From patchwork Tue Jul 2 02:11:28 2024 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Zack Rusin X-Patchwork-Id: 13718900 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from gabe.freedesktop.org (gabe.freedesktop.org [131.252.210.177]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.lore.kernel.org (Postfix) with ESMTPS id B106DC2BD09 for ; Tue, 2 Jul 2024 02:13:03 +0000 (UTC) Received: from gabe.freedesktop.org (localhost [127.0.0.1]) by gabe.freedesktop.org (Postfix) with ESMTP id D850210E091; Tue, 2 Jul 2024 02:12:59 +0000 (UTC) Authentication-Results: gabe.freedesktop.org; dkim=pass (1024-bit key; unprotected) header.d=broadcom.com header.i=@broadcom.com header.b="KARVOUuO"; dkim-atps=neutral Received: from mail-qv1-f41.google.com (mail-qv1-f41.google.com [209.85.219.41]) by gabe.freedesktop.org (Postfix) with ESMTPS id E0B2910E090 for ; Tue, 2 Jul 2024 02:12:58 +0000 (UTC) Received: by mail-qv1-f41.google.com with SMTP id 6a1803df08f44-6b4f7541d7eso18165376d6.0 for ; Mon, 01 Jul 2024 19:12:58 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=broadcom.com; s=google; t=1719886377; x=1720491177; darn=lists.freedesktop.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to; bh=D1Q+WtxgLGLDV4vft3U4bEIvX489UvKjK9odMCfURBQ=; b=KARVOUuO5VhkUWCp7dR2A3BOa0JmLFpiVnSASSoGQApsgqLWZhssi9c9O3V581hX8I Tp5/wQ+dyooDR1T2WKVxNVw3+BC6THQy4JdUDp4dJHQK6us2g2not/pYnC9Q4T4rMrqj C2LbZwuVeqG5we9LX9cN+aBECcniHkEeAEYa8= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1719886377; x=1720491177; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-message-state:from:to:cc :subject:date:message-id:reply-to; bh=D1Q+WtxgLGLDV4vft3U4bEIvX489UvKjK9odMCfURBQ=; b=Fd6+rcGgTtvIAFtrNJMF9+qpqSNgmMVwJS4zxO5zw+jg+5XDvPw5DoCX6SSiQ3lLrM Y+0YN4WFh9fFSQZJOfywm23cg6OObirc1uzfD1yw1v+S1/UMACzARHjK+MvCwKTJrhi5 VmhpYJdXOpXaf76z+dEaOwrvS4Tb1HTXNXg/9CL9q6DbZTc4J8luYAMyx678bZxl1jEy BVE2UOU1QdsDihM1C4goW6flVXLNjV8RY8DD24n9Rz92mYXMzIhJCxefUiu3iKf08iB6 nmQbcWt4QStPzg0lL6y/7Vstjt9VrAfKu6GjXoD3toa9xCqIhEW/4sIRqzaV4hdNONxf vagw== X-Gm-Message-State: AOJu0YzWB2Zj9wd0y6XqboIM1fzx8WKSxbA0fmTq/OlqZua/6/5nXsb2 IZth/Ct3yQmK+F31sDYxErNPY2nN/hdmfcKXqcfyptSoPyfBZ3zemIqxzSL4HqQM5Yeqasb2c2u GUJqRRgZhGsu8wx+RbPzm2owEh6fpgjSfeBPdmGu2o4z/CWX2QYSQXLP/jjzAAwFVXMtTqqIJf+ D/xqiwZmm/Gk7KOqljm7CrPTQ49n6q0l0Cy836sQLKh9v9pF9Z7f2Z X-Google-Smtp-Source: AGHT+IGkfFiZLS1eY1teEvJp8VZMDP+EIvWeyyO5foWoZDpHQ9zeFwX1pqSQXaNInlRBbr6dco1E4A== X-Received: by 2002:a05:6214:5196:b0:6b5:d663:bb53 with SMTP id 6a1803df08f44-6b5d663bd86mr1834756d6.5.1719886377475; Mon, 01 Jul 2024 19:12:57 -0700 (PDT) Received: from vertex.vmware.com (pool-173-49-113-140.phlapa.fios.verizon.net. [173.49.113.140]) by smtp.gmail.com with ESMTPSA id 6a1803df08f44-6b5bcf1acc0sm21799366d6.44.2024.07.01.19.12.56 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Mon, 01 Jul 2024 19:12:57 -0700 (PDT) From: Zack Rusin To: dri-devel@lists.freedesktop.org Cc: Broadcom internal kernel review list , ian.forbes@broadcom.com, martin.krastev@broadcom.com, maaz.mombasawala@broadcom.com, Zack Rusin , stable@vger.kernel.org Subject: [PATCH v3 1/4] drm/vmwgfx: Fix a deadlock in dma buf fence polling Date: Mon, 1 Jul 2024 22:11:28 -0400 Message-ID: <20240702021254.1610188-2-zack.rusin@broadcom.com> X-Mailer: git-send-email 2.43.0 In-Reply-To: <20240702021254.1610188-1-zack.rusin@broadcom.com> References: <20240702021254.1610188-1-zack.rusin@broadcom.com> MIME-Version: 1.0 X-BeenThere: dri-devel@lists.freedesktop.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Direct Rendering Infrastructure - Development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: dri-devel-bounces@lists.freedesktop.org Sender: "dri-devel" Introduce a version of the fence ops that on release doesn't remove the fence from the pending list, and thus doesn't require a lock to fix poll->fence wait->fence unref deadlocks. vmwgfx overwrites the wait callback to iterate over the list of all fences and update their status, to do that it holds a lock to prevent the list modifcations from other threads. The fence destroy callback both deletes the fence and removes it from the list of pending fences, for which it holds a lock. dma buf polling cb unrefs a fence after it's been signaled: so the poll calls the wait, which signals the fences, which are being destroyed. The destruction tries to acquire the lock on the pending fences list which it can never get because it's held by the wait from which it was called. Old bug, but not a lot of userspace apps were using dma-buf polling interfaces. Fix those, in particular this fixes KDE stalls/deadlock. Signed-off-by: Zack Rusin Fixes: 2298e804e96e ("drm/vmwgfx: rework to new fence interface, v2") Cc: Broadcom internal kernel review list Cc: dri-devel@lists.freedesktop.org Cc: # v6.2+ Reviewed-by: Martin Krastev --- drivers/gpu/drm/vmwgfx/vmwgfx_fence.c | 17 +++++++---------- 1 file changed, 7 insertions(+), 10 deletions(-) diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_fence.c b/drivers/gpu/drm/vmwgfx/vmwgfx_fence.c index 5efc6a766f64..588d50ababf6 100644 --- a/drivers/gpu/drm/vmwgfx/vmwgfx_fence.c +++ b/drivers/gpu/drm/vmwgfx/vmwgfx_fence.c @@ -32,7 +32,6 @@ #define VMW_FENCE_WRAP (1 << 31) struct vmw_fence_manager { - int num_fence_objects; struct vmw_private *dev_priv; spinlock_t lock; struct list_head fence_list; @@ -124,13 +123,13 @@ static void vmw_fence_obj_destroy(struct dma_fence *f) { struct vmw_fence_obj *fence = container_of(f, struct vmw_fence_obj, base); - struct vmw_fence_manager *fman = fman_from_fence(fence); - spin_lock(&fman->lock); - list_del_init(&fence->head); - --fman->num_fence_objects; - spin_unlock(&fman->lock); + if (!list_empty(&fence->head)) { + spin_lock(&fman->lock); + list_del_init(&fence->head); + spin_unlock(&fman->lock); + } fence->destroy(fence); } @@ -257,7 +256,6 @@ static const struct dma_fence_ops vmw_fence_ops = { .release = vmw_fence_obj_destroy, }; - /* * Execute signal actions on fences recently signaled. * This is done from a workqueue so we don't have to execute @@ -355,7 +353,6 @@ static int vmw_fence_obj_init(struct vmw_fence_manager *fman, goto out_unlock; } list_add_tail(&fence->head, &fman->fence_list); - ++fman->num_fence_objects; out_unlock: spin_unlock(&fman->lock); @@ -403,7 +400,7 @@ static bool vmw_fence_goal_new_locked(struct vmw_fence_manager *fman, u32 passed_seqno) { u32 goal_seqno; - struct vmw_fence_obj *fence; + struct vmw_fence_obj *fence, *next_fence; if (likely(!fman->seqno_valid)) return false; @@ -413,7 +410,7 @@ static bool vmw_fence_goal_new_locked(struct vmw_fence_manager *fman, return false; fman->seqno_valid = false; - list_for_each_entry(fence, &fman->fence_list, head) { + list_for_each_entry_safe(fence, next_fence, &fman->fence_list, head) { if (!list_empty(&fence->seq_passed_actions)) { fman->seqno_valid = true; vmw_fence_goal_write(fman->dev_priv,