Linaro-mm-sig

linaro-mm-sig@lists.linaro.org

24 participants
3677 discussions

[PATCH] dma-fence: Dereference correct dma_fence in dma_fence_chain_find_seqno()

by Li Ming

dma_fence_chain_find_seqno() uses dma_fence_chain_for_each() to walk a given dma_fence_chain. dma_fence_chain_for_each() always holds a reference for the current fence during iteration. The reference must be dropped after breaking out. Instead of dereferencing the last fence as intended, dma_fence_chain_find_seqno() incorrectly dereferences the first fence in the chain. Fixes: 7bf60c52e093 ("dma-buf: add new dma_fence_chain container v7") Signed-off-by: Li Ming <ming.li(a)zohomail.com> --- drivers/dma-buf/dma-fence-chain.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/dma-buf/dma-fence-chain.c b/drivers/dma-buf/dma-fence-chain.c index a8a90acf4f34..71fa173aef13 100644 --- a/drivers/dma-buf/dma-fence-chain.c +++ b/drivers/dma-buf/dma-fence-chain.c @@ -103,7 +103,7 @@ int dma_fence_chain_find_seqno(struct dma_fence **pfence, uint64_t seqno) to_dma_fence_chain(*pfence)->prev_seqno < seqno) break; } - dma_fence_put(&chain->base); + dma_fence_put(*pfence); return 0; } --- base-commit: c369299895a591d96745d6492d4888259b004a9e change-id: 20260327-fix_dma_fence_chain_find_seqno-7adea64efe01 Best regards, -- Li Ming <ming.li(a)zohomail.com>

7 months

[PATCH v3 0/8] dma-buf: heaps: Turn heaps into modules

by Maxime Ripard

Hi, The recent introduction of heaps in the optee driver [1] made possible the creation of heaps as modules. It's generally a good idea if possible, including for the already existing system and CMA heaps. The system one is pretty trivial, the CMA one is a bit more involved, especially since we have a call from kernel/dma/contiguous.c to the CMA heap code. This was solved by turning the logic around and making the CMA heap call into the contiguous DMA code. Let me know what you think, Maxime 1: https://lore.kernel.org/dri-devel/20250911135007.1275833-4-jens.wiklander@l… Signed-off-by: Maxime Ripard <mripard(a)kernel.org> --- Changes in v3: - Squashed cma_get_name and cma_alloc/release patches - Fixed typo in Export dev_get_cma_area commit title - Fixed compilation failure with DMA_CMA but not OF_RESERVED_MEM - Link to v2: https://lore.kernel.org/r/20260227-dma-buf-heaps-as-modules-v2-0-454aee7e06… Changes in v2: - Collect tags - Don't export dma_contiguous_default_area anymore, but export dev_get_cma_area instead - Mentioned that heap modules can't be removed - Link to v1: https://lore.kernel.org/r/20260225-dma-buf-heaps-as-modules-v1-0-2109225a09… --- Maxime Ripard (8): dma: contiguous: Turn heap registration logic around dma: contiguous: Make dev_get_cma_area() a proper function dma: contiguous: Make dma_contiguous_default_area static dma: contiguous: Export dev_get_cma_area() mm: cma: Export cma_alloc(), cma_release() and cma_get_name() dma-buf: heaps: Export mem_accounting parameter dma-buf: heaps: cma: Turn the heap into a module dma-buf: heaps: system: Turn the heap into a module drivers/dma-buf/dma-heap.c | 1 + drivers/dma-buf/heaps/Kconfig | 4 ++-- drivers/dma-buf/heaps/cma_heap.c | 21 +++++---------------- drivers/dma-buf/heaps/system_heap.c | 5 +++++ include/linux/dma-map-ops.h | 18 ++++++++++-------- kernel/dma/contiguous.c | 37 ++++++++++++++++++++++++++++++++++--- mm/cma.c | 3 +++ 7 files changed, 60 insertions(+), 29 deletions(-) --- base-commit: 499a718536dc0e1c1d1b6211847207d58acd9916 change-id: 20260225-dma-buf-heaps-as-modules-1034b3ec9f2a Best regards, -- Maxime Ripard <mripard(a)kernel.org>

7 months

[PATCH v2 0/9] accel: New driver for NXP's Neutron NPU

by Ioana Ciocoi-Radulescu

Introduce a new accel driver for the Neutron Neural Processing Unit (NPU), along with associated dt-bindings and DTS node. The first patch extends the GEM DMA helper APIs to allow bidirectional mapping of non-coherent DMA buffers. While not part of the Neutron driver, it's a prerequisite allowing us to use the GEM DMA helper. Neutron is a Neural Processing Unit from NXP, providing machine learning (ML) acceleration for edge AI applications. Neutron is integrated on NXP SoCs such as the i.MX95. The NPU consists of the following: - RISC-V core running a proprietary firmware - One or more Neutron cores, representing the main computation engine performing ML operations - Dedicated fast memory (TCM) - DMA engine that handles data transfers between DDR and TCM The firmware is closed source and distributed as a binary here [1]. The Neutron software stack also contains a userspace library [1] and a LiteRT custom delegate [2] that allow integration with standard LiteRT tools. [1] https://github.com/nxp-upstream/neutron/tree/upstream [2] https://github.com/nxp-imx/tflite-neutron-delegate Signed-off-by: Ioana Ciocoi-Radulescu <ruxandra.radulescu(a)nxp.com> --- Changes in v2: - rebase on newer drm-misc-next - dt bindings: clock fixes and renames - update DTS to match new names - remove unnecessary fields from neutron_job structure - fix use of uninitialized variable - Link to v1: https://lore.kernel.org/r/20260226-neutron-v1-0-46eccb3bb50a@nxp.com --- Ioana Ciocoi-Radulescu (9): drm/gem-dma: Add flag for bidirectional mapping of non-coherent GEM DMA buffers accel/neutron: Add documentation for NXP Neutron accelerator driver dt-bindings: npu: Add NXP Neutron accel/neutron: Add driver for NXP Neutron NPU accel/neutron: Add GEM buffer object support accel/neutron: Add mailbox support accel/neutron: Add job submission IOCTL accel/neutron: Add logging support arm64: dts: imx95: Add Neutron node Documentation/accel/index.rst | 1 + Documentation/accel/neutron/index.rst | 12 + Documentation/accel/neutron/neutron.rst | 131 ++++++++ .../devicetree/bindings/npu/nxp,imx95-neutron.yaml | 96 ++++++ MAINTAINERS | 10 + arch/arm64/boot/dts/freescale/imx95.dtsi | 28 ++ drivers/accel/Kconfig | 1 + drivers/accel/Makefile | 3 +- drivers/accel/neutron/Kconfig | 16 + drivers/accel/neutron/Makefile | 12 + drivers/accel/neutron/neutron_debugfs.c | 34 ++ drivers/accel/neutron/neutron_debugfs.h | 15 + drivers/accel/neutron/neutron_device.c | 239 +++++++++++++ drivers/accel/neutron/neutron_device.h | 155 +++++++++ drivers/accel/neutron/neutron_driver.c | 262 +++++++++++++++ drivers/accel/neutron/neutron_driver.h | 16 + drivers/accel/neutron/neutron_gem.c | 116 +++++++ drivers/accel/neutron/neutron_gem.h | 14 + drivers/accel/neutron/neutron_job.c | 372 +++++++++++++++++++++ drivers/accel/neutron/neutron_job.h | 43 +++ drivers/accel/neutron/neutron_mailbox.c | 47 +++ drivers/accel/neutron/neutron_mailbox.h | 42 +++ drivers/gpu/drm/drm_gem_dma_helper.c | 6 +- include/drm/drm_gem_dma_helper.h | 3 + include/uapi/drm/neutron_accel.h | 130 +++++++ 25 files changed, 1801 insertions(+), 3 deletions(-) --- base-commit: 6716101ae42949e98ad4b9e71eeba08c055be410 change-id: 20260226-neutron-c435e39d167f Best regards, -- Ioana Ciocoi-Radulescu <ruxandra.radulescu(a)nxp.com>

7 months

corgi puppies for sale near me

by Tirrell Otalvaro

7 months

Diving Headfirst into the Addictive World of io Games

by ideal.elephant.yxcu＠hidingmail.com

Ever find yourself with five minutes to spare and a craving for some quick, competitive fun? Look no further than the ever-expanding universe of io games! These browser-based gems offer instant gratification and addictive gameplay, making them perfect for short bursts of entertainment or even surprisingly engaging longer sessions. Let's explore how to get started and truly enjoy these simple yet captivating games. https://iogamesweb.com/ Introduction: What's the Allure of io Games? The beauty of io games lies in their accessibility. No downloads, no complex tutorials, just pure, unadulterated gaming. Often featuring simple graphics and intuitive controls, they're incredibly easy to pick up. But don't let the simplicity fool you – under the hood lies competitive gameplay that can be surprisingly strategic and rewarding. The “io” suffix typically indicates a game hosted on a public domain, allowing for many different developers and styles within the genre. Tips for Thriving in the io Arena While easy to learn, mastering io games requires some strategy. Here are a few tips to help you succeed: Observe and Adapt: Pay attention to the gameplay style of other players. Are they aggressive or defensive? What strategies are they using? Adjust your own approach accordingly. Learn the Maps: Familiarize yourself with the layout of each game's map. Knowing where resources are located and where potential dangers lurk can give you a significant advantage. Team Up (Sometimes): Some io games encourage or even necessitate teamwork. Forming alliances with other players can provide mutual protection and increase your chances of survival. However, be wary of betrayal! Practice Makes Perfect: The more you play, the better you'll become at understanding the game's mechanics, anticipating enemy movements, and executing effective strategies. Don’t get discouraged if you are constantly losing in the beginning. Have Fun! The most important tip of all! Don't take the games too seriously. Relax, experiment, and enjoy the fast-paced, chaotic nature of io games. Explore different types of io games to find what style best suits your gaming preferences. Conclusion: A Quick Escape for the Modern Gamer io games offer a fantastic escape for anyone looking for a quick dose of competitive fun. Their accessibility, simple mechanics, and addictive gameplay make them a perfect choice for short breaks or longer gaming sessions. So, jump in, give it a try, and prepare to be captivated by the surprisingly engaging world of io games!

7 months

[PATCH net-next v3 0/2] dma-buf: heaps: system: add an option to allocate explicitly decrypted memory

by Jiri Pirko

From: Jiri Pirko <jiri(a)nvidia.com> Confidential computing (CoCo) VMs/guests, such as AMD SEV and Intel TDX, run with encrypted/protected memory which creates a challenge for devices that do not support DMA to it (no TDISP support). For kernel-only DMA operations, swiotlb bounce buffering provides a transparent solution by copying data through decrypted memory. However, the only way to get this memory into userspace is via the DMA API's dma_alloc_pages()/dma_mmap_pages() type interfaces which limits the use of the memory to a single DMA device, and is incompatible with pin_user_pages(). These limitations are particularly problematic for the RDMA subsystem which makes heavy use of pin_user_pages() and expects flexible memory usage between many different DMA devices. This patch series enables userspace to explicitly request decrypted (shared) memory allocations from the dma-buf system heap. Userspace can mmap this memory and pass the dma-buf fd to other existing importers such as RDMA or DRM devices to access the memory. The DMA API is improved to allow the dma heap exporter to DMA map the shared memory to each importing device. Jiri Pirko (2): dma-mapping: introduce DMA_ATTR_CC_DECRYPTED for pre-decrypted memory dma-buf: heaps: system: add system_cc_decrypted heap for explicitly decrypted memory drivers/dma-buf/heaps/system_heap.c | 103 ++++++++++++++++++++++++++-- include/linux/dma-mapping.h | 6 ++ include/trace/events/dma.h | 3 +- kernel/dma/direct.h | 14 +++- 4 files changed, 117 insertions(+), 9 deletions(-) -- 2.51.1

7 months, 1 week

[PATCH v4 0/2] dma-buf: heaps: system: add an option to allocate explicitly decrypted memory

by Jiri Pirko

From: Jiri Pirko <jiri(a)nvidia.com> Confidential computing (CoCo) VMs/guests, such as AMD SEV and Intel TDX, run with encrypted/protected memory which creates a challenge for devices that do not support DMA to it (no TDISP support). For kernel-only DMA operations, swiotlb bounce buffering provides a transparent solution by copying data through decrypted memory. However, the only way to get this memory into userspace is via the DMA API's dma_alloc_pages()/dma_mmap_pages() type interfaces which limits the use of the memory to a single DMA device, and is incompatible with pin_user_pages(). These limitations are particularly problematic for the RDMA subsystem which makes heavy use of pin_user_pages() and expects flexible memory usage between many different DMA devices. This patch series enables userspace to explicitly request decrypted (shared) memory allocations from new dma-buf system_cc_decrypted heap. Userspace can mmap this memory and pass the dma-buf fd to other existing importers such as RDMA or DRM devices to access the memory. The DMA API is improved to allow the dma heap exporter to DMA map the shared memory to each importing device. Jiri Pirko (2): dma-mapping: introduce DMA_ATTR_CC_DECRYPTED for pre-decrypted memory dma-buf: heaps: system: add system_cc_decrypted heap for explicitly decrypted memory drivers/dma-buf/heaps/system_heap.c | 103 ++++++++++++++++++++++++++-- include/linux/dma-mapping.h | 10 +++ include/trace/events/dma.h | 3 +- kernel/dma/direct.h | 14 +++- kernel/dma/mapping.c | 13 +++- 5 files changed, 132 insertions(+), 11 deletions(-) -- 2.51.1

7 months, 1 week

[PATCH] media: pluto2: fix potential buffer overflow in pluto_dma_end()

by Dmitriy Chumachenko

The while loop in pluto_dma_end() scans the DMA buffer for MPEG-TS sync bytes (0x47) at 188-byte intervals. However, it does not check the buffer boundary. If the buffer contains 0x47 at every 188-byte offset, the loop index will exceed the buffer size, causing an out-of-bounds read. Add a check to ensure the index stays within TS_DMA_BYTES. Found by Linux Verification Center (linuxtesting.org) with SVACE. Fixes: c7cadb3a02b5 ("[PATCH] dvb: add Pluto2 driver") Signed-off-by: Dmitriy Chumachenko <Dmitry.Chumachenko(a)cyberprotect.ru> --- drivers/media/pci/pluto2/pluto2.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/media/pci/pluto2/pluto2.c b/drivers/media/pci/pluto2/pluto2.c index 6ac9b9bd7435..fd7f8d8b85a8 100644 --- a/drivers/media/pci/pluto2/pluto2.c +++ b/drivers/media/pci/pluto2/pluto2.c @@ -291,7 +291,7 @@ static void pluto_dma_end(struct pluto *pluto, unsigned int nbpackets) */ if ((nbpackets == 0) || (nbpackets > TS_DMA_PACKETS)) { unsigned int i = 0; - while (pluto->dma_buf[i] == 0x47) + while (i < TS_DMA_BYTES && pluto->dma_buf[i] == 0x47) i += 188; nbpackets = i / 188; if (i == 0) { -- 2.49.0

7 months, 1 week

[PATCH] dma-buf/dma_fence_array: remove unused functionality

by Christian König

Amdgpu was the only user of the signal on any feature and we dropped that use case recently, so we can remove that functionality again. This allows to simplfy the dma_fence_array code a lot and saves us from the need to install a callback on all fences at the same time. Signed-off-by: Christian König <christian.koenig(a)amd.com> --- drivers/dma-buf/dma-fence-array.c | 133 +++++++----------- drivers/dma-buf/dma-fence-unwrap.c | 3 +- drivers/dma-buf/dma-resv.c | 3 +- drivers/dma-buf/st-dma-fence-unwrap.c | 2 +- .../gpu/drm/i915/gem/i915_gem_execbuffer.c | 3 +- drivers/gpu/drm/xe/xe_sync.c | 2 +- drivers/gpu/drm/xe/xe_vm.c | 4 +- include/linux/dma-fence-array.h | 28 +--- 8 files changed, 63 insertions(+), 115 deletions(-) diff --git a/drivers/dma-buf/dma-fence-array.c b/drivers/dma-buf/dma-fence-array.c index 089f69469524..0d54bf2e47ba 100644 --- a/drivers/dma-buf/dma-fence-array.c +++ b/drivers/dma-buf/dma-fence-array.c @@ -42,97 +42,71 @@ static void dma_fence_array_clear_pending_error(struct dma_fence_array *array) cmpxchg(&array->base.error, PENDING_ERROR, 0); } -static void irq_dma_fence_array_work(struct irq_work *wrk) +static void dma_fence_array_cb_func(struct dma_fence *f, + struct dma_fence_cb *cb) { - struct dma_fence_array *array = container_of(wrk, typeof(*array), work); + struct dma_fence_array *array = + container_of(cb, struct dma_fence_array, callback); - dma_fence_array_clear_pending_error(array); - - dma_fence_signal(&array->base); - dma_fence_put(&array->base); + irq_work_queue(&array->work); } -static void dma_fence_array_cb_func(struct dma_fence *f, - struct dma_fence_cb *cb) +static void irq_dma_fence_array_work(struct irq_work *wrk) { - struct dma_fence_array_cb *array_cb = - container_of(cb, struct dma_fence_array_cb, cb); - struct dma_fence_array *array = array_cb->array; + struct dma_fence_array *array = container_of(wrk, typeof(*array), work); - dma_fence_array_set_pending_error(array, f->error); + while (array->num_pending--) { + struct dma_fence *f = array->fences[array->num_pending]; - if (atomic_dec_and_test(&array->num_pending)) - irq_work_queue(&array->work); - else - dma_fence_put(&array->base); + if (!dma_fence_add_callback(f, &array->callback, + dma_fence_array_cb_func)) + return; + + dma_fence_array_set_pending_error(array, f->error); + } + + dma_fence_signal(&array->base); + dma_fence_put(&array->base); } static bool dma_fence_array_enable_signaling(struct dma_fence *fence) { struct dma_fence_array *array = to_dma_fence_array(fence); - struct dma_fence_array_cb *cb = array->callbacks; - unsigned i; - - for (i = 0; i < array->num_fences; ++i) { - cb[i].array = array; - /* - * As we may report that the fence is signaled before all - * callbacks are complete, we need to take an additional - * reference count on the array so that we do not free it too - * early. The core fence handling will only hold the reference - * until we signal the array as complete (but that is now - * insufficient). - */ - dma_fence_get(&array->base); - if (dma_fence_add_callback(array->fences[i], &cb[i].cb, - dma_fence_array_cb_func)) { - int error = array->fences[i]->error; - - dma_fence_array_set_pending_error(array, error); - dma_fence_put(&array->base); - if (atomic_dec_and_test(&array->num_pending)) { - dma_fence_array_clear_pending_error(array); - return false; - } - } - } + /* + * As we may report that the fence is signaled before all + * callbacks are complete, we need to take an additional + * reference count on the array so that we do not free it too + * early. The core fence handling will only hold the reference + * until we signal the array as complete (but that is now + * insufficient). + */ + dma_fence_get(&array->base); + irq_dma_fence_array_work(&array->work); return true; } static bool dma_fence_array_signaled(struct dma_fence *fence) { struct dma_fence_array *array = to_dma_fence_array(fence); - int num_pending; + int num_pending, error = 0; unsigned int i; /* - * We need to read num_pending before checking the enable_signal bit - * to avoid racing with the enable_signaling() implementation, which - * might decrement the counter, and cause a partial check. - * atomic_read_acquire() pairs with atomic_dec_and_test() in - * dma_fence_array_enable_signaling() - * - * The !--num_pending check is here to account for the any_signaled case - * if we race with enable_signaling(), that means the !num_pending check - * in the is_signalling_enabled branch might be outdated (num_pending - * might have been decremented), but that's fine. The user will get the - * right value when testing again later. + * Reading num_pending is just an optimization, it is perfectly + * acceptable to have a stale value for it. */ - num_pending = atomic_read_acquire(&array->num_pending); - if (test_bit(DMA_FENCE_FLAG_ENABLE_SIGNAL_BIT, &array->base.flags)) { - if (num_pending <= 0) - goto signal; - return false; - } + num_pending = READ_ONCE(array->num_pending); + for (i = 0; i < num_pending; ++i) { + struct dma_fence *f = array->fences[i]; - for (i = 0; i < array->num_fences; ++i) { - if (dma_fence_is_signaled(array->fences[i]) && !--num_pending) - goto signal; - } - return false; + if (!dma_fence_is_signaled(f)) + return false; -signal: + if (!error) + error = f->error; + } + dma_fence_array_set_pending_error(array, error); dma_fence_array_clear_pending_error(array); return true; } @@ -171,15 +145,12 @@ EXPORT_SYMBOL(dma_fence_array_ops); /** * dma_fence_array_alloc - Allocate a custom fence array - * @num_fences: [in] number of fences to add in the array * * Return dma fence array on success, NULL on failure */ -struct dma_fence_array *dma_fence_array_alloc(int num_fences) +struct dma_fence_array *dma_fence_array_alloc(void) { - struct dma_fence_array *array; - - return kzalloc_flex(*array, callbacks, num_fences); + return kzalloc_obj(struct dma_fence_array); } EXPORT_SYMBOL(dma_fence_array_alloc); @@ -190,21 +161,22 @@ EXPORT_SYMBOL(dma_fence_array_alloc); * @fences: [in] array containing the fences * @context: [in] fence context to use * @seqno: [in] sequence number to use - * @signal_on_any: [in] signal on any fence in the array * * Implementation of @dma_fence_array_create without allocation. Useful to init * a preallocated dma fence array in the path of reclaim or dma fence signaling. */ void dma_fence_array_init(struct dma_fence_array *array, int num_fences, struct dma_fence **fences, - u64 context, unsigned seqno, - bool signal_on_any) + u64 context, unsigned seqno) { static struct lock_class_key dma_fence_array_lock_key; WARN_ON(!num_fences || !fences); array->num_fences = num_fences; + array->num_pending = num_fences; + array->fences = fences; + array->base.error = PENDING_ERROR; dma_fence_init(&array->base, &dma_fence_array_ops, NULL, context, seqno); @@ -222,11 +194,6 @@ void dma_fence_array_init(struct dma_fence_array *array, */ lockdep_set_class(&array->base.inline_lock, &dma_fence_array_lock_key); - atomic_set(&array->num_pending, signal_on_any ? 1 : num_fences); - array->fences = fences; - - array->base.error = PENDING_ERROR; - /* * dma_fence_array objects should never contain any other fence * containers or otherwise we run into recursion and potential kernel @@ -249,7 +216,6 @@ EXPORT_SYMBOL(dma_fence_array_init); * @fences: [in] array containing the fences * @context: [in] fence context to use * @seqno: [in] sequence number to use - * @signal_on_any: [in] signal on any fence in the array * * Allocate a dma_fence_array object and initialize the base fence with * dma_fence_init(). @@ -264,17 +230,16 @@ EXPORT_SYMBOL(dma_fence_array_init); */ struct dma_fence_array *dma_fence_array_create(int num_fences, struct dma_fence **fences, - u64 context, unsigned seqno, - bool signal_on_any) + u64 context, unsigned seqno) { struct dma_fence_array *array; - array = dma_fence_array_alloc(num_fences); + array = dma_fence_array_alloc(); if (!array) return NULL; dma_fence_array_init(array, num_fences, fences, - context, seqno, signal_on_any); + context, seqno); return array; } diff --git a/drivers/dma-buf/dma-fence-unwrap.c b/drivers/dma-buf/dma-fence-unwrap.c index 07fe9bf45aea..53bb40e70b27 100644 --- a/drivers/dma-buf/dma-fence-unwrap.c +++ b/drivers/dma-buf/dma-fence-unwrap.c @@ -180,8 +180,7 @@ struct dma_fence *__dma_fence_unwrap_merge(unsigned int num_fences, if (count > 1) { result = dma_fence_array_create(count, array, - dma_fence_context_alloc(1), - 1, false); + dma_fence_context_alloc(1), 1); if (!result) { for (i = 0; i < count; i++) dma_fence_put(array[i]); diff --git a/drivers/dma-buf/dma-resv.c b/drivers/dma-buf/dma-resv.c index ce9e6c04897f..39a92d9f2413 100644 --- a/drivers/dma-buf/dma-resv.c +++ b/drivers/dma-buf/dma-resv.c @@ -648,8 +648,7 @@ int dma_resv_get_singleton(struct dma_resv *obj, enum dma_resv_usage usage, } array = dma_fence_array_create(count, fences, - dma_fence_context_alloc(1), - 1, false); + dma_fence_context_alloc(1), 1); if (!array) { while (count--) dma_fence_put(fences[count]); diff --git a/drivers/dma-buf/st-dma-fence-unwrap.c b/drivers/dma-buf/st-dma-fence-unwrap.c index 9c74195f47fd..45413666970e 100644 --- a/drivers/dma-buf/st-dma-fence-unwrap.c +++ b/drivers/dma-buf/st-dma-fence-unwrap.c @@ -65,7 +65,7 @@ static struct dma_fence *mock_array(unsigned int num_fences, ...) array = dma_fence_array_create(num_fences, fences, dma_fence_context_alloc(1), - 1, false); + 1); if (!array) goto error_free; return &array->base; diff --git a/drivers/gpu/drm/i915/gem/i915_gem_execbuffer.c b/drivers/gpu/drm/i915/gem/i915_gem_execbuffer.c index e7918f896a26..1ac91a46d87f 100644 --- a/drivers/gpu/drm/i915/gem/i915_gem_execbuffer.c +++ b/drivers/gpu/drm/i915/gem/i915_gem_execbuffer.c @@ -3203,8 +3203,7 @@ eb_composite_fence_create(struct i915_execbuffer *eb, int out_fence_fd) fence_array = dma_fence_array_create(eb->num_batches, fences, eb->context->parallel.fence_context, - eb->context->parallel.seqno++, - false); + eb->context->parallel.seqno++); if (!fence_array) { kfree(fences); return ERR_PTR(-ENOMEM); diff --git a/drivers/gpu/drm/xe/xe_sync.c b/drivers/gpu/drm/xe/xe_sync.c index 24d6d9af20d6..37866768d64c 100644 --- a/drivers/gpu/drm/xe/xe_sync.c +++ b/drivers/gpu/drm/xe/xe_sync.c @@ -376,7 +376,7 @@ xe_sync_in_fence_get(struct xe_sync_entry *sync, int num_sync, xe_assert(vm->xe, current_fence == num_fence); cf = dma_fence_array_create(num_fence, fences, dma_fence_context_alloc(1), - 1, false); + 1); if (!cf) goto err_out; diff --git a/drivers/gpu/drm/xe/xe_vm.c b/drivers/gpu/drm/xe/xe_vm.c index 548b0769b3ef..b916a9d90104 100644 --- a/drivers/gpu/drm/xe/xe_vm.c +++ b/drivers/gpu/drm/xe/xe_vm.c @@ -3196,7 +3196,7 @@ static struct dma_fence *ops_execute(struct xe_vm *vm, goto err_trace; } - cf = dma_fence_array_alloc(n_fence); + cf = dma_fence_array_alloc(); if (!cf) { fence = ERR_PTR(-ENOMEM); goto err_out; @@ -3240,7 +3240,7 @@ static struct dma_fence *ops_execute(struct xe_vm *vm, xe_assert(vm->xe, current_fence == n_fence); dma_fence_array_init(cf, n_fence, fences, dma_fence_context_alloc(1), - 1, false); + 1); fence = &cf->base; for_each_tile(tile, vm->xe, id) { diff --git a/include/linux/dma-fence-array.h b/include/linux/dma-fence-array.h index 370b3d2bba37..3ee55c0e2fa4 100644 --- a/include/linux/dma-fence-array.h +++ b/include/linux/dma-fence-array.h @@ -15,16 +15,6 @@ #include <linux/dma-fence.h> #include <linux/irq_work.h> -/** - * struct dma_fence_array_cb - callback helper for fence array - * @cb: fence callback structure for signaling - * @array: reference to the parent fence array object - */ -struct dma_fence_array_cb { - struct dma_fence_cb cb; - struct dma_fence_array *array; -}; - /** * struct dma_fence_array - fence to represent an array of fences * @base: fence base class @@ -33,18 +23,17 @@ struct dma_fence_array_cb { * @num_pending: fences in the array still pending * @fences: array of the fences * @work: internal irq_work function - * @callbacks: array of callback helpers + * @callback: callback structure for signaling */ struct dma_fence_array { struct dma_fence base; - unsigned num_fences; - atomic_t num_pending; + unsigned int num_fences; + unsigned int num_pending; struct dma_fence **fences; struct irq_work work; - - struct dma_fence_array_cb callbacks[] __counted_by(num_fences); + struct dma_fence_cb callback; }; /** @@ -78,16 +67,13 @@ to_dma_fence_array(struct dma_fence *fence) for (index = 0, fence = dma_fence_array_first(head); fence; \ ++(index), fence = dma_fence_array_next(head, index)) -struct dma_fence_array *dma_fence_array_alloc(int num_fences); +struct dma_fence_array *dma_fence_array_alloc(void); void dma_fence_array_init(struct dma_fence_array *array, int num_fences, struct dma_fence **fences, - u64 context, unsigned seqno, - bool signal_on_any); - + u64 context, unsigned seqno); struct dma_fence_array *dma_fence_array_create(int num_fences, struct dma_fence **fences, - u64 context, unsigned seqno, - bool signal_on_any); + u64 context, unsigned seqno); bool dma_fence_match_context(struct dma_fence *fence, u64 context); -- 2.43.0

7 months, 1 week

[PATCH] dma-buf/dma_fence: be more defensive in dma_fence_release

by Christian König

In case of a refcounting bug dma_fence_release() can be called before the fence was even signaled. Previously the dma_fence framework then force signaled the fence to make sure to unblock waiters, but that can potentially lead to random memory corruption when the DMA operation continues. So be more defensive here and pick the lesser evil. Instead of force signaling the fence set an error code on the fence, re-initialize the refcount to something large and taint the kernel. This will leak memory and eventually can cause a deadlock when the fence is never signaled, but at least we won't run into an use after free or random memory corruption. Signed-off-by: Christian König <christian.koenig(a)amd.com> --- drivers/dma-buf/dma-fence.c | 18 ++++++++++++++---- 1 file changed, 14 insertions(+), 4 deletions(-) diff --git a/drivers/dma-buf/dma-fence.c b/drivers/dma-buf/dma-fence.c index 1826ba73094c..8bf07685a053 100644 --- a/drivers/dma-buf/dma-fence.c +++ b/drivers/dma-buf/dma-fence.c @@ -593,14 +593,24 @@ void dma_fence_release(struct kref *kref) /* * Failed to signal before release, likely a refcounting issue. * - * This should never happen, but if it does make sure that we - * don't leave chains dangling. We set the error flag first - * so that the callbacks know this signal is due to an error. + * This should never happen, but if try to be defensive and take + * the lesser evil. Initialize the refcount to something large, + * but not so large that it can overflow. + * + * That will leak memory and could deadlock if the fence never + * signals, but at least it doesn't cause an use after free or + * random memory corruption. + * + * Also taint the kernel to note that it is rather unreliable to + * continue. */ dma_fence_lock_irqsave(fence, flags); fence->error = -EDEADLK; - dma_fence_signal_locked(fence); + refcount_set(&fence->refcount.refcount, INT_MAX); dma_fence_unlock_irqrestore(fence, flags); + rcu_read_unlock(); + add_taint(TAINT_SOFTLOCKUP, LOCKDEP_STILL_OK); + return; } ops = rcu_dereference(fence->ops); -- 2.43.0

7 months, 1 week

Jump to page:

2026

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

Linaro-mm-sig