This patch set is to fix a bug in amdgpu that results in a crash when dma_map_sg combines segments. There are 2 shortfalls in the current kernel.
1) AMDGPU assumes that the requested and created segments from dma_map_sg are equal
2) drm_prime does not allow for setting the segment length via the correct dma macro
Shane Francis (2): drm/prime: correct logic for mapping sg to arrays drm/amdgpu: fix scatter-gather mapping with user pages
drivers/gpu/drm/amd/amdgpu/amdgpu_ttm.c | 7 +-- drivers/gpu/drm/drm_prime.c | 71 +++++++++++++++++++++---- include/drm/drm_prime.h | 5 ++ 3 files changed, 71 insertions(+), 12 deletions(-)
Previously drm_prime_sg_to_page_addr_arrays did not allow for scatter-gather tables where the length had been reduced in a dma_map.
This commit enables this via drm_prime_dma_sg_to_page_addr_arrays while still keeping the original logic in place for tables that that have not been through dma mapping
Signed-off-by: Shane Francis bigbeeshane@gmail.com --- drivers/gpu/drm/drm_prime.c | 71 ++++++++++++++++++++++++++++++++----- include/drm/drm_prime.h | 5 +++ 2 files changed, 67 insertions(+), 9 deletions(-)
diff --git a/drivers/gpu/drm/drm_prime.c b/drivers/gpu/drm/drm_prime.c index 86d9b0e45c8c..ed045043323e 100644 --- a/drivers/gpu/drm/drm_prime.c +++ b/drivers/gpu/drm/drm_prime.c @@ -943,21 +943,22 @@ struct drm_gem_object *drm_gem_prime_import(struct drm_device *dev, } EXPORT_SYMBOL(drm_gem_prime_import);
+ /** * drm_prime_sg_to_page_addr_arrays - convert an sg table into a page array * @sgt: scatter-gather table to convert * @pages: optional array of page pointers to store the page array in * @addrs: optional array to store the dma bus address of each page * @max_entries: size of both the passed-in arrays + * @sg_length: size of scatter-gather table + * @dma_mapped: if the supplied scatter-gather table has been dma mapped * - * Exports an sg table into an array of pages and addresses. This is currently - * required by the TTM driver in order to do correct fault handling. - * - * Drivers can use this in their &drm_driver.gem_prime_import_sg_table - * implementation. + * Used internally to dri for both drm_prime_sg_to_page_addr_arrays and + * drm_prime_dma_sg_to_page_addr_arrays */ -int drm_prime_sg_to_page_addr_arrays(struct sg_table *sgt, struct page **pages, - dma_addr_t *addrs, int max_entries) +static int drm_prime_sg_to_arrays(struct sg_table *sgt, struct page **pages, + dma_addr_t *addrs, int max_entries, + unsigned sg_length, bool dma_mapped) { unsigned count; struct scatterlist *sg; @@ -966,8 +967,11 @@ int drm_prime_sg_to_page_addr_arrays(struct sg_table *sgt, struct page **pages, dma_addr_t addr;
index = 0; - for_each_sg(sgt->sgl, sg, sgt->nents, count) { - len = sg->length; + for_each_sg(sgt->sgl, sg, sg_length, count) { + if (!dma_mapped) + len = sg->length; + else + len = sg_dma_len(sg); page = sg_page(sg); addr = sg_dma_address(sg);
@@ -987,8 +991,57 @@ int drm_prime_sg_to_page_addr_arrays(struct sg_table *sgt, struct page **pages, } return 0; } + + +/** + * drm_prime_sg_to_page_addr_arrays - convert an sg table into a page array + * @sgt: scatter-gather table to convert + * @pages: optional array of page pointers to store the page array in + * @addrs: optional array to store the dma bus address of each page + * @max_entries: size of both the passed-in arrays + * + * Exports an sg table into an array of pages and addresses. This is currently + * required by the TTM driver in order to do correct fault handling. + * + * Used in instances when sgt->nents is the true length of the scatter-gather + * table + * + * Drivers can use this in their &drm_driver.gem_prime_import_sg_table + * implementation. + */ +int drm_prime_sg_to_page_addr_arrays(struct sg_table *sgt, struct page **pages, + dma_addr_t *addrs, int max_entries) +{ + return drm_prime_sg_to_arrays(sgt, pages, addrs, max_entries, sgt->nents, + false); +} EXPORT_SYMBOL(drm_prime_sg_to_page_addr_arrays);
+ +/** + * drm_prime_dma_sg_to_page_addr_arrays - convert an sg table into a page array + * @sgt: scatter-gather table to convert + * @pages: optional array of page pointers to store the page array in + * @addrs: optional array to store the dma bus address of each page + * @max_entries: size of both the passed-in arrays + * @sg_length: size of scatter-gather table (this has the potential to differ + * from sgt->nents due to dma_mapping) + * + * + * Used in instances when sgt->nents is not a valid length of the scatter-gather + * table + */ +int drm_prime_dma_sg_to_page_addr_arrays(struct sg_table *sgt, + struct page **pages, + dma_addr_t *addrs, int max_entries, + unsigned sg_length) +{ + return drm_prime_sg_to_arrays(sgt, pages, addrs, max_entries, sg_length, + true); +} +EXPORT_SYMBOL(drm_prime_dma_sg_to_page_addr_arrays); + + /** * drm_prime_gem_destroy - helper to clean up a PRIME-imported GEM object * @obj: GEM object which was created from a dma-buf diff --git a/include/drm/drm_prime.h b/include/drm/drm_prime.h index 9af7422b44cf..83fa7b28fc1f 100644 --- a/include/drm/drm_prime.h +++ b/include/drm/drm_prime.h @@ -104,5 +104,10 @@ void drm_prime_gem_destroy(struct drm_gem_object *obj, struct sg_table *sg); int drm_prime_sg_to_page_addr_arrays(struct sg_table *sgt, struct page **pages, dma_addr_t *addrs, int max_pages);
+int drm_prime_dma_sg_to_page_addr_arrays(struct sg_table *sgt, + struct page **pages, + dma_addr_t *addrs, int max_pages, + unsigned entries); +
#endif /* __DRM_PRIME_H__ */
Calls to dma_map_sg may return segments / entries than requested if they fall on page bounderies. The old implementation did not support this use case.
Signed-off-by: Shane Francis bigbeeshane@gmail.com --- drivers/gpu/drm/amd/amdgpu/amdgpu_ttm.c | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-)
diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_ttm.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_ttm.c index dee446278417..d07f143b50c3 100644 --- a/drivers/gpu/drm/amd/amdgpu/amdgpu_ttm.c +++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_ttm.c @@ -974,12 +974,13 @@ static int amdgpu_ttm_tt_pin_userptr(struct ttm_tt *ttm) /* Map SG to device */ r = -ENOMEM; nents = dma_map_sg(adev->dev, ttm->sg->sgl, ttm->sg->nents, direction); - if (nents != ttm->sg->nents) + if (nents == 0) goto release_sg;
/* convert SG to linear array of pages and dma addresses */ - drm_prime_sg_to_page_addr_arrays(ttm->sg, ttm->pages, - gtt->ttm.dma_address, ttm->num_pages); + drm_prime_dma_sg_to_page_addr_arrays(ttm->sg, ttm->pages, + gtt->ttm.dma_address, ttm->num_pages, + nents);
return 0;
On Mon, Mar 23, 2020 at 4:52 PM Shane Francis bigbeeshane@gmail.com wrote:
Calls to dma_map_sg may return segments / entries than requested if they fall on page bounderies. The old implementation did not support this use case.
Signed-off-by: Shane Francis bigbeeshane@gmail.com
Fixes: be62dbf554c5 ("iommu/amd: Convert AMD iommu driver to the dma-iommu api")
drivers/gpu/drm/amd/amdgpu/amdgpu_ttm.c | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-)
diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_ttm.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_ttm.c index dee446278417..d07f143b50c3 100644 --- a/drivers/gpu/drm/amd/amdgpu/amdgpu_ttm.c +++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_ttm.c @@ -974,12 +974,13 @@ static int amdgpu_ttm_tt_pin_userptr(struct ttm_tt *ttm) /* Map SG to device */ r = -ENOMEM; nents = dma_map_sg(adev->dev, ttm->sg->sgl, ttm->sg->nents, direction);
if (nents != ttm->sg->nents)
if (nents == 0) goto release_sg; /* convert SG to linear array of pages and dma addresses */
drm_prime_sg_to_page_addr_arrays(ttm->sg, ttm->pages,gtt->ttm.dma_address, ttm->num_pages);
drm_prime_dma_sg_to_page_addr_arrays(ttm->sg, ttm->pages,gtt->ttm.dma_address, ttm->num_pages,nents);
I think the other call to drm_prime_sg_to_page_addr_arrays in amdgpu needs a similar fix.
Alex
return 0;-- 2.26.0
I think the other call to drm_prime_sg_to_page_addr_arrays in amdgpu needs a similar fix.
Alex
Looking at the other call in amdgpu tmm it does not seem to undergo the segment remapping that happens in dma_map_sg, so should be safe.
I will port the changes to drm/radeon as that seems to use the same logic for user pages.
Regards : Shane Francis
This patch set is to fix a bug in amdgpu / radeon drm that results in a crash when dma_map_sg combines segments. There are 2 shortfalls in the current kernel.
1) AMDGPU / RADEON assumes that the requested and created segments from dma_map_sg are equal
2) drm_prime does not allow for setting the segment length via the correct dma macro
Shane Francis (3): drm/prime: correct logic for mapping sg to arrays drm/amdgpu: fix scatter-gather mapping with user pages drm/radeon: fix scatter-gather mapping with user pages
drivers/gpu/drm/amd/amdgpu/amdgpu_ttm.c | 7 +-- drivers/gpu/drm/drm_prime.c | 71 +++++++++++++++++++++---- drivers/gpu/drm/radeon/radeon_ttm.c | 7 +-- include/drm/drm_prime.h | 5 ++ 4 files changed, 75 insertions(+), 15 deletions(-)
Previously drm_prime_sg_to_page_addr_arrays did not allow for scatter-gather tables where the length had been reduced in a dma_map.
This commit enables this via drm_prime_dma_sg_to_page_addr_arrays while still keeping the original logic in place for tables that that have not been through dma mapping
Signed-off-by: Shane Francis bigbeeshane@gmail.com --- drivers/gpu/drm/drm_prime.c | 71 ++++++++++++++++++++++++++++++++----- include/drm/drm_prime.h | 5 +++ 2 files changed, 67 insertions(+), 9 deletions(-)
diff --git a/drivers/gpu/drm/drm_prime.c b/drivers/gpu/drm/drm_prime.c index 86d9b0e45c8c..ed045043323e 100644 --- a/drivers/gpu/drm/drm_prime.c +++ b/drivers/gpu/drm/drm_prime.c @@ -943,21 +943,22 @@ struct drm_gem_object *drm_gem_prime_import(struct drm_device *dev, } EXPORT_SYMBOL(drm_gem_prime_import);
+ /** * drm_prime_sg_to_page_addr_arrays - convert an sg table into a page array * @sgt: scatter-gather table to convert * @pages: optional array of page pointers to store the page array in * @addrs: optional array to store the dma bus address of each page * @max_entries: size of both the passed-in arrays + * @sg_length: size of scatter-gather table + * @dma_mapped: if the supplied scatter-gather table has been dma mapped * - * Exports an sg table into an array of pages and addresses. This is currently - * required by the TTM driver in order to do correct fault handling. - * - * Drivers can use this in their &drm_driver.gem_prime_import_sg_table - * implementation. + * Used internally to dri for both drm_prime_sg_to_page_addr_arrays and + * drm_prime_dma_sg_to_page_addr_arrays */ -int drm_prime_sg_to_page_addr_arrays(struct sg_table *sgt, struct page **pages, - dma_addr_t *addrs, int max_entries) +static int drm_prime_sg_to_arrays(struct sg_table *sgt, struct page **pages, + dma_addr_t *addrs, int max_entries, + unsigned sg_length, bool dma_mapped) { unsigned count; struct scatterlist *sg; @@ -966,8 +967,11 @@ int drm_prime_sg_to_page_addr_arrays(struct sg_table *sgt, struct page **pages, dma_addr_t addr;
index = 0; - for_each_sg(sgt->sgl, sg, sgt->nents, count) { - len = sg->length; + for_each_sg(sgt->sgl, sg, sg_length, count) { + if (!dma_mapped) + len = sg->length; + else + len = sg_dma_len(sg); page = sg_page(sg); addr = sg_dma_address(sg);
@@ -987,8 +991,57 @@ int drm_prime_sg_to_page_addr_arrays(struct sg_table *sgt, struct page **pages, } return 0; } + + +/** + * drm_prime_sg_to_page_addr_arrays - convert an sg table into a page array + * @sgt: scatter-gather table to convert + * @pages: optional array of page pointers to store the page array in + * @addrs: optional array to store the dma bus address of each page + * @max_entries: size of both the passed-in arrays + * + * Exports an sg table into an array of pages and addresses. This is currently + * required by the TTM driver in order to do correct fault handling. + * + * Used in instances when sgt->nents is the true length of the scatter-gather + * table + * + * Drivers can use this in their &drm_driver.gem_prime_import_sg_table + * implementation. + */ +int drm_prime_sg_to_page_addr_arrays(struct sg_table *sgt, struct page **pages, + dma_addr_t *addrs, int max_entries) +{ + return drm_prime_sg_to_arrays(sgt, pages, addrs, max_entries, sgt->nents, + false); +} EXPORT_SYMBOL(drm_prime_sg_to_page_addr_arrays);
+ +/** + * drm_prime_dma_sg_to_page_addr_arrays - convert an sg table into a page array + * @sgt: scatter-gather table to convert + * @pages: optional array of page pointers to store the page array in + * @addrs: optional array to store the dma bus address of each page + * @max_entries: size of both the passed-in arrays + * @sg_length: size of scatter-gather table (this has the potential to differ + * from sgt->nents due to dma_mapping) + * + * + * Used in instances when sgt->nents is not a valid length of the scatter-gather + * table + */ +int drm_prime_dma_sg_to_page_addr_arrays(struct sg_table *sgt, + struct page **pages, + dma_addr_t *addrs, int max_entries, + unsigned sg_length) +{ + return drm_prime_sg_to_arrays(sgt, pages, addrs, max_entries, sg_length, + true); +} +EXPORT_SYMBOL(drm_prime_dma_sg_to_page_addr_arrays); + + /** * drm_prime_gem_destroy - helper to clean up a PRIME-imported GEM object * @obj: GEM object which was created from a dma-buf diff --git a/include/drm/drm_prime.h b/include/drm/drm_prime.h index 9af7422b44cf..83fa7b28fc1f 100644 --- a/include/drm/drm_prime.h +++ b/include/drm/drm_prime.h @@ -104,5 +104,10 @@ void drm_prime_gem_destroy(struct drm_gem_object *obj, struct sg_table *sg); int drm_prime_sg_to_page_addr_arrays(struct sg_table *sgt, struct page **pages, dma_addr_t *addrs, int max_pages);
+int drm_prime_dma_sg_to_page_addr_arrays(struct sg_table *sgt, + struct page **pages, + dma_addr_t *addrs, int max_pages, + unsigned entries); +
#endif /* __DRM_PRIME_H__ */
Calls to dma_map_sg may return segments / entries than requested if they fall on page bounderies. The old implementation did not support this use case.
Signed-off-by: Shane Francis bigbeeshane@gmail.com --- drivers/gpu/drm/amd/amdgpu/amdgpu_ttm.c | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-)
diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_ttm.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_ttm.c index dee446278417..d07f143b50c3 100644 --- a/drivers/gpu/drm/amd/amdgpu/amdgpu_ttm.c +++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_ttm.c @@ -974,12 +974,13 @@ static int amdgpu_ttm_tt_pin_userptr(struct ttm_tt *ttm) /* Map SG to device */ r = -ENOMEM; nents = dma_map_sg(adev->dev, ttm->sg->sgl, ttm->sg->nents, direction); - if (nents != ttm->sg->nents) + if (nents == 0) goto release_sg;
/* convert SG to linear array of pages and dma addresses */ - drm_prime_sg_to_page_addr_arrays(ttm->sg, ttm->pages, - gtt->ttm.dma_address, ttm->num_pages); + drm_prime_dma_sg_to_page_addr_arrays(ttm->sg, ttm->pages, + gtt->ttm.dma_address, ttm->num_pages, + nents);
return 0;
Calls to dma_map_sg may return segments / entries than requested if they fall on page bounderies. The old implementation did not support this use case.
Signed-off-by: Shane Francis bigbeeshane@gmail.com --- drivers/gpu/drm/radeon/radeon_ttm.c | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-)
diff --git a/drivers/gpu/drm/radeon/radeon_ttm.c b/drivers/gpu/drm/radeon/radeon_ttm.c index 3b92311d30b9..e6003f701517 100644 --- a/drivers/gpu/drm/radeon/radeon_ttm.c +++ b/drivers/gpu/drm/radeon/radeon_ttm.c @@ -528,11 +528,12 @@ static int radeon_ttm_tt_pin_userptr(struct ttm_tt *ttm)
r = -ENOMEM; nents = dma_map_sg(rdev->dev, ttm->sg->sgl, ttm->sg->nents, direction); - if (nents != ttm->sg->nents) + if (nents == 0) goto release_sg;
- drm_prime_sg_to_page_addr_arrays(ttm->sg, ttm->pages, - gtt->ttm.dma_address, ttm->num_pages); + drm_prime_dma_sg_to_page_addr_arrays(ttm->sg, ttm->pages, + gtt->ttm.dma_address, ttm->num_pages, + nents);
return 0;
dri-devel@lists.freedesktop.org
-
Alex Deucher -
Shane Francis