* [PATCH] drm/ttm: fix kref count mess in ttm_bo_move_to_lru_tail
@ 2016-04-20 17:52 ` Alex Deucher
0 siblings, 0 replies; 4+ messages in thread
From: Alex Deucher @ 2016-04-20 17:52 UTC (permalink / raw)
To: dri-devel, thellstrom; +Cc: Alex Deucher, Flora Cui, stable
From: Flora Cui <Flora.Cui@amd.com>
Fixes the following scenario:
1. Page table bo allocated in vram and linked to man->lru.
tbo->list_kref.refcount=2
2. Page table bo is swapped out and removed from man->lru.
tbo->list_kref.refcount=1
3. Command submission from userspace. Page table bo is moved
to vram. ttm_bo_move_to_lru_tail() link it to man->lru and
don't increase the kref count.
Signed-off-by: Flora Cui <Flora.Cui@amd.com>
Reviewed-by: Christian König <christian.koenig@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Cc: stable@vger.kernel.org
---
drivers/gpu/drm/ttm/ttm_bo.c | 17 ++++-------------
1 file changed, 4 insertions(+), 13 deletions(-)
diff --git a/drivers/gpu/drm/ttm/ttm_bo.c b/drivers/gpu/drm/ttm/ttm_bo.c
index 4cbf265..e3daafa 100644
--- a/drivers/gpu/drm/ttm/ttm_bo.c
+++ b/drivers/gpu/drm/ttm/ttm_bo.c
@@ -230,22 +230,13 @@ EXPORT_SYMBOL(ttm_bo_del_sub_from_lru);
void ttm_bo_move_to_lru_tail(struct ttm_buffer_object *bo)
{
- struct ttm_bo_device *bdev = bo->bdev;
- struct ttm_mem_type_manager *man;
+ int put_count = 0;
lockdep_assert_held(&bo->resv->lock.base);
- if (bo->mem.placement & TTM_PL_FLAG_NO_EVICT) {
- list_del_init(&bo->swap);
- list_del_init(&bo->lru);
-
- } else {
- if (bo->ttm && !(bo->ttm->page_flags & TTM_PAGE_FLAG_SG))
- list_move_tail(&bo->swap, &bo->glob->swap_lru);
-
- man = &bdev->man[bo->mem.mem_type];
- list_move_tail(&bo->lru, &man->lru);
- }
+ put_count = ttm_bo_del_from_lru(bo);
+ ttm_bo_list_ref_sub(bo, put_count, true);
+ ttm_bo_add_to_lru(bo);
}
EXPORT_SYMBOL(ttm_bo_move_to_lru_tail);
--
2.5.5
_______________________________________________
dri-devel mailing list
dri-devel@lists.freedesktop.org
https://lists.freedesktop.org/mailman/listinfo/dri-devel
^ permalink raw reply related [flat|nested] 4+ messages in thread
* [PATCH] drm/ttm: fix kref count mess in ttm_bo_move_to_lru_tail
@ 2016-04-20 17:52 ` Alex Deucher
0 siblings, 0 replies; 4+ messages in thread
From: Alex Deucher @ 2016-04-20 17:52 UTC (permalink / raw)
To: dri-devel, thellstrom; +Cc: Flora Cui, Alex Deucher, stable
From: Flora Cui <Flora.Cui@amd.com>
Fixes the following scenario:
1. Page table bo allocated in vram and linked to man->lru.
tbo->list_kref.refcount=2
2. Page table bo is swapped out and removed from man->lru.
tbo->list_kref.refcount=1
3. Command submission from userspace. Page table bo is moved
to vram. ttm_bo_move_to_lru_tail() link it to man->lru and
don't increase the kref count.
Signed-off-by: Flora Cui <Flora.Cui@amd.com>
Reviewed-by: Christian König <christian.koenig@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Cc: stable@vger.kernel.org
---
drivers/gpu/drm/ttm/ttm_bo.c | 17 ++++-------------
1 file changed, 4 insertions(+), 13 deletions(-)
diff --git a/drivers/gpu/drm/ttm/ttm_bo.c b/drivers/gpu/drm/ttm/ttm_bo.c
index 4cbf265..e3daafa 100644
--- a/drivers/gpu/drm/ttm/ttm_bo.c
+++ b/drivers/gpu/drm/ttm/ttm_bo.c
@@ -230,22 +230,13 @@ EXPORT_SYMBOL(ttm_bo_del_sub_from_lru);
void ttm_bo_move_to_lru_tail(struct ttm_buffer_object *bo)
{
- struct ttm_bo_device *bdev = bo->bdev;
- struct ttm_mem_type_manager *man;
+ int put_count = 0;
lockdep_assert_held(&bo->resv->lock.base);
- if (bo->mem.placement & TTM_PL_FLAG_NO_EVICT) {
- list_del_init(&bo->swap);
- list_del_init(&bo->lru);
-
- } else {
- if (bo->ttm && !(bo->ttm->page_flags & TTM_PAGE_FLAG_SG))
- list_move_tail(&bo->swap, &bo->glob->swap_lru);
-
- man = &bdev->man[bo->mem.mem_type];
- list_move_tail(&bo->lru, &man->lru);
- }
+ put_count = ttm_bo_del_from_lru(bo);
+ ttm_bo_list_ref_sub(bo, put_count, true);
+ ttm_bo_add_to_lru(bo);
}
EXPORT_SYMBOL(ttm_bo_move_to_lru_tail);
--
2.5.5
^ permalink raw reply related [flat|nested] 4+ messages in thread
* Re: [PATCH] drm/ttm: fix kref count mess in ttm_bo_move_to_lru_tail
2016-04-20 17:52 ` Alex Deucher
(?)
@ 2016-04-26 4:50 ` Alex Deucher
2016-04-27 15:34 ` Thomas Hellstrom
-1 siblings, 1 reply; 4+ messages in thread
From: Alex Deucher @ 2016-04-26 4:50 UTC (permalink / raw)
To: Maling list - DRI developers, Thomas Hellstrom
Cc: Flora Cui, Alex Deucher, for 3.8
Ping. Any objections?
On Wed, Apr 20, 2016 at 1:52 PM, Alex Deucher <alexdeucher@gmail.com> wrote:
> From: Flora Cui <Flora.Cui@amd.com>
>
> Fixes the following scenario:
>
> 1. Page table bo allocated in vram and linked to man->lru.
> tbo->list_kref.refcount=2
> 2. Page table bo is swapped out and removed from man->lru.
> tbo->list_kref.refcount=1
> 3. Command submission from userspace. Page table bo is moved
> to vram. ttm_bo_move_to_lru_tail() link it to man->lru and
> don't increase the kref count.
>
> Signed-off-by: Flora Cui <Flora.Cui@amd.com>
> Reviewed-by: Christian König <christian.koenig@amd.com>
> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
> Cc: stable@vger.kernel.org
> ---
> drivers/gpu/drm/ttm/ttm_bo.c | 17 ++++-------------
> 1 file changed, 4 insertions(+), 13 deletions(-)
>
> diff --git a/drivers/gpu/drm/ttm/ttm_bo.c b/drivers/gpu/drm/ttm/ttm_bo.c
> index 4cbf265..e3daafa 100644
> --- a/drivers/gpu/drm/ttm/ttm_bo.c
> +++ b/drivers/gpu/drm/ttm/ttm_bo.c
> @@ -230,22 +230,13 @@ EXPORT_SYMBOL(ttm_bo_del_sub_from_lru);
>
> void ttm_bo_move_to_lru_tail(struct ttm_buffer_object *bo)
> {
> - struct ttm_bo_device *bdev = bo->bdev;
> - struct ttm_mem_type_manager *man;
> + int put_count = 0;
>
> lockdep_assert_held(&bo->resv->lock.base);
>
> - if (bo->mem.placement & TTM_PL_FLAG_NO_EVICT) {
> - list_del_init(&bo->swap);
> - list_del_init(&bo->lru);
> -
> - } else {
> - if (bo->ttm && !(bo->ttm->page_flags & TTM_PAGE_FLAG_SG))
> - list_move_tail(&bo->swap, &bo->glob->swap_lru);
> -
> - man = &bdev->man[bo->mem.mem_type];
> - list_move_tail(&bo->lru, &man->lru);
> - }
> + put_count = ttm_bo_del_from_lru(bo);
> + ttm_bo_list_ref_sub(bo, put_count, true);
> + ttm_bo_add_to_lru(bo);
> }
> EXPORT_SYMBOL(ttm_bo_move_to_lru_tail);
>
> --
> 2.5.5
>
^ permalink raw reply [flat|nested] 4+ messages in thread
* Re: [PATCH] drm/ttm: fix kref count mess in ttm_bo_move_to_lru_tail
2016-04-26 4:50 ` Alex Deucher
@ 2016-04-27 15:34 ` Thomas Hellstrom
0 siblings, 0 replies; 4+ messages in thread
From: Thomas Hellstrom @ 2016-04-27 15:34 UTC (permalink / raw)
To: Alex Deucher, Maling list - DRI developers
Cc: Alex Deucher, Flora Cui, for 3.8
LGTM
Reviewed-by: Thomas Hellstrom <thellstrom@vmware.com>
On 04/26/2016 06:50 AM, Alex Deucher wrote:
> Ping. Any objections?
>
>
> On Wed, Apr 20, 2016 at 1:52 PM, Alex Deucher <alexdeucher@gmail.com> wrote:
>> From: Flora Cui <Flora.Cui@amd.com>
>>
>> Fixes the following scenario:
>>
>> 1. Page table bo allocated in vram and linked to man->lru.
>> tbo->list_kref.refcount=2
>> 2. Page table bo is swapped out and removed from man->lru.
>> tbo->list_kref.refcount=1
>> 3. Command submission from userspace. Page table bo is moved
>> to vram. ttm_bo_move_to_lru_tail() link it to man->lru and
>> don't increase the kref count.
>>
>> Signed-off-by: Flora Cui <Flora.Cui@amd.com>
>> Reviewed-by: Christian König <christian.koenig@amd.com>
>> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
>> Cc: stable@vger.kernel.org
>> ---
>> drivers/gpu/drm/ttm/ttm_bo.c | 17 ++++-------------
>> 1 file changed, 4 insertions(+), 13 deletions(-)
>>
>> diff --git a/drivers/gpu/drm/ttm/ttm_bo.c b/drivers/gpu/drm/ttm/ttm_bo.c
>> index 4cbf265..e3daafa 100644
>> --- a/drivers/gpu/drm/ttm/ttm_bo.c
>> +++ b/drivers/gpu/drm/ttm/ttm_bo.c
>> @@ -230,22 +230,13 @@ EXPORT_SYMBOL(ttm_bo_del_sub_from_lru);
>>
>> void ttm_bo_move_to_lru_tail(struct ttm_buffer_object *bo)
>> {
>> - struct ttm_bo_device *bdev = bo->bdev;
>> - struct ttm_mem_type_manager *man;
>> + int put_count = 0;
>>
>> lockdep_assert_held(&bo->resv->lock.base);
>>
>> - if (bo->mem.placement & TTM_PL_FLAG_NO_EVICT) {
>> - list_del_init(&bo->swap);
>> - list_del_init(&bo->lru);
>> -
>> - } else {
>> - if (bo->ttm && !(bo->ttm->page_flags & TTM_PAGE_FLAG_SG))
>> - list_move_tail(&bo->swap, &bo->glob->swap_lru);
>> -
>> - man = &bdev->man[bo->mem.mem_type];
>> - list_move_tail(&bo->lru, &man->lru);
>> - }
>> + put_count = ttm_bo_del_from_lru(bo);
>> + ttm_bo_list_ref_sub(bo, put_count, true);
>> + ttm_bo_add_to_lru(bo);
>> }
>> EXPORT_SYMBOL(ttm_bo_move_to_lru_tail);
>>
>> --
>> 2.5.5
>>
_______________________________________________
dri-devel mailing list
dri-devel@lists.freedesktop.org
https://lists.freedesktop.org/mailman/listinfo/dri-devel
^ permalink raw reply [flat|nested] 4+ messages in thread
end of thread, other threads:[~2016-04-27 15:34 UTC | newest]
Thread overview: 4+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2016-04-20 17:52 [PATCH] drm/ttm: fix kref count mess in ttm_bo_move_to_lru_tail Alex Deucher
2016-04-20 17:52 ` Alex Deucher
2016-04-26 4:50 ` Alex Deucher
2016-04-27 15:34 ` Thomas Hellstrom
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.