drm/ttm: Fix race condition in ttm_bo_delayed_delete (v3, final)
[safe/jmp/linux-2.6] / drivers / gpu / drm / ttm / ttm_bo.c
index 4cd4007..8036b6e 100644 (file)
@@ -71,34 +71,34 @@ static inline int ttm_mem_type_from_flags(uint32_t flags, uint32_t *mem_type)
        return -EINVAL;
 }
 
-static void ttm_mem_type_manager_debug(struct ttm_bo_global *glob,
-                                       struct ttm_mem_type_manager *man)
+static void ttm_mem_type_debug(struct ttm_bo_device *bdev, int mem_type)
 {
+       struct ttm_mem_type_manager *man = &bdev->man[mem_type];
+
        printk(KERN_ERR TTM_PFX "    has_type: %d\n", man->has_type);
        printk(KERN_ERR TTM_PFX "    use_type: %d\n", man->use_type);
        printk(KERN_ERR TTM_PFX "    flags: 0x%08X\n", man->flags);
        printk(KERN_ERR TTM_PFX "    gpu_offset: 0x%08lX\n", man->gpu_offset);
        printk(KERN_ERR TTM_PFX "    io_offset: 0x%08lX\n", man->io_offset);
        printk(KERN_ERR TTM_PFX "    io_size: %ld\n", man->io_size);
-       printk(KERN_ERR TTM_PFX "    size: %ld\n", (unsigned long)man->size);
+       printk(KERN_ERR TTM_PFX "    size: %llu\n", man->size);
        printk(KERN_ERR TTM_PFX "    available_caching: 0x%08X\n",
                man->available_caching);
        printk(KERN_ERR TTM_PFX "    default_caching: 0x%08X\n",
                man->default_caching);
-       spin_lock(&glob->lru_lock);
-       drm_mm_debug_table(&man->manager, TTM_PFX);
-       spin_unlock(&glob->lru_lock);
+       if (mem_type != TTM_PL_SYSTEM) {
+               spin_lock(&bdev->glob->lru_lock);
+               drm_mm_debug_table(&man->manager, TTM_PFX);
+               spin_unlock(&bdev->glob->lru_lock);
+       }
 }
 
 static void ttm_bo_mem_space_debug(struct ttm_buffer_object *bo,
                                        struct ttm_placement *placement)
 {
-       struct ttm_bo_device *bdev = bo->bdev;
-       struct ttm_bo_global *glob = bo->glob;
-       struct ttm_mem_type_manager *man;
        int i, ret, mem_type;
 
-       printk(KERN_ERR TTM_PFX "No space for %p (%ld pages, %ldK, %ldM)\n",
+       printk(KERN_ERR TTM_PFX "No space for %p (%lu pages, %luK, %luM)\n",
                bo, bo->mem.num_pages, bo->mem.size >> 10,
                bo->mem.size >> 20);
        for (i = 0; i < placement->num_placement; i++) {
@@ -106,10 +106,9 @@ static void ttm_bo_mem_space_debug(struct ttm_buffer_object *bo,
                                                &mem_type);
                if (ret)
                        return;
-               man = &bdev->man[mem_type];
                printk(KERN_ERR TTM_PFX "  placement[%d]=0x%08X (%d)\n",
                        i, placement->placement[i], mem_type);
-               ttm_mem_type_manager_debug(glob, man);
+               ttm_mem_type_debug(bo->bdev, mem_type);
        }
 }
 
@@ -427,7 +426,8 @@ moved:
                    bdev->man[bo->mem.mem_type].gpu_offset;
                bo->cur_placement = bo->mem.placement;
                spin_unlock(&bo->lock);
-       }
+       } else
+               bo->offset = 0;
 
        return 0;
 
@@ -465,6 +465,8 @@ static int ttm_bo_cleanup_refs(struct ttm_buffer_object *bo, bool remove_all)
                spin_unlock(&bo->lock);
 
                spin_lock(&glob->lru_lock);
+               put_count = ttm_bo_del_from_lru(bo);
+
                ret = ttm_bo_reserve_locked(bo, false, false, false, 0);
                BUG_ON(ret);
                if (bo->ttm)
@@ -472,20 +474,19 @@ static int ttm_bo_cleanup_refs(struct ttm_buffer_object *bo, bool remove_all)
 
                if (!list_empty(&bo->ddestroy)) {
                        list_del_init(&bo->ddestroy);
-                       kref_put(&bo->list_kref, ttm_bo_ref_bug);
+                       ++put_count;
                }
                if (bo->mem.mm_node) {
                        bo->mem.mm_node->private = NULL;
                        drm_mm_put_block(bo->mem.mm_node);
                        bo->mem.mm_node = NULL;
                }
-               put_count = ttm_bo_del_from_lru(bo);
                spin_unlock(&glob->lru_lock);
 
                atomic_set(&bo->reserved, 0);
 
                while (put_count--)
-                       kref_put(&bo->list_kref, ttm_bo_release_list);
+                       kref_put(&bo->list_kref, ttm_bo_ref_bug);
 
                return 0;
        }
@@ -523,52 +524,44 @@ static int ttm_bo_cleanup_refs(struct ttm_buffer_object *bo, bool remove_all)
 static int ttm_bo_delayed_delete(struct ttm_bo_device *bdev, bool remove_all)
 {
        struct ttm_bo_global *glob = bdev->glob;
-       struct ttm_buffer_object *entry, *nentry;
-       struct list_head *list, *next;
-       int ret;
+       struct ttm_buffer_object *entry = NULL;
+       int ret = 0;
 
        spin_lock(&glob->lru_lock);
-       list_for_each_safe(list, next, &bdev->ddestroy) {
-               entry = list_entry(list, struct ttm_buffer_object, ddestroy);
-               nentry = NULL;
+       if (list_empty(&bdev->ddestroy))
+               goto out_unlock;
 
-               /*
-                * Protect the next list entry from destruction while we
-                * unlock the lru_lock.
-                */
+       entry = list_first_entry(&bdev->ddestroy,
+               struct ttm_buffer_object, ddestroy);
+       kref_get(&entry->list_kref);
 
-               if (next != &bdev->ddestroy) {
-                       nentry = list_entry(next, struct ttm_buffer_object,
-                                           ddestroy);
+       for (;;) {
+               struct ttm_buffer_object *nentry = NULL;
+
+               if (entry->ddestroy.next != &bdev->ddestroy) {
+                       nentry = list_first_entry(&entry->ddestroy,
+                               struct ttm_buffer_object, ddestroy);
                        kref_get(&nentry->list_kref);
                }
-               kref_get(&entry->list_kref);
 
                spin_unlock(&glob->lru_lock);
                ret = ttm_bo_cleanup_refs(entry, remove_all);
                kref_put(&entry->list_kref, ttm_bo_release_list);
+               entry = nentry;
+
+               if (ret || !entry)
+                       goto out;
 
                spin_lock(&glob->lru_lock);
-               if (nentry) {
-                       bool next_onlist = !list_empty(next);
-                       spin_unlock(&glob->lru_lock);
-                       kref_put(&nentry->list_kref, ttm_bo_release_list);
-                       spin_lock(&glob->lru_lock);
-                       /*
-                        * Someone might have raced us and removed the
-                        * next entry from the list. We don't bother restarting
-                        * list traversal.
-                        */
-
-                       if (!next_onlist)
-                               break;
-               }
-               if (ret)
+               if (list_empty(&entry->ddestroy))
                        break;
        }
-       ret = !list_empty(&bdev->ddestroy);
-       spin_unlock(&glob->lru_lock);
 
+out_unlock:
+       spin_unlock(&glob->lru_lock);
+out:
+       if (entry)
+               kref_put(&entry->list_kref, ttm_bo_release_list);
        return ret;
 }
 
@@ -684,19 +677,45 @@ static int ttm_mem_evict_first(struct ttm_bo_device *bdev,
        struct ttm_buffer_object *bo;
        int ret, put_count = 0;
 
+retry:
        spin_lock(&glob->lru_lock);
+       if (list_empty(&man->lru)) {
+               spin_unlock(&glob->lru_lock);
+               return -EBUSY;
+       }
+
        bo = list_first_entry(&man->lru, struct ttm_buffer_object, lru);
        kref_get(&bo->list_kref);
-       ret = ttm_bo_reserve_locked(bo, interruptible, no_wait, false, 0);
-       if (likely(ret == 0))
-               put_count = ttm_bo_del_from_lru(bo);
+
+       ret = ttm_bo_reserve_locked(bo, false, true, false, 0);
+
+       if (unlikely(ret == -EBUSY)) {
+               spin_unlock(&glob->lru_lock);
+               if (likely(!no_wait))
+                       ret = ttm_bo_wait_unreserved(bo, interruptible);
+
+               kref_put(&bo->list_kref, ttm_bo_release_list);
+
+               /**
+                * We *need* to retry after releasing the lru lock.
+                */
+
+               if (unlikely(ret != 0))
+                       return ret;
+               goto retry;
+       }
+
+       put_count = ttm_bo_del_from_lru(bo);
        spin_unlock(&glob->lru_lock);
-       if (unlikely(ret != 0))
-               return ret;
+
+       BUG_ON(ret != 0);
+
        while (put_count--)
                kref_put(&bo->list_kref, ttm_bo_ref_bug);
+
        ret = ttm_bo_evict(bo, interruptible, no_wait);
        ttm_bo_unreserve(bo);
+
        kref_put(&bo->list_kref, ttm_bo_release_list);
        return ret;
 }
@@ -1115,6 +1134,7 @@ int ttm_bo_init(struct ttm_bo_device *bdev,
        bo->glob = bdev->glob;
        bo->type = type;
        bo->num_pages = num_pages;
+       bo->mem.size = num_pages << PAGE_SHIFT;
        bo->mem.mem_type = TTM_PL_SYSTEM;
        bo->mem.num_pages = bo->num_pages;
        bo->mem.mm_node = NULL;
@@ -1817,6 +1837,9 @@ static int ttm_bo_swapout(struct ttm_mem_shrink *shrink)
         * anyone tries to access a ttm page.
         */
 
+       if (bo->bdev->driver->swap_notify)
+               bo->bdev->driver->swap_notify(bo);
+
        ret = ttm_tt_swapout(bo->ttm, bo->persistant_swap_storage);
 out:
 
@@ -1837,3 +1860,4 @@ void ttm_bo_swapout_all(struct ttm_bo_device *bdev)
        while (ttm_bo_swapout(&bdev->glob->shrink) == 0)
                ;
 }
+EXPORT_SYMBOL(ttm_bo_swapout_all);