gpu: nvgpu: prevent crash during unbind

This change solves crashes during bind that were introduced in the driver
during the OS unification refactoring due to lack of coverage of the remove()
function.

The fixes during remove are:

(1) Prevent NULL dereference on GPUs with secure boot
(2) Prevent NULL dereferences when fecs_trace is not enabled
(3) Added PRAMIN blocker during driver removal if HW is no longer accesible
(4) Prevent double free of debugfs nodes as they are handled on the
debugfs_remove_recursive() call
(5) quiesce() can now be called without checking is HW accesible flag is set
(6) added function to free irq so no IRQ association is left on the driver after
it is removed
(7) prevent NULL dereference on nvgpu_thread_stop() if the thread is already
stopped

JIRA: EVLR-1739

Change-Id: I787d38f202d5267a6b34815f23e1bc88110e8455
Signed-off-by: David Nieto <dmartineznie@nvidia.com>
Reviewed-on: https://git-master.nvidia.com/r/1563005
Reviewed-by: mobile promotions <svcmobile_promotions@nvidia.com>
Tested-by: mobile promotions <svcmobile_promotions@nvidia.com>

2 files changed, 38 insertions, 32 deletions

diff --git a/drivers/gpu/nvgpu/gk20a/channel_gk20a.c b/drivers/gpu/nvgpu/gk20a/channel_gk20a.c
index 0b8422a6..ea69d7cb 100644
--- a/drivers/gpu/nvgpu/gk20a/channel_gk20a.c
+++ b/drivers/gpu/nvgpu/gk20a/channel_gk20a.c
@@ -465,21 +465,30 @@ static void gk20a_free_channel(struct channel_gk20a *ch, bool force)
 
         trace_gk20a_free_channel(ch->chid);
 
-        /* abort channel and remove from runlist */
-        if (gk20a_is_channel_marked_as_tsg(ch)) {
-                err = g->ops.fifo.tsg_unbind_channel(ch);
-                if (err)
-                        nvgpu_err(g, "failed to unbind channel %d from TSG", ch->chid);
-                /*
-                 * Channel is not a part of TSG this point onwards
-                 * So stash its status and use it whenever necessary
-                 * e.g. while releasing gr_ctx in g->ops.gr.free_channel_ctx()
-                 */
-                was_tsg = true;
-        } else {
-                gk20a_disable_channel(ch);
+        /*
+         * Disable channel/TSG and unbind here. This should not be executed if
+         * HW access is not available during shutdown/removal path as it will
+         * trigger a timeout
+         */
+        if (!nvgpu_is_enabled(g, NVGPU_DRIVER_IS_DYING)) {
+                /* abort channel and remove from runlist */
+                if (gk20a_is_channel_marked_as_tsg(ch)) {
+                        err = g->ops.fifo.tsg_unbind_channel(ch);
+                        if (err)
+                                nvgpu_err(g,
+                                        "failed to unbind channel %d from TSG",
+                                        ch->chid);
+                        /*
+                         * Channel is not a part of TSG this point onwards
+                         * So stash its status and use it whenever necessary
+                         * e.g. while releasing gr_ctx in
+                         * g->ops.gr.free_channel_ctx()
+                         */
+                        was_tsg = true;
+                } else {
+                        gk20a_disable_channel(ch);
+                }
         }
-
         /* wait until there's only our ref to the channel */
         if (!force)
                 gk20a_wait_until_counter_is_N(
diff --git a/drivers/gpu/nvgpu/gk20a/fecs_trace_gk20a.c b/drivers/gpu/nvgpu/gk20a/fecs_trace_gk20a.c
index fea3b0fa..71cba9ec 100644
--- a/drivers/gpu/nvgpu/gk20a/fecs_trace_gk20a.c
+++ b/drivers/gpu/nvgpu/gk20a/fecs_trace_gk20a.c
@@ -67,6 +67,7 @@ struct gk20a_fecs_trace {
         struct nvgpu_mutex hash_lock;
         struct nvgpu_mutex poll_lock;
         struct nvgpu_thread poll_task;
+        bool init;
 };
 
 #ifdef CONFIG_GK20A_CTXSW_TRACE
@@ -547,23 +548,12 @@ static void gk20a_fecs_trace_debugfs_init(struct gk20a *g)
                 &gk20a_fecs_trace_debugfs_ring_fops);
 }
 
-static void gk20a_fecs_trace_debugfs_cleanup(struct gk20a *g)
-{
-        struct nvgpu_os_linux *l = nvgpu_os_linux_from_gk20a(g);
-
-        debugfs_remove_recursive(l->debugfs);
-}
-
 #else
 
 static void gk20a_fecs_trace_debugfs_init(struct gk20a *g)
 {
 }
 
-static inline void gk20a_fecs_trace_debugfs_cleanup(struct gk20a *g)
-{
-}
-
 #endif /* CONFIG_DEBUG_FS */
 
 int gk20a_fecs_trace_init(struct gk20a *g)
@@ -598,6 +588,9 @@ int gk20a_fecs_trace_init(struct gk20a *g)
                 NVGPU_GPU_FLAGS_SUPPORT_FECS_CTXSW_TRACE;
 
         gk20a_fecs_trace_debugfs_init(g);
+
+        trace->init = true;
+
         return 0;
 
 clean_hash_lock:
@@ -682,15 +675,17 @@ int gk20a_fecs_trace_unbind_channel(struct gk20a *g, struct channel_gk20a *ch)
 {
         u32 context_ptr = gk20a_fecs_trace_fecs_context_ptr(g, ch);
 
-        gk20a_dbg(gpu_dbg_fn|gpu_dbg_ctxsw,
+        if (g->fecs_trace) {
+                gk20a_dbg(gpu_dbg_fn|gpu_dbg_ctxsw,
                         "ch=%p context_ptr=%x", ch, context_ptr);
 
-        if (g->ops.fecs_trace.is_enabled(g)) {
-                if (g->ops.fecs_trace.flush)
-                        g->ops.fecs_trace.flush(g);
-                gk20a_fecs_trace_poll(g);
+                if (g->ops.fecs_trace.is_enabled(g)) {
+                        if (g->ops.fecs_trace.flush)
+                                g->ops.fecs_trace.flush(g);
+                        gk20a_fecs_trace_poll(g);
+                }
+                gk20a_fecs_trace_hash_del(g, context_ptr);
         }
-        gk20a_fecs_trace_hash_del(g, context_ptr);
         return 0;
 }
 
@@ -709,7 +704,9 @@ int gk20a_fecs_trace_deinit(struct gk20a *g)
 {
         struct gk20a_fecs_trace *trace = g->fecs_trace;
 
-        gk20a_fecs_trace_debugfs_cleanup(g);
+        if (!trace->init)
+                return 0;
+
         nvgpu_thread_stop(&trace->poll_task);
         gk20a_fecs_trace_free_ring(g);
         gk20a_fecs_trace_free_hash_table(g);