[PATCH 2/2] drm/msm/a7xx: Call CP_RESET_CONTEXT_STATE

[Connor Abbott]

On Thu, May 22, 2025 at 11:46 AM Konrad Dybcio
<konrad.dybcio at oss.qualcomm.com> wrote:
>
> On 5/21/25 12:28 AM, Connor Abbott wrote:
> > Calling this packet is necessary when we switch contexts because there
> > are various pieces of state used by userspace to synchronize between BR
> > and BV that are persistent across submits and we need to make sure that
> > they are in a "safe" state when switching contexts. Otherwise a
> > userspace submission in one context could cause another context to
> > function incorrectly and hang, effectively a denial of service (although
> > without leaking data). This was missed during initial a7xx bringup.
> >
> > Fixes: af66706accdf ("drm/msm/a6xx: Add skeleton A7xx support")
> > Signed-off-by: Connor Abbott <cwabbott0 at gmail.com>
> > ---
> >  drivers/gpu/drm/msm/adreno/a6xx_gpu.c | 14 ++++++++++++++
> >  1 file changed, 14 insertions(+)
> >
> > diff --git a/drivers/gpu/drm/msm/adreno/a6xx_gpu.c b/drivers/gpu/drm/msm/adreno/a6xx_gpu.c
> > index 06465bc2d0b4b128cddfcfcaf1fe4252632b6777..f776e9ce43a7cdbb4ef769606ec851909b0c4cdd 100644
> > --- a/drivers/gpu/drm/msm/adreno/a6xx_gpu.c
> > +++ b/drivers/gpu/drm/msm/adreno/a6xx_gpu.c
> > @@ -130,6 +130,20 @@ static void a6xx_set_pagetable(struct a6xx_gpu *a6xx_gpu,
> >               OUT_RING(ring, lower_32_bits(rbmemptr(ring, fence)));
> >               OUT_RING(ring, upper_32_bits(rbmemptr(ring, fence)));
> >               OUT_RING(ring, submit->seqno - 1);
> > +
> > +             OUT_PKT7(ring, CP_THREAD_CONTROL, 1);
> > +             OUT_RING(ring, CP_SET_THREAD_BOTH);
>
> Downstream does CP_SYNC_THREADS | CP_SET_THREAD_BOTH, fwiw
>
> Konrad

Unfortunately the rest of the sequence downstream is slightly
different so I had to adapt this somewhat. Downstream does this as the
very first thing whereas we have a CP_SYNC_THREADS | CP_SET_THREAD_BR
beforehand so the threads are already synced, and there were a few
other minor differences iirc.

Connor

>
> > +
> > +             /* Reset state used to synchronize BR and BV */
> > +             OUT_PKT7(ring, CP_RESET_CONTEXT_STATE, 1);
> > +             OUT_RING(ring,
> > +                      CP_RESET_CONTEXT_STATE_0_CLEAR_ON_CHIP_TS |
> > +                      CP_RESET_CONTEXT_STATE_0_CLEAR_RESOURCE_TABLE |
> > +                      CP_RESET_CONTEXT_STATE_0_CLEAR_BV_BR_COUNTER |
> > +                      CP_RESET_CONTEXT_STATE_0_RESET_GLOBAL_LOCAL_TS);
> > +
> > +             OUT_PKT7(ring, CP_THREAD_CONTROL, 1);
> > +             OUT_RING(ring, CP_SET_THREAD_BR);
> >       }
> >
> >       if (!sysprof) {
> >