From: Hangyu Hua <hbh25y@gmail.com>
To: Andrey Grodzovsky <andrey.grodzovsky@amd.com>,
yuq825@gmail.com, airlied@linux.ie, daniel@ffwll.ch
Cc: dri-devel@lists.freedesktop.org, lima@lists.freedesktop.org,
linux-kernel@vger.kernel.org
Subject: Re: [PATCH] gpu: drm: remove redundant dma_fence_put() when drm_sched_job_add_dependency() fails
Date: Wed, 27 Apr 2022 10:31:15 +0800 [thread overview]
Message-ID: <88dd5d67-7dd5-2f58-5254-adaa941deb0f@gmail.com> (raw)
In-Reply-To: <e26e6ef8-6665-0b9d-804f-cf107f1788d4@amd.com>
On 2022/4/26 22:55, Andrey Grodzovsky wrote:
>
> On 2022-04-25 22:54, Hangyu Hua wrote:
>> On 2022/4/25 23:42, Andrey Grodzovsky wrote:
>>> On 2022-04-25 04:36, Hangyu Hua wrote:
>>>
>>>> When drm_sched_job_add_dependency() fails, dma_fence_put() will be
>>>> called
>>>> internally. Calling it again after drm_sched_job_add_dependency()
>>>> finishes
>>>> may result in a dangling pointer.
>>>>
>>>> Fix this by removing redundant dma_fence_put().
>>>>
>>>> Signed-off-by: Hangyu Hua <hbh25y@gmail.com>
>>>> ---
>>>> drivers/gpu/drm/lima/lima_gem.c | 1 -
>>>> drivers/gpu/drm/scheduler/sched_main.c | 1 -
>>>> 2 files changed, 2 deletions(-)
>>>>
>>>> diff --git a/drivers/gpu/drm/lima/lima_gem.c
>>>> b/drivers/gpu/drm/lima/lima_gem.c
>>>> index 55bb1ec3c4f7..99c8e7f6bb1c 100644
>>>> --- a/drivers/gpu/drm/lima/lima_gem.c
>>>> +++ b/drivers/gpu/drm/lima/lima_gem.c
>>>> @@ -291,7 +291,6 @@ static int lima_gem_add_deps(struct drm_file
>>>> *file, struct lima_submit *submit)
>>>> err = drm_sched_job_add_dependency(&submit->task->base,
>>>> fence);
>>>> if (err) {
>>>> - dma_fence_put(fence);
>>>> return err;
>>>
>>>
>>> Makes sense here
>>>
>>>
>>>> }
>>>> }
>>>> diff --git a/drivers/gpu/drm/scheduler/sched_main.c
>>>> b/drivers/gpu/drm/scheduler/sched_main.c
>>>> index b81fceb0b8a2..ebab9eca37a8 100644
>>>> --- a/drivers/gpu/drm/scheduler/sched_main.c
>>>> +++ b/drivers/gpu/drm/scheduler/sched_main.c
>>>> @@ -708,7 +708,6 @@ int
>>>> drm_sched_job_add_implicit_dependencies(struct drm_sched_job *job,
>>>> dma_fence_get(fence);
>>>> ret = drm_sched_job_add_dependency(job, fence);
>>>> if (ret) {
>>>> - dma_fence_put(fence);
>>>
>>>
>>>
>>> Not sure about this one since if you look at the relevant commits -
>>> 'drm/scheduler: fix drm_sched_job_add_implicit_dependencies' and
>>> 'drm/scheduler: fix drm_sched_job_add_implicit_dependencies harder'
>>> You will see that the dma_fence_put here balances the extra
>>> dma_fence_get
>>> above
>>>
>>> Andrey
>>>
>>
>> I don't think so. I checked the call chain and found no additional
>> dma_fence_get(). But dma_fence_get() needs to be called before
>> drm_sched_job_add_dependency() to keep the counter balanced.
>
>
> I don't say there is an additional get, I just say that
> drm_sched_job_add_dependency doesn't grab an extra reference to the
> fences it stores so this needs to be done outside and for that
> drm_sched_job_add_implicit_dependencies->dma_fence_get is called and, if
> this addition fails you just call dma_fence_put to keep the counter
> balanced.
>
drm_sched_job_add_implicit_dependencies() will call
drm_sched_job_add_dependency(). And drm_sched_job_add_dependency()
already call dma_fence_put() when it fails. Calling dma_fence_put()
twice doesn't make sense.
dma_fence_get() is in [2]. But dma_fence_put() will be called in [1] and
[3] when xa_alloc() fails.
int drm_sched_job_add_dependency(struct drm_sched_job *job,
struct dma_fence *fence)
{
...
ret = xa_alloc(&job->dependencies, &id, fence, xa_limit_32b, GFP_KERNEL);
if (ret != 0)
dma_fence_put(fence); <--- [1]
return ret;
}
EXPORT_SYMBOL(drm_sched_job_add_dependency);
int drm_sched_job_add_implicit_dependencies(struct drm_sched_job *job,
struct drm_gem_object *obj,
bool write)
{
struct dma_resv_iter cursor;
struct dma_fence *fence;
int ret;
dma_resv_for_each_fence(&cursor, obj->resv, write, fence) {
/* Make sure to grab an additional ref on the added fence */
dma_fence_get(fence); <--- [2]
ret = drm_sched_job_add_dependency(job, fence);
if (ret) {
dma_fence_put(fence); <--- [3]
return ret;
}
}
return 0;
}
>
>> On the other hand, dma_fence_get() and dma_fence_put() are meaningless
>> here if threre is an extra dma_fence_get() beacause counter will not
>> decrease to 0 during drm_sched_job_add_dependency().
>>
>> I check the call chain as follows:
>>
>> msm_ioctl_gem_submit()
>> -> submit_fence_sync()
>> -> drm_sched_job_add_implicit_dependencies()
>
>
> Can you maybe trace or print one such example of problematic refcount
> that you are trying to fix ? I still don't see where is the problem.
>
> Andrey
>
I also wish I could. System logs can make this easy. But i don't have a
corresponding GPU physical device.
drm_sched_job_add_implicit_dependencies is only used in a few devices.
Thanks.
>
>>
>> Thanks,
>> Hangyu
>>
>>>
>>>> return ret;
>>>> }
>>>> }
next prev parent reply other threads:[~2022-04-27 2:31 UTC|newest]
Thread overview: 10+ messages / expand[flat|nested] mbox.gz Atom feed top
2022-04-25 8:36 [PATCH] gpu: drm: remove redundant dma_fence_put() when drm_sched_job_add_dependency() fails Hangyu Hua
2022-04-25 15:42 ` Andrey Grodzovsky
2022-04-26 2:54 ` Hangyu Hua
2022-04-26 14:48 ` Andrey Grodzovsky
2022-04-26 14:55 ` Andrey Grodzovsky
2022-04-27 2:31 ` Hangyu Hua [this message]
[not found] ` <65b6cc23-1a77-7df0-5768-f81cd03b6514@amd.com>
2022-04-28 8:56 ` Hangyu Hua
2022-04-28 15:27 ` Andrey Grodzovsky
2022-04-29 3:03 ` Hangyu Hua
2022-04-29 16:34 ` Andrey Grodzovsky
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=88dd5d67-7dd5-2f58-5254-adaa941deb0f@gmail.com \
--to=hbh25y@gmail.com \
--cc=airlied@linux.ie \
--cc=andrey.grodzovsky@amd.com \
--cc=daniel@ffwll.ch \
--cc=dri-devel@lists.freedesktop.org \
--cc=lima@lists.freedesktop.org \
--cc=linux-kernel@vger.kernel.org \
--cc=yuq825@gmail.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).