mirror of
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
synced 2026-08-09 06:14:34 +02:00
GuC exec queue destruction can run asynchronously. If the final device
put happens from a destroy worker, drmm cleanup can end up draining
the same workqueue and deadlock.
Hold a drm_device reference for the queue lifetime and drop it after
queue teardown completes. This keeps drmm cleanup from running while
async destroy work is still pending.
Move GuC destroy work to a module-lifetime Xe workqueue and flush it
on PCI remove so hot-unbind/rebind still waits for pending destroy work.
With queue-held device refs, guc_submit_sw_fini() cannot run with live
GuC IDs. Replace the fini wait with an assertion and remove the unused
fini_wq.
v2:
- Rebase
v3:
- Switch to queue-lifetime drm_dev_get()/drm_dev_put() model. (Matt)
- Queue async teardown on system_dfl_wq instead of xe->destroy_wq. (Matt)
- Drop separate deferred drm_dev_put worker.
- Remove stale drain_workqueue(xe->destroy_wq) from guc_submit_sw_fini().
v4:
- Replace the guc_submit_sw_fini() wait with an assertion and remove
the now-unused fini_wq. (sashiko)
v5:
- Move destroy work to a module-lifetime Xe workqueue instead of
system_dfl_wq. (Matt)
- Flush the module-lifetime destroy workqueue during PCI remove to
preserve the old device-remove wait semantics.
v6:
- Keep SVM pagemap destroy work on the per-device destroy_wq to avoid
letting it outlive the xe_device/drm_device. (Sashiko)
- Use WQ_MEM_RECLAIM for xe->destroy_wq because SVM pagemap destroy work
can be queued from the reclaim path.
v7:
- Drop the per-device xe->destroy_wq and use the module-level destroy WQ
for SVM pagemap destroy as well. (Matt)
- Rename xe_exec_queue_destroy_wq_*() helpers to xe_destroy_wq_*()
helpers because the WQ is no longer exec-queue specific. (Matt)
v8:
- Rebase.
v9:
- Keep SVM pagemap destroy work on the per-device WQ_MEM_RECLAIM
destroy_wq because it can be queued from reclaim and embeds
the dev_pagemap used by devres teardown. (Sashiko)
- Keep the module-level destroy WQ GuC-only and drop WQ_MEM_RECLAIM
from it.
- Update the module-WQ kdoc to document the GuC/SVM split.
v10:
- Keep xe->destroy_wq per-cpu while adding WQ_MEM_RECLAIM to fix the
workqueue allocation warning.
v11:
- Drop the SVM pagemap destroy comment as it was revision-specific.
(Thomas)
v12:
- Rebase.
Fixes: 2d2be279f1 ("drm/xe: fix UAF around queue destruction")
Cc: Thomas Hellström <thomas.hellstrom@linux.intel.com>
Cc: Rodrigo Vivi <rodrigo.vivi@intel.com>
Cc: Himal Prasad Ghimiray <himal.prasad.ghimiray@intel.com>
Cc: Tejas Upadhyay <tejas.upadhyay@intel.com>
Reviewed-by: Matthew Brost <matthew.brost@intel.com>
Signed-off-by: Arvind Yadav <arvind.yadav@intel.com>
Link: https://patch.msgid.link/20260716062624.211396-1-arvind.yadav@intel.com
Signed-off-by: Tejas Upadhyay <tejas.upadhyay@intel.com>
(cherry picked from commit da1124abac689cc2b1d8995e5f0a816f8a122edb)
Signed-off-by: Thomas Hellström <thomas.hellstrom@linux.intel.com>
223 lines
5.9 KiB
C
223 lines
5.9 KiB
C
// SPDX-License-Identifier: MIT
|
|
/*
|
|
* Copyright © 2021 Intel Corporation
|
|
*/
|
|
|
|
#include "xe_module.h"
|
|
|
|
#include <linux/init.h>
|
|
#include <linux/module.h>
|
|
#include <linux/workqueue.h>
|
|
|
|
#include <drm/drm_module.h>
|
|
|
|
#include "xe_defaults.h"
|
|
#include "xe_device_types.h"
|
|
#include "xe_drv.h"
|
|
#include "xe_configfs.h"
|
|
#include "xe_hw_fence.h"
|
|
#include "xe_pci.h"
|
|
#include "xe_pm.h"
|
|
#include "xe_observation.h"
|
|
#include "xe_sched_job.h"
|
|
|
|
struct xe_modparam xe_modparam = {
|
|
.probe_display = XE_DEFAULT_PROBE_DISPLAY,
|
|
.guc_log_level = XE_DEFAULT_GUC_LOG_LEVEL,
|
|
.force_probe = XE_DEFAULT_FORCE_PROBE,
|
|
#ifdef CONFIG_PCI_IOV
|
|
.max_vfs = XE_DEFAULT_MAX_VFS,
|
|
#endif
|
|
.wedged_mode = XE_DEFAULT_WEDGED_MODE,
|
|
.svm_notifier_size = XE_DEFAULT_SVM_NOTIFIER_SIZE,
|
|
/* the rest are 0 by default */
|
|
};
|
|
|
|
module_param_named(svm_notifier_size, xe_modparam.svm_notifier_size, uint, 0600);
|
|
MODULE_PARM_DESC(svm_notifier_size, "Set the svm notifier size in MiB, must be power of 2 "
|
|
"[default=" __stringify(XE_DEFAULT_SVM_NOTIFIER_SIZE) "]");
|
|
|
|
module_param_named_unsafe(force_execlist, xe_modparam.force_execlist, bool, 0444);
|
|
MODULE_PARM_DESC(force_execlist, "Force Execlist submission");
|
|
|
|
#if IS_ENABLED(CONFIG_DRM_XE_DISPLAY)
|
|
module_param_named(probe_display, xe_modparam.probe_display, bool, 0444);
|
|
MODULE_PARM_DESC(probe_display, "Probe display HW, otherwise it's left untouched "
|
|
"[default=" __stringify(XE_DEFAULT_PROBE_DISPLAY) "])");
|
|
#endif
|
|
|
|
module_param_named(vram_bar_size, xe_modparam.force_vram_bar_size, int, 0600);
|
|
MODULE_PARM_DESC(vram_bar_size, "Set the vram bar size in MiB (<0=disable-resize, 0=max-needed-size, >0=force-size "
|
|
"[default=" __stringify(XE_DEFAULT_VRAM_BAR_SIZE) "])");
|
|
|
|
module_param_named(guc_log_level, xe_modparam.guc_log_level, int, 0600);
|
|
MODULE_PARM_DESC(guc_log_level, "GuC firmware logging level (0=disable, 1=normal, 2..5=verbose-levels "
|
|
"[default=" __stringify(XE_DEFAULT_GUC_LOG_LEVEL) "])");
|
|
|
|
module_param_named_unsafe(guc_firmware_path, xe_modparam.guc_firmware_path, charp, 0400);
|
|
MODULE_PARM_DESC(guc_firmware_path,
|
|
"GuC firmware path to use instead of the default one");
|
|
|
|
module_param_named_unsafe(huc_firmware_path, xe_modparam.huc_firmware_path, charp, 0400);
|
|
MODULE_PARM_DESC(huc_firmware_path,
|
|
"HuC firmware path to use instead of the default one - empty string disables");
|
|
|
|
module_param_named_unsafe(gsc_firmware_path, xe_modparam.gsc_firmware_path, charp, 0400);
|
|
MODULE_PARM_DESC(gsc_firmware_path,
|
|
"GSC firmware path to use instead of the default one - empty string disables");
|
|
|
|
module_param_named_unsafe(force_probe, xe_modparam.force_probe, charp, 0400);
|
|
MODULE_PARM_DESC(force_probe,
|
|
"Force probe options for specified devices. See CONFIG_DRM_XE_FORCE_PROBE for details "
|
|
"[default=" XE_DEFAULT_FORCE_PROBE "])");
|
|
|
|
#ifdef CONFIG_PCI_IOV
|
|
module_param_named(max_vfs, xe_modparam.max_vfs, uint, 0400);
|
|
MODULE_PARM_DESC(max_vfs,
|
|
"Limit number of Virtual Functions (VFs) that could be managed. "
|
|
"(0=no VFs; N=allow up to N VFs "
|
|
"[default=" XE_DEFAULT_MAX_VFS_STR "])");
|
|
#endif
|
|
|
|
module_param_named_unsafe(wedged_mode, xe_modparam.wedged_mode, uint, 0600);
|
|
MODULE_PARM_DESC(wedged_mode,
|
|
"Module's default policy for the wedged mode (0=never, 1=upon-critical-error, 2=upon-any-hang-no-reset "
|
|
"[default=" XE_DEFAULT_WEDGED_MODE_STR "])");
|
|
|
|
static int xe_check_nomodeset(void)
|
|
{
|
|
if (drm_firmware_drivers_only())
|
|
return -ENODEV;
|
|
|
|
return 0;
|
|
}
|
|
|
|
static struct workqueue_struct *xe_destroy_wq;
|
|
|
|
static int __init xe_destroy_wq_module_init(void)
|
|
{
|
|
xe_destroy_wq = alloc_workqueue("xe-guc-destroy-wq", WQ_UNBOUND, 0);
|
|
if (!xe_destroy_wq)
|
|
return -ENOMEM;
|
|
return 0;
|
|
}
|
|
|
|
static void xe_destroy_wq_module_exit(void)
|
|
{
|
|
if (xe_destroy_wq)
|
|
destroy_workqueue(xe_destroy_wq);
|
|
xe_destroy_wq = NULL;
|
|
}
|
|
|
|
/**
|
|
* xe_destroy_wq_queue() - Queue work on the destroy workqueue
|
|
* @work: work item to queue
|
|
*
|
|
* The destroy workqueue has module lifetime and is used for GuC exec queue
|
|
* teardown that can outlive a single xe_device. SVM pagemap destroy uses the
|
|
* per-device xe->destroy_wq instead.
|
|
*
|
|
* Return: %true if @work was queued, %false if it was already pending.
|
|
*/
|
|
bool xe_destroy_wq_queue(struct work_struct *work)
|
|
{
|
|
return queue_work(xe_destroy_wq, work);
|
|
}
|
|
|
|
/**
|
|
* xe_destroy_wq_flush() - Flush the destroy workqueue
|
|
*
|
|
* Drains all pending destroy work. Called from PCI remove to ensure
|
|
* teardown ordering before the device is destroyed.
|
|
*/
|
|
void xe_destroy_wq_flush(void)
|
|
{
|
|
if (xe_destroy_wq)
|
|
flush_workqueue(xe_destroy_wq);
|
|
}
|
|
|
|
struct init_funcs {
|
|
int (*init)(void);
|
|
void (*exit)(void);
|
|
};
|
|
|
|
static const struct init_funcs init_funcs[] = {
|
|
{
|
|
.init = xe_check_nomodeset,
|
|
},
|
|
{
|
|
.init = xe_configfs_init,
|
|
.exit = xe_configfs_exit,
|
|
},
|
|
{
|
|
.init = xe_hw_fence_module_init,
|
|
.exit = xe_hw_fence_module_exit,
|
|
},
|
|
{
|
|
.init = xe_sched_job_module_init,
|
|
.exit = xe_sched_job_module_exit,
|
|
},
|
|
{
|
|
.init = xe_destroy_wq_module_init,
|
|
.exit = xe_destroy_wq_module_exit,
|
|
},
|
|
{
|
|
.init = xe_register_pci_driver,
|
|
.exit = xe_unregister_pci_driver,
|
|
},
|
|
{
|
|
.init = xe_observation_sysctl_register,
|
|
.exit = xe_observation_sysctl_unregister,
|
|
},
|
|
{
|
|
.init = xe_pm_module_init,
|
|
},
|
|
};
|
|
|
|
static int __init xe_call_init_func(const struct init_funcs *func)
|
|
{
|
|
if (func->init)
|
|
return func->init();
|
|
return 0;
|
|
}
|
|
|
|
static void xe_call_exit_func(const struct init_funcs *func)
|
|
{
|
|
if (func->exit)
|
|
func->exit();
|
|
}
|
|
|
|
static int __init xe_init(void)
|
|
{
|
|
int err, i;
|
|
|
|
for (i = 0; i < ARRAY_SIZE(init_funcs); i++) {
|
|
err = xe_call_init_func(init_funcs + i);
|
|
if (err) {
|
|
pr_info("%s: module_init aborted at %ps %pe\n",
|
|
DRIVER_NAME, init_funcs[i].init, ERR_PTR(err));
|
|
while (i--)
|
|
xe_call_exit_func(init_funcs + i);
|
|
return err;
|
|
}
|
|
}
|
|
|
|
return 0;
|
|
}
|
|
|
|
static void __exit xe_exit(void)
|
|
{
|
|
int i;
|
|
|
|
for (i = ARRAY_SIZE(init_funcs) - 1; i >= 0; i--)
|
|
xe_call_exit_func(init_funcs + i);
|
|
}
|
|
|
|
module_init(xe_init);
|
|
module_exit(xe_exit);
|
|
|
|
MODULE_AUTHOR("Intel Corporation");
|
|
|
|
MODULE_DESCRIPTION(DRIVER_DESC);
|
|
MODULE_LICENSE("GPL and additional rights");
|