drm/i915: Introduce DRM_I915_GEM_MMAP_OFFSET (cc662126) · Commits · 戴 / test

drivers/gpu/drm/i915/gem/i915_gem_domain.c

+1 −0

Original line number	Diff line number	Diff line
		@@ -13,6 +13,7 @@
		#include "i915_gem_object.h"
		#include "i915_vma.h"
		#include "i915_gem_lmem.h"
		#include "i915_gem_mman.h"

		static void __i915_gem_object_flush_for_display(struct drm_i915_gem_object *obj)
		{

drivers/gpu/drm/i915/gem/i915_gem_ioctls.h

+2 −2

Original line number	Diff line number	Diff line
		@@ -28,7 +28,7 @@ int i915_gem_madvise_ioctl(struct drm_device dev, void data,
		struct drm_file *file);
		int i915_gem_mmap_ioctl(struct drm_device dev, void data,
		struct drm_file *file);
		int i915_gem_mmap_gtt_ioctl(struct drm_device dev, void data,
		int i915_gem_mmap_offset_ioctl(struct drm_device dev, void data,
		struct drm_file *file);
		int i915_gem_pread_ioctl(struct drm_device dev, void data,
		struct drm_file *file);

drivers/gpu/drm/i915/gem/i915_gem_mman.c

+370 −91

Original line number	Diff line number	Diff line
		@@ -5,6 +5,7 @@
		*/

		#include <linux/mman.h>
		#include <linux/pfn_t.h>
		#include <linux/sizes.h>

		#include "gt/intel_gt.h"
		@@ -14,6 +15,7 @@
		#include "i915_gem_gtt.h"
		#include "i915_gem_ioctls.h"
		#include "i915_gem_object.h"
		#include "i915_gem_mman.h"
		#include "i915_trace.h"
		#include "i915_vma.h"

		@@ -144,6 +146,9 @@ static unsigned int tile_row_pages(const struct drm_i915_gem_object *obj)
		* 3 - Remove implicit set-domain(GTT) and synchronisation on initial
		* pagefault; swapin remains transparent.
		*
		* 4 - Support multiple fault handlers per object depending on object's
		* backing storage (a.k.a. MMAP_OFFSET).
		*
		* Restrictions:
		*
		* * snoopable objects cannot be accessed via the GTT. It can cause machine
		@@ -171,7 +176,7 @@ static unsigned int tile_row_pages(const struct drm_i915_gem_object *obj)
		*/
		int i915_gem_mmap_gtt_version(void)
		{
		return 3;
		return 4;
		}

		static inline struct i915_ggtt_view
		@@ -197,29 +202,83 @@ compute_partial_view(const struct drm_i915_gem_object *obj,
		return view;
		}

		/**
		* i915_gem_fault - fault a page into the GTT
		* @vmf: fault info
		*
		* The fault handler is set up by drm_gem_mmap() when a object is GTT mapped
		* from userspace. The fault handler takes care of binding the object to
		* the GTT (if needed), allocating and programming a fence register (again,
		* only if needed based on whether the old reg is still valid or the object
		* is tiled) and inserting a new PTE into the faulting process.
		*
		* Note that the faulting process may involve evicting existing objects
		* from the GTT and/or fence registers to make room. So performance may
		* suffer if the GTT working set is large or there are few fence registers
		* left.
		*
		* The current feature set supported by i915_gem_fault() and thus GTT mmaps
		* is exposed via I915_PARAM_MMAP_GTT_VERSION (see i915_gem_mmap_gtt_version).
		static vm_fault_t i915_error_to_vmf_fault(int err)
		{
		switch (err) {
		default:
		WARN_ONCE(err, "unhandled error in %s: %i\n", __func__, err);
		/* fallthrough */
		case -EIO: /* shmemfs failure from swap device */
		case -EFAULT: /* purged object */
		case -ENODEV: /* bad object, how did you get here! */
		return VM_FAULT_SIGBUS;

		case -ENOSPC: /* shmemfs allocation failure */
		case -ENOMEM: /* our allocation failure */
		return VM_FAULT_OOM;

		case 0:
		case -EAGAIN:
		case -ERESTARTSYS:
		case -EINTR:
		case -EBUSY:
		/*
		* EBUSY is ok: this just means that another thread
		* already did the job.
		*/
		vm_fault_t i915_gem_fault(struct vm_fault *vmf)
		return VM_FAULT_NOPAGE;
		}
		}

		static vm_fault_t vm_fault_cpu(struct vm_fault *vmf)
		{
		struct vm_area_struct *area = vmf->vma;
		struct i915_mmap_offset *mmo = area->vm_private_data;
		struct drm_i915_gem_object *obj = mmo->obj;
		unsigned long i, size = area->vm_end - area->vm_start;
		bool write = area->vm_flags & VM_WRITE;
		vm_fault_t ret = VM_FAULT_SIGBUS;
		int err;

		if (!i915_gem_object_has_struct_page(obj))
		return ret;

		/* Sanity check that we allow writing into this object */
		if (i915_gem_object_is_readonly(obj) && write)
		return ret;

		err = i915_gem_object_pin_pages(obj);
		if (err)
		return i915_error_to_vmf_fault(err);

		/* PTEs are revoked in obj->ops->put_pages() */
		for (i = 0; i < size >> PAGE_SHIFT; i++) {
		struct page *page = i915_gem_object_get_page(obj, i);

		ret = vmf_insert_pfn(area,
		(unsigned long)area->vm_start + i * PAGE_SIZE,
		page_to_pfn(page));
		if (ret != VM_FAULT_NOPAGE)
		break;
		}

		if (write) {
		GEM_BUG_ON(!i915_gem_object_has_pinned_pages(obj));
		obj->cache_dirty = true; /* XXX flush after PAT update? */
		obj->mm.dirty = true;
		}

		i915_gem_object_unpin_pages(obj);

		return ret;
		}

		static vm_fault_t vm_fault_gtt(struct vm_fault *vmf)
		{
		#define MIN_CHUNK_PAGES (SZ_1M >> PAGE_SHIFT)
		struct vm_area_struct *area = vmf->vma;
		struct drm_i915_gem_object *obj = to_intel_bo(area->vm_private_data);
		struct i915_mmap_offset *mmo = area->vm_private_data;
		struct drm_i915_gem_object *obj = mmo->obj;
		struct drm_device *dev = obj->base.dev;
		struct drm_i915_private *i915 = to_i915(dev);
		struct intel_runtime_pm *rpm = &i915->runtime_pm;
		@@ -312,6 +371,9 @@ vm_fault_t i915_gem_fault(struct vm_fault *vmf)
		list_add(&obj->userfault_link, &i915->ggtt.userfault_list);
		mutex_unlock(&i915->ggtt.vm.mutex);

		/* Track the mmo associated with the fenced vma */
		vma->mmo = mmo;

		if (IS_ACTIVE(CONFIG_DRM_I915_USERFAULT_AUTOSUSPEND))
		intel_wakeref_auto(&i915->ggtt.userfault_wakeref,
		msecs_to_jiffies_timeout(CONFIG_DRM_I915_USERFAULT_AUTOSUSPEND));
		@@ -332,67 +394,36 @@ err_rpm:
		intel_runtime_pm_put(rpm, wakeref);
		i915_gem_object_unpin_pages(obj);
		err:
		switch (ret) {
		default:
		WARN_ONCE(ret, "unhandled error in %s: %i\n", __func__, ret);
		/* fallthrough */
		case -EIO: /* shmemfs failure from swap device */
		case -EFAULT: /* purged object */
		case -ENODEV: /* bad object, how did you get here! */
		return VM_FAULT_SIGBUS;

		case -ENOSPC: /* shmemfs allocation failure */
		case -ENOMEM: /* our allocation failure */
		return VM_FAULT_OOM;

		case 0:
		case -EAGAIN:
		case -ERESTARTSYS:
		case -EINTR:
		case -EBUSY:
		/*
		* EBUSY is ok: this just means that another thread
		* already did the job.
		*/
		return VM_FAULT_NOPAGE;
		}
		return i915_error_to_vmf_fault(ret);
		}

		void __i915_gem_object_release_mmap(struct drm_i915_gem_object *obj)
		void __i915_gem_object_release_mmap_gtt(struct drm_i915_gem_object *obj)
		{
		struct i915_vma *vma;

		GEM_BUG_ON(!obj->userfault_count);

		obj->userfault_count = 0;
		list_del(&obj->userfault_link);
		drm_vma_node_unmap(&obj->base.vma_node,
		obj->base.dev->anon_inode->i_mapping);

		for_each_ggtt_vma(vma, obj)
		i915_vma_unset_userfault(vma);
		i915_vma_revoke_mmap(vma);

		GEM_BUG_ON(obj->userfault_count);
		}

		/**
		* i915_gem_object_release_mmap - remove physical page mappings
		* @obj: obj in question
		*
		* Preserve the reservation of the mmapping with the DRM core code, but
		* relinquish ownership of the pages back to the system.
		*
		/*
		* It is vital that we remove the page mapping if we have mapped a tiled
		* object through the GTT and then lose the fence register due to
		* resource pressure. Similarly if the object has been moved out of the
		* aperture, than pages mapped into userspace must be revoked. Removing the
		* mapping will then trigger a page fault on the next user access, allowing
		* fixup by i915_gem_fault().
		* fixup by vm_fault_gtt().
		*/
		void i915_gem_object_release_mmap(struct drm_i915_gem_object *obj)
		static void i915_gem_object_release_mmap_gtt(struct drm_i915_gem_object *obj)
		{
		struct drm_i915_private *i915 = to_i915(obj->base.dev);
		intel_wakeref_t wakeref;

		/* Serialisation between user GTT access and our code depends upon
		/*
		* Serialisation between user GTT access and our code depends upon
		* revoking the CPU's PTE whilst the mutex is held. The next user
		* pagefault then has to wait until we release the mutex.
		*
		@@ -406,9 +437,10 @@ void i915_gem_object_release_mmap(struct drm_i915_gem_object *obj)
		if (!obj->userfault_count)
		goto out;

		__i915_gem_object_release_mmap(obj);
		__i915_gem_object_release_mmap_gtt(obj);

		/* Ensure that the CPU's PTE are revoked and there are not outstanding
		/*
		* Ensure that the CPU's PTE are revoked and there are not outstanding
		* memory transactions from userspace before we return. The TLB
		* flushing implied above by changing the PTE above should be
		* sufficient, an extra barrier here just provides us with a bit
		@@ -422,57 +454,149 @@ out:
		intel_runtime_pm_put(&i915->runtime_pm, wakeref);
		}

		static int create_mmap_offset(struct drm_i915_gem_object *obj)
		void i915_gem_object_release_mmap_offset(struct drm_i915_gem_object *obj)
		{
		struct i915_mmap_offset *mmo;

		spin_lock(&obj->mmo.lock);
		list_for_each_entry(mmo, &obj->mmo.offsets, offset) {
		/*
		* vma_node_unmap for GTT mmaps handled already in
		* __i915_gem_object_release_mmap_gtt
		*/
		if (mmo->mmap_type == I915_MMAP_TYPE_GTT)
		continue;

		spin_unlock(&obj->mmo.lock);
		drm_vma_node_unmap(&mmo->vma_node,
		obj->base.dev->anon_inode->i_mapping);
		spin_lock(&obj->mmo.lock);
		}
		spin_unlock(&obj->mmo.lock);
		}

		/**
		* i915_gem_object_release_mmap - remove physical page mappings
		* @obj: obj in question
		*
		* Preserve the reservation of the mmapping with the DRM core code, but
		* relinquish ownership of the pages back to the system.
		*/
		void i915_gem_object_release_mmap(struct drm_i915_gem_object *obj)
		{
		i915_gem_object_release_mmap_gtt(obj);
		i915_gem_object_release_mmap_offset(obj);
		}

		static struct i915_mmap_offset *
		mmap_offset_attach(struct drm_i915_gem_object *obj,
		enum i915_mmap_type mmap_type,
		struct drm_file *file)
		{
		struct drm_i915_private *i915 = to_i915(obj->base.dev);
		struct intel_gt *gt = &i915->gt;
		struct i915_mmap_offset *mmo;
		int err;

		err = drm_gem_create_mmap_offset(&obj->base);
		mmo = kmalloc(sizeof(*mmo), GFP_KERNEL);
		if (!mmo)
		return ERR_PTR(-ENOMEM);

		mmo->obj = obj;
		mmo->dev = obj->base.dev;
		mmo->file = file;
		mmo->mmap_type = mmap_type;
		drm_vma_node_reset(&mmo->vma_node);

		err = drm_vma_offset_add(mmo->dev->vma_offset_manager, &mmo->vma_node,
		obj->base.size / PAGE_SIZE);
		if (likely(!err))
		return 0;
		goto out;

		/* Attempt to reap some mmap space from dead objects */
		err = intel_gt_retire_requests_timeout(gt, MAX_SCHEDULE_TIMEOUT);
		err = intel_gt_retire_requests_timeout(&i915->gt, MAX_SCHEDULE_TIMEOUT);
		if (err)
		return err;
		goto err;

		i915_gem_drain_freed_objects(i915);
		return drm_gem_create_mmap_offset(&obj->base);
		err = drm_vma_offset_add(mmo->dev->vma_offset_manager, &mmo->vma_node,
		obj->base.size / PAGE_SIZE);
		if (err)
		goto err;

		out:
		if (file)
		drm_vma_node_allow(&mmo->vma_node, file);

		spin_lock(&obj->mmo.lock);
		list_add(&mmo->offset, &obj->mmo.offsets);
		spin_unlock(&obj->mmo.lock);

		return mmo;

		err:
		kfree(mmo);
		return ERR_PTR(err);
		}

		int
		i915_gem_mmap_gtt(struct drm_file *file,
		struct drm_device *dev,
		static int
		__assign_mmap_offset(struct drm_file *file,
		u32 handle,
		enum i915_mmap_type mmap_type,
		u64 *offset)
		{
		struct drm_i915_gem_object *obj;
		int ret;

		if (!i915_ggtt_has_aperture(&to_i915(dev)->ggtt))
		return -ENODEV;
		struct i915_mmap_offset *mmo;
		int err;

		obj = i915_gem_object_lookup(file, handle);
		if (!obj)
		return -ENOENT;

		if (i915_gem_object_never_bind_ggtt(obj)) {
		ret = -ENODEV;
		if (mmap_type == I915_MMAP_TYPE_GTT &&
		i915_gem_object_never_bind_ggtt(obj)) {
		err = -ENODEV;
		goto out;
		}

		ret = create_mmap_offset(obj);
		if (ret == 0)
		*offset = drm_vma_node_offset_addr(&obj->base.vma_node);
		if (mmap_type != I915_MMAP_TYPE_GTT &&
		!i915_gem_object_has_struct_page(obj)) {
		err = -ENODEV;
		goto out;
		}

		mmo = mmap_offset_attach(obj, mmap_type, file);
		if (IS_ERR(mmo)) {
		err = PTR_ERR(mmo);
		goto out;
		}

		*offset = drm_vma_node_offset_addr(&mmo->vma_node);
		err = 0;
		out:
		i915_gem_object_put(obj);
		return ret;
		return err;
		}

		int
		i915_gem_dumb_mmap_offset(struct drm_file *file,
		struct drm_device *dev,
		u32 handle,
		u64 *offset)
		{
		enum i915_mmap_type mmap_type;

		if (boot_cpu_has(X86_FEATURE_PAT))
		mmap_type = I915_MMAP_TYPE_WC;
		else if (!i915_ggtt_has_aperture(&to_i915(dev)->ggtt))
		return -ENODEV;
		else
		mmap_type = I915_MMAP_TYPE_GTT;

		return __assign_mmap_offset(file, handle, mmap_type, offset);
		}

		/**
		* i915_gem_mmap_gtt_ioctl - prepare an object for GTT mmap'ing
		* i915_gem_mmap_offset_ioctl - prepare an object for GTT mmap'ing
		* @dev: DRM device
		* @data: GTT mapping ioctl data
		* @file: GEM object info
		@@ -487,12 +611,167 @@ out:
		* userspace.
		*/
		int
		i915_gem_mmap_gtt_ioctl(struct drm_device dev, void data,
		i915_gem_mmap_offset_ioctl(struct drm_device dev, void data,
		struct drm_file *file)
		{
		struct drm_i915_gem_mmap_gtt *args = data;
		struct drm_i915_private *i915 = to_i915(dev);
		struct drm_i915_gem_mmap_offset *args = data;
		enum i915_mmap_type type;

		if (args->extensions)
		return -EINVAL;

		switch (args->flags) {
		case I915_MMAP_OFFSET_GTT:
		if (!i915_ggtt_has_aperture(&i915->ggtt))
		return -ENODEV;
		type = I915_MMAP_TYPE_GTT;
		break;

		case I915_MMAP_OFFSET_WC:
		if (!boot_cpu_has(X86_FEATURE_PAT))
		return -ENODEV;
		type = I915_MMAP_TYPE_WC;
		break;

		case I915_MMAP_OFFSET_WB:
		type = I915_MMAP_TYPE_WB;
		break;

		case I915_MMAP_OFFSET_UC:
		if (!boot_cpu_has(X86_FEATURE_PAT))
		return -ENODEV;
		type = I915_MMAP_TYPE_UC;
		break;

		default:
		return -EINVAL;
		}

		return __assign_mmap_offset(file, args->handle, type, &args->offset);
		}

		static void vm_open(struct vm_area_struct *vma)
		{
		struct i915_mmap_offset *mmo = vma->vm_private_data;
		struct drm_i915_gem_object *obj = mmo->obj;

		GEM_BUG_ON(!obj);
		i915_gem_object_get(obj);
		}

		static void vm_close(struct vm_area_struct *vma)
		{
		struct i915_mmap_offset *mmo = vma->vm_private_data;
		struct drm_i915_gem_object *obj = mmo->obj;

		return i915_gem_mmap_gtt(file, dev, args->handle, &args->offset);
		GEM_BUG_ON(!obj);
		i915_gem_object_put(obj);
		}

		static const struct vm_operations_struct vm_ops_gtt = {
		.fault = vm_fault_gtt,
		.open = vm_open,
		.close = vm_close,
		};

		static const struct vm_operations_struct vm_ops_cpu = {
		.fault = vm_fault_cpu,
		.open = vm_open,
		.close = vm_close,
		};

		/*
		* This overcomes the limitation in drm_gem_mmap's assignment of a
		* drm_gem_object as the vma->vm_private_data. Since we need to
		* be able to resolve multiple mmap offsets which could be tied
		* to a single gem object.
		*/
		int i915_gem_mmap(struct file filp, struct vm_area_struct vma)
		{
		struct drm_vma_offset_node *node;
		struct drm_file *priv = filp->private_data;
		struct drm_device *dev = priv->minor->dev;
		struct i915_mmap_offset *mmo = NULL;
		struct drm_gem_object *obj = NULL;

		if (drm_dev_is_unplugged(dev))
		return -ENODEV;

		drm_vma_offset_lock_lookup(dev->vma_offset_manager);
		node = drm_vma_offset_exact_lookup_locked(dev->vma_offset_manager,
		vma->vm_pgoff,
		vma_pages(vma));
		if (likely(node)) {
		mmo = container_of(node, struct i915_mmap_offset,
		vma_node);
		/*
		* In our dependency chain, the drm_vma_offset_node
		* depends on the validity of the mmo, which depends on
		* the gem object. However the only reference we have
		* at this point is the mmo (as the parent of the node).
		* Try to check if the gem object was at least cleared.
		*/
		if (!mmo \|\| !mmo->obj) {
		drm_vma_offset_unlock_lookup(dev->vma_offset_manager);
		return -EINVAL;
		}
		/*
		* Skip 0-refcnted objects as it is in the process of being
		* destroyed and will be invalid when the vma manager lock
		* is released.
		*/
		obj = &mmo->obj->base;
		if (!kref_get_unless_zero(&obj->refcount))
		obj = NULL;
		}
		drm_vma_offset_unlock_lookup(dev->vma_offset_manager);
		if (!obj)
		return -EINVAL;

		if (!drm_vma_node_is_allowed(node, priv)) {
		drm_gem_object_put_unlocked(obj);
		return -EACCES;
		}

		if (i915_gem_object_is_readonly(to_intel_bo(obj))) {
		if (vma->vm_flags & VM_WRITE) {
		drm_gem_object_put_unlocked(obj);
		return -EINVAL;
		}
		vma->vm_flags &= ~VM_MAYWRITE;
		}

		vma->vm_flags \|= VM_PFNMAP \| VM_DONTEXPAND \| VM_DONTDUMP;
		vma->vm_private_data = mmo;

		switch (mmo->mmap_type) {
		case I915_MMAP_TYPE_WC:
		vma->vm_page_prot =
		pgprot_writecombine(vm_get_page_prot(vma->vm_flags));
		vma->vm_ops = &vm_ops_cpu;
		break;

		case I915_MMAP_TYPE_WB:
		vma->vm_page_prot = vm_get_page_prot(vma->vm_flags);
		vma->vm_ops = &vm_ops_cpu;
		break;

		case I915_MMAP_TYPE_UC:
		vma->vm_page_prot =
		pgprot_noncached(vm_get_page_prot(vma->vm_flags));
		vma->vm_ops = &vm_ops_cpu;
		break;

		case I915_MMAP_TYPE_GTT:
		vma->vm_page_prot =
		pgprot_writecombine(vm_get_page_prot(vma->vm_flags));
		vma->vm_ops = &vm_ops_gtt;
		break;
		}
		vma->vm_page_prot = pgprot_decrypted(vma->vm_page_prot);

		return 0;
		}

		#if IS_ENABLED(CONFIG_DRM_I915_SELFTEST)

drivers/gpu/drm/i915/gem/i915_gem_mman.h

0 → 100644

+31 −0

Original line number	Diff line number	Diff line
		/*
		* SPDX-License-Identifier: MIT
		*
		* Copyright © 2019 Intel Corporation
		*/

		#ifndef __I915_GEM_MMAN_H__
		#define __I915_GEM_MMAN_H__

		#include <linux/mm_types.h>
		#include <linux/types.h>

		struct drm_device;
		struct drm_file;
		struct drm_i915_gem_object;
		struct file;
		struct i915_mmap_offset;
		struct mutex;

		int i915_gem_mmap_gtt_version(void);
		int i915_gem_mmap(struct file filp, struct vm_area_struct vma);

		int i915_gem_dumb_mmap_offset(struct drm_file *file_priv,
		struct drm_device *dev,
		u32 handle, u64 *offset);

		void __i915_gem_object_release_mmap_gtt(struct drm_i915_gem_object *obj);
		void i915_gem_object_release_mmap(struct drm_i915_gem_object *obj);
		void i915_gem_object_release_mmap_offset(struct drm_i915_gem_object *obj);

		#endif

drivers/gpu/drm/i915/gem/i915_gem_object.c

+27 −0

Original line number	Diff line number	Diff line
		@@ -29,6 +29,7 @@
		#include "i915_drv.h"
		#include "i915_gem_clflush.h"
		#include "i915_gem_context.h"
		#include "i915_gem_mman.h"
		#include "i915_gem_object.h"
		#include "i915_globals.h"
		#include "i915_trace.h"
		@@ -61,6 +62,9 @@ void i915_gem_object_init(struct drm_i915_gem_object *obj,

		INIT_LIST_HEAD(&obj->lut_list);

		spin_lock_init(&obj->mmo.lock);
		INIT_LIST_HEAD(&obj->mmo.offsets);

		init_rcu_head(&obj->rcu);

		obj->ops = ops;
		@@ -97,6 +101,7 @@ void i915_gem_close_object(struct drm_gem_object gem, struct drm_file file)
		struct drm_i915_gem_object *obj = to_intel_bo(gem);
		struct drm_i915_file_private *fpriv = file->driver_priv;
		struct i915_lut_handle lut, ln;
		struct i915_mmap_offset *mmo;
		LIST_HEAD(close);

		i915_gem_object_lock(obj);
		@@ -111,6 +116,17 @@ void i915_gem_close_object(struct drm_gem_object gem, struct drm_file file)
		}
		i915_gem_object_unlock(obj);

		spin_lock(&obj->mmo.lock);
		list_for_each_entry(mmo, &obj->mmo.offsets, offset) {
		if (mmo->file != file)
		continue;

		spin_unlock(&obj->mmo.lock);
		drm_vma_node_revoke(&mmo->vma_node, file);
		spin_lock(&obj->mmo.lock);
		}
		spin_unlock(&obj->mmo.lock);

		list_for_each_entry_safe(lut, ln, &close, obj_link) {
		struct i915_gem_context *ctx = lut->ctx;
		struct i915_vma *vma;
		@@ -158,6 +174,8 @@ static void __i915_gem_free_objects(struct drm_i915_private *i915,

		wakeref = intel_runtime_pm_get(&i915->runtime_pm);
		llist_for_each_entry_safe(obj, on, freed, freed) {
		struct i915_mmap_offset mmo, mn;

		trace_i915_gem_object_destroy(obj);

		if (!list_empty(&obj->vma.list)) {
		@@ -183,6 +201,15 @@ static void __i915_gem_free_objects(struct drm_i915_private *i915,
		spin_unlock(&obj->vma.lock);
		}

		i915_gem_object_release_mmap(obj);

		list_for_each_entry_safe(mmo, mn, &obj->mmo.offsets, offset) {
		drm_vma_offset_remove(obj->base.dev->vma_offset_manager,
		&mmo->vma_node);
		kfree(mmo);
		}
		INIT_LIST_HEAD(&obj->mmo.offsets);

		GEM_BUG_ON(atomic_read(&obj->bind_count));
		GEM_BUG_ON(obj->userfault_count);
		GEM_BUG_ON(!list_empty(&obj->lut_list));

Admin message