linux-stable.git/drivers/gpu/drm/ttm, branch linux-3.13.y

drm/ttm: don't oops if no invalidate_caches()

2014-03-24T04:44:05+00:00

commit 9ef7506f7eff3fc42724269f62e30164c141661f upstream.

A few of the simpler TTM drivers (cirrus, ast, mgag200) do not implement
this function.  Yet can end up somehow with an evicted bo:

  BUG: unable to handle kernel NULL pointer dereference at           (null)
  IP: [<          (null)>]           (null)
  PGD 16e761067 PUD 16e6cf067 PMD 0
  Oops: 0010 [#1] SMP
  Modules linked in: bnep bluetooth rfkill fuse ip6t_rpfilter ip6t_REJECT ipt_REJECT xt_conntrack ebtable_nat ebtable_broute bridge stp llc ebtable_filter ebtables ip6table_nat nf_conntrack_ipv6 nf_defrag_ipv6 nf_nat_ipv6 ip6table_mangle ip6table_security ip6table_raw ip6table_filter ip6_tables iptable_nat nf_conntrack_ipv4 nf_defrag_ipv4 nf_nat_ipv4 nf_nat nf_conntrack iptable_mangle iptable_security iptable_raw iptable_filter ip_tables sg btrfs zlib_deflate raid6_pq xor dm_queue_length iTCO_wdt iTCO_vendor_support coretemp kvm dcdbas dm_service_time microcode serio_raw pcspkr lpc_ich mfd_core i7core_edac edac_core ses enclosure ipmi_si ipmi_msghandler shpchp acpi_power_meter mperf nfsd auth_rpcgss nfs_acl lockd uinput sunrpc dm_multipath xfs libcrc32c ata_generic pata_acpi sr_mod cdrom
   sd_mod usb_storage mgag200 syscopyarea sysfillrect sysimgblt i2c_algo_bit lpfc drm_kms_helper ttm crc32c_intel ata_piix bfa drm ixgbe libata i2c_core mdio crc_t10dif ptp crct10dif_common pps_core scsi_transport_fc dca scsi_tgt megaraid_sas bnx2 dm_mirror dm_region_hash dm_log dm_mod
  CPU: 16 PID: 2572 Comm: X Not tainted 3.10.0-86.el7.x86_64 #1
  Hardware name: Dell Inc. PowerEdge R810/0H235N, BIOS 0.3.0 11/14/2009
  task: ffff8801799dabc0 ti: ffff88016c884000 task.ti: ffff88016c884000
  RIP: 0010:[<0000000000000000>]  [<          (null)>]           (null)
  RSP: 0018:ffff88016c885ad8  EFLAGS: 00010202
  RAX: ffffffffa04e94c0 RBX: ffff880178937a20 RCX: 0000000000000000
  RDX: 0000000000000000 RSI: 0000000000240004 RDI: ffff880178937a00
  RBP: ffff88016c885b60 R08: 00000000000171a0 R09: ffff88007cf171a0
  R10: ffffea0005842540 R11: ffffffff810487b9 R12: ffff880178937b30
  R13: ffff880178937a00 R14: ffff88016c885b78 R15: ffff880179929400
  FS:  00007f81ba2ef980(0000) GS:ffff88007cf00000(0000) knlGS:0000000000000000
  CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
  CR2: 0000000000000000 CR3: 000000016e763000 CR4: 00000000000007e0
  DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
  DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000400
  Stack:
   ffffffffa0306fae ffff8801799295c0 0000000000260004 0000000000000001
   ffff88016c885b60 ffffffffa0307669 00ff88007cf17738 ffff88017cf17700
   ffff880178937a00 ffff880100000000 ffff880100000000 0000000079929400
  Call Trace:
   [] ? ttm_bo_handle_move_mem+0x54e/0x5b0 [ttm]
   [] ? ttm_bo_mem_space+0x169/0x340 [ttm]
   [] ttm_bo_move_buffer+0x117/0x130 [ttm]
   [] ? perf_event_init_context+0x141/0x220
   [] ttm_bo_validate+0xc1/0x130 [ttm]
   [] mgag200_bo_pin+0x87/0xc0 [mgag200]
   [] mga_crtc_cursor_set+0x474/0xbb0 [mgag200]
   [] ? __mem_cgroup_commit_charge+0x152/0x3b0
   [] ? mutex_lock+0x12/0x2f
   [] drm_mode_cursor_common+0x123/0x170 [drm]
   [] drm_mode_cursor_ioctl+0x41/0x50 [drm]
   [] drm_ioctl+0x502/0x630 [drm]
   [] ? __do_page_fault+0x1f4/0x510
   [] ? __restore_xstate_sig+0x218/0x4f0
   [] do_vfs_ioctl+0x2e5/0x4d0
   [] ? file_has_perm+0x8e/0xa0
   [] SyS_ioctl+0x81/0xa0
   [] system_call_fastpath+0x16/0x1b
  Code:  Bad RIP value.
  RIP  [<          (null)>]           (null)
   RSP 
  CR2: 0000000000000000

Signed-off-by: Rob Clark 
Reviewed-by: Jérôme Glisse 
Reviewed-by: Thomas Hellstrom 
Signed-off-by: Greg Kroah-Hartman

drm/ttm: Fix swapin regression

2013-12-23T00:33:07+00:00

Commit "drm/ttm: Don't move non-existing data" didn't take the
swapped-out corner case into account. This patch corrects that.
Fixes blank screen after attempted suspend / hibernate on vmwgfx.

Signed-off-by: Thomas Hellstrom 
Signed-off-by: Dave Airlie

drm/ttm: Fix accesses through vmas with only partial coverage

2013-12-16T18:08:35+00:00

VMAs covering a bo but that didn't start at the same address space offset as
the bo they were mapping were incorrectly generating SEGFAULT errors in
the fault handler.

Reported-by: Joseph Dolinak 
Signed-off-by: Thomas Hellstrom 
Reviewed-by: Jakob Bornecrantz 
Cc: stable@vger.kernel.org

Merge branch 'ttm-fixes-3.13' of git://people.freedesktop.org/~thomash/linux into drm-fixes

2013-11-21T08:46:56+00:00

The set_need_resched() removal fix and yet another fix in
ttm_bo_move_memcpy().

* 'ttm-fixes-3.13' of git://people.freedesktop.org/~thomash/linux:
  drm/ttm: Remove set_need_resched from the ttm fault handler
  drm/ttm: Don't move non-existing data

drm/ttm: Remove set_need_resched from the ttm fault handler

2013-11-20T11:46:54+00:00

Addresses
"[BUG] completely bonkers use of set_need_resched + VM_FAULT_NOPAGE".

In the first occurence it was used to try to be nice while releasing the
mmap_sem and retrying the fault to work around a locking inversion.
The second occurence was never used.

There has been some discussion whether we should change the locking order to
mmap_sem -> bo_reserve. This patch doesn't address that issue, and leaves
that locking order undefined. The solution that we release the mmap_sem if
tryreserve fails and wait for the buffer to become unreserved is something
we want in any case, and follows how the core vm system waits for pages
to be come unlocked while releasing the mmap_sem.

The code also outlines what needs to be changed if we want to establish the
locking order as mmap_sem -> bo::reserve.

One slight issue that remains with this code is that the fault handler might
be prone to starvation if another thread countinously reserves the buffer.
IMO that usage pattern is highly unlikely.

Signed-off-by: Thomas Hellstrom

drm/ttm: Don't move non-existing data

2013-11-20T11:43:28+00:00

If ttm_bo_move_memcpy was instructed to move a non-populated ttm to
io memory, it would first populate the ttm, then move the data and then
destroy the ttm. That's stupid. However, some drivers might have relied on
this to clear io memory from old stuff. So instead of a NOP, which would
be the most efficient, just clear the destination.

Signed-off-by: Thomas Hellstrom 
Reviewed-by: Jakob Bornecrantz

drm/ttm: Add a minimal prime implementation for ttm base objects

2013-11-18T08:46:41+00:00

Signed-off-by: Thomas Hellstrom 
Reviewed-by: Jakob Bornecrantz

drm/ttm: Allow execbuf util reserves without ticket

2013-11-18T08:38:52+00:00

If no reservation ticket is given to the execbuf reservation utilities,
try reservation with non-blocking semantics.
This is intended for eviction paths that use the execbuf reservation
utilities for convenience rather than for deadlock avoidance.

Signed-off-by: Thomas Hellstrom 
Reviewed-by: Jakob Bornecrantz

Merge branch 'ttm-next-3.13' of git://people.freedesktop.org/~thomash/linux into drm-next

2013-11-13T23:52:10+00:00

The page-prot bit fix.

* 'ttm-next-3.13' of git://people.freedesktop.org/~thomash/linux:
  drm/ttm: Fix vma page_prot bit manipulation

drm/ttm: Fix vma page_prot bit manipulation

2013-11-13T07:55:31+00:00

Fix a long-standing TTM issue where we manipulated the vma page_prot
bits while mmap_sem was taken in read mode only. We now make a local
copy of the vma structure which we pass when we set the ptes.

Signed-off-by: Thomas Hellstrom 
Reviewed-by: Jerome Glisse