xe_vm_free() is the drm_gpuvm vm_free callback. It hands the final
teardown to vm_destroy_work_func() on a workqueue and returns.
drm_gpuvm_free() drops its device reference immediately after the
callback returns:
gpuvm->ops->vm_free(gpuvm);
drm_dev_put(drm);
vm_destroy_work_func() then keeps using device state: xe_pm_runtime_put()
for an LR mode VM, ttm_lru_bulk_move_fini() on xe->ttm, and the tile
iteration. If the freed VM held the last device reference, the work runs
against a released xe_device.
Take a device reference in xe_vm_free() and drop it once
vm_destroy_work_func() has finished using the device.
Cc: Matthew Brost <[email protected]>
Cc: Thomas Hellström <[email protected]>
Cc: Himal Prasad Ghimiray <[email protected]>
Cc: Rodrigo Vivi <[email protected]>
Assisted-by: LLM
Reviewed-by: Matthew Brost <[email protected]>
Signed-off-by: Arvind Yadav <[email protected]>
---
drivers/gpu/drm/xe/xe_vm.c | 11 ++++++++---
1 file changed, 8 insertions(+), 3 deletions(-)
diff --git a/drivers/gpu/drm/xe/xe_vm.c b/drivers/gpu/drm/xe/xe_vm.c
index 823e264319a1..a1a4eaf3165f 100644
--- a/drivers/gpu/drm/xe/xe_vm.c
+++ b/drivers/gpu/drm/xe/xe_vm.c
@@ -2108,6 +2108,8 @@ static void vm_destroy_work_func(struct work_struct *w)
xe_file_put(vm->xef);
kfree(vm);
+
+ drm_dev_put(&xe->drm);
}
static void xe_vm_free(struct drm_gpuvm *gpuvm)
@@ -2115,10 +2117,13 @@ static void xe_vm_free(struct drm_gpuvm *gpuvm)
struct xe_vm *vm = container_of(gpuvm, struct xe_vm, gpuvm);
/*
- * To destroy the VM we need to be able to sleep.
- * drm_gpuvm keeps at least one device reference at this
- * point so xe->destroy_wq must still be alive.
+ * drm_gpuvm drops its device reference as soon as this callback
+ * returns, but vm_destroy_work_func() still uses device state. Hold a
+ * reference across the deferred work.
*/
+ drm_dev_get(&vm->xe->drm);
+
+ /* To destroy the VM we need to be able to sleep */
queue_work(vm->xe->destroy_wq, &vm->destroy_work);
}
--
2.43.0
