[PATCH 0/3] RFC/T: dma_resv vs. mmap_sem

[PATCH 0/3] RFC/T: dma_resv vs. mmap_sem

[Daniel Vetter]

Hi all,

As part of all the recent discussions around ttm and dma_resv I started
looking into this. The goal (at least somewhen in the near future) is to
have it all documented and the cross-driver semantics locked down as much
as possible.

One of the biggest issues there is how the dma_resv ww_mutex fits into the
overall locking hierarchy, especially wrt core mm locks. This patch series
should fix that.

Comments, review and especially testing (there's only so much you can do
with auditing) very much appreciated.

Cheers, Daniel

Daniel Vetter (3):
  dma_resv: prime lockdep annotations
  drm/nouveau: slowpath for pushbuf ioctl
  drm/ttm: remove ttm_bo_wait_unreserved

 drivers/dma-buf/dma-resv.c            | 12 ++++++
 drivers/gpu/drm/nouveau/nouveau_gem.c | 57 ++++++++++++++++++---------
 drivers/gpu/drm/ttm/ttm_bo.c          | 34 ----------------
 drivers/gpu/drm/ttm/ttm_bo_vm.c       | 26 +-----------
 include/drm/ttm/ttm_bo_api.h          |  1 -
 5 files changed, 51 insertions(+), 79 deletions(-)

-- 
2.23.0.rc1

_______________________________________________
dri-devel mailing list
dri-devel@lists.freedesktop.org
https://lists.freedesktop.org/mailman/listinfo/dri-devel

[PATCH 1/3] dma_resv: prime lockdep annotations

[Daniel Vetter]

Full audit of everyone:

- i915, radeon, amdgpu should be clean per their maintainers.

- vram helpers should be fine, they don't do command submission, so
  really no business holding struct_mutex while doing copy_*_user. But
  I haven't checked them all.

- panfrost seems to dma_resv_lock only in panfrost_job_push, which
  looks clean.

- v3d holds dma_resv locks in the tail of its v3d_submit_cl_ioctl(),
  copying from/to userspace happens all in v3d_lookup_bos which is
  outside of the critical section.

- vmwgfx has a bunch of ioctls that do their own copy_*_user:
  - vmw_execbuf_process: First this does some copies in
    vmw_execbuf_cmdbuf() and also in the vmw_execbuf_process() itself.
    Then comes the usual ttm reserve/validate sequence, then actual
    submission/fencing, then unreserving, and finally some more
    copy_to_user in vmw_execbuf_copy_fence_user. Glossing over tons of
    details, but looks all safe.
  - vmw_fence_event_ioctl: No ttm_reserve/dma_resv_lock anywhere to be
    seen, seems to only create a fence and copy it out.
  - a pile of smaller ioctl in vmwgfx_ioctl.c, no reservations to be
    found there.
  Summary: vmwgfx seems to be fine too.

- virtio: There's virtio_gpu_execbuffer_ioctl, which does all the
  copying from userspace before even looking up objects through their
  handles, so safe. Plus the getparam/getcaps ioctl, also both safe.

- qxl only has qxl_execbuffer_ioctl, which calls into
  qxl_process_single_command. There's a lovely comment before the
  __copy_from_user_inatomic that the slowpath should be copied from
  i915, but I guess that never happened. Try not to be unlucky and get
  your CS data evicted between when it's written and the kernel tries
  to read it. The only other copy_from_user is for relocs, but those
  are done before qxl_release_reserve_list(), which seems to be the
  only thing reserving buffers (in the ttm/dma_resv sense) in that
  code. So looks safe.

- A debugfs file in nouveau_debugfs_pstate_set() and the usif ioctl in
  usif_ioctl() look safe. nouveau_gem_ioctl_pushbuf() otoh breaks this
  everywhere and needs to be fixed up.

Cc: Alex Deucher <alexander.deucher@amd.com>
Cc: Christian König <christian.koenig@amd.com>
Cc: Chris Wilson <chris@chris-wilson.co.uk>
Cc: Thomas Zimmermann <tzimmermann@suse.de>
Cc: Rob Herring <robh@kernel.org>
Cc: Tomeu Vizoso <tomeu.vizoso@collabora.com>
Cc: Eric Anholt <eric@anholt.net>
Cc: Dave Airlie <airlied@redhat.com>
Cc: Gerd Hoffmann <kraxel@redhat.com>
Cc: Ben Skeggs <bskeggs@redhat.com>
Cc: "VMware Graphics" <linux-graphics-maintainer@vmware.com>
Cc: Thomas Hellstrom <thellstrom@vmware.com>
Signed-off-by: Daniel Vetter <daniel.vetter@intel.com>
---
 drivers/dma-buf/dma-resv.c | 12 ++++++++++++
 1 file changed, 12 insertions(+)

diff --git a/drivers/dma-buf/dma-resv.c b/drivers/dma-buf/dma-resv.c
index 42a8f3f11681..3edca10d3faf 100644
--- a/drivers/dma-buf/dma-resv.c
+++ b/drivers/dma-buf/dma-resv.c
@@ -34,6 +34,7 @@
 
 #include <linux/dma-resv.h>
 #include <linux/export.h>
+#include <linux/sched/mm.h>
 
 /**
  * DOC: Reservation Object Overview
@@ -107,6 +108,17 @@ void dma_resv_init(struct dma_resv *obj)
 			&reservation_seqcount_class);
 	RCU_INIT_POINTER(obj->fence, NULL);
 	RCU_INIT_POINTER(obj->fence_excl, NULL);
+
+	if (IS_ENABLED(CONFIG_LOCKDEP)) {
+		if (current->mm)
+			down_read(&current->mm->mmap_sem);
+		ww_mutex_lock(&obj->lock, NULL);
+		fs_reclaim_acquire(GFP_KERNEL);
+		fs_reclaim_release(GFP_KERNEL);
+		ww_mutex_unlock(&obj->lock);
+		if (current->mm)
+			up_read(&current->mm->mmap_sem);
+	}
 }
 EXPORT_SYMBOL(dma_resv_init);
 
-- 
2.23.0.rc1

_______________________________________________
Intel-gfx mailing list
Intel-gfx@lists.freedesktop.org
https://lists.freedesktop.org/mailman/listinfo/intel-gfx

[PATCH 2/3] drm/nouveau: slowpath for pushbuf ioctl

[Daniel Vetter]

We can't copy_*_user while holding reservations, that will (soon even
for nouveau) lead to deadlocks. And it breaks the cross-driver
contract around dma_resv.

Fix this by adding a slowpath for when we need relocations, and by
pushing the writeback of the new presumed offsets to the very end.

Aside from "it compiles" entirely untested unfortunately.

Signed-off-by: Daniel Vetter <daniel.vetter@intel.com>
Cc: Ben Skeggs <bskeggs@redhat.com>
Cc: nouveau@lists.freedesktop.org
---
 drivers/gpu/drm/nouveau/nouveau_gem.c | 57 ++++++++++++++++++---------
 1 file changed, 38 insertions(+), 19 deletions(-)

diff --git a/drivers/gpu/drm/nouveau/nouveau_gem.c b/drivers/gpu/drm/nouveau/nouveau_gem.c
index c77302f969e8..60309b997951 100644
--- a/drivers/gpu/drm/nouveau/nouveau_gem.c
+++ b/drivers/gpu/drm/nouveau/nouveau_gem.c
@@ -482,12 +482,9 @@ validate_init(struct nouveau_channel *chan, struct drm_file *file_priv,
 
 static int
 validate_list(struct nouveau_channel *chan, struct nouveau_cli *cli,
-	      struct list_head *list, struct drm_nouveau_gem_pushbuf_bo *pbbo,
-	      uint64_t user_pbbo_ptr)
+	      struct list_head *list, struct drm_nouveau_gem_pushbuf_bo *pbbo)
 {
 	struct nouveau_drm *drm = chan->drm;
-	struct drm_nouveau_gem_pushbuf_bo __user *upbbo =
-				(void __force __user *)(uintptr_t)user_pbbo_ptr;
 	struct nouveau_bo *nvbo;
 	int ret, relocs = 0;
 
@@ -531,10 +528,6 @@ validate_list(struct nouveau_channel *chan, struct nouveau_cli *cli,
 			b->presumed.offset = nvbo->bo.offset;
 			b->presumed.valid = 0;
 			relocs++;
-
-			if (copy_to_user(&upbbo[nvbo->pbbo_index].presumed,
-					     &b->presumed, sizeof(b->presumed)))
-				return -EFAULT;
 		}
 	}
 
@@ -545,8 +538,8 @@ static int
 nouveau_gem_pushbuf_validate(struct nouveau_channel *chan,
 			     struct drm_file *file_priv,
 			     struct drm_nouveau_gem_pushbuf_bo *pbbo,
-			     uint64_t user_buffers, int nr_buffers,
-			     struct validate_op *op, int *apply_relocs)
+			     int nr_buffers,
+			     struct validate_op *op, bool *apply_relocs)
 {
 	struct nouveau_cli *cli = nouveau_cli(file_priv);
 	int ret;
@@ -563,7 +556,7 @@ nouveau_gem_pushbuf_validate(struct nouveau_channel *chan,
 		return ret;
 	}
 
-	ret = validate_list(chan, cli, &op->list, pbbo, user_buffers);
+	ret = validate_list(chan, cli, &op->list, pbbo);
 	if (unlikely(ret < 0)) {
 		if (ret != -ERESTARTSYS)
 			NV_PRINTK(err, cli, "validating bo list\n");
@@ -603,16 +596,12 @@ u_memcpya(uint64_t user, unsigned nmemb, unsigned size)
 static int
 nouveau_gem_pushbuf_reloc_apply(struct nouveau_cli *cli,
 				struct drm_nouveau_gem_pushbuf *req,
+				struct drm_nouveau_gem_pushbuf_reloc *reloc,
 				struct drm_nouveau_gem_pushbuf_bo *bo)
 {
-	struct drm_nouveau_gem_pushbuf_reloc *reloc = NULL;
 	int ret = 0;
 	unsigned i;
 
-	reloc = u_memcpya(req->relocs, req->nr_relocs, sizeof(*reloc));
-	if (IS_ERR(reloc))
-		return PTR_ERR(reloc);
-
 	for (i = 0; i < req->nr_relocs; i++) {
 		struct drm_nouveau_gem_pushbuf_reloc *r = &reloc[i];
 		struct drm_nouveau_gem_pushbuf_bo *b;
@@ -691,11 +680,13 @@ nouveau_gem_ioctl_pushbuf(struct drm_device *dev, void *data,
 	struct nouveau_drm *drm = nouveau_drm(dev);
 	struct drm_nouveau_gem_pushbuf *req = data;
 	struct drm_nouveau_gem_pushbuf_push *push;
+	struct drm_nouveau_gem_pushbuf_reloc *reloc = NULL;
 	struct drm_nouveau_gem_pushbuf_bo *bo;
 	struct nouveau_channel *chan = NULL;
 	struct validate_op op;
 	struct nouveau_fence *fence = NULL;
-	int i, j, ret = 0, do_reloc = 0;
+	int i, j, ret = 0;
+	bool do_reloc = false;
 
 	if (unlikely(!abi16))
 		return -ENOMEM;
@@ -753,7 +744,8 @@ nouveau_gem_ioctl_pushbuf(struct drm_device *dev, void *data,
 	}
 
 	/* Validate buffer list */
-	ret = nouveau_gem_pushbuf_validate(chan, file_priv, bo, req->buffers,
+revalidate:
+	ret = nouveau_gem_pushbuf_validate(chan, file_priv, bo,
 					   req->nr_buffers, &op, &do_reloc);
 	if (ret) {
 		if (ret != -ERESTARTSYS)
@@ -763,7 +755,18 @@ nouveau_gem_ioctl_pushbuf(struct drm_device *dev, void *data,
 
 	/* Apply any relocations that are required */
 	if (do_reloc) {
-		ret = nouveau_gem_pushbuf_reloc_apply(cli, req, bo);
+		if (!reloc) {
+			validate_fini(&op, chan, NULL, bo);
+			reloc = u_memcpya(req->relocs, req->nr_relocs, sizeof(*reloc));
+			if (IS_ERR(reloc)) {
+				ret = PTR_ERR(reloc);
+				goto out_prevalid;
+			}
+
+			goto revalidate;
+		}
+
+		ret = nouveau_gem_pushbuf_reloc_apply(cli, req, reloc, bo);
 		if (ret) {
 			NV_PRINTK(err, cli, "reloc apply: %d\n", ret);
 			goto out;
@@ -849,6 +852,22 @@ nouveau_gem_ioctl_pushbuf(struct drm_device *dev, void *data,
 	validate_fini(&op, chan, fence, bo);
 	nouveau_fence_unref(&fence);
 
+	if (do_reloc) {
+		struct drm_nouveau_gem_pushbuf_bo __user *upbbo =
+			u64_to_user_ptr(req->buffers);
+
+		for (i = 0; i < req->nr_buffers; i++) {
+			if (bo[i].presumed.valid)
+				continue;
+
+			if (copy_to_user(&upbbo[i].presumed, &bo[i].presumed,
+					 sizeof(bo[i].presumed))) {
+				ret = -EFAULT;
+				break;
+			}
+		}
+		u_free(reloc);
+	}
 out_prevalid:
 	u_free(bo);
 	u_free(push);
-- 
2.23.0.rc1

_______________________________________________
Intel-gfx mailing list
Intel-gfx@lists.freedesktop.org
https://lists.freedesktop.org/mailman/listinfo/intel-gfx

[PATCH 3/3] drm/ttm: remove ttm_bo_wait_unreserved

[Daniel Vetter]

With nouveau fixed all ttm-using drives have the correct nesting of
mmap_sem vs dma_resv, and we can just lock the buffer.

Assuming I didn't screw up anything with my audit of course.

Signed-off-by: Daniel Vetter <daniel.vetter@intel.com>
Cc: Christian Koenig <christian.koenig@amd.com>
Cc: Huang Rui <ray.huang@amd.com>
Cc: Gerd Hoffmann <kraxel@redhat.com>
Cc: "VMware Graphics" <linux-graphics-maintainer@vmware.com>
Cc: Thomas Hellstrom <thellstrom@vmware.com>
---
 drivers/gpu/drm/ttm/ttm_bo.c    | 34 ---------------------------------
 drivers/gpu/drm/ttm/ttm_bo_vm.c | 26 +------------------------
 include/drm/ttm/ttm_bo_api.h    |  1 -
 3 files changed, 1 insertion(+), 60 deletions(-)

diff --git a/drivers/gpu/drm/ttm/ttm_bo.c b/drivers/gpu/drm/ttm/ttm_bo.c
index 20ff56f27aa4..a952dd624b06 100644
--- a/drivers/gpu/drm/ttm/ttm_bo.c
+++ b/drivers/gpu/drm/ttm/ttm_bo.c
@@ -1954,37 +1954,3 @@ void ttm_bo_swapout_all(struct ttm_bo_device *bdev)
 		;
 }
 EXPORT_SYMBOL(ttm_bo_swapout_all);
-
-/**
- * ttm_bo_wait_unreserved - interruptible wait for a buffer object to become
- * unreserved
- *
- * @bo: Pointer to buffer
- */
-int ttm_bo_wait_unreserved(struct ttm_buffer_object *bo)
-{
-	int ret;
-
-	/*
-	 * In the absense of a wait_unlocked API,
-	 * Use the bo::wu_mutex to avoid triggering livelocks due to
-	 * concurrent use of this function. Note that this use of
-	 * bo::wu_mutex can go away if we change locking order to
-	 * mmap_sem -> bo::reserve.
-	 */
-	ret = mutex_lock_interruptible(&bo->wu_mutex);
-	if (unlikely(ret != 0))
-		return -ERESTARTSYS;
-	if (!dma_resv_is_locked(bo->base.resv))
-		goto out_unlock;
-	ret = dma_resv_lock_interruptible(bo->base.resv, NULL);
-	if (ret == -EINTR)
-		ret = -ERESTARTSYS;
-	if (unlikely(ret != 0))
-		goto out_unlock;
-	dma_resv_unlock(bo->base.resv);
-
-out_unlock:
-	mutex_unlock(&bo->wu_mutex);
-	return ret;
-}
diff --git a/drivers/gpu/drm/ttm/ttm_bo_vm.c b/drivers/gpu/drm/ttm/ttm_bo_vm.c
index 76eedb963693..505e1787aeea 100644
--- a/drivers/gpu/drm/ttm/ttm_bo_vm.c
+++ b/drivers/gpu/drm/ttm/ttm_bo_vm.c
@@ -125,31 +125,7 @@ static vm_fault_t ttm_bo_vm_fault(struct vm_fault *vmf)
 		&bdev->man[bo->mem.mem_type];
 	struct vm_area_struct cvma;
 
-	/*
-	 * Work around locking order reversal in fault / nopfn
-	 * between mmap_sem and bo_reserve: Perform a trylock operation
-	 * for reserve, and if it fails, retry the fault after waiting
-	 * for the buffer to become unreserved.
-	 */
-	if (unlikely(!dma_resv_trylock(bo->base.resv))) {
-		if (vmf->flags & FAULT_FLAG_ALLOW_RETRY) {
-			if (!(vmf->flags & FAULT_FLAG_RETRY_NOWAIT)) {
-				ttm_bo_get(bo);
-				up_read(&vmf->vma->vm_mm->mmap_sem);
-				(void) ttm_bo_wait_unreserved(bo);
-				ttm_bo_put(bo);
-			}
-
-			return VM_FAULT_RETRY;
-		}
-
-		/*
-		 * If we'd want to change locking order to
-		 * mmap_sem -> bo::reserve, we'd use a blocking reserve here
-		 * instead of retrying the fault...
-		 */
-		return VM_FAULT_NOPAGE;
-	}
+	dma_resv_lock(bo->base.resv, NULL);
 
 	/*
 	 * Refuse to fault imported pages. This should be handled
diff --git a/include/drm/ttm/ttm_bo_api.h b/include/drm/ttm/ttm_bo_api.h
index 43c4929a2171..6b50e624e3e2 100644
--- a/include/drm/ttm/ttm_bo_api.h
+++ b/include/drm/ttm/ttm_bo_api.h
@@ -765,7 +765,6 @@ ssize_t ttm_bo_io(struct ttm_bo_device *bdev, struct file *filp,
 int ttm_bo_swapout(struct ttm_bo_global *glob,
 			struct ttm_operation_ctx *ctx);
 void ttm_bo_swapout_all(struct ttm_bo_device *bdev);
-int ttm_bo_wait_unreserved(struct ttm_buffer_object *bo);
 
 /**
  * ttm_bo_uses_embedded_gem_object - check if the given bo uses the
-- 
2.23.0.rc1

_______________________________________________
Intel-gfx mailing list
Intel-gfx@lists.freedesktop.org
https://lists.freedesktop.org/mailman/listinfo/intel-gfx

Re: [PATCH 1/3] dma_resv: prime lockdep annotations

[Koenig, Christian]

Am 20.08.19 um 16:53 schrieb Daniel Vetter:
> Full audit of everyone:
>
> - i915, radeon, amdgpu should be clean per their maintainers.
>
> - vram helpers should be fine, they don't do command submission, so
>    really no business holding struct_mutex while doing copy_*_user. But
>    I haven't checked them all.
>
> - panfrost seems to dma_resv_lock only in panfrost_job_push, which
>    looks clean.
>
> - v3d holds dma_resv locks in the tail of its v3d_submit_cl_ioctl(),
>    copying from/to userspace happens all in v3d_lookup_bos which is
>    outside of the critical section.
>
> - vmwgfx has a bunch of ioctls that do their own copy_*_user:
>    - vmw_execbuf_process: First this does some copies in
>      vmw_execbuf_cmdbuf() and also in the vmw_execbuf_process() itself.
>      Then comes the usual ttm reserve/validate sequence, then actual
>      submission/fencing, then unreserving, and finally some more
>      copy_to_user in vmw_execbuf_copy_fence_user. Glossing over tons of
>      details, but looks all safe.
>    - vmw_fence_event_ioctl: No ttm_reserve/dma_resv_lock anywhere to be
>      seen, seems to only create a fence and copy it out.
>    - a pile of smaller ioctl in vmwgfx_ioctl.c, no reservations to be
>      found there.
>    Summary: vmwgfx seems to be fine too.
>
> - virtio: There's virtio_gpu_execbuffer_ioctl, which does all the
>    copying from userspace before even looking up objects through their
>    handles, so safe. Plus the getparam/getcaps ioctl, also both safe.
>
> - qxl only has qxl_execbuffer_ioctl, which calls into
>    qxl_process_single_command. There's a lovely comment before the
>    __copy_from_user_inatomic that the slowpath should be copied from
>    i915, but I guess that never happened. Try not to be unlucky and get
>    your CS data evicted between when it's written and the kernel tries
>    to read it. The only other copy_from_user is for relocs, but those
>    are done before qxl_release_reserve_list(), which seems to be the
>    only thing reserving buffers (in the ttm/dma_resv sense) in that
>    code. So looks safe.
>
> - A debugfs file in nouveau_debugfs_pstate_set() and the usif ioctl in
>    usif_ioctl() look safe. nouveau_gem_ioctl_pushbuf() otoh breaks this
>    everywhere and needs to be fixed up.
>
> Cc: Alex Deucher <alexander.deucher@amd.com>
> Cc: Christian König <christian.koenig@amd.com>
> Cc: Chris Wilson <chris@chris-wilson.co.uk>
> Cc: Thomas Zimmermann <tzimmermann@suse.de>
> Cc: Rob Herring <robh@kernel.org>
> Cc: Tomeu Vizoso <tomeu.vizoso@collabora.com>
> Cc: Eric Anholt <eric@anholt.net>
> Cc: Dave Airlie <airlied@redhat.com>
> Cc: Gerd Hoffmann <kraxel@redhat.com>
> Cc: Ben Skeggs <bskeggs@redhat.com>
> Cc: "VMware Graphics" <linux-graphics-maintainer@vmware.com>
> Cc: Thomas Hellstrom <thellstrom@vmware.com>
> Signed-off-by: Daniel Vetter <daniel.vetter@intel.com>

Reviewed-by: Christian König <christian.koenig@amd.com>

> ---
>   drivers/dma-buf/dma-resv.c | 12 ++++++++++++
>   1 file changed, 12 insertions(+)
>
> diff --git a/drivers/dma-buf/dma-resv.c b/drivers/dma-buf/dma-resv.c
> index 42a8f3f11681..3edca10d3faf 100644
> --- a/drivers/dma-buf/dma-resv.c
> +++ b/drivers/dma-buf/dma-resv.c
> @@ -34,6 +34,7 @@
>   
>   #include <linux/dma-resv.h>
>   #include <linux/export.h>
> +#include <linux/sched/mm.h>
>   
>   /**
>    * DOC: Reservation Object Overview
> @@ -107,6 +108,17 @@ void dma_resv_init(struct dma_resv *obj)
>   			&reservation_seqcount_class);
>   	RCU_INIT_POINTER(obj->fence, NULL);
>   	RCU_INIT_POINTER(obj->fence_excl, NULL);
> +
> +	if (IS_ENABLED(CONFIG_LOCKDEP)) {
> +		if (current->mm)
> +			down_read(&current->mm->mmap_sem);
> +		ww_mutex_lock(&obj->lock, NULL);
> +		fs_reclaim_acquire(GFP_KERNEL);
> +		fs_reclaim_release(GFP_KERNEL);
> +		ww_mutex_unlock(&obj->lock);
> +		if (current->mm)
> +			up_read(&current->mm->mmap_sem);
> +	}
>   }
>   EXPORT_SYMBOL(dma_resv_init);
>   

_______________________________________________
dri-devel mailing list
dri-devel@lists.freedesktop.org
https://lists.freedesktop.org/mailman/listinfo/dri-devel

Re: [PATCH 1/3] dma_resv: prime lockdep annotations

[Chris Wilson]

Quoting Daniel Vetter (2019-08-20 15:53:34)
> Full audit of everyone:
> 
> - i915, radeon, amdgpu should be clean per their maintainers.
> 
> - vram helpers should be fine, they don't do command submission, so
>   really no business holding struct_mutex while doing copy_*_user. But
>   I haven't checked them all.
> 
> - panfrost seems to dma_resv_lock only in panfrost_job_push, which
>   looks clean.
> 
> - v3d holds dma_resv locks in the tail of its v3d_submit_cl_ioctl(),
>   copying from/to userspace happens all in v3d_lookup_bos which is
>   outside of the critical section.
> 
> - vmwgfx has a bunch of ioctls that do their own copy_*_user:
>   - vmw_execbuf_process: First this does some copies in
>     vmw_execbuf_cmdbuf() and also in the vmw_execbuf_process() itself.
>     Then comes the usual ttm reserve/validate sequence, then actual
>     submission/fencing, then unreserving, and finally some more
>     copy_to_user in vmw_execbuf_copy_fence_user. Glossing over tons of
>     details, but looks all safe.
>   - vmw_fence_event_ioctl: No ttm_reserve/dma_resv_lock anywhere to be
>     seen, seems to only create a fence and copy it out.
>   - a pile of smaller ioctl in vmwgfx_ioctl.c, no reservations to be
>     found there.
>   Summary: vmwgfx seems to be fine too.
> 
> - virtio: There's virtio_gpu_execbuffer_ioctl, which does all the
>   copying from userspace before even looking up objects through their
>   handles, so safe. Plus the getparam/getcaps ioctl, also both safe.
> 
> - qxl only has qxl_execbuffer_ioctl, which calls into
>   qxl_process_single_command. There's a lovely comment before the
>   __copy_from_user_inatomic that the slowpath should be copied from
>   i915, but I guess that never happened. Try not to be unlucky and get
>   your CS data evicted between when it's written and the kernel tries
>   to read it. The only other copy_from_user is for relocs, but those
>   are done before qxl_release_reserve_list(), which seems to be the
>   only thing reserving buffers (in the ttm/dma_resv sense) in that
>   code. So looks safe.
> 
> - A debugfs file in nouveau_debugfs_pstate_set() and the usif ioctl in
>   usif_ioctl() look safe. nouveau_gem_ioctl_pushbuf() otoh breaks this
>   everywhere and needs to be fixed up.
> 
> Cc: Alex Deucher <alexander.deucher@amd.com>
> Cc: Christian König <christian.koenig@amd.com>
> Cc: Chris Wilson <chris@chris-wilson.co.uk>
> Cc: Thomas Zimmermann <tzimmermann@suse.de>
> Cc: Rob Herring <robh@kernel.org>
> Cc: Tomeu Vizoso <tomeu.vizoso@collabora.com>
> Cc: Eric Anholt <eric@anholt.net>
> Cc: Dave Airlie <airlied@redhat.com>
> Cc: Gerd Hoffmann <kraxel@redhat.com>
> Cc: Ben Skeggs <bskeggs@redhat.com>
> Cc: "VMware Graphics" <linux-graphics-maintainer@vmware.com>
> Cc: Thomas Hellstrom <thellstrom@vmware.com>
> Signed-off-by: Daniel Vetter <daniel.vetter@intel.com>
> ---
>  drivers/dma-buf/dma-resv.c | 12 ++++++++++++
>  1 file changed, 12 insertions(+)
> 
> diff --git a/drivers/dma-buf/dma-resv.c b/drivers/dma-buf/dma-resv.c
> index 42a8f3f11681..3edca10d3faf 100644
> --- a/drivers/dma-buf/dma-resv.c
> +++ b/drivers/dma-buf/dma-resv.c
> @@ -34,6 +34,7 @@
>  
>  #include <linux/dma-resv.h>
>  #include <linux/export.h>
> +#include <linux/sched/mm.h>
>  
>  /**
>   * DOC: Reservation Object Overview
> @@ -107,6 +108,17 @@ void dma_resv_init(struct dma_resv *obj)
>                         &reservation_seqcount_class);
>         RCU_INIT_POINTER(obj->fence, NULL);
>         RCU_INIT_POINTER(obj->fence_excl, NULL);
> +
> +       if (IS_ENABLED(CONFIG_LOCKDEP)) {
> +               if (current->mm)
> +                       down_read(&current->mm->mmap_sem);
> +               ww_mutex_lock(&obj->lock, NULL);
> +               fs_reclaim_acquire(GFP_KERNEL);
> +               fs_reclaim_release(GFP_KERNEL);

A candidate for might_alloc(GFP_KERNEL), we've repeated this often
enough.
-Chris
_______________________________________________
Intel-gfx mailing list
Intel-gfx@lists.freedesktop.org
https://lists.freedesktop.org/mailman/listinfo/intel-gfx

Re: [PATCH 3/3] drm/ttm: remove ttm_bo_wait_unreserved

[Koenig, Christian]

Am 20.08.19 um 16:53 schrieb Daniel Vetter:
> With nouveau fixed all ttm-using drives have the correct nesting of
> mmap_sem vs dma_resv, and we can just lock the buffer.
>
> Assuming I didn't screw up anything with my audit of course.
>
> Signed-off-by: Daniel Vetter <daniel.vetter@intel.com>
> Cc: Christian Koenig <christian.koenig@amd.com>
> Cc: Huang Rui <ray.huang@amd.com>
> Cc: Gerd Hoffmann <kraxel@redhat.com>
> Cc: "VMware Graphics" <linux-graphics-maintainer@vmware.com>
> Cc: Thomas Hellstrom <thellstrom@vmware.com>

Yes, please. But one more point: you can now remove bo->wu_mutex as well!

Apart from that Reviewed-by: Christian König <christian.koenig@amd.com>

> ---
>   drivers/gpu/drm/ttm/ttm_bo.c    | 34 ---------------------------------
>   drivers/gpu/drm/ttm/ttm_bo_vm.c | 26 +------------------------
>   include/drm/ttm/ttm_bo_api.h    |  1 -
>   3 files changed, 1 insertion(+), 60 deletions(-)
>
> diff --git a/drivers/gpu/drm/ttm/ttm_bo.c b/drivers/gpu/drm/ttm/ttm_bo.c
> index 20ff56f27aa4..a952dd624b06 100644
> --- a/drivers/gpu/drm/ttm/ttm_bo.c
> +++ b/drivers/gpu/drm/ttm/ttm_bo.c
> @@ -1954,37 +1954,3 @@ void ttm_bo_swapout_all(struct ttm_bo_device *bdev)
>   		;
>   }
>   EXPORT_SYMBOL(ttm_bo_swapout_all);
> -
> -/**
> - * ttm_bo_wait_unreserved - interruptible wait for a buffer object to become
> - * unreserved
> - *
> - * @bo: Pointer to buffer
> - */
> -int ttm_bo_wait_unreserved(struct ttm_buffer_object *bo)
> -{
> -	int ret;
> -
> -	/*
> -	 * In the absense of a wait_unlocked API,
> -	 * Use the bo::wu_mutex to avoid triggering livelocks due to
> -	 * concurrent use of this function. Note that this use of
> -	 * bo::wu_mutex can go away if we change locking order to
> -	 * mmap_sem -> bo::reserve.
> -	 */
> -	ret = mutex_lock_interruptible(&bo->wu_mutex);
> -	if (unlikely(ret != 0))
> -		return -ERESTARTSYS;
> -	if (!dma_resv_is_locked(bo->base.resv))
> -		goto out_unlock;
> -	ret = dma_resv_lock_interruptible(bo->base.resv, NULL);
> -	if (ret == -EINTR)
> -		ret = -ERESTARTSYS;
> -	if (unlikely(ret != 0))
> -		goto out_unlock;
> -	dma_resv_unlock(bo->base.resv);
> -
> -out_unlock:
> -	mutex_unlock(&bo->wu_mutex);
> -	return ret;
> -}
> diff --git a/drivers/gpu/drm/ttm/ttm_bo_vm.c b/drivers/gpu/drm/ttm/ttm_bo_vm.c
> index 76eedb963693..505e1787aeea 100644
> --- a/drivers/gpu/drm/ttm/ttm_bo_vm.c
> +++ b/drivers/gpu/drm/ttm/ttm_bo_vm.c
> @@ -125,31 +125,7 @@ static vm_fault_t ttm_bo_vm_fault(struct vm_fault *vmf)
>   		&bdev->man[bo->mem.mem_type];
>   	struct vm_area_struct cvma;
>   
> -	/*
> -	 * Work around locking order reversal in fault / nopfn
> -	 * between mmap_sem and bo_reserve: Perform a trylock operation
> -	 * for reserve, and if it fails, retry the fault after waiting
> -	 * for the buffer to become unreserved.
> -	 */
> -	if (unlikely(!dma_resv_trylock(bo->base.resv))) {
> -		if (vmf->flags & FAULT_FLAG_ALLOW_RETRY) {
> -			if (!(vmf->flags & FAULT_FLAG_RETRY_NOWAIT)) {
> -				ttm_bo_get(bo);
> -				up_read(&vmf->vma->vm_mm->mmap_sem);
> -				(void) ttm_bo_wait_unreserved(bo);
> -				ttm_bo_put(bo);
> -			}
> -
> -			return VM_FAULT_RETRY;
> -		}
> -
> -		/*
> -		 * If we'd want to change locking order to
> -		 * mmap_sem -> bo::reserve, we'd use a blocking reserve here
> -		 * instead of retrying the fault...
> -		 */
> -		return VM_FAULT_NOPAGE;
> -	}
> +	dma_resv_lock(bo->base.resv, NULL);
>   
>   	/*
>   	 * Refuse to fault imported pages. This should be handled
> diff --git a/include/drm/ttm/ttm_bo_api.h b/include/drm/ttm/ttm_bo_api.h
> index 43c4929a2171..6b50e624e3e2 100644
> --- a/include/drm/ttm/ttm_bo_api.h
> +++ b/include/drm/ttm/ttm_bo_api.h
> @@ -765,7 +765,6 @@ ssize_t ttm_bo_io(struct ttm_bo_device *bdev, struct file *filp,
>   int ttm_bo_swapout(struct ttm_bo_global *glob,
>   			struct ttm_operation_ctx *ctx);
>   void ttm_bo_swapout_all(struct ttm_bo_device *bdev);
> -int ttm_bo_wait_unreserved(struct ttm_buffer_object *bo);
>   
>   /**
>    * ttm_bo_uses_embedded_gem_object - check if the given bo uses the

_______________________________________________
Intel-gfx mailing list
Intel-gfx@lists.freedesktop.org
https://lists.freedesktop.org/mailman/listinfo/intel-gfx

Re: [PATCH 3/3] drm/ttm: remove ttm_bo_wait_unreserved

[Daniel Vetter]

On Tue, Aug 20, 2019 at 5:16 PM Koenig, Christian
<Christian.Koenig@amd.com> wrote:
>
> Am 20.08.19 um 16:53 schrieb Daniel Vetter:
> > With nouveau fixed all ttm-using drives have the correct nesting of
> > mmap_sem vs dma_resv, and we can just lock the buffer.
> >
> > Assuming I didn't screw up anything with my audit of course.
> >
> > Signed-off-by: Daniel Vetter <daniel.vetter@intel.com>
> > Cc: Christian Koenig <christian.koenig@amd.com>
> > Cc: Huang Rui <ray.huang@amd.com>
> > Cc: Gerd Hoffmann <kraxel@redhat.com>
> > Cc: "VMware Graphics" <linux-graphics-maintainer@vmware.com>
> > Cc: Thomas Hellstrom <thellstrom@vmware.com>
>
> Yes, please. But one more point: you can now remove bo->wu_mutex as well!

Ah right totally forgot about that in my enthusiasm after all the
auditing and fixing nouveau.

> Apart from that Reviewed-by: Christian König <christian.koenig@amd.com>

Thanks, I already respun the patches, so will be in the next version.
Can you pls also give this a spin on the amdgpu CI, just to make sure
it's all fine? With full lockdep ofc. And then reply with a t-b.

Thanks, Daniel
>
> > ---
> >   drivers/gpu/drm/ttm/ttm_bo.c    | 34 ---------------------------------
> >   drivers/gpu/drm/ttm/ttm_bo_vm.c | 26 +------------------------
> >   include/drm/ttm/ttm_bo_api.h    |  1 -
> >   3 files changed, 1 insertion(+), 60 deletions(-)
> >
> > diff --git a/drivers/gpu/drm/ttm/ttm_bo.c b/drivers/gpu/drm/ttm/ttm_bo.c
> > index 20ff56f27aa4..a952dd624b06 100644
> > --- a/drivers/gpu/drm/ttm/ttm_bo.c
> > +++ b/drivers/gpu/drm/ttm/ttm_bo.c
> > @@ -1954,37 +1954,3 @@ void ttm_bo_swapout_all(struct ttm_bo_device *bdev)
> >               ;
> >   }
> >   EXPORT_SYMBOL(ttm_bo_swapout_all);
> > -
> > -/**
> > - * ttm_bo_wait_unreserved - interruptible wait for a buffer object to become
> > - * unreserved
> > - *
> > - * @bo: Pointer to buffer
> > - */
> > -int ttm_bo_wait_unreserved(struct ttm_buffer_object *bo)
> > -{
> > -     int ret;
> > -
> > -     /*
> > -      * In the absense of a wait_unlocked API,
> > -      * Use the bo::wu_mutex to avoid triggering livelocks due to
> > -      * concurrent use of this function. Note that this use of
> > -      * bo::wu_mutex can go away if we change locking order to
> > -      * mmap_sem -> bo::reserve.
> > -      */
> > -     ret = mutex_lock_interruptible(&bo->wu_mutex);
> > -     if (unlikely(ret != 0))
> > -             return -ERESTARTSYS;
> > -     if (!dma_resv_is_locked(bo->base.resv))
> > -             goto out_unlock;
> > -     ret = dma_resv_lock_interruptible(bo->base.resv, NULL);
> > -     if (ret == -EINTR)
> > -             ret = -ERESTARTSYS;
> > -     if (unlikely(ret != 0))
> > -             goto out_unlock;
> > -     dma_resv_unlock(bo->base.resv);
> > -
> > -out_unlock:
> > -     mutex_unlock(&bo->wu_mutex);
> > -     return ret;
> > -}
> > diff --git a/drivers/gpu/drm/ttm/ttm_bo_vm.c b/drivers/gpu/drm/ttm/ttm_bo_vm.c
> > index 76eedb963693..505e1787aeea 100644
> > --- a/drivers/gpu/drm/ttm/ttm_bo_vm.c
> > +++ b/drivers/gpu/drm/ttm/ttm_bo_vm.c
> > @@ -125,31 +125,7 @@ static vm_fault_t ttm_bo_vm_fault(struct vm_fault *vmf)
> >               &bdev->man[bo->mem.mem_type];
> >       struct vm_area_struct cvma;
> >
> > -     /*
> > -      * Work around locking order reversal in fault / nopfn
> > -      * between mmap_sem and bo_reserve: Perform a trylock operation
> > -      * for reserve, and if it fails, retry the fault after waiting
> > -      * for the buffer to become unreserved.
> > -      */
> > -     if (unlikely(!dma_resv_trylock(bo->base.resv))) {
> > -             if (vmf->flags & FAULT_FLAG_ALLOW_RETRY) {
> > -                     if (!(vmf->flags & FAULT_FLAG_RETRY_NOWAIT)) {
> > -                             ttm_bo_get(bo);
> > -                             up_read(&vmf->vma->vm_mm->mmap_sem);
> > -                             (void) ttm_bo_wait_unreserved(bo);
> > -                             ttm_bo_put(bo);
> > -                     }
> > -
> > -                     return VM_FAULT_RETRY;
> > -             }
> > -
> > -             /*
> > -              * If we'd want to change locking order to
> > -              * mmap_sem -> bo::reserve, we'd use a blocking reserve here
> > -              * instead of retrying the fault...
> > -              */
> > -             return VM_FAULT_NOPAGE;
> > -     }
> > +     dma_resv_lock(bo->base.resv, NULL);
> >
> >       /*
> >        * Refuse to fault imported pages. This should be handled
> > diff --git a/include/drm/ttm/ttm_bo_api.h b/include/drm/ttm/ttm_bo_api.h
> > index 43c4929a2171..6b50e624e3e2 100644
> > --- a/include/drm/ttm/ttm_bo_api.h
> > +++ b/include/drm/ttm/ttm_bo_api.h
> > @@ -765,7 +765,6 @@ ssize_t ttm_bo_io(struct ttm_bo_device *bdev, struct file *filp,
> >   int ttm_bo_swapout(struct ttm_bo_global *glob,
> >                       struct ttm_operation_ctx *ctx);
> >   void ttm_bo_swapout_all(struct ttm_bo_device *bdev);
> > -int ttm_bo_wait_unreserved(struct ttm_buffer_object *bo);
> >
> >   /**
> >    * ttm_bo_uses_embedded_gem_object - check if the given bo uses the
>


-- 
Daniel Vetter
Software Engineer, Intel Corporation
+41 (0) 79 365 57 48 - http://blog.ffwll.ch
_______________________________________________
dri-devel mailing list
dri-devel@lists.freedesktop.org
https://lists.freedesktop.org/mailman/listinfo/dri-devel

Re: [PATCH 3/3] drm/ttm: remove ttm_bo_wait_unreserved

[Koenig, Christian]

Am 20.08.19 um 17:21 schrieb Daniel Vetter:
> On Tue, Aug 20, 2019 at 5:16 PM Koenig, Christian
> <Christian.Koenig@amd.com> wrote:
>> Am 20.08.19 um 16:53 schrieb Daniel Vetter:
>>> With nouveau fixed all ttm-using drives have the correct nesting of
>>> mmap_sem vs dma_resv, and we can just lock the buffer.
>>>
>>> Assuming I didn't screw up anything with my audit of course.
>>>
>>> Signed-off-by: Daniel Vetter <daniel.vetter@intel.com>
>>> Cc: Christian Koenig <christian.koenig@amd.com>
>>> Cc: Huang Rui <ray.huang@amd.com>
>>> Cc: Gerd Hoffmann <kraxel@redhat.com>
>>> Cc: "VMware Graphics" <linux-graphics-maintainer@vmware.com>
>>> Cc: Thomas Hellstrom <thellstrom@vmware.com>
>> Yes, please. But one more point: you can now remove bo->wu_mutex as well!
> Ah right totally forgot about that in my enthusiasm after all the
> auditing and fixing nouveau.
>
>> Apart from that Reviewed-by: Christian König <christian.koenig@amd.com>
> Thanks, I already respun the patches, so will be in the next version.
> Can you pls also give this a spin on the amdgpu CI, just to make sure
> it's all fine? With full lockdep ofc. And then reply with a t-b.

I can ask for this on our call tomorrow, but I fear our CI 
infrastructure is not ready yet.

Christian.

>
> Thanks, Daniel
>>> ---
>>>    drivers/gpu/drm/ttm/ttm_bo.c    | 34 ---------------------------------
>>>    drivers/gpu/drm/ttm/ttm_bo_vm.c | 26 +------------------------
>>>    include/drm/ttm/ttm_bo_api.h    |  1 -
>>>    3 files changed, 1 insertion(+), 60 deletions(-)
>>>
>>> diff --git a/drivers/gpu/drm/ttm/ttm_bo.c b/drivers/gpu/drm/ttm/ttm_bo.c
>>> index 20ff56f27aa4..a952dd624b06 100644
>>> --- a/drivers/gpu/drm/ttm/ttm_bo.c
>>> +++ b/drivers/gpu/drm/ttm/ttm_bo.c
>>> @@ -1954,37 +1954,3 @@ void ttm_bo_swapout_all(struct ttm_bo_device *bdev)
>>>                ;
>>>    }
>>>    EXPORT_SYMBOL(ttm_bo_swapout_all);
>>> -
>>> -/**
>>> - * ttm_bo_wait_unreserved - interruptible wait for a buffer object to become
>>> - * unreserved
>>> - *
>>> - * @bo: Pointer to buffer
>>> - */
>>> -int ttm_bo_wait_unreserved(struct ttm_buffer_object *bo)
>>> -{
>>> -     int ret;
>>> -
>>> -     /*
>>> -      * In the absense of a wait_unlocked API,
>>> -      * Use the bo::wu_mutex to avoid triggering livelocks due to
>>> -      * concurrent use of this function. Note that this use of
>>> -      * bo::wu_mutex can go away if we change locking order to
>>> -      * mmap_sem -> bo::reserve.
>>> -      */
>>> -     ret = mutex_lock_interruptible(&bo->wu_mutex);
>>> -     if (unlikely(ret != 0))
>>> -             return -ERESTARTSYS;
>>> -     if (!dma_resv_is_locked(bo->base.resv))
>>> -             goto out_unlock;
>>> -     ret = dma_resv_lock_interruptible(bo->base.resv, NULL);
>>> -     if (ret == -EINTR)
>>> -             ret = -ERESTARTSYS;
>>> -     if (unlikely(ret != 0))
>>> -             goto out_unlock;
>>> -     dma_resv_unlock(bo->base.resv);
>>> -
>>> -out_unlock:
>>> -     mutex_unlock(&bo->wu_mutex);
>>> -     return ret;
>>> -}
>>> diff --git a/drivers/gpu/drm/ttm/ttm_bo_vm.c b/drivers/gpu/drm/ttm/ttm_bo_vm.c
>>> index 76eedb963693..505e1787aeea 100644
>>> --- a/drivers/gpu/drm/ttm/ttm_bo_vm.c
>>> +++ b/drivers/gpu/drm/ttm/ttm_bo_vm.c
>>> @@ -125,31 +125,7 @@ static vm_fault_t ttm_bo_vm_fault(struct vm_fault *vmf)
>>>                &bdev->man[bo->mem.mem_type];
>>>        struct vm_area_struct cvma;
>>>
>>> -     /*
>>> -      * Work around locking order reversal in fault / nopfn
>>> -      * between mmap_sem and bo_reserve: Perform a trylock operation
>>> -      * for reserve, and if it fails, retry the fault after waiting
>>> -      * for the buffer to become unreserved.
>>> -      */
>>> -     if (unlikely(!dma_resv_trylock(bo->base.resv))) {
>>> -             if (vmf->flags & FAULT_FLAG_ALLOW_RETRY) {
>>> -                     if (!(vmf->flags & FAULT_FLAG_RETRY_NOWAIT)) {
>>> -                             ttm_bo_get(bo);
>>> -                             up_read(&vmf->vma->vm_mm->mmap_sem);
>>> -                             (void) ttm_bo_wait_unreserved(bo);
>>> -                             ttm_bo_put(bo);
>>> -                     }
>>> -
>>> -                     return VM_FAULT_RETRY;
>>> -             }
>>> -
>>> -             /*
>>> -              * If we'd want to change locking order to
>>> -              * mmap_sem -> bo::reserve, we'd use a blocking reserve here
>>> -              * instead of retrying the fault...
>>> -              */
>>> -             return VM_FAULT_NOPAGE;
>>> -     }
>>> +     dma_resv_lock(bo->base.resv, NULL);
>>>
>>>        /*
>>>         * Refuse to fault imported pages. This should be handled
>>> diff --git a/include/drm/ttm/ttm_bo_api.h b/include/drm/ttm/ttm_bo_api.h
>>> index 43c4929a2171..6b50e624e3e2 100644
>>> --- a/include/drm/ttm/ttm_bo_api.h
>>> +++ b/include/drm/ttm/ttm_bo_api.h
>>> @@ -765,7 +765,6 @@ ssize_t ttm_bo_io(struct ttm_bo_device *bdev, struct file *filp,
>>>    int ttm_bo_swapout(struct ttm_bo_global *glob,
>>>                        struct ttm_operation_ctx *ctx);
>>>    void ttm_bo_swapout_all(struct ttm_bo_device *bdev);
>>> -int ttm_bo_wait_unreserved(struct ttm_buffer_object *bo);
>>>
>>>    /**
>>>     * ttm_bo_uses_embedded_gem_object - check if the given bo uses the
>

_______________________________________________
Intel-gfx mailing list
Intel-gfx@lists.freedesktop.org
https://lists.freedesktop.org/mailman/listinfo/intel-gfx

Re: [PATCH 3/3] drm/ttm: remove ttm_bo_wait_unreserved

[Daniel Vetter]

On Tue, Aug 20, 2019 at 5:34 PM Koenig, Christian
<Christian.Koenig@amd.com> wrote:
>
> Am 20.08.19 um 17:21 schrieb Daniel Vetter:
> > On Tue, Aug 20, 2019 at 5:16 PM Koenig, Christian
> > <Christian.Koenig@amd.com> wrote:
> >> Am 20.08.19 um 16:53 schrieb Daniel Vetter:
> >>> With nouveau fixed all ttm-using drives have the correct nesting of
> >>> mmap_sem vs dma_resv, and we can just lock the buffer.
> >>>
> >>> Assuming I didn't screw up anything with my audit of course.
> >>>
> >>> Signed-off-by: Daniel Vetter <daniel.vetter@intel.com>
> >>> Cc: Christian Koenig <christian.koenig@amd.com>
> >>> Cc: Huang Rui <ray.huang@amd.com>
> >>> Cc: Gerd Hoffmann <kraxel@redhat.com>
> >>> Cc: "VMware Graphics" <linux-graphics-maintainer@vmware.com>
> >>> Cc: Thomas Hellstrom <thellstrom@vmware.com>
> >> Yes, please. But one more point: you can now remove bo->wu_mutex as well!
> > Ah right totally forgot about that in my enthusiasm after all the
> > auditing and fixing nouveau.
> >
> >> Apart from that Reviewed-by: Christian König <christian.koenig@amd.com>
> > Thanks, I already respun the patches, so will be in the next version.
> > Can you pls also give this a spin on the amdgpu CI, just to make sure
> > it's all fine? With full lockdep ofc. And then reply with a t-b.
>
> I can ask for this on our call tomorrow, but I fear our CI
> infrastructure is not ready yet.

I thought you have some internal branch you all commit amdgpu stuff
for, and then Alex goes and collects the pieces that are ready? Or
does that all blow up if you push a patch which touches code outside
of the dkms?
-Daniel

>
> Christian.
>
> >
> > Thanks, Daniel
> >>> ---
> >>>    drivers/gpu/drm/ttm/ttm_bo.c    | 34 ---------------------------------
> >>>    drivers/gpu/drm/ttm/ttm_bo_vm.c | 26 +------------------------
> >>>    include/drm/ttm/ttm_bo_api.h    |  1 -
> >>>    3 files changed, 1 insertion(+), 60 deletions(-)
> >>>
> >>> diff --git a/drivers/gpu/drm/ttm/ttm_bo.c b/drivers/gpu/drm/ttm/ttm_bo.c
> >>> index 20ff56f27aa4..a952dd624b06 100644
> >>> --- a/drivers/gpu/drm/ttm/ttm_bo.c
> >>> +++ b/drivers/gpu/drm/ttm/ttm_bo.c
> >>> @@ -1954,37 +1954,3 @@ void ttm_bo_swapout_all(struct ttm_bo_device *bdev)
> >>>                ;
> >>>    }
> >>>    EXPORT_SYMBOL(ttm_bo_swapout_all);
> >>> -
> >>> -/**
> >>> - * ttm_bo_wait_unreserved - interruptible wait for a buffer object to become
> >>> - * unreserved
> >>> - *
> >>> - * @bo: Pointer to buffer
> >>> - */
> >>> -int ttm_bo_wait_unreserved(struct ttm_buffer_object *bo)
> >>> -{
> >>> -     int ret;
> >>> -
> >>> -     /*
> >>> -      * In the absense of a wait_unlocked API,
> >>> -      * Use the bo::wu_mutex to avoid triggering livelocks due to
> >>> -      * concurrent use of this function. Note that this use of
> >>> -      * bo::wu_mutex can go away if we change locking order to
> >>> -      * mmap_sem -> bo::reserve.
> >>> -      */
> >>> -     ret = mutex_lock_interruptible(&bo->wu_mutex);
> >>> -     if (unlikely(ret != 0))
> >>> -             return -ERESTARTSYS;
> >>> -     if (!dma_resv_is_locked(bo->base.resv))
> >>> -             goto out_unlock;
> >>> -     ret = dma_resv_lock_interruptible(bo->base.resv, NULL);
> >>> -     if (ret == -EINTR)
> >>> -             ret = -ERESTARTSYS;
> >>> -     if (unlikely(ret != 0))
> >>> -             goto out_unlock;
> >>> -     dma_resv_unlock(bo->base.resv);
> >>> -
> >>> -out_unlock:
> >>> -     mutex_unlock(&bo->wu_mutex);
> >>> -     return ret;
> >>> -}
> >>> diff --git a/drivers/gpu/drm/ttm/ttm_bo_vm.c b/drivers/gpu/drm/ttm/ttm_bo_vm.c
> >>> index 76eedb963693..505e1787aeea 100644
> >>> --- a/drivers/gpu/drm/ttm/ttm_bo_vm.c
> >>> +++ b/drivers/gpu/drm/ttm/ttm_bo_vm.c
> >>> @@ -125,31 +125,7 @@ static vm_fault_t ttm_bo_vm_fault(struct vm_fault *vmf)
> >>>                &bdev->man[bo->mem.mem_type];
> >>>        struct vm_area_struct cvma;
> >>>
> >>> -     /*
> >>> -      * Work around locking order reversal in fault / nopfn
> >>> -      * between mmap_sem and bo_reserve: Perform a trylock operation
> >>> -      * for reserve, and if it fails, retry the fault after waiting
> >>> -      * for the buffer to become unreserved.
> >>> -      */
> >>> -     if (unlikely(!dma_resv_trylock(bo->base.resv))) {
> >>> -             if (vmf->flags & FAULT_FLAG_ALLOW_RETRY) {
> >>> -                     if (!(vmf->flags & FAULT_FLAG_RETRY_NOWAIT)) {
> >>> -                             ttm_bo_get(bo);
> >>> -                             up_read(&vmf->vma->vm_mm->mmap_sem);
> >>> -                             (void) ttm_bo_wait_unreserved(bo);
> >>> -                             ttm_bo_put(bo);
> >>> -                     }
> >>> -
> >>> -                     return VM_FAULT_RETRY;
> >>> -             }
> >>> -
> >>> -             /*
> >>> -              * If we'd want to change locking order to
> >>> -              * mmap_sem -> bo::reserve, we'd use a blocking reserve here
> >>> -              * instead of retrying the fault...
> >>> -              */
> >>> -             return VM_FAULT_NOPAGE;
> >>> -     }
> >>> +     dma_resv_lock(bo->base.resv, NULL);
> >>>
> >>>        /*
> >>>         * Refuse to fault imported pages. This should be handled
> >>> diff --git a/include/drm/ttm/ttm_bo_api.h b/include/drm/ttm/ttm_bo_api.h
> >>> index 43c4929a2171..6b50e624e3e2 100644
> >>> --- a/include/drm/ttm/ttm_bo_api.h
> >>> +++ b/include/drm/ttm/ttm_bo_api.h
> >>> @@ -765,7 +765,6 @@ ssize_t ttm_bo_io(struct ttm_bo_device *bdev, struct file *filp,
> >>>    int ttm_bo_swapout(struct ttm_bo_global *glob,
> >>>                        struct ttm_operation_ctx *ctx);
> >>>    void ttm_bo_swapout_all(struct ttm_bo_device *bdev);
> >>> -int ttm_bo_wait_unreserved(struct ttm_buffer_object *bo);
> >>>
> >>>    /**
> >>>     * ttm_bo_uses_embedded_gem_object - check if the given bo uses the
> >
>


-- 
Daniel Vetter
Software Engineer, Intel Corporation
+41 (0) 79 365 57 48 - http://blog.ffwll.ch
_______________________________________________
dri-devel mailing list
dri-devel@lists.freedesktop.org
https://lists.freedesktop.org/mailman/listinfo/dri-devel

Re: [PATCH 3/3] drm/ttm: remove ttm_bo_wait_unreserved

[Koenig, Christian]

Am 20.08.19 um 17:41 schrieb Daniel Vetter:
> On Tue, Aug 20, 2019 at 5:34 PM Koenig, Christian
> <Christian.Koenig@amd.com> wrote:
>> Am 20.08.19 um 17:21 schrieb Daniel Vetter:
>>> On Tue, Aug 20, 2019 at 5:16 PM Koenig, Christian
>>> <Christian.Koenig@amd.com> wrote:
>>>> Am 20.08.19 um 16:53 schrieb Daniel Vetter:
>>>>> With nouveau fixed all ttm-using drives have the correct nesting of
>>>>> mmap_sem vs dma_resv, and we can just lock the buffer.
>>>>>
>>>>> Assuming I didn't screw up anything with my audit of course.
>>>>>
>>>>> Signed-off-by: Daniel Vetter <daniel.vetter@intel.com>
>>>>> Cc: Christian Koenig <christian.koenig@amd.com>
>>>>> Cc: Huang Rui <ray.huang@amd.com>
>>>>> Cc: Gerd Hoffmann <kraxel@redhat.com>
>>>>> Cc: "VMware Graphics" <linux-graphics-maintainer@vmware.com>
>>>>> Cc: Thomas Hellstrom <thellstrom@vmware.com>
>>>> Yes, please. But one more point: you can now remove bo->wu_mutex as well!
>>> Ah right totally forgot about that in my enthusiasm after all the
>>> auditing and fixing nouveau.
>>>
>>>> Apart from that Reviewed-by: Christian König <christian.koenig@amd.com>
>>> Thanks, I already respun the patches, so will be in the next version.
>>> Can you pls also give this a spin on the amdgpu CI, just to make sure
>>> it's all fine? With full lockdep ofc. And then reply with a t-b.
>> I can ask for this on our call tomorrow, but I fear our CI
>> infrastructure is not ready yet.
> I thought you have some internal branch you all commit amdgpu stuff
> for, and then Alex goes and collects the pieces that are ready?

No, that part is correct. The problem is that this branch is not QA 
tested regularly as far as I know.

> Or does that all blow up if you push a patch which touches code outside
> of the dkms?

No, but the problem is related to that.

See the release branches for dkms are separate and indeed QA tested 
regularly.

But changes from amd-staging-drm-next are only cherry picked into those 
in certain intervals.

Well going to discuss that tomorrow,
Christian.

> -Daniel
>
>> Christian.
>>
>>> Thanks, Daniel
>>>>> ---
>>>>>     drivers/gpu/drm/ttm/ttm_bo.c    | 34 ---------------------------------
>>>>>     drivers/gpu/drm/ttm/ttm_bo_vm.c | 26 +------------------------
>>>>>     include/drm/ttm/ttm_bo_api.h    |  1 -
>>>>>     3 files changed, 1 insertion(+), 60 deletions(-)
>>>>>
>>>>> diff --git a/drivers/gpu/drm/ttm/ttm_bo.c b/drivers/gpu/drm/ttm/ttm_bo.c
>>>>> index 20ff56f27aa4..a952dd624b06 100644
>>>>> --- a/drivers/gpu/drm/ttm/ttm_bo.c
>>>>> +++ b/drivers/gpu/drm/ttm/ttm_bo.c
>>>>> @@ -1954,37 +1954,3 @@ void ttm_bo_swapout_all(struct ttm_bo_device *bdev)
>>>>>                 ;
>>>>>     }
>>>>>     EXPORT_SYMBOL(ttm_bo_swapout_all);
>>>>> -
>>>>> -/**
>>>>> - * ttm_bo_wait_unreserved - interruptible wait for a buffer object to become
>>>>> - * unreserved
>>>>> - *
>>>>> - * @bo: Pointer to buffer
>>>>> - */
>>>>> -int ttm_bo_wait_unreserved(struct ttm_buffer_object *bo)
>>>>> -{
>>>>> -     int ret;
>>>>> -
>>>>> -     /*
>>>>> -      * In the absense of a wait_unlocked API,
>>>>> -      * Use the bo::wu_mutex to avoid triggering livelocks due to
>>>>> -      * concurrent use of this function. Note that this use of
>>>>> -      * bo::wu_mutex can go away if we change locking order to
>>>>> -      * mmap_sem -> bo::reserve.
>>>>> -      */
>>>>> -     ret = mutex_lock_interruptible(&bo->wu_mutex);
>>>>> -     if (unlikely(ret != 0))
>>>>> -             return -ERESTARTSYS;
>>>>> -     if (!dma_resv_is_locked(bo->base.resv))
>>>>> -             goto out_unlock;
>>>>> -     ret = dma_resv_lock_interruptible(bo->base.resv, NULL);
>>>>> -     if (ret == -EINTR)
>>>>> -             ret = -ERESTARTSYS;
>>>>> -     if (unlikely(ret != 0))
>>>>> -             goto out_unlock;
>>>>> -     dma_resv_unlock(bo->base.resv);
>>>>> -
>>>>> -out_unlock:
>>>>> -     mutex_unlock(&bo->wu_mutex);
>>>>> -     return ret;
>>>>> -}
>>>>> diff --git a/drivers/gpu/drm/ttm/ttm_bo_vm.c b/drivers/gpu/drm/ttm/ttm_bo_vm.c
>>>>> index 76eedb963693..505e1787aeea 100644
>>>>> --- a/drivers/gpu/drm/ttm/ttm_bo_vm.c
>>>>> +++ b/drivers/gpu/drm/ttm/ttm_bo_vm.c
>>>>> @@ -125,31 +125,7 @@ static vm_fault_t ttm_bo_vm_fault(struct vm_fault *vmf)
>>>>>                 &bdev->man[bo->mem.mem_type];
>>>>>         struct vm_area_struct cvma;
>>>>>
>>>>> -     /*
>>>>> -      * Work around locking order reversal in fault / nopfn
>>>>> -      * between mmap_sem and bo_reserve: Perform a trylock operation
>>>>> -      * for reserve, and if it fails, retry the fault after waiting
>>>>> -      * for the buffer to become unreserved.
>>>>> -      */
>>>>> -     if (unlikely(!dma_resv_trylock(bo->base.resv))) {
>>>>> -             if (vmf->flags & FAULT_FLAG_ALLOW_RETRY) {
>>>>> -                     if (!(vmf->flags & FAULT_FLAG_RETRY_NOWAIT)) {
>>>>> -                             ttm_bo_get(bo);
>>>>> -                             up_read(&vmf->vma->vm_mm->mmap_sem);
>>>>> -                             (void) ttm_bo_wait_unreserved(bo);
>>>>> -                             ttm_bo_put(bo);
>>>>> -                     }
>>>>> -
>>>>> -                     return VM_FAULT_RETRY;
>>>>> -             }
>>>>> -
>>>>> -             /*
>>>>> -              * If we'd want to change locking order to
>>>>> -              * mmap_sem -> bo::reserve, we'd use a blocking reserve here
>>>>> -              * instead of retrying the fault...
>>>>> -              */
>>>>> -             return VM_FAULT_NOPAGE;
>>>>> -     }
>>>>> +     dma_resv_lock(bo->base.resv, NULL);
>>>>>
>>>>>         /*
>>>>>          * Refuse to fault imported pages. This should be handled
>>>>> diff --git a/include/drm/ttm/ttm_bo_api.h b/include/drm/ttm/ttm_bo_api.h
>>>>> index 43c4929a2171..6b50e624e3e2 100644
>>>>> --- a/include/drm/ttm/ttm_bo_api.h
>>>>> +++ b/include/drm/ttm/ttm_bo_api.h
>>>>> @@ -765,7 +765,6 @@ ssize_t ttm_bo_io(struct ttm_bo_device *bdev, struct file *filp,
>>>>>     int ttm_bo_swapout(struct ttm_bo_global *glob,
>>>>>                         struct ttm_operation_ctx *ctx);
>>>>>     void ttm_bo_swapout_all(struct ttm_bo_device *bdev);
>>>>> -int ttm_bo_wait_unreserved(struct ttm_buffer_object *bo);
>>>>>
>>>>>     /**
>>>>>      * ttm_bo_uses_embedded_gem_object - check if the given bo uses the
>

_______________________________________________
Intel-gfx mailing list
Intel-gfx@lists.freedesktop.org
https://lists.freedesktop.org/mailman/listinfo/intel-gfx

✗ Fi.CI.CHECKPATCH: warning for RFC/T: dma_resv vs. mmap_sem

[Patchwork]

== Series Details ==

Series: RFC/T: dma_resv vs. mmap_sem
URL   : https://patchwork.freedesktop.org/series/65488/
State : warning

== Summary ==

$ dim checkpatch origin/drm-tip
4823a79936e3 dma_resv: prime lockdep annotations
-:65: WARNING:BAD_SIGN_OFF: email address '"VMware Graphics" <linux-graphics-maintainer@vmware.com>' might be better as 'VMware Graphics <linux-graphics-maintainer@vmware.com>'
#65: 
Cc: "VMware Graphics" <linux-graphics-maintainer@vmware.com>

-:99: WARNING:NO_AUTHOR_SIGN_OFF: Missing Signed-off-by: line by nominal patch author 'Daniel Vetter <daniel.vetter@ffwll.ch>'

total: 0 errors, 2 warnings, 0 checks, 24 lines checked
315152ee339d drm/nouveau: slowpath for pushbuf ioctl
-:153: WARNING:NO_AUTHOR_SIGN_OFF: Missing Signed-off-by: line by nominal patch author 'Daniel Vetter <daniel.vetter@ffwll.ch>'

total: 0 errors, 1 warnings, 0 checks, 122 lines checked
7207c8da4209 drm/ttm: remove ttm_bo_wait_unreserved
-:15: WARNING:BAD_SIGN_OFF: email address '"VMware Graphics" <linux-graphics-maintainer@vmware.com>' might be better as 'VMware Graphics <linux-graphics-maintainer@vmware.com>'
#15: 
Cc: "VMware Graphics" <linux-graphics-maintainer@vmware.com>

-:108: WARNING:NO_AUTHOR_SIGN_OFF: Missing Signed-off-by: line by nominal patch author 'Daniel Vetter <daniel.vetter@ffwll.ch>'

total: 0 errors, 2 warnings, 0 checks, 42 lines checked

_______________________________________________
Intel-gfx mailing list
Intel-gfx@lists.freedesktop.org
https://lists.freedesktop.org/mailman/listinfo/intel-gfx

✗ Fi.CI.BAT: failure for RFC/T: dma_resv vs. mmap_sem

[Patchwork]

== Series Details ==

Series: RFC/T: dma_resv vs. mmap_sem
URL   : https://patchwork.freedesktop.org/series/65488/
State : failure

== Summary ==

CI Bug Log - changes from CI_DRM_6749 -> Patchwork_14107
====================================================

Summary
-------

  **FAILURE**

  Serious unknown changes coming with Patchwork_14107 absolutely need to be
  verified manually.
  
  If you think the reported changes have nothing to do with the changes
  introduced in Patchwork_14107, please notify your bug team to allow them
  to document this new failure mode, which will reduce false positives in CI.

  External URL: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_14107/

Possible new issues
-------------------

  Here are the unknown changes that may have been introduced in Patchwork_14107:

### IGT changes ###

#### Possible regressions ####

  * igt@gem_exec_reloc@basic-gtt:
    - fi-hsw-4770:        [PASS][1] -> [DMESG-WARN][2]
   [1]: https://intel-gfx-ci.01.org/tree/drm-tip/CI_DRM_6749/fi-hsw-4770/igt@gem_exec_reloc@basic-gtt.html
   [2]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_14107/fi-hsw-4770/igt@gem_exec_reloc@basic-gtt.html
    - fi-byt-j1900:       [PASS][3] -> [DMESG-WARN][4]
   [3]: https://intel-gfx-ci.01.org/tree/drm-tip/CI_DRM_6749/fi-byt-j1900/igt@gem_exec_reloc@basic-gtt.html
   [4]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_14107/fi-byt-j1900/igt@gem_exec_reloc@basic-gtt.html
    - fi-blb-e6850:       [PASS][5] -> [DMESG-WARN][6]
   [5]: https://intel-gfx-ci.01.org/tree/drm-tip/CI_DRM_6749/fi-blb-e6850/igt@gem_exec_reloc@basic-gtt.html
   [6]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_14107/fi-blb-e6850/igt@gem_exec_reloc@basic-gtt.html
    - fi-skl-6260u:       [PASS][7] -> [DMESG-WARN][8]
   [7]: https://intel-gfx-ci.01.org/tree/drm-tip/CI_DRM_6749/fi-skl-6260u/igt@gem_exec_reloc@basic-gtt.html
   [8]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_14107/fi-skl-6260u/igt@gem_exec_reloc@basic-gtt.html
    - fi-cml-u2:          [PASS][9] -> [DMESG-WARN][10]
   [9]: https://intel-gfx-ci.01.org/tree/drm-tip/CI_DRM_6749/fi-cml-u2/igt@gem_exec_reloc@basic-gtt.html
   [10]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_14107/fi-cml-u2/igt@gem_exec_reloc@basic-gtt.html
    - fi-ivb-3770:        [PASS][11] -> [DMESG-WARN][12]
   [11]: https://intel-gfx-ci.01.org/tree/drm-tip/CI_DRM_6749/fi-ivb-3770/igt@gem_exec_reloc@basic-gtt.html
   [12]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_14107/fi-ivb-3770/igt@gem_exec_reloc@basic-gtt.html
    - fi-skl-6600u:       [PASS][13] -> [DMESG-WARN][14]
   [13]: https://intel-gfx-ci.01.org/tree/drm-tip/CI_DRM_6749/fi-skl-6600u/igt@gem_exec_reloc@basic-gtt.html
   [14]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_14107/fi-skl-6600u/igt@gem_exec_reloc@basic-gtt.html
    - fi-kbl-x1275:       [PASS][15] -> [DMESG-WARN][16]
   [15]: https://intel-gfx-ci.01.org/tree/drm-tip/CI_DRM_6749/fi-kbl-x1275/igt@gem_exec_reloc@basic-gtt.html
   [16]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_14107/fi-kbl-x1275/igt@gem_exec_reloc@basic-gtt.html
    - fi-apl-guc:         [PASS][17] -> [DMESG-WARN][18]
   [17]: https://intel-gfx-ci.01.org/tree/drm-tip/CI_DRM_6749/fi-apl-guc/igt@gem_exec_reloc@basic-gtt.html
   [18]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_14107/fi-apl-guc/igt@gem_exec_reloc@basic-gtt.html
    - fi-glk-dsi:         [PASS][19] -> [DMESG-WARN][20]
   [19]: https://intel-gfx-ci.01.org/tree/drm-tip/CI_DRM_6749/fi-glk-dsi/igt@gem_exec_reloc@basic-gtt.html
   [20]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_14107/fi-glk-dsi/igt@gem_exec_reloc@basic-gtt.html
    - fi-kbl-guc:         [PASS][21] -> [DMESG-WARN][22]
   [21]: https://intel-gfx-ci.01.org/tree/drm-tip/CI_DRM_6749/fi-kbl-guc/igt@gem_exec_reloc@basic-gtt.html
   [22]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_14107/fi-kbl-guc/igt@gem_exec_reloc@basic-gtt.html
    - fi-gdg-551:         [PASS][23] -> [DMESG-WARN][24]
   [23]: https://intel-gfx-ci.01.org/tree/drm-tip/CI_DRM_6749/fi-gdg-551/igt@gem_exec_reloc@basic-gtt.html
   [24]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_14107/fi-gdg-551/igt@gem_exec_reloc@basic-gtt.html
    - fi-kbl-7500u:       [PASS][25] -> [DMESG-WARN][26]
   [25]: https://intel-gfx-ci.01.org/tree/drm-tip/CI_DRM_6749/fi-kbl-7500u/igt@gem_exec_reloc@basic-gtt.html
   [26]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_14107/fi-kbl-7500u/igt@gem_exec_reloc@basic-gtt.html
    - fi-whl-u:           [PASS][27] -> [DMESG-WARN][28]
   [27]: https://intel-gfx-ci.01.org/tree/drm-tip/CI_DRM_6749/fi-whl-u/igt@gem_exec_reloc@basic-gtt.html
   [28]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_14107/fi-whl-u/igt@gem_exec_reloc@basic-gtt.html
    - fi-icl-u3:          [PASS][29] -> [DMESG-WARN][30]
   [29]: https://intel-gfx-ci.01.org/tree/drm-tip/CI_DRM_6749/fi-icl-u3/igt@gem_exec_reloc@basic-gtt.html
   [30]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_14107/fi-icl-u3/igt@gem_exec_reloc@basic-gtt.html
    - fi-skl-iommu:       [PASS][31] -> [DMESG-WARN][32]
   [31]: https://intel-gfx-ci.01.org/tree/drm-tip/CI_DRM_6749/fi-skl-iommu/igt@gem_exec_reloc@basic-gtt.html
   [32]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_14107/fi-skl-iommu/igt@gem_exec_reloc@basic-gtt.html
    - fi-skl-gvtdvm:      [PASS][33] -> [DMESG-WARN][34]
   [33]: https://intel-gfx-ci.01.org/tree/drm-tip/CI_DRM_6749/fi-skl-gvtdvm/igt@gem_exec_reloc@basic-gtt.html
   [34]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_14107/fi-skl-gvtdvm/igt@gem_exec_reloc@basic-gtt.html
    - fi-elk-e7500:       [PASS][35] -> [DMESG-WARN][36]
   [35]: https://intel-gfx-ci.01.org/tree/drm-tip/CI_DRM_6749/fi-elk-e7500/igt@gem_exec_reloc@basic-gtt.html
   [36]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_14107/fi-elk-e7500/igt@gem_exec_reloc@basic-gtt.html
    - fi-ilk-650:         [PASS][37] -> [DMESG-WARN][38]
   [37]: https://intel-gfx-ci.01.org/tree/drm-tip/CI_DRM_6749/fi-ilk-650/igt@gem_exec_reloc@basic-gtt.html
   [38]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_14107/fi-ilk-650/igt@gem_exec_reloc@basic-gtt.html
    - fi-bdw-gvtdvm:      [PASS][39] -> [DMESG-WARN][40]
   [39]: https://intel-gfx-ci.01.org/tree/drm-tip/CI_DRM_6749/fi-bdw-gvtdvm/igt@gem_exec_reloc@basic-gtt.html
   [40]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_14107/fi-bdw-gvtdvm/igt@gem_exec_reloc@basic-gtt.html
    - fi-cfl-guc:         [PASS][41] -> [DMESG-WARN][42]
   [41]: https://intel-gfx-ci.01.org/tree/drm-tip/CI_DRM_6749/fi-cfl-guc/igt@gem_exec_reloc@basic-gtt.html
   [42]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_14107/fi-cfl-guc/igt@gem_exec_reloc@basic-gtt.html
    - fi-skl-guc:         [PASS][43] -> [DMESG-WARN][44]
   [43]: https://intel-gfx-ci.01.org/tree/drm-tip/CI_DRM_6749/fi-skl-guc/igt@gem_exec_reloc@basic-gtt.html
   [44]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_14107/fi-skl-guc/igt@gem_exec_reloc@basic-gtt.html
    - fi-kbl-7567u:       [PASS][45] -> [DMESG-WARN][46]
   [45]: https://intel-gfx-ci.01.org/tree/drm-tip/CI_DRM_6749/fi-kbl-7567u/igt@gem_exec_reloc@basic-gtt.html
   [46]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_14107/fi-kbl-7567u/igt@gem_exec_reloc@basic-gtt.html
    - fi-pnv-d510:        [PASS][47] -> [DMESG-WARN][48]
   [47]: https://intel-gfx-ci.01.org/tree/drm-tip/CI_DRM_6749/fi-pnv-d510/igt@gem_exec_reloc@basic-gtt.html
   [48]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_14107/fi-pnv-d510/igt@gem_exec_reloc@basic-gtt.html
    - fi-snb-2520m:       [PASS][49] -> [DMESG-WARN][50]
   [49]: https://intel-gfx-ci.01.org/tree/drm-tip/CI_DRM_6749/fi-snb-2520m/igt@gem_exec_reloc@basic-gtt.html
   [50]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_14107/fi-snb-2520m/igt@gem_exec_reloc@basic-gtt.html
    - fi-hsw-peppy:       [PASS][51] -> [DMESG-WARN][52]
   [51]: https://intel-gfx-ci.01.org/tree/drm-tip/CI_DRM_6749/fi-hsw-peppy/igt@gem_exec_reloc@basic-gtt.html
   [52]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_14107/fi-hsw-peppy/igt@gem_exec_reloc@basic-gtt.html
    - fi-icl-u2:          [PASS][53] -> [DMESG-WARN][54]
   [53]: https://intel-gfx-ci.01.org/tree/drm-tip/CI_DRM_6749/fi-icl-u2/igt@gem_exec_reloc@basic-gtt.html
   [54]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_14107/fi-icl-u2/igt@gem_exec_reloc@basic-gtt.html
    - fi-cfl-8700k:       [PASS][55] -> [DMESG-WARN][56]
   [55]: https://intel-gfx-ci.01.org/tree/drm-tip/CI_DRM_6749/fi-cfl-8700k/igt@gem_exec_reloc@basic-gtt.html
   [56]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_14107/fi-cfl-8700k/igt@gem_exec_reloc@basic-gtt.html
    - fi-kbl-r:           [PASS][57] -> [DMESG-WARN][58]
   [57]: https://intel-gfx-ci.01.org/tree/drm-tip/CI_DRM_6749/fi-kbl-r/igt@gem_exec_reloc@basic-gtt.html
   [58]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_14107/fi-kbl-r/igt@gem_exec_reloc@basic-gtt.html
    - fi-hsw-4770r:       [PASS][59] -> [DMESG-WARN][60]
   [59]: https://intel-gfx-ci.01.org/tree/drm-tip/CI_DRM_6749/fi-hsw-4770r/igt@gem_exec_reloc@basic-gtt.html
   [60]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_14107/fi-hsw-4770r/igt@gem_exec_reloc@basic-gtt.html
    - fi-byt-n2820:       [PASS][61] -> [DMESG-WARN][62]
   [61]: https://intel-gfx-ci.01.org/tree/drm-tip/CI_DRM_6749/fi-byt-n2820/igt@gem_exec_reloc@basic-gtt.html
   [62]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_14107/fi-byt-n2820/igt@gem_exec_reloc@basic-gtt.html
    - fi-cfl-8109u:       [PASS][63] -> [DMESG-WARN][64]
   [63]: https://intel-gfx-ci.01.org/tree/drm-tip/CI_DRM_6749/fi-cfl-8109u/igt@gem_exec_reloc@basic-gtt.html
   [64]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_14107/fi-cfl-8109u/igt@gem_exec_reloc@basic-gtt.html
    - fi-skl-lmem:        [PASS][65] -> [DMESG-WARN][66]
   [65]: https://intel-gfx-ci.01.org/tree/drm-tip/CI_DRM_6749/fi-skl-lmem/igt@gem_exec_reloc@basic-gtt.html
   [66]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_14107/fi-skl-lmem/igt@gem_exec_reloc@basic-gtt.html
    - fi-bwr-2160:        [PASS][67] -> [DMESG-WARN][68]
   [67]: https://intel-gfx-ci.01.org/tree/drm-tip/CI_DRM_6749/fi-bwr-2160/igt@gem_exec_reloc@basic-gtt.html
   [68]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_14107/fi-bwr-2160/igt@gem_exec_reloc@basic-gtt.html
    - fi-bdw-5557u:       [PASS][69] -> [DMESG-WARN][70]
   [69]: https://intel-gfx-ci.01.org/tree/drm-tip/CI_DRM_6749/fi-bdw-5557u/igt@gem_exec_reloc@basic-gtt.html
   [70]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_14107/fi-bdw-5557u/igt@gem_exec_reloc@basic-gtt.html
    - fi-snb-2600:        [PASS][71] -> [DMESG-WARN][72]
   [71]: https://intel-gfx-ci.01.org/tree/drm-tip/CI_DRM_6749/fi-snb-2600/igt@gem_exec_reloc@basic-gtt.html
   [72]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_14107/fi-snb-2600/igt@gem_exec_reloc@basic-gtt.html
    - fi-skl-6700k2:      [PASS][73] -> [DMESG-WARN][74]
   [73]: https://intel-gfx-ci.01.org/tree/drm-tip/CI_DRM_6749/fi-skl-6700k2/igt@gem_exec_reloc@basic-gtt.html
   [74]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_14107/fi-skl-6700k2/igt@gem_exec_reloc@basic-gtt.html

  
#### Suppressed ####

  The following results come from untrusted machines, tests, or statuses.
  They do not affect the overall result.

  * igt@gem_exec_reloc@basic-gtt:
    - {fi-icl-dsi}:       [PASS][75] -> [DMESG-WARN][76]
   [75]: https://intel-gfx-ci.01.org/tree/drm-tip/CI_DRM_6749/fi-icl-dsi/igt@gem_exec_reloc@basic-gtt.html
   [76]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_14107/fi-icl-dsi/igt@gem_exec_reloc@basic-gtt.html
    - {fi-icl-guc}:       [PASS][77] -> [DMESG-WARN][78]
   [77]: https://intel-gfx-ci.01.org/tree/drm-tip/CI_DRM_6749/fi-icl-guc/igt@gem_exec_reloc@basic-gtt.html
   [78]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_14107/fi-icl-guc/igt@gem_exec_reloc@basic-gtt.html
    - {fi-icl-u4}:        [PASS][79] -> [DMESG-WARN][80]
   [79]: https://intel-gfx-ci.01.org/tree/drm-tip/CI_DRM_6749/fi-icl-u4/igt@gem_exec_reloc@basic-gtt.html
   [80]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_14107/fi-icl-u4/igt@gem_exec_reloc@basic-gtt.html

  
Known issues
------------

  Here are the changes found in Patchwork_14107 that come from known issues:

### IGT changes ###

#### Issues hit ####

  * igt@gem_exec_reloc@basic-gtt:
    - fi-bxt-dsi:         [PASS][81] -> [DMESG-WARN][82] ([fdo#109385])
   [81]: https://intel-gfx-ci.01.org/tree/drm-tip/CI_DRM_6749/fi-bxt-dsi/igt@gem_exec_reloc@basic-gtt.html
   [82]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_14107/fi-bxt-dsi/igt@gem_exec_reloc@basic-gtt.html
    - fi-bsw-n3050:       [PASS][83] -> [DMESG-WARN][84] ([fdo#109385])
   [83]: https://intel-gfx-ci.01.org/tree/drm-tip/CI_DRM_6749/fi-bsw-n3050/igt@gem_exec_reloc@basic-gtt.html
   [84]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_14107/fi-bsw-n3050/igt@gem_exec_reloc@basic-gtt.html
    - fi-bsw-kefka:       [PASS][85] -> [DMESG-WARN][86] ([fdo#109385])
   [85]: https://intel-gfx-ci.01.org/tree/drm-tip/CI_DRM_6749/fi-bsw-kefka/igt@gem_exec_reloc@basic-gtt.html
   [86]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_14107/fi-bsw-kefka/igt@gem_exec_reloc@basic-gtt.html

  * igt@i915_selftest@live_execlists:
    - fi-bwr-2160:        [PASS][87] -> [DMESG-WARN][88] ([fdo#111115])
   [87]: https://intel-gfx-ci.01.org/tree/drm-tip/CI_DRM_6749/fi-bwr-2160/igt@i915_selftest@live_execlists.html
   [88]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_14107/fi-bwr-2160/igt@i915_selftest@live_execlists.html

  * igt@i915_selftest@live_gem:
    - fi-bsw-kefka:       [PASS][89] -> [DMESG-WARN][90] ([fdo#111373])
   [89]: https://intel-gfx-ci.01.org/tree/drm-tip/CI_DRM_6749/fi-bsw-kefka/igt@i915_selftest@live_gem.html
   [90]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_14107/fi-bsw-kefka/igt@i915_selftest@live_gem.html

  * igt@i915_selftest@live_hangcheck:
    - fi-bwr-2160:        [PASS][91] -> [DMESG-FAIL][92] ([fdo#111115])
   [91]: https://intel-gfx-ci.01.org/tree/drm-tip/CI_DRM_6749/fi-bwr-2160/igt@i915_selftest@live_hangcheck.html
   [92]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_14107/fi-bwr-2160/igt@i915_selftest@live_hangcheck.html
    - fi-kbl-7500u:       [PASS][93] -> [INCOMPLETE][94] ([fdo#108744])
   [93]: https://intel-gfx-ci.01.org/tree/drm-tip/CI_DRM_6749/fi-kbl-7500u/igt@i915_selftest@live_hangcheck.html
   [94]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_14107/fi-kbl-7500u/igt@i915_selftest@live_hangcheck.html

  * igt@vgem_basic@dmabuf-fence:
    - fi-icl-u3:          [PASS][95] -> [DMESG-WARN][96] ([fdo#107724])
   [95]: https://intel-gfx-ci.01.org/tree/drm-tip/CI_DRM_6749/fi-icl-u3/igt@vgem_basic@dmabuf-fence.html
   [96]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_14107/fi-icl-u3/igt@vgem_basic@dmabuf-fence.html

  
#### Possible fixes ####

  * igt@gem_mmap_gtt@basic-copy:
    - fi-icl-u3:          [DMESG-WARN][97] ([fdo#107724]) -> [PASS][98]
   [97]: https://intel-gfx-ci.01.org/tree/drm-tip/CI_DRM_6749/fi-icl-u3/igt@gem_mmap_gtt@basic-copy.html
   [98]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_14107/fi-icl-u3/igt@gem_mmap_gtt@basic-copy.html

  * igt@kms_frontbuffer_tracking@basic:
    - fi-icl-u2:          [FAIL][99] ([fdo#103167]) -> [PASS][100]
   [99]: https://intel-gfx-ci.01.org/tree/drm-tip/CI_DRM_6749/fi-icl-u2/igt@kms_frontbuffer_tracking@basic.html
   [100]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_14107/fi-icl-u2/igt@kms_frontbuffer_tracking@basic.html

  
#### Warnings ####

  * igt@kms_chamelium@hdmi-hpd-fast:
    - fi-kbl-7567u:       [FAIL][101] ([fdo#109800]) -> [FAIL][102] ([fdo#111407])
   [101]: https://intel-gfx-ci.01.org/tree/drm-tip/CI_DRM_6749/fi-kbl-7567u/igt@kms_chamelium@hdmi-hpd-fast.html
   [102]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_14107/fi-kbl-7567u/igt@kms_chamelium@hdmi-hpd-fast.html

  
  {name}: This element is suppressed. This means it is ignored when computing
          the status of the difference (SUCCESS, WARNING, or FAILURE).

  [fdo#103167]: https://bugs.freedesktop.org/show_bug.cgi?id=103167
  [fdo#107713]: https://bugs.freedesktop.org/show_bug.cgi?id=107713
  [fdo#107724]: https://bugs.freedesktop.org/show_bug.cgi?id=107724
  [fdo#108569]: https://bugs.freedesktop.org/show_bug.cgi?id=108569
  [fdo#108744]: https://bugs.freedesktop.org/show_bug.cgi?id=108744
  [fdo#109385]: https://bugs.freedesktop.org/show_bug.cgi?id=109385
  [fdo#109800]: https://bugs.freedesktop.org/show_bug.cgi?id=109800
  [fdo#111045]: https://bugs.freedesktop.org/show_bug.cgi?id=111045
  [fdo#111096]: https://bugs.freedesktop.org/show_bug.cgi?id=111096
  [fdo#111115]: https://bugs.freedesktop.org/show_bug.cgi?id=111115
  [fdo#111373]: https://bugs.freedesktop.org/show_bug.cgi?id=111373
  [fdo#111407]: https://bugs.freedesktop.org/show_bug.cgi?id=111407


Participating hosts (55 -> 47)
------------------------------

  Missing    (8): fi-kbl-soraka fi-ilk-m540 fi-hsw-4200u fi-byt-squawks fi-bsw-cyan fi-icl-y fi-byt-clapper fi-bdw-samus 


Build changes
-------------

  * CI: CI-20190529 -> None
  * Linux: CI_DRM_6749 -> Patchwork_14107

  CI-20190529: 20190529
  CI_DRM_6749: 889140938c5c4bb9f2df652dd23d16fdcb86db72 @ git://anongit.freedesktop.org/gfx-ci/linux
  IGT_5146: 357dbe1869d88a2f08bcee4eebceff4ee9014424 @ git://anongit.freedesktop.org/xorg/app/intel-gpu-tools
  Patchwork_14107: 7207c8da4209ca60d293a06f4d7011c806fb4d89 @ git://anongit.freedesktop.org/gfx-ci/linux


== Linux commits ==

7207c8da4209 drm/ttm: remove ttm_bo_wait_unreserved
315152ee339d drm/nouveau: slowpath for pushbuf ioctl
4823a79936e3 dma_resv: prime lockdep annotations

== Logs ==

For more details see: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_14107/
_______________________________________________
Intel-gfx mailing list
Intel-gfx@lists.freedesktop.org
https://lists.freedesktop.org/mailman/listinfo/intel-gfx

Re: [PATCH 3/3] drm/ttm: remove ttm_bo_wait_unreserved

[Thomas Hellström (VMware)]

On 8/20/19 4:53 PM, Daniel Vetter wrote:
> With nouveau fixed all ttm-using drives have the correct nesting of
> mmap_sem vs dma_resv, and we can just lock the buffer.
>
> Assuming I didn't screw up anything with my audit of course.
>
> Signed-off-by: Daniel Vetter <daniel.vetter@intel.com>
> Cc: Christian Koenig <christian.koenig@amd.com>
> Cc: Huang Rui <ray.huang@amd.com>
> Cc: Gerd Hoffmann <kraxel@redhat.com>
> Cc: "VMware Graphics" <linux-graphics-maintainer@vmware.com>
> Cc: Thomas Hellstrom <thellstrom@vmware.com>
> ---
>   drivers/gpu/drm/ttm/ttm_bo.c    | 34 ---------------------------------
>   drivers/gpu/drm/ttm/ttm_bo_vm.c | 26 +------------------------
>   include/drm/ttm/ttm_bo_api.h    |  1 -
>   3 files changed, 1 insertion(+), 60 deletions(-)
>
> diff --git a/drivers/gpu/drm/ttm/ttm_bo.c b/drivers/gpu/drm/ttm/ttm_bo.c
> index 20ff56f27aa4..a952dd624b06 100644
> --- a/drivers/gpu/drm/ttm/ttm_bo.c
> +++ b/drivers/gpu/drm/ttm/ttm_bo.c
> @@ -1954,37 +1954,3 @@ void ttm_bo_swapout_all(struct ttm_bo_device *bdev)
>   		;
>   }
>   EXPORT_SYMBOL(ttm_bo_swapout_all);
> -
> -/**
> - * ttm_bo_wait_unreserved - interruptible wait for a buffer object to become
> - * unreserved
> - *
> - * @bo: Pointer to buffer
> - */
> -int ttm_bo_wait_unreserved(struct ttm_buffer_object *bo)
> -{
> -	int ret;
> -
> -	/*
> -	 * In the absense of a wait_unlocked API,
> -	 * Use the bo::wu_mutex to avoid triggering livelocks due to
> -	 * concurrent use of this function. Note that this use of
> -	 * bo::wu_mutex can go away if we change locking order to
> -	 * mmap_sem -> bo::reserve.
> -	 */
> -	ret = mutex_lock_interruptible(&bo->wu_mutex);
> -	if (unlikely(ret != 0))
> -		return -ERESTARTSYS;
> -	if (!dma_resv_is_locked(bo->base.resv))
> -		goto out_unlock;
> -	ret = dma_resv_lock_interruptible(bo->base.resv, NULL);
> -	if (ret == -EINTR)
> -		ret = -ERESTARTSYS;
> -	if (unlikely(ret != 0))
> -		goto out_unlock;
> -	dma_resv_unlock(bo->base.resv);
> -
> -out_unlock:
> -	mutex_unlock(&bo->wu_mutex);
> -	return ret;
> -}
> diff --git a/drivers/gpu/drm/ttm/ttm_bo_vm.c b/drivers/gpu/drm/ttm/ttm_bo_vm.c
> index 76eedb963693..505e1787aeea 100644
> --- a/drivers/gpu/drm/ttm/ttm_bo_vm.c
> +++ b/drivers/gpu/drm/ttm/ttm_bo_vm.c
> @@ -125,31 +125,7 @@ static vm_fault_t ttm_bo_vm_fault(struct vm_fault *vmf)
>   		&bdev->man[bo->mem.mem_type];
>   	struct vm_area_struct cvma;
>   
> -	/*
> -	 * Work around locking order reversal in fault / nopfn
> -	 * between mmap_sem and bo_reserve: Perform a trylock operation
> -	 * for reserve, and if it fails, retry the fault after waiting
> -	 * for the buffer to become unreserved.
> -	 */
> -	if (unlikely(!dma_resv_trylock(bo->base.resv))) {
> -		if (vmf->flags & FAULT_FLAG_ALLOW_RETRY) {
> -			if (!(vmf->flags & FAULT_FLAG_RETRY_NOWAIT)) {
> -				ttm_bo_get(bo);
> -				up_read(&vmf->vma->vm_mm->mmap_sem);
> -				(void) ttm_bo_wait_unreserved(bo);
> -				ttm_bo_put(bo);
> -			}
> -
> -			return VM_FAULT_RETRY;
> -		}
> -
> -		/*
> -		 * If we'd want to change locking order to
> -		 * mmap_sem -> bo::reserve, we'd use a blocking reserve here
> -		 * instead of retrying the fault...
> -		 */

I think you should justify why the above code is removed, since the 
comments actually outlines what to do if we change locking order.

The code that's removed above is not for adjusting locking orders but to 
decrease the mm latency by releasing the mmap_sem while waiting for bo 
reserve which in turn might be waiting for GPU. At a minimum we should 
have a separate patch with justification.

Note that the caller here ensures locking progress by adjusting the 
RETRY flags after a retry.

/Thomas


> -		return VM_FAULT_NOPAGE;
> -	}
> +	dma_resv_lock(bo->base.resv, NULL);
>   
>   	/*
>   	 * Refuse to fault imported pages. This should be handled
> diff --git a/include/drm/ttm/ttm_bo_api.h b/include/drm/ttm/ttm_bo_api.h
> index 43c4929a2171..6b50e624e3e2 100644
> --- a/include/drm/ttm/ttm_bo_api.h
> +++ b/include/drm/ttm/ttm_bo_api.h
> @@ -765,7 +765,6 @@ ssize_t ttm_bo_io(struct ttm_bo_device *bdev, struct file *filp,
>   int ttm_bo_swapout(struct ttm_bo_global *glob,
>   			struct ttm_operation_ctx *ctx);
>   void ttm_bo_swapout_all(struct ttm_bo_device *bdev);
> -int ttm_bo_wait_unreserved(struct ttm_buffer_object *bo);
>   
>   /**
>    * ttm_bo_uses_embedded_gem_object - check if the given bo uses the


_______________________________________________
Intel-gfx mailing list
Intel-gfx@lists.freedesktop.org
https://lists.freedesktop.org/mailman/listinfo/intel-gfx

Re: [PATCH 3/3] drm/ttm: remove ttm_bo_wait_unreserved

[Thomas Hellström (VMware)]

On 8/21/19 2:40 PM, Thomas Hellström (VMware) wrote:
> On 8/20/19 4:53 PM, Daniel Vetter wrote:
>> With nouveau fixed all ttm-using drives have the correct nesting of
>> mmap_sem vs dma_resv, and we can just lock the buffer.
>>
>> Assuming I didn't screw up anything with my audit of course.
>>
>> Signed-off-by: Daniel Vetter <daniel.vetter@intel.com>
>> Cc: Christian Koenig <christian.koenig@amd.com>
>> Cc: Huang Rui <ray.huang@amd.com>
>> Cc: Gerd Hoffmann <kraxel@redhat.com>
>> Cc: "VMware Graphics" <linux-graphics-maintainer@vmware.com>
>> Cc: Thomas Hellstrom <thellstrom@vmware.com>
>> ---
>>   drivers/gpu/drm/ttm/ttm_bo.c    | 34 ---------------------------------
>>   drivers/gpu/drm/ttm/ttm_bo_vm.c | 26 +------------------------
>>   include/drm/ttm/ttm_bo_api.h    |  1 -
>>   3 files changed, 1 insertion(+), 60 deletions(-)
>>
>> diff --git a/drivers/gpu/drm/ttm/ttm_bo.c b/drivers/gpu/drm/ttm/ttm_bo.c
>> index 20ff56f27aa4..a952dd624b06 100644
>> --- a/drivers/gpu/drm/ttm/ttm_bo.c
>> +++ b/drivers/gpu/drm/ttm/ttm_bo.c
>> @@ -1954,37 +1954,3 @@ void ttm_bo_swapout_all(struct ttm_bo_device 
>> *bdev)
>>           ;
>>   }
>>   EXPORT_SYMBOL(ttm_bo_swapout_all);
>> -
>> -/**
>> - * ttm_bo_wait_unreserved - interruptible wait for a buffer object 
>> to become
>> - * unreserved
>> - *
>> - * @bo: Pointer to buffer
>> - */
>> -int ttm_bo_wait_unreserved(struct ttm_buffer_object *bo)
>> -{
>> -    int ret;
>> -
>> -    /*
>> -     * In the absense of a wait_unlocked API,
>> -     * Use the bo::wu_mutex to avoid triggering livelocks due to
>> -     * concurrent use of this function. Note that this use of
>> -     * bo::wu_mutex can go away if we change locking order to
>> -     * mmap_sem -> bo::reserve.
>> -     */
>> -    ret = mutex_lock_interruptible(&bo->wu_mutex);
>> -    if (unlikely(ret != 0))
>> -        return -ERESTARTSYS;
>> -    if (!dma_resv_is_locked(bo->base.resv))
>> -        goto out_unlock;
>> -    ret = dma_resv_lock_interruptible(bo->base.resv, NULL);
>> -    if (ret == -EINTR)
>> -        ret = -ERESTARTSYS;
>> -    if (unlikely(ret != 0))
>> -        goto out_unlock;
>> -    dma_resv_unlock(bo->base.resv);
>> -
>> -out_unlock:
>> -    mutex_unlock(&bo->wu_mutex);
>> -    return ret;
>> -}
>> diff --git a/drivers/gpu/drm/ttm/ttm_bo_vm.c 
>> b/drivers/gpu/drm/ttm/ttm_bo_vm.c
>> index 76eedb963693..505e1787aeea 100644
>> --- a/drivers/gpu/drm/ttm/ttm_bo_vm.c
>> +++ b/drivers/gpu/drm/ttm/ttm_bo_vm.c
>> @@ -125,31 +125,7 @@ static vm_fault_t ttm_bo_vm_fault(struct 
>> vm_fault *vmf)
>>           &bdev->man[bo->mem.mem_type];
>>       struct vm_area_struct cvma;
>>   -    /*
>> -     * Work around locking order reversal in fault / nopfn
>> -     * between mmap_sem and bo_reserve: Perform a trylock operation
>> -     * for reserve, and if it fails, retry the fault after waiting
>> -     * for the buffer to become unreserved.
>> -     */
>> -    if (unlikely(!dma_resv_trylock(bo->base.resv))) {
>> -        if (vmf->flags & FAULT_FLAG_ALLOW_RETRY) {
>> -            if (!(vmf->flags & FAULT_FLAG_RETRY_NOWAIT)) {
>> -                ttm_bo_get(bo);
>> - up_read(&vmf->vma->vm_mm->mmap_sem);
>> -                (void) ttm_bo_wait_unreserved(bo);
>> -                ttm_bo_put(bo);
>> -            }
>> -
>> -            return VM_FAULT_RETRY;
>> -        }
>> -
>> -        /*
>> -         * If we'd want to change locking order to
>> -         * mmap_sem -> bo::reserve, we'd use a blocking reserve here
>> -         * instead of retrying the fault...
>> -         */
>
> I think you should justify why the above code is removed, since the 
> comments actually outlines what to do if we change locking order.
>
> The code that's removed above is not for adjusting locking orders but 
> to decrease the mm latency by releasing the mmap_sem while waiting for 
> bo reserve which in turn might be waiting for GPU. At a minimum we 
> should have a separate patch with justification.
>
> Note that the caller here ensures locking progress by adjusting the 
> RETRY flags after a retry.

And this last sentence also means we still can remove the wu-mutex when 
the locking order is changed, since the chance of livelock is goes away. 
IIRC only a single RETRY spin is allowed by the mm core.

/Thomas

>
> /Thomas
>
>
>> -        return VM_FAULT_NOPAGE;
>> -    }
>> +    dma_resv_lock(bo->base.resv, NULL);
>>         /*
>>        * Refuse to fault imported pages. This should be handled
>> diff --git a/include/drm/ttm/ttm_bo_api.h b/include/drm/ttm/ttm_bo_api.h
>> index 43c4929a2171..6b50e624e3e2 100644
>> --- a/include/drm/ttm/ttm_bo_api.h
>> +++ b/include/drm/ttm/ttm_bo_api.h
>> @@ -765,7 +765,6 @@ ssize_t ttm_bo_io(struct ttm_bo_device *bdev, 
>> struct file *filp,
>>   int ttm_bo_swapout(struct ttm_bo_global *glob,
>>               struct ttm_operation_ctx *ctx);
>>   void ttm_bo_swapout_all(struct ttm_bo_device *bdev);
>> -int ttm_bo_wait_unreserved(struct ttm_buffer_object *bo);
>>     /**
>>    * ttm_bo_uses_embedded_gem_object - check if the given bo uses the
>
>

_______________________________________________
Intel-gfx mailing list
Intel-gfx@lists.freedesktop.org
https://lists.freedesktop.org/mailman/listinfo/intel-gfx

Re: [PATCH 3/3] drm/ttm: remove ttm_bo_wait_unreserved

[Thomas Hellström (VMware)]

On 8/20/19 4:53 PM, Daniel Vetter wrote:
> With nouveau fixed all ttm-using drives have the correct nesting of
> mmap_sem vs dma_resv, and we can just lock the buffer.
>
> Assuming I didn't screw up anything with my audit of course.
>
> Signed-off-by: Daniel Vetter <daniel.vetter@intel.com>
> Cc: Christian Koenig <christian.koenig@amd.com>
> Cc: Huang Rui <ray.huang@amd.com>
> Cc: Gerd Hoffmann <kraxel@redhat.com>
> Cc: "VMware Graphics" <linux-graphics-maintainer@vmware.com>
> Cc: Thomas Hellstrom <thellstrom@vmware.com>
> ---
>   drivers/gpu/drm/ttm/ttm_bo.c    | 34 ---------------------------------
>   drivers/gpu/drm/ttm/ttm_bo_vm.c | 26 +------------------------
>   include/drm/ttm/ttm_bo_api.h    |  1 -
>   3 files changed, 1 insertion(+), 60 deletions(-)
>
>
> +	dma_resv_lock(bo->base.resv, NULL);

interruptible, or at least killable. (IIRC think killable is the right 
choice in fault code, even if TTM initially implemented interruptible to 
get reasonable Xorg "silken mouse" latency).

Thanks,
/Thomas


_______________________________________________
Intel-gfx mailing list
Intel-gfx@lists.freedesktop.org
https://lists.freedesktop.org/mailman/listinfo/intel-gfx

Re: [PATCH 3/3] drm/ttm: remove ttm_bo_wait_unreserved

[Daniel Vetter]

On Wed, Aug 21, 2019 at 2:47 PM Thomas Hellström (VMware)
<thomas_os@shipmail.org> wrote:
> On 8/21/19 2:40 PM, Thomas Hellström (VMware) wrote:
> > On 8/20/19 4:53 PM, Daniel Vetter wrote:
> >> With nouveau fixed all ttm-using drives have the correct nesting of
> >> mmap_sem vs dma_resv, and we can just lock the buffer.
> >>
> >> Assuming I didn't screw up anything with my audit of course.
> >>
> >> Signed-off-by: Daniel Vetter <daniel.vetter@intel.com>
> >> Cc: Christian Koenig <christian.koenig@amd.com>
> >> Cc: Huang Rui <ray.huang@amd.com>
> >> Cc: Gerd Hoffmann <kraxel@redhat.com>
> >> Cc: "VMware Graphics" <linux-graphics-maintainer@vmware.com>
> >> Cc: Thomas Hellstrom <thellstrom@vmware.com>
> >> ---
> >>   drivers/gpu/drm/ttm/ttm_bo.c    | 34 ---------------------------------
> >>   drivers/gpu/drm/ttm/ttm_bo_vm.c | 26 +------------------------
> >>   include/drm/ttm/ttm_bo_api.h    |  1 -
> >>   3 files changed, 1 insertion(+), 60 deletions(-)
> >>
> >> diff --git a/drivers/gpu/drm/ttm/ttm_bo.c b/drivers/gpu/drm/ttm/ttm_bo.c
> >> index 20ff56f27aa4..a952dd624b06 100644
> >> --- a/drivers/gpu/drm/ttm/ttm_bo.c
> >> +++ b/drivers/gpu/drm/ttm/ttm_bo.c
> >> @@ -1954,37 +1954,3 @@ void ttm_bo_swapout_all(struct ttm_bo_device
> >> *bdev)
> >>           ;
> >>   }
> >>   EXPORT_SYMBOL(ttm_bo_swapout_all);
> >> -
> >> -/**
> >> - * ttm_bo_wait_unreserved - interruptible wait for a buffer object
> >> to become
> >> - * unreserved
> >> - *
> >> - * @bo: Pointer to buffer
> >> - */
> >> -int ttm_bo_wait_unreserved(struct ttm_buffer_object *bo)
> >> -{
> >> -    int ret;
> >> -
> >> -    /*
> >> -     * In the absense of a wait_unlocked API,
> >> -     * Use the bo::wu_mutex to avoid triggering livelocks due to
> >> -     * concurrent use of this function. Note that this use of
> >> -     * bo::wu_mutex can go away if we change locking order to
> >> -     * mmap_sem -> bo::reserve.
> >> -     */
> >> -    ret = mutex_lock_interruptible(&bo->wu_mutex);
> >> -    if (unlikely(ret != 0))
> >> -        return -ERESTARTSYS;
> >> -    if (!dma_resv_is_locked(bo->base.resv))
> >> -        goto out_unlock;
> >> -    ret = dma_resv_lock_interruptible(bo->base.resv, NULL);
> >> -    if (ret == -EINTR)
> >> -        ret = -ERESTARTSYS;
> >> -    if (unlikely(ret != 0))
> >> -        goto out_unlock;
> >> -    dma_resv_unlock(bo->base.resv);
> >> -
> >> -out_unlock:
> >> -    mutex_unlock(&bo->wu_mutex);
> >> -    return ret;
> >> -}
> >> diff --git a/drivers/gpu/drm/ttm/ttm_bo_vm.c
> >> b/drivers/gpu/drm/ttm/ttm_bo_vm.c
> >> index 76eedb963693..505e1787aeea 100644
> >> --- a/drivers/gpu/drm/ttm/ttm_bo_vm.c
> >> +++ b/drivers/gpu/drm/ttm/ttm_bo_vm.c
> >> @@ -125,31 +125,7 @@ static vm_fault_t ttm_bo_vm_fault(struct
> >> vm_fault *vmf)
> >>           &bdev->man[bo->mem.mem_type];
> >>       struct vm_area_struct cvma;
> >>   -    /*
> >> -     * Work around locking order reversal in fault / nopfn
> >> -     * between mmap_sem and bo_reserve: Perform a trylock operation
> >> -     * for reserve, and if it fails, retry the fault after waiting
> >> -     * for the buffer to become unreserved.
> >> -     */
> >> -    if (unlikely(!dma_resv_trylock(bo->base.resv))) {
> >> -        if (vmf->flags & FAULT_FLAG_ALLOW_RETRY) {
> >> -            if (!(vmf->flags & FAULT_FLAG_RETRY_NOWAIT)) {
> >> -                ttm_bo_get(bo);
> >> - up_read(&vmf->vma->vm_mm->mmap_sem);
> >> -                (void) ttm_bo_wait_unreserved(bo);
> >> -                ttm_bo_put(bo);
> >> -            }
> >> -
> >> -            return VM_FAULT_RETRY;
> >> -        }
> >> -
> >> -        /*
> >> -         * If we'd want to change locking order to
> >> -         * mmap_sem -> bo::reserve, we'd use a blocking reserve here
> >> -         * instead of retrying the fault...
> >> -         */
> >
> > I think you should justify why the above code is removed, since the
> > comments actually outlines what to do if we change locking order.
> >
> > The code that's removed above is not for adjusting locking orders but
> > to decrease the mm latency by releasing the mmap_sem while waiting for
> > bo reserve which in turn might be waiting for GPU. At a minimum we
> > should have a separate patch with justification.
> >
> > Note that the caller here ensures locking progress by adjusting the
> > RETRY flags after a retry.

That would be patches 1&2 in this series.

> And this last sentence also means we still can remove the wu-mutex when
> the locking order is changed, since the chance of livelock is goes away.
> IIRC only a single RETRY spin is allowed by the mm core.

Christian already noticed that one too, I simply forgot, it's fixed in
v2 I have here.
-Daniel

> /Thomas
>
> >
> > /Thomas
> >
> >
> >> -        return VM_FAULT_NOPAGE;
> >> -    }
> >> +    dma_resv_lock(bo->base.resv, NULL);
> >>         /*
> >>        * Refuse to fault imported pages. This should be handled
> >> diff --git a/include/drm/ttm/ttm_bo_api.h b/include/drm/ttm/ttm_bo_api.h
> >> index 43c4929a2171..6b50e624e3e2 100644
> >> --- a/include/drm/ttm/ttm_bo_api.h
> >> +++ b/include/drm/ttm/ttm_bo_api.h
> >> @@ -765,7 +765,6 @@ ssize_t ttm_bo_io(struct ttm_bo_device *bdev,
> >> struct file *filp,
> >>   int ttm_bo_swapout(struct ttm_bo_global *glob,
> >>               struct ttm_operation_ctx *ctx);
> >>   void ttm_bo_swapout_all(struct ttm_bo_device *bdev);
> >> -int ttm_bo_wait_unreserved(struct ttm_buffer_object *bo);
> >>     /**
> >>    * ttm_bo_uses_embedded_gem_object - check if the given bo uses the
> >
> >
>


--
Daniel Vetter
Software Engineer, Intel Corporation
+41 (0) 79 365 57 48 - http://blog.ffwll.ch
_______________________________________________
Intel-gfx mailing list
Intel-gfx@lists.freedesktop.org
https://lists.freedesktop.org/mailman/listinfo/intel-gfx

Re: [PATCH 3/3] drm/ttm: remove ttm_bo_wait_unreserved

[Daniel Vetter]

On Wed, Aug 21, 2019 at 3:16 PM Thomas Hellström (VMware)
<thomas_os@shipmail.org> wrote:
>
> On 8/20/19 4:53 PM, Daniel Vetter wrote:
> > With nouveau fixed all ttm-using drives have the correct nesting of
> > mmap_sem vs dma_resv, and we can just lock the buffer.
> >
> > Assuming I didn't screw up anything with my audit of course.
> >
> > Signed-off-by: Daniel Vetter <daniel.vetter@intel.com>
> > Cc: Christian Koenig <christian.koenig@amd.com>
> > Cc: Huang Rui <ray.huang@amd.com>
> > Cc: Gerd Hoffmann <kraxel@redhat.com>
> > Cc: "VMware Graphics" <linux-graphics-maintainer@vmware.com>
> > Cc: Thomas Hellstrom <thellstrom@vmware.com>
> > ---
> >   drivers/gpu/drm/ttm/ttm_bo.c    | 34 ---------------------------------
> >   drivers/gpu/drm/ttm/ttm_bo_vm.c | 26 +------------------------
> >   include/drm/ttm/ttm_bo_api.h    |  1 -
> >   3 files changed, 1 insertion(+), 60 deletions(-)
> >
> >
> > +     dma_resv_lock(bo->base.resv, NULL);
>
> interruptible, or at least killable. (IIRC think killable is the right
> choice in fault code, even if TTM initially implemented interruptible to
> get reasonable Xorg "silken mouse" latency).

I think interruptible is fine. I chickend out of that for v1 because I
always mix up the return code for _lock_interruptibl() :-)

I'll add that for the next version too.
-Daniel
-- 
Daniel Vetter
Software Engineer, Intel Corporation
+41 (0) 79 365 57 48 - http://blog.ffwll.ch
_______________________________________________
Intel-gfx mailing list
Intel-gfx@lists.freedesktop.org
https://lists.freedesktop.org/mailman/listinfo/intel-gfx

Re: [PATCH 3/3] drm/ttm: remove ttm_bo_wait_unreserved

[Thomas Hellström (VMware)]

On 8/21/19 4:09 PM, Daniel Vetter wrote:
> On Wed, Aug 21, 2019 at 2:47 PM Thomas Hellström (VMware)
> <thomas_os@shipmail.org> wrote:
>> On 8/21/19 2:40 PM, Thomas Hellström (VMware) wrote:
>>> On 8/20/19 4:53 PM, Daniel Vetter wrote:
>>>> With nouveau fixed all ttm-using drives have the correct nesting of
>>>> mmap_sem vs dma_resv, and we can just lock the buffer.
>>>>
>>>> Assuming I didn't screw up anything with my audit of course.
>>>>
>>>> Signed-off-by: Daniel Vetter <daniel.vetter@intel.com>
>>>> Cc: Christian Koenig <christian.koenig@amd.com>
>>>> Cc: Huang Rui <ray.huang@amd.com>
>>>> Cc: Gerd Hoffmann <kraxel@redhat.com>
>>>> Cc: "VMware Graphics" <linux-graphics-maintainer@vmware.com>
>>>> Cc: Thomas Hellstrom <thellstrom@vmware.com>
>>>> ---
>>>>    drivers/gpu/drm/ttm/ttm_bo.c    | 34 ---------------------------------
>>>>    drivers/gpu/drm/ttm/ttm_bo_vm.c | 26 +------------------------
>>>>    include/drm/ttm/ttm_bo_api.h    |  1 -
>>>>    3 files changed, 1 insertion(+), 60 deletions(-)
>>>>
>>>> diff --git a/drivers/gpu/drm/ttm/ttm_bo.c b/drivers/gpu/drm/ttm/ttm_bo.c
>>>> index 20ff56f27aa4..a952dd624b06 100644
>>>> --- a/drivers/gpu/drm/ttm/ttm_bo.c
>>>> +++ b/drivers/gpu/drm/ttm/ttm_bo.c
>>>> @@ -1954,37 +1954,3 @@ void ttm_bo_swapout_all(struct ttm_bo_device
>>>> *bdev)
>>>>            ;
>>>>    }
>>>>    EXPORT_SYMBOL(ttm_bo_swapout_all);
>>>> -
>>>> -/**
>>>> - * ttm_bo_wait_unreserved - interruptible wait for a buffer object
>>>> to become
>>>> - * unreserved
>>>> - *
>>>> - * @bo: Pointer to buffer
>>>> - */
>>>> -int ttm_bo_wait_unreserved(struct ttm_buffer_object *bo)
>>>> -{
>>>> -    int ret;
>>>> -
>>>> -    /*
>>>> -     * In the absense of a wait_unlocked API,
>>>> -     * Use the bo::wu_mutex to avoid triggering livelocks due to
>>>> -     * concurrent use of this function. Note that this use of
>>>> -     * bo::wu_mutex can go away if we change locking order to
>>>> -     * mmap_sem -> bo::reserve.
>>>> -     */
>>>> -    ret = mutex_lock_interruptible(&bo->wu_mutex);
>>>> -    if (unlikely(ret != 0))
>>>> -        return -ERESTARTSYS;
>>>> -    if (!dma_resv_is_locked(bo->base.resv))
>>>> -        goto out_unlock;
>>>> -    ret = dma_resv_lock_interruptible(bo->base.resv, NULL);
>>>> -    if (ret == -EINTR)
>>>> -        ret = -ERESTARTSYS;
>>>> -    if (unlikely(ret != 0))
>>>> -        goto out_unlock;
>>>> -    dma_resv_unlock(bo->base.resv);
>>>> -
>>>> -out_unlock:
>>>> -    mutex_unlock(&bo->wu_mutex);
>>>> -    return ret;
>>>> -}
>>>> diff --git a/drivers/gpu/drm/ttm/ttm_bo_vm.c
>>>> b/drivers/gpu/drm/ttm/ttm_bo_vm.c
>>>> index 76eedb963693..505e1787aeea 100644
>>>> --- a/drivers/gpu/drm/ttm/ttm_bo_vm.c
>>>> +++ b/drivers/gpu/drm/ttm/ttm_bo_vm.c
>>>> @@ -125,31 +125,7 @@ static vm_fault_t ttm_bo_vm_fault(struct
>>>> vm_fault *vmf)
>>>>            &bdev->man[bo->mem.mem_type];
>>>>        struct vm_area_struct cvma;
>>>>    -    /*
>>>> -     * Work around locking order reversal in fault / nopfn
>>>> -     * between mmap_sem and bo_reserve: Perform a trylock operation
>>>> -     * for reserve, and if it fails, retry the fault after waiting
>>>> -     * for the buffer to become unreserved.
>>>> -     */
>>>> -    if (unlikely(!dma_resv_trylock(bo->base.resv))) {
>>>> -        if (vmf->flags & FAULT_FLAG_ALLOW_RETRY) {
>>>> -            if (!(vmf->flags & FAULT_FLAG_RETRY_NOWAIT)) {
>>>> -                ttm_bo_get(bo);
>>>> - up_read(&vmf->vma->vm_mm->mmap_sem);
>>>> -                (void) ttm_bo_wait_unreserved(bo);
>>>> -                ttm_bo_put(bo);
>>>> -            }
>>>> -
>>>> -            return VM_FAULT_RETRY;
>>>> -        }
>>>> -
>>>> -        /*
>>>> -         * If we'd want to change locking order to
>>>> -         * mmap_sem -> bo::reserve, we'd use a blocking reserve here
>>>> -         * instead of retrying the fault...
>>>> -         */
>>> I think you should justify why the above code is removed, since the
>>> comments actually outlines what to do if we change locking order.
>>>
>>> The code that's removed above is not for adjusting locking orders but
>>> to decrease the mm latency by releasing the mmap_sem while waiting for
>>> bo reserve which in turn might be waiting for GPU. At a minimum we
>>> should have a separate patch with justification.
>>>
>>> Note that the caller here ensures locking progress by adjusting the
>>> RETRY flags after a retry.
> That would be patches 1&2 in this series.
>
Hmm? Those seem to touch only dma-buf and nouveau not ttm?  I mean this 
patch should look along the lines of (based on an older tree) to 
implement the new locking-order mmap_sem->reservation,

but to keep the mm latency optimization using the RETRY functionality:


Thanks,
Thomas


diff --git a/drivers/gpu/drm/ttm/ttm_bo_vm.c b/drivers/gpu/drm/ttm/ttm_bo_vm.c
index 85f5bcbe0c76..68482c67b9f7 100644
--- a/drivers/gpu/drm/ttm/ttm_bo_vm.c
+++ b/drivers/gpu/drm/ttm/ttm_bo_vm.c
@@ -125,30 +125,20 @@ static vm_fault_t ttm_bo_vm_fault(struct vm_fault *vmf)
                 &bdev->man[bo->mem.mem_type];
         struct vm_area_struct cvma;
  
-       /*
-        * Work around locking order reversal in fault / nopfn
-        * between mmap_sem and bo_reserve: Perform a trylock operation
-        * for reserve, and if it fails, retry the fault after waiting
-        * for the buffer to become unreserved.
-        */
+       /* Avoid blocking on reservation with mmap_sem held, if possible */
         if (unlikely(!reservation_object_trylock(bo->base.resv))) {
-               if (vmf->flags & FAULT_FLAG_ALLOW_RETRY) {
-                       if (!(vmf->flags & FAULT_FLAG_RETRY_NOWAIT)) {
-                               ttm_bo_get(bo);
-                               up_read(&vmf->vma->vm_mm->mmap_sem);
-                               (void) ttm_bo_wait_unreserved(bo);
-                               ttm_bo_put(bo);
-                       }
+               if ((vmf->flags & FAULT_FLAG_ALLOW_RETRY) &&
+                   !(vmf->flags & FAULT_FLAG_RETRY_NOWAIT)) {
+                       ttm_bo_get(bo);
+                       up_read(&vmf->vma->vm_mm->mmap_sem);
+                       (void) ttm_bo_wait_unreserved(bo);
+                       ttm_bo_put(bo);
  
                         return VM_FAULT_RETRY;
                 }
  
-               /*
-                * If we'd want to change locking order to
-                * mmap_sem -> bo::reserve, we'd use a blocking reserve here
-                * instead of retrying the fault...
-                */
-               return VM_FAULT_NOPAGE;
+               if (reservation_object_lock_interruptible(bo->base.resv, NULL))
+                       return VM_FAULT_NOPAGE;
         }


_______________________________________________
Intel-gfx mailing list
Intel-gfx@lists.freedesktop.org
https://lists.freedesktop.org/mailman/listinfo/intel-gfx

Re: [PATCH 3/3] drm/ttm: remove ttm_bo_wait_unreserved

[Thomas Hellström (VMware)]

On 8/21/19 4:10 PM, Daniel Vetter wrote:
> On Wed, Aug 21, 2019 at 3:16 PM Thomas Hellström (VMware)
> <thomas_os@shipmail.org> wrote:
>> On 8/20/19 4:53 PM, Daniel Vetter wrote:
>>> With nouveau fixed all ttm-using drives have the correct nesting of
>>> mmap_sem vs dma_resv, and we can just lock the buffer.
>>>
>>> Assuming I didn't screw up anything with my audit of course.
>>>
>>> Signed-off-by: Daniel Vetter <daniel.vetter@intel.com>
>>> Cc: Christian Koenig <christian.koenig@amd.com>
>>> Cc: Huang Rui <ray.huang@amd.com>
>>> Cc: Gerd Hoffmann <kraxel@redhat.com>
>>> Cc: "VMware Graphics" <linux-graphics-maintainer@vmware.com>
>>> Cc: Thomas Hellstrom <thellstrom@vmware.com>
>>> ---
>>>    drivers/gpu/drm/ttm/ttm_bo.c    | 34 ---------------------------------
>>>    drivers/gpu/drm/ttm/ttm_bo_vm.c | 26 +------------------------
>>>    include/drm/ttm/ttm_bo_api.h    |  1 -
>>>    3 files changed, 1 insertion(+), 60 deletions(-)
>>>
>>>
>>> +     dma_resv_lock(bo->base.resv, NULL);
>> interruptible, or at least killable. (IIRC think killable is the right
>> choice in fault code, even if TTM initially implemented interruptible to
>> get reasonable Xorg "silken mouse" latency).
> I think interruptible is fine. I chickend out of that for v1 because I
> always mix up the return code for _lock_interruptibl() :-)

:). IIRC I think the in-kernel users of fault() were unhappy with 
interruptible.  (GUP?), but I guess it's better to use a bulk change at 
some point if necessary.

/Thomas

> I'll add that for the next version too.
> -Daniel


_______________________________________________
Intel-gfx mailing list
Intel-gfx@lists.freedesktop.org
https://lists.freedesktop.org/mailman/listinfo/intel-gfx

Re: [PATCH 3/3] drm/ttm: remove ttm_bo_wait_unreserved

[Daniel Vetter]

On Wed, Aug 21, 2019 at 4:30 PM Thomas Hellström (VMware)
<thomas_os@shipmail.org> wrote:
>
> On 8/21/19 4:10 PM, Daniel Vetter wrote:
> > On Wed, Aug 21, 2019 at 3:16 PM Thomas Hellström (VMware)
> > <thomas_os@shipmail.org> wrote:
> >> On 8/20/19 4:53 PM, Daniel Vetter wrote:
> >>> With nouveau fixed all ttm-using drives have the correct nesting of
> >>> mmap_sem vs dma_resv, and we can just lock the buffer.
> >>>
> >>> Assuming I didn't screw up anything with my audit of course.
> >>>
> >>> Signed-off-by: Daniel Vetter <daniel.vetter@intel.com>
> >>> Cc: Christian Koenig <christian.koenig@amd.com>
> >>> Cc: Huang Rui <ray.huang@amd.com>
> >>> Cc: Gerd Hoffmann <kraxel@redhat.com>
> >>> Cc: "VMware Graphics" <linux-graphics-maintainer@vmware.com>
> >>> Cc: Thomas Hellstrom <thellstrom@vmware.com>
> >>> ---
> >>>    drivers/gpu/drm/ttm/ttm_bo.c    | 34 ---------------------------------
> >>>    drivers/gpu/drm/ttm/ttm_bo_vm.c | 26 +------------------------
> >>>    include/drm/ttm/ttm_bo_api.h    |  1 -
> >>>    3 files changed, 1 insertion(+), 60 deletions(-)
> >>>
> >>>
> >>> +     dma_resv_lock(bo->base.resv, NULL);
> >> interruptible, or at least killable. (IIRC think killable is the right
> >> choice in fault code, even if TTM initially implemented interruptible to
> >> get reasonable Xorg "silken mouse" latency).
> > I think interruptible is fine. I chickend out of that for v1 because I
> > always mix up the return code for _lock_interruptibl() :-)
>
> :). IIRC I think the in-kernel users of fault() were unhappy with
> interruptible.  (GUP?), but I guess it's better to use a bulk change at
> some point if necessary.

We've been using interruptible since forever, returning
VM_FAULT_NOPAGE to get the signal handled and re-run. Seems to not
have pissed off anyone thus far. I think if we do this I'll do it as a
follow-up.
-Daniel
-- 
Daniel Vetter
Software Engineer, Intel Corporation
+41 (0) 79 365 57 48 - http://blog.ffwll.ch
_______________________________________________
Intel-gfx mailing list
Intel-gfx@lists.freedesktop.org
https://lists.freedesktop.org/mailman/listinfo/intel-gfx

Re: [PATCH 3/3] drm/ttm: remove ttm_bo_wait_unreserved

[Daniel Vetter]

On Wed, Aug 21, 2019 at 4:27 PM Thomas Hellström (VMware)
<thomas_os@shipmail.org> wrote:
> On 8/21/19 4:09 PM, Daniel Vetter wrote:
> > On Wed, Aug 21, 2019 at 2:47 PM Thomas Hellström (VMware)
> > <thomas_os@shipmail.org> wrote:
> >> On 8/21/19 2:40 PM, Thomas Hellström (VMware) wrote:
> >>> On 8/20/19 4:53 PM, Daniel Vetter wrote:
> >>>> With nouveau fixed all ttm-using drives have the correct nesting of
> >>>> mmap_sem vs dma_resv, and we can just lock the buffer.
> >>>>
> >>>> Assuming I didn't screw up anything with my audit of course.
> >>>>
> >>>> Signed-off-by: Daniel Vetter <daniel.vetter@intel.com>
> >>>> Cc: Christian Koenig <christian.koenig@amd.com>
> >>>> Cc: Huang Rui <ray.huang@amd.com>
> >>>> Cc: Gerd Hoffmann <kraxel@redhat.com>
> >>>> Cc: "VMware Graphics" <linux-graphics-maintainer@vmware.com>
> >>>> Cc: Thomas Hellstrom <thellstrom@vmware.com>
> >>>> ---
> >>>>    drivers/gpu/drm/ttm/ttm_bo.c    | 34 ---------------------------------
> >>>>    drivers/gpu/drm/ttm/ttm_bo_vm.c | 26 +------------------------
> >>>>    include/drm/ttm/ttm_bo_api.h    |  1 -
> >>>>    3 files changed, 1 insertion(+), 60 deletions(-)
> >>>>
> >>>> diff --git a/drivers/gpu/drm/ttm/ttm_bo.c b/drivers/gpu/drm/ttm/ttm_bo.c
> >>>> index 20ff56f27aa4..a952dd624b06 100644
> >>>> --- a/drivers/gpu/drm/ttm/ttm_bo.c
> >>>> +++ b/drivers/gpu/drm/ttm/ttm_bo.c
> >>>> @@ -1954,37 +1954,3 @@ void ttm_bo_swapout_all(struct ttm_bo_device
> >>>> *bdev)
> >>>>            ;
> >>>>    }
> >>>>    EXPORT_SYMBOL(ttm_bo_swapout_all);
> >>>> -
> >>>> -/**
> >>>> - * ttm_bo_wait_unreserved - interruptible wait for a buffer object
> >>>> to become
> >>>> - * unreserved
> >>>> - *
> >>>> - * @bo: Pointer to buffer
> >>>> - */
> >>>> -int ttm_bo_wait_unreserved(struct ttm_buffer_object *bo)
> >>>> -{
> >>>> -    int ret;
> >>>> -
> >>>> -    /*
> >>>> -     * In the absense of a wait_unlocked API,
> >>>> -     * Use the bo::wu_mutex to avoid triggering livelocks due to
> >>>> -     * concurrent use of this function. Note that this use of
> >>>> -     * bo::wu_mutex can go away if we change locking order to
> >>>> -     * mmap_sem -> bo::reserve.
> >>>> -     */
> >>>> -    ret = mutex_lock_interruptible(&bo->wu_mutex);
> >>>> -    if (unlikely(ret != 0))
> >>>> -        return -ERESTARTSYS;
> >>>> -    if (!dma_resv_is_locked(bo->base.resv))
> >>>> -        goto out_unlock;
> >>>> -    ret = dma_resv_lock_interruptible(bo->base.resv, NULL);
> >>>> -    if (ret == -EINTR)
> >>>> -        ret = -ERESTARTSYS;
> >>>> -    if (unlikely(ret != 0))
> >>>> -        goto out_unlock;
> >>>> -    dma_resv_unlock(bo->base.resv);
> >>>> -
> >>>> -out_unlock:
> >>>> -    mutex_unlock(&bo->wu_mutex);
> >>>> -    return ret;
> >>>> -}
> >>>> diff --git a/drivers/gpu/drm/ttm/ttm_bo_vm.c
> >>>> b/drivers/gpu/drm/ttm/ttm_bo_vm.c
> >>>> index 76eedb963693..505e1787aeea 100644
> >>>> --- a/drivers/gpu/drm/ttm/ttm_bo_vm.c
> >>>> +++ b/drivers/gpu/drm/ttm/ttm_bo_vm.c
> >>>> @@ -125,31 +125,7 @@ static vm_fault_t ttm_bo_vm_fault(struct
> >>>> vm_fault *vmf)
> >>>>            &bdev->man[bo->mem.mem_type];
> >>>>        struct vm_area_struct cvma;
> >>>>    -    /*
> >>>> -     * Work around locking order reversal in fault / nopfn
> >>>> -     * between mmap_sem and bo_reserve: Perform a trylock operation
> >>>> -     * for reserve, and if it fails, retry the fault after waiting
> >>>> -     * for the buffer to become unreserved.
> >>>> -     */
> >>>> -    if (unlikely(!dma_resv_trylock(bo->base.resv))) {
> >>>> -        if (vmf->flags & FAULT_FLAG_ALLOW_RETRY) {
> >>>> -            if (!(vmf->flags & FAULT_FLAG_RETRY_NOWAIT)) {
> >>>> -                ttm_bo_get(bo);
> >>>> - up_read(&vmf->vma->vm_mm->mmap_sem);
> >>>> -                (void) ttm_bo_wait_unreserved(bo);
> >>>> -                ttm_bo_put(bo);
> >>>> -            }
> >>>> -
> >>>> -            return VM_FAULT_RETRY;
> >>>> -        }
> >>>> -
> >>>> -        /*
> >>>> -         * If we'd want to change locking order to
> >>>> -         * mmap_sem -> bo::reserve, we'd use a blocking reserve here
> >>>> -         * instead of retrying the fault...
> >>>> -         */
> >>> I think you should justify why the above code is removed, since the
> >>> comments actually outlines what to do if we change locking order.
> >>>
> >>> The code that's removed above is not for adjusting locking orders but
> >>> to decrease the mm latency by releasing the mmap_sem while waiting for
> >>> bo reserve which in turn might be waiting for GPU. At a minimum we
> >>> should have a separate patch with justification.
> >>>
> >>> Note that the caller here ensures locking progress by adjusting the
> >>> RETRY flags after a retry.
> > That would be patches 1&2 in this series.
> >
> Hmm? Those seem to touch only dma-buf and nouveau not ttm?  I mean this
> patch should look along the lines of (based on an older tree) to
> implement the new locking-order mmap_sem->reservation,

Only nouveau was breaking was doing copy_*_user or get_user_pages
while holding dma_resv locks, no one else. So nothing else needed to
be changed. But patch 1 contains the full audit. I might have missed
something.

> but to keep the mm latency optimization using the RETRY functionality:

Still no idea why this is needed? All the comments here and the code
and history seem like they've been about the mmap_sem vs dma_resv
inversion between driver ioctls and fault handling here. Once that's
officially fixed there's no reason to play games here and retry loops
- previously that was necessary because the old ttm_bo_vm_fault had a
busy spin and that's definitely not nice. If it's needed I think it
should be a second patch on top, to keep this all clear. I had to
audit an enormous amount of code, I'd like to make sure I didn't miss
anything before we start to make this super fancy again. Further
patches on top is obviously all fine with me.
-Daniel

> Thanks,
> Thomas
>
>
> diff --git a/drivers/gpu/drm/ttm/ttm_bo_vm.c b/drivers/gpu/drm/ttm/ttm_bo_vm.c
> index 85f5bcbe0c76..68482c67b9f7 100644
> --- a/drivers/gpu/drm/ttm/ttm_bo_vm.c
> +++ b/drivers/gpu/drm/ttm/ttm_bo_vm.c
> @@ -125,30 +125,20 @@ static vm_fault_t ttm_bo_vm_fault(struct vm_fault *vmf)
>                  &bdev->man[bo->mem.mem_type];
>          struct vm_area_struct cvma;
>
> -       /*
> -        * Work around locking order reversal in fault / nopfn
> -        * between mmap_sem and bo_reserve: Perform a trylock operation
> -        * for reserve, and if it fails, retry the fault after waiting
> -        * for the buffer to become unreserved.
> -        */
> +       /* Avoid blocking on reservation with mmap_sem held, if possible */
>          if (unlikely(!reservation_object_trylock(bo->base.resv))) {
> -               if (vmf->flags & FAULT_FLAG_ALLOW_RETRY) {
> -                       if (!(vmf->flags & FAULT_FLAG_RETRY_NOWAIT)) {
> -                               ttm_bo_get(bo);
> -                               up_read(&vmf->vma->vm_mm->mmap_sem);
> -                               (void) ttm_bo_wait_unreserved(bo);
> -                               ttm_bo_put(bo);
> -                       }
> +               if ((vmf->flags & FAULT_FLAG_ALLOW_RETRY) &&
> +                   !(vmf->flags & FAULT_FLAG_RETRY_NOWAIT)) {
> +                       ttm_bo_get(bo);
> +                       up_read(&vmf->vma->vm_mm->mmap_sem);
> +                       (void) ttm_bo_wait_unreserved(bo);
> +                       ttm_bo_put(bo);
>
>                          return VM_FAULT_RETRY;
>                  }
>
> -               /*
> -                * If we'd want to change locking order to
> -                * mmap_sem -> bo::reserve, we'd use a blocking reserve here
> -                * instead of retrying the fault...
> -                */
> -               return VM_FAULT_NOPAGE;
> +               if (reservation_object_lock_interruptible(bo->base.resv, NULL))
> +                       return VM_FAULT_NOPAGE;
>          }
>
>


-- 
Daniel Vetter
Software Engineer, Intel Corporation
+41 (0) 79 365 57 48 - http://blog.ffwll.ch
_______________________________________________
Intel-gfx mailing list
Intel-gfx@lists.freedesktop.org
https://lists.freedesktop.org/mailman/listinfo/intel-gfx

Re: [PATCH 3/3] drm/ttm: remove ttm_bo_wait_unreserved

[Thomas Hellström (VMware)]

On 8/21/19 4:47 PM, Daniel Vetter wrote:
> On Wed, Aug 21, 2019 at 4:27 PM Thomas Hellström (VMware)
> <thomas_os@shipmail.org> wrote:
>> On 8/21/19 4:09 PM, Daniel Vetter wrote:
>>> On Wed, Aug 21, 2019 at 2:47 PM Thomas Hellström (VMware)
>>> <thomas_os@shipmail.org> wrote:
>>>> On 8/21/19 2:40 PM, Thomas Hellström (VMware) wrote:
>>>>> On 8/20/19 4:53 PM, Daniel Vetter wrote:
>>>>>> With nouveau fixed all ttm-using drives have the correct nesting of
>>>>>> mmap_sem vs dma_resv, and we can just lock the buffer.
>>>>>>
>>>>>> Assuming I didn't screw up anything with my audit of course.
>>>>>>
>>>>>> Signed-off-by: Daniel Vetter <daniel.vetter@intel.com>
>>>>>> Cc: Christian Koenig <christian.koenig@amd.com>
>>>>>> Cc: Huang Rui <ray.huang@amd.com>
>>>>>> Cc: Gerd Hoffmann <kraxel@redhat.com>
>>>>>> Cc: "VMware Graphics" <linux-graphics-maintainer@vmware.com>
>>>>>> Cc: Thomas Hellstrom <thellstrom@vmware.com>
>>>>>> ---
>>>>>>     drivers/gpu/drm/ttm/ttm_bo.c    | 34 ---------------------------------
>>>>>>     drivers/gpu/drm/ttm/ttm_bo_vm.c | 26 +------------------------
>>>>>>     include/drm/ttm/ttm_bo_api.h    |  1 -
>>>>>>     3 files changed, 1 insertion(+), 60 deletions(-)
>>>>>>
>>>>>> diff --git a/drivers/gpu/drm/ttm/ttm_bo.c b/drivers/gpu/drm/ttm/ttm_bo.c
>>>>>> index 20ff56f27aa4..a952dd624b06 100644
>>>>>> --- a/drivers/gpu/drm/ttm/ttm_bo.c
>>>>>> +++ b/drivers/gpu/drm/ttm/ttm_bo.c
>>>>>> @@ -1954,37 +1954,3 @@ void ttm_bo_swapout_all(struct ttm_bo_device
>>>>>> *bdev)
>>>>>>             ;
>>>>>>     }
>>>>>>     EXPORT_SYMBOL(ttm_bo_swapout_all);
>>>>>> -
>>>>>> -/**
>>>>>> - * ttm_bo_wait_unreserved - interruptible wait for a buffer object
>>>>>> to become
>>>>>> - * unreserved
>>>>>> - *
>>>>>> - * @bo: Pointer to buffer
>>>>>> - */
>>>>>> -int ttm_bo_wait_unreserved(struct ttm_buffer_object *bo)
>>>>>> -{
>>>>>> -    int ret;
>>>>>> -
>>>>>> -    /*
>>>>>> -     * In the absense of a wait_unlocked API,
>>>>>> -     * Use the bo::wu_mutex to avoid triggering livelocks due to
>>>>>> -     * concurrent use of this function. Note that this use of
>>>>>> -     * bo::wu_mutex can go away if we change locking order to
>>>>>> -     * mmap_sem -> bo::reserve.
>>>>>> -     */
>>>>>> -    ret = mutex_lock_interruptible(&bo->wu_mutex);
>>>>>> -    if (unlikely(ret != 0))
>>>>>> -        return -ERESTARTSYS;
>>>>>> -    if (!dma_resv_is_locked(bo->base.resv))
>>>>>> -        goto out_unlock;
>>>>>> -    ret = dma_resv_lock_interruptible(bo->base.resv, NULL);
>>>>>> -    if (ret == -EINTR)
>>>>>> -        ret = -ERESTARTSYS;
>>>>>> -    if (unlikely(ret != 0))
>>>>>> -        goto out_unlock;
>>>>>> -    dma_resv_unlock(bo->base.resv);
>>>>>> -
>>>>>> -out_unlock:
>>>>>> -    mutex_unlock(&bo->wu_mutex);
>>>>>> -    return ret;
>>>>>> -}
>>>>>> diff --git a/drivers/gpu/drm/ttm/ttm_bo_vm.c
>>>>>> b/drivers/gpu/drm/ttm/ttm_bo_vm.c
>>>>>> index 76eedb963693..505e1787aeea 100644
>>>>>> --- a/drivers/gpu/drm/ttm/ttm_bo_vm.c
>>>>>> +++ b/drivers/gpu/drm/ttm/ttm_bo_vm.c
>>>>>> @@ -125,31 +125,7 @@ static vm_fault_t ttm_bo_vm_fault(struct
>>>>>> vm_fault *vmf)
>>>>>>             &bdev->man[bo->mem.mem_type];
>>>>>>         struct vm_area_struct cvma;
>>>>>>     -    /*
>>>>>> -     * Work around locking order reversal in fault / nopfn
>>>>>> -     * between mmap_sem and bo_reserve: Perform a trylock operation
>>>>>> -     * for reserve, and if it fails, retry the fault after waiting
>>>>>> -     * for the buffer to become unreserved.
>>>>>> -     */
>>>>>> -    if (unlikely(!dma_resv_trylock(bo->base.resv))) {
>>>>>> -        if (vmf->flags & FAULT_FLAG_ALLOW_RETRY) {
>>>>>> -            if (!(vmf->flags & FAULT_FLAG_RETRY_NOWAIT)) {
>>>>>> -                ttm_bo_get(bo);
>>>>>> - up_read(&vmf->vma->vm_mm->mmap_sem);
>>>>>> -                (void) ttm_bo_wait_unreserved(bo);
>>>>>> -                ttm_bo_put(bo);
>>>>>> -            }
>>>>>> -
>>>>>> -            return VM_FAULT_RETRY;
>>>>>> -        }
>>>>>> -
>>>>>> -        /*
>>>>>> -         * If we'd want to change locking order to
>>>>>> -         * mmap_sem -> bo::reserve, we'd use a blocking reserve here
>>>>>> -         * instead of retrying the fault...
>>>>>> -         */
>>>>> I think you should justify why the above code is removed, since the
>>>>> comments actually outlines what to do if we change locking order.
>>>>>
>>>>> The code that's removed above is not for adjusting locking orders but
>>>>> to decrease the mm latency by releasing the mmap_sem while waiting for
>>>>> bo reserve which in turn might be waiting for GPU. At a minimum we
>>>>> should have a separate patch with justification.
>>>>>
>>>>> Note that the caller here ensures locking progress by adjusting the
>>>>> RETRY flags after a retry.
>>> That would be patches 1&2 in this series.
>>>
>> Hmm? Those seem to touch only dma-buf and nouveau not ttm?  I mean this
>> patch should look along the lines of (based on an older tree) to
>> implement the new locking-order mmap_sem->reservation,
> Only nouveau was breaking was doing copy_*_user or get_user_pages
> while holding dma_resv locks, no one else. So nothing else needed to
> be changed. But patch 1 contains the full audit. I might have missed
> something.
>
>> but to keep the mm latency optimization using the RETRY functionality:
> Still no idea why this is needed? All the comments here and the code
> and history seem like they've been about the mmap_sem vs dma_resv
> inversion between driver ioctls and fault handling here. Once that's
> officially fixed there's no reason to play games here and retry loops
> - previously that was necessary because the old ttm_bo_vm_fault had a
> busy spin and that's definitely not nice. If it's needed I think it
> should be a second patch on top, to keep this all clear. I had to
> audit an enormous amount of code, I'd like to make sure I didn't miss
> anything before we start to make this super fancy again. Further
> patches on top is obviously all fine with me.
> -Daniel

Yes, but there are two different things you remove here. One is the 
workaround for the locking reversal, which is obviously correct.

One is TTM's implementation of the mmap_sem latency optimization, which 
looks like an oversight.

That optimization is why the VM_FAULT_RETRY functionality was added to 
mm in the first place and is intended to be used when drivers expect a 
substantial sleep to avoid keeping the pretty globalish mmap_sem held 
while that sleep is taking place. We do exactly the same while waiting 
for move-fences (ttm_bo_vm_fault_idle) and other drivers that expect 
long waits in the fault handler do the same.

To avoid this accidently happening there was even this comment:

         /*
          * If we'd want to change locking order to
          * mmap_sem -> bo::reserve, we'd use a blocking reserve here
          * instead of retrying the fault...
          */
         return VM_FAULT_NOPAGE;

And I do really think we should avoid accidently removing this just to 
re-add it in a later patch, particularly when I pointed it out at review 
time.

/Thomas



_______________________________________________
Intel-gfx mailing list
Intel-gfx@lists.freedesktop.org
https://lists.freedesktop.org/mailman/listinfo/intel-gfx

Re: [PATCH 3/3] drm/ttm: remove ttm_bo_wait_unreserved

[Koenig, Christian]

Am 21.08.19 um 16:47 schrieb Daniel Vetter:
> On Wed, Aug 21, 2019 at 4:27 PM Thomas Hellström (VMware)
> <thomas_os@shipmail.org> wrote:
>> On 8/21/19 4:09 PM, Daniel Vetter wrote:
>>> On Wed, Aug 21, 2019 at 2:47 PM Thomas Hellström (VMware)
>>> <thomas_os@shipmail.org> wrote:
>>>> On 8/21/19 2:40 PM, Thomas Hellström (VMware) wrote:
>>>>> On 8/20/19 4:53 PM, Daniel Vetter wrote:
>>>>> [SNIP]
>> but to keep the mm latency optimization using the RETRY functionality:
> Still no idea why this is needed? All the comments here and the code
> and history seem like they've been about the mmap_sem vs dma_resv
> inversion between driver ioctls and fault handling here. Once that's
> officially fixed there's no reason to play games here and retry loops
> - previously that was necessary because the old ttm_bo_vm_fault had a
> busy spin and that's definitely not nice. If it's needed I think it
> should be a second patch on top, to keep this all clear. I had to
> audit an enormous amount of code, I'd like to make sure I didn't miss
> anything before we start to make this super fancy again. Further
> patches on top is obviously all fine with me.

I think this is just an optimization to not hold the mmap_sem while 
waiting for the dma_resv lock.

I agree that it shouldn't be necessary, but maybe it's a good idea for 
performance. I'm also OK with removing it, cause I'm not sure if it's 
worth it.

But Thomas noted correctly that we should probably do it in a separate 
patch so that when somebody points out "Hey my system is slower now!" 
he's able to bisect to the change.

Christian.

> -Daniel
>
>> Thanks,
>> Thomas
>>

_______________________________________________
dri-devel mailing list
dri-devel@lists.freedesktop.org
https://lists.freedesktop.org/mailman/listinfo/dri-devel

Re: [PATCH 3/3] drm/ttm: remove ttm_bo_wait_unreserved

[Daniel Vetter]

On Wed, Aug 21, 2019 at 5:03 PM Thomas Hellström (VMware)
<thomas_os@shipmail.org> wrote:
> On 8/21/19 4:47 PM, Daniel Vetter wrote:
> > On Wed, Aug 21, 2019 at 4:27 PM Thomas Hellström (VMware)
> > <thomas_os@shipmail.org> wrote:
> >> On 8/21/19 4:09 PM, Daniel Vetter wrote:
> >>> On Wed, Aug 21, 2019 at 2:47 PM Thomas Hellström (VMware)
> >>> <thomas_os@shipmail.org> wrote:
> >>>> On 8/21/19 2:40 PM, Thomas Hellström (VMware) wrote:
> >>>>> On 8/20/19 4:53 PM, Daniel Vetter wrote:
> >>>>>> With nouveau fixed all ttm-using drives have the correct nesting of
> >>>>>> mmap_sem vs dma_resv, and we can just lock the buffer.
> >>>>>>
> >>>>>> Assuming I didn't screw up anything with my audit of course.
> >>>>>>
> >>>>>> Signed-off-by: Daniel Vetter <daniel.vetter@intel.com>
> >>>>>> Cc: Christian Koenig <christian.koenig@amd.com>
> >>>>>> Cc: Huang Rui <ray.huang@amd.com>
> >>>>>> Cc: Gerd Hoffmann <kraxel@redhat.com>
> >>>>>> Cc: "VMware Graphics" <linux-graphics-maintainer@vmware.com>
> >>>>>> Cc: Thomas Hellstrom <thellstrom@vmware.com>
> >>>>>> ---
> >>>>>>     drivers/gpu/drm/ttm/ttm_bo.c    | 34 ---------------------------------
> >>>>>>     drivers/gpu/drm/ttm/ttm_bo_vm.c | 26 +------------------------
> >>>>>>     include/drm/ttm/ttm_bo_api.h    |  1 -
> >>>>>>     3 files changed, 1 insertion(+), 60 deletions(-)
> >>>>>>
> >>>>>> diff --git a/drivers/gpu/drm/ttm/ttm_bo.c b/drivers/gpu/drm/ttm/ttm_bo.c
> >>>>>> index 20ff56f27aa4..a952dd624b06 100644
> >>>>>> --- a/drivers/gpu/drm/ttm/ttm_bo.c
> >>>>>> +++ b/drivers/gpu/drm/ttm/ttm_bo.c
> >>>>>> @@ -1954,37 +1954,3 @@ void ttm_bo_swapout_all(struct ttm_bo_device
> >>>>>> *bdev)
> >>>>>>             ;
> >>>>>>     }
> >>>>>>     EXPORT_SYMBOL(ttm_bo_swapout_all);
> >>>>>> -
> >>>>>> -/**
> >>>>>> - * ttm_bo_wait_unreserved - interruptible wait for a buffer object
> >>>>>> to become
> >>>>>> - * unreserved
> >>>>>> - *
> >>>>>> - * @bo: Pointer to buffer
> >>>>>> - */
> >>>>>> -int ttm_bo_wait_unreserved(struct ttm_buffer_object *bo)
> >>>>>> -{
> >>>>>> -    int ret;
> >>>>>> -
> >>>>>> -    /*
> >>>>>> -     * In the absense of a wait_unlocked API,
> >>>>>> -     * Use the bo::wu_mutex to avoid triggering livelocks due to
> >>>>>> -     * concurrent use of this function. Note that this use of
> >>>>>> -     * bo::wu_mutex can go away if we change locking order to
> >>>>>> -     * mmap_sem -> bo::reserve.
> >>>>>> -     */
> >>>>>> -    ret = mutex_lock_interruptible(&bo->wu_mutex);
> >>>>>> -    if (unlikely(ret != 0))
> >>>>>> -        return -ERESTARTSYS;
> >>>>>> -    if (!dma_resv_is_locked(bo->base.resv))
> >>>>>> -        goto out_unlock;
> >>>>>> -    ret = dma_resv_lock_interruptible(bo->base.resv, NULL);
> >>>>>> -    if (ret == -EINTR)
> >>>>>> -        ret = -ERESTARTSYS;
> >>>>>> -    if (unlikely(ret != 0))
> >>>>>> -        goto out_unlock;
> >>>>>> -    dma_resv_unlock(bo->base.resv);
> >>>>>> -
> >>>>>> -out_unlock:
> >>>>>> -    mutex_unlock(&bo->wu_mutex);
> >>>>>> -    return ret;
> >>>>>> -}
> >>>>>> diff --git a/drivers/gpu/drm/ttm/ttm_bo_vm.c
> >>>>>> b/drivers/gpu/drm/ttm/ttm_bo_vm.c
> >>>>>> index 76eedb963693..505e1787aeea 100644
> >>>>>> --- a/drivers/gpu/drm/ttm/ttm_bo_vm.c
> >>>>>> +++ b/drivers/gpu/drm/ttm/ttm_bo_vm.c
> >>>>>> @@ -125,31 +125,7 @@ static vm_fault_t ttm_bo_vm_fault(struct
> >>>>>> vm_fault *vmf)
> >>>>>>             &bdev->man[bo->mem.mem_type];
> >>>>>>         struct vm_area_struct cvma;
> >>>>>>     -    /*
> >>>>>> -     * Work around locking order reversal in fault / nopfn
> >>>>>> -     * between mmap_sem and bo_reserve: Perform a trylock operation
> >>>>>> -     * for reserve, and if it fails, retry the fault after waiting
> >>>>>> -     * for the buffer to become unreserved.
> >>>>>> -     */
> >>>>>> -    if (unlikely(!dma_resv_trylock(bo->base.resv))) {
> >>>>>> -        if (vmf->flags & FAULT_FLAG_ALLOW_RETRY) {
> >>>>>> -            if (!(vmf->flags & FAULT_FLAG_RETRY_NOWAIT)) {
> >>>>>> -                ttm_bo_get(bo);
> >>>>>> - up_read(&vmf->vma->vm_mm->mmap_sem);
> >>>>>> -                (void) ttm_bo_wait_unreserved(bo);
> >>>>>> -                ttm_bo_put(bo);
> >>>>>> -            }
> >>>>>> -
> >>>>>> -            return VM_FAULT_RETRY;
> >>>>>> -        }
> >>>>>> -
> >>>>>> -        /*
> >>>>>> -         * If we'd want to change locking order to
> >>>>>> -         * mmap_sem -> bo::reserve, we'd use a blocking reserve here
> >>>>>> -         * instead of retrying the fault...
> >>>>>> -         */
> >>>>> I think you should justify why the above code is removed, since the
> >>>>> comments actually outlines what to do if we change locking order.
> >>>>>
> >>>>> The code that's removed above is not for adjusting locking orders but
> >>>>> to decrease the mm latency by releasing the mmap_sem while waiting for
> >>>>> bo reserve which in turn might be waiting for GPU. At a minimum we
> >>>>> should have a separate patch with justification.
> >>>>>
> >>>>> Note that the caller here ensures locking progress by adjusting the
> >>>>> RETRY flags after a retry.
> >>> That would be patches 1&2 in this series.
> >>>
> >> Hmm? Those seem to touch only dma-buf and nouveau not ttm?  I mean this
> >> patch should look along the lines of (based on an older tree) to
> >> implement the new locking-order mmap_sem->reservation,
> > Only nouveau was breaking was doing copy_*_user or get_user_pages
> > while holding dma_resv locks, no one else. So nothing else needed to
> > be changed. But patch 1 contains the full audit. I might have missed
> > something.
> >
> >> but to keep the mm latency optimization using the RETRY functionality:
> > Still no idea why this is needed? All the comments here and the code
> > and history seem like they've been about the mmap_sem vs dma_resv
> > inversion between driver ioctls and fault handling here. Once that's
> > officially fixed there's no reason to play games here and retry loops
> > - previously that was necessary because the old ttm_bo_vm_fault had a
> > busy spin and that's definitely not nice. If it's needed I think it
> > should be a second patch on top, to keep this all clear. I had to
> > audit an enormous amount of code, I'd like to make sure I didn't miss
> > anything before we start to make this super fancy again. Further
> > patches on top is obviously all fine with me.
> > -Daniel
>
> Yes, but there are two different things you remove here. One is the
> workaround for the locking reversal, which is obviously correct.
>
> One is TTM's implementation of the mmap_sem latency optimization, which
> looks like an oversight.
>
> That optimization is why the VM_FAULT_RETRY functionality was added to
> mm in the first place and is intended to be used when drivers expect a
> substantial sleep to avoid keeping the pretty globalish mmap_sem held
> while that sleep is taking place. We do exactly the same while waiting
> for move-fences (ttm_bo_vm_fault_idle) and other drivers that expect
> long waits in the fault handler do the same.

Hm, are we guaranteed that core mm will only call us once with
ALLOW_RETRY? Just to make sure that we're not live-locking here. I'd
also like to get rid of the wu_mutex, that just looks really strange
(and I thought it was to duct-tape over the inversion, not as an
optimization). If the livelock due to locking inversion is gone I have
no idea anymore why we even needs the wu_mutex.

> To avoid this accidently happening there was even this comment:
>
>          /*
>           * If we'd want to change locking order to
>           * mmap_sem -> bo::reserve, we'd use a blocking reserve here
>           * instead of retrying the fault...
>           */
>          return VM_FAULT_NOPAGE;
>
> And I do really think we should avoid accidently removing this just to
> re-add it in a later patch, particularly when I pointed it out at review
> time.

Yeah I read that, but I didn't read this comment the way you now explained it.
-Daniel




--
Daniel Vetter
Software Engineer, Intel Corporation
+41 (0) 79 365 57 48 - http://blog.ffwll.ch
_______________________________________________
Intel-gfx mailing list
Intel-gfx@lists.freedesktop.org
https://lists.freedesktop.org/mailman/listinfo/intel-gfx

Re: [PATCH 3/3] drm/ttm: remove ttm_bo_wait_unreserved

[Thomas Hellström (VMware)]

On 8/21/19 5:14 PM, Daniel Vetter wrote:
> On Wed, Aug 21, 2019 at 5:03 PM Thomas Hellström (VMware)
> <thomas_os@shipmail.org> wrote:
>> On 8/21/19 4:47 PM, Daniel Vetter wrote:
>>> On Wed, Aug 21, 2019 at 4:27 PM Thomas Hellström (VMware)
>>> <thomas_os@shipmail.org> wrote:
>>>> On 8/21/19 4:09 PM, Daniel Vetter wrote:
>>>>> On Wed, Aug 21, 2019 at 2:47 PM Thomas Hellström (VMware)
>>>>> <thomas_os@shipmail.org> wrote:
>>>>>> On 8/21/19 2:40 PM, Thomas Hellström (VMware) wrote:
>>>>>>> On 8/20/19 4:53 PM, Daniel Vetter wrote:
>>>>>>>> With nouveau fixed all ttm-using drives have the correct nesting of
>>>>>>>> mmap_sem vs dma_resv, and we can just lock the buffer.
>>>>>>>>
>>>>>>>> Assuming I didn't screw up anything with my audit of course.
>>>>>>>>
>>>>>>>> Signed-off-by: Daniel Vetter <daniel.vetter@intel.com>
>>>>>>>> Cc: Christian Koenig <christian.koenig@amd.com>
>>>>>>>> Cc: Huang Rui <ray.huang@amd.com>
>>>>>>>> Cc: Gerd Hoffmann <kraxel@redhat.com>
>>>>>>>> Cc: "VMware Graphics" <linux-graphics-maintainer@vmware.com>
>>>>>>>> Cc: Thomas Hellstrom <thellstrom@vmware.com>
>>>>>>>> ---
>>>>>>>>      drivers/gpu/drm/ttm/ttm_bo.c    | 34 ---------------------------------
>>>>>>>>      drivers/gpu/drm/ttm/ttm_bo_vm.c | 26 +------------------------
>>>>>>>>      include/drm/ttm/ttm_bo_api.h    |  1 -
>>>>>>>>      3 files changed, 1 insertion(+), 60 deletions(-)
>>>>>>>>
>>>>>>>> diff --git a/drivers/gpu/drm/ttm/ttm_bo.c b/drivers/gpu/drm/ttm/ttm_bo.c
>>>>>>>> index 20ff56f27aa4..a952dd624b06 100644
>>>>>>>> --- a/drivers/gpu/drm/ttm/ttm_bo.c
>>>>>>>> +++ b/drivers/gpu/drm/ttm/ttm_bo.c
>>>>>>>> @@ -1954,37 +1954,3 @@ void ttm_bo_swapout_all(struct ttm_bo_device
>>>>>>>> *bdev)
>>>>>>>>              ;
>>>>>>>>      }
>>>>>>>>      EXPORT_SYMBOL(ttm_bo_swapout_all);
>>>>>>>> -
>>>>>>>> -/**
>>>>>>>> - * ttm_bo_wait_unreserved - interruptible wait for a buffer object
>>>>>>>> to become
>>>>>>>> - * unreserved
>>>>>>>> - *
>>>>>>>> - * @bo: Pointer to buffer
>>>>>>>> - */
>>>>>>>> -int ttm_bo_wait_unreserved(struct ttm_buffer_object *bo)
>>>>>>>> -{
>>>>>>>> -    int ret;
>>>>>>>> -
>>>>>>>> -    /*
>>>>>>>> -     * In the absense of a wait_unlocked API,
>>>>>>>> -     * Use the bo::wu_mutex to avoid triggering livelocks due to
>>>>>>>> -     * concurrent use of this function. Note that this use of
>>>>>>>> -     * bo::wu_mutex can go away if we change locking order to
>>>>>>>> -     * mmap_sem -> bo::reserve.
>>>>>>>> -     */
>>>>>>>> -    ret = mutex_lock_interruptible(&bo->wu_mutex);
>>>>>>>> -    if (unlikely(ret != 0))
>>>>>>>> -        return -ERESTARTSYS;
>>>>>>>> -    if (!dma_resv_is_locked(bo->base.resv))
>>>>>>>> -        goto out_unlock;
>>>>>>>> -    ret = dma_resv_lock_interruptible(bo->base.resv, NULL);
>>>>>>>> -    if (ret == -EINTR)
>>>>>>>> -        ret = -ERESTARTSYS;
>>>>>>>> -    if (unlikely(ret != 0))
>>>>>>>> -        goto out_unlock;
>>>>>>>> -    dma_resv_unlock(bo->base.resv);
>>>>>>>> -
>>>>>>>> -out_unlock:
>>>>>>>> -    mutex_unlock(&bo->wu_mutex);
>>>>>>>> -    return ret;
>>>>>>>> -}
>>>>>>>> diff --git a/drivers/gpu/drm/ttm/ttm_bo_vm.c
>>>>>>>> b/drivers/gpu/drm/ttm/ttm_bo_vm.c
>>>>>>>> index 76eedb963693..505e1787aeea 100644
>>>>>>>> --- a/drivers/gpu/drm/ttm/ttm_bo_vm.c
>>>>>>>> +++ b/drivers/gpu/drm/ttm/ttm_bo_vm.c
>>>>>>>> @@ -125,31 +125,7 @@ static vm_fault_t ttm_bo_vm_fault(struct
>>>>>>>> vm_fault *vmf)
>>>>>>>>              &bdev->man[bo->mem.mem_type];
>>>>>>>>          struct vm_area_struct cvma;
>>>>>>>>      -    /*
>>>>>>>> -     * Work around locking order reversal in fault / nopfn
>>>>>>>> -     * between mmap_sem and bo_reserve: Perform a trylock operation
>>>>>>>> -     * for reserve, and if it fails, retry the fault after waiting
>>>>>>>> -     * for the buffer to become unreserved.
>>>>>>>> -     */
>>>>>>>> -    if (unlikely(!dma_resv_trylock(bo->base.resv))) {
>>>>>>>> -        if (vmf->flags & FAULT_FLAG_ALLOW_RETRY) {
>>>>>>>> -            if (!(vmf->flags & FAULT_FLAG_RETRY_NOWAIT)) {
>>>>>>>> -                ttm_bo_get(bo);
>>>>>>>> - up_read(&vmf->vma->vm_mm->mmap_sem);
>>>>>>>> -                (void) ttm_bo_wait_unreserved(bo);
>>>>>>>> -                ttm_bo_put(bo);
>>>>>>>> -            }
>>>>>>>> -
>>>>>>>> -            return VM_FAULT_RETRY;
>>>>>>>> -        }
>>>>>>>> -
>>>>>>>> -        /*
>>>>>>>> -         * If we'd want to change locking order to
>>>>>>>> -         * mmap_sem -> bo::reserve, we'd use a blocking reserve here
>>>>>>>> -         * instead of retrying the fault...
>>>>>>>> -         */
>>>>>>> I think you should justify why the above code is removed, since the
>>>>>>> comments actually outlines what to do if we change locking order.
>>>>>>>
>>>>>>> The code that's removed above is not for adjusting locking orders but
>>>>>>> to decrease the mm latency by releasing the mmap_sem while waiting for
>>>>>>> bo reserve which in turn might be waiting for GPU. At a minimum we
>>>>>>> should have a separate patch with justification.
>>>>>>>
>>>>>>> Note that the caller here ensures locking progress by adjusting the
>>>>>>> RETRY flags after a retry.
>>>>> That would be patches 1&2 in this series.
>>>>>
>>>> Hmm? Those seem to touch only dma-buf and nouveau not ttm?  I mean this
>>>> patch should look along the lines of (based on an older tree) to
>>>> implement the new locking-order mmap_sem->reservation,
>>> Only nouveau was breaking was doing copy_*_user or get_user_pages
>>> while holding dma_resv locks, no one else. So nothing else needed to
>>> be changed. But patch 1 contains the full audit. I might have missed
>>> something.
>>>
>>>> but to keep the mm latency optimization using the RETRY functionality:
>>> Still no idea why this is needed? All the comments here and the code
>>> and history seem like they've been about the mmap_sem vs dma_resv
>>> inversion between driver ioctls and fault handling here. Once that's
>>> officially fixed there's no reason to play games here and retry loops
>>> - previously that was necessary because the old ttm_bo_vm_fault had a
>>> busy spin and that's definitely not nice. If it's needed I think it
>>> should be a second patch on top, to keep this all clear. I had to
>>> audit an enormous amount of code, I'd like to make sure I didn't miss
>>> anything before we start to make this super fancy again. Further
>>> patches on top is obviously all fine with me.
>>> -Daniel
>> Yes, but there are two different things you remove here. One is the
>> workaround for the locking reversal, which is obviously correct.
>>
>> One is TTM's implementation of the mmap_sem latency optimization, which
>> looks like an oversight.
>>
>> That optimization is why the VM_FAULT_RETRY functionality was added to
>> mm in the first place and is intended to be used when drivers expect a
>> substantial sleep to avoid keeping the pretty globalish mmap_sem held
>> while that sleep is taking place. We do exactly the same while waiting
>> for move-fences (ttm_bo_vm_fault_idle) and other drivers that expect
>> long waits in the fault handler do the same.
> Hm, are we guaranteed that core mm will only call us once with
> ALLOW_RETRY?

Last time I looked in the implementation, yes. The ALLOW_RETRY was there 
to specifically
allow making progress in the locking.

>   Just to make sure that we're not live-locking here. I'd
> also like to get rid of the wu_mutex, that just looks really strange
> (and I thought it was to duct-tape over the inversion, not as an
> optimization). If the livelock due to locking inversion is gone I have
> no idea anymore why we even needs the wu_mutex.

Yes, my interpretation of this is that wu_mutex definitely can be ditched.

/Thomas


_______________________________________________
Intel-gfx mailing list
Intel-gfx@lists.freedesktop.org
https://lists.freedesktop.org/mailman/listinfo/intel-gfx

Re: [PATCH 3/3] drm/ttm: remove ttm_bo_wait_unreserved

[Daniel Vetter]

On Wed, Aug 21, 2019 at 5:19 PM Thomas Hellström (VMware)
<thomas_os@shipmail.org> wrote:
> On 8/21/19 5:14 PM, Daniel Vetter wrote:
> > On Wed, Aug 21, 2019 at 5:03 PM Thomas Hellström (VMware)
> > <thomas_os@shipmail.org> wrote:
> >> On 8/21/19 4:47 PM, Daniel Vetter wrote:
> >>> On Wed, Aug 21, 2019 at 4:27 PM Thomas Hellström (VMware)
> >>> <thomas_os@shipmail.org> wrote:
> >>>> On 8/21/19 4:09 PM, Daniel Vetter wrote:
> >>>>> On Wed, Aug 21, 2019 at 2:47 PM Thomas Hellström (VMware)
> >>>>> <thomas_os@shipmail.org> wrote:
> >>>>>> On 8/21/19 2:40 PM, Thomas Hellström (VMware) wrote:
> >>>>>>> On 8/20/19 4:53 PM, Daniel Vetter wrote:
> >>>>>>>> With nouveau fixed all ttm-using drives have the correct nesting of
> >>>>>>>> mmap_sem vs dma_resv, and we can just lock the buffer.
> >>>>>>>>
> >>>>>>>> Assuming I didn't screw up anything with my audit of course.
> >>>>>>>>
> >>>>>>>> Signed-off-by: Daniel Vetter <daniel.vetter@intel.com>
> >>>>>>>> Cc: Christian Koenig <christian.koenig@amd.com>
> >>>>>>>> Cc: Huang Rui <ray.huang@amd.com>
> >>>>>>>> Cc: Gerd Hoffmann <kraxel@redhat.com>
> >>>>>>>> Cc: "VMware Graphics" <linux-graphics-maintainer@vmware.com>
> >>>>>>>> Cc: Thomas Hellstrom <thellstrom@vmware.com>
> >>>>>>>> ---
> >>>>>>>>      drivers/gpu/drm/ttm/ttm_bo.c    | 34 ---------------------------------
> >>>>>>>>      drivers/gpu/drm/ttm/ttm_bo_vm.c | 26 +------------------------
> >>>>>>>>      include/drm/ttm/ttm_bo_api.h    |  1 -
> >>>>>>>>      3 files changed, 1 insertion(+), 60 deletions(-)
> >>>>>>>>
> >>>>>>>> diff --git a/drivers/gpu/drm/ttm/ttm_bo.c b/drivers/gpu/drm/ttm/ttm_bo.c
> >>>>>>>> index 20ff56f27aa4..a952dd624b06 100644
> >>>>>>>> --- a/drivers/gpu/drm/ttm/ttm_bo.c
> >>>>>>>> +++ b/drivers/gpu/drm/ttm/ttm_bo.c
> >>>>>>>> @@ -1954,37 +1954,3 @@ void ttm_bo_swapout_all(struct ttm_bo_device
> >>>>>>>> *bdev)
> >>>>>>>>              ;
> >>>>>>>>      }
> >>>>>>>>      EXPORT_SYMBOL(ttm_bo_swapout_all);
> >>>>>>>> -
> >>>>>>>> -/**
> >>>>>>>> - * ttm_bo_wait_unreserved - interruptible wait for a buffer object
> >>>>>>>> to become
> >>>>>>>> - * unreserved
> >>>>>>>> - *
> >>>>>>>> - * @bo: Pointer to buffer
> >>>>>>>> - */
> >>>>>>>> -int ttm_bo_wait_unreserved(struct ttm_buffer_object *bo)
> >>>>>>>> -{
> >>>>>>>> -    int ret;
> >>>>>>>> -
> >>>>>>>> -    /*
> >>>>>>>> -     * In the absense of a wait_unlocked API,
> >>>>>>>> -     * Use the bo::wu_mutex to avoid triggering livelocks due to
> >>>>>>>> -     * concurrent use of this function. Note that this use of
> >>>>>>>> -     * bo::wu_mutex can go away if we change locking order to
> >>>>>>>> -     * mmap_sem -> bo::reserve.
> >>>>>>>> -     */
> >>>>>>>> -    ret = mutex_lock_interruptible(&bo->wu_mutex);
> >>>>>>>> -    if (unlikely(ret != 0))
> >>>>>>>> -        return -ERESTARTSYS;
> >>>>>>>> -    if (!dma_resv_is_locked(bo->base.resv))
> >>>>>>>> -        goto out_unlock;
> >>>>>>>> -    ret = dma_resv_lock_interruptible(bo->base.resv, NULL);
> >>>>>>>> -    if (ret == -EINTR)
> >>>>>>>> -        ret = -ERESTARTSYS;
> >>>>>>>> -    if (unlikely(ret != 0))
> >>>>>>>> -        goto out_unlock;
> >>>>>>>> -    dma_resv_unlock(bo->base.resv);
> >>>>>>>> -
> >>>>>>>> -out_unlock:
> >>>>>>>> -    mutex_unlock(&bo->wu_mutex);
> >>>>>>>> -    return ret;
> >>>>>>>> -}
> >>>>>>>> diff --git a/drivers/gpu/drm/ttm/ttm_bo_vm.c
> >>>>>>>> b/drivers/gpu/drm/ttm/ttm_bo_vm.c
> >>>>>>>> index 76eedb963693..505e1787aeea 100644
> >>>>>>>> --- a/drivers/gpu/drm/ttm/ttm_bo_vm.c
> >>>>>>>> +++ b/drivers/gpu/drm/ttm/ttm_bo_vm.c
> >>>>>>>> @@ -125,31 +125,7 @@ static vm_fault_t ttm_bo_vm_fault(struct
> >>>>>>>> vm_fault *vmf)
> >>>>>>>>              &bdev->man[bo->mem.mem_type];
> >>>>>>>>          struct vm_area_struct cvma;
> >>>>>>>>      -    /*
> >>>>>>>> -     * Work around locking order reversal in fault / nopfn
> >>>>>>>> -     * between mmap_sem and bo_reserve: Perform a trylock operation
> >>>>>>>> -     * for reserve, and if it fails, retry the fault after waiting
> >>>>>>>> -     * for the buffer to become unreserved.
> >>>>>>>> -     */
> >>>>>>>> -    if (unlikely(!dma_resv_trylock(bo->base.resv))) {
> >>>>>>>> -        if (vmf->flags & FAULT_FLAG_ALLOW_RETRY) {
> >>>>>>>> -            if (!(vmf->flags & FAULT_FLAG_RETRY_NOWAIT)) {
> >>>>>>>> -                ttm_bo_get(bo);
> >>>>>>>> - up_read(&vmf->vma->vm_mm->mmap_sem);
> >>>>>>>> -                (void) ttm_bo_wait_unreserved(bo);
> >>>>>>>> -                ttm_bo_put(bo);
> >>>>>>>> -            }
> >>>>>>>> -
> >>>>>>>> -            return VM_FAULT_RETRY;
> >>>>>>>> -        }
> >>>>>>>> -
> >>>>>>>> -        /*
> >>>>>>>> -         * If we'd want to change locking order to
> >>>>>>>> -         * mmap_sem -> bo::reserve, we'd use a blocking reserve here
> >>>>>>>> -         * instead of retrying the fault...
> >>>>>>>> -         */
> >>>>>>> I think you should justify why the above code is removed, since the
> >>>>>>> comments actually outlines what to do if we change locking order.
> >>>>>>>
> >>>>>>> The code that's removed above is not for adjusting locking orders but
> >>>>>>> to decrease the mm latency by releasing the mmap_sem while waiting for
> >>>>>>> bo reserve which in turn might be waiting for GPU. At a minimum we
> >>>>>>> should have a separate patch with justification.
> >>>>>>>
> >>>>>>> Note that the caller here ensures locking progress by adjusting the
> >>>>>>> RETRY flags after a retry.
> >>>>> That would be patches 1&2 in this series.
> >>>>>
> >>>> Hmm? Those seem to touch only dma-buf and nouveau not ttm?  I mean this
> >>>> patch should look along the lines of (based on an older tree) to
> >>>> implement the new locking-order mmap_sem->reservation,
> >>> Only nouveau was breaking was doing copy_*_user or get_user_pages
> >>> while holding dma_resv locks, no one else. So nothing else needed to
> >>> be changed. But patch 1 contains the full audit. I might have missed
> >>> something.
> >>>
> >>>> but to keep the mm latency optimization using the RETRY functionality:
> >>> Still no idea why this is needed? All the comments here and the code
> >>> and history seem like they've been about the mmap_sem vs dma_resv
> >>> inversion between driver ioctls and fault handling here. Once that's
> >>> officially fixed there's no reason to play games here and retry loops
> >>> - previously that was necessary because the old ttm_bo_vm_fault had a
> >>> busy spin and that's definitely not nice. If it's needed I think it
> >>> should be a second patch on top, to keep this all clear. I had to
> >>> audit an enormous amount of code, I'd like to make sure I didn't miss
> >>> anything before we start to make this super fancy again. Further
> >>> patches on top is obviously all fine with me.
> >>> -Daniel
> >> Yes, but there are two different things you remove here. One is the
> >> workaround for the locking reversal, which is obviously correct.
> >>
> >> One is TTM's implementation of the mmap_sem latency optimization, which
> >> looks like an oversight.
> >>
> >> That optimization is why the VM_FAULT_RETRY functionality was added to
> >> mm in the first place and is intended to be used when drivers expect a
> >> substantial sleep to avoid keeping the pretty globalish mmap_sem held
> >> while that sleep is taking place. We do exactly the same while waiting
> >> for move-fences (ttm_bo_vm_fault_idle) and other drivers that expect
> >> long waits in the fault handler do the same.
> > Hm, are we guaranteed that core mm will only call us once with
> > ALLOW_RETRY?
>
> Last time I looked in the implementation, yes. The ALLOW_RETRY was there
> to specifically
> allow making progress in the locking.
>
> >   Just to make sure that we're not live-locking here. I'd
> > also like to get rid of the wu_mutex, that just looks really strange
> > (and I thought it was to duct-tape over the inversion, not as an
> > optimization). If the livelock due to locking inversion is gone I have
> > no idea anymore why we even needs the wu_mutex.
>
> Yes, my interpretation of this is that wu_mutex definitely can be ditched.

Ok I'll respin and just do normal interruptible locks, keeping the
mmap_sem-less path. I think perfectly ok to leave the optimization in,
as long as we can remove the wu_mutex.

btw r-b/t-b on patch 1 from vmwgfx would be very much appreciated.
That one is the real trick in this series here I think.
-Daniel
-- 
Daniel Vetter
Software Engineer, Intel Corporation
+41 (0) 79 365 57 48 - http://blog.ffwll.ch
_______________________________________________
dri-devel mailing list
dri-devel@lists.freedesktop.org
https://lists.freedesktop.org/mailman/listinfo/dri-devel

[PATCH] drm/ttm: remove ttm_bo_wait_unreserved

[Daniel Vetter]

With nouveau fixed all ttm-using drives have the correct nesting of
mmap_sem vs dma_resv, and we can just lock the buffer.

Assuming I didn't screw up anything with my audit of course.

v2:
- Dont forget wu_mutex (Christian König)
- Keep the mmap_sem-less wait optimization (Thomas)
- Use _lock_interruptible to be good citizens (Thomas)

Reviewed-by: Christian König <christian.koenig@amd.com>
Signed-off-by: Daniel Vetter <daniel.vetter@intel.com>
Cc: Christian Koenig <christian.koenig@amd.com>
Cc: Huang Rui <ray.huang@amd.com>
Cc: Gerd Hoffmann <kraxel@redhat.com>
Cc: "VMware Graphics" <linux-graphics-maintainer@vmware.com>
Cc: Thomas Hellstrom <thellstrom@vmware.com>
---
 drivers/gpu/drm/ttm/ttm_bo.c      | 36 -------------------------------
 drivers/gpu/drm/ttm/ttm_bo_util.c |  1 -
 drivers/gpu/drm/ttm/ttm_bo_vm.c   | 18 +++++-----------
 include/drm/ttm/ttm_bo_api.h      |  4 ----
 4 files changed, 5 insertions(+), 54 deletions(-)

diff --git a/drivers/gpu/drm/ttm/ttm_bo.c b/drivers/gpu/drm/ttm/ttm_bo.c
index 20ff56f27aa4..d1ce5d315d5b 100644
--- a/drivers/gpu/drm/ttm/ttm_bo.c
+++ b/drivers/gpu/drm/ttm/ttm_bo.c
@@ -162,7 +162,6 @@ static void ttm_bo_release_list(struct kref *list_kref)
 	dma_fence_put(bo->moving);
 	if (!ttm_bo_uses_embedded_gem_object(bo))
 		dma_resv_fini(&bo->base._resv);
-	mutex_destroy(&bo->wu_mutex);
 	bo->destroy(bo);
 	ttm_mem_global_free(bdev->glob->mem_glob, acc_size);
 }
@@ -1319,7 +1318,6 @@ int ttm_bo_init_reserved(struct ttm_bo_device *bdev,
 	INIT_LIST_HEAD(&bo->ddestroy);
 	INIT_LIST_HEAD(&bo->swap);
 	INIT_LIST_HEAD(&bo->io_reserve_lru);
-	mutex_init(&bo->wu_mutex);
 	bo->bdev = bdev;
 	bo->type = type;
 	bo->num_pages = num_pages;
@@ -1954,37 +1952,3 @@ void ttm_bo_swapout_all(struct ttm_bo_device *bdev)
 		;
 }
 EXPORT_SYMBOL(ttm_bo_swapout_all);
-
-/**
- * ttm_bo_wait_unreserved - interruptible wait for a buffer object to become
- * unreserved
- *
- * @bo: Pointer to buffer
- */
-int ttm_bo_wait_unreserved(struct ttm_buffer_object *bo)
-{
-	int ret;
-
-	/*
-	 * In the absense of a wait_unlocked API,
-	 * Use the bo::wu_mutex to avoid triggering livelocks due to
-	 * concurrent use of this function. Note that this use of
-	 * bo::wu_mutex can go away if we change locking order to
-	 * mmap_sem -> bo::reserve.
-	 */
-	ret = mutex_lock_interruptible(&bo->wu_mutex);
-	if (unlikely(ret != 0))
-		return -ERESTARTSYS;
-	if (!dma_resv_is_locked(bo->base.resv))
-		goto out_unlock;
-	ret = dma_resv_lock_interruptible(bo->base.resv, NULL);
-	if (ret == -EINTR)
-		ret = -ERESTARTSYS;
-	if (unlikely(ret != 0))
-		goto out_unlock;
-	dma_resv_unlock(bo->base.resv);
-
-out_unlock:
-	mutex_unlock(&bo->wu_mutex);
-	return ret;
-}
diff --git a/drivers/gpu/drm/ttm/ttm_bo_util.c b/drivers/gpu/drm/ttm/ttm_bo_util.c
index fe81c565e7ef..82ea26a49959 100644
--- a/drivers/gpu/drm/ttm/ttm_bo_util.c
+++ b/drivers/gpu/drm/ttm/ttm_bo_util.c
@@ -508,7 +508,6 @@ static int ttm_buffer_object_transfer(struct ttm_buffer_object *bo,
 	INIT_LIST_HEAD(&fbo->base.lru);
 	INIT_LIST_HEAD(&fbo->base.swap);
 	INIT_LIST_HEAD(&fbo->base.io_reserve_lru);
-	mutex_init(&fbo->base.wu_mutex);
 	fbo->base.moving = NULL;
 	drm_vma_node_reset(&fbo->base.base.vma_node);
 	atomic_set(&fbo->base.cpu_writers, 0);
diff --git a/drivers/gpu/drm/ttm/ttm_bo_vm.c b/drivers/gpu/drm/ttm/ttm_bo_vm.c
index 76eedb963693..a61a35e57d1c 100644
--- a/drivers/gpu/drm/ttm/ttm_bo_vm.c
+++ b/drivers/gpu/drm/ttm/ttm_bo_vm.c
@@ -125,30 +125,22 @@ static vm_fault_t ttm_bo_vm_fault(struct vm_fault *vmf)
 		&bdev->man[bo->mem.mem_type];
 	struct vm_area_struct cvma;
 
-	/*
-	 * Work around locking order reversal in fault / nopfn
-	 * between mmap_sem and bo_reserve: Perform a trylock operation
-	 * for reserve, and if it fails, retry the fault after waiting
-	 * for the buffer to become unreserved.
-	 */
 	if (unlikely(!dma_resv_trylock(bo->base.resv))) {
 		if (vmf->flags & FAULT_FLAG_ALLOW_RETRY) {
 			if (!(vmf->flags & FAULT_FLAG_RETRY_NOWAIT)) {
 				ttm_bo_get(bo);
 				up_read(&vmf->vma->vm_mm->mmap_sem);
-				(void) ttm_bo_wait_unreserved(bo);
+				if (!dma_resv_lock_interruptible(bo->base.resv,
+								 NULL))
+					dma_resv_unlock(bo->base.resv);
 				ttm_bo_put(bo);
 			}
 
 			return VM_FAULT_RETRY;
 		}
 
-		/*
-		 * If we'd want to change locking order to
-		 * mmap_sem -> bo::reserve, we'd use a blocking reserve here
-		 * instead of retrying the fault...
-		 */
-		return VM_FAULT_NOPAGE;
+		if (dma_resv_lock_interruptible(bo->base.resv, NULL))
+			return VM_FAULT_NOPAGE;
 	}
 
 	/*
diff --git a/include/drm/ttm/ttm_bo_api.h b/include/drm/ttm/ttm_bo_api.h
index 43c4929a2171..21c7d0d28757 100644
--- a/include/drm/ttm/ttm_bo_api.h
+++ b/include/drm/ttm/ttm_bo_api.h
@@ -155,7 +155,6 @@ struct ttm_tt;
  * @offset: The current GPU offset, which can have different meanings
  * depending on the memory type. For SYSTEM type memory, it should be 0.
  * @cur_placement: Hint of current placement.
- * @wu_mutex: Wait unreserved mutex.
  *
  * Base class for TTM buffer object, that deals with data placement and CPU
  * mappings. GPU mappings are really up to the driver, but for simpler GPUs
@@ -229,8 +228,6 @@ struct ttm_buffer_object {
 	uint64_t offset; /* GPU address space is independent of CPU word size */
 
 	struct sg_table *sg;
-
-	struct mutex wu_mutex;
 };
 
 /**
@@ -765,7 +762,6 @@ ssize_t ttm_bo_io(struct ttm_bo_device *bdev, struct file *filp,
 int ttm_bo_swapout(struct ttm_bo_global *glob,
 			struct ttm_operation_ctx *ctx);
 void ttm_bo_swapout_all(struct ttm_bo_device *bdev);
-int ttm_bo_wait_unreserved(struct ttm_buffer_object *bo);
 
 /**
  * ttm_bo_uses_embedded_gem_object - check if the given bo uses the
-- 
2.23.0.rc1

_______________________________________________
dri-devel mailing list
dri-devel@lists.freedesktop.org
https://lists.freedesktop.org/mailman/listinfo/dri-devel

Re: [PATCH 3/3] drm/ttm: remove ttm_bo_wait_unreserved

[Thomas Hellström (VMware)]

On 8/21/19 5:22 PM, Daniel Vetter wrote:
> On Wed, Aug 21, 2019 at 5:19 PM Thomas Hellström (VMware)
> <thomas_os@shipmail.org> wrote:
>> On 8/21/19 5:14 PM, Daniel Vetter wrote:
>>> On Wed, Aug 21, 2019 at 5:03 PM Thomas Hellström (VMware)
>>> <thomas_os@shipmail.org> wrote:
>>>> On 8/21/19 4:47 PM, Daniel Vetter wrote:
>>>>> On Wed, Aug 21, 2019 at 4:27 PM Thomas Hellström (VMware)
>>>>> <thomas_os@shipmail.org> wrote:
>>>>>> On 8/21/19 4:09 PM, Daniel Vetter wrote:
>>>>>>> On Wed, Aug 21, 2019 at 2:47 PM Thomas Hellström (VMware)
>>>>>>> <thomas_os@shipmail.org> wrote:
>>>>>>>> On 8/21/19 2:40 PM, Thomas Hellström (VMware) wrote:
>>>>>>>>> On 8/20/19 4:53 PM, Daniel Vetter wrote:
>>>>>>>>>> With nouveau fixed all ttm-using drives have the correct nesting of
>>>>>>>>>> mmap_sem vs dma_resv, and we can just lock the buffer.
>>>>>>>>>>
>>>>>>>>>> Assuming I didn't screw up anything with my audit of course.
>>>>>>>>>>
>>>>>>>>>> Signed-off-by: Daniel Vetter <daniel.vetter@intel.com>
>>>>>>>>>> Cc: Christian Koenig <christian.koenig@amd.com>
>>>>>>>>>> Cc: Huang Rui <ray.huang@amd.com>
>>>>>>>>>> Cc: Gerd Hoffmann <kraxel@redhat.com>
>>>>>>>>>> Cc: "VMware Graphics" <linux-graphics-maintainer@vmware.com>
>>>>>>>>>> Cc: Thomas Hellstrom <thellstrom@vmware.com>
>>>>>>>>>> ---
>>>>>>>>>>       drivers/gpu/drm/ttm/ttm_bo.c    | 34 ---------------------------------
>>>>>>>>>>       drivers/gpu/drm/ttm/ttm_bo_vm.c | 26 +------------------------
>>>>>>>>>>       include/drm/ttm/ttm_bo_api.h    |  1 -
>>>>>>>>>>       3 files changed, 1 insertion(+), 60 deletions(-)
>>>>>>>>>>
>>>>>>>>>> diff --git a/drivers/gpu/drm/ttm/ttm_bo.c b/drivers/gpu/drm/ttm/ttm_bo.c
>>>>>>>>>> index 20ff56f27aa4..a952dd624b06 100644
>>>>>>>>>> --- a/drivers/gpu/drm/ttm/ttm_bo.c
>>>>>>>>>> +++ b/drivers/gpu/drm/ttm/ttm_bo.c
>>>>>>>>>> @@ -1954,37 +1954,3 @@ void ttm_bo_swapout_all(struct ttm_bo_device
>>>>>>>>>> *bdev)
>>>>>>>>>>               ;
>>>>>>>>>>       }
>>>>>>>>>>       EXPORT_SYMBOL(ttm_bo_swapout_all);
>>>>>>>>>> -
>>>>>>>>>> -/**
>>>>>>>>>> - * ttm_bo_wait_unreserved - interruptible wait for a buffer object
>>>>>>>>>> to become
>>>>>>>>>> - * unreserved
>>>>>>>>>> - *
>>>>>>>>>> - * @bo: Pointer to buffer
>>>>>>>>>> - */
>>>>>>>>>> -int ttm_bo_wait_unreserved(struct ttm_buffer_object *bo)
>>>>>>>>>> -{
>>>>>>>>>> -    int ret;
>>>>>>>>>> -
>>>>>>>>>> -    /*
>>>>>>>>>> -     * In the absense of a wait_unlocked API,
>>>>>>>>>> -     * Use the bo::wu_mutex to avoid triggering livelocks due to
>>>>>>>>>> -     * concurrent use of this function. Note that this use of
>>>>>>>>>> -     * bo::wu_mutex can go away if we change locking order to
>>>>>>>>>> -     * mmap_sem -> bo::reserve.
>>>>>>>>>> -     */
>>>>>>>>>> -    ret = mutex_lock_interruptible(&bo->wu_mutex);
>>>>>>>>>> -    if (unlikely(ret != 0))
>>>>>>>>>> -        return -ERESTARTSYS;
>>>>>>>>>> -    if (!dma_resv_is_locked(bo->base.resv))
>>>>>>>>>> -        goto out_unlock;
>>>>>>>>>> -    ret = dma_resv_lock_interruptible(bo->base.resv, NULL);
>>>>>>>>>> -    if (ret == -EINTR)
>>>>>>>>>> -        ret = -ERESTARTSYS;
>>>>>>>>>> -    if (unlikely(ret != 0))
>>>>>>>>>> -        goto out_unlock;
>>>>>>>>>> -    dma_resv_unlock(bo->base.resv);
>>>>>>>>>> -
>>>>>>>>>> -out_unlock:
>>>>>>>>>> -    mutex_unlock(&bo->wu_mutex);
>>>>>>>>>> -    return ret;
>>>>>>>>>> -}
>>>>>>>>>> diff --git a/drivers/gpu/drm/ttm/ttm_bo_vm.c
>>>>>>>>>> b/drivers/gpu/drm/ttm/ttm_bo_vm.c
>>>>>>>>>> index 76eedb963693..505e1787aeea 100644
>>>>>>>>>> --- a/drivers/gpu/drm/ttm/ttm_bo_vm.c
>>>>>>>>>> +++ b/drivers/gpu/drm/ttm/ttm_bo_vm.c
>>>>>>>>>> @@ -125,31 +125,7 @@ static vm_fault_t ttm_bo_vm_fault(struct
>>>>>>>>>> vm_fault *vmf)
>>>>>>>>>>               &bdev->man[bo->mem.mem_type];
>>>>>>>>>>           struct vm_area_struct cvma;
>>>>>>>>>>       -    /*
>>>>>>>>>> -     * Work around locking order reversal in fault / nopfn
>>>>>>>>>> -     * between mmap_sem and bo_reserve: Perform a trylock operation
>>>>>>>>>> -     * for reserve, and if it fails, retry the fault after waiting
>>>>>>>>>> -     * for the buffer to become unreserved.
>>>>>>>>>> -     */
>>>>>>>>>> -    if (unlikely(!dma_resv_trylock(bo->base.resv))) {
>>>>>>>>>> -        if (vmf->flags & FAULT_FLAG_ALLOW_RETRY) {
>>>>>>>>>> -            if (!(vmf->flags & FAULT_FLAG_RETRY_NOWAIT)) {
>>>>>>>>>> -                ttm_bo_get(bo);
>>>>>>>>>> - up_read(&vmf->vma->vm_mm->mmap_sem);
>>>>>>>>>> -                (void) ttm_bo_wait_unreserved(bo);
>>>>>>>>>> -                ttm_bo_put(bo);
>>>>>>>>>> -            }
>>>>>>>>>> -
>>>>>>>>>> -            return VM_FAULT_RETRY;
>>>>>>>>>> -        }
>>>>>>>>>> -
>>>>>>>>>> -        /*
>>>>>>>>>> -         * If we'd want to change locking order to
>>>>>>>>>> -         * mmap_sem -> bo::reserve, we'd use a blocking reserve here
>>>>>>>>>> -         * instead of retrying the fault...
>>>>>>>>>> -         */
>>>>>>>>> I think you should justify why the above code is removed, since the
>>>>>>>>> comments actually outlines what to do if we change locking order.
>>>>>>>>>
>>>>>>>>> The code that's removed above is not for adjusting locking orders but
>>>>>>>>> to decrease the mm latency by releasing the mmap_sem while waiting for
>>>>>>>>> bo reserve which in turn might be waiting for GPU. At a minimum we
>>>>>>>>> should have a separate patch with justification.
>>>>>>>>>
>>>>>>>>> Note that the caller here ensures locking progress by adjusting the
>>>>>>>>> RETRY flags after a retry.
>>>>>>> That would be patches 1&2 in this series.
>>>>>>>
>>>>>> Hmm? Those seem to touch only dma-buf and nouveau not ttm?  I mean this
>>>>>> patch should look along the lines of (based on an older tree) to
>>>>>> implement the new locking-order mmap_sem->reservation,
>>>>> Only nouveau was breaking was doing copy_*_user or get_user_pages
>>>>> while holding dma_resv locks, no one else. So nothing else needed to
>>>>> be changed. But patch 1 contains the full audit. I might have missed
>>>>> something.
>>>>>
>>>>>> but to keep the mm latency optimization using the RETRY functionality:
>>>>> Still no idea why this is needed? All the comments here and the code
>>>>> and history seem like they've been about the mmap_sem vs dma_resv
>>>>> inversion between driver ioctls and fault handling here. Once that's
>>>>> officially fixed there's no reason to play games here and retry loops
>>>>> - previously that was necessary because the old ttm_bo_vm_fault had a
>>>>> busy spin and that's definitely not nice. If it's needed I think it
>>>>> should be a second patch on top, to keep this all clear. I had to
>>>>> audit an enormous amount of code, I'd like to make sure I didn't miss
>>>>> anything before we start to make this super fancy again. Further
>>>>> patches on top is obviously all fine with me.
>>>>> -Daniel
>>>> Yes, but there are two different things you remove here. One is the
>>>> workaround for the locking reversal, which is obviously correct.
>>>>
>>>> One is TTM's implementation of the mmap_sem latency optimization, which
>>>> looks like an oversight.
>>>>
>>>> That optimization is why the VM_FAULT_RETRY functionality was added to
>>>> mm in the first place and is intended to be used when drivers expect a
>>>> substantial sleep to avoid keeping the pretty globalish mmap_sem held
>>>> while that sleep is taking place. We do exactly the same while waiting
>>>> for move-fences (ttm_bo_vm_fault_idle) and other drivers that expect
>>>> long waits in the fault handler do the same.
>>> Hm, are we guaranteed that core mm will only call us once with
>>> ALLOW_RETRY?
>> Last time I looked in the implementation, yes. The ALLOW_RETRY was there
>> to specifically
>> allow making progress in the locking.
>>
>>>    Just to make sure that we're not live-locking here. I'd
>>> also like to get rid of the wu_mutex, that just looks really strange
>>> (and I thought it was to duct-tape over the inversion, not as an
>>> optimization). If the livelock due to locking inversion is gone I have
>>> no idea anymore why we even needs the wu_mutex.
>> Yes, my interpretation of this is that wu_mutex definitely can be ditched.
> Ok I'll respin and just do normal interruptible locks, keeping the
> mmap_sem-less path. I think perfectly ok to leave the optimization in,
> as long as we can remove the wu_mutex.
>
> btw r-b/t-b on patch 1 from vmwgfx would be very much appreciated.
> That one is the real trick in this series here I think.

Thanks!

I'll look into patch 1 as well.

/Thomas



> -Daniel


_______________________________________________
Intel-gfx mailing list
Intel-gfx@lists.freedesktop.org
https://lists.freedesktop.org/mailman/listinfo/intel-gfx

Re: [PATCH] drm/ttm: remove ttm_bo_wait_unreserved

[Thomas Hellström (VMware)]

On 8/21/19 5:33 PM, Daniel Vetter wrote:
> With nouveau fixed all ttm-using drives have the correct nesting of
> mmap_sem vs dma_resv, and we can just lock the buffer.
>
> Assuming I didn't screw up anything with my audit of course.
>
> v2:
> - Dont forget wu_mutex (Christian König)
> - Keep the mmap_sem-less wait optimization (Thomas)
> - Use _lock_interruptible to be good citizens (Thomas)
>
> Reviewed-by: Christian König <christian.koenig@amd.com>
> Signed-off-by: Daniel Vetter <daniel.vetter@intel.com>
> Cc: Christian Koenig <christian.koenig@amd.com>
> Cc: Huang Rui <ray.huang@amd.com>
> Cc: Gerd Hoffmann <kraxel@redhat.com>
> Cc: "VMware Graphics" <linux-graphics-maintainer@vmware.com>
> Cc: Thomas Hellstrom <thellstrom@vmware.com>
> ---
>   drivers/gpu/drm/ttm/ttm_bo.c      | 36 -------------------------------
>   drivers/gpu/drm/ttm/ttm_bo_util.c |  1 -
>   drivers/gpu/drm/ttm/ttm_bo_vm.c   | 18 +++++-----------
>   include/drm/ttm/ttm_bo_api.h      |  4 ----
>   4 files changed, 5 insertions(+), 54 deletions(-)
>
> diff --git a/drivers/gpu/drm/ttm/ttm_bo.c b/drivers/gpu/drm/ttm/ttm_bo.c
> index 20ff56f27aa4..d1ce5d315d5b 100644
> --- a/drivers/gpu/drm/ttm/ttm_bo.c
> +++ b/drivers/gpu/drm/ttm/ttm_bo.c
> @@ -162,7 +162,6 @@ static void ttm_bo_release_list(struct kref *list_kref)
>   	dma_fence_put(bo->moving);
>   	if (!ttm_bo_uses_embedded_gem_object(bo))
>   		dma_resv_fini(&bo->base._resv);
> -	mutex_destroy(&bo->wu_mutex);
>   	bo->destroy(bo);
>   	ttm_mem_global_free(bdev->glob->mem_glob, acc_size);
>   }
> @@ -1319,7 +1318,6 @@ int ttm_bo_init_reserved(struct ttm_bo_device *bdev,
>   	INIT_LIST_HEAD(&bo->ddestroy);
>   	INIT_LIST_HEAD(&bo->swap);
>   	INIT_LIST_HEAD(&bo->io_reserve_lru);
> -	mutex_init(&bo->wu_mutex);
>   	bo->bdev = bdev;
>   	bo->type = type;
>   	bo->num_pages = num_pages;
> @@ -1954,37 +1952,3 @@ void ttm_bo_swapout_all(struct ttm_bo_device *bdev)
>   		;
>   }
>   EXPORT_SYMBOL(ttm_bo_swapout_all);
> -
> -/**
> - * ttm_bo_wait_unreserved - interruptible wait for a buffer object to become
> - * unreserved
> - *
> - * @bo: Pointer to buffer
> - */
> -int ttm_bo_wait_unreserved(struct ttm_buffer_object *bo)
> -{
> -	int ret;
> -
> -	/*
> -	 * In the absense of a wait_unlocked API,
> -	 * Use the bo::wu_mutex to avoid triggering livelocks due to
> -	 * concurrent use of this function. Note that this use of
> -	 * bo::wu_mutex can go away if we change locking order to
> -	 * mmap_sem -> bo::reserve.
> -	 */
> -	ret = mutex_lock_interruptible(&bo->wu_mutex);
> -	if (unlikely(ret != 0))
> -		return -ERESTARTSYS;
> -	if (!dma_resv_is_locked(bo->base.resv))
> -		goto out_unlock;
> -	ret = dma_resv_lock_interruptible(bo->base.resv, NULL);
> -	if (ret == -EINTR)
> -		ret = -ERESTARTSYS;
> -	if (unlikely(ret != 0))
> -		goto out_unlock;
> -	dma_resv_unlock(bo->base.resv);
> -
> -out_unlock:
> -	mutex_unlock(&bo->wu_mutex);
> -	return ret;
> -}
> diff --git a/drivers/gpu/drm/ttm/ttm_bo_util.c b/drivers/gpu/drm/ttm/ttm_bo_util.c
> index fe81c565e7ef..82ea26a49959 100644
> --- a/drivers/gpu/drm/ttm/ttm_bo_util.c
> +++ b/drivers/gpu/drm/ttm/ttm_bo_util.c
> @@ -508,7 +508,6 @@ static int ttm_buffer_object_transfer(struct ttm_buffer_object *bo,
>   	INIT_LIST_HEAD(&fbo->base.lru);
>   	INIT_LIST_HEAD(&fbo->base.swap);
>   	INIT_LIST_HEAD(&fbo->base.io_reserve_lru);
> -	mutex_init(&fbo->base.wu_mutex);
>   	fbo->base.moving = NULL;
>   	drm_vma_node_reset(&fbo->base.base.vma_node);
>   	atomic_set(&fbo->base.cpu_writers, 0);
> diff --git a/drivers/gpu/drm/ttm/ttm_bo_vm.c b/drivers/gpu/drm/ttm/ttm_bo_vm.c
> index 76eedb963693..a61a35e57d1c 100644
> --- a/drivers/gpu/drm/ttm/ttm_bo_vm.c
> +++ b/drivers/gpu/drm/ttm/ttm_bo_vm.c
> @@ -125,30 +125,22 @@ static vm_fault_t ttm_bo_vm_fault(struct vm_fault *vmf)
>   		&bdev->man[bo->mem.mem_type];
>   	struct vm_area_struct cvma;
>   
> -	/*
> -	 * Work around locking order reversal in fault / nopfn
> -	 * between mmap_sem and bo_reserve: Perform a trylock operation
> -	 * for reserve, and if it fails, retry the fault after waiting
> -	 * for the buffer to become unreserved.
> -	 */
>   	if (unlikely(!dma_resv_trylock(bo->base.resv))) {
>   		if (vmf->flags & FAULT_FLAG_ALLOW_RETRY) {
>   			if (!(vmf->flags & FAULT_FLAG_RETRY_NOWAIT)) {
>   				ttm_bo_get(bo);
>   				up_read(&vmf->vma->vm_mm->mmap_sem);
> -				(void) ttm_bo_wait_unreserved(bo);
> +				if (!dma_resv_lock_interruptible(bo->base.resv,
> +								 NULL))
> +					dma_resv_unlock(bo->base.resv);
>   				ttm_bo_put(bo);
>   			}
>   
>   			return VM_FAULT_RETRY;
>   		}
>   
> -		/*
> -		 * If we'd want to change locking order to
> -		 * mmap_sem -> bo::reserve, we'd use a blocking reserve here
> -		 * instead of retrying the fault...
> -		 */
> -		return VM_FAULT_NOPAGE;
> +		if (dma_resv_lock_interruptible(bo->base.resv, NULL))
> +			return VM_FAULT_NOPAGE;
>   	}
>   
>   	/*
> diff --git a/include/drm/ttm/ttm_bo_api.h b/include/drm/ttm/ttm_bo_api.h
> index 43c4929a2171..21c7d0d28757 100644
> --- a/include/drm/ttm/ttm_bo_api.h
> +++ b/include/drm/ttm/ttm_bo_api.h
> @@ -155,7 +155,6 @@ struct ttm_tt;
>    * @offset: The current GPU offset, which can have different meanings
>    * depending on the memory type. For SYSTEM type memory, it should be 0.
>    * @cur_placement: Hint of current placement.
> - * @wu_mutex: Wait unreserved mutex.
>    *
>    * Base class for TTM buffer object, that deals with data placement and CPU
>    * mappings. GPU mappings are really up to the driver, but for simpler GPUs
> @@ -229,8 +228,6 @@ struct ttm_buffer_object {
>   	uint64_t offset; /* GPU address space is independent of CPU word size */
>   
>   	struct sg_table *sg;
> -
> -	struct mutex wu_mutex;
>   };
>   
>   /**
> @@ -765,7 +762,6 @@ ssize_t ttm_bo_io(struct ttm_bo_device *bdev, struct file *filp,
>   int ttm_bo_swapout(struct ttm_bo_global *glob,
>   			struct ttm_operation_ctx *ctx);
>   void ttm_bo_swapout_all(struct ttm_bo_device *bdev);
> -int ttm_bo_wait_unreserved(struct ttm_buffer_object *bo);
>   
>   /**
>    * ttm_bo_uses_embedded_gem_object - check if the given bo uses the

Thanks. LGTM.

Reviewed-by: Thomas Hellström <thellstrom@vmware.com>


_______________________________________________
dri-devel mailing list
dri-devel@lists.freedesktop.org
https://lists.freedesktop.org/mailman/listinfo/dri-devel

Re: [PATCH 1/3] dma_resv: prime lockdep annotations

[Daniel Vetter]

On Tue, Aug 20, 2019 at 02:56:36PM +0000, Koenig, Christian wrote:
> Am 20.08.19 um 16:53 schrieb Daniel Vetter:
> > Full audit of everyone:
> >
> > - i915, radeon, amdgpu should be clean per their maintainers.
> >
> > - vram helpers should be fine, they don't do command submission, so
> >    really no business holding struct_mutex while doing copy_*_user. But
> >    I haven't checked them all.
> >
> > - panfrost seems to dma_resv_lock only in panfrost_job_push, which
> >    looks clean.
> >
> > - v3d holds dma_resv locks in the tail of its v3d_submit_cl_ioctl(),
> >    copying from/to userspace happens all in v3d_lookup_bos which is
> >    outside of the critical section.
> >
> > - vmwgfx has a bunch of ioctls that do their own copy_*_user:
> >    - vmw_execbuf_process: First this does some copies in
> >      vmw_execbuf_cmdbuf() and also in the vmw_execbuf_process() itself.
> >      Then comes the usual ttm reserve/validate sequence, then actual
> >      submission/fencing, then unreserving, and finally some more
> >      copy_to_user in vmw_execbuf_copy_fence_user. Glossing over tons of
> >      details, but looks all safe.
> >    - vmw_fence_event_ioctl: No ttm_reserve/dma_resv_lock anywhere to be
> >      seen, seems to only create a fence and copy it out.
> >    - a pile of smaller ioctl in vmwgfx_ioctl.c, no reservations to be
> >      found there.
> >    Summary: vmwgfx seems to be fine too.
> >
> > - virtio: There's virtio_gpu_execbuffer_ioctl, which does all the
> >    copying from userspace before even looking up objects through their
> >    handles, so safe. Plus the getparam/getcaps ioctl, also both safe.
> >
> > - qxl only has qxl_execbuffer_ioctl, which calls into
> >    qxl_process_single_command. There's a lovely comment before the
> >    __copy_from_user_inatomic that the slowpath should be copied from
> >    i915, but I guess that never happened. Try not to be unlucky and get
> >    your CS data evicted between when it's written and the kernel tries
> >    to read it. The only other copy_from_user is for relocs, but those
> >    are done before qxl_release_reserve_list(), which seems to be the
> >    only thing reserving buffers (in the ttm/dma_resv sense) in that
> >    code. So looks safe.
> >
> > - A debugfs file in nouveau_debugfs_pstate_set() and the usif ioctl in
> >    usif_ioctl() look safe. nouveau_gem_ioctl_pushbuf() otoh breaks this
> >    everywhere and needs to be fixed up.
> >
> > Cc: Alex Deucher <alexander.deucher@amd.com>
> > Cc: Christian König <christian.koenig@amd.com>
> > Cc: Chris Wilson <chris@chris-wilson.co.uk>
> > Cc: Thomas Zimmermann <tzimmermann@suse.de>
> > Cc: Rob Herring <robh@kernel.org>
> > Cc: Tomeu Vizoso <tomeu.vizoso@collabora.com>
> > Cc: Eric Anholt <eric@anholt.net>
> > Cc: Dave Airlie <airlied@redhat.com>
> > Cc: Gerd Hoffmann <kraxel@redhat.com>
> > Cc: Ben Skeggs <bskeggs@redhat.com>
> > Cc: "VMware Graphics" <linux-graphics-maintainer@vmware.com>
> > Cc: Thomas Hellstrom <thellstrom@vmware.com>
> > Signed-off-by: Daniel Vetter <daniel.vetter@intel.com>
> 
> Reviewed-by: Christian König <christian.koenig@amd.com>

Does this r-b just apply to radeon/amdgpu or for the full audit?
-Daniel

> 
> > ---
> >   drivers/dma-buf/dma-resv.c | 12 ++++++++++++
> >   1 file changed, 12 insertions(+)
> >
> > diff --git a/drivers/dma-buf/dma-resv.c b/drivers/dma-buf/dma-resv.c
> > index 42a8f3f11681..3edca10d3faf 100644
> > --- a/drivers/dma-buf/dma-resv.c
> > +++ b/drivers/dma-buf/dma-resv.c
> > @@ -34,6 +34,7 @@
> >   
> >   #include <linux/dma-resv.h>
> >   #include <linux/export.h>
> > +#include <linux/sched/mm.h>
> >   
> >   /**
> >    * DOC: Reservation Object Overview
> > @@ -107,6 +108,17 @@ void dma_resv_init(struct dma_resv *obj)
> >   			&reservation_seqcount_class);
> >   	RCU_INIT_POINTER(obj->fence, NULL);
> >   	RCU_INIT_POINTER(obj->fence_excl, NULL);
> > +
> > +	if (IS_ENABLED(CONFIG_LOCKDEP)) {
> > +		if (current->mm)
> > +			down_read(&current->mm->mmap_sem);
> > +		ww_mutex_lock(&obj->lock, NULL);
> > +		fs_reclaim_acquire(GFP_KERNEL);
> > +		fs_reclaim_release(GFP_KERNEL);
> > +		ww_mutex_unlock(&obj->lock);
> > +		if (current->mm)
> > +			up_read(&current->mm->mmap_sem);
> > +	}
> >   }
> >   EXPORT_SYMBOL(dma_resv_init);
> >   
> 

-- 
Daniel Vetter
Software Engineer, Intel Corporation
http://blog.ffwll.ch
_______________________________________________
Intel-gfx mailing list
Intel-gfx@lists.freedesktop.org
https://lists.freedesktop.org/mailman/listinfo/intel-gfx

Re: [PATCH 1/3] dma_resv: prime lockdep annotations

[Thomas Hellström (VMware)]

On 8/20/19 4:53 PM, Daniel Vetter wrote:
> Full audit of everyone:
>
> - i915, radeon, amdgpu should be clean per their maintainers.
>
> - vram helpers should be fine, they don't do command submission, so
>    really no business holding struct_mutex while doing copy_*_user. But
>    I haven't checked them all.
>
> - panfrost seems to dma_resv_lock only in panfrost_job_push, which
>    looks clean.
>
> - v3d holds dma_resv locks in the tail of its v3d_submit_cl_ioctl(),
>    copying from/to userspace happens all in v3d_lookup_bos which is
>    outside of the critical section.
>
> - vmwgfx has a bunch of ioctls that do their own copy_*_user:
>    - vmw_execbuf_process: First this does some copies in
>      vmw_execbuf_cmdbuf() and also in the vmw_execbuf_process() itself.
>      Then comes the usual ttm reserve/validate sequence, then actual
>      submission/fencing, then unreserving, and finally some more
>      copy_to_user in vmw_execbuf_copy_fence_user. Glossing over tons of
>      details, but looks all safe.
>    - vmw_fence_event_ioctl: No ttm_reserve/dma_resv_lock anywhere to be
>      seen, seems to only create a fence and copy it out.
>    - a pile of smaller ioctl in vmwgfx_ioctl.c, no reservations to be
>      found there.
>    Summary: vmwgfx seems to be fine too.
>
> - virtio: There's virtio_gpu_execbuffer_ioctl, which does all the
>    copying from userspace before even looking up objects through their
>    handles, so safe. Plus the getparam/getcaps ioctl, also both safe.
>
> - qxl only has qxl_execbuffer_ioctl, which calls into
>    qxl_process_single_command. There's a lovely comment before the
>    __copy_from_user_inatomic that the slowpath should be copied from
>    i915, but I guess that never happened. Try not to be unlucky and get
>    your CS data evicted between when it's written and the kernel tries
>    to read it. The only other copy_from_user is for relocs, but those
>    are done before qxl_release_reserve_list(), which seems to be the
>    only thing reserving buffers (in the ttm/dma_resv sense) in that
>    code. So looks safe.
>
> - A debugfs file in nouveau_debugfs_pstate_set() and the usif ioctl in
>    usif_ioctl() look safe. nouveau_gem_ioctl_pushbuf() otoh breaks this
>    everywhere and needs to be fixed up.
>
> Cc: Alex Deucher <alexander.deucher@amd.com>
> Cc: Christian König <christian.koenig@amd.com>
> Cc: Chris Wilson <chris@chris-wilson.co.uk>
> Cc: Thomas Zimmermann <tzimmermann@suse.de>
> Cc: Rob Herring <robh@kernel.org>
> Cc: Tomeu Vizoso <tomeu.vizoso@collabora.com>
> Cc: Eric Anholt <eric@anholt.net>
> Cc: Dave Airlie <airlied@redhat.com>
> Cc: Gerd Hoffmann <kraxel@redhat.com>
> Cc: Ben Skeggs <bskeggs@redhat.com>
> Cc: "VMware Graphics" <linux-graphics-maintainer@vmware.com>
> Cc: Thomas Hellstrom <thellstrom@vmware.com>
> Signed-off-by: Daniel Vetter <daniel.vetter@intel.com>
> ---
>   drivers/dma-buf/dma-resv.c | 12 ++++++++++++
>   1 file changed, 12 insertions(+)
>
> diff --git a/drivers/dma-buf/dma-resv.c b/drivers/dma-buf/dma-resv.c
> index 42a8f3f11681..3edca10d3faf 100644
> --- a/drivers/dma-buf/dma-resv.c
> +++ b/drivers/dma-buf/dma-resv.c
> @@ -34,6 +34,7 @@
>   
>   #include <linux/dma-resv.h>
>   #include <linux/export.h>
> +#include <linux/sched/mm.h>
>   
>   /**
>    * DOC: Reservation Object Overview
> @@ -107,6 +108,17 @@ void dma_resv_init(struct dma_resv *obj)
>   			&reservation_seqcount_class);
>   	RCU_INIT_POINTER(obj->fence, NULL);
>   	RCU_INIT_POINTER(obj->fence_excl, NULL);
> +
> +	if (IS_ENABLED(CONFIG_LOCKDEP)) {
> +		if (current->mm)
> +			down_read(&current->mm->mmap_sem);
> +		ww_mutex_lock(&obj->lock, NULL);
> +		fs_reclaim_acquire(GFP_KERNEL);
> +		fs_reclaim_release(GFP_KERNEL);
> +		ww_mutex_unlock(&obj->lock);
> +		if (current->mm)
> +			up_read(&current->mm->mmap_sem);
> +	}
>   }
>   EXPORT_SYMBOL(dma_resv_init);
>   

I assume if this would have been easily done and maintainable using only 
lockdep annotation instead of actually acquiring the locks, that would 
have been done?

Otherwise LGTM.

Reviewed-by: Thomas Hellström <thellstrom@vmware.com>

Will test this and let you know if it trips on vmwgfx, but it really 
shouldn't.

/Thomas

_______________________________________________
Intel-gfx mailing list
Intel-gfx@lists.freedesktop.org
https://lists.freedesktop.org/mailman/listinfo/intel-gfx

✗ Fi.CI.CHECKPATCH: warning for RFC/T: dma_resv vs. mmap_sem (rev2)

[Patchwork]

== Series Details ==

Series: RFC/T: dma_resv vs. mmap_sem (rev2)
URL   : https://patchwork.freedesktop.org/series/65488/
State : warning

== Summary ==

$ dim checkpatch origin/drm-tip
3166313498da dma_resv: prime lockdep annotations
-:65: WARNING:BAD_SIGN_OFF: email address '"VMware Graphics" <linux-graphics-maintainer@vmware.com>' might be better as 'VMware Graphics <linux-graphics-maintainer@vmware.com>'
#65: 
Cc: "VMware Graphics" <linux-graphics-maintainer@vmware.com>

-:99: WARNING:NO_AUTHOR_SIGN_OFF: Missing Signed-off-by: line by nominal patch author 'Daniel Vetter <daniel.vetter@ffwll.ch>'

total: 0 errors, 2 warnings, 0 checks, 24 lines checked
7c35577035f8 drm/nouveau: slowpath for pushbuf ioctl
-:153: WARNING:NO_AUTHOR_SIGN_OFF: Missing Signed-off-by: line by nominal patch author 'Daniel Vetter <daniel.vetter@ffwll.ch>'

total: 0 errors, 1 warnings, 0 checks, 122 lines checked
e00626825d81 drm/ttm: remove ttm_bo_wait_unreserved
-:24: WARNING:BAD_SIGN_OFF: email address '"VMware Graphics" <linux-graphics-maintainer@vmware.com>' might be better as 'VMware Graphics <linux-graphics-maintainer@vmware.com>'
#24: 
Cc: "VMware Graphics" <linux-graphics-maintainer@vmware.com>

-:165: WARNING:NO_AUTHOR_SIGN_OFF: Missing Signed-off-by: line by nominal patch author 'Daniel Vetter <daniel.vetter@ffwll.ch>'

total: 0 errors, 2 warnings, 0 checks, 81 lines checked

_______________________________________________
Intel-gfx mailing list
Intel-gfx@lists.freedesktop.org
https://lists.freedesktop.org/mailman/listinfo/intel-gfx

Re: [PATCH 1/3] dma_resv: prime lockdep annotations

[Daniel Vetter]

On Wed, Aug 21, 2019 at 05:54:27PM +0200, Thomas Hellström (VMware) wrote:
> On 8/20/19 4:53 PM, Daniel Vetter wrote:
> > Full audit of everyone:
> > 
> > - i915, radeon, amdgpu should be clean per their maintainers.
> > 
> > - vram helpers should be fine, they don't do command submission, so
> >    really no business holding struct_mutex while doing copy_*_user. But
> >    I haven't checked them all.
> > 
> > - panfrost seems to dma_resv_lock only in panfrost_job_push, which
> >    looks clean.
> > 
> > - v3d holds dma_resv locks in the tail of its v3d_submit_cl_ioctl(),
> >    copying from/to userspace happens all in v3d_lookup_bos which is
> >    outside of the critical section.
> > 
> > - vmwgfx has a bunch of ioctls that do their own copy_*_user:
> >    - vmw_execbuf_process: First this does some copies in
> >      vmw_execbuf_cmdbuf() and also in the vmw_execbuf_process() itself.
> >      Then comes the usual ttm reserve/validate sequence, then actual
> >      submission/fencing, then unreserving, and finally some more
> >      copy_to_user in vmw_execbuf_copy_fence_user. Glossing over tons of
> >      details, but looks all safe.
> >    - vmw_fence_event_ioctl: No ttm_reserve/dma_resv_lock anywhere to be
> >      seen, seems to only create a fence and copy it out.
> >    - a pile of smaller ioctl in vmwgfx_ioctl.c, no reservations to be
> >      found there.
> >    Summary: vmwgfx seems to be fine too.
> > 
> > - virtio: There's virtio_gpu_execbuffer_ioctl, which does all the
> >    copying from userspace before even looking up objects through their
> >    handles, so safe. Plus the getparam/getcaps ioctl, also both safe.
> > 
> > - qxl only has qxl_execbuffer_ioctl, which calls into
> >    qxl_process_single_command. There's a lovely comment before the
> >    __copy_from_user_inatomic that the slowpath should be copied from
> >    i915, but I guess that never happened. Try not to be unlucky and get
> >    your CS data evicted between when it's written and the kernel tries
> >    to read it. The only other copy_from_user is for relocs, but those
> >    are done before qxl_release_reserve_list(), which seems to be the
> >    only thing reserving buffers (in the ttm/dma_resv sense) in that
> >    code. So looks safe.
> > 
> > - A debugfs file in nouveau_debugfs_pstate_set() and the usif ioctl in
> >    usif_ioctl() look safe. nouveau_gem_ioctl_pushbuf() otoh breaks this
> >    everywhere and needs to be fixed up.
> > 
> > Cc: Alex Deucher <alexander.deucher@amd.com>
> > Cc: Christian König <christian.koenig@amd.com>
> > Cc: Chris Wilson <chris@chris-wilson.co.uk>
> > Cc: Thomas Zimmermann <tzimmermann@suse.de>
> > Cc: Rob Herring <robh@kernel.org>
> > Cc: Tomeu Vizoso <tomeu.vizoso@collabora.com>
> > Cc: Eric Anholt <eric@anholt.net>
> > Cc: Dave Airlie <airlied@redhat.com>
> > Cc: Gerd Hoffmann <kraxel@redhat.com>
> > Cc: Ben Skeggs <bskeggs@redhat.com>
> > Cc: "VMware Graphics" <linux-graphics-maintainer@vmware.com>
> > Cc: Thomas Hellstrom <thellstrom@vmware.com>
> > Signed-off-by: Daniel Vetter <daniel.vetter@intel.com>
> > ---
> >   drivers/dma-buf/dma-resv.c | 12 ++++++++++++
> >   1 file changed, 12 insertions(+)
> > 
> > diff --git a/drivers/dma-buf/dma-resv.c b/drivers/dma-buf/dma-resv.c
> > index 42a8f3f11681..3edca10d3faf 100644
> > --- a/drivers/dma-buf/dma-resv.c
> > +++ b/drivers/dma-buf/dma-resv.c
> > @@ -34,6 +34,7 @@
> >   #include <linux/dma-resv.h>
> >   #include <linux/export.h>
> > +#include <linux/sched/mm.h>
> >   /**
> >    * DOC: Reservation Object Overview
> > @@ -107,6 +108,17 @@ void dma_resv_init(struct dma_resv *obj)
> >   			&reservation_seqcount_class);
> >   	RCU_INIT_POINTER(obj->fence, NULL);
> >   	RCU_INIT_POINTER(obj->fence_excl, NULL);
> > +
> > +	if (IS_ENABLED(CONFIG_LOCKDEP)) {
> > +		if (current->mm)
> > +			down_read(&current->mm->mmap_sem);
> > +		ww_mutex_lock(&obj->lock, NULL);
> > +		fs_reclaim_acquire(GFP_KERNEL);
> > +		fs_reclaim_release(GFP_KERNEL);
> > +		ww_mutex_unlock(&obj->lock);
> > +		if (current->mm)
> > +			up_read(&current->mm->mmap_sem);
> > +	}
> >   }
> >   EXPORT_SYMBOL(dma_resv_init);
> 
> I assume if this would have been easily done and maintainable using only
> lockdep annotation instead of actually acquiring the locks, that would have
> been done?

There's might_lock(), plus a pile of macros, but they don't map obviuosly,
so pretty good chances I accidentally end up with the wrong type of
annotation. Easier to just take the locks quickly, and stuff that all into
a lockdep-only section to avoid overhead.

> Otherwise LGTM.
> 
> Reviewed-by: Thomas Hellström <thellstrom@vmware.com>
> 
> Will test this and let you know if it trips on vmwgfx, but it really
> shouldn't.

Thanks, Daniel
-- 
Daniel Vetter
Software Engineer, Intel Corporation
http://blog.ffwll.ch
_______________________________________________
Intel-gfx mailing list
Intel-gfx@lists.freedesktop.org
https://lists.freedesktop.org/mailman/listinfo/intel-gfx

✗ Fi.CI.BAT: failure for RFC/T: dma_resv vs. mmap_sem (rev2)

[Patchwork]

== Series Details ==

Series: RFC/T: dma_resv vs. mmap_sem (rev2)
URL   : https://patchwork.freedesktop.org/series/65488/
State : failure

== Summary ==

CI Bug Log - changes from CI_DRM_6755 -> Patchwork_14124
====================================================

Summary
-------

  **FAILURE**

  Serious unknown changes coming with Patchwork_14124 absolutely need to be
  verified manually.
  
  If you think the reported changes have nothing to do with the changes
  introduced in Patchwork_14124, please notify your bug team to allow them
  to document this new failure mode, which will reduce false positives in CI.

  External URL: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_14124/

Possible new issues
-------------------

  Here are the unknown changes that may have been introduced in Patchwork_14124:

### IGT changes ###

#### Possible regressions ####

  * igt@gem_exec_reloc@basic-gtt:
    - fi-hsw-4770:        [PASS][1] -> [DMESG-WARN][2]
   [1]: https://intel-gfx-ci.01.org/tree/drm-tip/CI_DRM_6755/fi-hsw-4770/igt@gem_exec_reloc@basic-gtt.html
   [2]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_14124/fi-hsw-4770/igt@gem_exec_reloc@basic-gtt.html
    - fi-byt-j1900:       [PASS][3] -> [DMESG-WARN][4]
   [3]: https://intel-gfx-ci.01.org/tree/drm-tip/CI_DRM_6755/fi-byt-j1900/igt@gem_exec_reloc@basic-gtt.html
   [4]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_14124/fi-byt-j1900/igt@gem_exec_reloc@basic-gtt.html
    - fi-blb-e6850:       [PASS][5] -> [DMESG-WARN][6]
   [5]: https://intel-gfx-ci.01.org/tree/drm-tip/CI_DRM_6755/fi-blb-e6850/igt@gem_exec_reloc@basic-gtt.html
   [6]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_14124/fi-blb-e6850/igt@gem_exec_reloc@basic-gtt.html
    - fi-skl-6260u:       [PASS][7] -> [DMESG-WARN][8]
   [7]: https://intel-gfx-ci.01.org/tree/drm-tip/CI_DRM_6755/fi-skl-6260u/igt@gem_exec_reloc@basic-gtt.html
   [8]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_14124/fi-skl-6260u/igt@gem_exec_reloc@basic-gtt.html
    - fi-cml-u2:          [PASS][9] -> [DMESG-WARN][10]
   [9]: https://intel-gfx-ci.01.org/tree/drm-tip/CI_DRM_6755/fi-cml-u2/igt@gem_exec_reloc@basic-gtt.html
   [10]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_14124/fi-cml-u2/igt@gem_exec_reloc@basic-gtt.html
    - fi-ivb-3770:        [PASS][11] -> [DMESG-WARN][12]
   [11]: https://intel-gfx-ci.01.org/tree/drm-tip/CI_DRM_6755/fi-ivb-3770/igt@gem_exec_reloc@basic-gtt.html
   [12]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_14124/fi-ivb-3770/igt@gem_exec_reloc@basic-gtt.html
    - fi-skl-6600u:       [PASS][13] -> [DMESG-WARN][14]
   [13]: https://intel-gfx-ci.01.org/tree/drm-tip/CI_DRM_6755/fi-skl-6600u/igt@gem_exec_reloc@basic-gtt.html
   [14]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_14124/fi-skl-6600u/igt@gem_exec_reloc@basic-gtt.html
    - fi-kbl-x1275:       [PASS][15] -> [DMESG-WARN][16]
   [15]: https://intel-gfx-ci.01.org/tree/drm-tip/CI_DRM_6755/fi-kbl-x1275/igt@gem_exec_reloc@basic-gtt.html
   [16]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_14124/fi-kbl-x1275/igt@gem_exec_reloc@basic-gtt.html
    - fi-apl-guc:         [PASS][17] -> [DMESG-WARN][18]
   [17]: https://intel-gfx-ci.01.org/tree/drm-tip/CI_DRM_6755/fi-apl-guc/igt@gem_exec_reloc@basic-gtt.html
   [18]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_14124/fi-apl-guc/igt@gem_exec_reloc@basic-gtt.html
    - fi-glk-dsi:         [PASS][19] -> [DMESG-WARN][20]
   [19]: https://intel-gfx-ci.01.org/tree/drm-tip/CI_DRM_6755/fi-glk-dsi/igt@gem_exec_reloc@basic-gtt.html
   [20]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_14124/fi-glk-dsi/igt@gem_exec_reloc@basic-gtt.html
    - fi-kbl-guc:         [PASS][21] -> [DMESG-WARN][22]
   [21]: https://intel-gfx-ci.01.org/tree/drm-tip/CI_DRM_6755/fi-kbl-guc/igt@gem_exec_reloc@basic-gtt.html
   [22]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_14124/fi-kbl-guc/igt@gem_exec_reloc@basic-gtt.html
    - fi-gdg-551:         [PASS][23] -> [DMESG-WARN][24]
   [23]: https://intel-gfx-ci.01.org/tree/drm-tip/CI_DRM_6755/fi-gdg-551/igt@gem_exec_reloc@basic-gtt.html
   [24]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_14124/fi-gdg-551/igt@gem_exec_reloc@basic-gtt.html
    - fi-kbl-7500u:       [PASS][25] -> [DMESG-WARN][26]
   [25]: https://intel-gfx-ci.01.org/tree/drm-tip/CI_DRM_6755/fi-kbl-7500u/igt@gem_exec_reloc@basic-gtt.html
   [26]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_14124/fi-kbl-7500u/igt@gem_exec_reloc@basic-gtt.html
    - fi-whl-u:           [PASS][27] -> [DMESG-WARN][28]
   [27]: https://intel-gfx-ci.01.org/tree/drm-tip/CI_DRM_6755/fi-whl-u/igt@gem_exec_reloc@basic-gtt.html
   [28]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_14124/fi-whl-u/igt@gem_exec_reloc@basic-gtt.html
    - fi-skl-iommu:       [PASS][29] -> [DMESG-WARN][30]
   [29]: https://intel-gfx-ci.01.org/tree/drm-tip/CI_DRM_6755/fi-skl-iommu/igt@gem_exec_reloc@basic-gtt.html
   [30]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_14124/fi-skl-iommu/igt@gem_exec_reloc@basic-gtt.html
    - fi-skl-gvtdvm:      [PASS][31] -> [DMESG-WARN][32]
   [31]: https://intel-gfx-ci.01.org/tree/drm-tip/CI_DRM_6755/fi-skl-gvtdvm/igt@gem_exec_reloc@basic-gtt.html
   [32]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_14124/fi-skl-gvtdvm/igt@gem_exec_reloc@basic-gtt.html
    - fi-elk-e7500:       [PASS][33] -> [DMESG-WARN][34]
   [33]: https://intel-gfx-ci.01.org/tree/drm-tip/CI_DRM_6755/fi-elk-e7500/igt@gem_exec_reloc@basic-gtt.html
   [34]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_14124/fi-elk-e7500/igt@gem_exec_reloc@basic-gtt.html
    - fi-ilk-650:         [PASS][35] -> [DMESG-WARN][36]
   [35]: https://intel-gfx-ci.01.org/tree/drm-tip/CI_DRM_6755/fi-ilk-650/igt@gem_exec_reloc@basic-gtt.html
   [36]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_14124/fi-ilk-650/igt@gem_exec_reloc@basic-gtt.html
    - fi-bdw-gvtdvm:      [PASS][37] -> [DMESG-WARN][38]
   [37]: https://intel-gfx-ci.01.org/tree/drm-tip/CI_DRM_6755/fi-bdw-gvtdvm/igt@gem_exec_reloc@basic-gtt.html
   [38]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_14124/fi-bdw-gvtdvm/igt@gem_exec_reloc@basic-gtt.html
    - fi-cfl-guc:         [PASS][39] -> [DMESG-WARN][40]
   [39]: https://intel-gfx-ci.01.org/tree/drm-tip/CI_DRM_6755/fi-cfl-guc/igt@gem_exec_reloc@basic-gtt.html
   [40]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_14124/fi-cfl-guc/igt@gem_exec_reloc@basic-gtt.html
    - fi-skl-guc:         [PASS][41] -> [DMESG-WARN][42]
   [41]: https://intel-gfx-ci.01.org/tree/drm-tip/CI_DRM_6755/fi-skl-guc/igt@gem_exec_reloc@basic-gtt.html
   [42]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_14124/fi-skl-guc/igt@gem_exec_reloc@basic-gtt.html
    - fi-kbl-7567u:       [PASS][43] -> [DMESG-WARN][44]
   [43]: https://intel-gfx-ci.01.org/tree/drm-tip/CI_DRM_6755/fi-kbl-7567u/igt@gem_exec_reloc@basic-gtt.html
   [44]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_14124/fi-kbl-7567u/igt@gem_exec_reloc@basic-gtt.html
    - fi-pnv-d510:        [PASS][45] -> [DMESG-WARN][46]
   [45]: https://intel-gfx-ci.01.org/tree/drm-tip/CI_DRM_6755/fi-pnv-d510/igt@gem_exec_reloc@basic-gtt.html
   [46]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_14124/fi-pnv-d510/igt@gem_exec_reloc@basic-gtt.html
    - fi-snb-2520m:       [PASS][47] -> [DMESG-WARN][48]
   [47]: https://intel-gfx-ci.01.org/tree/drm-tip/CI_DRM_6755/fi-snb-2520m/igt@gem_exec_reloc@basic-gtt.html
   [48]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_14124/fi-snb-2520m/igt@gem_exec_reloc@basic-gtt.html
    - fi-hsw-peppy:       [PASS][49] -> [DMESG-WARN][50]
   [49]: https://intel-gfx-ci.01.org/tree/drm-tip/CI_DRM_6755/fi-hsw-peppy/igt@gem_exec_reloc@basic-gtt.html
   [50]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_14124/fi-hsw-peppy/igt@gem_exec_reloc@basic-gtt.html
    - fi-icl-u2:          [PASS][51] -> [DMESG-WARN][52]
   [51]: https://intel-gfx-ci.01.org/tree/drm-tip/CI_DRM_6755/fi-icl-u2/igt@gem_exec_reloc@basic-gtt.html
   [52]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_14124/fi-icl-u2/igt@gem_exec_reloc@basic-gtt.html
    - fi-cfl-8700k:       [PASS][53] -> [DMESG-WARN][54]
   [53]: https://intel-gfx-ci.01.org/tree/drm-tip/CI_DRM_6755/fi-cfl-8700k/igt@gem_exec_reloc@basic-gtt.html
   [54]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_14124/fi-cfl-8700k/igt@gem_exec_reloc@basic-gtt.html
    - fi-kbl-r:           [PASS][55] -> [DMESG-WARN][56]
   [55]: https://intel-gfx-ci.01.org/tree/drm-tip/CI_DRM_6755/fi-kbl-r/igt@gem_exec_reloc@basic-gtt.html
   [56]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_14124/fi-kbl-r/igt@gem_exec_reloc@basic-gtt.html
    - fi-hsw-4770r:       [PASS][57] -> [DMESG-WARN][58]
   [57]: https://intel-gfx-ci.01.org/tree/drm-tip/CI_DRM_6755/fi-hsw-4770r/igt@gem_exec_reloc@basic-gtt.html
   [58]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_14124/fi-hsw-4770r/igt@gem_exec_reloc@basic-gtt.html
    - fi-byt-n2820:       [PASS][59] -> [DMESG-WARN][60]
   [59]: https://intel-gfx-ci.01.org/tree/drm-tip/CI_DRM_6755/fi-byt-n2820/igt@gem_exec_reloc@basic-gtt.html
   [60]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_14124/fi-byt-n2820/igt@gem_exec_reloc@basic-gtt.html
    - fi-cfl-8109u:       NOTRUN -> [DMESG-WARN][61]
   [61]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_14124/fi-cfl-8109u/igt@gem_exec_reloc@basic-gtt.html
    - fi-skl-lmem:        [PASS][62] -> [DMESG-WARN][63]
   [62]: https://intel-gfx-ci.01.org/tree/drm-tip/CI_DRM_6755/fi-skl-lmem/igt@gem_exec_reloc@basic-gtt.html
   [63]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_14124/fi-skl-lmem/igt@gem_exec_reloc@basic-gtt.html
    - fi-bwr-2160:        [PASS][64] -> [DMESG-WARN][65]
   [64]: https://intel-gfx-ci.01.org/tree/drm-tip/CI_DRM_6755/fi-bwr-2160/igt@gem_exec_reloc@basic-gtt.html
   [65]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_14124/fi-bwr-2160/igt@gem_exec_reloc@basic-gtt.html
    - fi-bdw-5557u:       [PASS][66] -> [DMESG-WARN][67]
   [66]: https://intel-gfx-ci.01.org/tree/drm-tip/CI_DRM_6755/fi-bdw-5557u/igt@gem_exec_reloc@basic-gtt.html
   [67]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_14124/fi-bdw-5557u/igt@gem_exec_reloc@basic-gtt.html
    - fi-snb-2600:        [PASS][68] -> [DMESG-WARN][69]
   [68]: https://intel-gfx-ci.01.org/tree/drm-tip/CI_DRM_6755/fi-snb-2600/igt@gem_exec_reloc@basic-gtt.html
   [69]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_14124/fi-snb-2600/igt@gem_exec_reloc@basic-gtt.html
    - fi-skl-6770hq:      [PASS][70] -> [DMESG-WARN][71]
   [70]: https://intel-gfx-ci.01.org/tree/drm-tip/CI_DRM_6755/fi-skl-6770hq/igt@gem_exec_reloc@basic-gtt.html
   [71]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_14124/fi-skl-6770hq/igt@gem_exec_reloc@basic-gtt.html
    - fi-skl-6700k2:      [PASS][72] -> [DMESG-WARN][73]
   [72]: https://intel-gfx-ci.01.org/tree/drm-tip/CI_DRM_6755/fi-skl-6700k2/igt@gem_exec_reloc@basic-gtt.html
   [73]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_14124/fi-skl-6700k2/igt@gem_exec_reloc@basic-gtt.html

  
#### Suppressed ####

  The following results come from untrusted machines, tests, or statuses.
  They do not affect the overall result.

  * igt@gem_exec_reloc@basic-gtt:
    - {fi-icl-guc}:       [PASS][74] -> [DMESG-WARN][75]
   [74]: https://intel-gfx-ci.01.org/tree/drm-tip/CI_DRM_6755/fi-icl-guc/igt@gem_exec_reloc@basic-gtt.html
   [75]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_14124/fi-icl-guc/igt@gem_exec_reloc@basic-gtt.html
    - {fi-icl-u4}:        [PASS][76] -> [DMESG-WARN][77]
   [76]: https://intel-gfx-ci.01.org/tree/drm-tip/CI_DRM_6755/fi-icl-u4/igt@gem_exec_reloc@basic-gtt.html
   [77]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_14124/fi-icl-u4/igt@gem_exec_reloc@basic-gtt.html

  
Known issues
------------

  Here are the changes found in Patchwork_14124 that come from known issues:

### IGT changes ###

#### Issues hit ####

  * igt@gem_ctx_create@basic-files:
    - fi-icl-u3:          [PASS][78] -> [INCOMPLETE][79] ([fdo#107713] / [fdo#109100])
   [78]: https://intel-gfx-ci.01.org/tree/drm-tip/CI_DRM_6755/fi-icl-u3/igt@gem_ctx_create@basic-files.html
   [79]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_14124/fi-icl-u3/igt@gem_ctx_create@basic-files.html

  * igt@gem_exec_reloc@basic-gtt:
    - fi-bxt-dsi:         [PASS][80] -> [DMESG-WARN][81] ([fdo#109385])
   [80]: https://intel-gfx-ci.01.org/tree/drm-tip/CI_DRM_6755/fi-bxt-dsi/igt@gem_exec_reloc@basic-gtt.html
   [81]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_14124/fi-bxt-dsi/igt@gem_exec_reloc@basic-gtt.html
    - fi-bsw-n3050:       [PASS][82] -> [DMESG-WARN][83] ([fdo#109385])
   [82]: https://intel-gfx-ci.01.org/tree/drm-tip/CI_DRM_6755/fi-bsw-n3050/igt@gem_exec_reloc@basic-gtt.html
   [83]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_14124/fi-bsw-n3050/igt@gem_exec_reloc@basic-gtt.html
    - fi-bsw-kefka:       [PASS][84] -> [DMESG-WARN][85] ([fdo#109385])
   [84]: https://intel-gfx-ci.01.org/tree/drm-tip/CI_DRM_6755/fi-bsw-kefka/igt@gem_exec_reloc@basic-gtt.html
   [85]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_14124/fi-bsw-kefka/igt@gem_exec_reloc@basic-gtt.html

  * igt@gem_exec_suspend@basic-s4-devices:
    - fi-blb-e6850:       [PASS][86] -> [INCOMPLETE][87] ([fdo#107718])
   [86]: https://intel-gfx-ci.01.org/tree/drm-tip/CI_DRM_6755/fi-blb-e6850/igt@gem_exec_suspend@basic-s4-devices.html
   [87]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_14124/fi-blb-e6850/igt@gem_exec_suspend@basic-s4-devices.html
    - fi-skl-6600u:       [PASS][88] -> [INCOMPLETE][89] ([fdo#104108])
   [88]: https://intel-gfx-ci.01.org/tree/drm-tip/CI_DRM_6755/fi-skl-6600u/igt@gem_exec_suspend@basic-s4-devices.html
   [89]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_14124/fi-skl-6600u/igt@gem_exec_suspend@basic-s4-devices.html

  * igt@i915_pm_rpm@basic-pci-d3-state:
    - fi-hsw-4770:        [PASS][90] -> [SKIP][91] ([fdo#109271]) +1 similar issue
   [90]: https://intel-gfx-ci.01.org/tree/drm-tip/CI_DRM_6755/fi-hsw-4770/igt@i915_pm_rpm@basic-pci-d3-state.html
   [91]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_14124/fi-hsw-4770/igt@i915_pm_rpm@basic-pci-d3-state.html

  * igt@i915_selftest@live_execlists:
    - fi-bwr-2160:        [PASS][92] -> [DMESG-WARN][93] ([fdo#111115])
   [92]: https://intel-gfx-ci.01.org/tree/drm-tip/CI_DRM_6755/fi-bwr-2160/igt@i915_selftest@live_execlists.html
   [93]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_14124/fi-bwr-2160/igt@i915_selftest@live_execlists.html

  * igt@i915_selftest@live_hangcheck:
    - fi-bwr-2160:        [PASS][94] -> [DMESG-FAIL][95] ([fdo#111115])
   [94]: https://intel-gfx-ci.01.org/tree/drm-tip/CI_DRM_6755/fi-bwr-2160/igt@i915_selftest@live_hangcheck.html
   [95]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_14124/fi-bwr-2160/igt@i915_selftest@live_hangcheck.html

  * igt@kms_frontbuffer_tracking@basic:
    - fi-hsw-peppy:       [PASS][96] -> [DMESG-WARN][97] ([fdo#102614])
   [96]: https://intel-gfx-ci.01.org/tree/drm-tip/CI_DRM_6755/fi-hsw-peppy/igt@kms_frontbuffer_tracking@basic.html
   [97]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_14124/fi-hsw-peppy/igt@kms_frontbuffer_tracking@basic.html

  
#### Possible fixes ####

  * igt@gem_ctx_switch@legacy-render:
    - fi-cfl-8109u:       [INCOMPLETE][98] -> [PASS][99]
   [98]: https://intel-gfx-ci.01.org/tree/drm-tip/CI_DRM_6755/fi-cfl-8109u/igt@gem_ctx_switch@legacy-render.html
   [99]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_14124/fi-cfl-8109u/igt@gem_ctx_switch@legacy-render.html

  * igt@kms_chamelium@hdmi-edid-read:
    - {fi-icl-u4}:        [FAIL][100] ([fdo#111045]) -> [PASS][101]
   [100]: https://intel-gfx-ci.01.org/tree/drm-tip/CI_DRM_6755/fi-icl-u4/igt@kms_chamelium@hdmi-edid-read.html
   [101]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_14124/fi-icl-u4/igt@kms_chamelium@hdmi-edid-read.html

  * igt@kms_frontbuffer_tracking@basic:
    - {fi-icl-u4}:        [FAIL][102] ([fdo#103167]) -> [PASS][103]
   [102]: https://intel-gfx-ci.01.org/tree/drm-tip/CI_DRM_6755/fi-icl-u4/igt@kms_frontbuffer_tracking@basic.html
   [103]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_14124/fi-icl-u4/igt@kms_frontbuffer_tracking@basic.html

  
  {name}: This element is suppressed. This means it is ignored when computing
          the status of the difference (SUCCESS, WARNING, or FAILURE).

  [fdo#102614]: https://bugs.freedesktop.org/show_bug.cgi?id=102614
  [fdo#103167]: https://bugs.freedesktop.org/show_bug.cgi?id=103167
  [fdo#104108]: https://bugs.freedesktop.org/show_bug.cgi?id=104108
  [fdo#107713]: https://bugs.freedesktop.org/show_bug.cgi?id=107713
  [fdo#107718]: https://bugs.freedesktop.org/show_bug.cgi?id=107718
  [fdo#109100]: https://bugs.freedesktop.org/show_bug.cgi?id=109100
  [fdo#109271]: https://bugs.freedesktop.org/show_bug.cgi?id=109271
  [fdo#109385]: https://bugs.freedesktop.org/show_bug.cgi?id=109385
  [fdo#109644]: https://bugs.freedesktop.org/show_bug.cgi?id=109644
  [fdo#110464]: https://bugs.freedesktop.org/show_bug.cgi?id=110464
  [fdo#111045]: https://bugs.freedesktop.org/show_bug.cgi?id=111045
  [fdo#111096]: https://bugs.freedesktop.org/show_bug.cgi?id=111096
  [fdo#111115]: https://bugs.freedesktop.org/show_bug.cgi?id=111115
  [fdo#111407]: https://bugs.freedesktop.org/show_bug.cgi?id=111407


Participating hosts (57 -> 48)
------------------------------

  Missing    (9): fi-kbl-soraka fi-ilk-m540 fi-hsw-4200u fi-byt-squawks fi-bsw-cyan fi-ctg-p8600 fi-icl-y fi-byt-clapper fi-bdw-samus 


Build changes
-------------

  * CI: CI-20190529 -> None
  * Linux: CI_DRM_6755 -> Patchwork_14124

  CI-20190529: 20190529
  CI_DRM_6755: 8ef0018b4afe55bff6f538b2125a72250a8bf67f @ git://anongit.freedesktop.org/gfx-ci/linux
  IGT_5146: 357dbe1869d88a2f08bcee4eebceff4ee9014424 @ git://anongit.freedesktop.org/xorg/app/intel-gpu-tools
  Patchwork_14124: e00626825d8134fcccdf1db087ac1d6d446f336c @ git://anongit.freedesktop.org/gfx-ci/linux


== Linux commits ==

e00626825d81 drm/ttm: remove ttm_bo_wait_unreserved
7c35577035f8 drm/nouveau: slowpath for pushbuf ioctl
3166313498da dma_resv: prime lockdep annotations

== Logs ==

For more details see: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_14124/
_______________________________________________
Intel-gfx mailing list
Intel-gfx@lists.freedesktop.org
https://lists.freedesktop.org/mailman/listinfo/intel-gfx

Re: [PATCH 1/3] dma_resv: prime lockdep annotations

[Thomas Hellström (VMware)]

On 8/21/19 6:34 PM, Daniel Vetter wrote:
> On Wed, Aug 21, 2019 at 05:54:27PM +0200, Thomas Hellström (VMware) wrote:
>> On 8/20/19 4:53 PM, Daniel Vetter wrote:
>>> Full audit of everyone:
>>>
>>> - i915, radeon, amdgpu should be clean per their maintainers.
>>>
>>> - vram helpers should be fine, they don't do command submission, so
>>>     really no business holding struct_mutex while doing copy_*_user. But
>>>     I haven't checked them all.
>>>
>>> - panfrost seems to dma_resv_lock only in panfrost_job_push, which
>>>     looks clean.
>>>
>>> - v3d holds dma_resv locks in the tail of its v3d_submit_cl_ioctl(),
>>>     copying from/to userspace happens all in v3d_lookup_bos which is
>>>     outside of the critical section.
>>>
>>> - vmwgfx has a bunch of ioctls that do their own copy_*_user:
>>>     - vmw_execbuf_process: First this does some copies in
>>>       vmw_execbuf_cmdbuf() and also in the vmw_execbuf_process() itself.
>>>       Then comes the usual ttm reserve/validate sequence, then actual
>>>       submission/fencing, then unreserving, and finally some more
>>>       copy_to_user in vmw_execbuf_copy_fence_user. Glossing over tons of
>>>       details, but looks all safe.
>>>     - vmw_fence_event_ioctl: No ttm_reserve/dma_resv_lock anywhere to be
>>>       seen, seems to only create a fence and copy it out.
>>>     - a pile of smaller ioctl in vmwgfx_ioctl.c, no reservations to be
>>>       found there.
>>>     Summary: vmwgfx seems to be fine too.
>>>
>>> - virtio: There's virtio_gpu_execbuffer_ioctl, which does all the
>>>     copying from userspace before even looking up objects through their
>>>     handles, so safe. Plus the getparam/getcaps ioctl, also both safe.
>>>
>>> - qxl only has qxl_execbuffer_ioctl, which calls into
>>>     qxl_process_single_command. There's a lovely comment before the
>>>     __copy_from_user_inatomic that the slowpath should be copied from
>>>     i915, but I guess that never happened. Try not to be unlucky and get
>>>     your CS data evicted between when it's written and the kernel tries
>>>     to read it. The only other copy_from_user is for relocs, but those
>>>     are done before qxl_release_reserve_list(), which seems to be the
>>>     only thing reserving buffers (in the ttm/dma_resv sense) in that
>>>     code. So looks safe.
>>>
>>> - A debugfs file in nouveau_debugfs_pstate_set() and the usif ioctl in
>>>     usif_ioctl() look safe. nouveau_gem_ioctl_pushbuf() otoh breaks this
>>>     everywhere and needs to be fixed up.
>>>
>>> Cc: Alex Deucher <alexander.deucher@amd.com>
>>> Cc: Christian König <christian.koenig@amd.com>
>>> Cc: Chris Wilson <chris@chris-wilson.co.uk>
>>> Cc: Thomas Zimmermann <tzimmermann@suse.de>
>>> Cc: Rob Herring <robh@kernel.org>
>>> Cc: Tomeu Vizoso <tomeu.vizoso@collabora.com>
>>> Cc: Eric Anholt <eric@anholt.net>
>>> Cc: Dave Airlie <airlied@redhat.com>
>>> Cc: Gerd Hoffmann <kraxel@redhat.com>
>>> Cc: Ben Skeggs <bskeggs@redhat.com>
>>> Cc: "VMware Graphics" <linux-graphics-maintainer@vmware.com>
>>> Cc: Thomas Hellstrom <thellstrom@vmware.com>
>>> Signed-off-by: Daniel Vetter <daniel.vetter@intel.com>
>>> ---
>>>    drivers/dma-buf/dma-resv.c | 12 ++++++++++++
>>>    1 file changed, 12 insertions(+)
>>>
>>> diff --git a/drivers/dma-buf/dma-resv.c b/drivers/dma-buf/dma-resv.c
>>> index 42a8f3f11681..3edca10d3faf 100644
>>> --- a/drivers/dma-buf/dma-resv.c
>>> +++ b/drivers/dma-buf/dma-resv.c
>>> @@ -34,6 +34,7 @@
>>>    #include <linux/dma-resv.h>
>>>    #include <linux/export.h>
>>> +#include <linux/sched/mm.h>
>>>    /**
>>>     * DOC: Reservation Object Overview
>>> @@ -107,6 +108,17 @@ void dma_resv_init(struct dma_resv *obj)
>>>    			&reservation_seqcount_class);
>>>    	RCU_INIT_POINTER(obj->fence, NULL);
>>>    	RCU_INIT_POINTER(obj->fence_excl, NULL);
>>> +
>>> +	if (IS_ENABLED(CONFIG_LOCKDEP)) {
>>> +		if (current->mm)
>>> +			down_read(&current->mm->mmap_sem);
>>> +		ww_mutex_lock(&obj->lock, NULL);
>>> +		fs_reclaim_acquire(GFP_KERNEL);
>>> +		fs_reclaim_release(GFP_KERNEL);
>>> +		ww_mutex_unlock(&obj->lock);
>>> +		if (current->mm)
>>> +			up_read(&current->mm->mmap_sem);
>>> +	}
>>>    }
>>>    EXPORT_SYMBOL(dma_resv_init);
>> I assume if this would have been easily done and maintainable using only
>> lockdep annotation instead of actually acquiring the locks, that would have
>> been done?
> There's might_lock(), plus a pile of macros, but they don't map obviuosly,
> so pretty good chances I accidentally end up with the wrong type of
> annotation. Easier to just take the locks quickly, and stuff that all into
> a lockdep-only section to avoid overhead.
>
>> Otherwise LGTM.
>>
>> Reviewed-by: Thomas Hellström <thellstrom@vmware.com>
>>
>> Will test this and let you know if it trips on vmwgfx, but it really
>> shouldn't.
> Thanks, Daniel

One thing that strikes me is that this puts restrictions on where you 
can actually initialize a dma_resv, even if locking orders are otherwise 
obeyed. But that might not be a big problem.

/Thomas




_______________________________________________
Intel-gfx mailing list
Intel-gfx@lists.freedesktop.org
https://lists.freedesktop.org/mailman/listinfo/intel-gfx

Re: [PATCH 1/3] dma_resv: prime lockdep annotations

[Daniel Vetter]

On Wed, Aug 21, 2019 at 7:06 PM Thomas Hellström (VMware)
<thomas_os@shipmail.org> wrote:
>
> On 8/21/19 6:34 PM, Daniel Vetter wrote:
> > On Wed, Aug 21, 2019 at 05:54:27PM +0200, Thomas Hellström (VMware) wrote:
> >> On 8/20/19 4:53 PM, Daniel Vetter wrote:
> >>> Full audit of everyone:
> >>>
> >>> - i915, radeon, amdgpu should be clean per their maintainers.
> >>>
> >>> - vram helpers should be fine, they don't do command submission, so
> >>>     really no business holding struct_mutex while doing copy_*_user. But
> >>>     I haven't checked them all.
> >>>
> >>> - panfrost seems to dma_resv_lock only in panfrost_job_push, which
> >>>     looks clean.
> >>>
> >>> - v3d holds dma_resv locks in the tail of its v3d_submit_cl_ioctl(),
> >>>     copying from/to userspace happens all in v3d_lookup_bos which is
> >>>     outside of the critical section.
> >>>
> >>> - vmwgfx has a bunch of ioctls that do their own copy_*_user:
> >>>     - vmw_execbuf_process: First this does some copies in
> >>>       vmw_execbuf_cmdbuf() and also in the vmw_execbuf_process() itself.
> >>>       Then comes the usual ttm reserve/validate sequence, then actual
> >>>       submission/fencing, then unreserving, and finally some more
> >>>       copy_to_user in vmw_execbuf_copy_fence_user. Glossing over tons of
> >>>       details, but looks all safe.
> >>>     - vmw_fence_event_ioctl: No ttm_reserve/dma_resv_lock anywhere to be
> >>>       seen, seems to only create a fence and copy it out.
> >>>     - a pile of smaller ioctl in vmwgfx_ioctl.c, no reservations to be
> >>>       found there.
> >>>     Summary: vmwgfx seems to be fine too.
> >>>
> >>> - virtio: There's virtio_gpu_execbuffer_ioctl, which does all the
> >>>     copying from userspace before even looking up objects through their
> >>>     handles, so safe. Plus the getparam/getcaps ioctl, also both safe.
> >>>
> >>> - qxl only has qxl_execbuffer_ioctl, which calls into
> >>>     qxl_process_single_command. There's a lovely comment before the
> >>>     __copy_from_user_inatomic that the slowpath should be copied from
> >>>     i915, but I guess that never happened. Try not to be unlucky and get
> >>>     your CS data evicted between when it's written and the kernel tries
> >>>     to read it. The only other copy_from_user is for relocs, but those
> >>>     are done before qxl_release_reserve_list(), which seems to be the
> >>>     only thing reserving buffers (in the ttm/dma_resv sense) in that
> >>>     code. So looks safe.
> >>>
> >>> - A debugfs file in nouveau_debugfs_pstate_set() and the usif ioctl in
> >>>     usif_ioctl() look safe. nouveau_gem_ioctl_pushbuf() otoh breaks this
> >>>     everywhere and needs to be fixed up.
> >>>
> >>> Cc: Alex Deucher <alexander.deucher@amd.com>
> >>> Cc: Christian König <christian.koenig@amd.com>
> >>> Cc: Chris Wilson <chris@chris-wilson.co.uk>
> >>> Cc: Thomas Zimmermann <tzimmermann@suse.de>
> >>> Cc: Rob Herring <robh@kernel.org>
> >>> Cc: Tomeu Vizoso <tomeu.vizoso@collabora.com>
> >>> Cc: Eric Anholt <eric@anholt.net>
> >>> Cc: Dave Airlie <airlied@redhat.com>
> >>> Cc: Gerd Hoffmann <kraxel@redhat.com>
> >>> Cc: Ben Skeggs <bskeggs@redhat.com>
> >>> Cc: "VMware Graphics" <linux-graphics-maintainer@vmware.com>
> >>> Cc: Thomas Hellstrom <thellstrom@vmware.com>
> >>> Signed-off-by: Daniel Vetter <daniel.vetter@intel.com>
> >>> ---
> >>>    drivers/dma-buf/dma-resv.c | 12 ++++++++++++
> >>>    1 file changed, 12 insertions(+)
> >>>
> >>> diff --git a/drivers/dma-buf/dma-resv.c b/drivers/dma-buf/dma-resv.c
> >>> index 42a8f3f11681..3edca10d3faf 100644
> >>> --- a/drivers/dma-buf/dma-resv.c
> >>> +++ b/drivers/dma-buf/dma-resv.c
> >>> @@ -34,6 +34,7 @@
> >>>    #include <linux/dma-resv.h>
> >>>    #include <linux/export.h>
> >>> +#include <linux/sched/mm.h>
> >>>    /**
> >>>     * DOC: Reservation Object Overview
> >>> @@ -107,6 +108,17 @@ void dma_resv_init(struct dma_resv *obj)
> >>>                     &reservation_seqcount_class);
> >>>     RCU_INIT_POINTER(obj->fence, NULL);
> >>>     RCU_INIT_POINTER(obj->fence_excl, NULL);
> >>> +
> >>> +   if (IS_ENABLED(CONFIG_LOCKDEP)) {
> >>> +           if (current->mm)
> >>> +                   down_read(&current->mm->mmap_sem);
> >>> +           ww_mutex_lock(&obj->lock, NULL);
> >>> +           fs_reclaim_acquire(GFP_KERNEL);
> >>> +           fs_reclaim_release(GFP_KERNEL);
> >>> +           ww_mutex_unlock(&obj->lock);
> >>> +           if (current->mm)
> >>> +                   up_read(&current->mm->mmap_sem);
> >>> +   }
> >>>    }
> >>>    EXPORT_SYMBOL(dma_resv_init);
> >> I assume if this would have been easily done and maintainable using only
> >> lockdep annotation instead of actually acquiring the locks, that would have
> >> been done?
> > There's might_lock(), plus a pile of macros, but they don't map obviuosly,
> > so pretty good chances I accidentally end up with the wrong type of
> > annotation. Easier to just take the locks quickly, and stuff that all into
> > a lockdep-only section to avoid overhead.
> >
> >> Otherwise LGTM.
> >>
> >> Reviewed-by: Thomas Hellström <thellstrom@vmware.com>
> >>
> >> Will test this and let you know if it trips on vmwgfx, but it really
> >> shouldn't.
> > Thanks, Daniel
>
> One thing that strikes me is that this puts restrictions on where you
> can actually initialize a dma_resv, even if locking orders are otherwise
> obeyed. But that might not be a big problem.

Hm yeah ... the trouble is a need a non-kthread thread so that I have
a current->mm. Otherwise I'd have put it into some init section with a
temp dma_buf. And I kinda don't want to create a fake ->mm just for
lockdep priming. I don't expect this to be a real problem in practice,
since before you've called dma_resv_init the reservation lock doesn't
exist, so you can't hold it. And you've probably just allocated it, so
fs_reclaim is going to be fine. And if you allocate dma_resv objects
from your fault handlers I have questions anyway :-)

So I think this should be safe.
-Daniel
-- 
Daniel Vetter
Software Engineer, Intel Corporation
+41 (0) 79 365 57 48 - http://blog.ffwll.ch
_______________________________________________
Intel-gfx mailing list
Intel-gfx@lists.freedesktop.org
https://lists.freedesktop.org/mailman/listinfo/intel-gfx

Re: [PATCH 1/3] dma_resv: prime lockdep annotations

[Thomas Hellström (VMware)]

On 8/21/19 8:11 PM, Daniel Vetter wrote:
> On Wed, Aug 21, 2019 at 7:06 PM Thomas Hellström (VMware)
> <thomas_os@shipmail.org> wrote:
>> On 8/21/19 6:34 PM, Daniel Vetter wrote:
>>> On Wed, Aug 21, 2019 at 05:54:27PM +0200, Thomas Hellström (VMware) wrote:
>>>> On 8/20/19 4:53 PM, Daniel Vetter wrote:
>>>>> Full audit of everyone:
>>>>>
>>>>> - i915, radeon, amdgpu should be clean per their maintainers.
>>>>>
>>>>> - vram helpers should be fine, they don't do command submission, so
>>>>>      really no business holding struct_mutex while doing copy_*_user. But
>>>>>      I haven't checked them all.
>>>>>
>>>>> - panfrost seems to dma_resv_lock only in panfrost_job_push, which
>>>>>      looks clean.
>>>>>
>>>>> - v3d holds dma_resv locks in the tail of its v3d_submit_cl_ioctl(),
>>>>>      copying from/to userspace happens all in v3d_lookup_bos which is
>>>>>      outside of the critical section.
>>>>>
>>>>> - vmwgfx has a bunch of ioctls that do their own copy_*_user:
>>>>>      - vmw_execbuf_process: First this does some copies in
>>>>>        vmw_execbuf_cmdbuf() and also in the vmw_execbuf_process() itself.
>>>>>        Then comes the usual ttm reserve/validate sequence, then actual
>>>>>        submission/fencing, then unreserving, and finally some more
>>>>>        copy_to_user in vmw_execbuf_copy_fence_user. Glossing over tons of
>>>>>        details, but looks all safe.
>>>>>      - vmw_fence_event_ioctl: No ttm_reserve/dma_resv_lock anywhere to be
>>>>>        seen, seems to only create a fence and copy it out.
>>>>>      - a pile of smaller ioctl in vmwgfx_ioctl.c, no reservations to be
>>>>>        found there.
>>>>>      Summary: vmwgfx seems to be fine too.
>>>>>
>>>>> - virtio: There's virtio_gpu_execbuffer_ioctl, which does all the
>>>>>      copying from userspace before even looking up objects through their
>>>>>      handles, so safe. Plus the getparam/getcaps ioctl, also both safe.
>>>>>
>>>>> - qxl only has qxl_execbuffer_ioctl, which calls into
>>>>>      qxl_process_single_command. There's a lovely comment before the
>>>>>      __copy_from_user_inatomic that the slowpath should be copied from
>>>>>      i915, but I guess that never happened. Try not to be unlucky and get
>>>>>      your CS data evicted between when it's written and the kernel tries
>>>>>      to read it. The only other copy_from_user is for relocs, but those
>>>>>      are done before qxl_release_reserve_list(), which seems to be the
>>>>>      only thing reserving buffers (in the ttm/dma_resv sense) in that
>>>>>      code. So looks safe.
>>>>>
>>>>> - A debugfs file in nouveau_debugfs_pstate_set() and the usif ioctl in
>>>>>      usif_ioctl() look safe. nouveau_gem_ioctl_pushbuf() otoh breaks this
>>>>>      everywhere and needs to be fixed up.
>>>>>
>>>>> Cc: Alex Deucher <alexander.deucher@amd.com>
>>>>> Cc: Christian König <christian.koenig@amd.com>
>>>>> Cc: Chris Wilson <chris@chris-wilson.co.uk>
>>>>> Cc: Thomas Zimmermann <tzimmermann@suse.de>
>>>>> Cc: Rob Herring <robh@kernel.org>
>>>>> Cc: Tomeu Vizoso <tomeu.vizoso@collabora.com>
>>>>> Cc: Eric Anholt <eric@anholt.net>
>>>>> Cc: Dave Airlie <airlied@redhat.com>
>>>>> Cc: Gerd Hoffmann <kraxel@redhat.com>
>>>>> Cc: Ben Skeggs <bskeggs@redhat.com>
>>>>> Cc: "VMware Graphics" <linux-graphics-maintainer@vmware.com>
>>>>> Cc: Thomas Hellstrom <thellstrom@vmware.com>
>>>>> Signed-off-by: Daniel Vetter <daniel.vetter@intel.com>
>>>>> ---
>>>>>     drivers/dma-buf/dma-resv.c | 12 ++++++++++++
>>>>>     1 file changed, 12 insertions(+)
>>>>>
>>>>> diff --git a/drivers/dma-buf/dma-resv.c b/drivers/dma-buf/dma-resv.c
>>>>> index 42a8f3f11681..3edca10d3faf 100644
>>>>> --- a/drivers/dma-buf/dma-resv.c
>>>>> +++ b/drivers/dma-buf/dma-resv.c
>>>>> @@ -34,6 +34,7 @@
>>>>>     #include <linux/dma-resv.h>
>>>>>     #include <linux/export.h>
>>>>> +#include <linux/sched/mm.h>
>>>>>     /**
>>>>>      * DOC: Reservation Object Overview
>>>>> @@ -107,6 +108,17 @@ void dma_resv_init(struct dma_resv *obj)
>>>>>                      &reservation_seqcount_class);
>>>>>      RCU_INIT_POINTER(obj->fence, NULL);
>>>>>      RCU_INIT_POINTER(obj->fence_excl, NULL);
>>>>> +
>>>>> +   if (IS_ENABLED(CONFIG_LOCKDEP)) {
>>>>> +           if (current->mm)
>>>>> +                   down_read(&current->mm->mmap_sem);
>>>>> +           ww_mutex_lock(&obj->lock, NULL);
>>>>> +           fs_reclaim_acquire(GFP_KERNEL);
>>>>> +           fs_reclaim_release(GFP_KERNEL);
>>>>> +           ww_mutex_unlock(&obj->lock);
>>>>> +           if (current->mm)
>>>>> +                   up_read(&current->mm->mmap_sem);
>>>>> +   }
>>>>>     }
>>>>>     EXPORT_SYMBOL(dma_resv_init);
>>>> I assume if this would have been easily done and maintainable using only
>>>> lockdep annotation instead of actually acquiring the locks, that would have
>>>> been done?
>>> There's might_lock(), plus a pile of macros, but they don't map obviuosly,
>>> so pretty good chances I accidentally end up with the wrong type of
>>> annotation. Easier to just take the locks quickly, and stuff that all into
>>> a lockdep-only section to avoid overhead.
>>>
>>>> Otherwise LGTM.
>>>>
>>>> Reviewed-by: Thomas Hellström <thellstrom@vmware.com>
>>>>
>>>> Will test this and let you know if it trips on vmwgfx, but it really
>>>> shouldn't.
>>> Thanks, Daniel
>> One thing that strikes me is that this puts restrictions on where you
>> can actually initialize a dma_resv, even if locking orders are otherwise
>> obeyed. But that might not be a big problem.
> Hm yeah ... the trouble is a need a non-kthread thread so that I have
> a current->mm. Otherwise I'd have put it into some init section with a
> temp dma_buf. And I kinda don't want to create a fake ->mm just for
> lockdep priming. I don't expect this to be a real problem in practice,
> since before you've called dma_resv_init the reservation lock doesn't
> exist, so you can't hold it. And you've probably just allocated it, so
> fs_reclaim is going to be fine. And if you allocate dma_resv objects
> from your fault handlers I have questions anyway :-)

Coming to think of it, I think vmwgfx sometimes create bos with other 
bo's reservation lock held. I guess that would trip both the mmap_sem 
check the ww_mutex check?

/Thomas


/Thomas




>
> So I think this should be safe.
> -Daniel


_______________________________________________
Intel-gfx mailing list
Intel-gfx@lists.freedesktop.org
https://lists.freedesktop.org/mailman/listinfo/intel-gfx

✗ Fi.CI.BAT: failure for RFC/T: dma_resv vs. mmap_sem (rev3)

[Patchwork]

== Series Details ==

Series: RFC/T: dma_resv vs. mmap_sem (rev3)
URL   : https://patchwork.freedesktop.org/series/65488/
State : failure

== Summary ==

Applying: dma_resv: prime lockdep annotations
Applying: drm/nouveau: slowpath for pushbuf ioctl
Applying: drm/ttm: remove ttm_bo_wait_unreserved
error: patch failed: drivers/gpu/drm/ttm/ttm_bo_vm.c:125
error: drivers/gpu/drm/ttm/ttm_bo_vm.c: patch does not apply
error: Did you hand edit your patch?
It does not apply to blobs recorded in its index.
hint: Use 'git am --show-current-patch' to see the failed patch
Using index info to reconstruct a base tree...
M	drivers/gpu/drm/ttm/ttm_bo_vm.c
Patch failed at 0003 drm/ttm: remove ttm_bo_wait_unreserved
When you have resolved this problem, run "git am --continue".
If you prefer to skip this patch, run "git am --skip" instead.
To restore the original branch and stop patching, run "git am --abort".

_______________________________________________
Intel-gfx mailing list
Intel-gfx@lists.freedesktop.org
https://lists.freedesktop.org/mailman/listinfo/intel-gfx

Re: [PATCH 1/3] dma_resv: prime lockdep annotations

[Daniel Vetter]

On Wed, Aug 21, 2019 at 08:27:59PM +0200, Thomas Hellström (VMware) wrote:
> On 8/21/19 8:11 PM, Daniel Vetter wrote:
> > On Wed, Aug 21, 2019 at 7:06 PM Thomas Hellström (VMware)
> > <thomas_os@shipmail.org> wrote:
> > > On 8/21/19 6:34 PM, Daniel Vetter wrote:
> > > > On Wed, Aug 21, 2019 at 05:54:27PM +0200, Thomas Hellström (VMware) wrote:
> > > > > On 8/20/19 4:53 PM, Daniel Vetter wrote:
> > > > > > Full audit of everyone:
> > > > > > 
> > > > > > - i915, radeon, amdgpu should be clean per their maintainers.
> > > > > > 
> > > > > > - vram helpers should be fine, they don't do command submission, so
> > > > > >      really no business holding struct_mutex while doing copy_*_user. But
> > > > > >      I haven't checked them all.
> > > > > > 
> > > > > > - panfrost seems to dma_resv_lock only in panfrost_job_push, which
> > > > > >      looks clean.
> > > > > > 
> > > > > > - v3d holds dma_resv locks in the tail of its v3d_submit_cl_ioctl(),
> > > > > >      copying from/to userspace happens all in v3d_lookup_bos which is
> > > > > >      outside of the critical section.
> > > > > > 
> > > > > > - vmwgfx has a bunch of ioctls that do their own copy_*_user:
> > > > > >      - vmw_execbuf_process: First this does some copies in
> > > > > >        vmw_execbuf_cmdbuf() and also in the vmw_execbuf_process() itself.
> > > > > >        Then comes the usual ttm reserve/validate sequence, then actual
> > > > > >        submission/fencing, then unreserving, and finally some more
> > > > > >        copy_to_user in vmw_execbuf_copy_fence_user. Glossing over tons of
> > > > > >        details, but looks all safe.
> > > > > >      - vmw_fence_event_ioctl: No ttm_reserve/dma_resv_lock anywhere to be
> > > > > >        seen, seems to only create a fence and copy it out.
> > > > > >      - a pile of smaller ioctl in vmwgfx_ioctl.c, no reservations to be
> > > > > >        found there.
> > > > > >      Summary: vmwgfx seems to be fine too.
> > > > > > 
> > > > > > - virtio: There's virtio_gpu_execbuffer_ioctl, which does all the
> > > > > >      copying from userspace before even looking up objects through their
> > > > > >      handles, so safe. Plus the getparam/getcaps ioctl, also both safe.
> > > > > > 
> > > > > > - qxl only has qxl_execbuffer_ioctl, which calls into
> > > > > >      qxl_process_single_command. There's a lovely comment before the
> > > > > >      __copy_from_user_inatomic that the slowpath should be copied from
> > > > > >      i915, but I guess that never happened. Try not to be unlucky and get
> > > > > >      your CS data evicted between when it's written and the kernel tries
> > > > > >      to read it. The only other copy_from_user is for relocs, but those
> > > > > >      are done before qxl_release_reserve_list(), which seems to be the
> > > > > >      only thing reserving buffers (in the ttm/dma_resv sense) in that
> > > > > >      code. So looks safe.
> > > > > > 
> > > > > > - A debugfs file in nouveau_debugfs_pstate_set() and the usif ioctl in
> > > > > >      usif_ioctl() look safe. nouveau_gem_ioctl_pushbuf() otoh breaks this
> > > > > >      everywhere and needs to be fixed up.
> > > > > > 
> > > > > > Cc: Alex Deucher <alexander.deucher@amd.com>
> > > > > > Cc: Christian König <christian.koenig@amd.com>
> > > > > > Cc: Chris Wilson <chris@chris-wilson.co.uk>
> > > > > > Cc: Thomas Zimmermann <tzimmermann@suse.de>
> > > > > > Cc: Rob Herring <robh@kernel.org>
> > > > > > Cc: Tomeu Vizoso <tomeu.vizoso@collabora.com>
> > > > > > Cc: Eric Anholt <eric@anholt.net>
> > > > > > Cc: Dave Airlie <airlied@redhat.com>
> > > > > > Cc: Gerd Hoffmann <kraxel@redhat.com>
> > > > > > Cc: Ben Skeggs <bskeggs@redhat.com>
> > > > > > Cc: "VMware Graphics" <linux-graphics-maintainer@vmware.com>
> > > > > > Cc: Thomas Hellstrom <thellstrom@vmware.com>
> > > > > > Signed-off-by: Daniel Vetter <daniel.vetter@intel.com>
> > > > > > ---
> > > > > >     drivers/dma-buf/dma-resv.c | 12 ++++++++++++
> > > > > >     1 file changed, 12 insertions(+)
> > > > > > 
> > > > > > diff --git a/drivers/dma-buf/dma-resv.c b/drivers/dma-buf/dma-resv.c
> > > > > > index 42a8f3f11681..3edca10d3faf 100644
> > > > > > --- a/drivers/dma-buf/dma-resv.c
> > > > > > +++ b/drivers/dma-buf/dma-resv.c
> > > > > > @@ -34,6 +34,7 @@
> > > > > >     #include <linux/dma-resv.h>
> > > > > >     #include <linux/export.h>
> > > > > > +#include <linux/sched/mm.h>
> > > > > >     /**
> > > > > >      * DOC: Reservation Object Overview
> > > > > > @@ -107,6 +108,17 @@ void dma_resv_init(struct dma_resv *obj)
> > > > > >                      &reservation_seqcount_class);
> > > > > >      RCU_INIT_POINTER(obj->fence, NULL);
> > > > > >      RCU_INIT_POINTER(obj->fence_excl, NULL);
> > > > > > +
> > > > > > +   if (IS_ENABLED(CONFIG_LOCKDEP)) {
> > > > > > +           if (current->mm)
> > > > > > +                   down_read(&current->mm->mmap_sem);
> > > > > > +           ww_mutex_lock(&obj->lock, NULL);
> > > > > > +           fs_reclaim_acquire(GFP_KERNEL);
> > > > > > +           fs_reclaim_release(GFP_KERNEL);
> > > > > > +           ww_mutex_unlock(&obj->lock);
> > > > > > +           if (current->mm)
> > > > > > +                   up_read(&current->mm->mmap_sem);
> > > > > > +   }
> > > > > >     }
> > > > > >     EXPORT_SYMBOL(dma_resv_init);
> > > > > I assume if this would have been easily done and maintainable using only
> > > > > lockdep annotation instead of actually acquiring the locks, that would have
> > > > > been done?
> > > > There's might_lock(), plus a pile of macros, but they don't map obviuosly,
> > > > so pretty good chances I accidentally end up with the wrong type of
> > > > annotation. Easier to just take the locks quickly, and stuff that all into
> > > > a lockdep-only section to avoid overhead.
> > > > 
> > > > > Otherwise LGTM.
> > > > > 
> > > > > Reviewed-by: Thomas Hellström <thellstrom@vmware.com>
> > > > > 
> > > > > Will test this and let you know if it trips on vmwgfx, but it really
> > > > > shouldn't.
> > > > Thanks, Daniel
> > > One thing that strikes me is that this puts restrictions on where you
> > > can actually initialize a dma_resv, even if locking orders are otherwise
> > > obeyed. But that might not be a big problem.
> > Hm yeah ... the trouble is a need a non-kthread thread so that I have
> > a current->mm. Otherwise I'd have put it into some init section with a
> > temp dma_buf. And I kinda don't want to create a fake ->mm just for
> > lockdep priming. I don't expect this to be a real problem in practice,
> > since before you've called dma_resv_init the reservation lock doesn't
> > exist, so you can't hold it. And you've probably just allocated it, so
> > fs_reclaim is going to be fine. And if you allocate dma_resv objects
> > from your fault handlers I have questions anyway :-)
> 
> Coming to think of it, I think vmwgfx sometimes create bos with other bo's
> reservation lock held. I guess that would trip both the mmap_sem check the
> ww_mutex check?

If you do that, yes we're busted. Do you do that?

I guess needs a new idea for where to put this ... while making sure
everyone gets it. So some evil trick like putting it in drm_open() won't
work, since I also want to make sure everyone else using dma-buf follows
these rules.

Ideas?
-Daniel
-- 
Daniel Vetter
Software Engineer, Intel Corporation
http://blog.ffwll.ch
_______________________________________________
Intel-gfx mailing list
Intel-gfx@lists.freedesktop.org
https://lists.freedesktop.org/mailman/listinfo/intel-gfx

Re: [PATCH 1/3] dma_resv: prime lockdep annotations

[Thomas Hellström (VMware)]

On 8/21/19 9:51 PM, Daniel Vetter wrote:
> On Wed, Aug 21, 2019 at 08:27:59PM +0200, Thomas Hellström (VMware) wrote:
>> On 8/21/19 8:11 PM, Daniel Vetter wrote:
>>> On Wed, Aug 21, 2019 at 7:06 PM Thomas Hellström (VMware)
>>> <thomas_os@shipmail.org> wrote:
>>>> On 8/21/19 6:34 PM, Daniel Vetter wrote:
>>>>> On Wed, Aug 21, 2019 at 05:54:27PM +0200, Thomas Hellström (VMware) wrote:
>>>>>> On 8/20/19 4:53 PM, Daniel Vetter wrote:
>>>>>>> Full audit of everyone:
>>>>>>>
>>>>>>> - i915, radeon, amdgpu should be clean per their maintainers.
>>>>>>>
>>>>>>> - vram helpers should be fine, they don't do command submission, so
>>>>>>>       really no business holding struct_mutex while doing copy_*_user. But
>>>>>>>       I haven't checked them all.
>>>>>>>
>>>>>>> - panfrost seems to dma_resv_lock only in panfrost_job_push, which
>>>>>>>       looks clean.
>>>>>>>
>>>>>>> - v3d holds dma_resv locks in the tail of its v3d_submit_cl_ioctl(),
>>>>>>>       copying from/to userspace happens all in v3d_lookup_bos which is
>>>>>>>       outside of the critical section.
>>>>>>>
>>>>>>> - vmwgfx has a bunch of ioctls that do their own copy_*_user:
>>>>>>>       - vmw_execbuf_process: First this does some copies in
>>>>>>>         vmw_execbuf_cmdbuf() and also in the vmw_execbuf_process() itself.
>>>>>>>         Then comes the usual ttm reserve/validate sequence, then actual
>>>>>>>         submission/fencing, then unreserving, and finally some more
>>>>>>>         copy_to_user in vmw_execbuf_copy_fence_user. Glossing over tons of
>>>>>>>         details, but looks all safe.
>>>>>>>       - vmw_fence_event_ioctl: No ttm_reserve/dma_resv_lock anywhere to be
>>>>>>>         seen, seems to only create a fence and copy it out.
>>>>>>>       - a pile of smaller ioctl in vmwgfx_ioctl.c, no reservations to be
>>>>>>>         found there.
>>>>>>>       Summary: vmwgfx seems to be fine too.
>>>>>>>
>>>>>>> - virtio: There's virtio_gpu_execbuffer_ioctl, which does all the
>>>>>>>       copying from userspace before even looking up objects through their
>>>>>>>       handles, so safe. Plus the getparam/getcaps ioctl, also both safe.
>>>>>>>
>>>>>>> - qxl only has qxl_execbuffer_ioctl, which calls into
>>>>>>>       qxl_process_single_command. There's a lovely comment before the
>>>>>>>       __copy_from_user_inatomic that the slowpath should be copied from
>>>>>>>       i915, but I guess that never happened. Try not to be unlucky and get
>>>>>>>       your CS data evicted between when it's written and the kernel tries
>>>>>>>       to read it. The only other copy_from_user is for relocs, but those
>>>>>>>       are done before qxl_release_reserve_list(), which seems to be the
>>>>>>>       only thing reserving buffers (in the ttm/dma_resv sense) in that
>>>>>>>       code. So looks safe.
>>>>>>>
>>>>>>> - A debugfs file in nouveau_debugfs_pstate_set() and the usif ioctl in
>>>>>>>       usif_ioctl() look safe. nouveau_gem_ioctl_pushbuf() otoh breaks this
>>>>>>>       everywhere and needs to be fixed up.
>>>>>>>
>>>>>>> Cc: Alex Deucher <alexander.deucher@amd.com>
>>>>>>> Cc: Christian König <christian.koenig@amd.com>
>>>>>>> Cc: Chris Wilson <chris@chris-wilson.co.uk>
>>>>>>> Cc: Thomas Zimmermann <tzimmermann@suse.de>
>>>>>>> Cc: Rob Herring <robh@kernel.org>
>>>>>>> Cc: Tomeu Vizoso <tomeu.vizoso@collabora.com>
>>>>>>> Cc: Eric Anholt <eric@anholt.net>
>>>>>>> Cc: Dave Airlie <airlied@redhat.com>
>>>>>>> Cc: Gerd Hoffmann <kraxel@redhat.com>
>>>>>>> Cc: Ben Skeggs <bskeggs@redhat.com>
>>>>>>> Cc: "VMware Graphics" <linux-graphics-maintainer@vmware.com>
>>>>>>> Cc: Thomas Hellstrom <thellstrom@vmware.com>
>>>>>>> Signed-off-by: Daniel Vetter <daniel.vetter@intel.com>
>>>>>>> ---
>>>>>>>      drivers/dma-buf/dma-resv.c | 12 ++++++++++++
>>>>>>>      1 file changed, 12 insertions(+)
>>>>>>>
>>>>>>> diff --git a/drivers/dma-buf/dma-resv.c b/drivers/dma-buf/dma-resv.c
>>>>>>> index 42a8f3f11681..3edca10d3faf 100644
>>>>>>> --- a/drivers/dma-buf/dma-resv.c
>>>>>>> +++ b/drivers/dma-buf/dma-resv.c
>>>>>>> @@ -34,6 +34,7 @@
>>>>>>>      #include <linux/dma-resv.h>
>>>>>>>      #include <linux/export.h>
>>>>>>> +#include <linux/sched/mm.h>
>>>>>>>      /**
>>>>>>>       * DOC: Reservation Object Overview
>>>>>>> @@ -107,6 +108,17 @@ void dma_resv_init(struct dma_resv *obj)
>>>>>>>                       &reservation_seqcount_class);
>>>>>>>       RCU_INIT_POINTER(obj->fence, NULL);
>>>>>>>       RCU_INIT_POINTER(obj->fence_excl, NULL);
>>>>>>> +
>>>>>>> +   if (IS_ENABLED(CONFIG_LOCKDEP)) {
>>>>>>> +           if (current->mm)
>>>>>>> +                   down_read(&current->mm->mmap_sem);
>>>>>>> +           ww_mutex_lock(&obj->lock, NULL);
>>>>>>> +           fs_reclaim_acquire(GFP_KERNEL);
>>>>>>> +           fs_reclaim_release(GFP_KERNEL);
>>>>>>> +           ww_mutex_unlock(&obj->lock);
>>>>>>> +           if (current->mm)
>>>>>>> +                   up_read(&current->mm->mmap_sem);
>>>>>>> +   }
>>>>>>>      }
>>>>>>>      EXPORT_SYMBOL(dma_resv_init);
>>>>>> I assume if this would have been easily done and maintainable using only
>>>>>> lockdep annotation instead of actually acquiring the locks, that would have
>>>>>> been done?
>>>>> There's might_lock(), plus a pile of macros, but they don't map obviuosly,
>>>>> so pretty good chances I accidentally end up with the wrong type of
>>>>> annotation. Easier to just take the locks quickly, and stuff that all into
>>>>> a lockdep-only section to avoid overhead.
>>>>>
>>>>>> Otherwise LGTM.
>>>>>>
>>>>>> Reviewed-by: Thomas Hellström <thellstrom@vmware.com>
>>>>>>
>>>>>> Will test this and let you know if it trips on vmwgfx, but it really
>>>>>> shouldn't.
>>>>> Thanks, Daniel
>>>> One thing that strikes me is that this puts restrictions on where you
>>>> can actually initialize a dma_resv, even if locking orders are otherwise
>>>> obeyed. But that might not be a big problem.
>>> Hm yeah ... the trouble is a need a non-kthread thread so that I have
>>> a current->mm. Otherwise I'd have put it into some init section with a
>>> temp dma_buf. And I kinda don't want to create a fake ->mm just for
>>> lockdep priming. I don't expect this to be a real problem in practice,
>>> since before you've called dma_resv_init the reservation lock doesn't
>>> exist, so you can't hold it. And you've probably just allocated it, so
>>> fs_reclaim is going to be fine. And if you allocate dma_resv objects
>>> from your fault handlers I have questions anyway :-)
>> Coming to think of it, I think vmwgfx sometimes create bos with other bo's
>> reservation lock held. I guess that would trip both the mmap_sem check the
>> ww_mutex check?
> If you do that, yes we're busted. Do you do that?

Yes, we do, in a couple of places it seems, and it also appears like TTM 
is doing it according to Christian.

>
> I guess needs a new idea for where to put this ... while making sure
> everyone gets it. So some evil trick like putting it in drm_open() won't
> work, since I also want to make sure everyone else using dma-buf follows
> these rules.

IMO it should be sufficient to establish this locking order once, but I 
guess dma-buf module init time won't work because we might not have an 
mm structure?

/Thomas

>
> Ideas?
> -Daniel


_______________________________________________
dri-devel mailing list
dri-devel@lists.freedesktop.org
https://lists.freedesktop.org/mailman/listinfo/dri-devel

Re: [PATCH 1/3] dma_resv: prime lockdep annotations

[Daniel Vetter]

On Thu, Aug 22, 2019 at 8:42 AM Thomas Hellström (VMware)
<thomas_os@shipmail.org> wrote:
>
> On 8/21/19 9:51 PM, Daniel Vetter wrote:
> > On Wed, Aug 21, 2019 at 08:27:59PM +0200, Thomas Hellström (VMware) wrote:
> >> On 8/21/19 8:11 PM, Daniel Vetter wrote:
> >>> On Wed, Aug 21, 2019 at 7:06 PM Thomas Hellström (VMware)
> >>> <thomas_os@shipmail.org> wrote:
> >>>> On 8/21/19 6:34 PM, Daniel Vetter wrote:
> >>>>> On Wed, Aug 21, 2019 at 05:54:27PM +0200, Thomas Hellström (VMware) wrote:
> >>>>>> On 8/20/19 4:53 PM, Daniel Vetter wrote:
> >>>>>>> Full audit of everyone:
> >>>>>>>
> >>>>>>> - i915, radeon, amdgpu should be clean per their maintainers.
> >>>>>>>
> >>>>>>> - vram helpers should be fine, they don't do command submission, so
> >>>>>>>       really no business holding struct_mutex while doing copy_*_user. But
> >>>>>>>       I haven't checked them all.
> >>>>>>>
> >>>>>>> - panfrost seems to dma_resv_lock only in panfrost_job_push, which
> >>>>>>>       looks clean.
> >>>>>>>
> >>>>>>> - v3d holds dma_resv locks in the tail of its v3d_submit_cl_ioctl(),
> >>>>>>>       copying from/to userspace happens all in v3d_lookup_bos which is
> >>>>>>>       outside of the critical section.
> >>>>>>>
> >>>>>>> - vmwgfx has a bunch of ioctls that do their own copy_*_user:
> >>>>>>>       - vmw_execbuf_process: First this does some copies in
> >>>>>>>         vmw_execbuf_cmdbuf() and also in the vmw_execbuf_process() itself.
> >>>>>>>         Then comes the usual ttm reserve/validate sequence, then actual
> >>>>>>>         submission/fencing, then unreserving, and finally some more
> >>>>>>>         copy_to_user in vmw_execbuf_copy_fence_user. Glossing over tons of
> >>>>>>>         details, but looks all safe.
> >>>>>>>       - vmw_fence_event_ioctl: No ttm_reserve/dma_resv_lock anywhere to be
> >>>>>>>         seen, seems to only create a fence and copy it out.
> >>>>>>>       - a pile of smaller ioctl in vmwgfx_ioctl.c, no reservations to be
> >>>>>>>         found there.
> >>>>>>>       Summary: vmwgfx seems to be fine too.
> >>>>>>>
> >>>>>>> - virtio: There's virtio_gpu_execbuffer_ioctl, which does all the
> >>>>>>>       copying from userspace before even looking up objects through their
> >>>>>>>       handles, so safe. Plus the getparam/getcaps ioctl, also both safe.
> >>>>>>>
> >>>>>>> - qxl only has qxl_execbuffer_ioctl, which calls into
> >>>>>>>       qxl_process_single_command. There's a lovely comment before the
> >>>>>>>       __copy_from_user_inatomic that the slowpath should be copied from
> >>>>>>>       i915, but I guess that never happened. Try not to be unlucky and get
> >>>>>>>       your CS data evicted between when it's written and the kernel tries
> >>>>>>>       to read it. The only other copy_from_user is for relocs, but those
> >>>>>>>       are done before qxl_release_reserve_list(), which seems to be the
> >>>>>>>       only thing reserving buffers (in the ttm/dma_resv sense) in that
> >>>>>>>       code. So looks safe.
> >>>>>>>
> >>>>>>> - A debugfs file in nouveau_debugfs_pstate_set() and the usif ioctl in
> >>>>>>>       usif_ioctl() look safe. nouveau_gem_ioctl_pushbuf() otoh breaks this
> >>>>>>>       everywhere and needs to be fixed up.
> >>>>>>>
> >>>>>>> Cc: Alex Deucher <alexander.deucher@amd.com>
> >>>>>>> Cc: Christian König <christian.koenig@amd.com>
> >>>>>>> Cc: Chris Wilson <chris@chris-wilson.co.uk>
> >>>>>>> Cc: Thomas Zimmermann <tzimmermann@suse.de>
> >>>>>>> Cc: Rob Herring <robh@kernel.org>
> >>>>>>> Cc: Tomeu Vizoso <tomeu.vizoso@collabora.com>
> >>>>>>> Cc: Eric Anholt <eric@anholt.net>
> >>>>>>> Cc: Dave Airlie <airlied@redhat.com>
> >>>>>>> Cc: Gerd Hoffmann <kraxel@redhat.com>
> >>>>>>> Cc: Ben Skeggs <bskeggs@redhat.com>
> >>>>>>> Cc: "VMware Graphics" <linux-graphics-maintainer@vmware.com>
> >>>>>>> Cc: Thomas Hellstrom <thellstrom@vmware.com>
> >>>>>>> Signed-off-by: Daniel Vetter <daniel.vetter@intel.com>
> >>>>>>> ---
> >>>>>>>      drivers/dma-buf/dma-resv.c | 12 ++++++++++++
> >>>>>>>      1 file changed, 12 insertions(+)
> >>>>>>>
> >>>>>>> diff --git a/drivers/dma-buf/dma-resv.c b/drivers/dma-buf/dma-resv.c
> >>>>>>> index 42a8f3f11681..3edca10d3faf 100644
> >>>>>>> --- a/drivers/dma-buf/dma-resv.c
> >>>>>>> +++ b/drivers/dma-buf/dma-resv.c
> >>>>>>> @@ -34,6 +34,7 @@
> >>>>>>>      #include <linux/dma-resv.h>
> >>>>>>>      #include <linux/export.h>
> >>>>>>> +#include <linux/sched/mm.h>
> >>>>>>>      /**
> >>>>>>>       * DOC: Reservation Object Overview
> >>>>>>> @@ -107,6 +108,17 @@ void dma_resv_init(struct dma_resv *obj)
> >>>>>>>                       &reservation_seqcount_class);
> >>>>>>>       RCU_INIT_POINTER(obj->fence, NULL);
> >>>>>>>       RCU_INIT_POINTER(obj->fence_excl, NULL);
> >>>>>>> +
> >>>>>>> +   if (IS_ENABLED(CONFIG_LOCKDEP)) {
> >>>>>>> +           if (current->mm)
> >>>>>>> +                   down_read(&current->mm->mmap_sem);
> >>>>>>> +           ww_mutex_lock(&obj->lock, NULL);
> >>>>>>> +           fs_reclaim_acquire(GFP_KERNEL);
> >>>>>>> +           fs_reclaim_release(GFP_KERNEL);
> >>>>>>> +           ww_mutex_unlock(&obj->lock);
> >>>>>>> +           if (current->mm)
> >>>>>>> +                   up_read(&current->mm->mmap_sem);
> >>>>>>> +   }
> >>>>>>>      }
> >>>>>>>      EXPORT_SYMBOL(dma_resv_init);
> >>>>>> I assume if this would have been easily done and maintainable using only
> >>>>>> lockdep annotation instead of actually acquiring the locks, that would have
> >>>>>> been done?
> >>>>> There's might_lock(), plus a pile of macros, but they don't map obviuosly,
> >>>>> so pretty good chances I accidentally end up with the wrong type of
> >>>>> annotation. Easier to just take the locks quickly, and stuff that all into
> >>>>> a lockdep-only section to avoid overhead.
> >>>>>
> >>>>>> Otherwise LGTM.
> >>>>>>
> >>>>>> Reviewed-by: Thomas Hellström <thellstrom@vmware.com>
> >>>>>>
> >>>>>> Will test this and let you know if it trips on vmwgfx, but it really
> >>>>>> shouldn't.
> >>>>> Thanks, Daniel
> >>>> One thing that strikes me is that this puts restrictions on where you
> >>>> can actually initialize a dma_resv, even if locking orders are otherwise
> >>>> obeyed. But that might not be a big problem.
> >>> Hm yeah ... the trouble is a need a non-kthread thread so that I have
> >>> a current->mm. Otherwise I'd have put it into some init section with a
> >>> temp dma_buf. And I kinda don't want to create a fake ->mm just for
> >>> lockdep priming. I don't expect this to be a real problem in practice,
> >>> since before you've called dma_resv_init the reservation lock doesn't
> >>> exist, so you can't hold it. And you've probably just allocated it, so
> >>> fs_reclaim is going to be fine. And if you allocate dma_resv objects
> >>> from your fault handlers I have questions anyway :-)
> >> Coming to think of it, I think vmwgfx sometimes create bos with other bo's
> >> reservation lock held. I guess that would trip both the mmap_sem check the
> >> ww_mutex check?
> > If you do that, yes we're busted. Do you do that?
>
> Yes, we do, in a couple of places it seems, and it also appears like TTM
> is doing it according to Christian.
>
> >
> > I guess needs a new idea for where to put this ... while making sure
> > everyone gets it. So some evil trick like putting it in drm_open() won't
> > work, since I also want to make sure everyone else using dma-buf follows
> > these rules.
>
> IMO it should be sufficient to establish this locking order once, but I
> guess dma-buf module init time won't work because we might not have an
> mm structure?

mm_alloc() is a thing as Chris pointed out, and it works. v3 on its way.
-Daniel
--
Daniel Vetter
Software Engineer, Intel Corporation
+41 (0) 79 365 57 48 - http://blog.ffwll.ch
_______________________________________________
Intel-gfx mailing list
Intel-gfx@lists.freedesktop.org
https://lists.freedesktop.org/mailman/listinfo/intel-gfx

Re: [PATCH 1/3] dma_resv: prime lockdep annotations

[Daniel Vetter]

On Thu, Nov 14, 2019 at 11:50:28AM +0000, Steven Price wrote:
> On 11/11/2019 15:42, Daniel Vetter wrote:
> > On Mon, Nov 11, 2019 at 2:11 PM Steven Price <steven.price@arm.com> wrote:
> >>
> >> On 04/11/2019 17:37, Daniel Vetter wrote:
> >>> Full audit of everyone:
> >>>
> >>> - i915, radeon, amdgpu should be clean per their maintainers.
> >>>
> >>> - vram helpers should be fine, they don't do command submission, so
> >>>   really no business holding struct_mutex while doing copy_*_user. But
> >>>   I haven't checked them all.
> >>>
> >>> - panfrost seems to dma_resv_lock only in panfrost_job_push, which
> >>>   looks clean.
> >>>
> >>> - v3d holds dma_resv locks in the tail of its v3d_submit_cl_ioctl(),
> >>>   copying from/to userspace happens all in v3d_lookup_bos which is
> >>>   outside of the critical section.
> >>>
> >>> - vmwgfx has a bunch of ioctls that do their own copy_*_user:
> >>>   - vmw_execbuf_process: First this does some copies in
> >>>     vmw_execbuf_cmdbuf() and also in the vmw_execbuf_process() itself.
> >>>     Then comes the usual ttm reserve/validate sequence, then actual
> >>>     submission/fencing, then unreserving, and finally some more
> >>>     copy_to_user in vmw_execbuf_copy_fence_user. Glossing over tons of
> >>>     details, but looks all safe.
> >>>   - vmw_fence_event_ioctl: No ttm_reserve/dma_resv_lock anywhere to be
> >>>     seen, seems to only create a fence and copy it out.
> >>>   - a pile of smaller ioctl in vmwgfx_ioctl.c, no reservations to be
> >>>     found there.
> >>>   Summary: vmwgfx seems to be fine too.
> >>>
> >>> - virtio: There's virtio_gpu_execbuffer_ioctl, which does all the
> >>>   copying from userspace before even looking up objects through their
> >>>   handles, so safe. Plus the getparam/getcaps ioctl, also both safe.
> >>>
> >>> - qxl only has qxl_execbuffer_ioctl, which calls into
> >>>   qxl_process_single_command. There's a lovely comment before the
> >>>   __copy_from_user_inatomic that the slowpath should be copied from
> >>>   i915, but I guess that never happened. Try not to be unlucky and get
> >>>   your CS data evicted between when it's written and the kernel tries
> >>>   to read it. The only other copy_from_user is for relocs, but those
> >>>   are done before qxl_release_reserve_list(), which seems to be the
> >>>   only thing reserving buffers (in the ttm/dma_resv sense) in that
> >>>   code. So looks safe.
> >>>
> >>> - A debugfs file in nouveau_debugfs_pstate_set() and the usif ioctl in
> >>>   usif_ioctl() look safe. nouveau_gem_ioctl_pushbuf() otoh breaks this
> >>>   everywhere and needs to be fixed up.
> >>>
> >>> v2: Thomas pointed at that vmwgfx calls dma_resv_init while it holds a
> >>> dma_resv lock of a different object already. Christian mentioned that
> >>> ttm core does this too for ghost objects. intel-gfx-ci highlighted
> >>> that i915 has similar issues.
> >>>
> >>> Unfortunately we can't do this in the usual module init functions,
> >>> because kernel threads don't have an ->mm - we have to wait around for
> >>> some user thread to do this.
> >>>
> >>> Solution is to spawn a worker (but only once). It's horrible, but it
> >>> works.
> >>>
> >>> v3: We can allocate mm! (Chris). Horrible worker hack out, clean
> >>> initcall solution in.
> >>>
> >>> v4: Annotate with __init (Rob Herring)
> >>>
> >>> Cc: Rob Herring <robh@kernel.org>
> >>> Cc: Alex Deucher <alexander.deucher@amd.com>
> >>> Cc: Christian König <christian.koenig@amd.com>
> >>> Cc: Chris Wilson <chris@chris-wilson.co.uk>
> >>> Cc: Thomas Zimmermann <tzimmermann@suse.de>
> >>> Cc: Rob Herring <robh@kernel.org>
> >>> Cc: Tomeu Vizoso <tomeu.vizoso@collabora.com>
> >>> Cc: Eric Anholt <eric@anholt.net>
> >>> Cc: Dave Airlie <airlied@redhat.com>
> >>> Cc: Gerd Hoffmann <kraxel@redhat.com>
> >>> Cc: Ben Skeggs <bskeggs@redhat.com>
> >>> Cc: "VMware Graphics" <linux-graphics-maintainer@vmware.com>
> >>> Cc: Thomas Hellstrom <thellstrom@vmware.com>
> >>> Reviewed-by: Christian König <christian.koenig@amd.com>
> >>> Reviewed-by: Chris Wilson <chris@chris-wilson.co.uk>
> >>> Tested-by: Chris Wilson <chris@chris-wilson.co.uk>
> >>> Signed-off-by: Daniel Vetter <daniel.vetter@intel.com>
> >>> ---
> >>>  drivers/dma-buf/dma-resv.c | 24 ++++++++++++++++++++++++
> >>>  1 file changed, 24 insertions(+)
> >>>
> >>> diff --git a/drivers/dma-buf/dma-resv.c b/drivers/dma-buf/dma-resv.c
> >>> index 709002515550..a05ff542be22 100644
> >>> --- a/drivers/dma-buf/dma-resv.c
> >>> +++ b/drivers/dma-buf/dma-resv.c
> >>> @@ -34,6 +34,7 @@
> >>>
> >>>  #include <linux/dma-resv.h>
> >>>  #include <linux/export.h>
> >>> +#include <linux/sched/mm.h>
> >>>
> >>>  /**
> >>>   * DOC: Reservation Object Overview
> >>> @@ -95,6 +96,29 @@ static void dma_resv_list_free(struct dma_resv_list *list)
> >>>       kfree_rcu(list, rcu);
> >>>  }
> >>>
> >>> +#if IS_ENABLED(CONFIG_LOCKDEP)
> >>> +static void __init dma_resv_lockdep(void)
> >>> +{
> >>> +     struct mm_struct *mm = mm_alloc();
> >>> +     struct dma_resv obj;
> >>> +
> >>> +     if (!mm)
> >>> +             return;
> >>> +
> >>> +     dma_resv_init(&obj);
> >>> +
> >>> +     down_read(&mm->mmap_sem);
> >>> +     ww_mutex_lock(&obj.lock, NULL);
> >>> +     fs_reclaim_acquire(GFP_KERNEL);
> >>> +     fs_reclaim_release(GFP_KERNEL);
> >>> +     ww_mutex_unlock(&obj.lock);
> >>> +     up_read(&mm->mmap_sem);
> >>> +
> >>
> >> Nit: trailing whitespace
> >>
> >>> +     mmput(mm);
> >>> +}
> >>> +subsys_initcall(dma_resv_lockdep);
> >>
> >> This expects a function returning int, but dma_resv_lockdep() is void.
> >> Causing:
> >>
> >> drivers/dma-buf/dma-resv.c:119:17: error: initialization of ‘initcall_t’
> >> {aka ‘int (*)(void)’} from incompatible pointer type ‘void (*)(void)’
> >> [-Werror=incompatible-pointer-types]
> >>  subsys_initcall(dma_resv_lockdep);
> >>
> >> The below fixes it for me.
> > 
> > Uh, so _that_ was what the 0day thing was all about, I totally misread
> > that completely. Thanks for the patch.
> > 
> > Reviewed-by: Daniel Vetter <daniel.vetter@ffwll.ch>
> > 
> > Aside, do you need commit rights for pushing this kind of stuff?
> 
> I guess it's about time I got round to requesting that:
> 
> https://gitlab.freedesktop.org/freedesktop/freedesktop/issues/208

Since this seems a bit stuck in processing I went ahead and merged your
fix meanwhile.

Thanks, Daniel
-- 
Daniel Vetter
Software Engineer, Intel Corporation
http://blog.ffwll.ch
_______________________________________________
dri-devel mailing list
dri-devel@lists.freedesktop.org
https://lists.freedesktop.org/mailman/listinfo/dri-devel

Re: [PATCH 1/3] dma_resv: prime lockdep annotations

[Steven Price]

On 11/11/2019 15:42, Daniel Vetter wrote:
> On Mon, Nov 11, 2019 at 2:11 PM Steven Price <steven.price@arm.com> wrote:
>>
>> On 04/11/2019 17:37, Daniel Vetter wrote:
>>> Full audit of everyone:
>>>
>>> - i915, radeon, amdgpu should be clean per their maintainers.
>>>
>>> - vram helpers should be fine, they don't do command submission, so
>>>   really no business holding struct_mutex while doing copy_*_user. But
>>>   I haven't checked them all.
>>>
>>> - panfrost seems to dma_resv_lock only in panfrost_job_push, which
>>>   looks clean.
>>>
>>> - v3d holds dma_resv locks in the tail of its v3d_submit_cl_ioctl(),
>>>   copying from/to userspace happens all in v3d_lookup_bos which is
>>>   outside of the critical section.
>>>
>>> - vmwgfx has a bunch of ioctls that do their own copy_*_user:
>>>   - vmw_execbuf_process: First this does some copies in
>>>     vmw_execbuf_cmdbuf() and also in the vmw_execbuf_process() itself.
>>>     Then comes the usual ttm reserve/validate sequence, then actual
>>>     submission/fencing, then unreserving, and finally some more
>>>     copy_to_user in vmw_execbuf_copy_fence_user. Glossing over tons of
>>>     details, but looks all safe.
>>>   - vmw_fence_event_ioctl: No ttm_reserve/dma_resv_lock anywhere to be
>>>     seen, seems to only create a fence and copy it out.
>>>   - a pile of smaller ioctl in vmwgfx_ioctl.c, no reservations to be
>>>     found there.
>>>   Summary: vmwgfx seems to be fine too.
>>>
>>> - virtio: There's virtio_gpu_execbuffer_ioctl, which does all the
>>>   copying from userspace before even looking up objects through their
>>>   handles, so safe. Plus the getparam/getcaps ioctl, also both safe.
>>>
>>> - qxl only has qxl_execbuffer_ioctl, which calls into
>>>   qxl_process_single_command. There's a lovely comment before the
>>>   __copy_from_user_inatomic that the slowpath should be copied from
>>>   i915, but I guess that never happened. Try not to be unlucky and get
>>>   your CS data evicted between when it's written and the kernel tries
>>>   to read it. The only other copy_from_user is for relocs, but those
>>>   are done before qxl_release_reserve_list(), which seems to be the
>>>   only thing reserving buffers (in the ttm/dma_resv sense) in that
>>>   code. So looks safe.
>>>
>>> - A debugfs file in nouveau_debugfs_pstate_set() and the usif ioctl in
>>>   usif_ioctl() look safe. nouveau_gem_ioctl_pushbuf() otoh breaks this
>>>   everywhere and needs to be fixed up.
>>>
>>> v2: Thomas pointed at that vmwgfx calls dma_resv_init while it holds a
>>> dma_resv lock of a different object already. Christian mentioned that
>>> ttm core does this too for ghost objects. intel-gfx-ci highlighted
>>> that i915 has similar issues.
>>>
>>> Unfortunately we can't do this in the usual module init functions,
>>> because kernel threads don't have an ->mm - we have to wait around for
>>> some user thread to do this.
>>>
>>> Solution is to spawn a worker (but only once). It's horrible, but it
>>> works.
>>>
>>> v3: We can allocate mm! (Chris). Horrible worker hack out, clean
>>> initcall solution in.
>>>
>>> v4: Annotate with __init (Rob Herring)
>>>
>>> Cc: Rob Herring <robh@kernel.org>
>>> Cc: Alex Deucher <alexander.deucher@amd.com>
>>> Cc: Christian König <christian.koenig@amd.com>
>>> Cc: Chris Wilson <chris@chris-wilson.co.uk>
>>> Cc: Thomas Zimmermann <tzimmermann@suse.de>
>>> Cc: Rob Herring <robh@kernel.org>
>>> Cc: Tomeu Vizoso <tomeu.vizoso@collabora.com>
>>> Cc: Eric Anholt <eric@anholt.net>
>>> Cc: Dave Airlie <airlied@redhat.com>
>>> Cc: Gerd Hoffmann <kraxel@redhat.com>
>>> Cc: Ben Skeggs <bskeggs@redhat.com>
>>> Cc: "VMware Graphics" <linux-graphics-maintainer@vmware.com>
>>> Cc: Thomas Hellstrom <thellstrom@vmware.com>
>>> Reviewed-by: Christian König <christian.koenig@amd.com>
>>> Reviewed-by: Chris Wilson <chris@chris-wilson.co.uk>
>>> Tested-by: Chris Wilson <chris@chris-wilson.co.uk>
>>> Signed-off-by: Daniel Vetter <daniel.vetter@intel.com>
>>> ---
>>>  drivers/dma-buf/dma-resv.c | 24 ++++++++++++++++++++++++
>>>  1 file changed, 24 insertions(+)
>>>
>>> diff --git a/drivers/dma-buf/dma-resv.c b/drivers/dma-buf/dma-resv.c
>>> index 709002515550..a05ff542be22 100644
>>> --- a/drivers/dma-buf/dma-resv.c
>>> +++ b/drivers/dma-buf/dma-resv.c
>>> @@ -34,6 +34,7 @@
>>>
>>>  #include <linux/dma-resv.h>
>>>  #include <linux/export.h>
>>> +#include <linux/sched/mm.h>
>>>
>>>  /**
>>>   * DOC: Reservation Object Overview
>>> @@ -95,6 +96,29 @@ static void dma_resv_list_free(struct dma_resv_list *list)
>>>       kfree_rcu(list, rcu);
>>>  }
>>>
>>> +#if IS_ENABLED(CONFIG_LOCKDEP)
>>> +static void __init dma_resv_lockdep(void)
>>> +{
>>> +     struct mm_struct *mm = mm_alloc();
>>> +     struct dma_resv obj;
>>> +
>>> +     if (!mm)
>>> +             return;
>>> +
>>> +     dma_resv_init(&obj);
>>> +
>>> +     down_read(&mm->mmap_sem);
>>> +     ww_mutex_lock(&obj.lock, NULL);
>>> +     fs_reclaim_acquire(GFP_KERNEL);
>>> +     fs_reclaim_release(GFP_KERNEL);
>>> +     ww_mutex_unlock(&obj.lock);
>>> +     up_read(&mm->mmap_sem);
>>> +
>>
>> Nit: trailing whitespace
>>
>>> +     mmput(mm);
>>> +}
>>> +subsys_initcall(dma_resv_lockdep);
>>
>> This expects a function returning int, but dma_resv_lockdep() is void.
>> Causing:
>>
>> drivers/dma-buf/dma-resv.c:119:17: error: initialization of ‘initcall_t’
>> {aka ‘int (*)(void)’} from incompatible pointer type ‘void (*)(void)’
>> [-Werror=incompatible-pointer-types]
>>  subsys_initcall(dma_resv_lockdep);
>>
>> The below fixes it for me.
> 
> Uh, so _that_ was what the 0day thing was all about, I totally misread
> that completely. Thanks for the patch.
> 
> Reviewed-by: Daniel Vetter <daniel.vetter@ffwll.ch>
> 
> Aside, do you need commit rights for pushing this kind of stuff?

I guess it's about time I got round to requesting that:

https://gitlab.freedesktop.org/freedesktop/freedesktop/issues/208

Thanks,

Steve
_______________________________________________
Intel-gfx mailing list
Intel-gfx@lists.freedesktop.org
https://lists.freedesktop.org/mailman/listinfo/intel-gfx

Re: [PATCH 1/3] dma_resv: prime lockdep annotations

[Steven Price]

On 11/11/2019 15:42, Daniel Vetter wrote:
> On Mon, Nov 11, 2019 at 2:11 PM Steven Price <steven.price@arm.com> wrote:
>>
>> On 04/11/2019 17:37, Daniel Vetter wrote:
>>> Full audit of everyone:
>>>
>>> - i915, radeon, amdgpu should be clean per their maintainers.
>>>
>>> - vram helpers should be fine, they don't do command submission, so
>>>   really no business holding struct_mutex while doing copy_*_user. But
>>>   I haven't checked them all.
>>>
>>> - panfrost seems to dma_resv_lock only in panfrost_job_push, which
>>>   looks clean.
>>>
>>> - v3d holds dma_resv locks in the tail of its v3d_submit_cl_ioctl(),
>>>   copying from/to userspace happens all in v3d_lookup_bos which is
>>>   outside of the critical section.
>>>
>>> - vmwgfx has a bunch of ioctls that do their own copy_*_user:
>>>   - vmw_execbuf_process: First this does some copies in
>>>     vmw_execbuf_cmdbuf() and also in the vmw_execbuf_process() itself.
>>>     Then comes the usual ttm reserve/validate sequence, then actual
>>>     submission/fencing, then unreserving, and finally some more
>>>     copy_to_user in vmw_execbuf_copy_fence_user. Glossing over tons of
>>>     details, but looks all safe.
>>>   - vmw_fence_event_ioctl: No ttm_reserve/dma_resv_lock anywhere to be
>>>     seen, seems to only create a fence and copy it out.
>>>   - a pile of smaller ioctl in vmwgfx_ioctl.c, no reservations to be
>>>     found there.
>>>   Summary: vmwgfx seems to be fine too.
>>>
>>> - virtio: There's virtio_gpu_execbuffer_ioctl, which does all the
>>>   copying from userspace before even looking up objects through their
>>>   handles, so safe. Plus the getparam/getcaps ioctl, also both safe.
>>>
>>> - qxl only has qxl_execbuffer_ioctl, which calls into
>>>   qxl_process_single_command. There's a lovely comment before the
>>>   __copy_from_user_inatomic that the slowpath should be copied from
>>>   i915, but I guess that never happened. Try not to be unlucky and get
>>>   your CS data evicted between when it's written and the kernel tries
>>>   to read it. The only other copy_from_user is for relocs, but those
>>>   are done before qxl_release_reserve_list(), which seems to be the
>>>   only thing reserving buffers (in the ttm/dma_resv sense) in that
>>>   code. So looks safe.
>>>
>>> - A debugfs file in nouveau_debugfs_pstate_set() and the usif ioctl in
>>>   usif_ioctl() look safe. nouveau_gem_ioctl_pushbuf() otoh breaks this
>>>   everywhere and needs to be fixed up.
>>>
>>> v2: Thomas pointed at that vmwgfx calls dma_resv_init while it holds a
>>> dma_resv lock of a different object already. Christian mentioned that
>>> ttm core does this too for ghost objects. intel-gfx-ci highlighted
>>> that i915 has similar issues.
>>>
>>> Unfortunately we can't do this in the usual module init functions,
>>> because kernel threads don't have an ->mm - we have to wait around for
>>> some user thread to do this.
>>>
>>> Solution is to spawn a worker (but only once). It's horrible, but it
>>> works.
>>>
>>> v3: We can allocate mm! (Chris). Horrible worker hack out, clean
>>> initcall solution in.
>>>
>>> v4: Annotate with __init (Rob Herring)
>>>
>>> Cc: Rob Herring <robh@kernel.org>
>>> Cc: Alex Deucher <alexander.deucher@amd.com>
>>> Cc: Christian König <christian.koenig@amd.com>
>>> Cc: Chris Wilson <chris@chris-wilson.co.uk>
>>> Cc: Thomas Zimmermann <tzimmermann@suse.de>
>>> Cc: Rob Herring <robh@kernel.org>
>>> Cc: Tomeu Vizoso <tomeu.vizoso@collabora.com>
>>> Cc: Eric Anholt <eric@anholt.net>
>>> Cc: Dave Airlie <airlied@redhat.com>
>>> Cc: Gerd Hoffmann <kraxel@redhat.com>
>>> Cc: Ben Skeggs <bskeggs@redhat.com>
>>> Cc: "VMware Graphics" <linux-graphics-maintainer@vmware.com>
>>> Cc: Thomas Hellstrom <thellstrom@vmware.com>
>>> Reviewed-by: Christian König <christian.koenig@amd.com>
>>> Reviewed-by: Chris Wilson <chris@chris-wilson.co.uk>
>>> Tested-by: Chris Wilson <chris@chris-wilson.co.uk>
>>> Signed-off-by: Daniel Vetter <daniel.vetter@intel.com>
>>> ---
>>>  drivers/dma-buf/dma-resv.c | 24 ++++++++++++++++++++++++
>>>  1 file changed, 24 insertions(+)
>>>
>>> diff --git a/drivers/dma-buf/dma-resv.c b/drivers/dma-buf/dma-resv.c
>>> index 709002515550..a05ff542be22 100644
>>> --- a/drivers/dma-buf/dma-resv.c
>>> +++ b/drivers/dma-buf/dma-resv.c
>>> @@ -34,6 +34,7 @@
>>>
>>>  #include <linux/dma-resv.h>
>>>  #include <linux/export.h>
>>> +#include <linux/sched/mm.h>
>>>
>>>  /**
>>>   * DOC: Reservation Object Overview
>>> @@ -95,6 +96,29 @@ static void dma_resv_list_free(struct dma_resv_list *list)
>>>       kfree_rcu(list, rcu);
>>>  }
>>>
>>> +#if IS_ENABLED(CONFIG_LOCKDEP)
>>> +static void __init dma_resv_lockdep(void)
>>> +{
>>> +     struct mm_struct *mm = mm_alloc();
>>> +     struct dma_resv obj;
>>> +
>>> +     if (!mm)
>>> +             return;
>>> +
>>> +     dma_resv_init(&obj);
>>> +
>>> +     down_read(&mm->mmap_sem);
>>> +     ww_mutex_lock(&obj.lock, NULL);
>>> +     fs_reclaim_acquire(GFP_KERNEL);
>>> +     fs_reclaim_release(GFP_KERNEL);
>>> +     ww_mutex_unlock(&obj.lock);
>>> +     up_read(&mm->mmap_sem);
>>> +
>>
>> Nit: trailing whitespace
>>
>>> +     mmput(mm);
>>> +}
>>> +subsys_initcall(dma_resv_lockdep);
>>
>> This expects a function returning int, but dma_resv_lockdep() is void.
>> Causing:
>>
>> drivers/dma-buf/dma-resv.c:119:17: error: initialization of ‘initcall_t’
>> {aka ‘int (*)(void)’} from incompatible pointer type ‘void (*)(void)’
>> [-Werror=incompatible-pointer-types]
>>  subsys_initcall(dma_resv_lockdep);
>>
>> The below fixes it for me.
> 
> Uh, so _that_ was what the 0day thing was all about, I totally misread
> that completely. Thanks for the patch.
> 
> Reviewed-by: Daniel Vetter <daniel.vetter@ffwll.ch>
> 
> Aside, do you need commit rights for pushing this kind of stuff?

I guess it's about time I got round to requesting that:

https://gitlab.freedesktop.org/freedesktop/freedesktop/issues/208

Thanks,

Steve
_______________________________________________
dri-devel mailing list
dri-devel@lists.freedesktop.org
https://lists.freedesktop.org/mailman/listinfo/dri-devel

Re: [PATCH 1/3] dma_resv: prime lockdep annotations

[Daniel Vetter]

On Mon, Nov 11, 2019 at 2:11 PM Steven Price <steven.price@arm.com> wrote:
>
> On 04/11/2019 17:37, Daniel Vetter wrote:
> > Full audit of everyone:
> >
> > - i915, radeon, amdgpu should be clean per their maintainers.
> >
> > - vram helpers should be fine, they don't do command submission, so
> >   really no business holding struct_mutex while doing copy_*_user. But
> >   I haven't checked them all.
> >
> > - panfrost seems to dma_resv_lock only in panfrost_job_push, which
> >   looks clean.
> >
> > - v3d holds dma_resv locks in the tail of its v3d_submit_cl_ioctl(),
> >   copying from/to userspace happens all in v3d_lookup_bos which is
> >   outside of the critical section.
> >
> > - vmwgfx has a bunch of ioctls that do their own copy_*_user:
> >   - vmw_execbuf_process: First this does some copies in
> >     vmw_execbuf_cmdbuf() and also in the vmw_execbuf_process() itself.
> >     Then comes the usual ttm reserve/validate sequence, then actual
> >     submission/fencing, then unreserving, and finally some more
> >     copy_to_user in vmw_execbuf_copy_fence_user. Glossing over tons of
> >     details, but looks all safe.
> >   - vmw_fence_event_ioctl: No ttm_reserve/dma_resv_lock anywhere to be
> >     seen, seems to only create a fence and copy it out.
> >   - a pile of smaller ioctl in vmwgfx_ioctl.c, no reservations to be
> >     found there.
> >   Summary: vmwgfx seems to be fine too.
> >
> > - virtio: There's virtio_gpu_execbuffer_ioctl, which does all the
> >   copying from userspace before even looking up objects through their
> >   handles, so safe. Plus the getparam/getcaps ioctl, also both safe.
> >
> > - qxl only has qxl_execbuffer_ioctl, which calls into
> >   qxl_process_single_command. There's a lovely comment before the
> >   __copy_from_user_inatomic that the slowpath should be copied from
> >   i915, but I guess that never happened. Try not to be unlucky and get
> >   your CS data evicted between when it's written and the kernel tries
> >   to read it. The only other copy_from_user is for relocs, but those
> >   are done before qxl_release_reserve_list(), which seems to be the
> >   only thing reserving buffers (in the ttm/dma_resv sense) in that
> >   code. So looks safe.
> >
> > - A debugfs file in nouveau_debugfs_pstate_set() and the usif ioctl in
> >   usif_ioctl() look safe. nouveau_gem_ioctl_pushbuf() otoh breaks this
> >   everywhere and needs to be fixed up.
> >
> > v2: Thomas pointed at that vmwgfx calls dma_resv_init while it holds a
> > dma_resv lock of a different object already. Christian mentioned that
> > ttm core does this too for ghost objects. intel-gfx-ci highlighted
> > that i915 has similar issues.
> >
> > Unfortunately we can't do this in the usual module init functions,
> > because kernel threads don't have an ->mm - we have to wait around for
> > some user thread to do this.
> >
> > Solution is to spawn a worker (but only once). It's horrible, but it
> > works.
> >
> > v3: We can allocate mm! (Chris). Horrible worker hack out, clean
> > initcall solution in.
> >
> > v4: Annotate with __init (Rob Herring)
> >
> > Cc: Rob Herring <robh@kernel.org>
> > Cc: Alex Deucher <alexander.deucher@amd.com>
> > Cc: Christian König <christian.koenig@amd.com>
> > Cc: Chris Wilson <chris@chris-wilson.co.uk>
> > Cc: Thomas Zimmermann <tzimmermann@suse.de>
> > Cc: Rob Herring <robh@kernel.org>
> > Cc: Tomeu Vizoso <tomeu.vizoso@collabora.com>
> > Cc: Eric Anholt <eric@anholt.net>
> > Cc: Dave Airlie <airlied@redhat.com>
> > Cc: Gerd Hoffmann <kraxel@redhat.com>
> > Cc: Ben Skeggs <bskeggs@redhat.com>
> > Cc: "VMware Graphics" <linux-graphics-maintainer@vmware.com>
> > Cc: Thomas Hellstrom <thellstrom@vmware.com>
> > Reviewed-by: Christian König <christian.koenig@amd.com>
> > Reviewed-by: Chris Wilson <chris@chris-wilson.co.uk>
> > Tested-by: Chris Wilson <chris@chris-wilson.co.uk>
> > Signed-off-by: Daniel Vetter <daniel.vetter@intel.com>
> > ---
> >  drivers/dma-buf/dma-resv.c | 24 ++++++++++++++++++++++++
> >  1 file changed, 24 insertions(+)
> >
> > diff --git a/drivers/dma-buf/dma-resv.c b/drivers/dma-buf/dma-resv.c
> > index 709002515550..a05ff542be22 100644
> > --- a/drivers/dma-buf/dma-resv.c
> > +++ b/drivers/dma-buf/dma-resv.c
> > @@ -34,6 +34,7 @@
> >
> >  #include <linux/dma-resv.h>
> >  #include <linux/export.h>
> > +#include <linux/sched/mm.h>
> >
> >  /**
> >   * DOC: Reservation Object Overview
> > @@ -95,6 +96,29 @@ static void dma_resv_list_free(struct dma_resv_list *list)
> >       kfree_rcu(list, rcu);
> >  }
> >
> > +#if IS_ENABLED(CONFIG_LOCKDEP)
> > +static void __init dma_resv_lockdep(void)
> > +{
> > +     struct mm_struct *mm = mm_alloc();
> > +     struct dma_resv obj;
> > +
> > +     if (!mm)
> > +             return;
> > +
> > +     dma_resv_init(&obj);
> > +
> > +     down_read(&mm->mmap_sem);
> > +     ww_mutex_lock(&obj.lock, NULL);
> > +     fs_reclaim_acquire(GFP_KERNEL);
> > +     fs_reclaim_release(GFP_KERNEL);
> > +     ww_mutex_unlock(&obj.lock);
> > +     up_read(&mm->mmap_sem);
> > +
>
> Nit: trailing whitespace
>
> > +     mmput(mm);
> > +}
> > +subsys_initcall(dma_resv_lockdep);
>
> This expects a function returning int, but dma_resv_lockdep() is void.
> Causing:
>
> drivers/dma-buf/dma-resv.c:119:17: error: initialization of ‘initcall_t’
> {aka ‘int (*)(void)’} from incompatible pointer type ‘void (*)(void)’
> [-Werror=incompatible-pointer-types]
>  subsys_initcall(dma_resv_lockdep);
>
> The below fixes it for me.

Uh, so _that_ was what the 0day thing was all about, I totally misread
that completely. Thanks for the patch.

Reviewed-by: Daniel Vetter <daniel.vetter@ffwll.ch>

Aside, do you need commit rights for pushing this kind of stuff?
-Daniel

>
> Steve
>
> ----8<----
> From d07ea81611ed6e4fb8cc290f42d23dbcca2da2f8 Mon Sep 17 00:00:00 2001
> From: Steven Price <steven.price@arm.com>
> Date: Mon, 11 Nov 2019 13:07:19 +0000
> Subject: [PATCH] dma_resv: Correct return type of dma_resv_lockdep()
>
> subsys_initcall() expects a function which returns 'int'. Fix
> dma_resv_lockdep() so it returns an 'int' error code.
>
> Fixes: b2a8116e2592 ("dma_resv: prime lockdep annotations")
> Signed-off-by: Steven Price <steven.price@arm.com>
> ---
>  drivers/dma-buf/dma-resv.c | 6 ++++--
>  1 file changed, 4 insertions(+), 2 deletions(-)
>
> diff --git a/drivers/dma-buf/dma-resv.c b/drivers/dma-buf/dma-resv.c
> index a05ff542be22..9918a6e5cf91 100644
> --- a/drivers/dma-buf/dma-resv.c
> +++ b/drivers/dma-buf/dma-resv.c
> @@ -97,13 +97,13 @@ static void dma_resv_list_free(struct dma_resv_list *list)
>  }
>
>  #if IS_ENABLED(CONFIG_LOCKDEP)
> -static void __init dma_resv_lockdep(void)
> +static int __init dma_resv_lockdep(void)
>  {
>         struct mm_struct *mm = mm_alloc();
>         struct dma_resv obj;
>
>         if (!mm)
> -               return;
> +               return -ENOMEM;
>
>         dma_resv_init(&obj);
>
> @@ -115,6 +115,8 @@ static void __init dma_resv_lockdep(void)
>         up_read(&mm->mmap_sem);
>
>         mmput(mm);
> +
> +       return 0;
>  }
>  subsys_initcall(dma_resv_lockdep);
>  #endif
> --
> 2.20.1
>


-- 
Daniel Vetter
Software Engineer, Intel Corporation
+41 (0) 79 365 57 48 - http://blog.ffwll.ch
_______________________________________________
Intel-gfx mailing list
Intel-gfx@lists.freedesktop.org
https://lists.freedesktop.org/mailman/listinfo/intel-gfx

Re: [PATCH 1/3] dma_resv: prime lockdep annotations

[Daniel Vetter]

On Mon, Nov 11, 2019 at 2:11 PM Steven Price <steven.price@arm.com> wrote:
>
> On 04/11/2019 17:37, Daniel Vetter wrote:
> > Full audit of everyone:
> >
> > - i915, radeon, amdgpu should be clean per their maintainers.
> >
> > - vram helpers should be fine, they don't do command submission, so
> >   really no business holding struct_mutex while doing copy_*_user. But
> >   I haven't checked them all.
> >
> > - panfrost seems to dma_resv_lock only in panfrost_job_push, which
> >   looks clean.
> >
> > - v3d holds dma_resv locks in the tail of its v3d_submit_cl_ioctl(),
> >   copying from/to userspace happens all in v3d_lookup_bos which is
> >   outside of the critical section.
> >
> > - vmwgfx has a bunch of ioctls that do their own copy_*_user:
> >   - vmw_execbuf_process: First this does some copies in
> >     vmw_execbuf_cmdbuf() and also in the vmw_execbuf_process() itself.
> >     Then comes the usual ttm reserve/validate sequence, then actual
> >     submission/fencing, then unreserving, and finally some more
> >     copy_to_user in vmw_execbuf_copy_fence_user. Glossing over tons of
> >     details, but looks all safe.
> >   - vmw_fence_event_ioctl: No ttm_reserve/dma_resv_lock anywhere to be
> >     seen, seems to only create a fence and copy it out.
> >   - a pile of smaller ioctl in vmwgfx_ioctl.c, no reservations to be
> >     found there.
> >   Summary: vmwgfx seems to be fine too.
> >
> > - virtio: There's virtio_gpu_execbuffer_ioctl, which does all the
> >   copying from userspace before even looking up objects through their
> >   handles, so safe. Plus the getparam/getcaps ioctl, also both safe.
> >
> > - qxl only has qxl_execbuffer_ioctl, which calls into
> >   qxl_process_single_command. There's a lovely comment before the
> >   __copy_from_user_inatomic that the slowpath should be copied from
> >   i915, but I guess that never happened. Try not to be unlucky and get
> >   your CS data evicted between when it's written and the kernel tries
> >   to read it. The only other copy_from_user is for relocs, but those
> >   are done before qxl_release_reserve_list(), which seems to be the
> >   only thing reserving buffers (in the ttm/dma_resv sense) in that
> >   code. So looks safe.
> >
> > - A debugfs file in nouveau_debugfs_pstate_set() and the usif ioctl in
> >   usif_ioctl() look safe. nouveau_gem_ioctl_pushbuf() otoh breaks this
> >   everywhere and needs to be fixed up.
> >
> > v2: Thomas pointed at that vmwgfx calls dma_resv_init while it holds a
> > dma_resv lock of a different object already. Christian mentioned that
> > ttm core does this too for ghost objects. intel-gfx-ci highlighted
> > that i915 has similar issues.
> >
> > Unfortunately we can't do this in the usual module init functions,
> > because kernel threads don't have an ->mm - we have to wait around for
> > some user thread to do this.
> >
> > Solution is to spawn a worker (but only once). It's horrible, but it
> > works.
> >
> > v3: We can allocate mm! (Chris). Horrible worker hack out, clean
> > initcall solution in.
> >
> > v4: Annotate with __init (Rob Herring)
> >
> > Cc: Rob Herring <robh@kernel.org>
> > Cc: Alex Deucher <alexander.deucher@amd.com>
> > Cc: Christian König <christian.koenig@amd.com>
> > Cc: Chris Wilson <chris@chris-wilson.co.uk>
> > Cc: Thomas Zimmermann <tzimmermann@suse.de>
> > Cc: Rob Herring <robh@kernel.org>
> > Cc: Tomeu Vizoso <tomeu.vizoso@collabora.com>
> > Cc: Eric Anholt <eric@anholt.net>
> > Cc: Dave Airlie <airlied@redhat.com>
> > Cc: Gerd Hoffmann <kraxel@redhat.com>
> > Cc: Ben Skeggs <bskeggs@redhat.com>
> > Cc: "VMware Graphics" <linux-graphics-maintainer@vmware.com>
> > Cc: Thomas Hellstrom <thellstrom@vmware.com>
> > Reviewed-by: Christian König <christian.koenig@amd.com>
> > Reviewed-by: Chris Wilson <chris@chris-wilson.co.uk>
> > Tested-by: Chris Wilson <chris@chris-wilson.co.uk>
> > Signed-off-by: Daniel Vetter <daniel.vetter@intel.com>
> > ---
> >  drivers/dma-buf/dma-resv.c | 24 ++++++++++++++++++++++++
> >  1 file changed, 24 insertions(+)
> >
> > diff --git a/drivers/dma-buf/dma-resv.c b/drivers/dma-buf/dma-resv.c
> > index 709002515550..a05ff542be22 100644
> > --- a/drivers/dma-buf/dma-resv.c
> > +++ b/drivers/dma-buf/dma-resv.c
> > @@ -34,6 +34,7 @@
> >
> >  #include <linux/dma-resv.h>
> >  #include <linux/export.h>
> > +#include <linux/sched/mm.h>
> >
> >  /**
> >   * DOC: Reservation Object Overview
> > @@ -95,6 +96,29 @@ static void dma_resv_list_free(struct dma_resv_list *list)
> >       kfree_rcu(list, rcu);
> >  }
> >
> > +#if IS_ENABLED(CONFIG_LOCKDEP)
> > +static void __init dma_resv_lockdep(void)
> > +{
> > +     struct mm_struct *mm = mm_alloc();
> > +     struct dma_resv obj;
> > +
> > +     if (!mm)
> > +             return;
> > +
> > +     dma_resv_init(&obj);
> > +
> > +     down_read(&mm->mmap_sem);
> > +     ww_mutex_lock(&obj.lock, NULL);
> > +     fs_reclaim_acquire(GFP_KERNEL);
> > +     fs_reclaim_release(GFP_KERNEL);
> > +     ww_mutex_unlock(&obj.lock);
> > +     up_read(&mm->mmap_sem);
> > +
>
> Nit: trailing whitespace
>
> > +     mmput(mm);
> > +}
> > +subsys_initcall(dma_resv_lockdep);
>
> This expects a function returning int, but dma_resv_lockdep() is void.
> Causing:
>
> drivers/dma-buf/dma-resv.c:119:17: error: initialization of ‘initcall_t’
> {aka ‘int (*)(void)’} from incompatible pointer type ‘void (*)(void)’
> [-Werror=incompatible-pointer-types]
>  subsys_initcall(dma_resv_lockdep);
>
> The below fixes it for me.

Uh, so _that_ was what the 0day thing was all about, I totally misread
that completely. Thanks for the patch.

Reviewed-by: Daniel Vetter <daniel.vetter@ffwll.ch>

Aside, do you need commit rights for pushing this kind of stuff?
-Daniel

>
> Steve
>
> ----8<----
> From d07ea81611ed6e4fb8cc290f42d23dbcca2da2f8 Mon Sep 17 00:00:00 2001
> From: Steven Price <steven.price@arm.com>
> Date: Mon, 11 Nov 2019 13:07:19 +0000
> Subject: [PATCH] dma_resv: Correct return type of dma_resv_lockdep()
>
> subsys_initcall() expects a function which returns 'int'. Fix
> dma_resv_lockdep() so it returns an 'int' error code.
>
> Fixes: b2a8116e2592 ("dma_resv: prime lockdep annotations")
> Signed-off-by: Steven Price <steven.price@arm.com>
> ---
>  drivers/dma-buf/dma-resv.c | 6 ++++--
>  1 file changed, 4 insertions(+), 2 deletions(-)
>
> diff --git a/drivers/dma-buf/dma-resv.c b/drivers/dma-buf/dma-resv.c
> index a05ff542be22..9918a6e5cf91 100644
> --- a/drivers/dma-buf/dma-resv.c
> +++ b/drivers/dma-buf/dma-resv.c
> @@ -97,13 +97,13 @@ static void dma_resv_list_free(struct dma_resv_list *list)
>  }
>
>  #if IS_ENABLED(CONFIG_LOCKDEP)
> -static void __init dma_resv_lockdep(void)
> +static int __init dma_resv_lockdep(void)
>  {
>         struct mm_struct *mm = mm_alloc();
>         struct dma_resv obj;
>
>         if (!mm)
> -               return;
> +               return -ENOMEM;
>
>         dma_resv_init(&obj);
>
> @@ -115,6 +115,8 @@ static void __init dma_resv_lockdep(void)
>         up_read(&mm->mmap_sem);
>
>         mmput(mm);
> +
> +       return 0;
>  }
>  subsys_initcall(dma_resv_lockdep);
>  #endif
> --
> 2.20.1
>


-- 
Daniel Vetter
Software Engineer, Intel Corporation
+41 (0) 79 365 57 48 - http://blog.ffwll.ch
_______________________________________________
dri-devel mailing list
dri-devel@lists.freedesktop.org
https://lists.freedesktop.org/mailman/listinfo/dri-devel

Re: [PATCH 1/3] dma_resv: prime lockdep annotations

[Steven Price]

On 04/11/2019 17:37, Daniel Vetter wrote:
> Full audit of everyone:
> 
> - i915, radeon, amdgpu should be clean per their maintainers.
> 
> - vram helpers should be fine, they don't do command submission, so
>   really no business holding struct_mutex while doing copy_*_user. But
>   I haven't checked them all.
> 
> - panfrost seems to dma_resv_lock only in panfrost_job_push, which
>   looks clean.
> 
> - v3d holds dma_resv locks in the tail of its v3d_submit_cl_ioctl(),
>   copying from/to userspace happens all in v3d_lookup_bos which is
>   outside of the critical section.
> 
> - vmwgfx has a bunch of ioctls that do their own copy_*_user:
>   - vmw_execbuf_process: First this does some copies in
>     vmw_execbuf_cmdbuf() and also in the vmw_execbuf_process() itself.
>     Then comes the usual ttm reserve/validate sequence, then actual
>     submission/fencing, then unreserving, and finally some more
>     copy_to_user in vmw_execbuf_copy_fence_user. Glossing over tons of
>     details, but looks all safe.
>   - vmw_fence_event_ioctl: No ttm_reserve/dma_resv_lock anywhere to be
>     seen, seems to only create a fence and copy it out.
>   - a pile of smaller ioctl in vmwgfx_ioctl.c, no reservations to be
>     found there.
>   Summary: vmwgfx seems to be fine too.
> 
> - virtio: There's virtio_gpu_execbuffer_ioctl, which does all the
>   copying from userspace before even looking up objects through their
>   handles, so safe. Plus the getparam/getcaps ioctl, also both safe.
> 
> - qxl only has qxl_execbuffer_ioctl, which calls into
>   qxl_process_single_command. There's a lovely comment before the
>   __copy_from_user_inatomic that the slowpath should be copied from
>   i915, but I guess that never happened. Try not to be unlucky and get
>   your CS data evicted between when it's written and the kernel tries
>   to read it. The only other copy_from_user is for relocs, but those
>   are done before qxl_release_reserve_list(), which seems to be the
>   only thing reserving buffers (in the ttm/dma_resv sense) in that
>   code. So looks safe.
> 
> - A debugfs file in nouveau_debugfs_pstate_set() and the usif ioctl in
>   usif_ioctl() look safe. nouveau_gem_ioctl_pushbuf() otoh breaks this
>   everywhere and needs to be fixed up.
> 
> v2: Thomas pointed at that vmwgfx calls dma_resv_init while it holds a
> dma_resv lock of a different object already. Christian mentioned that
> ttm core does this too for ghost objects. intel-gfx-ci highlighted
> that i915 has similar issues.
> 
> Unfortunately we can't do this in the usual module init functions,
> because kernel threads don't have an ->mm - we have to wait around for
> some user thread to do this.
> 
> Solution is to spawn a worker (but only once). It's horrible, but it
> works.
> 
> v3: We can allocate mm! (Chris). Horrible worker hack out, clean
> initcall solution in.
> 
> v4: Annotate with __init (Rob Herring)
> 
> Cc: Rob Herring <robh@kernel.org>
> Cc: Alex Deucher <alexander.deucher@amd.com>
> Cc: Christian König <christian.koenig@amd.com>
> Cc: Chris Wilson <chris@chris-wilson.co.uk>
> Cc: Thomas Zimmermann <tzimmermann@suse.de>
> Cc: Rob Herring <robh@kernel.org>
> Cc: Tomeu Vizoso <tomeu.vizoso@collabora.com>
> Cc: Eric Anholt <eric@anholt.net>
> Cc: Dave Airlie <airlied@redhat.com>
> Cc: Gerd Hoffmann <kraxel@redhat.com>
> Cc: Ben Skeggs <bskeggs@redhat.com>
> Cc: "VMware Graphics" <linux-graphics-maintainer@vmware.com>
> Cc: Thomas Hellstrom <thellstrom@vmware.com>
> Reviewed-by: Christian König <christian.koenig@amd.com>
> Reviewed-by: Chris Wilson <chris@chris-wilson.co.uk>
> Tested-by: Chris Wilson <chris@chris-wilson.co.uk>
> Signed-off-by: Daniel Vetter <daniel.vetter@intel.com>
> ---
>  drivers/dma-buf/dma-resv.c | 24 ++++++++++++++++++++++++
>  1 file changed, 24 insertions(+)
> 
> diff --git a/drivers/dma-buf/dma-resv.c b/drivers/dma-buf/dma-resv.c
> index 709002515550..a05ff542be22 100644
> --- a/drivers/dma-buf/dma-resv.c
> +++ b/drivers/dma-buf/dma-resv.c
> @@ -34,6 +34,7 @@
>  
>  #include <linux/dma-resv.h>
>  #include <linux/export.h>
> +#include <linux/sched/mm.h>
>  
>  /**
>   * DOC: Reservation Object Overview
> @@ -95,6 +96,29 @@ static void dma_resv_list_free(struct dma_resv_list *list)
>  	kfree_rcu(list, rcu);
>  }
>  
> +#if IS_ENABLED(CONFIG_LOCKDEP)
> +static void __init dma_resv_lockdep(void)
> +{
> +	struct mm_struct *mm = mm_alloc();
> +	struct dma_resv obj;
> +
> +	if (!mm)
> +		return;
> +
> +	dma_resv_init(&obj);
> +
> +	down_read(&mm->mmap_sem);
> +	ww_mutex_lock(&obj.lock, NULL);
> +	fs_reclaim_acquire(GFP_KERNEL);
> +	fs_reclaim_release(GFP_KERNEL);
> +	ww_mutex_unlock(&obj.lock);
> +	up_read(&mm->mmap_sem);
> +	

Nit: trailing whitespace

> +	mmput(mm);
> +}
> +subsys_initcall(dma_resv_lockdep);

This expects a function returning int, but dma_resv_lockdep() is void.
Causing:

drivers/dma-buf/dma-resv.c:119:17: error: initialization of ‘initcall_t’
{aka ‘int (*)(void)’} from incompatible pointer type ‘void (*)(void)’
[-Werror=incompatible-pointer-types]
 subsys_initcall(dma_resv_lockdep);

The below fixes it for me.

Steve

----8<----
From d07ea81611ed6e4fb8cc290f42d23dbcca2da2f8 Mon Sep 17 00:00:00 2001
From: Steven Price <steven.price@arm.com>
Date: Mon, 11 Nov 2019 13:07:19 +0000
Subject: [PATCH] dma_resv: Correct return type of dma_resv_lockdep()

subsys_initcall() expects a function which returns 'int'. Fix
dma_resv_lockdep() so it returns an 'int' error code.

Fixes: b2a8116e2592 ("dma_resv: prime lockdep annotations")
Signed-off-by: Steven Price <steven.price@arm.com>
---
 drivers/dma-buf/dma-resv.c | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/drivers/dma-buf/dma-resv.c b/drivers/dma-buf/dma-resv.c
index a05ff542be22..9918a6e5cf91 100644
--- a/drivers/dma-buf/dma-resv.c
+++ b/drivers/dma-buf/dma-resv.c
@@ -97,13 +97,13 @@ static void dma_resv_list_free(struct dma_resv_list *list)
 }
 
 #if IS_ENABLED(CONFIG_LOCKDEP)
-static void __init dma_resv_lockdep(void)
+static int __init dma_resv_lockdep(void)
 {
 	struct mm_struct *mm = mm_alloc();
 	struct dma_resv obj;
 
 	if (!mm)
-		return;
+		return -ENOMEM;
 
 	dma_resv_init(&obj);
 
@@ -115,6 +115,8 @@ static void __init dma_resv_lockdep(void)
 	up_read(&mm->mmap_sem);
 	
 	mmput(mm);
+
+	return 0;
 }
 subsys_initcall(dma_resv_lockdep);
 #endif
-- 
2.20.1

_______________________________________________
dri-devel mailing list
dri-devel@lists.freedesktop.org
https://lists.freedesktop.org/mailman/listinfo/dri-devel

Re: [PATCH 1/3] dma_resv: prime lockdep annotations

[Daniel Vetter]

On Mon, Nov 04, 2019 at 08:01:09PM +0000, Koenig, Christian wrote:
> Am 04.11.19 um 18:37 schrieb Daniel Vetter:
> > Full audit of everyone:
> >
> > - i915, radeon, amdgpu should be clean per their maintainers.
> >
> > - vram helpers should be fine, they don't do command submission, so
> >    really no business holding struct_mutex while doing copy_*_user. But
> >    I haven't checked them all.
> >
> > - panfrost seems to dma_resv_lock only in panfrost_job_push, which
> >    looks clean.
> >
> > - v3d holds dma_resv locks in the tail of its v3d_submit_cl_ioctl(),
> >    copying from/to userspace happens all in v3d_lookup_bos which is
> >    outside of the critical section.
> >
> > - vmwgfx has a bunch of ioctls that do their own copy_*_user:
> >    - vmw_execbuf_process: First this does some copies in
> >      vmw_execbuf_cmdbuf() and also in the vmw_execbuf_process() itself.
> >      Then comes the usual ttm reserve/validate sequence, then actual
> >      submission/fencing, then unreserving, and finally some more
> >      copy_to_user in vmw_execbuf_copy_fence_user. Glossing over tons of
> >      details, but looks all safe.
> >    - vmw_fence_event_ioctl: No ttm_reserve/dma_resv_lock anywhere to be
> >      seen, seems to only create a fence and copy it out.
> >    - a pile of smaller ioctl in vmwgfx_ioctl.c, no reservations to be
> >      found there.
> >    Summary: vmwgfx seems to be fine too.
> >
> > - virtio: There's virtio_gpu_execbuffer_ioctl, which does all the
> >    copying from userspace before even looking up objects through their
> >    handles, so safe. Plus the getparam/getcaps ioctl, also both safe.
> >
> > - qxl only has qxl_execbuffer_ioctl, which calls into
> >    qxl_process_single_command. There's a lovely comment before the
> >    __copy_from_user_inatomic that the slowpath should be copied from
> >    i915, but I guess that never happened. Try not to be unlucky and get
> >    your CS data evicted between when it's written and the kernel tries
> >    to read it. The only other copy_from_user is for relocs, but those
> >    are done before qxl_release_reserve_list(), which seems to be the
> >    only thing reserving buffers (in the ttm/dma_resv sense) in that
> >    code. So looks safe.
> >
> > - A debugfs file in nouveau_debugfs_pstate_set() and the usif ioctl in
> >    usif_ioctl() look safe. nouveau_gem_ioctl_pushbuf() otoh breaks this
> >    everywhere and needs to be fixed up.
> >
> > v2: Thomas pointed at that vmwgfx calls dma_resv_init while it holds a
> > dma_resv lock of a different object already. Christian mentioned that
> > ttm core does this too for ghost objects. intel-gfx-ci highlighted
> > that i915 has similar issues.
> >
> > Unfortunately we can't do this in the usual module init functions,
> > because kernel threads don't have an ->mm - we have to wait around for
> > some user thread to do this.
> >
> > Solution is to spawn a worker (but only once). It's horrible, but it
> > works.
> >
> > v3: We can allocate mm! (Chris). Horrible worker hack out, clean
> > initcall solution in.
> >
> > v4: Annotate with __init (Rob Herring)
> >
> > Cc: Rob Herring <robh@kernel.org>
> > Cc: Alex Deucher <alexander.deucher@amd.com>
> > Cc: Christian König <christian.koenig@amd.com>
> > Cc: Chris Wilson <chris@chris-wilson.co.uk>
> > Cc: Thomas Zimmermann <tzimmermann@suse.de>
> > Cc: Rob Herring <robh@kernel.org>
> > Cc: Tomeu Vizoso <tomeu.vizoso@collabora.com>
> > Cc: Eric Anholt <eric@anholt.net>
> > Cc: Dave Airlie <airlied@redhat.com>
> > Cc: Gerd Hoffmann <kraxel@redhat.com>
> > Cc: Ben Skeggs <bskeggs@redhat.com>
> > Cc: "VMware Graphics" <linux-graphics-maintainer@vmware.com>
> > Cc: Thomas Hellstrom <thellstrom@vmware.com>
> > Reviewed-by: Christian König <christian.koenig@amd.com>
> > Reviewed-by: Chris Wilson <chris@chris-wilson.co.uk>
> > Tested-by: Chris Wilson <chris@chris-wilson.co.uk>
> > Signed-off-by: Daniel Vetter <daniel.vetter@intel.com>
> 
> What's holding you back to commit that?

The nouveau patch, can't push this one without also fixing nouveau :-/
-Daniel

> 
> Christian.
> 
> > ---
> >   drivers/dma-buf/dma-resv.c | 24 ++++++++++++++++++++++++
> >   1 file changed, 24 insertions(+)
> >
> > diff --git a/drivers/dma-buf/dma-resv.c b/drivers/dma-buf/dma-resv.c
> > index 709002515550..a05ff542be22 100644
> > --- a/drivers/dma-buf/dma-resv.c
> > +++ b/drivers/dma-buf/dma-resv.c
> > @@ -34,6 +34,7 @@
> >   
> >   #include <linux/dma-resv.h>
> >   #include <linux/export.h>
> > +#include <linux/sched/mm.h>
> >   
> >   /**
> >    * DOC: Reservation Object Overview
> > @@ -95,6 +96,29 @@ static void dma_resv_list_free(struct dma_resv_list *list)
> >   	kfree_rcu(list, rcu);
> >   }
> >   
> > +#if IS_ENABLED(CONFIG_LOCKDEP)
> > +static void __init dma_resv_lockdep(void)
> > +{
> > +	struct mm_struct *mm = mm_alloc();
> > +	struct dma_resv obj;
> > +
> > +	if (!mm)
> > +		return;
> > +
> > +	dma_resv_init(&obj);
> > +
> > +	down_read(&mm->mmap_sem);
> > +	ww_mutex_lock(&obj.lock, NULL);
> > +	fs_reclaim_acquire(GFP_KERNEL);
> > +	fs_reclaim_release(GFP_KERNEL);
> > +	ww_mutex_unlock(&obj.lock);
> > +	up_read(&mm->mmap_sem);
> > +	
> > +	mmput(mm);
> > +}
> > +subsys_initcall(dma_resv_lockdep);
> > +#endif
> > +
> >   /**
> >    * dma_resv_init - initialize a reservation object
> >    * @obj: the reservation object
> 
> _______________________________________________
> dri-devel mailing list
> dri-devel@lists.freedesktop.org
> https://lists.freedesktop.org/mailman/listinfo/dri-devel

-- 
Daniel Vetter
Software Engineer, Intel Corporation
http://blog.ffwll.ch
_______________________________________________
Intel-gfx mailing list
Intel-gfx@lists.freedesktop.org
https://lists.freedesktop.org/mailman/listinfo/intel-gfx

Re: [PATCH 1/3] dma_resv: prime lockdep annotations

[Daniel Vetter]

On Mon, Nov 04, 2019 at 08:01:09PM +0000, Koenig, Christian wrote:
> Am 04.11.19 um 18:37 schrieb Daniel Vetter:
> > Full audit of everyone:
> >
> > - i915, radeon, amdgpu should be clean per their maintainers.
> >
> > - vram helpers should be fine, they don't do command submission, so
> >    really no business holding struct_mutex while doing copy_*_user. But
> >    I haven't checked them all.
> >
> > - panfrost seems to dma_resv_lock only in panfrost_job_push, which
> >    looks clean.
> >
> > - v3d holds dma_resv locks in the tail of its v3d_submit_cl_ioctl(),
> >    copying from/to userspace happens all in v3d_lookup_bos which is
> >    outside of the critical section.
> >
> > - vmwgfx has a bunch of ioctls that do their own copy_*_user:
> >    - vmw_execbuf_process: First this does some copies in
> >      vmw_execbuf_cmdbuf() and also in the vmw_execbuf_process() itself.
> >      Then comes the usual ttm reserve/validate sequence, then actual
> >      submission/fencing, then unreserving, and finally some more
> >      copy_to_user in vmw_execbuf_copy_fence_user. Glossing over tons of
> >      details, but looks all safe.
> >    - vmw_fence_event_ioctl: No ttm_reserve/dma_resv_lock anywhere to be
> >      seen, seems to only create a fence and copy it out.
> >    - a pile of smaller ioctl in vmwgfx_ioctl.c, no reservations to be
> >      found there.
> >    Summary: vmwgfx seems to be fine too.
> >
> > - virtio: There's virtio_gpu_execbuffer_ioctl, which does all the
> >    copying from userspace before even looking up objects through their
> >    handles, so safe. Plus the getparam/getcaps ioctl, also both safe.
> >
> > - qxl only has qxl_execbuffer_ioctl, which calls into
> >    qxl_process_single_command. There's a lovely comment before the
> >    __copy_from_user_inatomic that the slowpath should be copied from
> >    i915, but I guess that never happened. Try not to be unlucky and get
> >    your CS data evicted between when it's written and the kernel tries
> >    to read it. The only other copy_from_user is for relocs, but those
> >    are done before qxl_release_reserve_list(), which seems to be the
> >    only thing reserving buffers (in the ttm/dma_resv sense) in that
> >    code. So looks safe.
> >
> > - A debugfs file in nouveau_debugfs_pstate_set() and the usif ioctl in
> >    usif_ioctl() look safe. nouveau_gem_ioctl_pushbuf() otoh breaks this
> >    everywhere and needs to be fixed up.
> >
> > v2: Thomas pointed at that vmwgfx calls dma_resv_init while it holds a
> > dma_resv lock of a different object already. Christian mentioned that
> > ttm core does this too for ghost objects. intel-gfx-ci highlighted
> > that i915 has similar issues.
> >
> > Unfortunately we can't do this in the usual module init functions,
> > because kernel threads don't have an ->mm - we have to wait around for
> > some user thread to do this.
> >
> > Solution is to spawn a worker (but only once). It's horrible, but it
> > works.
> >
> > v3: We can allocate mm! (Chris). Horrible worker hack out, clean
> > initcall solution in.
> >
> > v4: Annotate with __init (Rob Herring)
> >
> > Cc: Rob Herring <robh@kernel.org>
> > Cc: Alex Deucher <alexander.deucher@amd.com>
> > Cc: Christian König <christian.koenig@amd.com>
> > Cc: Chris Wilson <chris@chris-wilson.co.uk>
> > Cc: Thomas Zimmermann <tzimmermann@suse.de>
> > Cc: Rob Herring <robh@kernel.org>
> > Cc: Tomeu Vizoso <tomeu.vizoso@collabora.com>
> > Cc: Eric Anholt <eric@anholt.net>
> > Cc: Dave Airlie <airlied@redhat.com>
> > Cc: Gerd Hoffmann <kraxel@redhat.com>
> > Cc: Ben Skeggs <bskeggs@redhat.com>
> > Cc: "VMware Graphics" <linux-graphics-maintainer@vmware.com>
> > Cc: Thomas Hellstrom <thellstrom@vmware.com>
> > Reviewed-by: Christian König <christian.koenig@amd.com>
> > Reviewed-by: Chris Wilson <chris@chris-wilson.co.uk>
> > Tested-by: Chris Wilson <chris@chris-wilson.co.uk>
> > Signed-off-by: Daniel Vetter <daniel.vetter@intel.com>
> 
> What's holding you back to commit that?

The nouveau patch, can't push this one without also fixing nouveau :-/
-Daniel

> 
> Christian.
> 
> > ---
> >   drivers/dma-buf/dma-resv.c | 24 ++++++++++++++++++++++++
> >   1 file changed, 24 insertions(+)
> >
> > diff --git a/drivers/dma-buf/dma-resv.c b/drivers/dma-buf/dma-resv.c
> > index 709002515550..a05ff542be22 100644
> > --- a/drivers/dma-buf/dma-resv.c
> > +++ b/drivers/dma-buf/dma-resv.c
> > @@ -34,6 +34,7 @@
> >   
> >   #include <linux/dma-resv.h>
> >   #include <linux/export.h>
> > +#include <linux/sched/mm.h>
> >   
> >   /**
> >    * DOC: Reservation Object Overview
> > @@ -95,6 +96,29 @@ static void dma_resv_list_free(struct dma_resv_list *list)
> >   	kfree_rcu(list, rcu);
> >   }
> >   
> > +#if IS_ENABLED(CONFIG_LOCKDEP)
> > +static void __init dma_resv_lockdep(void)
> > +{
> > +	struct mm_struct *mm = mm_alloc();
> > +	struct dma_resv obj;
> > +
> > +	if (!mm)
> > +		return;
> > +
> > +	dma_resv_init(&obj);
> > +
> > +	down_read(&mm->mmap_sem);
> > +	ww_mutex_lock(&obj.lock, NULL);
> > +	fs_reclaim_acquire(GFP_KERNEL);
> > +	fs_reclaim_release(GFP_KERNEL);
> > +	ww_mutex_unlock(&obj.lock);
> > +	up_read(&mm->mmap_sem);
> > +	
> > +	mmput(mm);
> > +}
> > +subsys_initcall(dma_resv_lockdep);
> > +#endif
> > +
> >   /**
> >    * dma_resv_init - initialize a reservation object
> >    * @obj: the reservation object
> 
> _______________________________________________
> dri-devel mailing list
> dri-devel@lists.freedesktop.org
> https://lists.freedesktop.org/mailman/listinfo/dri-devel

-- 
Daniel Vetter
Software Engineer, Intel Corporation
http://blog.ffwll.ch
_______________________________________________
dri-devel mailing list
dri-devel@lists.freedesktop.org
https://lists.freedesktop.org/mailman/listinfo/dri-devel

Re: [PATCH 1/3] dma_resv: prime lockdep annotations

[Koenig, Christian]

Am 04.11.19 um 18:37 schrieb Daniel Vetter:
> Full audit of everyone:
>
> - i915, radeon, amdgpu should be clean per their maintainers.
>
> - vram helpers should be fine, they don't do command submission, so
>    really no business holding struct_mutex while doing copy_*_user. But
>    I haven't checked them all.
>
> - panfrost seems to dma_resv_lock only in panfrost_job_push, which
>    looks clean.
>
> - v3d holds dma_resv locks in the tail of its v3d_submit_cl_ioctl(),
>    copying from/to userspace happens all in v3d_lookup_bos which is
>    outside of the critical section.
>
> - vmwgfx has a bunch of ioctls that do their own copy_*_user:
>    - vmw_execbuf_process: First this does some copies in
>      vmw_execbuf_cmdbuf() and also in the vmw_execbuf_process() itself.
>      Then comes the usual ttm reserve/validate sequence, then actual
>      submission/fencing, then unreserving, and finally some more
>      copy_to_user in vmw_execbuf_copy_fence_user. Glossing over tons of
>      details, but looks all safe.
>    - vmw_fence_event_ioctl: No ttm_reserve/dma_resv_lock anywhere to be
>      seen, seems to only create a fence and copy it out.
>    - a pile of smaller ioctl in vmwgfx_ioctl.c, no reservations to be
>      found there.
>    Summary: vmwgfx seems to be fine too.
>
> - virtio: There's virtio_gpu_execbuffer_ioctl, which does all the
>    copying from userspace before even looking up objects through their
>    handles, so safe. Plus the getparam/getcaps ioctl, also both safe.
>
> - qxl only has qxl_execbuffer_ioctl, which calls into
>    qxl_process_single_command. There's a lovely comment before the
>    __copy_from_user_inatomic that the slowpath should be copied from
>    i915, but I guess that never happened. Try not to be unlucky and get
>    your CS data evicted between when it's written and the kernel tries
>    to read it. The only other copy_from_user is for relocs, but those
>    are done before qxl_release_reserve_list(), which seems to be the
>    only thing reserving buffers (in the ttm/dma_resv sense) in that
>    code. So looks safe.
>
> - A debugfs file in nouveau_debugfs_pstate_set() and the usif ioctl in
>    usif_ioctl() look safe. nouveau_gem_ioctl_pushbuf() otoh breaks this
>    everywhere and needs to be fixed up.
>
> v2: Thomas pointed at that vmwgfx calls dma_resv_init while it holds a
> dma_resv lock of a different object already. Christian mentioned that
> ttm core does this too for ghost objects. intel-gfx-ci highlighted
> that i915 has similar issues.
>
> Unfortunately we can't do this in the usual module init functions,
> because kernel threads don't have an ->mm - we have to wait around for
> some user thread to do this.
>
> Solution is to spawn a worker (but only once). It's horrible, but it
> works.
>
> v3: We can allocate mm! (Chris). Horrible worker hack out, clean
> initcall solution in.
>
> v4: Annotate with __init (Rob Herring)
>
> Cc: Rob Herring <robh@kernel.org>
> Cc: Alex Deucher <alexander.deucher@amd.com>
> Cc: Christian König <christian.koenig@amd.com>
> Cc: Chris Wilson <chris@chris-wilson.co.uk>
> Cc: Thomas Zimmermann <tzimmermann@suse.de>
> Cc: Rob Herring <robh@kernel.org>
> Cc: Tomeu Vizoso <tomeu.vizoso@collabora.com>
> Cc: Eric Anholt <eric@anholt.net>
> Cc: Dave Airlie <airlied@redhat.com>
> Cc: Gerd Hoffmann <kraxel@redhat.com>
> Cc: Ben Skeggs <bskeggs@redhat.com>
> Cc: "VMware Graphics" <linux-graphics-maintainer@vmware.com>
> Cc: Thomas Hellstrom <thellstrom@vmware.com>
> Reviewed-by: Christian König <christian.koenig@amd.com>
> Reviewed-by: Chris Wilson <chris@chris-wilson.co.uk>
> Tested-by: Chris Wilson <chris@chris-wilson.co.uk>
> Signed-off-by: Daniel Vetter <daniel.vetter@intel.com>

What's holding you back to commit that?

Christian.

> ---
>   drivers/dma-buf/dma-resv.c | 24 ++++++++++++++++++++++++
>   1 file changed, 24 insertions(+)
>
> diff --git a/drivers/dma-buf/dma-resv.c b/drivers/dma-buf/dma-resv.c
> index 709002515550..a05ff542be22 100644
> --- a/drivers/dma-buf/dma-resv.c
> +++ b/drivers/dma-buf/dma-resv.c
> @@ -34,6 +34,7 @@
>   
>   #include <linux/dma-resv.h>
>   #include <linux/export.h>
> +#include <linux/sched/mm.h>
>   
>   /**
>    * DOC: Reservation Object Overview
> @@ -95,6 +96,29 @@ static void dma_resv_list_free(struct dma_resv_list *list)
>   	kfree_rcu(list, rcu);
>   }
>   
> +#if IS_ENABLED(CONFIG_LOCKDEP)
> +static void __init dma_resv_lockdep(void)
> +{
> +	struct mm_struct *mm = mm_alloc();
> +	struct dma_resv obj;
> +
> +	if (!mm)
> +		return;
> +
> +	dma_resv_init(&obj);
> +
> +	down_read(&mm->mmap_sem);
> +	ww_mutex_lock(&obj.lock, NULL);
> +	fs_reclaim_acquire(GFP_KERNEL);
> +	fs_reclaim_release(GFP_KERNEL);
> +	ww_mutex_unlock(&obj.lock);
> +	up_read(&mm->mmap_sem);
> +	
> +	mmput(mm);
> +}
> +subsys_initcall(dma_resv_lockdep);
> +#endif
> +
>   /**
>    * dma_resv_init - initialize a reservation object
>    * @obj: the reservation object

_______________________________________________
Intel-gfx mailing list
Intel-gfx@lists.freedesktop.org
https://lists.freedesktop.org/mailman/listinfo/intel-gfx

Re: [PATCH 1/3] dma_resv: prime lockdep annotations

[Koenig, Christian]

Am 04.11.19 um 18:37 schrieb Daniel Vetter:
> Full audit of everyone:
>
> - i915, radeon, amdgpu should be clean per their maintainers.
>
> - vram helpers should be fine, they don't do command submission, so
>    really no business holding struct_mutex while doing copy_*_user. But
>    I haven't checked them all.
>
> - panfrost seems to dma_resv_lock only in panfrost_job_push, which
>    looks clean.
>
> - v3d holds dma_resv locks in the tail of its v3d_submit_cl_ioctl(),
>    copying from/to userspace happens all in v3d_lookup_bos which is
>    outside of the critical section.
>
> - vmwgfx has a bunch of ioctls that do their own copy_*_user:
>    - vmw_execbuf_process: First this does some copies in
>      vmw_execbuf_cmdbuf() and also in the vmw_execbuf_process() itself.
>      Then comes the usual ttm reserve/validate sequence, then actual
>      submission/fencing, then unreserving, and finally some more
>      copy_to_user in vmw_execbuf_copy_fence_user. Glossing over tons of
>      details, but looks all safe.
>    - vmw_fence_event_ioctl: No ttm_reserve/dma_resv_lock anywhere to be
>      seen, seems to only create a fence and copy it out.
>    - a pile of smaller ioctl in vmwgfx_ioctl.c, no reservations to be
>      found there.
>    Summary: vmwgfx seems to be fine too.
>
> - virtio: There's virtio_gpu_execbuffer_ioctl, which does all the
>    copying from userspace before even looking up objects through their
>    handles, so safe. Plus the getparam/getcaps ioctl, also both safe.
>
> - qxl only has qxl_execbuffer_ioctl, which calls into
>    qxl_process_single_command. There's a lovely comment before the
>    __copy_from_user_inatomic that the slowpath should be copied from
>    i915, but I guess that never happened. Try not to be unlucky and get
>    your CS data evicted between when it's written and the kernel tries
>    to read it. The only other copy_from_user is for relocs, but those
>    are done before qxl_release_reserve_list(), which seems to be the
>    only thing reserving buffers (in the ttm/dma_resv sense) in that
>    code. So looks safe.
>
> - A debugfs file in nouveau_debugfs_pstate_set() and the usif ioctl in
>    usif_ioctl() look safe. nouveau_gem_ioctl_pushbuf() otoh breaks this
>    everywhere and needs to be fixed up.
>
> v2: Thomas pointed at that vmwgfx calls dma_resv_init while it holds a
> dma_resv lock of a different object already. Christian mentioned that
> ttm core does this too for ghost objects. intel-gfx-ci highlighted
> that i915 has similar issues.
>
> Unfortunately we can't do this in the usual module init functions,
> because kernel threads don't have an ->mm - we have to wait around for
> some user thread to do this.
>
> Solution is to spawn a worker (but only once). It's horrible, but it
> works.
>
> v3: We can allocate mm! (Chris). Horrible worker hack out, clean
> initcall solution in.
>
> v4: Annotate with __init (Rob Herring)
>
> Cc: Rob Herring <robh@kernel.org>
> Cc: Alex Deucher <alexander.deucher@amd.com>
> Cc: Christian König <christian.koenig@amd.com>
> Cc: Chris Wilson <chris@chris-wilson.co.uk>
> Cc: Thomas Zimmermann <tzimmermann@suse.de>
> Cc: Rob Herring <robh@kernel.org>
> Cc: Tomeu Vizoso <tomeu.vizoso@collabora.com>
> Cc: Eric Anholt <eric@anholt.net>
> Cc: Dave Airlie <airlied@redhat.com>
> Cc: Gerd Hoffmann <kraxel@redhat.com>
> Cc: Ben Skeggs <bskeggs@redhat.com>
> Cc: "VMware Graphics" <linux-graphics-maintainer@vmware.com>
> Cc: Thomas Hellstrom <thellstrom@vmware.com>
> Reviewed-by: Christian König <christian.koenig@amd.com>
> Reviewed-by: Chris Wilson <chris@chris-wilson.co.uk>
> Tested-by: Chris Wilson <chris@chris-wilson.co.uk>
> Signed-off-by: Daniel Vetter <daniel.vetter@intel.com>

What's holding you back to commit that?

Christian.

> ---
>   drivers/dma-buf/dma-resv.c | 24 ++++++++++++++++++++++++
>   1 file changed, 24 insertions(+)
>
> diff --git a/drivers/dma-buf/dma-resv.c b/drivers/dma-buf/dma-resv.c
> index 709002515550..a05ff542be22 100644
> --- a/drivers/dma-buf/dma-resv.c
> +++ b/drivers/dma-buf/dma-resv.c
> @@ -34,6 +34,7 @@
>   
>   #include <linux/dma-resv.h>
>   #include <linux/export.h>
> +#include <linux/sched/mm.h>
>   
>   /**
>    * DOC: Reservation Object Overview
> @@ -95,6 +96,29 @@ static void dma_resv_list_free(struct dma_resv_list *list)
>   	kfree_rcu(list, rcu);
>   }
>   
> +#if IS_ENABLED(CONFIG_LOCKDEP)
> +static void __init dma_resv_lockdep(void)
> +{
> +	struct mm_struct *mm = mm_alloc();
> +	struct dma_resv obj;
> +
> +	if (!mm)
> +		return;
> +
> +	dma_resv_init(&obj);
> +
> +	down_read(&mm->mmap_sem);
> +	ww_mutex_lock(&obj.lock, NULL);
> +	fs_reclaim_acquire(GFP_KERNEL);
> +	fs_reclaim_release(GFP_KERNEL);
> +	ww_mutex_unlock(&obj.lock);
> +	up_read(&mm->mmap_sem);
> +	
> +	mmput(mm);
> +}
> +subsys_initcall(dma_resv_lockdep);
> +#endif
> +
>   /**
>    * dma_resv_init - initialize a reservation object
>    * @obj: the reservation object

_______________________________________________
dri-devel mailing list
dri-devel@lists.freedesktop.org
https://lists.freedesktop.org/mailman/listinfo/dri-devel

Re: [PATCH 1/3] dma_resv: prime lockdep annotations

[Daniel Vetter]

On Mon, Nov 04, 2019 at 06:37:59PM +0100, Daniel Vetter wrote:
> Full audit of everyone:
> 
> - i915, radeon, amdgpu should be clean per their maintainers.
> 
> - vram helpers should be fine, they don't do command submission, so
>   really no business holding struct_mutex while doing copy_*_user. But
>   I haven't checked them all.
> 
> - panfrost seems to dma_resv_lock only in panfrost_job_push, which
>   looks clean.
> 
> - v3d holds dma_resv locks in the tail of its v3d_submit_cl_ioctl(),
>   copying from/to userspace happens all in v3d_lookup_bos which is
>   outside of the critical section.
> 
> - vmwgfx has a bunch of ioctls that do their own copy_*_user:
>   - vmw_execbuf_process: First this does some copies in
>     vmw_execbuf_cmdbuf() and also in the vmw_execbuf_process() itself.
>     Then comes the usual ttm reserve/validate sequence, then actual
>     submission/fencing, then unreserving, and finally some more
>     copy_to_user in vmw_execbuf_copy_fence_user. Glossing over tons of
>     details, but looks all safe.
>   - vmw_fence_event_ioctl: No ttm_reserve/dma_resv_lock anywhere to be
>     seen, seems to only create a fence and copy it out.
>   - a pile of smaller ioctl in vmwgfx_ioctl.c, no reservations to be
>     found there.
>   Summary: vmwgfx seems to be fine too.
> 
> - virtio: There's virtio_gpu_execbuffer_ioctl, which does all the
>   copying from userspace before even looking up objects through their
>   handles, so safe. Plus the getparam/getcaps ioctl, also both safe.
> 
> - qxl only has qxl_execbuffer_ioctl, which calls into
>   qxl_process_single_command. There's a lovely comment before the
>   __copy_from_user_inatomic that the slowpath should be copied from
>   i915, but I guess that never happened. Try not to be unlucky and get
>   your CS data evicted between when it's written and the kernel tries
>   to read it. The only other copy_from_user is for relocs, but those
>   are done before qxl_release_reserve_list(), which seems to be the
>   only thing reserving buffers (in the ttm/dma_resv sense) in that
>   code. So looks safe.
> 
> - A debugfs file in nouveau_debugfs_pstate_set() and the usif ioctl in
>   usif_ioctl() look safe. nouveau_gem_ioctl_pushbuf() otoh breaks this
>   everywhere and needs to be fixed up.
> 
> v2: Thomas pointed at that vmwgfx calls dma_resv_init while it holds a
> dma_resv lock of a different object already. Christian mentioned that
> ttm core does this too for ghost objects. intel-gfx-ci highlighted
> that i915 has similar issues.
> 
> Unfortunately we can't do this in the usual module init functions,
> because kernel threads don't have an ->mm - we have to wait around for
> some user thread to do this.
> 
> Solution is to spawn a worker (but only once). It's horrible, but it
> works.
> 
> v3: We can allocate mm! (Chris). Horrible worker hack out, clean
> initcall solution in.
> 
> v4: Annotate with __init (Rob Herring)
> 
> Cc: Rob Herring <robh@kernel.org>
> Cc: Alex Deucher <alexander.deucher@amd.com>
> Cc: Christian König <christian.koenig@amd.com>
> Cc: Chris Wilson <chris@chris-wilson.co.uk>
> Cc: Thomas Zimmermann <tzimmermann@suse.de>
> Cc: Rob Herring <robh@kernel.org>
> Cc: Tomeu Vizoso <tomeu.vizoso@collabora.com>
> Cc: Eric Anholt <eric@anholt.net>
> Cc: Dave Airlie <airlied@redhat.com>
> Cc: Gerd Hoffmann <kraxel@redhat.com>
> Cc: Ben Skeggs <bskeggs@redhat.com>
> Cc: "VMware Graphics" <linux-graphics-maintainer@vmware.com>
> Cc: Thomas Hellstrom <thellstrom@vmware.com>
> Reviewed-by: Christian König <christian.koenig@amd.com>
> Reviewed-by: Chris Wilson <chris@chris-wilson.co.uk>
> Tested-by: Chris Wilson <chris@chris-wilson.co.uk>
> Signed-off-by: Daniel Vetter <daniel.vetter@intel.com>

I lost the r-b from Thomas on the last round:

Reviewed-by: Thomas Hellstrom <thellstrom@vmware.com>
> ---
>  drivers/dma-buf/dma-resv.c | 24 ++++++++++++++++++++++++
>  1 file changed, 24 insertions(+)
> 
> diff --git a/drivers/dma-buf/dma-resv.c b/drivers/dma-buf/dma-resv.c
> index 709002515550..a05ff542be22 100644
> --- a/drivers/dma-buf/dma-resv.c
> +++ b/drivers/dma-buf/dma-resv.c
> @@ -34,6 +34,7 @@
>  
>  #include <linux/dma-resv.h>
>  #include <linux/export.h>
> +#include <linux/sched/mm.h>
>  
>  /**
>   * DOC: Reservation Object Overview
> @@ -95,6 +96,29 @@ static void dma_resv_list_free(struct dma_resv_list *list)
>  	kfree_rcu(list, rcu);
>  }
>  
> +#if IS_ENABLED(CONFIG_LOCKDEP)
> +static void __init dma_resv_lockdep(void)
> +{
> +	struct mm_struct *mm = mm_alloc();
> +	struct dma_resv obj;
> +
> +	if (!mm)
> +		return;
> +
> +	dma_resv_init(&obj);
> +
> +	down_read(&mm->mmap_sem);
> +	ww_mutex_lock(&obj.lock, NULL);
> +	fs_reclaim_acquire(GFP_KERNEL);
> +	fs_reclaim_release(GFP_KERNEL);
> +	ww_mutex_unlock(&obj.lock);
> +	up_read(&mm->mmap_sem);
> +	
> +	mmput(mm);
> +}
> +subsys_initcall(dma_resv_lockdep);
> +#endif
> +
>  /**
>   * dma_resv_init - initialize a reservation object
>   * @obj: the reservation object
> -- 
> 2.24.0.rc2
> 

-- 
Daniel Vetter
Software Engineer, Intel Corporation
http://blog.ffwll.ch
_______________________________________________
Intel-gfx mailing list
Intel-gfx@lists.freedesktop.org
https://lists.freedesktop.org/mailman/listinfo/intel-gfx

Re: [PATCH 1/3] dma_resv: prime lockdep annotations

[Daniel Vetter]

On Mon, Nov 04, 2019 at 06:37:59PM +0100, Daniel Vetter wrote:
> Full audit of everyone:
> 
> - i915, radeon, amdgpu should be clean per their maintainers.
> 
> - vram helpers should be fine, they don't do command submission, so
>   really no business holding struct_mutex while doing copy_*_user. But
>   I haven't checked them all.
> 
> - panfrost seems to dma_resv_lock only in panfrost_job_push, which
>   looks clean.
> 
> - v3d holds dma_resv locks in the tail of its v3d_submit_cl_ioctl(),
>   copying from/to userspace happens all in v3d_lookup_bos which is
>   outside of the critical section.
> 
> - vmwgfx has a bunch of ioctls that do their own copy_*_user:
>   - vmw_execbuf_process: First this does some copies in
>     vmw_execbuf_cmdbuf() and also in the vmw_execbuf_process() itself.
>     Then comes the usual ttm reserve/validate sequence, then actual
>     submission/fencing, then unreserving, and finally some more
>     copy_to_user in vmw_execbuf_copy_fence_user. Glossing over tons of
>     details, but looks all safe.
>   - vmw_fence_event_ioctl: No ttm_reserve/dma_resv_lock anywhere to be
>     seen, seems to only create a fence and copy it out.
>   - a pile of smaller ioctl in vmwgfx_ioctl.c, no reservations to be
>     found there.
>   Summary: vmwgfx seems to be fine too.
> 
> - virtio: There's virtio_gpu_execbuffer_ioctl, which does all the
>   copying from userspace before even looking up objects through their
>   handles, so safe. Plus the getparam/getcaps ioctl, also both safe.
> 
> - qxl only has qxl_execbuffer_ioctl, which calls into
>   qxl_process_single_command. There's a lovely comment before the
>   __copy_from_user_inatomic that the slowpath should be copied from
>   i915, but I guess that never happened. Try not to be unlucky and get
>   your CS data evicted between when it's written and the kernel tries
>   to read it. The only other copy_from_user is for relocs, but those
>   are done before qxl_release_reserve_list(), which seems to be the
>   only thing reserving buffers (in the ttm/dma_resv sense) in that
>   code. So looks safe.
> 
> - A debugfs file in nouveau_debugfs_pstate_set() and the usif ioctl in
>   usif_ioctl() look safe. nouveau_gem_ioctl_pushbuf() otoh breaks this
>   everywhere and needs to be fixed up.
> 
> v2: Thomas pointed at that vmwgfx calls dma_resv_init while it holds a
> dma_resv lock of a different object already. Christian mentioned that
> ttm core does this too for ghost objects. intel-gfx-ci highlighted
> that i915 has similar issues.
> 
> Unfortunately we can't do this in the usual module init functions,
> because kernel threads don't have an ->mm - we have to wait around for
> some user thread to do this.
> 
> Solution is to spawn a worker (but only once). It's horrible, but it
> works.
> 
> v3: We can allocate mm! (Chris). Horrible worker hack out, clean
> initcall solution in.
> 
> v4: Annotate with __init (Rob Herring)
> 
> Cc: Rob Herring <robh@kernel.org>
> Cc: Alex Deucher <alexander.deucher@amd.com>
> Cc: Christian König <christian.koenig@amd.com>
> Cc: Chris Wilson <chris@chris-wilson.co.uk>
> Cc: Thomas Zimmermann <tzimmermann@suse.de>
> Cc: Rob Herring <robh@kernel.org>
> Cc: Tomeu Vizoso <tomeu.vizoso@collabora.com>
> Cc: Eric Anholt <eric@anholt.net>
> Cc: Dave Airlie <airlied@redhat.com>
> Cc: Gerd Hoffmann <kraxel@redhat.com>
> Cc: Ben Skeggs <bskeggs@redhat.com>
> Cc: "VMware Graphics" <linux-graphics-maintainer@vmware.com>
> Cc: Thomas Hellstrom <thellstrom@vmware.com>
> Reviewed-by: Christian König <christian.koenig@amd.com>
> Reviewed-by: Chris Wilson <chris@chris-wilson.co.uk>
> Tested-by: Chris Wilson <chris@chris-wilson.co.uk>
> Signed-off-by: Daniel Vetter <daniel.vetter@intel.com>

I lost the r-b from Thomas on the last round:

Reviewed-by: Thomas Hellstrom <thellstrom@vmware.com>
> ---
>  drivers/dma-buf/dma-resv.c | 24 ++++++++++++++++++++++++
>  1 file changed, 24 insertions(+)
> 
> diff --git a/drivers/dma-buf/dma-resv.c b/drivers/dma-buf/dma-resv.c
> index 709002515550..a05ff542be22 100644
> --- a/drivers/dma-buf/dma-resv.c
> +++ b/drivers/dma-buf/dma-resv.c
> @@ -34,6 +34,7 @@
>  
>  #include <linux/dma-resv.h>
>  #include <linux/export.h>
> +#include <linux/sched/mm.h>
>  
>  /**
>   * DOC: Reservation Object Overview
> @@ -95,6 +96,29 @@ static void dma_resv_list_free(struct dma_resv_list *list)
>  	kfree_rcu(list, rcu);
>  }
>  
> +#if IS_ENABLED(CONFIG_LOCKDEP)
> +static void __init dma_resv_lockdep(void)
> +{
> +	struct mm_struct *mm = mm_alloc();
> +	struct dma_resv obj;
> +
> +	if (!mm)
> +		return;
> +
> +	dma_resv_init(&obj);
> +
> +	down_read(&mm->mmap_sem);
> +	ww_mutex_lock(&obj.lock, NULL);
> +	fs_reclaim_acquire(GFP_KERNEL);
> +	fs_reclaim_release(GFP_KERNEL);
> +	ww_mutex_unlock(&obj.lock);
> +	up_read(&mm->mmap_sem);
> +	
> +	mmput(mm);
> +}
> +subsys_initcall(dma_resv_lockdep);
> +#endif
> +
>  /**
>   * dma_resv_init - initialize a reservation object
>   * @obj: the reservation object
> -- 
> 2.24.0.rc2
> 

-- 
Daniel Vetter
Software Engineer, Intel Corporation
http://blog.ffwll.ch
_______________________________________________
dri-devel mailing list
dri-devel@lists.freedesktop.org
https://lists.freedesktop.org/mailman/listinfo/dri-devel

[PATCH 1/3] dma_resv: prime lockdep annotations

[Daniel Vetter]

Full audit of everyone:

- i915, radeon, amdgpu should be clean per their maintainers.

- vram helpers should be fine, they don't do command submission, so
  really no business holding struct_mutex while doing copy_*_user. But
  I haven't checked them all.

- panfrost seems to dma_resv_lock only in panfrost_job_push, which
  looks clean.

- v3d holds dma_resv locks in the tail of its v3d_submit_cl_ioctl(),
  copying from/to userspace happens all in v3d_lookup_bos which is
  outside of the critical section.

- vmwgfx has a bunch of ioctls that do their own copy_*_user:
  - vmw_execbuf_process: First this does some copies in
    vmw_execbuf_cmdbuf() and also in the vmw_execbuf_process() itself.
    Then comes the usual ttm reserve/validate sequence, then actual
    submission/fencing, then unreserving, and finally some more
    copy_to_user in vmw_execbuf_copy_fence_user. Glossing over tons of
    details, but looks all safe.
  - vmw_fence_event_ioctl: No ttm_reserve/dma_resv_lock anywhere to be
    seen, seems to only create a fence and copy it out.
  - a pile of smaller ioctl in vmwgfx_ioctl.c, no reservations to be
    found there.
  Summary: vmwgfx seems to be fine too.

- virtio: There's virtio_gpu_execbuffer_ioctl, which does all the
  copying from userspace before even looking up objects through their
  handles, so safe. Plus the getparam/getcaps ioctl, also both safe.

- qxl only has qxl_execbuffer_ioctl, which calls into
  qxl_process_single_command. There's a lovely comment before the
  __copy_from_user_inatomic that the slowpath should be copied from
  i915, but I guess that never happened. Try not to be unlucky and get
  your CS data evicted between when it's written and the kernel tries
  to read it. The only other copy_from_user is for relocs, but those
  are done before qxl_release_reserve_list(), which seems to be the
  only thing reserving buffers (in the ttm/dma_resv sense) in that
  code. So looks safe.

- A debugfs file in nouveau_debugfs_pstate_set() and the usif ioctl in
  usif_ioctl() look safe. nouveau_gem_ioctl_pushbuf() otoh breaks this
  everywhere and needs to be fixed up.

v2: Thomas pointed at that vmwgfx calls dma_resv_init while it holds a
dma_resv lock of a different object already. Christian mentioned that
ttm core does this too for ghost objects. intel-gfx-ci highlighted
that i915 has similar issues.

Unfortunately we can't do this in the usual module init functions,
because kernel threads don't have an ->mm - we have to wait around for
some user thread to do this.

Solution is to spawn a worker (but only once). It's horrible, but it
works.

v3: We can allocate mm! (Chris). Horrible worker hack out, clean
initcall solution in.

v4: Annotate with __init (Rob Herring)

Cc: Rob Herring <robh@kernel.org>
Cc: Alex Deucher <alexander.deucher@amd.com>
Cc: Christian König <christian.koenig@amd.com>
Cc: Chris Wilson <chris@chris-wilson.co.uk>
Cc: Thomas Zimmermann <tzimmermann@suse.de>
Cc: Rob Herring <robh@kernel.org>
Cc: Tomeu Vizoso <tomeu.vizoso@collabora.com>
Cc: Eric Anholt <eric@anholt.net>
Cc: Dave Airlie <airlied@redhat.com>
Cc: Gerd Hoffmann <kraxel@redhat.com>
Cc: Ben Skeggs <bskeggs@redhat.com>
Cc: "VMware Graphics" <linux-graphics-maintainer@vmware.com>
Cc: Thomas Hellstrom <thellstrom@vmware.com>
Reviewed-by: Christian König <christian.koenig@amd.com>
Reviewed-by: Chris Wilson <chris@chris-wilson.co.uk>
Tested-by: Chris Wilson <chris@chris-wilson.co.uk>
Signed-off-by: Daniel Vetter <daniel.vetter@intel.com>
---
 drivers/dma-buf/dma-resv.c | 24 ++++++++++++++++++++++++
 1 file changed, 24 insertions(+)

diff --git a/drivers/dma-buf/dma-resv.c b/drivers/dma-buf/dma-resv.c
index 709002515550..a05ff542be22 100644
--- a/drivers/dma-buf/dma-resv.c
+++ b/drivers/dma-buf/dma-resv.c
@@ -34,6 +34,7 @@
 
 #include <linux/dma-resv.h>
 #include <linux/export.h>
+#include <linux/sched/mm.h>
 
 /**
  * DOC: Reservation Object Overview
@@ -95,6 +96,29 @@ static void dma_resv_list_free(struct dma_resv_list *list)
 	kfree_rcu(list, rcu);
 }
 
+#if IS_ENABLED(CONFIG_LOCKDEP)
+static void __init dma_resv_lockdep(void)
+{
+	struct mm_struct *mm = mm_alloc();
+	struct dma_resv obj;
+
+	if (!mm)
+		return;
+
+	dma_resv_init(&obj);
+
+	down_read(&mm->mmap_sem);
+	ww_mutex_lock(&obj.lock, NULL);
+	fs_reclaim_acquire(GFP_KERNEL);
+	fs_reclaim_release(GFP_KERNEL);
+	ww_mutex_unlock(&obj.lock);
+	up_read(&mm->mmap_sem);
+	
+	mmput(mm);
+}
+subsys_initcall(dma_resv_lockdep);
+#endif
+
 /**
  * dma_resv_init - initialize a reservation object
  * @obj: the reservation object
-- 
2.24.0.rc2

_______________________________________________
Intel-gfx mailing list
Intel-gfx@lists.freedesktop.org
https://lists.freedesktop.org/mailman/listinfo/intel-gfx

[PATCH 1/3] dma_resv: prime lockdep annotations

[Daniel Vetter]

Full audit of everyone:

- i915, radeon, amdgpu should be clean per their maintainers.

- vram helpers should be fine, they don't do command submission, so
  really no business holding struct_mutex while doing copy_*_user. But
  I haven't checked them all.

- panfrost seems to dma_resv_lock only in panfrost_job_push, which
  looks clean.

- v3d holds dma_resv locks in the tail of its v3d_submit_cl_ioctl(),
  copying from/to userspace happens all in v3d_lookup_bos which is
  outside of the critical section.

- vmwgfx has a bunch of ioctls that do their own copy_*_user:
  - vmw_execbuf_process: First this does some copies in
    vmw_execbuf_cmdbuf() and also in the vmw_execbuf_process() itself.
    Then comes the usual ttm reserve/validate sequence, then actual
    submission/fencing, then unreserving, and finally some more
    copy_to_user in vmw_execbuf_copy_fence_user. Glossing over tons of
    details, but looks all safe.
  - vmw_fence_event_ioctl: No ttm_reserve/dma_resv_lock anywhere to be
    seen, seems to only create a fence and copy it out.
  - a pile of smaller ioctl in vmwgfx_ioctl.c, no reservations to be
    found there.
  Summary: vmwgfx seems to be fine too.

- virtio: There's virtio_gpu_execbuffer_ioctl, which does all the
  copying from userspace before even looking up objects through their
  handles, so safe. Plus the getparam/getcaps ioctl, also both safe.

- qxl only has qxl_execbuffer_ioctl, which calls into
  qxl_process_single_command. There's a lovely comment before the
  __copy_from_user_inatomic that the slowpath should be copied from
  i915, but I guess that never happened. Try not to be unlucky and get
  your CS data evicted between when it's written and the kernel tries
  to read it. The only other copy_from_user is for relocs, but those
  are done before qxl_release_reserve_list(), which seems to be the
  only thing reserving buffers (in the ttm/dma_resv sense) in that
  code. So looks safe.

- A debugfs file in nouveau_debugfs_pstate_set() and the usif ioctl in
  usif_ioctl() look safe. nouveau_gem_ioctl_pushbuf() otoh breaks this
  everywhere and needs to be fixed up.

v2: Thomas pointed at that vmwgfx calls dma_resv_init while it holds a
dma_resv lock of a different object already. Christian mentioned that
ttm core does this too for ghost objects. intel-gfx-ci highlighted
that i915 has similar issues.

Unfortunately we can't do this in the usual module init functions,
because kernel threads don't have an ->mm - we have to wait around for
some user thread to do this.

Solution is to spawn a worker (but only once). It's horrible, but it
works.

v3: We can allocate mm! (Chris). Horrible worker hack out, clean
initcall solution in.

v4: Annotate with __init (Rob Herring)

Cc: Rob Herring <robh@kernel.org>
Cc: Alex Deucher <alexander.deucher@amd.com>
Cc: Christian König <christian.koenig@amd.com>
Cc: Chris Wilson <chris@chris-wilson.co.uk>
Cc: Thomas Zimmermann <tzimmermann@suse.de>
Cc: Rob Herring <robh@kernel.org>
Cc: Tomeu Vizoso <tomeu.vizoso@collabora.com>
Cc: Eric Anholt <eric@anholt.net>
Cc: Dave Airlie <airlied@redhat.com>
Cc: Gerd Hoffmann <kraxel@redhat.com>
Cc: Ben Skeggs <bskeggs@redhat.com>
Cc: "VMware Graphics" <linux-graphics-maintainer@vmware.com>
Cc: Thomas Hellstrom <thellstrom@vmware.com>
Reviewed-by: Christian König <christian.koenig@amd.com>
Reviewed-by: Chris Wilson <chris@chris-wilson.co.uk>
Tested-by: Chris Wilson <chris@chris-wilson.co.uk>
Signed-off-by: Daniel Vetter <daniel.vetter@intel.com>
---
 drivers/dma-buf/dma-resv.c | 24 ++++++++++++++++++++++++
 1 file changed, 24 insertions(+)

diff --git a/drivers/dma-buf/dma-resv.c b/drivers/dma-buf/dma-resv.c
index 709002515550..a05ff542be22 100644
--- a/drivers/dma-buf/dma-resv.c
+++ b/drivers/dma-buf/dma-resv.c
@@ -34,6 +34,7 @@
 
 #include <linux/dma-resv.h>
 #include <linux/export.h>
+#include <linux/sched/mm.h>
 
 /**
  * DOC: Reservation Object Overview
@@ -95,6 +96,29 @@ static void dma_resv_list_free(struct dma_resv_list *list)
 	kfree_rcu(list, rcu);
 }
 
+#if IS_ENABLED(CONFIG_LOCKDEP)
+static void __init dma_resv_lockdep(void)
+{
+	struct mm_struct *mm = mm_alloc();
+	struct dma_resv obj;
+
+	if (!mm)
+		return;
+
+	dma_resv_init(&obj);
+
+	down_read(&mm->mmap_sem);
+	ww_mutex_lock(&obj.lock, NULL);
+	fs_reclaim_acquire(GFP_KERNEL);
+	fs_reclaim_release(GFP_KERNEL);
+	ww_mutex_unlock(&obj.lock);
+	up_read(&mm->mmap_sem);
+	
+	mmput(mm);
+}
+subsys_initcall(dma_resv_lockdep);
+#endif
+
 /**
  * dma_resv_init - initialize a reservation object
  * @obj: the reservation object
-- 
2.24.0.rc2

_______________________________________________
dri-devel mailing list
dri-devel@lists.freedesktop.org
https://lists.freedesktop.org/mailman/listinfo/dri-devel

Re: [PATCH 1/3] dma_resv: prime lockdep annotations

[kbuild test robot]

[-- Attachment #1: Type: text/plain, Size: 6716 bytes --]

Hi Daniel,

I love your patch! Yet something to improve:

[auto build test ERROR on linus/master]
[cannot apply to v5.4-rc4 next-20191021]
[if your patch is applied to the wrong git tree, please drop us a note to help
improve the system. BTW, we also suggest to use '--base' option to specify the
base tree in git format-patch, please see https://stackoverflow.com/a/37406982]

url:    https://github.com/0day-ci/linux/commits/Daniel-Vetter/dma_resv-lockdep-annotations-priming/20191022-015539
base:   https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git 7d194c2100ad2a6dded545887d02754948ca5241
config: sparc64-allmodconfig (attached as .config)
compiler: sparc64-linux-gcc (GCC) 7.4.0
reproduce:
        wget https://raw.githubusercontent.com/intel/lkp-tests/master/sbin/make.cross -O ~/bin/make.cross
        chmod +x ~/bin/make.cross
        # save the attached .config to linux build tree
        GCC_VERSION=7.4.0 make.cross ARCH=sparc64 

If you fix the issue, kindly add following tag
Reported-by: kbuild test robot <lkp@intel.com>

All error/warnings (new ones prefixed by >>):

   In file included from include/linux/printk.h:6:0,
                    from include/linux/kernel.h:15,
                    from include/asm-generic/bug.h:19,
                    from arch/sparc/include/asm/bug.h:25,
                    from include/linux/bug.h:5,
                    from include/linux/thread_info.h:12,
                    from arch/sparc/include/asm/current.h:15,
                    from include/linux/mutex.h:14,
                    from include/linux/ww_mutex.h:20,
                    from include/linux/dma-resv.h:42,
                    from drivers/dma-buf/dma-resv.c:35:
>> drivers/dma-buf/dma-resv.c:119:17: error: initialization from incompatible pointer type [-Werror=incompatible-pointer-types]
    subsys_initcall(dma_resv_lockdep);
                    ^
   include/linux/init.h:197:50: note: in definition of macro '___define_initcall'
      __attribute__((__section__(#__sec ".init"))) = fn;
                                                     ^~
>> include/linux/init.h:224:30: note: in expansion of macro '__define_initcall'
    #define subsys_initcall(fn)  __define_initcall(fn, 4)
                                 ^~~~~~~~~~~~~~~~~
>> drivers/dma-buf/dma-resv.c:119:1: note: in expansion of macro 'subsys_initcall'
    subsys_initcall(dma_resv_lockdep);
    ^~~~~~~~~~~~~~~
   cc1: some warnings being treated as errors
--
   In file included from include/linux/printk.h:6:0,
                    from include/linux/kernel.h:15,
                    from include/asm-generic/bug.h:19,
                    from arch/sparc/include/asm/bug.h:25,
                    from include/linux/bug.h:5,
                    from include/linux/thread_info.h:12,
                    from arch/sparc/include/asm/current.h:15,
                    from include/linux/mutex.h:14,
                    from include/linux/ww_mutex.h:20,
                    from include/linux/dma-resv.h:42,
                    from drivers//dma-buf/dma-resv.c:35:
   drivers//dma-buf/dma-resv.c:119:17: error: initialization from incompatible pointer type [-Werror=incompatible-pointer-types]
    subsys_initcall(dma_resv_lockdep);
                    ^
   include/linux/init.h:197:50: note: in definition of macro '___define_initcall'
      __attribute__((__section__(#__sec ".init"))) = fn;
                                                     ^~
>> include/linux/init.h:224:30: note: in expansion of macro '__define_initcall'
    #define subsys_initcall(fn)  __define_initcall(fn, 4)
                                 ^~~~~~~~~~~~~~~~~
   drivers//dma-buf/dma-resv.c:119:1: note: in expansion of macro 'subsys_initcall'
    subsys_initcall(dma_resv_lockdep);
    ^~~~~~~~~~~~~~~
   cc1: some warnings being treated as errors

vim +119 drivers/dma-buf/dma-resv.c

  > 35	#include <linux/dma-resv.h>
    36	#include <linux/export.h>
    37	#include <linux/sched/mm.h>
    38	
    39	/**
    40	 * DOC: Reservation Object Overview
    41	 *
    42	 * The reservation object provides a mechanism to manage shared and
    43	 * exclusive fences associated with a buffer.  A reservation object
    44	 * can have attached one exclusive fence (normally associated with
    45	 * write operations) or N shared fences (read operations).  The RCU
    46	 * mechanism is used to protect read access to fences from locked
    47	 * write-side updates.
    48	 */
    49	
    50	DEFINE_WD_CLASS(reservation_ww_class);
    51	EXPORT_SYMBOL(reservation_ww_class);
    52	
    53	struct lock_class_key reservation_seqcount_class;
    54	EXPORT_SYMBOL(reservation_seqcount_class);
    55	
    56	const char reservation_seqcount_string[] = "reservation_seqcount";
    57	EXPORT_SYMBOL(reservation_seqcount_string);
    58	
    59	/**
    60	 * dma_resv_list_alloc - allocate fence list
    61	 * @shared_max: number of fences we need space for
    62	 *
    63	 * Allocate a new dma_resv_list and make sure to correctly initialize
    64	 * shared_max.
    65	 */
    66	static struct dma_resv_list *dma_resv_list_alloc(unsigned int shared_max)
    67	{
    68		struct dma_resv_list *list;
    69	
    70		list = kmalloc(offsetof(typeof(*list), shared[shared_max]), GFP_KERNEL);
    71		if (!list)
    72			return NULL;
    73	
    74		list->shared_max = (ksize(list) - offsetof(typeof(*list), shared)) /
    75			sizeof(*list->shared);
    76	
    77		return list;
    78	}
    79	
    80	/**
    81	 * dma_resv_list_free - free fence list
    82	 * @list: list to free
    83	 *
    84	 * Free a dma_resv_list and make sure to drop all references.
    85	 */
    86	static void dma_resv_list_free(struct dma_resv_list *list)
    87	{
    88		unsigned int i;
    89	
    90		if (!list)
    91			return;
    92	
    93		for (i = 0; i < list->shared_count; ++i)
    94			dma_fence_put(rcu_dereference_protected(list->shared[i], true));
    95	
    96		kfree_rcu(list, rcu);
    97	}
    98	
    99	#if IS_ENABLED(CONFIG_LOCKDEP)
   100	static void __init dma_resv_lockdep(void)
   101	{
   102		struct mm_struct *mm = mm_alloc();
   103		struct dma_resv obj;
   104	
   105		if (!mm)
   106			return;
   107	
   108		dma_resv_init(&obj);
   109	
   110		down_read(&mm->mmap_sem);
   111		ww_mutex_lock(&obj.lock, NULL);
   112		fs_reclaim_acquire(GFP_KERNEL);
   113		fs_reclaim_release(GFP_KERNEL);
   114		ww_mutex_unlock(&obj.lock);
   115		up_read(&mm->mmap_sem);
   116		
   117		mmput(mm);
   118	}
 > 119	subsys_initcall(dma_resv_lockdep);
   120	#endif
   121	

---
0-DAY kernel test infrastructure                Open Source Technology Center
https://lists.01.org/pipermail/kbuild-all                   Intel Corporation

[-- Attachment #2: .config.gz --]
[-- Type: application/gzip, Size: 59103 bytes --]

[-- Attachment #3: Type: text/plain, Size: 159 bytes --]

_______________________________________________
dri-devel mailing list
dri-devel@lists.freedesktop.org
https://lists.freedesktop.org/mailman/listinfo/dri-devel

Re: [PATCH 1/3] dma_resv: prime lockdep annotations

[kbuild test robot]

[-- Attachment #1: Type: text/plain, Size: 6884 bytes --]

Hi Daniel,

I love your patch! Yet something to improve:

[auto build test ERROR on linus/master]
[cannot apply to v5.4-rc4 next-20191021]
[if your patch is applied to the wrong git tree, please drop us a note to help
improve the system. BTW, we also suggest to use '--base' option to specify the
base tree in git format-patch, please see https://stackoverflow.com/a/37406982]

url:    https://github.com/0day-ci/linux/commits/Daniel-Vetter/dma_resv-lockdep-annotations-priming/20191022-015539
base:   https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git 7d194c2100ad2a6dded545887d02754948ca5241
config: sparc64-allmodconfig (attached as .config)
compiler: sparc64-linux-gcc (GCC) 7.4.0
reproduce:
        wget https://raw.githubusercontent.com/intel/lkp-tests/master/sbin/make.cross -O ~/bin/make.cross
        chmod +x ~/bin/make.cross
        # save the attached .config to linux build tree
        GCC_VERSION=7.4.0 make.cross ARCH=sparc64 

If you fix the issue, kindly add following tag
Reported-by: kbuild test robot <lkp@intel.com>

All error/warnings (new ones prefixed by >>):

   In file included from include/linux/printk.h:6:0,
                    from include/linux/kernel.h:15,
                    from include/asm-generic/bug.h:19,
                    from arch/sparc/include/asm/bug.h:25,
                    from include/linux/bug.h:5,
                    from include/linux/thread_info.h:12,
                    from arch/sparc/include/asm/current.h:15,
                    from include/linux/mutex.h:14,
                    from include/linux/ww_mutex.h:20,
                    from include/linux/dma-resv.h:42,
                    from drivers/dma-buf/dma-resv.c:35:
>> drivers/dma-buf/dma-resv.c:119:17: error: initialization from incompatible pointer type [-Werror=incompatible-pointer-types]
    subsys_initcall(dma_resv_lockdep);
                    ^
   include/linux/init.h:197:50: note: in definition of macro '___define_initcall'
      __attribute__((__section__(#__sec ".init"))) = fn;
                                                     ^~
>> include/linux/init.h:224:30: note: in expansion of macro '__define_initcall'
    #define subsys_initcall(fn)  __define_initcall(fn, 4)
                                 ^~~~~~~~~~~~~~~~~
>> drivers/dma-buf/dma-resv.c:119:1: note: in expansion of macro 'subsys_initcall'
    subsys_initcall(dma_resv_lockdep);
    ^~~~~~~~~~~~~~~
   cc1: some warnings being treated as errors
--
   In file included from include/linux/printk.h:6:0,
                    from include/linux/kernel.h:15,
                    from include/asm-generic/bug.h:19,
                    from arch/sparc/include/asm/bug.h:25,
                    from include/linux/bug.h:5,
                    from include/linux/thread_info.h:12,
                    from arch/sparc/include/asm/current.h:15,
                    from include/linux/mutex.h:14,
                    from include/linux/ww_mutex.h:20,
                    from include/linux/dma-resv.h:42,
                    from drivers//dma-buf/dma-resv.c:35:
   drivers//dma-buf/dma-resv.c:119:17: error: initialization from incompatible pointer type [-Werror=incompatible-pointer-types]
    subsys_initcall(dma_resv_lockdep);
                    ^
   include/linux/init.h:197:50: note: in definition of macro '___define_initcall'
      __attribute__((__section__(#__sec ".init"))) = fn;
                                                     ^~
>> include/linux/init.h:224:30: note: in expansion of macro '__define_initcall'
    #define subsys_initcall(fn)  __define_initcall(fn, 4)
                                 ^~~~~~~~~~~~~~~~~
   drivers//dma-buf/dma-resv.c:119:1: note: in expansion of macro 'subsys_initcall'
    subsys_initcall(dma_resv_lockdep);
    ^~~~~~~~~~~~~~~
   cc1: some warnings being treated as errors

vim +119 drivers/dma-buf/dma-resv.c

  > 35	#include <linux/dma-resv.h>
    36	#include <linux/export.h>
    37	#include <linux/sched/mm.h>
    38	
    39	/**
    40	 * DOC: Reservation Object Overview
    41	 *
    42	 * The reservation object provides a mechanism to manage shared and
    43	 * exclusive fences associated with a buffer.  A reservation object
    44	 * can have attached one exclusive fence (normally associated with
    45	 * write operations) or N shared fences (read operations).  The RCU
    46	 * mechanism is used to protect read access to fences from locked
    47	 * write-side updates.
    48	 */
    49	
    50	DEFINE_WD_CLASS(reservation_ww_class);
    51	EXPORT_SYMBOL(reservation_ww_class);
    52	
    53	struct lock_class_key reservation_seqcount_class;
    54	EXPORT_SYMBOL(reservation_seqcount_class);
    55	
    56	const char reservation_seqcount_string[] = "reservation_seqcount";
    57	EXPORT_SYMBOL(reservation_seqcount_string);
    58	
    59	/**
    60	 * dma_resv_list_alloc - allocate fence list
    61	 * @shared_max: number of fences we need space for
    62	 *
    63	 * Allocate a new dma_resv_list and make sure to correctly initialize
    64	 * shared_max.
    65	 */
    66	static struct dma_resv_list *dma_resv_list_alloc(unsigned int shared_max)
    67	{
    68		struct dma_resv_list *list;
    69	
    70		list = kmalloc(offsetof(typeof(*list), shared[shared_max]), GFP_KERNEL);
    71		if (!list)
    72			return NULL;
    73	
    74		list->shared_max = (ksize(list) - offsetof(typeof(*list), shared)) /
    75			sizeof(*list->shared);
    76	
    77		return list;
    78	}
    79	
    80	/**
    81	 * dma_resv_list_free - free fence list
    82	 * @list: list to free
    83	 *
    84	 * Free a dma_resv_list and make sure to drop all references.
    85	 */
    86	static void dma_resv_list_free(struct dma_resv_list *list)
    87	{
    88		unsigned int i;
    89	
    90		if (!list)
    91			return;
    92	
    93		for (i = 0; i < list->shared_count; ++i)
    94			dma_fence_put(rcu_dereference_protected(list->shared[i], true));
    95	
    96		kfree_rcu(list, rcu);
    97	}
    98	
    99	#if IS_ENABLED(CONFIG_LOCKDEP)
   100	static void __init dma_resv_lockdep(void)
   101	{
   102		struct mm_struct *mm = mm_alloc();
   103		struct dma_resv obj;
   104	
   105		if (!mm)
   106			return;
   107	
   108		dma_resv_init(&obj);
   109	
   110		down_read(&mm->mmap_sem);
   111		ww_mutex_lock(&obj.lock, NULL);
   112		fs_reclaim_acquire(GFP_KERNEL);
   113		fs_reclaim_release(GFP_KERNEL);
   114		ww_mutex_unlock(&obj.lock);
   115		up_read(&mm->mmap_sem);
   116		
   117		mmput(mm);
   118	}
 > 119	subsys_initcall(dma_resv_lockdep);
   120	#endif
   121	

---
0-DAY kernel test infrastructure                Open Source Technology Center
https://lists.01.org/pipermail/kbuild-all                   Intel Corporation

[-- Attachment #2: config.gz --]
[-- Type: application/gzip, Size: 59103 bytes --]

Re: [PATCH 1/3] dma_resv: prime lockdep annotations

[Thomas Hellstrom]

On 10/21/19 4:50 PM, Daniel Vetter wrote:
> Full audit of everyone:
>
> - i915, radeon, amdgpu should be clean per their maintainers.
>
> - vram helpers should be fine, they don't do command submission, so
>   really no business holding struct_mutex while doing copy_*_user. But
>   I haven't checked them all.
>
> - panfrost seems to dma_resv_lock only in panfrost_job_push, which
>   looks clean.
>
> - v3d holds dma_resv locks in the tail of its v3d_submit_cl_ioctl(),
>   copying from/to userspace happens all in v3d_lookup_bos which is
>   outside of the critical section.
>
> - vmwgfx has a bunch of ioctls that do their own copy_*_user:
>   - vmw_execbuf_process: First this does some copies in
>     vmw_execbuf_cmdbuf() and also in the vmw_execbuf_process() itself.
>     Then comes the usual ttm reserve/validate sequence, then actual
>     submission/fencing, then unreserving, and finally some more
>     copy_to_user in vmw_execbuf_copy_fence_user. Glossing over tons of
>     details, but looks all safe.
>   - vmw_fence_event_ioctl: No ttm_reserve/dma_resv_lock anywhere to be
>     seen, seems to only create a fence and copy it out.
>   - a pile of smaller ioctl in vmwgfx_ioctl.c, no reservations to be
>     found there.
>   Summary: vmwgfx seems to be fine too.
>
> - virtio: There's virtio_gpu_execbuffer_ioctl, which does all the
>   copying from userspace before even looking up objects through their
>   handles, so safe. Plus the getparam/getcaps ioctl, also both safe.
>
> - qxl only has qxl_execbuffer_ioctl, which calls into
>   qxl_process_single_command. There's a lovely comment before the
>   __copy_from_user_inatomic that the slowpath should be copied from
>   i915, but I guess that never happened. Try not to be unlucky and get
>   your CS data evicted between when it's written and the kernel tries
>   to read it. The only other copy_from_user is for relocs, but those
>   are done before qxl_release_reserve_list(), which seems to be the
>   only thing reserving buffers (in the ttm/dma_resv sense) in that
>   code. So looks safe.
>
> - A debugfs file in nouveau_debugfs_pstate_set() and the usif ioctl in
>   usif_ioctl() look safe. nouveau_gem_ioctl_pushbuf() otoh breaks this
>   everywhere and needs to be fixed up.
>
> v2: Thomas pointed at that vmwgfx calls dma_resv_init while it holds a
> dma_resv lock of a different object already. Christian mentioned that
> ttm core does this too for ghost objects. intel-gfx-ci highlighted
> that i915 has similar issues.
>
> Unfortunately we can't do this in the usual module init functions,
> because kernel threads don't have an ->mm - we have to wait around for
> some user thread to do this.
>
> Solution is to spawn a worker (but only once). It's horrible, but it
> works.
>
> v3: We can allocate mm! (Chris). Horrible worker hack out, clean
> initcall solution in.
>
> v4: Annotate with __init (Rob Herring)
>
> Cc: Rob Herring <robh@kernel.org>
> Cc: Alex Deucher <alexander.deucher@amd.com>
> Cc: Christian König <christian.koenig@amd.com>
> Cc: Chris Wilson <chris@chris-wilson.co.uk>
> Cc: Thomas Zimmermann <tzimmermann@suse.de>
> Cc: Rob Herring <robh@kernel.org>
> Cc: Tomeu Vizoso <tomeu.vizoso@collabora.com>
> Cc: Eric Anholt <eric@anholt.net>
> Cc: Dave Airlie <airlied@redhat.com>
> Cc: Gerd Hoffmann <kraxel@redhat.com>
> Cc: Ben Skeggs <bskeggs@redhat.com>
> Cc: "VMware Graphics" <linux-graphics-maintainer@vmware.com>
> Cc: Thomas Hellstrom <thellstrom@vmware.com>
> Reviewed-by: Christian König <christian.koenig@amd.com>
> Reviewed-by: Chris Wilson <chris@chris-wilson.co.uk>
> Tested-by: Chris Wilson <chris@chris-wilson.co.uk>
> Signed-off-by: Daniel Vetter <daniel.vetter@intel.com>

Including the vmwgfx audit,

Reviewed-by: Thomas Hellstrom <thellstrom@vmware.com>

Thanks,

Thomas



_______________________________________________
Intel-gfx mailing list
Intel-gfx@lists.freedesktop.org
https://lists.freedesktop.org/mailman/listinfo/intel-gfx

[PATCH 1/3] dma_resv: prime lockdep annotations

[Daniel Vetter]

Full audit of everyone:

- i915, radeon, amdgpu should be clean per their maintainers.

- vram helpers should be fine, they don't do command submission, so
  really no business holding struct_mutex while doing copy_*_user. But
  I haven't checked them all.

- panfrost seems to dma_resv_lock only in panfrost_job_push, which
  looks clean.

- v3d holds dma_resv locks in the tail of its v3d_submit_cl_ioctl(),
  copying from/to userspace happens all in v3d_lookup_bos which is
  outside of the critical section.

- vmwgfx has a bunch of ioctls that do their own copy_*_user:
  - vmw_execbuf_process: First this does some copies in
    vmw_execbuf_cmdbuf() and also in the vmw_execbuf_process() itself.
    Then comes the usual ttm reserve/validate sequence, then actual
    submission/fencing, then unreserving, and finally some more
    copy_to_user in vmw_execbuf_copy_fence_user. Glossing over tons of
    details, but looks all safe.
  - vmw_fence_event_ioctl: No ttm_reserve/dma_resv_lock anywhere to be
    seen, seems to only create a fence and copy it out.
  - a pile of smaller ioctl in vmwgfx_ioctl.c, no reservations to be
    found there.
  Summary: vmwgfx seems to be fine too.

- virtio: There's virtio_gpu_execbuffer_ioctl, which does all the
  copying from userspace before even looking up objects through their
  handles, so safe. Plus the getparam/getcaps ioctl, also both safe.

- qxl only has qxl_execbuffer_ioctl, which calls into
  qxl_process_single_command. There's a lovely comment before the
  __copy_from_user_inatomic that the slowpath should be copied from
  i915, but I guess that never happened. Try not to be unlucky and get
  your CS data evicted between when it's written and the kernel tries
  to read it. The only other copy_from_user is for relocs, but those
  are done before qxl_release_reserve_list(), which seems to be the
  only thing reserving buffers (in the ttm/dma_resv sense) in that
  code. So looks safe.

- A debugfs file in nouveau_debugfs_pstate_set() and the usif ioctl in
  usif_ioctl() look safe. nouveau_gem_ioctl_pushbuf() otoh breaks this
  everywhere and needs to be fixed up.

v2: Thomas pointed at that vmwgfx calls dma_resv_init while it holds a
dma_resv lock of a different object already. Christian mentioned that
ttm core does this too for ghost objects. intel-gfx-ci highlighted
that i915 has similar issues.

Unfortunately we can't do this in the usual module init functions,
because kernel threads don't have an ->mm - we have to wait around for
some user thread to do this.

Solution is to spawn a worker (but only once). It's horrible, but it
works.

v3: We can allocate mm! (Chris). Horrible worker hack out, clean
initcall solution in.

v4: Annotate with __init (Rob Herring)

Cc: Rob Herring <robh@kernel.org>
Cc: Alex Deucher <alexander.deucher@amd.com>
Cc: Christian König <christian.koenig@amd.com>
Cc: Chris Wilson <chris@chris-wilson.co.uk>
Cc: Thomas Zimmermann <tzimmermann@suse.de>
Cc: Rob Herring <robh@kernel.org>
Cc: Tomeu Vizoso <tomeu.vizoso@collabora.com>
Cc: Eric Anholt <eric@anholt.net>
Cc: Dave Airlie <airlied@redhat.com>
Cc: Gerd Hoffmann <kraxel@redhat.com>
Cc: Ben Skeggs <bskeggs@redhat.com>
Cc: "VMware Graphics" <linux-graphics-maintainer@vmware.com>
Cc: Thomas Hellstrom <thellstrom@vmware.com>
Reviewed-by: Christian König <christian.koenig@amd.com>
Reviewed-by: Chris Wilson <chris@chris-wilson.co.uk>
Tested-by: Chris Wilson <chris@chris-wilson.co.uk>
Signed-off-by: Daniel Vetter <daniel.vetter@intel.com>
---
 drivers/dma-buf/dma-resv.c | 24 ++++++++++++++++++++++++
 1 file changed, 24 insertions(+)

diff --git a/drivers/dma-buf/dma-resv.c b/drivers/dma-buf/dma-resv.c
index 709002515550..a05ff542be22 100644
--- a/drivers/dma-buf/dma-resv.c
+++ b/drivers/dma-buf/dma-resv.c
@@ -34,6 +34,7 @@
 
 #include <linux/dma-resv.h>
 #include <linux/export.h>
+#include <linux/sched/mm.h>
 
 /**
  * DOC: Reservation Object Overview
@@ -95,6 +96,29 @@ static void dma_resv_list_free(struct dma_resv_list *list)
 	kfree_rcu(list, rcu);
 }
 
+#if IS_ENABLED(CONFIG_LOCKDEP)
+static void __init dma_resv_lockdep(void)
+{
+	struct mm_struct *mm = mm_alloc();
+	struct dma_resv obj;
+
+	if (!mm)
+		return;
+
+	dma_resv_init(&obj);
+
+	down_read(&mm->mmap_sem);
+	ww_mutex_lock(&obj.lock, NULL);
+	fs_reclaim_acquire(GFP_KERNEL);
+	fs_reclaim_release(GFP_KERNEL);
+	ww_mutex_unlock(&obj.lock);
+	up_read(&mm->mmap_sem);
+	
+	mmput(mm);
+}
+subsys_initcall(dma_resv_lockdep);
+#endif
+
 /**
  * dma_resv_init - initialize a reservation object
  * @obj: the reservation object
-- 
2.23.0

_______________________________________________
Intel-gfx mailing list
Intel-gfx@lists.freedesktop.org
https://lists.freedesktop.org/mailman/listinfo/intel-gfx

Re: [PATCH 1/3] dma_resv: prime lockdep annotations

[Chris Wilson]

Quoting Daniel Vetter (2019-08-21 22:50:28)
> Full audit of everyone:
> 
> - i915, radeon, amdgpu should be clean per their maintainers.
> 
> - vram helpers should be fine, they don't do command submission, so
>   really no business holding struct_mutex while doing copy_*_user. But
>   I haven't checked them all.
> 
> - panfrost seems to dma_resv_lock only in panfrost_job_push, which
>   looks clean.
> 
> - v3d holds dma_resv locks in the tail of its v3d_submit_cl_ioctl(),
>   copying from/to userspace happens all in v3d_lookup_bos which is
>   outside of the critical section.
> 
> - vmwgfx has a bunch of ioctls that do their own copy_*_user:
>   - vmw_execbuf_process: First this does some copies in
>     vmw_execbuf_cmdbuf() and also in the vmw_execbuf_process() itself.
>     Then comes the usual ttm reserve/validate sequence, then actual
>     submission/fencing, then unreserving, and finally some more
>     copy_to_user in vmw_execbuf_copy_fence_user. Glossing over tons of
>     details, but looks all safe.
>   - vmw_fence_event_ioctl: No ttm_reserve/dma_resv_lock anywhere to be
>     seen, seems to only create a fence and copy it out.
>   - a pile of smaller ioctl in vmwgfx_ioctl.c, no reservations to be
>     found there.
>   Summary: vmwgfx seems to be fine too.
> 
> - virtio: There's virtio_gpu_execbuffer_ioctl, which does all the
>   copying from userspace before even looking up objects through their
>   handles, so safe. Plus the getparam/getcaps ioctl, also both safe.
> 
> - qxl only has qxl_execbuffer_ioctl, which calls into
>   qxl_process_single_command. There's a lovely comment before the
>   __copy_from_user_inatomic that the slowpath should be copied from
>   i915, but I guess that never happened. Try not to be unlucky and get
>   your CS data evicted between when it's written and the kernel tries
>   to read it. The only other copy_from_user is for relocs, but those
>   are done before qxl_release_reserve_list(), which seems to be the
>   only thing reserving buffers (in the ttm/dma_resv sense) in that
>   code. So looks safe.
> 
> - A debugfs file in nouveau_debugfs_pstate_set() and the usif ioctl in
>   usif_ioctl() look safe. nouveau_gem_ioctl_pushbuf() otoh breaks this
>   everywhere and needs to be fixed up.
> 
> v2: Thomas pointed at that vmwgfx calls dma_resv_init while it holds a
> dma_resv lock of a different object already. Christian mentioned that
> ttm core does this too for ghost objects. intel-gfx-ci highlighted
> that i915 has similar issues.
> 
> Unfortunately we can't do this in the usual module init functions,
> because kernel threads don't have an ->mm - we have to wait around for
> some user thread to do this.
> 
> Solution is to spawn a worker (but only once). It's horrible, but it
> works.
> 
> Cc: Alex Deucher <alexander.deucher@amd.com>
> Cc: Christian König <christian.koenig@amd.com>
> Cc: Chris Wilson <chris@chris-wilson.co.uk>
> Cc: Thomas Zimmermann <tzimmermann@suse.de>
> Cc: Rob Herring <robh@kernel.org>
> Cc: Tomeu Vizoso <tomeu.vizoso@collabora.com>
> Cc: Eric Anholt <eric@anholt.net>
> Cc: Dave Airlie <airlied@redhat.com>
> Cc: Gerd Hoffmann <kraxel@redhat.com>
> Cc: Ben Skeggs <bskeggs@redhat.com>
> Cc: "VMware Graphics" <linux-graphics-maintainer@vmware.com>
> Cc: Thomas Hellstrom <thellstrom@vmware.com>
> Signed-off-by: Daniel Vetter <daniel.vetter@intel.com>
> ---
>  drivers/dma-buf/dma-resv.c | 42 ++++++++++++++++++++++++++++++++++++++
>  1 file changed, 42 insertions(+)
> 
> diff --git a/drivers/dma-buf/dma-resv.c b/drivers/dma-buf/dma-resv.c
> index 42a8f3f11681..29988b1564c1 100644
> --- a/drivers/dma-buf/dma-resv.c
> +++ b/drivers/dma-buf/dma-resv.c
> @@ -34,6 +34,7 @@
>  
>  #include <linux/dma-resv.h>
>  #include <linux/export.h>
> +#include <linux/sched/mm.h>
>  
>  /**
>   * DOC: Reservation Object Overview
> @@ -95,6 +96,28 @@ static void dma_resv_list_free(struct dma_resv_list *list)
>         kfree_rcu(list, rcu);
>  }
>  
> +#if IS_ENABLED(CONFIG_LOCKDEP)
> +struct lockdep_work {
> +       struct work_struct work;
> +       struct dma_resv obj;
> +       struct mm_struct *mm;
> +} lockdep_work;
> +
> +void lockdep_work_fn(struct work_struct *work)
> +{
> +       dma_resv_init(&lockdep_work.obj);
> +
> +       down_read(&lockdep_work.mm->mmap_sem);
> +       ww_mutex_lock(&lockdep_work.obj.lock, NULL);
> +       fs_reclaim_acquire(GFP_KERNEL);
> +       fs_reclaim_release(GFP_KERNEL);
> +       ww_mutex_unlock(&lockdep_work.obj.lock);
> +       up_read(&lockdep_work.mm->mmap_sem);
> +       
> +       mmput(lockdep_work.mm);
> +}
> +#endif

#if IS_ENABLED(CONFIG_LOCKDEP)
static void dma_resv_lockmap(void)
{
	struct mm_struct *mm = alloc_mm();
	struct dma_resv obj;

	dma_resv_init(&obj);

	down_read(&mm->mmap_sem);
	ww_mutex_lock(&obj.lock, NULL);
	fs_reclaim_acquire(GFP_KERNEL);
	fs_reclaim_release(GFP_KERNEL);
	ww_mutex_unlock(&obj.lock);
	up_read(&mm->mmap_sem);

	mmput(mm);
}
core_initcall(dma_resv_lockmap);
#endif

as a thought.
-Chris
_______________________________________________
Intel-gfx mailing list
Intel-gfx@lists.freedesktop.org
https://lists.freedesktop.org/mailman/listinfo/intel-gfx

[PATCH 1/3] dma_resv: prime lockdep annotations

[Daniel Vetter]

Full audit of everyone:

- i915, radeon, amdgpu should be clean per their maintainers.

- vram helpers should be fine, they don't do command submission, so
  really no business holding struct_mutex while doing copy_*_user. But
  I haven't checked them all.

- panfrost seems to dma_resv_lock only in panfrost_job_push, which
  looks clean.

- v3d holds dma_resv locks in the tail of its v3d_submit_cl_ioctl(),
  copying from/to userspace happens all in v3d_lookup_bos which is
  outside of the critical section.

- vmwgfx has a bunch of ioctls that do their own copy_*_user:
  - vmw_execbuf_process: First this does some copies in
    vmw_execbuf_cmdbuf() and also in the vmw_execbuf_process() itself.
    Then comes the usual ttm reserve/validate sequence, then actual
    submission/fencing, then unreserving, and finally some more
    copy_to_user in vmw_execbuf_copy_fence_user. Glossing over tons of
    details, but looks all safe.
  - vmw_fence_event_ioctl: No ttm_reserve/dma_resv_lock anywhere to be
    seen, seems to only create a fence and copy it out.
  - a pile of smaller ioctl in vmwgfx_ioctl.c, no reservations to be
    found there.
  Summary: vmwgfx seems to be fine too.

- virtio: There's virtio_gpu_execbuffer_ioctl, which does all the
  copying from userspace before even looking up objects through their
  handles, so safe. Plus the getparam/getcaps ioctl, also both safe.

- qxl only has qxl_execbuffer_ioctl, which calls into
  qxl_process_single_command. There's a lovely comment before the
  __copy_from_user_inatomic that the slowpath should be copied from
  i915, but I guess that never happened. Try not to be unlucky and get
  your CS data evicted between when it's written and the kernel tries
  to read it. The only other copy_from_user is for relocs, but those
  are done before qxl_release_reserve_list(), which seems to be the
  only thing reserving buffers (in the ttm/dma_resv sense) in that
  code. So looks safe.

- A debugfs file in nouveau_debugfs_pstate_set() and the usif ioctl in
  usif_ioctl() look safe. nouveau_gem_ioctl_pushbuf() otoh breaks this
  everywhere and needs to be fixed up.

v2: Thomas pointed at that vmwgfx calls dma_resv_init while it holds a
dma_resv lock of a different object already. Christian mentioned that
ttm core does this too for ghost objects. intel-gfx-ci highlighted
that i915 has similar issues.

Unfortunately we can't do this in the usual module init functions,
because kernel threads don't have an ->mm - we have to wait around for
some user thread to do this.

Solution is to spawn a worker (but only once). It's horrible, but it
works.

Cc: Alex Deucher <alexander.deucher@amd.com>
Cc: Christian König <christian.koenig@amd.com>
Cc: Chris Wilson <chris@chris-wilson.co.uk>
Cc: Thomas Zimmermann <tzimmermann@suse.de>
Cc: Rob Herring <robh@kernel.org>
Cc: Tomeu Vizoso <tomeu.vizoso@collabora.com>
Cc: Eric Anholt <eric@anholt.net>
Cc: Dave Airlie <airlied@redhat.com>
Cc: Gerd Hoffmann <kraxel@redhat.com>
Cc: Ben Skeggs <bskeggs@redhat.com>
Cc: "VMware Graphics" <linux-graphics-maintainer@vmware.com>
Cc: Thomas Hellstrom <thellstrom@vmware.com>
Signed-off-by: Daniel Vetter <daniel.vetter@intel.com>
---
 drivers/dma-buf/dma-resv.c | 42 ++++++++++++++++++++++++++++++++++++++
 1 file changed, 42 insertions(+)

diff --git a/drivers/dma-buf/dma-resv.c b/drivers/dma-buf/dma-resv.c
index 42a8f3f11681..29988b1564c1 100644
--- a/drivers/dma-buf/dma-resv.c
+++ b/drivers/dma-buf/dma-resv.c
@@ -34,6 +34,7 @@
 
 #include <linux/dma-resv.h>
 #include <linux/export.h>
+#include <linux/sched/mm.h>
 
 /**
  * DOC: Reservation Object Overview
@@ -95,6 +96,28 @@ static void dma_resv_list_free(struct dma_resv_list *list)
 	kfree_rcu(list, rcu);
 }
 
+#if IS_ENABLED(CONFIG_LOCKDEP)
+struct lockdep_work {
+	struct work_struct work;
+	struct dma_resv obj;
+	struct mm_struct *mm;
+} lockdep_work;
+
+void lockdep_work_fn(struct work_struct *work)
+{
+	dma_resv_init(&lockdep_work.obj);
+
+	down_read(&lockdep_work.mm->mmap_sem);
+	ww_mutex_lock(&lockdep_work.obj.lock, NULL);
+	fs_reclaim_acquire(GFP_KERNEL);
+	fs_reclaim_release(GFP_KERNEL);
+	ww_mutex_unlock(&lockdep_work.obj.lock);
+	up_read(&lockdep_work.mm->mmap_sem);
+	
+	mmput(lockdep_work.mm);
+}
+#endif
+
 /**
  * dma_resv_init - initialize a reservation object
  * @obj: the reservation object
@@ -107,6 +130,25 @@ void dma_resv_init(struct dma_resv *obj)
 			&reservation_seqcount_class);
 	RCU_INIT_POINTER(obj->fence, NULL);
 	RCU_INIT_POINTER(obj->fence_excl, NULL);
+
+#if IS_ENABLED(CONFIG_LOCKDEP)
+	if (current->mm) {
+		static atomic_t lockdep_primed;
+
+		/*
+		 * This gets called from all kinds of places, launch a worker.
+		 * Usual init sections don't work for kernel threads lack an
+		 * ->mm.
+		 */
+		if (atomic_cmpxchg(&lockdep_primed, 0, 1) == 0) {
+			INIT_WORK(&lockdep_work.work, lockdep_work_fn);
+			lockdep_work.mm = current->mm;
+			mmget(lockdep_work.mm);
+
+			schedule_work(&lockdep_work.work);
+		}
+	}
+#endif
 }
 EXPORT_SYMBOL(dma_resv_init);
 
-- 
2.23.0.rc1

_______________________________________________
Intel-gfx mailing list
Intel-gfx@lists.freedesktop.org
https://lists.freedesktop.org/mailman/listinfo/intel-gfx

Re: [PATCH 1/3] dma_resv: prime lockdep annotations

[Koenig, Christian]

[-- Attachment #1.1: Type: text/plain, Size: 6825 bytes --]



Am 21.08.2019 20:28 schrieb "Thomas Hellström (VMware)" <thomas_os@shipmail.org>:
On 8/21/19 8:11 PM, Daniel Vetter wrote:
> On Wed, Aug 21, 2019 at 7:06 PM Thomas Hellström (VMware)
> <thomas_os@shipmail.org> wrote:
>> On 8/21/19 6:34 PM, Daniel Vetter wrote:
>>> On Wed, Aug 21, 2019 at 05:54:27PM +0200, Thomas Hellström (VMware) wrote:
>>>> On 8/20/19 4:53 PM, Daniel Vetter wrote:
>>>>> Full audit of everyone:
>>>>>
>>>>> - i915, radeon, amdgpu should be clean per their maintainers.
>>>>>
>>>>> - vram helpers should be fine, they don't do command submission, so
>>>>>      really no business holding struct_mutex while doing copy_*_user. But
>>>>>      I haven't checked them all.
>>>>>
>>>>> - panfrost seems to dma_resv_lock only in panfrost_job_push, which
>>>>>      looks clean.
>>>>>
>>>>> - v3d holds dma_resv locks in the tail of its v3d_submit_cl_ioctl(),
>>>>>      copying from/to userspace happens all in v3d_lookup_bos which is
>>>>>      outside of the critical section.
>>>>>
>>>>> - vmwgfx has a bunch of ioctls that do their own copy_*_user:
>>>>>      - vmw_execbuf_process: First this does some copies in
>>>>>        vmw_execbuf_cmdbuf() and also in the vmw_execbuf_process() itself.
>>>>>        Then comes the usual ttm reserve/validate sequence, then actual
>>>>>        submission/fencing, then unreserving, and finally some more
>>>>>        copy_to_user in vmw_execbuf_copy_fence_user. Glossing over tons of
>>>>>        details, but looks all safe.
>>>>>      - vmw_fence_event_ioctl: No ttm_reserve/dma_resv_lock anywhere to be
>>>>>        seen, seems to only create a fence and copy it out.
>>>>>      - a pile of smaller ioctl in vmwgfx_ioctl.c, no reservations to be
>>>>>        found there.
>>>>>      Summary: vmwgfx seems to be fine too.
>>>>>
>>>>> - virtio: There's virtio_gpu_execbuffer_ioctl, which does all the
>>>>>      copying from userspace before even looking up objects through their
>>>>>      handles, so safe. Plus the getparam/getcaps ioctl, also both safe.
>>>>>
>>>>> - qxl only has qxl_execbuffer_ioctl, which calls into
>>>>>      qxl_process_single_command. There's a lovely comment before the
>>>>>      __copy_from_user_inatomic that the slowpath should be copied from
>>>>>      i915, but I guess that never happened. Try not to be unlucky and get
>>>>>      your CS data evicted between when it's written and the kernel tries
>>>>>      to read it. The only other copy_from_user is for relocs, but those
>>>>>      are done before qxl_release_reserve_list(), which seems to be the
>>>>>      only thing reserving buffers (in the ttm/dma_resv sense) in that
>>>>>      code. So looks safe.
>>>>>
>>>>> - A debugfs file in nouveau_debugfs_pstate_set() and the usif ioctl in
>>>>>      usif_ioctl() look safe. nouveau_gem_ioctl_pushbuf() otoh breaks this
>>>>>      everywhere and needs to be fixed up.
>>>>>
>>>>> Cc: Alex Deucher <alexander.deucher@amd.com>
>>>>> Cc: Christian König <christian.koenig@amd.com>
>>>>> Cc: Chris Wilson <chris@chris-wilson.co.uk>
>>>>> Cc: Thomas Zimmermann <tzimmermann@suse.de>
>>>>> Cc: Rob Herring <robh@kernel.org>
>>>>> Cc: Tomeu Vizoso <tomeu.vizoso@collabora.com>
>>>>> Cc: Eric Anholt <eric@anholt.net>
>>>>> Cc: Dave Airlie <airlied@redhat.com>
>>>>> Cc: Gerd Hoffmann <kraxel@redhat.com>
>>>>> Cc: Ben Skeggs <bskeggs@redhat.com>
>>>>> Cc: "VMware Graphics" <linux-graphics-maintainer@vmware.com>
>>>>> Cc: Thomas Hellstrom <thellstrom@vmware.com>
>>>>> Signed-off-by: Daniel Vetter <daniel.vetter@intel.com>
>>>>> ---
>>>>>     drivers/dma-buf/dma-resv.c | 12 ++++++++++++
>>>>>     1 file changed, 12 insertions(+)
>>>>>
>>>>> diff --git a/drivers/dma-buf/dma-resv.c b/drivers/dma-buf/dma-resv.c
>>>>> index 42a8f3f11681..3edca10d3faf 100644
>>>>> --- a/drivers/dma-buf/dma-resv.c
>>>>> +++ b/drivers/dma-buf/dma-resv.c
>>>>> @@ -34,6 +34,7 @@
>>>>>     #include <linux/dma-resv.h>
>>>>>     #include <linux/export.h>
>>>>> +#include <linux/sched/mm.h>
>>>>>     /**
>>>>>      * DOC: Reservation Object Overview
>>>>> @@ -107,6 +108,17 @@ void dma_resv_init(struct dma_resv *obj)
>>>>>                      &reservation_seqcount_class);
>>>>>      RCU_INIT_POINTER(obj->fence, NULL);
>>>>>      RCU_INIT_POINTER(obj->fence_excl, NULL);
>>>>> +
>>>>> +   if (IS_ENABLED(CONFIG_LOCKDEP)) {
>>>>> +           if (current->mm)
>>>>> +                   down_read(&current->mm->mmap_sem);
>>>>> +           ww_mutex_lock(&obj->lock, NULL);
>>>>> +           fs_reclaim_acquire(GFP_KERNEL);
>>>>> +           fs_reclaim_release(GFP_KERNEL);
>>>>> +           ww_mutex_unlock(&obj->lock);
>>>>> +           if (current->mm)
>>>>> +                   up_read(&current->mm->mmap_sem);
>>>>> +   }
>>>>>     }
>>>>>     EXPORT_SYMBOL(dma_resv_init);
>>>> I assume if this would have been easily done and maintainable using only
>>>> lockdep annotation instead of actually acquiring the locks, that would have
>>>> been done?
>>> There's might_lock(), plus a pile of macros, but they don't map obviuosly,
>>> so pretty good chances I accidentally end up with the wrong type of
>>> annotation. Easier to just take the locks quickly, and stuff that all into
>>> a lockdep-only section to avoid overhead.
>>>
>>>> Otherwise LGTM.
>>>>
>>>> Reviewed-by: Thomas Hellström <thellstrom@vmware.com>
>>>>
>>>> Will test this and let you know if it trips on vmwgfx, but it really
>>>> shouldn't.
>>> Thanks, Daniel
>> One thing that strikes me is that this puts restrictions on where you
>> can actually initialize a dma_resv, even if locking orders are otherwise
>> obeyed. But that might not be a big problem.
> Hm yeah ... the trouble is a need a non-kthread thread so that I have
> a current->mm. Otherwise I'd have put it into some init section with a
> temp dma_buf. And I kinda don't want to create a fake ->mm just for
> lockdep priming. I don't expect this to be a real problem in practice,
> since before you've called dma_resv_init the reservation lock doesn't
> exist, so you can't hold it. And you've probably just allocated it, so
> fs_reclaim is going to be fine. And if you allocate dma_resv objects
> from your fault handlers I have questions anyway :-)

Coming to think of it, I think vmwgfx sometimes create bos with other
bo's reservation lock held. I guess that would trip both the mmap_sem
check the ww_mutex check?

Dito inside TTM for ghost objects.

We even used to have an dma_resv_init() in an atomic section, but that should be gone by now.

Anyway, probably have to take my review back since this will certainly go up in flames.

Need a better place for this,
Christian.


/Thomas


/Thomas




>
> So I think this should be safe.
> -Daniel




[-- Attachment #1.2: Type: text/html, Size: 11899 bytes --]

[-- Attachment #2: Type: text/plain, Size: 159 bytes --]

_______________________________________________
Intel-gfx mailing list
Intel-gfx@lists.freedesktop.org
https://lists.freedesktop.org/mailman/listinfo/intel-gfx