diff mbox series

[2/2] drm/etnaviv: reap idle mapping if it doesn't match the softpin address

Message ID 20220714103143.1704573-2-l.stach@pengutronix.de (mailing list archive)
State New, archived
Headers show
Series [1/2] drm/etnaviv: move idle mapping reaping into separate function | expand

Commit Message

Lucas Stach July 14, 2022, 10:31 a.m. UTC
When a idle BO, which is held open by another process, gets freed by
userspace and subsequently referenced again by e.g. importing it again,
userspace may assign a different softpin VA than the last time around.
As the kernel GEM object still exists, we likely have a idle mapping
with the old VA still cached, if it hasn't been reaped in the meantime.

As the context matches, we then simply try to resurrect this mapping by
increasing the refcount. As the VA in this mapping does not match the
new softpin address, we consequently fail the otherwise valid submit.
Instead of failing, reap the idle mapping.

Cc: stable@vger.kernel.org # 5.19
Signed-off-by: Lucas Stach <l.stach@pengutronix.de>
---
 drivers/gpu/drm/etnaviv/etnaviv_gem.c | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

Comments

Guido Günther Aug. 24, 2022, 7:28 a.m. UTC | #1
Hi,
On Thu, Jul 14, 2022 at 12:31:43PM +0200, Lucas Stach wrote:
> When a idle BO, which is held open by another process, gets freed by
> userspace and subsequently referenced again by e.g. importing it again,
> userspace may assign a different softpin VA than the last time around.
> As the kernel GEM object still exists, we likely have a idle mapping
> with the old VA still cached, if it hasn't been reaped in the meantime.
> 
> As the context matches, we then simply try to resurrect this mapping by
> increasing the refcount. As the VA in this mapping does not match the
> new softpin address, we consequently fail the otherwise valid submit.
> Instead of failing, reap the idle mapping.
> 
> Cc: stable@vger.kernel.org # 5.19
> Signed-off-by: Lucas Stach <l.stach@pengutronix.de>
> ---
>  drivers/gpu/drm/etnaviv/etnaviv_gem.c | 7 ++++++-
>  1 file changed, 6 insertions(+), 1 deletion(-)
> 
> diff --git a/drivers/gpu/drm/etnaviv/etnaviv_gem.c b/drivers/gpu/drm/etnaviv/etnaviv_gem.c
> index cc386f8a7116..5cf13e52f7c9 100644
> --- a/drivers/gpu/drm/etnaviv/etnaviv_gem.c
> +++ b/drivers/gpu/drm/etnaviv/etnaviv_gem.c
> @@ -258,7 +258,12 @@ struct etnaviv_vram_mapping *etnaviv_gem_mapping_get(
>  		if (mapping->use == 0) {
>  			mutex_lock(&mmu_context->lock);
>  			if (mapping->context == mmu_context)
> -				mapping->use += 1;
> +				if (va && mapping->iova != va) {
> +					etnaviv_iommu_reap_mapping(mapping);
> +					mapping = NULL;
> +				} else {
> +					mapping->use += 1;
> +				}
>  			else
>  				mapping = NULL;
>  			mutex_unlock(&mmu_context->lock);

Reviewed-by: Guido Günther <agx@sigxcpu.org>

Cheers,
 -- Guido

> -- 
> 2.30.2
>
diff mbox series

Patch

diff --git a/drivers/gpu/drm/etnaviv/etnaviv_gem.c b/drivers/gpu/drm/etnaviv/etnaviv_gem.c
index cc386f8a7116..5cf13e52f7c9 100644
--- a/drivers/gpu/drm/etnaviv/etnaviv_gem.c
+++ b/drivers/gpu/drm/etnaviv/etnaviv_gem.c
@@ -258,7 +258,12 @@  struct etnaviv_vram_mapping *etnaviv_gem_mapping_get(
 		if (mapping->use == 0) {
 			mutex_lock(&mmu_context->lock);
 			if (mapping->context == mmu_context)
-				mapping->use += 1;
+				if (va && mapping->iova != va) {
+					etnaviv_iommu_reap_mapping(mapping);
+					mapping = NULL;
+				} else {
+					mapping->use += 1;
+				}
 			else
 				mapping = NULL;
 			mutex_unlock(&mmu_context->lock);