[resend PATCH] drm/ttm: Fix a deadlock if the target BO is not idle during swap

[Daniel Vetter]

On Wed, Sep 15, 2021 at 12:05:30PM +0200, Christian König wrote:
> Am 14.09.21 um 15:50 schrieb Daniel Vetter:
> > On Thu, Sep 09, 2021 at 09:10:39AM +0200, Christian König wrote:
> > > Am 08.09.21 um 20:27 schrieb Daniel Vetter:
> > > > On Tue, Sep 07, 2021 at 11:28:23AM +0200, Christian König wrote:
> > > > > Am 07.09.21 um 11:05 schrieb Daniel Vetter:
> > > > > > On Tue, Sep 07, 2021 at 08:22:20AM +0200, Christian König wrote:
> > > > > > > Added a Fixes tag and pushed this to drm-misc-fixes.
> > > > > > We're in the merge window, this should have been drm-misc-next-fixes. I'll
> > > > > > poke misc maintainers so it's not lost.
> > > > > Hui? It's a fix for a problem in stable and not in drm-misc-next.
> > > > Ah the flow chart is confusing. There is no current -rc, so it's always
> > > > -next-fixes. Or you're running the risk that it's lost until after -rc1.
> > > > Maybe we should clarify that "is the bug in current -rc?" only applies if
> > > > there is a current -rc.
> > > Yeah, I've noticed this as well.
> > > 
> > > But when there is no current -rc because we are in the merge window then the
> > > question is how do I submit patches to the current stable?
> > You never submit patches directly to stable. It's always "get it into
> > Linus' tree asap" plus either Cc: stable or a Fixes: line.
> 
> But what if the code in drm-misc-next-fixes has been restructured and
> doesn't have that issue any more?
> 
> How do I get the patch into stable then? Submitting directly to Greg?

Yes, that's the exception. With a reference to the commit in Linus' tree
that resolves the issue, and an explainer why you need something else as a
backport.

https://dri.freedesktop.org/docs/drm/process/stable-kernel-rules.html#option-3

Cheers, Daniel

> 
> Thanks,
> Christian.
> 
> >   During merge
> > window "get into Linus' tree asap" means "put it into drm-misc-next-fixes"
> > 
> > > In other words this patch here is really for 5.14 and should then be
> > > backported to 5.13 and maybe even 5.10 as well.
> > > 
> > > The code was restructured for 5.15 and I even need to double check if that
> > > still applies there as well.
> > > 
> > > Or should I send patches like those directly to Greg?
> > Nope. Just fastest path into Linus' tree is good enough. Greg picks up
> > patches directly from the merge window if it has one of the tags. There's
> > occasionally a bit of grumbling because there's so many stable patches
> > coming in during the merge window, but otherwise it should be in stable in
> > the next release like during -rc phase.
> > -Daniel
> > 
> > > Regards,
> > > Christian.
> > > 
> > > > Anyway Thomas sent out a pr, so it's all good.
> > > > -Daniel
> > > > 
> > > > > Christian.
> > > > > 
> > > > > > -Daniel
> > > > > > 
> > > > > > > It will take a while until it cycles back into the development branches, so
> > > > > > > feel free to push some version to amd-staging-drm-next as well. Just ping
> > > > > > > Alex when you do this.
> > > > > > > 
> > > > > > > Thanks,
> > > > > > > Christian.
> > > > > > > 
> > > > > > > Am 07.09.21 um 06:08 schrieb xinhui pan:
> > > > > > > > The ret value might be -EBUSY, caller will think lru lock is still
> > > > > > > > locked but actually NOT. So return -ENOSPC instead. Otherwise we hit
> > > > > > > > list corruption.
> > > > > > > > 
> > > > > > > > ttm_bo_cleanup_refs might fail too if BO is not idle. If we return 0,
> > > > > > > > caller(ttm_tt_populate -> ttm_global_swapout ->ttm_device_swapout) will
> > > > > > > > be stuck as we actually did not free any BO memory. This usually happens
> > > > > > > > when the fence is not signaled for a long time.
> > > > > > > > 
> > > > > > > > Signed-off-by: xinhui pan <xinhui.pan at amd.com>
> > > > > > > > Reviewed-by: Christian König <christian.koenig at amd.com>
> > > > > > > > ---
> > > > > > > >      drivers/gpu/drm/ttm/ttm_bo.c | 6 +++---
> > > > > > > >      1 file changed, 3 insertions(+), 3 deletions(-)
> > > > > > > > 
> > > > > > > > diff --git a/drivers/gpu/drm/ttm/ttm_bo.c b/drivers/gpu/drm/ttm/ttm_bo.c
> > > > > > > > index 8d7fd65ccced..23f906941ac9 100644
> > > > > > > > --- a/drivers/gpu/drm/ttm/ttm_bo.c
> > > > > > > > +++ b/drivers/gpu/drm/ttm/ttm_bo.c
> > > > > > > > @@ -1152,9 +1152,9 @@ int ttm_bo_swapout(struct ttm_buffer_object *bo, struct ttm_operation_ctx *ctx,
> > > > > > > >      	}
> > > > > > > >      	if (bo->deleted) {
> > > > > > > > -		ttm_bo_cleanup_refs(bo, false, false, locked);
> > > > > > > > +		ret = ttm_bo_cleanup_refs(bo, false, false, locked);
> > > > > > > >      		ttm_bo_put(bo);
> > > > > > > > -		return 0;
> > > > > > > > +		return ret == -EBUSY ? -ENOSPC : ret;
> > > > > > > >      	}
> > > > > > > >      	ttm_bo_del_from_lru(bo);
> > > > > > > > @@ -1208,7 +1208,7 @@ int ttm_bo_swapout(struct ttm_buffer_object *bo, struct ttm_operation_ctx *ctx,
> > > > > > > >      	if (locked)
> > > > > > > >      		dma_resv_unlock(bo->base.resv);
> > > > > > > >      	ttm_bo_put(bo);
> > > > > > > > -	return ret;
> > > > > > > > +	return ret == -EBUSY ? -ENOSPC : ret;
> > > > > > > >      }
> > > > > > > >      void ttm_bo_tt_destroy(struct ttm_buffer_object *bo)
> 

-- 
Daniel Vetter
Software Engineer, Intel Corporation
http://blog.ffwll.ch