Skip to content

Commit 2f90ec1

Browse files
airliedairlied
committed
Merge tag 'drm-misc-fixes-2022-06-16' of git://anongit.freedesktop.org/drm/drm-misc into drm-fixes
Two fixes for TTM, one for a NULL pointer dereference and one to make sure the buffer is pinned prior to a bulk move, and a fix for a spurious compiler warning. Signed-off-by: Dave Airlie <airlied@redhat.com> From: Maxime Ripard <maxime@cerno.tech> Link: https://patchwork.freedesktop.org/patch/msgid/20220616072519.qwrsefsemejefowu@houat
2 parents b13bacc + 0f9cd1e commit 2f90ec1

5 files changed

Lines changed: 60 additions & 29 deletions

File tree

‎drivers/gpu/drm/ttm/ttm_bo.c‎

Lines changed: 14 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -109,11 +109,11 @@ void ttm_bo_set_bulk_move(struct ttm_buffer_object *bo,
109109
return;
110110

111111
spin_lock(&bo->bdev->lru_lock);
112-
if (bo->bulk_move && bo->resource)
113-
ttm_lru_bulk_move_del(bo->bulk_move, bo->resource);
112+
if (bo->resource)
113+
ttm_resource_del_bulk_move(bo->resource, bo);
114114
bo->bulk_move = bulk;
115-
if (bo->bulk_move && bo->resource)
116-
ttm_lru_bulk_move_add(bo->bulk_move, bo->resource);
115+
if (bo->resource)
116+
ttm_resource_add_bulk_move(bo->resource, bo);
117117
spin_unlock(&bo->bdev->lru_lock);
118118
}
119119
EXPORT_SYMBOL(ttm_bo_set_bulk_move);
@@ -689,8 +689,11 @@ void ttm_bo_pin(struct ttm_buffer_object *bo)
689689
{
690690
dma_resv_assert_held(bo->base.resv);
691691
WARN_ON_ONCE(!kref_read(&bo->kref));
692-
if (!(bo->pin_count++) && bo->bulk_move && bo->resource)
693-
ttm_lru_bulk_move_del(bo->bulk_move, bo->resource);
692+
spin_lock(&bo->bdev->lru_lock);
693+
if (bo->resource)
694+
ttm_resource_del_bulk_move(bo->resource, bo);
695+
++bo->pin_count;
696+
spin_unlock(&bo->bdev->lru_lock);
694697
}
695698
EXPORT_SYMBOL(ttm_bo_pin);
696699

@@ -707,8 +710,11 @@ void ttm_bo_unpin(struct ttm_buffer_object *bo)
707710
if (WARN_ON_ONCE(!bo->pin_count))
708711
return;
709712

710-
if (!(--bo->pin_count) && bo->bulk_move && bo->resource)
711-
ttm_lru_bulk_move_add(bo->bulk_move, bo->resource);
713+
spin_lock(&bo->bdev->lru_lock);
714+
--bo->pin_count;
715+
if (bo->resource)
716+
ttm_resource_add_bulk_move(bo->resource, bo);
717+
spin_unlock(&bo->bdev->lru_lock);
712718
}
713719
EXPORT_SYMBOL(ttm_bo_unpin);
714720

‎drivers/gpu/drm/ttm/ttm_device.c‎

Lines changed: 5 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -156,8 +156,12 @@ int ttm_device_swapout(struct ttm_device *bdev, struct ttm_operation_ctx *ctx,
156156

157157
ttm_resource_manager_for_each_res(man, &cursor, res) {
158158
struct ttm_buffer_object *bo = res->bo;
159-
uint32_t num_pages = PFN_UP(bo->base.size);
159+
uint32_t num_pages;
160160

161+
if (!bo)
162+
continue;
163+
164+
num_pages = PFN_UP(bo->base.size);
161165
ret = ttm_bo_swapout(bo, ctx, gfp_flags);
162166
/* ttm_bo_swapout has dropped the lru_lock */
163167
if (!ret)

‎drivers/gpu/drm/ttm/ttm_resource.c‎

Lines changed: 36 additions & 16 deletions
Original file line numberDiff line numberDiff line change
@@ -91,8 +91,8 @@ static void ttm_lru_bulk_move_pos_tail(struct ttm_lru_bulk_move_pos *pos,
9191
}
9292

9393
/* Add the resource to a bulk_move cursor */
94-
void ttm_lru_bulk_move_add(struct ttm_lru_bulk_move *bulk,
95-
struct ttm_resource *res)
94+
static void ttm_lru_bulk_move_add(struct ttm_lru_bulk_move *bulk,
95+
struct ttm_resource *res)
9696
{
9797
struct ttm_lru_bulk_move_pos *pos = ttm_lru_bulk_move_pos(bulk, res);
9898

@@ -105,8 +105,8 @@ void ttm_lru_bulk_move_add(struct ttm_lru_bulk_move *bulk,
105105
}
106106

107107
/* Remove the resource from a bulk_move range */
108-
void ttm_lru_bulk_move_del(struct ttm_lru_bulk_move *bulk,
109-
struct ttm_resource *res)
108+
static void ttm_lru_bulk_move_del(struct ttm_lru_bulk_move *bulk,
109+
struct ttm_resource *res)
110110
{
111111
struct ttm_lru_bulk_move_pos *pos = ttm_lru_bulk_move_pos(bulk, res);
112112

@@ -122,6 +122,22 @@ void ttm_lru_bulk_move_del(struct ttm_lru_bulk_move *bulk,
122122
}
123123
}
124124

125+
/* Add the resource to a bulk move if the BO is configured for it */
126+
void ttm_resource_add_bulk_move(struct ttm_resource *res,
127+
struct ttm_buffer_object *bo)
128+
{
129+
if (bo->bulk_move && !bo->pin_count)
130+
ttm_lru_bulk_move_add(bo->bulk_move, res);
131+
}
132+
133+
/* Remove the resource from a bulk move if the BO is configured for it */
134+
void ttm_resource_del_bulk_move(struct ttm_resource *res,
135+
struct ttm_buffer_object *bo)
136+
{
137+
if (bo->bulk_move && !bo->pin_count)
138+
ttm_lru_bulk_move_del(bo->bulk_move, res);
139+
}
140+
125141
/* Move a resource to the LRU or bulk tail */
126142
void ttm_resource_move_to_lru_tail(struct ttm_resource *res)
127143
{
@@ -169,15 +185,14 @@ void ttm_resource_init(struct ttm_buffer_object *bo,
169185
res->bus.is_iomem = false;
170186
res->bus.caching = ttm_cached;
171187
res->bo = bo;
172-
INIT_LIST_HEAD(&res->lru);
173188

174189
man = ttm_manager_type(bo->bdev, place->mem_type);
175190
spin_lock(&bo->bdev->lru_lock);
176-
man->usage += res->num_pages << PAGE_SHIFT;
177-
if (bo->bulk_move)
178-
ttm_lru_bulk_move_add(bo->bulk_move, res);
191+
if (bo->pin_count)
192+
list_add_tail(&res->lru, &bo->bdev->pinned);
179193
else
180-
ttm_resource_move_to_lru_tail(res);
194+
list_add_tail(&res->lru, &man->lru[bo->priority]);
195+
man->usage += res->num_pages << PAGE_SHIFT;
181196
spin_unlock(&bo->bdev->lru_lock);
182197
}
183198
EXPORT_SYMBOL(ttm_resource_init);
@@ -210,8 +225,16 @@ int ttm_resource_alloc(struct ttm_buffer_object *bo,
210225
{
211226
struct ttm_resource_manager *man =
212227
ttm_manager_type(bo->bdev, place->mem_type);
228+
int ret;
229+
230+
ret = man->func->alloc(man, bo, place, res_ptr);
231+
if (ret)
232+
return ret;
213233

214-
return man->func->alloc(man, bo, place, res_ptr);
234+
spin_lock(&bo->bdev->lru_lock);
235+
ttm_resource_add_bulk_move(*res_ptr, bo);
236+
spin_unlock(&bo->bdev->lru_lock);
237+
return 0;
215238
}
216239

217240
void ttm_resource_free(struct ttm_buffer_object *bo, struct ttm_resource **res)
@@ -221,12 +244,9 @@ void ttm_resource_free(struct ttm_buffer_object *bo, struct ttm_resource **res)
221244
if (!*res)
222245
return;
223246

224-
if (bo->bulk_move) {
225-
spin_lock(&bo->bdev->lru_lock);
226-
ttm_lru_bulk_move_del(bo->bulk_move, *res);
227-
spin_unlock(&bo->bdev->lru_lock);
228-
}
229-
247+
spin_lock(&bo->bdev->lru_lock);
248+
ttm_resource_del_bulk_move(*res, bo);
249+
spin_unlock(&bo->bdev->lru_lock);
230250
man = ttm_manager_type(bo->bdev, (*res)->mem_type);
231251
man->func->free(man, *res);
232252
*res = NULL;

‎include/drm/drm_atomic.h‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1022,6 +1022,7 @@ void drm_state_dump(struct drm_device *dev, struct drm_printer *p);
10221022
for ((__i) = 0; \
10231023
(__i) < (__state)->num_private_objs && \
10241024
((obj) = (__state)->private_objs[__i].ptr, \
1025+
(void)(obj) /* Only to avoid unused-but-set-variable warning */, \
10251026
(new_obj_state) = (__state)->private_objs[__i].new_state, 1); \
10261027
(__i)++)
10271028

‎include/drm/ttm/ttm_resource.h‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -311,12 +311,12 @@ ttm_resource_manager_cleanup(struct ttm_resource_manager *man)
311311
}
312312

313313
void ttm_lru_bulk_move_init(struct ttm_lru_bulk_move *bulk);
314-
void ttm_lru_bulk_move_add(struct ttm_lru_bulk_move *bulk,
315-
struct ttm_resource *res);
316-
void ttm_lru_bulk_move_del(struct ttm_lru_bulk_move *bulk,
317-
struct ttm_resource *res);
318314
void ttm_lru_bulk_move_tail(struct ttm_lru_bulk_move *bulk);
319315

316+
void ttm_resource_add_bulk_move(struct ttm_resource *res,
317+
struct ttm_buffer_object *bo);
318+
void ttm_resource_del_bulk_move(struct ttm_resource *res,
319+
struct ttm_buffer_object *bo);
320320
void ttm_resource_move_to_lru_tail(struct ttm_resource *res);
321321

322322
void ttm_resource_init(struct ttm_buffer_object *bo,

0 commit comments

Comments
 (0)