From patchwork Mon Feb 6 13:25:59 2017 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Chris Wilson X-Patchwork-Id: 9557743 Return-Path: Received: from mail.wl.linuxfoundation.org (pdx-wl-mail.web.codeaurora.org [172.30.200.125]) by pdx-korg-patchwork.web.codeaurora.org (Postfix) with ESMTP id 5989060236 for ; Mon, 6 Feb 2017 13:26:08 +0000 (UTC) Received: from mail.wl.linuxfoundation.org (localhost [127.0.0.1]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id 4389E23E64 for ; Mon, 6 Feb 2017 13:26:08 +0000 (UTC) Received: by mail.wl.linuxfoundation.org (Postfix, from userid 486) id 37CA826E90; Mon, 6 Feb 2017 13:26:08 +0000 (UTC) X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on pdx-wl-mail.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-4.1 required=2.0 tests=BAYES_00,DKIM_SIGNED, RCVD_IN_DNSWL_MED,T_DKIM_INVALID autolearn=ham version=3.3.1 Received: from gabe.freedesktop.org (gabe.freedesktop.org [131.252.210.177]) (using TLSv1.2 with cipher DHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.wl.linuxfoundation.org (Postfix) with ESMTPS id E120C23E64 for ; Mon, 6 Feb 2017 13:26:07 +0000 (UTC) Received: from gabe.freedesktop.org (localhost [127.0.0.1]) by gabe.freedesktop.org (Postfix) with ESMTP id 869F26E32C; Mon, 6 Feb 2017 13:26:07 +0000 (UTC) X-Original-To: intel-gfx@lists.freedesktop.org Delivered-To: intel-gfx@lists.freedesktop.org Received: from mail-wj0-x242.google.com (mail-wj0-x242.google.com [IPv6:2a00:1450:400c:c01::242]) by gabe.freedesktop.org (Postfix) with ESMTPS id 898316E32C for ; Mon, 6 Feb 2017 13:26:04 +0000 (UTC) Received: by mail-wj0-x242.google.com with SMTP id kq3so2918236wjc.3 for ; Mon, 06 Feb 2017 05:26:04 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=sender:from:to:cc:subject:date:message-id:in-reply-to:references; bh=QfN2KW3488+A5n91mz06FqszISvaqIGw64k22Ai6Tn0=; b=TLkJTWFX18w2Wo0taZ71BFCyGTLr80HtBvO5fmy5uBj8Yo3Nf9vIZ0uscX9oJz7ER2 hnyavX/ymzf4h3k75or+SvyrLl2t6iC96KkEJeAdimPQIs99AE2t+CSX9UE7yXV9KQ7D W6gUsQI9bJaK9ghgc++FxqxqdVu2ae0M3SPnu+qth5019vViqHeho1oWaaiZN8Phk5Je bxT96UUxCDGCzaCcfCFmcS0PGEkgu2w57f1D8gEyWoRyQhFZPVOCX+F+GPbOH67jyMJn C+Bfe85kk7o/KYZyBe3N2x2ujEV+Loc1lDgPYniIjvkWZR5rzrlJr4ywnSXva70rGpsd Q6KA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:sender:from:to:cc:subject:date:message-id :in-reply-to:references; bh=QfN2KW3488+A5n91mz06FqszISvaqIGw64k22Ai6Tn0=; b=hweC8uAnH/aEfk8xlS5dHMd79gELg23gU7dJlQzPeoQgUL9aDLOzXCS739PIWHq9uA VdT4KSDkpcgVFXRZalFe/T0/PSpOfT6Bps8Rc9Cf4EhoueTRXE+hYE2ZFZGRkCvq12ir 0n8JSsBR1znNqK6+cFf7sdWNzWPnTIqQNZrgRKDfuYUSUJYofbuUTqY9/JG6Z6Mqpq02 yokcvZy2S1zFdZXi2B1y/8kiIPOfatu5LfXObBDY2ZrBJOBd/qdAUYzGl6FevYUFkpdD HFzSXIkmW2KJzGyVawIIoUKqtcamJZak8SiOhufBog94xBE7XrsGsc8tnkiHXxWoMLMk S0fw== X-Gm-Message-State: AIkVDXLvCn9o394Hle6ggyfwhVLdegzHdzI0IcRVe2/U9m/f3OyFl4o8Z4x/4Ihx0FonBQ== X-Received: by 10.223.160.43 with SMTP id k40mr10912850wrk.24.1486387563164; Mon, 06 Feb 2017 05:26:03 -0800 (PST) Received: from haswell.alporthouse.com ([78.156.65.138]) by smtp.gmail.com with ESMTPSA id o42sm1490123wrb.18.2017.02.06.05.26.02 (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Mon, 06 Feb 2017 05:26:02 -0800 (PST) From: Chris Wilson To: intel-gfx@lists.freedesktop.org Date: Mon, 6 Feb 2017 13:25:59 +0000 Message-Id: <20170206132559.6137-2-chris@chris-wilson.co.uk> X-Mailer: git-send-email 2.11.0 In-Reply-To: <20170206132559.6137-1-chris@chris-wilson.co.uk> References: <20170206132559.6137-1-chris@chris-wilson.co.uk> Cc: Mika Kuoppala Subject: [Intel-gfx] [PATCH 2/2] drm/i915: Avoid unguarded reads from the request pointer X-BeenThere: intel-gfx@lists.freedesktop.org X-Mailman-Version: 2.1.18 Precedence: list List-Id: Intel graphics driver community testing & development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , MIME-Version: 1.0 Errors-To: intel-gfx-bounces@lists.freedesktop.org Sender: "Intel-gfx" X-Virus-Scanned: ClamAV using ClamSMTP In commit 86aa7e760a67 ("drm/i915: Assert that the context-switch completion matches our context") I added a read to the irq tasklet handler that compared the on-chip status with that of our sw tracking, using an unguarded read of the request pointer to get the context and beyond. Whilst we hold a reference to the request, we do not hold anything on the context and if we are unlucky it may be reaped from a second thread retiring the request (since it may retire the request as soon as the breadcrumb is complete, even before we finish processing the context switch) as we try to read from the context pointer. Avoid the racy read from underneath the request by storing the expected result in the execlist_port[]. Fixes: 86aa7e760a67 ("drm/i915: Assert that the context-switch completion matches our context") Reported-by: Mika Kuoppala Signed-off-by: Chris Wilson Cc: Joonas Lahtinen Cc: Tvrtko Ursulin Cc: Mika Kuoppala Reviewed-by: Mika Kuoppala --- drivers/gpu/drm/i915/intel_lrc.c | 7 ++++--- drivers/gpu/drm/i915/intel_ringbuffer.h | 1 + 2 files changed, 5 insertions(+), 3 deletions(-) diff --git a/drivers/gpu/drm/i915/intel_lrc.c b/drivers/gpu/drm/i915/intel_lrc.c index 754f77c394fb..ba39c2952438 100644 --- a/drivers/gpu/drm/i915/intel_lrc.c +++ b/drivers/gpu/drm/i915/intel_lrc.c @@ -350,6 +350,7 @@ static void execlists_submit_ports(struct intel_engine_cs *engine) execlists_context_status_change(port[0].request, INTEL_CONTEXT_SCHEDULE_IN); desc[0] = execlists_update_context(port[0].request); + GEM_BUG_ONLY(port[0].context_id = upper_32_bits(desc[0])); port[0].count++; if (port[1].request) { @@ -357,6 +358,7 @@ static void execlists_submit_ports(struct intel_engine_cs *engine) execlists_context_status_change(port[1].request, INTEL_CONTEXT_SCHEDULE_IN); desc[1] = execlists_update_context(port[1].request); + GEM_BUG_ONLY(port[1].context_id = upper_32_bits(desc[1])); port[1].count = 1; } else { desc[1] = 0; @@ -563,9 +565,8 @@ static void intel_lrc_irq_handler(unsigned long data) continue; /* Check the context/desc id for this event matches */ - GEM_BUG_ON(readl(buf + 2 * idx + 1) != - upper_32_bits(intel_lr_context_descriptor(port[0].request->ctx, - engine))); + GEM_BUG_ONLY_ON(readl(buf + 2 * idx + 1) != + port[0].context_id); GEM_BUG_ON(port[0].count == 0); if (--port[0].count == 0) { diff --git a/drivers/gpu/drm/i915/intel_ringbuffer.h b/drivers/gpu/drm/i915/intel_ringbuffer.h index 2c6d3655985e..896838ca502c 100644 --- a/drivers/gpu/drm/i915/intel_ringbuffer.h +++ b/drivers/gpu/drm/i915/intel_ringbuffer.h @@ -381,6 +381,7 @@ struct intel_engine_cs { struct execlist_port { struct drm_i915_gem_request *request; unsigned int count; + GEM_BUG_ONLY_DECLARE(u32 context_id); } execlist_port[2]; struct rb_root execlist_queue; struct rb_node *execlist_first;