drm/i915: Fix lock order reversal in GEM relocation entry copying.
Signed-off-by: Eric Anholt <eric@anholt.net> Reviewed-by: Keith Packard <keithp@keithp.com>
This commit is contained in:
Eric Anholt
Родитель
201361a54e
Коммит
40a5f0decd
|
|
@ -2713,12 +2713,11 @@ i915_gem_object_set_cpu_read_domain_range(struct drm_gem_object *obj,
|
|||
static int
|
||||
i915_gem_object_pin_and_relocate(struct drm_gem_object *obj,
|
||||
struct drm_file *file_priv,
|
||||
struct drm_i915_gem_exec_object *entry)
|
||||
struct drm_i915_gem_exec_object *entry,
|
||||
struct drm_i915_gem_relocation_entry *relocs)
|
||||
{
|
||||
struct drm_device *dev = obj->dev;
|
||||
drm_i915_private_t *dev_priv = dev->dev_private;
|
||||
struct drm_i915_gem_relocation_entry reloc;
|
||||
struct drm_i915_gem_relocation_entry __user *relocs;
|
||||
struct drm_i915_gem_object *obj_priv = obj->driver_private;
|
||||
int i, ret;
|
||||
void __iomem *reloc_page;
|
||||
|
|
@ -2730,25 +2729,18 @@ i915_gem_object_pin_and_relocate(struct drm_gem_object *obj,
|
|||
|
||||
entry->offset = obj_priv->gtt_offset;
|
||||
|
||||
relocs = (struct drm_i915_gem_relocation_entry __user *)
|
||||
(uintptr_t) entry->relocs_ptr;
|
||||
/* Apply the relocations, using the GTT aperture to avoid cache
|
||||
* flushing requirements.
|
||||
*/
|
||||
for (i = 0; i < entry->relocation_count; i++) {
|
||||
struct drm_i915_gem_relocation_entry *reloc= &relocs[i];
|
||||
struct drm_gem_object *target_obj;
|
||||
struct drm_i915_gem_object *target_obj_priv;
|
||||
uint32_t reloc_val, reloc_offset;
|
||||
uint32_t __iomem *reloc_entry;
|
||||
|
||||
ret = copy_from_user(&reloc, relocs + i, sizeof(reloc));
|
||||
if (ret != 0) {
|
||||
i915_gem_object_unpin(obj);
|
||||
return ret;
|
||||
}
|
||||
|
||||
target_obj = drm_gem_object_lookup(obj->dev, file_priv,
|
||||
reloc.target_handle);
|
||||
reloc->target_handle);
|
||||
if (target_obj == NULL) {
|
||||
i915_gem_object_unpin(obj);
|
||||
return -EBADF;
|
||||
|
|
@ -2760,53 +2752,53 @@ i915_gem_object_pin_and_relocate(struct drm_gem_object *obj,
|
|||
*/
|
||||
if (target_obj_priv->gtt_space == NULL) {
|
||||
DRM_ERROR("No GTT space found for object %d\n",
|
||||
reloc.target_handle);
|
||||
reloc->target_handle);
|
||||
drm_gem_object_unreference(target_obj);
|
||||
i915_gem_object_unpin(obj);
|
||||
return -EINVAL;
|
||||
}
|
||||
|
||||
if (reloc.offset > obj->size - 4) {
|
||||
if (reloc->offset > obj->size - 4) {
|
||||
DRM_ERROR("Relocation beyond object bounds: "
|
||||
"obj %p target %d offset %d size %d.\n",
|
||||
obj, reloc.target_handle,
|
||||
(int) reloc.offset, (int) obj->size);
|
||||
obj, reloc->target_handle,
|
||||
(int) reloc->offset, (int) obj->size);
|
||||
drm_gem_object_unreference(target_obj);
|
||||
i915_gem_object_unpin(obj);
|
||||
return -EINVAL;
|
||||
}
|
||||
if (reloc.offset & 3) {
|
||||
if (reloc->offset & 3) {
|
||||
DRM_ERROR("Relocation not 4-byte aligned: "
|
||||
"obj %p target %d offset %d.\n",
|
||||
obj, reloc.target_handle,
|
||||
(int) reloc.offset);
|
||||
obj, reloc->target_handle,
|
||||
(int) reloc->offset);
|
||||
drm_gem_object_unreference(target_obj);
|
||||
i915_gem_object_unpin(obj);
|
||||
return -EINVAL;
|
||||
}
|
||||
|
||||
if (reloc.write_domain & I915_GEM_DOMAIN_CPU ||
|
||||
reloc.read_domains & I915_GEM_DOMAIN_CPU) {
|
||||
if (reloc->write_domain & I915_GEM_DOMAIN_CPU ||
|
||||
reloc->read_domains & I915_GEM_DOMAIN_CPU) {
|
||||
DRM_ERROR("reloc with read/write CPU domains: "
|
||||
"obj %p target %d offset %d "
|
||||
"read %08x write %08x",
|
||||
obj, reloc.target_handle,
|
||||
(int) reloc.offset,
|
||||
reloc.read_domains,
|
||||
reloc.write_domain);
|
||||
obj, reloc->target_handle,
|
||||
(int) reloc->offset,
|
||||
reloc->read_domains,
|
||||
reloc->write_domain);
|
||||
drm_gem_object_unreference(target_obj);
|
||||
i915_gem_object_unpin(obj);
|
||||
return -EINVAL;
|
||||
}
|
||||
|
||||
if (reloc.write_domain && target_obj->pending_write_domain &&
|
||||
reloc.write_domain != target_obj->pending_write_domain) {
|
||||
if (reloc->write_domain && target_obj->pending_write_domain &&
|
||||
reloc->write_domain != target_obj->pending_write_domain) {
|
||||
DRM_ERROR("Write domain conflict: "
|
||||
"obj %p target %d offset %d "
|
||||
"new %08x old %08x\n",
|
||||
obj, reloc.target_handle,
|
||||
(int) reloc.offset,
|
||||
reloc.write_domain,
|
||||
obj, reloc->target_handle,
|
||||
(int) reloc->offset,
|
||||
reloc->write_domain,
|
||||
target_obj->pending_write_domain);
|
||||
drm_gem_object_unreference(target_obj);
|
||||
i915_gem_object_unpin(obj);
|
||||
|
|
@ -2819,22 +2811,22 @@ i915_gem_object_pin_and_relocate(struct drm_gem_object *obj,
|
|||
"presumed %08x delta %08x\n",
|
||||
__func__,
|
||||
obj,
|
||||
(int) reloc.offset,
|
||||
(int) reloc.target_handle,
|
||||
(int) reloc.read_domains,
|
||||
(int) reloc.write_domain,
|
||||
(int) reloc->offset,
|
||||
(int) reloc->target_handle,
|
||||
(int) reloc->read_domains,
|
||||
(int) reloc->write_domain,
|
||||
(int) target_obj_priv->gtt_offset,
|
||||
(int) reloc.presumed_offset,
|
||||
reloc.delta);
|
||||
(int) reloc->presumed_offset,
|
||||
reloc->delta);
|
||||
#endif
|
||||
|
||||
target_obj->pending_read_domains |= reloc.read_domains;
|
||||
target_obj->pending_write_domain |= reloc.write_domain;
|
||||
target_obj->pending_read_domains |= reloc->read_domains;
|
||||
target_obj->pending_write_domain |= reloc->write_domain;
|
||||
|
||||
/* If the relocation already has the right value in it, no
|
||||
* more work needs to be done.
|
||||
*/
|
||||
if (target_obj_priv->gtt_offset == reloc.presumed_offset) {
|
||||
if (target_obj_priv->gtt_offset == reloc->presumed_offset) {
|
||||
drm_gem_object_unreference(target_obj);
|
||||
continue;
|
||||
}
|
||||
|
|
@ -2849,32 +2841,26 @@ i915_gem_object_pin_and_relocate(struct drm_gem_object *obj,
|
|||
/* Map the page containing the relocation we're going to
|
||||
* perform.
|
||||
*/
|
||||
reloc_offset = obj_priv->gtt_offset + reloc.offset;
|
||||
reloc_offset = obj_priv->gtt_offset + reloc->offset;
|
||||
reloc_page = io_mapping_map_atomic_wc(dev_priv->mm.gtt_mapping,
|
||||
(reloc_offset &
|
||||
~(PAGE_SIZE - 1)));
|
||||
reloc_entry = (uint32_t __iomem *)(reloc_page +
|
||||
(reloc_offset & (PAGE_SIZE - 1)));
|
||||
reloc_val = target_obj_priv->gtt_offset + reloc.delta;
|
||||
reloc_val = target_obj_priv->gtt_offset + reloc->delta;
|
||||
|
||||
#if WATCH_BUF
|
||||
DRM_INFO("Applied relocation: %p@0x%08x %08x -> %08x\n",
|
||||
obj, (unsigned int) reloc.offset,
|
||||
obj, (unsigned int) reloc->offset,
|
||||
readl(reloc_entry), reloc_val);
|
||||
#endif
|
||||
writel(reloc_val, reloc_entry);
|
||||
io_mapping_unmap_atomic(reloc_page);
|
||||
|
||||
/* Write the updated presumed offset for this entry back out
|
||||
* to the user.
|
||||
/* The updated presumed offset for this entry will be
|
||||
* copied back out to the user.
|
||||
*/
|
||||
reloc.presumed_offset = target_obj_priv->gtt_offset;
|
||||
ret = copy_to_user(relocs + i, &reloc, sizeof(reloc));
|
||||
if (ret != 0) {
|
||||
drm_gem_object_unreference(target_obj);
|
||||
i915_gem_object_unpin(obj);
|
||||
return ret;
|
||||
}
|
||||
reloc->presumed_offset = target_obj_priv->gtt_offset;
|
||||
|
||||
drm_gem_object_unreference(target_obj);
|
||||
}
|
||||
|
|
@ -2971,6 +2957,75 @@ i915_gem_ring_throttle(struct drm_device *dev, struct drm_file *file_priv)
|
|||
return ret;
|
||||
}
|
||||
|
||||
static int
|
||||
i915_gem_get_relocs_from_user(struct drm_i915_gem_exec_object *exec_list,
|
||||
uint32_t buffer_count,
|
||||
struct drm_i915_gem_relocation_entry **relocs)
|
||||
{
|
||||
uint32_t reloc_count = 0, reloc_index = 0, i;
|
||||
int ret;
|
||||
|
||||
*relocs = NULL;
|
||||
for (i = 0; i < buffer_count; i++) {
|
||||
if (reloc_count + exec_list[i].relocation_count < reloc_count)
|
||||
return -EINVAL;
|
||||
reloc_count += exec_list[i].relocation_count;
|
||||
}
|
||||
|
||||
*relocs = drm_calloc(reloc_count, sizeof(**relocs), DRM_MEM_DRIVER);
|
||||
if (*relocs == NULL)
|
||||
return -ENOMEM;
|
||||
|
||||
for (i = 0; i < buffer_count; i++) {
|
||||
struct drm_i915_gem_relocation_entry __user *user_relocs;
|
||||
|
||||
user_relocs = (void __user *)(uintptr_t)exec_list[i].relocs_ptr;
|
||||
|
||||
ret = copy_from_user(&(*relocs)[reloc_index],
|
||||
user_relocs,
|
||||
exec_list[i].relocation_count *
|
||||
sizeof(**relocs));
|
||||
if (ret != 0) {
|
||||
drm_free(*relocs, reloc_count * sizeof(**relocs),
|
||||
DRM_MEM_DRIVER);
|
||||
*relocs = NULL;
|
||||
return ret;
|
||||
}
|
||||
|
||||
reloc_index += exec_list[i].relocation_count;
|
||||
}
|
||||
|
||||
return ret;
|
||||
}
|
||||
|
||||
static int
|
||||
i915_gem_put_relocs_to_user(struct drm_i915_gem_exec_object *exec_list,
|
||||
uint32_t buffer_count,
|
||||
struct drm_i915_gem_relocation_entry *relocs)
|
||||
{
|
||||
uint32_t reloc_count = 0, i;
|
||||
int ret;
|
||||
|
||||
for (i = 0; i < buffer_count; i++) {
|
||||
struct drm_i915_gem_relocation_entry __user *user_relocs;
|
||||
|
||||
user_relocs = (void __user *)(uintptr_t)exec_list[i].relocs_ptr;
|
||||
|
||||
if (ret == 0) {
|
||||
ret = copy_to_user(user_relocs,
|
||||
&relocs[reloc_count],
|
||||
exec_list[i].relocation_count *
|
||||
sizeof(*relocs));
|
||||
}
|
||||
|
||||
reloc_count += exec_list[i].relocation_count;
|
||||
}
|
||||
|
||||
drm_free(relocs, reloc_count * sizeof(*relocs), DRM_MEM_DRIVER);
|
||||
|
||||
return ret;
|
||||
}
|
||||
|
||||
int
|
||||
i915_gem_execbuffer(struct drm_device *dev, void *data,
|
||||
struct drm_file *file_priv)
|
||||
|
|
@ -2983,9 +3038,10 @@ i915_gem_execbuffer(struct drm_device *dev, void *data,
|
|||
struct drm_gem_object *batch_obj;
|
||||
struct drm_i915_gem_object *obj_priv;
|
||||
struct drm_clip_rect *cliprects = NULL;
|
||||
int ret, i, pinned = 0;
|
||||
struct drm_i915_gem_relocation_entry *relocs;
|
||||
int ret, ret2, i, pinned = 0;
|
||||
uint64_t exec_offset;
|
||||
uint32_t seqno, flush_domains;
|
||||
uint32_t seqno, flush_domains, reloc_index;
|
||||
int pin_tries;
|
||||
|
||||
#if WATCH_EXEC
|
||||
|
|
@ -3036,6 +3092,11 @@ i915_gem_execbuffer(struct drm_device *dev, void *data,
|
|||
}
|
||||
}
|
||||
|
||||
ret = i915_gem_get_relocs_from_user(exec_list, args->buffer_count,
|
||||
&relocs);
|
||||
if (ret != 0)
|
||||
goto pre_mutex_err;
|
||||
|
||||
mutex_lock(&dev->struct_mutex);
|
||||
|
||||
i915_verify_inactive(dev, __FILE__, __LINE__);
|
||||
|
|
@ -3078,15 +3139,19 @@ i915_gem_execbuffer(struct drm_device *dev, void *data,
|
|||
/* Pin and relocate */
|
||||
for (pin_tries = 0; ; pin_tries++) {
|
||||
ret = 0;
|
||||
reloc_index = 0;
|
||||
|
||||
for (i = 0; i < args->buffer_count; i++) {
|
||||
object_list[i]->pending_read_domains = 0;
|
||||
object_list[i]->pending_write_domain = 0;
|
||||
ret = i915_gem_object_pin_and_relocate(object_list[i],
|
||||
file_priv,
|
||||
&exec_list[i]);
|
||||
&exec_list[i],
|
||||
&relocs[reloc_index]);
|
||||
if (ret)
|
||||
break;
|
||||
pinned = i + 1;
|
||||
reloc_index += exec_list[i].relocation_count;
|
||||
}
|
||||
/* success */
|
||||
if (ret == 0)
|
||||
|
|
@ -3236,6 +3301,20 @@ err:
|
|||
args->buffer_count, ret);
|
||||
}
|
||||
|
||||
/* Copy the updated relocations out regardless of current error
|
||||
* state. Failure to update the relocs would mean that the next
|
||||
* time userland calls execbuf, it would do so with presumed offset
|
||||
* state that didn't match the actual object state.
|
||||
*/
|
||||
ret2 = i915_gem_put_relocs_to_user(exec_list, args->buffer_count,
|
||||
relocs);
|
||||
if (ret2 != 0) {
|
||||
DRM_ERROR("Failed to copy relocations back out: %d\n", ret2);
|
||||
|
||||
if (ret == 0)
|
||||
ret = ret2;
|
||||
}
|
||||
|
||||
pre_mutex_err:
|
||||
drm_free(object_list, sizeof(*object_list) * args->buffer_count,
|
||||
DRM_MEM_DRIVER);
|
||||
|
|
|
|||
Загрузка…
Ссылка в новой задаче