[PATCH] drm/amdgpu: refuse to reserve io mem for split VRAM buffers

[PATCH] drm/amdgpu: refuse to reserve io mem for split VRAM buffers

[Nicolai Hähnle]

From: Nicolai Hähnle <nicolai.haehnle@amd.com>

When the fast blit path fails while attempting to move a buffer from RAM
to VRAM, we fall back to a CPU-based memcpy that cannot handle split VRAM
buffers. Instead of crashing, simply fail the buffer move.

Ideally, we would teach TTM about split buffers so that the fallback still
works in this case, but that is quite involved. So for now, apply the
simplest possible fix.

Fixes: 40361bb1704b ("drm/amdgpu: add VRAM manager v2")
Signed-off-by: Nicolai Hähnle <nicolai.haehnle@amd.com>
--
I ran into this bug during testing. Unfortunately it does not fix the
memory corruption bug that I mentioned elsewhere... oh well.
---
 drivers/gpu/drm/amd/amdgpu/amdgpu_ttm.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_ttm.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_ttm.c
index 8d6a68f..f8b578d 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_ttm.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_ttm.c
@@ -529,6 +529,9 @@ static int amdgpu_ttm_io_mem_reserve(struct ttm_bo_device *bdev, struct ttm_mem_
 	case TTM_PL_TT:
 		break;
 	case TTM_PL_VRAM:
+		if (mem->start == AMDGPU_BO_INVALID_OFFSET)
+			return -EINVAL;
+
 		mem->bus.offset = mem->start << PAGE_SHIFT;
 		/* check if it's visible */
 		if ((mem->bus.offset + mem->bus.size) > adev->mc.visible_vram_size)
-- 
2.9.3

_______________________________________________
amd-gfx mailing list
amd-gfx@lists.freedesktop.org
https://lists.freedesktop.org/mailman/listinfo/amd-gfx

Re: [PATCH] drm/amdgpu: refuse to reserve io mem for split VRAM buffers

[Alex Deucher]

On Thu, Feb 16, 2017 at 5:55 PM, Nicolai Hähnle <nhaehnle@gmail.com> wrote:
> From: Nicolai Hähnle <nicolai.haehnle@amd.com>
>
> When the fast blit path fails while attempting to move a buffer from RAM
> to VRAM, we fall back to a CPU-based memcpy that cannot handle split VRAM
> buffers. Instead of crashing, simply fail the buffer move.
>
> Ideally, we would teach TTM about split buffers so that the fallback still
> works in this case, but that is quite involved. So for now, apply the
> simplest possible fix.
>
> Fixes: 40361bb1704b ("drm/amdgpu: add VRAM manager v2")
> Signed-off-by: Nicolai Hähnle <nicolai.haehnle@amd.com>

Possibly fixes this bug report?
https://bugzilla.kernel.org/show_bug.cgi?id=194579

Alex

> --
> I ran into this bug during testing. Unfortunately it does not fix the
> memory corruption bug that I mentioned elsewhere... oh well.
> ---
>  drivers/gpu/drm/amd/amdgpu/amdgpu_ttm.c | 3 +++
>  1 file changed, 3 insertions(+)
>
> diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_ttm.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_ttm.c
> index 8d6a68f..f8b578d 100644
> --- a/drivers/gpu/drm/amd/amdgpu/amdgpu_ttm.c
> +++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_ttm.c
> @@ -529,6 +529,9 @@ static int amdgpu_ttm_io_mem_reserve(struct ttm_bo_device *bdev, struct ttm_mem_
>         case TTM_PL_TT:
>                 break;
>         case TTM_PL_VRAM:
> +               if (mem->start == AMDGPU_BO_INVALID_OFFSET)
> +                       return -EINVAL;
> +
>                 mem->bus.offset = mem->start << PAGE_SHIFT;
>                 /* check if it's visible */
>                 if ((mem->bus.offset + mem->bus.size) > adev->mc.visible_vram_size)
> --
> 2.9.3
>
> _______________________________________________
> amd-gfx mailing list
> amd-gfx@lists.freedesktop.org
> https://lists.freedesktop.org/mailman/listinfo/amd-gfx
_______________________________________________
amd-gfx mailing list
amd-gfx@lists.freedesktop.org
https://lists.freedesktop.org/mailman/listinfo/amd-gfx

Re: [PATCH] drm/amdgpu: refuse to reserve io mem for split VRAM buffers

[Nicolai Hähnle]

On 17.02.2017 00:02, Alex Deucher wrote:
> On Thu, Feb 16, 2017 at 5:55 PM, Nicolai Hähnle <nhaehnle@gmail.com> wrote:
>> From: Nicolai Hähnle <nicolai.haehnle@amd.com>
>>
>> When the fast blit path fails while attempting to move a buffer from RAM
>> to VRAM, we fall back to a CPU-based memcpy that cannot handle split VRAM
>> buffers. Instead of crashing, simply fail the buffer move.
>>
>> Ideally, we would teach TTM about split buffers so that the fallback still
>> works in this case, but that is quite involved. So for now, apply the
>> simplest possible fix.
>>
>> Fixes: 40361bb1704b ("drm/amdgpu: add VRAM manager v2")
>> Signed-off-by: Nicolai Hähnle <nicolai.haehnle@amd.com>
>
> Possibly fixes this bug report?
> https://bugzilla.kernel.org/show_bug.cgi?id=194579

It's related, but I think that report is a false positive. It does point 
at code that is not too pretty, though. I've commented on that bug 
report as well.

In any case, that overflow should indeed happen whenever the bug 
addressed by this patch happens, but (a) this patch doesn't change that, 
and (b) I'm pretty sure that the overflow reported by PaX is benign.

We may still have other bugs with split BOs, though.

Cheers,
Nicolai

>
> Alex
>
>> --
>> I ran into this bug during testing. Unfortunately it does not fix the
>> memory corruption bug that I mentioned elsewhere... oh well.
>> ---
>>  drivers/gpu/drm/amd/amdgpu/amdgpu_ttm.c | 3 +++
>>  1 file changed, 3 insertions(+)
>>
>> diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_ttm.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_ttm.c
>> index 8d6a68f..f8b578d 100644
>> --- a/drivers/gpu/drm/amd/amdgpu/amdgpu_ttm.c
>> +++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_ttm.c
>> @@ -529,6 +529,9 @@ static int amdgpu_ttm_io_mem_reserve(struct ttm_bo_device *bdev, struct ttm_mem_
>>         case TTM_PL_TT:
>>                 break;
>>         case TTM_PL_VRAM:
>> +               if (mem->start == AMDGPU_BO_INVALID_OFFSET)
>> +                       return -EINVAL;
>> +
>>                 mem->bus.offset = mem->start << PAGE_SHIFT;
>>                 /* check if it's visible */
>>                 if ((mem->bus.offset + mem->bus.size) > adev->mc.visible_vram_size)
>> --
>> 2.9.3
>>
>> _______________________________________________
>> amd-gfx mailing list
>> amd-gfx@lists.freedesktop.org
>> https://lists.freedesktop.org/mailman/listinfo/amd-gfx

_______________________________________________
amd-gfx mailing list
amd-gfx@lists.freedesktop.org
https://lists.freedesktop.org/mailman/listinfo/amd-gfx

Re: [PATCH] drm/amdgpu: refuse to reserve io mem for split VRAM buffers

[Christian König]

Am 17.02.2017 um 00:21 schrieb Nicolai Hähnle:
> On 17.02.2017 00:02, Alex Deucher wrote:
>> On Thu, Feb 16, 2017 at 5:55 PM, Nicolai Hähnle <nhaehnle@gmail.com> 
>> wrote:
>>> From: Nicolai Hähnle <nicolai.haehnle@amd.com>
>>>
>>> When the fast blit path fails while attempting to move a buffer from 
>>> RAM
>>> to VRAM, we fall back to a CPU-based memcpy that cannot handle split 
>>> VRAM
>>> buffers. Instead of crashing, simply fail the buffer move.
>>>
>>> Ideally, we would teach TTM about split buffers so that the fallback 
>>> still
>>> works in this case, but that is quite involved. So for now, apply the
>>> simplest possible fix.
>>>
>>> Fixes: 40361bb1704b ("drm/amdgpu: add VRAM manager v2")
>>> Signed-off-by: Nicolai Hähnle <nicolai.haehnle@amd.com>
>>
>> Possibly fixes this bug report?
>> https://bugzilla.kernel.org/show_bug.cgi?id=194579
>
> It's related, but I think that report is a false positive. It does 
> point at code that is not too pretty, though. I've commented on that 
> bug report as well.
>
> In any case, that overflow should indeed happen whenever the bug 
> addressed by this patch happens, but (a) this patch doesn't change 
> that, and (b) I'm pretty sure that the overflow reported by PaX is 
> benign.

Yes, agree. The bug report is indeed a false positive.

Nicolai what do you think about removing the offset from the BO 
structure and only calculate it on demand?

>
> We may still have other bugs with split BOs, though.

Yeah, agree as well. I was also considering disabling that feature by 
default for the moment if it helps with your corruption bug.

Regards,
Christian.

>
> Cheers,
> Nicolai
>
>>
>> Alex
>>
>>> -- 
>>> I ran into this bug during testing. Unfortunately it does not fix the
>>> memory corruption bug that I mentioned elsewhere... oh well.
>>> ---
>>>  drivers/gpu/drm/amd/amdgpu/amdgpu_ttm.c | 3 +++
>>>  1 file changed, 3 insertions(+)
>>>
>>> diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_ttm.c 
>>> b/drivers/gpu/drm/amd/amdgpu/amdgpu_ttm.c
>>> index 8d6a68f..f8b578d 100644
>>> --- a/drivers/gpu/drm/amd/amdgpu/amdgpu_ttm.c
>>> +++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_ttm.c
>>> @@ -529,6 +529,9 @@ static int amdgpu_ttm_io_mem_reserve(struct 
>>> ttm_bo_device *bdev, struct ttm_mem_
>>>         case TTM_PL_TT:
>>>                 break;
>>>         case TTM_PL_VRAM:
>>> +               if (mem->start == AMDGPU_BO_INVALID_OFFSET)
>>> +                       return -EINVAL;
>>> +
>>>                 mem->bus.offset = mem->start << PAGE_SHIFT;
>>>                 /* check if it's visible */
>>>                 if ((mem->bus.offset + mem->bus.size) > 
>>> adev->mc.visible_vram_size)
>>> -- 
>>> 2.9.3
>>>
>>> _______________________________________________
>>> amd-gfx mailing list
>>> amd-gfx@lists.freedesktop.org
>>> https://lists.freedesktop.org/mailman/listinfo/amd-gfx
>
> _______________________________________________
> amd-gfx mailing list
> amd-gfx@lists.freedesktop.org
> https://lists.freedesktop.org/mailman/listinfo/amd-gfx


_______________________________________________
amd-gfx mailing list
amd-gfx@lists.freedesktop.org
https://lists.freedesktop.org/mailman/listinfo/amd-gfx

Re: [PATCH] drm/amdgpu: refuse to reserve io mem for split VRAM buffers

[Nicolai Hähnle]

On 17.02.2017 11:08, Christian König wrote:
> Am 17.02.2017 um 00:21 schrieb Nicolai Hähnle:
>> On 17.02.2017 00:02, Alex Deucher wrote:
>>> On Thu, Feb 16, 2017 at 5:55 PM, Nicolai Hähnle <nhaehnle@gmail.com>
>>> wrote:
>>>> From: Nicolai Hähnle <nicolai.haehnle@amd.com>
>>>>
>>>> When the fast blit path fails while attempting to move a buffer from
>>>> RAM
>>>> to VRAM, we fall back to a CPU-based memcpy that cannot handle split
>>>> VRAM
>>>> buffers. Instead of crashing, simply fail the buffer move.
>>>>
>>>> Ideally, we would teach TTM about split buffers so that the fallback
>>>> still
>>>> works in this case, but that is quite involved. So for now, apply the
>>>> simplest possible fix.
>>>>
>>>> Fixes: 40361bb1704b ("drm/amdgpu: add VRAM manager v2")
>>>> Signed-off-by: Nicolai Hähnle <nicolai.haehnle@amd.com>
>>>
>>> Possibly fixes this bug report?
>>> https://bugzilla.kernel.org/show_bug.cgi?id=194579
>>
>> It's related, but I think that report is a false positive. It does
>> point at code that is not too pretty, though. I've commented on that
>> bug report as well.
>>
>> In any case, that overflow should indeed happen whenever the bug
>> addressed by this patch happens, but (a) this patch doesn't change
>> that, and (b) I'm pretty sure that the overflow reported by PaX is
>> benign.
>
> Yes, agree. The bug report is indeed a false positive.
>
> Nicolai what do you think about removing the offset from the BO
> structure and only calculate it on demand?

I think it's a good idea. There are lots of uses in other drivers, 
though, so a first step would be adding a helper analogous to 
amdgpu_bo_gpu_offset in ttm_bo_api.h.


>> We may still have other bugs with split BOs, though.
>
> Yeah, agree as well. I was also considering disabling that feature by
> default for the moment if it helps with your corruption bug.

Good point, I'll give that a try as well.

Cheers,
Nicolai
_______________________________________________
amd-gfx mailing list
amd-gfx@lists.freedesktop.org
https://lists.freedesktop.org/mailman/listinfo/amd-gfx

Re: [PATCH] drm/amdgpu: refuse to reserve io mem for split VRAM buffers

[Nicolai Hähnle]

Ping? People seem to agree, but I haven't seen an explicit R-b...

On 16.02.2017 23:55, Nicolai Hähnle wrote:
> From: Nicolai Hähnle <nicolai.haehnle@amd.com>
>
> When the fast blit path fails while attempting to move a buffer from RAM
> to VRAM, we fall back to a CPU-based memcpy that cannot handle split VRAM
> buffers. Instead of crashing, simply fail the buffer move.
>
> Ideally, we would teach TTM about split buffers so that the fallback still
> works in this case, but that is quite involved. So for now, apply the
> simplest possible fix.
>
> Fixes: 40361bb1704b ("drm/amdgpu: add VRAM manager v2")
> Signed-off-by: Nicolai Hähnle <nicolai.haehnle@amd.com>
> --
> I ran into this bug during testing. Unfortunately it does not fix the
> memory corruption bug that I mentioned elsewhere... oh well.
> ---
>  drivers/gpu/drm/amd/amdgpu/amdgpu_ttm.c | 3 +++
>  1 file changed, 3 insertions(+)
>
> diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_ttm.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_ttm.c
> index 8d6a68f..f8b578d 100644
> --- a/drivers/gpu/drm/amd/amdgpu/amdgpu_ttm.c
> +++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_ttm.c
> @@ -529,6 +529,9 @@ static int amdgpu_ttm_io_mem_reserve(struct ttm_bo_device *bdev, struct ttm_mem_
>  	case TTM_PL_TT:
>  		break;
>  	case TTM_PL_VRAM:
> +		if (mem->start == AMDGPU_BO_INVALID_OFFSET)
> +			return -EINVAL;
> +
>  		mem->bus.offset = mem->start << PAGE_SHIFT;
>  		/* check if it's visible */
>  		if ((mem->bus.offset + mem->bus.size) > adev->mc.visible_vram_size)
>

_______________________________________________
amd-gfx mailing list
amd-gfx@lists.freedesktop.org
https://lists.freedesktop.org/mailman/listinfo/amd-gfx

Re: [PATCH] drm/amdgpu: refuse to reserve io mem for split VRAM buffers

[Christian König]

Sorry, patch is Reviewed-by: Christian König <christian.koenig@amd.com>.

Christian.

Am 20.02.2017 um 18:23 schrieb Nicolai Hähnle:
> Ping? People seem to agree, but I haven't seen an explicit R-b...
>
> On 16.02.2017 23:55, Nicolai Hähnle wrote:
>> From: Nicolai Hähnle <nicolai.haehnle@amd.com>
>>
>> When the fast blit path fails while attempting to move a buffer from RAM
>> to VRAM, we fall back to a CPU-based memcpy that cannot handle split 
>> VRAM
>> buffers. Instead of crashing, simply fail the buffer move.
>>
>> Ideally, we would teach TTM about split buffers so that the fallback 
>> still
>> works in this case, but that is quite involved. So for now, apply the
>> simplest possible fix.
>>
>> Fixes: 40361bb1704b ("drm/amdgpu: add VRAM manager v2")
>> Signed-off-by: Nicolai Hähnle <nicolai.haehnle@amd.com>
>> -- 
>> I ran into this bug during testing. Unfortunately it does not fix the
>> memory corruption bug that I mentioned elsewhere... oh well.
>> ---
>>  drivers/gpu/drm/amd/amdgpu/amdgpu_ttm.c | 3 +++
>>  1 file changed, 3 insertions(+)
>>
>> diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_ttm.c 
>> b/drivers/gpu/drm/amd/amdgpu/amdgpu_ttm.c
>> index 8d6a68f..f8b578d 100644
>> --- a/drivers/gpu/drm/amd/amdgpu/amdgpu_ttm.c
>> +++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_ttm.c
>> @@ -529,6 +529,9 @@ static int amdgpu_ttm_io_mem_reserve(struct 
>> ttm_bo_device *bdev, struct ttm_mem_
>>      case TTM_PL_TT:
>>          break;
>>      case TTM_PL_VRAM:
>> +        if (mem->start == AMDGPU_BO_INVALID_OFFSET)
>> +            return -EINVAL;
>> +
>>          mem->bus.offset = mem->start << PAGE_SHIFT;
>>          /* check if it's visible */
>>          if ((mem->bus.offset + mem->bus.size) > 
>> adev->mc.visible_vram_size)
>>
>
> _______________________________________________
> amd-gfx mailing list
> amd-gfx@lists.freedesktop.org
> https://lists.freedesktop.org/mailman/listinfo/amd-gfx


_______________________________________________
amd-gfx mailing list
amd-gfx@lists.freedesktop.org
https://lists.freedesktop.org/mailman/listinfo/amd-gfx

Re: [PATCH] drm/amdgpu: refuse to reserve io mem for split VRAM buffers

[Nicolai Hähnle]

On 20.02.2017 18:29, Christian König wrote:
> Sorry, patch is Reviewed-by: Christian König <christian.koenig@amd.com>.

Thanks!

>
> Christian.
>
> Am 20.02.2017 um 18:23 schrieb Nicolai Hähnle:
>> Ping? People seem to agree, but I haven't seen an explicit R-b...
>>
>> On 16.02.2017 23:55, Nicolai Hähnle wrote:
>>> From: Nicolai Hähnle <nicolai.haehnle@amd.com>
>>>
>>> When the fast blit path fails while attempting to move a buffer from RAM
>>> to VRAM, we fall back to a CPU-based memcpy that cannot handle split
>>> VRAM
>>> buffers. Instead of crashing, simply fail the buffer move.
>>>
>>> Ideally, we would teach TTM about split buffers so that the fallback
>>> still
>>> works in this case, but that is quite involved. So for now, apply the
>>> simplest possible fix.
>>>
>>> Fixes: 40361bb1704b ("drm/amdgpu: add VRAM manager v2")
>>> Signed-off-by: Nicolai Hähnle <nicolai.haehnle@amd.com>
>>> --
>>> I ran into this bug during testing. Unfortunately it does not fix the
>>> memory corruption bug that I mentioned elsewhere... oh well.
>>> ---
>>>  drivers/gpu/drm/amd/amdgpu/amdgpu_ttm.c | 3 +++
>>>  1 file changed, 3 insertions(+)
>>>
>>> diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_ttm.c
>>> b/drivers/gpu/drm/amd/amdgpu/amdgpu_ttm.c
>>> index 8d6a68f..f8b578d 100644
>>> --- a/drivers/gpu/drm/amd/amdgpu/amdgpu_ttm.c
>>> +++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_ttm.c
>>> @@ -529,6 +529,9 @@ static int amdgpu_ttm_io_mem_reserve(struct
>>> ttm_bo_device *bdev, struct ttm_mem_
>>>      case TTM_PL_TT:
>>>          break;
>>>      case TTM_PL_VRAM:
>>> +        if (mem->start == AMDGPU_BO_INVALID_OFFSET)
>>> +            return -EINVAL;
>>> +
>>>          mem->bus.offset = mem->start << PAGE_SHIFT;
>>>          /* check if it's visible */
>>>          if ((mem->bus.offset + mem->bus.size) >
>>> adev->mc.visible_vram_size)
>>>
>>
>> _______________________________________________
>> amd-gfx mailing list
>> amd-gfx@lists.freedesktop.org
>> https://lists.freedesktop.org/mailman/listinfo/amd-gfx
>
>

_______________________________________________
amd-gfx mailing list
amd-gfx@lists.freedesktop.org
https://lists.freedesktop.org/mailman/listinfo/amd-gfx

Re: [PATCH] drm/amdgpu: refuse to reserve io mem for split VRAM buffers

[Nicolai Hähnle]

On 17.02.2017 11:08, Christian König wrote:
> Am 17.02.2017 um 00:21 schrieb Nicolai Hähnle:
>> We may still have other bugs with split BOs, though.
>
> Yeah, agree as well. I was also considering disabling that feature by
> default for the moment if it helps with your corruption bug.

The corruption still occurs with amdgpu.vram_page_split = -1, unfortunately.

Cheers,
Nicolai
_______________________________________________
amd-gfx mailing list
amd-gfx@lists.freedesktop.org
https://lists.freedesktop.org/mailman/listinfo/amd-gfx