[PATCH 0/2] drm/xe: Fix the hotunplug NULL ptr dereference

[Aradhya Bhatia]

Hi,

This patch series helps mitigate the kernel ptr dereference errors that has
been recently seen on a few platforms over the xe driver, when the core
hotunplug IGT tests are ran[0].

*Bried explanation of the error and its cause*

When attempting to close the drm file-descriptor (fd) after a hotunplug of
the xe gpu device, the kernel runs into a NULL pointer.

This happens when the close(fd) call puts back the final DRM reference. The
destroy migrate-subsystem action (xe_migrate_fini) is called upon, which
tries to put the page-table tree (pt) BO back.
However, the underlying struct device has already been removed during the
hotunplug, and so the iommu group for that pt BO is destroyed and hence,
unavailable.
When the xe_migrate_fini() tries to put back the pt-BO, the iommu group is
unavailable, causing a NULL ptr dereference.


*Brief description of the fix*

The xe migrate subsystem has been changed from being drm managed to being
dev managed. This way, the migrate subsystem destroy action will be called
sooner (during the unplug process) - allowing the pt-BO to be put back
sooner, i.e. at a point when the iommu group is not yet destroyed.

Since we are changing the migrate subsystem to be dev managed, this
subsystem is long gone by the time the TTM and VRAM resource managers do
get destroyed. (The TTM and VRAM resource manager destruction is drm
managed). So, when these resource managers attempt to evict all the BOs
before their destruction, that's not going to be possible any more, as
the BOs were already destroyed during the unplug process. Hence, we
extend the fix by making all the VRAM evictions during the xe device
remove.

Regards,
Aradhya

[0]: Link to the gitlab issue
https://gitlab.freedesktop.org/drm/xe/kernel/-/issues/3914

Aradhya Bhatia (2):
  drm/xe_migrate: Switch from drm to dev managed actions
  drm/xe_device: Evict all the VRAM objects during device remove

 drivers/gpu/drm/xe/xe_device.c  | 14 ++++++++++++++
 drivers/gpu/drm/xe/xe_migrate.c |  6 +++---
 2 files changed, 17 insertions(+), 3 deletions(-)


base-commit: 873b1a50bb4394e95332cfa611aa6463de6b7cb0
-- 
2.45.2