From 377635a18a8d682ac4ec64e6f40399e2ad98b41b Mon Sep 17 00:00:00 2001 From: "Justin M. Forbes" Date: Wed, 6 May 2020 13:33:50 -0500 Subject: Linux v5.6.11 --- ...m-Hold-obj-vma.lock-over-for_each_ggtt_vm.patch | 187 --------------------- drm-scheduler-fix-drm_sched_get_cleanup_job.patch | 37 ---- kernel.spec | 7 +- sources | 2 +- 4 files changed, 5 insertions(+), 228 deletions(-) delete mode 100644 0001-drm-i915-gem-Hold-obj-vma.lock-over-for_each_ggtt_vm.patch delete mode 100644 drm-scheduler-fix-drm_sched_get_cleanup_job.patch diff --git a/0001-drm-i915-gem-Hold-obj-vma.lock-over-for_each_ggtt_vm.patch b/0001-drm-i915-gem-Hold-obj-vma.lock-over-for_each_ggtt_vm.patch deleted file mode 100644 index 1e7cf51ee..000000000 --- a/0001-drm-i915-gem-Hold-obj-vma.lock-over-for_each_ggtt_vm.patch +++ /dev/null @@ -1,187 +0,0 @@ -From MAILER-DAEMON Tue Apr 28 19:41:24 2020 -From: Chris Wilson -To: intel-gfx@lists.freedesktop.org -Date: Wed, 22 Apr 2020 08:28:05 +0100 -Message-Id: <20200422072805.17340-1-chris@chris-wilson.co.uk> -In-Reply-To: <20200422072037.17163-1-chris@chris-wilson.co.uk> -References: <20200422072037.17163-1-chris@chris-wilson.co.uk> -Subject: [Intel-gfx] [PATCH] drm/i915/gem: Hold obj->vma.lock over for_each_ggtt_vma() -List-Id: Intel graphics driver community testing & development -Cc: Dave Airlie , stable@vger.kernel.org, Chris Wilson -Errors-To: intel-gfx-bounces@lists.freedesktop.org -Sender: "Intel-gfx" -MIME-Version: 1.0 -Content-Type: text/plain; charset="utf-8" -Content-Transfer-Encoding: 7bit - -While the ggtt vma are protected by their object lifetime, the list -continues until it hits a non-ggtt vma, and that vma is not protected -and may be freed as we inspect it. Hence, we require the obj->vma.lock -to protect the list as we iterate. - -An example of forgetting to hold the obj->vma.lock is - -[1642834.464973] general protection fault, probably for non-canonical address 0xdead000000000122: 0000 [#1] SMP PTI -[1642834.464977] CPU: 3 PID: 1954 Comm: Xorg Not tainted 5.6.0-300.fc32.x86_64 #1 -[1642834.464979] Hardware name: LENOVO 20ARS25701/20ARS25701, BIOS GJET94WW (2.44 ) 09/14/2017 -[1642834.465021] RIP: 0010:i915_gem_object_set_tiling+0x2c0/0x3e0 [i915] -[1642834.465024] Code: 8b 84 24 18 01 00 00 f6 c4 80 74 59 49 8b 94 24 a0 00 00 00 49 8b 84 24 e0 00 00 00 49 8b 74 24 10 48 8b 92 30 01 00 00 89 c7 <80> ba 0a 06 00 00 03 0f 87 86 00 00 00 ba 00 00 08 00 b9 00 00 10 -[1642834.465025] RSP: 0018:ffffa98780c77d60 EFLAGS: 00010282 -[1642834.465028] RAX: ffff8d232bfb2578 RBX: 0000000000000002 RCX: ffff8d25873a0000 -[1642834.465029] RDX: dead000000000122 RSI: fffff0af8ac6e408 RDI: 000000002bfb2578 -[1642834.465030] RBP: ffff8d25873a0000 R08: ffff8d252bfb5638 R09: 0000000000000000 -[1642834.465031] R10: 0000000000000000 R11: ffff8d252bfb5640 R12: ffffa987801cb8f8 -[1642834.465032] R13: 0000000000001000 R14: ffff8d233e972e50 R15: ffff8d233e972d00 -[1642834.465034] FS: 00007f6a3d327f00(0000) GS:ffff8d25926c0000(0000) knlGS:0000000000000000 -[1642834.465036] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 -[1642834.465037] CR2: 00007f6a2064d000 CR3: 00000002fb57c001 CR4: 00000000001606e0 -[1642834.465038] Call Trace: -[1642834.465083] i915_gem_set_tiling_ioctl+0x122/0x230 [i915] -[1642834.465121] ? i915_gem_object_set_tiling+0x3e0/0x3e0 [i915] -[1642834.465151] drm_ioctl_kernel+0x86/0xd0 [drm] -[1642834.465156] ? avc_has_perm+0x3b/0x160 -[1642834.465178] drm_ioctl+0x206/0x390 [drm] -[1642834.465216] ? i915_gem_object_set_tiling+0x3e0/0x3e0 [i915] -[1642834.465221] ? selinux_file_ioctl+0x122/0x1c0 -[1642834.465226] ? __do_munmap+0x24b/0x4d0 -[1642834.465231] ksys_ioctl+0x82/0xc0 -[1642834.465235] __x64_sys_ioctl+0x16/0x20 -[1642834.465238] do_syscall_64+0x5b/0xf0 -[1642834.465243] entry_SYSCALL_64_after_hwframe+0x44/0xa9 -[1642834.465245] RIP: 0033:0x7f6a3d7b047b -[1642834.465247] Code: 0f 1e fa 48 8b 05 1d aa 0c 00 64 c7 00 26 00 00 00 48 c7 c0 ff ff ff ff c3 66 0f 1f 44 00 00 f3 0f 1e fa b8 10 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 8b 0d ed a9 0c 00 f7 d8 64 89 01 48 -[1642834.465249] RSP: 002b:00007ffe71adba28 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 -[1642834.465251] RAX: ffffffffffffffda RBX: 000055f99048fa40 RCX: 00007f6a3d7b047b -[1642834.465253] RDX: 00007ffe71adba30 RSI: 00000000c0106461 RDI: 000000000000000e -[1642834.465254] RBP: 0000000000000002 R08: 000055f98f3f1798 R09: 0000000000000002 -[1642834.465255] R10: 0000000000001000 R11: 0000000000000246 R12: 0000000000000080 -[1642834.465257] R13: 000055f98f3f1690 R14: 00000000c0106461 R15: 00007ffe71adba30 - -Now to take the spinlock during the list iteration, we need to break it -down into two phases. In the first phase under the lock, we cannot sleep -and so must defer the actual work to a second list, protected by the -ggtt->mutex. - -We also need to hold the spinlock during creation of a new spinlock to -serialise updates of the tiling on the object. - -Fixes: 2850748ef876 ("drm/i915: Pull i915_vma_pin under the vm->mutex") -Reported-by: Dave Airlie -Signed-off-by: Chris Wilson -Cc: # v5.5+ -Cc: Dave Airlie -Cc: Tvrtko Ursulin ---- - drivers/gpu/drm/i915/gem/i915_gem_tiling.c | 20 ++++++++++++++++++-- - drivers/gpu/drm/i915/i915_vma.c | 10 ++++++---- - 2 files changed, 24 insertions(+), 6 deletions(-) - -diff --git a/drivers/gpu/drm/i915/gem/i915_gem_tiling.c b/drivers/gpu/drm/i915/gem/i915_gem_tiling.c -index 37f77aee1212..0158e49bf9bb 100644 ---- a/drivers/gpu/drm/i915/gem/i915_gem_tiling.c -+++ b/drivers/gpu/drm/i915/gem/i915_gem_tiling.c -@@ -182,21 +182,35 @@ i915_gem_object_fence_prepare(struct drm_i915_gem_object *obj, - int tiling_mode, unsigned int stride) - { - struct i915_ggtt *ggtt = &to_i915(obj->base.dev)->ggtt; -- struct i915_vma *vma; -+ struct i915_vma *vma, *vn; -+ LIST_HEAD(unbind); - int ret = 0; - - if (tiling_mode == I915_TILING_NONE) - return 0; - - mutex_lock(&ggtt->vm.mutex); -+ -+ spin_lock(&obj->vma.lock); - for_each_ggtt_vma(vma, obj) { -+ GEM_BUG_ON(vma->vm != &ggtt->vm); -+ - if (i915_vma_fence_prepare(vma, tiling_mode, stride)) - continue; - -+ list_move(&vma->vm_link, &unbind); -+ } -+ spin_unlock(&obj->vma.lock); -+ -+ list_for_each_entry_safe(vma, vn, &unbind, vm_link) { - ret = __i915_vma_unbind(vma); -- if (ret) -+ if (ret) { -+ /* Restore the remaining vma on an error */ -+ list_splice(&unbind, &ggtt->vm.bound_list); - break; -+ } - } -+ - mutex_unlock(&ggtt->vm.mutex); - - return ret; -@@ -268,6 +282,7 @@ i915_gem_object_set_tiling(struct drm_i915_gem_object *obj, - } - mutex_unlock(&obj->mm.lock); - -+ spin_lock(&obj->vma.lock); - for_each_ggtt_vma(vma, obj) { - vma->fence_size = - i915_gem_fence_size(i915, vma->size, tiling, stride); -@@ -278,6 +293,7 @@ i915_gem_object_set_tiling(struct drm_i915_gem_object *obj, - if (vma->fence) - vma->fence->dirty = true; - } -+ spin_unlock(&obj->vma.lock); - - obj->tiling_and_stride = tiling | stride; - i915_gem_object_unlock(obj); -diff --git a/drivers/gpu/drm/i915/i915_vma.c b/drivers/gpu/drm/i915/i915_vma.c -index f0383a68c981..20fe5a134d92 100644 ---- a/drivers/gpu/drm/i915/i915_vma.c -+++ b/drivers/gpu/drm/i915/i915_vma.c -@@ -158,16 +158,18 @@ vma_create(struct drm_i915_gem_object *obj, - - GEM_BUG_ON(!IS_ALIGNED(vma->size, I915_GTT_PAGE_SIZE)); - -+ spin_lock(&obj->vma.lock); -+ - if (i915_is_ggtt(vm)) { - if (unlikely(overflows_type(vma->size, u32))) -- goto err_vma; -+ goto err_unlock; - - vma->fence_size = i915_gem_fence_size(vm->i915, vma->size, - i915_gem_object_get_tiling(obj), - i915_gem_object_get_stride(obj)); - if (unlikely(vma->fence_size < vma->size || /* overflow */ - vma->fence_size > vm->total)) -- goto err_vma; -+ goto err_unlock; - - GEM_BUG_ON(!IS_ALIGNED(vma->fence_size, I915_GTT_MIN_ALIGNMENT)); - -@@ -179,8 +181,6 @@ vma_create(struct drm_i915_gem_object *obj, - __set_bit(I915_VMA_GGTT_BIT, __i915_vma_flags(vma)); - } - -- spin_lock(&obj->vma.lock); -- - rb = NULL; - p = &obj->vma.tree.rb_node; - while (*p) { -@@ -225,6 +225,8 @@ vma_create(struct drm_i915_gem_object *obj, - - return vma; - -+err_unlock: -+ spin_unlock(&obj->vma.lock); - err_vma: - i915_vma_free(vma); - return ERR_PTR(-E2BIG); --- -2.20.1 - -_______________________________________________ -Intel-gfx mailing list -Intel-gfx@lists.freedesktop.org -https://lists.freedesktop.org/mailman/listinfo/intel-gfx - diff --git a/drm-scheduler-fix-drm_sched_get_cleanup_job.patch b/drm-scheduler-fix-drm_sched_get_cleanup_job.patch deleted file mode 100644 index db232c0cd..000000000 --- a/drm-scheduler-fix-drm_sched_get_cleanup_job.patch +++ /dev/null @@ -1,37 +0,0 @@ -From 8623b5255ae7ccaf276aac3920787bf575fa6b37 Mon Sep 17 00:00:00 2001 -From: =?UTF-8?q?Christian=20K=C3=B6nig?= -Date: Sat, 11 Apr 2020 11:54:01 +0200 -Subject: drm/scheduler: fix drm_sched_get_cleanup_job -MIME-Version: 1.0 -Content-Type: text/plain; charset=UTF-8 -Content-Transfer-Encoding: 8bit - -From: Christian König - -commit 8623b5255ae7ccaf276aac3920787bf575fa6b37 upstream. - -We are racing to initialize sched->thread here, just always check the -current thread. - -Signed-off-by: Christian König -Reviewed-by: Andrey Grodzovsky -Reviewed-by: Kent Russell -Link: https://patchwork.freedesktop.org/patch/361303/ -Cc: Linus Torvalds -Signed-off-by: Greg Kroah-Hartman - ---- - drivers/gpu/drm/scheduler/sched_main.c | 2 +- - 1 file changed, 1 insertion(+), 1 deletion(-) - ---- a/drivers/gpu/drm/scheduler/sched_main.c -+++ b/drivers/gpu/drm/scheduler/sched_main.c -@@ -687,7 +687,7 @@ drm_sched_get_cleanup_job(struct drm_gpu - */ - if ((sched->timeout != MAX_SCHEDULE_TIMEOUT && - !cancel_delayed_work(&sched->work_tdr)) || -- __kthread_should_park(sched->thread)) -+ kthread_should_park()) - return NULL; - - spin_lock_irqsave(&sched->job_list_lock, flags); diff --git a/kernel.spec b/kernel.spec index 0909526b9..546109342 100644 --- a/kernel.spec +++ b/kernel.spec @@ -92,7 +92,7 @@ Summary: The Linux kernel %if 0%{?released_kernel} # Do we have a -stable update to apply? -%define stable_update 10 +%define stable_update 11 # Set rpm version accordingly %if 0%{?stable_update} %define stablerev %{stable_update} @@ -902,8 +902,6 @@ Patch509: drm-i915-backports.patch Patch511: e1000e-bump-up-timeout-to-wait-when-ME-un-configure-ULP-mode.patch Patch512: drm-dp_mst-Fix-drm_dp_send_dpcd_write-return-code.patch -Patch513: 0001-drm-i915-gem-Hold-obj-vma.lock-over-for_each_ggtt_vm.patch -Patch514: drm-scheduler-fix-drm_sched_get_cleanup_job.patch # END OF PATCH DEFINITIONS @@ -3001,6 +2999,9 @@ fi # # %changelog +* Wed May 06 2020 Justin M. Forbes - 5.6.11-300 +- Linux v5.6.11 + * Mon May 04 2020 Justin M. Forbes - 5.6.10-300 - Linux v5.6.10 diff --git a/sources b/sources index f4324f7a3..3244f95a5 100644 --- a/sources +++ b/sources @@ -1,2 +1,2 @@ SHA512 (linux-5.6.tar.xz) = 80846fe2b4e4a7ff471d2dde28a8216ae807a3209f959e93d39ea4fc9a189ea28ec3db9d303b3fe15a28c2cb90e7446876678e93e23353c2d6f262e364a06bc9 -SHA512 (patch-5.6.10.xz) = 57860a7576149a34c1ff9277a8daee8d4ee8574270561302e4fb3916a7f4c23cf298a3a7f13ba5370ec665548b679f5340d3ce6788152b4d8d79f41009efa865 +SHA512 (patch-5.6.11.xz) = 0e9bda5aea7617e1d1ec6aa906a7845dd498a30a0e1018583561f3af64d7e67afee3bfffdea2e7eab81d100054aa49b8cfaa0fbfc4e308e7f8b70f21dfdb7908 -- cgit