Re: [PATCH v2 1/3] drm/vmwgfx: Don't map or free the exporter's sg_table for imported BOs

[Zack Rusin]

On Thu, Sep 10, 2026 at 12:52 PM Michal TOMA <michaltoma@xxxxxxxxxx> wrote:
> The exporter has already mapped the table for this device in
> dma_buf_map_attachment(), so there is nothing for vmwgfx to do here:
> use the table as it is, and leave mapping, unmapping and freeing to its
> owner.

Thanks, agreed, that part is right.

> Cc: stable@xxxxxxxxxxxxxxx # v6.9+

b32233acceff went to stable as "# v6.6+", so this should probably be
v6.6+ like patch 2.

> +       if (vmw_tt->dma_ttm.page_flags & TTM_TT_FLAG_EXTERNAL) {
> +               /* The mapping and the table belong to the exporter. */
> +               vmw_tt->vsgt.sgt = NULL;
> +               vmw_tt->mapped = false;
> +               return;
> +       }
> +

There's one more problem this exposes. With this patch imported BOs
can actually be bound, but they're never unbound on destruction:
vmw_ttm_unpopulate() returns early for external TTs before it gets to
vmw_ttm_unbind(), and vmw_ttm_destroy() doesn't unbind either. So an
imported BO destroyed while in VMW_PL_MOB/GMR is never unbound from
the device, and its MOB/GMR id goes back to the allocator anyway. That
was already reachable in vmw_dma_alloc_coherent mode; this patch makes
it the default.

Could you add a patch ahead of this one that only skips the
ttm_pool_free() for external TTs? Something like:

      bool external = (ttm->page_flags & TTM_TT_FLAG_EXTERNAL) != 0;

-     if (external)
-             return;
-
      vmw_ttm_unbind(bdev, ttm);
      ...
      vmw_ttm_unmap_dma(vmw_tt);

+     /* The pages of an imported buffer belong to the exporter. */
+     if (external)
+             return;
+
      ttm_pool_free(&bdev->pool, ttm);


z

Attachment: smime.p7s
Description: S/MIME Cryptographic Signature