Commit a60f5ee6 authored by Dave Airlie's avatar Dave Airlie
Browse files

Merge tag 'drm-xe-fixes-2025-08-21-1' of... 

Merge tag 'drm-xe-fixes-2025-08-21-1' of https://gitlab.freedesktop.org/drm/xe/kernel

 into drm-fixes

- xe_vm_create fixes (Piotr)
- Fix vm_bind_ioctl double free (Christoph)

Signed-off-by: default avatarDave Airlie <airlied@redhat.com>

From: Rodrigo Vivi <rodrigo.vivi@intel.com>
Link: https://lore.kernel.org/r/aKdxiw9hvO6mcyKs@intel.com
parents f9915c39 111fb43a

drivers/gpu/drm/xe/xe_migrate.c

+1 −1
Original line number Diff line number Diff line
@@ -408,7 +408,7 @@ struct xe_migrate *xe_migrate_init(struct xe_tile *tile) 


	/* Special layout, prepared below.. */

	vm = xe_vm_create(xe, XE_VM_FLAG_MIGRATION |

			  XE_VM_FLAG_SET_TILE_ID(tile));

			  XE_VM_FLAG_SET_TILE_ID(tile), NULL);

	if (IS_ERR(vm))

		return ERR_CAST(vm);

drivers/gpu/drm/xe/xe_pxp_submit.c

+1 −1
Original line number Diff line number Diff line
@@ -101,7 +101,7 @@ static int allocate_gsc_client_resources(struct xe_gt *gt, 
	xe_assert(xe, hwe);



	/* PXP instructions must be issued from PPGTT */

	vm = xe_vm_create(xe, XE_VM_FLAG_GSC);

	vm = xe_vm_create(xe, XE_VM_FLAG_GSC, NULL);

	if (IS_ERR(vm))

		return PTR_ERR(vm);

drivers/gpu/drm/xe/xe_vm.c

+23 −25
Original line number Diff line number Diff line
@@ -1640,7 +1640,7 @@ static void xe_vm_free_scratch(struct xe_vm *vm) 
	}

}



struct xe_vm *xe_vm_create(struct xe_device *xe, u32 flags)

struct xe_vm *xe_vm_create(struct xe_device *xe, u32 flags, struct xe_file *xef)

{

	struct drm_gem_object *vm_resv_obj;

	struct xe_vm *vm;
@@ -1661,9 +1661,10 @@ struct xe_vm *xe_vm_create(struct xe_device *xe, u32 flags) 
	vm->xe = xe;



	vm->size = 1ull << xe->info.va_bits;



	vm->flags = flags;



	if (xef)

		vm->xef = xe_file_get(xef);

	/**

	 * GSC VMs are kernel-owned, only used for PXP ops and can sometimes be

	 * manipulated under the PXP mutex. However, the PXP mutex can be taken
@@ -1794,6 +1795,20 @@ struct xe_vm *xe_vm_create(struct xe_device *xe, u32 flags) 
	if (number_tiles > 1)

		vm->composite_fence_ctx = dma_fence_context_alloc(1);



	if (xef && xe->info.has_asid) {

		u32 asid;



		down_write(&xe->usm.lock);

		err = xa_alloc_cyclic(&xe->usm.asid_to_vm, &asid, vm,

				      XA_LIMIT(1, XE_MAX_ASID - 1),

				      &xe->usm.next_asid, GFP_KERNEL);

		up_write(&xe->usm.lock);

		if (err < 0)

			goto err_unlock_close;



		vm->usm.asid = asid;

	}



	trace_xe_vm_create(vm);



	return vm;
@@ -1814,6 +1829,8 @@ struct xe_vm *xe_vm_create(struct xe_device *xe, u32 flags) 
	for_each_tile(tile, xe, id)

		xe_range_fence_tree_fini(&vm->rftree[id]);

	ttm_lru_bulk_move_fini(&xe->ttm, &vm->lru_bulk_move);

	if (vm->xef)

		xe_file_put(vm->xef);

	kfree(vm);

	if (flags & XE_VM_FLAG_LR_MODE)

		xe_pm_runtime_put(xe);
@@ -2059,9 +2076,8 @@ int xe_vm_create_ioctl(struct drm_device *dev, void *data, 
	struct xe_device *xe = to_xe_device(dev);

	struct xe_file *xef = to_xe_file(file);

	struct drm_xe_vm_create *args = data;

	struct xe_tile *tile;

	struct xe_vm *vm;

	u32 id, asid;

	u32 id;

	int err;

	u32 flags = 0;
@@ -2097,29 +2113,10 @@ int xe_vm_create_ioctl(struct drm_device *dev, void *data, 
	if (args->flags & DRM_XE_VM_CREATE_FLAG_FAULT_MODE)

		flags |= XE_VM_FLAG_FAULT_MODE;



	vm = xe_vm_create(xe, flags);

	vm = xe_vm_create(xe, flags, xef);

	if (IS_ERR(vm))

		return PTR_ERR(vm);



	if (xe->info.has_asid) {

		down_write(&xe->usm.lock);

		err = xa_alloc_cyclic(&xe->usm.asid_to_vm, &asid, vm,

				      XA_LIMIT(1, XE_MAX_ASID - 1),

				      &xe->usm.next_asid, GFP_KERNEL);

		up_write(&xe->usm.lock);

		if (err < 0)

			goto err_close_and_put;



		vm->usm.asid = asid;

	}



	vm->xef = xe_file_get(xef);



	/* Record BO memory for VM pagetable created against client */

	for_each_tile(tile, xe, id)

		if (vm->pt_root[id])

			xe_drm_client_add_bo(vm->xef->client, vm->pt_root[id]->bo);



#if IS_ENABLED(CONFIG_DRM_XE_DEBUG_MEM)

	/* Warning: Security issue - never enable by default */

	args->reserved[0] = xe_bo_main_addr(vm->pt_root[0]->bo, XE_PAGE_SIZE);
@@ -3421,6 +3418,7 @@ static int vm_bind_ioctl_check_args(struct xe_device *xe, struct xe_vm *vm, 
free_bind_ops:

	if (args->num_binds > 1)

		kvfree(*bind_ops);

	*bind_ops = NULL;

	return err;

}
@@ -3527,7 +3525,7 @@ int xe_vm_bind_ioctl(struct drm_device *dev, void *data, struct drm_file *file) 
	struct xe_exec_queue *q = NULL;

	u32 num_syncs, num_ufence = 0;

	struct xe_sync_entry *syncs = NULL;

	struct drm_xe_vm_bind_op *bind_ops;

	struct drm_xe_vm_bind_op *bind_ops = NULL;

	struct xe_vma_ops vops;

	struct dma_fence *fence;

	int err;

drivers/gpu/drm/xe/xe_vm.h

+1 −1
Original line number Diff line number Diff line
@@ -26,7 +26,7 @@ struct xe_sync_entry; 
struct xe_svm_range;

struct drm_exec;



struct xe_vm *xe_vm_create(struct xe_device *xe, u32 flags);

struct xe_vm *xe_vm_create(struct xe_device *xe, u32 flags, struct xe_file *xef);



struct xe_vm *xe_vm_lookup(struct xe_file *xef, u32 id);

int xe_vma_cmp_vma_cb(const void *key, const struct rb_node *node);