From: Chris Wilson <chris@chris-wilson.co.uk> To: dri-devel@lists.freedesktop.org Cc: intel-gfx@lists.freedesktop.org, "Chris Wilson" <chris@chris-wilson.co.uk>, "Daniel Vetter" <daniel.vetter@ffwll.ch>, "Maarten Lankhorst" <maarten.lankhorst@linux.intel.com>, "Christian König" <christian.koenig@amd.com>, "Alex Deucher" <alexander.deucher@amd.com>, "Sumit Semwal" <sumit.semwal@linaro.org>, linux-media@vger.kernel.org, linaro-mm-sig@lists.linaro.org Subject: [PATCH 09/11] dma-buf: Restart reservation_object_test_signaled_rcu() after writes Date: Mon, 29 Aug 2016 08:08:32 +0100 [thread overview] Message-ID: <20160829070834.22296-9-chris@chris-wilson.co.uk> (raw) In-Reply-To: <20160829070834.22296-1-chris@chris-wilson.co.uk> In order to be completely generic, we have to double check the read seqlock after acquiring a reference to the fence. If the driver is allocating fences from a SLAB_DESTROY_BY_RCU, or similar freelist, then within an RCU grace period a fence may be freed and reallocated. The RCU read side critical section does not prevent this reallocation, instead we have to inspect the reservation's seqlock to double check if the fences have been reassigned as we were acquiring our reference. Signed-off-by: Chris Wilson <chris@chris-wilson.co.uk> Cc: Daniel Vetter <daniel.vetter@ffwll.ch> Cc: Maarten Lankhorst <maarten.lankhorst@linux.intel.com> Cc: Christian König <christian.koenig@amd.com> Cc: Alex Deucher <alexander.deucher@amd.com> Cc: Sumit Semwal <sumit.semwal@linaro.org> Cc: linux-media@vger.kernel.org Cc: dri-devel@lists.freedesktop.org Cc: linaro-mm-sig@lists.linaro.org --- drivers/dma-buf/reservation.c | 30 ++++++++++-------------------- 1 file changed, 10 insertions(+), 20 deletions(-) diff --git a/drivers/dma-buf/reservation.c b/drivers/dma-buf/reservation.c index 3369e4668e96..e74493e7332b 100644 --- a/drivers/dma-buf/reservation.c +++ b/drivers/dma-buf/reservation.c @@ -474,12 +474,13 @@ bool reservation_object_test_signaled_rcu(struct reservation_object *obj, bool test_all) { unsigned seq, shared_count; - int ret = true; + int ret; + rcu_read_lock(); retry: + ret = true; shared_count = 0; seq = read_seqcount_begin(&obj->seq); - rcu_read_lock(); if (test_all) { unsigned i; @@ -490,46 +491,35 @@ retry: if (fobj) shared_count = fobj->shared_count; - if (read_seqcount_retry(&obj->seq, seq)) - goto unlock_retry; - for (i = 0; i < shared_count; ++i) { struct fence *fence = rcu_dereference(fobj->shared[i]); ret = reservation_object_test_signaled_single(fence); if (ret < 0) - goto unlock_retry; + goto retry; else if (!ret) break; } - /* - * There could be a read_seqcount_retry here, but nothing cares - * about whether it's the old or newer fence pointers that are - * signaled. That race could still have happened after checking - * read_seqcount_retry. If you care, use ww_mutex_lock. - */ + if (read_seqcount_retry(&obj->seq, seq)) + goto retry; } if (!shared_count) { struct fence *fence_excl = rcu_dereference(obj->fence_excl); - if (read_seqcount_retry(&obj->seq, seq)) - goto unlock_retry; - if (fence_excl) { ret = reservation_object_test_signaled_single( fence_excl); if (ret < 0) - goto unlock_retry; + goto retry; + + if (read_seqcount_retry(&obj->seq, seq)) + goto retry; } } rcu_read_unlock(); return ret; - -unlock_retry: - rcu_read_unlock(); - goto retry; } EXPORT_SYMBOL_GPL(reservation_object_test_signaled_rcu); -- 2.9.3
WARNING: multiple messages have this Message-ID (diff)
From: Chris Wilson <chris@chris-wilson.co.uk> To: dri-devel@lists.freedesktop.org Cc: "Daniel Vetter" <daniel.vetter@ffwll.ch>, intel-gfx@lists.freedesktop.org, linaro-mm-sig@lists.linaro.org, "Alex Deucher" <alexander.deucher@amd.com>, "Christian König" <christian.koenig@amd.com>, linux-media@vger.kernel.org Subject: [PATCH 09/11] dma-buf: Restart reservation_object_test_signaled_rcu() after writes Date: Mon, 29 Aug 2016 08:08:32 +0100 [thread overview] Message-ID: <20160829070834.22296-9-chris@chris-wilson.co.uk> (raw) In-Reply-To: <20160829070834.22296-1-chris@chris-wilson.co.uk> In order to be completely generic, we have to double check the read seqlock after acquiring a reference to the fence. If the driver is allocating fences from a SLAB_DESTROY_BY_RCU, or similar freelist, then within an RCU grace period a fence may be freed and reallocated. The RCU read side critical section does not prevent this reallocation, instead we have to inspect the reservation's seqlock to double check if the fences have been reassigned as we were acquiring our reference. Signed-off-by: Chris Wilson <chris@chris-wilson.co.uk> Cc: Daniel Vetter <daniel.vetter@ffwll.ch> Cc: Maarten Lankhorst <maarten.lankhorst@linux.intel.com> Cc: Christian König <christian.koenig@amd.com> Cc: Alex Deucher <alexander.deucher@amd.com> Cc: Sumit Semwal <sumit.semwal@linaro.org> Cc: linux-media@vger.kernel.org Cc: dri-devel@lists.freedesktop.org Cc: linaro-mm-sig@lists.linaro.org --- drivers/dma-buf/reservation.c | 30 ++++++++++-------------------- 1 file changed, 10 insertions(+), 20 deletions(-) diff --git a/drivers/dma-buf/reservation.c b/drivers/dma-buf/reservation.c index 3369e4668e96..e74493e7332b 100644 --- a/drivers/dma-buf/reservation.c +++ b/drivers/dma-buf/reservation.c @@ -474,12 +474,13 @@ bool reservation_object_test_signaled_rcu(struct reservation_object *obj, bool test_all) { unsigned seq, shared_count; - int ret = true; + int ret; + rcu_read_lock(); retry: + ret = true; shared_count = 0; seq = read_seqcount_begin(&obj->seq); - rcu_read_lock(); if (test_all) { unsigned i; @@ -490,46 +491,35 @@ retry: if (fobj) shared_count = fobj->shared_count; - if (read_seqcount_retry(&obj->seq, seq)) - goto unlock_retry; - for (i = 0; i < shared_count; ++i) { struct fence *fence = rcu_dereference(fobj->shared[i]); ret = reservation_object_test_signaled_single(fence); if (ret < 0) - goto unlock_retry; + goto retry; else if (!ret) break; } - /* - * There could be a read_seqcount_retry here, but nothing cares - * about whether it's the old or newer fence pointers that are - * signaled. That race could still have happened after checking - * read_seqcount_retry. If you care, use ww_mutex_lock. - */ + if (read_seqcount_retry(&obj->seq, seq)) + goto retry; } if (!shared_count) { struct fence *fence_excl = rcu_dereference(obj->fence_excl); - if (read_seqcount_retry(&obj->seq, seq)) - goto unlock_retry; - if (fence_excl) { ret = reservation_object_test_signaled_single( fence_excl); if (ret < 0) - goto unlock_retry; + goto retry; + + if (read_seqcount_retry(&obj->seq, seq)) + goto retry; } } rcu_read_unlock(); return ret; - -unlock_retry: - rcu_read_unlock(); - goto retry; } EXPORT_SYMBOL_GPL(reservation_object_test_signaled_rcu); -- 2.9.3 _______________________________________________ dri-devel mailing list dri-devel@lists.freedesktop.org https://lists.freedesktop.org/mailman/listinfo/dri-devel
next prev parent reply other threads:[~2016-08-29 7:24 UTC|newest] Thread overview: 63+ messages / expand[flat|nested] mbox.gz Atom feed top 2016-08-29 7:08 [PATCH 01/11] drm/amdgpu: Remove call to reservation_object_test_signaled_rcu before wait Chris Wilson 2016-08-29 7:08 ` [PATCH 02/11] drm/etnaviv: Remove manual " Chris Wilson 2016-09-23 12:55 ` Daniel Vetter 2016-10-05 16:15 ` Sumit Semwal 2016-10-10 13:17 ` Lucas Stach 2016-08-29 7:08 ` [PATCH 03/11] drm/msm: Remove " Chris Wilson 2016-09-23 12:55 ` Daniel Vetter 2016-09-23 13:07 ` [Intel-gfx] " Rob Clark 2016-08-29 7:08 ` [PATCH 04/11] drm/nouveau: " Chris Wilson 2016-09-23 12:55 ` Daniel Vetter 2016-10-05 16:05 ` Sumit Semwal 2016-08-29 7:08 ` [PATCH 05/11] drm/vmwgfx: " Chris Wilson 2016-09-23 12:56 ` Daniel Vetter 2016-10-05 16:11 ` [Intel-gfx] " Sumit Semwal 2016-10-05 17:03 ` Sinclair Yeh 2016-08-29 7:08 ` [PATCH 06/11] dma-buf: Introduce fence_get_rcu_safe() Chris Wilson 2016-08-29 7:08 ` Chris Wilson 2016-09-23 12:59 ` Daniel Vetter 2016-09-23 12:59 ` Daniel Vetter 2016-09-23 13:34 ` Markus Heiser 2016-09-23 13:34 ` Markus Heiser 2016-08-29 7:08 ` [PATCH 07/11] dma-buf: Restart reservation_object_get_fences_rcu() after writes Chris Wilson 2016-08-29 7:08 ` Chris Wilson 2016-09-23 13:03 ` Daniel Vetter 2016-09-23 13:03 ` Daniel Vetter 2016-08-29 7:08 ` [PATCH 08/11] dma-buf: Restart reservation_object_wait_timeout_rcu() " Chris Wilson 2016-08-29 7:08 ` Chris Wilson 2016-09-23 13:18 ` Daniel Vetter 2016-08-29 7:08 ` Chris Wilson [this message] 2016-08-29 7:08 ` [PATCH 09/11] dma-buf: Restart reservation_object_test_signaled_rcu() " Chris Wilson 2016-09-23 13:43 ` Daniel Vetter 2016-09-23 13:43 ` Daniel Vetter 2016-08-29 7:08 ` [PATCH 10/11] dma-buf: Use seqlock to close RCU race in test_signaled_single Chris Wilson 2016-08-29 7:08 ` Chris Wilson 2016-09-23 13:49 ` [Linaro-mm-sig] " Daniel Vetter 2016-09-23 13:49 ` Daniel Vetter 2016-09-23 14:02 ` Chris Wilson 2016-09-25 20:43 ` Daniel Vetter 2016-09-25 20:43 ` Daniel Vetter 2016-08-29 7:08 ` [PATCH 11/11] dma-buf: Do a fast lockless check for poll with timeout=0 Chris Wilson 2016-08-29 7:08 ` Chris Wilson 2016-08-29 18:16 ` [PATCH] dma-buf/sync-file: Avoid enable fence signaling if poll(.timeout=0) Chris Wilson 2016-08-29 18:16 ` Chris Wilson 2016-08-29 18:26 ` Gustavo Padovan 2016-09-13 14:46 ` Sumit Semwal 2016-09-13 14:46 ` Sumit Semwal 2016-09-15 0:00 ` Rafael Antognolli 2016-09-21 7:26 ` Gustavo Padovan 2016-09-21 11:08 ` Chris Wilson 2016-09-23 13:50 ` [Intel-gfx] [PATCH 11/11] dma-buf: Do a fast lockless check for poll with timeout=0 Daniel Vetter 2016-09-23 13:50 ` Daniel Vetter 2016-09-23 14:15 ` Chris Wilson 2016-09-23 15:06 ` Chris Wilson 2016-09-23 15:06 ` Chris Wilson 2016-09-23 15:20 ` [Intel-gfx] " Chris Wilson 2016-09-23 17:59 ` Christian König 2016-09-23 17:59 ` Christian König 2016-09-25 20:44 ` Daniel Vetter 2016-09-25 20:44 ` Daniel Vetter 2016-08-29 7:50 ` ✗ Fi.CI.BAT: warning for series starting with [01/11] drm/amdgpu: Remove call to reservation_object_test_signaled_rcu before wait Patchwork 2016-08-29 8:20 ` [PATCH 01/11] " Christian König 2016-09-23 12:54 ` Daniel Vetter 2016-10-05 16:03 ` Sumit Semwal
Reply instructions: You may reply publicly to this message via plain-text email using any one of the following methods: * Save the following mbox file, import it into your mail client, and reply-to-all from there: mbox Avoid top-posting and favor interleaved quoting: https://en.wikipedia.org/wiki/Posting_style#Interleaved_style * Reply using the --to, --cc, and --in-reply-to switches of git-send-email(1): git send-email \ --in-reply-to=20160829070834.22296-9-chris@chris-wilson.co.uk \ --to=chris@chris-wilson.co.uk \ --cc=alexander.deucher@amd.com \ --cc=christian.koenig@amd.com \ --cc=daniel.vetter@ffwll.ch \ --cc=dri-devel@lists.freedesktop.org \ --cc=intel-gfx@lists.freedesktop.org \ --cc=linaro-mm-sig@lists.linaro.org \ --cc=linux-media@vger.kernel.org \ --cc=maarten.lankhorst@linux.intel.com \ --cc=sumit.semwal@linaro.org \ /path/to/YOUR_REPLY https://kernel.org/pub/software/scm/git/docs/git-send-email.html * If your mail client supports setting the In-Reply-To header via mailto: links, try the mailto: linkBe sure your reply has a Subject: header at the top and a blank line before the message body.
This is an external index of several public inboxes, see mirroring instructions on how to clone and mirror all data and code used by this external index.