From patchwork Tue Jun 14 18:43:46 2022 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Ramalingam C X-Patchwork-Id: 12881367 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from gabe.freedesktop.org (gabe.freedesktop.org [131.252.210.177]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.lore.kernel.org (Postfix) with ESMTPS id 16EB1C433EF for ; Tue, 14 Jun 2022 18:42:30 +0000 (UTC) Received: from gabe.freedesktop.org (localhost [127.0.0.1]) by gabe.freedesktop.org (Postfix) with ESMTP id 99E4C10E488; Tue, 14 Jun 2022 18:42:22 +0000 (UTC) Received: from mga09.intel.com (mga09.intel.com [134.134.136.24]) by gabe.freedesktop.org (Postfix) with ESMTPS id F152410E488; Tue, 14 Jun 2022 18:42:20 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=intel.com; i=@intel.com; q=dns/txt; s=Intel; t=1655232141; x=1686768141; h=from:to:cc:subject:date:message-id:in-reply-to: references:mime-version:content-transfer-encoding; bh=oqeDFkIeetC2wEaujxi3tiITw4j+xHoPlFr8CP/BMxU=; b=kNhnS2Wo9fAhzYCguii3WVU7Fzqg4EsOlOl0ZTQSB59IlmYBww1Cf7vD vzYeP0+2djJ+iCrJP7it04IVSEd1yJmPr1+HeOroDvLPAlSru7rpmF2Jl Ux+73LfQNFocod89GR+4EO/S2OYYqsLGmal3oB0dwpPGugKpxT/IB9xNT LjDPYpNECU482ge9ARdssKBT/ERUQRIVLj+3H3AmK3F10RsF97XYqJEst vwl0g2l1/RDlkLnckdXfdOOKw1+cdmdgHkBQ7f4VBdRYSbNW4MCDgrL2d K8wRGqI7zFx9WjehYOm66bQTi0lLyAqaw/3dtqLKyMHnNKw8r/aI0mlPz g==; X-IronPort-AV: E=McAfee;i="6400,9594,10378"; a="279426431" X-IronPort-AV: E=Sophos;i="5.91,300,1647327600"; d="scan'208";a="279426431" Received: from fmsmga007.fm.intel.com ([10.253.24.52]) by orsmga102.jf.intel.com with ESMTP/TLS/ECDHE-RSA-AES256-GCM-SHA384; 14 Jun 2022 11:42:20 -0700 X-IronPort-AV: E=Sophos;i="5.91,300,1647327600"; d="scan'208";a="588627293" Received: from ramaling-i9x.iind.intel.com ([10.203.144.108]) by fmsmga007-auth.fm.intel.com with ESMTP/TLS/ECDHE-RSA-AES256-GCM-SHA384; 14 Jun 2022 11:42:18 -0700 From: Ramalingam C To: intel-gfx , dri-devel Date: Wed, 15 Jun 2022 00:13:46 +0530 Message-Id: <20220614184348.23746-2-ramalingam.c@intel.com> X-Mailer: git-send-email 2.20.1 In-Reply-To: <20220614184348.23746-1-ramalingam.c@intel.com> References: <20220614184348.23746-1-ramalingam.c@intel.com> MIME-Version: 1.0 Subject: [Intel-gfx] [PATCH 1/3] drm/i915: Do not access rq->engine without a reference X-BeenThere: intel-gfx@lists.freedesktop.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Intel graphics driver community testing & development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Cc: Hellstrom Thomas , Matthew Auld Errors-To: intel-gfx-bounces@lists.freedesktop.org Sender: "Intel-gfx" From: Niranjana Vishwanathapura In i915_fence_get_driver_name(), user may not hold a reference to rq->engine. Hence do not access it. Instead, store required device private pointer in 'rq->i915' and use it. Signed-off-by: Niranjana Vishwanathapura Suggested-by: Matthew Brost Reviewed-by: Matthew Brost --- drivers/gpu/drm/i915/i915_request.c | 3 ++- drivers/gpu/drm/i915/i915_request.h | 2 ++ 2 files changed, 4 insertions(+), 1 deletion(-) diff --git a/drivers/gpu/drm/i915/i915_request.c b/drivers/gpu/drm/i915/i915_request.c index 73d5195146b0..7f6998bf390c 100644 --- a/drivers/gpu/drm/i915/i915_request.c +++ b/drivers/gpu/drm/i915/i915_request.c @@ -60,7 +60,7 @@ static struct kmem_cache *slab_execute_cbs; static const char *i915_fence_get_driver_name(struct dma_fence *fence) { - return dev_name(to_request(fence)->engine->i915->drm.dev); + return dev_name(to_request(fence)->i915->drm.dev); } static const char *i915_fence_get_timeline_name(struct dma_fence *fence) @@ -937,6 +937,7 @@ __i915_request_create(struct intel_context *ce, gfp_t gfp) rq->engine = ce->engine; rq->ring = ce->ring; rq->execution_mask = ce->engine->mask; + rq->i915 = ce->engine->i915; ret = intel_timeline_get_seqno(tl, rq, &seqno); if (ret) diff --git a/drivers/gpu/drm/i915/i915_request.h b/drivers/gpu/drm/i915/i915_request.h index 28b1f9db5487..47041ec68df8 100644 --- a/drivers/gpu/drm/i915/i915_request.h +++ b/drivers/gpu/drm/i915/i915_request.h @@ -196,6 +196,8 @@ struct i915_request { struct dma_fence fence; spinlock_t lock; + struct drm_i915_private *i915; + /** * Context and ring buffer related to this request * Contexts are refcounted, so when this request is associated with a From patchwork Tue Jun 14 18:43:47 2022 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Ramalingam C X-Patchwork-Id: 12881368 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from gabe.freedesktop.org (gabe.freedesktop.org [131.252.210.177]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.lore.kernel.org (Postfix) with ESMTPS id 0CC3AC433EF for ; Tue, 14 Jun 2022 18:42:36 +0000 (UTC) Received: from gabe.freedesktop.org (localhost [127.0.0.1]) by gabe.freedesktop.org (Postfix) with ESMTP id 67D2410F66A; Tue, 14 Jun 2022 18:42:25 +0000 (UTC) Received: from mga09.intel.com (mga09.intel.com [134.134.136.24]) by gabe.freedesktop.org (Postfix) with ESMTPS id 6C88210F595; Tue, 14 Jun 2022 18:42:23 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=intel.com; i=@intel.com; q=dns/txt; s=Intel; t=1655232143; x=1686768143; h=from:to:cc:subject:date:message-id:in-reply-to: references:mime-version:content-transfer-encoding; bh=bVILIje0+rsSnZ99JOHXd9L6D0kHaRYn5HRmLEj/7gk=; b=den/W/pYzNQGUzPJo6s+ZbkwnsH+NKNr8auuYNeyBZN2y532MAzd/yxE dVesvqjuI5rC/JH+jjEFo/fGh+b89qknvnjpt+eWnoegMZpT9Swm4DaXH lJsBpNzDLMtgqAXTs/oSMiALfFVBn75/OkXVheU2y0Vq43GBddGw10JAa hpRh7aFNgIEFnf+I40s9uO6GMmlHgN+H7nTfNU0sepxbIXytpRD30DkP4 SlO+VhOa6UqMQrLbZV7O4VLDSZNhDepw+8MBcyk11mV6YVDmFLQc0PRyE ggDwaxTNqV4u7lwq9ag/1xRUeBOSFmheZnM1xPl38OEoxBpxp4yN6Jaca A==; X-IronPort-AV: E=McAfee;i="6400,9594,10378"; a="279426465" X-IronPort-AV: E=Sophos;i="5.91,300,1647327600"; d="scan'208";a="279426465" Received: from fmsmga007.fm.intel.com ([10.253.24.52]) by orsmga102.jf.intel.com with ESMTP/TLS/ECDHE-RSA-AES256-GCM-SHA384; 14 Jun 2022 11:42:23 -0700 X-IronPort-AV: E=Sophos;i="5.91,300,1647327600"; d="scan'208";a="588627301" Received: from ramaling-i9x.iind.intel.com ([10.203.144.108]) by fmsmga007-auth.fm.intel.com with ESMTP/TLS/ECDHE-RSA-AES256-GCM-SHA384; 14 Jun 2022 11:42:20 -0700 From: Ramalingam C To: intel-gfx , dri-devel Date: Wed, 15 Jun 2022 00:13:47 +0530 Message-Id: <20220614184348.23746-3-ramalingam.c@intel.com> X-Mailer: git-send-email 2.20.1 In-Reply-To: <20220614184348.23746-1-ramalingam.c@intel.com> References: <20220614184348.23746-1-ramalingam.c@intel.com> MIME-Version: 1.0 Subject: [Intel-gfx] [PATCH 2/3] Revert "drm/i915: Hold reference to intel_context over life of i915_request" X-BeenThere: intel-gfx@lists.freedesktop.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Intel graphics driver community testing & development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Cc: Hellstrom Thomas , Matthew Auld Errors-To: intel-gfx-bounces@lists.freedesktop.org Sender: "Intel-gfx" From: Niranjana Vishwanathapura This reverts commit 1e98d8c52ed5dfbaf273c4423c636525c2ce59e7. The problem with this patch is that it makes i915_request to hold a reference to intel_context, which in turn holds a reference on the VM. This strong back referencing can lead to reference loops which leads to resource leak. An example is the upcoming VM_BIND work which requires VM to hold a reference to some shared VM specific BO. But this BO's dma-resv fences holds reference to the i915_request thus leading to reference loop. Signed-off-by: Niranjana Vishwanathapura Signed-off-by: Ramalingam C Suggested-by: Matthew Brost Reviewed-by: Mathew Brost --- drivers/gpu/drm/i915/i915_request.c | 55 +++++++++++++++++------------ 1 file changed, 32 insertions(+), 23 deletions(-) diff --git a/drivers/gpu/drm/i915/i915_request.c b/drivers/gpu/drm/i915/i915_request.c index 7f6998bf390c..c71905d8e154 100644 --- a/drivers/gpu/drm/i915/i915_request.c +++ b/drivers/gpu/drm/i915/i915_request.c @@ -134,17 +134,39 @@ static void i915_fence_release(struct dma_fence *fence) i915_sw_fence_fini(&rq->semaphore); /* - * Keep one request on each engine for reserved use under mempressure, - * do not use with virtual engines as this really is only needed for - * kernel contexts. + * Keep one request on each engine for reserved use under mempressure + * + * We do not hold a reference to the engine here and so have to be + * very careful in what rq->engine we poke. The virtual engine is + * referenced via the rq->context and we released that ref during + * i915_request_retire(), ergo we must not dereference a virtual + * engine here. Not that we would want to, as the only consumer of + * the reserved engine->request_pool is the power management parking, + * which must-not-fail, and that is only run on the physical engines. + * + * Since the request must have been executed to be have completed, + * we know that it will have been processed by the HW and will + * not be unsubmitted again, so rq->engine and rq->execution_mask + * at this point is stable. rq->execution_mask will be a single + * bit if the last and _only_ engine it could execution on was a + * physical engine, if it's multiple bits then it started on and + * could still be on a virtual engine. Thus if the mask is not a + * power-of-two we assume that rq->engine may still be a virtual + * engine and so a dangling invalid pointer that we cannot dereference + * + * For example, consider the flow of a bonded request through a virtual + * engine. The request is created with a wide engine mask (all engines + * that we might execute on). On processing the bond, the request mask + * is reduced to one or more engines. If the request is subsequently + * bound to a single engine, it will then be constrained to only + * execute on that engine and never returned to the virtual engine + * after timeslicing away, see __unwind_incomplete_requests(). Thus we + * know that if the rq->execution_mask is a single bit, rq->engine + * can be a physical engine with the exact corresponding mask. */ - if (!intel_engine_is_virtual(rq->engine) && - !cmpxchg(&rq->engine->request_pool, NULL, rq)) { - intel_context_put(rq->context); + if (is_power_of_2(rq->execution_mask) && + !cmpxchg(&rq->engine->request_pool, NULL, rq)) return; - } - - intel_context_put(rq->context); kmem_cache_free(slab_requests, rq); } @@ -921,19 +943,7 @@ __i915_request_create(struct intel_context *ce, gfp_t gfp) } } - /* - * Hold a reference to the intel_context over life of an i915_request. - * Without this an i915_request can exist after the context has been - * destroyed (e.g. request retired, context closed, but user space holds - * a reference to the request from an out fence). In the case of GuC - * submission + virtual engine, the engine that the request references - * is also destroyed which can trigger bad pointer dref in fence ops - * (e.g. i915_fence_get_driver_name). We could likely change these - * functions to avoid touching the engine but let's just be safe and - * hold the intel_context reference. In execlist mode the request always - * eventually points to a physical engine so this isn't an issue. - */ - rq->context = intel_context_get(ce); + rq->context = ce; rq->engine = ce->engine; rq->ring = ce->ring; rq->execution_mask = ce->engine->mask; @@ -1009,7 +1019,6 @@ __i915_request_create(struct intel_context *ce, gfp_t gfp) GEM_BUG_ON(!list_empty(&rq->sched.waiters_list)); err_free: - intel_context_put(ce); kmem_cache_free(slab_requests, rq); err_unreserve: intel_context_unpin(ce); From patchwork Tue Jun 14 18:43:48 2022 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Ramalingam C X-Patchwork-Id: 12881369 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from gabe.freedesktop.org (gabe.freedesktop.org [131.252.210.177]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.lore.kernel.org (Postfix) with ESMTPS id 92420CCA47A for ; Tue, 14 Jun 2022 18:42:42 +0000 (UTC) Received: from gabe.freedesktop.org (localhost [127.0.0.1]) by gabe.freedesktop.org (Postfix) with ESMTP id 1A85F10FE67; Tue, 14 Jun 2022 18:42:31 +0000 (UTC) Received: from mga09.intel.com (mga09.intel.com [134.134.136.24]) by gabe.freedesktop.org (Postfix) with ESMTPS id 885A810FC9A; Tue, 14 Jun 2022 18:42:26 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=intel.com; i=@intel.com; q=dns/txt; s=Intel; t=1655232146; x=1686768146; h=from:to:cc:subject:date:message-id:in-reply-to: references:mime-version:content-transfer-encoding; bh=d9BrXaQdih6hNr6yEHkTJeQhLqRwUaHrERctslSo+mI=; b=LsRBDUA7FUowldAHKsBb1gUObBgfXDItfRIopg5BiJowpESPGjlWTkxY lEPy/qLlBJgbtDxdM2ihmmfKlS0/8z9i6AUkMz2gUrOT39vt8xqA2IKb6 IA1kfkKqDRI1Ns1Nj52l43+Uch4a/JMz5BvYCt9dnS532AZs79bWrzedl 2ffVHx5B5k6YiKYlKqhaqk7Zrw/NkmUQvxuIS9XGHyMAtG9Ko7KAqZjrK X5YlA7LMeuFdCkYdFCE17a0EebhOS+jD2hM5XML2ohRzmkrzWBZCXyORP FDP/hDbgKxi/DKpaP/4b25QBLB1vCduwYnbzW6RaMkc50vhP1Jqc1E3ls w==; X-IronPort-AV: E=McAfee;i="6400,9594,10378"; a="279426483" X-IronPort-AV: E=Sophos;i="5.91,300,1647327600"; d="scan'208";a="279426483" Received: from fmsmga007.fm.intel.com ([10.253.24.52]) by orsmga102.jf.intel.com with ESMTP/TLS/ECDHE-RSA-AES256-GCM-SHA384; 14 Jun 2022 11:42:26 -0700 X-IronPort-AV: E=Sophos;i="5.91,300,1647327600"; d="scan'208";a="588627311" Received: from ramaling-i9x.iind.intel.com ([10.203.144.108]) by fmsmga007-auth.fm.intel.com with ESMTP/TLS/ECDHE-RSA-AES256-GCM-SHA384; 14 Jun 2022 11:42:23 -0700 From: Ramalingam C To: intel-gfx , dri-devel Date: Wed, 15 Jun 2022 00:13:48 +0530 Message-Id: <20220614184348.23746-4-ramalingam.c@intel.com> X-Mailer: git-send-email 2.20.1 In-Reply-To: <20220614184348.23746-1-ramalingam.c@intel.com> References: <20220614184348.23746-1-ramalingam.c@intel.com> MIME-Version: 1.0 Subject: [Intel-gfx] [PATCH 3/3] drm/i915: Do not use reserved requests for virtual engines X-BeenThere: intel-gfx@lists.freedesktop.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Intel graphics driver community testing & development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Cc: Hellstrom Thomas , Matthew Auld Errors-To: intel-gfx-bounces@lists.freedesktop.org Sender: "Intel-gfx" Do not use reserved requests for virtual engines as this is only needed for kernel contexts. Signed-off-by: Ramalingam C Suggested-by: Matthew Brost Reviewed-by: Matthew Brost --- drivers/gpu/drm/i915/i915_request.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/drivers/gpu/drm/i915/i915_request.c b/drivers/gpu/drm/i915/i915_request.c index c71905d8e154..f0392b053bca 100644 --- a/drivers/gpu/drm/i915/i915_request.c +++ b/drivers/gpu/drm/i915/i915_request.c @@ -135,6 +135,8 @@ static void i915_fence_release(struct dma_fence *fence) /* * Keep one request on each engine for reserved use under mempressure + * do not use with virtual engines as this really is only needed for + * kernel contexts. * * We do not hold a reference to the engine here and so have to be * very careful in what rq->engine we poke. The virtual engine is @@ -164,7 +166,8 @@ static void i915_fence_release(struct dma_fence *fence) * know that if the rq->execution_mask is a single bit, rq->engine * can be a physical engine with the exact corresponding mask. */ - if (is_power_of_2(rq->execution_mask) && + if (!intel_engine_is_virtual(rq->engine) && + is_power_of_2(rq->execution_mask) && !cmpxchg(&rq->engine->request_pool, NULL, rq)) return;