[PATCH] drm/xe/dma_buf: stop relying on placement in unmap

[Matthew Brost]

On Thu, Apr 10, 2025 at 05:27:17PM +0100, Matthew Auld wrote:
> The is_vram() is checking the current placement, however if we consider
> exported VRAM with dynamic dma-buf, it looks possible for the xe driver
> to async evict the memory, notifying the importer, however importer does
> not have to call unmap_attachment() immediately, but rather just as
> "soon as possible", like when the dma-resv idles. Following from this we
> would then pipeline the move, attaching the fence to the manager, and
> then update the current placement. But when the unmap_attachment() runs
> at some later point we might see that is_vram() is now false, and take
> the complete wrong path when dma-unmapping the sg, leading to
> explosions.
> 
> To fix this check if the sgl was mapping a struct page.
> 
> v2:
>   - The attachment can be mapped multiple times it seems, so we can't
>     really rely on encoding something in the attachment->priv. Instead
>     see if the page_link has an encoded struct page. For vram we expect
>     this to be NULL.
> 
> Link: https://gitlab.freedesktop.org/drm/xe/kernel/-/issues/4563
> Fixes: dd08ebf6c352 ("drm/xe: Introduce a new DRM driver for Intel GPUs")
> Signed-off-by: Matthew Auld <matthew.auld at intel.com>
> Cc: Thomas Hellström <thomas.hellstrom at linux.intel.com>
> Cc: Matthew Brost <matthew.brost at intel.com>

Reviewed-by: Matthew Brost <matthew.brost at intel.com>

> Cc: <stable at vger.kernel.org> # v6.8+
> Acked-by: Christian König <christian.koenig at amd.com>
> ---
>  drivers/gpu/drm/xe/xe_dma_buf.c | 5 +----
>  1 file changed, 1 insertion(+), 4 deletions(-)
> 
> diff --git a/drivers/gpu/drm/xe/xe_dma_buf.c b/drivers/gpu/drm/xe/xe_dma_buf.c
> index f67803e15a0e..f7a20264ea33 100644
> --- a/drivers/gpu/drm/xe/xe_dma_buf.c
> +++ b/drivers/gpu/drm/xe/xe_dma_buf.c
> @@ -145,10 +145,7 @@ static void xe_dma_buf_unmap(struct dma_buf_attachment *attach,
>  			     struct sg_table *sgt,
>  			     enum dma_data_direction dir)
>  {
> -	struct dma_buf *dma_buf = attach->dmabuf;
> -	struct xe_bo *bo = gem_to_xe_bo(dma_buf->priv);
> -
> -	if (!xe_bo_is_vram(bo)) {
> +	if (sg_page(sgt->sgl)) {
>  		dma_unmap_sgtable(attach->dev, sgt, dir, 0);
>  		sg_free_table(sgt);
>  		kfree(sgt);
> -- 
> 2.49.0
>