| Message ID | 20231106091603.231100-2-janusz.krzysztofik@linux.intel.com (mailing list archive) |
|---|---|
| State | New, archived |
| Headers | show |
| Series | drm/i915/vma: Fix potential UAF on multi-tile platforms | expand |
On Mon, 06 Nov 2023, Janusz Krzysztofik <janusz.krzysztofik@linux.intel.com> wrote: > Object debugging tools were sporadically reporting illegal attempts to > free a still active i915 VMA object from when parking a GPU tile believed > to be idle. > > [161.359441] ODEBUG: free active (active state 0) object: ffff88811643b958 object type: i915_active hint: __i915_vma_active+0x0/0x50 [i915] > [161.360082] WARNING: CPU: 5 PID: 276 at lib/debugobjects.c:514 debug_print_object+0x80/0xb0 > ... > [161.360304] CPU: 5 PID: 276 Comm: kworker/5:2 Not tainted 6.5.0-rc1-CI_DRM_13375-g003f860e5577+ #1 > [161.360314] Hardware name: Intel Corporation Rocket Lake Client Platform/RocketLake S UDIMM 6L RVP, BIOS RKLSFWI1.R00.3173.A03.2204210138 04/21/2022 > [161.360322] Workqueue: i915-unordered __intel_wakeref_put_work [i915] > [161.360592] RIP: 0010:debug_print_object+0x80/0xb0 > ... > [161.361347] debug_object_free+0xeb/0x110 > [161.361362] i915_active_fini+0x14/0x130 [i915] > [161.361866] release_references+0xfe/0x1f0 [i915] > [161.362543] i915_vma_parked+0x1db/0x380 [i915] > [161.363129] __gt_park+0x121/0x230 [i915] > [161.363515] ____intel_wakeref_put_last+0x1f/0x70 [i915] > > That has been tracked down to be happening when another thread was > deactivating the VMA inside __active_retire() helper, after the VMA's > active counter was already decremented to 0, but before deactivation of > the VMA's object was reported to the object debugging tools. Root cause > has been identified as premature release of last wakeref for the GPU tile > to which the active VMA belonged. > > In case of single tile platforms, an engine associated with a request that > uses the VMA is keeping the tile's wakeref long enough for that VMA to be > deactivated on time, before it is going to be freed. However, on multi- > tile platforms, a request may use a VMA from a tile other than the one > that hosts the request's engine, then, not protected with the engine's > wakeref. > > Get an extra wakeref for the VMA's tile when activating it, and put that > wakeref only after the VMA is deactivated. However, exclude GGTT from > that processing path, otherwise the GPU never goes idle. Since > __i915_vma_retire() may be called from atomic contexts, use async variant > of wakeref put. > > Closes: https://gitlab.freedesktop.org/drm/intel/issues/8875 > Fixes: Fixes: 213c43676beb ("drm/i915/mtl: Remove the 'force_probe' requirement for Meteor Lake") I get the motivation, but this is hardly true. Also, double Fixes. BR, Jani. > Signed-off-by: Janusz Krzysztofik <janusz.krzysztofik@linux.intel.com> > --- > drivers/gpu/drm/i915/i915_vma.c | 18 ++++++++++++++++-- > 1 file changed, 16 insertions(+), 2 deletions(-) > > diff --git a/drivers/gpu/drm/i915/i915_vma.c b/drivers/gpu/drm/i915/i915_vma.c > index d09aad34ba37f..70c68f614c6db 100644 > --- a/drivers/gpu/drm/i915/i915_vma.c > +++ b/drivers/gpu/drm/i915/i915_vma.c > @@ -34,6 +34,7 @@ > #include "gt/intel_engine.h" > #include "gt/intel_engine_heartbeat.h" > #include "gt/intel_gt.h" > +#include "gt/intel_gt_pm.h" > #include "gt/intel_gt_requests.h" > #include "gt/intel_tlb.h" > > @@ -103,12 +104,25 @@ static inline struct i915_vma *active_to_vma(struct i915_active *ref) > > static int __i915_vma_active(struct i915_active *ref) > { > - return i915_vma_tryget(active_to_vma(ref)) ? 0 : -ENOENT; > + struct i915_vma *vma = active_to_vma(ref); > + > + if (!i915_vma_tryget(vma)) > + return -ENOENT; > + > + if (!i915_vma_is_ggtt(vma)) > + intel_gt_pm_get(vma->vm->gt); > + > + return 0; > } > > static void __i915_vma_retire(struct i915_active *ref) > { > - i915_vma_put(active_to_vma(ref)); > + struct i915_vma *vma = active_to_vma(ref); > + > + if (!i915_vma_is_ggtt(vma)) > + intel_gt_pm_put_async(vma->vm->gt); > + > + i915_vma_put(vma); > } > > static struct i915_vma *
Hi Jani, Thanks for looking at this. On Monday, 6 November 2023 10:53:11 CET Jani Nikula wrote: > On Mon, 06 Nov 2023, Janusz Krzysztofik <janusz.krzysztofik@linux.intel.com> wrote: > > Object debugging tools were sporadically reporting illegal attempts to > > free a still active i915 VMA object from when parking a GPU tile believed > > to be idle. > > > > [161.359441] ODEBUG: free active (active state 0) object: ffff88811643b958 object type: i915_active hint: __i915_vma_active+0x0/0x50 [i915] > > [161.360082] WARNING: CPU: 5 PID: 276 at lib/debugobjects.c:514 debug_print_object+0x80/0xb0 > > ... > > [161.360304] CPU: 5 PID: 276 Comm: kworker/5:2 Not tainted 6.5.0-rc1- CI_DRM_13375-g003f860e5577+ #1 > > [161.360314] Hardware name: Intel Corporation Rocket Lake Client Platform/ RocketLake S UDIMM 6L RVP, BIOS RKLSFWI1.R00.3173.A03.2204210138 04/21/2022 > > [161.360322] Workqueue: i915-unordered __intel_wakeref_put_work [i915] > > [161.360592] RIP: 0010:debug_print_object+0x80/0xb0 > > ... > > [161.361347] debug_object_free+0xeb/0x110 > > [161.361362] i915_active_fini+0x14/0x130 [i915] > > [161.361866] release_references+0xfe/0x1f0 [i915] > > [161.362543] i915_vma_parked+0x1db/0x380 [i915] > > [161.363129] __gt_park+0x121/0x230 [i915] > > [161.363515] ____intel_wakeref_put_last+0x1f/0x70 [i915] > > > > That has been tracked down to be happening when another thread was > > deactivating the VMA inside __active_retire() helper, after the VMA's > > active counter was already decremented to 0, but before deactivation of > > the VMA's object was reported to the object debugging tools. Root cause > > has been identified as premature release of last wakeref for the GPU tile > > to which the active VMA belonged. > > > > In case of single tile platforms, an engine associated with a request that > > uses the VMA is keeping the tile's wakeref long enough for that VMA to be > > deactivated on time, before it is going to be freed. However, on multi- > > tile platforms, a request may use a VMA from a tile other than the one > > that hosts the request's engine, then, not protected with the engine's > > wakeref. > > > > Get an extra wakeref for the VMA's tile when activating it, and put that > > wakeref only after the VMA is deactivated. However, exclude GGTT from > > that processing path, otherwise the GPU never goes idle. Since > > __i915_vma_retire() may be called from atomic contexts, use async variant > > of wakeref put. > > > > Closes: https://gitlab.freedesktop.org/drm/intel/issues/8875 > > Fixes: Fixes: 213c43676beb ("drm/i915/mtl: Remove the 'force_probe' requirement for Meteor Lake") > > I get the motivation, but this is hardly true. Hmm, do you suggest to blame a commit that was actually guilty, or to drop the Fixes: tag completely? IOW, are we interested in fixing former stable releases that had no single multi-tile platform officially supported? > Also, double Fixes. Ops, sorry. Janusz > > BR, > Jani. > > > Signed-off-by: Janusz Krzysztofik <janusz.krzysztofik@linux.intel.com> > > --- > > drivers/gpu/drm/i915/i915_vma.c | 18 ++++++++++++++++-- > > 1 file changed, 16 insertions(+), 2 deletions(-) > > > > diff --git a/drivers/gpu/drm/i915/i915_vma.c b/drivers/gpu/drm/i915/ i915_vma.c > > index d09aad34ba37f..70c68f614c6db 100644 > > --- a/drivers/gpu/drm/i915/i915_vma.c > > +++ b/drivers/gpu/drm/i915/i915_vma.c > > @@ -34,6 +34,7 @@ > > #include "gt/intel_engine.h" > > #include "gt/intel_engine_heartbeat.h" > > #include "gt/intel_gt.h" > > +#include "gt/intel_gt_pm.h" > > #include "gt/intel_gt_requests.h" > > #include "gt/intel_tlb.h" > > > > @@ -103,12 +104,25 @@ static inline struct i915_vma *active_to_vma(struct i915_active *ref) > > > > static int __i915_vma_active(struct i915_active *ref) > > { > > - return i915_vma_tryget(active_to_vma(ref)) ? 0 : -ENOENT; > > + struct i915_vma *vma = active_to_vma(ref); > > + > > + if (!i915_vma_tryget(vma)) > > + return -ENOENT; > > + > > + if (!i915_vma_is_ggtt(vma)) > > + intel_gt_pm_get(vma->vm->gt); > > + > > + return 0; > > } > > > > static void __i915_vma_retire(struct i915_active *ref) > > { > > - i915_vma_put(active_to_vma(ref)); > > + struct i915_vma *vma = active_to_vma(ref); > > + > > + if (!i915_vma_is_ggtt(vma)) > > + intel_gt_pm_put_async(vma->vm->gt); > > + > > + i915_vma_put(vma); > > } > > > > static struct i915_vma * > >
On Mon, 06 Nov 2023, Janusz Krzysztofik <janusz.krzysztofik@linux.intel.com> wrote: > Hi Jani, > > Thanks for looking at this. > > On Monday, 6 November 2023 10:53:11 CET Jani Nikula wrote: >> On Mon, 06 Nov 2023, Janusz Krzysztofik <janusz.krzysztofik@linux.intel.com> > wrote: >> > Object debugging tools were sporadically reporting illegal attempts to >> > free a still active i915 VMA object from when parking a GPU tile believed >> > to be idle. >> > >> > [161.359441] ODEBUG: free active (active state 0) object: ffff88811643b958 > object type: i915_active hint: __i915_vma_active+0x0/0x50 [i915] >> > [161.360082] WARNING: CPU: 5 PID: 276 at lib/debugobjects.c:514 > debug_print_object+0x80/0xb0 >> > ... >> > [161.360304] CPU: 5 PID: 276 Comm: kworker/5:2 Not tainted 6.5.0-rc1- > CI_DRM_13375-g003f860e5577+ #1 >> > [161.360314] Hardware name: Intel Corporation Rocket Lake Client Platform/ > RocketLake S UDIMM 6L RVP, BIOS RKLSFWI1.R00.3173.A03.2204210138 04/21/2022 >> > [161.360322] Workqueue: i915-unordered __intel_wakeref_put_work [i915] >> > [161.360592] RIP: 0010:debug_print_object+0x80/0xb0 >> > ... >> > [161.361347] debug_object_free+0xeb/0x110 >> > [161.361362] i915_active_fini+0x14/0x130 [i915] >> > [161.361866] release_references+0xfe/0x1f0 [i915] >> > [161.362543] i915_vma_parked+0x1db/0x380 [i915] >> > [161.363129] __gt_park+0x121/0x230 [i915] >> > [161.363515] ____intel_wakeref_put_last+0x1f/0x70 [i915] >> > >> > That has been tracked down to be happening when another thread was >> > deactivating the VMA inside __active_retire() helper, after the VMA's >> > active counter was already decremented to 0, but before deactivation of >> > the VMA's object was reported to the object debugging tools. Root cause >> > has been identified as premature release of last wakeref for the GPU tile >> > to which the active VMA belonged. >> > >> > In case of single tile platforms, an engine associated with a request that >> > uses the VMA is keeping the tile's wakeref long enough for that VMA to be >> > deactivated on time, before it is going to be freed. However, on multi- >> > tile platforms, a request may use a VMA from a tile other than the one >> > that hosts the request's engine, then, not protected with the engine's >> > wakeref. >> > >> > Get an extra wakeref for the VMA's tile when activating it, and put that >> > wakeref only after the VMA is deactivated. However, exclude GGTT from >> > that processing path, otherwise the GPU never goes idle. Since >> > __i915_vma_retire() may be called from atomic contexts, use async variant >> > of wakeref put. >> > >> > Closes: https://gitlab.freedesktop.org/drm/intel/issues/8875 >> > Fixes: Fixes: 213c43676beb ("drm/i915/mtl: Remove the 'force_probe' > requirement for Meteor Lake") >> >> I get the motivation, but this is hardly true. > > Hmm, do you suggest to blame a commit that was actually guilty, or to drop the > Fixes: tag completely? IOW, are we interested in fixing former stable > releases that had no single multi-tile platform officially supported? IMO Fixes: should only point at the actually broken commits. If you want to get the backport to a specific stable kernel, please use Cc: stable@vger.kernel.org # v6.6+ or similar. IIUC in this case you want the fix to go to v6.7 which doesn't exist yet, so you'll just have to ask the maintainers to pick it up in fixes. BR, Jani. > >> Also, double Fixes. > > Ops, sorry. > > Janusz > >> >> BR, >> Jani. >> >> > Signed-off-by: Janusz Krzysztofik <janusz.krzysztofik@linux.intel.com> >> > --- >> > drivers/gpu/drm/i915/i915_vma.c | 18 ++++++++++++++++-- >> > 1 file changed, 16 insertions(+), 2 deletions(-) >> > >> > diff --git a/drivers/gpu/drm/i915/i915_vma.c b/drivers/gpu/drm/i915/ > i915_vma.c >> > index d09aad34ba37f..70c68f614c6db 100644 >> > --- a/drivers/gpu/drm/i915/i915_vma.c >> > +++ b/drivers/gpu/drm/i915/i915_vma.c >> > @@ -34,6 +34,7 @@ >> > #include "gt/intel_engine.h" >> > #include "gt/intel_engine_heartbeat.h" >> > #include "gt/intel_gt.h" >> > +#include "gt/intel_gt_pm.h" >> > #include "gt/intel_gt_requests.h" >> > #include "gt/intel_tlb.h" >> > >> > @@ -103,12 +104,25 @@ static inline struct i915_vma *active_to_vma(struct > i915_active *ref) >> > >> > static int __i915_vma_active(struct i915_active *ref) >> > { >> > - return i915_vma_tryget(active_to_vma(ref)) ? 0 : -ENOENT; >> > + struct i915_vma *vma = active_to_vma(ref); >> > + >> > + if (!i915_vma_tryget(vma)) >> > + return -ENOENT; >> > + >> > + if (!i915_vma_is_ggtt(vma)) >> > + intel_gt_pm_get(vma->vm->gt); >> > + >> > + return 0; >> > } >> > >> > static void __i915_vma_retire(struct i915_active *ref) >> > { >> > - i915_vma_put(active_to_vma(ref)); >> > + struct i915_vma *vma = active_to_vma(ref); >> > + >> > + if (!i915_vma_is_ggtt(vma)) >> > + intel_gt_pm_put_async(vma->vm->gt); >> > + >> > + i915_vma_put(vma); >> > } >> > >> > static struct i915_vma * >> >> > > > >
On Monday, 6 November 2023 20:16:20 CET Patchwork wrote: > == Series Details == > > Series: drm/i915/vma: Fix potential UAF on multi-tile platforms > URL : https://patchwork.freedesktop.org/series/126012/ > State : failure > > == Summary == > > CI Bug Log - changes from CI_DRM_13844 -> Patchwork_126012v1 > ==================================================== > > Summary > ------- > > **FAILURE** > > Serious unknown changes coming with Patchwork_126012v1 absolutely need to be > verified manually. > > If you think the reported changes have nothing to do with the changes > introduced in Patchwork_126012v1, please notify your bug team (lgci.bug.filing@intel.com) to allow them > to document this new failure mode, which will reduce false positives in CI. > > External URL: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_126012v1/ index.html > > Participating hosts (33 -> 32) > ------------------------------ > > Additional (2): fi-kbl-soraka fi-hsw-4770 > Missing (3): bat-adlp-11 fi-snb-2520m fi-pnv-d510 > > Possible new issues > ------------------- > > Here are the unknown changes that may have been introduced in Patchwork_126012v1: > > ### IGT changes ### > > #### Possible regressions #### > > * igt@i915_selftest@live@gt_lrc: > - bat-adln-1: NOTRUN -> [INCOMPLETE][1] > [1]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_126012v1/bat-adln-1/igt@i915_selftest@live@gt_lrc.html This looks to me like an occurrence of an already known issue http://gfx-ci.igk.intel.com/cibuglog-ng/issue/10056 > * igt@i915_selftest@live@perf: > - fi-hsw-4770: NOTRUN -> [INCOMPLETE][2] > [2]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_126012v1/fi-hsw-4770/igt@i915_selftest@live@perf.html And this looks the same as http://gfx-ci.igk.intel.com/cibuglog-ng/testresult/1609698018 reported for CI_DRM_13828, then apparently not related to the patch under test. @BUG Filing, please update filters and re-report. Thanks, Janusz > > > Known issues > ------------ > > Here are the changes found in Patchwork_126012v1 that come from known issues: > > ### IGT changes ### > > #### Issues hit #### > > * igt@gem_huc_copy@huc-copy: > - fi-kbl-soraka: NOTRUN -> [SKIP][3] ([fdo#109271] / [i915#2190]) > [3]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_126012v1/fi-kbl-soraka/igt@gem_huc_copy@huc-copy.html > > * igt@gem_lmem_swapping@basic: > - fi-kbl-soraka: NOTRUN -> [SKIP][4] ([fdo#109271] / [i915#4613]) +3 other tests skip > [4]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_126012v1/fi-kbl-soraka/igt@gem_lmem_swapping@basic.html > - bat-adln-1: NOTRUN -> [SKIP][5] ([i915#4613]) +3 other tests skip > [5]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_126012v1/bat-adln-1/igt@gem_lmem_swapping@basic.html > > * igt@gem_lmem_swapping@parallel-random-engines: > - bat-rplp-1: NOTRUN -> [SKIP][6] ([i915#4613]) +3 other tests skip > [6]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_126012v1/bat-rplp-1/igt@gem_lmem_swapping@parallel-random-engines.html > > * igt@gem_lmem_swapping@random-engines: > - bat-adlp-6: NOTRUN -> [SKIP][7] ([i915#4613]) +3 other tests skip > [7]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_126012v1/bat-adlp-6/igt@gem_lmem_swapping@random-engines.html > > * igt@i915_module_load@reload: > - fi-skl-6600u: [PASS][8] -> [DMESG-WARN][9] ([i915#1982]) > [8]: https://intel-gfx-ci.01.org/tree/drm-tip/CI_DRM_13844/fi-skl-6600u/ igt@i915_module_load@reload.html > [9]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_126012v1/fi-skl-6600u/igt@i915_module_load@reload.html > > * igt@i915_pm_rps@basic-api: > - bat-adlp-6: NOTRUN -> [SKIP][10] ([i915#6621]) > [10]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_126012v1/bat-adlp-6/igt@i915_pm_rps@basic-api.html > - bat-rplp-1: NOTRUN -> [SKIP][11] ([i915#6621]) > [11]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_126012v1/bat-rplp-1/igt@i915_pm_rps@basic-api.html > - bat-adln-1: NOTRUN -> [SKIP][12] ([i915#6621]) > [12]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_126012v1/bat-adln-1/igt@i915_pm_rps@basic-api.html > > * igt@i915_selftest@live@gt_pm: > - fi-kbl-soraka: NOTRUN -> [DMESG-FAIL][13] ([i915#1886]) > [13]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_126012v1/fi-kbl-soraka/igt@i915_selftest@live@gt_pm.html > > * igt@i915_suspend@basic-s3-without-i915: > - bat-rpls-1: NOTRUN -> [ABORT][14] ([i915#7978] / [i915#9631]) > [14]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_126012v1/bat-rpls-1/igt@i915_suspend@basic-s3-without-i915.html > > * igt@kms_addfb_basic@addfb25-y-tiled-small-legacy: > - fi-hsw-4770: NOTRUN -> [SKIP][15] ([fdo#109271] / [i915#5190]) > [15]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_126012v1/fi-hsw-4770/igt@kms_addfb_basic@addfb25-y-tiled-small-legacy.html > > * igt@kms_dsc@dsc-basic: > - fi-kbl-soraka: NOTRUN -> [SKIP][16] ([fdo#109271]) +9 other tests skip > [16]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_126012v1/fi-kbl-soraka/igt@kms_dsc@dsc-basic.html > > * igt@kms_hdmi_inject@inject-audio: > - fi-kbl-guc: [PASS][17] -> [FAIL][18] ([IGT#3]) > [17]: https://intel-gfx-ci.01.org/tree/drm-tip/CI_DRM_13844/fi-kbl-guc/ igt@kms_hdmi_inject@inject-audio.html > [18]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_126012v1/fi-kbl-guc/igt@kms_hdmi_inject@inject-audio.html > > * igt@kms_pipe_crc_basic@compare-crc-sanitycheck-nv12@pipe-a-vga-1: > - fi-hsw-4770: NOTRUN -> [SKIP][19] ([fdo#109271]) +12 other tests skip > [19]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_126012v1/fi-hsw-4770/igt@kms_pipe_crc_basic@compare-crc-sanitycheck-nv12@pipe-a-vga-1.html > > * igt@kms_psr@primary_page_flip: > - bat-rplp-1: NOTRUN -> [SKIP][20] ([i915#1072]) +3 other tests skip > [20]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_126012v1/bat-rplp-1/igt@kms_psr@primary_page_flip.html > > * igt@kms_psr@sprite_plane_onoff: > - fi-hsw-4770: NOTRUN -> [SKIP][21] ([fdo#109271] / [i915#1072]) +3 other tests skip > [21]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_126012v1/fi-hsw-4770/igt@kms_psr@sprite_plane_onoff.html > > * igt@kms_setmode@basic-clone-single-crtc: > - bat-adlp-6: NOTRUN -> [SKIP][22] ([i915#3555]) > [22]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_126012v1/bat-adlp-6/igt@kms_setmode@basic-clone-single-crtc.html > - bat-rplp-1: NOTRUN -> [SKIP][23] ([i915#3555]) > [23]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_126012v1/bat-rplp-1/igt@kms_setmode@basic-clone-single-crtc.html > - bat-adln-1: NOTRUN -> [SKIP][24] ([i915#3555]) > [24]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_126012v1/bat-adln-1/igt@kms_setmode@basic-clone-single-crtc.html > > * igt@prime_vgem@basic-fence-read: > - bat-adlp-6: NOTRUN -> [SKIP][25] ([fdo#109295] / [i915#3291] / [i915#3708]) +2 other tests skip > [25]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_126012v1/bat-adlp-6/igt@prime_vgem@basic-fence-read.html > > * igt@prime_vgem@basic-read: > - bat-rplp-1: NOTRUN -> [SKIP][26] ([i915#3708]) +2 other tests skip > [26]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_126012v1/bat-rplp-1/igt@prime_vgem@basic-read.html > > * igt@prime_vgem@basic-write: > - bat-adln-1: NOTRUN -> [SKIP][27] ([fdo#109295] / [i915#3291]) +2 other tests skip > [27]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_126012v1/bat-adln-1/igt@prime_vgem@basic-write.html > > > #### Possible fixes #### > > * igt@gem_exec_suspend@basic-s0@smem: > - fi-rkl-11600: [FAIL][28] ([fdo#103375]) -> [PASS][29] > [28]: https://intel-gfx-ci.01.org/tree/drm-tip/CI_DRM_13844/fi-rkl-11600/ igt@gem_exec_suspend@basic-s0@smem.html > [29]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_126012v1/fi-rkl-11600/igt@gem_exec_suspend@basic-s0@smem.html > > * igt@i915_selftest@live@gt_heartbeat: > - fi-apl-guc: [DMESG-FAIL][30] ([i915#5334]) -> [PASS][31] > [30]: https://intel-gfx-ci.01.org/tree/drm-tip/CI_DRM_13844/fi-apl-guc/ igt@i915_selftest@live@gt_heartbeat.html > [31]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_126012v1/fi-apl-guc/igt@i915_selftest@live@gt_heartbeat.html > > * igt@i915_selftest@live@workarounds: > - bat-rpls-1: [INCOMPLETE][32] -> [PASS][33] > [32]: https://intel-gfx-ci.01.org/tree/drm-tip/CI_DRM_13844/bat-rpls-1/ igt@i915_selftest@live@workarounds.html > [33]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_126012v1/bat-rpls-1/igt@i915_selftest@live@workarounds.html > > * {igt@kms_pm_backlight@basic-brightness@edp-1}: > - bat-adlp-6: [ABORT][34] ([i915#8668]) -> [PASS][35] > [34]: https://intel-gfx-ci.01.org/tree/drm-tip/CI_DRM_13844/bat-adlp-6/ igt@kms_pm_backlight@basic-brightness@edp-1.html > [35]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_126012v1/bat-adlp-6/igt@kms_pm_backlight@basic-brightness@edp-1.html > - bat-rplp-1: [ABORT][36] ([i915#8668]) -> [PASS][37] > [36]: https://intel-gfx-ci.01.org/tree/drm-tip/CI_DRM_13844/bat-rplp-1/ igt@kms_pm_backlight@basic-brightness@edp-1.html > [37]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_126012v1/bat-rplp-1/igt@kms_pm_backlight@basic-brightness@edp-1.html > > * {igt@kms_pm_rpm@basic-pci-d3-state}: > - bat-adln-1: [ABORT][38] ([i915#8668]) -> [PASS][39] > [38]: https://intel-gfx-ci.01.org/tree/drm-tip/CI_DRM_13844/bat-adln-1/ igt@kms_pm_rpm@basic-pci-d3-state.html > [39]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_126012v1/bat-adln-1/igt@kms_pm_rpm@basic-pci-d3-state.html > > > {name}: This element is suppressed. This means it is ignored when computing > the status of the difference (SUCCESS, WARNING, or FAILURE). > > [IGT#3]: https://gitlab.freedesktop.org/drm/igt-gpu-tools/issues/3 > [fdo#103375]: https://bugs.freedesktop.org/show_bug.cgi?id=103375 > [fdo#109271]: https://bugs.freedesktop.org/show_bug.cgi?id=109271 > [fdo#109295]: https://bugs.freedesktop.org/show_bug.cgi?id=109295 > [i915#1072]: https://gitlab.freedesktop.org/drm/intel/issues/1072 > [i915#1886]: https://gitlab.freedesktop.org/drm/intel/issues/1886 > [i915#1982]: https://gitlab.freedesktop.org/drm/intel/issues/1982 > [i915#2190]: https://gitlab.freedesktop.org/drm/intel/issues/2190 > [i915#3291]: https://gitlab.freedesktop.org/drm/intel/issues/3291 > [i915#3555]: https://gitlab.freedesktop.org/drm/intel/issues/3555 > [i915#3708]: https://gitlab.freedesktop.org/drm/intel/issues/3708 > [i915#4613]: https://gitlab.freedesktop.org/drm/intel/issues/4613 > [i915#5190]: https://gitlab.freedesktop.org/drm/intel/issues/5190 > [i915#5334]: https://gitlab.freedesktop.org/drm/intel/issues/5334 > [i915#6621]: https://gitlab.freedesktop.org/drm/intel/issues/6621 > [i915#7978]: https://gitlab.freedesktop.org/drm/intel/issues/7978 > [i915#8668]: https://gitlab.freedesktop.org/drm/intel/issues/8668 > [i915#9631]: https://gitlab.freedesktop.org/drm/intel/issues/9631 > > > Build changes > ------------- > > * Linux: CI_DRM_13844 -> Patchwork_126012v1 > > CI-20190529: 20190529 > CI_DRM_13844: 98a039fc048898d9ecec16153267968fd18a5a52 @ git:// anongit.freedesktop.org/gfx-ci/linux > IGT_7574: 0485a4bf66f69aaf7244a3e689402b522f636780 @ https:// gitlab.freedesktop.org/drm/igt-gpu-tools.git > Patchwork_126012v1: 98a039fc048898d9ecec16153267968fd18a5a52 @ git:// anongit.freedesktop.org/gfx-ci/linux > > > ### Linux commits > > 4be63e4925fd drm/i915/vma: Fix potential UAF on multi-tile platforms > > == Logs == > > For more details see: https://intel-gfx-ci.01.org/tree/drm-tip/ Patchwork_126012v1/index.html >
Hi, https://patchwork.freedesktop.org/series/126012/ - Re-reported. Thanks, Tejasree -----Original Message----- From: Janusz Krzysztofik <janusz.krzysztofik@linux.intel.com> Sent: Tuesday, November 7, 2023 3:27 PM To: LGCI Bug Filing <lgci.bug.filing@intel.com> Cc: intel-gfx@lists.freedesktop.org Subject: Re: ✗ Fi.CI.BAT: failure for drm/i915/vma: Fix potential UAF on multi-tile platforms On Monday, 6 November 2023 20:16:20 CET Patchwork wrote: > == Series Details == > > Series: drm/i915/vma: Fix potential UAF on multi-tile platforms > URL : https://patchwork.freedesktop.org/series/126012/ > State : failure > > == Summary == > > CI Bug Log - changes from CI_DRM_13844 -> Patchwork_126012v1 > ==================================================== > > Summary > ------- > > **FAILURE** > > Serious unknown changes coming with Patchwork_126012v1 absolutely > need to be > verified manually. > > If you think the reported changes have nothing to do with the changes > introduced in Patchwork_126012v1, please notify your bug team (lgci.bug.filing@intel.com) to allow them > to document this new failure mode, which will reduce false positives > in CI. > > External URL: > https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_126012v1/ index.html > > Participating hosts (33 -> 32) > ------------------------------ > > Additional (2): fi-kbl-soraka fi-hsw-4770 > Missing (3): bat-adlp-11 fi-snb-2520m fi-pnv-d510 > > Possible new issues > ------------------- > > Here are the unknown changes that may have been introduced in Patchwork_126012v1: > > ### IGT changes ### > > #### Possible regressions #### > > * igt@i915_selftest@live@gt_lrc: > - bat-adln-1: NOTRUN -> [INCOMPLETE][1] > [1]: > https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_126012v1/bat-adln-1 > /igt@i915_selftest@live@gt_lrc.html This looks to me like an occurrence of an already known issue http://gfx-ci.igk.intel.com/cibuglog-ng/issue/10056 > * igt@i915_selftest@live@perf: > - fi-hsw-4770: NOTRUN -> [INCOMPLETE][2] > [2]: > https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_126012v1/fi-hsw-477 > 0/igt@i915_selftest@live@perf.html And this looks the same as http://gfx-ci.igk.intel.com/cibuglog-ng/testresult/1609698018 reported for CI_DRM_13828, then apparently not related to the patch under test. @BUG Filing, please update filters and re-report. Thanks, Janusz > > > Known issues > ------------ > > Here are the changes found in Patchwork_126012v1 that come from > known issues: > > ### IGT changes ### > > #### Issues hit #### > > * igt@gem_huc_copy@huc-copy: > - fi-kbl-soraka: NOTRUN -> [SKIP][3] ([fdo#109271] / [i915#2190]) > [3]: > https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_126012v1/fi-kbl-sor > aka/igt@gem_huc_copy@huc-copy.html > > * igt@gem_lmem_swapping@basic: > - fi-kbl-soraka: NOTRUN -> [SKIP][4] ([fdo#109271] / [i915#4613]) +3 other tests skip > [4]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_126012v1/fi-kbl-soraka/igt@gem_lmem_swapping@basic.html > - bat-adln-1: NOTRUN -> [SKIP][5] ([i915#4613]) +3 other tests skip > [5]: > https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_126012v1/bat-adln-1 > /igt@gem_lmem_swapping@basic.html > > * igt@gem_lmem_swapping@parallel-random-engines: > - bat-rplp-1: NOTRUN -> [SKIP][6] ([i915#4613]) +3 other tests skip > [6]: > https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_126012v1/bat-rplp-1 > /igt@gem_lmem_swapping@parallel-random-engines.html > > * igt@gem_lmem_swapping@random-engines: > - bat-adlp-6: NOTRUN -> [SKIP][7] ([i915#4613]) +3 other tests skip > [7]: > https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_126012v1/bat-adlp-6 > /igt@gem_lmem_swapping@random-engines.html > > * igt@i915_module_load@reload: > - fi-skl-6600u: [PASS][8] -> [DMESG-WARN][9] ([i915#1982]) > [8]: > https://intel-gfx-ci.01.org/tree/drm-tip/CI_DRM_13844/fi-skl-6600u/ igt@i915_module_load@reload.html > [9]: > https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_126012v1/fi-skl-660 > 0u/igt@i915_module_load@reload.html > > * igt@i915_pm_rps@basic-api: > - bat-adlp-6: NOTRUN -> [SKIP][10] ([i915#6621]) > [10]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_126012v1/bat-adlp-6/igt@i915_pm_rps@basic-api.html > - bat-rplp-1: NOTRUN -> [SKIP][11] ([i915#6621]) > [11]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_126012v1/bat-rplp-1/igt@i915_pm_rps@basic-api.html > - bat-adln-1: NOTRUN -> [SKIP][12] ([i915#6621]) > [12]: > https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_126012v1/bat-adln-1 > /igt@i915_pm_rps@basic-api.html > > * igt@i915_selftest@live@gt_pm: > - fi-kbl-soraka: NOTRUN -> [DMESG-FAIL][13] ([i915#1886]) > [13]: > https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_126012v1/fi-kbl-sor > aka/igt@i915_selftest@live@gt_pm.html > > * igt@i915_suspend@basic-s3-without-i915: > - bat-rpls-1: NOTRUN -> [ABORT][14] ([i915#7978] / [i915#9631]) > [14]: > https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_126012v1/bat-rpls-1 > /igt@i915_suspend@basic-s3-without-i915.html > > * igt@kms_addfb_basic@addfb25-y-tiled-small-legacy: > - fi-hsw-4770: NOTRUN -> [SKIP][15] ([fdo#109271] / [i915#5190]) > [15]: > https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_126012v1/fi-hsw-477 > 0/igt@kms_addfb_basic@addfb25-y-tiled-small-legacy.html > > * igt@kms_dsc@dsc-basic: > - fi-kbl-soraka: NOTRUN -> [SKIP][16] ([fdo#109271]) +9 other tests skip > [16]: > https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_126012v1/fi-kbl-sor > aka/igt@kms_dsc@dsc-basic.html > > * igt@kms_hdmi_inject@inject-audio: > - fi-kbl-guc: [PASS][17] -> [FAIL][18] ([IGT#3]) > [17]: > https://intel-gfx-ci.01.org/tree/drm-tip/CI_DRM_13844/fi-kbl-guc/ igt@kms_hdmi_inject@inject-audio.html > [18]: > https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_126012v1/fi-kbl-guc > /igt@kms_hdmi_inject@inject-audio.html > > * igt@kms_pipe_crc_basic@compare-crc-sanitycheck-nv12@pipe-a-vga-1: > - fi-hsw-4770: NOTRUN -> [SKIP][19] ([fdo#109271]) +12 other tests skip > [19]: > https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_126012v1/fi-hsw-477 > 0/igt@kms_pipe_crc_basic@compare-crc-sanitycheck-nv12@pipe-a-vga-1.htm > l > > * igt@kms_psr@primary_page_flip: > - bat-rplp-1: NOTRUN -> [SKIP][20] ([i915#1072]) +3 other tests skip > [20]: > https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_126012v1/bat-rplp-1 > /igt@kms_psr@primary_page_flip.html > > * igt@kms_psr@sprite_plane_onoff: > - fi-hsw-4770: NOTRUN -> [SKIP][21] ([fdo#109271] / [i915#1072]) +3 other tests skip > [21]: > https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_126012v1/fi-hsw-477 > 0/igt@kms_psr@sprite_plane_onoff.html > > * igt@kms_setmode@basic-clone-single-crtc: > - bat-adlp-6: NOTRUN -> [SKIP][22] ([i915#3555]) > [22]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_126012v1/bat-adlp-6/igt@kms_setmode@basic-clone-single-crtc.html > - bat-rplp-1: NOTRUN -> [SKIP][23] ([i915#3555]) > [23]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_126012v1/bat-rplp-1/igt@kms_setmode@basic-clone-single-crtc.html > - bat-adln-1: NOTRUN -> [SKIP][24] ([i915#3555]) > [24]: > https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_126012v1/bat-adln-1 > /igt@kms_setmode@basic-clone-single-crtc.html > > * igt@prime_vgem@basic-fence-read: > - bat-adlp-6: NOTRUN -> [SKIP][25] ([fdo#109295] / [i915#3291] / [i915#3708]) +2 other tests skip > [25]: > https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_126012v1/bat-adlp-6 > /igt@prime_vgem@basic-fence-read.html > > * igt@prime_vgem@basic-read: > - bat-rplp-1: NOTRUN -> [SKIP][26] ([i915#3708]) +2 other tests skip > [26]: > https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_126012v1/bat-rplp-1 > /igt@prime_vgem@basic-read.html > > * igt@prime_vgem@basic-write: > - bat-adln-1: NOTRUN -> [SKIP][27] ([fdo#109295] / [i915#3291]) +2 other tests skip > [27]: > https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_126012v1/bat-adln-1 > /igt@prime_vgem@basic-write.html > > > #### Possible fixes #### > > * igt@gem_exec_suspend@basic-s0@smem: > - fi-rkl-11600: [FAIL][28] ([fdo#103375]) -> [PASS][29] > [28]: > https://intel-gfx-ci.01.org/tree/drm-tip/CI_DRM_13844/fi-rkl-11600/ igt@gem_exec_suspend@basic-s0@smem.html > [29]: > https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_126012v1/fi-rkl-116 > 00/igt@gem_exec_suspend@basic-s0@smem.html > > * igt@i915_selftest@live@gt_heartbeat: > - fi-apl-guc: [DMESG-FAIL][30] ([i915#5334]) -> [PASS][31] > [30]: > https://intel-gfx-ci.01.org/tree/drm-tip/CI_DRM_13844/fi-apl-guc/ igt@i915_selftest@live@gt_heartbeat.html > [31]: > https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_126012v1/fi-apl-guc > /igt@i915_selftest@live@gt_heartbeat.html > > * igt@i915_selftest@live@workarounds: > - bat-rpls-1: [INCOMPLETE][32] -> [PASS][33] > [32]: > https://intel-gfx-ci.01.org/tree/drm-tip/CI_DRM_13844/bat-rpls-1/ igt@i915_selftest@live@workarounds.html > [33]: > https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_126012v1/bat-rpls-1 > /igt@i915_selftest@live@workarounds.html > > * {igt@kms_pm_backlight@basic-brightness@edp-1}: > - bat-adlp-6: [ABORT][34] ([i915#8668]) -> [PASS][35] > [34]: > https://intel-gfx-ci.01.org/tree/drm-tip/CI_DRM_13844/bat-adlp-6/ igt@kms_pm_backlight@basic-brightness@edp-1.html > [35]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_126012v1/bat-adlp-6/igt@kms_pm_backlight@basic-brightness@edp-1.html > - bat-rplp-1: [ABORT][36] ([i915#8668]) -> [PASS][37] > [36]: > https://intel-gfx-ci.01.org/tree/drm-tip/CI_DRM_13844/bat-rplp-1/ igt@kms_pm_backlight@basic-brightness@edp-1.html > [37]: > https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_126012v1/bat-rplp-1 > /igt@kms_pm_backlight@basic-brightness@edp-1.html > > * {igt@kms_pm_rpm@basic-pci-d3-state}: > - bat-adln-1: [ABORT][38] ([i915#8668]) -> [PASS][39] > [38]: > https://intel-gfx-ci.01.org/tree/drm-tip/CI_DRM_13844/bat-adln-1/ igt@kms_pm_rpm@basic-pci-d3-state.html > [39]: > https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_126012v1/bat-adln-1 > /igt@kms_pm_rpm@basic-pci-d3-state.html > > > {name}: This element is suppressed. This means it is ignored when computing > the status of the difference (SUCCESS, WARNING, or FAILURE). > > [IGT#3]: https://gitlab.freedesktop.org/drm/igt-gpu-tools/issues/3 > [fdo#103375]: https://bugs.freedesktop.org/show_bug.cgi?id=103375 > [fdo#109271]: https://bugs.freedesktop.org/show_bug.cgi?id=109271 > [fdo#109295]: https://bugs.freedesktop.org/show_bug.cgi?id=109295 > [i915#1072]: https://gitlab.freedesktop.org/drm/intel/issues/1072 > [i915#1886]: https://gitlab.freedesktop.org/drm/intel/issues/1886 > [i915#1982]: https://gitlab.freedesktop.org/drm/intel/issues/1982 > [i915#2190]: https://gitlab.freedesktop.org/drm/intel/issues/2190 > [i915#3291]: https://gitlab.freedesktop.org/drm/intel/issues/3291 > [i915#3555]: https://gitlab.freedesktop.org/drm/intel/issues/3555 > [i915#3708]: https://gitlab.freedesktop.org/drm/intel/issues/3708 > [i915#4613]: https://gitlab.freedesktop.org/drm/intel/issues/4613 > [i915#5190]: https://gitlab.freedesktop.org/drm/intel/issues/5190 > [i915#5334]: https://gitlab.freedesktop.org/drm/intel/issues/5334 > [i915#6621]: https://gitlab.freedesktop.org/drm/intel/issues/6621 > [i915#7978]: https://gitlab.freedesktop.org/drm/intel/issues/7978 > [i915#8668]: https://gitlab.freedesktop.org/drm/intel/issues/8668 > [i915#9631]: https://gitlab.freedesktop.org/drm/intel/issues/9631 > > > Build changes > ------------- > > * Linux: CI_DRM_13844 -> Patchwork_126012v1 > > CI-20190529: 20190529 > CI_DRM_13844: 98a039fc048898d9ecec16153267968fd18a5a52 @ git:// anongit.freedesktop.org/gfx-ci/linux > IGT_7574: 0485a4bf66f69aaf7244a3e689402b522f636780 @ https:// gitlab.freedesktop.org/drm/igt-gpu-tools.git > Patchwork_126012v1: 98a039fc048898d9ecec16153267968fd18a5a52 @ > git:// anongit.freedesktop.org/gfx-ci/linux > > > ### Linux commits > > 4be63e4925fd drm/i915/vma: Fix potential UAF on multi-tile platforms > > == Logs == > > For more details see: https://intel-gfx-ci.01.org/tree/drm-tip/ Patchwork_126012v1/index.html >
diff --git a/drivers/gpu/drm/i915/i915_vma.c b/drivers/gpu/drm/i915/i915_vma.c index d09aad34ba37f..70c68f614c6db 100644 --- a/drivers/gpu/drm/i915/i915_vma.c +++ b/drivers/gpu/drm/i915/i915_vma.c @@ -34,6 +34,7 @@ #include "gt/intel_engine.h" #include "gt/intel_engine_heartbeat.h" #include "gt/intel_gt.h" +#include "gt/intel_gt_pm.h" #include "gt/intel_gt_requests.h" #include "gt/intel_tlb.h" @@ -103,12 +104,25 @@ static inline struct i915_vma *active_to_vma(struct i915_active *ref) static int __i915_vma_active(struct i915_active *ref) { - return i915_vma_tryget(active_to_vma(ref)) ? 0 : -ENOENT; + struct i915_vma *vma = active_to_vma(ref); + + if (!i915_vma_tryget(vma)) + return -ENOENT; + + if (!i915_vma_is_ggtt(vma)) + intel_gt_pm_get(vma->vm->gt); + + return 0; } static void __i915_vma_retire(struct i915_active *ref) { - i915_vma_put(active_to_vma(ref)); + struct i915_vma *vma = active_to_vma(ref); + + if (!i915_vma_is_ggtt(vma)) + intel_gt_pm_put_async(vma->vm->gt); + + i915_vma_put(vma); } static struct i915_vma *
Object debugging tools were sporadically reporting illegal attempts to free a still active i915 VMA object from when parking a GPU tile believed to be idle. [161.359441] ODEBUG: free active (active state 0) object: ffff88811643b958 object type: i915_active hint: __i915_vma_active+0x0/0x50 [i915] [161.360082] WARNING: CPU: 5 PID: 276 at lib/debugobjects.c:514 debug_print_object+0x80/0xb0 ... [161.360304] CPU: 5 PID: 276 Comm: kworker/5:2 Not tainted 6.5.0-rc1-CI_DRM_13375-g003f860e5577+ #1 [161.360314] Hardware name: Intel Corporation Rocket Lake Client Platform/RocketLake S UDIMM 6L RVP, BIOS RKLSFWI1.R00.3173.A03.2204210138 04/21/2022 [161.360322] Workqueue: i915-unordered __intel_wakeref_put_work [i915] [161.360592] RIP: 0010:debug_print_object+0x80/0xb0 ... [161.361347] debug_object_free+0xeb/0x110 [161.361362] i915_active_fini+0x14/0x130 [i915] [161.361866] release_references+0xfe/0x1f0 [i915] [161.362543] i915_vma_parked+0x1db/0x380 [i915] [161.363129] __gt_park+0x121/0x230 [i915] [161.363515] ____intel_wakeref_put_last+0x1f/0x70 [i915] That has been tracked down to be happening when another thread was deactivating the VMA inside __active_retire() helper, after the VMA's active counter was already decremented to 0, but before deactivation of the VMA's object was reported to the object debugging tools. Root cause has been identified as premature release of last wakeref for the GPU tile to which the active VMA belonged. In case of single tile platforms, an engine associated with a request that uses the VMA is keeping the tile's wakeref long enough for that VMA to be deactivated on time, before it is going to be freed. However, on multi- tile platforms, a request may use a VMA from a tile other than the one that hosts the request's engine, then, not protected with the engine's wakeref. Get an extra wakeref for the VMA's tile when activating it, and put that wakeref only after the VMA is deactivated. However, exclude GGTT from that processing path, otherwise the GPU never goes idle. Since __i915_vma_retire() may be called from atomic contexts, use async variant of wakeref put. Closes: https://gitlab.freedesktop.org/drm/intel/issues/8875 Fixes: Fixes: 213c43676beb ("drm/i915/mtl: Remove the 'force_probe' requirement for Meteor Lake") Signed-off-by: Janusz Krzysztofik <janusz.krzysztofik@linux.intel.com> --- drivers/gpu/drm/i915/i915_vma.c | 18 ++++++++++++++++-- 1 file changed, 16 insertions(+), 2 deletions(-)