On Wed, Sep 16, 2026 at 05:37:20PM +0000, Wentao Liang wrote:
> intel_vgpu_get_ppgtt_mm() returns a reference the caller must drop, but
> the PPGTT page table create path only inspected the result. A page
> table that is already tracked gained an extra reference which nothing
> would ever drop. Skip the lookup-get for an already registered mm; a
> newly created mm keeps its initial registration reference.
>
Besides sashiko's reply, those reference was designed to guard against
case that possible same ppgtt table usage within single client case.
This change just breaks all of that. So NAK this with other reason Joonas
has replied..
> Fixes: e6e9c46fd235 ("drm/i915/gvt: Factor out intel_vgpu_{get, put}_ppgtt_mm
> interface")
> Cc: [email protected]
> Signed-off-by: Wentao Liang <[email protected]>
> ---
> drivers/gpu/drm/i915/gvt/handlers.c | 12 +++++++++++-
> 1 file changed, 11 insertions(+), 1 deletion(-)
>
> diff --git a/drivers/gpu/drm/i915/gvt/handlers.c
> b/drivers/gpu/drm/i915/gvt/handlers.c
> index a34f56630af9..3d7aae6c5cf1 100644
> --- a/drivers/gpu/drm/i915/gvt/handlers.c
> +++ b/drivers/gpu/drm/i915/gvt/handlers.c
> @@ -1506,7 +1506,17 @@ static int handle_g2v_notification(struct intel_vgpu
> *vgpu, int notification)
> root_entry_type = GTT_TYPE_PPGTT_ROOT_L3_ENTRY;
> fallthrough;
> case VGT_G2V_PPGTT_L4_PAGE_TABLE_CREATE:
> - mm = intel_vgpu_get_ppgtt_mm(vgpu, root_entry_type, pdps);
> + /*
> + * A newly created mm keeps its initial reference as the
> + * registration reference, dropped by the DESTROY
> + * notification. A duplicate CREATE for an already tracked
> + * mm must not take an extra reference that nothing drops.
> + */
> + mm = intel_vgpu_find_ppgtt_mm(vgpu, pdps);
> + if (mm)
> + return 0;
> +
> + mm = intel_vgpu_create_ppgtt_mm(vgpu, root_entry_type, pdps);
> return PTR_ERR_OR_ZERO(mm);
> case VGT_G2V_PPGTT_L3_PAGE_TABLE_DESTROY:
> case VGT_G2V_PPGTT_L4_PAGE_TABLE_DESTROY:
> --
> 2.34.1
