Re: [PATCH v2 01/11] drm/sched: Split drm_sched_job_init

Christian König <christian.koenig@xxxxxxx> · Wed, 7 Jul 2021 14:58:10 +0200

Am 07.07.21 um 14:13 schrieb Daniel Vetter:
On Wed, Jul 7, 2021 at 1:57 PM Christian König <christian.koenig@xxxxxxx> wrote:
Am 07.07.21 um 13:14 schrieb Daniel Vetter:
On Wed, Jul 7, 2021 at 11:30 AM Christian König
<christian.koenig@xxxxxxx> wrote:
Am 02.07.21 um 23:38 schrieb Daniel Vetter:
This is a very confusingly named function, because not just does it
init an object, it arms it and provides a point of no return for
pushing a job into the scheduler. It would be nice if that's a bit
clearer in the interface.

But the real reason is that I want to push the dependency tracking
helpers into the scheduler code, and that means drm_sched_job_init
must be called a lot earlier, without arming the job.

v2:
- don't change .gitignore (Steven)
- don't forget v3d (Emma)

v3: Emma noticed that I leak the memory allocated in
drm_sched_job_init if we bail out before the point of no return in
subsequent driver patches. To be able to fix this change
drm_sched_job_cleanup() so it can handle being called both before and
after drm_sched_job_arm().
Thinking more about this, I'm not sure if this really works.

See drm_sched_job_init() was also calling drm_sched_entity_select_rq()
to update the entity->rq association.

And that can only be done later on when we arm the fence as well.
Hm yeah, but that's a bug in the existing code I think: We already
fail to clean up if we fail to allocate the fences. So I think the
right thing to do here is to split the checks into job_init, and do
the actual arming/rq selection in job_arm? I'm not entirely sure
what's all going on there, the first check looks a bit like trying to
schedule before the entity is set up, which is a driver bug and should
have a WARN_ON?
No you misunderstood me, the problem is something else.

You asked previously why the call to drm_sched_job_init() was so late in
the CS.

The reason for this was not alone the scheduler fence init, but also the
call to drm_sched_entity_select_rq().
Ah ok, I think I can fix that. Needs a prep patch to first make
drm_sched_entity_select infallible, then should be easy to do.

The 2nd check around last_scheduled I have honeslty no idea what it's
even trying to do.
You mean that here?

          fence = READ_ONCE(entity->last_scheduled);
          if (fence && !dma_fence_is_signaled(fence))
                  return;

This makes sure that load balancing is not moving the entity to a
different scheduler while there are still jobs running from this entity
on the hardware,
Yeah after a nap that idea crossed my mind too. But now I have locking
questions, afaiui the scheduler thread updates this, without taking
any locks - entity dequeuing is lockless. And here we read the fence
and then seem to yolo check whether it's signalled? What's preventing
a use-after-free here? There's no rcu or anything going on here at
all, and it's outside of the spinlock section, which starts a bit
further down.

The last_scheduled fence of an entity can only change when there are 
jobs on the entities queued, and we have just ruled that out in the 
check before.

Christian.


-Daniel

Regards
Christian.

-Daniel

Christian.

Also improve the kerneldoc for this.

Acked-by: Steven Price <steven.price@xxxxxxx> (v2)
Signed-off-by: Daniel Vetter <daniel.vetter@xxxxxxxxx>
Cc: Lucas Stach <l.stach@xxxxxxxxxxxxxx>
Cc: Russell King <linux+etnaviv@xxxxxxxxxxxxxxx>
Cc: Christian Gmeiner <christian.gmeiner@xxxxxxxxx>
Cc: Qiang Yu <yuq825@xxxxxxxxx>
Cc: Rob Herring <robh@xxxxxxxxxx>
Cc: Tomeu Vizoso <tomeu.vizoso@xxxxxxxxxxxxx>
Cc: Steven Price <steven.price@xxxxxxx>
Cc: Alyssa Rosenzweig <alyssa.rosenzweig@xxxxxxxxxxxxx>
Cc: David Airlie <airlied@xxxxxxxx>
Cc: Daniel Vetter <daniel@xxxxxxxx>
Cc: Sumit Semwal <sumit.semwal@xxxxxxxxxx>
Cc: "Christian König" <christian.koenig@xxxxxxx>
Cc: Masahiro Yamada <masahiroy@xxxxxxxxxx>
Cc: Kees Cook <keescook@xxxxxxxxxxxx>
Cc: Adam Borowski <kilobyte@xxxxxxxxxx>
Cc: Nick Terrell <terrelln@xxxxxx>
Cc: Mauro Carvalho Chehab <mchehab+huawei@xxxxxxxxxx>
Cc: Paul Menzel <pmenzel@xxxxxxxxxxxxx>
Cc: Sami Tolvanen <samitolvanen@xxxxxxxxxx>
Cc: Viresh Kumar <viresh.kumar@xxxxxxxxxx>
Cc: Alex Deucher <alexander.deucher@xxxxxxx>
Cc: Dave Airlie <airlied@xxxxxxxxxx>
Cc: Nirmoy Das <nirmoy.das@xxxxxxx>
Cc: Deepak R Varma <mh12gx2825@xxxxxxxxx>
Cc: Lee Jones <lee.jones@xxxxxxxxxx>
Cc: Kevin Wang <kevin1.wang@xxxxxxx>
Cc: Chen Li <chenli@xxxxxxxxxxxxx>
Cc: Luben Tuikov <luben.tuikov@xxxxxxx>
Cc: "Marek Olšák" <marek.olsak@xxxxxxx>
Cc: Dennis Li <Dennis.Li@xxxxxxx>
Cc: Maarten Lankhorst <maarten.lankhorst@xxxxxxxxxxxxxxx>
Cc: Andrey Grodzovsky <andrey.grodzovsky@xxxxxxx>
Cc: Sonny Jiang <sonny.jiang@xxxxxxx>
Cc: Boris Brezillon <boris.brezillon@xxxxxxxxxxxxx>
Cc: Tian Tao <tiantao6@xxxxxxxxxxxxx>
Cc: Jack Zhang <Jack.Zhang1@xxxxxxx>
Cc: etnaviv@xxxxxxxxxxxxxxxxxxxxx
Cc: lima@xxxxxxxxxxxxxxxxxxxxx
Cc: linux-media@xxxxxxxxxxxxxxx
Cc: linaro-mm-sig@xxxxxxxxxxxxxxxx
Cc: Emma Anholt <emma@xxxxxxxxxx>
---
    drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c   |  2 ++
    drivers/gpu/drm/amd/amdgpu/amdgpu_job.c  |  2 ++
    drivers/gpu/drm/etnaviv/etnaviv_sched.c  |  2 ++
    drivers/gpu/drm/lima/lima_sched.c        |  2 ++
    drivers/gpu/drm/panfrost/panfrost_job.c  |  2 ++
    drivers/gpu/drm/scheduler/sched_entity.c |  6 ++--
    drivers/gpu/drm/scheduler/sched_fence.c  | 17 +++++----
    drivers/gpu/drm/scheduler/sched_main.c   | 46 +++++++++++++++++++++---
    drivers/gpu/drm/v3d/v3d_gem.c            |  2 ++
    include/drm/gpu_scheduler.h              |  7 +++-
    10 files changed, 74 insertions(+), 14 deletions(-)

diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c
index c5386d13eb4a..a4ec092af9a7 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c
@@ -1226,6 +1226,8 @@ static int amdgpu_cs_submit(struct amdgpu_cs_parser *p,
        if (r)
                goto error_unlock;

+     drm_sched_job_arm(&job->base);
+
        /* No memory allocation is allowed while holding the notifier lock.
         * The lock is held until amdgpu_cs_submit is finished and fence is
         * added to BOs.
diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_job.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_job.c
index d33e6d97cc89..5ddb955d2315 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_job.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_job.c
@@ -170,6 +170,8 @@ int amdgpu_job_submit(struct amdgpu_job *job, struct drm_sched_entity *entity,
        if (r)
                return r;

+     drm_sched_job_arm(&job->base);
+
        *f = dma_fence_get(&job->base.s_fence->finished);
        amdgpu_job_free_resources(job);
        drm_sched_entity_push_job(&job->base, entity);
diff --git a/drivers/gpu/drm/etnaviv/etnaviv_sched.c b/drivers/gpu/drm/etnaviv/etnaviv_sched.c
index feb6da1b6ceb..05f412204118 100644
--- a/drivers/gpu/drm/etnaviv/etnaviv_sched.c
+++ b/drivers/gpu/drm/etnaviv/etnaviv_sched.c
@@ -163,6 +163,8 @@ int etnaviv_sched_push_job(struct drm_sched_entity *sched_entity,
        if (ret)
                goto out_unlock;

+     drm_sched_job_arm(&submit->sched_job);
+
        submit->out_fence = dma_fence_get(&submit->sched_job.s_fence->finished);
        submit->out_fence_id = idr_alloc_cyclic(&submit->gpu->fence_idr,
                                                submit->out_fence, 0,
diff --git a/drivers/gpu/drm/lima/lima_sched.c b/drivers/gpu/drm/lima/lima_sched.c
index dba8329937a3..38f755580507 100644
--- a/drivers/gpu/drm/lima/lima_sched.c
+++ b/drivers/gpu/drm/lima/lima_sched.c
@@ -129,6 +129,8 @@ int lima_sched_task_init(struct lima_sched_task *task,
                return err;
        }

+     drm_sched_job_arm(&task->base);
+
        task->num_bos = num_bos;
        task->vm = lima_vm_get(vm);

diff --git a/drivers/gpu/drm/panfrost/panfrost_job.c b/drivers/gpu/drm/panfrost/panfrost_job.c
index 71a72fb50e6b..2992dc85325f 100644
--- a/drivers/gpu/drm/panfrost/panfrost_job.c
+++ b/drivers/gpu/drm/panfrost/panfrost_job.c
@@ -288,6 +288,8 @@ int panfrost_job_push(struct panfrost_job *job)
                goto unlock;
        }

+     drm_sched_job_arm(&job->base);
+
        job->render_done_fence = dma_fence_get(&job->base.s_fence->finished);

        ret = panfrost_acquire_object_fences(job->bos, job->bo_count,
diff --git a/drivers/gpu/drm/scheduler/sched_entity.c b/drivers/gpu/drm/scheduler/sched_entity.c
index 79554aa4dbb1..f7347c284886 100644
--- a/drivers/gpu/drm/scheduler/sched_entity.c
+++ b/drivers/gpu/drm/scheduler/sched_entity.c
@@ -485,9 +485,9 @@ void drm_sched_entity_select_rq(struct drm_sched_entity *entity)
     * @sched_job: job to submit
     * @entity: scheduler entity
     *
- * Note: To guarantee that the order of insertion to queue matches
- * the job's fence sequence number this function should be
- * called with drm_sched_job_init under common lock.
+ * Note: To guarantee that the order of insertion to queue matches the job's
+ * fence sequence number this function should be called with drm_sched_job_arm()
+ * under common lock.
     *
     * Returns 0 for success, negative error code otherwise.
     */
diff --git a/drivers/gpu/drm/scheduler/sched_fence.c b/drivers/gpu/drm/scheduler/sched_fence.c
index 69de2c76731f..c451ee9a30d7 100644
--- a/drivers/gpu/drm/scheduler/sched_fence.c
+++ b/drivers/gpu/drm/scheduler/sched_fence.c
@@ -90,7 +90,7 @@ static const char *drm_sched_fence_get_timeline_name(struct dma_fence *f)
     *
     * Free up the fence memory after the RCU grace period.
     */
-static void drm_sched_fence_free(struct rcu_head *rcu)
+void drm_sched_fence_free(struct rcu_head *rcu)
    {
        struct dma_fence *f = container_of(rcu, struct dma_fence, rcu);
        struct drm_sched_fence *fence = to_drm_sched_fence(f);
@@ -152,11 +152,10 @@ struct drm_sched_fence *to_drm_sched_fence(struct dma_fence *f)
    }
    EXPORT_SYMBOL(to_drm_sched_fence);

-struct drm_sched_fence *drm_sched_fence_create(struct drm_sched_entity *entity,
-                                            void *owner)
+struct drm_sched_fence *drm_sched_fence_alloc(struct drm_sched_entity *entity,
+                                           void *owner)
    {
        struct drm_sched_fence *fence = NULL;
-     unsigned seq;

        fence = kmem_cache_zalloc(sched_fence_slab, GFP_KERNEL);
        if (fence == NULL)
@@ -166,13 +165,19 @@ struct drm_sched_fence *drm_sched_fence_create(struct drm_sched_entity *entity,
        fence->sched = entity->rq->sched;
        spin_lock_init(&fence->lock);

+     return fence;
+}
+
+void drm_sched_fence_init(struct drm_sched_fence *fence,
+                       struct drm_sched_entity *entity)
+{
+     unsigned seq;
+
        seq = atomic_inc_return(&entity->fence_seq);
        dma_fence_init(&fence->scheduled, &drm_sched_fence_ops_scheduled,
                       &fence->lock, entity->fence_context, seq);
        dma_fence_init(&fence->finished, &drm_sched_fence_ops_finished,
                       &fence->lock, entity->fence_context + 1, seq);
-
-     return fence;
    }

    module_init(drm_sched_fence_slab_init);
diff --git a/drivers/gpu/drm/scheduler/sched_main.c b/drivers/gpu/drm/scheduler/sched_main.c
index 33c414d55fab..5e84e1500c32 100644
--- a/drivers/gpu/drm/scheduler/sched_main.c
+++ b/drivers/gpu/drm/scheduler/sched_main.c
@@ -48,9 +48,11 @@
    #include <linux/wait.h>
    #include <linux/sched.h>
    #include <linux/completion.h>
+#include <linux/dma-resv.h>
    #include <uapi/linux/sched/types.h>

    #include <drm/drm_print.h>
+#include <drm/drm_gem.h>
    #include <drm/gpu_scheduler.h>
    #include <drm/spsc_queue.h>

@@ -569,7 +571,6 @@ EXPORT_SYMBOL(drm_sched_resubmit_jobs_ext);

    /**
     * drm_sched_job_init - init a scheduler job
- *
     * @job: scheduler job to init
     * @entity: scheduler entity to use
     * @owner: job owner for debugging
@@ -577,6 +578,9 @@ EXPORT_SYMBOL(drm_sched_resubmit_jobs_ext);
     * Refer to drm_sched_entity_push_job() documentation
     * for locking considerations.
     *
+ * Drivers must make sure drm_sched_job_cleanup() if this function returns
+ * successfully, even when @job is aborted before drm_sched_job_arm() is called.
+ *
     * Returns 0 for success, negative error code otherwise.
     */
    int drm_sched_job_init(struct drm_sched_job *job,
@@ -594,7 +598,7 @@ int drm_sched_job_init(struct drm_sched_job *job,
        job->sched = sched;
        job->entity = entity;
        job->s_priority = entity->rq - sched->sched_rq;
-     job->s_fence = drm_sched_fence_create(entity, owner);
+     job->s_fence = drm_sched_fence_alloc(entity, owner);
        if (!job->s_fence)
                return -ENOMEM;
        job->id = atomic64_inc_return(&sched->job_id_count);
@@ -606,13 +610,47 @@ int drm_sched_job_init(struct drm_sched_job *job,
    EXPORT_SYMBOL(drm_sched_job_init);

    /**
- * drm_sched_job_cleanup - clean up scheduler job resources
+ * drm_sched_job_arm - arm a scheduler job for execution
+ * @job: scheduler job to arm
+ *
+ * This arms a scheduler job for execution. Specifically it initializes the
+ * &drm_sched_job.s_fence of @job, so that it can be attached to struct dma_resv
+ * or other places that need to track the completion of this job.
+ *
+ * Refer to drm_sched_entity_push_job() documentation for locking
+ * considerations.
     *
+ * This can only be called if drm_sched_job_init() succeeded.
+ */
+void drm_sched_job_arm(struct drm_sched_job *job)
+{
+     drm_sched_fence_init(job->s_fence, job->entity);
+}
+EXPORT_SYMBOL(drm_sched_job_arm);
+
+/**
+ * drm_sched_job_cleanup - clean up scheduler job resources
     * @job: scheduler job to clean up
+ *
+ * Cleans up the resources allocated with drm_sched_job_init().
+ *
+ * Drivers should call this from their error unwind code if @job is aborted
+ * before drm_sched_job_arm() is called.
+ *
+ * After that point of no return @job is committed to be executed by the
+ * scheduler, and this function should be called from the
+ * &drm_sched_backend_ops.free_job callback.
     */
    void drm_sched_job_cleanup(struct drm_sched_job *job)
    {
-     dma_fence_put(&job->s_fence->finished);
+     if (!kref_read(&job->s_fence->finished.refcount)) {
+             /* drm_sched_job_arm() has been called */
+             dma_fence_put(&job->s_fence->finished);
+     } else {
+             /* aborted job before committing to run it */
+             drm_sched_fence_free(&job->s_fence->finished.rcu);
+     }
+
        job->s_fence = NULL;
    }
    EXPORT_SYMBOL(drm_sched_job_cleanup);
diff --git a/drivers/gpu/drm/v3d/v3d_gem.c b/drivers/gpu/drm/v3d/v3d_gem.c
index 4eb354226972..5c3a99027ecd 100644
--- a/drivers/gpu/drm/v3d/v3d_gem.c
+++ b/drivers/gpu/drm/v3d/v3d_gem.c
@@ -475,6 +475,8 @@ v3d_push_job(struct v3d_file_priv *v3d_priv,
        if (ret)
                return ret;

+     drm_sched_job_arm(&job->base);
+
        job->done_fence = dma_fence_get(&job->base.s_fence->finished);

        /* put by scheduler job completion */
diff --git a/include/drm/gpu_scheduler.h b/include/drm/gpu_scheduler.h
index 88ae7f331bb1..83afc3aa8e2f 100644
--- a/include/drm/gpu_scheduler.h
+++ b/include/drm/gpu_scheduler.h
@@ -348,6 +348,7 @@ void drm_sched_fini(struct drm_gpu_scheduler *sched);
    int drm_sched_job_init(struct drm_sched_job *job,
                       struct drm_sched_entity *entity,
                       void *owner);
+void drm_sched_job_arm(struct drm_sched_job *job);
    void drm_sched_entity_modify_sched(struct drm_sched_entity *entity,
                                    struct drm_gpu_scheduler **sched_list,
                                       unsigned int num_sched_list);
@@ -387,8 +388,12 @@ void drm_sched_entity_set_priority(struct drm_sched_entity *entity,
                                   enum drm_sched_priority priority);
    bool drm_sched_entity_is_ready(struct drm_sched_entity *entity);

-struct drm_sched_fence *drm_sched_fence_create(
+struct drm_sched_fence *drm_sched_fence_alloc(
        struct drm_sched_entity *s_entity, void *owner);
+void drm_sched_fence_init(struct drm_sched_fence *fence,
+                       struct drm_sched_entity *entity);
+void drm_sched_fence_free(struct rcu_head *rcu);
+
    void drm_sched_fence_scheduled(struct drm_sched_fence *fence);
    void drm_sched_fence_finished(struct drm_sched_fence *fence);









