linux-kernel - Re: [PATCH] drm/msm: Reject MAP

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <19a168d95e8.7a90f7d35482131.1689650792018355758@collabora.com>
Date: Fri, 24 Oct 2025 16:09:29 +0200
From: Valentine Burley <valentine.burley@...labora.com>
To: "Rob Clark" <robin.clark@....qualcomm.com>
Cc: "dri-devel" <dri-devel@...ts.freedesktop.org>,
	"freedreno" <freedreno@...ts.freedesktop.org>,
	"linux-arm-msm" <linux-arm-msm@...r.kernel.org>,
	"Sean Paul" <sean@...rly.run>,
	"Konrad Dybcio" <konradybcio@...nel.org>,
	"Dmitry Baryshkov" <lumag@...nel.org>,
	"Abhinav Kumar" <abhinav.kumar@...ux.dev>,
	"Jessica Zhang" <jessica.zhang@....qualcomm.com>,
	"Marijn Suijten" <marijn.suijten@...ainline.org>,
	"David Airlie" <airlied@...il.com>,
	"Simona Vetter" <simona@...ll.ch>,
	"open list" <linux-kernel@...r.kernel.org>
Subject: Re: [PATCH] drm/msm: Reject MAP_NULL op if no PRR

Hi,

This fixes the GPU faults and hangs I was seeing on sc7180.

Tested-by: Valentine Burley <valentine.burley@...labora.com>

Thanks!
Valentine

 ---- On Thu, 23 Oct 2025 00:20:51 +0200  Rob Clark <robin.clark@....qualcomm.com> wrote --- 
 > We need PRR support in order to implement MAP_NULL.  Userspace shouldn't
 > be trying to use this if it is unsupported.
 > 
 > Reported-by: Valentine Burley <valentine.burley@...labora.com>
 > Link: https://gitlab.freedesktop.org/mesa/mesa/-/merge_requests/37935#note_3153730
 > Signed-off-by: Rob Clark <robin.clark@....qualcomm.com>
 > ---
 >  drivers/gpu/drm/msm/adreno/adreno_gpu.c |  7 -------
 >  drivers/gpu/drm/msm/msm_gem_vma.c       |  6 ++++++
 >  drivers/gpu/drm/msm/msm_gpu.h           | 11 +++++++++++
 >  3 files changed, 17 insertions(+), 7 deletions(-)
 > 
 > diff --git a/drivers/gpu/drm/msm/adreno/adreno_gpu.c b/drivers/gpu/drm/msm/adreno/adreno_gpu.c
 > index 19181b6fddfd..f93eee67240d 100644
 > --- a/drivers/gpu/drm/msm/adreno/adreno_gpu.c
 > +++ b/drivers/gpu/drm/msm/adreno/adreno_gpu.c
 > @@ -365,13 +365,6 @@ int adreno_fault_handler(struct msm_gpu *gpu, unsigned long iova, int flags,
 >      return 0;
 >  }
 >  
 > -static bool
 > -adreno_smmu_has_prr(struct msm_gpu *gpu)
 > -{
 > -    struct adreno_smmu_priv *adreno_smmu = dev_get_drvdata(&gpu->pdev->dev);
 > -    return adreno_smmu && adreno_smmu->set_prr_addr;
 > -}
 > -
 >  int adreno_get_param(struct msm_gpu *gpu, struct msm_context *ctx,
 >               uint32_t param, uint64_t *value, uint32_t *len)
 >  {
 > diff --git a/drivers/gpu/drm/msm/msm_gem_vma.c b/drivers/gpu/drm/msm/msm_gem_vma.c
 > index 90712586faac..96925a0f3965 100644
 > --- a/drivers/gpu/drm/msm/msm_gem_vma.c
 > +++ b/drivers/gpu/drm/msm/msm_gem_vma.c
 > @@ -964,6 +964,7 @@ static int
 >  lookup_op(struct msm_vm_bind_job *job, const struct drm_msm_vm_bind_op *op)
 >  {
 >      struct drm_device *dev = job->vm->drm;
 > +    struct msm_drm_private *priv = dev->dev_private;
 >      int i = job->nr_ops++;
 >      int ret = 0;
 >  
 > @@ -1010,6 +1011,11 @@ lookup_op(struct msm_vm_bind_job *job, const struct drm_msm_vm_bind_op *op)
 >          break;
 >      }
 >  
 > +    if ((op->op == MSM_VM_BIND_OP_MAP_NULL) &&
 > +        !adreno_smmu_has_prr(priv->gpu)) {
 > +        ret = UERR(EINVAL, dev, "PRR not supported\n");
 > +    }
 > +
 >      return ret;
 >  }
 >  
 > diff --git a/drivers/gpu/drm/msm/msm_gpu.h b/drivers/gpu/drm/msm/msm_gpu.h
 > index a597f2bee30b..2894fc118485 100644
 > --- a/drivers/gpu/drm/msm/msm_gpu.h
 > +++ b/drivers/gpu/drm/msm/msm_gpu.h
 > @@ -299,6 +299,17 @@ static inline struct msm_gpu *dev_to_gpu(struct device *dev)
 >      return container_of(adreno_smmu, struct msm_gpu, adreno_smmu);
 >  }
 >  
 > +static inline bool
 > +adreno_smmu_has_prr(struct msm_gpu *gpu)
 > +{
 > +    struct adreno_smmu_priv *adreno_smmu = dev_get_drvdata(&gpu->pdev->dev);
 > +
 > +    if (!adreno_smmu)
 > +        return false;
 > +
 > +    return adreno_smmu && adreno_smmu->set_prr_addr;
 > +}
 > +
 >  /* It turns out that all targets use the same ringbuffer size */
 >  #define MSM_GPU_RINGBUFFER_SZ SZ_32K
 >  #define MSM_GPU_RINGBUFFER_BLKSIZE 32
 > -- 
 > 2.51.0
 > 
 >