[PATCH] drm/msm: Reject MAP_NULL op if no PRR

[PATCH] drm/msm: Reject MAP_NULL op if no PRR

[Rob Clark]

We need PRR support in order to implement MAP_NULL.  Userspace shouldn't
be trying to use this if it is unsupported.

Reported-by: Valentine Burley <valentine.burley@collabora.com>
Link: https://gitlab.freedesktop.org/mesa/mesa/-/merge_requests/37935#note_3153730
Signed-off-by: Rob Clark <robin.clark@oss.qualcomm.com>
---
 drivers/gpu/drm/msm/adreno/adreno_gpu.c |  7 -------
 drivers/gpu/drm/msm/msm_gem_vma.c       |  6 ++++++
 drivers/gpu/drm/msm/msm_gpu.h           | 11 +++++++++++
 3 files changed, 17 insertions(+), 7 deletions(-)

diff --git a/drivers/gpu/drm/msm/adreno/adreno_gpu.c b/drivers/gpu/drm/msm/adreno/adreno_gpu.c
index 19181b6fddfd..f93eee67240d 100644
--- a/drivers/gpu/drm/msm/adreno/adreno_gpu.c
+++ b/drivers/gpu/drm/msm/adreno/adreno_gpu.c
@@ -365,13 +365,6 @@ int adreno_fault_handler(struct msm_gpu *gpu, unsigned long iova, int flags,
 	return 0;
 }
 
-static bool
-adreno_smmu_has_prr(struct msm_gpu *gpu)
-{
-	struct adreno_smmu_priv *adreno_smmu = dev_get_drvdata(&gpu->pdev->dev);
-	return adreno_smmu && adreno_smmu->set_prr_addr;
-}
-
 int adreno_get_param(struct msm_gpu *gpu, struct msm_context *ctx,
 		     uint32_t param, uint64_t *value, uint32_t *len)
 {
diff --git a/drivers/gpu/drm/msm/msm_gem_vma.c b/drivers/gpu/drm/msm/msm_gem_vma.c
index 90712586faac..96925a0f3965 100644
--- a/drivers/gpu/drm/msm/msm_gem_vma.c
+++ b/drivers/gpu/drm/msm/msm_gem_vma.c
@@ -964,6 +964,7 @@ static int
 lookup_op(struct msm_vm_bind_job *job, const struct drm_msm_vm_bind_op *op)
 {
 	struct drm_device *dev = job->vm->drm;
+	struct msm_drm_private *priv = dev->dev_private;
 	int i = job->nr_ops++;
 	int ret = 0;
 
@@ -1010,6 +1011,11 @@ lookup_op(struct msm_vm_bind_job *job, const struct drm_msm_vm_bind_op *op)
 		break;
 	}
 
+	if ((op->op == MSM_VM_BIND_OP_MAP_NULL) &&
+	    !adreno_smmu_has_prr(priv->gpu)) {
+		ret = UERR(EINVAL, dev, "PRR not supported\n");
+	}
+
 	return ret;
 }
 
diff --git a/drivers/gpu/drm/msm/msm_gpu.h b/drivers/gpu/drm/msm/msm_gpu.h
index a597f2bee30b..2894fc118485 100644
--- a/drivers/gpu/drm/msm/msm_gpu.h
+++ b/drivers/gpu/drm/msm/msm_gpu.h
@@ -299,6 +299,17 @@ static inline struct msm_gpu *dev_to_gpu(struct device *dev)
 	return container_of(adreno_smmu, struct msm_gpu, adreno_smmu);
 }
 
+static inline bool
+adreno_smmu_has_prr(struct msm_gpu *gpu)
+{
+	struct adreno_smmu_priv *adreno_smmu = dev_get_drvdata(&gpu->pdev->dev);
+
+	if (!adreno_smmu)
+		return false;
+
+	return adreno_smmu && adreno_smmu->set_prr_addr;
+}
+
 /* It turns out that all targets use the same ringbuffer size */
 #define MSM_GPU_RINGBUFFER_SZ SZ_32K
 #define MSM_GPU_RINGBUFFER_BLKSIZE 32
-- 
2.51.0

Re: [PATCH] drm/msm: Reject MAP_NULL op if no PRR

[Valentine Burley]

Hi,

This fixes the GPU faults and hangs I was seeing on sc7180.

Tested-by: Valentine Burley <valentine.burley@collabora.com>

Thanks!
Valentine

 ---- On Thu, 23 Oct 2025 00:20:51 +0200  Rob Clark <robin.clark@oss.qualcomm.com> wrote --- 
 > We need PRR support in order to implement MAP_NULL.  Userspace shouldn't
 > be trying to use this if it is unsupported.
 > 
 > Reported-by: Valentine Burley <valentine.burley@collabora.com>
 > Link: https://gitlab.freedesktop.org/mesa/mesa/-/merge_requests/37935#note_3153730
 > Signed-off-by: Rob Clark <robin.clark@oss.qualcomm.com>
 > ---
 >  drivers/gpu/drm/msm/adreno/adreno_gpu.c |  7 -------
 >  drivers/gpu/drm/msm/msm_gem_vma.c       |  6 ++++++
 >  drivers/gpu/drm/msm/msm_gpu.h           | 11 +++++++++++
 >  3 files changed, 17 insertions(+), 7 deletions(-)
 > 
 > diff --git a/drivers/gpu/drm/msm/adreno/adreno_gpu.c b/drivers/gpu/drm/msm/adreno/adreno_gpu.c
 > index 19181b6fddfd..f93eee67240d 100644
 > --- a/drivers/gpu/drm/msm/adreno/adreno_gpu.c
 > +++ b/drivers/gpu/drm/msm/adreno/adreno_gpu.c
 > @@ -365,13 +365,6 @@ int adreno_fault_handler(struct msm_gpu *gpu, unsigned long iova, int flags,
 >      return 0;
 >  }
 >  
 > -static bool
 > -adreno_smmu_has_prr(struct msm_gpu *gpu)
 > -{
 > -    struct adreno_smmu_priv *adreno_smmu = dev_get_drvdata(&gpu->pdev->dev);
 > -    return adreno_smmu && adreno_smmu->set_prr_addr;
 > -}
 > -
 >  int adreno_get_param(struct msm_gpu *gpu, struct msm_context *ctx,
 >               uint32_t param, uint64_t *value, uint32_t *len)
 >  {
 > diff --git a/drivers/gpu/drm/msm/msm_gem_vma.c b/drivers/gpu/drm/msm/msm_gem_vma.c
 > index 90712586faac..96925a0f3965 100644
 > --- a/drivers/gpu/drm/msm/msm_gem_vma.c
 > +++ b/drivers/gpu/drm/msm/msm_gem_vma.c
 > @@ -964,6 +964,7 @@ static int
 >  lookup_op(struct msm_vm_bind_job *job, const struct drm_msm_vm_bind_op *op)
 >  {
 >      struct drm_device *dev = job->vm->drm;
 > +    struct msm_drm_private *priv = dev->dev_private;
 >      int i = job->nr_ops++;
 >      int ret = 0;
 >  
 > @@ -1010,6 +1011,11 @@ lookup_op(struct msm_vm_bind_job *job, const struct drm_msm_vm_bind_op *op)
 >          break;
 >      }
 >  
 > +    if ((op->op == MSM_VM_BIND_OP_MAP_NULL) &&
 > +        !adreno_smmu_has_prr(priv->gpu)) {
 > +        ret = UERR(EINVAL, dev, "PRR not supported\n");
 > +    }
 > +
 >      return ret;
 >  }
 >  
 > diff --git a/drivers/gpu/drm/msm/msm_gpu.h b/drivers/gpu/drm/msm/msm_gpu.h
 > index a597f2bee30b..2894fc118485 100644
 > --- a/drivers/gpu/drm/msm/msm_gpu.h
 > +++ b/drivers/gpu/drm/msm/msm_gpu.h
 > @@ -299,6 +299,17 @@ static inline struct msm_gpu *dev_to_gpu(struct device *dev)
 >      return container_of(adreno_smmu, struct msm_gpu, adreno_smmu);
 >  }
 >  
 > +static inline bool
 > +adreno_smmu_has_prr(struct msm_gpu *gpu)
 > +{
 > +    struct adreno_smmu_priv *adreno_smmu = dev_get_drvdata(&gpu->pdev->dev);
 > +
 > +    if (!adreno_smmu)
 > +        return false;
 > +
 > +    return adreno_smmu && adreno_smmu->set_prr_addr;
 > +}
 > +
 >  /* It turns out that all targets use the same ringbuffer size */
 >  #define MSM_GPU_RINGBUFFER_SZ SZ_32K
 >  #define MSM_GPU_RINGBUFFER_BLKSIZE 32
 > -- 
 > 2.51.0
 > 
 >