Re: [PATCH v2 2/8] drm/ttm: Remap all page faults to per process dummy page.

[Daniel Vetter <daniel@ffwll.ch>]

On Tue, Jun 23, 2020 at 11:31:45PM -0400, Andrey Grodzovsky wrote:
> 
> On 6/22/20 5:41 AM, Daniel Vetter wrote:
> > On Sun, Jun 21, 2020 at 02:03:02AM -0400, Andrey Grodzovsky wrote:
> > > On device removal reroute all CPU mappings to dummy page per drm_file
> > > instance or imported GEM object.
> > > 
> > > Signed-off-by: Andrey Grodzovsky <andrey.grodzovsky@amd.com>
> > > ---
> > >   drivers/gpu/drm/ttm/ttm_bo_vm.c | 65 ++++++++++++++++++++++++++++++++++++-----
> > >   1 file changed, 57 insertions(+), 8 deletions(-)
> > > 
> > > diff --git a/drivers/gpu/drm/ttm/ttm_bo_vm.c b/drivers/gpu/drm/ttm/ttm_bo_vm.c
> > > index 389128b..2f8bf5e 100644
> > > --- a/drivers/gpu/drm/ttm/ttm_bo_vm.c
> > > +++ b/drivers/gpu/drm/ttm/ttm_bo_vm.c
> > > @@ -35,6 +35,8 @@
> > >   #include <drm/ttm/ttm_bo_driver.h>
> > >   #include <drm/ttm/ttm_placement.h>
> > >   #include <drm/drm_vma_manager.h>
> > > +#include <drm/drm_drv.h>
> > > +#include <drm/drm_file.h>
> > >   #include <linux/mm.h>
> > >   #include <linux/pfn_t.h>
> > >   #include <linux/rbtree.h>
> > > @@ -328,19 +330,66 @@ vm_fault_t ttm_bo_vm_fault(struct vm_fault *vmf)
> > Hm I think diff and code flow look a bit bad now. What about renaming the
> > current function to __ttm_bo_vm_fault and then having something like the
> > below:
> > 
> > ttm_bo_vm_fault(args) {
> > 
> > 	if (drm_dev_enter()) {
> > 		__ttm_bo_vm_fault(args);
> > 		drm_dev_exit();
> > 	} else  {
> > 		drm_gem_insert_dummy_pfn();
> > 	}
> > }
> > 
> > I think drm_gem_insert_dummy_pfn(); should be portable across drivers, so
> > another nice point to try to unifiy drivers as much as possible.
> > -Daniel
> > 
> > >   	pgprot_t prot;
> > >   	struct ttm_buffer_object *bo = vma->vm_private_data;
> > >   	vm_fault_t ret;
> > > +	int idx;
> > > +	struct drm_device *ddev = bo->base.dev;
> > > -	ret = ttm_bo_vm_reserve(bo, vmf);
> > > -	if (ret)
> > > -		return ret;
> > > +	if (drm_dev_enter(ddev, &idx)) {
> > > +		ret = ttm_bo_vm_reserve(bo, vmf);
> > > +		if (ret)
> > > +			goto exit;
> > > +
> > > +		prot = vma->vm_page_prot;
> > > -	prot = vma->vm_page_prot;
> > > -	ret = ttm_bo_vm_fault_reserved(vmf, prot, TTM_BO_VM_NUM_PREFAULT);
> > > -	if (ret == VM_FAULT_RETRY && !(vmf->flags & FAULT_FLAG_RETRY_NOWAIT))
> > > +		ret = ttm_bo_vm_fault_reserved(vmf, prot, TTM_BO_VM_NUM_PREFAULT);
> > > +		if (ret == VM_FAULT_RETRY && !(vmf->flags & FAULT_FLAG_RETRY_NOWAIT))
> > > +			goto exit;
> > > +
> > > +		dma_resv_unlock(bo->base.resv);
> > > +
> > > +exit:
> > > +		drm_dev_exit(idx);
> > >   		return ret;
> > > +	} else {
> > > -	dma_resv_unlock(bo->base.resv);
> > > +		struct drm_file *file = NULL;
> > > +		struct page *dummy_page = NULL;
> > > +		int handle;
> > > -	return ret;
> > > +		/* We are faulting on imported BO from dma_buf */
> > > +		if (bo->base.dma_buf && bo->base.import_attach) {
> > > +			dummy_page = bo->base.dummy_page;
> > > +		/* We are faulting on non imported BO, find drm_file owning the BO*/
> > Uh, we can't fish that out of the vma->vm_file pointer somehow? Or is that
> > one all wrong? Doing this kind of list walk looks pretty horrible.
> > 
> > If the vma doesn't have the right pointer I guess next option is that we
> > store the drm_file page in gem_bo->dummy_page, and replace it on first
> > export. But that's going to be tricky to track ...
> > 
> > > +		} else {
> > > +			struct drm_gem_object *gobj;
> > > +
> > > +			mutex_lock(&ddev->filelist_mutex);
> > > +			list_for_each_entry(file, &ddev->filelist, lhead) {
> > > +				spin_lock(&file->table_lock);
> > > +				idr_for_each_entry(&file->object_idr, gobj, handle) {
> > > +					if (gobj == &bo->base) {
> > > +						dummy_page = file->dummy_page;
> > > +						break;
> > > +					}
> > > +				}
> > > +				spin_unlock(&file->table_lock);
> > > +			}
> > > +			mutex_unlock(&ddev->filelist_mutex);
> > > +		}
> > > +
> > > +		if (dummy_page) {
> > > +			/*
> > > +			 * Let do_fault complete the PTE install e.t.c using vmf->page
> > > +			 *
> > > +			 * TODO - should i call free_page somewhere ?
> > Nah, instead don't call get_page. The page will be around as long as
> > there's a reference for the drm_file or gem_bo, which is longer than any
> > mmap. Otherwise yes this would like really badly.
> 
> 
> So actually that was my thinking in the first place and I indeed avoided
> taking reference and this ended up
> with multiple BUG_ONs as seen bellow where  refcount:-63 mapcount:-48 for a
> page are deep into negative
> values... Those warnings were gone once i added get_page(dummy) which in my
> opinion implies that there
> is a page reference per each PTE and that when there is unmapping of the
> process address
> space and PTEs are deleted there is also put_page somewhere in mm core and
> the get_page per mapping
> keeps it balanced.
> 
> Jun 20 01:36:43 ubuntu-1604-test kernel: [   98.762929] BUG: Bad page map in
> process glxgear:disk$0  pte:8000000132284867 pmd:15aaec067
> Jun 20 01:36:43 ubuntu-1604-test kernel: [   98.762931]
> page:ffffe63384c8a100 refcount:-63 mapcount:-48 mapping:0000000000000000
> index:0x0
> Jun 20 01:36:43 ubuntu-1604-test kernel: [   98.762932] flags:
> 0x17fff8000000008(dirty)
> Jun 20 01:36:43 ubuntu-1604-test kernel: [   98.762933] raw:
> 017fff8000000008 dead000000000100 dead000000000122 0000000000000000
> Jun 20 01:36:43 ubuntu-1604-test kernel: [   98.762934] raw:
> 0000000000000000 0000000000000000 ffffffc1ffffffcf 0000000000000000
> Jun 20 01:36:43 ubuntu-1604-test kernel: [   98.762935] page dumped because: bad pte
> Jun 20 01:36:43 ubuntu-1604-test kernel: [   98.762937]
> addr:00007fe086263000 vm_flags:1c0440fb anon_vma:0000000000000000
> mapping:ffff9b5cd42db268 index:1008b3
> Jun 20 01:36:43 ubuntu-1604-test kernel: [   98.762981] file:renderD129
> fault:ttm_bo_vm_fault [ttm] mmap:amdgpu_mmap [amdgpu] readpage:0x0
> Jun 20 01:36:43 ubuntu-1604-test kernel: [   98.762984] CPU: 5 PID: 2619
> Comm: glxgear:disk$0 Tainted: G    B      OE 5.6.0-dev+ #51
> Jun 20 01:36:43 ubuntu-1604-test kernel: [   98.762985] Hardware name:
> System manufacturer System Product Name/RAMPAGE IV FORMULA, BIOS 4804
> 12/30/2013
> Jun 20 01:36:43 ubuntu-1604-test kernel: [   98.762985] Call Trace:
> Jun 20 01:36:43 ubuntu-1604-test kernel: [   98.762988] dump_stack+0x68/0x9b
> Jun 20 01:36:43 ubuntu-1604-test kernel: [   98.762990] print_bad_pte+0x19f/0x270
> Jun 20 01:36:43 ubuntu-1604-test kernel: [   98.762992]  ? lock_page_memcg+0x5/0xf0
> Jun 20 01:36:43 ubuntu-1604-test kernel: [   98.762995] unmap_page_range+0x777/0xbe0
> Jun 20 01:36:43 ubuntu-1604-test kernel: [   98.763000] unmap_vmas+0xcc/0x160
> Jun 20 01:36:43 ubuntu-1604-test kernel: [   98.763004] exit_mmap+0xb5/0x1b0
> Jun 20 01:36:43 ubuntu-1604-test kernel: [   98.763009] mmput+0x65/0x140
> Jun 20 01:36:43 ubuntu-1604-test kernel: [   98.763010] do_exit+0x362/0xc40
> Jun 20 01:36:43 ubuntu-1604-test kernel: [   98.763013] do_group_exit+0x47/0xb0
> Jun 20 01:36:43 ubuntu-1604-test kernel: [   98.763016] get_signal+0x18b/0xc30
> Jun 20 01:36:43 ubuntu-1604-test kernel: [   98.763019] do_signal+0x36/0x6a0
> Jun 20 01:36:43 ubuntu-1604-test kernel: [   98.763021]  ?
> __set_task_comm+0x62/0x120
> Jun 20 01:36:43 ubuntu-1604-test kernel: [   98.763024]  ?
> __x64_sys_futex+0x88/0x180
> Jun 20 01:36:43 ubuntu-1604-test kernel: [   98.763028]
> exit_to_usermode_loop+0x6f/0xc0
> Jun 20 01:36:43 ubuntu-1604-test kernel: [   98.763030] do_syscall_64+0x149/0x1c0
> Jun 20 01:36:43 ubuntu-1604-test kernel: [   98.763032]
> entry_SYSCALL_64_after_hwframe+0x49/0xbe
> Jun 20 01:36:43 ubuntu-1604-test kernel: [   98.763034] RIP: 0033:0x7fe091bd9360
> Jun 20 01:36:43 ubuntu-1604-test kernel: [   98.763037] Code: Bad RIP value.

Uh, I guess that just shows how little I understand how this all works.
But yeah if we set vmf->page then I guess core mm takes care of
everything, but apparently expects a page reference.
-Daniel
 
> Andrey
> 
> 
> > 
> > > +			 */
> > > +			get_page(dummy_page);
> > > +			vmf->page = dummy_page;
> > > +			return 0;
> > > +		} else {
> > > +			return VM_FAULT_SIGSEGV;
> > Hm that would be a kernel bug, wouldn't it? WARN_ON() required here imo.
> > -Daniel
> > 
> > > +		}
> > > +	}
> > >   }
> > >   EXPORT_SYMBOL(ttm_bo_vm_fault);
> > > -- 
> > > 2.7.4
> > > 

-- 
Daniel Vetter
Software Engineer, Intel Corporation
http://blog.ffwll.ch
_______________________________________________
amd-gfx mailing list
amd-gfx@lists.freedesktop.org
https://lists.freedesktop.org/mailman/listinfo/amd-gfx