From 930002f1817b90911085193a9a6d371032c3ece5 Mon Sep 17 00:00:00 2001 From: Kishor Krishna Bhat Date: Thu, 20 Oct 2022 13:27:46 +0530 Subject: [PATCH 1/4] defconfig: msm: Enable dcc in sdm660 config Enable dcc configuration to parse dcc data in dumps to debug crashes. Change-Id: I954696d01ec05f74d6eb38758fc95b4395e7f855 Signed-off-by: Kishor Krishna Bhat --- arch/arm64/configs/vendor/sdm660_defconfig | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/arch/arm64/configs/vendor/sdm660_defconfig b/arch/arm64/configs/vendor/sdm660_defconfig index 4252f63d015c..7a00bc5fcc70 100644 --- a/arch/arm64/configs/vendor/sdm660_defconfig +++ b/arch/arm64/configs/vendor/sdm660_defconfig @@ -623,7 +623,6 @@ CONFIG_MSM_PIL=y CONFIG_MSM_SYSMON_QMI_COMM=y CONFIG_MSM_PIL_SSR_GENERIC=y CONFIG_MSM_BOOT_STATS=y -CONFIG_QCOM_DCC_V2=y CONFIG_QCOM_EUD=y CONFIG_QCOM_MINIDUMP=y CONFIG_MSM_CORE_HANG_DETECT=y @@ -644,6 +643,7 @@ CONFIG_QCOM_SMCINVOKE=y CONFIG_MSM_EVENT_TIMER=y CONFIG_MSM_PM=y CONFIG_QTI_L2_REUSE=y +CONFIG_QCOM_DCC=y CONFIG_QTI_RPM_STATS_LOG=y CONFIG_QTEE_SHM_BRIDGE=y CONFIG_MEM_SHARE_QMI_SERVICE=y From 2eb4c0dd21a13af7d68b445fc67ae694c04c8fd7 Mon Sep 17 00:00:00 2001 From: Vamsi Krishna Gattupalli Date: Thu, 16 Feb 2023 13:01:40 +0530 Subject: [PATCH 2/4] msm: adsprpc: Fix race condition in internal_control Protect add and update qos request with mutex to avoid race condition when multiple threads try to add or update request simultaneously. Change-Id: Id33b81bf85246ec69c72bad59cca068e627bb21d Acked-by: Anand Kulkarni Signed-off-by: Vamsi Krishna Gattupalli --- drivers/char/adsprpc.c | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/drivers/char/adsprpc.c b/drivers/char/adsprpc.c index 413614ac4b53..4ad460ce48f0 100644 --- a/drivers/char/adsprpc.c +++ b/drivers/char/adsprpc.c @@ -472,6 +472,7 @@ struct fastrpc_file { struct mutex perf_mutex; struct pm_qos_request pm_qos_req; int qos_request; + struct mutex pm_qos_mutex; struct mutex map_mutex; struct mutex internal_map_mutex; /* Identifies the device (MINOR_NUM_DEV / MINOR_NUM_SECURE_DEV) */ @@ -3859,6 +3860,7 @@ static int fastrpc_file_free(struct fastrpc_file *fl) mutex_destroy(&fl->perf_mutex); mutex_destroy(&fl->map_mutex); mutex_destroy(&fl->internal_map_mutex); + mutex_destroy(&fl->pm_qos_mutex); kfree(fl); return 0; } @@ -4232,6 +4234,7 @@ static int fastrpc_device_open(struct inode *inode, struct file *filp) hlist_add_head(&fl->hn, &me->drivers); spin_unlock(&me->hlock); mutex_init(&fl->perf_mutex); + mutex_init(&fl->pm_qos_mutex); init_completion(&fl->shutdown); return 0; } @@ -4359,12 +4362,14 @@ static int fastrpc_internal_control(struct fastrpc_file *fl, fl->pm_qos_req.type = PM_QOS_REQ_AFFINE_CORES; cpumask_copy(&fl->pm_qos_req.cpus_affine, &mask); + mutex_lock(&fl->pm_qos_mutex); if (!fl->qos_request) { pm_qos_add_request(&fl->pm_qos_req, PM_QOS_CPU_DMA_LATENCY, latency); fl->qos_request = 1; } else pm_qos_update_request(&fl->pm_qos_req, latency); + mutex_unlock(&fl->pm_qos_mutex); /* Ensure CPU feature map updated to DSP for early WakeUp */ fastrpc_send_cpuinfo_to_dsp(fl); From 9968fcdd9d1c853d0c6472307510a81f5db398da Mon Sep 17 00:00:00 2001 From: Kamal Agrawal Date: Mon, 13 Feb 2023 16:51:37 +0530 Subject: [PATCH 3/4] msm: kgsl: Make sure that pool pages don't have any extra references Before putting a page back in the pool be sure that it doesn't have any additional references that would be a signal that somebody else is looking at the page and that it would be a bad idea to keep it around and run the risk of accidentally handing it to a different process. Change-Id: Ic0dedbad0cf2ffb34b76ad23e393c5a911114b82 Signed-off-by: Jordan Crouse Signed-off-by: Kamal Agrawal --- drivers/gpu/msm/kgsl_pool.c | 10 ++++++++++ 1 file changed, 10 insertions(+) diff --git a/drivers/gpu/msm/kgsl_pool.c b/drivers/gpu/msm/kgsl_pool.c index ecb05b9b9a06..b5429cbb12ec 100644 --- a/drivers/gpu/msm/kgsl_pool.c +++ b/drivers/gpu/msm/kgsl_pool.c @@ -1,6 +1,7 @@ // SPDX-License-Identifier: GPL-2.0-only /* * Copyright (c) 2016-2021, The Linux Foundation. All rights reserved. + * Copyright (c) 2023 Qualcomm Innovation Center, Inc. All rights reserved. */ #include @@ -61,6 +62,15 @@ _kgsl_get_pool_from_order(unsigned int order) static void _kgsl_pool_add_page(struct kgsl_page_pool *pool, struct page *p) { + /* + * Sanity check to make sure we don't re-pool a page that + * somebody else has a reference to. + */ + if (WARN_ON_ONCE(unlikely(page_count(p) > 1))) { + __free_pages(p, pool->pool_order); + return; + } + kgsl_zero_page(p, pool->pool_order); spin_lock(&pool->list_lock); From 86695e1dd101e71571998281541b0b4378f89414 Mon Sep 17 00:00:00 2001 From: Puranam V G Tejaswi Date: Tue, 14 Feb 2023 16:09:02 +0530 Subject: [PATCH 4/4] msm: kgsl: Use dma_buf_get() to get dma_buf structure Currently we don't ensure if vma->vm_file is associated with dma_buf. This can cause issues later when private_data from a non dma_buf file is used as dma_buf structure. Hence get the fd that is associated with vma->vm_file and use dma_buf_get() to get pointer to dma_buf structure. dma_buf_get() ensures that the file from the input fd is associated with dma_buf. Change-Id: Ib78aef8b16bedca5ca86d3a132278ff9f07dce73 Signed-off-by: Puranam V G Tejaswi --- drivers/gpu/msm/kgsl.c | 41 +++++++++++++++++++++++++++++++++-------- 1 file changed, 33 insertions(+), 8 deletions(-) diff --git a/drivers/gpu/msm/kgsl.c b/drivers/gpu/msm/kgsl.c index 8e6bb0341cb5..f3c37d7a0670 100644 --- a/drivers/gpu/msm/kgsl.c +++ b/drivers/gpu/msm/kgsl.c @@ -1,7 +1,7 @@ // SPDX-License-Identifier: GPL-2.0-only /* * Copyright (c) 2008-2021, The Linux Foundation. All rights reserved. - * Copyright (c) 2022 Qualcomm Innovation Center, Inc. All rights reserved. + * Copyright (c) 2022-2023, Qualcomm Innovation Center, Inc. All rights reserved. */ #include @@ -2677,6 +2677,15 @@ static int kgsl_setup_anon_useraddr(struct kgsl_pagetable *pagetable, } #ifdef CONFIG_DMA_SHARED_BUFFER +static int match_file(const void *p, struct file *file, unsigned int fd) +{ + /* + * We must return fd + 1 because iterate_fd stops searching on + * non-zero return, but 0 is a valid fd. + */ + return (p == file) ? (fd + 1) : 0; +} + static void _setup_cache_mode(struct kgsl_mem_entry *entry, struct vm_area_struct *vma) { @@ -2714,6 +2723,8 @@ static int kgsl_setup_dmabuf_useraddr(struct kgsl_device *device, vma = find_vma(current->mm, hostptr); if (vma && vma->vm_file) { + int fd; + ret = check_vma_flags(vma, entry->memdesc.flags); if (ret) { up_read(¤t->mm->mmap_sem); @@ -2729,13 +2740,27 @@ static int kgsl_setup_dmabuf_useraddr(struct kgsl_device *device, return -EFAULT; } - /* - * Take a refcount because dma_buf_put() decrements the - * refcount - */ - get_file(vma->vm_file); - - dmabuf = vma->vm_file->private_data; + /* Look for the fd that matches this vma file */ + fd = iterate_fd(current->files, 0, match_file, vma->vm_file); + if (fd) { + dmabuf = dma_buf_get(fd - 1); + if (IS_ERR(dmabuf)) { + up_read(¤t->mm->mmap_sem); + return PTR_ERR(dmabuf); + } + /* + * It is possible that the fd obtained from iterate_fd + * was closed before passing the fd to dma_buf_get(). + * Hence dmabuf returned by dma_buf_get() could be + * different from vma->vm_file->private_data. Return + * failure if this happens. + */ + if (dmabuf != vma->vm_file->private_data) { + dma_buf_put(dmabuf); + up_read(¤t->mm->mmap_sem); + return -EBADF; + } + } } if (IS_ERR_OR_NULL(dmabuf)) {