[PATCH] drm/ttm: Clear the ghost cpu_writers flag on ttm_buffer_object_transfer.

[PATCH] drm/ttm: Clear the ghost cpu_writers flag on ttm_buffer_object_transfer.

[Francisco Jerez]

It makes sense for a BO to move after a process has requested
exclusive RW access on it (e.g. because the BO used to be located in
unmappable VRAM and we intercepted the CPU access from the fault
handler).

If we let the ghost object inherit cpu_writers from the original
object, ttm_bo_release_list() will raise a kernel BUG when the ghost
object is destroyed. This can be reproduced with the nouveau driver on
nv5x.

Reported-by: Marcin Slusarz <marcin.slusarz@gmail.com>
Signed-off-by: Francisco Jerez <currojerez@riseup.net>
---
 drivers/gpu/drm/ttm/ttm_bo_util.c |    1 +
 1 files changed, 1 insertions(+), 0 deletions(-)

diff --git a/drivers/gpu/drm/ttm/ttm_bo_util.c b/drivers/gpu/drm/ttm/ttm_bo_util.c
index 7cffb3e..3451a82 100644
--- a/drivers/gpu/drm/ttm/ttm_bo_util.c
+++ b/drivers/gpu/drm/ttm/ttm_bo_util.c
@@ -351,6 +351,7 @@ static int ttm_buffer_object_transfer(struct ttm_buffer_object *bo,
 	INIT_LIST_HEAD(&fbo->lru);
 	INIT_LIST_HEAD(&fbo->swap);
 	fbo->vm_node = NULL;
+	atomic_set(&fbo->cpu_writers, 0);
 
 	fbo->sync_obj = driver->sync_obj_ref(bo->sync_obj);
 	kref_init(&fbo->list_kref);
-- 
1.6.4.4

Re: [PATCH] drm/ttm: Clear the ghost cpu_writers flag on ttm_buffer_object_transfer.

[Jerome Glisse]

On Mon, Sep 20, 2010 at 8:15 PM, Francisco Jerez <currojerez@riseup.net> wrote:
> It makes sense for a BO to move after a process has requested
> exclusive RW access on it (e.g. because the BO used to be located in
> unmappable VRAM and we intercepted the CPU access from the fault
> handler).
>
> If we let the ghost object inherit cpu_writers from the original
> object, ttm_bo_release_list() will raise a kernel BUG when the ghost
> object is destroyed. This can be reproduced with the nouveau driver on
> nv5x.
>
> Reported-by: Marcin Slusarz <marcin.slusarz@gmail.com>
> Signed-off-by: Francisco Jerez <currojerez@riseup.net>

Reviewed-by: Jerome Glisse <jglisse@redhat.com>

> ---
>  drivers/gpu/drm/ttm/ttm_bo_util.c |    1 +
>  1 files changed, 1 insertions(+), 0 deletions(-)
>
> diff --git a/drivers/gpu/drm/ttm/ttm_bo_util.c b/drivers/gpu/drm/ttm/ttm_bo_util.c
> index 7cffb3e..3451a82 100644
> --- a/drivers/gpu/drm/ttm/ttm_bo_util.c
> +++ b/drivers/gpu/drm/ttm/ttm_bo_util.c
> @@ -351,6 +351,7 @@ static int ttm_buffer_object_transfer(struct ttm_buffer_object *bo,
>        INIT_LIST_HEAD(&fbo->lru);
>        INIT_LIST_HEAD(&fbo->swap);
>        fbo->vm_node = NULL;
> +       atomic_set(&fbo->cpu_writers, 0);
>
>        fbo->sync_obj = driver->sync_obj_ref(bo->sync_obj);
>        kref_init(&fbo->list_kref);
> --
> 1.6.4.4
>
> _______________________________________________
> dri-devel mailing list
> dri-devel@lists.freedesktop.org
> http://lists.freedesktop.org/mailman/listinfo/dri-devel
>

Re: [PATCH] drm/ttm: Clear the ghost cpu_writers flag on ttm_buffer_object_transfer.

[Marcin Slusarz]

On Tue, Sep 21, 2010 at 02:15:15AM +0200, Francisco Jerez wrote:
> It makes sense for a BO to move after a process has requested
> exclusive RW access on it (e.g. because the BO used to be located in
> unmappable VRAM and we intercepted the CPU access from the fault
> handler).
> 
> If we let the ghost object inherit cpu_writers from the original
> object, ttm_bo_release_list() will raise a kernel BUG when the ghost
> object is destroyed. This can be reproduced with the nouveau driver on
> nv5x.
> 
> Reported-by: Marcin Slusarz <marcin.slusarz@gmail.com>
> Signed-off-by: Francisco Jerez <currojerez@riseup.net>

After few hours of testing, I can say:
Tested-by: Marcin Slusarz <marcin.slusarz@gmail.com>

Thanks,
Marcin