From patchwork Thu Apr 4 10:24:45 2019 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Janusz Krzysztofik X-Patchwork-Id: 10885387 Return-Path: Received: from mail.wl.linuxfoundation.org (pdx-wl-mail.web.codeaurora.org [172.30.200.125]) by pdx-korg-patchwork-2.web.codeaurora.org (Postfix) with ESMTP id D1149139A for ; Thu, 4 Apr 2019 10:24:58 +0000 (UTC) Received: from mail.wl.linuxfoundation.org (localhost [127.0.0.1]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id B916028496 for ; Thu, 4 Apr 2019 10:24:58 +0000 (UTC) Received: by mail.wl.linuxfoundation.org (Postfix, from userid 486) id AD4AB285C7; Thu, 4 Apr 2019 10:24:58 +0000 (UTC) X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on pdx-wl-mail.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-5.2 required=2.0 tests=BAYES_00,MAILING_LIST_MULTI, RCVD_IN_DNSWL_MED autolearn=unavailable version=3.3.1 Received: from gabe.freedesktop.org (gabe.freedesktop.org [131.252.210.177]) (using TLSv1.2 with cipher DHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.wl.linuxfoundation.org (Postfix) with ESMTPS id 669C728496 for ; Thu, 4 Apr 2019 10:24:58 +0000 (UTC) Received: from gabe.freedesktop.org (localhost [127.0.0.1]) by gabe.freedesktop.org (Postfix) with ESMTP id C53106E58C; Thu, 4 Apr 2019 10:24:55 +0000 (UTC) X-Original-To: dri-devel@lists.freedesktop.org Delivered-To: dri-devel@lists.freedesktop.org Received: from mga09.intel.com (mga09.intel.com [134.134.136.24]) by gabe.freedesktop.org (Postfix) with ESMTPS id 22FA16E58B; Thu, 4 Apr 2019 10:24:54 +0000 (UTC) X-Amp-Result: SKIPPED(no attachment in message) X-Amp-File-Uploaded: False Received: from orsmga008.jf.intel.com ([10.7.209.65]) by orsmga102.jf.intel.com with ESMTP/TLS/DHE-RSA-AES256-GCM-SHA384; 04 Apr 2019 03:24:53 -0700 X-IronPort-AV: E=Sophos;i="5.60,308,1549958400"; d="scan'208";a="131386438" Received: from jkrzyszt-desk.igk.intel.com ([172.22.244.18]) by orsmga008-auth.jf.intel.com with ESMTP/TLS/DHE-RSA-AES256-GCM-SHA384; 04 Apr 2019 03:24:50 -0700 From: Janusz Krzysztofik To: Joonas Lahtinen , Jani Nikula , Rodrigo Vivi Subject: [PATCH] drm/i915: Fix context IDs not released on driver hot unbind Date: Thu, 4 Apr 2019 12:24:45 +0200 Message-Id: <20190404102445.12303-1-janusz.krzysztofik@linux.intel.com> X-Mailer: git-send-email 2.20.1 MIME-Version: 1.0 X-BeenThere: dri-devel@lists.freedesktop.org X-Mailman-Version: 2.1.23 Precedence: list List-Id: Direct Rendering Infrastructure - Development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Cc: Janusz Krzysztofik , David Airlie , intel-gfx@lists.freedesktop.org, linux-kernel@vger.kernel.org, dri-devel@lists.freedesktop.org, michal.wajdeczko@intel.com Errors-To: dri-devel-bounces@lists.freedesktop.org Sender: "dri-devel" X-Virus-Scanned: ClamAV using ClamSMTP From: Janusz Krzysztofik In case the driver gets unbound while a device is open, kernel panic may be forced if a list of allocated context IDs is not empty. When a device is open, the list may happen to be not empty because a context ID, once allocated by a context ID allocator to a context assosiated with that open file descriptor, is released as late as on device close. On the other hand, there is a need to release all allocated context IDs and destroy the context ID allocator on driver unbind, even if a device is open, in order to free memory resources consumed and prevent from memory leaks. The purpose of the forced kernel panic was to protect the context ID allocator from being silently destroyed if not all allocated IDs had been released. Before forcing the kernel panic on non-empty list of allocated context IDs, do that unlikely on non-empty list of contexts that should be freed by preceding drain of work queue (there must be another bug if that list happens to be not empty). If empty, we may assume that remaining contexts are idle (not pinned) and their IDs can be safely released. Once done, release context IDs of each of those remaining contexts unless it happens a context is unlikely pinned. Force kernel panic in that case, there must be still another bug in the driver code. Now the kernel panic protecting the allocator should not pop up as the list it checks should be empty. If it unlikely happens to be not empty, there must be still another bug. Signed-off-by: Janusz Krzysztofik --- drivers/gpu/drm/i915/i915_gem_context.c | 10 ++++++++++ 1 file changed, 10 insertions(+) diff --git a/drivers/gpu/drm/i915/i915_gem_context.c b/drivers/gpu/drm/i915/i915_gem_context.c index 280813a4bf82..18d004d94e43 100644 --- a/drivers/gpu/drm/i915/i915_gem_context.c +++ b/drivers/gpu/drm/i915/i915_gem_context.c @@ -611,6 +611,8 @@ void i915_gem_contexts_lost(struct drm_i915_private *dev_priv) void i915_gem_contexts_fini(struct drm_i915_private *i915) { + struct i915_gem_context *ctx, *cn; + lockdep_assert_held(&i915->drm.struct_mutex); if (i915->preempt_context) @@ -618,6 +620,14 @@ void i915_gem_contexts_fini(struct drm_i915_private *i915) destroy_kernel_context(&i915->kernel_context); /* Must free all deferred contexts (via flush_workqueue) first */ + GEM_BUG_ON(!llist_empty(&i915->contexts.free_list)); + + /* Release all remaining HW IDs before ID allocator is destroyed */ + list_for_each_entry_safe(ctx, cn, &i915->contexts.hw_id_list, + hw_id_link) { + GEM_BUG_ON(atomic_read(&ctx->hw_id_pin_count)); + release_hw_id(ctx); + } GEM_BUG_ON(!list_empty(&i915->contexts.hw_id_list)); ida_destroy(&i915->contexts.hw_ida); }