drivers/gpu/drm/xe/xe_vm.c

   1 // SPDX-License-Identifier: MIT
   2 /*
   3  * Copyright © 2021 Intel Corporation
   4  */
   5
   6 #include "xe_vm.h"
   7
   8 #include <linux/dma-fence-array.h>
   9
  10 #include <drm/drm_print.h>
  11 #include <drm/ttm/ttm_execbuf_util.h>
  12 #include <drm/ttm/ttm_tt.h>
  13 #include <drm/xe_drm.h>
  14 #include <linux/delay.h>
  15 #include <linux/kthread.h>
  16 #include <linux/mm.h>
  17 #include <linux/swap.h>
  18
  19 #include "xe_bo.h"
  20 #include "xe_device.h"
  21 #include "xe_engine.h"
  22 #include "xe_gt.h"
  23 #include "xe_gt_pagefault.h"
  24 #include "xe_gt_tlb_invalidation.h"
  25 #include "xe_migrate.h"
  26 #include "xe_pm.h"
  27 #include "xe_preempt_fence.h"
  28 #include "xe_pt.h"
  29 #include "xe_res_cursor.h"
  30 #include "xe_sync.h"
  31 #include "xe_trace.h"
  32
  33 #define TEST_VM_ASYNC_OPS_ERROR
  34
  35 /**
  36  * xe_vma_userptr_check_repin() - Advisory check for repin needed
  37  * @vma: The userptr vma
  38  *
  39  * Check if the userptr vma has been invalidated since last successful
  40  * repin. The check is advisory only and can the function can be called
  41  * without the vm->userptr.notifier_lock held. There is no guarantee that the
  42  * vma userptr will remain valid after a lockless check, so typically
  43  * the call needs to be followed by a proper check under the notifier_lock.
  44  *
  45  * Return: 0 if userptr vma is valid, -EAGAIN otherwise; repin recommended.
  46  */
  47 int xe_vma_userptr_check_repin(struct xe_vma *vma)
  48 {
  49         return mmu_interval_check_retry(&vma->userptr.notifier,
  50                                         vma->userptr.notifier_seq) ?
  51                 -EAGAIN : 0;
  52 }
  53
  54 int xe_vma_userptr_pin_pages(struct xe_vma *vma)
  55 {
  56         struct xe_vm *vm = vma->vm;
  57         struct xe_device *xe = vm->xe;
  58         const unsigned long num_pages =
  59                 (vma->end - vma->start + 1) >> PAGE_SHIFT;
  60         struct page **pages;
  61         bool in_kthread = !current->mm;
  62         unsigned long notifier_seq;
  63         int pinned, ret, i;
  64         bool read_only = vma->pte_flags & XE_PTE_FLAG_READ_ONLY;
  65
  66         lockdep_assert_held(&vm->lock);
  67         XE_BUG_ON(!xe_vma_is_userptr(vma));
  68 retry:
  69         if (vma->destroyed)
  70                 return 0;
  71
  72         notifier_seq = mmu_interval_read_begin(&vma->userptr.notifier);
  73         if (notifier_seq == vma->userptr.notifier_seq)
  74                 return 0;
  75
  76         pages = kvmalloc_array(num_pages, sizeof(*pages), GFP_KERNEL);
  77         if (!pages)
  78                 return -ENOMEM;
  79
  80         if (vma->userptr.sg) {
  81                 dma_unmap_sgtable(xe->drm.dev,
  82                                   vma->userptr.sg,
  83                                   read_only ? DMA_TO_DEVICE :
  84                                   DMA_BIDIRECTIONAL, 0);
  85                 sg_free_table(vma->userptr.sg);
  86                 vma->userptr.sg = NULL;
  87         }
  88
  89         pinned = ret = 0;
  90         if (in_kthread) {
  91                 if (!mmget_not_zero(vma->userptr.notifier.mm)) {
  92                         ret = -EFAULT;
  93                         goto mm_closed;
  94                 }
  95                 kthread_use_mm(vma->userptr.notifier.mm);
  96         }
  97
  98         while (pinned < num_pages) {
  99                 ret = get_user_pages_fast(vma->userptr.ptr + pinned * PAGE_SIZE,
 100                                           num_pages - pinned,
 101                                           read_only ? 0 : FOLL_WRITE,
 102                                           &pages[pinned]);
 103                 if (ret < 0) {
 104                         if (in_kthread)
 105                                 ret = 0;
 106                         break;
 107                 }
 108
 109                 pinned += ret;
 110                 ret = 0;
 111         }
 112
 113         if (in_kthread) {
 114                 kthread_unuse_mm(vma->userptr.notifier.mm);
 115                 mmput(vma->userptr.notifier.mm);
 116         }
 117 mm_closed:
 118         if (ret)
 119                 goto out;
 120
 121         ret = sg_alloc_table_from_pages_segment(&vma->userptr.sgt, pages,
 122                                                 pinned, 0,
 123                                                 (u64)pinned << PAGE_SHIFT,
 124                                                 xe_sg_segment_size(xe->drm.dev),
 125                                                 GFP_KERNEL);
 126         if (ret) {
 127                 vma->userptr.sg = NULL;
 128                 goto out;
 129         }
 130         vma->userptr.sg = &vma->userptr.sgt;
 131
 132         ret = dma_map_sgtable(xe->drm.dev, vma->userptr.sg,
 133                               read_only ? DMA_TO_DEVICE :
 134                               DMA_BIDIRECTIONAL,
 135                               DMA_ATTR_SKIP_CPU_SYNC |
 136                               DMA_ATTR_NO_KERNEL_MAPPING);
 137         if (ret) {
 138                 sg_free_table(vma->userptr.sg);
 139                 vma->userptr.sg = NULL;
 140                 goto out;
 141         }
 142
 143         for (i = 0; i < pinned; ++i) {
 144                 if (!read_only) {
 145                         lock_page(pages[i]);
 146                         set_page_dirty(pages[i]);
 147                         unlock_page(pages[i]);
 148                 }
 149
 150                 mark_page_accessed(pages[i]);
 151         }
 152
 153 out:
 154         release_pages(pages, pinned);
 155         kvfree(pages);
 156
 157         if (!(ret < 0)) {
 158                 vma->userptr.notifier_seq = notifier_seq;
 159                 if (xe_vma_userptr_check_repin(vma) == -EAGAIN)
 160                         goto retry;
 161         }
 162
 163         return ret < 0 ? ret : 0;
 164 }
 165
 166 static bool preempt_fences_waiting(struct xe_vm *vm)
 167 {
 168         struct xe_engine *e;
 169
 170         lockdep_assert_held(&vm->lock);
 171         xe_vm_assert_held(vm);
 172
 173         list_for_each_entry(e, &vm->preempt.engines, compute.link) {
 174                 if (!e->compute.pfence || (e->compute.pfence &&
 175                     test_bit(DMA_FENCE_FLAG_ENABLE_SIGNAL_BIT,
 176                              &e->compute.pfence->flags))) {
 177                         return true;
 178                 }
 179         }
 180
 181         return false;
 182 }
 183
 184 static void free_preempt_fences(struct list_head *list)
 185 {
 186         struct list_head *link, *next;
 187
 188         list_for_each_safe(link, next, list)
 189                 xe_preempt_fence_free(to_preempt_fence_from_link(link));
 190 }
 191
 192 static int alloc_preempt_fences(struct xe_vm *vm, struct list_head *list,
 193                                 unsigned int *count)
 194 {
 195         lockdep_assert_held(&vm->lock);
 196         xe_vm_assert_held(vm);
 197
 198         if (*count >= vm->preempt.num_engines)
 199                 return 0;
 200
 201         for (; *count < vm->preempt.num_engines; ++(*count)) {
 202                 struct xe_preempt_fence *pfence = xe_preempt_fence_alloc();
 203
 204                 if (IS_ERR(pfence))
 205                         return PTR_ERR(pfence);
 206
 207                 list_move_tail(xe_preempt_fence_link(pfence), list);
 208         }
 209
 210         return 0;
 211 }
 212
 213 static int wait_for_existing_preempt_fences(struct xe_vm *vm)
 214 {
 215         struct xe_engine *e;
 216
 217         xe_vm_assert_held(vm);
 218
 219         list_for_each_entry(e, &vm->preempt.engines, compute.link) {
 220                 if (e->compute.pfence) {
 221                         long timeout = dma_fence_wait(e->compute.pfence, false);
 222
 223                         if (timeout < 0)
 224                                 return -ETIME;
 225                         dma_fence_put(e->compute.pfence);
 226                         e->compute.pfence = NULL;
 227                 }
 228         }
 229
 230         return 0;
 231 }
 232
 233 static bool xe_vm_is_idle(struct xe_vm *vm)
 234 {
 235         struct xe_engine *e;
 236
 237         xe_vm_assert_held(vm);
 238         list_for_each_entry(e, &vm->preempt.engines, compute.link) {
 239                 if (!xe_engine_is_idle(e))
 240                         return false;
 241         }
 242
 243         return true;
 244 }
 245
 246 static void arm_preempt_fences(struct xe_vm *vm, struct list_head *list)
 247 {
 248         struct list_head *link;
 249         struct xe_engine *e;
 250
 251         list_for_each_entry(e, &vm->preempt.engines, compute.link) {
 252                 struct dma_fence *fence;
 253
 254                 link = list->next;
 255                 XE_BUG_ON(link == list);
 256
 257                 fence = xe_preempt_fence_arm(to_preempt_fence_from_link(link),
 258                                              e, e->compute.context,
 259                                              ++e->compute.seqno);
 260                 dma_fence_put(e->compute.pfence);
 261                 e->compute.pfence = fence;
 262         }
 263 }
 264
 265 static int add_preempt_fences(struct xe_vm *vm, struct xe_bo *bo)
 266 {
 267         struct xe_engine *e;
 268         struct ww_acquire_ctx ww;
 269         int err;
 270
 271         err = xe_bo_lock(bo, &ww, vm->preempt.num_engines, true);
 272         if (err)
 273                 return err;
 274
 275         list_for_each_entry(e, &vm->preempt.engines, compute.link)
 276                 if (e->compute.pfence) {
 277                         dma_resv_add_fence(bo->ttm.base.resv,
 278                                            e->compute.pfence,
 279                                            DMA_RESV_USAGE_BOOKKEEP);
 280                 }
 281
 282         xe_bo_unlock(bo, &ww);
 283         return 0;
 284 }
 285
 286 /**
 287  * xe_vm_fence_all_extobjs() - Add a fence to vm's external objects' resv
 288  * @vm: The vm.
 289  * @fence: The fence to add.
 290  * @usage: The resv usage for the fence.
 291  *
 292  * Loops over all of the vm's external object bindings and adds a @fence
 293  * with the given @usage to all of the external object's reservation
 294  * objects.
 295  */
 296 void xe_vm_fence_all_extobjs(struct xe_vm *vm, struct dma_fence *fence,
 297                              enum dma_resv_usage usage)
 298 {
 299         struct xe_vma *vma;
 300
 301         list_for_each_entry(vma, &vm->extobj.list, extobj.link)
 302                 dma_resv_add_fence(vma->bo->ttm.base.resv, fence, usage);
 303 }
 304
 305 static void resume_and_reinstall_preempt_fences(struct xe_vm *vm)
 306 {
 307         struct xe_engine *e;
 308
 309         lockdep_assert_held(&vm->lock);
 310         xe_vm_assert_held(vm);
 311
 312         list_for_each_entry(e, &vm->preempt.engines, compute.link) {
 313                 e->ops->resume(e);
 314
 315                 dma_resv_add_fence(&vm->resv, e->compute.pfence,
 316                                    DMA_RESV_USAGE_BOOKKEEP);
 317                 xe_vm_fence_all_extobjs(vm, e->compute.pfence,
 318                                         DMA_RESV_USAGE_BOOKKEEP);
 319         }
 320 }
 321
 322 int xe_vm_add_compute_engine(struct xe_vm *vm, struct xe_engine *e)
 323 {
 324         struct ttm_validate_buffer tv_onstack[XE_ONSTACK_TV];
 325         struct ttm_validate_buffer *tv;
 326         struct ww_acquire_ctx ww;
 327         struct list_head objs;
 328         struct dma_fence *pfence;
 329         int err;
 330         bool wait;
 331
 332         XE_BUG_ON(!xe_vm_in_compute_mode(vm));
 333
 334         down_write(&vm->lock);
 335
 336         err = xe_vm_lock_dma_resv(vm, &ww, tv_onstack, &tv, &objs, true, 1);
 337         if (err)
 338                 goto out_unlock_outer;
 339
 340         pfence = xe_preempt_fence_create(e, e->compute.context,
 341                                          ++e->compute.seqno);
 342         if (!pfence) {
 343                 err = -ENOMEM;
 344                 goto out_unlock;
 345         }
 346
 347         list_add(&e->compute.link, &vm->preempt.engines);
 348         ++vm->preempt.num_engines;
 349         e->compute.pfence = pfence;
 350
 351         down_read(&vm->userptr.notifier_lock);
 352
 353         dma_resv_add_fence(&vm->resv, pfence,
 354                            DMA_RESV_USAGE_BOOKKEEP);
 355
 356         xe_vm_fence_all_extobjs(vm, pfence, DMA_RESV_USAGE_BOOKKEEP);
 357
 358         /*
 359          * Check to see if a preemption on VM is in flight or userptr
 360          * invalidation, if so trigger this preempt fence to sync state with
 361          * other preempt fences on the VM.
 362          */
 363         wait = __xe_vm_userptr_needs_repin(vm) || preempt_fences_waiting(vm);
 364         if (wait)
 365                 dma_fence_enable_sw_signaling(pfence);
 366
 367         up_read(&vm->userptr.notifier_lock);
 368
 369 out_unlock:
 370         xe_vm_unlock_dma_resv(vm, tv_onstack, tv, &ww, &objs);
 371 out_unlock_outer:
 372         up_write(&vm->lock);
 373
 374         return err;
 375 }
 376
 377 /**
 378  * __xe_vm_userptr_needs_repin() - Check whether the VM does have userptrs
 379  * that need repinning.
 380  * @vm: The VM.
 381  *
 382  * This function checks for whether the VM has userptrs that need repinning,
 383  * and provides a release-type barrier on the userptr.notifier_lock after
 384  * checking.
 385  *
 386  * Return: 0 if there are no userptrs needing repinning, -EAGAIN if there are.
 387  */
 388 int __xe_vm_userptr_needs_repin(struct xe_vm *vm)
 389 {
 390         lockdep_assert_held_read(&vm->userptr.notifier_lock);
 391
 392         return (list_empty(&vm->userptr.repin_list) &&
 393                 list_empty(&vm->userptr.invalidated)) ? 0 : -EAGAIN;
 394 }
 395
 396 /**
 397  * xe_vm_lock_dma_resv() - Lock the vm dma_resv object and the dma_resv
 398  * objects of the vm's external buffer objects.
 399  * @vm: The vm.
 400  * @ww: Pointer to a struct ww_acquire_ctx locking context.
 401  * @tv_onstack: Array size XE_ONSTACK_TV of storage for the struct
 402  * ttm_validate_buffers used for locking.
 403  * @tv: Pointer to a pointer that on output contains the actual storage used.
 404  * @objs: List head for the buffer objects locked.
 405  * @intr: Whether to lock interruptible.
 406  * @num_shared: Number of dma-fence slots to reserve in the locked objects.
 407  *
 408  * Locks the vm dma-resv objects and all the dma-resv objects of the
 409  * buffer objects on the vm external object list. The TTM utilities require
 410  * a list of struct ttm_validate_buffers pointing to the actual buffer
 411  * objects to lock. Storage for those struct ttm_validate_buffers should
 412  * be provided in @tv_onstack, and is typically reserved on the stack
 413  * of the caller. If the size of @tv_onstack isn't sufficient, then
 414  * storage will be allocated internally using kvmalloc().
 415  *
 416  * The function performs deadlock handling internally, and after a
 417  * successful return the ww locking transaction should be considered
 418  * sealed.
 419  *
 420  * Return: 0 on success, Negative error code on error. In particular if
 421  * @intr is set to true, -EINTR or -ERESTARTSYS may be returned. In case
 422  * of error, any locking performed has been reverted.
 423  */
 424 int xe_vm_lock_dma_resv(struct xe_vm *vm, struct ww_acquire_ctx *ww,
 425                         struct ttm_validate_buffer *tv_onstack,
 426                         struct ttm_validate_buffer **tv,
 427                         struct list_head *objs,
 428                         bool intr,
 429                         unsigned int num_shared)
 430 {
 431         struct ttm_validate_buffer *tv_vm, *tv_bo;
 432         struct xe_vma *vma, *next;
 433         LIST_HEAD(dups);
 434         int err;
 435
 436         lockdep_assert_held(&vm->lock);
 437
 438         if (vm->extobj.entries < XE_ONSTACK_TV) {
 439                 tv_vm = tv_onstack;
 440         } else {
 441                 tv_vm = kvmalloc_array(vm->extobj.entries + 1, sizeof(*tv_vm),
 442                                        GFP_KERNEL);
 443                 if (!tv_vm)
 444                         return -ENOMEM;
 445         }
 446         tv_bo = tv_vm + 1;
 447
 448         INIT_LIST_HEAD(objs);
 449         list_for_each_entry(vma, &vm->extobj.list, extobj.link) {
 450                 tv_bo->num_shared = num_shared;
 451                 tv_bo->bo = &vma->bo->ttm;
 452
 453                 list_add_tail(&tv_bo->head, objs);
 454                 tv_bo++;
 455         }
 456         tv_vm->num_shared = num_shared;
 457         tv_vm->bo = xe_vm_ttm_bo(vm);
 458         list_add_tail(&tv_vm->head, objs);
 459         err = ttm_eu_reserve_buffers(ww, objs, intr, &dups);
 460         if (err)
 461                 goto out_err;
 462
 463         spin_lock(&vm->notifier.list_lock);
 464         list_for_each_entry_safe(vma, next, &vm->notifier.rebind_list,
 465                                  notifier.rebind_link) {
 466                 xe_bo_assert_held(vma->bo);
 467
 468                 list_del_init(&vma->notifier.rebind_link);
 469                 if (vma->tile_present && !vma->destroyed)
 470                         list_move_tail(&vma->rebind_link, &vm->rebind_list);
 471         }
 472         spin_unlock(&vm->notifier.list_lock);
 473
 474         *tv = tv_vm;
 475         return 0;
 476
 477 out_err:
 478         if (tv_vm != tv_onstack)
 479                 kvfree(tv_vm);
 480
 481         return err;
 482 }
 483
 484 /**
 485  * xe_vm_unlock_dma_resv() - Unlock reservation objects locked by
 486  * xe_vm_lock_dma_resv()
 487  * @vm: The vm.
 488  * @tv_onstack: The @tv_onstack array given to xe_vm_lock_dma_resv().
 489  * @tv: The value of *@tv given by xe_vm_lock_dma_resv().
 490  * @ww: The ww_acquire_context used for locking.
 491  * @objs: The list returned from xe_vm_lock_dma_resv().
 492  *
 493  * Unlocks the reservation objects and frees any memory allocated by
 494  * xe_vm_lock_dma_resv().
 495  */
 496 void xe_vm_unlock_dma_resv(struct xe_vm *vm,
 497                            struct ttm_validate_buffer *tv_onstack,
 498                            struct ttm_validate_buffer *tv,
 499                            struct ww_acquire_ctx *ww,
 500                            struct list_head *objs)
 501 {
 502         /*
 503          * Nothing should've been able to enter the list while we were locked,
 504          * since we've held the dma-resvs of all the vm's external objects,
 505          * and holding the dma_resv of an object is required for list
 506          * addition, and we shouldn't add ourselves.
 507          */
 508         XE_WARN_ON(!list_empty(&vm->notifier.rebind_list));
 509
 510         ttm_eu_backoff_reservation(ww, objs);
 511         if (tv && tv != tv_onstack)
 512                 kvfree(tv);
 513 }
 514
 515 #define XE_VM_REBIND_RETRY_TIMEOUT_MS 1000
 516
 517 static void preempt_rebind_work_func(struct work_struct *w)
 518 {
 519         struct xe_vm *vm = container_of(w, struct xe_vm, preempt.rebind_work);
 520         struct xe_vma *vma;
 521         struct ttm_validate_buffer tv_onstack[XE_ONSTACK_TV];
 522         struct ttm_validate_buffer *tv;
 523         struct ww_acquire_ctx ww;
 524         struct list_head objs;
 525         struct dma_fence *rebind_fence;
 526         unsigned int fence_count = 0;
 527         LIST_HEAD(preempt_fences);
 528         ktime_t end = 0;
 529         int err;
 530         long wait;
 531         int __maybe_unused tries = 0;
 532
 533         XE_BUG_ON(!xe_vm_in_compute_mode(vm));
 534         trace_xe_vm_rebind_worker_enter(vm);
 535
 536         if (xe_vm_is_closed(vm)) {
 537                 trace_xe_vm_rebind_worker_exit(vm);
 538                 return;
 539         }
 540
 541         down_write(&vm->lock);
 542
 543 retry:
 544         if (vm->async_ops.error)
 545                 goto out_unlock_outer;
 546
 547         /*
 548          * Extreme corner where we exit a VM error state with a munmap style VM
 549          * unbind inflight which requires a rebind. In this case the rebind
 550          * needs to install some fences into the dma-resv slots. The worker to
 551          * do this queued, let that worker make progress by dropping vm->lock
 552          * and trying this again.
 553          */
 554         if (vm->async_ops.munmap_rebind_inflight) {
 555                 up_write(&vm->lock);
 556                 flush_work(&vm->async_ops.work);
 557                 goto retry;
 558         }
 559
 560         if (xe_vm_userptr_check_repin(vm)) {
 561                 err = xe_vm_userptr_pin(vm);
 562                 if (err)
 563                         goto out_unlock_outer;
 564         }
 565
 566         err = xe_vm_lock_dma_resv(vm, &ww, tv_onstack, &tv, &objs,
 567                                   false, vm->preempt.num_engines);
 568         if (err)
 569                 goto out_unlock_outer;
 570
 571         if (xe_vm_is_idle(vm)) {
 572                 vm->preempt.rebind_deactivated = true;
 573                 goto out_unlock;
 574         }
 575
 576         /* Fresh preempt fences already installed. Everyting is running. */
 577         if (!preempt_fences_waiting(vm))
 578                 goto out_unlock;
 579
 580         /*
 581          * This makes sure vm is completely suspended and also balances
 582          * xe_engine suspend- and resume; we resume *all* vm engines below.
 583          */
 584         err = wait_for_existing_preempt_fences(vm);
 585         if (err)
 586                 goto out_unlock;
 587
 588         err = alloc_preempt_fences(vm, &preempt_fences, &fence_count);
 589         if (err)
 590                 goto out_unlock;
 591
 592         list_for_each_entry(vma, &vm->rebind_list, rebind_link) {
 593                 if (xe_vma_has_no_bo(vma) || vma->destroyed)
 594                         continue;
 595
 596                 err = xe_bo_validate(vma->bo, vm, false);
 597                 if (err)
 598                         goto out_unlock;
 599         }
 600
 601         rebind_fence = xe_vm_rebind(vm, true);
 602         if (IS_ERR(rebind_fence)) {
 603                 err = PTR_ERR(rebind_fence);
 604                 goto out_unlock;
 605         }
 606
 607         if (rebind_fence) {
 608                 dma_fence_wait(rebind_fence, false);
 609                 dma_fence_put(rebind_fence);
 610         }
 611
 612         /* Wait on munmap style VM unbinds */
 613         wait = dma_resv_wait_timeout(&vm->resv,
 614                                      DMA_RESV_USAGE_KERNEL,
 615                                      false, MAX_SCHEDULE_TIMEOUT);
 616         if (wait <= 0) {
 617                 err = -ETIME;
 618                 goto out_unlock;
 619         }
 620
 621 #define retry_required(__tries, __vm) \
 622         (IS_ENABLED(CONFIG_DRM_XE_USERPTR_INVAL_INJECT) ? \
 623         (!(__tries)++ || __xe_vm_userptr_needs_repin(__vm)) : \
 624         __xe_vm_userptr_needs_repin(__vm))
 625
 626         down_read(&vm->userptr.notifier_lock);
 627         if (retry_required(tries, vm)) {
 628                 up_read(&vm->userptr.notifier_lock);
 629                 err = -EAGAIN;
 630                 goto out_unlock;
 631         }
 632
 633 #undef retry_required
 634
 635         spin_lock(&vm->xe->ttm.lru_lock);
 636         ttm_lru_bulk_move_tail(&vm->lru_bulk_move);
 637         spin_unlock(&vm->xe->ttm.lru_lock);
 638
 639         /* Point of no return. */
 640         arm_preempt_fences(vm, &preempt_fences);
 641         resume_and_reinstall_preempt_fences(vm);
 642         up_read(&vm->userptr.notifier_lock);
 643
 644 out_unlock:
 645         xe_vm_unlock_dma_resv(vm, tv_onstack, tv, &ww, &objs);
 646 out_unlock_outer:
 647         if (err == -EAGAIN) {
 648                 trace_xe_vm_rebind_worker_retry(vm);
 649                 goto retry;
 650         }
 651
 652         /*
 653          * With multiple active VMs, under memory pressure, it is possible that
 654          * ttm_bo_validate() run into -EDEADLK and in such case returns -ENOMEM.
 655          * Until ttm properly handles locking in such scenarios, best thing the
 656          * driver can do is retry with a timeout. Killing the VM or putting it
 657          * in error state after timeout or other error scenarios is still TBD.
 658          */
 659         if (err == -ENOMEM) {
 660                 ktime_t cur = ktime_get();
 661
 662                 end = end ? : ktime_add_ms(cur, XE_VM_REBIND_RETRY_TIMEOUT_MS);
 663                 if (ktime_before(cur, end)) {
 664                         msleep(20);
 665                         trace_xe_vm_rebind_worker_retry(vm);
 666                         goto retry;
 667                 }
 668         }
 669         up_write(&vm->lock);
 670
 671         free_preempt_fences(&preempt_fences);
 672
 673         XE_WARN_ON(err < 0);    /* TODO: Kill VM or put in error state */
 674         trace_xe_vm_rebind_worker_exit(vm);
 675 }
 676
 677 struct async_op_fence;
 678 static int __xe_vm_bind(struct xe_vm *vm, struct xe_vma *vma,
 679                         struct xe_engine *e, struct xe_sync_entry *syncs,
 680                         u32 num_syncs, struct async_op_fence *afence);
 681
 682 static bool vma_userptr_invalidate(struct mmu_interval_notifier *mni,
 683                                    const struct mmu_notifier_range *range,
 684                                    unsigned long cur_seq)
 685 {
 686         struct xe_vma *vma = container_of(mni, struct xe_vma, userptr.notifier);
 687         struct xe_vm *vm = vma->vm;
 688         struct dma_resv_iter cursor;
 689         struct dma_fence *fence;
 690         long err;
 691
 692         XE_BUG_ON(!xe_vma_is_userptr(vma));
 693         trace_xe_vma_userptr_invalidate(vma);
 694
 695         if (!mmu_notifier_range_blockable(range))
 696                 return false;
 697
 698         down_write(&vm->userptr.notifier_lock);
 699         mmu_interval_set_seq(mni, cur_seq);
 700
 701         /* No need to stop gpu access if the userptr is not yet bound. */
 702         if (!vma->userptr.initial_bind) {
 703                 up_write(&vm->userptr.notifier_lock);
 704                 return true;
 705         }
 706
 707         /*
 708          * Tell exec and rebind worker they need to repin and rebind this
 709          * userptr.
 710          */
 711         if (!xe_vm_in_fault_mode(vm) && !vma->destroyed && vma->tile_present) {
 712                 spin_lock(&vm->userptr.invalidated_lock);
 713                 list_move_tail(&vma->userptr.invalidate_link,
 714                                &vm->userptr.invalidated);
 715                 spin_unlock(&vm->userptr.invalidated_lock);
 716         }
 717
 718         up_write(&vm->userptr.notifier_lock);
 719
 720         /*
 721          * Preempt fences turn into schedule disables, pipeline these.
 722          * Note that even in fault mode, we need to wait for binds and
 723          * unbinds to complete, and those are attached as BOOKMARK fences
 724          * to the vm.
 725          */
 726         dma_resv_iter_begin(&cursor, &vm->resv,
 727                             DMA_RESV_USAGE_BOOKKEEP);
 728         dma_resv_for_each_fence_unlocked(&cursor, fence)
 729                 dma_fence_enable_sw_signaling(fence);
 730         dma_resv_iter_end(&cursor);
 731
 732         err = dma_resv_wait_timeout(&vm->resv,
 733                                     DMA_RESV_USAGE_BOOKKEEP,
 734                                     false, MAX_SCHEDULE_TIMEOUT);
 735         XE_WARN_ON(err <= 0);
 736
 737         if (xe_vm_in_fault_mode(vm)) {
 738                 err = xe_vm_invalidate_vma(vma);
 739                 XE_WARN_ON(err);
 740         }
 741
 742         trace_xe_vma_userptr_invalidate_complete(vma);
 743
 744         return true;
 745 }
 746
 747 static const struct mmu_interval_notifier_ops vma_userptr_notifier_ops = {
 748         .invalidate = vma_userptr_invalidate,
 749 };
 750
 751 int xe_vm_userptr_pin(struct xe_vm *vm)
 752 {
 753         struct xe_vma *vma, *next;
 754         int err = 0;
 755         LIST_HEAD(tmp_evict);
 756
 757         lockdep_assert_held_write(&vm->lock);
 758
 759         /* Collect invalidated userptrs */
 760         spin_lock(&vm->userptr.invalidated_lock);
 761         list_for_each_entry_safe(vma, next, &vm->userptr.invalidated,
 762                                  userptr.invalidate_link) {
 763                 list_del_init(&vma->userptr.invalidate_link);
 764                 list_move_tail(&vma->userptr_link, &vm->userptr.repin_list);
 765         }
 766         spin_unlock(&vm->userptr.invalidated_lock);
 767
 768         /* Pin and move to temporary list */
 769         list_for_each_entry_safe(vma, next, &vm->userptr.repin_list, userptr_link) {
 770                 err = xe_vma_userptr_pin_pages(vma);
 771                 if (err < 0)
 772                         goto out_err;
 773
 774                 list_move_tail(&vma->userptr_link, &tmp_evict);
 775         }
 776
 777         /* Take lock and move to rebind_list for rebinding. */
 778         err = dma_resv_lock_interruptible(&vm->resv, NULL);
 779         if (err)
 780                 goto out_err;
 781
 782         list_for_each_entry_safe(vma, next, &tmp_evict, userptr_link) {
 783                 list_del_init(&vma->userptr_link);
 784                 list_move_tail(&vma->rebind_link, &vm->rebind_list);
 785         }
 786
 787         dma_resv_unlock(&vm->resv);
 788
 789         return 0;
 790
 791 out_err:
 792         list_splice_tail(&tmp_evict, &vm->userptr.repin_list);
 793
 794         return err;
 795 }
 796
 797 /**
 798  * xe_vm_userptr_check_repin() - Check whether the VM might have userptrs
 799  * that need repinning.
 800  * @vm: The VM.
 801  *
 802  * This function does an advisory check for whether the VM has userptrs that
 803  * need repinning.
 804  *
 805  * Return: 0 if there are no indications of userptrs needing repinning,
 806  * -EAGAIN if there are.
 807  */
 808 int xe_vm_userptr_check_repin(struct xe_vm *vm)
 809 {
 810         return (list_empty_careful(&vm->userptr.repin_list) &&
 811                 list_empty_careful(&vm->userptr.invalidated)) ? 0 : -EAGAIN;
 812 }
 813
 814 static struct dma_fence *
 815 xe_vm_bind_vma(struct xe_vma *vma, struct xe_engine *e,
 816                struct xe_sync_entry *syncs, u32 num_syncs);
 817
 818 struct dma_fence *xe_vm_rebind(struct xe_vm *vm, bool rebind_worker)
 819 {
 820         struct dma_fence *fence = NULL;
 821         struct xe_vma *vma, *next;
 822
 823         lockdep_assert_held(&vm->lock);
 824         if (xe_vm_no_dma_fences(vm) && !rebind_worker)
 825                 return NULL;
 826
 827         xe_vm_assert_held(vm);
 828         list_for_each_entry_safe(vma, next, &vm->rebind_list, rebind_link) {
 829                 XE_WARN_ON(!vma->tile_present);
 830
 831                 list_del_init(&vma->rebind_link);
 832                 dma_fence_put(fence);
 833                 if (rebind_worker)
 834                         trace_xe_vma_rebind_worker(vma);
 835                 else
 836                         trace_xe_vma_rebind_exec(vma);
 837                 fence = xe_vm_bind_vma(vma, NULL, NULL, 0);
 838                 if (IS_ERR(fence))
 839                         return fence;
 840         }
 841
 842         return fence;
 843 }
 844
 845 static struct xe_vma *xe_vma_create(struct xe_vm *vm,
 846                                     struct xe_bo *bo,
 847                                     u64 bo_offset_or_userptr,
 848                                     u64 start, u64 end,
 849                                     bool read_only,
 850                                     bool is_null,
 851                                     u64 tile_mask)
 852 {
 853         struct xe_vma *vma;
 854         struct xe_tile *tile;
 855         u8 id;
 856
 857         XE_BUG_ON(start >= end);
 858         XE_BUG_ON(end >= vm->size);
 859
 860         vma = kzalloc(sizeof(*vma), GFP_KERNEL);
 861         if (!vma) {
 862                 vma = ERR_PTR(-ENOMEM);
 863                 return vma;
 864         }
 865
 866         INIT_LIST_HEAD(&vma->rebind_link);
 867         INIT_LIST_HEAD(&vma->unbind_link);
 868         INIT_LIST_HEAD(&vma->userptr_link);
 869         INIT_LIST_HEAD(&vma->userptr.invalidate_link);
 870         INIT_LIST_HEAD(&vma->notifier.rebind_link);
 871         INIT_LIST_HEAD(&vma->extobj.link);
 872
 873         vma->vm = vm;
 874         vma->start = start;
 875         vma->end = end;
 876         vma->pte_flags = 0;
 877         if (read_only)
 878                 vma->pte_flags |= XE_PTE_FLAG_READ_ONLY;
 879         if (is_null)
 880                 vma->pte_flags |= XE_PTE_FLAG_NULL;
 881
 882         if (tile_mask) {
 883                 vma->tile_mask = tile_mask;
 884         } else {
 885                 for_each_tile(tile, vm->xe, id)
 886                         vma->tile_mask |= 0x1 << id;
 887         }
 888
 889         if (vm->xe->info.platform == XE_PVC)
 890                 vma->use_atomic_access_pte_bit = true;
 891
 892         if (bo) {
 893                 xe_bo_assert_held(bo);
 894                 vma->bo_offset = bo_offset_or_userptr;
 895                 vma->bo = xe_bo_get(bo);
 896                 list_add_tail(&vma->bo_link, &bo->vmas);
 897         } else /* userptr or null */ {
 898                 if (!is_null) {
 899                         u64 size = end - start + 1;
 900                         int err;
 901
 902                         vma->userptr.ptr = bo_offset_or_userptr;
 903
 904                         err = mmu_interval_notifier_insert(&vma->userptr.notifier,
 905                                                            current->mm,
 906                                                            vma->userptr.ptr, size,
 907                                                            &vma_userptr_notifier_ops);
 908                         if (err) {
 909                                 kfree(vma);
 910                                 vma = ERR_PTR(err);
 911                                 return vma;
 912                         }
 913
 914                         vma->userptr.notifier_seq = LONG_MAX;
 915                 }
 916
 917                 xe_vm_get(vm);
 918         }
 919
 920         return vma;
 921 }
 922
 923 static bool vm_remove_extobj(struct xe_vma *vma)
 924 {
 925         if (!list_empty(&vma->extobj.link)) {
 926                 vma->vm->extobj.entries--;
 927                 list_del_init(&vma->extobj.link);
 928                 return true;
 929         }
 930         return false;
 931 }
 932
 933 static void xe_vma_destroy_late(struct xe_vma *vma)
 934 {
 935         struct xe_vm *vm = vma->vm;
 936         struct xe_device *xe = vm->xe;
 937         bool read_only = vma->pte_flags & XE_PTE_FLAG_READ_ONLY;
 938
 939         if (xe_vma_is_userptr(vma)) {
 940                 if (vma->userptr.sg) {
 941                         dma_unmap_sgtable(xe->drm.dev,
 942                                           vma->userptr.sg,
 943                                           read_only ? DMA_TO_DEVICE :
 944                                           DMA_BIDIRECTIONAL, 0);
 945                         sg_free_table(vma->userptr.sg);
 946                         vma->userptr.sg = NULL;
 947                 }
 948
 949                 /*
 950                  * Since userptr pages are not pinned, we can't remove
 951                  * the notifer until we're sure the GPU is not accessing
 952                  * them anymore
 953                  */
 954                 mmu_interval_notifier_remove(&vma->userptr.notifier);
 955                 xe_vm_put(vm);
 956         } else if (xe_vma_is_null(vma)) {
 957                 xe_vm_put(vm);
 958         } else {
 959                 xe_bo_put(vma->bo);
 960         }
 961
 962         kfree(vma);
 963 }
 964
 965 static void vma_destroy_work_func(struct work_struct *w)
 966 {
 967         struct xe_vma *vma =
 968                 container_of(w, struct xe_vma, destroy_work);
 969
 970         xe_vma_destroy_late(vma);
 971 }
 972
 973 static struct xe_vma *
 974 bo_has_vm_references_locked(struct xe_bo *bo, struct xe_vm *vm,
 975                             struct xe_vma *ignore)
 976 {
 977         struct xe_vma *vma;
 978
 979         list_for_each_entry(vma, &bo->vmas, bo_link) {
 980                 if (vma != ignore && vma->vm == vm)
 981                         return vma;
 982         }
 983
 984         return NULL;
 985 }
 986
 987 static bool bo_has_vm_references(struct xe_bo *bo, struct xe_vm *vm,
 988                                  struct xe_vma *ignore)
 989 {
 990         struct ww_acquire_ctx ww;
 991         bool ret;
 992
 993         xe_bo_lock(bo, &ww, 0, false);
 994         ret = !!bo_has_vm_references_locked(bo, vm, ignore);
 995         xe_bo_unlock(bo, &ww);
 996
 997         return ret;
 998 }
 999
1000 static void __vm_insert_extobj(struct xe_vm *vm, struct xe_vma *vma)
1001 {
1002         list_add(&vma->extobj.link, &vm->extobj.list);
1003         vm->extobj.entries++;
1004 }
1005
1006 static void vm_insert_extobj(struct xe_vm *vm, struct xe_vma *vma)
1007 {
1008         struct xe_bo *bo = vma->bo;
1009
1010         lockdep_assert_held_write(&vm->lock);
1011
1012         if (bo_has_vm_references(bo, vm, vma))
1013                 return;
1014
1015         __vm_insert_extobj(vm, vma);
1016 }
1017
1018 static void vma_destroy_cb(struct dma_fence *fence,
1019                            struct dma_fence_cb *cb)
1020 {
1021         struct xe_vma *vma = container_of(cb, struct xe_vma, destroy_cb);
1022
1023         INIT_WORK(&vma->destroy_work, vma_destroy_work_func);
1024         queue_work(system_unbound_wq, &vma->destroy_work);
1025 }
1026
1027 static void xe_vma_destroy(struct xe_vma *vma, struct dma_fence *fence)
1028 {
1029         struct xe_vm *vm = vma->vm;
1030
1031         lockdep_assert_held_write(&vm->lock);
1032         XE_BUG_ON(!list_empty(&vma->unbind_link));
1033
1034         if (xe_vma_is_userptr(vma)) {
1035                 XE_WARN_ON(!vma->destroyed);
1036                 spin_lock(&vm->userptr.invalidated_lock);
1037                 list_del_init(&vma->userptr.invalidate_link);
1038                 spin_unlock(&vm->userptr.invalidated_lock);
1039                 list_del(&vma->userptr_link);
1040         } else if (!xe_vma_is_null(vma)) {
1041                 xe_bo_assert_held(vma->bo);
1042                 list_del(&vma->bo_link);
1043
1044                 spin_lock(&vm->notifier.list_lock);
1045                 list_del(&vma->notifier.rebind_link);
1046                 spin_unlock(&vm->notifier.list_lock);
1047
1048                 if (!vma->bo->vm && vm_remove_extobj(vma)) {
1049                         struct xe_vma *other;
1050
1051                         other = bo_has_vm_references_locked(vma->bo, vm, NULL);
1052
1053                         if (other)
1054                                 __vm_insert_extobj(vm, other);
1055                 }
1056         }
1057
1058         xe_vm_assert_held(vm);
1059         if (!list_empty(&vma->rebind_link))
1060                 list_del(&vma->rebind_link);
1061
1062         if (fence) {
1063                 int ret = dma_fence_add_callback(fence, &vma->destroy_cb,
1064                                                  vma_destroy_cb);
1065
1066                 if (ret) {
1067                         XE_WARN_ON(ret != -ENOENT);
1068                         xe_vma_destroy_late(vma);
1069                 }
1070         } else {
1071                 xe_vma_destroy_late(vma);
1072         }
1073 }
1074
1075 static void xe_vma_destroy_unlocked(struct xe_vma *vma)
1076 {
1077         struct ttm_validate_buffer tv[2];
1078         struct ww_acquire_ctx ww;
1079         struct xe_bo *bo = vma->bo;
1080         LIST_HEAD(objs);
1081         LIST_HEAD(dups);
1082         int err;
1083
1084         memset(tv, 0, sizeof(tv));
1085         tv[0].bo = xe_vm_ttm_bo(vma->vm);
1086         list_add(&tv[0].head, &objs);
1087
1088         if (bo) {
1089                 tv[1].bo = &xe_bo_get(bo)->ttm;
1090                 list_add(&tv[1].head, &objs);
1091         }
1092         err = ttm_eu_reserve_buffers(&ww, &objs, false, &dups);
1093         XE_WARN_ON(err);
1094
1095         xe_vma_destroy(vma, NULL);
1096
1097         ttm_eu_backoff_reservation(&ww, &objs);
1098         if (bo)
1099                 xe_bo_put(bo);
1100 }
1101
1102 static struct xe_vma *to_xe_vma(const struct rb_node *node)
1103 {
1104         BUILD_BUG_ON(offsetof(struct xe_vma, vm_node) != 0);
1105         return (struct xe_vma *)node;
1106 }
1107
1108 static int xe_vma_cmp(const struct xe_vma *a, const struct xe_vma *b)
1109 {
1110         if (a->end < b->start) {
1111                 return -1;
1112         } else if (b->end < a->start) {
1113                 return 1;
1114         } else {
1115                 return 0;
1116         }
1117 }
1118
1119 static bool xe_vma_less_cb(struct rb_node *a, const struct rb_node *b)
1120 {
1121         return xe_vma_cmp(to_xe_vma(a), to_xe_vma(b)) < 0;
1122 }
1123
1124 int xe_vma_cmp_vma_cb(const void *key, const struct rb_node *node)
1125 {
1126         struct xe_vma *cmp = to_xe_vma(node);
1127         const struct xe_vma *own = key;
1128
1129         if (own->start > cmp->end)
1130                 return 1;
1131
1132         if (own->end < cmp->start)
1133                 return -1;
1134
1135         return 0;
1136 }
1137
1138 struct xe_vma *
1139 xe_vm_find_overlapping_vma(struct xe_vm *vm, const struct xe_vma *vma)
1140 {
1141         struct rb_node *node;
1142
1143         if (xe_vm_is_closed(vm))
1144                 return NULL;
1145
1146         XE_BUG_ON(vma->end >= vm->size);
1147         lockdep_assert_held(&vm->lock);
1148
1149         node = rb_find(vma, &vm->vmas, xe_vma_cmp_vma_cb);
1150
1151         return node ? to_xe_vma(node) : NULL;
1152 }
1153
1154 static void xe_vm_insert_vma(struct xe_vm *vm, struct xe_vma *vma)
1155 {
1156         XE_BUG_ON(vma->vm != vm);
1157         lockdep_assert_held(&vm->lock);
1158
1159         rb_add(&vma->vm_node, &vm->vmas, xe_vma_less_cb);
1160 }
1161
1162 static void xe_vm_remove_vma(struct xe_vm *vm, struct xe_vma *vma)
1163 {
1164         XE_BUG_ON(vma->vm != vm);
1165         lockdep_assert_held(&vm->lock);
1166
1167         rb_erase(&vma->vm_node, &vm->vmas);
1168         if (vm->usm.last_fault_vma == vma)
1169                 vm->usm.last_fault_vma = NULL;
1170 }
1171
1172 static void async_op_work_func(struct work_struct *w);
1173 static void vm_destroy_work_func(struct work_struct *w);
1174
1175 struct xe_vm *xe_vm_create(struct xe_device *xe, u32 flags)
1176 {
1177         struct xe_vm *vm;
1178         int err, i = 0, number_tiles = 0;
1179         struct xe_tile *tile;
1180         u8 id;
1181
1182         vm = kzalloc(sizeof(*vm), GFP_KERNEL);
1183         if (!vm)
1184                 return ERR_PTR(-ENOMEM);
1185
1186         vm->xe = xe;
1187         kref_init(&vm->refcount);
1188         dma_resv_init(&vm->resv);
1189
1190         vm->size = 1ull << xe_pt_shift(xe->info.vm_max_level + 1);
1191
1192         vm->vmas = RB_ROOT;
1193         vm->flags = flags;
1194
1195         init_rwsem(&vm->lock);
1196
1197         INIT_LIST_HEAD(&vm->rebind_list);
1198
1199         INIT_LIST_HEAD(&vm->userptr.repin_list);
1200         INIT_LIST_HEAD(&vm->userptr.invalidated);
1201         init_rwsem(&vm->userptr.notifier_lock);
1202         spin_lock_init(&vm->userptr.invalidated_lock);
1203
1204         INIT_LIST_HEAD(&vm->notifier.rebind_list);
1205         spin_lock_init(&vm->notifier.list_lock);
1206
1207         INIT_LIST_HEAD(&vm->async_ops.pending);
1208         INIT_WORK(&vm->async_ops.work, async_op_work_func);
1209         spin_lock_init(&vm->async_ops.lock);
1210
1211         INIT_WORK(&vm->destroy_work, vm_destroy_work_func);
1212
1213         INIT_LIST_HEAD(&vm->preempt.engines);
1214         vm->preempt.min_run_period_ms = 10;     /* FIXME: Wire up to uAPI */
1215
1216         INIT_LIST_HEAD(&vm->extobj.list);
1217
1218         if (!(flags & XE_VM_FLAG_MIGRATION)) {
1219                 /* We need to immeditatelly exit from any D3 state */
1220                 xe_pm_runtime_get(xe);
1221                 xe_device_mem_access_get(xe);
1222         }
1223
1224         err = dma_resv_lock_interruptible(&vm->resv, NULL);
1225         if (err)
1226                 goto err_put;
1227
1228         if (IS_DGFX(xe) && xe->info.vram_flags & XE_VRAM_FLAGS_NEED64K)
1229                 vm->flags |= XE_VM_FLAGS_64K;
1230
1231         for_each_tile(tile, xe, id) {
1232                 if (flags & XE_VM_FLAG_MIGRATION &&
1233                     tile->id != XE_VM_FLAG_GT_ID(flags))
1234                         continue;
1235
1236                 vm->pt_root[id] = xe_pt_create(vm, tile, xe->info.vm_max_level);
1237                 if (IS_ERR(vm->pt_root[id])) {
1238                         err = PTR_ERR(vm->pt_root[id]);
1239                         vm->pt_root[id] = NULL;
1240                         goto err_destroy_root;
1241                 }
1242         }
1243
1244         if (flags & XE_VM_FLAG_SCRATCH_PAGE) {
1245                 for_each_tile(tile, xe, id) {
1246                         if (!vm->pt_root[id])
1247                                 continue;
1248
1249                         err = xe_pt_create_scratch(xe, tile, vm);
1250                         if (err)
1251                                 goto err_scratch_pt;
1252                 }
1253                 vm->batch_invalidate_tlb = true;
1254         }
1255
1256         if (flags & XE_VM_FLAG_COMPUTE_MODE) {
1257                 INIT_WORK(&vm->preempt.rebind_work, preempt_rebind_work_func);
1258                 vm->flags |= XE_VM_FLAG_COMPUTE_MODE;
1259                 vm->batch_invalidate_tlb = false;
1260         }
1261
1262         if (flags & XE_VM_FLAG_ASYNC_BIND_OPS) {
1263                 vm->async_ops.fence.context = dma_fence_context_alloc(1);
1264                 vm->flags |= XE_VM_FLAG_ASYNC_BIND_OPS;
1265         }
1266
1267         /* Fill pt_root after allocating scratch tables */
1268         for_each_tile(tile, xe, id) {
1269                 if (!vm->pt_root[id])
1270                         continue;
1271
1272                 xe_pt_populate_empty(tile, vm, vm->pt_root[id]);
1273         }
1274         dma_resv_unlock(&vm->resv);
1275
1276         /* Kernel migration VM shouldn't have a circular loop.. */
1277         if (!(flags & XE_VM_FLAG_MIGRATION)) {
1278                 for_each_tile(tile, xe, id) {
1279                         struct xe_gt *gt = tile->primary_gt;
1280                         struct xe_vm *migrate_vm;
1281                         struct xe_engine *eng;
1282
1283                         if (!vm->pt_root[id])
1284                                 continue;
1285
1286                         migrate_vm = xe_migrate_get_vm(tile->migrate);
1287                         eng = xe_engine_create_class(xe, gt, migrate_vm,
1288                                                      XE_ENGINE_CLASS_COPY,
1289                                                      ENGINE_FLAG_VM);
1290                         xe_vm_put(migrate_vm);
1291                         if (IS_ERR(eng)) {
1292                                 xe_vm_close_and_put(vm);
1293                                 return ERR_CAST(eng);
1294                         }
1295                         vm->eng[id] = eng;
1296                         number_tiles++;
1297                 }
1298         }
1299
1300         if (number_tiles > 1)
1301                 vm->composite_fence_ctx = dma_fence_context_alloc(1);
1302
1303         mutex_lock(&xe->usm.lock);
1304         if (flags & XE_VM_FLAG_FAULT_MODE)
1305                 xe->usm.num_vm_in_fault_mode++;
1306         else if (!(flags & XE_VM_FLAG_MIGRATION))
1307                 xe->usm.num_vm_in_non_fault_mode++;
1308         mutex_unlock(&xe->usm.lock);
1309
1310         trace_xe_vm_create(vm);
1311
1312         return vm;
1313
1314 err_scratch_pt:
1315         for_each_tile(tile, xe, id) {
1316                 if (!vm->pt_root[id])
1317                         continue;
1318
1319                 i = vm->pt_root[id]->level;
1320                 while (i)
1321                         if (vm->scratch_pt[id][--i])
1322                                 xe_pt_destroy(vm->scratch_pt[id][i],
1323                                               vm->flags, NULL);
1324                 xe_bo_unpin(vm->scratch_bo[id]);
1325                 xe_bo_put(vm->scratch_bo[id]);
1326         }
1327 err_destroy_root:
1328         for_each_tile(tile, xe, id) {
1329                 if (vm->pt_root[id])
1330                         xe_pt_destroy(vm->pt_root[id], vm->flags, NULL);
1331         }
1332         dma_resv_unlock(&vm->resv);
1333 err_put:
1334         dma_resv_fini(&vm->resv);
1335         kfree(vm);
1336         if (!(flags & XE_VM_FLAG_MIGRATION)) {
1337                 xe_device_mem_access_put(xe);
1338                 xe_pm_runtime_put(xe);
1339         }
1340         return ERR_PTR(err);
1341 }
1342
1343 static void flush_async_ops(struct xe_vm *vm)
1344 {
1345         queue_work(system_unbound_wq, &vm->async_ops.work);
1346         flush_work(&vm->async_ops.work);
1347 }
1348
1349 static void vm_error_capture(struct xe_vm *vm, int err,
1350                              u32 op, u64 addr, u64 size)
1351 {
1352         struct drm_xe_vm_bind_op_error_capture capture;
1353         u64 __user *address =
1354                 u64_to_user_ptr(vm->async_ops.error_capture.addr);
1355         bool in_kthread = !current->mm;
1356
1357         capture.error = err;
1358         capture.op = op;
1359         capture.addr = addr;
1360         capture.size = size;
1361
1362         if (in_kthread) {
1363                 if (!mmget_not_zero(vm->async_ops.error_capture.mm))
1364                         goto mm_closed;
1365                 kthread_use_mm(vm->async_ops.error_capture.mm);
1366         }
1367
1368         if (copy_to_user(address, &capture, sizeof(capture)))
1369                 XE_WARN_ON("Copy to user failed");
1370
1371         if (in_kthread) {
1372                 kthread_unuse_mm(vm->async_ops.error_capture.mm);
1373                 mmput(vm->async_ops.error_capture.mm);
1374         }
1375
1376 mm_closed:
1377         wake_up_all(&vm->async_ops.error_capture.wq);
1378 }
1379
1380 void xe_vm_close_and_put(struct xe_vm *vm)
1381 {
1382         struct rb_root contested = RB_ROOT;
1383         struct ww_acquire_ctx ww;
1384         struct xe_device *xe = vm->xe;
1385         struct xe_tile *tile;
1386         u8 id;
1387
1388         XE_BUG_ON(vm->preempt.num_engines);
1389
1390         vm->size = 0;
1391         smp_mb();
1392         flush_async_ops(vm);
1393         if (xe_vm_in_compute_mode(vm))
1394                 flush_work(&vm->preempt.rebind_work);
1395
1396         for_each_tile(tile, xe, id) {
1397                 if (vm->eng[id]) {
1398                         xe_engine_kill(vm->eng[id]);
1399                         xe_engine_put(vm->eng[id]);
1400                         vm->eng[id] = NULL;
1401                 }
1402         }
1403
1404         down_write(&vm->lock);
1405         xe_vm_lock(vm, &ww, 0, false);
1406         while (vm->vmas.rb_node) {
1407                 struct xe_vma *vma = to_xe_vma(vm->vmas.rb_node);
1408
1409                 if (xe_vma_has_no_bo(vma)) {
1410                         down_read(&vm->userptr.notifier_lock);
1411                         vma->destroyed = true;
1412                         up_read(&vm->userptr.notifier_lock);
1413                 }
1414
1415                 rb_erase(&vma->vm_node, &vm->vmas);
1416
1417                 /* easy case, remove from VMA? */
1418                 if (xe_vma_has_no_bo(vma) || vma->bo->vm) {
1419                         xe_vma_destroy(vma, NULL);
1420                         continue;
1421                 }
1422
1423                 rb_add(&vma->vm_node, &contested, xe_vma_less_cb);
1424         }
1425
1426         /*
1427          * All vm operations will add shared fences to resv.
1428          * The only exception is eviction for a shared object,
1429          * but even so, the unbind when evicted would still
1430          * install a fence to resv. Hence it's safe to
1431          * destroy the pagetables immediately.
1432          */
1433         for_each_tile(tile, xe, id) {
1434                 if (vm->scratch_bo[id]) {
1435                         u32 i;
1436
1437                         xe_bo_unpin(vm->scratch_bo[id]);
1438                         xe_bo_put(vm->scratch_bo[id]);
1439                         for (i = 0; i < vm->pt_root[id]->level; i++)
1440                                 xe_pt_destroy(vm->scratch_pt[id][i], vm->flags,
1441                                               NULL);
1442                 }
1443         }
1444         xe_vm_unlock(vm, &ww);
1445
1446         if (contested.rb_node) {
1447
1448                 /*
1449                  * VM is now dead, cannot re-add nodes to vm->vmas if it's NULL
1450                  * Since we hold a refcount to the bo, we can remove and free
1451                  * the members safely without locking.
1452                  */
1453                 while (contested.rb_node) {
1454                         struct xe_vma *vma = to_xe_vma(contested.rb_node);
1455
1456                         rb_erase(&vma->vm_node, &contested);
1457                         xe_vma_destroy_unlocked(vma);
1458                 }
1459         }
1460
1461         if (vm->async_ops.error_capture.addr)
1462                 wake_up_all(&vm->async_ops.error_capture.wq);
1463
1464         XE_WARN_ON(!list_empty(&vm->extobj.list));
1465         up_write(&vm->lock);
1466
1467         mutex_lock(&xe->usm.lock);
1468         if (vm->flags & XE_VM_FLAG_FAULT_MODE)
1469                 xe->usm.num_vm_in_fault_mode--;
1470         else if (!(vm->flags & XE_VM_FLAG_MIGRATION))
1471                 xe->usm.num_vm_in_non_fault_mode--;
1472         mutex_unlock(&xe->usm.lock);
1473
1474         xe_vm_put(vm);
1475 }
1476
1477 static void vm_destroy_work_func(struct work_struct *w)
1478 {
1479         struct xe_vm *vm =
1480                 container_of(w, struct xe_vm, destroy_work);
1481         struct ww_acquire_ctx ww;
1482         struct xe_device *xe = vm->xe;
1483         struct xe_tile *tile;
1484         u8 id;
1485         void *lookup;
1486
1487         /* xe_vm_close_and_put was not called? */
1488         XE_WARN_ON(vm->size);
1489
1490         if (!(vm->flags & XE_VM_FLAG_MIGRATION)) {
1491                 xe_device_mem_access_put(xe);
1492                 xe_pm_runtime_put(xe);
1493
1494                 if (xe->info.has_asid) {
1495                         mutex_lock(&xe->usm.lock);
1496                         lookup = xa_erase(&xe->usm.asid_to_vm, vm->usm.asid);
1497                         XE_WARN_ON(lookup != vm);
1498                         mutex_unlock(&xe->usm.lock);
1499                 }
1500         }
1501
1502         /*
1503          * XXX: We delay destroying the PT root until the VM if freed as PT root
1504          * is needed for xe_vm_lock to work. If we remove that dependency this
1505          * can be moved to xe_vm_close_and_put.
1506          */
1507         xe_vm_lock(vm, &ww, 0, false);
1508         for_each_tile(tile, xe, id) {
1509                 if (vm->pt_root[id]) {
1510                         xe_pt_destroy(vm->pt_root[id], vm->flags, NULL);
1511                         vm->pt_root[id] = NULL;
1512                 }
1513         }
1514         xe_vm_unlock(vm, &ww);
1515
1516         trace_xe_vm_free(vm);
1517         dma_fence_put(vm->rebind_fence);
1518         dma_resv_fini(&vm->resv);
1519         kfree(vm);
1520 }
1521
1522 void xe_vm_free(struct kref *ref)
1523 {
1524         struct xe_vm *vm = container_of(ref, struct xe_vm, refcount);
1525
1526         /* To destroy the VM we need to be able to sleep */
1527         queue_work(system_unbound_wq, &vm->destroy_work);
1528 }
1529
1530 struct xe_vm *xe_vm_lookup(struct xe_file *xef, u32 id)
1531 {
1532         struct xe_vm *vm;
1533
1534         mutex_lock(&xef->vm.lock);
1535         vm = xa_load(&xef->vm.xa, id);
1536         if (vm)
1537                 xe_vm_get(vm);
1538         mutex_unlock(&xef->vm.lock);
1539
1540         return vm;
1541 }
1542
1543 u64 xe_vm_pdp4_descriptor(struct xe_vm *vm, struct xe_tile *tile)
1544 {
1545         return xe_pde_encode(vm->pt_root[tile->id]->bo, 0,
1546                              XE_CACHE_WB);
1547 }
1548
1549 static struct dma_fence *
1550 xe_vm_unbind_vma(struct xe_vma *vma, struct xe_engine *e,
1551                  struct xe_sync_entry *syncs, u32 num_syncs)
1552 {
1553         struct xe_tile *tile;
1554         struct dma_fence *fence = NULL;
1555         struct dma_fence **fences = NULL;
1556         struct dma_fence_array *cf = NULL;
1557         struct xe_vm *vm = vma->vm;
1558         int cur_fence = 0, i;
1559         int number_tiles = hweight_long(vma->tile_present);
1560         int err;
1561         u8 id;
1562
1563         trace_xe_vma_unbind(vma);
1564
1565         if (number_tiles > 1) {
1566                 fences = kmalloc_array(number_tiles, sizeof(*fences),
1567                                        GFP_KERNEL);
1568                 if (!fences)
1569                         return ERR_PTR(-ENOMEM);
1570         }
1571
1572         for_each_tile(tile, vm->xe, id) {
1573                 if (!(vma->tile_present & BIT(id)))
1574                         goto next;
1575
1576                 fence = __xe_pt_unbind_vma(tile, vma, e, syncs, num_syncs);
1577                 if (IS_ERR(fence)) {
1578                         err = PTR_ERR(fence);
1579                         goto err_fences;
1580                 }
1581
1582                 if (fences)
1583                         fences[cur_fence++] = fence;
1584
1585 next:
1586                 if (e && vm->pt_root[id] && !list_empty(&e->multi_gt_list))
1587                         e = list_next_entry(e, multi_gt_list);
1588         }
1589
1590         if (fences) {
1591                 cf = dma_fence_array_create(number_tiles, fences,
1592                                             vm->composite_fence_ctx,
1593                                             vm->composite_fence_seqno++,
1594                                             false);
1595                 if (!cf) {
1596                         --vm->composite_fence_seqno;
1597                         err = -ENOMEM;
1598                         goto err_fences;
1599                 }
1600         }
1601
1602         for (i = 0; i < num_syncs; i++)
1603                 xe_sync_entry_signal(&syncs[i], NULL, cf ? &cf->base : fence);
1604
1605         return cf ? &cf->base : !fence ? dma_fence_get_stub() : fence;
1606
1607 err_fences:
1608         if (fences) {
1609                 while (cur_fence) {
1610                         /* FIXME: Rewind the previous binds? */
1611                         dma_fence_put(fences[--cur_fence]);
1612                 }
1613                 kfree(fences);
1614         }
1615
1616         return ERR_PTR(err);
1617 }
1618
1619 static struct dma_fence *
1620 xe_vm_bind_vma(struct xe_vma *vma, struct xe_engine *e,
1621                struct xe_sync_entry *syncs, u32 num_syncs)
1622 {
1623         struct xe_tile *tile;
1624         struct dma_fence *fence;
1625         struct dma_fence **fences = NULL;
1626         struct dma_fence_array *cf = NULL;
1627         struct xe_vm *vm = vma->vm;
1628         int cur_fence = 0, i;
1629         int number_tiles = hweight_long(vma->tile_mask);
1630         int err;
1631         u8 id;
1632
1633         trace_xe_vma_bind(vma);
1634
1635         if (number_tiles > 1) {
1636                 fences = kmalloc_array(number_tiles, sizeof(*fences),
1637                                        GFP_KERNEL);
1638                 if (!fences)
1639                         return ERR_PTR(-ENOMEM);
1640         }
1641
1642         for_each_tile(tile, vm->xe, id) {
1643                 if (!(vma->tile_mask & BIT(id)))
1644                         goto next;
1645
1646                 fence = __xe_pt_bind_vma(tile, vma, e, syncs, num_syncs,
1647                                          vma->tile_present & BIT(id));
1648                 if (IS_ERR(fence)) {
1649                         err = PTR_ERR(fence);
1650                         goto err_fences;
1651                 }
1652
1653                 if (fences)
1654                         fences[cur_fence++] = fence;
1655
1656 next:
1657                 if (e && vm->pt_root[id] && !list_empty(&e->multi_gt_list))
1658                         e = list_next_entry(e, multi_gt_list);
1659         }
1660
1661         if (fences) {
1662                 cf = dma_fence_array_create(number_tiles, fences,
1663                                             vm->composite_fence_ctx,
1664                                             vm->composite_fence_seqno++,
1665                                             false);
1666                 if (!cf) {
1667                         --vm->composite_fence_seqno;
1668                         err = -ENOMEM;
1669                         goto err_fences;
1670                 }
1671         }
1672
1673         for (i = 0; i < num_syncs; i++)
1674                 xe_sync_entry_signal(&syncs[i], NULL, cf ? &cf->base : fence);
1675
1676         return cf ? &cf->base : fence;
1677
1678 err_fences:
1679         if (fences) {
1680                 while (cur_fence) {
1681                         /* FIXME: Rewind the previous binds? */
1682                         dma_fence_put(fences[--cur_fence]);
1683                 }
1684                 kfree(fences);
1685         }
1686
1687         return ERR_PTR(err);
1688 }
1689
1690 struct async_op_fence {
1691         struct dma_fence fence;
1692         struct dma_fence *wait_fence;
1693         struct dma_fence_cb cb;
1694         struct xe_vm *vm;
1695         wait_queue_head_t wq;
1696         bool started;
1697 };
1698
1699 static const char *async_op_fence_get_driver_name(struct dma_fence *dma_fence)
1700 {
1701         return "xe";
1702 }
1703
1704 static const char *
1705 async_op_fence_get_timeline_name(struct dma_fence *dma_fence)
1706 {
1707         return "async_op_fence";
1708 }
1709
1710 static const struct dma_fence_ops async_op_fence_ops = {
1711         .get_driver_name = async_op_fence_get_driver_name,
1712         .get_timeline_name = async_op_fence_get_timeline_name,
1713 };
1714
1715 static void async_op_fence_cb(struct dma_fence *fence, struct dma_fence_cb *cb)
1716 {
1717         struct async_op_fence *afence =
1718                 container_of(cb, struct async_op_fence, cb);
1719
1720         afence->fence.error = afence->wait_fence->error;
1721         dma_fence_signal(&afence->fence);
1722         xe_vm_put(afence->vm);
1723         dma_fence_put(afence->wait_fence);
1724         dma_fence_put(&afence->fence);
1725 }
1726
1727 static void add_async_op_fence_cb(struct xe_vm *vm,
1728                                   struct dma_fence *fence,
1729                                   struct async_op_fence *afence)
1730 {
1731         int ret;
1732
1733         if (!xe_vm_no_dma_fences(vm)) {
1734                 afence->started = true;
1735                 smp_wmb();
1736                 wake_up_all(&afence->wq);
1737         }
1738
1739         afence->wait_fence = dma_fence_get(fence);
1740         afence->vm = xe_vm_get(vm);
1741         dma_fence_get(&afence->fence);
1742         ret = dma_fence_add_callback(fence, &afence->cb, async_op_fence_cb);
1743         if (ret == -ENOENT) {
1744                 afence->fence.error = afence->wait_fence->error;
1745                 dma_fence_signal(&afence->fence);
1746         }
1747         if (ret) {
1748                 xe_vm_put(vm);
1749                 dma_fence_put(afence->wait_fence);
1750                 dma_fence_put(&afence->fence);
1751         }
1752         XE_WARN_ON(ret && ret != -ENOENT);
1753 }
1754
1755 int xe_vm_async_fence_wait_start(struct dma_fence *fence)
1756 {
1757         if (fence->ops == &async_op_fence_ops) {
1758                 struct async_op_fence *afence =
1759                         container_of(fence, struct async_op_fence, fence);
1760
1761                 XE_BUG_ON(xe_vm_no_dma_fences(afence->vm));
1762
1763                 smp_rmb();
1764                 return wait_event_interruptible(afence->wq, afence->started);
1765         }
1766
1767         return 0;
1768 }
1769
1770 static int __xe_vm_bind(struct xe_vm *vm, struct xe_vma *vma,
1771                         struct xe_engine *e, struct xe_sync_entry *syncs,
1772                         u32 num_syncs, struct async_op_fence *afence)
1773 {
1774         struct dma_fence *fence;
1775
1776         xe_vm_assert_held(vm);
1777
1778         fence = xe_vm_bind_vma(vma, e, syncs, num_syncs);
1779         if (IS_ERR(fence))
1780                 return PTR_ERR(fence);
1781         if (afence)
1782                 add_async_op_fence_cb(vm, fence, afence);
1783
1784         dma_fence_put(fence);
1785         return 0;
1786 }
1787
1788 static int xe_vm_bind(struct xe_vm *vm, struct xe_vma *vma, struct xe_engine *e,
1789                       struct xe_bo *bo, struct xe_sync_entry *syncs,
1790                       u32 num_syncs, struct async_op_fence *afence)
1791 {
1792         int err;
1793
1794         xe_vm_assert_held(vm);
1795         xe_bo_assert_held(bo);
1796
1797         if (bo) {
1798                 err = xe_bo_validate(bo, vm, true);
1799                 if (err)
1800                         return err;
1801         }
1802
1803         return __xe_vm_bind(vm, vma, e, syncs, num_syncs, afence);
1804 }
1805
1806 static int xe_vm_unbind(struct xe_vm *vm, struct xe_vma *vma,
1807                         struct xe_engine *e, struct xe_sync_entry *syncs,
1808                         u32 num_syncs, struct async_op_fence *afence)
1809 {
1810         struct dma_fence *fence;
1811
1812         xe_vm_assert_held(vm);
1813         xe_bo_assert_held(vma->bo);
1814
1815         fence = xe_vm_unbind_vma(vma, e, syncs, num_syncs);
1816         if (IS_ERR(fence))
1817                 return PTR_ERR(fence);
1818         if (afence)
1819                 add_async_op_fence_cb(vm, fence, afence);
1820
1821         xe_vma_destroy(vma, fence);
1822         dma_fence_put(fence);
1823
1824         return 0;
1825 }
1826
1827 static int vm_set_error_capture_address(struct xe_device *xe, struct xe_vm *vm,
1828                                         u64 value)
1829 {
1830         if (XE_IOCTL_ERR(xe, !value))
1831                 return -EINVAL;
1832
1833         if (XE_IOCTL_ERR(xe, !(vm->flags & XE_VM_FLAG_ASYNC_BIND_OPS)))
1834                 return -EOPNOTSUPP;
1835
1836         if (XE_IOCTL_ERR(xe, vm->async_ops.error_capture.addr))
1837                 return -EOPNOTSUPP;
1838
1839         vm->async_ops.error_capture.mm = current->mm;
1840         vm->async_ops.error_capture.addr = value;
1841         init_waitqueue_head(&vm->async_ops.error_capture.wq);
1842
1843         return 0;
1844 }
1845
1846 typedef int (*xe_vm_set_property_fn)(struct xe_device *xe, struct xe_vm *vm,
1847                                      u64 value);
1848
1849 static const xe_vm_set_property_fn vm_set_property_funcs[] = {
1850         [XE_VM_PROPERTY_BIND_OP_ERROR_CAPTURE_ADDRESS] =
1851                 vm_set_error_capture_address,
1852 };
1853
1854 static int vm_user_ext_set_property(struct xe_device *xe, struct xe_vm *vm,
1855                                     u64 extension)
1856 {
1857         u64 __user *address = u64_to_user_ptr(extension);
1858         struct drm_xe_ext_vm_set_property ext;
1859         int err;
1860
1861         err = __copy_from_user(&ext, address, sizeof(ext));
1862         if (XE_IOCTL_ERR(xe, err))
1863                 return -EFAULT;
1864
1865         if (XE_IOCTL_ERR(xe, ext.property >=
1866                          ARRAY_SIZE(vm_set_property_funcs)) ||
1867             XE_IOCTL_ERR(xe, ext.pad) ||
1868             XE_IOCTL_ERR(xe, ext.reserved[0] || ext.reserved[1]))
1869                 return -EINVAL;
1870
1871         return vm_set_property_funcs[ext.property](xe, vm, ext.value);
1872 }
1873
1874 typedef int (*xe_vm_user_extension_fn)(struct xe_device *xe, struct xe_vm *vm,
1875                                        u64 extension);
1876
1877 static const xe_vm_set_property_fn vm_user_extension_funcs[] = {
1878         [XE_VM_EXTENSION_SET_PROPERTY] = vm_user_ext_set_property,
1879 };
1880
1881 #define MAX_USER_EXTENSIONS     16
1882 static int vm_user_extensions(struct xe_device *xe, struct xe_vm *vm,
1883                               u64 extensions, int ext_number)
1884 {
1885         u64 __user *address = u64_to_user_ptr(extensions);
1886         struct xe_user_extension ext;
1887         int err;
1888
1889         if (XE_IOCTL_ERR(xe, ext_number >= MAX_USER_EXTENSIONS))
1890                 return -E2BIG;
1891
1892         err = __copy_from_user(&ext, address, sizeof(ext));
1893         if (XE_IOCTL_ERR(xe, err))
1894                 return -EFAULT;
1895
1896         if (XE_IOCTL_ERR(xe, ext.pad) ||
1897             XE_IOCTL_ERR(xe, ext.name >=
1898                          ARRAY_SIZE(vm_user_extension_funcs)))
1899                 return -EINVAL;
1900
1901         err = vm_user_extension_funcs[ext.name](xe, vm, extensions);
1902         if (XE_IOCTL_ERR(xe, err))
1903                 return err;
1904
1905         if (ext.next_extension)
1906                 return vm_user_extensions(xe, vm, ext.next_extension,
1907                                           ++ext_number);
1908
1909         return 0;
1910 }
1911
1912 #define ALL_DRM_XE_VM_CREATE_FLAGS (DRM_XE_VM_CREATE_SCRATCH_PAGE | \
1913                                     DRM_XE_VM_CREATE_COMPUTE_MODE | \
1914                                     DRM_XE_VM_CREATE_ASYNC_BIND_OPS | \
1915                                     DRM_XE_VM_CREATE_FAULT_MODE)
1916
1917 int xe_vm_create_ioctl(struct drm_device *dev, void *data,
1918                        struct drm_file *file)
1919 {
1920         struct xe_device *xe = to_xe_device(dev);
1921         struct xe_file *xef = to_xe_file(file);
1922         struct drm_xe_vm_create *args = data;
1923         struct xe_vm *vm;
1924         u32 id, asid;
1925         int err;
1926         u32 flags = 0;
1927
1928         if (XE_IOCTL_ERR(xe, args->reserved[0] || args->reserved[1]))
1929                 return -EINVAL;
1930
1931         if (XE_IOCTL_ERR(xe, args->flags & ~ALL_DRM_XE_VM_CREATE_FLAGS))
1932                 return -EINVAL;
1933
1934         if (XE_IOCTL_ERR(xe, args->flags & DRM_XE_VM_CREATE_SCRATCH_PAGE &&
1935                          args->flags & DRM_XE_VM_CREATE_FAULT_MODE))
1936                 return -EINVAL;
1937
1938         if (XE_IOCTL_ERR(xe, args->flags & DRM_XE_VM_CREATE_COMPUTE_MODE &&
1939                          args->flags & DRM_XE_VM_CREATE_FAULT_MODE))
1940                 return -EINVAL;
1941
1942         if (XE_IOCTL_ERR(xe, args->flags & DRM_XE_VM_CREATE_FAULT_MODE &&
1943                          xe_device_in_non_fault_mode(xe)))
1944                 return -EINVAL;
1945
1946         if (XE_IOCTL_ERR(xe, !(args->flags & DRM_XE_VM_CREATE_FAULT_MODE) &&
1947                          xe_device_in_fault_mode(xe)))
1948                 return -EINVAL;
1949
1950         if (XE_IOCTL_ERR(xe, args->flags & DRM_XE_VM_CREATE_FAULT_MODE &&
1951                          !xe->info.supports_usm))
1952                 return -EINVAL;
1953
1954         if (args->flags & DRM_XE_VM_CREATE_SCRATCH_PAGE)
1955                 flags |= XE_VM_FLAG_SCRATCH_PAGE;
1956         if (args->flags & DRM_XE_VM_CREATE_COMPUTE_MODE)
1957                 flags |= XE_VM_FLAG_COMPUTE_MODE;
1958         if (args->flags & DRM_XE_VM_CREATE_ASYNC_BIND_OPS)
1959                 flags |= XE_VM_FLAG_ASYNC_BIND_OPS;
1960         if (args->flags & DRM_XE_VM_CREATE_FAULT_MODE)
1961                 flags |= XE_VM_FLAG_FAULT_MODE;
1962
1963         vm = xe_vm_create(xe, flags);
1964         if (IS_ERR(vm))
1965                 return PTR_ERR(vm);
1966
1967         if (args->extensions) {
1968                 err = vm_user_extensions(xe, vm, args->extensions, 0);
1969                 if (XE_IOCTL_ERR(xe, err)) {
1970                         xe_vm_close_and_put(vm);
1971                         return err;
1972                 }
1973         }
1974
1975         mutex_lock(&xef->vm.lock);
1976         err = xa_alloc(&xef->vm.xa, &id, vm, xa_limit_32b, GFP_KERNEL);
1977         mutex_unlock(&xef->vm.lock);
1978         if (err) {
1979                 xe_vm_close_and_put(vm);
1980                 return err;
1981         }
1982
1983         if (xe->info.has_asid) {
1984                 mutex_lock(&xe->usm.lock);
1985                 err = xa_alloc_cyclic(&xe->usm.asid_to_vm, &asid, vm,
1986                                       XA_LIMIT(0, XE_MAX_ASID - 1),
1987                                       &xe->usm.next_asid, GFP_KERNEL);
1988                 mutex_unlock(&xe->usm.lock);
1989                 if (err) {
1990                         xe_vm_close_and_put(vm);
1991                         return err;
1992                 }
1993                 vm->usm.asid = asid;
1994         }
1995
1996         args->vm_id = id;
1997
1998 #if IS_ENABLED(CONFIG_DRM_XE_DEBUG_MEM)
1999         /* Warning: Security issue - never enable by default */
2000         args->reserved[0] = xe_bo_main_addr(vm->pt_root[0]->bo, XE_PAGE_SIZE);
2001 #endif
2002
2003         return 0;
2004 }
2005
2006 int xe_vm_destroy_ioctl(struct drm_device *dev, void *data,
2007                         struct drm_file *file)
2008 {
2009         struct xe_device *xe = to_xe_device(dev);
2010         struct xe_file *xef = to_xe_file(file);
2011         struct drm_xe_vm_destroy *args = data;
2012         struct xe_vm *vm;
2013         int err = 0;
2014
2015         if (XE_IOCTL_ERR(xe, args->pad) ||
2016             XE_IOCTL_ERR(xe, args->reserved[0] || args->reserved[1]))
2017                 return -EINVAL;
2018
2019         mutex_lock(&xef->vm.lock);
2020         vm = xa_load(&xef->vm.xa, args->vm_id);
2021         if (XE_IOCTL_ERR(xe, !vm))
2022                 err = -ENOENT;
2023         else if (XE_IOCTL_ERR(xe, vm->preempt.num_engines))
2024                 err = -EBUSY;
2025         else
2026                 xa_erase(&xef->vm.xa, args->vm_id);
2027         mutex_unlock(&xef->vm.lock);
2028
2029         if (!err)
2030                 xe_vm_close_and_put(vm);
2031
2032         return err;
2033 }
2034
2035 static const u32 region_to_mem_type[] = {
2036         XE_PL_TT,
2037         XE_PL_VRAM0,
2038         XE_PL_VRAM1,
2039 };
2040
2041 static int xe_vm_prefetch(struct xe_vm *vm, struct xe_vma *vma,
2042                           struct xe_engine *e, u32 region,
2043                           struct xe_sync_entry *syncs, u32 num_syncs,
2044                           struct async_op_fence *afence)
2045 {
2046         int err;
2047
2048         XE_BUG_ON(region > ARRAY_SIZE(region_to_mem_type));
2049
2050         if (!xe_vma_has_no_bo(vma)) {
2051                 err = xe_bo_migrate(vma->bo, region_to_mem_type[region]);
2052                 if (err)
2053                         return err;
2054         }
2055
2056         if (vma->tile_mask != (vma->tile_present & ~vma->usm.tile_invalidated)) {
2057                 return xe_vm_bind(vm, vma, e, vma->bo, syncs, num_syncs,
2058                                   afence);
2059         } else {
2060                 int i;
2061
2062                 /* Nothing to do, signal fences now */
2063                 for (i = 0; i < num_syncs; i++)
2064                         xe_sync_entry_signal(&syncs[i], NULL,
2065                                              dma_fence_get_stub());
2066                 if (afence)
2067                         dma_fence_signal(&afence->fence);
2068                 return 0;
2069         }
2070 }
2071
2072 #define VM_BIND_OP(op)  (op & 0xffff)
2073
2074 static int __vm_bind_ioctl(struct xe_vm *vm, struct xe_vma *vma,
2075                            struct xe_engine *e, struct xe_bo *bo, u32 op,
2076                            u32 region, struct xe_sync_entry *syncs,
2077                            u32 num_syncs, struct async_op_fence *afence)
2078 {
2079         switch (VM_BIND_OP(op)) {
2080         case XE_VM_BIND_OP_MAP:
2081                 return xe_vm_bind(vm, vma, e, bo, syncs, num_syncs, afence);
2082         case XE_VM_BIND_OP_UNMAP:
2083         case XE_VM_BIND_OP_UNMAP_ALL:
2084                 return xe_vm_unbind(vm, vma, e, syncs, num_syncs, afence);
2085         case XE_VM_BIND_OP_MAP_USERPTR:
2086                 return xe_vm_bind(vm, vma, e, NULL, syncs, num_syncs, afence);
2087         case XE_VM_BIND_OP_PREFETCH:
2088                 return xe_vm_prefetch(vm, vma, e, region, syncs, num_syncs,
2089                                       afence);
2090                 break;
2091         default:
2092                 XE_BUG_ON("NOT POSSIBLE");
2093                 return -EINVAL;
2094         }
2095 }
2096
2097 struct ttm_buffer_object *xe_vm_ttm_bo(struct xe_vm *vm)
2098 {
2099         int idx = vm->flags & XE_VM_FLAG_MIGRATION ?
2100                 XE_VM_FLAG_GT_ID(vm->flags) : 0;
2101
2102         /* Safe to use index 0 as all BO in the VM share a single dma-resv lock */
2103         return &vm->pt_root[idx]->bo->ttm;
2104 }
2105
2106 static void xe_vm_tv_populate(struct xe_vm *vm, struct ttm_validate_buffer *tv)
2107 {
2108         tv->num_shared = 1;
2109         tv->bo = xe_vm_ttm_bo(vm);
2110 }
2111
2112 static bool is_map_op(u32 op)
2113 {
2114         return VM_BIND_OP(op) == XE_VM_BIND_OP_MAP ||
2115                 VM_BIND_OP(op) == XE_VM_BIND_OP_MAP_USERPTR;
2116 }
2117
2118 static bool is_unmap_op(u32 op)
2119 {
2120         return VM_BIND_OP(op) == XE_VM_BIND_OP_UNMAP ||
2121                 VM_BIND_OP(op) == XE_VM_BIND_OP_UNMAP_ALL;
2122 }
2123
2124 static int vm_bind_ioctl(struct xe_vm *vm, struct xe_vma *vma,
2125                          struct xe_engine *e, struct xe_bo *bo,
2126                          struct drm_xe_vm_bind_op *bind_op,
2127                          struct xe_sync_entry *syncs, u32 num_syncs,
2128                          struct async_op_fence *afence)
2129 {
2130         LIST_HEAD(objs);
2131         LIST_HEAD(dups);
2132         struct ttm_validate_buffer tv_bo, tv_vm;
2133         struct ww_acquire_ctx ww;
2134         struct xe_bo *vbo;
2135         int err, i;
2136
2137         lockdep_assert_held(&vm->lock);
2138         XE_BUG_ON(!list_empty(&vma->unbind_link));
2139
2140         /* Binds deferred to faults, signal fences now */
2141         if (xe_vm_in_fault_mode(vm) && is_map_op(bind_op->op) &&
2142             !(bind_op->op & XE_VM_BIND_FLAG_IMMEDIATE)) {
2143                 for (i = 0; i < num_syncs; i++)
2144                         xe_sync_entry_signal(&syncs[i], NULL,
2145                                              dma_fence_get_stub());
2146                 if (afence)
2147                         dma_fence_signal(&afence->fence);
2148                 return 0;
2149         }
2150
2151         xe_vm_tv_populate(vm, &tv_vm);
2152         list_add_tail(&tv_vm.head, &objs);
2153         vbo = vma->bo;
2154         if (vbo) {
2155                 /*
2156                  * An unbind can drop the last reference to the BO and
2157                  * the BO is needed for ttm_eu_backoff_reservation so
2158                  * take a reference here.
2159                  */
2160                 xe_bo_get(vbo);
2161
2162                 if (!vbo->vm) {
2163                         tv_bo.bo = &vbo->ttm;
2164                         tv_bo.num_shared = 1;
2165                         list_add(&tv_bo.head, &objs);
2166                 }
2167         }
2168
2169 again:
2170         err = ttm_eu_reserve_buffers(&ww, &objs, true, &dups);
2171         if (!err) {
2172                 err = __vm_bind_ioctl(vm, vma, e, bo,
2173                                       bind_op->op, bind_op->region, syncs,
2174                                       num_syncs, afence);
2175                 ttm_eu_backoff_reservation(&ww, &objs);
2176                 if (err == -EAGAIN && xe_vma_is_userptr(vma)) {
2177                         lockdep_assert_held_write(&vm->lock);
2178                         err = xe_vma_userptr_pin_pages(vma);
2179                         if (!err)
2180                                 goto again;
2181                 }
2182         }
2183         xe_bo_put(vbo);
2184
2185         return err;
2186 }
2187
2188 struct async_op {
2189         struct xe_vma *vma;
2190         struct xe_engine *engine;
2191         struct xe_bo *bo;
2192         struct drm_xe_vm_bind_op bind_op;
2193         struct xe_sync_entry *syncs;
2194         u32 num_syncs;
2195         struct list_head link;
2196         struct async_op_fence *fence;
2197 };
2198
2199 static void async_op_cleanup(struct xe_vm *vm, struct async_op *op)
2200 {
2201         while (op->num_syncs--)
2202                 xe_sync_entry_cleanup(&op->syncs[op->num_syncs]);
2203         kfree(op->syncs);
2204         xe_bo_put(op->bo);
2205         if (op->engine)
2206                 xe_engine_put(op->engine);
2207         xe_vm_put(vm);
2208         if (op->fence)
2209                 dma_fence_put(&op->fence->fence);
2210         kfree(op);
2211 }
2212
2213 static struct async_op *next_async_op(struct xe_vm *vm)
2214 {
2215         return list_first_entry_or_null(&vm->async_ops.pending,
2216                                         struct async_op, link);
2217 }
2218
2219 static void vm_set_async_error(struct xe_vm *vm, int err)
2220 {
2221         lockdep_assert_held(&vm->lock);
2222         vm->async_ops.error = err;
2223 }
2224
2225 static void async_op_work_func(struct work_struct *w)
2226 {
2227         struct xe_vm *vm = container_of(w, struct xe_vm, async_ops.work);
2228
2229         for (;;) {
2230                 struct async_op *op;
2231                 int err;
2232
2233                 if (vm->async_ops.error && !xe_vm_is_closed(vm))
2234                         break;
2235
2236                 spin_lock_irq(&vm->async_ops.lock);
2237                 op = next_async_op(vm);
2238                 if (op)
2239                         list_del_init(&op->link);
2240                 spin_unlock_irq(&vm->async_ops.lock);
2241
2242                 if (!op)
2243                         break;
2244
2245                 if (!xe_vm_is_closed(vm)) {
2246                         bool first, last;
2247
2248                         down_write(&vm->lock);
2249 again:
2250                         first = op->vma->first_munmap_rebind;
2251                         last = op->vma->last_munmap_rebind;
2252 #ifdef TEST_VM_ASYNC_OPS_ERROR
2253 #define FORCE_ASYNC_OP_ERROR    BIT(31)
2254                         if (!(op->bind_op.op & FORCE_ASYNC_OP_ERROR)) {
2255                                 err = vm_bind_ioctl(vm, op->vma, op->engine,
2256                                                     op->bo, &op->bind_op,
2257                                                     op->syncs, op->num_syncs,
2258                                                     op->fence);
2259                         } else {
2260                                 err = -ENOMEM;
2261                                 op->bind_op.op &= ~FORCE_ASYNC_OP_ERROR;
2262                         }
2263 #else
2264                         err = vm_bind_ioctl(vm, op->vma, op->engine, op->bo,
2265                                             &op->bind_op, op->syncs,
2266                                             op->num_syncs, op->fence);
2267 #endif
2268                         /*
2269                          * In order for the fencing to work (stall behind
2270                          * existing jobs / prevent new jobs from running) all
2271                          * the dma-resv slots need to be programmed in a batch
2272                          * relative to execs / the rebind worker. The vm->lock
2273                          * ensure this.
2274                          */
2275                         if (!err && ((first && VM_BIND_OP(op->bind_op.op) ==
2276                                       XE_VM_BIND_OP_UNMAP) ||
2277                                      vm->async_ops.munmap_rebind_inflight)) {
2278                                 if (last) {
2279                                         op->vma->last_munmap_rebind = false;
2280                                         vm->async_ops.munmap_rebind_inflight =
2281                                                 false;
2282                                 } else {
2283                                         vm->async_ops.munmap_rebind_inflight =
2284                                                 true;
2285
2286                                         async_op_cleanup(vm, op);
2287
2288                                         spin_lock_irq(&vm->async_ops.lock);
2289                                         op = next_async_op(vm);
2290                                         XE_BUG_ON(!op);
2291                                         list_del_init(&op->link);
2292                                         spin_unlock_irq(&vm->async_ops.lock);
2293
2294                                         goto again;
2295                                 }
2296                         }
2297                         if (err) {
2298                                 trace_xe_vma_fail(op->vma);
2299                                 drm_warn(&vm->xe->drm, "Async VM op(%d) failed with %d",
2300                                          VM_BIND_OP(op->bind_op.op),
2301                                          err);
2302
2303                                 spin_lock_irq(&vm->async_ops.lock);
2304                                 list_add(&op->link, &vm->async_ops.pending);
2305                                 spin_unlock_irq(&vm->async_ops.lock);
2306
2307                                 vm_set_async_error(vm, err);
2308                                 up_write(&vm->lock);
2309
2310                                 if (vm->async_ops.error_capture.addr)
2311                                         vm_error_capture(vm, err,
2312                                                          op->bind_op.op,
2313                                                          op->bind_op.addr,
2314                                                          op->bind_op.range);
2315                                 break;
2316                         }
2317                         up_write(&vm->lock);
2318                 } else {
2319                         trace_xe_vma_flush(op->vma);
2320
2321                         if (is_unmap_op(op->bind_op.op)) {
2322                                 down_write(&vm->lock);
2323                                 xe_vma_destroy_unlocked(op->vma);
2324                                 up_write(&vm->lock);
2325                         }
2326
2327                         if (op->fence && !test_bit(DMA_FENCE_FLAG_SIGNALED_BIT,
2328                                                    &op->fence->fence.flags)) {
2329                                 if (!xe_vm_no_dma_fences(vm)) {
2330                                         op->fence->started = true;
2331                                         smp_wmb();
2332                                         wake_up_all(&op->fence->wq);
2333                                 }
2334                                 dma_fence_signal(&op->fence->fence);
2335                         }
2336                 }
2337
2338                 async_op_cleanup(vm, op);
2339         }
2340 }
2341
2342 static int __vm_bind_ioctl_async(struct xe_vm *vm, struct xe_vma *vma,
2343                                  struct xe_engine *e, struct xe_bo *bo,
2344                                  struct drm_xe_vm_bind_op *bind_op,
2345                                  struct xe_sync_entry *syncs, u32 num_syncs)
2346 {
2347         struct async_op *op;
2348         bool installed = false;
2349         u64 seqno;
2350         int i;
2351
2352         lockdep_assert_held(&vm->lock);
2353
2354         op = kmalloc(sizeof(*op), GFP_KERNEL);
2355         if (!op) {
2356                 return -ENOMEM;
2357         }
2358
2359         if (num_syncs) {
2360                 op->fence = kmalloc(sizeof(*op->fence), GFP_KERNEL);
2361                 if (!op->fence) {
2362                         kfree(op);
2363                         return -ENOMEM;
2364                 }
2365
2366                 seqno = e ? ++e->bind.fence_seqno : ++vm->async_ops.fence.seqno;
2367                 dma_fence_init(&op->fence->fence, &async_op_fence_ops,
2368                                &vm->async_ops.lock, e ? e->bind.fence_ctx :
2369                                vm->async_ops.fence.context, seqno);
2370
2371                 if (!xe_vm_no_dma_fences(vm)) {
2372                         op->fence->vm = vm;
2373                         op->fence->started = false;
2374                         init_waitqueue_head(&op->fence->wq);
2375                 }
2376         } else {
2377                 op->fence = NULL;
2378         }
2379         op->vma = vma;
2380         op->engine = e;
2381         op->bo = bo;
2382         op->bind_op = *bind_op;
2383         op->syncs = syncs;
2384         op->num_syncs = num_syncs;
2385         INIT_LIST_HEAD(&op->link);
2386
2387         for (i = 0; i < num_syncs; i++)
2388                 installed |= xe_sync_entry_signal(&syncs[i], NULL,
2389                                                   &op->fence->fence);
2390
2391         if (!installed && op->fence)
2392                 dma_fence_signal(&op->fence->fence);
2393
2394         spin_lock_irq(&vm->async_ops.lock);
2395         list_add_tail(&op->link, &vm->async_ops.pending);
2396         spin_unlock_irq(&vm->async_ops.lock);
2397
2398         if (!vm->async_ops.error)
2399                 queue_work(system_unbound_wq, &vm->async_ops.work);
2400
2401         return 0;
2402 }
2403
2404 static int vm_bind_ioctl_async(struct xe_vm *vm, struct xe_vma *vma,
2405                                struct xe_engine *e, struct xe_bo *bo,
2406                                struct drm_xe_vm_bind_op *bind_op,
2407                                struct xe_sync_entry *syncs, u32 num_syncs)
2408 {
2409         struct xe_vma *__vma, *next;
2410         struct list_head rebind_list;
2411         struct xe_sync_entry *in_syncs = NULL, *out_syncs = NULL;
2412         u32 num_in_syncs = 0, num_out_syncs = 0;
2413         bool first = true, last;
2414         int err;
2415         int i;
2416
2417         lockdep_assert_held(&vm->lock);
2418
2419         /* Not a linked list of unbinds + rebinds, easy */
2420         if (list_empty(&vma->unbind_link))
2421                 return __vm_bind_ioctl_async(vm, vma, e, bo, bind_op,
2422                                              syncs, num_syncs);
2423
2424         /*
2425          * Linked list of unbinds + rebinds, decompose syncs into 'in / out'
2426          * passing the 'in' to the first operation and 'out' to the last. Also
2427          * the reference counting is a little tricky, increment the VM / bind
2428          * engine ref count on all but the last operation and increment the BOs
2429          * ref count on each rebind.
2430          */
2431
2432         XE_BUG_ON(VM_BIND_OP(bind_op->op) != XE_VM_BIND_OP_UNMAP &&
2433                   VM_BIND_OP(bind_op->op) != XE_VM_BIND_OP_UNMAP_ALL &&
2434                   VM_BIND_OP(bind_op->op) != XE_VM_BIND_OP_PREFETCH);
2435
2436         /* Decompose syncs */
2437         if (num_syncs) {
2438                 in_syncs = kmalloc(sizeof(*in_syncs) * num_syncs, GFP_KERNEL);
2439                 out_syncs = kmalloc(sizeof(*out_syncs) * num_syncs, GFP_KERNEL);
2440                 if (!in_syncs || !out_syncs) {
2441                         err = -ENOMEM;
2442                         goto out_error;
2443                 }
2444
2445                 for (i = 0; i < num_syncs; ++i) {
2446                         bool signal = syncs[i].flags & DRM_XE_SYNC_SIGNAL;
2447
2448                         if (signal)
2449                                 out_syncs[num_out_syncs++] = syncs[i];
2450                         else
2451                                 in_syncs[num_in_syncs++] = syncs[i];
2452                 }
2453         }
2454
2455         /* Do unbinds + move rebinds to new list */
2456         INIT_LIST_HEAD(&rebind_list);
2457         list_for_each_entry_safe(__vma, next, &vma->unbind_link, unbind_link) {
2458                 if (__vma->destroyed ||
2459                     VM_BIND_OP(bind_op->op) == XE_VM_BIND_OP_PREFETCH) {
2460                         list_del_init(&__vma->unbind_link);
2461                         xe_bo_get(bo);
2462                         err = __vm_bind_ioctl_async(xe_vm_get(vm), __vma,
2463                                                     e ? xe_engine_get(e) : NULL,
2464                                                     bo, bind_op, first ?
2465                                                     in_syncs : NULL,
2466                                                     first ? num_in_syncs : 0);
2467                         if (err) {
2468                                 xe_bo_put(bo);
2469                                 xe_vm_put(vm);
2470                                 if (e)
2471                                         xe_engine_put(e);
2472                                 goto out_error;
2473                         }
2474                         in_syncs = NULL;
2475                         first = false;
2476                 } else {
2477                         list_move_tail(&__vma->unbind_link, &rebind_list);
2478                 }
2479         }
2480         last = list_empty(&rebind_list);
2481         if (!last) {
2482                 xe_vm_get(vm);
2483                 if (e)
2484                         xe_engine_get(e);
2485         }
2486         err = __vm_bind_ioctl_async(vm, vma, e,
2487                                     bo, bind_op,
2488                                     first ? in_syncs :
2489                                     last ? out_syncs : NULL,
2490                                     first ? num_in_syncs :
2491                                     last ? num_out_syncs : 0);
2492         if (err) {
2493                 if (!last) {
2494                         xe_vm_put(vm);
2495                         if (e)
2496                                 xe_engine_put(e);
2497                 }
2498                 goto out_error;
2499         }
2500         in_syncs = NULL;
2501
2502         /* Do rebinds */
2503         list_for_each_entry_safe(__vma, next, &rebind_list, unbind_link) {
2504                 list_del_init(&__vma->unbind_link);
2505                 last = list_empty(&rebind_list);
2506
2507                 if (xe_vma_is_userptr(__vma)) {
2508                         bind_op->op = XE_VM_BIND_FLAG_ASYNC |
2509                                 XE_VM_BIND_OP_MAP_USERPTR;
2510                 } else {
2511                         bind_op->op = XE_VM_BIND_FLAG_ASYNC |
2512                                 XE_VM_BIND_OP_MAP;
2513                         xe_bo_get(__vma->bo);
2514                 }
2515
2516                 if (!last) {
2517                         xe_vm_get(vm);
2518                         if (e)
2519                                 xe_engine_get(e);
2520                 }
2521
2522                 err = __vm_bind_ioctl_async(vm, __vma, e,
2523                                             __vma->bo, bind_op, last ?
2524                                             out_syncs : NULL,
2525                                             last ? num_out_syncs : 0);
2526                 if (err) {
2527                         if (!last) {
2528                                 xe_vm_put(vm);
2529                                 if (e)
2530                                         xe_engine_put(e);
2531                         }
2532                         goto out_error;
2533                 }
2534         }
2535
2536         kfree(syncs);
2537         return 0;
2538
2539 out_error:
2540         kfree(in_syncs);
2541         kfree(out_syncs);
2542         kfree(syncs);
2543
2544         return err;
2545 }
2546
2547 static int __vm_bind_ioctl_lookup_vma(struct xe_vm *vm, struct xe_bo *bo,
2548                                       u64 addr, u64 range, u32 op)
2549 {
2550         struct xe_device *xe = vm->xe;
2551         struct xe_vma *vma, lookup;
2552         bool async = !!(op & XE_VM_BIND_FLAG_ASYNC);
2553
2554         lockdep_assert_held(&vm->lock);
2555
2556         lookup.start = addr;
2557         lookup.end = addr + range - 1;
2558
2559         switch (VM_BIND_OP(op)) {
2560         case XE_VM_BIND_OP_MAP:
2561         case XE_VM_BIND_OP_MAP_USERPTR:
2562                 vma = xe_vm_find_overlapping_vma(vm, &lookup);
2563                 if (XE_IOCTL_ERR(xe, vma))
2564                         return -EBUSY;
2565                 break;
2566         case XE_VM_BIND_OP_UNMAP:
2567         case XE_VM_BIND_OP_PREFETCH:
2568                 vma = xe_vm_find_overlapping_vma(vm, &lookup);
2569                 if (XE_IOCTL_ERR(xe, !vma) ||
2570                     XE_IOCTL_ERR(xe, (vma->start != addr ||
2571                                  vma->end != addr + range - 1) && !async))
2572                         return -EINVAL;
2573                 break;
2574         case XE_VM_BIND_OP_UNMAP_ALL:
2575                 break;
2576         default:
2577                 XE_BUG_ON("NOT POSSIBLE");
2578                 return -EINVAL;
2579         }
2580
2581         return 0;
2582 }
2583
2584 static void prep_vma_destroy(struct xe_vm *vm, struct xe_vma *vma)
2585 {
2586         down_read(&vm->userptr.notifier_lock);
2587         vma->destroyed = true;
2588         up_read(&vm->userptr.notifier_lock);
2589         xe_vm_remove_vma(vm, vma);
2590 }
2591
2592 static int prep_replacement_vma(struct xe_vm *vm, struct xe_vma *vma)
2593 {
2594         int err;
2595
2596         if (vma->bo && !vma->bo->vm) {
2597                 vm_insert_extobj(vm, vma);
2598                 err = add_preempt_fences(vm, vma->bo);
2599                 if (err)
2600                         return err;
2601         }
2602
2603         return 0;
2604 }
2605
2606 /*
2607  * Find all overlapping VMAs in lookup range and add to a list in the returned
2608  * VMA, all of VMAs found will be unbound. Also possibly add 2 new VMAs that
2609  * need to be bound if first / last VMAs are not fully unbound. This is akin to
2610  * how munmap works.
2611  */
2612 static struct xe_vma *vm_unbind_lookup_vmas(struct xe_vm *vm,
2613                                             struct xe_vma *lookup)
2614 {
2615         struct xe_vma *vma = xe_vm_find_overlapping_vma(vm, lookup);
2616         struct rb_node *node;
2617         struct xe_vma *first = vma, *last = vma, *new_first = NULL,
2618                       *new_last = NULL, *__vma, *next;
2619         int err = 0;
2620         bool first_munmap_rebind = false;
2621
2622         lockdep_assert_held(&vm->lock);
2623         XE_BUG_ON(!vma);
2624
2625         node = &vma->vm_node;
2626         while ((node = rb_next(node))) {
2627                 if (!xe_vma_cmp_vma_cb(lookup, node)) {
2628                         __vma = to_xe_vma(node);
2629                         list_add_tail(&__vma->unbind_link, &vma->unbind_link);
2630                         last = __vma;
2631                 } else {
2632                         break;
2633                 }
2634         }
2635
2636         node = &vma->vm_node;
2637         while ((node = rb_prev(node))) {
2638                 if (!xe_vma_cmp_vma_cb(lookup, node)) {
2639                         __vma = to_xe_vma(node);
2640                         list_add(&__vma->unbind_link, &vma->unbind_link);
2641                         first = __vma;
2642                 } else {
2643                         break;
2644                 }
2645         }
2646
2647         if (first->start != lookup->start) {
2648                 struct ww_acquire_ctx ww;
2649
2650                 if (first->bo)
2651                         err = xe_bo_lock(first->bo, &ww, 0, true);
2652                 if (err)
2653                         goto unwind;
2654                 new_first = xe_vma_create(first->vm, first->bo,
2655                                           first->bo ? first->bo_offset :
2656                                           first->userptr.ptr,
2657                                           first->start,
2658                                           lookup->start - 1,
2659                                           (first->pte_flags &
2660                                            XE_PTE_FLAG_READ_ONLY),
2661                                           (first->pte_flags &
2662                                            XE_PTE_FLAG_NULL),
2663                                           first->tile_mask);
2664                 if (first->bo)
2665                         xe_bo_unlock(first->bo, &ww);
2666                 if (!new_first) {
2667                         err = -ENOMEM;
2668                         goto unwind;
2669                 }
2670                 if (xe_vma_is_userptr(first)) {
2671                         err = xe_vma_userptr_pin_pages(new_first);
2672                         if (err)
2673                                 goto unwind;
2674                 }
2675                 err = prep_replacement_vma(vm, new_first);
2676                 if (err)
2677                         goto unwind;
2678         }
2679
2680         if (last->end != lookup->end) {
2681                 struct ww_acquire_ctx ww;
2682                 u64 chunk = lookup->end + 1 - last->start;
2683
2684                 if (last->bo)
2685                         err = xe_bo_lock(last->bo, &ww, 0, true);
2686                 if (err)
2687                         goto unwind;
2688                 new_last = xe_vma_create(last->vm, last->bo,
2689                                          last->bo ? last->bo_offset + chunk :
2690                                          last->userptr.ptr + chunk,
2691                                          last->start + chunk,
2692                                          last->end,
2693                                          (last->pte_flags &
2694                                           XE_PTE_FLAG_READ_ONLY),
2695                                          (last->pte_flags & XE_PTE_FLAG_NULL),
2696                                          last->tile_mask);
2697                 if (last->bo)
2698                         xe_bo_unlock(last->bo, &ww);
2699                 if (!new_last) {
2700                         err = -ENOMEM;
2701                         goto unwind;
2702                 }
2703                 if (xe_vma_is_userptr(last)) {
2704                         err = xe_vma_userptr_pin_pages(new_last);
2705                         if (err)
2706                                 goto unwind;
2707                 }
2708                 err = prep_replacement_vma(vm, new_last);
2709                 if (err)
2710                         goto unwind;
2711         }
2712
2713         prep_vma_destroy(vm, vma);
2714         if (list_empty(&vma->unbind_link) && (new_first || new_last))
2715                 vma->first_munmap_rebind = true;
2716         list_for_each_entry(__vma, &vma->unbind_link, unbind_link) {
2717                 if ((new_first || new_last) && !first_munmap_rebind) {
2718                         __vma->first_munmap_rebind = true;
2719                         first_munmap_rebind = true;
2720                 }
2721                 prep_vma_destroy(vm, __vma);
2722         }
2723         if (new_first) {
2724                 xe_vm_insert_vma(vm, new_first);
2725                 list_add_tail(&new_first->unbind_link, &vma->unbind_link);
2726                 if (!new_last)
2727                         new_first->last_munmap_rebind = true;
2728         }
2729         if (new_last) {
2730                 xe_vm_insert_vma(vm, new_last);
2731                 list_add_tail(&new_last->unbind_link, &vma->unbind_link);
2732                 new_last->last_munmap_rebind = true;
2733         }
2734
2735         return vma;
2736
2737 unwind:
2738         list_for_each_entry_safe(__vma, next, &vma->unbind_link, unbind_link)
2739                 list_del_init(&__vma->unbind_link);
2740         if (new_last) {
2741                 prep_vma_destroy(vm, new_last);
2742                 xe_vma_destroy_unlocked(new_last);
2743         }
2744         if (new_first) {
2745                 prep_vma_destroy(vm, new_first);
2746                 xe_vma_destroy_unlocked(new_first);
2747         }
2748
2749         return ERR_PTR(err);
2750 }
2751
2752 /*
2753  * Similar to vm_unbind_lookup_vmas, find all VMAs in lookup range to prefetch
2754  */
2755 static struct xe_vma *vm_prefetch_lookup_vmas(struct xe_vm *vm,
2756                                               struct xe_vma *lookup,
2757                                               u32 region)
2758 {
2759         struct xe_vma *vma = xe_vm_find_overlapping_vma(vm, lookup), *__vma,
2760                       *next;
2761         struct rb_node *node;
2762
2763         if (!xe_vma_has_no_bo(vma)) {
2764                 if (!xe_bo_can_migrate(vma->bo, region_to_mem_type[region]))
2765                         return ERR_PTR(-EINVAL);
2766         }
2767
2768         node = &vma->vm_node;
2769         while ((node = rb_next(node))) {
2770                 if (!xe_vma_cmp_vma_cb(lookup, node)) {
2771                         __vma = to_xe_vma(node);
2772                         if (!xe_vma_has_no_bo(__vma)) {
2773                                 if (!xe_bo_can_migrate(__vma->bo, region_to_mem_type[region]))
2774                                         goto flush_list;
2775                         }
2776                         list_add_tail(&__vma->unbind_link, &vma->unbind_link);
2777                 } else {
2778                         break;
2779                 }
2780         }
2781
2782         node = &vma->vm_node;
2783         while ((node = rb_prev(node))) {
2784                 if (!xe_vma_cmp_vma_cb(lookup, node)) {
2785                         __vma = to_xe_vma(node);
2786                         if (!xe_vma_has_no_bo(__vma)) {
2787                                 if (!xe_bo_can_migrate(__vma->bo, region_to_mem_type[region]))
2788                                         goto flush_list;
2789                         }
2790                         list_add(&__vma->unbind_link, &vma->unbind_link);
2791                 } else {
2792                         break;
2793                 }
2794         }
2795
2796         return vma;
2797
2798 flush_list:
2799         list_for_each_entry_safe(__vma, next, &vma->unbind_link,
2800                                  unbind_link)
2801                 list_del_init(&__vma->unbind_link);
2802
2803         return ERR_PTR(-EINVAL);
2804 }
2805
2806 static struct xe_vma *vm_unbind_all_lookup_vmas(struct xe_vm *vm,
2807                                                 struct xe_bo *bo)
2808 {
2809         struct xe_vma *first = NULL, *vma;
2810
2811         lockdep_assert_held(&vm->lock);
2812         xe_bo_assert_held(bo);
2813
2814         list_for_each_entry(vma, &bo->vmas, bo_link) {
2815                 if (vma->vm != vm)
2816                         continue;
2817
2818                 prep_vma_destroy(vm, vma);
2819                 if (!first)
2820                         first = vma;
2821                 else
2822                         list_add_tail(&vma->unbind_link, &first->unbind_link);
2823         }
2824
2825         return first;
2826 }
2827
2828 static struct xe_vma *vm_bind_ioctl_lookup_vma(struct xe_vm *vm,
2829                                                struct xe_bo *bo,
2830                                                u64 bo_offset_or_userptr,
2831                                                u64 addr, u64 range, u32 op,
2832                                                u64 tile_mask, u32 region)
2833 {
2834         struct ww_acquire_ctx ww;
2835         struct xe_vma *vma, lookup;
2836         int err;
2837
2838         lockdep_assert_held(&vm->lock);
2839
2840         lookup.start = addr;
2841         lookup.end = addr + range - 1;
2842
2843         switch (VM_BIND_OP(op)) {
2844         case XE_VM_BIND_OP_MAP:
2845                 if (bo) {
2846                         err = xe_bo_lock(bo, &ww, 0, true);
2847                         if (err)
2848                                 return ERR_PTR(err);
2849                 }
2850                 vma = xe_vma_create(vm, bo, bo_offset_or_userptr, addr,
2851                                     addr + range - 1,
2852                                     op & XE_VM_BIND_FLAG_READONLY,
2853                                     op & XE_VM_BIND_FLAG_NULL,
2854                                     tile_mask);
2855                 if (bo)
2856                         xe_bo_unlock(bo, &ww);
2857                 if (!vma)
2858                         return ERR_PTR(-ENOMEM);
2859
2860                 xe_vm_insert_vma(vm, vma);
2861                 if (bo && !bo->vm) {
2862                         vm_insert_extobj(vm, vma);
2863                         err = add_preempt_fences(vm, bo);
2864                         if (err) {
2865                                 prep_vma_destroy(vm, vma);
2866                                 xe_vma_destroy_unlocked(vma);
2867
2868                                 return ERR_PTR(err);
2869                         }
2870                 }
2871                 break;
2872         case XE_VM_BIND_OP_UNMAP:
2873                 vma = vm_unbind_lookup_vmas(vm, &lookup);
2874                 break;
2875         case XE_VM_BIND_OP_PREFETCH:
2876                 vma = vm_prefetch_lookup_vmas(vm, &lookup, region);
2877                 break;
2878         case XE_VM_BIND_OP_UNMAP_ALL:
2879                 XE_BUG_ON(!bo);
2880
2881                 err = xe_bo_lock(bo, &ww, 0, true);
2882                 if (err)
2883                         return ERR_PTR(err);
2884                 vma = vm_unbind_all_lookup_vmas(vm, bo);
2885                 if (!vma)
2886                         vma = ERR_PTR(-EINVAL);
2887                 xe_bo_unlock(bo, &ww);
2888                 break;
2889         case XE_VM_BIND_OP_MAP_USERPTR:
2890                 XE_BUG_ON(bo);
2891
2892                 vma = xe_vma_create(vm, NULL, bo_offset_or_userptr, addr,
2893                                     addr + range - 1,
2894                                     op & XE_VM_BIND_FLAG_READONLY,
2895                                     op & XE_VM_BIND_FLAG_NULL,
2896                                     tile_mask);
2897                 if (!vma)
2898                         return ERR_PTR(-ENOMEM);
2899
2900                 err = xe_vma_userptr_pin_pages(vma);
2901                 if (err) {
2902                         prep_vma_destroy(vm, vma);
2903                         xe_vma_destroy_unlocked(vma);
2904
2905                         return ERR_PTR(err);
2906                 } else {
2907                         xe_vm_insert_vma(vm, vma);
2908                 }
2909                 break;
2910         default:
2911                 XE_BUG_ON("NOT POSSIBLE");
2912                 vma = ERR_PTR(-EINVAL);
2913         }
2914
2915         return vma;
2916 }
2917
2918 #ifdef TEST_VM_ASYNC_OPS_ERROR
2919 #define SUPPORTED_FLAGS \
2920         (FORCE_ASYNC_OP_ERROR | XE_VM_BIND_FLAG_ASYNC | \
2921          XE_VM_BIND_FLAG_READONLY | XE_VM_BIND_FLAG_IMMEDIATE | \
2922          XE_VM_BIND_FLAG_NULL | 0xffff)
2923 #else
2924 #define SUPPORTED_FLAGS \
2925         (XE_VM_BIND_FLAG_ASYNC | XE_VM_BIND_FLAG_READONLY | \
2926          XE_VM_BIND_FLAG_IMMEDIATE | XE_VM_BIND_FLAG_NULL | 0xffff)
2927 #endif
2928 #define XE_64K_PAGE_MASK 0xffffull
2929
2930 #define MAX_BINDS       512     /* FIXME: Picking random upper limit */
2931
2932 static int vm_bind_ioctl_check_args(struct xe_device *xe,
2933                                     struct drm_xe_vm_bind *args,
2934                                     struct drm_xe_vm_bind_op **bind_ops,
2935                                     bool *async)
2936 {
2937         int err;
2938         int i;
2939
2940         if (XE_IOCTL_ERR(xe, args->extensions) ||
2941             XE_IOCTL_ERR(xe, args->pad || args->pad2) ||
2942             XE_IOCTL_ERR(xe, args->reserved[0] || args->reserved[1]) ||
2943             XE_IOCTL_ERR(xe, !args->num_binds) ||
2944             XE_IOCTL_ERR(xe, args->num_binds > MAX_BINDS))
2945                 return -EINVAL;
2946
2947         if (args->num_binds > 1) {
2948                 u64 __user *bind_user =
2949                         u64_to_user_ptr(args->vector_of_binds);
2950
2951                 *bind_ops = kmalloc(sizeof(struct drm_xe_vm_bind_op) *
2952                                     args->num_binds, GFP_KERNEL);
2953                 if (!*bind_ops)
2954                         return -ENOMEM;
2955
2956                 err = __copy_from_user(*bind_ops, bind_user,
2957                                        sizeof(struct drm_xe_vm_bind_op) *
2958                                        args->num_binds);
2959                 if (XE_IOCTL_ERR(xe, err)) {
2960                         err = -EFAULT;
2961                         goto free_bind_ops;
2962                 }
2963         } else {
2964                 *bind_ops = &args->bind;
2965         }
2966
2967         for (i = 0; i < args->num_binds; ++i) {
2968                 u64 range = (*bind_ops)[i].range;
2969                 u64 addr = (*bind_ops)[i].addr;
2970                 u32 op = (*bind_ops)[i].op;
2971                 u32 obj = (*bind_ops)[i].obj;
2972                 u64 obj_offset = (*bind_ops)[i].obj_offset;
2973                 u32 region = (*bind_ops)[i].region;
2974                 bool is_null = op &  XE_VM_BIND_FLAG_NULL;
2975
2976                 if (XE_IOCTL_ERR(xe, (*bind_ops)[i].pad) ||
2977                     XE_IOCTL_ERR(xe, (*bind_ops)[i].reserved[0] ||
2978                                      (*bind_ops)[i].reserved[1])) {
2979                         err = -EINVAL;
2980                         goto free_bind_ops;
2981                 }
2982
2983                 if (i == 0) {
2984                         *async = !!(op & XE_VM_BIND_FLAG_ASYNC);
2985                 } else if (XE_IOCTL_ERR(xe, !*async) ||
2986                            XE_IOCTL_ERR(xe, !(op & XE_VM_BIND_FLAG_ASYNC)) ||
2987                            XE_IOCTL_ERR(xe, VM_BIND_OP(op) ==
2988                                         XE_VM_BIND_OP_RESTART)) {
2989                         err = -EINVAL;
2990                         goto free_bind_ops;
2991                 }
2992
2993                 if (XE_IOCTL_ERR(xe, !*async &&
2994                                  VM_BIND_OP(op) == XE_VM_BIND_OP_UNMAP_ALL)) {
2995                         err = -EINVAL;
2996                         goto free_bind_ops;
2997                 }
2998
2999                 if (XE_IOCTL_ERR(xe, !*async &&
3000                                  VM_BIND_OP(op) == XE_VM_BIND_OP_PREFETCH)) {
3001                         err = -EINVAL;
3002                         goto free_bind_ops;
3003                 }
3004
3005                 if (XE_IOCTL_ERR(xe, VM_BIND_OP(op) >
3006                                  XE_VM_BIND_OP_PREFETCH) ||
3007                     XE_IOCTL_ERR(xe, op & ~SUPPORTED_FLAGS) ||
3008                     XE_IOCTL_ERR(xe, obj && is_null) ||
3009                     XE_IOCTL_ERR(xe, obj_offset && is_null) ||
3010                     XE_IOCTL_ERR(xe, VM_BIND_OP(op) != XE_VM_BIND_OP_MAP &&
3011                                  is_null) ||
3012                     XE_IOCTL_ERR(xe, !obj &&
3013                                  VM_BIND_OP(op) == XE_VM_BIND_OP_MAP &&
3014                                  !is_null) ||
3015                     XE_IOCTL_ERR(xe, !obj &&
3016                                  VM_BIND_OP(op) == XE_VM_BIND_OP_UNMAP_ALL) ||
3017                     XE_IOCTL_ERR(xe, addr &&
3018                                  VM_BIND_OP(op) == XE_VM_BIND_OP_UNMAP_ALL) ||
3019                     XE_IOCTL_ERR(xe, range &&
3020                                  VM_BIND_OP(op) == XE_VM_BIND_OP_UNMAP_ALL) ||
3021                     XE_IOCTL_ERR(xe, obj &&
3022                                  VM_BIND_OP(op) == XE_VM_BIND_OP_MAP_USERPTR) ||
3023                     XE_IOCTL_ERR(xe, obj &&
3024                                  VM_BIND_OP(op) == XE_VM_BIND_OP_PREFETCH) ||
3025                     XE_IOCTL_ERR(xe, region &&
3026                                  VM_BIND_OP(op) != XE_VM_BIND_OP_PREFETCH) ||
3027                     XE_IOCTL_ERR(xe, !(BIT(region) &
3028                                        xe->info.mem_region_mask)) ||
3029                     XE_IOCTL_ERR(xe, obj &&
3030                                  VM_BIND_OP(op) == XE_VM_BIND_OP_UNMAP)) {
3031                         err = -EINVAL;
3032                         goto free_bind_ops;
3033                 }
3034
3035                 if (XE_IOCTL_ERR(xe, obj_offset & ~PAGE_MASK) ||
3036                     XE_IOCTL_ERR(xe, addr & ~PAGE_MASK) ||
3037                     XE_IOCTL_ERR(xe, range & ~PAGE_MASK) ||
3038                     XE_IOCTL_ERR(xe, !range && VM_BIND_OP(op) !=
3039                                  XE_VM_BIND_OP_RESTART &&
3040                                  VM_BIND_OP(op) != XE_VM_BIND_OP_UNMAP_ALL)) {
3041                         err = -EINVAL;
3042                         goto free_bind_ops;
3043                 }
3044         }
3045
3046         return 0;
3047
3048 free_bind_ops:
3049         if (args->num_binds > 1)
3050                 kfree(*bind_ops);
3051         return err;
3052 }
3053
3054 int xe_vm_bind_ioctl(struct drm_device *dev, void *data, struct drm_file *file)
3055 {
3056         struct xe_device *xe = to_xe_device(dev);
3057         struct xe_file *xef = to_xe_file(file);
3058         struct drm_xe_vm_bind *args = data;
3059         struct drm_xe_sync __user *syncs_user;
3060         struct xe_bo **bos = NULL;
3061         struct xe_vma **vmas = NULL;
3062         struct xe_vm *vm;
3063         struct xe_engine *e = NULL;
3064         u32 num_syncs;
3065         struct xe_sync_entry *syncs = NULL;
3066         struct drm_xe_vm_bind_op *bind_ops;
3067         bool async;
3068         int err;
3069         int i, j = 0;
3070
3071         err = vm_bind_ioctl_check_args(xe, args, &bind_ops, &async);
3072         if (err)
3073                 return err;
3074
3075         vm = xe_vm_lookup(xef, args->vm_id);
3076         if (XE_IOCTL_ERR(xe, !vm)) {
3077                 err = -EINVAL;
3078                 goto free_objs;
3079         }
3080
3081         if (XE_IOCTL_ERR(xe, xe_vm_is_closed(vm))) {
3082                 drm_err(dev, "VM closed while we began looking up?\n");
3083                 err = -ENOENT;
3084                 goto put_vm;
3085         }
3086
3087         if (args->engine_id) {
3088                 e = xe_engine_lookup(xef, args->engine_id);
3089                 if (XE_IOCTL_ERR(xe, !e)) {
3090                         err = -ENOENT;
3091                         goto put_vm;
3092                 }
3093                 if (XE_IOCTL_ERR(xe, !(e->flags & ENGINE_FLAG_VM))) {
3094                         err = -EINVAL;
3095                         goto put_engine;
3096                 }
3097         }
3098
3099         if (VM_BIND_OP(bind_ops[0].op) == XE_VM_BIND_OP_RESTART) {
3100                 if (XE_IOCTL_ERR(xe, !(vm->flags & XE_VM_FLAG_ASYNC_BIND_OPS)))
3101                         err = -EOPNOTSUPP;
3102                 if (XE_IOCTL_ERR(xe, !err && args->num_syncs))
3103                         err = EINVAL;
3104                 if (XE_IOCTL_ERR(xe, !err && !vm->async_ops.error))
3105                         err = -EPROTO;
3106
3107                 if (!err) {
3108                         down_write(&vm->lock);
3109                         trace_xe_vm_restart(vm);
3110                         vm_set_async_error(vm, 0);
3111                         up_write(&vm->lock);
3112
3113                         queue_work(system_unbound_wq, &vm->async_ops.work);
3114
3115                         /* Rebinds may have been blocked, give worker a kick */
3116                         if (xe_vm_in_compute_mode(vm))
3117                                 xe_vm_queue_rebind_worker(vm);
3118                 }
3119
3120                 goto put_engine;
3121         }
3122
3123         if (XE_IOCTL_ERR(xe, !vm->async_ops.error &&
3124                          async != !!(vm->flags & XE_VM_FLAG_ASYNC_BIND_OPS))) {
3125                 err = -EOPNOTSUPP;
3126                 goto put_engine;
3127         }
3128
3129         for (i = 0; i < args->num_binds; ++i) {
3130                 u64 range = bind_ops[i].range;
3131                 u64 addr = bind_ops[i].addr;
3132
3133                 if (XE_IOCTL_ERR(xe, range > vm->size) ||
3134                     XE_IOCTL_ERR(xe, addr > vm->size - range)) {
3135                         err = -EINVAL;
3136                         goto put_engine;
3137                 }
3138
3139                 if (bind_ops[i].tile_mask) {
3140                         u64 valid_tiles = BIT(xe->info.tile_count) - 1;
3141
3142                         if (XE_IOCTL_ERR(xe, bind_ops[i].tile_mask &
3143                                          ~valid_tiles)) {
3144                                 err = -EINVAL;
3145                                 goto put_engine;
3146                         }
3147                 }
3148         }
3149
3150         bos = kzalloc(sizeof(*bos) * args->num_binds, GFP_KERNEL);
3151         if (!bos) {
3152                 err = -ENOMEM;
3153                 goto put_engine;
3154         }
3155
3156         vmas = kzalloc(sizeof(*vmas) * args->num_binds, GFP_KERNEL);
3157         if (!vmas) {
3158                 err = -ENOMEM;
3159                 goto put_engine;
3160         }
3161
3162         for (i = 0; i < args->num_binds; ++i) {
3163                 struct drm_gem_object *gem_obj;
3164                 u64 range = bind_ops[i].range;
3165                 u64 addr = bind_ops[i].addr;
3166                 u32 obj = bind_ops[i].obj;
3167                 u64 obj_offset = bind_ops[i].obj_offset;
3168
3169                 if (!obj)
3170                         continue;
3171
3172                 gem_obj = drm_gem_object_lookup(file, obj);
3173                 if (XE_IOCTL_ERR(xe, !gem_obj)) {
3174                         err = -ENOENT;
3175                         goto put_obj;
3176                 }
3177                 bos[i] = gem_to_xe_bo(gem_obj);
3178
3179                 if (XE_IOCTL_ERR(xe, range > bos[i]->size) ||
3180                     XE_IOCTL_ERR(xe, obj_offset >
3181                                  bos[i]->size - range)) {
3182                         err = -EINVAL;
3183                         goto put_obj;
3184                 }
3185
3186                 if (bos[i]->flags & XE_BO_INTERNAL_64K) {
3187                         if (XE_IOCTL_ERR(xe, obj_offset &
3188                                          XE_64K_PAGE_MASK) ||
3189                             XE_IOCTL_ERR(xe, addr & XE_64K_PAGE_MASK) ||
3190                             XE_IOCTL_ERR(xe, range & XE_64K_PAGE_MASK)) {
3191                                 err = -EINVAL;
3192                                 goto put_obj;
3193                         }
3194                 }
3195         }
3196
3197         if (args->num_syncs) {
3198                 syncs = kcalloc(args->num_syncs, sizeof(*syncs), GFP_KERNEL);
3199                 if (!syncs) {
3200                         err = -ENOMEM;
3201                         goto put_obj;
3202                 }
3203         }
3204
3205         syncs_user = u64_to_user_ptr(args->syncs);
3206         for (num_syncs = 0; num_syncs < args->num_syncs; num_syncs++) {
3207                 err = xe_sync_entry_parse(xe, xef, &syncs[num_syncs],
3208                                           &syncs_user[num_syncs], false,
3209                                           xe_vm_in_fault_mode(vm));
3210                 if (err)
3211                         goto free_syncs;
3212         }
3213
3214         err = down_write_killable(&vm->lock);
3215         if (err)
3216                 goto free_syncs;
3217
3218         /* Do some error checking first to make the unwind easier */
3219         for (i = 0; i < args->num_binds; ++i) {
3220                 u64 range = bind_ops[i].range;
3221                 u64 addr = bind_ops[i].addr;
3222                 u32 op = bind_ops[i].op;
3223
3224                 err = __vm_bind_ioctl_lookup_vma(vm, bos[i], addr, range, op);
3225                 if (err)
3226                         goto release_vm_lock;
3227         }
3228
3229         for (i = 0; i < args->num_binds; ++i) {
3230                 u64 range = bind_ops[i].range;
3231                 u64 addr = bind_ops[i].addr;
3232                 u32 op = bind_ops[i].op;
3233                 u64 obj_offset = bind_ops[i].obj_offset;
3234                 u64 tile_mask = bind_ops[i].tile_mask;
3235                 u32 region = bind_ops[i].region;
3236
3237                 vmas[i] = vm_bind_ioctl_lookup_vma(vm, bos[i], obj_offset,
3238                                                    addr, range, op, tile_mask,
3239                                                    region);
3240                 if (IS_ERR(vmas[i])) {
3241                         err = PTR_ERR(vmas[i]);
3242                         vmas[i] = NULL;
3243                         goto destroy_vmas;
3244                 }
3245         }
3246
3247         for (j = 0; j < args->num_binds; ++j) {
3248                 struct xe_sync_entry *__syncs;
3249                 u32 __num_syncs = 0;
3250                 bool first_or_last = j == 0 || j == args->num_binds - 1;
3251
3252                 if (args->num_binds == 1) {
3253                         __num_syncs = num_syncs;
3254                         __syncs = syncs;
3255                 } else if (first_or_last && num_syncs) {
3256                         bool first = j == 0;
3257
3258                         __syncs = kmalloc(sizeof(*__syncs) * num_syncs,
3259                                           GFP_KERNEL);
3260                         if (!__syncs) {
3261                                 err = ENOMEM;
3262                                 break;
3263                         }
3264
3265                         /* in-syncs on first bind, out-syncs on last bind */
3266                         for (i = 0; i < num_syncs; ++i) {
3267                                 bool signal = syncs[i].flags &
3268                                         DRM_XE_SYNC_SIGNAL;
3269
3270                                 if ((first && !signal) || (!first && signal))
3271                                         __syncs[__num_syncs++] = syncs[i];
3272                         }
3273                 } else {
3274                         __num_syncs = 0;
3275                         __syncs = NULL;
3276                 }
3277
3278                 if (async) {
3279                         bool last = j == args->num_binds - 1;
3280
3281                         /*
3282                          * Each pass of async worker drops the ref, take a ref
3283                          * here, 1 set of refs taken above
3284                          */
3285                         if (!last) {
3286                                 if (e)
3287                                         xe_engine_get(e);
3288                                 xe_vm_get(vm);
3289                         }
3290
3291                         err = vm_bind_ioctl_async(vm, vmas[j], e, bos[j],
3292                                                   bind_ops + j, __syncs,
3293                                                   __num_syncs);
3294                         if (err && !last) {
3295                                 if (e)
3296                                         xe_engine_put(e);
3297                                 xe_vm_put(vm);
3298                         }
3299                         if (err)
3300                                 break;
3301                 } else {
3302                         XE_BUG_ON(j != 0);      /* Not supported */
3303                         err = vm_bind_ioctl(vm, vmas[j], e, bos[j],
3304                                             bind_ops + j, __syncs,
3305                                             __num_syncs, NULL);
3306                         break;  /* Needed so cleanup loops work */
3307                 }
3308         }
3309
3310         /* Most of cleanup owned by the async bind worker */
3311         if (async && !err) {
3312                 up_write(&vm->lock);
3313                 if (args->num_binds > 1)
3314                         kfree(syncs);
3315                 goto free_objs;
3316         }
3317
3318 destroy_vmas:
3319         for (i = j; err && i < args->num_binds; ++i) {
3320                 u32 op = bind_ops[i].op;
3321                 struct xe_vma *vma, *next;
3322
3323                 if (!vmas[i])
3324                         break;
3325
3326                 list_for_each_entry_safe(vma, next, &vmas[i]->unbind_link,
3327                                          unbind_link) {
3328                         list_del_init(&vma->unbind_link);
3329                         if (!vma->destroyed) {
3330                                 prep_vma_destroy(vm, vma);
3331                                 xe_vma_destroy_unlocked(vma);
3332                         }
3333                 }
3334
3335                 switch (VM_BIND_OP(op)) {
3336                 case XE_VM_BIND_OP_MAP:
3337                         prep_vma_destroy(vm, vmas[i]);
3338                         xe_vma_destroy_unlocked(vmas[i]);
3339                         break;
3340                 case XE_VM_BIND_OP_MAP_USERPTR:
3341                         prep_vma_destroy(vm, vmas[i]);
3342                         xe_vma_destroy_unlocked(vmas[i]);
3343                         break;
3344                 }
3345         }
3346 release_vm_lock:
3347         up_write(&vm->lock);
3348 free_syncs:
3349         while (num_syncs--) {
3350                 if (async && j &&
3351                     !(syncs[num_syncs].flags & DRM_XE_SYNC_SIGNAL))
3352                         continue;       /* Still in async worker */
3353                 xe_sync_entry_cleanup(&syncs[num_syncs]);
3354         }
3355
3356         kfree(syncs);
3357 put_obj:
3358         for (i = j; i < args->num_binds; ++i)
3359                 xe_bo_put(bos[i]);
3360 put_engine:
3361         if (e)
3362                 xe_engine_put(e);
3363 put_vm:
3364         xe_vm_put(vm);
3365 free_objs:
3366         kfree(bos);
3367         kfree(vmas);
3368         if (args->num_binds > 1)
3369                 kfree(bind_ops);
3370         return err;
3371 }
3372
3373 /*
3374  * XXX: Using the TTM wrappers for now, likely can call into dma-resv code
3375  * directly to optimize. Also this likely should be an inline function.
3376  */
3377 int xe_vm_lock(struct xe_vm *vm, struct ww_acquire_ctx *ww,
3378                int num_resv, bool intr)
3379 {
3380         struct ttm_validate_buffer tv_vm;
3381         LIST_HEAD(objs);
3382         LIST_HEAD(dups);
3383
3384         XE_BUG_ON(!ww);
3385
3386         tv_vm.num_shared = num_resv;
3387         tv_vm.bo = xe_vm_ttm_bo(vm);;
3388         list_add_tail(&tv_vm.head, &objs);
3389
3390         return ttm_eu_reserve_buffers(ww, &objs, intr, &dups);
3391 }
3392
3393 void xe_vm_unlock(struct xe_vm *vm, struct ww_acquire_ctx *ww)
3394 {
3395         dma_resv_unlock(&vm->resv);
3396         ww_acquire_fini(ww);
3397 }
3398
3399 /**
3400  * xe_vm_invalidate_vma - invalidate GPU mappings for VMA without a lock
3401  * @vma: VMA to invalidate
3402  *
3403  * Walks a list of page tables leaves which it memset the entries owned by this
3404  * VMA to zero, invalidates the TLBs, and block until TLBs invalidation is
3405  * complete.
3406  *
3407  * Returns 0 for success, negative error code otherwise.
3408  */
3409 int xe_vm_invalidate_vma(struct xe_vma *vma)
3410 {
3411         struct xe_device *xe = vma->vm->xe;
3412         struct xe_tile *tile;
3413         u32 tile_needs_invalidate = 0;
3414         int seqno[XE_MAX_TILES_PER_DEVICE];
3415         u8 id;
3416         int ret;
3417
3418         XE_BUG_ON(!xe_vm_in_fault_mode(vma->vm));
3419         XE_WARN_ON(xe_vma_is_null(vma));
3420         trace_xe_vma_usm_invalidate(vma);
3421
3422         /* Check that we don't race with page-table updates */
3423         if (IS_ENABLED(CONFIG_PROVE_LOCKING)) {
3424                 if (xe_vma_is_userptr(vma)) {
3425                         WARN_ON_ONCE(!mmu_interval_check_retry
3426                                      (&vma->userptr.notifier,
3427                                       vma->userptr.notifier_seq));
3428                         WARN_ON_ONCE(!dma_resv_test_signaled(&vma->vm->resv,
3429                                                              DMA_RESV_USAGE_BOOKKEEP));
3430
3431                 } else {
3432                         xe_bo_assert_held(vma->bo);
3433                 }
3434         }
3435
3436         for_each_tile(tile, xe, id) {
3437                 if (xe_pt_zap_ptes(tile, vma)) {
3438                         tile_needs_invalidate |= BIT(id);
3439                         xe_device_wmb(xe);
3440                         /*
3441                          * FIXME: We potentially need to invalidate multiple
3442                          * GTs within the tile
3443                          */
3444                         seqno[id] = xe_gt_tlb_invalidation_vma(tile->primary_gt, NULL, vma);
3445                         if (seqno[id] < 0)
3446                                 return seqno[id];
3447                 }
3448         }
3449
3450         for_each_tile(tile, xe, id) {
3451                 if (tile_needs_invalidate & BIT(id)) {
3452                         ret = xe_gt_tlb_invalidation_wait(tile->primary_gt, seqno[id]);
3453                         if (ret < 0)
3454                                 return ret;
3455                 }
3456         }
3457
3458         vma->usm.tile_invalidated = vma->tile_mask;
3459
3460         return 0;
3461 }
3462
3463 int xe_analyze_vm(struct drm_printer *p, struct xe_vm *vm, int gt_id)
3464 {
3465         struct rb_node *node;
3466         bool is_vram;
3467         uint64_t addr;
3468
3469         if (!down_read_trylock(&vm->lock)) {
3470                 drm_printf(p, " Failed to acquire VM lock to dump capture");
3471                 return 0;
3472         }
3473         if (vm->pt_root[gt_id]) {
3474                 addr = xe_bo_addr(vm->pt_root[gt_id]->bo, 0, XE_PAGE_SIZE,
3475                                   &is_vram);
3476                 drm_printf(p, " VM root: A:0x%llx %s\n", addr, is_vram ? "VRAM" : "SYS");
3477         }
3478
3479         for (node = rb_first(&vm->vmas); node; node = rb_next(node)) {
3480                 struct xe_vma *vma = to_xe_vma(node);
3481                 bool is_userptr = xe_vma_is_userptr(vma);
3482                 bool is_null = xe_vma_is_null(vma);
3483
3484                 if (is_null) {
3485                         addr = 0;
3486                 } else if (is_userptr) {
3487                         struct xe_res_cursor cur;
3488
3489                         if (vma->userptr.sg) {
3490                                 xe_res_first_sg(vma->userptr.sg, 0, XE_PAGE_SIZE,
3491                                                 &cur);
3492                                 addr = xe_res_dma(&cur);
3493                         } else {
3494                                 addr = 0;
3495                         }
3496                 } else {
3497                         addr = __xe_bo_addr(vma->bo, 0, XE_PAGE_SIZE, &is_vram);
3498                 }
3499                 drm_printf(p, " [%016llx-%016llx] S:0x%016llx A:%016llx %s\n",
3500                            vma->start, vma->end, vma->end - vma->start + 1ull,
3501                            addr, is_null ? "NULL" : is_userptr ? "USR" :
3502                            is_vram ? "VRAM" : "SYS");
3503         }
3504         up_read(&vm->lock);
3505
3506         return 0;
3507 }