github-mirror/linux
1
0
Fork 0
mirror of https://github.com/torvalds/linux.git synced 2026-09-24 06:24:02 +02:00
Code Issues Actions Packages Projects Releases Wiki Activity Graph

drm/msm/gem: Set resv before exposing obj

Browse Source 
Don't swap the resv object _after_ exposing the newly created obj in LRU
or global objects list, as that creates a race condition where another
thread could lock the object using the original (per-obj) resv, but then
unlock after the resv is replaced.

Signed-off-by: Rob Clark <robin.clark@oss.qualcomm.com>
Patchwork: https://patchwork.freedesktop.org/patch/743109/
Message-ID: <20260729155609.20190-13-robin.clark@oss.qualcomm.com>
This commit is contained in:
Rob Clark 2026-07-29 08:55:49 -07:00
parent 695d2b042a
commit df68029e63
5 changed files with 24 additions and 18 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
drivers/gpu/drm/msm/adreno/a6xx_gmu.c
View File

@ -1554,7 +1554,7 @@ static int a6xx_gmu_memory_alloc(struct a6xx_gmu *gmu, struct a6xx_gmu_bo *bo,
flags |= MSM_BO_MAP_PRIV;
}
bo->obj = msm_gem_new(dev, size, flags);
bo->obj = msm_gem_new(dev, size, flags, NULL);
if (IS_ERR(bo->obj))
return PTR_ERR(bo->obj);

2
drivers/gpu/drm/msm/disp/mdp4/mdp4_kms.c
View File

@ -463,7 +463,7 @@ static int mdp4_kms_init(struct drm_device *dev)
goto fail;
}
mdp4_kms->blank_cursor_bo = msm_gem_new(dev, SZ_16K, MSM_BO_WC | MSM_BO_SCANOUT);
mdp4_kms->blank_cursor_bo = msm_gem_new(dev, SZ_16K, MSM_BO_WC | MSM_BO_SCANOUT, NULL);
if (IS_ERR(mdp4_kms->blank_cursor_bo)) {
ret = PTR_ERR(mdp4_kms->blank_cursor_bo);
DRM_DEV_ERROR(dev->dev, "could not allocate blank-cursor bo: %d\n", ret);

4
drivers/gpu/drm/msm/msm_fb.c
View File

@ -267,11 +267,11 @@ msm_alloc_stolen_fb(struct drm_device *dev, int w, int h, int p, uint32_t format
/* allocate backing bo */
size = mode_cmd.pitches[0] * mode_cmd.height;
DBG("allocating %d bytes for fb %d", size, dev->primary->index);
bo = msm_gem_new(dev, size, MSM_BO_SCANOUT | MSM_BO_WC | MSM_BO_STOLEN);
bo = msm_gem_new(dev, size, MSM_BO_SCANOUT | MSM_BO_WC | MSM_BO_STOLEN, NULL);
if (IS_ERR(bo)) {
dev_warn(dev->dev, "could not allocate stolen bo\n");
/* try regular bo: */
bo = msm_gem_new(dev, size, MSM_BO_SCANOUT | MSM_BO_WC);
bo = msm_gem_new(dev, size, MSM_BO_SCANOUT | MSM_BO_WC, NULL);
}
if (IS_ERR(bo)) {
DRM_DEV_ERROR(dev->dev, "failed to allocate buffer object\n");

32
drivers/gpu/drm/msm/msm_gem.c
View File

@ -1136,10 +1136,17 @@ int msm_gem_new_handle(struct drm_device *dev, struct drm_file *file,
size_t size, uint32_t flags, uint32_t *handle,
char *name)
{
struct drm_gem_object *obj;
struct drm_gem_object *obj, *r_obj = NULL;
int ret;
obj = msm_gem_new(dev, size, flags);
if (flags & MSM_BO_NO_SHARE) {
struct msm_context *ctx = file->driver_priv;
struct drm_gpuvm *vm = msm_context_vm(dev, ctx);
r_obj = drm_gpuvm_resv_obj(vm);
}
obj = msm_gem_new(dev, size, flags, r_obj);
if (IS_ERR(obj))
return PTR_ERR(obj);
@ -1147,15 +1154,6 @@ int msm_gem_new_handle(struct drm_device *dev, struct drm_file *file,
if (name)
msm_gem_object_set_name(obj, "%s", name);
if (flags & MSM_BO_NO_SHARE) {
struct msm_context *ctx = file->driver_priv;
struct drm_gem_object *r_obj = drm_gpuvm_resv_obj(ctx->vm);
drm_gem_object_get(r_obj);
obj->resv = r_obj->resv;
}
ret = drm_gem_handle_create(file, obj, handle);
/* drop reference from allocate - handle holds it now */
@ -1251,7 +1249,9 @@ static int msm_gem_init_bookkeeping(struct drm_gem_object *obj)
return drm_gem_create_mmap_offset(obj);
}
struct drm_gem_object *msm_gem_new(struct drm_device *dev, size_t size, uint32_t flags)
struct drm_gem_object *
msm_gem_new(struct drm_device *dev, size_t size, uint32_t flags,
struct drm_gem_object *r_obj)
{
struct drm_gem_object *obj = NULL;
int ret;
@ -1268,6 +1268,11 @@ struct drm_gem_object *msm_gem_new(struct drm_device *dev, size_t size, uint32_t
if (ret)
return ERR_PTR(ret);
if (flags & MSM_BO_NO_SHARE) {
drm_gem_object_get(r_obj);
obj->resv = r_obj->resv;
}
ret = drm_gem_object_init(dev, obj, size);
if (ret)
goto fail;
@ -1311,6 +1316,7 @@ struct drm_gem_object *msm_gem_import(struct drm_device *dev,
* up in drm_gem_object_put() -> msm_gem_free_object()
*/
obj->import_attach = attach;
obj->resv = dmabuf->resv;
drm_gem_private_object_init(dev, obj, size);
npages = size / PAGE_SIZE;
@ -1346,7 +1352,7 @@ void *msm_gem_kernel_new(struct drm_device *dev, size_t size, uint32_t flags,
uint64_t *iova)
{
void *vaddr;
struct drm_gem_object *obj = msm_gem_new(dev, size, flags);
struct drm_gem_object *obj = msm_gem_new(dev, size, flags, NULL);
int ret;
if (IS_ERR(obj))

2
drivers/gpu/drm/msm/msm_gem.h
View File

@ -296,7 +296,7 @@ int msm_gem_cpu_fini(struct drm_gem_object *obj);
int msm_gem_new_handle(struct drm_device *dev, struct drm_file *file,
size_t size, uint32_t flags, uint32_t *handle, char *name);
struct drm_gem_object *msm_gem_new(struct drm_device *dev,
size_t size, uint32_t flags);
size_t size, uint32_t flags, struct drm_gem_object *r_obj);
void *msm_gem_kernel_new(struct drm_device *dev, size_t size, uint32_t flags,
struct drm_gpuvm *vm, struct drm_gem_object **bo,
uint64_t *iova);