gpu: nvgpu: kill TSG if channel has NEXT set while closing

Currently if channel has NEXT bit set while closing the channel we just print
an error and continue channel unbind sequence from TSG

But since channel with NEXT set is active killing it can potentially corrupt
the TSG context and cause unpredictable errors on remaining channels/TSG

Hence fix this by killing whole TSG context if channel being closed has
NEXT bit set

if gk20a_fifo_tsg_unbind_channel() API returns error, kill the TSG
otherwise continue with channel unbind sequence

Bug 200327095

Change-Id: I2abf1a3db8ba6f105b6ca86e78006c7b2a7726cc
Signed-off-by: Deepak Nibade <dnibade@nvidia.com>
Reviewed-on: https://git-master.nvidia.com/r/1568566
Reviewed-by: svc-mobile-coverity <svc-mobile-coverity@nvidia.com>
Reviewed-by: svccoveritychecker <svccoveritychecker@nvidia.com>
GVS: Gerrit_Virtual_Submit
Reviewed-by: Konsta Holtta <kholtta@nvidia.com>
Reviewed-by: Vijayakumar Subbu <vsubbu@nvidia.com>

2 files changed, 17 insertions, 5 deletions

diff --git a/drivers/gpu/nvgpu/gk20a/fifo_gk20a.c b/drivers/gpu/nvgpu/gk20a/fifo_gk20a.c
index 8e78b95e..9eb2204d 100644
--- a/drivers/gpu/nvgpu/gk20a/fifo_gk20a.c
+++ b/drivers/gpu/nvgpu/gk20a/fifo_gk20a.c
@@ -1918,9 +1918,11 @@ int gk20a_fifo_tsg_unbind_channel_verify_status(struct channel_gk20a *ch)
         if (g->ops.fifo.tsg_verify_status_faulted)
                 g->ops.fifo.tsg_verify_status_faulted(ch);
 
-        if (gk20a_fifo_channel_status_is_next(g, ch->chid))
-                nvgpu_err(g, "Channel %d to be removed from TSG has NEXT set!",
-                        ch->chid);
+        if (gk20a_fifo_channel_status_is_next(g, ch->chid)) {
+                nvgpu_err(g, "Channel %d to be removed from TSG %d has NEXT set!",
+                        ch->chid, ch->tsgid);
+                return -EINVAL;
+        }
 
         return 0;
 }
diff --git a/drivers/gpu/nvgpu/gk20a/tsg_gk20a.c b/drivers/gpu/nvgpu/gk20a/tsg_gk20a.c
index e285f96c..6c1c2955 100644
--- a/drivers/gpu/nvgpu/gk20a/tsg_gk20a.c
+++ b/drivers/gpu/nvgpu/gk20a/tsg_gk20a.c
@@ -150,8 +150,18 @@ int gk20a_tsg_unbind_channel(struct channel_gk20a *ch)
         int err;
 
         err = gk20a_fifo_tsg_unbind_channel(ch);
-        if (err)
-                return err;
+        if (err) {
+                nvgpu_err(g, "Channel %d unbind failed, tearing down TSG %d",
+                        ch->chid, tsg->tsgid);
+
+                gk20a_fifo_abort_tsg(ch->g, ch->tsgid, true);
+                /* If channel unbind fails, channel is still part of runlist */
+                channel_gk20a_update_runlist(ch, false);
+
+                down_write(&tsg->ch_list_lock);
+                nvgpu_list_del(&ch->ch_entry);
+                up_write(&tsg->ch_list_lock);
+        }
 
         nvgpu_ref_put(&tsg->refcount, gk20a_tsg_release);
         ch->tsgid = NVGPU_INVALID_TSG_ID;