[Intel-gfx] [PATCH] drm/i915: Unwind vma pinning for intel_pin_and_fence_fb_obj error path

[Chris Wilson]

Quoting Ville Syrjälä (2018-03-05 11:12:12)
> On Mon, Mar 05, 2018 at 10:33:12AM +0000, Chris Wilson wrote:
> > If we fail to acquire a fence when we must, we must unwind before
> > reporting the error. Otherwise, we lose tracking of the vma pinning and
> > eventually hit a bug like
> > 
> > <3>[   46.163202] i915_vma_unpin:333 GEM_BUG_ON(!i915_vma_is_pinned(vma))
> > <4>[   46.163424] ------------[ cut here ]------------
> > <2>[   46.163429] kernel BUG at drivers/gpu/drm/i915/i915_vma.h:333!
> > <4>[   46.163444] invalid opcode: 0000 [#1] PREEMPT SMP KASAN PTI
> > <0>[   46.163451] Dumping ftrace buffer:
> > <0>[   46.163457] ---------------------------------
> > <0>[   46.163630]    <...>-84      1.... 46260767us : i915_gem_object_unpin_from_display_plane: i915_vma_unpin:333 GEM_BUG_ON(!i915_vma_is_pinned(vma))
> > <0>[   46.163635] ---------------------------------
> > <4>[   46.163638] Modules linked in: vgem i915 snd_hda_codec_analog snd_hda_codec_generic coretemp snd_hda_intel snd_hda_codec snd_hwdep snd_hda_core snd_pcm lpc_ich mei_me e1000e mei prime_numbers
> > <4>[   46.163667] CPU: 1 PID: 84 Comm: kworker/u16:1 Tainted: G     U           4.16.0-rc3-gc07ef2c77d14-kasan_18+ #1
> > <4>[   46.163671] Hardware name: Dell Inc. OptiPlex 755                 /0PU052, BIOS A08 02/19/2008
> > <4>[   46.163743] Workqueue: events_unbound intel_atomic_commit_work [i915]
> > <4>[   46.163809] RIP: 0010:i915_gem_object_unpin_from_display_plane+0x253/0x2f0 [i915]
> > <4>[   46.163813] RSP: 0018:ffff8800624cfb48 EFLAGS: 00010286
> > <4>[   46.163818] RAX: 000000000000000c RBX: ffff880064446c40 RCX: ffff8800653135b8
> > <4>[   46.163822] RDX: dffffc0000000000 RSI: 0000000000000054 RDI: ffff8800651e30d0
> > <4>[   46.163825] RBP: 00000000000003d0 R08: 0000000000000001 R09: ffff8800651e3158
> > <4>[   46.163829] R10: 0000000000000000 R11: ffff8800651e30f0 R12: 0000000000000001
> > <4>[   46.163832] R13: ffff880054c58620 R14: 0000000000000000 R15: dffffc0000000000
> > <4>[   46.163836] FS:  0000000000000000(0000) GS:ffff880066040000(0000) knlGS:0000000000000000
> > <4>[   46.163840] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
> > <4>[   46.163843] CR2: 00007f1fc6fb0000 CR3: 00000000526fe000 CR4: 00000000000006e0
> > <4>[   46.163846] Call Trace:
> > <4>[   46.163918]  intel_unpin_fb_vma+0xbd/0x300 [i915]
> > <4>[   46.163990]  intel_cleanup_plane_fb+0x99/0xc0 [i915]
> > <4>[   46.163998]  drm_atomic_helper_cleanup_planes+0x166/0x280
> > <4>[   46.164071]  intel_atomic_commit_tail+0x1594/0x33a0 [i915]
> > <4>[   46.164081]  ? process_one_work+0x66e/0x1460
> > <4>[   46.164151]  ? skl_update_crtcs+0x9c0/0x9c0 [i915]
> > <4>[   46.164157]  ? lock_acquire+0x13d/0x390
> > <4>[   46.164161]  ? lock_acquire+0x13d/0x390
> > <4>[   46.164169]  process_one_work+0x71a/0x1460
> > <4>[   46.164175]  ? __schedule+0x838/0x1e50
> > <4>[   46.164182]  ? pwq_dec_nr_in_flight+0x2b0/0x2b0
> > <4>[   46.164188]  ? _raw_spin_lock_irq+0xa/0x40
> > <4>[   46.164194]  worker_thread+0xdf/0xf60
> > <4>[   46.164204]  ? process_one_work+0x1460/0x1460
> > <4>[   46.164209]  kthread+0x2cf/0x3c0
> > <4>[   46.164213]  ? _kthread_create_on_node+0xa0/0xa0
> > <4>[   46.164218]  ret_from_fork+0x3a/0x50
> > <4>[   46.164227] Code: e8 78 d9 cd e8 48 8b 35 cc 9e 47 00 49 c7 c0 c0 31 84 c0 b9 4d 01 00 00 48 c7 c2 e0 80 84 c0 48 c7 c7 0e bb 57 c0 e8 5d 4b df e8 <0f> 0b 48 c7 c1 c0 30 84 c0 ba 4e 01 00 00 48 c7 c6 e0 80 84 c0
> > <1>[   46.164368] RIP: i915_gem_object_unpin_from_display_plane+0x253/0x2f0 [i915] RSP: ffff8800624cfb48
> > 
> > Fixes: 85798ac9b35f ("drm/i915: Fail if we can't get a fence for gen2/3 tiled scanout")
> > Signed-off-by: Chris Wilson <chris at chris-wilson.co.uk>
> > Cc: Ville Syrjälä <ville.syrjala at linux.intel.com>
> > ---
> >  drivers/gpu/drm/i915/intel_display.c | 1 +
> >  1 file changed, 1 insertion(+)
> > 
> > diff --git a/drivers/gpu/drm/i915/intel_display.c b/drivers/gpu/drm/i915/intel_display.c
> > index 90f0fc8cc2bd..ceed0821b37d 100644
> > --- a/drivers/gpu/drm/i915/intel_display.c
> > +++ b/drivers/gpu/drm/i915/intel_display.c
> > @@ -2152,6 +2152,7 @@ intel_pin_and_fence_fb_obj(struct drm_framebuffer *fb,
> >                */
> >               ret = i915_vma_pin_fence(vma);
> >               if (ret != 0 && INTEL_GEN(dev_priv) < 4) {
> > +                     i915_gem_object_unpin_from_display_plane(vma);
> 
> Doh!
> 
> Reviewed-by: Ville Syrjälä <ville.syrjala at linux.intel.com>

And pushed. BAT is all the coverage we get until kasan runs.
Thanks,
-Chris