From patchwork Thu Nov 11 19:24:55 2021 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Rob Clark X-Patchwork-Id: 12615597 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 0EA23C433EF for ; Thu, 11 Nov 2021 19:20:01 +0000 (UTC) Received: from gabe.freedesktop.org (gabe.freedesktop.org [131.252.210.177]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPS id CDB3F61269 for ; Thu, 11 Nov 2021 19:20:00 +0000 (UTC) DMARC-Filter: OpenDMARC Filter v1.4.1 mail.kernel.org CDB3F61269 Authentication-Results: mail.kernel.org; dmarc=fail (p=none dis=none) header.from=gmail.com Authentication-Results: mail.kernel.org; spf=none smtp.mailfrom=lists.freedesktop.org Received: from gabe.freedesktop.org (localhost [127.0.0.1]) by gabe.freedesktop.org (Postfix) with ESMTP id 49FE46E911; Thu, 11 Nov 2021 19:19:56 +0000 (UTC) Received: from mail-pj1-x1035.google.com (mail-pj1-x1035.google.com [IPv6:2607:f8b0:4864:20::1035]) by gabe.freedesktop.org (Postfix) with ESMTPS id 2AD9C6E8F3; Thu, 11 Nov 2021 19:19:54 +0000 (UTC) Received: by mail-pj1-x1035.google.com with SMTP id gf14-20020a17090ac7ce00b001a7a2a0b5c3so5190007pjb.5; Thu, 11 Nov 2021 11:19:54 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20210112; h=from:to:cc:subject:date:message-id:in-reply-to:references :mime-version:content-transfer-encoding; bh=JmBLUrJ1pjWQ4c27cD0iWXnDGV3xPRlcSYls26QLyvM=; b=SFYqejm6GHXh73rIi8sp5NbmZZ3W339y3vnR/UWO+Jo8FFki88Vptu7yo08uDxeORl jrR1wf7rtOOAPSV7gsXIxcwdY2uOQn8ULunE1lgPmgqWt1+xbk4uJ8g20ajVoVVXHvTh SlA8XqRMoWaKnvIIz5bPYa97IhT5Kl8y+395Fna9MHkXn3/Oh7DizRDknkpiSdxR04DM 2SrtmFdrsaf07sGdza6bMWcAzXspNnF+gpf13RjguY/dyIOCSORWeGaCZ/V5IYf1XPNu CHa9NB5z0f2XueMxFQ6Z3b3CGErWBnoYu7Zz3pifXLSRRygMNZonyPpjN3l6YJKEOsh/ kbyQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20210112; h=x-gm-message-state:from:to:cc:subject:date:message-id:in-reply-to :references:mime-version:content-transfer-encoding; bh=JmBLUrJ1pjWQ4c27cD0iWXnDGV3xPRlcSYls26QLyvM=; b=HOJ6reLQ/L4eYjtsrH1NJxCRznx8aEIpnDQbEP1G14g6OTqM36vjdvUfA85VC1wEcK zJyzKnUREMWDbHsg8utlbFXm3kFBvqPLMCQ6LQy7u5ymJPrC3Z/TKeb4ABvzQTrYRg1D ZpuX9PnHt2NjjhyJl/EE7IIjorLM5oThH068EDRVnsoBIWPrVza8LgN8M01oEkHMJRA7 ZaFh4PmfbEG2qfjI+pnxeEIDTTx2y7lcyUo2sxJ1um9Fq9Y30VAvvVw0CBlESqYHDL59 6xfzruNkr+Xo4ONr54i5vXmNp+gZTFB4rgEMsFN/3Kz1zfbZayZGpFTs2tHF4MNyznNa STEA== X-Gm-Message-State: AOAM531QGdO6JTlswgE8OrsOPo0eW6EB469D5gdNiUy7f9PSpiFproTa Ii2ana/6UQV+5p0H6mVlltyN8fd1sBw= X-Google-Smtp-Source: ABdhPJwUDT3B3FYu1EtS/05ERDv63SGfgPigtC2o1eHKy2r6IRLrQnTx/ASkxfHvaAdLa0zev4uyww== X-Received: by 2002:a17:90b:3e8c:: with SMTP id rj12mr11006957pjb.152.1636658393183; Thu, 11 Nov 2021 11:19:53 -0800 (PST) Received: from localhost (c-73-25-156-94.hsd1.or.comcast.net. [73.25.156.94]) by smtp.gmail.com with ESMTPSA id j6sm2855418pgf.60.2021.11.11.11.19.51 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Thu, 11 Nov 2021 11:19:52 -0800 (PST) From: Rob Clark To: dri-devel@lists.freedesktop.org Subject: [PATCH 1/2] drm/msm: Fix wait_fence submitqueue leak Date: Thu, 11 Nov 2021 11:24:55 -0800 Message-Id: <20211111192457.747899-2-robdclark@gmail.com> X-Mailer: git-send-email 2.31.1 In-Reply-To: <20211111192457.747899-1-robdclark@gmail.com> References: <20211111192457.747899-1-robdclark@gmail.com> MIME-Version: 1.0 X-BeenThere: dri-devel@lists.freedesktop.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Direct Rendering Infrastructure - Development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Cc: Rob Clark , David Airlie , linux-arm-msm@vger.kernel.org, Akhil P Oommen , open list , Sean Paul , freedreno@lists.freedesktop.org, =?utf-8?q?Christian_K=C3=B6nig?= Errors-To: dri-devel-bounces@lists.freedesktop.org Sender: "dri-devel" From: Rob Clark We weren't dropping the submitqueue reference in all paths. In particular, when the fence has already been signalled. Split out a helper to simplify handling this in the various different return paths. Fixes: a61acbbe9cf8 ("drm/msm: Track "seqno" fences by idr") Signed-off-by: Rob Clark --- drivers/gpu/drm/msm/msm_drv.c | 49 +++++++++++++++++++++-------------- 1 file changed, 29 insertions(+), 20 deletions(-) diff --git a/drivers/gpu/drm/msm/msm_drv.c b/drivers/gpu/drm/msm/msm_drv.c index 73e827641024..cb14d997c174 100644 --- a/drivers/gpu/drm/msm/msm_drv.c +++ b/drivers/gpu/drm/msm/msm_drv.c @@ -961,29 +961,12 @@ static int msm_ioctl_gem_info(struct drm_device *dev, void *data, return ret; } -static int msm_ioctl_wait_fence(struct drm_device *dev, void *data, - struct drm_file *file) +static int wait_fence(struct msm_gpu_submitqueue *queue, uint32_t fence_id, + ktime_t timeout) { - struct msm_drm_private *priv = dev->dev_private; - struct drm_msm_wait_fence *args = data; - ktime_t timeout = to_ktime(args->timeout); - struct msm_gpu_submitqueue *queue; - struct msm_gpu *gpu = priv->gpu; struct dma_fence *fence; int ret; - if (args->pad) { - DRM_ERROR("invalid pad: %08x\n", args->pad); - return -EINVAL; - } - - if (!gpu) - return 0; - - queue = msm_submitqueue_get(file->driver_priv, args->queueid); - if (!queue) - return -ENOENT; - /* * Map submitqueue scoped "seqno" (which is actually an idr key) * back to underlying dma-fence @@ -995,7 +978,7 @@ static int msm_ioctl_wait_fence(struct drm_device *dev, void *data, ret = mutex_lock_interruptible(&queue->lock); if (ret) return ret; - fence = idr_find(&queue->fence_idr, args->fence); + fence = idr_find(&queue->fence_idr, fence_id); if (fence) fence = dma_fence_get_rcu(fence); mutex_unlock(&queue->lock); @@ -1011,6 +994,32 @@ static int msm_ioctl_wait_fence(struct drm_device *dev, void *data, } dma_fence_put(fence); + + return ret; +} + +static int msm_ioctl_wait_fence(struct drm_device *dev, void *data, + struct drm_file *file) +{ + struct msm_drm_private *priv = dev->dev_private; + struct drm_msm_wait_fence *args = data; + struct msm_gpu_submitqueue *queue; + int ret; + + if (args->pad) { + DRM_ERROR("invalid pad: %08x\n", args->pad); + return -EINVAL; + } + + if (!priv->gpu) + return 0; + + queue = msm_submitqueue_get(file->driver_priv, args->queueid); + if (!queue) + return -ENOENT; + + ret = wait_fence(queue, args->fence, to_ktime(args->timeout)); + msm_submitqueue_put(queue); return ret; From patchwork Thu Nov 11 19:24:56 2021 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Rob Clark X-Patchwork-Id: 12615599 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id B8437C433EF for ; Thu, 11 Nov 2021 19:20:04 +0000 (UTC) Received: from gabe.freedesktop.org (gabe.freedesktop.org [131.252.210.177]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPS id 87EAF61269 for ; Thu, 11 Nov 2021 19:20:04 +0000 (UTC) DMARC-Filter: OpenDMARC Filter v1.4.1 mail.kernel.org 87EAF61269 Authentication-Results: mail.kernel.org; dmarc=fail (p=none dis=none) header.from=gmail.com Authentication-Results: mail.kernel.org; spf=none smtp.mailfrom=lists.freedesktop.org Received: from gabe.freedesktop.org (localhost [127.0.0.1]) by gabe.freedesktop.org (Postfix) with ESMTP id 9AC146EA41; Thu, 11 Nov 2021 19:20:00 +0000 (UTC) Received: from mail-pg1-x535.google.com (mail-pg1-x535.google.com [IPv6:2607:f8b0:4864:20::535]) by gabe.freedesktop.org (Postfix) with ESMTPS id E97D36E916; Thu, 11 Nov 2021 19:19:56 +0000 (UTC) Received: by mail-pg1-x535.google.com with SMTP id r132so3844419pgr.9; Thu, 11 Nov 2021 11:19:56 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20210112; h=from:to:cc:subject:date:message-id:in-reply-to:references :mime-version:content-transfer-encoding; bh=Gll+pgQtBYECeJn/RU0NsPRmZk9ALD2l3W41Hro7yLE=; b=AtiOD3Rcv6buPs1m+tSPfQKVgnN8eBsb6zxBDTpFTJiTJa1rOCDgBu2nBWCV69MtAP sJtFzHofUFf9nnVgS3EmRlb9Dw6DxhyBWHFO14tzbnh6bm6AP8i0hnpdShokxj2CIt4u TVJ/w7J3RniL9Cn4w3vFshZFd6otTyw2Ia2k0Uh8BzIr5g21HmuAdQaGS8b+yFAxE0XZ VpwAkoKqEIhWvWsuG/8yDKwbSkmrWaSQzz9iuZ7dV42x86dxdXKlQJgd68O/AE9eF3bw gACUE9IDKAVj2nimLwRUE8+KClA8AYb6CW/o0F+rJpwSz1VNsbgRPYjTUlEEKNZ6C4Na +ZnQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20210112; h=x-gm-message-state:from:to:cc:subject:date:message-id:in-reply-to :references:mime-version:content-transfer-encoding; bh=Gll+pgQtBYECeJn/RU0NsPRmZk9ALD2l3W41Hro7yLE=; b=zx5eVzV1wFMC+U4pTxrZi3Y8YkpaBZDR8XM3JjkaidD2abDzkXBedCL67H8w4zfhvt akH/7JTPtGvXOquAX/2amSItIlHHcz2/PvdupM6WMtlc6QZYT46tn6xqCqENz3cCjUwD HCrrtH81DGsWc1xgVajrMqeQ1i/RjiDXrXYEYuqr4ROUiHou+ZnmOP1XTe5/4phjVuJE tW+6QMWkYaiIJzny4r3ds7VR1bwh6XnEo2fTps1FKKdt2XpqoMuh8/fxi7TvBjtlKOhZ Er/+1G5oOLnxniAccz4JDg5S4K+ClXT1mY/VoX9DKDEJaeVS/ylQpxpCv7sHNGJ3CQHz 1/HA== X-Gm-Message-State: AOAM530MoOXF2UmaK5JsZYuYNeCwnvxhDb7twhbl5PsyoMzzwthvLp+W j3kONOTSd8OI2iJ2x8N4/EUm6S4v/Ac= X-Google-Smtp-Source: ABdhPJx+lfYqAWYFGx0tk1yaXqVXH2LpwuOrESzXjHIuYrmwylZZLkLUOPKxleNWssUAHd9SngzmYw== X-Received: by 2002:a63:5a63:: with SMTP id k35mr6119632pgm.230.1636658395706; Thu, 11 Nov 2021 11:19:55 -0800 (PST) Received: from localhost (c-73-25-156-94.hsd1.or.comcast.net. [73.25.156.94]) by smtp.gmail.com with ESMTPSA id m9sm3588886pff.43.2021.11.11.11.19.54 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Thu, 11 Nov 2021 11:19:54 -0800 (PST) From: Rob Clark To: dri-devel@lists.freedesktop.org Subject: [PATCH 2/2] drm/msm: Restore error return on invalid fence Date: Thu, 11 Nov 2021 11:24:56 -0800 Message-Id: <20211111192457.747899-3-robdclark@gmail.com> X-Mailer: git-send-email 2.31.1 In-Reply-To: <20211111192457.747899-1-robdclark@gmail.com> References: <20211111192457.747899-1-robdclark@gmail.com> MIME-Version: 1.0 X-BeenThere: dri-devel@lists.freedesktop.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Direct Rendering Infrastructure - Development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Cc: Rob Clark , David Airlie , linux-arm-msm@vger.kernel.org, Akhil P Oommen , =?utf-8?q?Christian_K=C3=B6nig?= , "moderated list:DMA BUFFER SHARING FRAMEWORK" , Sean Paul , freedreno@lists.freedesktop.org, open list , "open list:DMA BUFFER SHARING FRAMEWORK" Errors-To: dri-devel-bounces@lists.freedesktop.org Sender: "dri-devel" From: Rob Clark When converting to use an idr to map userspace fence seqno values back to a dma_fence, we lost the error return when userspace passes seqno that is larger than the last submitted fence. Restore this check. Reported-by: Akhil P Oommen Fixes: a61acbbe9cf8 ("drm/msm: Track "seqno" fences by idr") Signed-off-by: Rob Clark Reviewed-by: Akhil P Oommen --- Note: I will rebase "drm/msm: Handle fence rollover" on top of this, to simplify backporting this patch to stable kernels drivers/gpu/drm/msm/msm_drv.c | 6 ++++++ drivers/gpu/drm/msm/msm_gem_submit.c | 1 + drivers/gpu/drm/msm/msm_gpu.h | 3 +++ 3 files changed, 10 insertions(+) diff --git a/drivers/gpu/drm/msm/msm_drv.c b/drivers/gpu/drm/msm/msm_drv.c index cb14d997c174..56500eb5219e 100644 --- a/drivers/gpu/drm/msm/msm_drv.c +++ b/drivers/gpu/drm/msm/msm_drv.c @@ -967,6 +967,12 @@ static int wait_fence(struct msm_gpu_submitqueue *queue, uint32_t fence_id, struct dma_fence *fence; int ret; + if (fence_id > queue->last_fence) { + DRM_ERROR_RATELIMITED("waiting on invalid fence: %u (of %u)\n", + fence_id, queue->last_fence); + return -EINVAL; + } + /* * Map submitqueue scoped "seqno" (which is actually an idr key) * back to underlying dma-fence diff --git a/drivers/gpu/drm/msm/msm_gem_submit.c b/drivers/gpu/drm/msm/msm_gem_submit.c index 151d19e4453c..a38f23be497d 100644 --- a/drivers/gpu/drm/msm/msm_gem_submit.c +++ b/drivers/gpu/drm/msm/msm_gem_submit.c @@ -911,6 +911,7 @@ int msm_ioctl_gem_submit(struct drm_device *dev, void *data, drm_sched_entity_push_job(&submit->base, queue->entity); args->fence = submit->fence_id; + queue->last_fence = submit->fence_id; msm_reset_syncobjs(syncobjs_to_reset, args->nr_in_syncobjs); msm_process_post_deps(post_deps, args->nr_out_syncobjs, diff --git a/drivers/gpu/drm/msm/msm_gpu.h b/drivers/gpu/drm/msm/msm_gpu.h index bd4e0024033e..e73a5bb03544 100644 --- a/drivers/gpu/drm/msm/msm_gpu.h +++ b/drivers/gpu/drm/msm/msm_gpu.h @@ -376,6 +376,8 @@ static inline int msm_gpu_convert_priority(struct msm_gpu *gpu, int prio, * @ring_nr: the ringbuffer used by this submitqueue, which is determined * by the submitqueue's priority * @faults: the number of GPU hangs associated with this submitqueue + * @last_fence: the sequence number of the last allocated fence (for error + * checking) * @ctx: the per-drm_file context associated with the submitqueue (ie. * which set of pgtables do submits jobs associated with the * submitqueue use) @@ -391,6 +393,7 @@ struct msm_gpu_submitqueue { u32 flags; u32 ring_nr; int faults; + uint32_t last_fence; struct msm_file_private *ctx; struct list_head node; struct idr fence_idr;