On Thu, Oct 25, 2007 at 03:37:32PM +0400, pluknet wrote:> Hi all.
>
> I am getting the following LOR on my 7.0-BETA1:
>
> lock order reversal: (sleepable after non-sleepable)
> 1st 0xc3c904d8 drm device (drm device) @
/media/src/sys/modules/drm/drm/../../..
> /dev/drm/drm_drv.c:907
> 2nd 0xc4135a3c user map (user map) @ vm/vm_glue.c:183
> KDB: stack backtrace:
> db_trace_self_wrapper(c076f2df,e6716a74,c055fcd6,c077168b,c4135a3c,...) at
db_tr
> ace_self_wrapper+0x26
> kdb_backtrace(c077168b,c4135a3c,c078accb,c078accb,c078a7e6,...) at
kdb_backtrace
> +0x29
> witness_checkorder(c4135a3c,9,c078a7dd,b7,c4135a3c,...) at
witness_checkorder+0x
> 6d6
> _sx_xlock(c4135a3c,0,c078a7dd,b7,e6716ad8,...) at _sx_xlock+0x7d
> _vm_map_lock_read(c41359f8,c078a7dd,b7,c078ac64,8,...) at
_vm_map_lock_read+0x50
> useracc(28aab980,8,1,1,c076b1ec,...) at useracc+0x65
> i915_cmdbuffer(c4147100,8018644b,c52e8180,3,c492dc60,...) at
i915_cmdbuffer+0x56
> 3
> drm_ioctl(c4147100,8018644b,c52e8180,3,c492dc60,...) at drm_ioctl+0x384
> giant_ioctl(c4147100,8018644b,c52e8180,3,c492dc60,...) at giant_ioctl+0x56
> devfs_ioctl_f(c5c146c0,8018644b,c52e8180,c5536500,c492dc60,...) at
devfs_ioctl_f
> +0xd5
> kern_ioctl(c492dc60,5,8018644b,c52e8180,c52e8180,...) at kern_ioctl+0x253
> ioctl(c492dc60,e6716cfc,c,e6716d38,c07a92d0,...) at ioctl+0x13f
> syscall(e6716d38) at syscall+0x2f3
> Xint0x80_syscall() at Xint0x80_syscall+0x20
> --- syscall (54, FreeBSD ELF32, ioctl), eip = 0x28698a53, esp = 0xbf6f6c9c,
ebp
> = 0xbf6f6cb8 ---
>
> It is first observed after update to 7.0-BETA1 (from CURRENT of Oct 11)
> $ ident /media/src/sys/dev/drm/drm_drv.c
> /media/src/sys/dev/drm/drm_drv.c:
> $FreeBSD: src/sys/dev/drm/drm_drv.c,v 1.6 2006/09/07 23:04:47 anholt
Exp $
> $ ident /media/src/sys/vm/vm_glue.c
> /media/src/sys/vm/vm_glue.c:
> $FreeBSD: src/sys/vm/vm_glue.c,v 1.225 2007/09/21 05:07:07 jeff Exp $
>
> Note that drm is kldloadable and is not statically compiled in a kernel.
> Thanks.
The folowing patch should fix it. I tried to get review by Eric, but failed.
diff --git a/sys/dev/drm/i915_dma.c b/sys/dev/drm/i915_dma.c
index 16955bd..69854b4 100644
--- a/sys/dev/drm/i915_dma.c
+++ b/sys/dev/drm/i915_dma.c
@@ -366,20 +366,14 @@ static int i915_emit_cmds(drm_device_t * dev, int __user *
buffer, int dwords)
for (i = 0; i < dwords;) {
int cmd, sz;
- if (DRM_COPY_FROM_USER_UNCHECKED(&cmd, &buffer[i], sizeof(cmd)))
{
-
- return DRM_ERR(EINVAL);
- }
+ cmd = buffer[i];
if ((sz = validate_cmd(cmd)) == 0 || i + sz > dwords)
return DRM_ERR(EINVAL);
OUT_RING(cmd);
while (++i, --sz) {
- if (DRM_COPY_FROM_USER_UNCHECKED(&cmd, &buffer[i],
- sizeof(cmd))) {
- return DRM_ERR(EINVAL);
- }
+ cmd = buffer[i];
OUT_RING(cmd);
}
}
@@ -400,10 +394,7 @@ static int i915_emit_box(drm_device_t * dev,
drm_clip_rect_t box;
RING_LOCALS;
- if (DRM_COPY_FROM_USER_UNCHECKED(&box, &boxes[i], sizeof(box))) {
- return EFAULT;
- }
-
+ box = boxes[i];
if (box.y2 <= box.y1 || box.x2 <= box.x1 || box.y2 <= 0 || box.x2
<= 0) {
DRM_ERROR("Bad box %d,%d..%d,%d\n",
box.x1, box.y1, box.x2, box.y2);
@@ -603,6 +594,7 @@ static int i915_batchbuffer(DRM_IOCTL_ARGS)
drm_i915_sarea_t *sarea_priv = (drm_i915_sarea_t *)
dev_priv->sarea_priv;
drm_i915_batchbuffer_t batch;
+ size_t cliplen;
int ret;
if (!dev_priv->allow_batchbuffer) {
@@ -618,14 +610,25 @@ static int i915_batchbuffer(DRM_IOCTL_ARGS)
LOCK_TEST_WITH_RETURN(dev, filp);
+ DRM_UNLOCK();
+ cliplen = batch.num_cliprects * sizeof(drm_clip_rect_t);
if (batch.num_cliprects && DRM_VERIFYAREA_READ(batch.cliprects,
- batch.num_cliprects *
- sizeof(drm_clip_rect_t)))
+ cliplen)) {
+ DRM_LOCK();
return DRM_ERR(EFAULT);
-
+ }
+ ret = vslock(batch.cliprects, cliplen);
+ if (ret) {
+ DRM_ERROR("Fault wiring cliprects\n");
+ DRM_LOCK();
+ return DRM_ERR(EFAULT);
+ }
+ DRM_LOCK();
ret = i915_dispatch_batchbuffer(dev, &batch);
-
sarea_priv->last_dispatch = (int)hw_status[5];
+ DRM_UNLOCK();
+ vsunlock(batch.cliprects, cliplen);
+ DRM_LOCK();
return ret;
}
@@ -637,6 +640,7 @@ static int i915_cmdbuffer(DRM_IOCTL_ARGS)
drm_i915_sarea_t *sarea_priv = (drm_i915_sarea_t *)
dev_priv->sarea_priv;
drm_i915_cmdbuffer_t cmdbuf;
+ size_t cliplen;
int ret;
DRM_COPY_FROM_USER_IOCTL(cmdbuf, (drm_i915_cmdbuffer_t __user *) data,
@@ -647,22 +651,38 @@ static int i915_cmdbuffer(DRM_IOCTL_ARGS)
LOCK_TEST_WITH_RETURN(dev, filp);
+ DRM_UNLOCK();
+ cliplen = cmdbuf.num_cliprects * sizeof(drm_clip_rect_t);
if (cmdbuf.num_cliprects &&
- DRM_VERIFYAREA_READ(cmdbuf.cliprects,
- cmdbuf.num_cliprects *
- sizeof(drm_clip_rect_t))) {
+ DRM_VERIFYAREA_READ(cmdbuf.cliprects, cliplen)) {
DRM_ERROR("Fault accessing cliprects\n");
+ DRM_LOCK();
return DRM_ERR(EFAULT);
}
-
- ret = i915_dispatch_cmdbuffer(dev, &cmdbuf);
+ ret = vslock(cmdbuf.cliprects, cliplen);
if (ret) {
- DRM_ERROR("i915_dispatch_cmdbuffer failed\n");
- return ret;
+ DRM_ERROR("Fault wiring cliprects\n");
+ DRM_LOCK();
+ return DRM_ERR(EFAULT);
}
-
- sarea_priv->last_dispatch = (int)hw_status[5];
- return 0;
+ ret = vslock(cmdbuf.buf, cmdbuf.sz);
+ if (ret) {
+ vsunlock(cmdbuf.cliprects, cliplen);
+ DRM_ERROR("Fault wiring cmds\n");
+ DRM_LOCK();
+ return DRM_ERR(EFAULT);
+ }
+ DRM_LOCK();
+ ret = i915_dispatch_cmdbuffer(dev, &cmdbuf);
+ if (ret == 0)
+ sarea_priv->last_dispatch = (int)hw_status[5];
+ else
+ DRM_ERROR("i915_dispatch_cmdbuffer failed\n");
+ DRM_UNLOCK();
+ vsunlock(cmdbuf.buf, cmdbuf.sz);
+ vsunlock(cmdbuf.cliprects, cliplen);
+ DRM_LOCK();
+ return (ret);
}
static int i915_do_cleanup_pageflip(drm_device_t * dev)
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 187 bytes
Desc: not available
Url :
http://lists.freebsd.org/pipermail/freebsd-stable/attachments/20071025/bc9b9393/attachment.pgp