[PATCH 5.11 regression fix] drm/ttm: fix combining __GFP_HIGHMEM and __GFP_DMA32 flag for DMA32 pools

Hans de Goede hdegoede at redhat.com
Tue Jan 12 18:32:49 UTC 2021


GFP_TRANSHUGE_LIGHT includes __GFP_HIGHMEM and combining
__GFP_HIGHMEM with __GFP_DMA32 is not allowed.

So we must not set add GFP_TRANSHUGE_LIGHT to the gfp_flags when
allocating pages from a dma32 pool.

This fixes the following oops when using a driver which uses DMA32
pools such as the vboxvideo driver:

[  419.852194] ------------[ cut here ]------------
[  419.852200] kernel BUG at include/linux/gfp.h:457!
[  419.852208] invalid opcode: 0000 [#4] SMP PTI
[  419.852212] CPU: 0 PID: 1522 Comm: Xorg Tainted: G      D           5.11.0-rc2+ #187
[  419.852214] Hardware name: innotek GmbH VirtualBox/VirtualBox, BIOS VirtualBox 12/01/2006
[  419.852216] RIP: 0010:__alloc_pages_nodemask+0x31a/0x3d0
[  419.852222] Code: 00 00 8b 05 a8 3b 93 01 85 c0 0f 85 03 fe ff ff 89 e8 44 89 fa c1 e8 03 80 ca 80 83 e0 03 83 f8 01 44 0f 44 fa e9 e9 fd ff ff <0f> 0b 0f 0b e9 79 fd ff ff 31 c0 e9 88 fd ff ff e8 41 ad fb ff 48
[  419.852224] RSP: 0000:ffffb1164096bc60 EFLAGS: 00010247
[  419.852227] RAX: 0000000000000000 RBX: 0000000000000000 RCX: 000000000000e8e8
[  419.852229] RDX: 0000000000000000 RSI: 0000000000000006 RDI: 0000000000192dc6
[  419.852230] RBP: 0000000000192dc6 R08: 0000000000000000 R09: 0000000000000000
[  419.852232] R10: 0000000000000017 R11: 00007ff303d0a000 R12: 0000000000000009
[  419.852233] R13: 0000000000000009 R14: ffff8be4cafe0880 R15: ffff8be5c26fe000
[  419.852235] FS:  00007ff3046e0f00(0000) GS:ffff8be5dbc00000(0000) knlGS:0000000000000000
[  419.852237] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[  419.852239] CR2: 00007ff303d0a000 CR3: 000000000afd8004 CR4: 00000000000706f0
[  419.852243] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
[  419.852244] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
[  419.852246] Call Trace:
[  419.852252]  ttm_pool_alloc+0x2e8/0x5f0 [ttm]
[  419.852261]  ttm_tt_populate+0x9f/0xe0 [ttm]
[  419.852267]  ttm_bo_vm_fault_reserved+0x236/0x6e0 [ttm]
[  419.852274]  ttm_bo_vm_fault+0x4a/0xe0 [ttm]
[  419.852279]  __do_fault+0x37/0x110
[  419.852283]  handle_mm_fault+0x1493/0x1990
[  419.852288]  do_user_addr_fault+0x1c7/0x4c0
[  419.852292]  exc_page_fault+0x67/0x250
[  419.852295]  ? asm_exc_page_fault+0x8/0x30
[  419.852299]  asm_exc_page_fault+0x1e/0x30
[  419.852301] RIP: 0033:0x7ff304f3cdf8
[  419.852304] Code: 83 c0 04 83 fa 03 7e ea a8 0f 75 ee 83 fa 7f 7e e1 83 c2 80 89 d6 c1 ee 07 8d 4e 01 48 c1 e1 07 48 01 c1 0f 1f 80 00 00 00 00 <0f> 29 00 48 83 e8 80 0f 29 40 90 0f 29 40 a0 0f 29 40 b0 0f 29 40
[  419.852306] RSP: 002b:00007ffec360e7d8 EFLAGS: 00010206
[  419.852308] RAX: 00007ff303d0a000 RBX: 00000000000002e2 RCX: 00007ff303d0b300
[  419.852309] RDX: 00000000000012c0 RSI: 0000000000000025 RDI: 0000000000000000
[  419.852311] RBP: 0000000000001340 R08: 0000000000000000 R09: 0000000000000000
[  419.852312] R10: 00007ff303d0a000 R11: 0000000000001340 R12: 00007ff303d0a000
[  419.852313] R13: 0000556665f1eb30 R14: 0000000000000000 R15: 0000000000000000
[  419.852318] Modules linked in: xt_CHECKSUM xt_MASQUERADE xt_conntrack ipt_REJECT nf_nat_tftp nf_conntrack_tftp tun bridge stp llc nft_objref nf_conntrack_netbios_ns nf_conntrack_broadcast nft_fib_inet nft_fib_ipv4 nft_fib_ipv6 nft_fib nft_reject_inet nf_reject_ipv4 nf_reject_ipv6 nft_reject nft_ct nft_chain_nat rfkill ip6table_nat ip6table_mangle ip6table_raw ip6table_security iptable_nat nf_nat nf_conntrack nf_defrag_ipv6 nf_defrag_ipv4 iptable_mangle iptable_raw iptable_security ip_set nf_tables vboxsf nfnetlink ip6table_filter ip6_tables iptable_filter sunrpc vfat fat intel_rapl_msr joydev intel_rapl_common intel_powerclamp crct10dif_pclmul crc32_pclmul ghash_clmulni_intel snd_intel8x0 rapl snd_ac97_codec ac97_bus snd_seq snd_seq_device snd_pcm pcspkr snd_timer snd soundcore i2c_piix4 vboxguest ip_tables vboxvideo drm_vram_helper drm_kms_helper cec drm_ttm_helper ttm crc32c_intel serio_raw e1000 drm drm_privacy_screen_helper ata_generic pata_acpi video fuse
[  419.852375] ---[ end trace 511e5346897d9526 ]---

Note in case of the vboxvideo driver the DMA32 pool is allocated through
drm_vram_helper_alloc_mm() which is also used by the bochs and
hisilicon/hibmc drivers.

Cc: Christian König <christian.koenig at amd.com>
Fixes: d099fc8f540a ("drm/ttm: new TT backend allocation pool v3")
Signed-off-by: Hans de Goede <hdegoede at redhat.com>
---
 drivers/gpu/drm/ttm/ttm_pool.c | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/drivers/gpu/drm/ttm/ttm_pool.c b/drivers/gpu/drm/ttm/ttm_pool.c
index 7b2f60616750..8b32fd8c8ccc 100644
--- a/drivers/gpu/drm/ttm/ttm_pool.c
+++ b/drivers/gpu/drm/ttm/ttm_pool.c
@@ -80,8 +80,9 @@ static struct page *ttm_pool_alloc_page(struct ttm_pool *pool, gfp_t gfp_flags,
 	void *vaddr;
 
 	if (order) {
-		gfp_flags |= GFP_TRANSHUGE_LIGHT | __GFP_NORETRY |
-			__GFP_KSWAPD_RECLAIM;
+		if (!pool->use_dma32)
+			gfp_flags |= GFP_TRANSHUGE_LIGHT;
+		gfp_flags |= __GFP_NORETRY | __GFP_KSWAPD_RECLAIM;
 		gfp_flags &= ~__GFP_MOVABLE;
 		gfp_flags &= ~__GFP_COMP;
 	}
-- 
2.28.0



More information about the dri-devel mailing list