When using a GTT mapping as a source or destination for the pwrite or
pread command respectively, unless the PTEs for the GTT vma had been
prepopulated then get_user_pages() would fail with EFAULT. Usually, we
only write small amounts of data with pwrite that happened to be
conveniently prefaulted by the 2-page fault_in_pages_readable. By
prefaulting all pages before we take the struct mutex, we avoid this
issue, can stay in the fast path longer and reduce the likelihood of a
recursive deadlock.

"Fixes" gem_mmap_gtt.

References: https://bugs.freedesktop.org/show_bug.cgi?id=38115
Signed-off-by: Chris Wilson <ch...@chris-wilson.co.uk>
---
 drivers/gpu/drm/i915/i915_gem.c |   34 ++++++++++++++++++++++++++++++----
 1 files changed, 30 insertions(+), 4 deletions(-)

diff --git a/drivers/gpu/drm/i915/i915_gem.c b/drivers/gpu/drm/i915/i915_gem.c
index 4fc9738..2fce620 100644
--- a/drivers/gpu/drm/i915/i915_gem.c
+++ b/drivers/gpu/drm/i915/i915_gem.c
@@ -503,6 +503,19 @@ out:
        return ret;
 }
 
+static int prefault_writeable(unsigned long uaddr, unsigned long len)
+{
+       int ret = 0;
+
+       len += uaddr;
+       while (uaddr < len) {
+               ret |= __put_user(0, (char __user *)uaddr);
+               uaddr += 4096;
+       }
+
+       return ret ? -EFAULT : 0;
+}
+
 /**
  * Reads data from the object referenced by handle.
  *
@@ -524,8 +537,7 @@ i915_gem_pread_ioctl(struct drm_device *dev, void *data,
                       args->size))
                return -EFAULT;
 
-       ret = fault_in_pages_writeable((char __user *)(uintptr_t)args->data_ptr,
-                                      args->size);
+       ret = prefault_writeable(args->data_ptr, args->size);
        if (ret)
                return -EFAULT;
 
@@ -943,6 +955,21 @@ out:
        return ret;
 }
 
+static int prefault_readable(unsigned long uaddr, unsigned long len)
+{
+       volatile char c;
+       int ret = 0;
+
+       len += uaddr;
+       while (uaddr < len) {
+               ret |= __get_user(c, (const char __user *)uaddr);
+               uaddr += 4096;
+       }
+
+       return ret ? -EFAULT : 0;
+       (void)c;
+}
+
 /**
  * Writes data to the object referenced by handle.
  *
@@ -964,8 +991,7 @@ i915_gem_pwrite_ioctl(struct drm_device *dev, void *data,
                       args->size))
                return -EFAULT;
 
-       ret = fault_in_pages_readable((char __user *)(uintptr_t)args->data_ptr,
-                                     args->size);
+       ret = prefault_readable(args->data_ptr, args->size);
        if (ret)
                return -EFAULT;
 
-- 
1.7.5.4

_______________________________________________
Intel-gfx mailing list
Intel-gfx@lists.freedesktop.org
http://lists.freedesktop.org/mailman/listinfo/intel-gfx

Reply via email to