Linaro-mm-sig

linaro-mm-sig@lists.linaro.org

51 participants
6030 discussions

Re: [PATCH 11/19] drm/amdgpu: independence for the amdgpu_fence! v2

by Christian König

On 12/11/25 16:53, Tvrtko Ursulin wrote: > > On 11/12/2025 13:16, Christian König wrote: >> This allows amdgpu_fences to outlive the amdgpu module. >> >> v2: use dma_fence_get_rcu_safe to be NULL safe here. >> >> Signed-off-by: Christian König <christian.koenig(a)amd.com> >> --- >> drivers/gpu/drm/amd/amdgpu/amdgpu_fence.c | 63 +++++++---------------- >> drivers/gpu/drm/amd/amdgpu/amdgpu_ring.h | 1 - >> 2 files changed, 20 insertions(+), 44 deletions(-) >> >> diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_fence.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_fence.c >> index c7843e336310..c636347801c1 100644 >> --- a/drivers/gpu/drm/amd/amdgpu/amdgpu_fence.c >> +++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_fence.c >> @@ -112,8 +112,7 @@ int amdgpu_fence_emit(struct amdgpu_ring *ring, struct amdgpu_fence *af, >> af->ring = ring; >> seq = ++ring->fence_drv.sync_seq; >> - dma_fence_init(fence, &amdgpu_fence_ops, >> - &ring->fence_drv.lock, >> + dma_fence_init(fence, &amdgpu_fence_ops, NULL, >> adev->fence_context + ring->idx, seq); >> amdgpu_ring_emit_fence(ring, ring->fence_drv.gpu_addr, >> @@ -467,7 +466,6 @@ int amdgpu_fence_driver_init_ring(struct amdgpu_ring *ring) >> timer_setup(&ring->fence_drv.fallback_timer, amdgpu_fence_fallback, 0); >> ring->fence_drv.num_fences_mask = ring->num_hw_submission * 2 - 1; >> - spin_lock_init(&ring->fence_drv.lock); >> ring->fence_drv.fences = kcalloc(ring->num_hw_submission * 2, sizeof(void *), >> GFP_KERNEL); >> @@ -654,16 +652,20 @@ void amdgpu_fence_driver_set_error(struct amdgpu_ring *ring, int error) >> struct amdgpu_fence_driver *drv = &ring->fence_drv; >> unsigned long flags; >> - spin_lock_irqsave(&drv->lock, flags); >> + rcu_read_lock(); >> for (unsigned int i = 0; i <= drv->num_fences_mask; ++i) { >> struct dma_fence *fence; >> - fence = rcu_dereference_protected(drv->fences[i], >> - lockdep_is_held(&drv->lock)); >> - if (fence && !dma_fence_is_signaled_locked(fence)) >> + fence = dma_fence_get_rcu(drv->fences[i]); > > dma_fence_get_rcu is not safe against passing a NULL fence in, while the existing code makes it look like drv->fence[] slot can contain NULL at this point? > > amdgpu_fence_process() is the place which can NULL the slots? Irq context? Why is that safe with no reference held from clearing the slot to operating on the fence? The slots are never cleared. It can only be that they are NULL when the driver is loaded. I've switched over to dma_fence_get_rcu_safe() where appropriated. Regards, Christian. > >> + if (!fence) >> + continue; >> + >> + dma_fence_lock_irqsave(fence, flags); >> + if (!dma_fence_is_signaled_locked(fence)) >> dma_fence_set_error(fence, error); >> + dma_fence_unlock_irqrestore(fence, flags); >> } >> - spin_unlock_irqrestore(&drv->lock, flags); >> + rcu_read_unlock(); >> } >> /** >> @@ -714,16 +716,19 @@ void amdgpu_fence_driver_guilty_force_completion(struct amdgpu_fence *af) >> seq = ring->fence_drv.sync_seq & ring->fence_drv.num_fences_mask; >> /* mark all fences from the guilty context with an error */ >> - spin_lock_irqsave(&ring->fence_drv.lock, flags); >> + rcu_read_lock(); >> do { >> last_seq++; >> last_seq &= ring->fence_drv.num_fences_mask; >> ptr = &ring->fence_drv.fences[last_seq]; >> - rcu_read_lock(); >> - unprocessed = rcu_dereference(*ptr); >> + unprocessed = dma_fence_get_rcu_safe(ptr); > > Similar concern like the above. > > Regards, > > Tvrtko >> + >> + if (!unprocessed) >> + continue; >> - if (unprocessed && !dma_fence_is_signaled_locked(unprocessed)) { >> + dma_fence_lock_irqsave(unprocessed, flags); >> + if (dma_fence_is_signaled_locked(unprocessed)) { >> fence = container_of(unprocessed, struct amdgpu_fence, base); >> if (fence == af) >> @@ -731,9 +736,10 @@ void amdgpu_fence_driver_guilty_force_completion(struct amdgpu_fence *af) >> else if (fence->context == af->context) >> dma_fence_set_error(&fence->base, -ECANCELED); >> } >> - rcu_read_unlock(); >> + dma_fence_unlock_irqrestore(unprocessed, flags); >> + dma_fence_put(unprocessed); >> } while (last_seq != seq); >> - spin_unlock_irqrestore(&ring->fence_drv.lock, flags); >> + rcu_read_unlock(); >> /* signal the guilty fence */ >> amdgpu_fence_write(ring, (u32)af->base.seqno); >> amdgpu_fence_process(ring); >> @@ -823,39 +829,10 @@ static bool amdgpu_fence_enable_signaling(struct dma_fence *f) >> return true; >> } >> -/** >> - * amdgpu_fence_free - free up the fence memory >> - * >> - * @rcu: RCU callback head >> - * >> - * Free up the fence memory after the RCU grace period. >> - */ >> -static void amdgpu_fence_free(struct rcu_head *rcu) >> -{ >> - struct dma_fence *f = container_of(rcu, struct dma_fence, rcu); >> - >> - /* free fence_slab if it's separated fence*/ >> - kfree(to_amdgpu_fence(f)); >> -} >> - >> -/** >> - * amdgpu_fence_release - callback that fence can be freed >> - * >> - * @f: fence >> - * >> - * This function is called when the reference count becomes zero. >> - * It just RCU schedules freeing up the fence. >> - */ >> -static void amdgpu_fence_release(struct dma_fence *f) >> -{ >> - call_rcu(&f->rcu, amdgpu_fence_free); >> -} >> - >> static const struct dma_fence_ops amdgpu_fence_ops = { >> .get_driver_name = amdgpu_fence_get_driver_name, >> .get_timeline_name = amdgpu_fence_get_timeline_name, >> .enable_signaling = amdgpu_fence_enable_signaling, >> - .release = amdgpu_fence_release, >> }; >> /* >> diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_ring.h b/drivers/gpu/drm/amd/amdgpu/amdgpu_ring.h >> index 7a27c6c4bb44..9cbf63454004 100644 >> --- a/drivers/gpu/drm/amd/amdgpu/amdgpu_ring.h >> +++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_ring.h >> @@ -125,7 +125,6 @@ struct amdgpu_fence_driver { >> unsigned irq_type; >> struct timer_list fallback_timer; >> unsigned num_fences_mask; >> - spinlock_t lock; >> struct dma_fence **fences; >> }; >> >

3 months

Re: [PATCH 15/19] drm/amdgpu: independence for the amdgpu_userq_fence!

by Christian König

On 12/11/25 17:12, Tvrtko Ursulin wrote: > > On 11/12/2025 13:16, Christian König wrote: >> This allows amdgpu_userq_fences to outlive the amdgpu module. >> >> Signed-off-by: Christian König <christian.koenig(a)amd.com> >> --- >> drivers/gpu/drm/amd/amdgpu/amdgpu_drv.c | 13 +---- >> .../gpu/drm/amd/amdgpu/amdgpu_userq_fence.c | 54 ++++--------------- >> .../gpu/drm/amd/amdgpu/amdgpu_userq_fence.h | 8 --- >> 3 files changed, 11 insertions(+), 64 deletions(-) >> >> diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_drv.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_drv.c >> index 2dfbddcef9ab..f206297aae8b 100644 >> --- a/drivers/gpu/drm/amd/amdgpu/amdgpu_drv.c >> +++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_drv.c >> @@ -3155,11 +3155,7 @@ static int __init amdgpu_init(void) >> r = amdgpu_sync_init(); >> if (r) >> - goto error_sync; >> - >> - r = amdgpu_userq_fence_slab_init(); >> - if (r) >> - goto error_fence; >> + return r; >> DRM_INFO("amdgpu kernel modesetting enabled.\n"); >> amdgpu_register_atpx_handler(); >> @@ -3176,12 +3172,6 @@ static int __init amdgpu_init(void) >> /* let modprobe override vga console setting */ >> return pci_register_driver(&amdgpu_kms_pci_driver); >> - >> -error_fence: >> - amdgpu_sync_fini(); >> - >> -error_sync: >> - return r; >> } >> static void __exit amdgpu_exit(void) >> @@ -3191,7 +3181,6 @@ static void __exit amdgpu_exit(void) >> amdgpu_unregister_atpx_handler(); >> amdgpu_acpi_release(); >> amdgpu_sync_fini(); >> - amdgpu_userq_fence_slab_fini(); >> mmu_notifier_synchronize(); >> amdgpu_xcp_drv_release(); >> } >> diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_userq_fence.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_userq_fence.c >> index eba9fb359047..bb19f72770b0 100644 >> --- a/drivers/gpu/drm/amd/amdgpu/amdgpu_userq_fence.c >> +++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_userq_fence.c >> @@ -33,26 +33,6 @@ >> #include "amdgpu_userq_fence.h" >> static const struct dma_fence_ops amdgpu_userq_fence_ops; >> -static struct kmem_cache *amdgpu_userq_fence_slab; >> - >> -int amdgpu_userq_fence_slab_init(void) >> -{ >> - amdgpu_userq_fence_slab = kmem_cache_create("amdgpu_userq_fence", >> - sizeof(struct amdgpu_userq_fence), >> - 0, >> - SLAB_HWCACHE_ALIGN, >> - NULL); >> - if (!amdgpu_userq_fence_slab) >> - return -ENOMEM; >> - >> - return 0; >> -} >> - >> -void amdgpu_userq_fence_slab_fini(void) >> -{ >> - rcu_barrier(); > > What was this rcu_barrier() for? Cargo culted or more to it? All dma_fences are RCU protected. When they are backed by a kmem_cache you need to make sure to wait for an RCU grace period to pass before destroying the kmem_cache. Since the dma_fence framework now uses kfree_rcu that shouldn't be problematic any more. >> - kmem_cache_destroy(amdgpu_userq_fence_slab); >> -} >> static inline struct amdgpu_userq_fence *to_amdgpu_userq_fence(struct dma_fence *f) >> { >> @@ -227,7 +207,7 @@ void amdgpu_userq_fence_driver_put(struct amdgpu_userq_fence_driver *fence_drv) >> static int amdgpu_userq_fence_alloc(struct amdgpu_userq_fence **userq_fence) >> { >> - *userq_fence = kmem_cache_alloc(amdgpu_userq_fence_slab, GFP_ATOMIC); >> + *userq_fence = kmalloc(sizeof(**userq_fence), GFP_ATOMIC); > This GFP_ATOMIC is suboptimal for sure being on the ioctl path. It is outside of the scope for this patch, but once my userq cleanup patches get reviewed next on my list was to try and understand this. >> return *userq_fence ? 0 : -ENOMEM; >> } >> @@ -243,12 +223,11 @@ static int amdgpu_userq_fence_create(struct amdgpu_usermode_queue *userq, >> if (!fence_drv) >> return -EINVAL; >> - spin_lock_init(&userq_fence->lock); >> INIT_LIST_HEAD(&userq_fence->link); >> fence = &userq_fence->base; >> userq_fence->fence_drv = fence_drv; >> - dma_fence_init64(fence, &amdgpu_userq_fence_ops, &userq_fence->lock, >> + dma_fence_init64(fence, &amdgpu_userq_fence_ops, NULL, >> fence_drv->context, seq); >> amdgpu_userq_fence_driver_get(fence_drv); >> @@ -318,35 +297,22 @@ static bool amdgpu_userq_fence_signaled(struct dma_fence *f) >> rptr = amdgpu_userq_fence_read(fence_drv); >> wptr = fence->base.seqno; >> - if (rptr >= wptr) >> + if (rptr >= wptr) { >> + amdgpu_userq_fence_driver_put(fence->fence_drv); > > fence_drv is in a local already. > >> + fence->fence_drv = NULL; > > amdgpu_userq_fence_get_timeline_name could now oops somehow? > >> + >> + kvfree(fence->fence_drv_array); >> + fence->fence_drv_array = NULL; > > Not sure if this is safe either. amdgpu_userq_fence_driver_process() drops its reference before it unlinks the fence from the list. Can someone external trigger the fence_is_signaled check, before the interrupt processing kicks in, which will clear fence_drv_array, and so amdgpu_userq_fence_driver_process() would oops? Oh, good question. I need to double check that. Thanks, Christian. > > Regards, > > Tvrtko > >> return true; >> + } >> return false; >> } >> -static void amdgpu_userq_fence_free(struct rcu_head *rcu) >> -{ >> - struct dma_fence *fence = container_of(rcu, struct dma_fence, rcu); >> - struct amdgpu_userq_fence *userq_fence = to_amdgpu_userq_fence(fence); >> - struct amdgpu_userq_fence_driver *fence_drv = userq_fence->fence_drv; >> - >> - /* Release the fence driver reference */ >> - amdgpu_userq_fence_driver_put(fence_drv); >> - >> - kvfree(userq_fence->fence_drv_array); >> - kmem_cache_free(amdgpu_userq_fence_slab, userq_fence); >> -} >> - >> -static void amdgpu_userq_fence_release(struct dma_fence *f) >> -{ >> - call_rcu(&f->rcu, amdgpu_userq_fence_free); >> -} >> - >> static const struct dma_fence_ops amdgpu_userq_fence_ops = { >> .get_driver_name = amdgpu_userq_fence_get_driver_name, >> .get_timeline_name = amdgpu_userq_fence_get_timeline_name, >> .signaled = amdgpu_userq_fence_signaled, >> - .release = amdgpu_userq_fence_release, >> }; >> /** >> @@ -560,7 +526,7 @@ int amdgpu_userq_signal_ioctl(struct drm_device *dev, void *data, >> r = amdgpu_userq_fence_create(queue, userq_fence, wptr, &fence); >> if (r) { >> mutex_unlock(&userq_mgr->userq_mutex); >> - kmem_cache_free(amdgpu_userq_fence_slab, userq_fence); >> + kfree(userq_fence); >> goto put_gobj_write; >> } >> diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_userq_fence.h b/drivers/gpu/drm/amd/amdgpu/amdgpu_userq_fence.h >> index d76add2afc77..6f04782f3ea9 100644 >> --- a/drivers/gpu/drm/amd/amdgpu/amdgpu_userq_fence.h >> +++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_userq_fence.h >> @@ -31,11 +31,6 @@ >> struct amdgpu_userq_fence { >> struct dma_fence base; >> - /* >> - * This lock is necessary to synchronize the >> - * userqueue dma fence operations. >> - */ >> - spinlock_t lock; >> struct list_head link; >> unsigned long fence_drv_array_count; >> struct amdgpu_userq_fence_driver *fence_drv; >> @@ -58,9 +53,6 @@ struct amdgpu_userq_fence_driver { >> char timeline_name[TASK_COMM_LEN]; >> }; >> -int amdgpu_userq_fence_slab_init(void); >> -void amdgpu_userq_fence_slab_fini(void); >> - >> void amdgpu_userq_fence_driver_get(struct amdgpu_userq_fence_driver *fence_drv); >> void amdgpu_userq_fence_driver_put(struct amdgpu_userq_fence_driver *fence_drv); >> int amdgpu_userq_fence_driver_alloc(struct amdgpu_device *adev, >

3 months

Re: [PATCH v2] drm: Fix object leak in DRM_IOCTL_GEM_CHANGE_HANDLE

by Christian König

On 12/12/25 14:20, Karol Wachowski wrote: > Add missing drm_gem_object_put() call when drm_gem_object_lookup() > successfully returns an object. This fixes a GEM object reference > leak that can prevent driver modules from unloading when using > prime buffers. > > Fixes: 53096728b891 ("drm: Add DRM prime interface to reassign GEM handle") > Signed-off-by: Karol Wachowski <karol.wachowski(a)linux.intel.com> > --- > Changes between v1 and v2: > - move setting ret value under if branch as suggested in review > - add Cc: stable 6.18+ Oh don't CC the stable list on the review mail directly, just add "CC: stable(a)vger.kernel.org # 6.18+" to the tags. Greg is going to complain about that :( With that done Reviewed-by: Christian König <christian.koenig(a)amd.com> and please push to drm-misc-fixes. If you don't have commit rights for drm-misc-fixes please ping me and I'm going to push that. Thanks, Christian. > --- > drivers/gpu/drm/drm_gem.c | 8 ++++++-- > 1 file changed, 6 insertions(+), 2 deletions(-) > > diff --git a/drivers/gpu/drm/drm_gem.c b/drivers/gpu/drm/drm_gem.c > index ca1956608261..bcc08a6aebf8 100644 > --- a/drivers/gpu/drm/drm_gem.c > +++ b/drivers/gpu/drm/drm_gem.c > @@ -1010,8 +1010,10 @@ int drm_gem_change_handle_ioctl(struct drm_device *dev, void *data, > if (!obj) > return -ENOENT; > > - if (args->handle == args->new_handle) > - return 0; > + if (args->handle == args->new_handle) { > + ret = 0; > + goto out; > + } > > mutex_lock(&file_priv->prime.lock); > > @@ -1043,6 +1045,8 @@ int drm_gem_change_handle_ioctl(struct drm_device *dev, void *data, > > out_unlock: > mutex_unlock(&file_priv->prime.lock); > +out: > + drm_gem_object_put(obj); > > return ret; > }

3 months

Re: [PATCH] drm: Fix object leak in DRM_IOCTL_GEM_CHANGE_HANDLE

by Christian König

On 12/12/25 14:02, Karol Wachowski wrote: > Add missing drm_gem_object_put() call when drm_gem_object_lookup() > successfully returns an object. This fixes a GEM object reference > leak that can prevent driver modules from unloading when using > prime buffers. Good catch. > Fixes: 53096728b891 ("drm: Add DRM prime interface to reassign GEM handle") > Signed-off-by: Karol Wachowski <karol.wachowski(a)linux.intel.com> CC: stable 6.18? > --- > drivers/gpu/drm/drm_gem.c | 6 ++++-- > 1 file changed, 4 insertions(+), 2 deletions(-) > > diff --git a/drivers/gpu/drm/drm_gem.c b/drivers/gpu/drm/drm_gem.c > index ca1956608261..e150bc1ce65a 100644 > --- a/drivers/gpu/drm/drm_gem.c > +++ b/drivers/gpu/drm/drm_gem.c > @@ -1001,7 +1001,7 @@ int drm_gem_change_handle_ioctl(struct drm_device *dev, void *data, > { > struct drm_gem_change_handle *args = data; > struct drm_gem_object *obj; > - int ret; > + int ret = 0; Please set ret explicitly in the if branch below. Always initializing return values is usually considered bad coding style. Apart from that looks good to me. Thanks, Christian. > > if (!drm_core_check_feature(dev, DRIVER_GEM)) > return -EOPNOTSUPP; > @@ -1011,7 +1011,7 @@ int drm_gem_change_handle_ioctl(struct drm_device *dev, void *data, > return -ENOENT; > > if (args->handle == args->new_handle) > - return 0; > + goto out; > > mutex_lock(&file_priv->prime.lock); > > @@ -1043,6 +1043,8 @@ int drm_gem_change_handle_ioctl(struct drm_device *dev, void *data, > > out_unlock: > mutex_unlock(&file_priv->prime.lock); > +out: > + drm_gem_object_put(obj); > > return ret; > }

3 months

Re: [PATCH 03/19] dma-buf: inline spinlock for fence protection v3

by Christian König

On 12/11/25 15:35, Tvrtko Ursulin wrote: > > Hi, > > On 11/12/2025 13:16, Christian König wrote: >> Implement per-fence spinlocks, allowing implementations to not give an >> external spinlock to protect the fence internal statei. Instead a spinlock >> embedded into the fence structure itself is used in this case. >> >> Shared spinlocks have the problem that implementations need to guarantee >> that the lock live at least as long all fences referencing them. >> >> Using a per-fence spinlock allows completely decoupling spinlock producer >> and consumer life times, simplifying the handling in most use cases. >> >> v2: improve naming, coverage and function documentation >> v3: fix one additional locking in the selftests >> >> Signed-off-by: Christian König <christian.koenig(a)amd.com> >> Reviewed-by: Tvrtko Ursulin <tvrtko.ursulin(a)igalia.com> > > I don't think I gave r-b on this one. Not just yet at least. Maybe you have missed the comments I had in the previous two rounds? I will repeat them below. I was already wondering why you gave comments and an rb but though that the comments might just be optional. Going to remove that and see on the comments below. >> @@ -365,7 +364,7 @@ void dma_fence_signal_timestamp_locked(struct dma_fence *fence, >> struct dma_fence_cb *cur, *tmp; >> struct list_head cb_list; >> - lockdep_assert_held(fence->lock); >> + lockdep_assert_held(dma_fence_spinlock(fence)); >> if (unlikely(test_and_set_bit(DMA_FENCE_FLAG_SIGNALED_BIT, >> &fence->flags))) >> @@ -412,9 +411,9 @@ void dma_fence_signal_timestamp(struct dma_fence *fence, ktime_t timestamp) >> if (WARN_ON(!fence)) >> return; >> - spin_lock_irqsave(fence->lock, flags); >> + dma_fence_lock_irqsave(fence, flags); > > For the locking wrappers I think it would be better to introduce them in a purely mechanical patch preceding this one. That is, just add the wrappers and nothing else. That doesn't fully work for all cases, but I will separate it out a bit more. >> static inline uint64_t amdgpu_vm_tlb_seq(struct amdgpu_vm *vm) >> { >> + struct dma_fence *fence; >> unsigned long flags; >> - spinlock_t *lock; >> /* >> * Workaround to stop racing between the fence signaling and handling >> - * the cb. The lock is static after initially setting it up, just make >> - * sure that the dma_fence structure isn't freed up. >> + * the cb. >> */ >> rcu_read_lock(); >> - lock = vm->last_tlb_flush->lock; >> + fence = dma_fence_get_rcu(vm->last_tlb_flush); > > Why does this belong here? If taking a reference fixes some race it needs to be a separate patch. If it doesn't then this patch shouldn't be adding it. The code previously assumed that the lock is global and can't go away while the function is called. When we start to use an inline lock that assumption is not true any more. But you're right that can be a separate patch. >> @@ -362,6 +368,38 @@ dma_fence_get_rcu_safe(struct dma_fence __rcu **fencep) >> } while (1); >> } >> +/** >> + * dma_fence_spinlock - return pointer to the spinlock protecting the fence >> + * @fence: the fence to get the lock from >> + * >> + * Return either the pointer to the embedded or the external spin lock. >> + */ >> +static inline spinlock_t *dma_fence_spinlock(struct dma_fence *fence) >> +{ >> + return test_bit(DMA_FENCE_FLAG_INLINE_LOCK_BIT, &fence->flags) ? >> + &fence->inline_lock : fence->extern_lock; > > Is sprinkling of conditionals better than growing the struct? Probably yes, since branch misses are cheaper than cache misses. Unless the code grows significantly on some hot path and we get instruction cache misses instead. Who knows. But let say in the commit message we considered it and decided on this solution due xyz. Sure. > > On a quick grep there is one arch where this grows the struct past a cache line anyway, but as it is PA-RISC I guess no one cares. Lets mention that in the commit message as well. Interesting, I was aware of the problems on Sparc regarding spinlocks but that PA-RISC also has something more complicated then an int is news to me. Anyway I agree it doesn't really matter. Regards, Christian. > > Regards, > > Tvrtko >> +} >> + >> +/** >> + * dma_fence_lock_irqsave - irqsave lock the fence >> + * @fence: the fence to lock >> + * @flags: where to store the CPU flags. >> + * >> + * Lock the fence, preventing it from changing to the signaled state. >> + */ >> +#define dma_fence_lock_irqsave(fence, flags) \ >> + spin_lock_irqsave(dma_fence_spinlock(fence), flags) >> + >> +/** >> + * dma_fence_unlock_irqrestore - unlock the fence and irqrestore >> + * @fence: the fence to unlock >> + * @flags the CPU flags to restore >> + * >> + * Unlock the fence, allowing it to change it's state to signaled again. >> + */ >> +#define dma_fence_unlock_irqrestore(fence, flags) \ >> + spin_unlock_irqrestore(dma_fence_spinlock(fence), flags) >> + >> #ifdef CONFIG_LOCKDEP >> bool dma_fence_begin_signalling(void); >> void dma_fence_end_signalling(bool cookie); >

3 months

Re: Independence for dma_fences! v4

by Christian König

On 12/11/25 13:33, Philipp Stanner wrote: > On Thu, 2025-12-11 at 13:16 +0100, Christian König wrote: >> Hi everyone, >> >> dma_fences have ever lived under the tyranny dictated by the module >> lifetime of their issuer, leading to crashes should anybody still holding >> a reference to a dma_fence when the module of the issuer was unloaded. >> >> The basic problem is that when buffer are shared between drivers >> dma_fence objects can leak into external drivers and stay there even >> after they are signaled. The dma_resv object for example only lazy releases >> dma_fences. >> >> So what happens is that when the module who originally created the dma_fence >> unloads the dma_fence_ops function table becomes unavailable as well and so >> any attempt to release the fence crashes the system. >> >> Previously various approaches have been discussed, including changing the >> locking semantics of the dma_fence callbacks (by me) as well as using the >> drm scheduler as intermediate layer (by Sima) to disconnect dma_fences >> from their actual users, but none of them are actually solving all problems. >> >> Tvrtko did some really nice prerequisite work by protecting the returned >> strings of the dma_fence_ops by RCU. This way dma_fence creators where >> able to just wait for an RCU grace period after fence signaling before >> they could be save to free those data structures. >> >> Now this patch set here goes a step further and protects the whole >> dma_fence_ops structure by RCU, so that after the fence signals the >> pointer to the dma_fence_ops is set to NULL when there is no wait nor >> release callback given. All functionality which use the dma_fence_ops >> reference are put inside an RCU critical section, except for the >> deprecated issuer specific wait and of course the optional release >> callback. >> >> Additional to the RCU changes the lock protecting the dma_fence state >> previously had to be allocated external. This set here now changes the >> functionality to make that external lock optional and allows dma_fences >> to use an inline lock and be self contained. >> >> v4: >> >> Rebases the whole set on upstream changes, especially the cleanup >> from Philip in patch "drm/amdgpu: independence for the amdkfd_fence!". >> >> Adding two patches which brings the DMA-fence self tests up to date. >> The first selftest changes removes the mock_wait and so actually starts >> testing the default behavior instead of some hacky implementation in the >> test. This one should probably go upstream independent of this set. >> The second drops the mock_fence as well and tests the new RCU and inline >> spinlock functionality. >> >> Especially the first patch still needs a Reviewed-by, apart from that I >> think I've addressed all review comments. >> >> The plan is to push the core DMA-buf changes to drm-misc-next and then the >> driver specific changes through the driver channels as approprite. > > This does not apply to drm-misc-next (unless I'm screwing up badly). > > Where can I apply it? I'd like to test the drm_sched changes before > this gets merged. drm-tip from a few days ago, otherwise the xe changes won't work. Regards, Christian. > > P. > >> >> Please review and comment, >> Christian. >> >> >

3 months

Re: [PATCH] dma-buf: system_heap: account for system heap allocation in memcg

by T.J. Mercier

On Fri, Dec 12, 2025 at 4:31 AM Eric Chanudet <echanude(a)redhat.com> wrote: > > The system dma-buf heap lets userspace allocate buffers from the page > allocator. However, these allocations are not accounted for in memcg, > allowing processes to escape limits that may be configured. > > Pass the __GFP_ACCOUNT for our allocations to account them into memcg. We had a discussion just last night in the MM track at LPC about how shared memory accounted in memcg is pretty broken. Without a way to identify (and possibly transfer) ownership of a shared buffer, this makes the accounting of shared memory, and zombie memcg problems worse. :\ > > Userspace components using the system heap can be constrained with, e.g: > systemd-run --user --scope -p MemoryMax=10M ... > > Signed-off-by: Eric Chanudet <echanude(a)redhat.com> > --- > drivers/dma-buf/heaps/system_heap.c | 4 ++-- > 1 file changed, 2 insertions(+), 2 deletions(-) > > diff --git a/drivers/dma-buf/heaps/system_heap.c b/drivers/dma-buf/heaps/system_heap.c > index 4c782fe33fd4..c91fcdff4b77 100644 > --- a/drivers/dma-buf/heaps/system_heap.c > +++ b/drivers/dma-buf/heaps/system_heap.c > @@ -38,10 +38,10 @@ struct dma_heap_attachment { > bool mapped; > }; > > -#define LOW_ORDER_GFP (GFP_HIGHUSER | __GFP_ZERO) > +#define LOW_ORDER_GFP (GFP_HIGHUSER | __GFP_ZERO | __GFP_ACCOUNT) > #define HIGH_ORDER_GFP (((GFP_HIGHUSER | __GFP_ZERO | __GFP_NOWARN \ > | __GFP_NORETRY) & ~__GFP_RECLAIM) \ > - | __GFP_COMP) > + | __GFP_COMP | __GFP_ACCOUNT) > static gfp_t order_flags[] = {HIGH_ORDER_GFP, HIGH_ORDER_GFP, LOW_ORDER_GFP}; > /* > * The selection of the orders used for allocation (1MB, 64K, 4K) is designed > -- > 2.52.0 >

3 months

Independence for dma_fences! v4

by Christian König

Hi everyone, dma_fences have ever lived under the tyranny dictated by the module lifetime of their issuer, leading to crashes should anybody still holding a reference to a dma_fence when the module of the issuer was unloaded. The basic problem is that when buffer are shared between drivers dma_fence objects can leak into external drivers and stay there even after they are signaled. The dma_resv object for example only lazy releases dma_fences. So what happens is that when the module who originally created the dma_fence unloads the dma_fence_ops function table becomes unavailable as well and so any attempt to release the fence crashes the system. Previously various approaches have been discussed, including changing the locking semantics of the dma_fence callbacks (by me) as well as using the drm scheduler as intermediate layer (by Sima) to disconnect dma_fences from their actual users, but none of them are actually solving all problems. Tvrtko did some really nice prerequisite work by protecting the returned strings of the dma_fence_ops by RCU. This way dma_fence creators where able to just wait for an RCU grace period after fence signaling before they could be save to free those data structures. Now this patch set here goes a step further and protects the whole dma_fence_ops structure by RCU, so that after the fence signals the pointer to the dma_fence_ops is set to NULL when there is no wait nor release callback given. All functionality which use the dma_fence_ops reference are put inside an RCU critical section, except for the deprecated issuer specific wait and of course the optional release callback. Additional to the RCU changes the lock protecting the dma_fence state previously had to be allocated external. This set here now changes the functionality to make that external lock optional and allows dma_fences to use an inline lock and be self contained. v4: Rebases the whole set on upstream changes, especially the cleanup from Philip in patch "drm/amdgpu: independence for the amdkfd_fence!". Adding two patches which brings the DMA-fence self tests up to date. The first selftest changes removes the mock_wait and so actually starts testing the default behavior instead of some hacky implementation in the test. This one should probably go upstream independent of this set. The second drops the mock_fence as well and tests the new RCU and inline spinlock functionality. Especially the first patch still needs a Reviewed-by, apart from that I think I've addressed all review comments. The plan is to push the core DMA-buf changes to drm-misc-next and then the driver specific changes through the driver channels as approprite. Please review and comment, Christian.

3 months

[PATCH bpf 1/2] bpf: Fix truncated dmabuf iterator reads

by T.J. Mercier

If there is a large number (hundreds) of dmabufs allocated, the text output generated from dmabuf_iter_seq_show can exceed common user buffer sizes (e.g. PAGE_SIZE) necessitating multiple start/stop cycles to iterate through all dmabufs. However the dmabuf iterator currently returns NULL in dmabuf_iter_seq_start for all non-zero pos values, which results in the truncation of the output before all dmabufs are handled. After dma_buf_iter_begin / dma_buf_iter_next, the refcount of the buffer is elevated so that the BPF iterator program can run without holding any locks. When a stop occurs, instead of immediately dropping the reference on the buffer, stash a pointer to the buffer in seq->priv until either start is called or the iterator is released. This also enables the resumption of iteration without first walking through the list of dmabufs based on the pos value. Fixes: 76ea95534995 ("bpf: Add dmabuf iterator") Signed-off-by: T.J. Mercier <tjmercier(a)google.com> --- kernel/bpf/dmabuf_iter.c | 56 +++++++++++++++++++++++++++++++++++----- 1 file changed, 49 insertions(+), 7 deletions(-) diff --git a/kernel/bpf/dmabuf_iter.c b/kernel/bpf/dmabuf_iter.c index 4dd7ef7c145c..cd500248abd9 100644 --- a/kernel/bpf/dmabuf_iter.c +++ b/kernel/bpf/dmabuf_iter.c @@ -6,10 +6,33 @@ #include <linux/kernel.h> #include <linux/seq_file.h> +struct dmabuf_iter_priv { + /* + * If this pointer is non-NULL, the buffer's refcount is elevated to + * prevent destruction between stop/start. If reading is not resumed and + * start is never called again, then dmabuf_iter_seq_fini drops the + * reference when the iterator is released. + */ + struct dma_buf *dmabuf; +}; + static void *dmabuf_iter_seq_start(struct seq_file *seq, loff_t *pos) { - if (*pos) - return NULL; + struct dmabuf_iter_priv *p = seq->private; + + if (*pos) { + struct dma_buf *dmabuf = p->dmabuf; + + if (!dmabuf) + return NULL; + + /* + * Always resume from where we stopped, regardless of the value + * of pos. + */ + p->dmabuf = NULL; + return dmabuf; + } return dma_buf_iter_begin(); } @@ -54,8 +77,11 @@ static void dmabuf_iter_seq_stop(struct seq_file *seq, void *v) { struct dma_buf *dmabuf = v; - if (dmabuf) - dma_buf_put(dmabuf); + if (dmabuf) { + struct dmabuf_iter_priv *p = seq->private; + + p->dmabuf = dmabuf; + } } static const struct seq_operations dmabuf_iter_seq_ops = { @@ -71,11 +97,27 @@ static void bpf_iter_dmabuf_show_fdinfo(const struct bpf_iter_aux_info *aux, seq_puts(seq, "dmabuf iter\n"); } +static int dmabuf_iter_seq_init(void *priv, struct bpf_iter_aux_info *aux) +{ + struct dmabuf_iter_priv *p = (struct dmabuf_iter_priv *)priv; + + p->dmabuf = NULL; + return 0; +} + +static void dmabuf_iter_seq_fini(void *priv) +{ + struct dmabuf_iter_priv *p = (struct dmabuf_iter_priv *)priv; + + if (p->dmabuf) + dma_buf_put(p->dmabuf); +} + static const struct bpf_iter_seq_info dmabuf_iter_seq_info = { .seq_ops = &dmabuf_iter_seq_ops, - .init_seq_private = NULL, - .fini_seq_private = NULL, - .seq_priv_size = 0, + .init_seq_private = dmabuf_iter_seq_init, + .fini_seq_private = dmabuf_iter_seq_fini, + .seq_priv_size = sizeof(struct dmabuf_iter_priv), }; static struct bpf_iter_reg bpf_dmabuf_reg_info = { base-commit: 30f09200cc4aefbd8385b01e41bde2e4565a6f0e -- 2.52.0.177.g9f829587af-goog

3 months

Re: [PATCH 1/2] dma-buf: Add __dma_fence_is_signaled()

by kernel test robot

Hello, kernel test robot noticed "Oops:general_protection_fault,probably_for_non-canonical_address#:#[##]SMP_KASAN_PTI" on: commit: 142f20971642be40507d3a0bc94e905e251db81a ("[PATCH 1/2] dma-buf: Add __dma_fence_is_signaled()") url: https://github.com/intel-lab-lkp/linux/commits/Philipp-Stanner/dma-buf-dma-… base: git://linuxtv.org/sailus/media_tree.git master patch link: https://lore.kernel.org/all/20251125104443.82974-2-phasta@kernel.org/ patch subject: [PATCH 1/2] dma-buf: Add __dma_fence_is_signaled() in testcase: lkvs version: lkvs-x86_64-6505b18-1_20251124 with following parameters: test: rapl-client config: x86_64-rhel-9.4-func compiler: gcc-14 test machine: 4 threads Intel(R) Core(TM) i5-6500 CPU @ 3.20GHz (Skylake) with 32G memory (please refer to attached dmesg/kmsg for entire log/backtrace) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <oliver.sang(a)intel.com> | Closes: https://lore.kernel.org/oe-lkp/202512092317.8cf778a-lkp@intel.com [ 46.662293][ T179] i915 0000:00:02.0: vgaarb: VGA decodes changed: olddecodes=io+mem,decodes=io+mem:owns=io+mem [ 46.680656][ T40] sd 1:0:0:0: [sda] Preferred minimum I/O size 4096 bytes [ 46.682302][ T59] i915 0000:00:02.0: Direct firmware load for i915/skl_dmc_ver1_27.bin failed with error -2 [ 46.698362][ T59] i915 0000:00:02.0: [drm] Failed to load DMC firmware i915/skl_dmc_ver1_27.bin (-ENOENT). Disabling runtime power management. [ 46.711256][ T59] i915 0000:00:02.0: [drm] DMC firmware homepage: https://git.kernel.org/pub/scm/linux/kernel/git/firmware/linux-firmware.git [ 46.725941][ T12] Oops: general protection fault, probably for non-canonical address 0xdffffc01544551ba: 0000 [#1] SMP KASAN PTI [ 46.725953][ T179] ------------[ cut here ]------------ [ 46.737600][ T12] KASAN: probably user-memory-access in range [0x0000000aa22a8dd0-0x0000000aa22a8dd7] [ 46.737612][ T12] CPU: 3 UID: 0 PID: 12 Comm: kworker/u16:0 Tainted: G S I 6.18.0-rc5-00236-g142f20971642 #1 PREEMPT(voluntary) [ 46.742889][ T179] Fence 0000:00:02.0:[i915]:9:2 released with pending signals! [ 46.752212][ T12] Tainted: [S]=CPU_OUT_OF_SPEC, [I]=FIRMWARE_WORKAROUND [ 46.752217][ T12] Hardware name: Dell Inc. OptiPlex 7040/0Y7WYT, BIOS 1.1.1 10/07/2015 [ 46.752220][ T12] Workqueue: i915 __i915_gem_free_work [i915] [ 46.765216][ T179] WARNING: CPU: 0 PID: 179 at drivers/dma-buf/dma-fence.c:555 dma_fence_release (kbuild/src/consumer/drivers/dma-buf/dma-fence.c:555 (discriminator 1)) [ 46.772517][ T12] [ 46.772521][ T12] RIP: 0010:__list_add_valid_or_report (kbuild/src/consumer/lib/list_debug.c:29) [ 46.772528][ T12] Code: 8b 98 fe 48 89 d3 48 85 d2 0f 84 af 8b 98 fe 4c 8d 62 08 48 89 fd 49 89 f5 48 b8 00 00 00 00 00 fc ff df 4c 89 e2 48 c1 ea 03 <80> 3c 02 00 0f 85 b7 00 00 00 4c 39 6b 08 75 43 48 b8 00 00 00 00 All code ======== 0: 8b 98 fe 48 89 d3 mov -0x2c76b702(%rax),%ebx 6: 48 85 d2 test %rdx,%rdx 9: 0f 84 af 8b 98 fe je 0xfffffffffe988bbe f: 4c 8d 62 08 lea 0x8(%rdx),%r12 13: 48 89 fd mov %rdi,%rbp 16: 49 89 f5 mov %rsi,%r13 19: 48 b8 00 00 00 00 00 movabs $0xdffffc0000000000,%rax 20: fc ff df 23: 4c 89 e2 mov %r12,%rdx 26: 48 c1 ea 03 shr $0x3,%rdx 2a:* 80 3c 02 00 cmpb $0x0,(%rdx,%rax,1) <-- trapping instruction 2e: 0f 85 b7 00 00 00 jne 0xeb 34: 4c 39 6b 08 cmp %r13,0x8(%rbx) 38: 75 43 jne 0x7d 3a: 48 rex.W 3b: b8 00 00 00 00 mov $0x0,%eax Code starting with the faulting instruction =========================================== 0: 80 3c 02 00 cmpb $0x0,(%rdx,%rax,1) 4: 0f 85 b7 00 00 00 jne 0xc1 a: 4c 39 6b 08 cmp %r13,0x8(%rbx) e: 75 43 jne 0x53 10: 48 rex.W 11: b8 00 00 00 00 mov $0x0,%eax [ 46.779267][ T179] Modules linked in: [ 46.787293][ T12] RSP: 0018:ffffc9000010fac8 EFLAGS: 00010003 [ 46.787300][ T12] RAX: dffffc0000000000 RBX: 0000000aa22a8dcf RCX: ffffffff82f5859d [ 46.793179][ T179] platform_profile [ 46.803018][ T12] RDX: 00000001544551ba RSI: ffff88884fde5c90 RDI: ffffc9000010fb50 [ 46.803023][ T12] RBP: ffffc9000010fb50 R08: 0000000000000000 R09: ffffed1109fbcb96 [ 46.803025][ T12] R10: ffff88884fde5cb7 R11: fefefefefefefeff R12: 0000000aa22a8dd7 [ 46.805219][ T179] sd_mod [ 46.811413][ T12] R13: ffff88884fde5c90 R14: ffff88884fde5c90 R15: 0000000aa22a8dcf [ 46.811417][ T12] FS: 0000000000000000(0000) GS:ffff888848e3e000(0000) knlGS:0000000000000000 [ 46.811419][ T12] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 46.830755][ T179] intel_rapl_common [ 46.834463][ T12] CR2: 00007f3bc83ae000 CR3: 0000000868388002 CR4: 00000000003726f0 [ 46.834467][ T12] Call Trace: [ 46.834469][ T12] <TASK> [ 46.840348][ T179] snd_hda_core [ 46.848115][ T12] dma_fence_default_wait (kbuild/src/consumer/include/linux/list.h:158 (discriminator 1) kbuild/src/consumer/include/linux/list.h:177 (discriminator 1) kbuild/src/consumer/drivers/dma-buf/dma-fence.c:800 (discriminator 1)) [ 46.851758][ T179] x86_pkg_temp_thermal [ 46.859527][ T12] ? __pfx_dma_fence_default_wait (kbuild/src/consumer/drivers/dma-buf/dma-fence.c:778) The kernel config and materials to reproduce are available at: https://download.01.org/0day-ci/archive/20251209/202512092317.8cf778a-lkp@i… -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

3 months

Jump to page:

2026

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

Linaro-mm-sig