On Wed, Jul 7, 2021 at 1:57 PM Christian König <christian.koenig@xxxxxxx> wrote:
> Am 07.07.21 um 13:14 schrieb Daniel Vetter:
> > On Wed, Jul 7, 2021 at 11:30 AM Christian König
> > <christian.koenig@xxxxxxx> wrote:
> >> Am 02.07.21 um 23:38 schrieb Daniel Vetter:
> >>> This is a very confusingly named function, because not just does it
> >>> init an object, it arms it and provides a point of no return for
> >>> pushing a job into the scheduler. It would be nice if that's a bit
> >>> clearer in the interface.
> >>>
> >>> But the real reason is that I want to push the dependency tracking
> >>> helpers into the scheduler code, and that means drm_sched_job_init
> >>> must be called a lot earlier, without arming the job.
> >>>
> >>> v2:
> >>> - don't change .gitignore (Steven)
> >>> - don't forget v3d (Emma)
> >>>
> >>> v3: Emma noticed that I leak the memory allocated in
> >>> drm_sched_job_init if we bail out before the point of no return in
> >>> subsequent driver patches. To be able to fix this change
> >>> drm_sched_job_cleanup() so it can handle being called both before and
> >>> after drm_sched_job_arm().
> >> Thinking more about this, I'm not sure if this really works.
> >>
> >> See drm_sched_job_init() was also calling drm_sched_entity_select_rq()
> >> to update the entity->rq association.
> >>
> >> And that can only be done later on when we arm the fence as well.
> > Hm yeah, but that's a bug in the existing code I think: We already
> > fail to clean up if we fail to allocate the fences. So I think the
> > right thing to do here is to split the checks into job_init, and do
> > the actual arming/rq selection in job_arm? I'm not entirely sure
> > what's all going on there, the first check looks a bit like trying to
> > schedule before the entity is set up, which is a driver bug and should
> > have a WARN_ON?
>
> No you misunderstood me, the problem is something else.
>
> You asked previously why the call to drm_sched_job_init() was so late in
> the CS.
>
> The reason for this was not alone the scheduler fence init, but also the
> call to drm_sched_entity_select_rq().
Ah ok, I think I can fix that. Needs a prep patch to first make
drm_sched_entity_select infallible, then should be easy to do.
> > The 2nd check around last_scheduled I have honeslty no idea what it's
> > even trying to do.
>
> You mean that here?
>
> fence = READ_ONCE(entity->last_scheduled);
> if (fence && !dma_fence_is_signaled(fence))
> return;
>
> This makes sure that load balancing is not moving the entity to a
> different scheduler while there are still jobs running from this entity
> on the hardware,
Yeah after a nap that idea crossed my mind too. But now I have locking
questions, afaiui the scheduler thread updates this, without taking
any locks - entity dequeuing is lockless. And here we read the fence
and then seem to yolo check whether it's signalled? What's preventing
a use-after-free here? There's no rcu or anything going on here at
all, and it's outside of the spinlock section, which starts a bit
further down.
-Daniel
>
> Regards
> Christian.
>
> > -Daniel
> >
> >> Christian.
> >>
> >>> Also improve the kerneldoc for this.
> >>>
> >>> Acked-by: Steven Price <steven.price@xxxxxxx> (v2)
> >>> Signed-off-by: Daniel Vetter <daniel.vetter@xxxxxxxxx>
> >>> Cc: Lucas Stach <l.stach@xxxxxxxxxxxxxx>
> >>> Cc: Russell King <linux+etnaviv@xxxxxxxxxxxxxxx>
> >>> Cc: Christian Gmeiner <christian.gmeiner@xxxxxxxxx>
> >>> Cc: Qiang Yu <yuq825@xxxxxxxxx>
> >>> Cc: Rob Herring <robh@xxxxxxxxxx>
> >>> Cc: Tomeu Vizoso <tomeu.vizoso@xxxxxxxxxxxxx>
> >>> Cc: Steven Price <steven.price@xxxxxxx>
> >>> Cc: Alyssa Rosenzweig <alyssa.rosenzweig@xxxxxxxxxxxxx>
> >>> Cc: David Airlie <airlied@xxxxxxxx>
> >>> Cc: Daniel Vetter <daniel@xxxxxxxx>
> >>> Cc: Sumit Semwal <sumit.semwal@xxxxxxxxxx>
> >>> Cc: "Christian König" <christian.koenig@xxxxxxx>
> >>> Cc: Masahiro Yamada <masahiroy@xxxxxxxxxx>
> >>> Cc: Kees Cook <keescook@xxxxxxxxxxxx>
> >>> Cc: Adam Borowski <kilobyte@xxxxxxxxxx>
> >>> Cc: Nick Terrell <terrelln@xxxxxx>
> >>> Cc: Mauro Carvalho Chehab <mchehab+huawei@xxxxxxxxxx>
> >>> Cc: Paul Menzel <pmenzel@xxxxxxxxxxxxx>
> >>> Cc: Sami Tolvanen <samitolvanen@xxxxxxxxxx>
> >>> Cc: Viresh Kumar <viresh.kumar@xxxxxxxxxx>
> >>> Cc: Alex Deucher <alexander.deucher@xxxxxxx>
> >>> Cc: Dave Airlie <airlied@xxxxxxxxxx>
> >>> Cc: Nirmoy Das <nirmoy.das@xxxxxxx>
> >>> Cc: Deepak R Varma <mh12gx2825@xxxxxxxxx>
> >>> Cc: Lee Jones <lee.jones@xxxxxxxxxx>
> >>> Cc: Kevin Wang <kevin1.wang@xxxxxxx>
> >>> Cc: Chen Li <chenli@xxxxxxxxxxxxx>
> >>> Cc: Luben Tuikov <luben.tuikov@xxxxxxx>
> >>> Cc: "Marek Olšák" <marek.olsak@xxxxxxx>
> >>> Cc: Dennis Li <Dennis.Li@xxxxxxx>
> >>> Cc: Maarten Lankhorst <maarten.lankhorst@xxxxxxxxxxxxxxx>
> >>> Cc: Andrey Grodzovsky <andrey.grodzovsky@xxxxxxx>
> >>> Cc: Sonny Jiang <sonny.jiang@xxxxxxx>
> >>> Cc: Boris Brezillon <boris.brezillon@xxxxxxxxxxxxx>
> >>> Cc: Tian Tao <tiantao6@xxxxxxxxxxxxx>
> >>> Cc: Jack Zhang <Jack.Zhang1@xxxxxxx>
> >>> Cc: etnaviv@xxxxxxxxxxxxxxxxxxxxx
> >>> Cc: lima@xxxxxxxxxxxxxxxxxxxxx
> >>> Cc: linux-media@xxxxxxxxxxxxxxx
> >>> Cc: linaro-mm-sig@xxxxxxxxxxxxxxxx
> >>> Cc: Emma Anholt <emma@xxxxxxxxxx>
> >>> ---
> >>> drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c | 2 ++
> >>> drivers/gpu/drm/amd/amdgpu/amdgpu_job.c | 2 ++
> >>> drivers/gpu/drm/etnaviv/etnaviv_sched.c | 2 ++
> >>> drivers/gpu/drm/lima/lima_sched.c | 2 ++
> >>> drivers/gpu/drm/panfrost/panfrost_job.c | 2 ++
> >>> drivers/gpu/drm/scheduler/sched_entity.c | 6 ++--
> >>> drivers/gpu/drm/scheduler/sched_fence.c | 17 +++++----
> >>> drivers/gpu/drm/scheduler/sched_main.c | 46 +++++++++++++++++++++---
> >>> drivers/gpu/drm/v3d/v3d_gem.c | 2 ++
> >>> include/drm/gpu_scheduler.h | 7 +++-
> >>> 10 files changed, 74 insertions(+), 14 deletions(-)
> >>>
> >>> diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c
> >>> index c5386d13eb4a..a4ec092af9a7 100644
> >>> --- a/drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c
> >>> +++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c
> >>> @@ -1226,6 +1226,8 @@ static int amdgpu_cs_submit(struct amdgpu_cs_parser *p,
> >>> if (r)
> >>> goto error_unlock;
> >>>
> >>> + drm_sched_job_arm(&job->base);
> >>> +
> >>> /* No memory allocation is allowed while holding the notifier lock.
> >>> * The lock is held until amdgpu_cs_submit is finished and fence is
> >>> * added to BOs.
> >>> diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_job.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_job.c
> >>> index d33e6d97cc89..5ddb955d2315 100644
> >>> --- a/drivers/gpu/drm/amd/amdgpu/amdgpu_job.c
> >>> +++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_job.c
> >>> @@ -170,6 +170,8 @@ int amdgpu_job_submit(struct amdgpu_job *job, struct drm_sched_entity *entity,
> >>> if (r)
> >>> return r;
> >>>
> >>> + drm_sched_job_arm(&job->base);
> >>> +
> >>> *f = dma_fence_get(&job->base.s_fence->finished);
> >>> amdgpu_job_free_resources(job);
> >>> drm_sched_entity_push_job(&job->base, entity);
> >>> diff --git a/drivers/gpu/drm/etnaviv/etnaviv_sched.c b/drivers/gpu/drm/etnaviv/etnaviv_sched.c
> >>> index feb6da1b6ceb..05f412204118 100644
> >>> --- a/drivers/gpu/drm/etnaviv/etnaviv_sched.c
> >>> +++ b/drivers/gpu/drm/etnaviv/etnaviv_sched.c
> >>> @@ -163,6 +163,8 @@ int etnaviv_sched_push_job(struct drm_sched_entity *sched_entity,
> >>> if (ret)
> >>> goto out_unlock;
> >>>
> >>> + drm_sched_job_arm(&submit->sched_job);
> >>> +
> >>> submit->out_fence = dma_fence_get(&submit->sched_job.s_fence->finished);
> >>> submit->out_fence_id = idr_alloc_cyclic(&submit->gpu->fence_idr,
> >>> submit->out_fence, 0,
> >>> diff --git a/drivers/gpu/drm/lima/lima_sched.c b/drivers/gpu/drm/lima/lima_sched.c
> >>> index dba8329937a3..38f755580507 100644
> >>> --- a/drivers/gpu/drm/lima/lima_sched.c
> >>> +++ b/drivers/gpu/drm/lima/lima_sched.c
> >>> @@ -129,6 +129,8 @@ int lima_sched_task_init(struct lima_sched_task *task,
> >>> return err;
> >>> }
> >>>
> >>> + drm_sched_job_arm(&task->base);
> >>> +
> >>> task->num_bos = num_bos;
> >>> task->vm = lima_vm_get(vm);
> >>>
> >>> diff --git a/drivers/gpu/drm/panfrost/panfrost_job.c b/drivers/gpu/drm/panfrost/panfrost_job.c
> >>> index 71a72fb50e6b..2992dc85325f 100644
> >>> --- a/drivers/gpu/drm/panfrost/panfrost_job.c
> >>> +++ b/drivers/gpu/drm/panfrost/panfrost_job.c
> >>> @@ -288,6 +288,8 @@ int panfrost_job_push(struct panfrost_job *job)
> >>> goto unlock;
> >>> }
> >>>
> >>> + drm_sched_job_arm(&job->base);
> >>> +
> >>> job->render_done_fence = dma_fence_get(&job->base.s_fence->finished);
> >>>
> >>> ret = panfrost_acquire_object_fences(job->bos, job->bo_count,
> >>> diff --git a/drivers/gpu/drm/scheduler/sched_entity.c b/drivers/gpu/drm/scheduler/sched_entity.c
> >>> index 79554aa4dbb1..f7347c284886 100644
> >>> --- a/drivers/gpu/drm/scheduler/sched_entity.c
> >>> +++ b/drivers/gpu/drm/scheduler/sched_entity.c
> >>> @@ -485,9 +485,9 @@ void drm_sched_entity_select_rq(struct drm_sched_entity *entity)
> >>> * @sched_job: job to submit
> >>> * @entity: scheduler entity
> >>> *
> >>> - * Note: To guarantee that the order of insertion to queue matches
> >>> - * the job's fence sequence number this function should be
> >>> - * called with drm_sched_job_init under common lock.
> >>> + * Note: To guarantee that the order of insertion to queue matches the job's
> >>> + * fence sequence number this function should be called with drm_sched_job_arm()
> >>> + * under common lock.
> >>> *
> >>> * Returns 0 for success, negative error code otherwise.
> >>> */
> >>> diff --git a/drivers/gpu/drm/scheduler/sched_fence.c b/drivers/gpu/drm/scheduler/sched_fence.c
> >>> index 69de2c76731f..c451ee9a30d7 100644
> >>> --- a/drivers/gpu/drm/scheduler/sched_fence.c
> >>> +++ b/drivers/gpu/drm/scheduler/sched_fence.c
> >>> @@ -90,7 +90,7 @@ static const char *drm_sched_fence_get_timeline_name(struct dma_fence *f)
> >>> *
> >>> * Free up the fence memory after the RCU grace period.
> >>> */
> >>> -static void drm_sched_fence_free(struct rcu_head *rcu)
> >>> +void drm_sched_fence_free(struct rcu_head *rcu)
> >>> {
> >>> struct dma_fence *f = container_of(rcu, struct dma_fence, rcu);
> >>> struct drm_sched_fence *fence = to_drm_sched_fence(f);
> >>> @@ -152,11 +152,10 @@ struct drm_sched_fence *to_drm_sched_fence(struct dma_fence *f)
> >>> }
> >>> EXPORT_SYMBOL(to_drm_sched_fence);
> >>>
> >>> -struct drm_sched_fence *drm_sched_fence_create(struct drm_sched_entity *entity,
> >>> - void *owner)
> >>> +struct drm_sched_fence *drm_sched_fence_alloc(struct drm_sched_entity *entity,
> >>> + void *owner)
> >>> {
> >>> struct drm_sched_fence *fence = NULL;
> >>> - unsigned seq;
> >>>
> >>> fence = kmem_cache_zalloc(sched_fence_slab, GFP_KERNEL);
> >>> if (fence == NULL)
> >>> @@ -166,13 +165,19 @@ struct drm_sched_fence *drm_sched_fence_create(struct drm_sched_entity *entity,
> >>> fence->sched = entity->rq->sched;
> >>> spin_lock_init(&fence->lock);
> >>>
> >>> + return fence;
> >>> +}
> >>> +
> >>> +void drm_sched_fence_init(struct drm_sched_fence *fence,
> >>> + struct drm_sched_entity *entity)
> >>> +{
> >>> + unsigned seq;
> >>> +
> >>> seq = atomic_inc_return(&entity->fence_seq);
> >>> dma_fence_init(&fence->scheduled, &drm_sched_fence_ops_scheduled,
> >>> &fence->lock, entity->fence_context, seq);
> >>> dma_fence_init(&fence->finished, &drm_sched_fence_ops_finished,
> >>> &fence->lock, entity->fence_context + 1, seq);
> >>> -
> >>> - return fence;
> >>> }
> >>>
> >>> module_init(drm_sched_fence_slab_init);
> >>> diff --git a/drivers/gpu/drm/scheduler/sched_main.c b/drivers/gpu/drm/scheduler/sched_main.c
> >>> index 33c414d55fab..5e84e1500c32 100644
> >>> --- a/drivers/gpu/drm/scheduler/sched_main.c
> >>> +++ b/drivers/gpu/drm/scheduler/sched_main.c
> >>> @@ -48,9 +48,11 @@
> >>> #include <linux/wait.h>
> >>> #include <linux/sched.h>
> >>> #include <linux/completion.h>
> >>> +#include <linux/dma-resv.h>
> >>> #include <uapi/linux/sched/types.h>
> >>>
> >>> #include <drm/drm_print.h>
> >>> +#include <drm/drm_gem.h>
> >>> #include <drm/gpu_scheduler.h>
> >>> #include <drm/spsc_queue.h>
> >>>
> >>> @@ -569,7 +571,6 @@ EXPORT_SYMBOL(drm_sched_resubmit_jobs_ext);
> >>>
> >>> /**
> >>> * drm_sched_job_init - init a scheduler job
> >>> - *
> >>> * @job: scheduler job to init
> >>> * @entity: scheduler entity to use
> >>> * @owner: job owner for debugging
> >>> @@ -577,6 +578,9 @@ EXPORT_SYMBOL(drm_sched_resubmit_jobs_ext);
> >>> * Refer to drm_sched_entity_push_job() documentation
> >>> * for locking considerations.
> >>> *
> >>> + * Drivers must make sure drm_sched_job_cleanup() if this function returns
> >>> + * successfully, even when @job is aborted before drm_sched_job_arm() is called.
> >>> + *
> >>> * Returns 0 for success, negative error code otherwise.
> >>> */
> >>> int drm_sched_job_init(struct drm_sched_job *job,
> >>> @@ -594,7 +598,7 @@ int drm_sched_job_init(struct drm_sched_job *job,
> >>> job->sched = sched;
> >>> job->entity = entity;
> >>> job->s_priority = entity->rq - sched->sched_rq;
> >>> - job->s_fence = drm_sched_fence_create(entity, owner);
> >>> + job->s_fence = drm_sched_fence_alloc(entity, owner);
> >>> if (!job->s_fence)
> >>> return -ENOMEM;
> >>> job->id = atomic64_inc_return(&sched->job_id_count);
> >>> @@ -606,13 +610,47 @@ int drm_sched_job_init(struct drm_sched_job *job,
> >>> EXPORT_SYMBOL(drm_sched_job_init);
> >>>
> >>> /**
> >>> - * drm_sched_job_cleanup - clean up scheduler job resources
> >>> + * drm_sched_job_arm - arm a scheduler job for execution
> >>> + * @job: scheduler job to arm
> >>> + *
> >>> + * This arms a scheduler job for execution. Specifically it initializes the
> >>> + * &drm_sched_job.s_fence of @job, so that it can be attached to struct dma_resv
> >>> + * or other places that need to track the completion of this job.
> >>> + *
> >>> + * Refer to drm_sched_entity_push_job() documentation for locking
> >>> + * considerations.
> >>> *
> >>> + * This can only be called if drm_sched_job_init() succeeded.
> >>> + */
> >>> +void drm_sched_job_arm(struct drm_sched_job *job)
> >>> +{
> >>> + drm_sched_fence_init(job->s_fence, job->entity);
> >>> +}
> >>> +EXPORT_SYMBOL(drm_sched_job_arm);
> >>> +
> >>> +/**
> >>> + * drm_sched_job_cleanup - clean up scheduler job resources
> >>> * @job: scheduler job to clean up
> >>> + *
> >>> + * Cleans up the resources allocated with drm_sched_job_init().
> >>> + *
> >>> + * Drivers should call this from their error unwind code if @job is aborted
> >>> + * before drm_sched_job_arm() is called.
> >>> + *
> >>> + * After that point of no return @job is committed to be executed by the
> >>> + * scheduler, and this function should be called from the
> >>> + * &drm_sched_backend_ops.free_job callback.
> >>> */
> >>> void drm_sched_job_cleanup(struct drm_sched_job *job)
> >>> {
> >>> - dma_fence_put(&job->s_fence->finished);
> >>> + if (!kref_read(&job->s_fence->finished.refcount)) {
> >>> + /* drm_sched_job_arm() has been called */
> >>> + dma_fence_put(&job->s_fence->finished);
> >>> + } else {
> >>> + /* aborted job before committing to run it */
> >>> + drm_sched_fence_free(&job->s_fence->finished.rcu);
> >>> + }
> >>> +
> >>> job->s_fence = NULL;
> >>> }
> >>> EXPORT_SYMBOL(drm_sched_job_cleanup);
> >>> diff --git a/drivers/gpu/drm/v3d/v3d_gem.c b/drivers/gpu/drm/v3d/v3d_gem.c
> >>> index 4eb354226972..5c3a99027ecd 100644
> >>> --- a/drivers/gpu/drm/v3d/v3d_gem.c
> >>> +++ b/drivers/gpu/drm/v3d/v3d_gem.c
> >>> @@ -475,6 +475,8 @@ v3d_push_job(struct v3d_file_priv *v3d_priv,
> >>> if (ret)
> >>> return ret;
> >>>
> >>> + drm_sched_job_arm(&job->base);
> >>> +
> >>> job->done_fence = dma_fence_get(&job->base.s_fence->finished);
> >>>
> >>> /* put by scheduler job completion */
> >>> diff --git a/include/drm/gpu_scheduler.h b/include/drm/gpu_scheduler.h
> >>> index 88ae7f331bb1..83afc3aa8e2f 100644
> >>> --- a/include/drm/gpu_scheduler.h
> >>> +++ b/include/drm/gpu_scheduler.h
> >>> @@ -348,6 +348,7 @@ void drm_sched_fini(struct drm_gpu_scheduler *sched);
> >>> int drm_sched_job_init(struct drm_sched_job *job,
> >>> struct drm_sched_entity *entity,
> >>> void *owner);
> >>> +void drm_sched_job_arm(struct drm_sched_job *job);
> >>> void drm_sched_entity_modify_sched(struct drm_sched_entity *entity,
> >>> struct drm_gpu_scheduler **sched_list,
> >>> unsigned int num_sched_list);
> >>> @@ -387,8 +388,12 @@ void drm_sched_entity_set_priority(struct drm_sched_entity *entity,
> >>> enum drm_sched_priority priority);
> >>> bool drm_sched_entity_is_ready(struct drm_sched_entity *entity);
> >>>
> >>> -struct drm_sched_fence *drm_sched_fence_create(
> >>> +struct drm_sched_fence *drm_sched_fence_alloc(
> >>> struct drm_sched_entity *s_entity, void *owner);
> >>> +void drm_sched_fence_init(struct drm_sched_fence *fence,
> >>> + struct drm_sched_entity *entity);
> >>> +void drm_sched_fence_free(struct rcu_head *rcu);
> >>> +
> >>> void drm_sched_fence_scheduled(struct drm_sched_fence *fence);
> >>> void drm_sched_fence_finished(struct drm_sched_fence *fence);
> >>>
> >
>
--
Daniel Vetter
Software Engineer, Intel Corporation
http://blog.ffwll.ch
