1 // SPDX-License-Identifier: GPL-2.0-only 2 /* 3 * Copyright (C) 2013 Red Hat 4 * Author: Rob Clark <robdclark@gmail.com> 5 */ 6 7 #include <linux/file.h> 8 #include <linux/sync_file.h> 9 #include <linux/uaccess.h> 10 11 #include <drm/drm_drv.h> 12 #include <drm/drm_file.h> 13 #include <drm/drm_syncobj.h> 14 15 #include "msm_drv.h" 16 #include "msm_gpu.h" 17 #include "msm_gem.h" 18 #include "msm_gpu_trace.h" 19 20 /* 21 * Cmdstream submission: 22 */ 23 24 /* make sure these don't conflict w/ MSM_SUBMIT_BO_x */ 25 #define BO_VALID 0x8000 /* is current addr in cmdstream correct/valid? */ 26 #define BO_LOCKED 0x4000 /* obj lock is held */ 27 #define BO_ACTIVE 0x2000 /* active refcnt is held */ 28 #define BO_PINNED 0x1000 /* obj is pinned and on active list */ 29 30 static struct msm_gem_submit *submit_create(struct drm_device *dev, 31 struct msm_gpu *gpu, 32 struct msm_gpu_submitqueue *queue, uint32_t nr_bos, 33 uint32_t nr_cmds) 34 { 35 struct msm_gem_submit *submit; 36 uint64_t sz; 37 int ret; 38 39 sz = struct_size(submit, bos, nr_bos) + 40 ((u64)nr_cmds * sizeof(submit->cmd[0])); 41 42 if (sz > SIZE_MAX) 43 return ERR_PTR(-ENOMEM); 44 45 submit = kzalloc(sz, GFP_KERNEL | __GFP_NOWARN | __GFP_NORETRY); 46 if (!submit) 47 return ERR_PTR(-ENOMEM); 48 49 ret = drm_sched_job_init(&submit->base, queue->entity, queue); 50 if (ret) { 51 kfree(submit); 52 return ERR_PTR(ret); 53 } 54 55 kref_init(&submit->ref); 56 submit->dev = dev; 57 submit->aspace = queue->ctx->aspace; 58 submit->gpu = gpu; 59 submit->cmd = (void *)&submit->bos[nr_bos]; 60 submit->queue = queue; 61 submit->ring = gpu->rb[queue->ring_nr]; 62 submit->fault_dumped = false; 63 64 INIT_LIST_HEAD(&submit->node); 65 66 return submit; 67 } 68 69 void __msm_gem_submit_destroy(struct kref *kref) 70 { 71 struct msm_gem_submit *submit = 72 container_of(kref, struct msm_gem_submit, ref); 73 unsigned i; 74 75 if (submit->fence_id) { 76 mutex_lock(&submit->queue->lock); 77 idr_remove(&submit->queue->fence_idr, submit->fence_id); 78 mutex_unlock(&submit->queue->lock); 79 } 80 81 dma_fence_put(submit->user_fence); 82 dma_fence_put(submit->hw_fence); 83 84 put_pid(submit->pid); 85 msm_submitqueue_put(submit->queue); 86 87 for (i = 0; i < submit->nr_cmds; i++) 88 kfree(submit->cmd[i].relocs); 89 90 kfree(submit); 91 } 92 93 static int submit_lookup_objects(struct msm_gem_submit *submit, 94 struct drm_msm_gem_submit *args, struct drm_file *file) 95 { 96 unsigned i; 97 int ret = 0; 98 99 for (i = 0; i < args->nr_bos; i++) { 100 struct drm_msm_gem_submit_bo submit_bo; 101 void __user *userptr = 102 u64_to_user_ptr(args->bos + (i * sizeof(submit_bo))); 103 104 /* make sure we don't have garbage flags, in case we hit 105 * error path before flags is initialized: 106 */ 107 submit->bos[i].flags = 0; 108 109 if (copy_from_user(&submit_bo, userptr, sizeof(submit_bo))) { 110 ret = -EFAULT; 111 i = 0; 112 goto out; 113 } 114 115 /* at least one of READ and/or WRITE flags should be set: */ 116 #define MANDATORY_FLAGS (MSM_SUBMIT_BO_READ | MSM_SUBMIT_BO_WRITE) 117 118 if ((submit_bo.flags & ~MSM_SUBMIT_BO_FLAGS) || 119 !(submit_bo.flags & MANDATORY_FLAGS)) { 120 DRM_ERROR("invalid flags: %x\n", submit_bo.flags); 121 ret = -EINVAL; 122 i = 0; 123 goto out; 124 } 125 126 submit->bos[i].handle = submit_bo.handle; 127 submit->bos[i].flags = submit_bo.flags; 128 /* in validate_objects() we figure out if this is true: */ 129 submit->bos[i].iova = submit_bo.presumed; 130 } 131 132 spin_lock(&file->table_lock); 133 134 for (i = 0; i < args->nr_bos; i++) { 135 struct drm_gem_object *obj; 136 137 /* normally use drm_gem_object_lookup(), but for bulk lookup 138 * all under single table_lock just hit object_idr directly: 139 */ 140 obj = idr_find(&file->object_idr, submit->bos[i].handle); 141 if (!obj) { 142 DRM_ERROR("invalid handle %u at index %u\n", submit->bos[i].handle, i); 143 ret = -EINVAL; 144 goto out_unlock; 145 } 146 147 drm_gem_object_get(obj); 148 149 submit->bos[i].obj = to_msm_bo(obj); 150 } 151 152 out_unlock: 153 spin_unlock(&file->table_lock); 154 155 out: 156 submit->nr_bos = i; 157 158 return ret; 159 } 160 161 static int submit_lookup_cmds(struct msm_gem_submit *submit, 162 struct drm_msm_gem_submit *args, struct drm_file *file) 163 { 164 unsigned i; 165 size_t sz; 166 int ret = 0; 167 168 for (i = 0; i < args->nr_cmds; i++) { 169 struct drm_msm_gem_submit_cmd submit_cmd; 170 void __user *userptr = 171 u64_to_user_ptr(args->cmds + (i * sizeof(submit_cmd))); 172 173 ret = copy_from_user(&submit_cmd, userptr, sizeof(submit_cmd)); 174 if (ret) { 175 ret = -EFAULT; 176 goto out; 177 } 178 179 /* validate input from userspace: */ 180 switch (submit_cmd.type) { 181 case MSM_SUBMIT_CMD_BUF: 182 case MSM_SUBMIT_CMD_IB_TARGET_BUF: 183 case MSM_SUBMIT_CMD_CTX_RESTORE_BUF: 184 break; 185 default: 186 DRM_ERROR("invalid type: %08x\n", submit_cmd.type); 187 return -EINVAL; 188 } 189 190 if (submit_cmd.size % 4) { 191 DRM_ERROR("non-aligned cmdstream buffer size: %u\n", 192 submit_cmd.size); 193 ret = -EINVAL; 194 goto out; 195 } 196 197 submit->cmd[i].type = submit_cmd.type; 198 submit->cmd[i].size = submit_cmd.size / 4; 199 submit->cmd[i].offset = submit_cmd.submit_offset / 4; 200 submit->cmd[i].idx = submit_cmd.submit_idx; 201 submit->cmd[i].nr_relocs = submit_cmd.nr_relocs; 202 203 userptr = u64_to_user_ptr(submit_cmd.relocs); 204 205 sz = array_size(submit_cmd.nr_relocs, 206 sizeof(struct drm_msm_gem_submit_reloc)); 207 /* check for overflow: */ 208 if (sz == SIZE_MAX) { 209 ret = -ENOMEM; 210 goto out; 211 } 212 submit->cmd[i].relocs = kmalloc(sz, GFP_KERNEL); 213 ret = copy_from_user(submit->cmd[i].relocs, userptr, sz); 214 if (ret) { 215 ret = -EFAULT; 216 goto out; 217 } 218 } 219 220 out: 221 return ret; 222 } 223 224 /* Unwind bo state, according to cleanup_flags. In the success case, only 225 * the lock is dropped at the end of the submit (and active/pin ref is dropped 226 * later when the submit is retired). 227 */ 228 static void submit_cleanup_bo(struct msm_gem_submit *submit, int i, 229 unsigned cleanup_flags) 230 { 231 struct drm_gem_object *obj = &submit->bos[i].obj->base; 232 unsigned flags = submit->bos[i].flags & cleanup_flags; 233 234 if (flags & BO_PINNED) 235 msm_gem_unpin_iova_locked(obj, submit->aspace); 236 237 if (flags & BO_ACTIVE) 238 msm_gem_active_put(obj); 239 240 if (flags & BO_LOCKED) 241 dma_resv_unlock(obj->resv); 242 243 submit->bos[i].flags &= ~cleanup_flags; 244 } 245 246 static void submit_unlock_unpin_bo(struct msm_gem_submit *submit, int i) 247 { 248 submit_cleanup_bo(submit, i, BO_PINNED | BO_ACTIVE | BO_LOCKED); 249 250 if (!(submit->bos[i].flags & BO_VALID)) 251 submit->bos[i].iova = 0; 252 } 253 254 /* This is where we make sure all the bo's are reserved and pin'd: */ 255 static int submit_lock_objects(struct msm_gem_submit *submit) 256 { 257 int contended, slow_locked = -1, i, ret = 0; 258 259 retry: 260 for (i = 0; i < submit->nr_bos; i++) { 261 struct msm_gem_object *msm_obj = submit->bos[i].obj; 262 263 if (slow_locked == i) 264 slow_locked = -1; 265 266 contended = i; 267 268 if (!(submit->bos[i].flags & BO_LOCKED)) { 269 ret = dma_resv_lock_interruptible(msm_obj->base.resv, 270 &submit->ticket); 271 if (ret) 272 goto fail; 273 submit->bos[i].flags |= BO_LOCKED; 274 } 275 } 276 277 ww_acquire_done(&submit->ticket); 278 279 return 0; 280 281 fail: 282 if (ret == -EALREADY) { 283 DRM_ERROR("handle %u at index %u already on submit list\n", 284 submit->bos[i].handle, i); 285 ret = -EINVAL; 286 } 287 288 for (; i >= 0; i--) 289 submit_unlock_unpin_bo(submit, i); 290 291 if (slow_locked > 0) 292 submit_unlock_unpin_bo(submit, slow_locked); 293 294 if (ret == -EDEADLK) { 295 struct msm_gem_object *msm_obj = submit->bos[contended].obj; 296 /* we lost out in a seqno race, lock and retry.. */ 297 ret = dma_resv_lock_slow_interruptible(msm_obj->base.resv, 298 &submit->ticket); 299 if (!ret) { 300 submit->bos[contended].flags |= BO_LOCKED; 301 slow_locked = contended; 302 goto retry; 303 } 304 305 /* Not expecting -EALREADY here, if the bo was already 306 * locked, we should have gotten -EALREADY already from 307 * the dma_resv_lock_interruptable() call. 308 */ 309 WARN_ON_ONCE(ret == -EALREADY); 310 } 311 312 return ret; 313 } 314 315 static int submit_fence_sync(struct msm_gem_submit *submit, bool no_implicit) 316 { 317 int i, ret = 0; 318 319 for (i = 0; i < submit->nr_bos; i++) { 320 struct drm_gem_object *obj = &submit->bos[i].obj->base; 321 bool write = submit->bos[i].flags & MSM_SUBMIT_BO_WRITE; 322 323 if (!write) { 324 /* NOTE: _reserve_shared() must happen before 325 * _add_shared_fence(), which makes this a slightly 326 * strange place to call it. OTOH this is a 327 * convenient can-fail point to hook it in. 328 */ 329 ret = dma_resv_reserve_shared(obj->resv, 1); 330 if (ret) 331 return ret; 332 } 333 334 /* exclusive fences must be ordered */ 335 if (no_implicit && !write) 336 continue; 337 338 ret = drm_sched_job_add_implicit_dependencies(&submit->base, 339 obj, 340 write); 341 if (ret) 342 break; 343 } 344 345 return ret; 346 } 347 348 static int submit_pin_objects(struct msm_gem_submit *submit) 349 { 350 int i, ret = 0; 351 352 submit->valid = true; 353 354 /* 355 * Increment active_count first, so if under memory pressure, we 356 * don't inadvertently evict a bo needed by the submit in order 357 * to pin an earlier bo in the same submit. 358 */ 359 for (i = 0; i < submit->nr_bos; i++) { 360 struct drm_gem_object *obj = &submit->bos[i].obj->base; 361 362 msm_gem_active_get(obj, submit->gpu); 363 submit->bos[i].flags |= BO_ACTIVE; 364 } 365 366 for (i = 0; i < submit->nr_bos; i++) { 367 struct drm_gem_object *obj = &submit->bos[i].obj->base; 368 uint64_t iova; 369 370 /* if locking succeeded, pin bo: */ 371 ret = msm_gem_get_and_pin_iova_locked(obj, 372 submit->aspace, &iova); 373 374 if (ret) 375 break; 376 377 submit->bos[i].flags |= BO_PINNED; 378 379 if (iova == submit->bos[i].iova) { 380 submit->bos[i].flags |= BO_VALID; 381 } else { 382 submit->bos[i].iova = iova; 383 /* iova changed, so address in cmdstream is not valid: */ 384 submit->bos[i].flags &= ~BO_VALID; 385 submit->valid = false; 386 } 387 } 388 389 return ret; 390 } 391 392 static void submit_attach_object_fences(struct msm_gem_submit *submit) 393 { 394 int i; 395 396 for (i = 0; i < submit->nr_bos; i++) { 397 struct drm_gem_object *obj = &submit->bos[i].obj->base; 398 399 if (submit->bos[i].flags & MSM_SUBMIT_BO_WRITE) 400 dma_resv_add_excl_fence(obj->resv, submit->user_fence); 401 else if (submit->bos[i].flags & MSM_SUBMIT_BO_READ) 402 dma_resv_add_shared_fence(obj->resv, submit->user_fence); 403 } 404 } 405 406 static int submit_bo(struct msm_gem_submit *submit, uint32_t idx, 407 struct msm_gem_object **obj, uint64_t *iova, bool *valid) 408 { 409 if (idx >= submit->nr_bos) { 410 DRM_ERROR("invalid buffer index: %u (out of %u)\n", 411 idx, submit->nr_bos); 412 return -EINVAL; 413 } 414 415 if (obj) 416 *obj = submit->bos[idx].obj; 417 if (iova) 418 *iova = submit->bos[idx].iova; 419 if (valid) 420 *valid = !!(submit->bos[idx].flags & BO_VALID); 421 422 return 0; 423 } 424 425 /* process the reloc's and patch up the cmdstream as needed: */ 426 static int submit_reloc(struct msm_gem_submit *submit, struct msm_gem_object *obj, 427 uint32_t offset, uint32_t nr_relocs, struct drm_msm_gem_submit_reloc *relocs) 428 { 429 uint32_t i, last_offset = 0; 430 uint32_t *ptr; 431 int ret = 0; 432 433 if (!nr_relocs) 434 return 0; 435 436 if (offset % 4) { 437 DRM_ERROR("non-aligned cmdstream buffer: %u\n", offset); 438 return -EINVAL; 439 } 440 441 /* For now, just map the entire thing. Eventually we probably 442 * to do it page-by-page, w/ kmap() if not vmap()d.. 443 */ 444 ptr = msm_gem_get_vaddr_locked(&obj->base); 445 446 if (IS_ERR(ptr)) { 447 ret = PTR_ERR(ptr); 448 DBG("failed to map: %d", ret); 449 return ret; 450 } 451 452 for (i = 0; i < nr_relocs; i++) { 453 struct drm_msm_gem_submit_reloc submit_reloc = relocs[i]; 454 uint32_t off; 455 uint64_t iova; 456 bool valid; 457 458 if (submit_reloc.submit_offset % 4) { 459 DRM_ERROR("non-aligned reloc offset: %u\n", 460 submit_reloc.submit_offset); 461 ret = -EINVAL; 462 goto out; 463 } 464 465 /* offset in dwords: */ 466 off = submit_reloc.submit_offset / 4; 467 468 if ((off >= (obj->base.size / 4)) || 469 (off < last_offset)) { 470 DRM_ERROR("invalid offset %u at reloc %u\n", off, i); 471 ret = -EINVAL; 472 goto out; 473 } 474 475 ret = submit_bo(submit, submit_reloc.reloc_idx, NULL, &iova, &valid); 476 if (ret) 477 goto out; 478 479 if (valid) 480 continue; 481 482 iova += submit_reloc.reloc_offset; 483 484 if (submit_reloc.shift < 0) 485 iova >>= -submit_reloc.shift; 486 else 487 iova <<= submit_reloc.shift; 488 489 ptr[off] = iova | submit_reloc.or; 490 491 last_offset = off; 492 } 493 494 out: 495 msm_gem_put_vaddr_locked(&obj->base); 496 497 return ret; 498 } 499 500 /* Cleanup submit at end of ioctl. In the error case, this also drops 501 * references, unpins, and drops active refcnt. In the non-error case, 502 * this is done when the submit is retired. 503 */ 504 static void submit_cleanup(struct msm_gem_submit *submit, bool error) 505 { 506 unsigned cleanup_flags = BO_LOCKED; 507 unsigned i; 508 509 if (error) 510 cleanup_flags |= BO_PINNED | BO_ACTIVE; 511 512 for (i = 0; i < submit->nr_bos; i++) { 513 struct msm_gem_object *msm_obj = submit->bos[i].obj; 514 submit_cleanup_bo(submit, i, cleanup_flags); 515 if (error) 516 drm_gem_object_put(&msm_obj->base); 517 } 518 } 519 520 void msm_submit_retire(struct msm_gem_submit *submit) 521 { 522 int i; 523 524 for (i = 0; i < submit->nr_bos; i++) { 525 struct drm_gem_object *obj = &submit->bos[i].obj->base; 526 527 msm_gem_lock(obj); 528 submit_cleanup_bo(submit, i, BO_PINNED | BO_ACTIVE); 529 msm_gem_unlock(obj); 530 drm_gem_object_put(obj); 531 } 532 } 533 534 struct msm_submit_post_dep { 535 struct drm_syncobj *syncobj; 536 uint64_t point; 537 struct dma_fence_chain *chain; 538 }; 539 540 static struct drm_syncobj **msm_parse_deps(struct msm_gem_submit *submit, 541 struct drm_file *file, 542 uint64_t in_syncobjs_addr, 543 uint32_t nr_in_syncobjs, 544 size_t syncobj_stride, 545 struct msm_ringbuffer *ring) 546 { 547 struct drm_syncobj **syncobjs = NULL; 548 struct drm_msm_gem_submit_syncobj syncobj_desc = {0}; 549 int ret = 0; 550 uint32_t i, j; 551 552 syncobjs = kcalloc(nr_in_syncobjs, sizeof(*syncobjs), 553 GFP_KERNEL | __GFP_NOWARN | __GFP_NORETRY); 554 if (!syncobjs) 555 return ERR_PTR(-ENOMEM); 556 557 for (i = 0; i < nr_in_syncobjs; ++i) { 558 uint64_t address = in_syncobjs_addr + i * syncobj_stride; 559 struct dma_fence *fence; 560 561 if (copy_from_user(&syncobj_desc, 562 u64_to_user_ptr(address), 563 min(syncobj_stride, sizeof(syncobj_desc)))) { 564 ret = -EFAULT; 565 break; 566 } 567 568 if (syncobj_desc.point && 569 !drm_core_check_feature(submit->dev, DRIVER_SYNCOBJ_TIMELINE)) { 570 ret = -EOPNOTSUPP; 571 break; 572 } 573 574 if (syncobj_desc.flags & ~MSM_SUBMIT_SYNCOBJ_FLAGS) { 575 ret = -EINVAL; 576 break; 577 } 578 579 ret = drm_syncobj_find_fence(file, syncobj_desc.handle, 580 syncobj_desc.point, 0, &fence); 581 if (ret) 582 break; 583 584 ret = drm_sched_job_add_dependency(&submit->base, fence); 585 if (ret) 586 break; 587 588 if (syncobj_desc.flags & MSM_SUBMIT_SYNCOBJ_RESET) { 589 syncobjs[i] = 590 drm_syncobj_find(file, syncobj_desc.handle); 591 if (!syncobjs[i]) { 592 ret = -EINVAL; 593 break; 594 } 595 } 596 } 597 598 if (ret) { 599 for (j = 0; j <= i; ++j) { 600 if (syncobjs[j]) 601 drm_syncobj_put(syncobjs[j]); 602 } 603 kfree(syncobjs); 604 return ERR_PTR(ret); 605 } 606 return syncobjs; 607 } 608 609 static void msm_reset_syncobjs(struct drm_syncobj **syncobjs, 610 uint32_t nr_syncobjs) 611 { 612 uint32_t i; 613 614 for (i = 0; syncobjs && i < nr_syncobjs; ++i) { 615 if (syncobjs[i]) 616 drm_syncobj_replace_fence(syncobjs[i], NULL); 617 } 618 } 619 620 static struct msm_submit_post_dep *msm_parse_post_deps(struct drm_device *dev, 621 struct drm_file *file, 622 uint64_t syncobjs_addr, 623 uint32_t nr_syncobjs, 624 size_t syncobj_stride) 625 { 626 struct msm_submit_post_dep *post_deps; 627 struct drm_msm_gem_submit_syncobj syncobj_desc = {0}; 628 int ret = 0; 629 uint32_t i, j; 630 631 post_deps = kmalloc_array(nr_syncobjs, sizeof(*post_deps), 632 GFP_KERNEL | __GFP_NOWARN | __GFP_NORETRY); 633 if (!post_deps) 634 return ERR_PTR(-ENOMEM); 635 636 for (i = 0; i < nr_syncobjs; ++i) { 637 uint64_t address = syncobjs_addr + i * syncobj_stride; 638 639 if (copy_from_user(&syncobj_desc, 640 u64_to_user_ptr(address), 641 min(syncobj_stride, sizeof(syncobj_desc)))) { 642 ret = -EFAULT; 643 break; 644 } 645 646 post_deps[i].point = syncobj_desc.point; 647 post_deps[i].chain = NULL; 648 649 if (syncobj_desc.flags) { 650 ret = -EINVAL; 651 break; 652 } 653 654 if (syncobj_desc.point) { 655 if (!drm_core_check_feature(dev, 656 DRIVER_SYNCOBJ_TIMELINE)) { 657 ret = -EOPNOTSUPP; 658 break; 659 } 660 661 post_deps[i].chain = dma_fence_chain_alloc(); 662 if (!post_deps[i].chain) { 663 ret = -ENOMEM; 664 break; 665 } 666 } 667 668 post_deps[i].syncobj = 669 drm_syncobj_find(file, syncobj_desc.handle); 670 if (!post_deps[i].syncobj) { 671 ret = -EINVAL; 672 break; 673 } 674 } 675 676 if (ret) { 677 for (j = 0; j <= i; ++j) { 678 dma_fence_chain_free(post_deps[j].chain); 679 if (post_deps[j].syncobj) 680 drm_syncobj_put(post_deps[j].syncobj); 681 } 682 683 kfree(post_deps); 684 return ERR_PTR(ret); 685 } 686 687 return post_deps; 688 } 689 690 static void msm_process_post_deps(struct msm_submit_post_dep *post_deps, 691 uint32_t count, struct dma_fence *fence) 692 { 693 uint32_t i; 694 695 for (i = 0; post_deps && i < count; ++i) { 696 if (post_deps[i].chain) { 697 drm_syncobj_add_point(post_deps[i].syncobj, 698 post_deps[i].chain, 699 fence, post_deps[i].point); 700 post_deps[i].chain = NULL; 701 } else { 702 drm_syncobj_replace_fence(post_deps[i].syncobj, 703 fence); 704 } 705 } 706 } 707 708 int msm_ioctl_gem_submit(struct drm_device *dev, void *data, 709 struct drm_file *file) 710 { 711 static atomic_t ident = ATOMIC_INIT(0); 712 struct msm_drm_private *priv = dev->dev_private; 713 struct drm_msm_gem_submit *args = data; 714 struct msm_file_private *ctx = file->driver_priv; 715 struct msm_gem_submit *submit = NULL; 716 struct msm_gpu *gpu = priv->gpu; 717 struct msm_gpu_submitqueue *queue; 718 struct msm_ringbuffer *ring; 719 struct msm_submit_post_dep *post_deps = NULL; 720 struct drm_syncobj **syncobjs_to_reset = NULL; 721 int out_fence_fd = -1; 722 struct pid *pid = get_pid(task_pid(current)); 723 bool has_ww_ticket = false; 724 unsigned i; 725 int ret, submitid; 726 727 if (!gpu) 728 return -ENXIO; 729 730 if (args->pad) 731 return -EINVAL; 732 733 /* for now, we just have 3d pipe.. eventually this would need to 734 * be more clever to dispatch to appropriate gpu module: 735 */ 736 if (MSM_PIPE_ID(args->flags) != MSM_PIPE_3D0) 737 return -EINVAL; 738 739 if (MSM_PIPE_FLAGS(args->flags) & ~MSM_SUBMIT_FLAGS) 740 return -EINVAL; 741 742 if (args->flags & MSM_SUBMIT_SUDO) { 743 if (!IS_ENABLED(CONFIG_DRM_MSM_GPU_SUDO) || 744 !capable(CAP_SYS_RAWIO)) 745 return -EINVAL; 746 } 747 748 queue = msm_submitqueue_get(ctx, args->queueid); 749 if (!queue) 750 return -ENOENT; 751 752 /* Get a unique identifier for the submission for logging purposes */ 753 submitid = atomic_inc_return(&ident) - 1; 754 755 ring = gpu->rb[queue->ring_nr]; 756 trace_msm_gpu_submit(pid_nr(pid), ring->id, submitid, 757 args->nr_bos, args->nr_cmds); 758 759 ret = mutex_lock_interruptible(&queue->lock); 760 if (ret) 761 goto out_post_unlock; 762 763 if (args->flags & MSM_SUBMIT_FENCE_FD_OUT) { 764 out_fence_fd = get_unused_fd_flags(O_CLOEXEC); 765 if (out_fence_fd < 0) { 766 ret = out_fence_fd; 767 goto out_unlock; 768 } 769 } 770 771 submit = submit_create(dev, gpu, queue, args->nr_bos, 772 args->nr_cmds); 773 if (IS_ERR(submit)) { 774 ret = PTR_ERR(submit); 775 submit = NULL; 776 goto out_unlock; 777 } 778 779 submit->pid = pid; 780 submit->ident = submitid; 781 782 if (args->flags & MSM_SUBMIT_SUDO) 783 submit->in_rb = true; 784 785 if (args->flags & MSM_SUBMIT_FENCE_FD_IN) { 786 struct dma_fence *in_fence; 787 788 in_fence = sync_file_get_fence(args->fence_fd); 789 790 if (!in_fence) { 791 ret = -EINVAL; 792 goto out_unlock; 793 } 794 795 ret = drm_sched_job_add_dependency(&submit->base, in_fence); 796 if (ret) 797 goto out_unlock; 798 } 799 800 if (args->flags & MSM_SUBMIT_SYNCOBJ_IN) { 801 syncobjs_to_reset = msm_parse_deps(submit, file, 802 args->in_syncobjs, 803 args->nr_in_syncobjs, 804 args->syncobj_stride, ring); 805 if (IS_ERR(syncobjs_to_reset)) { 806 ret = PTR_ERR(syncobjs_to_reset); 807 goto out_unlock; 808 } 809 } 810 811 if (args->flags & MSM_SUBMIT_SYNCOBJ_OUT) { 812 post_deps = msm_parse_post_deps(dev, file, 813 args->out_syncobjs, 814 args->nr_out_syncobjs, 815 args->syncobj_stride); 816 if (IS_ERR(post_deps)) { 817 ret = PTR_ERR(post_deps); 818 goto out_unlock; 819 } 820 } 821 822 ret = submit_lookup_objects(submit, args, file); 823 if (ret) 824 goto out; 825 826 ret = submit_lookup_cmds(submit, args, file); 827 if (ret) 828 goto out; 829 830 /* copy_*_user while holding a ww ticket upsets lockdep */ 831 ww_acquire_init(&submit->ticket, &reservation_ww_class); 832 has_ww_ticket = true; 833 ret = submit_lock_objects(submit); 834 if (ret) 835 goto out; 836 837 ret = submit_fence_sync(submit, !!(args->flags & MSM_SUBMIT_NO_IMPLICIT)); 838 if (ret) 839 goto out; 840 841 ret = submit_pin_objects(submit); 842 if (ret) 843 goto out; 844 845 for (i = 0; i < args->nr_cmds; i++) { 846 struct msm_gem_object *msm_obj; 847 uint64_t iova; 848 849 ret = submit_bo(submit, submit->cmd[i].idx, 850 &msm_obj, &iova, NULL); 851 if (ret) 852 goto out; 853 854 if (!submit->cmd[i].size || 855 ((submit->cmd[i].size + submit->cmd[i].offset) > 856 msm_obj->base.size / 4)) { 857 DRM_ERROR("invalid cmdstream size: %u\n", submit->cmd[i].size * 4); 858 ret = -EINVAL; 859 goto out; 860 } 861 862 submit->cmd[i].iova = iova + (submit->cmd[i].offset * 4); 863 864 if (submit->valid) 865 continue; 866 867 ret = submit_reloc(submit, msm_obj, submit->cmd[i].offset * 4, 868 submit->cmd[i].nr_relocs, submit->cmd[i].relocs); 869 if (ret) 870 goto out; 871 } 872 873 submit->nr_cmds = i; 874 875 drm_sched_job_arm(&submit->base); 876 877 submit->user_fence = dma_fence_get(&submit->base.s_fence->finished); 878 879 /* 880 * Allocate an id which can be used by WAIT_FENCE ioctl to map back 881 * to the underlying fence. 882 */ 883 submit->fence_id = idr_alloc_cyclic(&queue->fence_idr, 884 submit->user_fence, 1, INT_MAX, GFP_KERNEL); 885 if (submit->fence_id < 0) { 886 ret = submit->fence_id = 0; 887 submit->fence_id = 0; 888 } 889 890 if (ret == 0 && args->flags & MSM_SUBMIT_FENCE_FD_OUT) { 891 struct sync_file *sync_file = sync_file_create(submit->user_fence); 892 if (!sync_file) { 893 ret = -ENOMEM; 894 } else { 895 fd_install(out_fence_fd, sync_file->file); 896 args->fence_fd = out_fence_fd; 897 } 898 } 899 900 submit_attach_object_fences(submit); 901 902 /* The scheduler owns a ref now: */ 903 msm_gem_submit_get(submit); 904 905 drm_sched_entity_push_job(&submit->base); 906 907 args->fence = submit->fence_id; 908 queue->last_fence = submit->fence_id; 909 910 msm_reset_syncobjs(syncobjs_to_reset, args->nr_in_syncobjs); 911 msm_process_post_deps(post_deps, args->nr_out_syncobjs, 912 submit->user_fence); 913 914 915 out: 916 submit_cleanup(submit, !!ret); 917 if (has_ww_ticket) 918 ww_acquire_fini(&submit->ticket); 919 out_unlock: 920 if (ret && (out_fence_fd >= 0)) 921 put_unused_fd(out_fence_fd); 922 mutex_unlock(&queue->lock); 923 if (submit) 924 msm_gem_submit_put(submit); 925 out_post_unlock: 926 if (!IS_ERR_OR_NULL(post_deps)) { 927 for (i = 0; i < args->nr_out_syncobjs; ++i) { 928 kfree(post_deps[i].chain); 929 drm_syncobj_put(post_deps[i].syncobj); 930 } 931 kfree(post_deps); 932 } 933 934 if (!IS_ERR_OR_NULL(syncobjs_to_reset)) { 935 for (i = 0; i < args->nr_in_syncobjs; ++i) { 936 if (syncobjs_to_reset[i]) 937 drm_syncobj_put(syncobjs_to_reset[i]); 938 } 939 kfree(syncobjs_to_reset); 940 } 941 942 return ret; 943 } 944