search for: qxl_release_validate_bo

...rel = fobj ? fobj->shared_count : 0; rcu_read_unlock(); diff --git a/drivers/gpu/drm/qxl/qxl_release.c b/drivers/gpu/drm/qxl/qxl_release.c index 32126e8836b3..1b7be82c8e68 100644 --- a/drivers/gpu/drm/qxl/qxl_release.c +++ b/drivers/gpu/drm/qxl/qxl_release.c @@ -234,7 +234,7 @@ static int qxl_release_validate_bo(struct qxl_bo *bo) return ret; } - ret = reservation_object_reserve_shared(bo->tbo.resv, 1); + ret = reservation_object_reserve_shared(bo->tbo.base.resv, 1); if (ret) return ret; @@ -454,9 +454,9 @@ void qxl_release_fence_buffer_objects(struct qxl_release *release) list_for_e...

...rel = fobj ? fobj->shared_count : 0; rcu_read_unlock(); diff --git a/drivers/gpu/drm/qxl/qxl_release.c b/drivers/gpu/drm/qxl/qxl_release.c index 32126e8836b3..1b7be82c8e68 100644 --- a/drivers/gpu/drm/qxl/qxl_release.c +++ b/drivers/gpu/drm/qxl/qxl_release.c @@ -234,7 +234,7 @@ static int qxl_release_validate_bo(struct qxl_bo *bo) return ret; } - ret = reservation_object_reserve_shared(bo->tbo.resv, 1); + ret = reservation_object_reserve_shared(bo->tbo.base.resv, 1); if (ret) return ret; @@ -454,9 +454,9 @@ void qxl_release_fence_buffer_objects(struct qxl_release *release) list_for_e...

...rel = fobj ? fobj->shared_count : 0; rcu_read_unlock(); diff --git a/drivers/gpu/drm/qxl/qxl_release.c b/drivers/gpu/drm/qxl/qxl_release.c index 0022e31ba910..df55b83e0a55 100644 --- a/drivers/gpu/drm/qxl/qxl_release.c +++ b/drivers/gpu/drm/qxl/qxl_release.c @@ -238,7 +238,7 @@ static int qxl_release_validate_bo(struct qxl_bo *bo) return ret; } - ret = reservation_object_reserve_shared(bo->tbo.resv, 1); + ret = reservation_object_reserve_shared(bo->tbo.base.resv, 1); if (ret) return ret; @@ -458,9 +458,9 @@ void qxl_release_fence_buffer_objects(struct qxl_release *release) list_for_e...

...rel = fobj ? fobj->shared_count : 0; rcu_read_unlock(); diff --git a/drivers/gpu/drm/qxl/qxl_release.c b/drivers/gpu/drm/qxl/qxl_release.c index 0022e31ba910..df55b83e0a55 100644 --- a/drivers/gpu/drm/qxl/qxl_release.c +++ b/drivers/gpu/drm/qxl/qxl_release.c @@ -238,7 +238,7 @@ static int qxl_release_validate_bo(struct qxl_bo *bo) return ret; } - ret = reservation_object_reserve_shared(bo->tbo.resv, 1); + ret = reservation_object_reserve_shared(bo->tbo.base.resv, 1); if (ret) return ret; @@ -458,9 +458,9 @@ void qxl_release_fence_buffer_objects(struct qxl_release *release) list_for_e...

...rel = fobj ? fobj->shared_count : 0; rcu_read_unlock(); diff --git a/drivers/gpu/drm/qxl/qxl_release.c b/drivers/gpu/drm/qxl/qxl_release.c index 0022e31ba910..df55b83e0a55 100644 --- a/drivers/gpu/drm/qxl/qxl_release.c +++ b/drivers/gpu/drm/qxl/qxl_release.c @@ -238,7 +238,7 @@ static int qxl_release_validate_bo(struct qxl_bo *bo) return ret; } - ret = reservation_object_reserve_shared(bo->tbo.resv, 1); + ret = reservation_object_reserve_shared(bo->tbo.base.resv, 1); if (ret) return ret; @@ -458,9 +458,9 @@ void qxl_release_fence_buffer_objects(struct qxl_release *release) list_for_e...

..., bool no_intr) ret = ttm_eu_reserve_buffers(&release->ticket, &release->bos, !no_intr, NULL, true); if (ret) - return ret; + goto err_backoff; list_for_each_entry(entry, &release->bos, tv.head) { struct qxl_bo *bo = to_qxl_bo(entry->tv.bo); ret = qxl_release_validate_bo(bo); - if (ret) { - ttm_eu_backoff_reservation(&release->ticket, &release->bos); - return ret; - } + if (ret) + goto err_backoff; } return 0; + +err_backoff: + ttm_eu_backoff_reservation(&release->ticket, &release->bos); + return ret; } void qxl_release_...

...element from the list until the list is empty. It was found that the > linked list was cleared first, and that the lock on the corresponding > ttm Bo for the QXL had not been released, so that the new qxl could not > be locked when it used the TTM. So the dma_resv_reserve_shared() call in qxl_release_validate_bo() is unbalanced? Because the dma_resv_unlock() call in qxl_release_fence_buffer_objects() never happens due to qxl_release_free_list() clearing the list beforehand? Is that correct? The only way I see for this to happen is that the guest is preempted between qxl_push_{cursor,command}_ring_releas...

...); + drm_gem_object_put_unlocked(&bo->tbo.base); } } diff --git a/drivers/gpu/drm/qxl/qxl_release.c b/drivers/gpu/drm/qxl/qxl_release.c index 49f9a9385393..32126e8836b3 100644 --- a/drivers/gpu/drm/qxl/qxl_release.c +++ b/drivers/gpu/drm/qxl/qxl_release.c @@ -239,7 +239,7 @@ static int qxl_release_validate_bo(struct qxl_bo *bo) return ret; /* allocate a surface for reserved + validated buffers */ - ret = qxl_bo_check_id(bo->gem_base.dev->dev_private, bo); + ret = qxl_bo_check_id(bo->tbo.base.dev->dev_private, bo); if (ret) return ret; return 0; diff --git a/drivers/gpu/drm/qxl/...

...); + drm_gem_object_put_unlocked(&bo->tbo.base); } } diff --git a/drivers/gpu/drm/qxl/qxl_release.c b/drivers/gpu/drm/qxl/qxl_release.c index 49f9a9385393..32126e8836b3 100644 --- a/drivers/gpu/drm/qxl/qxl_release.c +++ b/drivers/gpu/drm/qxl/qxl_release.c @@ -239,7 +239,7 @@ static int qxl_release_validate_bo(struct qxl_bo *bo) return ret; /* allocate a surface for reserved + validated buffers */ - ret = qxl_bo_check_id(bo->gem_base.dev->dev_private, bo); + ret = qxl_bo_check_id(bo->tbo.base.dev->dev_private, bo); if (ret) return ret; return 0; diff --git a/drivers/gpu/drm/qxl/...

...); + drm_gem_object_put_unlocked(&bo->tbo.base); } } diff --git a/drivers/gpu/drm/qxl/qxl_release.c b/drivers/gpu/drm/qxl/qxl_release.c index 49f9a9385393..32126e8836b3 100644 --- a/drivers/gpu/drm/qxl/qxl_release.c +++ b/drivers/gpu/drm/qxl/qxl_release.c @@ -239,7 +239,7 @@ static int qxl_release_validate_bo(struct qxl_bo *bo) return ret; /* allocate a surface for reserved + validated buffers */ - ret = qxl_bo_check_id(bo->gem_base.dev->dev_private, bo); + ret = qxl_bo_check_id(bo->tbo.base.dev->dev_private, bo); if (ret) return ret; return 0; diff --git a/drivers/gpu/drm/qxl/...

...); + drm_gem_object_put_unlocked(&bo->tbo.base); } } diff --git a/drivers/gpu/drm/qxl/qxl_release.c b/drivers/gpu/drm/qxl/qxl_release.c index b805bfa87b68..0022e31ba910 100644 --- a/drivers/gpu/drm/qxl/qxl_release.c +++ b/drivers/gpu/drm/qxl/qxl_release.c @@ -243,7 +243,7 @@ static int qxl_release_validate_bo(struct qxl_bo *bo) return ret; /* allocate a surface for reserved + validated buffers */ - ret = qxl_bo_check_id(bo->gem_base.dev->dev_private, bo); + ret = qxl_bo_check_id(bo->tbo.base.dev->dev_private, bo); if (ret) return ret; return 0; diff --git a/drivers/gpu/drm/qxl/...

...); + drm_gem_object_put_unlocked(&bo->tbo.base); } } diff --git a/drivers/gpu/drm/qxl/qxl_release.c b/drivers/gpu/drm/qxl/qxl_release.c index b805bfa87b68..0022e31ba910 100644 --- a/drivers/gpu/drm/qxl/qxl_release.c +++ b/drivers/gpu/drm/qxl/qxl_release.c @@ -243,7 +243,7 @@ static int qxl_release_validate_bo(struct qxl_bo *bo) return ret; /* allocate a surface for reserved + validated buffers */ - ret = qxl_bo_check_id(bo->gem_base.dev->dev_private, bo); + ret = qxl_bo_check_id(bo->tbo.base.dev->dev_private, bo); if (ret) return ret; return 0; diff --git a/drivers/gpu/drm/qxl/...

...); + drm_gem_object_put_unlocked(&bo->tbo.base); } } diff --git a/drivers/gpu/drm/qxl/qxl_release.c b/drivers/gpu/drm/qxl/qxl_release.c index b805bfa87b68..0022e31ba910 100644 --- a/drivers/gpu/drm/qxl/qxl_release.c +++ b/drivers/gpu/drm/qxl/qxl_release.c @@ -243,7 +243,7 @@ static int qxl_release_validate_bo(struct qxl_bo *bo) return ret; /* allocate a surface for reserved + validated buffers */ - ret = qxl_bo_check_id(bo->gem_base.dev->dev_private, bo); + ret = qxl_bo_check_id(bo->tbo.base.dev->dev_private, bo); if (ret) return ret; return 0; diff --git a/drivers/gpu/drm/qxl/...

On Tue, 6 Aug 2019 21:00:10 +0300 From: Jaak Ristioja <jaak at ristioja.ee> > Hello! > > I'm writing to report a crash in the QXL / DRM code in the Linux kernel. > I originally filed the issue on LaunchPad and more details can be found > there, although I doubt whether these details are useful. > > https://bugs.launchpad.net/ubuntu/+source/linux/+bug/1813620

On Tue, 6 Aug 2019 21:00:10 +0300 From: Jaak Ristioja <jaak at ristioja.ee> > Hello! > > I'm writing to report a crash in the QXL / DRM code in the Linux kernel. > I originally filed the issue on LaunchPad and more details can be found > there, although I doubt whether these details are useful. > > https://bugs.launchpad.net/ubuntu/+source/linux/+bug/1813620

..._evict(qdev, bo, false); WARN_ON_ONCE(bo->map_count > 0); diff --git a/drivers/gpu/drm/qxl/qxl_release.c b/drivers/gpu/drm/qxl/qxl_release.c index 2feca734c7b1..4fae3e393da1 100644 --- a/drivers/gpu/drm/qxl/qxl_release.c +++ b/drivers/gpu/drm/qxl/qxl_release.c @@ -243,7 +243,7 @@ static int qxl_release_validate_bo(struct qxl_bo *bo) return ret; /* allocate a surface for reserved + validated buffers */ - ret = qxl_bo_check_id(bo->tbo.base.dev->dev_private, bo); + ret = qxl_bo_check_id(to_qxl(bo->tbo.base.dev), bo); if (ret) return ret; return 0; diff --git a/drivers/gpu/drm/qxl/qxl_ttm....

..._evict(qdev, bo, false); WARN_ON_ONCE(bo->map_count > 0); diff --git a/drivers/gpu/drm/qxl/qxl_release.c b/drivers/gpu/drm/qxl/qxl_release.c index 2feca734c7b1..4fae3e393da1 100644 --- a/drivers/gpu/drm/qxl/qxl_release.c +++ b/drivers/gpu/drm/qxl/qxl_release.c @@ -243,7 +243,7 @@ static int qxl_release_validate_bo(struct qxl_bo *bo) return ret; /* allocate a surface for reserved + validated buffers */ - ret = qxl_bo_check_id(bo->tbo.base.dev->dev_private, bo); + ret = qxl_bo_check_id(to_qxl(bo->tbo.base.dev), bo); if (ret) return ret; return 0; diff --git a/drivers/gpu/drm/qxl/qxl_ttm....

...mp;release->bos)); + qxl_release_free_list(release); + + fence_signal(&release->base); + fence_put(&release->base); + } else { + qxl_release_free_list(release); + kfree(release); + } } static int qxl_release_bo_alloc(struct qxl_device *qdev, @@ -142,6 +240,10 @@ static int qxl_release_validate_bo(struct qxl_bo *bo) return ret; } + ret = reservation_object_reserve_shared(bo->tbo.resv); + if (ret) + return ret; + /* allocate a surface for reserved + validated buffers */ ret = qxl_bo_check_id(bo->gem_base.dev->dev_private, bo); if (ret) @@ -199,6 +301,8 @@ int qxl_alloc...

This series depends on the previously posted reservation api patches. 2 of them are not yet in for-next-fences branch of git://git.linaro.org/people/sumit.semwal/linux-3.x.git The missing patches are still in my vmwgfx_wip branch at git://people.freedesktop.org/~mlankhorst/linux All ttm drivers are converted to the fence api, fence_lock is removed and rcu is used in its place. qxl is the first

fence_is_signaled callback should support being run in atomic context, but not in irq context. Signed-off-by: Maarten Lankhorst <maarten.lankhorst at canonical.com> --- include/linux/fence.h | 23 +++++++++++++++++++---- 1 file changed, 19 insertions(+), 4 deletions(-) diff --git a/include/linux/fence.h b/include/linux/fence.h index d174585b874b..c1a4519ba2f5 100644 ---