Files
linux-stable-mirror/drivers/gpu/drm/imagination/pvr_queue.h
T
Brajesh GuptaandAlessio Belle 4af24c27a3 drm/imagination: Fix double call to drm_sched_entity_fini()
Call sequence of double call:
pvr_context_destroy
  pvr_context_kill_queues
    pvr_queue_kill
      drm_sched_entity_destroy
        drm_sched_entity_fini // here
  pvr_context_put
    kref_put(..., pvr_context_release)
      pvr_context_destroy_queues
        pvr_queue_destroy
          drm_sched_entity_fini // here

Call to drm_sched_entity_destroy() from pvr_context_kill_queues() calls
drm_sched_entity_flush() + drm_sched_entity_fini().
drm_sched_entity_flush() ensures all pending jobs are completed and
drm_sched_entity_fini() ensures no further submission is allowed as
per expectation from pvr_context_kill_queues(). Double call to
drm_sched_entity_fini() is misuse of the API so keep call only in
pvr_context_create() failure path.

Stack trace for issue with addition of refcounting for DRM entity
stats in commit fd177135f0 ("drm/sched: Account entity GPU time"):

[  789.490527] ------------[ cut here ]------------
[  789.490559] refcount_t: underflow; use-after-free.
[  789.490657] WARNING: lib/refcount.c:28 at refcount_warn_saturate+0xf4/0x144, CPU#0: kworker/u16:1/440
[  789.490695] Modules linked in: powervr drm_gpuvm drm_exec gpu_sched drm_shmem_helper xhci_plat_hcd xhci_hcd dwc3 usbcore usb_common snd_soc_simple_card snd_soc_simple_card_utils sa2ul sha512 sha256 dwc3_am62 sha1 authenc rti_wdt libsha512 at24 sch_fq_codel fuse dm_mod ipv6
[  789.490798] CPU: 0 UID: 0 PID: 440 Comm: kworker/u16:1 Not tainted 7.0.0-rc7-02049-g5e2c0700091b #22 PREEMPT
[  789.490809] Hardware name: Texas Instruments AM625 SK (DT)
[  789.490815] Workqueue: powervr-sched pvr_queue_fence_release_work [powervr]
[  789.490868] pstate: 60000005 (nZCv daif -PAN -UAO -TCO -DIT -SSBS BTYPE=--)
[  789.490876] pc : refcount_warn_saturate+0xf4/0x144
[  789.490884] lr : refcount_warn_saturate+0xf4/0x144
[  789.490892] sp : ffff8000822cbcc0
[  789.490895] x29: ffff8000822cbcc0 x28: 0000000000000000 x27: 0000000000000000
[  789.490909] x26: 0000000000000000 x25: ffff800081b1e338 x24: ffff000004541405
[  789.490922] x23: ffff000004bea950 x22: ffff00000042e400 x21: ffff000007123e30
[  789.490935] x20: ffff000007123000 x19: ffff000007a80d50 x18: fffffffffffe7768
[  789.490948] x17: 74736574202c6e6f x16: 697461746e656d65 x15: ffff800081b269f0
[  789.490962] x14: 0000000000000030 x13: ffff800081b26a70 x12: 0000000000000211
[  789.490975] x11: 00000000000000c0 x10: 0000000000000b50 x9 : ffff8000822cbb30
[  789.490988] x8 : ffff0000014e7bb0 x7 : ffff00007725e780 x6 : 0000000372a05f49
[  789.491001] x5 : 0000000000000000 x4 : 0000000000000001 x3 : 0000000000000010
[  789.491013] x2 : 0000000000000000 x1 : 0000000000000000 x0 : ffff0000014e7000
[  789.491027] Call trace:
[  789.491032]  refcount_warn_saturate+0xf4/0x144 (P)
[  789.491043]  drm_sched_entity_fini+0x164/0x18c [gpu_sched]
[  789.491081]  pvr_queue_destroy+0x64/0x134 [powervr]
[  789.491110]  pvr_context_destroy_queues+0x34/0x64 [powervr]
[  789.491138]  pvr_context_release+0x70/0xac [powervr]
[  789.491166]  pvr_context_put.part.0+0x5c/0x7c [powervr]
[  789.491193]  pvr_context_put+0x14/0x24 [powervr]
[  789.491221]  pvr_queue_fence_release_work+0x20/0x38 [powervr]
[  789.491249]  process_one_work+0x160/0x4c4
[  789.491264]  worker_thread+0x188/0x310
[  789.491276]  kthread+0x130/0x13c
[  789.491287]  ret_from_fork+0x10/0x20
[  789.491300] ---[ end trace 0000000000000000 ]---

Fixes: eaf01ee5ba ("drm/imagination: Implement job submission and scheduling")
Cc: stable@vger.kernel.org
Signed-off-by: Brajesh Gupta <brajesh.gupta@imgtec.com>
Reviewed-by: Alessio Belle <alessio.belle@imgtec.com>
Link: https://patch.msgid.link/20260630-b4-sched_fix-v7-1-71aa39c62627@imgtec.com
Signed-off-by: Alessio Belle <alessio.belle@imgtec.com>
2026-07-02 11:15:35 +01:00

174 lines
4.7 KiB
C

/* SPDX-License-Identifier: GPL-2.0-only OR MIT */
/* Copyright (c) 2023 Imagination Technologies Ltd. */
#ifndef PVR_QUEUE_H
#define PVR_QUEUE_H
#include <drm/gpu_scheduler.h>
#include <linux/workqueue.h>
#include "pvr_cccb.h"
#include "pvr_device.h"
struct pvr_context;
struct pvr_queue;
/**
* struct pvr_queue_fence_ctx - Queue fence context
*
* Used to implement dma_fence_ops for pvr_job::{done,cccb}_fence.
*/
struct pvr_queue_fence_ctx {
/** @id: Fence context ID allocated with dma_fence_context_alloc(). */
u64 id;
/** @seqno: Sequence number incremented each time a fence is created. */
atomic_t seqno;
/** @lock: Lock used to synchronize access to fences allocated by this context. */
spinlock_t lock;
};
/**
* struct pvr_queue_cccb_fence_ctx - CCCB fence context
*
* Context used to manage fences controlling access to the CCCB. No fences are
* issued if there's enough space in the CCCB to push job commands.
*/
struct pvr_queue_cccb_fence_ctx {
/** @base: Base queue fence context. */
struct pvr_queue_fence_ctx base;
/**
* @job: Job waiting for CCCB space.
*
* Thanks to the serializationg done at the drm_sched_entity level,
* there's no more than one job waiting for CCCB at a given time.
*
* This field is NULL if no jobs are currently waiting for CCCB space.
*
* Must be accessed with @job_lock held.
*/
struct pvr_job *job;
/** @job_lock: Lock protecting access to the job object. */
struct mutex job_lock;
};
/**
* struct pvr_queue_fence - Queue fence object
*/
struct pvr_queue_fence {
/** @base: Base dma_fence. */
struct dma_fence base;
/** @queue: Queue that created this fence. */
struct pvr_queue *queue;
/** @release_work: Fence release work structure. */
struct work_struct release_work;
};
/**
* struct pvr_queue - Job queue
*
* Used to queue and track execution of pvr_job objects.
*/
struct pvr_queue {
/** @scheduler: Single entity scheduler use to push jobs to this queue. */
struct drm_gpu_scheduler scheduler;
/** @entity: Scheduling entity backing this queue. */
struct drm_sched_entity entity;
/** @type: Type of jobs queued to this queue. */
enum drm_pvr_job_type type;
/** @ctx: Context object this queue is bound to. */
struct pvr_context *ctx;
/** @node: Used to add the queue to the active/idle queue list. */
struct list_head node;
/**
* @in_flight_job_count: Number of jobs submitted to the CCCB that
* have not been processed yet.
*/
atomic_t in_flight_job_count;
/**
* @cccb_fence_ctx: CCCB fence context.
*
* Used to control access to the CCCB is full, such that we don't
* end up trying to push commands to the CCCB if there's not enough
* space to receive all commands needed for a job to complete.
*/
struct pvr_queue_cccb_fence_ctx cccb_fence_ctx;
/** @job_fence_ctx: Job fence context object. */
struct pvr_queue_fence_ctx job_fence_ctx;
/** @timeline_ufo: Timeline UFO for the context queue. */
struct {
/** @fw_obj: FW object representing the UFO value. */
struct pvr_fw_object *fw_obj;
/** @value: CPU mapping of the UFO value. */
u32 *value;
} timeline_ufo;
/**
* @last_queued_job_scheduled_fence: The scheduled fence of the last
* job queued to this queue.
*
* We use it to insert frag -> geom dependencies when issuing combined
* geom+frag jobs, to guarantee that the fragment job that's part of
* the combined operation comes after all fragment jobs that were queued
* before it.
*/
struct dma_fence *last_queued_job_scheduled_fence;
/** @cccb: Client Circular Command Buffer. */
struct pvr_cccb cccb;
/** @reg_state_obj: FW object representing the register state of this queue. */
struct pvr_fw_object *reg_state_obj;
/** @ctx_offset: Offset of the queue context in the FW context object. */
u32 ctx_offset;
/** @callstack_addr: Initial call stack address for register state object. */
u64 callstack_addr;
};
bool pvr_queue_fence_is_native(struct dma_fence *f);
int pvr_queue_job_init(struct pvr_job *job, u64 drm_client_id);
void pvr_queue_job_cleanup(struct pvr_job *job);
void pvr_queue_job_push(struct pvr_job *job);
struct dma_fence *pvr_queue_job_arm(struct pvr_job *job);
struct pvr_queue *pvr_queue_create(struct pvr_context *ctx,
enum drm_pvr_job_type type,
struct drm_pvr_ioctl_create_context_args *args,
void *fw_ctx_map);
void pvr_queue_kill(struct pvr_queue *queue);
void pvr_queue_destroy(struct pvr_queue *queue, bool cleanup_queue_entity);
void pvr_queue_process(struct pvr_queue *queue);
void pvr_queue_device_pre_reset(struct pvr_device *pvr_dev);
void pvr_queue_device_post_reset(struct pvr_device *pvr_dev);
int pvr_queue_device_init(struct pvr_device *pvr_dev);
void pvr_queue_device_fini(struct pvr_device *pvr_dev);
#endif /* PVR_QUEUE_H */