search for: qxl_bo_pin

On 05.09.19 10:14, Gerd Hoffmann wrote: > On Tue, Aug 06, 2019 at 09:00:10PM +0300, Jaak Ristioja wrote: >> Hello! >> >> I'm writing to report a crash in the QXL / DRM code in the Linux kernel. >> I originally filed the issue on LaunchPad and more details can be found >> there, although I doubt whether these details are useful. > > Any change with kernel

On 05.09.19 10:14, Gerd Hoffmann wrote: > On Tue, Aug 06, 2019 at 09:00:10PM +0300, Jaak Ristioja wrote: >> Hello! >> >> I'm writing to report a crash in the QXL / DRM code in the Linux kernel. >> I originally filed the issue on LaunchPad and more details can be found >> there, although I doubt whether these details are useful. > > Any change with kernel

...ock.isra.0+0x261/0x7f0 [124212.551345] ? ttm_bo_init+0x6b/0x100 [ttm] [124212.551346] __ww_mutex_lock_slowpath+0x16/0x20 [124212.551347] ww_mutex_lock+0x38/0x90 [124212.551352] ttm_eu_reserve_buffers+0x1cc/0x2f0 [ttm] [124212.551371] qxl_release_reserve_list+0x6d/0x150 [qxl] [124212.551373] ? qxl_bo_pin+0xf4/0x190 [qxl] [124212.551375] qxl_cursor_atomic_update+0x1ab/0x2e0 [qxl] [124212.551376] ? qxl_bo_pin+0xf4/0x190 [qxl] [124212.551384] drm_atomic_helper_commit_planes+0xd5/0x220 [drm_kms_helper] [124212.551388] drm_atomic_helper_commit_tail+0x2c/0x70 [drm_kms_helper] [124212.551392] commit_...

.../qxl/qxl_object.c b/drivers/gpu/drm/qxl/qxl_object.c index d3635e3e3267..eb45267d51db 100644 --- a/drivers/gpu/drm/qxl/qxl_object.c +++ b/drivers/gpu/drm/qxl/qxl_object.c @@ -145,7 +145,7 @@ int qxl_bo_create(struct qxl_device *qdev, return r; } if (pinned) - ttm_bo_pin(&bo->tbo); + qxl_bo_pin(bo); *bo_ptr = bo; return 0; } -- 2.27.0

.../qxl/qxl_object.c b/drivers/gpu/drm/qxl/qxl_object.c index d3635e3e3267..eb45267d51db 100644 --- a/drivers/gpu/drm/qxl/qxl_object.c +++ b/drivers/gpu/drm/qxl/qxl_object.c @@ -145,7 +145,7 @@ int qxl_bo_create(struct qxl_device *qdev, return r; } if (pinned) - ttm_bo_pin(&bo->tbo); + qxl_bo_pin(bo); *bo_ptr = bo; return 0; } -- 2.27.0

...24212.551345] ? ttm_bo_init+0x6b/0x100 [ttm] > [124212.551346] __ww_mutex_lock_slowpath+0x16/0x20 > [124212.551347] ww_mutex_lock+0x38/0x90 > [124212.551352] ttm_eu_reserve_buffers+0x1cc/0x2f0 [ttm] > [124212.551371] qxl_release_reserve_list+0x6d/0x150 [qxl] > [124212.551373] ? qxl_bo_pin+0xf4/0x190 [qxl] > [124212.551375] qxl_cursor_atomic_update+0x1ab/0x2e0 [qxl] > [124212.551376] ? qxl_bo_pin+0xf4/0x190 [qxl] > [124212.551384] drm_atomic_helper_commit_planes+0xd5/0x220 [drm_kms_helper] > [124212.551388] drm_atomic_helper_commit_tail+0x2c/0x70 [drm_kms_helper] >...

...disabled+0xe/0x10 [354073.738345] __ww_mutex_lock.isra.11+0x3e0/0x750 [354073.738346] __ww_mutex_lock_slowpath+0x16/0x20 [354073.738347] ww_mutex_lock+0x34/0x50 [354073.738352] ttm_eu_reserve_buffers+0x1f9/0x2e0 [ttm] [354073.738356] qxl_release_reserve_list+0x67/0x150 [qxl] [354073.738358] ? qxl_bo_pin+0xaa/0x190 [qxl] [354073.738359] qxl_cursor_atomic_update+0x1b0/0x2e0 [qxl] [354073.738367] drm_atomic_helper_commit_planes+0xb9/0x220 [drm_kms_helper] [354073.738371] drm_atomic_helper_commit_tail+0x2b/0x70 [drm_kms_helper] [354073.738374] commit_tail+0x67/0x70 [drm_kms_helper] [354073.738378]...

...disabled+0xe/0x10 [354073.738345] __ww_mutex_lock.isra.11+0x3e0/0x750 [354073.738346] __ww_mutex_lock_slowpath+0x16/0x20 [354073.738347] ww_mutex_lock+0x34/0x50 [354073.738352] ttm_eu_reserve_buffers+0x1f9/0x2e0 [ttm] [354073.738356] qxl_release_reserve_list+0x67/0x150 [qxl] [354073.738358] ? qxl_bo_pin+0xaa/0x190 [qxl] [354073.738359] qxl_cursor_atomic_update+0x1b0/0x2e0 [qxl] [354073.738367] drm_atomic_helper_commit_planes+0xb9/0x220 [drm_kms_helper] [354073.738371] drm_atomic_helper_commit_tail+0x2b/0x70 [drm_kms_helper] [354073.738374] commit_tail+0x67/0x70 [drm_kms_helper] [354073.738378]...

...879 790 0x00400004 Call Trace: __schedule+0x2d0/0x840 schedule+0x2c/0x70 schedule_preempt_disabled+0xe/0x10 __ww_mutex_lock.isra.11+0x3e0/0x750 __ww_mutex_lock_slowpath+0x16/0x20 ww_mutex_lock+0x34/0x50 ttm_eu_reserve_buffers+0x1f9/0x2e0 [ttm] qxl_release_reserve_list+0x67/0x150 [qxl] ? qxl_bo_pin+0x11d/0x200 [qxl] qxl_cursor_atomic_update+0x1b0/0x2e0 [qxl] drm_atomic_helper_commit_planes+0xb9/0x220 [drm_kms_helper] drm_atomic_helper_commit_tail+0x2b/0x70 [drm_kms_helper] commit_tail+0x67/0x70 [drm_kms_helper] drm_atomic_helper_commit+0x113/0x120 [drm_kms_helper] drm_atomic_commit+0x4a...

...879 790 0x00400004 Call Trace: __schedule+0x2d0/0x840 schedule+0x2c/0x70 schedule_preempt_disabled+0xe/0x10 __ww_mutex_lock.isra.11+0x3e0/0x750 __ww_mutex_lock_slowpath+0x16/0x20 ww_mutex_lock+0x34/0x50 ttm_eu_reserve_buffers+0x1f9/0x2e0 [ttm] qxl_release_reserve_list+0x67/0x150 [qxl] ? qxl_bo_pin+0x11d/0x200 [qxl] qxl_cursor_atomic_update+0x1b0/0x2e0 [qxl] drm_atomic_helper_commit_planes+0xb9/0x220 [drm_kms_helper] drm_atomic_helper_commit_tail+0x2b/0x70 [drm_kms_helper] commit_tail+0x67/0x70 [drm_kms_helper] drm_atomic_helper_commit+0x113/0x120 [drm_kms_helper] drm_atomic_commit+0x4a...

....738345] __ww_mutex_lock.isra.11+0x3e0/0x750 > [354073.738346] __ww_mutex_lock_slowpath+0x16/0x20 > [354073.738347] ww_mutex_lock+0x34/0x50 > [354073.738352] ttm_eu_reserve_buffers+0x1f9/0x2e0 [ttm] > [354073.738356] qxl_release_reserve_list+0x67/0x150 [qxl] > [354073.738358] ? qxl_bo_pin+0xaa/0x190 [qxl] > [354073.738359] qxl_cursor_atomic_update+0x1b0/0x2e0 [qxl] > [354073.738367] drm_atomic_helper_commit_planes+0xb9/0x220 [drm_kms_helper] > [354073.738371] drm_atomic_helper_commit_tail+0x2b/0x70 [drm_kms_helper] > [354073.738374] commit_tail+0x67/0x70 [drm_kms_hel...

....738345] __ww_mutex_lock.isra.11+0x3e0/0x750 > [354073.738346] __ww_mutex_lock_slowpath+0x16/0x20 > [354073.738347] ww_mutex_lock+0x34/0x50 > [354073.738352] ttm_eu_reserve_buffers+0x1f9/0x2e0 [ttm] > [354073.738356] qxl_release_reserve_list+0x67/0x150 [qxl] > [354073.738358] ? qxl_bo_pin+0xaa/0x190 [qxl] > [354073.738359] qxl_cursor_atomic_update+0x1b0/0x2e0 [qxl] > [354073.738367] drm_atomic_helper_commit_planes+0xb9/0x220 [drm_kms_helper] > [354073.738371] drm_atomic_helper_commit_tail+0x2b/0x70 [drm_kms_helper] > [354073.738374] commit_tail+0x67/0x70 [drm_kms_hel...

...bject.c > index d3635e3e3267..eb45267d51db 100644 > --- a/drivers/gpu/drm/qxl/qxl_object.c > +++ b/drivers/gpu/drm/qxl/qxl_object.c > @@ -145,7 +145,7 @@ int qxl_bo_create(struct qxl_device *qdev, > return r; > } > if (pinned) > - ttm_bo_pin(&bo->tbo); > + qxl_bo_pin(bo); I think this is now after ttm_bo_init, and at that point the object is visible to lru users and everything. So I do think you need to grab locks here instead of just incrementing the pin count alone. It's also I think a bit racy, since ttm_bo_init drops the lock, so someone might have sn...

....isra.11+0x3e0/0x750 > > [354073.738346] __ww_mutex_lock_slowpath+0x16/0x20 > > [354073.738347] ww_mutex_lock+0x34/0x50 > > [354073.738352] ttm_eu_reserve_buffers+0x1f9/0x2e0 [ttm] > > [354073.738356] qxl_release_reserve_list+0x67/0x150 [qxl] > > [354073.738358] ? qxl_bo_pin+0xaa/0x190 [qxl] > > [354073.738359] qxl_cursor_atomic_update+0x1b0/0x2e0 [qxl] > > [354073.738367] drm_atomic_helper_commit_planes+0xb9/0x220 > > [drm_kms_helper] > > [354073.738371] drm_atomic_helper_commit_tail+0x2b/0x70 [drm_kms_helper] > > [354073.738374] comm...

...y Implementations as there should not be any other driver for a virtual * device that might share buffers with qxl */ -int qxl_gem_prime_pin(struct drm_gem_object *obj) +int qxl_gem_prime_pin(struct drm_gem_object *obj, struct device *dev) { struct qxl_bo *bo = gem_to_qxl_bo(obj); return qxl_bo_pin(bo); } -void qxl_gem_prime_unpin(struct drm_gem_object *obj) +void qxl_gem_prime_unpin(struct drm_gem_object *obj, struct device *dev) { struct qxl_bo *bo = gem_to_qxl_bo(obj); diff --git a/drivers/gpu/drm/radeon/radeon_prime.c b/drivers/gpu/drm/radeon/radeon_prime.c index deaffce50a2e..f34...

...y Implementations as there should not be any other driver for a virtual * device that might share buffers with qxl */ -int qxl_gem_prime_pin(struct drm_gem_object *obj) +int qxl_gem_prime_pin(struct drm_gem_object *obj, struct device *dev) { struct qxl_bo *bo = gem_to_qxl_bo(obj); return qxl_bo_pin(bo); } -void qxl_gem_prime_unpin(struct drm_gem_object *obj) +void qxl_gem_prime_unpin(struct drm_gem_object *obj, struct device *dev) { struct qxl_bo *bo = gem_to_qxl_bo(obj); diff --git a/drivers/gpu/drm/radeon/radeon_prime.c b/drivers/gpu/drm/radeon/radeon_prime.c index deaffce50a2e..f34...

...y Implementations as there should not be any other driver for a virtual * device that might share buffers with qxl */ -int qxl_gem_prime_pin(struct drm_gem_object *obj) +int qxl_gem_prime_pin(struct drm_gem_object *obj, struct device *dev) { struct qxl_bo *bo = gem_to_qxl_bo(obj); return qxl_bo_pin(bo); } -void qxl_gem_prime_unpin(struct drm_gem_object *obj) +void qxl_gem_prime_unpin(struct drm_gem_object *obj, struct device *dev) { struct qxl_bo *bo = gem_to_qxl_bo(obj); diff --git a/drivers/gpu/drm/radeon/radeon_prime.c b/drivers/gpu/drm/radeon/radeon_prime.c index deaffce50a2e..f34...

...y Implementations as there should not be any other driver for a virtual * device that might share buffers with qxl */ -int qxl_gem_prime_pin(struct drm_gem_object *obj) +int qxl_gem_prime_pin(struct drm_gem_object *obj, struct device *dev) { struct qxl_bo *bo = gem_to_qxl_bo(obj); return qxl_bo_pin(bo); } -void qxl_gem_prime_unpin(struct drm_gem_object *obj) +void qxl_gem_prime_unpin(struct drm_gem_object *obj, struct device *dev) { struct qxl_bo *bo = gem_to_qxl_bo(obj); diff --git a/drivers/gpu/drm/radeon/radeon_prime.c b/drivers/gpu/drm/radeon/radeon_prime.c index d3a5bea9a2c5..2d3...

...y Implementations as there should not be any other driver for a virtual * device that might share buffers with qxl */ -int qxl_gem_prime_pin(struct drm_gem_object *obj) +int qxl_gem_prime_pin(struct drm_gem_object *obj, struct device *dev) { struct qxl_bo *bo = gem_to_qxl_bo(obj); return qxl_bo_pin(bo); } -void qxl_gem_prime_unpin(struct drm_gem_object *obj) +void qxl_gem_prime_unpin(struct drm_gem_object *obj, struct device *dev) { struct qxl_bo *bo = gem_to_qxl_bo(obj); diff --git a/drivers/gpu/drm/radeon/radeon_prime.c b/drivers/gpu/drm/radeon/radeon_prime.c index d3a5bea9a2c5..2d3...

...y Implementations as there should not be any other driver for a virtual * device that might share buffers with qxl */ -int qxl_gem_prime_pin(struct drm_gem_object *obj) +int qxl_gem_prime_pin(struct drm_gem_object *obj, struct device *dev) { struct qxl_bo *bo = gem_to_qxl_bo(obj); return qxl_bo_pin(bo); } -void qxl_gem_prime_unpin(struct drm_gem_object *obj) +void qxl_gem_prime_unpin(struct drm_gem_object *obj, struct device *dev) { struct qxl_bo *bo = gem_to_qxl_bo(obj); diff --git a/drivers/gpu/drm/radeon/radeon_prime.c b/drivers/gpu/drm/radeon/radeon_prime.c index d3a5bea9a2c5..2d3...