From patchwork Fri Aug 2 08:38:49 2024 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Andi Shyti X-Patchwork-Id: 13751256 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from gabe.freedesktop.org (gabe.freedesktop.org [131.252.210.177]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.lore.kernel.org (Postfix) with ESMTPS id DE677C3DA49 for ; Fri, 2 Aug 2024 08:39:23 +0000 (UTC) Received: from gabe.freedesktop.org (localhost [127.0.0.1]) by gabe.freedesktop.org (Postfix) with ESMTP id 91C7E10E9B8; Fri, 2 Aug 2024 08:39:23 +0000 (UTC) Authentication-Results: gabe.freedesktop.org; dkim=pass (2048-bit key; unprotected) header.d=intel.com header.i=@intel.com header.b="kH6MU9IM"; dkim-atps=neutral Received: from mgamail.intel.com (mgamail.intel.com [192.198.163.13]) by gabe.freedesktop.org (Postfix) with ESMTPS id B9C7910E9B8; Fri, 2 Aug 2024 08:39:22 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=intel.com; i=@intel.com; q=dns/txt; s=Intel; t=1722587963; x=1754123963; h=from:to:cc:subject:date:message-id:in-reply-to: references:mime-version:content-transfer-encoding; bh=z5OFWfv2GShnV6R7ss7YMCEmoj481tWWJZcJ7gkJC+g=; b=kH6MU9IMhwoxibROvy0DxjzmncVWvpkEJ+7OqO4vNB1nCFu62qCozTQx Hy0BD6zYeoFEHVuA6E7ma9yujldKbPKeBZnAIz5QuRuBd9oNUpw/VeNgc rgGecaABpWTuuSCWik/Gv93GOt4qmv6M/xY9bwUr6vRAaLw1LT0/dCv+t zsX4vv3w3sY/sW+8V5Pr37IaYfcYxJkIEInfkczV/eSEqS/UMzEYGRuMO /c797VGe9RyAwcZQWV3p0JtKbvcq9unyBVLkdM1+aZXlc6SICywj6Bv6+ A3YmakO4Y1L9NaFJCoAEYKDQXQJ6uD77QIKdGwdLaiuXtZtqnUtTW1MXw Q==; X-CSE-ConnectionGUID: lxismfhrSueLLtqq2scdhA== X-CSE-MsgGUID: fFIP1fCTSGa9QUSUcZn7Pw== X-IronPort-AV: E=McAfee;i="6700,10204,11151"; a="23513519" X-IronPort-AV: E=Sophos;i="6.09,257,1716274800"; d="scan'208";a="23513519" Received: from fmviesa003.fm.intel.com ([10.60.135.143]) by fmvoesa107.fm.intel.com with ESMTP/TLS/ECDHE-RSA-AES256-GCM-SHA384; 02 Aug 2024 01:39:22 -0700 X-CSE-ConnectionGUID: rCIQy/y+TqygnXE7yhO33g== X-CSE-MsgGUID: i42fV2HpTRK5kv1VLDDGlA== X-ExtLoop1: 1 X-IronPort-AV: E=Sophos;i="6.09,257,1716274800"; d="scan'208";a="59443698" Received: from pgcooper-mobl3.ger.corp.intel.com (HELO intel.com) ([10.245.245.86]) by fmviesa003-auth.fm.intel.com with ESMTP/TLS/ECDHE-RSA-AES256-GCM-SHA384; 02 Aug 2024 01:39:19 -0700 From: Andi Shyti To: intel-gfx , dri-devel Cc: Jann Horn , Jani Nikula , Joonas Lahtinen , Rodrigo Vivi , Tvrtko Ursulin , Jann Horn , Chris Wilson , Krzysztof Niemiec , Andi Shyti , Matthew Auld , Andi Shyti Subject: [PATCH 1/2] drm/i915/gem: Adjust vma offset for framebuffer mmap offset Date: Fri, 2 Aug 2024 10:38:49 +0200 Message-ID: <20240802083850.103694-2-andi.shyti@linux.intel.com> X-Mailer: git-send-email 2.45.2 In-Reply-To: <20240802083850.103694-1-andi.shyti@linux.intel.com> References: <20240802083850.103694-1-andi.shyti@linux.intel.com> MIME-Version: 1.0 X-BeenThere: intel-gfx@lists.freedesktop.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Intel graphics driver community testing & development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: intel-gfx-bounces@lists.freedesktop.org Sender: "Intel-gfx" When mapping a framebuffer object, the virtual memory area (VMA) offset ('vm_pgoff') should be adjusted by the start of the 'vma_node' associated with the object. This ensures that the VMA offset is correctly aligned with the corresponding offset within the GGTT aperture. Increment vm_pgoff by the start of the vma_node with the offset= provided by the user. Suggested-by: Chris Wilson Signed-off-by: Andi Shyti Reviewed-by: Jonathan Cavitt Reviewed-by: Rodrigo Vivi --- drivers/gpu/drm/i915/gem/i915_gem_mman.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/drivers/gpu/drm/i915/gem/i915_gem_mman.c b/drivers/gpu/drm/i915/gem/i915_gem_mman.c index a2195e28b625..ce10dd259812 100644 --- a/drivers/gpu/drm/i915/gem/i915_gem_mman.c +++ b/drivers/gpu/drm/i915/gem/i915_gem_mman.c @@ -1084,6 +1084,8 @@ int i915_gem_fb_mmap(struct drm_i915_gem_object *obj, struct vm_area_struct *vma mmo = mmap_offset_attach(obj, mmap_type, NULL); if (IS_ERR(mmo)) return PTR_ERR(mmo); + + vma->vm_pgoff += drm_vma_node_start(&mmo->vma_node); } /* From patchwork Fri Aug 2 08:38:50 2024 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Andi Shyti X-Patchwork-Id: 13751257 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from gabe.freedesktop.org (gabe.freedesktop.org [131.252.210.177]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.lore.kernel.org (Postfix) with ESMTPS id 03C28C3DA49 for ; Fri, 2 Aug 2024 08:39:31 +0000 (UTC) Received: from gabe.freedesktop.org (localhost [127.0.0.1]) by gabe.freedesktop.org (Postfix) with ESMTP id A054910E9BF; Fri, 2 Aug 2024 08:39:30 +0000 (UTC) Authentication-Results: gabe.freedesktop.org; dkim=pass (2048-bit key; unprotected) header.d=intel.com header.i=@intel.com header.b="Jt53GAcM"; dkim-atps=neutral Received: from mgamail.intel.com (mgamail.intel.com [192.198.163.13]) by gabe.freedesktop.org (Postfix) with ESMTPS id C0AD310E9BA; Fri, 2 Aug 2024 08:39:28 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=intel.com; i=@intel.com; q=dns/txt; s=Intel; t=1722587969; x=1754123969; h=from:to:cc:subject:date:message-id:in-reply-to: references:mime-version:content-transfer-encoding; bh=hb/60pPRHKBvSV3c6ABPS738jOCjOHMnorWAnGaob0M=; b=Jt53GAcMw8kmwA7Ri1pV6l2+5/wiq72hjPEwz1OEJe5otAW5t1vMjXsl DP8nofPAodg8dtAw8utOIqS5Wo3GG/9r8yEemPz2AGKAs7U/29CMQ5wg0 pHZ+d4CdzzMdtbHE5KJfOh66aE0JAFp4PrfvGvRFkOABfyZc3Mi8rNL8T yAsdfwgPbvs3b28uizaQj7CSXRqUuLrQ7TT3vNLPez90sX+T4hSomE537 e+M4UprjHoGG7oqlCWT1NpLajlNonKgZRgQ2DeOmNHcnYAd+fwih2PVQF OnLOKBiMd3h7/CC0BX58EEykrwHKkNfOTTew/y0AiBJmafP1tAwnS5J6Q g==; X-CSE-ConnectionGUID: CMEQMVSlSR66B2oqW95OUA== X-CSE-MsgGUID: pxxeLbtJRUuCNVDy4BXiuQ== X-IronPort-AV: E=McAfee;i="6700,10204,11151"; a="23513549" X-IronPort-AV: E=Sophos;i="6.09,257,1716274800"; d="scan'208";a="23513549" Received: from fmviesa003.fm.intel.com ([10.60.135.143]) by fmvoesa107.fm.intel.com with ESMTP/TLS/ECDHE-RSA-AES256-GCM-SHA384; 02 Aug 2024 01:39:28 -0700 X-CSE-ConnectionGUID: 6T5sGY/fQSyBQCDs3IJ3sw== X-CSE-MsgGUID: bWCV1d7rQU65wEPbUBmmiQ== X-ExtLoop1: 1 X-IronPort-AV: E=Sophos;i="6.09,257,1716274800"; d="scan'208";a="59443808" Received: from pgcooper-mobl3.ger.corp.intel.com (HELO intel.com) ([10.245.245.86]) by fmviesa003-auth.fm.intel.com with ESMTP/TLS/ECDHE-RSA-AES256-GCM-SHA384; 02 Aug 2024 01:39:25 -0700 From: Andi Shyti To: intel-gfx , dri-devel Cc: Jann Horn , Jani Nikula , Joonas Lahtinen , Rodrigo Vivi , Tvrtko Ursulin , Jann Horn , Chris Wilson , Krzysztof Niemiec , Andi Shyti , Matthew Auld , Andi Shyti Subject: [PATCH 2/2] drm/i915/gem: Fix Virtual Memory mapping boundaries calculation Date: Fri, 2 Aug 2024 10:38:50 +0200 Message-ID: <20240802083850.103694-3-andi.shyti@linux.intel.com> X-Mailer: git-send-email 2.45.2 In-Reply-To: <20240802083850.103694-1-andi.shyti@linux.intel.com> References: <20240802083850.103694-1-andi.shyti@linux.intel.com> MIME-Version: 1.0 X-BeenThere: intel-gfx@lists.freedesktop.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Intel graphics driver community testing & development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: intel-gfx-bounces@lists.freedesktop.org Sender: "Intel-gfx" Calculating the size of the mapped area as the lesser value between the requested size and the actual size does not consider the partial mapping offset. This can cause page fault access. Fix the calculation of the starting and ending addresses, the total size is now deduced from the difference between the end and start addresses. Additionally, the calculations have been rewritten in a clearer and more understandable form. Fixes: c58305af1835 ("drm/i915: Use remap_io_mapping() to prefault all PTE in a single pass") Reported-by: Jann Horn Co-developed-by: Chris Wilson Signed-off-by: Chris Wilson Signed-off-by: Andi Shyti Cc: Joonas Lahtinen Cc: Matthew Auld Cc: Rodrigo Vivi Cc: # v4.9+ Reviewed-by: Jann Horn Reviewed-by: Jonathan Cavitt --- drivers/gpu/drm/i915/gem/i915_gem_mman.c | 53 +++++++++++++++++++++--- 1 file changed, 47 insertions(+), 6 deletions(-) diff --git a/drivers/gpu/drm/i915/gem/i915_gem_mman.c b/drivers/gpu/drm/i915/gem/i915_gem_mman.c index ce10dd259812..cac6d4184506 100644 --- a/drivers/gpu/drm/i915/gem/i915_gem_mman.c +++ b/drivers/gpu/drm/i915/gem/i915_gem_mman.c @@ -290,6 +290,41 @@ static vm_fault_t vm_fault_cpu(struct vm_fault *vmf) return i915_error_to_vmf_fault(err); } +static void set_address_limits(struct vm_area_struct *area, + struct i915_vma *vma, + unsigned long obj_offset, + unsigned long *start_vaddr, + unsigned long *end_vaddr) +{ + unsigned long vm_start, vm_end, vma_size; /* user's memory parameters */ + long start, end; /* memory boundaries */ + + /* + * Let's move into the ">> PAGE_SHIFT" + * domain to be sure not to lose bits + */ + vm_start = area->vm_start >> PAGE_SHIFT; + vm_end = area->vm_end >> PAGE_SHIFT; + vma_size = vma->size >> PAGE_SHIFT; + + /* + * Calculate the memory boundaries by considering the offset + * provided by the user during memory mapping and the offset + * provided for the partial mapping. + */ + start = vm_start; + start -= obj_offset; + start += vma->gtt_view.partial.offset; + end = start + vma_size; + + start = max_t(long, start, vm_start); + end = min_t(long, end, vm_end); + + /* Let's move back into the "<< PAGE_SHIFT" domain */ + *start_vaddr = (unsigned long)start << PAGE_SHIFT; + *end_vaddr = (unsigned long)end << PAGE_SHIFT; +} + static vm_fault_t vm_fault_gtt(struct vm_fault *vmf) { #define MIN_CHUNK_PAGES (SZ_1M >> PAGE_SHIFT) @@ -302,14 +337,18 @@ static vm_fault_t vm_fault_gtt(struct vm_fault *vmf) struct i915_ggtt *ggtt = to_gt(i915)->ggtt; bool write = area->vm_flags & VM_WRITE; struct i915_gem_ww_ctx ww; + unsigned long obj_offset; + unsigned long start, end; /* memory boundaries */ intel_wakeref_t wakeref; struct i915_vma *vma; pgoff_t page_offset; + unsigned long pfn; int srcu; int ret; - /* We don't use vmf->pgoff since that has the fake offset */ + obj_offset = area->vm_pgoff - drm_vma_node_start(&mmo->vma_node); page_offset = (vmf->address - area->vm_start) >> PAGE_SHIFT; + page_offset += obj_offset; trace_i915_gem_object_fault(obj, page_offset, true, write); @@ -402,12 +441,14 @@ static vm_fault_t vm_fault_gtt(struct vm_fault *vmf) if (ret) goto err_unpin; + set_address_limits(area, vma, obj_offset, &start, &end); + + pfn = (ggtt->gmadr.start + i915_ggtt_offset(vma)) >> PAGE_SHIFT; + pfn += (start - area->vm_start) >> PAGE_SHIFT; + pfn += obj_offset - vma->gtt_view.partial.offset; + /* Finally, remap it using the new GTT offset */ - ret = remap_io_mapping(area, - area->vm_start + (vma->gtt_view.partial.offset << PAGE_SHIFT), - (ggtt->gmadr.start + i915_ggtt_offset(vma)) >> PAGE_SHIFT, - min_t(u64, vma->size, area->vm_end - area->vm_start), - &ggtt->iomap); + ret = remap_io_mapping(area, start, pfn, end - start, &ggtt->iomap); if (ret) goto err_fence;