From patchwork Tue Sep 13 13:46:48 2011 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Seth Forshee X-Patchwork-Id: 114495 Return-Path: X-Original-To: incoming@patchwork.ozlabs.org Delivered-To: patchwork-incoming@bilbo.ozlabs.org Received: from chlorine.canonical.com (chlorine.canonical.com [91.189.94.204]) by ozlabs.org (Postfix) with ESMTP id 715AFB71C2 for ; Tue, 13 Sep 2011 23:47:39 +1000 (EST) Received: from localhost ([127.0.0.1] helo=chlorine.canonical.com) by chlorine.canonical.com with esmtp (Exim 4.71) (envelope-from ) id 1R3TKO-0000PS-Uh; Tue, 13 Sep 2011 13:47:08 +0000 Received: from youngberry.canonical.com ([91.189.89.112]) by chlorine.canonical.com with esmtp (Exim 4.71) (envelope-from ) id 1R3TKI-0000Gt-1r for kernel-team@lists.ubuntu.com; Tue, 13 Sep 2011 13:47:02 +0000 Received: from c-69-254-227-224.hsd1.ks.comcast.net ([69.254.227.224] helo=canonical.com) by youngberry.canonical.com with esmtpsa (TLS1.0:DHE_RSA_AES_128_CBC_SHA1:16) (Exim 4.71) (envelope-from ) id 1R3TKH-0006HZ-Kd for kernel-team@lists.ubuntu.com; Tue, 13 Sep 2011 13:47:02 +0000 From: Seth Forshee To: kernel-team@lists.ubuntu.com Subject: [PATCH 1/2][Lucid SRU] drm/i915: Hold a reference to the object whilst unbinding the eviction list Date: Tue, 13 Sep 2011 08:46:48 -0500 Message-Id: <1315921609-8875-2-git-send-email-seth.forshee@canonical.com> X-Mailer: git-send-email 1.7.4.1 In-Reply-To: <1315921609-8875-1-git-send-email-seth.forshee@canonical.com> References: <1315921609-8875-1-git-send-email-seth.forshee@canonical.com> X-BeenThere: kernel-team@lists.ubuntu.com X-Mailman-Version: 2.1.13 Precedence: list List-Id: Kernel team discussions List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , MIME-Version: 1.0 Sender: kernel-team-bounces@lists.ubuntu.com Errors-To: kernel-team-bounces@lists.ubuntu.com From: Chris Wilson BugLink: http://bugs.launchpad.net/bugs/843904 During heavy aperture thrashing we may be forced to wait upon several active objects during eviction. The active list may be the last reference to these objects and so the action of waiting upon one of them may cause another to be freed (and itself unbound). To prevent the object disappearing underneath us, we need to acquire and hold a reference whilst unbinding. This should fix the reported page refcount OOPS: kernel BUG at drivers/gpu/drm/i915/i915_gem.c:1444! ... RIP: 0010:[] [] i915_gem_object_put_pages+0x25/0xf5 [i915] Call Trace: [] i915_gem_object_unbind+0xc5/0x1a7 [i915] [] i915_gem_evict_something+0x3bd/0x409 [i915] [] ? drm_gem_object_lookup+0x27/0x57 [drm] [] i915_gem_object_bind_to_gtt+0x1d3/0x279 [i915] [] i915_gem_object_pin+0xa3/0x146 [i915] [] ? drm_gem_object_lookup+0x4c/0x57 [drm] [] i915_gem_do_execbuffer+0x50d/0xe32 [i915] Reported-by: Shawn Starr Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=18902 Signed-off-by: Chris Wilson (backported from commit af6261031317f646d22f994c0b467521e47aa49f upstream) Signed-off-by: Seth Forshee --- drivers/gpu/drm/i915/i915_gem_evict.c | 4 ++++ 1 files changed, 4 insertions(+), 0 deletions(-) diff --git a/drivers/gpu/drm/i915/i915_gem_evict.c b/drivers/gpu/drm/i915/i915_gem_evict.c index c4c6b6f..c50c093 100644 --- a/drivers/gpu/drm/i915/i915_gem_evict.c +++ b/drivers/gpu/drm/i915/i915_gem_evict.c @@ -52,6 +52,7 @@ mark_free(struct drm_i915_gem_object *obj_priv, struct list_head *unwind) { list_add(&obj_priv->evict_list, unwind); + drm_gem_object_reference(obj_priv->obj); return drm_mm_scan_add_block(obj_priv->gtt_space); } @@ -143,6 +144,7 @@ i915_gem_evict_something(struct drm_device *dev, int min_size, unsigned alignmen BUG_ON(ret); list_del_init(&obj_priv->evict_list); + drm_gem_object_unreference(obj_priv->obj); } /* We expect the caller to unpin, evict all and try again, or give up. @@ -162,6 +164,7 @@ found: continue; } list_del_init(&obj_priv->evict_list); + drm_gem_object_unreference(obj_priv->obj); } /* Unbinding will emit any required flushes */ @@ -173,6 +176,7 @@ found: ret = i915_gem_object_unbind(obj_priv->obj); list_del_init(&obj_priv->evict_list); + drm_gem_object_unreference(obj_priv->obj); } return 0;