AMD General
[cid:dbc75673-7343-430c-b13d-102247b6401c]<https://outlook.office.com/bookwithme/user/[email protected]?anonymous&ep=owaSlotsEmailSignature> Book time to meet with me<https://outlook.office.com/bookwithme/user/[email protected]?anonymous&ep=owaSlotsEmailSignature> ________________________________ From: amd-gfx <[email protected]> on behalf of [email protected] <[email protected]> Sent: Friday, November 6, 2026 11:04 AM To: [email protected] <[email protected]> Subject: amd-gfx Digest, Vol 126, Issue 206 Send amd-gfx mailing list submissions to [email protected] To subscribe or unsubscribe via the World Wide Web, visit https://lists.freedesktop.org/mailman/listinfo/amd-gfx or, via email, send a message with subject or body 'help' to [email protected] You can reach the person managing the list at [email protected] When replying, please edit your Subject line so it is more specific than "Re: Contents of amd-gfx digest..." Today's Topics: 1. [PATCH v2] drm/amdgpu: wait for tlb flush before freeing BO (Benjamin Cheng) 2. [PATCH 1/2] drm/amdgpu: re-enable SPM updates in the the IB path (Alex Deucher) 3. [PATCH 2/2] drm/amdgpu: reemit RLC SPM register in ring reemit (Alex Deucher) 4. Re: [PATCH v2] drm/amdgpu: wait for tlb flush before freeing BO (Christian K?nig) ---------------------------------------------------------------------- Message: 1 Date: Fri, 6 Nov 2026 10:20:32 -0500 From: Benjamin Cheng <[email protected]> To: Alex Deucher <[email protected]>, Christian K?nig <[email protected]>, <[email protected]> Cc: Sunil Khatri <[email protected]>, Benjamin Cheng <[email protected]> Subject: [PATCH v2] drm/amdgpu: wait for tlb flush before freeing BO Message-ID: <[email protected]> Content-Type: text/plain On gem object close, we previously only attached the fence of its own clear_freed() call to the BO's resv. If an unmap of this BO happened prior to the close call, clear_freed() would be invoked, leaving vm->freed empty, and no meaningful fence to be attached to the resv. Because of that the memory may be freed before the TLB flush is complete, and give a running userq potential access to a stale address translation. Fix this by attaching the last_tlb_inv fence to the BO's resv. Fixes: a1d201e16940 ("drm/amdgpu: enable GFX-V11 userqueue support") Signed-off-by: Benjamin Cheng <[email protected]> --- v2: - Rebase on "drm/amdgpu: fix TLB invalidation fence handling v4" to get last_tlb_inv - Move the fence after the clear_freed call to make sure we wait for the right invalidation. --- drivers/gpu/drm/amd/amdgpu/amdgpu_gem.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_gem.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_gem.c index 6137ab4211be..36b0bd85616f 100644 --- a/drivers/gpu/drm/amd/amdgpu/amdgpu_gem.c +++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_gem.c @@ -371,11 +371,14 @@ static void amdgpu_gem_object_close(struct drm_gem_object *obj, dev_err(adev->dev, "failed to clear page " "tables on GEM object close (%ld)\n", r); if (r || !fence) - goto out_unlock; + goto out_tlb; amdgpu_bo_fence(bo, fence, true); dma_fence_put(fence); +out_tlb: + amdgpu_bo_fence(bo, vm->last_tlb_inv, true); + out_unlock: if (r && !drm_dev_is_unplugged(adev_to_drm(adev))) dev_err(adev->dev, "leaking bo va (%ld)\n", r); -- 2.56.0 For the series: 1. The RLC SPM register is not properly saved and restored for GFXOFF so reemit it in the IB path. 1. When we reemit the saved ring state after a reset, we need to reemit the RLC SPM state as well since it's done via MMIO. Acked-by: Vitaly Prosyak <[email protected]> and Tested-by: Vitaly Prosyak <[email protected]> ------------------------------ Message: 2 Date: Fri, 6 Nov 2026 10:52:18 -0500 From: Alex Deucher <[email protected]> To: <[email protected]> Cc: Alex Deucher <[email protected]> Subject: [PATCH 1/2] drm/amdgpu: re-enable SPM updates in the the IB path Message-ID: <[email protected]> Content-Type: text/plain The RLC SPM register is not properly saved and restored for GFXOFF so reemit it in the IB path. Fixes: 2fb5a4572c76 ("drm/amdgpu: remove the now-redundant runtime SPM VMID update") Signed-off-by: Alex Deucher <[email protected]> --- drivers/gpu/drm/amd/amdgpu/amdgpu_ib.c | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_ib.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_ib.c index f98a7c6797b3c..6210edf1937aa 100644 --- a/drivers/gpu/drm/amd/amdgpu/amdgpu_ib.c +++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_ib.c @@ -121,6 +121,9 @@ int amdgpu_ib_schedule(struct amdgpu_ring *ring, struct amdgpu_job *job, struct dma_fence **f) { struct amdgpu_device *adev = ring->adev; + bool emit_spm_needed = adev->gfx.rlc.funcs->update_spm_vmid && + (ring->funcs->type == AMDGPU_RING_TYPE_COMPUTE || + ring->funcs->type == AMDGPU_RING_TYPE_GFX); struct amdgpu_ib *ib; struct dma_fence *tmp = NULL; struct amdgpu_fence *af; @@ -209,6 +212,10 @@ int amdgpu_ib_schedule(struct amdgpu_ring *ring, struct amdgpu_job *job, if (need_pipe_sync) amdgpu_ring_emit_pipeline_sync(ring); + if (emit_spm_needed) + adev->gfx.rlc.funcs->update_spm_vmid(adev, ring->xcc_id, + adev->vm_manager.spm_vmid); + if (emit_gds_needed) amdgpu_ring_emit_gds_switch(ring, job->vmid, job->gds_base, job->gds_size, job->gws_base, -- 2.56.0 ------------------------------ Message: 3 Date: Fri, 6 Nov 2026 10:52:19 -0500 From: Alex Deucher <[email protected]> To: <[email protected]> Cc: Alex Deucher <[email protected]> Subject: [PATCH 2/2] drm/amdgpu: reemit RLC SPM register in ring reemit Message-ID: <[email protected]> Content-Type: text/plain When we reemit the saved ring state after a reset, we need to reemit the RLC SPM state as well since it's done via MMIO. Fixes: 2fb5a4572c76 ("drm/amdgpu: remove the now-redundant runtime SPM VMID update") Signed-off-by: Alex Deucher <[email protected]> --- drivers/gpu/drm/amd/amdgpu/amdgpu_fence.c | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_fence.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_fence.c index c3f56253d3b87..324d25c77897a 100644 --- a/drivers/gpu/drm/amd/amdgpu/amdgpu_fence.c +++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_fence.c @@ -715,6 +715,9 @@ void amdgpu_fence_driver_force_completion(struct amdgpu_ring *ring, void amdgpu_ring_set_fence_errors_and_reemit(struct amdgpu_ring *ring, struct amdgpu_fence *guilty_fence) { + bool emit_spm_needed = ring->adev->gfx.rlc.funcs->update_spm_vmid && + (ring->funcs->type == AMDGPU_RING_TYPE_COMPUTE || + ring->funcs->type == AMDGPU_RING_TYPE_GFX); struct dma_fence *unprocessed; struct dma_fence __rcu **ptr; struct amdgpu_fence *fence; @@ -746,6 +749,9 @@ void amdgpu_ring_set_fence_errors_and_reemit(struct amdgpu_ring *ring, } ring->reemit = true; amdgpu_ring_alloc(ring, ring->ring_backup_entries_to_copy); + if (emit_spm_needed) + ring->adev->gfx.rlc.funcs->update_spm_vmid(ring->adev, ring->xcc_id, + ring->adev->vm_manager.spm_vmid); spin_lock_irqsave(&ring->fence_drv.lock, flags); do { last_seq++; -- 2.56.0 ------------------------------ Message: 4 Date: Fri, 6 Nov 2026 17:04:11 +0100 From: Christian K?nig <[email protected]> To: Benjamin Cheng <[email protected]>, Alex Deucher <[email protected]>, [email protected] Cc: Sunil Khatri <[email protected]> Subject: Re: [PATCH v2] drm/amdgpu: wait for tlb flush before freeing BO Message-ID: <[email protected]> Content-Type: text/plain; charset=UTF-8 On 11/6/26 16:20, Benjamin Cheng wrote: > On gem object close, we previously only attached the fence of its own > clear_freed() call to the BO's resv. If an unmap of this BO happened > prior to the close call, clear_freed() would be invoked, leaving > vm->freed empty, and no meaningful fence to be attached to the resv. > Because of that the memory may be freed before the TLB flush is > complete, and give a running userq potential access to a stale > address translation. > > Fix this by attaching the last_tlb_inv fence to the BO's resv. > > Fixes: a1d201e16940 ("drm/amdgpu: enable GFX-V11 userqueue support") > Signed-off-by: Benjamin Cheng <[email protected]> > --- > v2: > - Rebase on "drm/amdgpu: fix TLB invalidation fence handling v4" to get > last_tlb_inv > - Move the fence after the clear_freed call to make sure we wait for the > right invalidation. > --- > drivers/gpu/drm/amd/amdgpu/amdgpu_gem.c | 5 ++++- > 1 file changed, 4 insertions(+), 1 deletion(-) > > diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_gem.c > b/drivers/gpu/drm/amd/amdgpu/amdgpu_gem.c > index 6137ab4211be..36b0bd85616f 100644 > --- a/drivers/gpu/drm/amd/amdgpu/amdgpu_gem.c > +++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_gem.c > @@ -371,11 +371,14 @@ static void amdgpu_gem_object_close(struct > drm_gem_object *obj, > dev_err(adev->dev, "failed to clear page " > "tables on GEM object close (%ld)\n", r); > if (r || !fence) > - goto out_unlock; > + goto out_tlb; > > amdgpu_bo_fence(bo, fence, true); > dma_fence_put(fence); > > +out_tlb: > + amdgpu_bo_fence(bo, vm->last_tlb_inv, true); You need to change the drm_exec_prepare_obj() call above from 1 to 2 since we are now attaching 2 fences. Apart from that looks good to me. Regards, Christian. > + > out_unlock: > if (r && !drm_dev_is_unplugged(adev_to_drm(adev))) > dev_err(adev->dev, "leaking bo va (%ld)\n", r); ------------------------------ Subject: Digest Footer _______________________________________________ amd-gfx mailing list [email protected] https://lists.freedesktop.org/mailman/listinfo/amd-gfx ------------------------------ End of amd-gfx Digest, Vol 126, Issue 206 *****************************************
