1. 28 Nov, 2017 2 commits
  2. 27 Nov, 2017 7 commits
  3. 26 Nov, 2017 1 commit
    • Chris Wilson's avatar
      drm/i915/fbdev: Serialise early hotplug events with async fbdev config · ad88d7fc
      Chris Wilson authored
      As both the hotplug event and fbdev configuration run asynchronously, it
      is possible for them to run concurrently. If configuration fails, we were
      freeing the fbdev causing a use-after-free in the hotplug event.
      
      <7>[ 3069.935211] [drm:intel_fb_initial_config [i915]] Not using firmware configuration
      <7>[ 3069.935225] [drm:drm_setup_crtcs] looking for cmdline mode on connector 77
      <7>[ 3069.935229] [drm:drm_setup_crtcs] looking for preferred mode on connector 77 0
      <7>[ 3069.935233] [drm:drm_setup_crtcs] found mode 3200x1800
      <7>[ 3069.935236] [drm:drm_setup_crtcs] picking CRTCs for 8192x8192 config
      <7>[ 3069.935253] [drm:drm_setup_crtcs] desired mode 3200x1800 set on crtc 43 (0,0)
      <7>[ 3069.935323] [drm:intelfb_create [i915]] no BIOS fb, allocating a new one
      <4>[ 3069.967737] general protection fault: 0000 [#1] PREEMPT SMP
      <0>[ 3069.977453] ---------------------------------
      <4>[ 3069.977457] Modules linked in: i915(+) vgem snd_hda_codec_hdmi snd_hda_codec_realtek snd_hda_codec_generic x86_pkg_temp_thermal intel_powerclamp coretemp crct10dif_pclmul crc32_pclmul ghash_clmulni_intel snd_hda_codec snd_hwdep snd_hda_core snd_pcm r8169 mei_me mii prime_numbers mei i2c_hid pinctrl_geminilake pinctrl_intel [last unloaded: i915]
      <4>[ 3069.977492] CPU: 1 PID: 15414 Comm: kworker/1:0 Tainted: G     U          4.14.0-CI-CI_DRM_3388+ #1
      <4>[ 3069.977497] Hardware name: Intel Corp. Geminilake/GLK RVP1 DDR4 (05), BIOS GELKRVPA.X64.0062.B30.1708222146 08/22/2017
      <4>[ 3069.977508] Workqueue: events output_poll_execute
      <4>[ 3069.977512] task: ffff880177734e40 task.stack: ffffc90001fe4000
      <4>[ 3069.977519] RIP: 0010:__lock_acquire+0x109/0x1b60
      <4>[ 3069.977523] RSP: 0018:ffffc90001fe7bb0 EFLAGS: 00010002
      <4>[ 3069.977526] RAX: 6b6b6b6b6b6b6b6b RBX: 0000000000000282 RCX: 0000000000000000
      <4>[ 3069.977530] RDX: 0000000000000000 RSI: 0000000000000000 RDI: ffff880170d4efd0
      <4>[ 3069.977534] RBP: ffffc90001fe7c70 R08: 0000000000000001 R09: 0000000000000000
      <4>[ 3069.977538] R10: 0000000000000000 R11: ffffffff81899609 R12: ffff880170d4efd0
      <4>[ 3069.977542] R13: ffff880177734e40 R14: 0000000000000001 R15: 0000000000000000
      <4>[ 3069.977547] FS:  0000000000000000(0000) GS:ffff88017fc80000(0000) knlGS:0000000000000000
      <4>[ 3069.977551] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
      <4>[ 3069.977555] CR2: 00007f7e8b7bcf04 CR3: 0000000003e0f000 CR4: 00000000003406e0
      <4>[ 3069.977559] Call Trace:
      <4>[ 3069.977565]  ? mark_held_locks+0x64/0x90
      <4>[ 3069.977571]  ? _raw_spin_unlock_irq+0x24/0x50
      <4>[ 3069.977575]  ? _raw_spin_unlock_irq+0x24/0x50
      <4>[ 3069.977579]  ? trace_hardirqs_on_caller+0xde/0x1c0
      <4>[ 3069.977583]  ? _raw_spin_unlock_irq+0x2f/0x50
      <4>[ 3069.977588]  ? finish_task_switch+0xa5/0x210
      <4>[ 3069.977592]  ? lock_acquire+0xaf/0x200
      <4>[ 3069.977596]  lock_acquire+0xaf/0x200
      <4>[ 3069.977600]  ? __mutex_lock+0x5e9/0x9b0
      <4>[ 3069.977604]  _raw_spin_lock+0x2a/0x40
      <4>[ 3069.977608]  ? __mutex_lock+0x5e9/0x9b0
      <4>[ 3069.977612]  __mutex_lock+0x5e9/0x9b0
      <4>[ 3069.977616]  ? drm_fb_helper_hotplug_event.part.19+0x16/0xa0
      <4>[ 3069.977621]  ? drm_fb_helper_hotplug_event.part.19+0x16/0xa0
      <4>[ 3069.977625]  drm_fb_helper_hotplug_event.part.19+0x16/0xa0
      <4>[ 3069.977630]  output_poll_execute+0x8d/0x180
      <4>[ 3069.977635]  process_one_work+0x22e/0x660
      <4>[ 3069.977640]  worker_thread+0x48/0x3a0
      <4>[ 3069.977644]  ? _raw_spin_unlock_irqrestore+0x4c/0x60
      <4>[ 3069.977649]  kthread+0x102/0x140
      <4>[ 3069.977653]  ? process_one_work+0x660/0x660
      <4>[ 3069.977657]  ? kthread_create_on_node+0x40/0x40
      <4>[ 3069.977662]  ret_from_fork+0x27/0x40
      <4>[ 3069.977666] Code: 8d 62 f8 c3 49 81 3c 24 e0 fa 3c 82 41 be 00 00 00 00 45 0f 45 f0 83 fe 01 77 86 89 f0 49 8b 44 c4 08 48 85 c0 0f 84 76 ff ff ff <f0> ff 80 38 01 00 00 8b 1d 62 f9 e8 01 45 8b 85 b8 08 00 00 85
      <1>[ 3069.977707] RIP: __lock_acquire+0x109/0x1b60 RSP: ffffc90001fe7bb0
      <4>[ 3069.977712] ---[ end trace 4ad012eb3af62df7 ]---
      
      In order to keep the dev_priv->ifbdev alive after failure, we have to
      avoid the free and leave it empty until we unload the module (which is
      less than ideal, but a necessary evil for simplicity). Then we can use
      intel_fbdev_sync() to serialise the hotplug event with the configuration.
      The serialisation between the two was removed in commit 934458c2
      ("Revert "drm/i915: Fix races on fbdev""), but the use after free is much
      older, commit 366e39b4 ("drm/i915: Tear down fbdev if initialization
      fails")
      
      Fixes: 366e39b4 ("drm/i915: Tear down fbdev if initialization fails")
      Fixes: 934458c2 ("Revert "drm/i915: Fix races on fbdev"")
      Signed-off-by: default avatarChris Wilson <chris@chris-wilson.co.uk>
      Cc: Lukas Wunner <lukas@wunner.de>
      Cc: Joonas Lahtinen <joonas.lahtinen@linux.intel.com>
      Cc: Daniel Vetter <daniel.vetter@ffwll.ch>
      Cc: stable@vger.kernel.org
      Reviewed-by: default avatarLukas Wunner <lukas@wunner.de>
      Link: https://patchwork.freedesktop.org/patch/msgid/20171125194155.355-1-chris@chris-wilson.co.uk
      ad88d7fc
  4. 24 Nov, 2017 15 commits
  5. 23 Nov, 2017 10 commits
  6. 22 Nov, 2017 5 commits
    • Chris Wilson's avatar
      drm/i915: Call i915_gem_init_userptr() before taking struct_mutex · ee48700d
      Chris Wilson authored
      We don't need struct_mutex to initialise userptr (it just allocates a
      workqueue for itself etc), but we do need struct_mutex later on in
      i915_gem_init() in order to feed requests onto the HW.
      
      This should break the chain
      
      [  385.697902] ======================================================
      [  385.697907] WARNING: possible circular locking dependency detected
      [  385.697913] 4.14.0-CI-Patchwork_7234+ #1 Tainted: G     U
      [  385.697917] ------------------------------------------------------
      [  385.697922] perf_pmu/2631 is trying to acquire lock:
      [  385.697927]  (&mm->mmap_sem){++++}, at: [<ffffffff811bfe1e>] __might_fault+0x3e/0x90
      [  385.697941]
                     but task is already holding lock:
      [  385.697946]  (&cpuctx_mutex){+.+.}, at: [<ffffffff8116fe8c>] perf_event_ctx_lock_nested+0xbc/0x1d0
      [  385.697957]
                     which lock already depends on the new lock.
      
      [  385.697963]
                     the existing dependency chain (in reverse order) is:
      [  385.697970]
                     -> #4 (&cpuctx_mutex){+.+.}:
      [  385.697980]        __mutex_lock+0x86/0x9b0
      [  385.697985]        perf_event_init_cpu+0x5a/0x90
      [  385.697991]        perf_event_init+0x178/0x1a4
      [  385.697997]        start_kernel+0x27f/0x3f1
      [  385.698003]        verify_cpu+0x0/0xfb
      [  385.698006]
                     -> #3 (pmus_lock){+.+.}:
      [  385.698015]        __mutex_lock+0x86/0x9b0
      [  385.698020]        perf_event_init_cpu+0x21/0x90
      [  385.698025]        cpuhp_invoke_callback+0xca/0xc00
      [  385.698030]        _cpu_up+0xa7/0x170
      [  385.698035]        do_cpu_up+0x57/0x70
      [  385.698039]        smp_init+0x62/0xa6
      [  385.698044]        kernel_init_freeable+0x97/0x193
      [  385.698050]        kernel_init+0xa/0x100
      [  385.698055]        ret_from_fork+0x27/0x40
      [  385.698058]
                     -> #2 (cpu_hotplug_lock.rw_sem){++++}:
      [  385.698068]        cpus_read_lock+0x39/0xa0
      [  385.698073]        apply_workqueue_attrs+0x12/0x50
      [  385.698078]        __alloc_workqueue_key+0x1d8/0x4d8
      [  385.698134]        i915_gem_init_userptr+0x5f/0x80 [i915]
      [  385.698176]        i915_gem_init+0x7c/0x390 [i915]
      [  385.698213]        i915_driver_load+0x99e/0x15c0 [i915]
      [  385.698250]        i915_pci_probe+0x33/0x90 [i915]
      [  385.698256]        pci_device_probe+0xa1/0x130
      [  385.698262]        driver_probe_device+0x293/0x440
      [  385.698267]        __driver_attach+0xde/0xe0
      [  385.698272]        bus_for_each_dev+0x5c/0x90
      [  385.698277]        bus_add_driver+0x16d/0x260
      [  385.698282]        driver_register+0x57/0xc0
      [  385.698287]        do_one_initcall+0x3e/0x160
      [  385.698292]        do_init_module+0x5b/0x1fa
      [  385.698297]        load_module+0x2374/0x2dc0
      [  385.698302]        SyS_finit_module+0xaa/0xe0
      [  385.698307]        entry_SYSCALL_64_fastpath+0x1c/0xb1
      [  385.698311]
                     -> #1 (&dev->struct_mutex){+.+.}:
      [  385.698320]        __mutex_lock+0x86/0x9b0
      [  385.698361]        i915_mutex_lock_interruptible+0x4c/0x130 [i915]
      [  385.698403]        i915_gem_fault+0x206/0x760 [i915]
      [  385.698409]        __do_fault+0x1a/0x70
      [  385.698413]        __handle_mm_fault+0x7c4/0xdb0
      [  385.698417]        handle_mm_fault+0x154/0x300
      [  385.698440]        __do_page_fault+0x2d6/0x570
      [  385.698445]        page_fault+0x22/0x30
      [  385.698449]
                     -> #0 (&mm->mmap_sem){++++}:
      [  385.698459]        lock_acquire+0xaf/0x200
      [  385.698464]        __might_fault+0x68/0x90
      [  385.698470]        _copy_to_user+0x1e/0x70
      [  385.698475]        perf_read+0x1aa/0x290
      [  385.698480]        __vfs_read+0x23/0x120
      [  385.698484]        vfs_read+0xa3/0x150
      [  385.698488]        SyS_read+0x45/0xb0
      [  385.698493]        entry_SYSCALL_64_fastpath+0x1c/0xb1
      [  385.698497]
                     other info that might help us debug this:
      
      [  385.698505] Chain exists of:
                       &mm->mmap_sem --> pmus_lock --> &cpuctx_mutex
      
      [  385.698517]  Possible unsafe locking scenario:
      
      [  385.698522]        CPU0                    CPU1
      [  385.698526]        ----                    ----
      [  385.698529]   lock(&cpuctx_mutex);
      [  385.698553]                                lock(pmus_lock);
      [  385.698558]                                lock(&cpuctx_mutex);
      [  385.698564]   lock(&mm->mmap_sem);
      [  385.698568]
                      *** DEADLOCK ***
      
      [  385.698574] 1 lock held by perf_pmu/2631:
      [  385.698578]  #0:  (&cpuctx_mutex){+.+.}, at: [<ffffffff8116fe8c>] perf_event_ctx_lock_nested+0xbc/0x1d0
      [  385.698589]
                     stack backtrace:
      [  385.698595] CPU: 3 PID: 2631 Comm: perf_pmu Tainted: G     U          4.14.0-CI-Patchwork_7234+ #1
      [  385.698602] Hardware name:                  /NUC6CAYB, BIOS AYAPLCEL.86A.0040.2017.0619.1722 06/19/2017
      [  385.698609] Call Trace:
      [  385.698615]  dump_stack+0x5f/0x86
      [  385.698621]  print_circular_bug.isra.18+0x1d0/0x2c0
      [  385.698627]  __lock_acquire+0x19c3/0x1b60
      [  385.698634]  ? generic_exec_single+0x77/0xe0
      [  385.698640]  ? lock_acquire+0xaf/0x200
      [  385.698644]  lock_acquire+0xaf/0x200
      [  385.698650]  ? __might_fault+0x3e/0x90
      [  385.698655]  __might_fault+0x68/0x90
      [  385.698660]  ? __might_fault+0x3e/0x90
      [  385.698665]  _copy_to_user+0x1e/0x70
      [  385.698670]  perf_read+0x1aa/0x290
      [  385.698675]  __vfs_read+0x23/0x120
      [  385.698682]  ? __fget+0x101/0x1f0
      [  385.698686]  vfs_read+0xa3/0x150
      [  385.698691]  SyS_read+0x45/0xb0
      [  385.698696]  entry_SYSCALL_64_fastpath+0x1c/0xb1
      [  385.698701] RIP: 0033:0x7ff1c46876ed
      [  385.698705] RSP: 002b:00007fff13552f90 EFLAGS: 00000293 ORIG_RAX: 0000000000000000
      [  385.698712] RAX: ffffffffffffffda RBX: ffffc90000647ff0 RCX: 00007ff1c46876ed
      [  385.698718] RDX: 0000000000000010 RSI: 00007fff13552fa0 RDI: 0000000000000005
      [  385.698723] RBP: 000056063d300580 R08: 0000000000000000 R09: 0000000000000060
      [  385.698729] R10: 0000000000000000 R11: 0000000000000293 R12: 0000000000000046
      [  385.698734] R13: 00007fff13552c6f R14: 00007ff1c6279d00 R15: 00007ff1c6279a40
      
      Testcase: igt/perf_pmu
      Signed-off-by: default avatarChris Wilson <chris@chris-wilson.co.uk>
      Cc: Tvrtko Ursulin <tvrtko.ursulin@intel.com>
      Link: https://patchwork.freedesktop.org/patch/msgid/20171122172621.16158-1-chris@chris-wilson.co.ukReviewed-by: default avatarTvrtko Ursulin <tvrtko.ursulin@intel.com>
      ee48700d
    • Chris Wilson's avatar
      drm/i915: Remove success dmesg noise for intel_rotate_pages() · 62d0fe45
      Chris Wilson authored
      During selftesting intel_rotate_pages() is very, very verbose without
      giving us any information. Suppress the noise.
      Signed-off-by: default avatarChris Wilson <chris@chris-wilson.co.uk>
      Cc: Tvrtko Ursulin <tvrtko.ursulin@intel.com>
      Link: https://patchwork.freedesktop.org/patch/msgid/20171122145646.1859-1-chris@chris-wilson.co.ukReviewed-by: default avatarTvrtko Ursulin <tvrtko.ursulin@intel.com>
      62d0fe45
    • Chris Wilson's avatar
      drm/i915/selftests: Use NOWARN for large allocations · c65c8b0f
      Chris Wilson authored
      We may try to do a large kmalloc for the permutation array, falling back
      to a smaller array/test if the first allocation fails. Since we are
      intentionally trying a large allocation which may fail, pass __GFP_NOWARN.
      
      Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=103842Signed-off-by: default avatarChris Wilson <chris@chris-wilson.co.uk>
      Cc: Matthew Auld <matthew.auld@intel.com>
      Link: https://patchwork.freedesktop.org/patch/msgid/20171122120600.27025-1-chris@chris-wilson.co.ukReviewed-by: default avatarMatthew Auld <matthew.auld@intel.com>
      c65c8b0f
    • Tvrtko Ursulin's avatar
      drm/i915/pmu: Add RC6 residency metrics · 6060b6ae
      Tvrtko Ursulin authored
      For clients like intel-gpu-overlay it is easier to read the
      counters via the perf API than having to parse sysfs.
      Signed-off-by: default avatarTvrtko Ursulin <tvrtko.ursulin@intel.com>
      Reviewed-by: default avatarChris Wilson <chris@chris-wilson.co.uk>
      Link: https://patchwork.freedesktop.org/patch/msgid/20171121181852.16128-9-tvrtko.ursulin@linux.intel.com
      6060b6ae
    • Tvrtko Ursulin's avatar
      drm/i915: Convert intel_rc6_residency_us to ns · 36cc8b96
      Tvrtko Ursulin authored
      Will be used for exposing the PMU counters.
      
      v2:
       * Move intel_runtime_pm_get/put to the callers. (Chris Wilson)
       * Restore full unit conversion precision.
      Signed-off-by: default avatarTvrtko Ursulin <tvrtko.ursulin@intel.com>
      Reviewed-by: default avatarChris Wilson <chris@chris-wilson.co.uk>
      Link: https://patchwork.freedesktop.org/patch/msgid/20171121181852.16128-8-tvrtko.ursulin@linux.intel.com
      36cc8b96