linux-next.git/drivers/gpu/drm/v3d/v3d_submit.c, branch master

BackMerge tag 'v7.2' into drm-next

2026-08-20T00:58:44+00:00

Linux 7.2 There was a lot of conflicts this round between fixes and next, and I'd like to get the merge resolutions that we have in drm-tip. Signed-off-by: Dave Airlie

drm/v3d: Associate BOs with every job that accesses them

2026-07-18T13:28:44+00:00

A submission can expand into a chain of jobs (e.g. bin + render + cache clean). Implicit synchronization in v3d_submit_lock_reservations() is gated on each job's bo[], but the BO list was only ever attached to the last job of the chain. When that last job is a trailing CACHE_CLEAN job, the job that actually consumes the BOs (that is, a RENDER or CSD job) was left with bo_count == 0 and picked up no implicit dependencies. It could therefore be dispatched to the hardware and read a BO while another context was still writing it, leading to data corruption. Attach the BOs to the job that consumes them, so (1) it acquires the correct implicit dependencies during reservation locking and (2) they are kept mapped until the end of the submission. Give it references to all consuming job's BOs through v3d_job_reference_bos() instead of looking the handles up a second time; that avoids a redundant lookup and guarantees both jobs reference the exact same objects. As the CACHE_CLEAN job now carries a BO array as well, add a per-job `has_implicit_dep` flag so that only the consuming jobs take implicit dependencies. The CACHE_CLEAN job (a global flush) and the BIN job (binning waiting on another context is not a realistic scenario) are excluded. Fixes: dffa9b7a78c4 ("drm/v3d: Add missing implicit synchronization.") Reviewed-by: Iago Toral Quiroga Link: https://patch.msgid.link/20260710114734.2731000-1-mcanal@igalia.com Signed-off-by: Maíra Canal

drm/v3d: bound CPU-job query writes to their destination BO

2026-07-08T12:15:42+00:00

The V3D_SUBMIT_CPU CPU jobs take user-supplied offsets and indices and consume them at exec time without checking that the accesses stay inside their BO: - TIMESTAMP_QUERY and RESET_TIMESTAMP_QUERY write one u64 per query into bo[0] at a fully user-controlled per-query offset. - COPY_TIMESTAMP_QUERY copies one u64 per query into bo[0] at offset + i * stride, and reads each result from a user-controlled offset in the source bo[1]. - COPY_PERFORMANCE_QUERY writes nperfmons * DRM_V3D_MAX_PERF_COUNTERS counter slots plus an availability slot into bo[0] at the same geometry. - INDIRECT_CSD reads three u32 work-group counts from bo[0] at a user-controlled offset, then writes each count back into the indirect BO at a user-controlled u32 index (wg_uniform_offsets[]). A render-node user (DRM_RENDER_ALLOW, no master, no capability) can make the handlers read or write past a BO's vmap mapping. Validate the full access extent against the BO size once the BOs are looked up, before the job is queued, rejecting out-of-range geometry with -EINVAL. The copy extent offset + (count - 1) * stride + write_size is computed in u64, mirroring the u8 * pointer arithmetic in the executors: (count - 1) * stride is a u32 * u32 product that is exact in u64, so one overflow check on the total guards the bound. The performance slot count and the bare timestamp, copy-source and indirect offsets are computed in u64 the same way, so a user value cannot wrap the comparison. Fixes: 18b8413b25b7 ("drm/v3d: Create a CPU job extension for a indirect CSD job") Fixes: 9ba0ff3e083f ("drm/v3d: Create a CPU job extension for the timestamp query job") Fixes: 34a101e64296 ("drm/v3d: Create a CPU job extension for the reset timestamp job") Fixes: 6745f3e44a20 ("drm/v3d: Create a CPU job extension to copy timestamp query to a buffer") Fixes: 209e8d2695ee ("drm/v3d: Create a CPU job extension for the copy performance query job") Assisted-by: Claude:claude-opus-4-8 Signed-off-by: Michael Bommarito Reviewed-by: Maíra Canal Signed-off-by: Maíra Canal Link: https://patch.msgid.link/20260707221334.3854433-1-michael.bommarito@gmail.com

drm/v3d: Reject invalid indirect BO handle in indirect CSD setup

2026-07-07T21:52:13+00:00

v3d_get_cpu_indirect_csd_params() looks up the indirect buffer object from a userspace-supplied handle but never checks the result. A bogus or stale handle makes drm_gem_object_lookup() return NULL, which is then stored in info->indirect and only dereferenced later when the indirect CSD job runs, turning a userspace mistake into a NULL pointer dereference in the kernel. Bail out with -ENOENT as soon as the lookup fails, so the bad handle is rejected at submission time. Fixes: 18b8413b25b7 ("drm/v3d: Create a CPU job extension for a indirect CSD job") Reviewed-by: Iago Toral Quiroga Signed-off-by: Maíra Canal Link: https://patch.msgid.link/20260703-v3d-cpu-job-fixes-v3-2-bc51b1f3eeb5@igalia.com

drm/v3d: Serialize jobs across queues when a perfmon is attached

2026-07-07T19:58:46+00:00

A non-global perfmon is meant to count events generated by a specific submission, but the scheduler can run jobs from different queues concurrently on the same V3D core. Without explicit serialization, an unrelated job running in parallel with a perfmon-carrying job pollutes the counters and generates unusable results. To address such issue, we must enforce cross-queue serialization when we detect a perfmon-carrying submission. It's possible to implement serialization by enforcing two rules: 1. A job that carries a non-global perfmon must wait for every job currently in-flight across all HW queues to finish. 2. While a perfmon-carrying job is still in-flight, all subsequently submitted jobs must wait for it. Note that serialization is not needed in the global perfmon case, as the global perfmon tracks activity from all jobs, so concurrency is desirable. Therefore, check if serialization is needed during job submission and if so, attach fence dependences to enforce cross-queue serialization. Reviewed-by: Iago Toral Quiroga Link: https://patch.msgid.link/20260706-v3d-perfmon-lifetime-v4-2-d7b312ff2c83@igalia.com Signed-off-by: Maíra Canal

drm/v3d: Refactor perfmon locking

2026-07-07T19:58:46+00:00

v3d exposes a single set of performance counters per core, so at any moment at most one performance monitor can be programmed in HW. In software, this singleton is represented by v3d_dev->active_perfmon, but until now nothing actually serialized access to it: scheduler callbacks, the GPU-reset path, and perfmon ioctls all read and wrote that field lock-free. The existence of v3d_perfmon->lock mutex did not close the gap. It serialized start/stop of *one* perfmon object against itself, but the invariant that needs protection is device-wide: there can be exactly one active perfmon at any moment in HW. Two threads acting on different perfmon objects could race through v3d_dev->active_perfmon and the counter registers, leaving software and HW out of sync. This commit moves the locking to where the invariant actually lives. Group the active perfmon pointer with a device-wide spinlock and route every state transition (job start, job completion, set global, reset, suspend/resume, destruction) through a small set of locked entry points that are the only mutators of the HW counters. Some design improvements needed to be made for the refactor: 1. Stop the perfmon from the IRQ handler at job-completion time (the natural boundary for "active perfmon follows the active job"). This required a change from a mutex to a spinlock. This solves another issue of the existing design: perfmon start/stop was exclusively attached to run_job() callbacks, which means that if nothing was further queued up, a perfmon would never actually be stopped. 2. Pause/resume the HW counters across runtime-PM transitions without dropping the software reference. This preserves the perfmon state while the device is idle. 3. Move the global perfmon lifecycle management to the set_global IOCTL. This simplifies the logic in v3d_perfmon_start() and v3d_perfmon_stop(), as there is no need to always check if the global perfmon is enabled. 4. v3d_perfmon_get_values_ioctl() doesn't stop the perfmon when capturing the values. All lifecycle management is handled by the job (for per-job perfmons) or the set_global IOCTL (for global perfmons). Reviewed-by: Iago Toral Quiroga Link: https://patch.msgid.link/20260706-v3d-perfmon-lifetime-v4-1-d7b312ff2c83@igalia.com Signed-off-by: Maíra Canal

drm/v3d: Ensure atomic submissions in v3d_submit_jobs()

2026-06-09T17:43:59+00:00

Currently, v3d_submit_jobs() arms and pushes each job one at a time, wiring dependencies between consecutive jobs after each push. If drm_sched_job_add_dependency() fails midway, the already-pushed jobs are scheduler-owned and will be submitted to the GPU for execution, even though the subsequent jobs won't be submitted. This breaks the atomicity of the submissions, as only some of the jobs from a submission would be submitted to the hardware, while the other part fails. Restructure v3d_submit_jobs() into three phases: (1) arm all jobs belonging to a given submission, (2) wire inter-job dependencies, and (3) push all jobs to the scheduler unconditionally. Phase (2) can fail; on failure, it marks every armed job finished fence with an error, so that run_job() callbacks skip hardware execution. This guarantees that every armed job is always pushed, either to run or to be skipped, and it also ensures the atomicity of a submission. Suggested-by: Tvrtko Ursulin Reviewed-by: Tvrtko Ursulin Link: https://patch.msgid.link/20260604-v3d-sched-misc-fixes-v4-12-c068f5bf5ccf@igalia.com Signed-off-by: Maíra Canal

drm/v3d: Reject invalid out_sync handles in submit ioctls

2026-06-09T17:43:59+00:00

v3d_submit_process_post_deps() looks up the out_sync syncobj via drm_syncobj_find(), and if userspace passes a non-zero handle that doesn't refer to a valid syncobj, the lookup silently returns NULL and the post-deps step skips publishing the submission's last fence to it. The ioctl still returns success, leaving userspace to wait on a invalid syncobj. Instead of silently ignoring an invalid non-zero out_sync, move the syncobj lookup to the submission and make it fail with -ENOENT up front, mirroring the syncobj validation already done for in_sync. Now, v3d_submit_process_post_deps() only does the fence replacement. Note that the lookup is skipped when the multi-sync extension is in use, since args->out_sync is unused in that case. To keep cleanup symmetric on error paths, convert the function v3d_put_multisync_post_deps() into a single function that releases the references that were acquired but never published for both single-sync and multi-sync. Suggested-by: Tvrtko Ursulin Reviewed-by: Tvrtko Ursulin Link: https://patch.msgid.link/20260604-v3d-sched-misc-fixes-v4-11-c068f5bf5ccf@igalia.com Signed-off-by: Maíra Canal

drm/v3d: Split BO fence attach from syncobj output handling

2026-06-09T17:43:58+00:00

v3d_attach_fences_and_unlock_reservation() does three different things: (1) attaches the submission's last fence to every BO, (2) releases drm_exec, and (3) replaces the userspace out_sync syncobjs. Decouple these three behaviors into different functions, so that each function has a more self-contained behavior. v3d_submit_jobs() now invokes the three steps explicitly, which makes the submission sequence self-documenting and keeps each helper self-contained. No functional change; just code consolidation. Reviewed-by: Tvrtko Ursulin Link: https://patch.msgid.link/20260604-v3d-sched-misc-fixes-v4-10-c068f5bf5ccf@igalia.com Signed-off-by: Maíra Canal

drm/v3d: Refactor CPU ioctl into unified submission chain

2026-06-09T17:43:58+00:00

Restructure the CPU ioctl so that all job types, including indirect CSD, use a single struct v3d_submit chain and a single DRM exec context. Now that v3d_get_cpu_indirect_csd_params() is a pure parser and the submit helpers operate on struct v3d_submit, fold the indirect CSD path into the standard flow by appending the CSD and CLEAN_CACHE jobs to the same struct v3d_submit as the CPU job and locking the union of all jobs' BOs under one drm_exec. This eliminates the second drm_exec, the nested submission, and the conditional two-pass fence attachment that the CPU ioctl previously required for the indirect CSD path. Reviewed-by: Tvrtko Ursulin Link: https://patch.msgid.link/20260604-v3d-sched-misc-fixes-v4-9-c068f5bf5ccf@igalia.com Signed-off-by: Maíra Canal