1. 09 Mar, 2017 4 commits
    • Matthew Auld's avatar
      drm/i915/selftests: don't leak the gem object · a5dd8f5a
      Matthew Auld authored
      For our fake dma objects we can leak the underlying gem object if we
      fail to pin our "backing storage".
      
      [   39.952618] =============================================================================
      [   39.952625] BUG mock_object (Tainted: G     U         ): Objects remaining in mock_object on __kmem_cache_shutdown()
      [   39.952629] -----------------------------------------------------------------------------
      
      [   39.952633] Disabling lock debugging due to kernel taint
      [   39.952635] INFO: Slab 0xffffea00086c6a00 objects=21 used=1 fp=0xffff88021b1abc00 flags=0x5fff8000008100
      [   39.952640] CPU: 1 PID: 1258 Comm: drv_selftest Tainted: G    BU          4.10.0+ #46
      [   39.952641] Hardware name: Apple Inc. MacBookPro11,1/Mac-189A3D4F975D5FFC, BIOS MBP111.88Z.0138.B17.1602221718 02/22/2016
      [   39.952642] Call Trace:
      [   39.952648]  dump_stack+0x4d/0x6f
      [   39.952651]  slab_err+0x9d/0xb0
      [   39.952654]  ? ksm_migrate_page+0xe0/0xe0
      [   39.952657]  ? on_each_cpu_cond+0x9a/0xc0
      [   39.952658]  ? __kmalloc+0x1af/0x1c0
      [   39.952660]  ? __kmem_cache_shutdown+0x173/0x3e0
      [   39.952661]  __kmem_cache_shutdown+0x196/0x3e0
      [   39.952664]  kmem_cache_destroy+0xa0/0x150
      [   39.952708]  mock_device_release+0x113/0x140 [i915]
      [   39.952726]  drm_dev_release+0x20/0x40 [drm]
      [   39.952735]  drm_dev_unref+0x23/0x30 [drm]
      [   39.952768]  i915_gem_gtt_mock_selftests+0x55/0x70 [i915]
      [   39.952803]  __run_selftests+0x169/0x1c0 [i915]
      [   39.952805]  ? 0xffffffffa0151000
      [   39.952840]  i915_mock_selftests+0x30/0x60 [i915]
      [   39.952869]  i915_init+0xc/0x78 [i915]
      [   39.952870]  ? 0xffffffffa0151000
      [   39.952872]  do_one_initcall+0x43/0x170
      [   39.952874]  ? __vunmap+0x81/0xd0
      [   39.952875]  ? kmem_cache_alloc_trace+0x37/0x170
      [   39.952877]  ? do_init_module+0x27/0x1f8
      [   39.952879]  do_init_module+0x5f/0x1f8
      [   39.952881]  load_module+0x2423/0x29b0
      [   39.952882]  ? __symbol_put+0x40/0x40
      [   39.952885]  ? kernel_read_file+0x1a3/0x1c0
      [   39.952887]  SYSC_finit_module+0xbc/0xf0
      [   39.952889]  SyS_finit_module+0xe/0x10
      [   39.952892]  entry_SYSCALL_64_fastpath+0x13/0x94
      
      v2: use onion teardown and favour i915_gem_object_put
      
      Fixes: 8d28ba45 ("drm/i915: Exercise filling the top/bottom portions of the ppgtt")
      Signed-off-by: default avatarMatthew Auld <matthew.auld@intel.com>
      Cc: Chris Wilson <chris@chris-wilson.co.uk>
      Cc: Joonas Lahtinen <joonas.lahtinen@linux.intel.com>
      Reviewed-by: default avatarJoonas Lahtinen <joonas.lahtinen@linux.intel.com>
      Reviewed-by: default avatarChris Wilson <chris@chris-wilson.co.uk>
      Link: http://patchwork.freedesktop.org/patch/msgid/20170306235414.23407-2-matthew.auld@intel.comSigned-off-by: default avatarChris Wilson <chris@chris-wilson.co.uk>
      a5dd8f5a
    • Chris Wilson's avatar
      drm/i915/userptr: Disallow wrapping GTT into a userptr · 1c8782dd
      Chris Wilson authored
      If we allow the user to convert a GTT mmap address into a userptr, we
      may end up in recursion hell, where currently we hit a mutex deadlock
      but other possibilities include use-after-free during the
      unbind/cancel_userptr.
      
      [  143.203989] gem_userptr_bli D    0   902    898 0x00000000
      [  143.204054] Call Trace:
      [  143.204137]  __schedule+0x511/0x1180
      [  143.204195]  ? pci_mmcfg_check_reserved+0xc0/0xc0
      [  143.204274]  schedule+0x57/0xe0
      [  143.204327]  schedule_timeout+0x383/0x670
      [  143.204374]  ? trace_hardirqs_on_caller+0x187/0x280
      [  143.204457]  ? trace_hardirqs_on_thunk+0x1a/0x1c
      [  143.204507]  ? usleep_range+0x110/0x110
      [  143.204657]  ? irq_exit+0x89/0x100
      [  143.204710]  ? retint_kernel+0x2d/0x2d
      [  143.204794]  ? trace_hardirqs_on_caller+0x187/0x280
      [  143.204857]  ? _raw_spin_unlock_irq+0x33/0x60
      [  143.204944]  wait_for_common+0x1f0/0x2f0
      [  143.205006]  ? out_of_line_wait_on_atomic_t+0x170/0x170
      [  143.205103]  ? wake_up_q+0xa0/0xa0
      [  143.205159]  ? flush_workqueue_prep_pwqs+0x15a/0x2c0
      [  143.205237]  wait_for_completion+0x1d/0x20
      [  143.205292]  flush_workqueue+0x2e9/0xbb0
      [  143.205339]  ? flush_workqueue+0x163/0xbb0
      [  143.205418]  ? __schedule+0x533/0x1180
      [  143.205498]  ? check_flush_dependency+0x1a0/0x1a0
      [  143.205681]  i915_gem_userptr_mn_invalidate_range_start+0x1c7/0x270 [i915]
      [  143.205865]  ? i915_gem_userptr_dmabuf_export+0x40/0x40 [i915]
      [  143.205955]  __mmu_notifier_invalidate_range_start+0xc6/0x120
      [  143.206044]  ? __mmu_notifier_invalidate_range_start+0x51/0x120
      [  143.206123]  zap_page_range_single+0x1c7/0x1f0
      [  143.206171]  ? unmap_single_vma+0x160/0x160
      [  143.206260]  ? unmap_mapping_range+0xa9/0x1b0
      [  143.206308]  ? vma_interval_tree_subtree_search+0x75/0xd0
      [  143.206397]  unmap_mapping_range+0x18f/0x1b0
      [  143.206444]  ? zap_vma_ptes+0x70/0x70
      [  143.206524]  ? __pm_runtime_resume+0x67/0xa0
      [  143.206723]  i915_gem_release_mmap+0x1ba/0x1c0 [i915]
      [  143.206846]  i915_vma_unbind+0x5c2/0x690 [i915]
      [  143.206925]  ? __lock_is_held+0x52/0x100
      [  143.207076]  i915_gem_object_set_tiling+0x1db/0x650 [i915]
      [  143.207236]  i915_gem_set_tiling_ioctl+0x1d3/0x3b0 [i915]
      [  143.207377]  ? i915_gem_set_tiling_ioctl+0x5/0x3b0 [i915]
      [  143.207457]  drm_ioctl+0x36c/0x670
      [  143.207535]  ? debug_lockdep_rcu_enabled.part.0+0x1a/0x30
      [  143.207730]  ? i915_gem_object_set_tiling+0x650/0x650 [i915]
      [  143.207793]  ? drm_getunique+0x120/0x120
      [  143.207875]  ? __handle_mm_fault+0x996/0x14a0
      [  143.207939]  ? vm_insert_page+0x340/0x340
      [  143.208028]  ? up_write+0x28/0x50
      [  143.208086]  ? vm_mmap_pgoff+0x160/0x190
      [  143.208163]  do_vfs_ioctl+0x12c/0xa60
      [  143.208218]  ? debug_lockdep_rcu_enabled+0x35/0x40
      [  143.208267]  ? ioctl_preallocate+0x150/0x150
      [  143.208353]  ? __do_page_fault+0x36a/0x6e0
      [  143.208400]  ? mark_held_locks+0x23/0xc0
      [  143.208479]  ? up_read+0x1f/0x40
      [  143.208526]  ? entry_SYSCALL_64_fastpath+0x5/0xc6
      [  143.208669]  ? __fget_light+0xa7/0xc0
      [  143.208747]  SyS_ioctl+0x41/0x70
      
      To prevent the possibility of a deadlock, we defer scheduling the worker
      until after we have proven that given the current mm, the userptr range
      does not overlap a GGTT mmaping. If another thread tries to remap the
      GGTT over the userptr before the worker is scheduled, it will be stopped
      by its invalidate-range flushing the current work, before the deadlock
      can occur.
      
      v2: Improve discussion of how we end up in the deadlock.
      v3: Don't forget to mark the userptr as active after a successful
      gup_fast. Rename overlaps_ggtt to noncontiguous_or_overlaps_ggtt.
      v4: Fix test ordering between invalid GTT mmaping and range completion
      (Tvrtko)
      Reported-by: default avatarMichał Winiarski <michal.winiarski@intel.com>
      Testcase: igt/gem_userptr_blits/map-fixed-invalidate-gup
      Signed-off-by: default avatarChris Wilson <chris@chris-wilson.co.uk>
      Cc: Michał Winiarski <michal.winiarski@intel.com>
      Cc: Tvrtko Ursulin <tvrtko.ursulin@intel.com>
      Link: http://patchwork.freedesktop.org/patch/msgid/20170308215903.24171-1-chris@chris-wilson.co.ukReviewed-by: default avatarTvrtko Ursulin <tvrtko.ursulin@intel.com>
      1c8782dd
    • Chris Wilson's avatar
      drm/i915/userptr: Only flush the workqueue if required · d151e9ce
      Chris Wilson authored
      To avoid waiting for work from other invalidate-range threads where
      not required, only wait on the userptr cancel workqueue if we have added
      some work to it.
      Signed-off-by: default avatarChris Wilson <chris@chris-wilson.co.uk>
      Cc: Michał Winiarski <michal.winiarski@intel.com>
      Cc: Tvrtko Ursulin <tvrtko.ursulin@intel.com>
      Link: http://patchwork.freedesktop.org/patch/msgid/20170307205851.32578-2-chris@chris-wilson.co.ukReviewed-by: default avatarMichał Winiarski <michal.winiarski@intel.com>
      Reviewed-by: default avatarTvrtko Ursulin <tvrtko.ursulin@intel.com>
      d151e9ce
    • Chris Wilson's avatar
      drm/i915/userptr: Deactivate a failed userptr if the worker reports an EFAULT · 42953b3c
      Chris Wilson authored
      If the worker fails, it no longer has pages to release and can be
      immediately removed from the invalidate-tree.
      Signed-off-by: default avatarChris Wilson <chris@chris-wilson.co.uk>
      Cc: Michał Winiarski <michal.winiarski@intel.com>
      Cc: Tvrtko Ursulin <tvrtko.ursulin@intel.com>
      Link: http://patchwork.freedesktop.org/patch/msgid/20170307205851.32578-1-chris@chris-wilson.co.ukReviewed-by: default avatarMichał Winiarski <michal.winiarski@intel.com>
      Reviewed-by: default avatarTvrtko Ursulin <tvrtko.ursulin@intel.com>
      42953b3c
  2. 08 Mar, 2017 19 commits
  3. 07 Mar, 2017 17 commits