to_xe(gt)) && XE_GT_WA(gt, 16023105232)) { + /* xe_gt_clock_init() warns and zeroes timestamp_base on unknown crystal clock. */ + if (!idledly_units_ps) + return; - if (!IS_SRIOV_VF(gt_to_xe(hwe->gt)) && XE_GT_WA(gt, 16023105232)) { idledly = xe_mmio_read32(>->mmio, RING_IDLEDLY(hwe->mmio_base)); maxcnt = xe_mmio_read32(>->mmio, RING_PWRCTX_MAXCNT(hwe->mmio_base)); inhibit_switch = idledly & INHIBIT_SWITCH_UNTIL_PREEMPTED; idledly = REG_FIELD_GET(IDLE_DELAY, idledly); - idledly = DIV_ROUND_CLOSEST(idledly * idledly_units_ps, 1000); + idledly = DIV_ROUND_CLOSEST_ULL((u64)idledly * idledly_units_ps, 1000); maxcnt = REG_FIELD_GET(IDLE_WAIT_TIME, maxcnt); maxcnt *= maxcnt_units_ns; - if (xe_gt_WARN_ON(gt, idledly >= maxcnt || inhibit_switch)) { - idledly = DIV_ROUND_CLOSEST(((maxcnt - 1) * 1000), - idledly_units_ps); - xe_mmio_write32(>->mmio, RING_IDLEDLY(hwe->mmio_base), idledly); + /* Clear the inhibit switch without disturbing a valid delay. */ + if (inhibit_switch) + wa_applied = true; + + if (xe_gt_WARN_ON(gt, idledly >= maxcnt)) { + /* Floor below maxcnt; write 0 to still clear the inhibit bit. */ + idledly = maxcnt ? + DIV_ROUND_DOWN_ULL((u64)(maxcnt - 1) * 1000, + idledly_units_ps) : 0; + wa_applied = true; } + + if (wa_applied) + xe_mmio_write32(>->mmio, RING_IDLEDLY(hwe->mmio_base), + REG_FIELD_PREP(IDLE_DELAY, idledly)); } } -- 2.53.0