[PATCH 5.11 regression fix] drm/ttm: fix combining __GFP_HIGHMEM and __GFP_DMA32 flag for DMA32 pools

Wed Jan 13 01:21:39 UTC 2021

On Wed, Jan 13, 2021 at 02:32:49AM +0800, Hans de Goede wrote:
> GFP_TRANSHUGE_LIGHT includes __GFP_HIGHMEM and combining
> __GFP_HIGHMEM with __GFP_DMA32 is not allowed.
> 
> So we must not set add GFP_TRANSHUGE_LIGHT to the gfp_flags when
> allocating pages from a dma32 pool.
> 
> This fixes the following oops when using a driver which uses DMA32
> pools such as the vboxvideo driver:
> 
> [  419.852194] ------------[ cut here ]------------
> [  419.852200] kernel BUG at include/linux/gfp.h:457!
> [  419.852208] invalid opcode: 0000 [#4] SMP PTI
> [  419.852212] CPU: 0 PID: 1522 Comm: Xorg Tainted: G      D           5.11.0-rc2+ #187
> [  419.852214] Hardware name: innotek GmbH VirtualBox/VirtualBox, BIOS VirtualBox 12/01/2006
> [  419.852216] RIP: 0010:__alloc_pages_nodemask+0x31a/0x3d0
> [  419.852222] Code: 00 00 8b 05 a8 3b 93 01 85 c0 0f 85 03 fe ff ff 89 e8 44 89 fa c1 e8 03 80 ca 80 83 e0 03 83 f8 01 44 0f 44 fa e9 e9 fd ff ff <0f> 0b 0f 0b e9 79 fd ff ff 31 c0 e9 88 fd ff ff e8 41 ad fb ff 48
> [  419.852224] RSP: 0000:ffffb1164096bc60 EFLAGS: 00010247
> [  419.852227] RAX: 0000000000000000 RBX: 0000000000000000 RCX: 000000000000e8e8
> [  419.852229] RDX: 0000000000000000 RSI: 0000000000000006 RDI: 0000000000192dc6
> [  419.852230] RBP: 0000000000192dc6 R08: 0000000000000000 R09: 0000000000000000
> [  419.852232] R10: 0000000000000017 R11: 00007ff303d0a000 R12: 0000000000000009
> [  419.852233] R13: 0000000000000009 R14: ffff8be4cafe0880 R15: ffff8be5c26fe000
> [  419.852235] FS:  00007ff3046e0f00(0000) GS:ffff8be5dbc00000(0000) knlGS:0000000000000000
> [  419.852237] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
> [  419.852239] CR2: 00007ff303d0a000 CR3: 000000000afd8004 CR4: 00000000000706f0
> [  419.852243] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
> [  419.852244] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
> [  419.852246] Call Trace:
> [  419.852252]  ttm_pool_alloc+0x2e8/0x5f0 [ttm]
> [  419.852261]  ttm_tt_populate+0x9f/0xe0 [ttm]
> [  419.852267]  ttm_bo_vm_fault_reserved+0x236/0x6e0 [ttm]
> [  419.852274]  ttm_bo_vm_fault+0x4a/0xe0 [ttm]
> [  419.852279]  __do_fault+0x37/0x110
> [  419.852283]  handle_mm_fault+0x1493/0x1990
> [  419.852288]  do_user_addr_fault+0x1c7/0x4c0
> [  419.852292]  exc_page_fault+0x67/0x250
> [  419.852295]  ? asm_exc_page_fault+0x8/0x30
> [  419.852299]  asm_exc_page_fault+0x1e/0x30
> [  419.852301] RIP: 0033:0x7ff304f3cdf8
> [  419.852304] Code: 83 c0 04 83 fa 03 7e ea a8 0f 75 ee 83 fa 7f 7e e1 83 c2 80 89 d6 c1 ee 07 8d 4e 01 48 c1 e1 07 48 01 c1 0f 1f 80 00 00 00 00 <0f> 29 00 48 83 e8 80 0f 29 40 90 0f 29 40 a0 0f 29 40 b0 0f 29 40
> [  419.852306] RSP: 002b:00007ffec360e7d8 EFLAGS: 00010206
> [  419.852308] RAX: 00007ff303d0a000 RBX: 00000000000002e2 RCX: 00007ff303d0b300
> [  419.852309] RDX: 00000000000012c0 RSI: 0000000000000025 RDI: 0000000000000000
> [  419.852311] RBP: 0000000000001340 R08: 0000000000000000 R09: 0000000000000000
> [  419.852312] R10: 00007ff303d0a000 R11: 0000000000001340 R12: 00007ff303d0a000
> [  419.852313] R13: 0000556665f1eb30 R14: 0000000000000000 R15: 0000000000000000
> [  419.852318] Modules linked in: xt_CHECKSUM xt_MASQUERADE xt_conntrack ipt_REJECT nf_nat_tftp nf_conntrack_tftp tun bridge stp llc nft_objref nf_conntrack_netbios_ns nf_conntrack_broadcast nft_fib_inet nft_fib_ipv4 nft_fib_ipv6 nft_fib nft_reject_inet nf_reject_ipv4 nf_reject_ipv6 nft_reject nft_ct nft_chain_nat rfkill ip6table_nat ip6table_mangle ip6table_raw ip6table_security iptable_nat nf_nat nf_conntrack nf_defrag_ipv6 nf_defrag_ipv4 iptable_mangle iptable_raw iptable_security ip_set nf_tables vboxsf nfnetlink ip6table_filter ip6_tables iptable_filter sunrpc vfat fat intel_rapl_msr joydev intel_rapl_common intel_powerclamp crct10dif_pclmul crc32_pclmul ghash_clmulni_intel snd_intel8x0 rapl snd_ac97_codec ac97_bus snd_seq snd_seq_device snd_pcm pcspkr snd_timer snd soundcore i2c_piix4 vboxguest ip_tables vboxvideo drm_vram_helper drm_kms_helper cec drm_ttm_helper ttm crc32c_intel serio_raw e1000 drm drm_privacy_screen_helper ata_generic pata_acpi video fuse
> [  419.852375] ---[ end trace 511e5346897d9526 ]---
> 
> Note in case of the vboxvideo driver the DMA32 pool is allocated through
> drm_vram_helper_alloc_mm() which is also used by the bochs and
> hisilicon/hibmc drivers.
> 
> Cc: Christian König <christian.koenig at amd.com>
> Fixes: d099fc8f540a ("drm/ttm: new TT backend allocation pool v3")
> Signed-off-by: Hans de Goede <hdegoede at redhat.com>

Thanks.

Reviewed-by: Huang Rui <ray.huang at amd.com>

> ---
>  drivers/gpu/drm/ttm/ttm_pool.c | 5 +++--
>  1 file changed, 3 insertions(+), 2 deletions(-)
> 
> diff --git a/drivers/gpu/drm/ttm/ttm_pool.c b/drivers/gpu/drm/ttm/ttm_pool.c
> index 7b2f60616750..8b32fd8c8ccc 100644
> --- a/drivers/gpu/drm/ttm/ttm_pool.c
> +++ b/drivers/gpu/drm/ttm/ttm_pool.c
> @@ -80,8 +80,9 @@ static struct page *ttm_pool_alloc_page(struct ttm_pool *pool, gfp_t gfp_flags,
>  	void *vaddr;
>  
>  	if (order) {
> -		gfp_flags |= GFP_TRANSHUGE_LIGHT | __GFP_NORETRY |
> -			__GFP_KSWAPD_RECLAIM;
> +		if (!pool->use_dma32)
> +			gfp_flags |= GFP_TRANSHUGE_LIGHT;
> +		gfp_flags |= __GFP_NORETRY | __GFP_KSWAPD_RECLAIM;
>  		gfp_flags &= ~__GFP_MOVABLE;
>  		gfp_flags &= ~__GFP_COMP;
>  	}
> -- 
> 2.28.0
> 