1 // SPDX-License-Identifier: GPL-2.0-only 2 /* 3 * Copyright (C) 2013 Red Hat 4 * Author: Rob Clark <robdclark@gmail.com> 5 */ 6 7 #include <linux/file.h> 8 #include <linux/sync_file.h> 9 #include <linux/uaccess.h> 10 11 #include <drm/drm_drv.h> 12 #include <drm/drm_file.h> 13 #include <drm/drm_syncobj.h> 14 15 #include "msm_drv.h" 16 #include "msm_gpu.h" 17 #include "msm_gem.h" 18 #include "msm_gpu_trace.h" 19 20 /* 21 * Cmdstream submission: 22 */ 23 24 /* make sure these don't conflict w/ MSM_SUBMIT_BO_x */ 25 #define BO_VALID 0x8000 /* is current addr in cmdstream correct/valid? */ 26 #define BO_LOCKED 0x4000 /* obj lock is held */ 27 #define BO_ACTIVE 0x2000 /* active refcnt is held */ 28 #define BO_PINNED 0x1000 /* obj is pinned and on active list */ 29 30 static struct msm_gem_submit *submit_create(struct drm_device *dev, 31 struct msm_gpu *gpu, 32 struct msm_gpu_submitqueue *queue, uint32_t nr_bos, 33 uint32_t nr_cmds) 34 { 35 struct msm_gem_submit *submit; 36 uint64_t sz; 37 int ret; 38 39 sz = struct_size(submit, bos, nr_bos) + 40 ((u64)nr_cmds * sizeof(submit->cmd[0])); 41 42 if (sz > SIZE_MAX) 43 return ERR_PTR(-ENOMEM); 44 45 submit = kzalloc(sz, GFP_KERNEL | __GFP_NOWARN | __GFP_NORETRY); 46 if (!submit) 47 return ERR_PTR(-ENOMEM); 48 49 ret = drm_sched_job_init(&submit->base, &queue->entity, queue); 50 if (ret) { 51 kfree(submit); 52 return ERR_PTR(ret); 53 } 54 55 kref_init(&submit->ref); 56 submit->dev = dev; 57 submit->aspace = queue->ctx->aspace; 58 submit->gpu = gpu; 59 submit->cmd = (void *)&submit->bos[nr_bos]; 60 submit->queue = queue; 61 submit->ring = gpu->rb[queue->ring_nr]; 62 submit->fault_dumped = false; 63 64 INIT_LIST_HEAD(&submit->node); 65 66 return submit; 67 } 68 69 void __msm_gem_submit_destroy(struct kref *kref) 70 { 71 struct msm_gem_submit *submit = 72 container_of(kref, struct msm_gem_submit, ref); 73 unsigned i; 74 75 if (submit->fence_id) { 76 mutex_lock(&submit->queue->lock); 77 idr_remove(&submit->queue->fence_idr, submit->fence_id); 78 mutex_unlock(&submit->queue->lock); 79 } 80 81 dma_fence_put(submit->user_fence); 82 dma_fence_put(submit->hw_fence); 83 84 put_pid(submit->pid); 85 msm_submitqueue_put(submit->queue); 86 87 for (i = 0; i < submit->nr_cmds; i++) 88 kfree(submit->cmd[i].relocs); 89 90 kfree(submit); 91 } 92 93 static int submit_lookup_objects(struct msm_gem_submit *submit, 94 struct drm_msm_gem_submit *args, struct drm_file *file) 95 { 96 unsigned i; 97 int ret = 0; 98 99 for (i = 0; i < args->nr_bos; i++) { 100 struct drm_msm_gem_submit_bo submit_bo; 101 void __user *userptr = 102 u64_to_user_ptr(args->bos + (i * sizeof(submit_bo))); 103 104 /* make sure we don't have garbage flags, in case we hit 105 * error path before flags is initialized: 106 */ 107 submit->bos[i].flags = 0; 108 109 if (copy_from_user(&submit_bo, userptr, sizeof(submit_bo))) { 110 ret = -EFAULT; 111 i = 0; 112 goto out; 113 } 114 115 /* at least one of READ and/or WRITE flags should be set: */ 116 #define MANDATORY_FLAGS (MSM_SUBMIT_BO_READ | MSM_SUBMIT_BO_WRITE) 117 118 if ((submit_bo.flags & ~MSM_SUBMIT_BO_FLAGS) || 119 !(submit_bo.flags & MANDATORY_FLAGS)) { 120 DRM_ERROR("invalid flags: %x\n", submit_bo.flags); 121 ret = -EINVAL; 122 i = 0; 123 goto out; 124 } 125 126 submit->bos[i].handle = submit_bo.handle; 127 submit->bos[i].flags = submit_bo.flags; 128 /* in validate_objects() we figure out if this is true: */ 129 submit->bos[i].iova = submit_bo.presumed; 130 } 131 132 spin_lock(&file->table_lock); 133 134 for (i = 0; i < args->nr_bos; i++) { 135 struct drm_gem_object *obj; 136 137 /* normally use drm_gem_object_lookup(), but for bulk lookup 138 * all under single table_lock just hit object_idr directly: 139 */ 140 obj = idr_find(&file->object_idr, submit->bos[i].handle); 141 if (!obj) { 142 DRM_ERROR("invalid handle %u at index %u\n", submit->bos[i].handle, i); 143 ret = -EINVAL; 144 goto out_unlock; 145 } 146 147 drm_gem_object_get(obj); 148 149 submit->bos[i].obj = to_msm_bo(obj); 150 } 151 152 out_unlock: 153 spin_unlock(&file->table_lock); 154 155 out: 156 submit->nr_bos = i; 157 158 return ret; 159 } 160 161 static int submit_lookup_cmds(struct msm_gem_submit *submit, 162 struct drm_msm_gem_submit *args, struct drm_file *file) 163 { 164 unsigned i, sz; 165 int ret = 0; 166 167 for (i = 0; i < args->nr_cmds; i++) { 168 struct drm_msm_gem_submit_cmd submit_cmd; 169 void __user *userptr = 170 u64_to_user_ptr(args->cmds + (i * sizeof(submit_cmd))); 171 172 ret = copy_from_user(&submit_cmd, userptr, sizeof(submit_cmd)); 173 if (ret) { 174 ret = -EFAULT; 175 goto out; 176 } 177 178 /* validate input from userspace: */ 179 switch (submit_cmd.type) { 180 case MSM_SUBMIT_CMD_BUF: 181 case MSM_SUBMIT_CMD_IB_TARGET_BUF: 182 case MSM_SUBMIT_CMD_CTX_RESTORE_BUF: 183 break; 184 default: 185 DRM_ERROR("invalid type: %08x\n", submit_cmd.type); 186 return -EINVAL; 187 } 188 189 if (submit_cmd.size % 4) { 190 DRM_ERROR("non-aligned cmdstream buffer size: %u\n", 191 submit_cmd.size); 192 ret = -EINVAL; 193 goto out; 194 } 195 196 submit->cmd[i].type = submit_cmd.type; 197 submit->cmd[i].size = submit_cmd.size / 4; 198 submit->cmd[i].offset = submit_cmd.submit_offset / 4; 199 submit->cmd[i].idx = submit_cmd.submit_idx; 200 submit->cmd[i].nr_relocs = submit_cmd.nr_relocs; 201 202 userptr = u64_to_user_ptr(submit_cmd.relocs); 203 204 sz = array_size(submit_cmd.nr_relocs, 205 sizeof(struct drm_msm_gem_submit_reloc)); 206 /* check for overflow: */ 207 if (sz == SIZE_MAX) { 208 ret = -ENOMEM; 209 goto out; 210 } 211 submit->cmd[i].relocs = kmalloc(sz, GFP_KERNEL); 212 ret = copy_from_user(submit->cmd[i].relocs, userptr, sz); 213 if (ret) { 214 ret = -EFAULT; 215 goto out; 216 } 217 } 218 219 out: 220 return ret; 221 } 222 223 /* Unwind bo state, according to cleanup_flags. In the success case, only 224 * the lock is dropped at the end of the submit (and active/pin ref is dropped 225 * later when the submit is retired). 226 */ 227 static void submit_cleanup_bo(struct msm_gem_submit *submit, int i, 228 unsigned cleanup_flags) 229 { 230 struct drm_gem_object *obj = &submit->bos[i].obj->base; 231 unsigned flags = submit->bos[i].flags & cleanup_flags; 232 233 if (flags & BO_PINNED) 234 msm_gem_unpin_iova_locked(obj, submit->aspace); 235 236 if (flags & BO_ACTIVE) 237 msm_gem_active_put(obj); 238 239 if (flags & BO_LOCKED) 240 dma_resv_unlock(obj->resv); 241 242 submit->bos[i].flags &= ~cleanup_flags; 243 } 244 245 static void submit_unlock_unpin_bo(struct msm_gem_submit *submit, int i) 246 { 247 submit_cleanup_bo(submit, i, BO_PINNED | BO_ACTIVE | BO_LOCKED); 248 249 if (!(submit->bos[i].flags & BO_VALID)) 250 submit->bos[i].iova = 0; 251 } 252 253 /* This is where we make sure all the bo's are reserved and pin'd: */ 254 static int submit_lock_objects(struct msm_gem_submit *submit) 255 { 256 int contended, slow_locked = -1, i, ret = 0; 257 258 retry: 259 for (i = 0; i < submit->nr_bos; i++) { 260 struct msm_gem_object *msm_obj = submit->bos[i].obj; 261 262 if (slow_locked == i) 263 slow_locked = -1; 264 265 contended = i; 266 267 if (!(submit->bos[i].flags & BO_LOCKED)) { 268 ret = dma_resv_lock_interruptible(msm_obj->base.resv, 269 &submit->ticket); 270 if (ret) 271 goto fail; 272 submit->bos[i].flags |= BO_LOCKED; 273 } 274 } 275 276 ww_acquire_done(&submit->ticket); 277 278 return 0; 279 280 fail: 281 if (ret == -EALREADY) { 282 DRM_ERROR("handle %u at index %u already on submit list\n", 283 submit->bos[i].handle, i); 284 ret = -EINVAL; 285 } 286 287 for (; i >= 0; i--) 288 submit_unlock_unpin_bo(submit, i); 289 290 if (slow_locked > 0) 291 submit_unlock_unpin_bo(submit, slow_locked); 292 293 if (ret == -EDEADLK) { 294 struct msm_gem_object *msm_obj = submit->bos[contended].obj; 295 /* we lost out in a seqno race, lock and retry.. */ 296 ret = dma_resv_lock_slow_interruptible(msm_obj->base.resv, 297 &submit->ticket); 298 if (!ret) { 299 submit->bos[contended].flags |= BO_LOCKED; 300 slow_locked = contended; 301 goto retry; 302 } 303 304 /* Not expecting -EALREADY here, if the bo was already 305 * locked, we should have gotten -EALREADY already from 306 * the dma_resv_lock_interruptable() call. 307 */ 308 WARN_ON_ONCE(ret == -EALREADY); 309 } 310 311 return ret; 312 } 313 314 static int submit_fence_sync(struct msm_gem_submit *submit, bool no_implicit) 315 { 316 int i, ret = 0; 317 318 for (i = 0; i < submit->nr_bos; i++) { 319 struct drm_gem_object *obj = &submit->bos[i].obj->base; 320 bool write = submit->bos[i].flags & MSM_SUBMIT_BO_WRITE; 321 322 if (!write) { 323 /* NOTE: _reserve_shared() must happen before 324 * _add_shared_fence(), which makes this a slightly 325 * strange place to call it. OTOH this is a 326 * convenient can-fail point to hook it in. 327 */ 328 ret = dma_resv_reserve_shared(obj->resv, 1); 329 if (ret) 330 return ret; 331 } 332 333 /* exclusive fences must be ordered */ 334 if (no_implicit && !write) 335 continue; 336 337 ret = drm_sched_job_add_implicit_dependencies(&submit->base, 338 obj, 339 write); 340 if (ret) 341 break; 342 } 343 344 return ret; 345 } 346 347 static int submit_pin_objects(struct msm_gem_submit *submit) 348 { 349 int i, ret = 0; 350 351 submit->valid = true; 352 353 /* 354 * Increment active_count first, so if under memory pressure, we 355 * don't inadvertently evict a bo needed by the submit in order 356 * to pin an earlier bo in the same submit. 357 */ 358 for (i = 0; i < submit->nr_bos; i++) { 359 struct drm_gem_object *obj = &submit->bos[i].obj->base; 360 361 msm_gem_active_get(obj, submit->gpu); 362 submit->bos[i].flags |= BO_ACTIVE; 363 } 364 365 for (i = 0; i < submit->nr_bos; i++) { 366 struct drm_gem_object *obj = &submit->bos[i].obj->base; 367 uint64_t iova; 368 369 /* if locking succeeded, pin bo: */ 370 ret = msm_gem_get_and_pin_iova_locked(obj, 371 submit->aspace, &iova); 372 373 if (ret) 374 break; 375 376 submit->bos[i].flags |= BO_PINNED; 377 378 if (iova == submit->bos[i].iova) { 379 submit->bos[i].flags |= BO_VALID; 380 } else { 381 submit->bos[i].iova = iova; 382 /* iova changed, so address in cmdstream is not valid: */ 383 submit->bos[i].flags &= ~BO_VALID; 384 submit->valid = false; 385 } 386 } 387 388 return ret; 389 } 390 391 static void submit_attach_object_fences(struct msm_gem_submit *submit) 392 { 393 int i; 394 395 for (i = 0; i < submit->nr_bos; i++) { 396 struct drm_gem_object *obj = &submit->bos[i].obj->base; 397 398 if (submit->bos[i].flags & MSM_SUBMIT_BO_WRITE) 399 dma_resv_add_excl_fence(obj->resv, submit->user_fence); 400 else if (submit->bos[i].flags & MSM_SUBMIT_BO_READ) 401 dma_resv_add_shared_fence(obj->resv, submit->user_fence); 402 } 403 } 404 405 static int submit_bo(struct msm_gem_submit *submit, uint32_t idx, 406 struct msm_gem_object **obj, uint64_t *iova, bool *valid) 407 { 408 if (idx >= submit->nr_bos) { 409 DRM_ERROR("invalid buffer index: %u (out of %u)\n", 410 idx, submit->nr_bos); 411 return -EINVAL; 412 } 413 414 if (obj) 415 *obj = submit->bos[idx].obj; 416 if (iova) 417 *iova = submit->bos[idx].iova; 418 if (valid) 419 *valid = !!(submit->bos[idx].flags & BO_VALID); 420 421 return 0; 422 } 423 424 /* process the reloc's and patch up the cmdstream as needed: */ 425 static int submit_reloc(struct msm_gem_submit *submit, struct msm_gem_object *obj, 426 uint32_t offset, uint32_t nr_relocs, struct drm_msm_gem_submit_reloc *relocs) 427 { 428 uint32_t i, last_offset = 0; 429 uint32_t *ptr; 430 int ret = 0; 431 432 if (!nr_relocs) 433 return 0; 434 435 if (offset % 4) { 436 DRM_ERROR("non-aligned cmdstream buffer: %u\n", offset); 437 return -EINVAL; 438 } 439 440 /* For now, just map the entire thing. Eventually we probably 441 * to do it page-by-page, w/ kmap() if not vmap()d.. 442 */ 443 ptr = msm_gem_get_vaddr_locked(&obj->base); 444 445 if (IS_ERR(ptr)) { 446 ret = PTR_ERR(ptr); 447 DBG("failed to map: %d", ret); 448 return ret; 449 } 450 451 for (i = 0; i < nr_relocs; i++) { 452 struct drm_msm_gem_submit_reloc submit_reloc = relocs[i]; 453 uint32_t off; 454 uint64_t iova; 455 bool valid; 456 457 if (submit_reloc.submit_offset % 4) { 458 DRM_ERROR("non-aligned reloc offset: %u\n", 459 submit_reloc.submit_offset); 460 ret = -EINVAL; 461 goto out; 462 } 463 464 /* offset in dwords: */ 465 off = submit_reloc.submit_offset / 4; 466 467 if ((off >= (obj->base.size / 4)) || 468 (off < last_offset)) { 469 DRM_ERROR("invalid offset %u at reloc %u\n", off, i); 470 ret = -EINVAL; 471 goto out; 472 } 473 474 ret = submit_bo(submit, submit_reloc.reloc_idx, NULL, &iova, &valid); 475 if (ret) 476 goto out; 477 478 if (valid) 479 continue; 480 481 iova += submit_reloc.reloc_offset; 482 483 if (submit_reloc.shift < 0) 484 iova >>= -submit_reloc.shift; 485 else 486 iova <<= submit_reloc.shift; 487 488 ptr[off] = iova | submit_reloc.or; 489 490 last_offset = off; 491 } 492 493 out: 494 msm_gem_put_vaddr_locked(&obj->base); 495 496 return ret; 497 } 498 499 /* Cleanup submit at end of ioctl. In the error case, this also drops 500 * references, unpins, and drops active refcnt. In the non-error case, 501 * this is done when the submit is retired. 502 */ 503 static void submit_cleanup(struct msm_gem_submit *submit, bool error) 504 { 505 unsigned cleanup_flags = BO_LOCKED; 506 unsigned i; 507 508 if (error) 509 cleanup_flags |= BO_PINNED | BO_ACTIVE; 510 511 for (i = 0; i < submit->nr_bos; i++) { 512 struct msm_gem_object *msm_obj = submit->bos[i].obj; 513 submit_cleanup_bo(submit, i, cleanup_flags); 514 if (error) 515 drm_gem_object_put(&msm_obj->base); 516 } 517 } 518 519 void msm_submit_retire(struct msm_gem_submit *submit) 520 { 521 int i; 522 523 for (i = 0; i < submit->nr_bos; i++) { 524 struct drm_gem_object *obj = &submit->bos[i].obj->base; 525 526 msm_gem_lock(obj); 527 submit_cleanup_bo(submit, i, BO_PINNED | BO_ACTIVE); 528 msm_gem_unlock(obj); 529 drm_gem_object_put(obj); 530 } 531 } 532 533 struct msm_submit_post_dep { 534 struct drm_syncobj *syncobj; 535 uint64_t point; 536 struct dma_fence_chain *chain; 537 }; 538 539 static struct drm_syncobj **msm_parse_deps(struct msm_gem_submit *submit, 540 struct drm_file *file, 541 uint64_t in_syncobjs_addr, 542 uint32_t nr_in_syncobjs, 543 size_t syncobj_stride, 544 struct msm_ringbuffer *ring) 545 { 546 struct drm_syncobj **syncobjs = NULL; 547 struct drm_msm_gem_submit_syncobj syncobj_desc = {0}; 548 int ret = 0; 549 uint32_t i, j; 550 551 syncobjs = kcalloc(nr_in_syncobjs, sizeof(*syncobjs), 552 GFP_KERNEL | __GFP_NOWARN | __GFP_NORETRY); 553 if (!syncobjs) 554 return ERR_PTR(-ENOMEM); 555 556 for (i = 0; i < nr_in_syncobjs; ++i) { 557 uint64_t address = in_syncobjs_addr + i * syncobj_stride; 558 struct dma_fence *fence; 559 560 if (copy_from_user(&syncobj_desc, 561 u64_to_user_ptr(address), 562 min(syncobj_stride, sizeof(syncobj_desc)))) { 563 ret = -EFAULT; 564 break; 565 } 566 567 if (syncobj_desc.point && 568 !drm_core_check_feature(submit->dev, DRIVER_SYNCOBJ_TIMELINE)) { 569 ret = -EOPNOTSUPP; 570 break; 571 } 572 573 if (syncobj_desc.flags & ~MSM_SUBMIT_SYNCOBJ_FLAGS) { 574 ret = -EINVAL; 575 break; 576 } 577 578 ret = drm_syncobj_find_fence(file, syncobj_desc.handle, 579 syncobj_desc.point, 0, &fence); 580 if (ret) 581 break; 582 583 ret = drm_sched_job_add_dependency(&submit->base, fence); 584 if (ret) 585 break; 586 587 if (syncobj_desc.flags & MSM_SUBMIT_SYNCOBJ_RESET) { 588 syncobjs[i] = 589 drm_syncobj_find(file, syncobj_desc.handle); 590 if (!syncobjs[i]) { 591 ret = -EINVAL; 592 break; 593 } 594 } 595 } 596 597 if (ret) { 598 for (j = 0; j <= i; ++j) { 599 if (syncobjs[j]) 600 drm_syncobj_put(syncobjs[j]); 601 } 602 kfree(syncobjs); 603 return ERR_PTR(ret); 604 } 605 return syncobjs; 606 } 607 608 static void msm_reset_syncobjs(struct drm_syncobj **syncobjs, 609 uint32_t nr_syncobjs) 610 { 611 uint32_t i; 612 613 for (i = 0; syncobjs && i < nr_syncobjs; ++i) { 614 if (syncobjs[i]) 615 drm_syncobj_replace_fence(syncobjs[i], NULL); 616 } 617 } 618 619 static struct msm_submit_post_dep *msm_parse_post_deps(struct drm_device *dev, 620 struct drm_file *file, 621 uint64_t syncobjs_addr, 622 uint32_t nr_syncobjs, 623 size_t syncobj_stride) 624 { 625 struct msm_submit_post_dep *post_deps; 626 struct drm_msm_gem_submit_syncobj syncobj_desc = {0}; 627 int ret = 0; 628 uint32_t i, j; 629 630 post_deps = kmalloc_array(nr_syncobjs, sizeof(*post_deps), 631 GFP_KERNEL | __GFP_NOWARN | __GFP_NORETRY); 632 if (!post_deps) 633 return ERR_PTR(-ENOMEM); 634 635 for (i = 0; i < nr_syncobjs; ++i) { 636 uint64_t address = syncobjs_addr + i * syncobj_stride; 637 638 if (copy_from_user(&syncobj_desc, 639 u64_to_user_ptr(address), 640 min(syncobj_stride, sizeof(syncobj_desc)))) { 641 ret = -EFAULT; 642 break; 643 } 644 645 post_deps[i].point = syncobj_desc.point; 646 post_deps[i].chain = NULL; 647 648 if (syncobj_desc.flags) { 649 ret = -EINVAL; 650 break; 651 } 652 653 if (syncobj_desc.point) { 654 if (!drm_core_check_feature(dev, 655 DRIVER_SYNCOBJ_TIMELINE)) { 656 ret = -EOPNOTSUPP; 657 break; 658 } 659 660 post_deps[i].chain = dma_fence_chain_alloc(); 661 if (!post_deps[i].chain) { 662 ret = -ENOMEM; 663 break; 664 } 665 } 666 667 post_deps[i].syncobj = 668 drm_syncobj_find(file, syncobj_desc.handle); 669 if (!post_deps[i].syncobj) { 670 ret = -EINVAL; 671 break; 672 } 673 } 674 675 if (ret) { 676 for (j = 0; j <= i; ++j) { 677 dma_fence_chain_free(post_deps[j].chain); 678 if (post_deps[j].syncobj) 679 drm_syncobj_put(post_deps[j].syncobj); 680 } 681 682 kfree(post_deps); 683 return ERR_PTR(ret); 684 } 685 686 return post_deps; 687 } 688 689 static void msm_process_post_deps(struct msm_submit_post_dep *post_deps, 690 uint32_t count, struct dma_fence *fence) 691 { 692 uint32_t i; 693 694 for (i = 0; post_deps && i < count; ++i) { 695 if (post_deps[i].chain) { 696 drm_syncobj_add_point(post_deps[i].syncobj, 697 post_deps[i].chain, 698 fence, post_deps[i].point); 699 post_deps[i].chain = NULL; 700 } else { 701 drm_syncobj_replace_fence(post_deps[i].syncobj, 702 fence); 703 } 704 } 705 } 706 707 int msm_ioctl_gem_submit(struct drm_device *dev, void *data, 708 struct drm_file *file) 709 { 710 static atomic_t ident = ATOMIC_INIT(0); 711 struct msm_drm_private *priv = dev->dev_private; 712 struct drm_msm_gem_submit *args = data; 713 struct msm_file_private *ctx = file->driver_priv; 714 struct msm_gem_submit *submit = NULL; 715 struct msm_gpu *gpu = priv->gpu; 716 struct msm_gpu_submitqueue *queue; 717 struct msm_ringbuffer *ring; 718 struct msm_submit_post_dep *post_deps = NULL; 719 struct drm_syncobj **syncobjs_to_reset = NULL; 720 int out_fence_fd = -1; 721 struct pid *pid = get_pid(task_pid(current)); 722 bool has_ww_ticket = false; 723 unsigned i; 724 int ret, submitid; 725 726 if (!gpu) 727 return -ENXIO; 728 729 if (args->pad) 730 return -EINVAL; 731 732 /* for now, we just have 3d pipe.. eventually this would need to 733 * be more clever to dispatch to appropriate gpu module: 734 */ 735 if (MSM_PIPE_ID(args->flags) != MSM_PIPE_3D0) 736 return -EINVAL; 737 738 if (MSM_PIPE_FLAGS(args->flags) & ~MSM_SUBMIT_FLAGS) 739 return -EINVAL; 740 741 if (args->flags & MSM_SUBMIT_SUDO) { 742 if (!IS_ENABLED(CONFIG_DRM_MSM_GPU_SUDO) || 743 !capable(CAP_SYS_RAWIO)) 744 return -EINVAL; 745 } 746 747 queue = msm_submitqueue_get(ctx, args->queueid); 748 if (!queue) 749 return -ENOENT; 750 751 /* Get a unique identifier for the submission for logging purposes */ 752 submitid = atomic_inc_return(&ident) - 1; 753 754 ring = gpu->rb[queue->ring_nr]; 755 trace_msm_gpu_submit(pid_nr(pid), ring->id, submitid, 756 args->nr_bos, args->nr_cmds); 757 758 ret = mutex_lock_interruptible(&queue->lock); 759 if (ret) 760 goto out_post_unlock; 761 762 if (args->flags & MSM_SUBMIT_FENCE_FD_OUT) { 763 out_fence_fd = get_unused_fd_flags(O_CLOEXEC); 764 if (out_fence_fd < 0) { 765 ret = out_fence_fd; 766 goto out_unlock; 767 } 768 } 769 770 submit = submit_create(dev, gpu, queue, args->nr_bos, 771 args->nr_cmds); 772 if (IS_ERR(submit)) { 773 ret = PTR_ERR(submit); 774 goto out_unlock; 775 } 776 777 submit->pid = pid; 778 submit->ident = submitid; 779 780 if (args->flags & MSM_SUBMIT_SUDO) 781 submit->in_rb = true; 782 783 if (args->flags & MSM_SUBMIT_FENCE_FD_IN) { 784 struct dma_fence *in_fence; 785 786 in_fence = sync_file_get_fence(args->fence_fd); 787 788 if (!in_fence) { 789 ret = -EINVAL; 790 goto out_unlock; 791 } 792 793 ret = drm_sched_job_add_dependency(&submit->base, in_fence); 794 if (ret) 795 goto out_unlock; 796 } 797 798 if (args->flags & MSM_SUBMIT_SYNCOBJ_IN) { 799 syncobjs_to_reset = msm_parse_deps(submit, file, 800 args->in_syncobjs, 801 args->nr_in_syncobjs, 802 args->syncobj_stride, ring); 803 if (IS_ERR(syncobjs_to_reset)) { 804 ret = PTR_ERR(syncobjs_to_reset); 805 goto out_unlock; 806 } 807 } 808 809 if (args->flags & MSM_SUBMIT_SYNCOBJ_OUT) { 810 post_deps = msm_parse_post_deps(dev, file, 811 args->out_syncobjs, 812 args->nr_out_syncobjs, 813 args->syncobj_stride); 814 if (IS_ERR(post_deps)) { 815 ret = PTR_ERR(post_deps); 816 goto out_unlock; 817 } 818 } 819 820 ret = submit_lookup_objects(submit, args, file); 821 if (ret) 822 goto out; 823 824 ret = submit_lookup_cmds(submit, args, file); 825 if (ret) 826 goto out; 827 828 /* copy_*_user while holding a ww ticket upsets lockdep */ 829 ww_acquire_init(&submit->ticket, &reservation_ww_class); 830 has_ww_ticket = true; 831 ret = submit_lock_objects(submit); 832 if (ret) 833 goto out; 834 835 ret = submit_fence_sync(submit, !!(args->flags & MSM_SUBMIT_NO_IMPLICIT)); 836 if (ret) 837 goto out; 838 839 ret = submit_pin_objects(submit); 840 if (ret) 841 goto out; 842 843 for (i = 0; i < args->nr_cmds; i++) { 844 struct msm_gem_object *msm_obj; 845 uint64_t iova; 846 847 ret = submit_bo(submit, submit->cmd[i].idx, 848 &msm_obj, &iova, NULL); 849 if (ret) 850 goto out; 851 852 if (!submit->cmd[i].size || 853 ((submit->cmd[i].size + submit->cmd[i].offset) > 854 msm_obj->base.size / 4)) { 855 DRM_ERROR("invalid cmdstream size: %u\n", submit->cmd[i].size * 4); 856 ret = -EINVAL; 857 goto out; 858 } 859 860 submit->cmd[i].iova = iova + (submit->cmd[i].offset * 4); 861 862 if (submit->valid) 863 continue; 864 865 ret = submit_reloc(submit, msm_obj, submit->cmd[i].offset * 4, 866 submit->cmd[i].nr_relocs, submit->cmd[i].relocs); 867 if (ret) 868 goto out; 869 } 870 871 submit->nr_cmds = i; 872 873 drm_sched_job_arm(&submit->base); 874 875 submit->user_fence = dma_fence_get(&submit->base.s_fence->finished); 876 877 /* 878 * Allocate an id which can be used by WAIT_FENCE ioctl to map back 879 * to the underlying fence. 880 */ 881 submit->fence_id = idr_alloc_cyclic(&queue->fence_idr, 882 submit->user_fence, 0, INT_MAX, GFP_KERNEL); 883 if (submit->fence_id < 0) { 884 ret = submit->fence_id = 0; 885 submit->fence_id = 0; 886 } 887 888 if (ret == 0 && args->flags & MSM_SUBMIT_FENCE_FD_OUT) { 889 struct sync_file *sync_file = sync_file_create(submit->user_fence); 890 if (!sync_file) { 891 ret = -ENOMEM; 892 } else { 893 fd_install(out_fence_fd, sync_file->file); 894 args->fence_fd = out_fence_fd; 895 } 896 } 897 898 submit_attach_object_fences(submit); 899 900 /* The scheduler owns a ref now: */ 901 msm_gem_submit_get(submit); 902 903 drm_sched_entity_push_job(&submit->base); 904 905 args->fence = submit->fence_id; 906 907 msm_reset_syncobjs(syncobjs_to_reset, args->nr_in_syncobjs); 908 msm_process_post_deps(post_deps, args->nr_out_syncobjs, 909 submit->user_fence); 910 911 912 out: 913 submit_cleanup(submit, !!ret); 914 if (has_ww_ticket) 915 ww_acquire_fini(&submit->ticket); 916 out_unlock: 917 if (ret && (out_fence_fd >= 0)) 918 put_unused_fd(out_fence_fd); 919 mutex_unlock(&queue->lock); 920 if (submit) 921 msm_gem_submit_put(submit); 922 out_post_unlock: 923 if (!IS_ERR_OR_NULL(post_deps)) { 924 for (i = 0; i < args->nr_out_syncobjs; ++i) { 925 kfree(post_deps[i].chain); 926 drm_syncobj_put(post_deps[i].syncobj); 927 } 928 kfree(post_deps); 929 } 930 931 if (!IS_ERR_OR_NULL(syncobjs_to_reset)) { 932 for (i = 0; i < args->nr_in_syncobjs; ++i) { 933 if (syncobjs_to_reset[i]) 934 drm_syncobj_put(syncobjs_to_reset[i]); 935 } 936 kfree(syncobjs_to_reset); 937 } 938 939 return ret; 940 } 941