projects/linux·blob master · refs

853 lines · 20.8 KiB

1// SPDX-License-Identifier: GPL-2.0-only
2/*
3 * Copyright (C) 2013 Red Hat
4 * Author: Rob Clark <[email protected]>
5 */
6
7#include <linux/dma-fence-unwrap.h>
8#include <linux/file.h>
9#include <linux/sync_file.h>
10#include <linux/uaccess.h>
11
12#include <drm/drm_drv.h>
13#include <drm/drm_file.h>
14#include <drm/drm_syncobj.h>
15
16#include "msm_drv.h"
17#include "msm_gpu.h"
18#include "msm_gem.h"
19#include "msm_gpu_trace.h"
20#include "msm_syncobj.h"
21
22/* For userspace errors, use DRM_UT_DRIVER.. so that userspace can enable
23 * error msgs for debugging, but we don't spam dmesg by default
24 */
25#define SUBMIT_ERROR(err, submit, fmt, ...) \
26 UERR(err, (submit)->dev, fmt, ##__VA_ARGS__)
27
28/*
29 * Cmdstream submission:
30 */
31
32static struct msm_gem_submit *submit_create(struct drm_device *dev,
33 struct msm_gpu *gpu, struct drm_gpuvm *vm,
34 struct msm_gpu_submitqueue *queue, uint32_t nr_bos,
35 uint32_t nr_cmds, u64 drm_client_id)
36{
37 static atomic_t ident = ATOMIC_INIT(0);
38 struct msm_gem_submit *submit;
39 size_t sz;
40 int ret;
41
42 sz = size_add(struct_size(submit, bos, nr_bos),
43 array_size(sizeof(submit->cmd[0]), nr_cmds));
44
45 submit = kzalloc(sz, GFP_KERNEL | __GFP_NOWARN);
46 if (!submit)
47 return ERR_PTR(-ENOMEM);
48
49 submit->hw_fence = msm_fence_alloc();
50 if (IS_ERR(submit->hw_fence)) {
51 ret = PTR_ERR(submit->hw_fence);
52 kfree(submit);
53 return ERR_PTR(ret);
54 }
55
56 ret = drm_sched_job_init(&submit->base, queue->entity, 1, queue,
57 drm_client_id);
58 if (ret) {
59 kfree(submit->hw_fence);
60 kfree(submit);
61 return ERR_PTR(ret);
62 }
63
64 kref_init(&submit->ref);
65 submit->dev = dev;
66 submit->vm = vm;
67 submit->gpu = gpu;
68 submit->cmd = (void *)&submit->bos[nr_bos];
69 submit->queue = queue;
70 submit->pid = get_pid(task_pid(current));
71 submit->ring = gpu->rb[queue->ring_nr];
72 submit->fault_dumped = false;
73
74 /* Get a unique identifier for the submission for logging purposes */
75 submit->ident = atomic_inc_return(&ident) - 1;
76
77 INIT_LIST_HEAD(&submit->node);
78
79 return submit;
80}
81
82void __msm_gem_submit_destroy(struct kref *kref)
83{
84 struct msm_gem_submit *submit =
85 container_of(kref, struct msm_gem_submit, ref);
86 unsigned i;
87
88 /*
89 * In error paths, we could unref the submit without calling
90 * drm_sched_entity_push_job(), so msm_job_free() will never
91 * get called. Since drm_sched_job_cleanup() will NULL out
92 * s_fence, we can use that to detect this case.
93 */
94 if (submit->base.s_fence)
95 drm_sched_job_cleanup(&submit->base);
96
97 if (submit->fence_id) {
98 spin_lock(&submit->queue->idr_lock);
99 idr_remove(&submit->queue->fence_idr, submit->fence_id);
100 spin_unlock(&submit->queue->idr_lock);
101 }
102
103 dma_fence_put(submit->user_fence);
104
105 /*
106 * If the submit is freed before msm_job_run(), then hw_fence is
107 * just some pre-allocated memory, not a reference counted fence.
108 * Once the job runs and the hw_fence is initialized, it will
109 * have a refcount of at least one, since the submit holds a ref
110 * to the hw_fence.
111 */
112 if (kref_read(&submit->hw_fence->refcount) == 0) {
113 kfree(submit->hw_fence);
114 } else {
115 dma_fence_put(submit->hw_fence);
116 }
117
118 put_pid(submit->pid);
119 msm_submitqueue_put(submit->queue);
120
121 for (i = 0; i < submit->nr_cmds; i++)
122 kfree(submit->cmd[i].relocs);
123
124 kfree(submit);
125}
126
127static int submit_lookup_objects(struct msm_gem_submit *submit,
128 struct drm_msm_gem_submit *args, struct drm_file *file)
129{
130 unsigned i;
131 int ret = 0;
132
133 for (i = 0; i < args->nr_bos; i++) {
134 struct drm_msm_gem_submit_bo submit_bo;
135 void __user *userptr =
136 u64_to_user_ptr(args->bos + (i * sizeof(submit_bo)));
137
138 /* make sure we don't have garbage flags, in case we hit
139 * error path before flags is initialized:
140 */
141 submit->bos[i].flags = 0;
142
143 if (copy_from_user(&submit_bo, userptr, sizeof(submit_bo))) {
144 ret = -EFAULT;
145 i = 0;
146 goto out;
147 }
148
149/* at least one of READ and/or WRITE flags should be set: */
150#define MANDATORY_FLAGS (MSM_SUBMIT_BO_READ | MSM_SUBMIT_BO_WRITE)
151
152 if ((submit_bo.flags & ~MSM_SUBMIT_BO_FLAGS) ||
153 !(submit_bo.flags & MANDATORY_FLAGS)) {
154 ret = SUBMIT_ERROR(EINVAL, submit, "invalid flags: %x\n", submit_bo.flags);
155 i = 0;
156 goto out;
157 }
158
159 submit->bos[i].handle = submit_bo.handle;
160 submit->bos[i].flags = submit_bo.flags;
161 }
162
163 spin_lock(&file->table_lock);
164
165 for (i = 0; i < args->nr_bos; i++) {
166 struct drm_gem_object *obj;
167
168 /* normally use drm_gem_object_lookup(), but for bulk lookup
169 * all under single table_lock just hit object_idr directly:
170 */
171 obj = idr_find(&file->object_idr, submit->bos[i].handle);
172 if (!obj) {
173 ret = SUBMIT_ERROR(EINVAL, submit, "invalid handle %u at index %u\n", submit->bos[i].handle, i);
174 goto out_unlock;
175 }
176
177 drm_gem_object_get(obj);
178
179 submit->bos[i].obj = obj;
180 }
181
182out_unlock:
183 spin_unlock(&file->table_lock);
184
185out:
186 submit->nr_bos = i;
187
188 return ret;
189}
190
191static int submit_lookup_cmds(struct msm_gem_submit *submit,
192 struct drm_msm_gem_submit *args, struct drm_file *file)
193{
194 struct msm_context *ctx = file->driver_priv;
195 unsigned i;
196 size_t sz;
197 int ret = 0;
198
199 for (i = 0; i < args->nr_cmds; i++) {
200 struct drm_msm_gem_submit_cmd submit_cmd;
201 void __user *userptr =
202 u64_to_user_ptr(args->cmds + (i * sizeof(submit_cmd)));
203
204 ret = copy_from_user(&submit_cmd, userptr, sizeof(submit_cmd));
205 if (ret) {
206 ret = -EFAULT;
207 goto out;
208 }
209
210 /* validate input from userspace: */
211 switch (submit_cmd.type) {
212 case MSM_SUBMIT_CMD_BUF:
213 case MSM_SUBMIT_CMD_IB_TARGET_BUF:
214 case MSM_SUBMIT_CMD_CTX_RESTORE_BUF:
215 break;
216 default:
217 return SUBMIT_ERROR(EINVAL, submit, "invalid type: %08x\n", submit_cmd.type);
218 }
219
220 if (submit_cmd.size % 4) {
221 ret = SUBMIT_ERROR(EINVAL, submit, "non-aligned cmdstream buffer size: %u\n",
222 submit_cmd.size);
223 goto out;
224 }
225
226 if (msm_context_is_vmbind(ctx)) {
227 if (submit_cmd.nr_relocs) {
228 ret = SUBMIT_ERROR(EINVAL, submit, "nr_relocs must be zero");
229 goto out;
230 }
231
232 if (submit_cmd.submit_idx || submit_cmd.submit_offset) {
233 ret = SUBMIT_ERROR(EINVAL, submit, "submit_idx/offset must be zero");
234 goto out;
235 }
236
237 submit->cmd[i].iova = submit_cmd.iova;
238 }
239
240 submit->cmd[i].type = submit_cmd.type;
241 submit->cmd[i].size = submit_cmd.size / 4;
242 submit->cmd[i].offset = submit_cmd.submit_offset / 4;
243 submit->cmd[i].idx = submit_cmd.submit_idx;
244 submit->cmd[i].nr_relocs = submit_cmd.nr_relocs;
245
246 userptr = u64_to_user_ptr(submit_cmd.relocs);
247
248 sz = array_size(submit_cmd.nr_relocs,
249 sizeof(struct drm_msm_gem_submit_reloc));
250 submit->cmd[i].relocs = kmalloc(sz, GFP_KERNEL | __GFP_NOWARN);
251 if (!submit->cmd[i].relocs) {
252 ret = -ENOMEM;
253 goto out;
254 }
255
256 submit->nr_cmds = i + 1;
257
258 ret = copy_from_user(submit->cmd[i].relocs, userptr, sz);
259 if (ret) {
260 ret = -EFAULT;
261 goto out;
262 }
263 }
264
265out:
266 return ret;
267}
268
269static int submit_lock_objects_vmbind(struct msm_gem_submit *submit)
270{
271 unsigned flags = DRM_EXEC_INTERRUPTIBLE_WAIT | DRM_EXEC_IGNORE_DUPLICATES;
272 struct drm_exec *exec = &submit->exec;
273 int ret = 0;
274
275 drm_exec_init(&submit->exec, flags, submit->nr_bos);
276 submit->has_exec = true;
277
278 drm_exec_until_all_locked (&submit->exec) {
279 ret = drm_gpuvm_prepare_vm(submit->vm, exec, 1);
280 drm_exec_retry_on_contention(exec);
281 if (ret)
282 break;
283
284 ret = drm_gpuvm_prepare_objects(submit->vm, exec, 1);
285 drm_exec_retry_on_contention(exec);
286 if (ret)
287 break;
288 }
289
290 return ret;
291}
292
293/* This is where we make sure all the bo's are reserved and pin'd: */
294static int submit_lock_objects(struct msm_gem_submit *submit)
295{
296 unsigned flags = DRM_EXEC_INTERRUPTIBLE_WAIT;
297 int ret = 0;
298
299 if (msm_context_is_vmbind(submit->queue->ctx))
300 return submit_lock_objects_vmbind(submit);
301
302 drm_exec_init(&submit->exec, flags, submit->nr_bos);
303 submit->has_exec = true;
304
305 drm_exec_until_all_locked (&submit->exec) {
306 ret = drm_exec_lock_obj(&submit->exec,
307 drm_gpuvm_resv_obj(submit->vm));
308 drm_exec_retry_on_contention(&submit->exec);
309 if (ret)
310 break;
311 for (unsigned i = 0; i < submit->nr_bos; i++) {
312 struct drm_gem_object *obj = submit->bos[i].obj;
313 ret = drm_exec_prepare_obj(&submit->exec, obj, 1);
314 drm_exec_retry_on_contention(&submit->exec);
315 if (ret)
316 break;
317 }
318 }
319
320 return ret;
321}
322
323static int submit_fence_sync(struct msm_gem_submit *submit)
324{
325 int i, ret = 0;
326
327 for (i = 0; i < submit->nr_bos; i++) {
328 struct drm_gem_object *obj = submit->bos[i].obj;
329 bool write = submit->bos[i].flags & MSM_SUBMIT_BO_WRITE;
330
331 /* Otherwise userspace can ask for implicit sync to be
332 * disabled on specific buffers. This is useful for internal
333 * usermode driver managed buffers, suballocation, etc.
334 */
335 if (submit->bos[i].flags & MSM_SUBMIT_BO_NO_IMPLICIT)
336 continue;
337
338 ret = drm_sched_job_add_implicit_dependencies(&submit->base,
339 obj,
340 write);
341 if (ret)
342 break;
343 }
344
345 return ret;
346}
347
348static int submit_pin_objects(struct msm_gem_submit *submit)
349{
350 struct drm_device *dev = submit->dev;
351 int i, ret = 0;
352
353 for (i = 0; i < submit->nr_bos; i++) {
354 struct drm_gem_object *obj = submit->bos[i].obj;
355 struct drm_gpuva *vma;
356
357 /* if locking succeeded, pin bo: */
358 vma = msm_gem_get_vma_locked(obj, submit->vm);
359 if (IS_ERR(vma)) {
360 ret = PTR_ERR(vma);
361 break;
362 }
363
364 ret = msm_gem_pin_vma_locked(obj, vma);
365 if (ret)
366 break;
367
368 submit->bos[i].vm_bo = drm_gpuvm_bo_get(vma->vm_bo);
369 submit->bos[i].iova = vma->va.addr;
370 }
371
372 /*
373 * A second loop while holding the LRU lock (a) avoids acquiring/dropping
374 * the LRU lock for each individual bo, while (b) avoiding holding the
375 * LRU lock while calling msm_gem_pin_vma_locked() (which could trigger
376 * get_pages() which could trigger reclaim.. and if we held the LRU lock
377 * could trigger deadlock with the shrinker).
378 */
379 mutex_lock(&dev->gem_lru_mutex);
380 for (i = 0; i < submit->nr_bos; i++) {
381 msm_gem_pin_obj_locked(submit->bos[i].obj);
382 }
383 mutex_unlock(&dev->gem_lru_mutex);
384
385 submit->bos_pinned = true;
386
387 return ret;
388}
389
390static void submit_unpin_objects(struct msm_gem_submit *submit)
391{
392 if (!submit->bos_pinned)
393 return;
394
395 for (int i = 0; i < submit->nr_bos; i++) {
396 struct drm_gem_object *obj = submit->bos[i].obj;
397
398 msm_gem_unpin_locked(obj);
399 }
400
401 submit->bos_pinned = false;
402}
403
404static void submit_attach_object_fences(struct msm_gem_submit *submit)
405{
406 struct msm_gem_vm *vm = to_msm_vm(submit->vm);
407 struct dma_fence *last_fence;
408
409 if (msm_context_is_vmbind(submit->queue->ctx)) {
410 drm_gpuvm_resv_add_fence(submit->vm, &submit->exec,
411 submit->user_fence,
412 DMA_RESV_USAGE_BOOKKEEP,
413 DMA_RESV_USAGE_BOOKKEEP);
414
415 last_fence = vm->last_fence;
416 vm->last_fence = dma_fence_unwrap_merge(submit->user_fence, last_fence);
417 dma_fence_put(last_fence);
418
419 return;
420 }
421
422 for (unsigned i = 0; i < submit->nr_bos; i++) {
423 struct drm_gem_object *obj = submit->bos[i].obj;
424
425 if (submit->bos[i].flags & MSM_SUBMIT_BO_WRITE)
426 dma_resv_add_fence(obj->resv, submit->user_fence,
427 DMA_RESV_USAGE_WRITE);
428 else if (submit->bos[i].flags & MSM_SUBMIT_BO_READ)
429 dma_resv_add_fence(obj->resv, submit->user_fence,
430 DMA_RESV_USAGE_READ);
431 }
432}
433
434static int submit_bo(struct msm_gem_submit *submit, uint32_t idx,
435 struct drm_gem_object **obj, uint64_t *iova)
436{
437 if (idx >= submit->nr_bos) {
438 return SUBMIT_ERROR(EINVAL, submit, "invalid buffer index: %u (out of %u)\n",
439 idx, submit->nr_bos);
440 }
441
442 if (obj)
443 *obj = submit->bos[idx].obj;
444 if (iova)
445 *iova = submit->bos[idx].iova;
446
447 return 0;
448}
449
450/* process the reloc's and patch up the cmdstream as needed: */
451static int submit_reloc(struct msm_gem_submit *submit, struct drm_gem_object *obj,
452 uint32_t offset, uint32_t nr_relocs, struct drm_msm_gem_submit_reloc *relocs)
453{
454 uint32_t i, last_offset = 0;
455 uint32_t *ptr;
456 int ret = 0;
457
458 if (offset % 4)
459 return SUBMIT_ERROR(EINVAL, submit, "non-aligned cmdstream buffer: %u\n", offset);
460
461 /* For now, just map the entire thing. Eventually we probably
462 * to do it page-by-page, w/ kmap() if not vmap()d..
463 */
464 ptr = msm_gem_get_vaddr_locked(obj);
465
466 if (IS_ERR(ptr)) {
467 ret = PTR_ERR(ptr);
468 DBG("failed to map: %d", ret);
469 return ret;
470 }
471
472 for (i = 0; i < nr_relocs; i++) {
473 struct drm_msm_gem_submit_reloc submit_reloc = relocs[i];
474 uint32_t off;
475 uint64_t iova;
476
477 if (submit_reloc.submit_offset % 4) {
478 ret = SUBMIT_ERROR(EINVAL, submit, "non-aligned reloc offset: %u\n",
479 submit_reloc.submit_offset);
480 goto out;
481 }
482
483 /* offset in dwords: */
484 off = submit_reloc.submit_offset / 4;
485
486 if ((off >= (obj->size / 4)) ||
487 (off < last_offset)) {
488 ret = SUBMIT_ERROR(EINVAL, submit, "invalid offset %u at reloc %u\n", off, i);
489 goto out;
490 }
491
492 ret = submit_bo(submit, submit_reloc.reloc_idx, NULL, &iova);
493 if (ret)
494 goto out;
495
496 iova += submit_reloc.reloc_offset;
497
498 if (submit_reloc.shift < 0)
499 iova >>= -submit_reloc.shift;
500 else
501 iova <<= submit_reloc.shift;
502
503 ptr[off] = iova | submit_reloc.or;
504
505 last_offset = off;
506 }
507
508out:
509 msm_gem_put_vaddr_locked(obj);
510
511 return ret;
512}
513
514/* Cleanup submit at end of ioctl. In the error case, this also drops
515 * references, unpins, and drops active refcnt. In the non-error case,
516 * this is done when the submit is retired.
517 */
518static void submit_cleanup(struct msm_gem_submit *submit, bool error)
519{
520 if (error)
521 submit_unpin_objects(submit);
522
523 if (submit->has_exec)
524 drm_exec_fini(&submit->exec);
525
526 /* if job wasn't enqueued to scheduler, early retirement: */
527 if (error)
528 msm_submit_retire(submit);
529}
530
531void msm_submit_retire(struct msm_gem_submit *submit)
532{
533 int i;
534
535 for (i = 0; i < submit->nr_bos; i++) {
536 struct drm_gem_object *obj = submit->bos[i].obj;
537 struct drm_gpuvm_bo *vm_bo = submit->bos[i].vm_bo;
538
539 msm_gem_lock(obj);
540 drm_gpuvm_bo_put(vm_bo);
541 msm_gem_unlock(obj);
542 drm_gem_object_put(obj);
543 }
544}
545
546int msm_ioctl_gem_submit(struct drm_device *dev, void *data,
547 struct drm_file *file)
548{
549 struct msm_drm_private *priv = dev->dev_private;
550 struct drm_msm_gem_submit *args = data;
551 struct msm_context *ctx = file->driver_priv;
552 struct drm_gpuvm *vm = msm_context_vm(dev, ctx);
553 struct msm_gem_submit *submit = NULL;
554 struct msm_gpu *gpu = priv->gpu;
555 struct msm_gpu_submitqueue *queue;
556 struct msm_ringbuffer *ring;
557 struct msm_syncobj_post_dep *post_deps = NULL;
558 struct drm_syncobj **syncobjs_to_reset = NULL;
559 struct sync_file *sync_file = NULL;
560 unsigned cmds_to_parse;
561 int out_fence_fd = -1;
562 unsigned i;
563 int ret;
564
565 if (!gpu)
566 return -ENXIO;
567
568 if (!vm)
569 return UERR(ENOMEM, dev, "no VM");
570
571 if (args->pad)
572 return -EINVAL;
573
574 if (to_msm_vm(vm)->unusable)
575 return UERR(EPIPE, dev, "context is unusable");
576
577 /* for now, we just have 3d pipe.. eventually this would need to
578 * be more clever to dispatch to appropriate gpu module:
579 */
580 if (MSM_PIPE_ID(args->flags) != MSM_PIPE_3D0)
581 return UERR(EINVAL, dev, "invalid pipe");
582
583 if (MSM_PIPE_FLAGS(args->flags) & ~MSM_SUBMIT_FLAGS)
584 return UERR(EINVAL, dev, "invalid flags");
585
586 if (args->flags & MSM_SUBMIT_SUDO) {
587 if (!IS_ENABLED(CONFIG_DRM_MSM_GPU_SUDO) ||
588 !capable(CAP_SYS_RAWIO))
589 return -EINVAL;
590 }
591
592 queue = msm_submitqueue_get(ctx, args->queueid);
593 if (!queue)
594 return -ENOENT;
595
596 if (queue->flags & MSM_SUBMITQUEUE_VM_BIND) {
597 ret = UERR(EINVAL, dev, "Invalid queue type");
598 goto out_post_unlock;
599 }
600
601 ring = gpu->rb[queue->ring_nr];
602
603 if (args->flags & MSM_SUBMIT_FENCE_FD_OUT) {
604 out_fence_fd = get_unused_fd_flags(O_CLOEXEC);
605 if (out_fence_fd < 0) {
606 ret = out_fence_fd;
607 goto out_post_unlock;
608 }
609 }
610
611 submit = submit_create(dev, gpu, vm, queue, args->nr_bos, args->nr_cmds,
612 file->client_id);
613 if (IS_ERR(submit)) {
614 ret = PTR_ERR(submit);
615 goto out_post_unlock;
616 }
617
618 trace_msm_gpu_submit(pid_nr(submit->pid), ring->id, submit->ident,
619 args->nr_bos, args->nr_cmds);
620
621 ret = mutex_lock_interruptible(&queue->lock);
622 if (ret)
623 goto out_post_unlock;
624
625 if (args->flags & MSM_SUBMIT_SUDO)
626 submit->in_rb = true;
627
628 if (args->flags & MSM_SUBMIT_FENCE_FD_IN) {
629 struct dma_fence *in_fence;
630
631 in_fence = sync_file_get_fence(args->fence_fd);
632
633 if (!in_fence) {
634 ret = UERR(EINVAL, dev, "invalid in-fence");
635 goto out_unlock;
636 }
637
638 ret = drm_sched_job_add_dependency(&submit->base, in_fence);
639 if (ret)
640 goto out_unlock;
641 }
642
643 if (args->flags & MSM_SUBMIT_SYNCOBJ_IN) {
644 syncobjs_to_reset = msm_syncobj_parse_deps(dev, &submit->base,
645 file, args->in_syncobjs,
646 args->nr_in_syncobjs,
647 args->syncobj_stride);
648 if (IS_ERR(syncobjs_to_reset)) {
649 ret = PTR_ERR(syncobjs_to_reset);
650 goto out_unlock;
651 }
652 }
653
654 if (args->flags & MSM_SUBMIT_SYNCOBJ_OUT) {
655 post_deps = msm_syncobj_parse_post_deps(dev, file,
656 args->out_syncobjs,
657 args->nr_out_syncobjs,
658 args->syncobj_stride);
659 if (IS_ERR(post_deps)) {
660 ret = PTR_ERR(post_deps);
661 goto out_unlock;
662 }
663 }
664
665 ret = submit_lookup_objects(submit, args, file);
666 if (ret)
667 goto out;
668
669 ret = submit_lookup_cmds(submit, args, file);
670 if (ret)
671 goto out;
672
673 /* copy_*_user while holding a ww ticket upsets lockdep */
674 ret = submit_lock_objects(submit);
675 if (ret)
676 goto out;
677
678 if (!(args->flags & MSM_SUBMIT_NO_IMPLICIT)) {
679 ret = submit_fence_sync(submit);
680 if (ret)
681 goto out;
682 }
683
684 ret = submit_pin_objects(submit);
685 if (ret)
686 goto out;
687
688 cmds_to_parse = msm_context_is_vmbind(ctx) ? 0 : args->nr_cmds;
689
690 for (i = 0; i < cmds_to_parse; i++) {
691 struct drm_gem_object *obj;
692 uint64_t iova;
693
694 ret = submit_bo(submit, submit->cmd[i].idx, &obj, &iova);
695 if (ret)
696 goto out;
697
698 if (!submit->cmd[i].size ||
699 (size_add(submit->cmd[i].size, submit->cmd[i].offset) > obj->size / 4)) {
700 ret = UERR(EINVAL, dev, "invalid cmdstream size: %u\n",
701 submit->cmd[i].size * 4);
702 goto out;
703 }
704
705 submit->cmd[i].iova = iova + (submit->cmd[i].offset * 4);
706
707 if (likely(!submit->cmd[i].nr_relocs))
708 continue;
709
710 if (!gpu->allow_relocs) {
711 ret = UERR(EINVAL, dev, "relocs not allowed\n");
712 goto out;
713 }
714
715 ret = submit_reloc(submit, obj, submit->cmd[i].offset * 4,
716 submit->cmd[i].nr_relocs, submit->cmd[i].relocs);
717 if (ret)
718 goto out;
719 }
720
721 idr_preload(GFP_KERNEL);
722
723 spin_lock(&queue->idr_lock);
724
725 /*
726 * If using userspace provided seqno fence, validate that the id
727 * is available before arming sched job. Since access to fence_idr
728 * is serialized on the queue lock, the slot should be still avail
729 * after the job is armed
730 */
731 if ((args->flags & MSM_SUBMIT_FENCE_SN_IN) &&
732 (!args->fence || idr_find(&queue->fence_idr, args->fence))) {
733 spin_unlock(&queue->idr_lock);
734 idr_preload_end();
735 ret = UERR(EINVAL, dev, "invalid in-fence-sn");
736 goto out;
737 }
738
739 drm_sched_job_arm(&submit->base);
740
741 submit->user_fence = dma_fence_get(&submit->base.s_fence->finished);
742
743 if (args->flags & MSM_SUBMIT_FENCE_SN_IN) {
744 /*
745 * Userspace has assigned the seqno fence that it wants
746 * us to use. It is an error to pick a fence sequence
747 * number that is not available.
748 */
749 submit->fence_id = args->fence;
750 ret = idr_alloc_u32(&queue->fence_idr, submit->user_fence,
751 &submit->fence_id, submit->fence_id,
752 GFP_NOWAIT);
753 /*
754 * We've already validated that the fence_id slot is valid,
755 * so if idr_alloc_u32 failed, it is a kernel bug
756 */
757 WARN_ON(ret);
758 } else {
759 /*
760 * Allocate an id which can be used by WAIT_FENCE ioctl to map
761 * back to the underlying fence.
762 */
763 submit->fence_id = idr_alloc_cyclic(&queue->fence_idr,
764 submit->user_fence, 1,
765 INT_MAX, GFP_NOWAIT);
766 }
767
768 spin_unlock(&queue->idr_lock);
769 idr_preload_end();
770
771 if (submit->fence_id < 0) {
772 ret = submit->fence_id;
773 submit->fence_id = 0;
774 }
775
776 if (ret == 0 && args->flags & MSM_SUBMIT_FENCE_FD_OUT) {
777 sync_file = sync_file_create(submit->user_fence);
778 if (!sync_file)
779 ret = -ENOMEM;
780 }
781
782 if (ret)
783 goto out;
784
785 submit_attach_object_fences(submit);
786
787 if (msm_context_is_vmbind(ctx)) {
788 /*
789 * If we are not using VM_BIND, submit_pin_vmas() will validate
790 * just the BOs attached to the submit. In that case we don't
791 * need to validate the _entire_ vm, because userspace tracked
792 * what BOs are associated with the submit.
793 */
794 ret = drm_gpuvm_validate(submit->vm, &submit->exec);
795 if (ret)
796 goto out;
797 }
798
799 /* The scheduler owns a ref now: */
800 msm_gem_submit_get(submit);
801
802 msm_rd_dump_submit(priv->rd, submit, NULL);
803
804 drm_sched_entity_push_job(&submit->base);
805
806 args->fence = submit->fence_id;
807 queue->last_fence = submit->fence_id;
808
809 msm_syncobj_reset(syncobjs_to_reset, args->nr_in_syncobjs);
810 msm_syncobj_process_post_deps(post_deps, args->nr_out_syncobjs, submit->user_fence);
811
812out:
813 submit_cleanup(submit, !!ret);
814out_unlock:
815 mutex_unlock(&queue->lock);
816out_post_unlock:
817 if (ret) {
818 if (out_fence_fd >= 0)
819 put_unused_fd(out_fence_fd);
820 if (sync_file)
821 fput(sync_file->file);
822 } else if (sync_file) {
823 fd_install(out_fence_fd, sync_file->file);
824 args->fence_fd = out_fence_fd;
825 }
826
827 if (!IS_ERR_OR_NULL(submit)) {
828 msm_gem_submit_put(submit);
829 } else {
830 /*
831 * If the submit hasn't yet taken ownership of the queue
832 * then we need to drop the reference ourself:
833 */
834 msm_submitqueue_put(queue);
835 }
836 if (!IS_ERR_OR_NULL(post_deps)) {
837 for (i = 0; i < args->nr_out_syncobjs; ++i) {
838 kfree(post_deps[i].chain);
839 drm_syncobj_put(post_deps[i].syncobj);
840 }
841 kfree(post_deps);
842 }
843
844 if (!IS_ERR_OR_NULL(syncobjs_to_reset)) {
845 for (i = 0; i < args->nr_in_syncobjs; ++i) {
846 if (syncobjs_to_reset[i])
847 drm_syncobj_put(syncobjs_to_reset[i]);
848 }
849 kfree(syncobjs_to_reset);
850 }
851
852 return ret;
853}