[RFC PATCH 3/3] drm/amdgpu: Disable L2 trap handler when its VA range is unmapped

If userspace removes the TBA or TMA mapping via GEM_VA UNMAP without
calling CLEAR_L2_TRAP first, the GPU still holds a reference to the old
VA. The next shader exception would cause the GPU to jump to an unmapped
address, triggering a page fault or memory corruption.

Intercept UNMAP and CLEAR in amdgpu_gem_va_ioctl(). If the VA range
overlaps the active TBA or TMA, drain the VM scheduler, evict all user
queues, flush the GPU TLB, and zero the TBA/TMA slots before allowing
the unmap to proceed. GEM_VA UNMAP and CLEAR must never return an error
— this path cleans up silently and lets the unmap succeed.

Cc: Christian König <[email protected]>
Cc: Alex Deucher <[email protected]>
Cc: Felix Kuehling <[email protected]>
Cc: James Zhu <[email protected]>
Cc: Lijo Lazar <[email protected]>
Cc: Lancelot Six <[email protected]>
Cc: Pierre-Eric Pelloux-Prayer <[email protected]>
Cc: Timur Kristóf <[email protected]>
Cc: Samuel Pitoiset <[email protected]>
Cc: Natalie Vock <[email protected]>
Signed-off-by: Srinivasan Shanmugam <[email protected]>
Change-Id: I1f103c586c4c5ee444d08bba93a3b6a93d6de98d
---
 drivers/gpu/drm/amd/amdgpu/amdgpu_gem.c | 24 +++++++++++++++++++++++-
 1 file changed, 23 insertions(+), 1 deletion(-)

diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_gem.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_gem.c
index efc270e99b4e..b51b691edb9d 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_gem.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_gem.c
@@ -47,6 +47,8 @@
 #include "amdgpu_hmm.h"
 #include "amdgpu_xgmi.h"
 #include "amdgpu_vm.h"
+#include "amdgpu_cwsr.h"
+#include "amdgpu_userq.h"
 
 static int
 amdgpu_gem_add_input_fence(struct drm_file *filp,
@@ -948,10 +950,31 @@ int amdgpu_gem_va_ioctl(struct drm_device *dev, void *data,
 				     args->flags);
 		break;
 	case AMDGPU_VA_OP_UNMAP:
+		/*
+		 * If the range overlaps an active second-level trap TBA or TMA,
+		 * wait for VM idle, evict queues, flush TLB, and disable the
+		 * handler. UNMAP must not return an error for this condition.
+		 */
+		amdgpu_cwsr_handle_l2_trap_unmap(adev,
+						 &fpriv->vm,
+						 &fpriv->userq_mgr,
+						 fpriv->cwsr_trap,
+						 args->va_address,
+						 args->map_size);
 		r = amdgpu_vm_bo_unmap(adev, bo_va, args->va_address);
 		break;
 
 	case AMDGPU_VA_OP_CLEAR:
+		/*
+		 * Same as VA_OP_UNMAP — disable the handler if needed,
+		 * then clear all mappings in the range.
+		 */
+		amdgpu_cwsr_handle_l2_trap_unmap(adev,
+						 &fpriv->vm,
+						 &fpriv->userq_mgr,
+						 fpriv->cwsr_trap,
+						 args->va_address,
+						 args->map_size);
 		r = amdgpu_vm_bo_clear_mappings(adev, &fpriv->vm,
 						args->va_address,
 						args->map_size);
@@ -991,7 +1014,6 @@ int amdgpu_gem_va_ioctl(struct drm_device *dev, void *data,
 			}
 		}
 		dma_fence_put(fence);
-
 	}
 
 error:
-- 
2.34.1