On Fri, Jan 26, 2024 at 10:08 PM Zack Rusin <zack.rusin@xxxxxxxxxxxx> wrote:
>
> The cleanup can be dispatched while the atomic update is still active,
> which means that the memory acquired in the atomic update needs to
> not be invalidated by the cleanup. The buffer objects in vmw_plane_state
> instead of using the builtin map_and_cache were trying to handle
> the lifetime of the mapped memory themselves, leading to crashes.
>
> Use the map_and_cache instead of trying to manage the lifetime of the
> buffer objects held by the vmw_plane_state.
>
> Fixes kernel oops'es in IGT's kms_cursor_legacy forked-bo.
>
> Signed-off-by: Zack Rusin <zack.rusin@xxxxxxxxxxxx>
> Fixes: bb6780aa5a1d ("drm/vmwgfx: Diff cursors when using cmds")
> Cc: <stable@xxxxxxxxxxxxxxx> # v6.2+
> ---
> drivers/gpu/drm/vmwgfx/vmwgfx_kms.c | 13 +------------
> 1 file changed, 1 insertion(+), 12 deletions(-)
>
> diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_kms.c b/drivers/gpu/drm/vmwgfx/vmwgfx_kms.c
> index e2bfaf4522a6..cd4925346ed4 100644
> --- a/drivers/gpu/drm/vmwgfx/vmwgfx_kms.c
> +++ b/drivers/gpu/drm/vmwgfx/vmwgfx_kms.c
> @@ -185,13 +185,12 @@ static u32 vmw_du_cursor_mob_size(u32 w, u32 h)
> */
> static u32 *vmw_du_cursor_plane_acquire_image(struct vmw_plane_state *vps)
> {
> - bool is_iomem;
> if (vps->surf) {
> if (vps->surf_mapped)
> return vmw_bo_map_and_cache(vps->surf->res.guest_memory_bo);
> return vps->surf->snooper.image;
> } else if (vps->bo)
> - return ttm_kmap_obj_virtual(&vps->bo->map, &is_iomem);
> + return vmw_bo_map_and_cache(vps->bo);
> return NULL;
> }
>
> @@ -653,22 +652,12 @@ vmw_du_cursor_plane_cleanup_fb(struct drm_plane *plane,
> {
> struct vmw_cursor_plane *vcp = vmw_plane_to_vcp(plane);
> struct vmw_plane_state *vps = vmw_plane_state_to_vps(old_state);
> - bool is_iomem;
>
> if (vps->surf_mapped) {
> vmw_bo_unmap(vps->surf->res.guest_memory_bo);
> vps->surf_mapped = false;
> }
>
> - if (vps->bo && ttm_kmap_obj_virtual(&vps->bo->map, &is_iomem)) {
> - const int ret = ttm_bo_reserve(&vps->bo->tbo, true, false, NULL);
> -
> - if (likely(ret == 0)) {
> - ttm_bo_kunmap(&vps->bo->map);
> - ttm_bo_unreserve(&vps->bo->tbo);
> - }
> - }
> -
> vmw_du_cursor_plane_unmap_cm(vps);
> vmw_du_put_cursor_mob(vcp, vps);
>
> --
> 2.40.1
>
LGTM!
Reviewed-by: Martin Krastev <martin.krastev@xxxxxxxxxxxx>
Regards,
Martin
