On 21/06/2021 13:08, Tvrtko Ursulin wrote:
I had some questions on the trybot mailing list, let me copy&paste..
On 21/06/2021 12:41, Maarten Lankhorst wrote:
It doesn't work for legacy ring submission, and is in the best case
ignored.
Looks rejected instead of ignored:
static int set_ringsize(struct i915_gem_context *ctx,
struct drm_i915_gem_context_param *args)
{
if (!HAS_LOGICAL_RING_CONTEXTS(ctx->i915))
return -ENODEV;
In the worst case we end up freeing engine->legacy.ring for all other
active engines, resulting in a use-after-free.
Worst case is cloning because ring_context_alloc is not taking a
reference to engine->legacy.ring, or something else?
No can't be that, it was my incomplete analysis last week. Since
ring_context_destroy does not actually free the legacy ring I don't see
any use after free paths.
Regards,
Tvrtko
Signed-off-by: Maarten Lankhorst <maarten.lankhorst@xxxxxxxxxxxxxxx>
Fixes: 88be76cdafc7 ("drm/i915: Allow userspace to specify ringsize on
construction")
Cc: Chris Wilson <chris@xxxxxxxxxxxxxxxxxx>
---
drivers/gpu/drm/i915/gt/intel_context_param.c | 3 +++
1 file changed, 3 insertions(+)
diff --git a/drivers/gpu/drm/i915/gt/intel_context_param.c
b/drivers/gpu/drm/i915/gt/intel_context_param.c
index 65dcd090245d..412c36d1b1dd 100644
--- a/drivers/gpu/drm/i915/gt/intel_context_param.c
+++ b/drivers/gpu/drm/i915/gt/intel_context_param.c
@@ -12,6 +12,9 @@ int intel_context_set_ring_size(struct intel_context
*ce, long sz)
{
int err;
+ if (ce->engine->gt->submission_method == INTEL_SUBMISSION_RING)
+ return 0;
+
if (intel_context_lock_pinned(ce))
return -EINTR;
_______________________________________________
Intel-gfx mailing list
Intel-gfx@xxxxxxxxxxxxxxxxxxxxx
https://lists.freedesktop.org/mailman/listinfo/intel-gfx
_______________________________________________
Intel-gfx mailing list
Intel-gfx@xxxxxxxxxxxxxxxxxxxxx
https://lists.freedesktop.org/mailman/listinfo/intel-gfx
