[Intel-gfx] [PATCH] drm/i915: remove user GTT mappings early during runtime suspend

[Imre Deak]

On Tue, 2014-05-06 at 12:59 +0100, Chris Wilson wrote:
> On Tue, May 06, 2014 at 02:42:26PM +0300, Imre Deak wrote:
> > On Tue, 2014-05-06 at 12:40 +0100, Chris Wilson wrote:
> > > On Tue, May 06, 2014 at 02:28:50PM +0300, Imre Deak wrote:
> > > > Currently user space can access GEM buffers mapped to GTT through
> > > > existing mappings concurrently while the platform specific suspend
> > > > handlers are running.  Since these handlers may change the HW state in a
> > > > way that would break such accesses, remove the mappings before calling
> > > > the handlers.
> > > 
> > > Hmm, but you never locked the device, so what is preventing those
> > > concurrent accesses from refaulting in GTT entires anyway. Please explain
> > > the context under which the runtime suspend code executes, and leave
> > > that explanation within easy reach of intel_runtime_suspend() -
> > > preferrably with testing of those assumptions.
> > 
> > During faulting we take an RPM reference, so that avoids concurrent
> > re-faults. I could add a comment about this to the code.
> 
> You are still iterating over lists that are not safe, right? Or are
> there more magic rpm references that prevent ioctls whilst
> intel_runtime_suspend is being called?

Tbh I haven't checked this, since moving the unmapping earlier doesn't
make a difference in this regard.

But it's a good point, I tried to audit now those paths. Currently the
assumption is that we hold an RPM reference everywhere where those lists
are changed. On the exec buffer path this is true, but for example in
i915_drop_caches_set() it's not.

We could fix this by taking struct_mutex around
i915_gem_release_all_mmaps() in intel_runtime_suspend(). Doing that
needs some more auditing to make sure we can't deadlock somehow. At
first glance it seems that the driver always schedules a deferred work
and calls intel_runtime_suspend() from that, so I think it's fine.

I suggest applying this patch regardless since the two issues are
separate.

--Imre
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 490 bytes
Desc: This is a digitally signed message part
URL: <http://lists.freedesktop.org/archives/intel-gfx/attachments/20140506/4700db0e/attachment.sig>