Driver and shared DRM helper code is increasingly relying on bare
drm_device references (drm_dev_get()/drm_dev_put()) to keep a device's
software state around, without also pairing that with a reference on
the owning kernel module. Xe itself does this in several places, and
so does drm_gpuvm for the lifetime of a GPU VM. None of these
references currently prevent the owning module from being unloaded
while they, or the teardown work they can still trigger, are
outstanding, meaning driver code can end up executing after its own
module's text has already been freed.
This series closes that gap for xe:
- Patch 1 adds core DRM infrastructure allowing a driver to wait for
its outstanding device-release callbacks to finish before
proceeding with module unload.
- Patch 2 makes xe use this infrastructure to hold up module unload
until every xe_device instance has actually been released, rather
than only until the module's own refcount happens to reach zero,
with a diagnostic if this ends up taking an unexpectedly long time.
- Patch 3 fixes a related, previously unprotected case where the
teardown of a GPU VM or its address space mappings can be deferred
to run at an arbitrary later time, including after module unload has
already completed.
Together, these changes ensure `rmmod xe` cannot free the module's
memory while any of its devices, or asynchronous work stemming from
them, might still be executing.
v2:
- Use plain WARN_ON_ONCE() instead of drm_WARN_ON_ONCE(NULL, ...) in
drm_dev_release_barrier(), fixing a NULL pointer dereference on the
warning path itself (patch 1, sashiko)
- Updated the commit message of patch 2 to describe the actual
implementation (a single 20s wait_var_event_timeout() followed by
one pr_warn() and an unbounded wait_var_event(), rather than a loop
retrying with a diagnostic every 10s) and its uninterruptible-sleep
tradeoff (sashiko)
Thomas Hellström (3):
drm: Provide a drm_dev_release_barrier() function to wait for device
release callbacks
drm/xe: Don't unload the driver until all drm devices are freed
drm/xe: Route deferred xe_vma/xe_vm teardown off system_dfl_wq
drivers/gpu/drm/drm_drv.c | 56 ++++++++++++++++++++++++++++++++++
drivers/gpu/drm/xe/xe_device.c | 42 +++++++++++++++++++++++++
drivers/gpu/drm/xe/xe_device.h | 2 ++
drivers/gpu/drm/xe/xe_module.c | 24 +++++++++++++--
drivers/gpu/drm/xe/xe_vm.c | 5 +--
include/drm/drm_drv.h | 24 +++++++++++++++
6 files changed, 148 insertions(+), 5 deletions(-)
--
2.55.0
