[PATCH v2 2/8] drm/ttm: Remap all page faults to per process dummy page.

Andrey Grodzovsky Andrey.Grodzovsky at amd.com
Wed Jun 24 03:31:45 UTC 2020


On 6/22/20 5:41 AM, Daniel Vetter wrote:
> On Sun, Jun 21, 2020 at 02:03:02AM -0400, Andrey Grodzovsky wrote:
>> On device removal reroute all CPU mappings to dummy page per drm_file
>> instance or imported GEM object.
>>
>> Signed-off-by: Andrey Grodzovsky <andrey.grodzovsky at amd.com>
>> ---
>>   drivers/gpu/drm/ttm/ttm_bo_vm.c | 65 ++++++++++++++++++++++++++++++++++++-----
>>   1 file changed, 57 insertions(+), 8 deletions(-)
>>
>> diff --git a/drivers/gpu/drm/ttm/ttm_bo_vm.c b/drivers/gpu/drm/ttm/ttm_bo_vm.c
>> index 389128b..2f8bf5e 100644
>> --- a/drivers/gpu/drm/ttm/ttm_bo_vm.c
>> +++ b/drivers/gpu/drm/ttm/ttm_bo_vm.c
>> @@ -35,6 +35,8 @@
>>   #include <drm/ttm/ttm_bo_driver.h>
>>   #include <drm/ttm/ttm_placement.h>
>>   #include <drm/drm_vma_manager.h>
>> +#include <drm/drm_drv.h>
>> +#include <drm/drm_file.h>
>>   #include <linux/mm.h>
>>   #include <linux/pfn_t.h>
>>   #include <linux/rbtree.h>
>> @@ -328,19 +330,66 @@ vm_fault_t ttm_bo_vm_fault(struct vm_fault *vmf)
> Hm I think diff and code flow look a bit bad now. What about renaming the
> current function to __ttm_bo_vm_fault and then having something like the
> below:
>
> ttm_bo_vm_fault(args) {
>
> 	if (drm_dev_enter()) {
> 		__ttm_bo_vm_fault(args);
> 		drm_dev_exit();
> 	} else  {
> 		drm_gem_insert_dummy_pfn();
> 	}
> }
>
> I think drm_gem_insert_dummy_pfn(); should be portable across drivers, so
> another nice point to try to unifiy drivers as much as possible.
> -Daniel
>
>>   	pgprot_t prot;
>>   	struct ttm_buffer_object *bo = vma->vm_private_data;
>>   	vm_fault_t ret;
>> +	int idx;
>> +	struct drm_device *ddev = bo->base.dev;
>>   
>> -	ret = ttm_bo_vm_reserve(bo, vmf);
>> -	if (ret)
>> -		return ret;
>> +	if (drm_dev_enter(ddev, &idx)) {
>> +		ret = ttm_bo_vm_reserve(bo, vmf);
>> +		if (ret)
>> +			goto exit;
>> +
>> +		prot = vma->vm_page_prot;
>>   
>> -	prot = vma->vm_page_prot;
>> -	ret = ttm_bo_vm_fault_reserved(vmf, prot, TTM_BO_VM_NUM_PREFAULT);
>> -	if (ret == VM_FAULT_RETRY && !(vmf->flags & FAULT_FLAG_RETRY_NOWAIT))
>> +		ret = ttm_bo_vm_fault_reserved(vmf, prot, TTM_BO_VM_NUM_PREFAULT);
>> +		if (ret == VM_FAULT_RETRY && !(vmf->flags & FAULT_FLAG_RETRY_NOWAIT))
>> +			goto exit;
>> +
>> +		dma_resv_unlock(bo->base.resv);
>> +
>> +exit:
>> +		drm_dev_exit(idx);
>>   		return ret;
>> +	} else {
>>   
>> -	dma_resv_unlock(bo->base.resv);
>> +		struct drm_file *file = NULL;
>> +		struct page *dummy_page = NULL;
>> +		int handle;
>>   
>> -	return ret;
>> +		/* We are faulting on imported BO from dma_buf */
>> +		if (bo->base.dma_buf && bo->base.import_attach) {
>> +			dummy_page = bo->base.dummy_page;
>> +		/* We are faulting on non imported BO, find drm_file owning the BO*/
> Uh, we can't fish that out of the vma->vm_file pointer somehow? Or is that
> one all wrong? Doing this kind of list walk looks pretty horrible.
>
> If the vma doesn't have the right pointer I guess next option is that we
> store the drm_file page in gem_bo->dummy_page, and replace it on first
> export. But that's going to be tricky to track ...
>
>> +		} else {
>> +			struct drm_gem_object *gobj;
>> +
>> +			mutex_lock(&ddev->filelist_mutex);
>> +			list_for_each_entry(file, &ddev->filelist, lhead) {
>> +				spin_lock(&file->table_lock);
>> +				idr_for_each_entry(&file->object_idr, gobj, handle) {
>> +					if (gobj == &bo->base) {
>> +						dummy_page = file->dummy_page;
>> +						break;
>> +					}
>> +				}
>> +				spin_unlock(&file->table_lock);
>> +			}
>> +			mutex_unlock(&ddev->filelist_mutex);
>> +		}
>> +
>> +		if (dummy_page) {
>> +			/*
>> +			 * Let do_fault complete the PTE install e.t.c using vmf->page
>> +			 *
>> +			 * TODO - should i call free_page somewhere ?
> Nah, instead don't call get_page. The page will be around as long as
> there's a reference for the drm_file or gem_bo, which is longer than any
> mmap. Otherwise yes this would like really badly.


So actually that was my thinking in the first place and I indeed avoided taking 
reference and this ended up
with multiple BUG_ONs as seen bellow where  refcount:-63 mapcount:-48 for a page 
are deep into negative
values... Those warnings were gone once i added get_page(dummy) which in my 
opinion implies that there
is a page reference per each PTE and that when there is unmapping of the process 
address
space and PTEs are deleted there is also put_page somewhere in mm core and the 
get_page per mapping
keeps it balanced.

Jun 20 01:36:43 ubuntu-1604-test kernel: [   98.762929] BUG: Bad page map in 
process glxgear:disk$0  pte:8000000132284867 pmd:15aaec067
Jun 20 01:36:43 ubuntu-1604-test kernel: [   98.762931] page:ffffe63384c8a100 
refcount:-63 mapcount:-48 mapping:0000000000000000 index:0x0
Jun 20 01:36:43 ubuntu-1604-test kernel: [   98.762932] flags: 
0x17fff8000000008(dirty)
Jun 20 01:36:43 ubuntu-1604-test kernel: [   98.762933] raw: 017fff8000000008 
dead000000000100 dead000000000122 0000000000000000
Jun 20 01:36:43 ubuntu-1604-test kernel: [   98.762934] raw: 0000000000000000 
0000000000000000 ffffffc1ffffffcf 0000000000000000
Jun 20 01:36:43 ubuntu-1604-test kernel: [   98.762935] page dumped because: bad pte
Jun 20 01:36:43 ubuntu-1604-test kernel: [   98.762937] addr:00007fe086263000 
vm_flags:1c0440fb anon_vma:0000000000000000 mapping:ffff9b5cd42db268 index:1008b3
Jun 20 01:36:43 ubuntu-1604-test kernel: [   98.762981] file:renderD129 
fault:ttm_bo_vm_fault [ttm] mmap:amdgpu_mmap [amdgpu] readpage:0x0
Jun 20 01:36:43 ubuntu-1604-test kernel: [   98.762984] CPU: 5 PID: 2619 Comm: 
glxgear:disk$0 Tainted: G    B      OE 5.6.0-dev+ #51
Jun 20 01:36:43 ubuntu-1604-test kernel: [   98.762985] Hardware name: System 
manufacturer System Product Name/RAMPAGE IV FORMULA, BIOS 4804 12/30/2013
Jun 20 01:36:43 ubuntu-1604-test kernel: [   98.762985] Call Trace:
Jun 20 01:36:43 ubuntu-1604-test kernel: [   98.762988] dump_stack+0x68/0x9b
Jun 20 01:36:43 ubuntu-1604-test kernel: [   98.762990] print_bad_pte+0x19f/0x270
Jun 20 01:36:43 ubuntu-1604-test kernel: [   98.762992]  ? lock_page_memcg+0x5/0xf0
Jun 20 01:36:43 ubuntu-1604-test kernel: [   98.762995] unmap_page_range+0x777/0xbe0
Jun 20 01:36:43 ubuntu-1604-test kernel: [   98.763000] unmap_vmas+0xcc/0x160
Jun 20 01:36:43 ubuntu-1604-test kernel: [   98.763004] exit_mmap+0xb5/0x1b0
Jun 20 01:36:43 ubuntu-1604-test kernel: [   98.763009] mmput+0x65/0x140
Jun 20 01:36:43 ubuntu-1604-test kernel: [   98.763010] do_exit+0x362/0xc40
Jun 20 01:36:43 ubuntu-1604-test kernel: [   98.763013] do_group_exit+0x47/0xb0
Jun 20 01:36:43 ubuntu-1604-test kernel: [   98.763016] get_signal+0x18b/0xc30
Jun 20 01:36:43 ubuntu-1604-test kernel: [   98.763019] do_signal+0x36/0x6a0
Jun 20 01:36:43 ubuntu-1604-test kernel: [   98.763021]  ? 
__set_task_comm+0x62/0x120
Jun 20 01:36:43 ubuntu-1604-test kernel: [   98.763024]  ? 
__x64_sys_futex+0x88/0x180
Jun 20 01:36:43 ubuntu-1604-test kernel: [   98.763028] 
exit_to_usermode_loop+0x6f/0xc0
Jun 20 01:36:43 ubuntu-1604-test kernel: [   98.763030] do_syscall_64+0x149/0x1c0
Jun 20 01:36:43 ubuntu-1604-test kernel: [   98.763032] 
entry_SYSCALL_64_after_hwframe+0x49/0xbe
Jun 20 01:36:43 ubuntu-1604-test kernel: [   98.763034] RIP: 0033:0x7fe091bd9360
Jun 20 01:36:43 ubuntu-1604-test kernel: [   98.763037] Code: Bad RIP value.

Andrey


>
>> +			 */
>> +			get_page(dummy_page);
>> +			vmf->page = dummy_page;
>> +			return 0;
>> +		} else {
>> +			return VM_FAULT_SIGSEGV;
> Hm that would be a kernel bug, wouldn't it? WARN_ON() required here imo.
> -Daniel
>
>> +		}
>> +	}
>>   }
>>   EXPORT_SYMBOL(ttm_bo_vm_fault);
>>   
>> -- 
>> 2.7.4
>>


More information about the dri-devel mailing list