2010-08-07 10:01:23 +00:00
|
|
|
/*
|
|
|
|
* Copyright © 2008-2010 Intel Corporation
|
|
|
|
*
|
|
|
|
* Permission is hereby granted, free of charge, to any person obtaining a
|
|
|
|
* copy of this software and associated documentation files (the "Software"),
|
|
|
|
* to deal in the Software without restriction, including without limitation
|
|
|
|
* the rights to use, copy, modify, merge, publish, distribute, sublicense,
|
|
|
|
* and/or sell copies of the Software, and to permit persons to whom the
|
|
|
|
* Software is furnished to do so, subject to the following conditions:
|
|
|
|
*
|
|
|
|
* The above copyright notice and this permission notice (including the next
|
|
|
|
* paragraph) shall be included in all copies or substantial portions of the
|
|
|
|
* Software.
|
|
|
|
*
|
|
|
|
* THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
|
|
|
|
* IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
|
|
|
|
* FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL
|
|
|
|
* THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
|
|
|
|
* LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING
|
|
|
|
* FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS
|
|
|
|
* IN THE SOFTWARE.
|
|
|
|
*
|
|
|
|
* Authors:
|
|
|
|
* Eric Anholt <eric@anholt.net>
|
|
|
|
* Chris Wilson <chris@chris-wilson.co.uuk>
|
|
|
|
*
|
|
|
|
*/
|
|
|
|
|
2012-10-02 17:01:07 +00:00
|
|
|
#include <drm/drmP.h>
|
|
|
|
#include <drm/i915_drm.h>
|
2014-01-20 10:17:37 +00:00
|
|
|
|
|
|
|
#include "i915_drv.h"
|
|
|
|
#include "intel_drv.h"
|
2011-02-03 11:57:46 +00:00
|
|
|
#include "i915_trace.h"
|
2010-08-07 10:01:23 +00:00
|
|
|
|
2016-08-04 15:32:17 +00:00
|
|
|
static bool
|
|
|
|
gpu_is_idle(struct drm_i915_private *dev_priv)
|
|
|
|
{
|
|
|
|
struct intel_engine_cs *engine;
|
|
|
|
|
|
|
|
for_each_engine(engine, dev_priv) {
|
2016-08-05 09:14:11 +00:00
|
|
|
if (intel_engine_is_active(engine))
|
2016-08-04 15:32:17 +00:00
|
|
|
return false;
|
|
|
|
}
|
|
|
|
|
|
|
|
return true;
|
|
|
|
}
|
|
|
|
|
2010-08-07 10:01:24 +00:00
|
|
|
static bool
|
2013-08-01 00:00:11 +00:00
|
|
|
mark_free(struct i915_vma *vma, struct list_head *unwind)
|
2010-08-07 10:01:23 +00:00
|
|
|
{
|
2016-08-04 15:32:30 +00:00
|
|
|
if (i915_vma_is_pinned(vma))
|
2012-04-24 14:47:30 +00:00
|
|
|
return false;
|
|
|
|
|
2013-08-26 09:23:47 +00:00
|
|
|
if (WARN_ON(!list_empty(&vma->exec_list)))
|
|
|
|
return false;
|
|
|
|
|
2013-08-14 09:38:34 +00:00
|
|
|
list_add(&vma->exec_list, unwind);
|
2013-07-17 19:19:03 +00:00
|
|
|
return drm_mm_scan_add_block(&vma->node);
|
2010-08-07 10:01:23 +00:00
|
|
|
}
|
|
|
|
|
2014-01-29 21:07:11 +00:00
|
|
|
/**
|
|
|
|
* i915_gem_evict_something - Evict vmas to make room for binding a new one
|
|
|
|
* @vm: address space to evict from
|
2015-01-05 13:36:59 +00:00
|
|
|
* @min_size: size of the desired free space
|
2014-01-29 21:07:11 +00:00
|
|
|
* @alignment: alignment constraint of the desired free space
|
|
|
|
* @cache_level: cache_level for the desired space
|
2015-01-05 13:36:59 +00:00
|
|
|
* @start: start (inclusive) of the range from which to evict objects
|
|
|
|
* @end: end (exclusive) of the range from which to evict objects
|
|
|
|
* @flags: additional flags to control the eviction algorithm
|
2014-01-29 21:07:11 +00:00
|
|
|
*
|
|
|
|
* This function will try to evict vmas until a free space satisfying the
|
|
|
|
* requirements is found. Callers must check first whether any such hole exists
|
|
|
|
* already before calling this function.
|
|
|
|
*
|
|
|
|
* This function is used by the object/vma binding code.
|
|
|
|
*
|
2015-03-18 13:47:59 +00:00
|
|
|
* Since this function is only used to free up virtual address space it only
|
|
|
|
* ignores pinned vmas, and not object where the backing storage itself is
|
|
|
|
* pinned. Hence obj->pages_pin_count does not protect against eviction.
|
|
|
|
*
|
2014-01-29 21:07:11 +00:00
|
|
|
* To clarify: This is for freeing up virtual address space, not for freeing
|
|
|
|
* memory in e.g. the shrinker.
|
|
|
|
*/
|
2010-08-07 10:01:23 +00:00
|
|
|
int
|
2016-08-04 15:32:18 +00:00
|
|
|
i915_gem_evict_something(struct i915_address_space *vm,
|
2016-08-04 15:32:22 +00:00
|
|
|
u64 min_size, u64 alignment,
|
|
|
|
unsigned cache_level,
|
|
|
|
u64 start, u64 end,
|
2014-02-14 13:01:11 +00:00
|
|
|
unsigned flags)
|
2010-08-07 10:01:23 +00:00
|
|
|
{
|
2016-08-04 15:32:18 +00:00
|
|
|
struct drm_i915_private *dev_priv = to_i915(vm->dev);
|
2016-08-04 15:32:17 +00:00
|
|
|
struct list_head eviction_list;
|
|
|
|
struct list_head *phases[] = {
|
|
|
|
&vm->inactive_list,
|
|
|
|
&vm->active_list,
|
|
|
|
NULL,
|
|
|
|
}, **phase;
|
|
|
|
struct i915_vma *vma, *next;
|
|
|
|
int ret;
|
2010-08-07 10:01:23 +00:00
|
|
|
|
2016-08-04 15:32:18 +00:00
|
|
|
trace_i915_gem_evict(vm, min_size, alignment, flags);
|
2011-02-03 11:57:46 +00:00
|
|
|
|
2010-08-07 10:01:24 +00:00
|
|
|
/*
|
|
|
|
* The goal is to evict objects and amalgamate space in LRU order.
|
|
|
|
* The oldest idle objects reside on the inactive list, which is in
|
2016-08-04 15:32:17 +00:00
|
|
|
* retirement order. The next objects to retire are those in flight,
|
|
|
|
* on the active list, again in retirement order.
|
2010-08-07 10:01:24 +00:00
|
|
|
*
|
|
|
|
* The retirement sequence is thus:
|
|
|
|
* 1. Inactive objects (already retired)
|
2016-08-04 15:32:17 +00:00
|
|
|
* 2. Active objects (will stall on unbinding)
|
2010-08-07 10:01:24 +00:00
|
|
|
*
|
|
|
|
* On each list, the oldest objects lie at the HEAD with the freshest
|
|
|
|
* object on the TAIL.
|
|
|
|
*/
|
drm/i915: Prevent negative relocation deltas from wrapping
This is pure evil. Userspace, I'm looking at you SNA, repacks batch
buffers on the fly after generation as they are being passed to the
kernel for execution. These batches also contain self-referenced
relocations as a single buffer encompasses the state commands, kernels,
vertices and sampler. During generation the buffers are placed at known
offsets within the full batch, and then the relocation deltas (as passed
to the kernel) are tweaked as the batch is repacked into a smaller buffer.
This means that userspace is passing negative relocations deltas, which
subsequently wrap to large values if the batch is at a low address. The
GPU hangs when it then tries to use the large value as a base for its
address offsets, rather than wrapping back to the real value (as one
would hope). As the GPU uses positive offsets from the base, we can
treat the relocation address as the minimum address read by the GPU.
For the upper bound, we trust that userspace will not read beyond the
end of the buffer.
So, how do we fix negative relocations from wrapping? We can either
check that every relocation looks valid when we write it, and then
position each object such that we prevent the offset wraparound, or we
just special-case the self-referential behaviour of SNA and force all
batches to be above 256k. Daniel prefers the latter approach.
This fixes a GPU hang when it tries to use an address (relocation +
offset) greater than the GTT size. The issue would occur quite easily
with full-ppgtt as each fd gets its own VM space, so low offsets would
often be handed out. However, with the rearrangement of the low GTT due
to capturing the BIOS framebuffer, it is already affecting kernels 3.15
onwards. I think only IVB+ is susceptible to this bug, but the workaround
should only kick in rarely, so it seems sensible to always apply it.
v3: Use a bias for batch buffers to prevent small negative delta relocations
from wrapping.
v4 from Daniel:
- s/BIAS/BATCH_OFFSET_BIAS/
- Extract eb_vma_misplaced/i915_vma_misplaced since the conditions
were growing rather cumbersome.
- Add a comment to eb_get_batch explaining why we do this.
- Apply the batch offset bias everywhere but mention that we've only
observed it on gen7 gpus.
- Drop PIN_OFFSET_FIX for now, that slipped in from a feature patch.
v5: Add static to eb_get_batch, spotted by 0-day tester.
Testcase: igt/gem_bad_reloc
Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=78533
Signed-off-by: Chris Wilson <chris@chris-wilson.co.uk> (v3)
Cc: stable@vger.kernel.org
Signed-off-by: Daniel Vetter <daniel.vetter@ffwll.ch>
2014-05-23 06:48:08 +00:00
|
|
|
if (start != 0 || end != vm->total) {
|
2013-07-16 23:50:08 +00:00
|
|
|
drm_mm_init_scan_with_range(&vm->mm, min_size,
|
drm/i915: Prevent negative relocation deltas from wrapping
This is pure evil. Userspace, I'm looking at you SNA, repacks batch
buffers on the fly after generation as they are being passed to the
kernel for execution. These batches also contain self-referenced
relocations as a single buffer encompasses the state commands, kernels,
vertices and sampler. During generation the buffers are placed at known
offsets within the full batch, and then the relocation deltas (as passed
to the kernel) are tweaked as the batch is repacked into a smaller buffer.
This means that userspace is passing negative relocations deltas, which
subsequently wrap to large values if the batch is at a low address. The
GPU hangs when it then tries to use the large value as a base for its
address offsets, rather than wrapping back to the real value (as one
would hope). As the GPU uses positive offsets from the base, we can
treat the relocation address as the minimum address read by the GPU.
For the upper bound, we trust that userspace will not read beyond the
end of the buffer.
So, how do we fix negative relocations from wrapping? We can either
check that every relocation looks valid when we write it, and then
position each object such that we prevent the offset wraparound, or we
just special-case the self-referential behaviour of SNA and force all
batches to be above 256k. Daniel prefers the latter approach.
This fixes a GPU hang when it tries to use an address (relocation +
offset) greater than the GTT size. The issue would occur quite easily
with full-ppgtt as each fd gets its own VM space, so low offsets would
often be handed out. However, with the rearrangement of the low GTT due
to capturing the BIOS framebuffer, it is already affecting kernels 3.15
onwards. I think only IVB+ is susceptible to this bug, but the workaround
should only kick in rarely, so it seems sensible to always apply it.
v3: Use a bias for batch buffers to prevent small negative delta relocations
from wrapping.
v4 from Daniel:
- s/BIAS/BATCH_OFFSET_BIAS/
- Extract eb_vma_misplaced/i915_vma_misplaced since the conditions
were growing rather cumbersome.
- Add a comment to eb_get_batch explaining why we do this.
- Apply the batch offset bias everywhere but mention that we've only
observed it on gen7 gpus.
- Drop PIN_OFFSET_FIX for now, that slipped in from a feature patch.
v5: Add static to eb_get_batch, spotted by 0-day tester.
Testcase: igt/gem_bad_reloc
Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=78533
Signed-off-by: Chris Wilson <chris@chris-wilson.co.uk> (v3)
Cc: stable@vger.kernel.org
Signed-off-by: Daniel Vetter <daniel.vetter@ffwll.ch>
2014-05-23 06:48:08 +00:00
|
|
|
alignment, cache_level,
|
|
|
|
start, end);
|
2013-08-01 00:00:11 +00:00
|
|
|
} else
|
2013-07-16 23:50:08 +00:00
|
|
|
drm_mm_init_scan(&vm->mm, min_size, alignment, cache_level);
|
2010-08-07 10:01:24 +00:00
|
|
|
|
2014-02-14 13:01:11 +00:00
|
|
|
if (flags & PIN_NONBLOCK)
|
2016-08-04 15:32:17 +00:00
|
|
|
phases[1] = NULL;
|
2010-08-07 10:01:23 +00:00
|
|
|
|
2016-08-04 15:32:17 +00:00
|
|
|
search_again:
|
|
|
|
INIT_LIST_HEAD(&eviction_list);
|
|
|
|
phase = phases;
|
|
|
|
do {
|
|
|
|
list_for_each_entry(vma, *phase, vm_link)
|
|
|
|
if (mark_free(vma, &eviction_list))
|
|
|
|
goto found;
|
|
|
|
} while (*++phase);
|
2010-08-07 10:01:24 +00:00
|
|
|
|
|
|
|
/* Nothing found, clean up and bail out! */
|
2016-08-04 15:32:17 +00:00
|
|
|
list_for_each_entry_safe(vma, next, &eviction_list, exec_list) {
|
2013-07-17 19:19:03 +00:00
|
|
|
ret = drm_mm_scan_remove_block(&vma->node);
|
2010-08-07 10:01:24 +00:00
|
|
|
BUG_ON(ret);
|
2011-01-10 14:21:05 +00:00
|
|
|
|
2016-08-04 15:32:17 +00:00
|
|
|
INIT_LIST_HEAD(&vma->exec_list);
|
2010-08-07 10:01:24 +00:00
|
|
|
}
|
|
|
|
|
2013-12-09 10:37:24 +00:00
|
|
|
/* Can we unpin some objects such as idle hw contents,
|
2016-08-04 15:32:17 +00:00
|
|
|
* or pending flips? But since only the GGTT has global entries
|
|
|
|
* such as scanouts, rinbuffers and contexts, we can skip the
|
|
|
|
* purge when inspecting per-process local address spaces.
|
2010-08-07 10:01:24 +00:00
|
|
|
*/
|
2016-08-04 15:32:17 +00:00
|
|
|
if (!i915_is_ggtt(vm) || flags & PIN_NONBLOCK)
|
2014-01-20 10:17:37 +00:00
|
|
|
return -ENOSPC;
|
2013-12-09 10:37:24 +00:00
|
|
|
|
2016-08-04 15:32:17 +00:00
|
|
|
if (gpu_is_idle(dev_priv)) {
|
|
|
|
/* If we still have pending pageflip completions, drop
|
|
|
|
* back to userspace to give our workqueues time to
|
|
|
|
* acquire our locks and unpin the old scanouts.
|
|
|
|
*/
|
2016-08-04 15:32:18 +00:00
|
|
|
return intel_has_pending_fb_unpin(vm->dev) ? -EAGAIN : -ENOSPC;
|
2014-01-20 10:17:37 +00:00
|
|
|
}
|
|
|
|
|
2016-08-04 15:32:17 +00:00
|
|
|
/* Not everything in the GGTT is tracked via vma (otherwise we
|
|
|
|
* could evict as required with minimal stalling) so we are forced
|
|
|
|
* to idle the GPU and explicitly retire outstanding requests in
|
|
|
|
* the hopes that we can then remove contexts and the like only
|
|
|
|
* bound by their active reference.
|
2014-01-20 10:17:37 +00:00
|
|
|
*/
|
2016-08-04 15:32:17 +00:00
|
|
|
ret = i915_gem_switch_to_kernel_context(dev_priv);
|
|
|
|
if (ret)
|
|
|
|
return ret;
|
|
|
|
|
2016-08-05 09:14:11 +00:00
|
|
|
ret = i915_gem_wait_for_idle(dev_priv, true);
|
2016-08-04 15:32:17 +00:00
|
|
|
if (ret)
|
|
|
|
return ret;
|
|
|
|
|
|
|
|
i915_gem_retire_requests(dev_priv);
|
|
|
|
goto search_again;
|
2010-08-07 10:01:24 +00:00
|
|
|
|
|
|
|
found:
|
2010-09-29 21:23:05 +00:00
|
|
|
/* drm_mm doesn't allow any other other operations while
|
2016-08-04 15:32:17 +00:00
|
|
|
* scanning, therefore store to-be-evicted objects on a
|
|
|
|
* temporary list and take a reference for all before
|
|
|
|
* calling unbind (which may remove the active reference
|
|
|
|
* of any of our objects, thus corrupting the list).
|
|
|
|
*/
|
|
|
|
list_for_each_entry_safe(vma, next, &eviction_list, exec_list) {
|
|
|
|
if (drm_mm_scan_remove_block(&vma->node))
|
2016-08-04 15:32:30 +00:00
|
|
|
__i915_vma_pin(vma);
|
2016-08-04 15:32:17 +00:00
|
|
|
else
|
|
|
|
list_del_init(&vma->exec_list);
|
2010-08-07 10:01:24 +00:00
|
|
|
}
|
2010-08-07 10:01:23 +00:00
|
|
|
|
2010-08-07 10:01:24 +00:00
|
|
|
/* Unbinding will emit any required flushes */
|
2010-09-29 21:23:05 +00:00
|
|
|
while (!list_empty(&eviction_list)) {
|
2013-08-14 09:38:34 +00:00
|
|
|
vma = list_first_entry(&eviction_list,
|
|
|
|
struct i915_vma,
|
2010-11-25 19:32:06 +00:00
|
|
|
exec_list);
|
2013-08-16 20:29:33 +00:00
|
|
|
|
|
|
|
list_del_init(&vma->exec_list);
|
2016-08-04 15:32:30 +00:00
|
|
|
__i915_vma_unpin(vma);
|
2010-09-29 21:23:05 +00:00
|
|
|
if (ret == 0)
|
2013-08-14 09:38:34 +00:00
|
|
|
ret = i915_vma_unbind(vma);
|
2010-08-07 10:01:23 +00:00
|
|
|
}
|
2010-09-29 21:23:05 +00:00
|
|
|
return ret;
|
2010-08-07 10:01:23 +00:00
|
|
|
}
|
|
|
|
|
2015-12-08 11:55:07 +00:00
|
|
|
int
|
|
|
|
i915_gem_evict_for_vma(struct i915_vma *target)
|
|
|
|
{
|
|
|
|
struct drm_mm_node *node, *next;
|
|
|
|
|
|
|
|
list_for_each_entry_safe(node, next,
|
|
|
|
&target->vm->mm.head_node.node_list,
|
|
|
|
node_list) {
|
|
|
|
struct i915_vma *vma;
|
|
|
|
int ret;
|
|
|
|
|
|
|
|
if (node->start + node->size <= target->node.start)
|
|
|
|
continue;
|
|
|
|
if (node->start >= target->node.start + target->node.size)
|
|
|
|
break;
|
|
|
|
|
|
|
|
vma = container_of(node, typeof(*vma), node);
|
|
|
|
|
2016-08-04 15:32:30 +00:00
|
|
|
if (i915_vma_is_pinned(vma)) {
|
|
|
|
if (!vma->exec_entry || i915_vma_pin_count(vma) > 1)
|
2015-12-08 11:55:07 +00:00
|
|
|
/* Object is pinned for some other use */
|
|
|
|
return -EBUSY;
|
|
|
|
|
|
|
|
/* We need to evict a buffer in the same batch */
|
|
|
|
if (vma->exec_entry->flags & EXEC_OBJECT_PINNED)
|
|
|
|
/* Overlapping fixed objects in the same batch */
|
|
|
|
return -EINVAL;
|
|
|
|
|
|
|
|
return -ENOSPC;
|
|
|
|
}
|
|
|
|
|
|
|
|
ret = i915_vma_unbind(vma);
|
|
|
|
if (ret)
|
|
|
|
return ret;
|
|
|
|
}
|
|
|
|
|
|
|
|
return 0;
|
|
|
|
}
|
|
|
|
|
2013-09-11 21:57:50 +00:00
|
|
|
/**
|
2014-01-29 21:07:11 +00:00
|
|
|
* i915_gem_evict_vm - Evict all idle vmas from a vm
|
|
|
|
* @vm: Address space to cleanse
|
2013-09-11 21:57:50 +00:00
|
|
|
* @do_idle: Boolean directing whether to idle first.
|
|
|
|
*
|
2014-01-29 21:07:11 +00:00
|
|
|
* This function evicts all idles vmas from a vm. If all unpinned vmas should be
|
|
|
|
* evicted the @do_idle needs to be set to true.
|
2013-09-11 21:57:50 +00:00
|
|
|
*
|
2014-01-29 21:07:11 +00:00
|
|
|
* This is used by the execbuf code as a last-ditch effort to defragment the
|
|
|
|
* address space.
|
|
|
|
*
|
|
|
|
* To clarify: This is for freeing up virtual address space, not for freeing
|
|
|
|
* memory in e.g. the shrinker.
|
2013-09-11 21:57:50 +00:00
|
|
|
*/
|
|
|
|
int i915_gem_evict_vm(struct i915_address_space *vm, bool do_idle)
|
2013-09-11 21:57:49 +00:00
|
|
|
{
|
|
|
|
struct i915_vma *vma, *next;
|
|
|
|
int ret;
|
|
|
|
|
2014-12-23 17:16:04 +00:00
|
|
|
WARN_ON(!mutex_is_locked(&vm->dev->struct_mutex));
|
2013-09-24 16:57:56 +00:00
|
|
|
trace_i915_gem_evict_vm(vm);
|
|
|
|
|
2013-09-11 21:57:49 +00:00
|
|
|
if (do_idle) {
|
2016-06-24 13:55:57 +00:00
|
|
|
struct drm_i915_private *dev_priv = to_i915(vm->dev);
|
|
|
|
|
2016-06-24 13:55:58 +00:00
|
|
|
if (i915_is_ggtt(vm)) {
|
2016-07-15 13:56:19 +00:00
|
|
|
ret = i915_gem_switch_to_kernel_context(dev_priv);
|
2016-06-24 13:55:58 +00:00
|
|
|
if (ret)
|
|
|
|
return ret;
|
|
|
|
}
|
2016-06-24 13:55:57 +00:00
|
|
|
|
2016-08-05 09:14:11 +00:00
|
|
|
ret = i915_gem_wait_for_idle(dev_priv, true);
|
2013-09-11 21:57:49 +00:00
|
|
|
if (ret)
|
|
|
|
return ret;
|
|
|
|
|
2016-06-24 13:55:57 +00:00
|
|
|
i915_gem_retire_requests(dev_priv);
|
2014-12-23 17:16:04 +00:00
|
|
|
WARN_ON(!list_empty(&vm->active_list));
|
2013-09-11 21:57:49 +00:00
|
|
|
}
|
|
|
|
|
2016-02-26 11:03:19 +00:00
|
|
|
list_for_each_entry_safe(vma, next, &vm->inactive_list, vm_link)
|
2016-08-04 15:32:30 +00:00
|
|
|
if (!i915_vma_is_pinned(vma))
|
2013-09-11 21:57:49 +00:00
|
|
|
WARN_ON(i915_vma_unbind(vma));
|
|
|
|
|
|
|
|
return 0;
|
|
|
|
}
|