From: Matthew Auld <matthew.william.auld@gmail.com>
To: Chris Wilson <chris@chris-wilson.co.uk>
Cc: Intel Graphics Development <intel-gfx@lists.freedesktop.org>,
Lucas De Marchi <lucas.demarchi@intel.com>,
Matthew Auld <matthew.auld@intel.com>
Subject: Re: [Intel-gfx] [PATCH] drm/i915/display: Defer initial modeset until after GGTT is initialised
Date: Thu, 26 Nov 2020 10:11:10 +0000 [thread overview]
Message-ID: <CAM0jSHPXwTwESVHfc3oTLkGp_qfc6UmzXpDVc0Rj8s=MD7mNUA@mail.gmail.com> (raw)
In-Reply-To: <20201125193032.29282-1-chris@chris-wilson.co.uk>
On Wed, 25 Nov 2020 at 19:30, Chris Wilson <chris@chris-wilson.co.uk> wrote:
>
> Prior to sanitizing the GGTT, the only operations around in
> intel_display_init_nogem() are those to reserve the preallocated (and
> active) regions in the GGTT leftover from the BIOS. Trying to allocate a
> GGTT vma (such as intel_pin_and_fence_fb_obj during the initial modeset)
> may then conflict with other preallocated regions that have not yet been
> protected.
>
> Move the initial modesetting from the end of init_nogem to the beginning
> of init so that any vma pinning (either framebuffers or DSB, for example),
> is after the GGTT is ready to handle it.
>
> This will prevent the DSB object from being destroyed too early:
>
> [ 53.448973] ==================================================================
> [ 53.449241] BUG: KASAN: use-after-free in i915_init_ggtt+0x324/0x9e0 [i915]
> [ 53.449309] Read of size 8 at addr ffff88811b1e8070 by task systemd-udevd/345
>
> [ 53.449399] CPU: 1 PID: 345 Comm: systemd-udevd Tainted: G W 5.10.0-rc5+ #12
> [ 53.449409] Call Trace:
> [ 53.449418] dump_stack+0x9a/0xcc
> [ 53.449558] ? i915_init_ggtt+0x324/0x9e0 [i915]
> [ 53.449565] print_address_description.constprop.0+0x3e/0x60
> [ 53.449577] ? _raw_spin_lock_irqsave+0x4e/0x50
> [ 53.449718] ? i915_init_ggtt+0x324/0x9e0 [i915]
> [ 53.449849] ? i915_init_ggtt+0x324/0x9e0 [i915]
> [ 53.449857] kasan_report.cold+0x1f/0x37
> [ 53.449993] ? i915_init_ggtt+0x324/0x9e0 [i915]
> [ 53.450130] i915_init_ggtt+0x324/0x9e0 [i915]
> [ 53.450273] ? i915_ggtt_suspend+0x1f0/0x1f0 [i915]
> [ 53.450281] ? static_obj+0x69/0x80
> [ 53.450289] ? lockdep_init_map_waits+0xa9/0x310
> [ 53.450431] ? intel_wopcm_init+0x96/0x3d0 [i915]
> [ 53.450581] ? i915_gem_init+0x75/0x2d0 [i915]
> [ 53.450720] i915_gem_init+0x75/0x2d0 [i915]
> [ 53.450852] i915_driver_probe+0x8c2/0x1210 [i915]
> [ 53.450993] ? i915_pm_prepare+0x630/0x630 [i915]
> [ 53.451006] ? check_chain_key+0x1e7/0x2e0
> [ 53.451025] ? __pm_runtime_resume+0x58/0xb0
> [ 53.451157] i915_pci_probe+0xa6/0x2b0 [i915]
> [ 53.451285] ? i915_pci_remove+0x40/0x40 [i915]
> [ 53.451295] ? lockdep_hardirqs_on_prepare+0x124/0x230
> [ 53.451302] ? _raw_spin_unlock_irqrestore+0x42/0x50
> [ 53.451309] ? lockdep_hardirqs_on+0xbf/0x130
> [ 53.451315] ? preempt_count_sub+0xf/0xb0
> [ 53.451321] ? _raw_spin_unlock_irqrestore+0x2f/0x50
> [ 53.451335] pci_device_probe+0xf9/0x190
> [ 53.451350] really_probe+0x17f/0x5b0
> [ 53.451365] driver_probe_device+0x13a/0x1c0
> [ 53.451376] device_driver_attach+0x82/0x90
> [ 53.451386] ? device_driver_attach+0x90/0x90
> [ 53.451391] __driver_attach+0xab/0x190
> [ 53.451401] ? device_driver_attach+0x90/0x90
> [ 53.451407] bus_for_each_dev+0xe4/0x140
> [ 53.451414] ? subsys_dev_iter_exit+0x10/0x10
> [ 53.451423] ? __list_add_valid+0x2b/0xa0
> [ 53.451440] bus_add_driver+0x227/0x2e0
> [ 53.451454] driver_register+0xd3/0x150
> [ 53.451585] i915_init+0x92/0xac [i915]
> [ 53.451592] ? 0xffffffffa0a20000
> [ 53.451598] do_one_initcall+0xb6/0x3b0
> [ 53.451606] ? trace_event_raw_event_initcall_finish+0x150/0x150
> [ 53.451614] ? __kasan_kmalloc.constprop.0+0xc2/0xd0
> [ 53.451627] ? kmem_cache_alloc_trace+0x4a4/0x8e0
> [ 53.451634] ? kasan_unpoison_shadow+0x33/0x40
> [ 53.451649] do_init_module+0xf8/0x350
> [ 53.451662] load_module+0x43de/0x47f0
> [ 53.451716] ? module_frob_arch_sections+0x20/0x20
> [ 53.451731] ? rw_verify_area+0x5f/0x130
> [ 53.451780] ? __do_sys_finit_module+0x10d/0x1a0
> [ 53.451785] __do_sys_finit_module+0x10d/0x1a0
> [ 53.451792] ? __ia32_sys_init_module+0x40/0x40
> [ 53.451800] ? seccomp_do_user_notification.isra.0+0x5c0/0x5c0
> [ 53.451829] ? rcu_read_lock_bh_held+0xb0/0xb0
> [ 53.451835] ? mark_held_locks+0x24/0x90
> [ 53.451856] do_syscall_64+0x33/0x80
> [ 53.451863] entry_SYSCALL_64_after_hwframe+0x44/0xa9
> [ 53.451868] RIP: 0033:0x7fde09b4470d
> [ 53.451875] Code: 00 c3 66 2e 0f 1f 84 00 00 00 00 00 90 f3 0f 1e fa 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 8b 0d 53 f7 0c 00 f7 d8 64 89 01 48
> [ 53.451880] RSP: 002b:00007ffd6abc1718 EFLAGS: 00000246 ORIG_RAX: 0000000000000139
> [ 53.451890] RAX: ffffffffffffffda RBX: 000056444e528150 RCX: 00007fde09b4470d
> [ 53.451895] RDX: 0000000000000000 RSI: 00007fde09a21ded RDI: 000000000000000f
> [ 53.451899] RBP: 0000000000020000 R08: 0000000000000000 R09: 0000000000000000
> [ 53.451904] R10: 000000000000000f R11: 0000000000000246 R12: 00007fde09a21ded
> [ 53.451909] R13: 0000000000000000 R14: 000056444e329200 R15: 000056444e528150
>
> [ 53.451957] Allocated by task 345:
> [ 53.451995] kasan_save_stack+0x1b/0x40
> [ 53.452001] __kasan_kmalloc.constprop.0+0xc2/0xd0
> [ 53.452006] kmem_cache_alloc+0x1cd/0x8d0
> [ 53.452146] i915_vma_instance+0x126/0xb70 [i915]
> [ 53.452304] i915_gem_object_ggtt_pin_ww+0x222/0x3f0 [i915]
> [ 53.452446] intel_dsb_prepare+0x14f/0x230 [i915]
> [ 53.452588] intel_atomic_commit+0x183/0x690 [i915]
> [ 53.452730] intel_initial_commit+0x2bc/0x2f0 [i915]
> [ 53.452871] intel_modeset_init_nogem+0xa02/0x2af0 [i915]
> [ 53.452995] i915_driver_probe+0x8af/0x1210 [i915]
> [ 53.453120] i915_pci_probe+0xa6/0x2b0 [i915]
> [ 53.453125] pci_device_probe+0xf9/0x190
> [ 53.453131] really_probe+0x17f/0x5b0
> [ 53.453136] driver_probe_device+0x13a/0x1c0
> [ 53.453142] device_driver_attach+0x82/0x90
> [ 53.453148] __driver_attach+0xab/0x190
> [ 53.453153] bus_for_each_dev+0xe4/0x140
> [ 53.453158] bus_add_driver+0x227/0x2e0
> [ 53.453164] driver_register+0xd3/0x150
> [ 53.453286] i915_init+0x92/0xac [i915]
> [ 53.453292] do_one_initcall+0xb6/0x3b0
> [ 53.453297] do_init_module+0xf8/0x350
> [ 53.453302] load_module+0x43de/0x47f0
> [ 53.453307] __do_sys_finit_module+0x10d/0x1a0
> [ 53.453312] do_syscall_64+0x33/0x80
> [ 53.453318] entry_SYSCALL_64_after_hwframe+0x44/0xa9
>
> [ 53.453345] Freed by task 82:
> [ 53.453379] kasan_save_stack+0x1b/0x40
> [ 53.453384] kasan_set_track+0x1c/0x30
> [ 53.453389] kasan_set_free_info+0x1b/0x30
> [ 53.453394] __kasan_slab_free+0x112/0x160
> [ 53.453399] kmem_cache_free+0xb2/0x3f0
> [ 53.453536] i915_gem_flush_free_objects+0x31a/0x3b0 [i915]
> [ 53.453542] process_one_work+0x519/0x9f0
> [ 53.453547] worker_thread+0x75/0x5c0
> [ 53.453552] kthread+0x1da/0x230
> [ 53.453557] ret_from_fork+0x22/0x30
>
> [ 53.453584] The buggy address belongs to the object at ffff88811b1e8040
> which belongs to the cache i915_vma of size 968
> [ 53.453692] The buggy address is located 48 bytes inside of
> 968-byte region [ffff88811b1e8040, ffff88811b1e8408)
> [ 53.453792] The buggy address belongs to the page:
> [ 53.453842] page:00000000b35f7048 refcount:1 mapcount:0 mapping:0000000000000000 index:0xffff88811b1ef940 pfn:0x11b1e8
> [ 53.453847] head:00000000b35f7048 order:3 compound_mapcount:0 compound_pincount:0
> [ 53.453853] flags: 0x8000000000010200(slab|head)
> [ 53.453860] raw: 8000000000010200 ffff888115596248 ffff888115596248 ffff8881155b6340
> [ 53.453866] raw: ffff88811b1ef940 0000000000170001 00000001ffffffff 0000000000000000
> [ 53.453870] page dumped because: kasan: bad access detected
>
> [ 53.453895] Memory state around the buggy address:
> [ 53.453944] ffff88811b1e7f00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
> [ 53.454011] ffff88811b1e7f80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
> [ 53.454079] >ffff88811b1e8000: fc fc fc fc fc fc fc fc fa fb fb fb fb fb fb fb
> [ 53.454146] ^
> [ 53.454211] ffff88811b1e8080: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
> [ 53.454279] ffff88811b1e8100: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
> [ 53.454347] ==================================================================
> [ 53.454414] Disabling lock debugging due to kernel taint
> [ 53.454434] general protection fault, probably for non-canonical address 0xdead0000000000d0: 0000 [#1] PREEMPT SMP KASAN PTI
> [ 53.454446] CPU: 1 PID: 345 Comm: systemd-udevd Tainted: G B W 5.10.0-rc5+ #12
> [ 53.454592] RIP: 0010:i915_init_ggtt+0x26f/0x9e0 [i915]
> [ 53.454602] Code: 89 8d 48 ff ff ff 4c 8d 60 d0 49 39 c7 0f 84 37 02 00 00 4c 89 b5 40 ff ff ff 4d 8d bc 24 90 00 00 00 4c 89 ff e8 c1 97 f8 e0 <49> 83 bc 24 90 00 00 00 00 0f 84 0f 02 00 00 49 8d 7c 24 08 e8 a8
> [ 53.454618] RSP: 0018:ffff88812247f430 EFLAGS: 00010286
> [ 53.454625] RAX: 0000000000000000 RBX: ffff888136440000 RCX: ffffffffa03fb78f
> [ 53.454633] RDX: 0000000000000000 RSI: 0000000000000008 RDI: dead000000000160
> [ 53.454641] RBP: ffff88812247f500 R08: ffffffff8113589f R09: 0000000000000000
> [ 53.454648] R10: ffffffff83063843 R11: fffffbfff060c708 R12: dead0000000000d0
> [ 53.454656] R13: ffff888136449ba0 R14: 0000000000002000 R15: dead000000000160
> [ 53.454664] FS: 00007fde095c4880(0000) GS:ffff88840c880000(0000) knlGS:0000000000000000
> [ 53.454672] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
> [ 53.454679] CR2: 00007fef132b4f28 CR3: 000000012245c002 CR4: 00000000003706e0
> [ 53.454686] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
> [ 53.454693] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
> [ 53.454700] Call Trace:
> [ 53.454833] ? i915_ggtt_suspend+0x1f0/0x1f0 [i915]
>
> Fixes: afeda4f3b1c8 ("drm/i915/dsb: Pre allocate and late cleanup of cmd buffer")
> Signed-off-by: Chris Wilson <chris@chris-wilson.co.uk>
> Cc: Ville Syrjälä <ville.syrjala@linux.intel.com>
> Cc: Matthew Auld <matthew.auld@intel.com>
> Cc: Lucas De Marchi <lucas.demarchi@intel.com>
Tested-by: Matthew Auld <matthew.auld@intel.com>
Reviewed-by: Matthew Auld <matthew.auld@intel.com>
_______________________________________________
Intel-gfx mailing list
Intel-gfx@lists.freedesktop.org
https://lists.freedesktop.org/mailman/listinfo/intel-gfx
prev parent reply other threads:[~2020-11-26 10:11 UTC|newest]
Thread overview: 5+ messages / expand[flat|nested] mbox.gz Atom feed top
2020-11-25 19:30 [Intel-gfx] [PATCH] drm/i915/display: Defer initial modeset until after GGTT is initialised Chris Wilson
2020-11-25 20:28 ` [Intel-gfx] ✗ Fi.CI.CHECKPATCH: warning for " Patchwork
2020-11-25 20:58 ` [Intel-gfx] ✓ Fi.CI.BAT: success " Patchwork
2020-11-25 22:47 ` [Intel-gfx] ✗ Fi.CI.IGT: failure " Patchwork
2020-11-26 10:11 ` Matthew Auld [this message]
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to='CAM0jSHPXwTwESVHfc3oTLkGp_qfc6UmzXpDVc0Rj8s=MD7mNUA@mail.gmail.com' \
--to=matthew.william.auld@gmail.com \
--cc=chris@chris-wilson.co.uk \
--cc=intel-gfx@lists.freedesktop.org \
--cc=lucas.demarchi@intel.com \
--cc=matthew.auld@intel.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.