[PATCH] drm/ttm: don't set page->mapping

[Christian König]

Am 05.11.20 um 14:20 schrieb Daniel Vetter:
> On Thu, Nov 05, 2020 at 01:56:22PM +0100, Christian König wrote:
>> Am 05.11.20 um 13:50 schrieb Daniel Vetter:
>>> On Thu, Nov 05, 2020 at 01:29:50PM +0100, Christian König wrote:
>>>> Am 05.11.20 um 10:11 schrieb Daniel Vetter:
>>>>> On Thu, Nov 5, 2020 at 9:00 AM Christian König <christian.koenig at amd.com> wrote:
>>>>>> Am 04.11.20 um 17:50 schrieb Daniel Vetter:
>>>>>>> Random observation while trying to review Christian's patch series to
>>>>>>> stop looking at struct page for dma-buf imports.
>>>>>>>
>>>>>>> This was originally added in
>>>>>>>
>>>>>>> commit 58aa6622d32af7d2c08d45085f44c54554a16ed7
>>>>>>> Author: Thomas Hellstrom <thellstrom at vmware.com>
>>>>>>> Date:   Fri Jan 3 11:47:23 2014 +0100
>>>>>>>
>>>>>>>         drm/ttm: Correctly set page mapping and -index members
>>>>>>>
>>>>>>>         Needed for some vm operations; most notably unmap_mapping_range() with
>>>>>>>         even_cows = 0.
>>>>>>>
>>>>>>>         Signed-off-by: Thomas Hellstrom <thellstrom at vmware.com>
>>>>>>>         Reviewed-by: Brian Paul <brianp at vmware.com>
>>>>>>>
>>>>>>> but we do not have a single caller of unmap_mapping_range with
>>>>>>> even_cows == 0. And all the gem drivers don't do this, so another
>>>>>>> small thing we could standardize between drm and ttm drivers.
>>>>>>>
>>>>>>> Plus I don't really see a need for unamp_mapping_range where we don't
>>>>>>> want to indiscriminately shoot down all ptes.
>>>>>> NAK, we use this to determine if a pages belongs to the driver or not in
>>>>>> amdgpu for example.
>>>>>>
>>>>>> Mostly used for debugging, but I would really like to keep that.
>>>>> Can you pls point me at that code? A quick grep hasn't really found much at all.
>>>> See amdgpu_iomem_read() for an example:
>>> Why do you reject this?
>> When IOMMU is disabled or uses an 1 to 1 mapping we would otherwise give the
>> same access as /dev/mem to system memory and that is forbidden. But as I
>> noted this is just for the debugfs file.
> Ah, there's a config option for that. Plus it's debugfs, anything goes in
> debugfs, but if you're worried about that hole we should just disable the
> entire debugfs file for CONFIG_STRICT_DEVMEM. I can perhaps throw that on
> top, that follow_pfn patch series I'm baking is all about this kind of
> fun.

And exactly that would get a NAK from us.

We have specially created that debugfs file as an alternative when 
CONFIG_STRICT_DEVMEM is set.

Regards,
Christian.

>
>> When I tried a few years ago to not set the page->mapping I immediately ran
>> into issues with our eviction test. So I think that this is used elsewhere
>> as well.
> That's the kind of interaction I'm worried about here tbh. If this does
> some kind of shrinking of some sorts, I think a real shrinker should take
> over.
>
> An improved grep shows nothing else, so the only the above is the only
> thing I can think of. What kind of eviction test goes boom if you clear
> ->mapping here? I'd be happy to type up the clever trick for the debugfs
> files.
> -Daniel
>
>> Regards,
>> Christian.
>>
>>> If this is to avoid issues with userptr, then I think there's a simple
>>> trick:
>>> - grab page reference
>>> - recheck that the iova still points at the same address
>>> - do read/write, safe in the knowledge that this page cannot be reused for
>>>     anything else
>>> - drop page reference
>>>
>>> Of course this can still race against iova updates, but that seems to be a
>>> fundamental part of your debug interface here.
>>>
>>> Or am I missing something?
>>>
>>> Just pondering this more since setting the page->mapping pointer for just
>>> this seems somewhat wild abuse of ->mapping semantics :-)
>>> -Daniel
>>>
>>>>>                   if (p->mapping != adev->mman.bdev.dev_mapping)
>>>>>                           return -EPERM;
>>>> Christian.
>>>>
>>>>> -Daniel
>>>>>
>>>>>> Christian.
>>>>>>
>>>>>>> Cc: Thomas Hellstrom <thellstrom at vmware.com>
>>>>>>> Cc: Brian Paul <brianp at vmware.com>
>>>>>>> Signed-off-by: Daniel Vetter <daniel.vetter at intel.com>
>>>>>>> Cc: Christian Koenig <christian.koenig at amd.com>
>>>>>>> Cc: Huang Rui <ray.huang at amd.com>
>>>>>>> ---
>>>>>>>      drivers/gpu/drm/ttm/ttm_tt.c | 12 ------------
>>>>>>>      1 file changed, 12 deletions(-)
>>>>>>>
>>>>>>> diff --git a/drivers/gpu/drm/ttm/ttm_tt.c b/drivers/gpu/drm/ttm/ttm_tt.c
>>>>>>> index 8861a74ac335..438ea43fd8c1 100644
>>>>>>> --- a/drivers/gpu/drm/ttm/ttm_tt.c
>>>>>>> +++ b/drivers/gpu/drm/ttm/ttm_tt.c
>>>>>>> @@ -291,17 +291,6 @@ int ttm_tt_swapout(struct ttm_bo_device *bdev, struct ttm_tt *ttm)
>>>>>>>          return ret;
>>>>>>>      }
>>>>>>>
>>>>>>> -static void ttm_tt_add_mapping(struct ttm_bo_device *bdev, struct ttm_tt *ttm)
>>>>>>> -{
>>>>>>> -     pgoff_t i;
>>>>>>> -
>>>>>>> -     if (ttm->page_flags & TTM_PAGE_FLAG_SG)
>>>>>>> -             return;
>>>>>>> -
>>>>>>> -     for (i = 0; i < ttm->num_pages; ++i)
>>>>>>> -             ttm->pages[i]->mapping = bdev->dev_mapping;
>>>>>>> -}
>>>>>>> -
>>>>>>>      int ttm_tt_populate(struct ttm_bo_device *bdev,
>>>>>>>                      struct ttm_tt *ttm, struct ttm_operation_ctx *ctx)
>>>>>>>      {
>>>>>>> @@ -320,7 +309,6 @@ int ttm_tt_populate(struct ttm_bo_device *bdev,
>>>>>>>          if (ret)
>>>>>>>                  return ret;
>>>>>>>
>>>>>>> -     ttm_tt_add_mapping(bdev, ttm);
>>>>>>>          ttm->page_flags |= TTM_PAGE_FLAG_PRIV_POPULATED;
>>>>>>>          if (unlikely(ttm->page_flags & TTM_PAGE_FLAG_SWAPPED)) {
>>>>>>>                  ret = ttm_tt_swapin(ttm);