On 31-Mar-26 12:41 AM, Mikhail Gavrilov wrote:
Commit 8f1de51f49be ("drm/amdgpu: prevent immediate PASID reuse case")
converted the global PASID allocator from IDA to IDR with a spinlock
for cyclic allocation, but introduced two locking bugs:
1) idr_alloc_cyclic() is called with GFP_KERNEL under spin_lock(),
which can sleep.
2) amdgpu_pasid_free() can be called from hardirq context via the
fence signal path (amdgpu_pasid_free_cb), but the lock is taken
with plain spin_lock() in process context, creating a potential
deadlock:
CPU0
----
spin_lock(&amdgpu_pasid_idr_lock) // process context, IRQs on
<Interrupt>
spin_lock(&amdgpu_pasid_idr_lock) // deadlock
The hardirq call chain is:
sdma_v6_0_process_trap_irq
-> amdgpu_fence_process
-> dma_fence_signal
-> drm_sched_job_done
-> dma_fence_signal
-> amdgpu_pasid_free_cb
-> amdgpu_pasid_free
This was observed on an RX 7900 XTX when exiting a Vulkan game
running under Proton/Wine, which triggers the fence callback path
during VM teardown.
Replace the IDR + spinlock with XArray. xa_alloc_cyclic() handles
GFP_KERNEL pre-allocation and IRQ-safe locking internally, so it is
used directly in amdgpu_pasid_alloc(). For amdgpu_pasid_free(), which
can be called from hardirq context, use explicit xa_lock_irqsave()
with __xa_erase() since xa_erase() only uses plain xa_lock() which
is not IRQ-safe.
Suggested-by: Lijo Lazar <[email protected]>
Fixes: 8f1de51f49be ("drm/amdgpu: prevent immediate PASID reuse case")
Cc: [email protected]
Signed-off-by: Mikhail Gavrilov <[email protected]>
Reviewed-by: Lijo Lazar <[email protected]>
Thanks,
Lijo
---
v5: Use explicit xa_lock_irqsave/__xa_erase for amdgpu_pasid_free()
since xa_erase() only uses plain xa_lock() which is not safe from
hardirq context. Keep xa_alloc_cyclic() for amdgpu_pasid_alloc()
as it handles locking internally. (Lijo Lazar)
v4: Use xa_alloc_cyclic/xa_erase directly instead of explicit
xa_lock_irqsave, as suggested by Lijo Lazar.
https://lore.kernel.org/all/[email protected]/
v3: Replace IDR with XArray instead of fixing the spinlock, as
suggested by Lijo Lazar.
https://lore.kernel.org/all/[email protected]/
v2: Added second patch fixing the {HARDIRQ-ON-W} -> {IN-HARDIRQ-W}
lock inconsistency (spin_lock -> spin_lock_irqsave).
https://lore.kernel.org/all/[email protected]/
v1: Fixed sleeping-under-spinlock (idr_alloc_cyclic with GFP_KERNEL)
using idr_preload/GFP_NOWAIT.
https://lore.kernel.org/all/[email protected]/
drivers/gpu/drm/amd/amdgpu/amdgpu_ids.c | 47 ++++++++++++-------------
1 file changed, 23 insertions(+), 24 deletions(-)
diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_ids.c
b/drivers/gpu/drm/amd/amdgpu/amdgpu_ids.c
index d88523568b62..3fbf631e67c7 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_ids.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_ids.c
@@ -22,7 +22,7 @@
*/
#include "amdgpu_ids.h"
-#include <linux/idr.h>
+#include <linux/xarray.h>
#include <linux/dma-fence-array.h>
@@ -35,13 +35,13 @@
* PASIDs are global address space identifiers that can be shared
* between the GPU, an IOMMU and the driver. VMs on different devices
* may use the same PASID if they share the same address
- * space. Therefore PASIDs are allocated using IDR cyclic allocator
- * (similar to kernel PID allocation) which naturally delays reuse.
- * VMs are looked up from the PASID per amdgpu_device.
+ * space. Therefore PASIDs are allocated using an XArray cyclic
+ * allocator (similar to kernel PID allocation) which naturally delays
+ * reuse. VMs are looked up from the PASID per amdgpu_device.
*/
-static DEFINE_IDR(amdgpu_pasid_idr);
-static DEFINE_SPINLOCK(amdgpu_pasid_idr_lock);
+static DEFINE_XARRAY_ALLOC(amdgpu_pasid_xa);
+static u32 amdgpu_pasid_xa_next;
/* Helper to free pasid from a fence callback */
struct amdgpu_pasid_cb {
@@ -53,8 +53,7 @@ struct amdgpu_pasid_cb {
* amdgpu_pasid_alloc - Allocate a PASID
* @bits: Maximum width of the PASID in bits, must be at least 1
*
- * Uses kernel's IDR cyclic allocator (same as PID allocation).
- * Allocates sequentially with automatic wrap-around.
+ * Uses XArray cyclic allocator for sequential allocation with wrap-around.
*
* Returns a positive integer on success. Returns %-EINVAL if bits==0.
* Returns %-ENOSPC if no PASID was available. Returns %-ENOMEM on
@@ -62,20 +61,22 @@ struct amdgpu_pasid_cb {
*/
int amdgpu_pasid_alloc(unsigned int bits)
{
- int pasid;
+ u32 pasid;
+ int r;
if (bits == 0)
return -EINVAL;
- spin_lock(&amdgpu_pasid_idr_lock);
- pasid = idr_alloc_cyclic(&amdgpu_pasid_idr, NULL, 1,
- 1U << bits, GFP_KERNEL);
- spin_unlock(&amdgpu_pasid_idr_lock);
+ r = xa_alloc_cyclic(&amdgpu_pasid_xa, &pasid, xa_mk_value(0),
+ XA_LIMIT(1, (1U << bits) - 1),
+ &amdgpu_pasid_xa_next, GFP_KERNEL);
- if (pasid >= 0)
+ if (r >= 0) {
trace_amdgpu_pasid_allocated(pasid);
+ return pasid;
+ }
- return pasid;
+ return r;
}
/**
@@ -84,11 +85,13 @@ int amdgpu_pasid_alloc(unsigned int bits)
*/
void amdgpu_pasid_free(u32 pasid)
{
+ unsigned long flags;
+
trace_amdgpu_pasid_freed(pasid);
- spin_lock(&amdgpu_pasid_idr_lock);
- idr_remove(&amdgpu_pasid_idr, pasid);
- spin_unlock(&amdgpu_pasid_idr_lock);
+ xa_lock_irqsave(&amdgpu_pasid_xa, flags);
+ __xa_erase(&amdgpu_pasid_xa, pasid);
+ xa_unlock_irqrestore(&amdgpu_pasid_xa, flags);
}
static void amdgpu_pasid_free_cb(struct dma_fence *fence,
@@ -625,13 +628,9 @@ void amdgpu_vmid_mgr_fini(struct amdgpu_device *adev)
}
/**
- * amdgpu_pasid_mgr_cleanup - cleanup PASID manager
- *
- * Cleanup the IDR allocator.
+ * amdgpu_pasid_mgr_cleanup - Cleanup PASID manager
*/
void amdgpu_pasid_mgr_cleanup(void)
{
- spin_lock(&amdgpu_pasid_idr_lock);
- idr_destroy(&amdgpu_pasid_idr);
- spin_unlock(&amdgpu_pasid_idr_lock);
+ xa_destroy(&amdgpu_pasid_xa);
}
