1. 03 Jun, 2020 1 commit
    • Daniel Vetter's avatar
      drm/msm: Don't call dma_buf_vunmap without _vmap · 8b6b7d84
      Daniel Vetter authored
      I honestly don't exactly understand what's going on here, but the
      current code is wrong for sure: It calls dma_buf_vunmap without ever
      calling dma_buf_vmap.
      
      What I'm not sure about is whether the WARN_ON is correct:
      - msm imports dma-buf using drm_prime_sg_to_page_addr_arrays. Which is
        a pretty neat layering violation of how you shouldn't peek behind
        the curtain of the dma-buf exporter, but par for course. Note that
        all the nice new helpers don't (and we should probably have a bit a
        warning about this in the kerneldoc).
      
      - but then in the get_vaddr() in msm_gem.c, we seems to happily wrap a
        vmap() around any object with ->pages set (so including imported
        dma-buf).
      
      - I'm not seeing any guarantees that userspace can't use an imported
        dma-buf for e.g. MSM_SUBMIT_CMD_BUF in a5xx_submit_in_rb, so no
        guarantees that an imported dma-buf won't end up with a ->vaddr set.
      
      But even if that WARN_ON is wrong, cleaning up a vmap() done by msm by
      calling dma_buf_vunmap is the wrong thing to do.
      
      v2: Rob said in review that we do indeed have a gap in get_vaddr() that
      needs to be plugged. But the users I've found aren't legit users on
      imported dma-buf, so we can just reject that.
      Reviewed-by: default avatarRob Clark <robdclark@gmail.com>
      Signed-off-by: default avatarDaniel Vetter <daniel.vetter@intel.com>
      Cc: Rob Clark <robdclark@gmail.com>
      Cc: Sean Paul <sean@poorly.run>
      Cc: linux-arm-msm@vger.kernel.org
      Cc: freedreno@lists.freedesktop.org
      Link: https://patchwork.freedesktop.org/patch/msgid/20200514201117.465146-1-daniel.vetter@ffwll.ch
      8b6b7d84
  2. 01 Jun, 2020 9 commits
  3. 31 May, 2020 5 commits
  4. 29 May, 2020 1 commit
  5. 27 May, 2020 10 commits
  6. 26 May, 2020 4 commits
  7. 25 May, 2020 2 commits
  8. 23 May, 2020 1 commit
  9. 20 May, 2020 3 commits
    • Daniel Vetter's avatar
      drm/writeback: don't set fence->ops to default · 38d6fd40
      Daniel Vetter authored
      It's the default.
      Signed-off-by: default avatarDaniel Vetter <daniel.vetter@intel.com>
      Cc: Maarten Lankhorst <maarten.lankhorst@linux.intel.com>
      Cc: Maxime Ripard <mripard@kernel.org>
      Cc: Thomas Zimmermann <tzimmermann@suse.de>
      Cc: David Airlie <airlied@linux.ie>
      Cc: Daniel Vetter <daniel@ffwll.ch>
      Reviewed-by: default avatarMichael J. Ruhl <michael.j.ruhl@intel.com>
      Link: https://patchwork.freedesktop.org/patch/msgid/20200511091142.208787-1-daniel.vetter@ffwll.ch
      38d6fd40
    • Chris Wilson's avatar
      drm: Restore the NULL check for drm_gem_object_put() · 0e799e84
      Chris Wilson authored
      Some users want to pass NULL to drm_gem_object_put(), but those using
      __drm_gem_object_put() did not. Compromise, have both and let the
      compiler sort it out.
      
      drm_gem_fb_destroy() calls drm_gem_object_put() with NULL obj causing:
      [   11.584209] BUG: kernel NULL pointer dereference, address: 0000000000000000
      [   11.584213] #PF: supervisor write access in kernel mode
      [   11.584215] #PF: error_code(0x0002) - not-present page
      [   11.584216] PGD 0 P4D 0
      [   11.584220] Oops: 0002 [#1] SMP NOPTI
      [   11.584223] CPU: 7 PID: 1571 Comm: gnome-shell Tainted: G            E     5.7.0-rc1-1-default+ #27
      [   11.584225] Hardware name: Micro-Star International Co., Ltd. MS-7A31/X370 XPOWER GAMING TITANIUM (MS-7A31), BIOS 1.MR 12/03/2019
      [   11.584237] RIP: 0010:drm_gem_fb_destroy+0x28/0x70 [drm_kms_helper]
      <snip>
      [   11.584256] Call Trace:
      [   11.584279]  drm_mode_rmfb+0x189/0x1c0 [drm]
      [   11.584299]  ? drm_mode_rmfb+0x1c0/0x1c0 [drm]
      [   11.584314]  drm_ioctl_kernel+0xaa/0xf0 [drm]
      [   11.584329]  drm_ioctl+0x1ff/0x3b0 [drm]
      [   11.584347]  ? drm_mode_rmfb+0x1c0/0x1c0 [drm]
      [   11.584421]  amdgpu_drm_ioctl+0x49/0x80 [amdgpu]
      [   11.584427]  ksys_ioctl+0x87/0xc0
      [   11.584430]  __x64_sys_ioctl+0x16/0x20
      [   11.584434]  do_syscall_64+0x5f/0x240
      [   11.584438]  entry_SYSCALL_64_after_hwframe+0x44/0xa9
      [   11.584440] RIP: 0033:0x7f0ef80f7227
      Reported-by: default avatarNirmoy Das <nirmoy.das@amd.com>
      Fixes: b5d25074 ("drm/gem: fold drm_gem_object_put_unlocked and __drm_gem_object_put()")
      Signed-off-by: default avatarChris Wilson <chris@chris-wilson.co.uk>
      Cc: Nirmoy Das <nirmoy.das@amd.com>
      Cc: Emil Velikov <emil.velikov@collabora.com>
      Cc: Christian König <christian.koenig@amd.com>.
      Acked-by: default avatarNirmoy Das <nirmoy.das@amd.com>
      Reviewed-by: default avatarEmil Velikov <emil.velikov@collabora.com>
      Link: https://patchwork.freedesktop.org/patch/msgid/20200520142347.29060-1-chris@chris-wilson.co.uk
      0e799e84
    • Daniel Vetter's avatar
      dma-fence: add might_sleep annotation to _wait() · ef825550
      Daniel Vetter authored
      Do it uncontionally, there's a separate peek function with
      dma_fence_is_signalled() which can be called from atomic context.
      
      v2: Consensus calls for an unconditional might_sleep (Chris,
      Christian)
      
      Full audit:
      - dma-fence.h: Uses MAX_SCHEDULE_TIMOUT, good chance this sleeps
      - dma-resv.c: Timeout always at least 1
      - st-dma-fence.c: Save to sleep in testcases
      - amdgpu_cs.c: Both callers are for variants of the wait ioctl
      - amdgpu_device.c: Two callers in vram recover code, both right next
        to mutex_lock.
      - amdgpu_vm.c: Use in the vm_wait ioctl, next to _reserve/unreserve
      - remaining functions in amdgpu: All for test_ib implementations for
        various engines, caller for that looks all safe (debugfs, driver
        load, reset)
      - etnaviv: another wait ioctl
      - habanalabs: another wait ioctl
      - nouveau_fence.c: hardcoded 15*HZ ... glorious
      - nouveau_gem.c: hardcoded 2*HZ ... so not even super consistent, but
        this one does have a WARN_ON :-/ At least this one is only a
        fallback path for when kmalloc fails. Maybe this should be put onto
        some worker list instead, instead of a work per unamp ...
      - i915/selftests: Hardecoded HZ / 4 or HZ / 8
      - i915/gt/selftests: Going up the callchain looks safe looking at
        nearby callers
      - i915/gt/intel_gt_requests.c. Wrapped in a mutex_lock
      - i915/gem_i915_gem_wait.c: The i915-version which is called instead
        for i915 fences already has a might_sleep() annotation, so all good
      
      Cc: Alex Deucher <alexander.deucher@amd.com>
      Cc: Lucas Stach <l.stach@pengutronix.de>
      Cc: Jani Nikula <jani.nikula@linux.intel.com>
      Cc: Joonas Lahtinen <joonas.lahtinen@linux.intel.com>
      Cc: Rodrigo Vivi <rodrigo.vivi@intel.com>
      Cc: Ben Skeggs <bskeggs@redhat.com>
      Cc: "VMware Graphics" <linux-graphics-maintainer@vmware.com>
      Cc: Oded Gabbay <oded.gabbay@gmail.com>
      Cc: linux-media@vger.kernel.org
      Cc: linaro-mm-sig@lists.linaro.org
      Cc: linux-rdma@vger.kernel.org
      Cc: amd-gfx@lists.freedesktop.org
      Cc: intel-gfx@lists.freedesktop.org
      Cc: Chris Wilson <chris@chris-wilson.co.uk>
      Cc: Maarten Lankhorst <maarten.lankhorst@linux.intel.com>
      Cc: Christian König <christian.koenig@amd.com>
      Reviewed-by: default avatarChris Wilson <chris@chris-wilson.co.uk>
      Reviewed-by: default avatarChristian König <christian.koenig@amd.com>
      Signed-off-by: default avatarDaniel Vetter <daniel.vetter@intel.com>
      Link: https://patchwork.freedesktop.org/patch/msgid/20200519132756.682888-1-daniel.vetter@ffwll.ch
      ef825550
  10. 19 May, 2020 4 commits