MIRRORS/linux-imx
1
0
Fork 0
mirror of https://github.com/nxp-imx/linux-imx.git synced 2026-05-15 19:30:13 +02:00
Code Issues Actions Packages Projects Releases Wiki Activity
git.kernel.org/linux-stable/linux-rolling-lts
linux-imx/include/drm/ttm
History
Jason Gunthorpe 71fb40ae9b drm/ttm: remove ttm_bo_vm_insert_huge() 
[ Upstream commit 0d97950953 ]

The huge page functionality in TTM does not work safely because PUD and
PMD entries do not have a special bit.

get_user_pages_fast() considers any page that passed pmd_huge() as
usable:

	if (unlikely(pmd_trans_huge(pmd) || pmd_huge(pmd) ||
		     pmd_devmap(pmd))) {

And vmf_insert_pfn_pmd_prot() unconditionally sets

	entry = pmd_mkhuge(pfn_t_pmd(pfn, prot));

eg on x86 the page will be _PAGE_PRESENT | PAGE_PSE.

As such gup_huge_pmd() will try to deref a struct page:

	head = try_grab_compound_head(pmd_page(orig), refs, flags);

and thus crash.

Thomas further notices that the drivers are not expecting the struct page
to be used by anything - in particular the refcount incr above will cause
them to malfunction.

Thus everything about this is not able to fully work correctly considering
GUP_fast. Delete it entirely. It can return someday along with a proper
PMD/PUD_SPECIAL bit in the page table itself to gate GUP_fast.

Fixes: 314b6580ad ("drm/ttm, drm/vmwgfx: Support huge TTM pagefaults")
Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
Reviewed-by: Thomas Hellström <thomas.helllstrom@linux.intel.com>
Reviewed-by: Christian König <christian.koenig@amd.com>
[danvet: Update subject per Thomas' &Christian's review]
Signed-off-by: Daniel Vetter <daniel.vetter@ffwll.ch>
Link: https://patchwork.freedesktop.org/patch/msgid/0-v2-a44694790652+4ac-ttm_pmd_jgg@nvidia.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
2021-11-18 19:17:08 +01:00
..
ttm_bo_api.h drm/ttm: remove ttm_bo_vm_insert_huge() 2021-11-18 19:17:08 +01:00
ttm_bo_driver.h drm/ttm: Add a generic TTM memcpy move for page-based iomem 2021-06-07 16:07:08 +02:00
ttm_caching.h drm/ttm: Add a generic TTM memcpy move for page-based iomem 2021-06-07 16:07:08 +02:00
ttm_device.h drm/ttm: Remove ttm_bo_mmap() and friends 2021-05-26 20:56:56 +02:00
ttm_execbuf_util.h drm/ttm: remove superflous extern attribute from funcs 2020-09-17 16:14:42 +02:00
ttm_kmap_iter.h drm/ttm: Add a generic TTM memcpy move for page-based iomem 2021-06-07 16:07:08 +02:00
ttm_placement.h drm/ttm: add TTM_PL_FLAG_TEMPORARY flag v3 2021-06-23 14:59:39 -04:00
ttm_pool.h drm/ttm: new TT backend allocation pool v3 2020-10-29 15:52:51 +01:00
ttm_range_manager.h drm/ttm: flip the switch for driver allocated resources v2 2021-06-04 15:16:46 +02:00
ttm_resource.h drm/ttm: Add a generic TTM memcpy move for page-based iomem 2021-06-07 16:07:08 +02:00
ttm_tt.h drm/ttm: Include pagemap.h from ttm_tt.h 2021-08-16 14:44:05 +02:00