| Message ID | 1394636377-8918-1-git-send-email-robdclark@gmail.com (mailing list archive) |
|---|---|
| State | New, archived |
| Headers | show |
On Wed, Mar 12, 2014 at 10:59:37AM -0400, Rob Clark wrote: > From: Rob Clark <rclark@redhat.com> > > A few of the simpler TTM drivers (cirrus, ast, mgag200) do not implement > this function. Yet can end up somehow with an evicted bo: > > BUG: unable to handle kernel NULL pointer dereference at (null) > IP: [< (null)>] (null) > PGD 16e761067 PUD 16e6cf067 PMD 0 > Oops: 0010 [#1] SMP > Modules linked in: bnep bluetooth rfkill fuse ip6t_rpfilter ip6t_REJECT ipt_REJECT xt_conntrack ebtable_nat ebtable_broute bridge stp llc ebtable_filter ebtables ip6table_nat nf_conntrack_ipv6 nf_defrag_ipv6 nf_nat_ipv6 ip6table_mangle ip6table_security ip6table_raw ip6table_filter ip6_tables iptable_nat nf_conntrack_ipv4 nf_defrag_ipv4 nf_nat_ipv4 nf_nat nf_conntrack iptable_mangle iptable_security iptable_raw iptable_filter ip_tables sg btrfs zlib_deflate raid6_pq xor dm_queue_length iTCO_wdt iTCO_vendor_support coretemp kvm dcdbas dm_service_time microcode serio_raw pcspkr lpc_ich mfd_core i7core_edac edac_core ses enclosure ipmi_si ipmi_msghandler shpchp acpi_power_meter mperf nfsd auth_rpcgss nfs_acl lockd uinput sunrpc dm_multipath xfs libcrc32c ata_generic pata_acpi sr_mod cdrom > sd_mod usb_storage mgag200 syscopyarea sysfillrect sysimgblt i2c_algo_bit lpfc drm_kms_helper ttm crc32c_intel ata_piix bfa drm ixgbe libata i2c_core mdio crc_t10dif ptp crct10dif_common pps_core scsi_transport_fc dca scsi_tgt megaraid_sas bnx2 dm_mirror dm_region_hash dm_log dm_mod > CPU: 16 PID: 2572 Comm: X Not tainted 3.10.0-86.el7.x86_64 #1 > Hardware name: Dell Inc. PowerEdge R810/0H235N, BIOS 0.3.0 11/14/2009 > task: ffff8801799dabc0 ti: ffff88016c884000 task.ti: ffff88016c884000 > RIP: 0010:[<0000000000000000>] [< (null)>] (null) > RSP: 0018:ffff88016c885ad8 EFLAGS: 00010202 > RAX: ffffffffa04e94c0 RBX: ffff880178937a20 RCX: 0000000000000000 > RDX: 0000000000000000 RSI: 0000000000240004 RDI: ffff880178937a00 > RBP: ffff88016c885b60 R08: 00000000000171a0 R09: ffff88007cf171a0 > R10: ffffea0005842540 R11: ffffffff810487b9 R12: ffff880178937b30 > R13: ffff880178937a00 R14: ffff88016c885b78 R15: ffff880179929400 > FS: 00007f81ba2ef980(0000) GS:ffff88007cf00000(0000) knlGS:0000000000000000 > CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 > CR2: 0000000000000000 CR3: 000000016e763000 CR4: 00000000000007e0 > DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 > DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000400 > Stack: > ffffffffa0306fae ffff8801799295c0 0000000000260004 0000000000000001 > ffff88016c885b60 ffffffffa0307669 00ff88007cf17738 ffff88017cf17700 > ffff880178937a00 ffff880100000000 ffff880100000000 0000000079929400 > Call Trace: > [<ffffffffa0306fae>] ? ttm_bo_handle_move_mem+0x54e/0x5b0 [ttm] > [<ffffffffa0307669>] ? ttm_bo_mem_space+0x169/0x340 [ttm] > [<ffffffffa0307bd7>] ttm_bo_move_buffer+0x117/0x130 [ttm] > [<ffffffff81130001>] ? perf_event_init_context+0x141/0x220 > [<ffffffffa0307cb1>] ttm_bo_validate+0xc1/0x130 [ttm] > [<ffffffffa04e7377>] mgag200_bo_pin+0x87/0xc0 [mgag200] > [<ffffffffa04e56c4>] mga_crtc_cursor_set+0x474/0xbb0 [mgag200] > [<ffffffff811971d2>] ? __mem_cgroup_commit_charge+0x152/0x3b0 > [<ffffffff815c4182>] ? mutex_lock+0x12/0x2f > [<ffffffffa0201433>] drm_mode_cursor_common+0x123/0x170 [drm] > [<ffffffffa0205231>] drm_mode_cursor_ioctl+0x41/0x50 [drm] > [<ffffffffa01f5ca2>] drm_ioctl+0x502/0x630 [drm] > [<ffffffff815cbab4>] ? __do_page_fault+0x1f4/0x510 > [<ffffffff8101cb68>] ? __restore_xstate_sig+0x218/0x4f0 > [<ffffffff811b4445>] do_vfs_ioctl+0x2e5/0x4d0 > [<ffffffff8124488e>] ? file_has_perm+0x8e/0xa0 > [<ffffffff811b46b1>] SyS_ioctl+0x81/0xa0 > [<ffffffff815d05d9>] system_call_fastpath+0x16/0x1b > Code: Bad RIP value. > RIP [< (null)>] (null) > RSP <ffff88016c885ad8> > CR2: 0000000000000000 > > Signed-off-by: Rob Clark <rclark@redhat.com> Reviewed-by: Jérôme Glisse <jglisse@redhat.com> > --- > drivers/gpu/drm/ttm/ttm_bo.c | 8 +++++--- > 1 file changed, 5 insertions(+), 3 deletions(-) > > diff --git a/drivers/gpu/drm/ttm/ttm_bo.c b/drivers/gpu/drm/ttm/ttm_bo.c > index 7298053..acd0fe0 100644 > --- a/drivers/gpu/drm/ttm/ttm_bo.c > +++ b/drivers/gpu/drm/ttm/ttm_bo.c > @@ -351,9 +351,11 @@ static int ttm_bo_handle_move_mem(struct ttm_buffer_object *bo, > > moved: > if (bo->evicted) { > - ret = bdev->driver->invalidate_caches(bdev, bo->mem.placement); > - if (ret) > - pr_err("Can not flush read caches\n"); > + if (bdev->driver->invalidate_caches) { > + ret = bdev->driver->invalidate_caches(bdev, bo->mem.placement); > + if (ret) > + pr_err("Can not flush read caches\n"); > + } > bo->evicted = false; > } > > -- > 1.8.5.3 > > _______________________________________________ > dri-devel mailing list > dri-devel@lists.freedesktop.org > http://lists.freedesktop.org/mailman/listinfo/dri-devel
On 03/12/2014 03:59 PM, Rob Clark wrote: > From: Rob Clark <rclark@redhat.com> > > A few of the simpler TTM drivers (cirrus, ast, mgag200) do not implement > this function. Yet can end up somehow with an evicted bo: > > BUG: unable to handle kernel NULL pointer dereference at (null) > IP: [< (null)>] (null) > PGD 16e761067 PUD 16e6cf067 PMD 0 > Oops: 0010 [#1] SMP > Modules linked in: bnep bluetooth rfkill fuse ip6t_rpfilter ip6t_REJECT ipt_REJECT xt_conntrack ebtable_nat ebtable_broute bridge stp llc ebtable_filter ebtables ip6table_nat nf_conntrack_ipv6 nf_defrag_ipv6 nf_nat_ipv6 ip6table_mangle ip6table_security ip6table_raw ip6table_filter ip6_tables iptable_nat nf_conntrack_ipv4 nf_defrag_ipv4 nf_nat_ipv4 nf_nat nf_conntrack iptable_mangle iptable_security iptable_raw iptable_filter ip_tables sg btrfs zlib_deflate raid6_pq xor dm_queue_length iTCO_wdt iTCO_vendor_support coretemp kvm dcdbas dm_service_time microcode serio_raw pcspkr lpc_ich mfd_core i7core_edac edac_core ses enclosure ipmi_si ipmi_msghandler shpchp acpi_power_meter mperf nfsd auth_rpcgss nfs_acl lockd uinput sunrpc dm_multipath xfs libcrc32c ata_generic pata_acpi sr_mod cdrom > sd_mod usb_storage mgag200 syscopyarea sysfillrect sysimgblt i2c_algo_bit lpfc drm_kms_helper ttm crc32c_intel ata_piix bfa drm ixgbe libata i2c_core mdio crc_t10dif ptp crct10dif_common pps_core scsi_transport_fc dca scsi_tgt megaraid_sas bnx2 dm_mirror dm_region_hash dm_log dm_mod > CPU: 16 PID: 2572 Comm: X Not tainted 3.10.0-86.el7.x86_64 #1 > Hardware name: Dell Inc. PowerEdge R810/0H235N, BIOS 0.3.0 11/14/2009 > task: ffff8801799dabc0 ti: ffff88016c884000 task.ti: ffff88016c884000 > RIP: 0010:[<0000000000000000>] [< (null)>] (null) > RSP: 0018:ffff88016c885ad8 EFLAGS: 00010202 > RAX: ffffffffa04e94c0 RBX: ffff880178937a20 RCX: 0000000000000000 > RDX: 0000000000000000 RSI: 0000000000240004 RDI: ffff880178937a00 > RBP: ffff88016c885b60 R08: 00000000000171a0 R09: ffff88007cf171a0 > R10: ffffea0005842540 R11: ffffffff810487b9 R12: ffff880178937b30 > R13: ffff880178937a00 R14: ffff88016c885b78 R15: ffff880179929400 > FS: 00007f81ba2ef980(0000) GS:ffff88007cf00000(0000) knlGS:0000000000000000 > CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 > CR2: 0000000000000000 CR3: 000000016e763000 CR4: 00000000000007e0 > DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 > DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000400 > Stack: > ffffffffa0306fae ffff8801799295c0 0000000000260004 0000000000000001 > ffff88016c885b60 ffffffffa0307669 00ff88007cf17738 ffff88017cf17700 > ffff880178937a00 ffff880100000000 ffff880100000000 0000000079929400 > Call Trace: > [<ffffffffa0306fae>] ? ttm_bo_handle_move_mem+0x54e/0x5b0 [ttm] > [<ffffffffa0307669>] ? ttm_bo_mem_space+0x169/0x340 [ttm] > [<ffffffffa0307bd7>] ttm_bo_move_buffer+0x117/0x130 [ttm] > [<ffffffff81130001>] ? perf_event_init_context+0x141/0x220 > [<ffffffffa0307cb1>] ttm_bo_validate+0xc1/0x130 [ttm] > [<ffffffffa04e7377>] mgag200_bo_pin+0x87/0xc0 [mgag200] > [<ffffffffa04e56c4>] mga_crtc_cursor_set+0x474/0xbb0 [mgag200] > [<ffffffff811971d2>] ? __mem_cgroup_commit_charge+0x152/0x3b0 > [<ffffffff815c4182>] ? mutex_lock+0x12/0x2f > [<ffffffffa0201433>] drm_mode_cursor_common+0x123/0x170 [drm] > [<ffffffffa0205231>] drm_mode_cursor_ioctl+0x41/0x50 [drm] > [<ffffffffa01f5ca2>] drm_ioctl+0x502/0x630 [drm] > [<ffffffff815cbab4>] ? __do_page_fault+0x1f4/0x510 > [<ffffffff8101cb68>] ? __restore_xstate_sig+0x218/0x4f0 > [<ffffffff811b4445>] do_vfs_ioctl+0x2e5/0x4d0 > [<ffffffff8124488e>] ? file_has_perm+0x8e/0xa0 > [<ffffffff811b46b1>] SyS_ioctl+0x81/0xa0 > [<ffffffff815d05d9>] system_call_fastpath+0x16/0x1b > Code: Bad RIP value. > RIP [< (null)>] (null) > RSP <ffff88016c885ad8> > CR2: 0000000000000000 > > Signed-off-by: Rob Clark <rclark@redhat.com> > --- > drivers/gpu/drm/ttm/ttm_bo.c | 8 +++++--- > 1 file changed, 5 insertions(+), 3 deletions(-) > > diff --git a/drivers/gpu/drm/ttm/ttm_bo.c b/drivers/gpu/drm/ttm/ttm_bo.c > index 7298053..acd0fe0 100644 > --- a/drivers/gpu/drm/ttm/ttm_bo.c > +++ b/drivers/gpu/drm/ttm/ttm_bo.c > @@ -351,9 +351,11 @@ static int ttm_bo_handle_move_mem(struct ttm_buffer_object *bo, > > moved: > if (bo->evicted) { > - ret = bdev->driver->invalidate_caches(bdev, bo->mem.placement); > - if (ret) > - pr_err("Can not flush read caches\n"); > + if (bdev->driver->invalidate_caches) { > + ret = bdev->driver->invalidate_caches(bdev, bo->mem.placement); > + if (ret) > + pr_err("Can not flush read caches\n"); > + } > bo->evicted = false; > } > Thanks. Reviewed-by: Thomas Hellstrom <thellstrom@vmware.com> I'll add a CC to stable and incorporate in the ttm-fixes pull. /Thomas
diff --git a/drivers/gpu/drm/ttm/ttm_bo.c b/drivers/gpu/drm/ttm/ttm_bo.c index 7298053..acd0fe0 100644 --- a/drivers/gpu/drm/ttm/ttm_bo.c +++ b/drivers/gpu/drm/ttm/ttm_bo.c @@ -351,9 +351,11 @@ static int ttm_bo_handle_move_mem(struct ttm_buffer_object *bo, moved: if (bo->evicted) { - ret = bdev->driver->invalidate_caches(bdev, bo->mem.placement); - if (ret) - pr_err("Can not flush read caches\n"); + if (bdev->driver->invalidate_caches) { + ret = bdev->driver->invalidate_caches(bdev, bo->mem.placement); + if (ret) + pr_err("Can not flush read caches\n"); + } bo->evicted = false; }