mirror of
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
synced 2026-08-09 06:14:34 +02:00
Call sequence of double call: pvr_context_destroy pvr_context_kill_queues pvr_queue_kill drm_sched_entity_destroy drm_sched_entity_fini // here pvr_context_put kref_put(..., pvr_context_release) pvr_context_destroy_queues pvr_queue_destroy drm_sched_entity_fini // here Call to drm_sched_entity_destroy() from pvr_context_kill_queues() calls drm_sched_entity_flush() + drm_sched_entity_fini(). drm_sched_entity_flush() ensures all pending jobs are completed and drm_sched_entity_fini() ensures no further submission is allowed as per expectation from pvr_context_kill_queues(). Double call to drm_sched_entity_fini() is misuse of the API so keep call only in pvr_context_create() failure path. Stack trace for issue with addition of refcounting for DRM entity stats in commitfd177135f0("drm/sched: Account entity GPU time"): [ 789.490527] ------------[ cut here ]------------ [ 789.490559] refcount_t: underflow; use-after-free. [ 789.490657] WARNING: lib/refcount.c:28 at refcount_warn_saturate+0xf4/0x144, CPU#0: kworker/u16:1/440 [ 789.490695] Modules linked in: powervr drm_gpuvm drm_exec gpu_sched drm_shmem_helper xhci_plat_hcd xhci_hcd dwc3 usbcore usb_common snd_soc_simple_card snd_soc_simple_card_utils sa2ul sha512 sha256 dwc3_am62 sha1 authenc rti_wdt libsha512 at24 sch_fq_codel fuse dm_mod ipv6 [ 789.490798] CPU: 0 UID: 0 PID: 440 Comm: kworker/u16:1 Not tainted 7.0.0-rc7-02049-g5e2c0700091b #22 PREEMPT [ 789.490809] Hardware name: Texas Instruments AM625 SK (DT) [ 789.490815] Workqueue: powervr-sched pvr_queue_fence_release_work [powervr] [ 789.490868] pstate: 60000005 (nZCv daif -PAN -UAO -TCO -DIT -SSBS BTYPE=--) [ 789.490876] pc : refcount_warn_saturate+0xf4/0x144 [ 789.490884] lr : refcount_warn_saturate+0xf4/0x144 [ 789.490892] sp : ffff8000822cbcc0 [ 789.490895] x29: ffff8000822cbcc0 x28: 0000000000000000 x27: 0000000000000000 [ 789.490909] x26: 0000000000000000 x25: ffff800081b1e338 x24: ffff000004541405 [ 789.490922] x23: ffff000004bea950 x22: ffff00000042e400 x21: ffff000007123e30 [ 789.490935] x20: ffff000007123000 x19: ffff000007a80d50 x18: fffffffffffe7768 [ 789.490948] x17: 74736574202c6e6f x16: 697461746e656d65 x15: ffff800081b269f0 [ 789.490962] x14: 0000000000000030 x13: ffff800081b26a70 x12: 0000000000000211 [ 789.490975] x11: 00000000000000c0 x10: 0000000000000b50 x9 : ffff8000822cbb30 [ 789.490988] x8 : ffff0000014e7bb0 x7 : ffff00007725e780 x6 : 0000000372a05f49 [ 789.491001] x5 : 0000000000000000 x4 : 0000000000000001 x3 : 0000000000000010 [ 789.491013] x2 : 0000000000000000 x1 : 0000000000000000 x0 : ffff0000014e7000 [ 789.491027] Call trace: [ 789.491032] refcount_warn_saturate+0xf4/0x144 (P) [ 789.491043] drm_sched_entity_fini+0x164/0x18c [gpu_sched] [ 789.491081] pvr_queue_destroy+0x64/0x134 [powervr] [ 789.491110] pvr_context_destroy_queues+0x34/0x64 [powervr] [ 789.491138] pvr_context_release+0x70/0xac [powervr] [ 789.491166] pvr_context_put.part.0+0x5c/0x7c [powervr] [ 789.491193] pvr_context_put+0x14/0x24 [powervr] [ 789.491221] pvr_queue_fence_release_work+0x20/0x38 [powervr] [ 789.491249] process_one_work+0x160/0x4c4 [ 789.491264] worker_thread+0x188/0x310 [ 789.491276] kthread+0x130/0x13c [ 789.491287] ret_from_fork+0x10/0x20 [ 789.491300] ---[ end trace 0000000000000000 ]--- Fixes:eaf01ee5ba("drm/imagination: Implement job submission and scheduling") Cc: stable@vger.kernel.org Signed-off-by: Brajesh Gupta <brajesh.gupta@imgtec.com> Reviewed-by: Alessio Belle <alessio.belle@imgtec.com> Link: https://patch.msgid.link/20260630-b4-sched_fix-v7-1-71aa39c62627@imgtec.com Signed-off-by: Alessio Belle <alessio.belle@imgtec.com>
174 lines
4.7 KiB
C
174 lines
4.7 KiB
C
/* SPDX-License-Identifier: GPL-2.0-only OR MIT */
|
|
/* Copyright (c) 2023 Imagination Technologies Ltd. */
|
|
|
|
#ifndef PVR_QUEUE_H
|
|
#define PVR_QUEUE_H
|
|
|
|
#include <drm/gpu_scheduler.h>
|
|
#include <linux/workqueue.h>
|
|
|
|
#include "pvr_cccb.h"
|
|
#include "pvr_device.h"
|
|
|
|
struct pvr_context;
|
|
struct pvr_queue;
|
|
|
|
/**
|
|
* struct pvr_queue_fence_ctx - Queue fence context
|
|
*
|
|
* Used to implement dma_fence_ops for pvr_job::{done,cccb}_fence.
|
|
*/
|
|
struct pvr_queue_fence_ctx {
|
|
/** @id: Fence context ID allocated with dma_fence_context_alloc(). */
|
|
u64 id;
|
|
|
|
/** @seqno: Sequence number incremented each time a fence is created. */
|
|
atomic_t seqno;
|
|
|
|
/** @lock: Lock used to synchronize access to fences allocated by this context. */
|
|
spinlock_t lock;
|
|
};
|
|
|
|
/**
|
|
* struct pvr_queue_cccb_fence_ctx - CCCB fence context
|
|
*
|
|
* Context used to manage fences controlling access to the CCCB. No fences are
|
|
* issued if there's enough space in the CCCB to push job commands.
|
|
*/
|
|
struct pvr_queue_cccb_fence_ctx {
|
|
/** @base: Base queue fence context. */
|
|
struct pvr_queue_fence_ctx base;
|
|
|
|
/**
|
|
* @job: Job waiting for CCCB space.
|
|
*
|
|
* Thanks to the serializationg done at the drm_sched_entity level,
|
|
* there's no more than one job waiting for CCCB at a given time.
|
|
*
|
|
* This field is NULL if no jobs are currently waiting for CCCB space.
|
|
*
|
|
* Must be accessed with @job_lock held.
|
|
*/
|
|
struct pvr_job *job;
|
|
|
|
/** @job_lock: Lock protecting access to the job object. */
|
|
struct mutex job_lock;
|
|
};
|
|
|
|
/**
|
|
* struct pvr_queue_fence - Queue fence object
|
|
*/
|
|
struct pvr_queue_fence {
|
|
/** @base: Base dma_fence. */
|
|
struct dma_fence base;
|
|
|
|
/** @queue: Queue that created this fence. */
|
|
struct pvr_queue *queue;
|
|
|
|
/** @release_work: Fence release work structure. */
|
|
struct work_struct release_work;
|
|
};
|
|
|
|
/**
|
|
* struct pvr_queue - Job queue
|
|
*
|
|
* Used to queue and track execution of pvr_job objects.
|
|
*/
|
|
struct pvr_queue {
|
|
/** @scheduler: Single entity scheduler use to push jobs to this queue. */
|
|
struct drm_gpu_scheduler scheduler;
|
|
|
|
/** @entity: Scheduling entity backing this queue. */
|
|
struct drm_sched_entity entity;
|
|
|
|
/** @type: Type of jobs queued to this queue. */
|
|
enum drm_pvr_job_type type;
|
|
|
|
/** @ctx: Context object this queue is bound to. */
|
|
struct pvr_context *ctx;
|
|
|
|
/** @node: Used to add the queue to the active/idle queue list. */
|
|
struct list_head node;
|
|
|
|
/**
|
|
* @in_flight_job_count: Number of jobs submitted to the CCCB that
|
|
* have not been processed yet.
|
|
*/
|
|
atomic_t in_flight_job_count;
|
|
|
|
/**
|
|
* @cccb_fence_ctx: CCCB fence context.
|
|
*
|
|
* Used to control access to the CCCB is full, such that we don't
|
|
* end up trying to push commands to the CCCB if there's not enough
|
|
* space to receive all commands needed for a job to complete.
|
|
*/
|
|
struct pvr_queue_cccb_fence_ctx cccb_fence_ctx;
|
|
|
|
/** @job_fence_ctx: Job fence context object. */
|
|
struct pvr_queue_fence_ctx job_fence_ctx;
|
|
|
|
/** @timeline_ufo: Timeline UFO for the context queue. */
|
|
struct {
|
|
/** @fw_obj: FW object representing the UFO value. */
|
|
struct pvr_fw_object *fw_obj;
|
|
|
|
/** @value: CPU mapping of the UFO value. */
|
|
u32 *value;
|
|
} timeline_ufo;
|
|
|
|
/**
|
|
* @last_queued_job_scheduled_fence: The scheduled fence of the last
|
|
* job queued to this queue.
|
|
*
|
|
* We use it to insert frag -> geom dependencies when issuing combined
|
|
* geom+frag jobs, to guarantee that the fragment job that's part of
|
|
* the combined operation comes after all fragment jobs that were queued
|
|
* before it.
|
|
*/
|
|
struct dma_fence *last_queued_job_scheduled_fence;
|
|
|
|
/** @cccb: Client Circular Command Buffer. */
|
|
struct pvr_cccb cccb;
|
|
|
|
/** @reg_state_obj: FW object representing the register state of this queue. */
|
|
struct pvr_fw_object *reg_state_obj;
|
|
|
|
/** @ctx_offset: Offset of the queue context in the FW context object. */
|
|
u32 ctx_offset;
|
|
|
|
/** @callstack_addr: Initial call stack address for register state object. */
|
|
u64 callstack_addr;
|
|
};
|
|
|
|
bool pvr_queue_fence_is_native(struct dma_fence *f);
|
|
|
|
int pvr_queue_job_init(struct pvr_job *job, u64 drm_client_id);
|
|
|
|
void pvr_queue_job_cleanup(struct pvr_job *job);
|
|
|
|
void pvr_queue_job_push(struct pvr_job *job);
|
|
|
|
struct dma_fence *pvr_queue_job_arm(struct pvr_job *job);
|
|
|
|
struct pvr_queue *pvr_queue_create(struct pvr_context *ctx,
|
|
enum drm_pvr_job_type type,
|
|
struct drm_pvr_ioctl_create_context_args *args,
|
|
void *fw_ctx_map);
|
|
|
|
void pvr_queue_kill(struct pvr_queue *queue);
|
|
|
|
void pvr_queue_destroy(struct pvr_queue *queue, bool cleanup_queue_entity);
|
|
|
|
void pvr_queue_process(struct pvr_queue *queue);
|
|
|
|
void pvr_queue_device_pre_reset(struct pvr_device *pvr_dev);
|
|
|
|
void pvr_queue_device_post_reset(struct pvr_device *pvr_dev);
|
|
|
|
int pvr_queue_device_init(struct pvr_device *pvr_dev);
|
|
|
|
void pvr_queue_device_fini(struct pvr_device *pvr_dev);
|
|
|
|
#endif /* PVR_QUEUE_H */
|