Commit af626103 authored by Chris Wilson's avatar Chris Wilson

drm/i915: Hold a reference to the object whilst unbinding the eviction list

During heavy aperture thrashing we may be forced to wait upon several active
objects during eviction. The active list may be the last reference to
these objects and so the action of waiting upon one of them may cause
another to be freed (and itself unbound). To prevent the object
disappearing underneath us, we need to acquire and hold a reference
whilst unbinding.

This should fix the reported page refcount OOPS:

kernel BUG at drivers/gpu/drm/i915/i915_gem.c:1444!
...
RIP: 0010:[<ffffffffa0093026>]  [<ffffffffa0093026>] i915_gem_object_put_pages+0x25/0xf5 [i915]
Call Trace:
 [<ffffffffa009481d>] i915_gem_object_unbind+0xc5/0x1a7 [i915]
 [<ffffffffa0098ab2>] i915_gem_evict_something+0x3bd/0x409 [i915]
 [<ffffffffa0027923>] ? drm_gem_object_lookup+0x27/0x57 [drm]
 [<ffffffffa0093bc3>] i915_gem_object_bind_to_gtt+0x1d3/0x279 [i915]
 [<ffffffffa0095b30>] i915_gem_object_pin+0xa3/0x146 [i915]
 [<ffffffffa0027948>] ? drm_gem_object_lookup+0x4c/0x57 [drm]
 [<ffffffffa00961bc>] i915_gem_do_execbuffer+0x50d/0xe32 [i915]
Reported-by: default avatarShawn Starr <shawn.starr@rogers.com>
Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=18902Signed-off-by: default avatarChris Wilson <chris@chris-wilson.co.uk>
parent 41a51428
...@@ -79,6 +79,7 @@ mark_free(struct drm_i915_gem_object *obj_priv, ...@@ -79,6 +79,7 @@ mark_free(struct drm_i915_gem_object *obj_priv,
struct list_head *unwind) struct list_head *unwind)
{ {
list_add(&obj_priv->evict_list, unwind); list_add(&obj_priv->evict_list, unwind);
drm_gem_object_reference(&obj_priv->base);
return drm_mm_scan_add_block(obj_priv->gtt_space); return drm_mm_scan_add_block(obj_priv->gtt_space);
} }
...@@ -165,6 +166,7 @@ i915_gem_evict_something(struct drm_device *dev, int min_size, unsigned alignmen ...@@ -165,6 +166,7 @@ i915_gem_evict_something(struct drm_device *dev, int min_size, unsigned alignmen
list_for_each_entry(obj_priv, &unwind_list, evict_list) { list_for_each_entry(obj_priv, &unwind_list, evict_list) {
ret = drm_mm_scan_remove_block(obj_priv->gtt_space); ret = drm_mm_scan_remove_block(obj_priv->gtt_space);
BUG_ON(ret); BUG_ON(ret);
drm_gem_object_unreference(&obj_priv->base);
} }
/* We expect the caller to unpin, evict all and try again, or give up. /* We expect the caller to unpin, evict all and try again, or give up.
...@@ -181,18 +183,21 @@ i915_gem_evict_something(struct drm_device *dev, int min_size, unsigned alignmen ...@@ -181,18 +183,21 @@ i915_gem_evict_something(struct drm_device *dev, int min_size, unsigned alignmen
* scanning, therefore store to be evicted objects on a * scanning, therefore store to be evicted objects on a
* temporary list. */ * temporary list. */
list_move(&obj_priv->evict_list, &eviction_list); list_move(&obj_priv->evict_list, &eviction_list);
} } else
drm_gem_object_unreference(&obj_priv->base);
} }
/* Unbinding will emit any required flushes */ /* Unbinding will emit any required flushes */
list_for_each_entry_safe(obj_priv, tmp_obj_priv, list_for_each_entry_safe(obj_priv, tmp_obj_priv,
&eviction_list, evict_list) { &eviction_list, evict_list) {
#if WATCH_LRU #if WATCH_LRU
DRM_INFO("%s: evicting %p\n", __func__, obj); DRM_INFO("%s: evicting %p\n", __func__, &obj_priv->base);
#endif #endif
ret = i915_gem_object_unbind(&obj_priv->base); ret = i915_gem_object_unbind(&obj_priv->base);
if (ret) if (ret)
return ret; return ret;
drm_gem_object_unreference(&obj_priv->base);
} }
/* The just created free hole should be on the top of the free stack /* The just created free hole should be on the top of the free stack
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment