[PATCH] drm/vmwgfx: unpin BOs without revalidating placement

[潘煜杭]

Unpinning a buffer object does not change its memory placement.
Placement revalidation is unnecessary. Currently
vmw_bo_pin_reserved() calls ttm_bo_validate() for both pin and unpin
operations and treats any validation error as impossible with BUG_ON().

During PRIME/GEM cleanup, vmw_gem_object_unpin() calls
vmw_bo_pin_reserved(vbo, false). The Linux 7.3-based QEMU reproducer
confirmed that ttm_bo_validate() returned -EINVAL. The following BUG_ON()
crashed the kernel during process exit. 

The relevant report excerpt is:

  [   72.916147] [BO_PIN_TRACE] before-validate pin=0 old_mem_type=0 target_mem_type=0 flags=0x10
  [   72.916201] [BO_PIN_TRACE] after-validate ret=-22 old_mem_type=0 new_mem_type=0 ...
  [   72.918841] kernel BUG at drivers/gpu/drm/vmwgfx/vmwgfx_bo.c:342!
  [   72.918892] Oops: invalid opcode: 0000 [#1] SMP NOPTI
  [   72.933292] CPU: 1 UID: 0 PID: 346 Comm: repro_vmwgfx_bo
               Not tainted 7.3.0-dirty #2 PREEMPT(lazy)
  [   72.937912] RIP: 0010:vmw_bo_pin_reserved+0x36d/0x380
  [   72.947235] RBP: 00000000ffffffea
  [   72.990254] Fixing recursive fault but reboot is needed!

The reproducer created a dumb GEM buffer, exported/imported its PRIME fd,
performed GEM flink/open/close operations, and exited. During exit_group(),
the call path was vmw_gem_object_unpin() -> drm_gem_map_detach() ->
dma_buf_detach() -> drm_prime_gem_destroy() -> drm_gem_shmem_release() ->
vmw_bo_pin_reserved().

The fix skips ttm_bo_validate() when unpinning. Validation remains on the
pin path before ttm_bo_pin().

Assisted-by: OpenAI Codex (GPT-5)
Signed-off-by: Yuhang Pan <242270054@xxxxxxxxxx>
---
 drivers/gpu/drm/vmwgfx/vmwgfx_bo.c | 10 ++++++----
 1 file changed, 6 insertions(+), 4 deletions(-)

diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_bo.c b/drivers/gpu/drm/vmwgfx/vmwgfx_bo.c
index 9c7a73c..14d28e2 100644
--- a/drivers/gpu/drm/vmwgfx/vmwgfx_bo.c
+++ b/drivers/gpu/drm/vmwgfx/vmwgfx_bo.c
@@ -308,6 +308,11 @@ void vmw_bo_pin_reserved(struct vmw_bo *vbo, bool pin)
     if (pin == !!bo->pin_count)
         return;
 
+    if (!pin) {
+        ttm_bo_unpin(bo);
+        return;
+    }
+
     pl.fpfn = 0;
     pl.lpfn = 0;
     pl.mem_type = bo->resource->mem_type;
@@ -321,8 +326,5 @@ void vmw_bo_pin_reserved(struct vmw_bo *vbo, bool pin)
 
     BUG_ON(ret != 0 || bo->resource->mem_type != old_mem_type);
 
-    if (pin)
-        ttm_bo_pin(bo);
-    else
-        ttm_bo_unpin(bo);
+    ttm_bo_pin(bo);
 }

-- 
2.34.1

Regards,
Yuhang Pan
242270054@xxxxxxxxxx