aboutsummaryrefslogtreecommitdiff
path: root/drivers/gpu
AgeCommit message (Collapse)AuthorFilesLines
2017-04-28drm/amdgpu: update smu9 driver interfaceEvan Quan1-2/+16
Updated interface between the driver and the SMU controller. Signed-off-by: Evan Quan <[email protected]> Signed-off-by: Alex Deucher <[email protected]> Reviewed-by: Alex Deucher <[email protected]> Signed-off-by: Alex Deucher <[email protected]>
2017-04-28drm/amd/amdgpu: Print out ring name in dev_infoTom St Denis1-2/+3
So it's more obvious which rings are using which INV engines. Signed-off-by: Tom St Denis <[email protected]> Reviewed-by: Christian König <[email protected]> Signed-off-by: Alex Deucher <[email protected]>
2017-04-28drm/amd/amdgpu: Change comp GFXv9 ring name to remove spaceTom St Denis1-1/+1
umr expects the ring name to be a complete word. This also makes it consistent with GFXv7/8. Signed-off-by: Tom St Denis <[email protected]> Reviewed-by: Christian König <[email protected]> Signed-off-by: Alex Deucher <[email protected]>
2017-04-28drm/amd/amdgpu: Change comp GFXv6 ring name to remove spaceTom St Denis1-1/+1
umr expects the ring name to be a complete word. This also makes it consistent with GFXv7/8. Signed-off-by: Tom St Denis <[email protected]> Reviewed-by: Christian König <[email protected]> Signed-off-by: Alex Deucher <[email protected]>
2017-04-28drm/amdgpu: Fix module unload hang by KIQ on Vega10Trigger Huang1-8/+2
Apply commit 4e683cb2644f ("drm/amdgpu: Fix module unload hang by KIQ IRQ set")to vega10 V2: delete reduant kiq irq funcs type check (suggested by Rex.Zhu) Signed-off-by: Trigger Huang <[email protected]> Reviewed-by: Alex Deucher <[email protected]> Signed-off-by: Alex Deucher <[email protected]>
2017-04-28drm/amdgpu: fix memory clock can't switch on CI.Rex Zhu1-2/+1
if we set only lowest mclk level enabled, when we enable uvd dpm during boot time, mclk will be fixed in the lowest level. the mclk switch will fail if try to enable other level of mclk at this time. so set all mclk levels enabled. Signed-off-by: Rex Zhu <[email protected]> Reviewed-by: Alex Deucher <[email protected]> Signed-off-by: Alex Deucher <[email protected]>
2017-04-28drm/amdgpu/gfx9: bypass clockgating settingXiangliang Yu1-0/+3
For SRIOV doesn't need clockgating, bypass it. Signed-off-by: Xiangliang Yu <[email protected]> Reviewed-by: Alex Deucher <[email protected]> Signed-off-by: Alex Deucher <[email protected]>
2017-04-28drm/amdgpu/mmhub_v1: bypass clockgating settingXiangliang Yu1-0/+3
For SRIOV doesn't need CG, so bypass it. Signed-off-by: Xiangliang Yu <[email protected]> Reviewed-by: Alex Deucher <[email protected]> Signed-off-by: Alex Deucher <[email protected]>
2017-04-28drm/amdgpu: fix coding style and printing in amdgpu_doorbell_initChristian König1-5/+4
Based on commit "drm/radeon: remove useless and potentially wrong message". The size of the info printing is incorrect and the PCI subsystems prints the same info on boot anyway. Signed-off-by: Christian König <[email protected]> Reviewed-by: Edward O'Callaghan <[email protected]> Signed-off-by: Alex Deucher <[email protected]>
2017-04-28drm/amdgpu/virt: don't check VALID bit for FLR completion messagePixel Ding1-3/+6
The interrupt after FLR is missed sometimes due to hardware reason, so guest driver get the notification of FLR completion via polling message. Then host doesn't write VALID bit to avoid sending interrupt, otherwise the completion will be handled twice. So there's a valid message without VALID bit for FLR completion, driver should handle it without checking. Signed-off-by: Pixel Ding <[email protected]> Reviewed-by: Xiangliang Yu <[email protected]> Signed-off-by: Alex Deucher <[email protected]>
2017-04-28drm/amdgpu: fix double_offchip_lds_buf for gfx v6Junwei Zhang1-1/+1
Was incorrect for SI. Signed-off-by: Junwei Zhang <[email protected]> Reviewed-by: Alex Deucher <[email protected]> Signed-off-by: Alex Deucher <[email protected]> Cc: [email protected]
2017-04-28drm/amd/powerplay: delete dead functions in vega10.Rex Zhu3-38/+2
Vega10 does not support AVFS BTC, remove function. Signed-off-by: Rex Zhu <[email protected]> Reviewed-by: Alex Deucher <[email protected]> Signed-off-by: Alex Deucher <[email protected]>
2017-04-28drm/amd/amdgpu: coding style refine in sdma_v4_0.cRex Zhu1-76/+75
Replace 8 spaces with tabs. correct {} braces, etc. Signed-off-by: Rex Zhu <[email protected]> Signed-off-by: Alex Deucher <[email protected]>
2017-04-28drm/amdgpu: Remove redundant itermediate return val in sdma_v4_0.cRex Zhu1-5/+1
Signed-off-by: Rex Zhu <[email protected]> Reviewed-by: Alex Deucher <[email protected]> Signed-off-by: Alex Deucher <[email protected]>
2017-04-28drm/ttm: cleanup unuse ret valueHuang Rui1-2/+1
The ret must be 0 here, otherwise, the function will return after init_mem_type. Signed-off-by: Huang Rui <[email protected]> Reviewed-by: Alex Deucher <[email protected]> Signed-off-by: Alex Deucher <[email protected]>
2017-04-28drm/amdgpu: fix to print incorrect wptr addressHuang Rui1-1/+1
Signed-off-by: Huang Rui <[email protected]> Reviewed-by: Michel Dänzer <[email protected]> Signed-off-by: Alex Deucher <[email protected]>
2017-04-28drm/amdgpu: fix dead lock if any ip block resume failed in s3Huang Rui1-15/+11
Driver must free the console lock whether driver resuming successful or not. Otherwise, fb_console will be always waiting for the lock and then cause system stuck. [ 244.405541] INFO: task kworker/0:0:4 blocked for more than 120 seconds. [ 244.405543] Tainted: G OE 4.9.0-custom #1 [ 244.405544] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. [ 244.405541] INFO: task kworker/0:0:4 blocked for more than 120 seconds. [ 244.405543] Tainted: G OE 4.9.0-custom #1 [ 244.405544] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. [ 244.405550] kworker/0:0 D 0 4 2 0x00080000 [ 244.405559] Workqueue: events console_callback [ 244.405564] ffff88045a2cfc00 0000000000000000 ffff880462b75940 ffffffff81c0e500 [ 244.405568] ffff880476419280 ffffc900018f7c90 ffffffff817dcf62 000000000000003c [ 244.405572] 0000000100000000 0000000000000002 ffff880462b75940 ffff880462b75940 [ 244.405573] Call Trace: [ 244.405580] [<ffffffff817dcf62>] ? __schedule+0x222/0x6a0 [ 244.405584] [<ffffffff817dd416>] schedule+0x36/0x80 [ 244.405588] [<ffffffff817e041c>] schedule_timeout+0x1fc/0x390 [ 244.405592] [<ffffffff817df1b4>] __down_common+0xa5/0xf8 [ 244.405598] [<ffffffff810b2ca8>] ? put_prev_entity+0x48/0x710 [ 244.405601] [<ffffffff817df224>] __down+0x1d/0x1f [ 244.405606] [<ffffffff810c71a1>] down+0x41/0x50 [ 244.405611] [<ffffffff810d380a>] console_lock+0x1a/0x40 [ 244.405614] [<ffffffff814e3c03>] console_callback+0x13/0x160 [ 244.405617] [<ffffffff817dcf6a>] ? __schedule+0x22a/0x6a0 [ 244.405623] [<ffffffff810954e3>] process_one_work+0x153/0x3f0 [ 244.405628] [<ffffffff81095cab>] worker_thread+0x12b/0x4b0 [ 244.405633] [<ffffffff81095b80>] ? rescuer_thread+0x350/0x350 [ 244.405637] [<ffffffff8109b473>] kthread+0xd3/0xf0 [ 244.405641] [<ffffffff8109b3a0>] ? kthread_park+0x60/0x60 [ 244.405645] [<ffffffff8109b3a0>] ? kthread_park+0x60/0x60 [ 244.405649] [<ffffffff817e1ee5>] ret_from_fork+0x25/0x30 Signed-off-by: Huang Rui <[email protected]> Reviewed-by: Michel Dänzer <[email protected]> Reviewed-by: Alex Deucher <[email protected]> Signed-off-by: Alex Deucher <[email protected]>
2017-04-28drm/radeon: force the UVD DPB into VRAM as wellChristian König2-5/+7
Seems to be mandatory for WMV playback. Bugs: https://bugs.freedesktop.org/show_bug.cgi?id=100510 Signed-off-by: Christian König <[email protected]> Acked-by: Alex Deucher <[email protected]> Signed-off-by: Alex Deucher <[email protected]>
2017-04-28drm/amdgpu: bump version number to note race fix and new fence functionalityAlex Deucher1-1/+2
fixed in: "drm/amdgpu:fix race condition" Reviewed-by: Christian König <[email protected]> Signed-off-by: Alex Deucher <[email protected]>
2017-04-28drm/amdgpu: trace vm hub during flush as well v2Christian König2-9/+13
Trace on which hub we are doing the flush. v2: fix typo in commit message Signed-off-by: Christian König <[email protected]> Reviewed-by: Alex Deucher <[email protected]> Reviewed-by: Andres Rodriguez <[email protected]> Signed-off-by: Alex Deucher <[email protected]>
2017-04-28drm/amdgpu: trace the vmhub in grab_id as wellChristian König2-8/+11
Trace on which VMHUB we assigned an VMID. Signed-off-by: Christian König <[email protected]> Reviewed-by: Alex Deucher <[email protected]> Signed-off-by: Alex Deucher <[email protected]>
2017-04-28drm/amdgpu: allow concurrent VM flushesChristian König1-22/+28
Enable concurrent VM flushes for Vega10. Signed-off-by: Christian König <[email protected]> Acked-by: Alex Deucher <[email protected]> Reviewed-by: Andres Rodriguez <[email protected]> Signed-off-by: Alex Deucher <[email protected]>
2017-04-28drm/amdgpu: assign VM invalidation engine manually v2Christian König6-5/+22
For Vega10 we have 18 VM invalidation engines for each VMHUB. Start to assign them manually to the rings. v2: add a BUG_ON if we use to many engines Signed-off-by: Christian König <[email protected]> Reviewed-by: Alex Deucher <[email protected]> Reviewed-by: Andres Rodriguez <[email protected]> Signed-off-by: Alex Deucher <[email protected]>
2017-04-28drm/amdgpu: invalidate only the currently needed VMHUB v2Christian König5-148/+119
Drop invalidating both hubs from each engine. v2: don't use hardcoded values Signed-off-by: Christian König <[email protected]> Reviewed-by: Alex Deucher <[email protected]> Reviewed-by: Andres Rodriguez <[email protected]> Signed-off-by: Alex Deucher <[email protected]>
2017-04-28drm/amdgpu: split VMID management by VMHUBChristian König10-45/+69
This way GFX and MM won't fight for VMIDs any more. Initially disabled since we need to stop flushing all HUBS at the same time as well. Signed-off-by: Christian König <[email protected]> Reviewed-by: Andres Rodriguez <[email protected]> Acked-by: Alex Deucher <[email protected]> Signed-off-by: Alex Deucher <[email protected]>
2017-04-28drm/amdgpu: drop VMID per ring trackingChristian König2-17/+3
David suggested this a long time ago, instead of checking each ring just walk over all the VMIDs in reverse LRU order. Signed-off-by: Christian König <[email protected]> Reviewed-by: Andres Rodriguez <[email protected]> Reviewed-by: Alex Deucher <[email protected]> Signed-off-by: Alex Deucher <[email protected]>
2017-04-28drm/amdgpu: add VMHUB to ring associationChristian König5-0/+8
Add the info which ring belonging to which VMHUB. Signed-off-by: Christian König <[email protected]> Reviewed-by: Alex Deucher <[email protected]> Reviewed-by: Andres Rodriguez <[email protected]> Signed-off-by: Alex Deucher <[email protected]>
2017-04-28drm/amdgpu/vce4: enable ring & ib test for sriovFrank Min1-8/+0
Now VCE block can work for SRIOV, enable ring & ib test. Signed-off-by: Frank Min <[email protected]> Acked-by: Christian König <[email protected]> Signed-off-by: Alex Deucher <[email protected]>
2017-04-28drm/amdgpu/vce4: workaround VCE ring test slow issueXiangliang Yu1-3/+7
Add VCE ring test slow workaround for SRIOV. Signed-off-by: Frank Min <[email protected]> Signed-off-by: Xiangliang Yu <[email protected]> Acked-by: Christian König <[email protected]> Signed-off-by: Alex Deucher <[email protected]>
2017-04-28drm/amdgpu/vce4: update VCE initialization sequence for SRIOVFrank Min1-7/+2
Update the initialization sequence of VCE to make VCE work. Signed-off-by: Frank Min <[email protected]> Acked-by: Christian König <[email protected]> Signed-off-by: Alex Deucher <[email protected]>
2017-04-28drm/amdgpu: Fix firmware UCODE_ID_STORAGE issue (v2)Trigger Huang1-3/+7
In Tonga's virtualization environment, for firmware UCODE_ID_STORAGE, there is no actual firmware data, but we still need alloc a BO and tell the BO's mc address to HW, or world switch will hang on VFs. v2: fix coding style (Alex) Signed-off-by: Trigger Huang <[email protected]> Reviewed-by: Xiangliang Yu <[email protected]> Reviewed-by: Monk Liu <[email protected]> Acked-by: Huang Rui <[email protected]> Signed-off-by: Alex Deucher <[email protected]>
2017-04-28drm/amdgpu: fix to add buffer funcs checkHuang Rui1-1/+3
This patch fixes the case when buffer funcs is empty and bo evict is executing. It must double check buffer funcs, otherwise, a NULL pointer dereference kernel panic will be encountered. BUG: unable to handle kernel NULL pointer dereference at 00000000000001a4 IP: [<ffffffffa067b6cd>] amdgpu_evict_flags+0x3d/0xf0 [amdgpu] PGD 0 Oops: 0000 [#1] SMP Modules linked in: amdgpu(OE) ttm drm_kms_helper drm i2c_algo_bit fb_sys_fops syscopyarea sysfillrect sysimgblt fmem(OE) physmem_drv(OE) rpcsec_gss_krb5 nfsv4 nfs fscache intel_rapl x86_pkg_temp_thermal intel_powerclamp snd_hda_codec_realtek snd_hda_codec_hdmi snd_hda_codec_generic kvm_intel snd_hda_intel snd_hda_codec kvm snd_hda_core joydev eeepc_wmi asus_wmi sparse_keymap snd_hwdep snd_pcm irqbypass crct10dif_pclmul snd_seq_midi snd_seq_midi_event snd_rawmidi snd_seq crc32_pclmul snd_seq_device ghash_clmulni_intel aesni_intel aes_x86_64 snd_timer lrw gf128mul mei_me snd glue_helper ablk_helper cryptd tpm_infineon mei lpc_ich serio_raw soundcore shpchp mac_hid nfsd auth_rpcgss nfs_acl lockd grace coretemp sunrpc parport_pc ppdev lp parport autofs4 hid_generic mxm_wmi r8169 usbhid ahci psmouse libahci nvme mii hid nvme_core wmi video CPU: 3 PID: 1627 Comm: kworker/u8:17 Tainted: G OE 4.9.0-custom #1 Hardware name: ASUS All Series/Z87-A, BIOS 1802 01/28/2014 Workqueue: events_unbound async_run_entry_fn task: ffff88021e7057c0 task.stack: ffffc9000262c000 RIP: 0010:[<ffffffffa067b6cd>] [<ffffffffa067b6cd>] amdgpu_evict_flags+0x3d/0xf0 [amdgpu] RSP: 0018:ffffc9000262fb30 EFLAGS: 00010246 RAX: 0000000000000000 RBX: ffff88021e8a5858 RCX: 0000000000000000 RDX: 0000000000000001 RSI: ffffc9000262fb58 RDI: ffff88021e8a5800 RBP: ffffc9000262fb48 R08: 0000000000000000 R09: ffff88021e8a5814 R10: 000000001def8f01 R11: ffff88021def8c80 R12: ffffc9000262fb58 R13: ffff88021d2b1990 R14: 0000000000000000 R15: ffff88021e8a5858 FS: 0000000000000000(0000) GS:ffff88022ed80000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00000000000001a4 CR3: 0000000001c07000 CR4: 00000000001406e0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Signed-off-by: Huang Rui <[email protected]> Reviewed-by: Ken Wang <[email protected]> Signed-off-by: Alex Deucher <[email protected]>
2017-04-28drm/amdgpu: fix to clear ASIC INIT COMPLETE bit on resuming phaseHuang Rui2-0/+13
ASIC_INIT_COMPLETE bit must be cleared during S3 resuming phase, because VBIOS will check the bit to decide if execute ASIC_Init posting via kernel driver. Signed-off-by: Huang Rui <[email protected]> Reviewed-by: Alex Deucher <[email protected]> Signed-off-by: Alex Deucher <[email protected]>
2017-04-28drm/amdgpu: do not free fence buf when driver probes.Huang Rui1-2/+4
Fence buf needs to be used on suspend/resume phase. Signed-off-by: Huang Rui <[email protected]> Reviewed-by: Alex Deucher <[email protected]> Signed-off-by: Alex Deucher <[email protected]>
2017-04-28drm/amd/powerplay: fix suspend error on DPM disabledHuang Rui1-1/+3
Don't fail if DPM is disabled. Signed-off-by: Huang Rui <[email protected]> Reviewed-by: Alex Deucher <[email protected]> Signed-off-by: Alex Deucher <[email protected]>
2017-04-28drm/amdgpu:fix race conditionMonk Liu1-0/+3
sequence is protected by spinlock so don't access sequence in paramter seq when invoking this function. ~0 means to get the latest sequence number and 0 means none to get. Change-Id: Ib7a03f3cf5594deeb4ad333cc59b47a6bddfd1ad Signed-off-by: Monk Liu <[email protected]> Reviewed-by: Christian König <[email protected]> Signed-off-by: Alex Deucher <[email protected]>
2017-04-28drm/amd/amdgpu: Port gfx9 driver over to new read/write macrosTom St Denis1-203/+203
Signed-off-by: Tom St Denis <[email protected]> Acked-by: Christian König <[email protected]> Reviewed-by: Chunming Zhou <[email protected]> Signed-off-by: Alex Deucher <[email protected]>
2017-04-28drm/amd/amdgpu: Introduce new read/write macros for SOC15Tom St Denis2-4/+19
Signed-off-by: Tom St Denis <[email protected]> Reviewed-by: Christian König <[email protected]> Signed-off-by: Alex Deucher <[email protected]>
2017-04-28drm/amdgpu: add hw_start and non-psp firmware loading into resumeHuang Rui1-2/+14
Rework in order to properly support suspend. Signed-off-by: Huang Rui <[email protected]> Reviewed-by: Alex Deucher <[email protected]> Signed-off-by: Alex Deucher <[email protected]>
2017-04-28drm/amdgpu: split psp ring init functionHuang Rui4-44/+87
Rework in order to properly support suspend. Signed-off-by: Huang Rui <[email protected]> Reviewed-by: Alex Deucher <[email protected]> Signed-off-by: Alex Deucher <[email protected]>
2017-04-28drm/amdgpu: split psp asd functionHuang Rui2-24/+26
Rework in order to properly support suspend. Signed-off-by: Huang Rui <[email protected]> Reviewed-by: Alex Deucher <[email protected]> Signed-off-by: Alex Deucher <[email protected]>
2017-04-28drm/amdgpu: use private memory to store psp firmware dataHuang Rui3-61/+16
Rework in order to properly support suspend. Signed-off-by: Huang Rui <[email protected]> Reviewed-by: Alex Deucher <[email protected]> Signed-off-by: Alex Deucher <[email protected]>
2017-04-28drm/amdgpu: add psp firmware private memoryHuang Rui2-4/+25
Needed for proper suspend support. Signed-off-by: Huang Rui <[email protected]> Reviewed-by: Alex Deucher <[email protected]> Signed-off-by: Alex Deucher <[email protected]>
2017-04-28drm/amdgpu: split psp tmr init functionHuang Rui1-10/+17
Rework in order to properly support suspend. Signed-off-by: Huang Rui <[email protected]> Reviewed-by: Alex Deucher <[email protected]> Signed-off-by: Alex Deucher <[email protected]>
2017-04-28drm/amd/powerplay: align with VBIOS to support new AVFS structureRex Zhu3-68/+68
Align the driver with the latest vbios structures. Signed-off-by: Rex Zhu <[email protected]> Reviewed-by: Alex Deucher <[email protected]> Signed-off-by: Alex Deucher <[email protected]>
2017-04-29Merge tag 'drm-intel-next-fixes-2017-04-27' of ↵Dave Airlie17-97/+163
git://anongit.freedesktop.org/git/drm-intel into drm-next drm/i915 and gvt fixes for drm-next/v4.12 * tag 'drm-intel-next-fixes-2017-04-27' of git://anongit.freedesktop.org/git/drm-intel: drm/i915: Confirm the request is still active before adding it to the await drm/i915: Avoid busy-spinning on VLV_GLTC_PW_STATUS mmio drm/i915/selftests: Allocate inode/file dynamically drm/i915: Fix system hang with EI UP masked on Haswell drm/i915: checking for NULL instead of IS_ERR() in mock selftests drm/i915: Perform link quality check unconditionally during long pulse drm/i915: Fix use after free in lpe_audio_platdev_destroy() drm/i915: Use the right mapping_gfp_mask for final shmem allocation drm/i915: Make legacy cursor updates more unsynced drm/i915: Apply a cond_resched() to the saturated signaler drm/i915: Park the signaler before sleeping drm/i915/gvt: fix a bounds check in ring_id_to_context_switch_event() drm/i915/gvt: Fix PTE write flush for taking runtime pm properly drm/i915/gvt: remove some debug messages in scheduler timer handler drm/i915/gvt: add mmio init for virtual display drm/i915/gvt: use directly assignment for structure copying drm/i915/gvt: remove redundant ring id check which cause significant CPU misprediction drm/i915/gvt: remove redundant platform check for mocs load/restore drm/i915/gvt: Align render mmio list to cacheline drm/i915/gvt: cleanup some too chatty scheduler message
2017-04-29Merge branch 'drm-vmwgfx-next' of ↵Dave Airlie1-1/+1
git://people.freedesktop.org/~syeh/repos_linux into drm-next trivial patch. * 'drm-vmwgfx-next' of git://people.freedesktop.org/~syeh/repos_linux: drm/vmwgfx: Convert macro to octal representation
2017-04-27drm/rockchip: Set line flag config register in vop_crtc_enableJeffy Chen3-15/+12
We need to set vop config done after update line flag config, it's a new requirement for chips newer than rk3368. Since we would only use line flag irq for vact_end, let's move it to vop_crtc_enable. Signed-off-by: Jeffy Chen <[email protected]> Acked-by: Mark Yao <[email protected] Signed-off-by: Sean Paul <[email protected]> Link: http://patchwork.freedesktop.org/patch/msgid/[email protected]
2017-04-26drm: mali-dp: use div_u64 for expensive 64-bit divisionsArnd Bergmann1-5/+4
On 32-bit machines, we can't divide 64-bit integers: drivers/gpu/drm/arm/malidp_crtc.o: In function `malidp_crtc_atomic_check': malidp_crtc.c:(.text.malidp_crtc_atomic_check+0x3c0): undefined reference to `__aeabi_uldivmod' malidp_crtc.c:(.text.malidp_crtc_atomic_check+0x3dc): undefined reference to `__aeabi_uldivmod' This calls the div_u64 function explicitly instead. Fixes: 4cea4e9f6690 ("drm: mali-dp: Add plane upscaling support") Signed-off-by: Arnd Bergmann <[email protected]>
2017-04-26drm/i915: Confirm the request is still active before adding it to the awaitChris Wilson1-0/+3
Although we do check the completion-status of the request before actually adding a wait on it (either to its submit fence or its completion dma-fence), we currently do not check before adding it to the dependency lists. In fact, without checking for a completed request we may try to use the signaler after it has been retired and its dependency tree freed: [ 60.044057] BUG: KASAN: use-after-free in __list_add_valid+0x1d/0xd0 at addr ffff880348c9e6a0 [ 60.044118] Read of size 8 by task gem_exec_fence/530 [ 60.044164] CPU: 1 PID: 530 Comm: gem_exec_fence Tainted: G E 4.11.0-rc7+ #46 [ 60.044226] Hardware name: ��������������������������������� ���������������������������������/���������������������������������, BIOS RYBDWi35.86A.0246.2 [ 60.044290] Call Trace: [ 60.044337] dump_stack+0x4d/0x6a [ 60.044383] kasan_object_err+0x21/0x70 [ 60.044435] kasan_report+0x225/0x4e0 [ 60.044488] ? __list_add_valid+0x1d/0xd0 [ 60.044534] ? kasan_kmalloc+0xad/0xe0 [ 60.044587] __asan_load8+0x5e/0x70 [ 60.044639] __list_add_valid+0x1d/0xd0 [ 60.044788] __i915_priotree_add_dependency+0x67/0x130 [i915] [ 60.044895] i915_gem_request_await_request+0xa8/0x370 [i915] [ 60.044974] i915_gem_request_await_dma_fence+0x129/0x140 [i915] [ 60.045049] i915_gem_do_execbuffer.isra.37+0xb0a/0x26b0 [i915] [ 60.045077] ? save_stack+0xb1/0xd0 [ 60.045105] ? save_stack_trace+0x1b/0x20 [ 60.045132] ? save_stack+0x46/0xd0 [ 60.045158] ? kasan_kmalloc+0xad/0xe0 [ 60.045184] ? __kmalloc+0xd8/0x670 [ 60.045229] ? drm_ioctl+0x359/0x640 [drm] [ 60.045256] ? SyS_ioctl+0x41/0x70 [ 60.045330] ? i915_vma_move_to_active+0x540/0x540 [i915] [ 60.045360] ? tty_insert_flip_string_flags+0xa1/0xf0 [ 60.045387] ? tty_flip_buffer_push+0x63/0x70 [ 60.045414] ? remove_wait_queue+0xa9/0xc0 [ 60.045441] ? kasan_unpoison_shadow+0x35/0x50 [ 60.045467] ? kasan_kmalloc+0xad/0xe0 [ 60.045494] ? kasan_check_write+0x14/0x20 [ 60.045568] i915_gem_execbuffer2+0xdb/0x2a0 [i915] [ 60.045616] drm_ioctl+0x359/0x640 [drm] [ 60.045705] ? i915_gem_execbuffer+0x5a0/0x5a0 [i915] [ 60.045751] ? drm_version+0x150/0x150 [drm] [ 60.045778] ? compat_start_thread+0x60/0x60 [ 60.045805] ? plist_del+0xda/0x1a0 [ 60.045833] do_vfs_ioctl+0x12e/0x910 [ 60.045860] ? ioctl_preallocate+0x130/0x130 [ 60.045886] ? pci_mmcfg_check_reserved+0xc0/0xc0 [ 60.045913] ? vfs_write+0x196/0x240 [ 60.045939] ? __fget_light+0xa7/0xc0 [ 60.045965] SyS_ioctl+0x41/0x70 [ 60.045991] entry_SYSCALL_64_fastpath+0x17/0x98 [ 60.046017] RIP: 0033:0x7feb2baefc47 [ 60.046042] RSP: 002b:00007fff56d28e58 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 60.046075] RAX: ffffffffffffffda RBX: 00007fff56d290a8 RCX: 00007feb2baefc47 [ 60.046102] RDX: 00007fff56d29050 RSI: 00000000c0406469 RDI: 0000000000000003 [ 60.046129] RBP: 00007fff56d29050 R08: 000055ecc4cd27d0 R09: 00007feb2bda8600 [ 60.046154] R10: 0000000000000073 R11: 0000000000000246 R12: 00000000c0406469 [ 60.046177] R13: 0000000000000003 R14: 000000000000000f R15: 0000000000000099 [ 60.046203] Object at ffff880348c9e680, in cache i915_dependency size: 64 [ 60.046225] Allocated: [ 60.046246] PID = 530 [ 60.046269] save_stack_trace+0x1b/0x20 [ 60.046292] save_stack+0x46/0xd0 [ 60.046318] kasan_kmalloc+0xad/0xe0 [ 60.046343] kasan_slab_alloc+0x12/0x20 [ 60.046368] kmem_cache_alloc+0xab/0x650 [ 60.046445] i915_gem_request_await_request+0x88/0x370 [i915] [ 60.046559] i915_gem_request_await_dma_fence+0x129/0x140 [i915] [ 60.046705] i915_gem_do_execbuffer.isra.37+0xb0a/0x26b0 [i915] [ 60.046849] i915_gem_execbuffer2+0xdb/0x2a0 [i915] [ 60.046936] drm_ioctl+0x359/0x640 [drm] [ 60.046987] do_vfs_ioctl+0x12e/0x910 [ 60.047038] SyS_ioctl+0x41/0x70 [ 60.047090] entry_SYSCALL_64_fastpath+0x17/0x98 [ 60.047139] Freed: [ 60.047179] PID = 530 [ 60.047223] save_stack_trace+0x1b/0x20 [ 60.047269] save_stack+0x46/0xd0 [ 60.047317] kasan_slab_free+0x72/0xc0 [ 60.047366] kmem_cache_free+0x39/0x160 [ 60.047512] i915_gem_request_retire+0x83f/0x930 [i915] [ 60.047657] i915_gem_request_alloc+0x166/0x600 [i915] [ 60.047799] i915_gem_do_execbuffer.isra.37+0xad8/0x26b0 [i915] [ 60.047897] i915_gem_execbuffer2+0xdb/0x2a0 [i915] [ 60.047942] drm_ioctl+0x359/0x640 [drm] [ 60.047968] do_vfs_ioctl+0x12e/0x910 [ 60.047993] SyS_ioctl+0x41/0x70 [ 60.048019] entry_SYSCALL_64_fastpath+0x17/0x98 [ 60.048044] Memory state around the buggy address: [ 60.048066] ffff880348c9e580: 00 00 00 00 00 00 00 00 fc fc fc fc fc fc fc fc [ 60.048105] ffff880348c9e600: 00 00 00 00 00 00 00 00 fc fc fc fc fc fc fc fc [ 60.048138] >ffff880348c9e680: fb fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc [ 60.048170] ^ [ 60.048191] ffff880348c9e700: 00 00 00 00 00 00 00 00 fc fc fc fc fc fc fc fc [ 60.048225] ffff880348c9e780: 00 00 00 00 00 00 00 00 fc fc fc fc fc fc fc fc Note to hit the use-after-free requires us to be passed back a request via a fence-array, that is from explicit fencing accumulated into a sync-file fence-array. Fixes: 52e542090701 ("drm/i915/scheduler: Record all dependencies upon request construction") Testcase: igt/gem_exec_fence/expired-history Signed-off-by: Chris Wilson <[email protected]> Reviewed-by: Michał Winiarski <[email protected]> Reviewed-by: Joonas Lahtinen <[email protected]> Cc: Tvrtko Ursulin <[email protected]> Link: http://patchwork.freedesktop.org/patch/msgid/[email protected] (cherry picked from commit ade0b0c965f59176daddbef9c4717354034f9bce) Signed-off-by: Jani Nikula <[email protected]>
Powered by cgit, Gruvboxed by Blaster4385.