From 7134e9e852116f86745cd23312bbfba34100bf6d Mon Sep 17 00:00:00 2001 From: David Nieto Date: Mon, 18 Sep 2017 20:31:28 -0700 Subject: gpu: nvgpu: prevent crash during unbind This change solves crashes during bind that were introduced in the driver during the OS unification refactoring due to lack of coverage of the remove() function. The fixes during remove are: (1) Prevent NULL dereference on GPUs with secure boot (2) Prevent NULL dereferences when fecs_trace is not enabled (3) Added PRAMIN blocker during driver removal if HW is no longer accesible (4) Prevent double free of debugfs nodes as they are handled on the debugfs_remove_recursive() call (5) quiesce() can now be called without checking is HW accesible flag is set (6) added function to free irq so no IRQ association is left on the driver after it is removed (7) prevent NULL dereference on nvgpu_thread_stop() if the thread is already stopped JIRA: EVLR-1739 Change-Id: I787d38f202d5267a6b34815f23e1bc88110e8455 Signed-off-by: David Nieto Reviewed-on: https://git-master.nvidia.com/r/1563005 Reviewed-by: mobile promotions Tested-by: mobile promotions --- drivers/gpu/nvgpu/gk20a/channel_gk20a.c | 37 +++++++++++++++++++----------- drivers/gpu/nvgpu/gk20a/fecs_trace_gk20a.c | 33 ++++++++++++-------------- 2 files changed, 38 insertions(+), 32 deletions(-) (limited to 'drivers/gpu/nvgpu/gk20a') diff --git a/drivers/gpu/nvgpu/gk20a/channel_gk20a.c b/drivers/gpu/nvgpu/gk20a/channel_gk20a.c index 0b8422a6..ea69d7cb 100644 --- a/drivers/gpu/nvgpu/gk20a/channel_gk20a.c +++ b/drivers/gpu/nvgpu/gk20a/channel_gk20a.c @@ -465,21 +465,30 @@ static void gk20a_free_channel(struct channel_gk20a *ch, bool force) trace_gk20a_free_channel(ch->chid); - /* abort channel and remove from runlist */ - if (gk20a_is_channel_marked_as_tsg(ch)) { - err = g->ops.fifo.tsg_unbind_channel(ch); - if (err) - nvgpu_err(g, "failed to unbind channel %d from TSG", ch->chid); - /* - * Channel is not a part of TSG this point onwards - * So stash its status and use it whenever necessary - * e.g. while releasing gr_ctx in g->ops.gr.free_channel_ctx() - */ - was_tsg = true; - } else { - gk20a_disable_channel(ch); + /* + * Disable channel/TSG and unbind here. This should not be executed if + * HW access is not available during shutdown/removal path as it will + * trigger a timeout + */ + if (!nvgpu_is_enabled(g, NVGPU_DRIVER_IS_DYING)) { + /* abort channel and remove from runlist */ + if (gk20a_is_channel_marked_as_tsg(ch)) { + err = g->ops.fifo.tsg_unbind_channel(ch); + if (err) + nvgpu_err(g, + "failed to unbind channel %d from TSG", + ch->chid); + /* + * Channel is not a part of TSG this point onwards + * So stash its status and use it whenever necessary + * e.g. while releasing gr_ctx in + * g->ops.gr.free_channel_ctx() + */ + was_tsg = true; + } else { + gk20a_disable_channel(ch); + } } - /* wait until there's only our ref to the channel */ if (!force) gk20a_wait_until_counter_is_N( diff --git a/drivers/gpu/nvgpu/gk20a/fecs_trace_gk20a.c b/drivers/gpu/nvgpu/gk20a/fecs_trace_gk20a.c index fea3b0fa..71cba9ec 100644 --- a/drivers/gpu/nvgpu/gk20a/fecs_trace_gk20a.c +++ b/drivers/gpu/nvgpu/gk20a/fecs_trace_gk20a.c @@ -67,6 +67,7 @@ struct gk20a_fecs_trace { struct nvgpu_mutex hash_lock; struct nvgpu_mutex poll_lock; struct nvgpu_thread poll_task; + bool init; }; #ifdef CONFIG_GK20A_CTXSW_TRACE @@ -547,23 +548,12 @@ static void gk20a_fecs_trace_debugfs_init(struct gk20a *g) &gk20a_fecs_trace_debugfs_ring_fops); } -static void gk20a_fecs_trace_debugfs_cleanup(struct gk20a *g) -{ - struct nvgpu_os_linux *l = nvgpu_os_linux_from_gk20a(g); - - debugfs_remove_recursive(l->debugfs); -} - #else static void gk20a_fecs_trace_debugfs_init(struct gk20a *g) { } -static inline void gk20a_fecs_trace_debugfs_cleanup(struct gk20a *g) -{ -} - #endif /* CONFIG_DEBUG_FS */ int gk20a_fecs_trace_init(struct gk20a *g) @@ -598,6 +588,9 @@ int gk20a_fecs_trace_init(struct gk20a *g) NVGPU_GPU_FLAGS_SUPPORT_FECS_CTXSW_TRACE; gk20a_fecs_trace_debugfs_init(g); + + trace->init = true; + return 0; clean_hash_lock: @@ -682,15 +675,17 @@ int gk20a_fecs_trace_unbind_channel(struct gk20a *g, struct channel_gk20a *ch) { u32 context_ptr = gk20a_fecs_trace_fecs_context_ptr(g, ch); - gk20a_dbg(gpu_dbg_fn|gpu_dbg_ctxsw, + if (g->fecs_trace) { + gk20a_dbg(gpu_dbg_fn|gpu_dbg_ctxsw, "ch=%p context_ptr=%x", ch, context_ptr); - if (g->ops.fecs_trace.is_enabled(g)) { - if (g->ops.fecs_trace.flush) - g->ops.fecs_trace.flush(g); - gk20a_fecs_trace_poll(g); + if (g->ops.fecs_trace.is_enabled(g)) { + if (g->ops.fecs_trace.flush) + g->ops.fecs_trace.flush(g); + gk20a_fecs_trace_poll(g); + } + gk20a_fecs_trace_hash_del(g, context_ptr); } - gk20a_fecs_trace_hash_del(g, context_ptr); return 0; } @@ -709,7 +704,9 @@ int gk20a_fecs_trace_deinit(struct gk20a *g) { struct gk20a_fecs_trace *trace = g->fecs_trace; - gk20a_fecs_trace_debugfs_cleanup(g); + if (!trace->init) + return 0; + nvgpu_thread_stop(&trace->poll_task); gk20a_fecs_trace_free_ring(g); gk20a_fecs_trace_free_hash_table(g); -- cgit v1.2.2