[PATCH v2 4/9] drm/i915: Drop user created GEM objects on driver remove

[Janusz Krzysztofik]

User created GEM objects associated with open device file descriptors,
together with their associated VM areas that keep references to address
spaces, may now be destroyed as late as on device file close.  If the
device is removed while being open, DMA API may then issue a warning
on device associated DMA mappings still active.  Moreover, subsequent
attempts to release those address spaces and revoke their associated
DMA mappings while closing the device file descriptor may be judged by
intel-iommu code as bugs and result in kernel panic.

Since user created GEM objects become useless after the device is no
longer available, drop them on device removal.

<4> [36.900985] ------------[ cut here ]------------
<2> [36.901005] kernel BUG at drivers/iommu/intel-iommu.c:3717!
<4> [36.901105] invalid opcode: 0000 [#1] PREEMPT SMP NOPTI
<4> [36.901117] CPU: 0 PID: 39 Comm: kworker/u8:1 Tainted: G     U  W         5.7.0-rc5-CI-CI_DRM_8485+ #1
<4> [36.901133] Hardware name: Intel Corporation Elkhart Lake Embedded Platform/ElkhartLake LPDDR4x T3 CRB, BIOS EHLSFWI1.R00.1484.A00.1911290833 11/29/2019
<4> [36.901250] Workqueue: i915 __i915_vm_release [i915]
<4> [36.901264] RIP: 0010:intel_unmap+0x1f5/0x230
<4> [36.901274] Code: 01 e8 9f bc a9 ff 85 c0 74 09 80 3d df 60 09 01 00 74 19 65 ff 0d 13 12 97 7e 0f 85 fc fe ff ff e8 82 b0 95 ff e9 f2 fe ff ff <0f> 0b e8 d4 bd a9 ff 85 c0 75 de 48 c7 c2 10 84 2c 82 be 54 00 00
<4> [36.901302] RSP: 0018:ffffc900001ebdc0 EFLAGS: 00010246
<4> [36.901313] RAX: 0000000000000000 RBX: ffff8882561dd000 RCX: 0000000000000000
<4> [36.901324] RDX: 0000000000001000 RSI: 00000000ffd9c000 RDI: ffff888274c94000
<4> [36.901336] RBP: ffff888274c940b0 R08: 0000000000000000 R09: 0000000000000001
<4> [36.901348] R10: 000000000a25d812 R11: 00000000112af2d4 R12: ffff888252c70200
<4> [36.901360] R13: 00000000ffd9c000 R14: 0000000000001000 R15: ffff8882561dd010
<4> [36.901372] FS:  0000000000000000(0000) GS:ffff888278000000(0000) knlGS:0000000000000000
<4> [36.901386] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
<4> [36.901396] CR2: 00007f06def54950 CR3: 0000000255844000 CR4: 0000000000340ef0
<4> [36.901408] Call Trace:
<4> [36.901418]  ? process_one_work+0x1de/0x600
<4> [36.901494]  cleanup_page_dma+0x37/0x70 [i915]
<4> [36.901573]  free_pd+0x9/0x20 [i915]
<4> [36.901644]  gen8_ppgtt_cleanup+0x59/0xc0 [i915]
<4> [36.901721]  __i915_vm_release+0x14/0x30 [i915]
<4> [36.901733]  process_one_work+0x268/0x600
<4> [36.901744]  ? __schedule+0x307/0x8d0
<4> [36.901756]  worker_thread+0x37/0x380
<4> [36.901766]  ? process_one_work+0x600/0x600
<4> [36.901775]  kthread+0x140/0x160
<4> [36.901783]  ? kthread_park+0x80/0x80
<4> [36.901792]  ret_from_fork+0x24/0x50
<4> [36.901804] Modules linked in: mei_hdcp i915 x86_pkg_temp_thermal coretemp crct10dif_pclmul crc32_pclmul ghash_clmulni_intel ax88179_178a usbnet mii mei_me mei prime_numbers intel_lpss_pci
<4> [36.901857] ---[ end trace 52d1b4d81f8d1ea7 ]---

Signed-off-by: Janusz Krzysztofik <janusz.krzysztofik at linux.intel.com>
---
 drivers/gpu/drm/i915/i915_gem.c | 17 ++++++++++++++++-
 1 file changed, 16 insertions(+), 1 deletion(-)

diff --git a/drivers/gpu/drm/i915/i915_gem.c b/drivers/gpu/drm/i915/i915_gem.c
index ec7e13b41556..2da3ea87ac29 100644
--- a/drivers/gpu/drm/i915/i915_gem.c
+++ b/drivers/gpu/drm/i915/i915_gem.c
@@ -1198,6 +1198,13 @@ void i915_gem_driver_unregister(struct drm_i915_private *i915)
 	i915_gem_driver_unregister__shrinker(i915);
 }
 
+static int i915_gem_remove_object_idr(int handle, void *p, void *data)
+{
+	struct drm_file *file_priv = data;
+
+	return drm_gem_handle_delete(file_priv, handle);
+}
+
 static void i915_gem_remove_user_resources(struct drm_i915_private *i915)
 {
 	struct drm_i915_file_private *fpriv;
@@ -1220,11 +1227,19 @@ static void i915_gem_remove_user_resources(struct drm_i915_private *i915)
 		}
 		spin_unlock(&i915->gem.contexts.lock);
 
-		if (fpriv)
+		if (fpriv) {
+			struct drm_file *file = fpriv->file;
+
+			idr_for_each(&file->object_idr,
+				     i915_gem_remove_object_idr, file);
+
 			i915_gem_context_remove(fpriv);
+		}
 	} while (fpriv);
 	mutex_unlock(&i915->gem.fpriv_mutex);
 
+	drm_WARN_ON(&i915->drm, !idr_is_empty(&i915->drm.object_name_idr));
+
 	i915_gem_driver_release__contexts(i915);
 	drm_WARN_ON(&i915->drm, !list_empty(&i915->gem.contexts.list));
 }
-- 
2.21.1