Intel-XE Archive on lore.kernel.org
 help / color / mirror / Atom feed
* [PATCH 0/3] drm/xe/ggtt: fix stale GGTT mappings on unmap
@ 2026-08-26 11:25 tilak.tirumalesh.tangudu
  2026-08-26 11:25 ` [PATCH 1/3] drm/xe/ggtt: fault on unmapped GGTT for multi-queue platforms tilak.tirumalesh.tangudu
                   ` (5 more replies)
  0 siblings, 6 replies; 25+ messages in thread
From: tilak.tirumalesh.tangudu @ 2026-08-26 11:25 UTC (permalink / raw)
  To: tilak.tirumalesh.tangudu, niranjana.vishwanathapura,
	matthew.brost, intel-xe

From: Tangudu Tilak Tirumalesh <tilak.tirumalesh.tangudu@intel.com>

This series addresses two related GGTT teardown issues on multi-queue
platforms:

First issue: unmapped GGTT ranges resolve to the scratch page. Because
scratch is a valid PTE, a re-walk of a freed range never faults, so any
stale TLB translation left behind is masked - the freed range silently
reads scratch instead of surfacing the problem. On multi-queue platforms
Patch 1 does not allocate the scratch page at all, so the whole GGTT -
initial clear and unmap alike - holds PTE=0 and faults consistently for
the entire boot. Other platforms keep scratch and are unchanged.

Second issue: engines cache GGTT translations in their own TLBs. The
existing GGTT invalidation (xe_tlb_inval_ggtt()) does not reach those
engine-side TLBs, so after an unmap an engine can keep hitting the stale
translation and read the old page. Patches 2 and 3 add and use a full
(INVAL_FULL, intra-VF) invalidation to drain the engine TLBs on unmap.

Patch 1: drm/xe/ggtt: fault on unmapped GGTT for multi-queue platforms
    Skip allocating the GGTT scratch page on multi-queue platforms so
    cleared and unmapped ranges hold PTE=0 and a stale-TLB access to a
    freed range faults instead of silently landing on scratch.

Patch 2: drm/xe/tlb_inval: add xe_tlb_inval_ggtt_full() GGTT
         invalidation helper
    xe_tlb_inval_ggtt_full() + GuC backend flush engine TLBs across all
    engines within the requesting VF.

Patch 3: drm/xe/ggtt: invalidate engine GGTT TLBs for multi-queue GTs
    Issue the invalidation on the unmap path, gated on the GT having any
    multi-queue engine class, for both the primary and media GTs.
    Draining the engine TLB on teardown guarantees a recycled range's
    next occupant cannot hit the predecessor's cached translation.

v2:
    - Add xe_gt_has_multi_queue() helper and gate on it (Niranjana).
    - Add xe_tlb_inval_issue_op_wait() and refactor the GGTT
      invalidation entry points onto it (Niranjana).
    - Other nits.

v3:
    - Patch 1: drop the scratch page entirely on multi-queue platforms
      instead of toggling scratch vs faulting at unmap, so the behaviour
      is consistent for the whole boot (Matt Brost).
    - Patch 2: avoid the CT-state TOCTOU; (Matt Brost).
    - Patch 3: invalidate both the primary and media GTs, similar to
      xe_ggtt_invalidate() (Matt Brost)

v4:
    - Patch 2: propagate real send errors instead of masking them as
      -ECANCELED (Sashiko).

Tangudu Tilak Tirumalesh (3):
  drm/xe/ggtt: fault on unmapped GGTT for multi-queue platforms
  drm/xe/tlb_inval: add xe_tlb_inval_ggtt_full() GGTT invalidation
    helper
  drm/xe/ggtt: invalidate engine GGTT TLBs for multi-queue GTs

 drivers/gpu/drm/xe/xe_ggtt.c            | 68 +++++++++++++++++++------
 drivers/gpu/drm/xe/xe_gt.h              | 13 +++++
 drivers/gpu/drm/xe/xe_guc_tlb_inval.c   | 25 +++++++++
 drivers/gpu/drm/xe/xe_tlb_inval.c       | 42 ++++++++++++---
 drivers/gpu/drm/xe/xe_tlb_inval.h       |  1 +
 drivers/gpu/drm/xe/xe_tlb_inval_types.h | 10 ++++
 6 files changed, 137 insertions(+), 22 deletions(-)

-- 
2.46.0


^ permalink raw reply	[flat|nested] 25+ messages in thread
* [PATCH 0/3] drm/xe/ggtt: fix stale GGTT mappings on unmap
@ 2026-08-27  8:20 tilak.tirumalesh.tangudu
  2026-08-27  8:20 ` [PATCH 2/3] drm/xe/tlb_inval: add xe_tlb_inval_ggtt_full() GGTT invalidation helper tilak.tirumalesh.tangudu
  0 siblings, 1 reply; 25+ messages in thread
From: tilak.tirumalesh.tangudu @ 2026-08-27  8:20 UTC (permalink / raw)
  To: tilak.tirumalesh.tangudu, niranjana.vishwanathapura,
	matthew.brost, intel-xe

From: Tangudu Tilak Tirumalesh <tilak.tirumalesh.tangudu@intel.com>

This series addresses two related GGTT teardown issues on multi-queue
platforms:

First issue: unmapped GGTT ranges resolve to the scratch page. Because
scratch is a valid PTE, a re-walk of a freed range never faults, so any
stale TLB translation left behind is masked - the freed range silently
reads scratch instead of surfacing the problem. On multi-queue platforms
Patch 1 does not allocate the scratch page at all, so the whole GGTT -
initial clear and unmap alike - holds PTE=0 and faults consistently for
the entire boot. Other platforms keep scratch and are unchanged.

Second issue: engines cache GGTT translations in their own TLBs. A
full context restore on engine switch normally flushes them, but on
multi-queue GuC does a lite-restore on secondary queue append and
skips the full context restore, so those engine TLB invalidations are
missed. The existing GGTT invalidation (xe_tlb_inval_ggtt()) does not
reach the engine-side TLBs either, so after an unmap an engine can
keep hitting the stale translation and read the old page. Patches 2
and 3 add and use a full (INVAL_FULL, intra-VF) invalidation to drain
the engine TLBs on unmap.

Patch 1: drm/xe/ggtt: fault on unmapped GGTT for multi-queue platforms
    Skip allocating the GGTT scratch page on multi-queue platforms so
    cleared and unmapped ranges hold PTE=0. A missed engine TLB
    invalidation (see above) then faults instead of silently landing
    on scratch.

Patch 2: drm/xe/tlb_inval: add xe_tlb_inval_ggtt_full() GGTT
         invalidation helper
    xe_tlb_inval_ggtt_full() + GuC backend flush engine TLBs across all
    engines within the requesting VF.

Patch 3: drm/xe/ggtt: invalidate engine GGTT TLBs for multi-queue GTs
    Issue the invalidation on the unmap path, gated on the GT having any
    multi-queue engine class, for both the primary and media GTs.
    Draining the engine TLB on teardown guarantees a recycled range's
    next occupant cannot hit the predecessor's cached translation.

v2:
    - Add xe_gt_has_multi_queue() helper and gate on it (Niranjana).
    - Add xe_tlb_inval_issue_op_wait() and refactor the GGTT
      invalidation entry points onto it (Niranjana).
    - Other nits.

v3:
    - Patch 1: drop the scratch page entirely on multi-queue platforms
      instead of toggling scratch vs faulting at unmap, so the behaviour
      is consistent for the whole boot (Matt Brost).
    - Patch 2: avoid the CT-state TOCTOU (Matt Brost).
    - Patch 3: invalidate both the primary and media GTs, similar to
      xe_ggtt_invalidate() (Matt Brost).

v4:
    - Patch 2: propagate real send errors instead of masking them as
      -ECANCELED (Sashiko).

v5:
    - Patch 1: document the rationale - GuC lite-restore on secondary
      queue append skips the full context restore, so engine TLB
      invalidations are missed (Matt Roper, Matt Brost).
    - Patch 2: handle -ENOTRECOVERABLE (wedged) alongside -ENODEV, and
      drop the redundant -ECANCELED check (Matt Brost, Niranjana).
    - Patch 3: guard NULL gt for parity with ggtt_invalidate_gt_tlb()
      and explain the multi-queue-only engine flush (Niranjana).

Tangudu Tilak Tirumalesh (3):
  drm/xe/ggtt: fault on unmapped GGTT for multi-queue platforms
  drm/xe/tlb_inval: add xe_tlb_inval_ggtt_full() GGTT invalidation
    helper
  drm/xe/ggtt: invalidate engine GGTT TLBs for multi-queue GTs

 drivers/gpu/drm/xe/xe_ggtt.c            | 74 +++++++++++++++++++------
 drivers/gpu/drm/xe/xe_gt.h              | 13 +++++
 drivers/gpu/drm/xe/xe_guc_tlb_inval.c   | 29 ++++++++++
 drivers/gpu/drm/xe/xe_tlb_inval.c       | 42 ++++++++++++--
 drivers/gpu/drm/xe/xe_tlb_inval.h       |  1 +
 drivers/gpu/drm/xe/xe_tlb_inval_types.h | 10 ++++
 6 files changed, 147 insertions(+), 22 deletions(-)

-- 
2.46.0


^ permalink raw reply	[flat|nested] 25+ messages in thread
* [PATCH 0/3] drm/xe/ggtt: fix stale GGTT mappings on unmap
@ 2026-08-26 10:31 tilak.tirumalesh.tangudu
  2026-08-26 10:31 ` [PATCH 2/3] drm/xe/tlb_inval: add xe_tlb_inval_ggtt_full() GGTT invalidation helper tilak.tirumalesh.tangudu
  0 siblings, 1 reply; 25+ messages in thread
From: tilak.tirumalesh.tangudu @ 2026-08-26 10:31 UTC (permalink / raw)
  To: tilak.tirumalesh.tangudu, niranjana.vishwanathapura,
	matthew.brost, intel-xe

From: Tangudu Tilak Tirumalesh <tilak.tirumalesh.tangudu@intel.com>

This series addresses two related GGTT teardown issues on multi-queue
platforms:

First issue: unmapped GGTT ranges resolve to the scratch page. Because
scratch is a valid PTE, a re-walk of a freed range never faults, so any
stale TLB translation left behind is masked - the freed range silently
reads scratch instead of surfacing the problem. On multi-queue platforms
Patch 1 does not allocate the scratch page at all, so the whole GGTT -
initial clear and unmap alike - holds PTE=0 and faults consistently for
the entire boot. Other platforms keep scratch and are unchanged.

Second issue: engines cache GGTT translations in their own TLBs. The
existing GGTT invalidation (xe_tlb_inval_ggtt()) does not reach those
engine-side TLBs, so after an unmap an engine can keep hitting the stale
translation and read the old page. Patches 2 and 3 add and use a full
(INVAL_FULL, intra-VF) invalidation to drain the engine TLBs on unmap.

Patch 1: drm/xe/ggtt: fault on unmapped GGTT for multi-queue platforms
    Skip allocating the GGTT scratch page on multi-queue platforms so
    cleared and unmapped ranges hold PTE=0 and a stale-TLB access to a
    freed range faults instead of silently landing on scratch.

Patch 2: drm/xe/tlb_inval: add xe_tlb_inval_ggtt_full() GGTT
         invalidation helper
    xe_tlb_inval_ggtt_full() + GuC backend flush engine TLBs across all
    engines within the requesting VF.

Patch 3: drm/xe/ggtt: invalidate engine GGTT TLBs for multi-queue GTs
    Issue the invalidation on the unmap path, gated on the GT having any
    multi-queue engine class, for both the primary and media GTs.
    Draining the engine TLB on teardown guarantees a recycled range's
    next occupant cannot hit the predecessor's cached translation.

v2:
    - Add xe_gt_has_multi_queue() helper and gate on it (Niranjana).
    - Add xe_tlb_inval_issue_op_wait() and refactor the GGTT
      invalidation entry points onto it (Niranjana).
    - Other nits.

v3:
    - Patch 1: drop the scratch page entirely on multi-queue platforms
      instead of toggling scratch vs faulting at unmap, so the behaviour
      is consistent for the whole boot (Matt Brost).
    - Patch 2: avoid the CT-state TOCTOU; (Matt Brost).
    - Patch 3: invalidate both the primary and media GTs, similar to
      xe_ggtt_invalidate() (Matt Brost)

Tangudu Tilak Tirumalesh (3):
  drm/xe/ggtt: fault on unmapped GGTT for multi-queue platforms
  drm/xe/tlb_inval: add xe_tlb_inval_ggtt_full() GGTT invalidation
    helper
  drm/xe/ggtt: invalidate engine GGTT TLBs for multi-queue GTs

 drivers/gpu/drm/xe/xe_ggtt.c            | 68 +++++++++++++++++++------
 drivers/gpu/drm/xe/xe_gt.h              | 13 +++++
 drivers/gpu/drm/xe/xe_guc_tlb_inval.c   | 21 ++++++++
 drivers/gpu/drm/xe/xe_tlb_inval.c       | 42 ++++++++++++---
 drivers/gpu/drm/xe/xe_tlb_inval.h       |  1 +
 drivers/gpu/drm/xe/xe_tlb_inval_types.h | 10 ++++
 6 files changed, 133 insertions(+), 22 deletions(-)

-- 
2.46.0


^ permalink raw reply	[flat|nested] 25+ messages in thread
* [PATCH 0/3] drm/xe/ggtt: fix stale GGTT mappings on unmap
@ 2026-08-24 16:34 tilak.tirumalesh.tangudu
  2026-08-24 16:34 ` [PATCH 2/3] drm/xe/tlb_inval: add xe_tlb_inval_ggtt_full() GGTT invalidation helper tilak.tirumalesh.tangudu
  0 siblings, 1 reply; 25+ messages in thread
From: tilak.tirumalesh.tangudu @ 2026-08-24 16:34 UTC (permalink / raw)
  To: tilak.tirumalesh.tangudu, niranjana.vishwanathapura,
	matthew.brost, intel-xe

From: Tangudu Tilak Tirumalesh <tilak.tirumalesh.tangudu@intel.com>

This series addresses two related GGTT teardown issues on multi-
queue platforms:

First issue: the unmap path mapped freed ranges to the scratch page.
Because scratch is a valid PTE, a re-walk of a freed range never
faults, so any stale TLB translation left behind is masked - the freed
range silently reads scratch instead of surfacing the problem. On
multi-queue platforms Patch 1 writes PTE=0 on unmap instead; other
platforms keep scratch, so free-hole and init-time handling are
unchanged.

Second issue: engines cache GGTT translations in their own TLBs. The
existing GGTT invalidation (xe_tlb_inval_ggtt()) does not reach those
engine-side TLBs, so after an unmap an engine can keep hitting the
stale translation and read the old page. Patches 2 and 3 add and use a
FULL_INTRA_VF invalidation to drain the engine TLBs on unmap.

Patch 1: drm/xe/ggtt: stop mapping unmapped GGTT pages to scratch
    On multi-queue platforms write PTE=0 on unmap so a stale-TLB
    access to a freed range faults instead of silently landing on
    scratch.

Patch 2: drm/xe/tlb_inval: add FULL_INTRA_VF GGTT invalidation helper
    xe_tlb_inval_ggtt_full() + GuC backend flush engine TLBs across
    all engines in the requesting VF partition.

Patch 3: drm/xe/ggtt: invalidate engine GGTT TLBs for multi-queue GTs
    Issue the FULL_INTRA_VF invalidation on the unmap path, gated on
    the GT having any multi-queue engine class. Draining the engine
    TLB on teardown guarantees a recycled range's next occupant cannot
    hit the predecessor's cached translation.

v2: Add xe_gt_has_multi_queue() helper and refactor.
    Add xe_tlb_inval_issue_op_wait and refactor.
    Other knits.

Tangudu Tilak Tirumalesh (3):
  drm/xe/ggtt: stop mapping unmapped GGTT pages to scratch
  drm/xe/tlb_inval: add xe_tlb_inval_ggtt_full() GGTT invalidation
    helper
  drm/xe/ggtt: invalidate engine GGTT TLBs for multi-queue GTs

 drivers/gpu/drm/xe/xe_ggtt.c            | 70 ++++++++++++++++++++-----
 drivers/gpu/drm/xe/xe_gt.h              | 13 +++++
 drivers/gpu/drm/xe/xe_guc_tlb_inval.c   | 21 ++++++++
 drivers/gpu/drm/xe/xe_tlb_inval.c       | 42 ++++++++++++---
 drivers/gpu/drm/xe/xe_tlb_inval.h       |  1 +
 drivers/gpu/drm/xe/xe_tlb_inval_types.h | 10 ++++
 6 files changed, 137 insertions(+), 20 deletions(-)

-- 
2.46.0


^ permalink raw reply	[flat|nested] 25+ messages in thread

end of thread, other threads:[~2026-08-27 17:12 UTC | newest]

Thread overview: 25+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2026-08-26 11:25 [PATCH 0/3] drm/xe/ggtt: fix stale GGTT mappings on unmap tilak.tirumalesh.tangudu
2026-08-26 11:25 ` [PATCH 1/3] drm/xe/ggtt: fault on unmapped GGTT for multi-queue platforms tilak.tirumalesh.tangudu
2026-08-26 19:15   ` Niranjana Vishwanathapura
2026-08-26 20:10   ` Matt Roper
2026-08-26 20:23     ` Matthew Brost
2026-08-27  4:18       ` Tangudu, Tilak Tirumalesh
2026-08-26 11:25 ` [PATCH 2/3] drm/xe/tlb_inval: add xe_tlb_inval_ggtt_full() GGTT invalidation helper tilak.tirumalesh.tangudu
2026-08-26 19:30   ` Niranjana Vishwanathapura
2026-08-26 19:48     ` Matthew Brost
2026-08-26 19:50       ` Matthew Brost
2026-08-27  6:30         ` Tangudu, Tilak Tirumalesh
2026-08-26 11:25 ` [PATCH 3/3] drm/xe/ggtt: invalidate engine GGTT TLBs for multi-queue GTs tilak.tirumalesh.tangudu
2026-08-26 19:45   ` Niranjana Vishwanathapura
2026-08-27  0:32   ` Matthew Brost
2026-08-26 11:35 ` ✓ CI.KUnit: success for drm/xe/ggtt: fix stale GGTT mappings on unmap (rev4) Patchwork
2026-08-26 12:19 ` ✓ Xe.CI.BAT: " Patchwork
2026-08-26 14:40 ` ✗ Xe.CI.FULL: failure " Patchwork
  -- strict thread matches above, loose matches on Subject: below --
2026-08-27  8:20 [PATCH 0/3] drm/xe/ggtt: fix stale GGTT mappings on unmap tilak.tirumalesh.tangudu
2026-08-27  8:20 ` [PATCH 2/3] drm/xe/tlb_inval: add xe_tlb_inval_ggtt_full() GGTT invalidation helper tilak.tirumalesh.tangudu
2026-08-27 16:58   ` Niranjana Vishwanathapura
2026-08-27 17:12     ` Matthew Brost
2026-08-26 10:31 [PATCH 0/3] drm/xe/ggtt: fix stale GGTT mappings on unmap tilak.tirumalesh.tangudu
2026-08-26 10:31 ` [PATCH 2/3] drm/xe/tlb_inval: add xe_tlb_inval_ggtt_full() GGTT invalidation helper tilak.tirumalesh.tangudu
2026-08-26 10:47   ` sashiko-bot
2026-08-24 16:34 [PATCH 0/3] drm/xe/ggtt: fix stale GGTT mappings on unmap tilak.tirumalesh.tangudu
2026-08-24 16:34 ` [PATCH 2/3] drm/xe/tlb_inval: add xe_tlb_inval_ggtt_full() GGTT invalidation helper tilak.tirumalesh.tangudu
2026-08-24 18:20   ` Niranjana Vishwanathapura
2026-08-25 18:08   ` Matthew Brost

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox