[resend PATCH] drm/ttm: Fix a deadlock if the target BO is not idle during swap

[Christian König]

Am 14.09.21 um 15:50 schrieb Daniel Vetter:
> On Thu, Sep 09, 2021 at 09:10:39AM +0200, Christian König wrote:
>> Am 08.09.21 um 20:27 schrieb Daniel Vetter:
>>> On Tue, Sep 07, 2021 at 11:28:23AM +0200, Christian König wrote:
>>>> Am 07.09.21 um 11:05 schrieb Daniel Vetter:
>>>>> On Tue, Sep 07, 2021 at 08:22:20AM +0200, Christian König wrote:
>>>>>> Added a Fixes tag and pushed this to drm-misc-fixes.
>>>>> We're in the merge window, this should have been drm-misc-next-fixes. I'll
>>>>> poke misc maintainers so it's not lost.
>>>> Hui? It's a fix for a problem in stable and not in drm-misc-next.
>>> Ah the flow chart is confusing. There is no current -rc, so it's always
>>> -next-fixes. Or you're running the risk that it's lost until after -rc1.
>>> Maybe we should clarify that "is the bug in current -rc?" only applies if
>>> there is a current -rc.
>> Yeah, I've noticed this as well.
>>
>> But when there is no current -rc because we are in the merge window then the
>> question is how do I submit patches to the current stable?
> You never submit patches directly to stable. It's always "get it into
> Linus' tree asap" plus either Cc: stable or a Fixes: line.

But what if the code in drm-misc-next-fixes has been restructured and 
doesn't have that issue any more?

How do I get the patch into stable then? Submitting directly to Greg?

Thanks,
Christian.

>   During merge
> window "get into Linus' tree asap" means "put it into drm-misc-next-fixes"
>
>> In other words this patch here is really for 5.14 and should then be
>> backported to 5.13 and maybe even 5.10 as well.
>>
>> The code was restructured for 5.15 and I even need to double check if that
>> still applies there as well.
>>
>> Or should I send patches like those directly to Greg?
> Nope. Just fastest path into Linus' tree is good enough. Greg picks up
> patches directly from the merge window if it has one of the tags. There's
> occasionally a bit of grumbling because there's so many stable patches
> coming in during the merge window, but otherwise it should be in stable in
> the next release like during -rc phase.
> -Daniel
>
>> Regards,
>> Christian.
>>
>>> Anyway Thomas sent out a pr, so it's all good.
>>> -Daniel
>>>
>>>> Christian.
>>>>
>>>>> -Daniel
>>>>>
>>>>>> It will take a while until it cycles back into the development branches, so
>>>>>> feel free to push some version to amd-staging-drm-next as well. Just ping
>>>>>> Alex when you do this.
>>>>>>
>>>>>> Thanks,
>>>>>> Christian.
>>>>>>
>>>>>> Am 07.09.21 um 06:08 schrieb xinhui pan:
>>>>>>> The ret value might be -EBUSY, caller will think lru lock is still
>>>>>>> locked but actually NOT. So return -ENOSPC instead. Otherwise we hit
>>>>>>> list corruption.
>>>>>>>
>>>>>>> ttm_bo_cleanup_refs might fail too if BO is not idle. If we return 0,
>>>>>>> caller(ttm_tt_populate -> ttm_global_swapout ->ttm_device_swapout) will
>>>>>>> be stuck as we actually did not free any BO memory. This usually happens
>>>>>>> when the fence is not signaled for a long time.
>>>>>>>
>>>>>>> Signed-off-by: xinhui pan <xinhui.pan at amd.com>
>>>>>>> Reviewed-by: Christian König <christian.koenig at amd.com>
>>>>>>> ---
>>>>>>>      drivers/gpu/drm/ttm/ttm_bo.c | 6 +++---
>>>>>>>      1 file changed, 3 insertions(+), 3 deletions(-)
>>>>>>>
>>>>>>> diff --git a/drivers/gpu/drm/ttm/ttm_bo.c b/drivers/gpu/drm/ttm/ttm_bo.c
>>>>>>> index 8d7fd65ccced..23f906941ac9 100644
>>>>>>> --- a/drivers/gpu/drm/ttm/ttm_bo.c
>>>>>>> +++ b/drivers/gpu/drm/ttm/ttm_bo.c
>>>>>>> @@ -1152,9 +1152,9 @@ int ttm_bo_swapout(struct ttm_buffer_object *bo, struct ttm_operation_ctx *ctx,
>>>>>>>      	}
>>>>>>>      	if (bo->deleted) {
>>>>>>> -		ttm_bo_cleanup_refs(bo, false, false, locked);
>>>>>>> +		ret = ttm_bo_cleanup_refs(bo, false, false, locked);
>>>>>>>      		ttm_bo_put(bo);
>>>>>>> -		return 0;
>>>>>>> +		return ret == -EBUSY ? -ENOSPC : ret;
>>>>>>>      	}
>>>>>>>      	ttm_bo_del_from_lru(bo);
>>>>>>> @@ -1208,7 +1208,7 @@ int ttm_bo_swapout(struct ttm_buffer_object *bo, struct ttm_operation_ctx *ctx,
>>>>>>>      	if (locked)
>>>>>>>      		dma_resv_unlock(bo->base.resv);
>>>>>>>      	ttm_bo_put(bo);
>>>>>>> -	return ret;
>>>>>>> +	return ret == -EBUSY ? -ENOSPC : ret;
>>>>>>>      }
>>>>>>>      void ttm_bo_tt_destroy(struct ttm_buffer_object *bo)