Skip to contentSkip to conversation

FAILED: patch "[PATCH] drm/vmwgfx: Prevent unmapping active read buffers" failed to apply to 6.1-stable tree

PATCH [email protected] 1 participant 1 message Aug 30, 2024

Subsystems (4)
Stable branch DRM drivers DRM misc DRM driver for VMware virtual GPU
lore
Share & tools
lore

[email protected]

author maintainer
#0 lore raw

The patch below does not apply to the 6.1-stable tree.
If someone wants it applied there, or to any other stable or longterm tree, then please email the backport, including the original git commit id to <[email protected]>.

To reproduce the conflict and resubmit, you may use the following commands:

git fetch https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ linux-6.1.y
git checkout FETCH_HEAD
git cherry-pick -x aba07b9a0587f50e5d3346eaa19019cf3f86c0ea
# <resolve conflicts, build, test, etc.>
git commit -s
git send-email --to '<[email protected]>' --in-reply-to '2024083034-repave-fit-eff7@gregkh' --subject-prefix 'PATCH 6.1.y' HEAD^..

Possible dependencies:

aba07b9a0587 ("drm/vmwgfx: Prevent unmapping active read buffers") d6667f0ddf46 ("drm/vmwgfx: Fix handling of dumb buffers") 0208ca55aa9c ("Backmerge tag 'v6.9-rc5' into drm-next")

thanks,

greg k-h

------------------ original commit in Linus's tree ------------------

From aba07b9a0587f50e5d3346eaa19019cf3f86c0ea Mon Sep 17 00:00:00 2001
From: Zack Rusin <[email protected]>
Date: Fri, 16 Aug 2024 14:32:05 -0400
Subject: [PATCH] drm/vmwgfx: Prevent unmapping active read buffers

The kms paths keep a persistent map active to read and compare the cursor buffer. These maps can race with each other in simple scenario where:
a) buffer "a" mapped for update
b) buffer "a" mapped for compare
c) do the compare
d) unmap "a" for compare
e) update the cursor
f) unmap "a" for update
At step "e" the buffer has been unmapped and the read contents is bogus.

Prevent unmapping of active read buffers by simply keeping a count of how many paths have currently active maps and unmap only when the count reaches 0.

Fixes 485d98d472d5 ("drm/vmwgfx: Add support for CursorMob and CursorBypass 4")
Cc Broadcom internal kernel review list <[email protected]>
Cc [email protected]
Cc <[email protected]> # v5.19+
Signed-off-by Zack Rusin <[email protected]>
Link https://patchwork.freedesktop.org/patch/msgid/[email protected]
Reviewed-by Martin Krastev <[email protected]>
Reviewed-by Maaz Mombasawala <[email protected]>
drivers/gpu/drm/vmwgfx/vmwgfx_bo.c +11 -2
index f42ebc4a7c22..a0e433fbcba6 100644
@@ -360,6 +360,8 @@ void *vmw_bo_map_and_cache_size(struct vmw_bo *vbo, size_t size)
 	void *virtual;
 	int ret;
 
+	atomic_inc(&vbo->map_count);
+
 	virtual = ttm_kmap_obj_virtual(&vbo->map, &not_used);
 	if (virtual)
 		return virtual;

@@ -383,11 +385,17 @@ void *vmw_bo_map_and_cache_size(struct vmw_bo *vbo, size_t size)
  */
 void vmw_bo_unmap(struct vmw_bo *vbo)
 {
+	int map_count;
+
 	if (vbo->map.bo == NULL)
 		return;
 
-	ttm_bo_kunmap(&vbo->map);
-	vbo->map.bo = NULL;
+	map_count = atomic_dec_return(&vbo->map_count);
+
+	if (!map_count) {
+		ttm_bo_kunmap(&vbo->map);
+		vbo->map.bo = NULL;
+	}
 }
 
 

@@ -421,6 +429,7 @@ static int vmw_bo_init(struct vmw_private *dev_priv,
 	vmw_bo->tbo.priority = 3;
 	vmw_bo->res_tree = RB_ROOT;
 	xa_init(&vmw_bo->detached_resources);
+	atomic_set(&vmw_bo->map_count, 0);
 
 	params->size = ALIGN(params->size, PAGE_SIZE);
 	drm_gem_private_object_init(vdev, &vmw_bo->tbo.base, params->size);
drivers/gpu/drm/vmwgfx/vmwgfx_bo.h +3 -0
index 62b4342d5f7c..43b5439ec9f7 100644
@@ -71,6 +71,8 @@ struct vmw_bo_params {
  * @map: Kmap object for semi-persistent mappings
  * @res_tree: RB tree of resources using this buffer object as a backing MOB
  * @res_prios: Eviction priority counts for attached resources
+ * @map_count: The number of currently active maps. Will differ from the
+ * cpu_writers because it includes kernel maps.
  * @cpu_writers: Number of synccpu write grabs. Protected by reservation when
  * increased. May be decreased without reservation.
  * @dx_query_ctx: DX context if this buffer object is used as a DX query MOB

@@ -90,6 +92,7 @@ struct vmw_bo {
 	u32 res_prios[TTM_MAX_BO_PRIORITY];
 	struct xarray detached_resources;
 
+	atomic_t map_count;
 	atomic_t cpu_writers;
 	/* Not ref-counted.  Protected by binding_mutex */
 	struct vmw_resource *dx_query_ctx;