1. 27 Nov, 2017 6 commits
  2. 26 Nov, 2017 1 commit
    • Chris Wilson's avatar
      drm/i915/fbdev: Serialise early hotplug events with async fbdev config · ad88d7fc
      Chris Wilson authored
      As both the hotplug event and fbdev configuration run asynchronously, it
      is possible for them to run concurrently. If configuration fails, we were
      freeing the fbdev causing a use-after-free in the hotplug event.
      
      <7>[ 3069.935211] [drm:intel_fb_initial_config [i915]] Not using firmware configuration
      <7>[ 3069.935225] [drm:drm_setup_crtcs] looking for cmdline mode on connector 77
      <7>[ 3069.935229] [drm:drm_setup_crtcs] looking for preferred mode on connector 77 0
      <7>[ 3069.935233] [drm:drm_setup_crtcs] found mode 3200x1800
      <7>[ 3069.935236] [drm:drm_setup_crtcs] picking CRTCs for 8192x8192 config
      <7>[ 3069.935253] [drm:drm_setup_crtcs] desired mode 3200x1800 set on crtc 43 (0,0)
      <7>[ 3069.935323] [drm:intelfb_create [i915]] no BIOS fb, allocating a new one
      <4>[ 3069.967737] general protection fault: 0000 [#1] PREEMPT SMP
      <0>[ 3069.977453] ---------------------------------
      <4>[ 3069.977457] Modules linked in: i915(+) vgem snd_hda_codec_hdmi snd_hda_codec_realtek snd_hda_codec_generic x86_pkg_temp_thermal intel_powerclamp coretemp crct10dif_pclmul crc32_pclmul ghash_clmulni_intel snd_hda_codec snd_hwdep snd_hda_core snd_pcm r8169 mei_me mii prime_numbers mei i2c_hid pinctrl_geminilake pinctrl_intel [last unloaded: i915]
      <4>[ 3069.977492] CPU: 1 PID: 15414 Comm: kworker/1:0 Tainted: G     U          4.14.0-CI-CI_DRM_3388+ #1
      <4>[ 3069.977497] Hardware name: Intel Corp. Geminilake/GLK RVP1 DDR4 (05), BIOS GELKRVPA.X64.0062.B30.1708222146 08/22/2017
      <4>[ 3069.977508] Workqueue: events output_poll_execute
      <4>[ 3069.977512] task: ffff880177734e40 task.stack: ffffc90001fe4000
      <4>[ 3069.977519] RIP: 0010:__lock_acquire+0x109/0x1b60
      <4>[ 3069.977523] RSP: 0018:ffffc90001fe7bb0 EFLAGS: 00010002
      <4>[ 3069.977526] RAX: 6b6b6b6b6b6b6b6b RBX: 0000000000000282 RCX: 0000000000000000
      <4>[ 3069.977530] RDX: 0000000000000000 RSI: 0000000000000000 RDI: ffff880170d4efd0
      <4>[ 3069.977534] RBP: ffffc90001fe7c70 R08: 0000000000000001 R09: 0000000000000000
      <4>[ 3069.977538] R10: 0000000000000000 R11: ffffffff81899609 R12: ffff880170d4efd0
      <4>[ 3069.977542] R13: ffff880177734e40 R14: 0000000000000001 R15: 0000000000000000
      <4>[ 3069.977547] FS:  0000000000000000(0000) GS:ffff88017fc80000(0000) knlGS:0000000000000000
      <4>[ 3069.977551] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
      <4>[ 3069.977555] CR2: 00007f7e8b7bcf04 CR3: 0000000003e0f000 CR4: 00000000003406e0
      <4>[ 3069.977559] Call Trace:
      <4>[ 3069.977565]  ? mark_held_locks+0x64/0x90
      <4>[ 3069.977571]  ? _raw_spin_unlock_irq+0x24/0x50
      <4>[ 3069.977575]  ? _raw_spin_unlock_irq+0x24/0x50
      <4>[ 3069.977579]  ? trace_hardirqs_on_caller+0xde/0x1c0
      <4>[ 3069.977583]  ? _raw_spin_unlock_irq+0x2f/0x50
      <4>[ 3069.977588]  ? finish_task_switch+0xa5/0x210
      <4>[ 3069.977592]  ? lock_acquire+0xaf/0x200
      <4>[ 3069.977596]  lock_acquire+0xaf/0x200
      <4>[ 3069.977600]  ? __mutex_lock+0x5e9/0x9b0
      <4>[ 3069.977604]  _raw_spin_lock+0x2a/0x40
      <4>[ 3069.977608]  ? __mutex_lock+0x5e9/0x9b0
      <4>[ 3069.977612]  __mutex_lock+0x5e9/0x9b0
      <4>[ 3069.977616]  ? drm_fb_helper_hotplug_event.part.19+0x16/0xa0
      <4>[ 3069.977621]  ? drm_fb_helper_hotplug_event.part.19+0x16/0xa0
      <4>[ 3069.977625]  drm_fb_helper_hotplug_event.part.19+0x16/0xa0
      <4>[ 3069.977630]  output_poll_execute+0x8d/0x180
      <4>[ 3069.977635]  process_one_work+0x22e/0x660
      <4>[ 3069.977640]  worker_thread+0x48/0x3a0
      <4>[ 3069.977644]  ? _raw_spin_unlock_irqrestore+0x4c/0x60
      <4>[ 3069.977649]  kthread+0x102/0x140
      <4>[ 3069.977653]  ? process_one_work+0x660/0x660
      <4>[ 3069.977657]  ? kthread_create_on_node+0x40/0x40
      <4>[ 3069.977662]  ret_from_fork+0x27/0x40
      <4>[ 3069.977666] Code: 8d 62 f8 c3 49 81 3c 24 e0 fa 3c 82 41 be 00 00 00 00 45 0f 45 f0 83 fe 01 77 86 89 f0 49 8b 44 c4 08 48 85 c0 0f 84 76 ff ff ff <f0> ff 80 38 01 00 00 8b 1d 62 f9 e8 01 45 8b 85 b8 08 00 00 85
      <1>[ 3069.977707] RIP: __lock_acquire+0x109/0x1b60 RSP: ffffc90001fe7bb0
      <4>[ 3069.977712] ---[ end trace 4ad012eb3af62df7 ]---
      
      In order to keep the dev_priv->ifbdev alive after failure, we have to
      avoid the free and leave it empty until we unload the module (which is
      less than ideal, but a necessary evil for simplicity). Then we can use
      intel_fbdev_sync() to serialise the hotplug event with the configuration.
      The serialisation between the two was removed in commit 934458c2
      ("Revert "drm/i915: Fix races on fbdev""), but the use after free is much
      older, commit 366e39b4 ("drm/i915: Tear down fbdev if initialization
      fails")
      
      Fixes: 366e39b4 ("drm/i915: Tear down fbdev if initialization fails")
      Fixes: 934458c2 ("Revert "drm/i915: Fix races on fbdev"")
      Signed-off-by: default avatarChris Wilson <chris@chris-wilson.co.uk>
      Cc: Lukas Wunner <lukas@wunner.de>
      Cc: Joonas Lahtinen <joonas.lahtinen@linux.intel.com>
      Cc: Daniel Vetter <daniel.vetter@ffwll.ch>
      Cc: stable@vger.kernel.org
      Reviewed-by: default avatarLukas Wunner <lukas@wunner.de>
      Link: https://patchwork.freedesktop.org/patch/msgid/20171125194155.355-1-chris@chris-wilson.co.uk
      ad88d7fc
  3. 24 Nov, 2017 15 commits
  4. 23 Nov, 2017 10 commits
  5. 22 Nov, 2017 8 commits
    • Chris Wilson's avatar
      drm/i915: Call i915_gem_init_userptr() before taking struct_mutex · ee48700d
      Chris Wilson authored
      We don't need struct_mutex to initialise userptr (it just allocates a
      workqueue for itself etc), but we do need struct_mutex later on in
      i915_gem_init() in order to feed requests onto the HW.
      
      This should break the chain
      
      [  385.697902] ======================================================
      [  385.697907] WARNING: possible circular locking dependency detected
      [  385.697913] 4.14.0-CI-Patchwork_7234+ #1 Tainted: G     U
      [  385.697917] ------------------------------------------------------
      [  385.697922] perf_pmu/2631 is trying to acquire lock:
      [  385.697927]  (&mm->mmap_sem){++++}, at: [<ffffffff811bfe1e>] __might_fault+0x3e/0x90
      [  385.697941]
                     but task is already holding lock:
      [  385.697946]  (&cpuctx_mutex){+.+.}, at: [<ffffffff8116fe8c>] perf_event_ctx_lock_nested+0xbc/0x1d0
      [  385.697957]
                     which lock already depends on the new lock.
      
      [  385.697963]
                     the existing dependency chain (in reverse order) is:
      [  385.697970]
                     -> #4 (&cpuctx_mutex){+.+.}:
      [  385.697980]        __mutex_lock+0x86/0x9b0
      [  385.697985]        perf_event_init_cpu+0x5a/0x90
      [  385.697991]        perf_event_init+0x178/0x1a4
      [  385.697997]        start_kernel+0x27f/0x3f1
      [  385.698003]        verify_cpu+0x0/0xfb
      [  385.698006]
                     -> #3 (pmus_lock){+.+.}:
      [  385.698015]        __mutex_lock+0x86/0x9b0
      [  385.698020]        perf_event_init_cpu+0x21/0x90
      [  385.698025]        cpuhp_invoke_callback+0xca/0xc00
      [  385.698030]        _cpu_up+0xa7/0x170
      [  385.698035]        do_cpu_up+0x57/0x70
      [  385.698039]        smp_init+0x62/0xa6
      [  385.698044]        kernel_init_freeable+0x97/0x193
      [  385.698050]        kernel_init+0xa/0x100
      [  385.698055]        ret_from_fork+0x27/0x40
      [  385.698058]
                     -> #2 (cpu_hotplug_lock.rw_sem){++++}:
      [  385.698068]        cpus_read_lock+0x39/0xa0
      [  385.698073]        apply_workqueue_attrs+0x12/0x50
      [  385.698078]        __alloc_workqueue_key+0x1d8/0x4d8
      [  385.698134]        i915_gem_init_userptr+0x5f/0x80 [i915]
      [  385.698176]        i915_gem_init+0x7c/0x390 [i915]
      [  385.698213]        i915_driver_load+0x99e/0x15c0 [i915]
      [  385.698250]        i915_pci_probe+0x33/0x90 [i915]
      [  385.698256]        pci_device_probe+0xa1/0x130
      [  385.698262]        driver_probe_device+0x293/0x440
      [  385.698267]        __driver_attach+0xde/0xe0
      [  385.698272]        bus_for_each_dev+0x5c/0x90
      [  385.698277]        bus_add_driver+0x16d/0x260
      [  385.698282]        driver_register+0x57/0xc0
      [  385.698287]        do_one_initcall+0x3e/0x160
      [  385.698292]        do_init_module+0x5b/0x1fa
      [  385.698297]        load_module+0x2374/0x2dc0
      [  385.698302]        SyS_finit_module+0xaa/0xe0
      [  385.698307]        entry_SYSCALL_64_fastpath+0x1c/0xb1
      [  385.698311]
                     -> #1 (&dev->struct_mutex){+.+.}:
      [  385.698320]        __mutex_lock+0x86/0x9b0
      [  385.698361]        i915_mutex_lock_interruptible+0x4c/0x130 [i915]
      [  385.698403]        i915_gem_fault+0x206/0x760 [i915]
      [  385.698409]        __do_fault+0x1a/0x70
      [  385.698413]        __handle_mm_fault+0x7c4/0xdb0
      [  385.698417]        handle_mm_fault+0x154/0x300
      [  385.698440]        __do_page_fault+0x2d6/0x570
      [  385.698445]        page_fault+0x22/0x30
      [  385.698449]
                     -> #0 (&mm->mmap_sem){++++}:
      [  385.698459]        lock_acquire+0xaf/0x200
      [  385.698464]        __might_fault+0x68/0x90
      [  385.698470]        _copy_to_user+0x1e/0x70
      [  385.698475]        perf_read+0x1aa/0x290
      [  385.698480]        __vfs_read+0x23/0x120
      [  385.698484]        vfs_read+0xa3/0x150
      [  385.698488]        SyS_read+0x45/0xb0
      [  385.698493]        entry_SYSCALL_64_fastpath+0x1c/0xb1
      [  385.698497]
                     other info that might help us debug this:
      
      [  385.698505] Chain exists of:
                       &mm->mmap_sem --> pmus_lock --> &cpuctx_mutex
      
      [  385.698517]  Possible unsafe locking scenario:
      
      [  385.698522]        CPU0                    CPU1
      [  385.698526]        ----                    ----
      [  385.698529]   lock(&cpuctx_mutex);
      [  385.698553]                                lock(pmus_lock);
      [  385.698558]                                lock(&cpuctx_mutex);
      [  385.698564]   lock(&mm->mmap_sem);
      [  385.698568]
                      *** DEADLOCK ***
      
      [  385.698574] 1 lock held by perf_pmu/2631:
      [  385.698578]  #0:  (&cpuctx_mutex){+.+.}, at: [<ffffffff8116fe8c>] perf_event_ctx_lock_nested+0xbc/0x1d0
      [  385.698589]
                     stack backtrace:
      [  385.698595] CPU: 3 PID: 2631 Comm: perf_pmu Tainted: G     U          4.14.0-CI-Patchwork_7234+ #1
      [  385.698602] Hardware name:                  /NUC6CAYB, BIOS AYAPLCEL.86A.0040.2017.0619.1722 06/19/2017
      [  385.698609] Call Trace:
      [  385.698615]  dump_stack+0x5f/0x86
      [  385.698621]  print_circular_bug.isra.18+0x1d0/0x2c0
      [  385.698627]  __lock_acquire+0x19c3/0x1b60
      [  385.698634]  ? generic_exec_single+0x77/0xe0
      [  385.698640]  ? lock_acquire+0xaf/0x200
      [  385.698644]  lock_acquire+0xaf/0x200
      [  385.698650]  ? __might_fault+0x3e/0x90
      [  385.698655]  __might_fault+0x68/0x90
      [  385.698660]  ? __might_fault+0x3e/0x90
      [  385.698665]  _copy_to_user+0x1e/0x70
      [  385.698670]  perf_read+0x1aa/0x290
      [  385.698675]  __vfs_read+0x23/0x120
      [  385.698682]  ? __fget+0x101/0x1f0
      [  385.698686]  vfs_read+0xa3/0x150
      [  385.698691]  SyS_read+0x45/0xb0
      [  385.698696]  entry_SYSCALL_64_fastpath+0x1c/0xb1
      [  385.698701] RIP: 0033:0x7ff1c46876ed
      [  385.698705] RSP: 002b:00007fff13552f90 EFLAGS: 00000293 ORIG_RAX: 0000000000000000
      [  385.698712] RAX: ffffffffffffffda RBX: ffffc90000647ff0 RCX: 00007ff1c46876ed
      [  385.698718] RDX: 0000000000000010 RSI: 00007fff13552fa0 RDI: 0000000000000005
      [  385.698723] RBP: 000056063d300580 R08: 0000000000000000 R09: 0000000000000060
      [  385.698729] R10: 0000000000000000 R11: 0000000000000293 R12: 0000000000000046
      [  385.698734] R13: 00007fff13552c6f R14: 00007ff1c6279d00 R15: 00007ff1c6279a40
      
      Testcase: igt/perf_pmu
      Signed-off-by: default avatarChris Wilson <chris@chris-wilson.co.uk>
      Cc: Tvrtko Ursulin <tvrtko.ursulin@intel.com>
      Link: https://patchwork.freedesktop.org/patch/msgid/20171122172621.16158-1-chris@chris-wilson.co.ukReviewed-by: default avatarTvrtko Ursulin <tvrtko.ursulin@intel.com>
      ee48700d
    • Chris Wilson's avatar
      drm/i915: Remove success dmesg noise for intel_rotate_pages() · 62d0fe45
      Chris Wilson authored
      During selftesting intel_rotate_pages() is very, very verbose without
      giving us any information. Suppress the noise.
      Signed-off-by: default avatarChris Wilson <chris@chris-wilson.co.uk>
      Cc: Tvrtko Ursulin <tvrtko.ursulin@intel.com>
      Link: https://patchwork.freedesktop.org/patch/msgid/20171122145646.1859-1-chris@chris-wilson.co.ukReviewed-by: default avatarTvrtko Ursulin <tvrtko.ursulin@intel.com>
      62d0fe45
    • Chris Wilson's avatar
      drm/i915/selftests: Use NOWARN for large allocations · c65c8b0f
      Chris Wilson authored
      We may try to do a large kmalloc for the permutation array, falling back
      to a smaller array/test if the first allocation fails. Since we are
      intentionally trying a large allocation which may fail, pass __GFP_NOWARN.
      
      Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=103842Signed-off-by: default avatarChris Wilson <chris@chris-wilson.co.uk>
      Cc: Matthew Auld <matthew.auld@intel.com>
      Link: https://patchwork.freedesktop.org/patch/msgid/20171122120600.27025-1-chris@chris-wilson.co.ukReviewed-by: default avatarMatthew Auld <matthew.auld@intel.com>
      c65c8b0f
    • Tvrtko Ursulin's avatar
      drm/i915/pmu: Add RC6 residency metrics · 6060b6ae
      Tvrtko Ursulin authored
      For clients like intel-gpu-overlay it is easier to read the
      counters via the perf API than having to parse sysfs.
      Signed-off-by: default avatarTvrtko Ursulin <tvrtko.ursulin@intel.com>
      Reviewed-by: default avatarChris Wilson <chris@chris-wilson.co.uk>
      Link: https://patchwork.freedesktop.org/patch/msgid/20171121181852.16128-9-tvrtko.ursulin@linux.intel.com
      6060b6ae
    • Tvrtko Ursulin's avatar
      drm/i915: Convert intel_rc6_residency_us to ns · 36cc8b96
      Tvrtko Ursulin authored
      Will be used for exposing the PMU counters.
      
      v2:
       * Move intel_runtime_pm_get/put to the callers. (Chris Wilson)
       * Restore full unit conversion precision.
      Signed-off-by: default avatarTvrtko Ursulin <tvrtko.ursulin@intel.com>
      Reviewed-by: default avatarChris Wilson <chris@chris-wilson.co.uk>
      Link: https://patchwork.freedesktop.org/patch/msgid/20171121181852.16128-8-tvrtko.ursulin@linux.intel.com
      36cc8b96
    • Tvrtko Ursulin's avatar
      drm/i915/pmu: Add interrupt count metric · 0cd4684d
      Tvrtko Ursulin authored
      For clients like intel-gpu-overlay it is easier to read the
      count via the perf API than having to parse /proc.
      Signed-off-by: default avatarTvrtko Ursulin <tvrtko.ursulin@intel.com>
      Reviewed-by: default avatarChris Wilson <chris@chris-wilson.co.uk>
      Link: https://patchwork.freedesktop.org/patch/msgid/20171121181852.16128-7-tvrtko.ursulin@linux.intel.com
      0cd4684d
    • Tvrtko Ursulin's avatar
      drm/i915/pmu: Wire up engine busy stats to PMU · b3add01e
      Tvrtko Ursulin authored
      We can use engine busy stats instead of the sampling timer for
      better accuracy.
      
      By doing this we replace the stohastic sampling with busyness
      metric derived directly from engine activity. This is context
      switch interrupt driven, so as accurate as we can get from
      software tracking.
      
      As a secondary benefit, we can also not run the sampling timer
      in cases only busyness metric is enabled.
      
      v2: Rebase.
      v3:
       * Rebase, comments.
       * Leave engine busyness controls out of workers.
      v4: Checkpatch cleanup.
      v5: Added comment to pmu_needs_timer change.
      v6:
       * Rebase.
       * Fix style of some comments. (Chris Wilson)
      v7: Rebase and commit message update. (Chris Wilson)
      v8: Add delayed stats disabling to improve accuracy in face of
          CPU hotplug events.
      v9: Rebase.
      v10: Rebase - i915_modparams.enable_execlists removal.
      Signed-off-by: default avatarTvrtko Ursulin <tvrtko.ursulin@intel.com>
      Reviewed-by: default avatarChris Wilson <chris@chris-wilson.co.uk>
      Link: https://patchwork.freedesktop.org/patch/msgid/20171121181852.16128-6-tvrtko.ursulin@linux.intel.com
      b3add01e
    • Tvrtko Ursulin's avatar
      drm/i915: Engine busy time tracking · 30e17b78
      Tvrtko Ursulin authored
      Track total time requests have been executing on the hardware.
      
      We add new kernel API to allow software tracking of time GPU
      engines are spending executing requests.
      
      Both per-engine and global API is added with the latter also
      being exported for use by external users.
      
      v2:
       * Squashed with the internal API.
       * Dropped static key.
       * Made per-engine.
       * Store time in monotonic ktime.
      
      v3: Moved stats clearing to disable.
      
      v4:
       * Comments.
       * Don't export the API just yet.
      
      v5: Whitespace cleanup.
      
      v6:
       * Rename ref to active.
       * Drop engine aggregate stats for now.
       * Account initial busy period after enabling stats.
      
      v7:
       * Rebase.
      
      v8:
       * Move context in notification after the notifier. (Chris Wilson)
      
      v9:
      
      In cases where stats tracking is getting disabled while there is
      an active context on an engine, add up the current value to the
      total. This also implies we don't clear the total when tracking
      is disabled any longer. There is no real need to do so because
      we define the stats as relative while enabled, meaning
      comparison between two samples while tracking is enabled is the
      valid usage. However, when busy stats will later be plugged into
      the perf PMU API, it is beneficial to not reset the total, since
      the PMU core likes to do some counter disable/enable cycles on
      startup, and while doing so during a single long context
      executing on an engine we would lose some accuracy and so make
      unit testing more difficult than needs to be.
      
      v10:
       * Fix accounting for preemption.
      
      v11:
       * Rebase for i915_modparams.enable_execlists removal.
      Signed-off-by: default avatarTvrtko Ursulin <tvrtko.ursulin@intel.com>
      Reviewed-by: default avatarChris Wilson <chris@chris-wilson.co.uk>
      Link: https://patchwork.freedesktop.org/patch/msgid/20171121181852.16128-5-tvrtko.ursulin@linux.intel.com
      30e17b78