From nobody Sun Feb 8 06:05:34 2026 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-1.web.codeaurora.org [10.30.226.201]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 8EFC81FA851 for ; Mon, 7 Apr 2025 15:22:54 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=10.30.226.201 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1744039374; cv=none; b=pIgV3W8/GS+Um7kFvvELUaFUi86A7EYBmpnZofAjOdCw4wji3UTAzWuMnWGG0DLbap0hO3YQqnKFM5t7EAiDq2YlmgFg7IZJt6sKIsYjST8tf1GunTdmh8t+OsXN8Y9+tq4YT0LzsNo5OQCiHVh9Jl0pT30SVjdumF8Zm7kC9BA= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1744039374; c=relaxed/simple; bh=cWQcv6gBiMhbP+MPQHqqvDH7hXs35yjPqlzbvtzbWUo=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=qwmWu+sovA2kQ1EmbjyZtZaoVtCEhX+4HjRkH6YZEa3XWngoXB0bPRpHqO+D4ttot4HBzUwVHyUAqG5nMviv47UUHAsqvGBk9KEQlFXcwK8+eD14qlJkqj6gfzu/sQLvYuoV1XEiK/tSmfji01IuR5z3oAdb/JJOWAT1Ze1snu0= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b=JLmAVMyv; arc=none smtp.client-ip=10.30.226.201 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b="JLmAVMyv" Received: by smtp.kernel.org (Postfix) with ESMTPSA id 44BBDC4CEE7; Mon, 7 Apr 2025 15:22:51 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=k20201202; t=1744039374; bh=cWQcv6gBiMhbP+MPQHqqvDH7hXs35yjPqlzbvtzbWUo=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=JLmAVMyvDtXHQ4mXDmJ/svFJYH1M9nVc47wrTCPVP9NtVay+w/qn/PiJU4H/KbZ83 JqwMEo9MmeYyC9x+wJfExRLot/VF4ydszPG8+NmUCLb30DCf77g69XrNDh6k+8WoC6 HQhwjI9paVA6K/o0WyF3BCokNKc7xjZPlP2Zluc5yNUmeMHtoS8jG7HYeiRHa/gojE nq7nqryFzzdG5BuW9ER4e5ma6VDCkopF0wyNQru6BGEGE8aCTQhDR4jrlE0tug4x/M KE2hRa+lMXBuPuQf8TdmCMHGTk5fWwD2KHvLvKtJiYP7jJ8bVi7XPwkW4WJjHLPSMF 1yhmHH6NJMkJA== From: Philipp Stanner To: Lyude Paul , Danilo Krummrich , David Airlie , Simona Vetter , Matthew Brost , Philipp Stanner , =?UTF-8?q?Christian=20K=C3=B6nig?= , Maarten Lankhorst , Maxime Ripard , Thomas Zimmermann , Tvrtko Ursulin Cc: dri-devel@lists.freedesktop.org, nouveau@lists.freedesktop.org, linux-kernel@vger.kernel.org, Philipp Stanner Subject: [PATCH 1/5] drm/sched: Fix teardown leaks with waitqueue Date: Mon, 7 Apr 2025 17:22:36 +0200 Message-ID: <20250407152239.34429-3-phasta@kernel.org> X-Mailer: git-send-email 2.48.1 In-Reply-To: <20250407152239.34429-2-phasta@kernel.org> References: <20250407152239.34429-2-phasta@kernel.org> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" From: Philipp Stanner The GPU scheduler currently does not ensure that its pending_list is empty before performing various other teardown tasks in drm_sched_fini(). If there are still jobs in the pending_list, this is problematic because after scheduler teardown, no one will call backend_ops.free_job() anymore. This would, consequently, result in memory leaks. One way to solve this is to implement a waitqueue that drm_sched_fini() blocks on until the pending_list has become empty. Add a waitqueue to struct drm_gpu_scheduler. Wake up waiters once the pending_list becomes empty. Wait in drm_sched_fini() for that to happen. Signed-off-by: Philipp Stanner --- drivers/gpu/drm/scheduler/sched_main.c | 84 ++++++++++++++++++++------ include/drm/gpu_scheduler.h | 8 +++ 2 files changed, 75 insertions(+), 17 deletions(-) diff --git a/drivers/gpu/drm/scheduler/sched_main.c b/drivers/gpu/drm/sched= uler/sched_main.c index 829579c41c6b..a6a4deeda72b 100644 --- a/drivers/gpu/drm/scheduler/sched_main.c +++ b/drivers/gpu/drm/scheduler/sched_main.c @@ -367,7 +367,7 @@ static void drm_sched_run_job_queue(struct drm_gpu_sche= duler *sched) */ static void __drm_sched_run_free_queue(struct drm_gpu_scheduler *sched) { - if (!READ_ONCE(sched->pause_submit)) + if (!READ_ONCE(sched->pause_free)) queue_work(sched->submit_wq, &sched->work_free_job); } =20 @@ -556,6 +556,7 @@ static void drm_sched_job_timedout(struct work_struct *= work) * is parked at which point it's safe. */ list_del_init(&job->list); + spin_unlock(&sched->job_list_lock); =20 status =3D job->sched->ops->timedout_job(job); @@ -572,8 +573,10 @@ static void drm_sched_job_timedout(struct work_struct = *work) spin_unlock(&sched->job_list_lock); } =20 - if (status !=3D DRM_GPU_SCHED_STAT_ENODEV) - drm_sched_start_timeout_unlocked(sched); + if (status !=3D DRM_GPU_SCHED_STAT_ENODEV) { + if (!READ_ONCE(sched->cancel_timeout)) + drm_sched_start_timeout_unlocked(sched); + } } =20 /** @@ -1119,12 +1122,22 @@ drm_sched_get_finished_job(struct drm_gpu_scheduler= *sched) /* remove job from pending_list */ list_del_init(&job->list); =20 + /* + * Inform tasks blocking in drm_sched_fini() that it's now safe to proce= ed. + */ + if (list_empty(&sched->pending_list)) + wake_up(&sched->pending_list_waitque); + /* cancel this job's TO timer */ cancel_delayed_work(&sched->work_tdr); /* make the scheduled timestamp more accurate */ next =3D list_first_entry_or_null(&sched->pending_list, typeof(*next), list); =20 + // TODO RFC: above we wake up the waitque which relies on the fact + // that timeouts have been deactivated. The below should never + // reactivate them since the list was empty above. Still, should + // we document that? if (next) { if (test_bit(DMA_FENCE_FLAG_TIMESTAMP_BIT, &next->s_fence->scheduled.flags)) @@ -1324,6 +1337,7 @@ int drm_sched_init(struct drm_gpu_scheduler *sched, c= onst struct drm_sched_init_ init_waitqueue_head(&sched->job_scheduled); INIT_LIST_HEAD(&sched->pending_list); spin_lock_init(&sched->job_list_lock); + init_waitqueue_head(&sched->pending_list_waitque); atomic_set(&sched->credit_count, 0); INIT_DELAYED_WORK(&sched->work_tdr, drm_sched_job_timedout); INIT_WORK(&sched->work_run_job, drm_sched_run_job_work); @@ -1331,6 +1345,8 @@ int drm_sched_init(struct drm_gpu_scheduler *sched, c= onst struct drm_sched_init_ atomic_set(&sched->_score, 0); atomic64_set(&sched->job_id_count, 0); sched->pause_submit =3D false; + sched->pause_free =3D false; + sched->cancel_timeout =3D false; =20 sched->ready =3D true; return 0; @@ -1348,6 +1364,40 @@ int drm_sched_init(struct drm_gpu_scheduler *sched, = const struct drm_sched_init_ } EXPORT_SYMBOL(drm_sched_init); =20 +/** + * drm_sched_submission_and_timeout_stop - stop everything except for free= _job() + * @sched: scheduler instance + * + * Only needed to cleanly tear down the scheduler in drm_sched_fini(). + */ +static inline void +drm_sched_submission_and_timeout_stop(struct drm_gpu_scheduler *sched) +{ + WRITE_ONCE(sched->pause_submit, true); + WRITE_ONCE(sched->cancel_timeout, true); + cancel_work_sync(&sched->work_run_job); + cancel_delayed_work_sync(&sched->work_tdr); +} + +static inline void +drm_sched_free_stop(struct drm_gpu_scheduler *sched) +{ + WRITE_ONCE(sched->pause_free, true); + cancel_work_sync(&sched->work_free_job); +} + +static inline bool +drm_sched_no_jobs_pending(struct drm_gpu_scheduler *sched) +{ + bool empty; + + spin_lock(&sched->job_list_lock); + empty =3D list_empty(&sched->pending_list); + spin_unlock(&sched->job_list_lock); + + return empty; +} + /** * drm_sched_fini - Destroy a gpu scheduler * @@ -1355,26 +1405,24 @@ EXPORT_SYMBOL(drm_sched_init); * * Tears down and cleans up the scheduler. * - * This stops submission of new jobs to the hardware through - * drm_sched_backend_ops.run_job(). Consequently, drm_sched_backend_ops.fr= ee_job() - * will not be called for all jobs still in drm_gpu_scheduler.pending_list. - * There is no solution for this currently. Thus, it is up to the driver t= o make - * sure that: - * - * a) drm_sched_fini() is only called after for all submitted jobs - * drm_sched_backend_ops.free_job() has been called or that - * b) the jobs for which drm_sched_backend_ops.free_job() has not been ca= lled - * after drm_sched_fini() ran are freed manually. - * - * FIXME: Take care of the above problem and prevent this function from le= aking - * the jobs in drm_gpu_scheduler.pending_list under any circumstances. + * Note that this function blocks until all the fences returned by + * &struct drm_sched_backend_ops.run_job have been signalled. */ void drm_sched_fini(struct drm_gpu_scheduler *sched) { struct drm_sched_entity *s_entity; int i; =20 - drm_sched_wqueue_stop(sched); + /* + * Jobs that have neither been scheduled or which have timed out are + * gone by now, but jobs that have been submitted through + * backend_ops.run_job() and have not yet terminated are still pending. + * + * Wait for the pending_list to become empty to avoid leaking those jobs. + */ + drm_sched_submission_and_timeout_stop(sched); + wait_event(sched->pending_list_waitque, drm_sched_no_jobs_pending(sched)); + drm_sched_free_stop(sched); =20 for (i =3D DRM_SCHED_PRIORITY_KERNEL; i < sched->num_rqs; i++) { struct drm_sched_rq *rq =3D sched->sched_rq[i]; @@ -1471,6 +1519,7 @@ EXPORT_SYMBOL(drm_sched_wqueue_ready); void drm_sched_wqueue_stop(struct drm_gpu_scheduler *sched) { WRITE_ONCE(sched->pause_submit, true); + WRITE_ONCE(sched->pause_free, true); cancel_work_sync(&sched->work_run_job); cancel_work_sync(&sched->work_free_job); } @@ -1488,6 +1537,7 @@ EXPORT_SYMBOL(drm_sched_wqueue_stop); void drm_sched_wqueue_start(struct drm_gpu_scheduler *sched) { WRITE_ONCE(sched->pause_submit, false); + WRITE_ONCE(sched->pause_free, false); queue_work(sched->submit_wq, &sched->work_run_job); queue_work(sched->submit_wq, &sched->work_free_job); } diff --git a/include/drm/gpu_scheduler.h b/include/drm/gpu_scheduler.h index 1a7e377d4cbb..badcf9ea4501 100644 --- a/include/drm/gpu_scheduler.h +++ b/include/drm/gpu_scheduler.h @@ -29,6 +29,7 @@ #include #include #include +#include =20 #define MAX_WAIT_SCHED_ENTITY_Q_EMPTY msecs_to_jiffies(1000) =20 @@ -533,6 +534,8 @@ struct drm_sched_backend_ops { * timeout interval is over. * @pending_list: the list of jobs which are currently in the job queue. * @job_list_lock: lock to protect the pending_list. + * @pending_list_waitque: a waitqueue for drm_sched_fini() to block on unt= il all + * pending jobs have been finished. * @hang_limit: once the hangs by a job crosses this limit then it is mark= ed * guilty and it will no longer be considered for scheduling. * @score: score to help loadbalancer pick a idle sched @@ -540,6 +543,8 @@ struct drm_sched_backend_ops { * @ready: marks if the underlying HW is ready to work * @free_guilty: A hit to time out handler to free the guilty job. * @pause_submit: pause queuing of @work_run_job on @submit_wq + * @pause_free: pause queuing of @work_free_job on @submit_wq + * @cancel_timeout: pause queuing of @work_tdr on @submit_wq * @own_submit_wq: scheduler owns allocation of @submit_wq * @dev: system &struct device * @@ -562,12 +567,15 @@ struct drm_gpu_scheduler { struct delayed_work work_tdr; struct list_head pending_list; spinlock_t job_list_lock; + wait_queue_head_t pending_list_waitque; int hang_limit; atomic_t *score; atomic_t _score; bool ready; bool free_guilty; bool pause_submit; + bool pause_free; + bool cancel_timeout; bool own_submit_wq; struct device *dev; }; --=20 2.48.1