From b8ff7357da45e025c446fe0479612215fe56a249 Mon Sep 17 00:00:00 2001 From: Dave Airlie Date: Tue, 15 Dec 2009 08:07:12 +1000 Subject: drm/ttm: fix incorrect logic in ttm_bo_io path This path isn't used by radeon yet, but future drivers will want it, so fix it right. Reported-by: Luca Barbieri Signed-off-by: Dave Airlie --- drivers/gpu/drm/ttm/ttm_bo_vm.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) (limited to 'drivers/gpu/drm/ttm') diff --git a/drivers/gpu/drm/ttm/ttm_bo_vm.c b/drivers/gpu/drm/ttm/ttm_bo_vm.c index 609a85a4d855..668dbe8b8dd3 100644 --- a/drivers/gpu/drm/ttm/ttm_bo_vm.c +++ b/drivers/gpu/drm/ttm/ttm_bo_vm.c @@ -320,7 +320,7 @@ ssize_t ttm_bo_io(struct ttm_bo_device *bdev, struct file *filp, return -EFAULT; driver = bo->bdev->driver; - if (unlikely(driver->verify_access)) { + if (unlikely(!driver->verify_access)) { ret = -EPERM; goto out_unref; } -- cgit v1.2.2 From b663752627e7c6b4bc414684d71c6adce5719fce Mon Sep 17 00:00:00 2001 From: Dave Airlie Date: Mon, 14 Dec 2009 14:51:35 +1000 Subject: drm/ttm: fix two bugs in new placement routines. a) the loops were going to <= not <, leading to illegal memory access b) the busy placement checks were using the placement arrays not the busy placement ones. Acked-by: Jerome Glisse Signed-off-by: Dave Airlie --- drivers/gpu/drm/ttm/ttm_bo.c | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) (limited to 'drivers/gpu/drm/ttm') diff --git a/drivers/gpu/drm/ttm/ttm_bo.c b/drivers/gpu/drm/ttm/ttm_bo.c index 1fbb2eea5e88..4cd4007e68fa 100644 --- a/drivers/gpu/drm/ttm/ttm_bo.c +++ b/drivers/gpu/drm/ttm/ttm_bo.c @@ -849,7 +849,7 @@ int ttm_bo_mem_space(struct ttm_buffer_object *bo, int i, ret; mem->mm_node = NULL; - for (i = 0; i <= placement->num_placement; ++i) { + for (i = 0; i < placement->num_placement; ++i) { ret = ttm_mem_type_from_flags(placement->placement[i], &mem_type); if (ret) @@ -900,8 +900,8 @@ int ttm_bo_mem_space(struct ttm_buffer_object *bo, if (!type_found) return -EINVAL; - for (i = 0; i <= placement->num_busy_placement; ++i) { - ret = ttm_mem_type_from_flags(placement->placement[i], + for (i = 0; i < placement->num_busy_placement; ++i) { + ret = ttm_mem_type_from_flags(placement->busy_placement[i], &mem_type); if (ret) return ret; @@ -911,7 +911,7 @@ int ttm_bo_mem_space(struct ttm_buffer_object *bo, if (!ttm_bo_mt_compatible(man, bo->type == ttm_bo_type_user, mem_type, - placement->placement[i], + placement->busy_placement[i], &cur_flags)) continue; @@ -921,7 +921,7 @@ int ttm_bo_mem_space(struct ttm_buffer_object *bo, * Use the access and other non-mapping-related flag bits from * the memory placement flags to the current flags */ - ttm_flag_masked(&cur_flags, placement->placement[i], + ttm_flag_masked(&cur_flags, placement->busy_placement[i], ~TTM_PL_MASK_MEMTYPE); ret = ttm_bo_mem_force_space(bo, mem_type, placement, mem, -- cgit v1.2.2 From aaa207369436d04bb85382ddbb688a5b9461fd21 Mon Sep 17 00:00:00 2001 From: Thomas Hellstrom Date: Wed, 2 Dec 2009 18:33:45 +0100 Subject: drm/ttm: Delayed delete fixes. 1) Remove from lru before reserving so we avoid competing with evicting processes. 2) Avoid calling kref_put() on bo::list_kref while spinlocked. 3) Additional refcounting bug-checking. Signed-off-by: Thomas Hellstrom Signed-off-by: Dave Airlie --- drivers/gpu/drm/ttm/ttm_bo.c | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) (limited to 'drivers/gpu/drm/ttm') diff --git a/drivers/gpu/drm/ttm/ttm_bo.c b/drivers/gpu/drm/ttm/ttm_bo.c index 4cd4007e68fa..7927fe99d017 100644 --- a/drivers/gpu/drm/ttm/ttm_bo.c +++ b/drivers/gpu/drm/ttm/ttm_bo.c @@ -465,6 +465,8 @@ static int ttm_bo_cleanup_refs(struct ttm_buffer_object *bo, bool remove_all) spin_unlock(&bo->lock); spin_lock(&glob->lru_lock); + put_count = ttm_bo_del_from_lru(bo); + ret = ttm_bo_reserve_locked(bo, false, false, false, 0); BUG_ON(ret); if (bo->ttm) @@ -472,20 +474,19 @@ static int ttm_bo_cleanup_refs(struct ttm_buffer_object *bo, bool remove_all) if (!list_empty(&bo->ddestroy)) { list_del_init(&bo->ddestroy); - kref_put(&bo->list_kref, ttm_bo_ref_bug); + ++put_count; } if (bo->mem.mm_node) { bo->mem.mm_node->private = NULL; drm_mm_put_block(bo->mem.mm_node); bo->mem.mm_node = NULL; } - put_count = ttm_bo_del_from_lru(bo); spin_unlock(&glob->lru_lock); atomic_set(&bo->reserved, 0); while (put_count--) - kref_put(&bo->list_kref, ttm_bo_release_list); + kref_put(&bo->list_kref, ttm_bo_ref_bug); return 0; } -- cgit v1.2.2 From 9c51ba1db37cab780f38b2210913959f22d7b830 Mon Sep 17 00:00:00 2001 From: Thomas Hellstrom Date: Wed, 2 Dec 2009 18:33:46 +0100 Subject: drm/ttm: Fix potential ttm_mem_evict_first races. 1) The function was previously called with a potentially empty LRU list which would have lead to an OOPS or servere corruption. 2) In rare cases, after reservation has succeeded, another process may already have evicted it or even pinned it. We must revalidate the buffer status after releasing the lru lock. Signed-off-by: Thomas Hellstrom Signed-off-by: Dave Airlie --- drivers/gpu/drm/ttm/ttm_bo.c | 36 +++++++++++++++++++++++++++++++----- 1 file changed, 31 insertions(+), 5 deletions(-) (limited to 'drivers/gpu/drm/ttm') diff --git a/drivers/gpu/drm/ttm/ttm_bo.c b/drivers/gpu/drm/ttm/ttm_bo.c index 7927fe99d017..826240d4d675 100644 --- a/drivers/gpu/drm/ttm/ttm_bo.c +++ b/drivers/gpu/drm/ttm/ttm_bo.c @@ -685,19 +685,45 @@ static int ttm_mem_evict_first(struct ttm_bo_device *bdev, struct ttm_buffer_object *bo; int ret, put_count = 0; +retry: spin_lock(&glob->lru_lock); + if (list_empty(&man->lru)) { + spin_unlock(&glob->lru_lock); + return -EBUSY; + } + bo = list_first_entry(&man->lru, struct ttm_buffer_object, lru); kref_get(&bo->list_kref); - ret = ttm_bo_reserve_locked(bo, interruptible, no_wait, false, 0); - if (likely(ret == 0)) - put_count = ttm_bo_del_from_lru(bo); + + ret = ttm_bo_reserve_locked(bo, false, true, false, 0); + + if (unlikely(ret == -EBUSY)) { + spin_unlock(&glob->lru_lock); + if (likely(!no_wait)) + ret = ttm_bo_wait_unreserved(bo, interruptible); + + kref_put(&bo->list_kref, ttm_bo_release_list); + + /** + * We *need* to retry after releasing the lru lock. + */ + + if (unlikely(ret != 0)) + return ret; + goto retry; + } + + put_count = ttm_bo_del_from_lru(bo); spin_unlock(&glob->lru_lock); - if (unlikely(ret != 0)) - return ret; + + BUG_ON(ret != 0); + while (put_count--) kref_put(&bo->list_kref, ttm_bo_ref_bug); + ret = ttm_bo_evict(bo, interruptible, no_wait); ttm_bo_unreserve(bo); + kref_put(&bo->list_kref, ttm_bo_release_list); return ret; } -- cgit v1.2.2 From eb6d2c39dbe46ea1c4f3da4eac5728c73f109ea1 Mon Sep 17 00:00:00 2001 From: Jerome Glisse Date: Thu, 10 Dec 2009 16:15:52 +0100 Subject: drm/ttm: Fix printk format & compute bo->mem.size at bo initialization Signed-off-by: Jerome Glisse Signed-off-by: Dave Airlie --- drivers/gpu/drm/ttm/ttm_bo.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) (limited to 'drivers/gpu/drm/ttm') diff --git a/drivers/gpu/drm/ttm/ttm_bo.c b/drivers/gpu/drm/ttm/ttm_bo.c index 826240d4d675..e00ed6942067 100644 --- a/drivers/gpu/drm/ttm/ttm_bo.c +++ b/drivers/gpu/drm/ttm/ttm_bo.c @@ -80,7 +80,7 @@ static void ttm_mem_type_manager_debug(struct ttm_bo_global *glob, printk(KERN_ERR TTM_PFX " gpu_offset: 0x%08lX\n", man->gpu_offset); printk(KERN_ERR TTM_PFX " io_offset: 0x%08lX\n", man->io_offset); printk(KERN_ERR TTM_PFX " io_size: %ld\n", man->io_size); - printk(KERN_ERR TTM_PFX " size: %ld\n", (unsigned long)man->size); + printk(KERN_ERR TTM_PFX " size: %llu\n", man->size); printk(KERN_ERR TTM_PFX " available_caching: 0x%08X\n", man->available_caching); printk(KERN_ERR TTM_PFX " default_caching: 0x%08X\n", @@ -98,7 +98,7 @@ static void ttm_bo_mem_space_debug(struct ttm_buffer_object *bo, struct ttm_mem_type_manager *man; int i, ret, mem_type; - printk(KERN_ERR TTM_PFX "No space for %p (%ld pages, %ldK, %ldM)\n", + printk(KERN_ERR TTM_PFX "No space for %p (%lu pages, %luK, %luM)\n", bo, bo->mem.num_pages, bo->mem.size >> 10, bo->mem.size >> 20); for (i = 0; i < placement->num_placement; i++) { @@ -1142,6 +1142,7 @@ int ttm_bo_init(struct ttm_bo_device *bdev, bo->glob = bdev->glob; bo->type = type; bo->num_pages = num_pages; + bo->mem.size = num_pages << PAGE_SHIFT; bo->mem.mem_type = TTM_PL_SYSTEM; bo->mem.num_pages = bo->num_pages; bo->mem.mm_node = NULL; -- cgit v1.2.2 From 5012f5063f41ca01240e5983c3b2cceb9aafc7a4 Mon Sep 17 00:00:00 2001 From: Jerome Glisse Date: Thu, 10 Dec 2009 18:07:26 +0100 Subject: drm/ttm: Fix memory type manager debug information printing System memory type doesn't have a drm_mm manager associated to it. This patch avoid trying to call drm_mm_debug on unitialized drm_mm when printing debug info on the system memory manager. Signed-off-by: Jerome Glisse Signed-off-by: Dave Airlie --- drivers/gpu/drm/ttm/ttm_bo.c | 19 +++++++++---------- 1 file changed, 9 insertions(+), 10 deletions(-) (limited to 'drivers/gpu/drm/ttm') diff --git a/drivers/gpu/drm/ttm/ttm_bo.c b/drivers/gpu/drm/ttm/ttm_bo.c index e00ed6942067..2920f9a279e1 100644 --- a/drivers/gpu/drm/ttm/ttm_bo.c +++ b/drivers/gpu/drm/ttm/ttm_bo.c @@ -71,9 +71,10 @@ static inline int ttm_mem_type_from_flags(uint32_t flags, uint32_t *mem_type) return -EINVAL; } -static void ttm_mem_type_manager_debug(struct ttm_bo_global *glob, - struct ttm_mem_type_manager *man) +static void ttm_mem_type_debug(struct ttm_bo_device *bdev, int mem_type) { + struct ttm_mem_type_manager *man = &bdev->man[mem_type]; + printk(KERN_ERR TTM_PFX " has_type: %d\n", man->has_type); printk(KERN_ERR TTM_PFX " use_type: %d\n", man->use_type); printk(KERN_ERR TTM_PFX " flags: 0x%08X\n", man->flags); @@ -85,17 +86,16 @@ static void ttm_mem_type_manager_debug(struct ttm_bo_global *glob, man->available_caching); printk(KERN_ERR TTM_PFX " default_caching: 0x%08X\n", man->default_caching); - spin_lock(&glob->lru_lock); - drm_mm_debug_table(&man->manager, TTM_PFX); - spin_unlock(&glob->lru_lock); + if (mem_type != TTM_PL_SYSTEM) { + spin_lock(&bdev->glob->lru_lock); + drm_mm_debug_table(&man->manager, TTM_PFX); + spin_unlock(&bdev->glob->lru_lock); + } } static void ttm_bo_mem_space_debug(struct ttm_buffer_object *bo, struct ttm_placement *placement) { - struct ttm_bo_device *bdev = bo->bdev; - struct ttm_bo_global *glob = bo->glob; - struct ttm_mem_type_manager *man; int i, ret, mem_type; printk(KERN_ERR TTM_PFX "No space for %p (%lu pages, %luK, %luM)\n", @@ -106,10 +106,9 @@ static void ttm_bo_mem_space_debug(struct ttm_buffer_object *bo, &mem_type); if (ret) return; - man = &bdev->man[mem_type]; printk(KERN_ERR TTM_PFX " placement[%d]=0x%08X (%d)\n", i, placement->placement[i], mem_type); - ttm_mem_type_manager_debug(glob, man); + ttm_mem_type_debug(bo->bdev, mem_type); } } -- cgit v1.2.2