From patchwork Wed May 13 18:15:56 2020 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Sultan Alsawaf X-Patchwork-Id: 1289598 Return-Path: X-Original-To: incoming@patchwork.ozlabs.org Delivered-To: patchwork-incoming@bilbo.ozlabs.org Authentication-Results: ozlabs.org; spf=none (no SPF record) smtp.mailfrom=lists.ubuntu.com (client-ip=91.189.94.19; helo=huckleberry.canonical.com; envelope-from=kernel-team-bounces@lists.ubuntu.com; receiver=) Authentication-Results: ozlabs.org; dmarc=fail (p=none dis=none) header.from=canonical.com Received: from huckleberry.canonical.com (huckleberry.canonical.com [91.189.94.19]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ozlabs.org (Postfix) with ESMTPS id 49MjXm31QXz9sSW; Thu, 14 May 2020 04:16:08 +1000 (AEST) Received: from localhost ([127.0.0.1] helo=huckleberry.canonical.com) by huckleberry.canonical.com with esmtp (Exim 4.86_2) (envelope-from ) id 1jYvvI-0006a6-DP; Wed, 13 May 2020 18:16:04 +0000 Received: from youngberry.canonical.com ([91.189.89.112]) by huckleberry.canonical.com with esmtps (TLS1.2:ECDHE_RSA_AES_128_GCM_SHA256:128) (Exim 4.86_2) (envelope-from ) id 1jYvvG-0006ZP-Pw for kernel-team@lists.ubuntu.com; Wed, 13 May 2020 18:16:02 +0000 Received: from mail-pl1-f200.google.com ([209.85.214.200]) by youngberry.canonical.com with esmtps (TLS1.2:ECDHE_RSA_AES_128_GCM_SHA256:128) (Exim 4.86_2) (envelope-from ) id 1jYvvG-0000MN-At for kernel-team@lists.ubuntu.com; Wed, 13 May 2020 18:16:02 +0000 Received: by mail-pl1-f200.google.com with SMTP id g9so347618plm.1 for ; Wed, 13 May 2020 11:16:02 -0700 (PDT) X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:to:subject:date:message-id:in-reply-to :references:mime-version:content-transfer-encoding; bh=3TB/uBZ7mDanBJAz7jupHPAqDTUUGgWPWA/6LQLtxmU=; b=TlQDDpvpBfHTpzD+qfysB90iTvDI8XUy6PIUqrvwW/fslj7Q2Vzd5zvk1nmo6wwInq cDkXgPlyRDB/FSbVIbAc5Ho2p27svnrREJOJjWusx2Ot0rBi0I1w5TOLXfx9BfqVbU6B jR8qspEREaenJKQZ1qY69usaDlT95d2UOfGvSruxg3jBunLqUJmfnruLsxx7GRdjW6+C 0rAGZZoq+COw5I4SJhDTHxHgm2l+icf4v0c1C1pjw5cxIK15Bh1t8AtnK0f6sIPSp1zT telr/WFKnANUvUBJh4smsPSpTSQUNXl1zqoK8cKxbH53GCrPixRdsyEdQUAnN20Wf5Gh cjyA== X-Gm-Message-State: AGi0PuacaOiNXkzFzEqDAynzvBv5NTvSn53lkQdzkc8LcBSr4XeMoMpQ CGSsBBScLcLBHJEZv/oHCFozjUF6+cR6n0fVW47hbBZ5niMDD/IHpzOBGIhX7b988s9BEyeTj1y +Mctb7/to9JqPLgTxuy7U4RJKwvA5uRsbPYHRWWZY9w== X-Received: by 2002:a17:90a:714c:: with SMTP id g12mr36885182pjs.31.1589393760710; Wed, 13 May 2020 11:16:00 -0700 (PDT) X-Google-Smtp-Source: APiQypIZ0fDUyfhtLsOGAgS0QFcPy4mG8QQAB1FLgbADZH6yYWqvwP/aqYaLe3Z1dMzodtlWr65DMA== X-Received: by 2002:a17:90a:714c:: with SMTP id g12mr36885155pjs.31.1589393760440; Wed, 13 May 2020 11:16:00 -0700 (PDT) Received: from sultan-box.conference (static-198-54-129-52.cust.tzulo.com. [198.54.129.52]) by smtp.gmail.com with ESMTPSA id a136sm202548pfa.99.2020.05.13.11.15.59 for (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Wed, 13 May 2020 11:15:59 -0700 (PDT) From: Sultan Alsawaf To: kernel-team@lists.ubuntu.com Subject: [PATCH 1/2] Revert "UBUNTU: SAUCE: drm/i915: Synchronize active and retire callbacks" Date: Wed, 13 May 2020 11:15:56 -0700 Message-Id: <20200513181557.15970-2-sultan.alsawaf@canonical.com> X-Mailer: git-send-email 2.20.1 In-Reply-To: <20200513181557.15970-1-sultan.alsawaf@canonical.com> References: <20200513181557.15970-1-sultan.alsawaf@canonical.com> MIME-Version: 1.0 X-BeenThere: kernel-team@lists.ubuntu.com X-Mailman-Version: 2.1.20 Precedence: list List-Id: Kernel team discussions List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: kernel-team-bounces@lists.ubuntu.com Sender: "kernel-team" BugLink: https://bugs.launchpad.net/bugs/1877394 This reverts commit 26178734ddf4c4517108ce6ef1e7620cc43aa336. Get rid of this so it can be replaced by an upstream fix. Signed-off-by: Sultan Alsawaf --- drivers/gpu/drm/i915/i915_active.c | 48 ++++-------------------- drivers/gpu/drm/i915/i915_active.h | 10 +++-- drivers/gpu/drm/i915/i915_active_types.h | 3 -- 3 files changed, 13 insertions(+), 48 deletions(-) diff --git a/drivers/gpu/drm/i915/i915_active.c b/drivers/gpu/drm/i915/i915_active.c index d0df1e0881c2..51dc8753b527 100644 --- a/drivers/gpu/drm/i915/i915_active.c +++ b/drivers/gpu/drm/i915/i915_active.c @@ -149,22 +149,8 @@ __active_retire(struct i915_active *ref, bool lock) } /* After the final retire, the entire struct may be freed */ - if (ref->retire) { - if (ref->active) { - bool freed = false; - - /* Don't race with the active callback, and avoid UaF */ - down_write(&ref->rwsem); - ref->freed = &freed; - ref->retire(ref); - if (!freed) { - ref->freed = NULL; - up_write(&ref->rwsem); - } - } else { - ref->retire(ref); - } - } + if (ref->retire) + ref->retire(ref); } static void @@ -255,8 +241,7 @@ void __i915_active_init(struct drm_i915_private *i915, struct i915_active *ref, int (*active)(struct i915_active *ref), void (*retire)(struct i915_active *ref), - struct lock_class_key *key, - struct lock_class_key *rkey) + struct lock_class_key *key) { debug_active_init(ref); @@ -269,9 +254,6 @@ void __i915_active_init(struct drm_i915_private *i915, init_llist_head(&ref->preallocated_barriers); atomic_set(&ref->count, 0); __mutex_init(&ref->mutex, "i915_active", key); - ref->freed = NULL; - if (ref->active && ref->retire) - __init_rwsem(&ref->rwsem, "i915_active.rwsem", rkey); } static bool ____active_del_barrier(struct i915_active *ref, @@ -375,20 +357,8 @@ int i915_active_acquire(struct i915_active *ref) if (err) return err; - if (!atomic_read(&ref->count) && ref->active) { - if (ref->retire) { - /* - * This can be a recursive call, and the mutex above - * already protects from concurrent active callbacks, so - * a read lock fits best. - */ - down_read(&ref->rwsem); - err = ref->active(ref); - up_read(&ref->rwsem); - } else { - err = ref->active(ref); - } - } + if (!atomic_read(&ref->count) && ref->active) + err = ref->active(ref); if (!err) { debug_active_activate(ref); atomic_inc(&ref->count); @@ -512,19 +482,15 @@ int i915_request_await_active(struct i915_request *rq, struct i915_active *ref) return err; } +#if IS_ENABLED(CONFIG_DRM_I915_DEBUG_GEM) void i915_active_fini(struct i915_active *ref) { - if (ref->freed) { - *ref->freed = true; - up_write(&ref->rwsem); - } -#if IS_ENABLED(CONFIG_DRM_I915_DEBUG_GEM) debug_active_fini(ref); GEM_BUG_ON(!RB_EMPTY_ROOT(&ref->tree)); GEM_BUG_ON(atomic_read(&ref->count)); mutex_destroy(&ref->mutex); -#endif } +#endif static inline bool is_idle_barrier(struct active_node *node, u64 idx) { diff --git a/drivers/gpu/drm/i915/i915_active.h b/drivers/gpu/drm/i915/i915_active.h index aaec0a773551..0ad7ef60d15f 100644 --- a/drivers/gpu/drm/i915/i915_active.h +++ b/drivers/gpu/drm/i915/i915_active.h @@ -362,13 +362,11 @@ void __i915_active_init(struct drm_i915_private *i915, struct i915_active *ref, int (*active)(struct i915_active *ref), void (*retire)(struct i915_active *ref), - struct lock_class_key *key, - struct lock_class_key *rkey); + struct lock_class_key *key); #define i915_active_init(i915, ref, active, retire) do { \ static struct lock_class_key __key; \ - static struct lock_class_key __rkey; \ \ - __i915_active_init(i915, ref, active, retire, &__key, &__rkey); \ + __i915_active_init(i915, ref, active, retire, &__key); \ } while (0) int i915_active_ref(struct i915_active *ref, @@ -395,7 +393,11 @@ i915_active_is_idle(const struct i915_active *ref) return !atomic_read(&ref->count); } +#if IS_ENABLED(CONFIG_DRM_I915_DEBUG_GEM) void i915_active_fini(struct i915_active *ref); +#else +static inline void i915_active_fini(struct i915_active *ref) { } +#endif int i915_active_acquire_preallocate_barrier(struct i915_active *ref, struct intel_engine_cs *engine); diff --git a/drivers/gpu/drm/i915/i915_active_types.h b/drivers/gpu/drm/i915/i915_active_types.h index 6619342eaa0d..1854e7d168c1 100644 --- a/drivers/gpu/drm/i915/i915_active_types.h +++ b/drivers/gpu/drm/i915/i915_active_types.h @@ -12,7 +12,6 @@ #include #include #include -#include struct drm_i915_private; struct i915_active_request; @@ -51,8 +50,6 @@ struct i915_active { struct rb_root tree; struct mutex mutex; atomic_t count; - struct rw_semaphore rwsem; - bool *freed; unsigned long flags; #define I915_ACTIVE_GRAB_BIT 0 From patchwork Wed May 13 18:15:57 2020 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Sultan Alsawaf X-Patchwork-Id: 1289600 Return-Path: X-Original-To: incoming@patchwork.ozlabs.org Delivered-To: patchwork-incoming@bilbo.ozlabs.org Authentication-Results: ozlabs.org; spf=none (no SPF record) smtp.mailfrom=lists.ubuntu.com (client-ip=91.189.94.19; helo=huckleberry.canonical.com; envelope-from=kernel-team-bounces@lists.ubuntu.com; receiver=) Authentication-Results: ozlabs.org; dmarc=fail (p=none dis=none) header.from=canonical.com Received: from huckleberry.canonical.com (huckleberry.canonical.com [91.189.94.19]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ozlabs.org (Postfix) with ESMTPS id 49MjXm5FRQz9sSf; Thu, 14 May 2020 04:16:08 +1000 (AEST) Received: from localhost ([127.0.0.1] helo=huckleberry.canonical.com) by huckleberry.canonical.com with esmtp (Exim 4.86_2) (envelope-from ) id 1jYvvJ-0006ao-Lb; Wed, 13 May 2020 18:16:05 +0000 Received: from youngberry.canonical.com ([91.189.89.112]) by huckleberry.canonical.com with esmtps (TLS1.2:ECDHE_RSA_AES_128_GCM_SHA256:128) (Exim 4.86_2) (envelope-from ) id 1jYvvH-0006Zn-TM for kernel-team@lists.ubuntu.com; Wed, 13 May 2020 18:16:03 +0000 Received: from mail-pj1-f71.google.com ([209.85.216.71]) by youngberry.canonical.com with esmtps (TLS1.2:ECDHE_RSA_AES_128_GCM_SHA256:128) (Exim 4.86_2) (envelope-from ) id 1jYvvH-0000MP-GB for kernel-team@lists.ubuntu.com; Wed, 13 May 2020 18:16:03 +0000 Received: by mail-pj1-f71.google.com with SMTP id 9so24177764pjz.6 for ; Wed, 13 May 2020 11:16:03 -0700 (PDT) X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:to:subject:date:message-id:in-reply-to :references:mime-version:content-transfer-encoding; bh=WgopuAR4+JLz4+i9F1ZxXJERCZ+ArTv5KhAdyhwoVT8=; b=EOGoon91uinXUdZX1R9Pv1B2ozkt96Vn1k7r/4ajZ8YKwRI87vhsI7zwtTViachnWR 5X/JykqIIJ+Hh1TKZNrwh0/3HXP4zvsTix8RTpTSOUokjwcpx3An5qOEqBkarL044dwr MMUxfbcBKf/O8zRqGrdx0IQZvMAlj8jDcYw0siiLWptx17ZV8kwsGS13KdoWpOWXehKC lWuc2uQ0F5GNEaSaKwAvq1k7spYEcRtpa4fUD+qqiaSdYAyW/tYuzatgN3sry+7CXQ4u 0s6yC2kkF9AC3X8uKd4/Zg8QLMR3Lzr54a04SbWQ5MChww5azAbIWdn/jial2jIWA6i0 O/VA== X-Gm-Message-State: AOAM530x6HRZZvZ30J2E4A1xvCZD1jufyZDoNomQOdM7o3WLT7Q5DveP FPA6hoEnMvhNzfse0vFDbp6vgUwO8hw3e8FkEVxzwjt/ss03EkN4iSBNeZuCMy3C2z7NMR3PVLC euYYWCgCZ2/biDaJ3ZhmZvdO5A5zUEwG6D8R7JVQnxg== X-Received: by 2002:a63:4926:: with SMTP id w38mr568635pga.222.1589393761902; Wed, 13 May 2020 11:16:01 -0700 (PDT) X-Google-Smtp-Source: ABdhPJxdf9go6xVObSdjZe97WWx2JbmH5zf2+EJ3Jv3yus45/WvNJzSYdYObON/35C1BpE9iOg3Vkw== X-Received: by 2002:a63:4926:: with SMTP id w38mr568605pga.222.1589393761599; Wed, 13 May 2020 11:16:01 -0700 (PDT) Received: from sultan-box.conference (static-198-54-129-52.cust.tzulo.com. [198.54.129.52]) by smtp.gmail.com with ESMTPSA id a136sm202548pfa.99.2020.05.13.11.16.00 for (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Wed, 13 May 2020 11:16:01 -0700 (PDT) From: Sultan Alsawaf To: kernel-team@lists.ubuntu.com Subject: [PATCH 2/2] drm/i915/gt: Make intel_ring_unpin() safe for concurrent pint Date: Wed, 13 May 2020 11:15:57 -0700 Message-Id: <20200513181557.15970-3-sultan.alsawaf@canonical.com> X-Mailer: git-send-email 2.20.1 In-Reply-To: <20200513181557.15970-1-sultan.alsawaf@canonical.com> References: <20200513181557.15970-1-sultan.alsawaf@canonical.com> MIME-Version: 1.0 X-BeenThere: kernel-team@lists.ubuntu.com X-Mailman-Version: 2.1.20 Precedence: list List-Id: Kernel team discussions List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: kernel-team-bounces@lists.ubuntu.com Sender: "kernel-team" From: Chris Wilson BugLink: https://bugs.launchpad.net/bugs/1877394 In order to avoid some nasty mutex inversions, commit 09c5ab384f6f ("drm/i915: Keep rings pinned while the context is active") allowed the intel_ring unpinning to be run concurrently with the next context pinning it. Thus each step in intel_ring_unpin() needed to be atomic and ordered in a nice onion with intel_ring_pin() so that the lifetimes overlapped and were always safe. Sadly, a few steps in intel_ring_unpin() were overlooked, such as closing the read/write pointers of the ring and discarding the intel_ring.vaddr, as these steps were not serialised with intel_ring_pin() and so could leave the ring in disarray. Fixes: 09c5ab384f6f ("drm/i915: Keep rings pinned while the context is active") Signed-off-by: Chris Wilson Cc: Mika Kuoppala Cc: Tvrtko Ursulin Reviewed-by: Tvrtko Ursulin Link: https://patchwork.freedesktop.org/patch/msgid/20191118230254.2615942-6-chris@chris-wilson.co.uk (backported from commit a266bf42006004306dd48a9082c35dfbff153307) Signed-off-by: Sultan Alsawaf --- drivers/gpu/drm/i915/gt/intel_ringbuffer.c | 13 ++++--------- 1 file changed, 4 insertions(+), 9 deletions(-) diff --git a/drivers/gpu/drm/i915/gt/intel_ringbuffer.c b/drivers/gpu/drm/i915/gt/intel_ringbuffer.c index aeaf9986697b..daa144b890f8 100644 --- a/drivers/gpu/drm/i915/gt/intel_ringbuffer.c +++ b/drivers/gpu/drm/i915/gt/intel_ringbuffer.c @@ -1220,9 +1220,10 @@ int intel_ring_pin(struct intel_ring *ring) i915_vma_make_unshrinkable(vma); - GEM_BUG_ON(ring->vaddr); - ring->vaddr = addr; + /* Discard any unused bytes beyond that submitted to hw. */ + intel_ring_reset(ring, ring->emit); + ring->vaddr = addr; return 0; err_ring: @@ -1248,20 +1249,14 @@ void intel_ring_unpin(struct intel_ring *ring) if (!atomic_dec_and_test(&ring->pin_count)) return; - /* Discard any unused bytes beyond that submitted to hw. */ - intel_ring_reset(ring, ring->emit); - i915_vma_unset_ggtt_write(vma); if (i915_vma_is_map_and_fenceable(vma)) i915_vma_unpin_iomap(vma); else i915_gem_object_unpin_map(vma->obj); - GEM_BUG_ON(!ring->vaddr); - ring->vaddr = NULL; - - i915_vma_unpin(vma); i915_vma_make_purgeable(vma); + i915_vma_unpin(vma); } static struct i915_vma *create_ring_vma(struct i915_ggtt *ggtt, int size)