[resend PATCH] drm/ttm: Fix a deadlock if the target BO is not idle during swap

[Daniel Vetter]

On Thu, Sep 09, 2021 at 09:10:39AM +0200, Christian König wrote:
> Am 08.09.21 um 20:27 schrieb Daniel Vetter:
> > On Tue, Sep 07, 2021 at 11:28:23AM +0200, Christian König wrote:
> > > Am 07.09.21 um 11:05 schrieb Daniel Vetter:
> > > > On Tue, Sep 07, 2021 at 08:22:20AM +0200, Christian König wrote:
> > > > > Added a Fixes tag and pushed this to drm-misc-fixes.
> > > > We're in the merge window, this should have been drm-misc-next-fixes. I'll
> > > > poke misc maintainers so it's not lost.
> > > Hui? It's a fix for a problem in stable and not in drm-misc-next.
> > Ah the flow chart is confusing. There is no current -rc, so it's always
> > -next-fixes. Or you're running the risk that it's lost until after -rc1.
> > Maybe we should clarify that "is the bug in current -rc?" only applies if
> > there is a current -rc.
> 
> Yeah, I've noticed this as well.
> 
> But when there is no current -rc because we are in the merge window then the
> question is how do I submit patches to the current stable?

You never submit patches directly to stable. It's always "get it into
Linus' tree asap" plus either Cc: stable or a Fixes: line. During merge
window "get into Linus' tree asap" means "put it into drm-misc-next-fixes"

> In other words this patch here is really for 5.14 and should then be
> backported to 5.13 and maybe even 5.10 as well.
> 
> The code was restructured for 5.15 and I even need to double check if that
> still applies there as well.
> 
> Or should I send patches like those directly to Greg?

Nope. Just fastest path into Linus' tree is good enough. Greg picks up
patches directly from the merge window if it has one of the tags. There's
occasionally a bit of grumbling because there's so many stable patches
coming in during the merge window, but otherwise it should be in stable in
the next release like during -rc phase.
-Daniel

> Regards,
> Christian.
> 
> > 
> > Anyway Thomas sent out a pr, so it's all good.
> > -Daniel
> > 
> > > Christian.
> > > 
> > > > -Daniel
> > > > 
> > > > > It will take a while until it cycles back into the development branches, so
> > > > > feel free to push some version to amd-staging-drm-next as well. Just ping
> > > > > Alex when you do this.
> > > > > 
> > > > > Thanks,
> > > > > Christian.
> > > > > 
> > > > > Am 07.09.21 um 06:08 schrieb xinhui pan:
> > > > > > The ret value might be -EBUSY, caller will think lru lock is still
> > > > > > locked but actually NOT. So return -ENOSPC instead. Otherwise we hit
> > > > > > list corruption.
> > > > > > 
> > > > > > ttm_bo_cleanup_refs might fail too if BO is not idle. If we return 0,
> > > > > > caller(ttm_tt_populate -> ttm_global_swapout ->ttm_device_swapout) will
> > > > > > be stuck as we actually did not free any BO memory. This usually happens
> > > > > > when the fence is not signaled for a long time.
> > > > > > 
> > > > > > Signed-off-by: xinhui pan <xinhui.pan at amd.com>
> > > > > > Reviewed-by: Christian König <christian.koenig at amd.com>
> > > > > > ---
> > > > > >     drivers/gpu/drm/ttm/ttm_bo.c | 6 +++---
> > > > > >     1 file changed, 3 insertions(+), 3 deletions(-)
> > > > > > 
> > > > > > diff --git a/drivers/gpu/drm/ttm/ttm_bo.c b/drivers/gpu/drm/ttm/ttm_bo.c
> > > > > > index 8d7fd65ccced..23f906941ac9 100644
> > > > > > --- a/drivers/gpu/drm/ttm/ttm_bo.c
> > > > > > +++ b/drivers/gpu/drm/ttm/ttm_bo.c
> > > > > > @@ -1152,9 +1152,9 @@ int ttm_bo_swapout(struct ttm_buffer_object *bo, struct ttm_operation_ctx *ctx,
> > > > > >     	}
> > > > > >     	if (bo->deleted) {
> > > > > > -		ttm_bo_cleanup_refs(bo, false, false, locked);
> > > > > > +		ret = ttm_bo_cleanup_refs(bo, false, false, locked);
> > > > > >     		ttm_bo_put(bo);
> > > > > > -		return 0;
> > > > > > +		return ret == -EBUSY ? -ENOSPC : ret;
> > > > > >     	}
> > > > > >     	ttm_bo_del_from_lru(bo);
> > > > > > @@ -1208,7 +1208,7 @@ int ttm_bo_swapout(struct ttm_buffer_object *bo, struct ttm_operation_ctx *ctx,
> > > > > >     	if (locked)
> > > > > >     		dma_resv_unlock(bo->base.resv);
> > > > > >     	ttm_bo_put(bo);
> > > > > > -	return ret;
> > > > > > +	return ret == -EBUSY ? -ENOSPC : ret;
> > > > > >     }
> > > > > >     void ttm_bo_tt_destroy(struct ttm_buffer_object *bo)
> 

-- 
Daniel Vetter
Software Engineer, Intel Corporation
http://blog.ffwll.ch