1. 02 Aug, 2021 3 commits
    • Eric Huang's avatar
      Revert "Revert "drm/amdgpu: Add table_freed parameter to amdgpu_vm_bo_update"" · cc6152ff
      Eric Huang authored
      This reverts commit 024d8811.
      
      Revert reason: The issue has been resolved.
      Signed-off-by: default avatarEric Huang <jinhuieric.huang@amd.com>
      Signed-off-by: default avatarAlex Deucher <alexander.deucher@amd.com>
      cc6152ff
    • Eric Huang's avatar
      Revert "Revert "drm/amdkfd: Add heavy-weight TLB flush after unmapping"" · 4a134261
      Eric Huang authored
      This reverts commit 430f8e6e.
      
      Revert reason: Issue has been resolved.
      Signed-off-by: default avatarEric Huang <jinhuieric.huang@amd.com>
      Signed-off-by: default avatarAlex Deucher <alexander.deucher@amd.com>
      4a134261
    • xinhui pan's avatar
      drm/amdgpu: Fix out-of-bounds read when update mapping · de598650
      xinhui pan authored
      If one GTT BO has been evicted/swapped out, it should sit in CPU domain.
      TTM only alloc struct ttm_resource instead of struct ttm_range_mgr_node
      for sysMem.
      
      Now when we update mapping for such invalidated BOs, we might walk out
      of bounds of struct ttm_resource.
      
      Three possible fix:
      1) Let sysMem manager alloc struct ttm_range_mgr_node, like
      ttm_range_manager does.
      2) Pass pages_addr to update_mapping function too, but need memset
      pages_addr[] to zero when unpopulate.
      3) Init amdgpu_res_cursor directly.
      
      bug is detected by kfence.
      ==================================================================
      BUG: KFENCE: out-of-bounds read in amdgpu_vm_bo_update_mapping+0x564/0x6e0
      
      Out-of-bounds read at 0x000000008ea93fe9 (64B right of kfence-#167):
       amdgpu_vm_bo_update_mapping+0x564/0x6e0 [amdgpu]
       amdgpu_vm_bo_update+0x282/0xa40 [amdgpu]
       amdgpu_vm_handle_moved+0x19e/0x1f0 [amdgpu]
       amdgpu_cs_vm_handling+0x4e4/0x640 [amdgpu]
       amdgpu_cs_ioctl+0x19e7/0x23c0 [amdgpu]
       drm_ioctl_kernel+0xf3/0x180 [drm]
       drm_ioctl+0x2cb/0x550 [drm]
       amdgpu_drm_ioctl+0x5e/0xb0 [amdgpu]
      
      kfence-#167 [0x000000008e11c055-0x000000001f676b3e
       ttm_sys_man_alloc+0x35/0x80 [ttm]
       ttm_resource_alloc+0x39/0x50 [ttm]
       ttm_bo_swapout+0x252/0x5a0 [ttm]
       ttm_device_swapout+0x107/0x180 [ttm]
       ttm_global_swapout+0x6f/0x130 [ttm]
       ttm_tt_populate+0xb1/0x2a0 [ttm]
       ttm_bo_handle_move_mem+0x17e/0x1d0 [ttm]
       ttm_mem_evict_first+0x59d/0x9c0 [ttm]
       ttm_bo_mem_space+0x39f/0x400 [ttm]
       ttm_bo_validate+0x13c/0x340 [ttm]
       ttm_bo_init_reserved+0x269/0x540 [ttm]
       amdgpu_bo_create+0x1d1/0xa30 [amdgpu]
       amdgpu_bo_create_user+0x40/0x80 [amdgpu]
       amdgpu_gem_object_create+0x71/0xc0 [amdgpu]
       amdgpu_amdkfd_gpuvm_alloc_memory_of_gpu+0x2f2/0xcd0 [amdgpu]
       kfd_ioctl_alloc_memory_of_gpu+0xe2/0x330 [amdgpu]
       kfd_ioctl+0x461/0x690 [amdgpu]
      Signed-off-by: default avatarxinhui pan <xinhui.pan@amd.com>
      Reviewed-by: default avatarChristian König <christian.koenig@amd.com>
      Signed-off-by: default avatarAlex Deucher <alexander.deucher@amd.com>
      de598650
  2. 30 Jul, 2021 4 commits
  3. 29 Jul, 2021 12 commits
  4. 28 Jul, 2021 21 commits