fix(AIESW-42718,AIESW-42772,AIESW-42780,AIESW-42800): zocl sysfs, copy-BO, aied, and KDS stat safety

[ManojTakasi]

Problem solved by the commit

• AIESW-42718. The zocl sysfs readers read_aie_metadata, read_debug_ip_layout, read_ip_layout, read_connectivity, and read_mem_topology walk every populated PR slot and memcpy up to count bytes per slot. buf advances, but count does not, so a second slot writes past the buffer kernfs allocated for that read().
• AIESW-42772. zocl_can_dma_performed() checks dst_offset + size and src_offset + size as uint64_t additions. An offset near 2^64 -1 wraps, the check passes, and zocl_copy_bo_async() adds that offset to the buffer-object physical address before DMA.
• AIESW-42780. aied::poll_aie() reads m_graphs while register_graph() and deregister_graph() insert and erase it. A reallocation or a graph destructor can free memory the poll thread is still using. done was a plain bool shared with the poll thread.
• AIESW-42800. show_kds_cuctx_stat_raw() walks kds->clients, cu_ctx_list, and hw_ctx_list while holding only cu_mgmt->lock. Those lists are updated under kds->lock and client->lock. A concurrent kds_free_cu_ctx() or kds_free_hw_ctx() can list_del and vfree a node the sysfs walk still dereferences. cu_idx was also used to index xcus[] with no upper bound.

Bug / issue (if any) fixed, which PR introduced the bug, how it was discovered

How problem was solved, alternative solutions (if any) and why they were rejected

• AIESW-42718. Each reader stops when count is exhausted and subtracts nread after every slot copy. A single helper was rejected so the five existing copy sites stay local and the per-slot offset behavior is unchanged.

• AIESW-42772. The check is now offset > bo_size || size > bo_size - offset, for both source and destination, before any addition. check_add_overflow() was rejected because the needed condition is "this range lies inside the buffer object," which the compare-before-subtract states directly.

• AIESW-42780. m_graphs_lock covers register, deregister, the empty check, and the status loop, including getname() and getstatus(). done is std::atomic. std::lock_guard unlocks at the end of its scope. Copying the vector and dropping the lock before getname()/getstatus() was rejected because the graph object can still be destroyed. std::shared_mutex was rejected because the poll thread must exclude deregister for the whole call. On rebase, upstream had renamed Aied to aied; the same lock was applied to m_graphs.

• AIESW-42800. The walk takes kds->lock around kds->clients and client->lock around each client's lists. cu_mgmt->lock is taken only while reading xcus[], and only after client->lock, because the ioctl path already uses that order. cu_idx >= MAX_CUS is skipped. RCU was rejected because these lists already have mutexes. Holding cu_mgmt->lock and then taking client->lock was rejected because kds_add_context() and kds_del_context() take client->lock and then cu_mgmt->lock.

Risks (if any) associated the changes in the commit

low

What has been tested and how, request additional testing if necessary

Testd on vck190 hw

Documentation impact (if any)

None

[github-actions]

clang-tidy review says "All clean, LGTM! 👍"