1. 15 3月, 2018 2 次提交
    • Z
      drm/i915/gvt: fix user copy warning by whitelist workload rb_tail field · 850555d1
      Zhenyu Wang 提交于
      This is to fix warning got as:
      
      [ 6730.476938] ------------[ cut here ]------------
      [ 6730.476979] Bad or missing usercopy whitelist? Kernel memory exposure attempt detected from SLAB object 'gvt-g_vgpu_workload' (offset 120, size 4)!
      [ 6730.477021] WARNING: CPU: 2 PID: 441 at mm/usercopy.c:81 usercopy_warn+0x7e/0xa0
      [ 6730.477042] Modules linked in: tun(E) bridge(E) stp(E) llc(E) kvmgt(E) x86_pkg_temp_thermal(E) vfio_mdev(E) intel_powerclamp(E) mdev(E) coretemp(E) vfio_iommu_type1(E) vfio(E) kvm_intel(E) kvm(E) hid_generic(E) irqbypass(E) crct10dif_pclmul(E) crc32_pclmul(E) usbhid(E) i915(E) crc32c_intel(E) hid(E) ghash_clmulni_intel(E) pcbc(E) aesni_intel(E) aes_x86_64(E) crypto_simd(E) cryptd(E) glue_helper(E) intel_cstate(E) idma64(E) evdev(E) virt_dma(E) iTCO_wdt(E) intel_uncore(E) intel_rapl_perf(E) intel_lpss_pci(E) sg(E) shpchp(E) mei_me(E) pcspkr(E) iTCO_vendor_support(E) intel_lpss(E) intel_pch_thermal(E) prime_numbers(E) mei(E) mfd_core(E) video(E) acpi_pad(E) button(E) binfmt_misc(E) ip_tables(E) x_tables(E) autofs4(E) ext4(E) crc16(E) mbcache(E) jbd2(E) fscrypto(E) sd_mod(E) e1000e(E) xhci_pci(E) sdhci_pci(E)
      [ 6730.477244]  ptp(E) cqhci(E) xhci_hcd(E) pps_core(E) sdhci(E) mmc_core(E) i2c_i801(E) usbcore(E) thermal(E) fan(E)
      [ 6730.477276] CPU: 2 PID: 441 Comm: gvt workload 0 Tainted: G            E    4.16.0-rc1-gvt-staging-0213+ #127
      [ 6730.477303] Hardware name:  /NUC6i5SYB, BIOS SYSKLi35.86A.0039.2016.0316.1747 03/16/2016
      [ 6730.477326] RIP: 0010:usercopy_warn+0x7e/0xa0
      [ 6730.477340] RSP: 0018:ffffba6301223d18 EFLAGS: 00010286
      [ 6730.477355] RAX: 0000000000000000 RBX: ffff8f41caae9838 RCX: 0000000000000006
      [ 6730.477375] RDX: 0000000000000007 RSI: 0000000000000082 RDI: ffff8f41dad166f0
      [ 6730.477395] RBP: 0000000000000004 R08: 0000000000000576 R09: 0000000000000000
      [ 6730.477415] R10: ffffffffb1293fb2 R11: 00000000ffffffff R12: 0000000000000001
      [ 6730.477447] R13: ffff8f41caae983c R14: ffff8f41caae9838 R15: 00007f183ca2b000
      [ 6730.477467] FS:  0000000000000000(0000) GS:ffff8f41dad00000(0000) knlGS:0000000000000000
      [ 6730.477489] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
      [ 6730.477506] CR2: 0000559462817291 CR3: 000000028b46c006 CR4: 00000000003626e0
      [ 6730.477526] Call Trace:
      [ 6730.477537]  __check_object_size+0x9c/0x1a0
      [ 6730.477562]  __kvm_write_guest_page+0x45/0x90 [kvm]
      [ 6730.477585]  kvm_write_guest+0x46/0x80 [kvm]
      [ 6730.477599]  kvmgt_rw_gpa+0x9b/0xf0 [kvmgt]
      [ 6730.477642]  workload_thread+0xa38/0x1040 [i915]
      [ 6730.477659]  ? do_wait_intr_irq+0xc0/0xc0
      [ 6730.477673]  ? finish_wait+0x80/0x80
      [ 6730.477707]  ? clean_workloads+0x120/0x120 [i915]
      [ 6730.477722]  kthread+0x111/0x130
      [ 6730.477733]  ? _kthread_create_worker_on_cpu+0x60/0x60
      [ 6730.477750]  ? exit_to_usermode_loop+0x6f/0xb0
      [ 6730.477766]  ret_from_fork+0x35/0x40
      [ 6730.477777] Code: 48 c7 c0 20 e3 25 b1 48 0f 44 c2 41 50 51 41 51 48 89 f9 49 89 f1 4d 89 d8 4c 89 d2 48 89 c6 48 c7 c7 78 e3 25 b1 e8 b2 bc e4 ff <0f> ff 48 83 c4 18 c3 48 c7 c6 09 d0 26 b1 49 89 f1 49 89 f3 eb
      [ 6730.477849] ---[ end trace cae869c1c323e45a ]---
      
      By whitelist guest page write from workload struct allocated from kmem cache.
      Reviewed-by: NHang Yuan <hang.yuan@linux.intel.com>
      Signed-off-by: NZhenyu Wang <zhenyuw@linux.intel.com>
      (cherry picked from commit 5627705406874df57fdfad3b4e0c9aedd3b007df)
      850555d1
    • F
      drm/i915/gvt: Correct the privilege shadow batch buffer address · ef75c685
      fred gao 提交于
      Once the ring buffer is copied to ring_scan_buffer and scanned,
      the shadow batch buffer start address is only updated into
      ring_scan_buffer, not the real ring address allocated through
      intel_ring_begin in later copy_workload_to_ring_buffer.
      
      This patch is only to set the right shadow batch buffer address
      from Ring buffer, not include the shadow_wa_ctx.
      
      v2:
      - refine some comments. (Zhenyu)
      v3:
      - fix typo in title. (Zhenyu)
      v4:
      - remove the unnecessary comments. (Zhenyu)
      - add comments in bb_start_cmd_va update. (Zhenyu)
      
      Fixes: 0a53bc07 ("drm/i915/gvt: Separate cmd scan from request allocation")
      Cc: stable@vger.kernel.org  # v4.15
      Cc: Zhenyu Wang <zhenyuw@linux.intel.com>
      Cc: Yulei Zhang <yulei.zhang@intel.com>
      Signed-off-by: Nfred gao <fred.gao@intel.com>
      Signed-off-by: NZhenyu Wang <zhenyuw@linux.intel.com>
      ef75c685
  2. 09 3月, 2018 1 次提交
  3. 07 2月, 2018 2 次提交
  4. 06 12月, 2017 3 次提交
  5. 04 12月, 2017 4 次提交
  6. 28 11月, 2017 2 次提交
    • F
      drm/i915/gvt: Move request alloc to dispatch_workload path only · c3c80f07
      fred gao 提交于
      Previously the performance is improved through the workload auditing
      and shadowing ahead of vGPU scheduling, however, there is the case that
      more requests are allocated in submit_context before the previous request
      is added, the timeline will hold its seqno which is later.
      
      This patch is to move the request alloc to dispatch_workload function,
      where is the same place as request is added.
      
      It will fix the issue of kernel BUG for (timeline->seqno != request->fence.seqno)
      check when add_request.
      
      Fixes: 89ea20b9 ("drm/i915/gvt: Factor out scan and shadow from workload dispatch")
      Signed-off-by: NChuanxiao Dong <chuanxiao.dong@intel.com>
      Signed-off-by: Nfred gao <fred.gao@intel.com>
      Signed-off-by: NZhenyu Wang <zhenyuw@linux.intel.com>
      (cherry picked from commit f2880e04)
      c3c80f07
    • C
      drm/i915/gvt: Fix unsafe locking caused by spin_unlock_bh · 679fd3eb
      Changbin Du 提交于
      The caller of shadow_context_status_change may disable irqs. So it is not
      safe to use spin_unlock_bh in such context. Let's switch to irqsave version
      for safety.
      
      ------------[ cut here ]------------
      WARNING: CPU: 2 PID: 4504 at kernel/softirq.c:161 __local_bh_enable_ip+0x46/0x60
      [  168.797710] Hardware name: Dell Inc. OptiPlex 7040/0Y7WYT, BIOS 1.2.8 01/26/2016
      [  168.797712] task: ffff8c693d22db80 task.stack: ffffb51b482bc000
      [  168.797718] RIP: 0010:__local_bh_enable_ip+0x46/0x60
      [  168.797721] RSP: 0018:ffffb51b482bfa10 EFLAGS: 00010046
      [  168.797724] RAX: 0000000000000046 RBX: ffff8c6900278000 RCX: 00000000ffffffff
      [  168.797726] RDX: 0000000000000001 RSI: 0000000000000200 RDI: ffffffffc06a0330
      [  168.797728] RBP: ffffb51b482bfa10 R08: 0000000000000000 R09: ffff8c690027cb90
      [  168.797730] R10: ffffb51b482bfa40 R11: 00000004072f0001 R12: 0000000000000000
      [  168.797732] R13: 0000000000000000 R14: ffff8c690027ca9c R15: 0000000000000000
      [  168.797735] FS:  00007ff187c56700(0000) GS:ffff8c6959d00000(0000) knlGS:0000000000000000
      [  168.797738] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
      [  168.797740] CR2: 0000562bc0c3991f CR3: 0000000430614006 CR4: 00000000003606e0
      [  168.797742] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
      [  168.797744] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
      [  168.797745] Call Trace:
      [  168.797755]  _raw_spin_unlock_bh+0x1e/0x20
      [  168.797826]  shadow_context_status_change+0x120/0x1e0 [i915]
      [  168.797831]  notifier_call_chain+0x4a/0x70
      [  168.797834]  atomic_notifier_call_chain+0x1a/0x20
      [  168.797896]  execlists_cancel_port_requests+0x4f/0x80 [i915]
      [  168.797956]  reset_common_ring+0x30/0x100 [i915]
      [  168.798007]  i915_gem_reset_engine+0x114/0x330 [i915]
      [  168.798060]  ? i915_gem_retire_requests+0x75/0x180 [i915]
      [  168.798111]  i915_gem_reset+0x3e/0xb0 [i915]
      [  168.798149]  i915_reset+0x10b/0x1c0 [i915]
      [  168.798187]  i915_reset_device+0x209/0x220 [i915]
      [  168.798225]  ? gen8_gt_irq_ack+0x170/0x170 [i915]
      [  168.798229]  ? __queue_work+0x430/0x430
      [  168.798270]  i915_handle_error+0x285/0x420 [i915]
      [  168.798275]  ? mntput+0x24/0x40
      [  168.798281]  ? terminate_walk+0x8e/0xf0
      [  168.798328]  i915_wedged_set+0x84/0xc0 [i915]
      [  168.798333]  simple_attr_write+0xab/0xc0
      [  168.798337]  full_proxy_write+0x54/0x90
      [  168.798343]  __vfs_write+0x37/0x170
      [  168.798349]  ? common_file_perm+0x4c/0x100
      [  168.798355]  ? apparmor_file_permission+0x1a/0x20
      [  168.798361]  ? security_file_permission+0x3b/0xc0
      [  168.798365]  vfs_write+0xb8/0x1b0
      [  168.798370]  SyS_write+0x55/0xc0
      [  168.798376]  entry_SYSCALL_64_fastpath+0x1e/0xa9
      
      Fixes: 0e86cc9c ("drm/i915/gvt: implement per-vm mmio switching optimization")
      Signed-off-by: NChangbin Du <changbin.du@intel.com>
      Signed-off-by: NZhenyu Wang <zhenyuw@linux.intel.com>
      679fd3eb
  7. 21 11月, 2017 1 次提交
    • C
      drm/i915/gvt: Cleanup unwanted public symbols · 7b302556
      Chris Wilson 提交于
      drivers/gpu/drm/i915/gvt/execlist.c:531:6: warning: symbol 'clean_execlist' was not declared. Should it be static?
      drivers/gpu/drm/i915/gvt/execlist.c:545:6: warning: symbol 'reset_execlist' was not declared. Should it be static?
      drivers/gpu/drm/i915/gvt/execlist.c:556:5: warning: symbol 'init_execlist' was not declared. Should it be static?
      drivers/gpu/drm/i915/gvt/scheduler.c:248:6: warning: symbol 'release_shadow_wa_ctx' was not declared. Should it be static?
      
      References: 06bb372f ("drm/i915/gvt: Introduce intel_vgpu_reset_submission")
      Signed-off-by: NChris Wilson <chris@chris-wilson.co.uk>
      Cc: Zhi Wang <zhi.a.wang@intel.com>
      Cc: Zhenyu Wang <zhenyuw@linux.intel.com>
      Cc: intel-gvt-dev@lists.freedesktop.org
      Signed-off-by: NZhenyu Wang <zhenyuw@linux.intel.com>
      7b302556
  8. 16 11月, 2017 17 次提交
  9. 11 11月, 2017 1 次提交
  10. 05 10月, 2017 1 次提交
  11. 13 9月, 2017 1 次提交
  12. 08 9月, 2017 3 次提交
    • F
      drm/i915/gvt: Refine error handling in dispatch_workload · 0f43702a
      fred gao 提交于
      When an error occurs in dispatch_workload, this patch is to do the
      proper cleanup and rollback to the original states before the workload
      is abandoned.
      
      v2:
      - split the mixed several error paths for better review. (Zhenyu)
      
      v3:
      - original PTR_ERR(cs) is good and code cleanup. (Zhenyu)
      
      v4:
      - reuse the existing i915_add_request for error handling. (Zhenyu)
      
      v5:
      - remove the duplicate error handling release_shadow_wa_ctx and
        move the engine->context_unpin upper. (Zhenyu)
      
      v6:
      - keep the old label "out". (Zhenyu)
      Signed-off-by: Nfred gao <fred.gao@intel.com>
      Signed-off-by: NZhenyu Wang <zhenyuw@linux.intel.com>
      0f43702a
    • F
      drm/i915/gvt: Add error handling for intel_gvt_scan_and_shadow_workload · a3cfdca9
      fred gao 提交于
      When an error occurs after shadow_indirect_ctx, this patch is to do the
      proper cleanup and rollback to the original states for shadowed indirect
      context before the workload is abandoned.
      
      v2:
      - split the mixed several error paths for better review. (Zhenyu)
      
      v3:
      - no return check for clean up functions. (Changbin)
      
      v4:
      - expose and reuse the existing release_shadow_wa_ctx. (Zhenyu)
      
      v5:
      - move the release function to scheduler.c file. (Zhenyu)
      
      v6:
      - move error handling code of intel_gvt_scan_and_shadow_workload
        to here. (Zhenyu)
      Signed-off-by: Nfred gao <fred.gao@intel.com>
      Signed-off-by: NZhenyu Wang <zhenyuw@linux.intel.com>
      a3cfdca9
    • F
      drm/i915/gvt: Separate cmd scan from request allocation · 0a53bc07
      fred gao 提交于
      Currently i915 request structure and shadow ring buffer are allocated
      before command scan, so it will have to restore to previous states once
      any error happens afterwards in the long dispatch_workload path.
      
      This patch is to introduce a reserved ring buffer created at the beginning
      of vGPU initialization. Workload will be coped to this reserved buffer and
      be scanned first, the i915 request and shadow ring buffer are only
      allocated after the result of scan is successful.
      
      To balance the memory usage and buffer alloc time, the coming bigger ring
      buffer will be reallocated and kept until more bigger buffer is coming.
      
      v2:
      - use kmalloc for the smaller ring buffer, realloc if required. (Zhenyu)
      
      v3:
      - remove the dynamically allocated ring buffer. (Zhenyu)
      
      v4:
      - code style polish.
      - kfree previous allocated buffer once kmalloc failed. (Zhenyu)
      Signed-off-by: Nfred gao <fred.gao@intel.com>
      Signed-off-by: NZhenyu Wang <zhenyuw@linux.intel.com>
      0a53bc07
  13. 10 8月, 2017 2 次提交