[PATCH] accel/ivpu: Fix pm related deadlocks in cmdq ioctls
Jacek Lawrynowicz
jacek.lawrynowicz at linux.intel.com
Wed Apr 30 09:54:45 UTC 2025
Applied to drm-misc-fixes
On 4/25/2025 11:33 AM, Jacek Lawrynowicz wrote:
> Fix deadlocks in ivpu_cmdq_create_ioctl() and ivpu_cmdq_destroy_ioctl()
> related to runtime suspend.
>
> Runtime suspend acquires file_priv->lock mutex by calling
> ivpu_cmdq_reset_all_contexts(). The same lock is acquired in the cmdq
> ioctls. If one of the cmdq ioctls is called while runtime suspend is in
> progress, it can lead to a deadlock.
>
> Call stacks from example deadlock below.
>
> Runtime suspend thread:
> [ 3443.179717] Call Trace:
> [ 3443.179724] __schedule+0x4b6/0x16b0
> [ 3443.179732] ? __mod_timer+0x27d/0x3a0
> [ 3443.179738] schedule+0x2f/0x140
> [ 3443.179741] schedule_preempt_disabled+0x19/0x30
> [ 3443.179743] __mutex_lock.constprop.0+0x335/0x7d0
> [ 3443.179745] ? xas_find+0x1ed/0x260
> [ 3443.179747] ? xa_find+0x8e/0xf0
> [ 3443.179749] __mutex_lock_slowpath+0x13/0x20
> [ 3443.179751] mutex_lock+0x41/0x60
> [ 3443.179757] ivpu_cmdq_reset_all_contexts+0x82/0x150 [intel_vpu a9bd091a97f28f0235f161316b29f8234f437295]
> [ 3443.179786] ivpu_pm_runtime_suspend_cb+0x1f1/0x3f0 [intel_vpu a9bd091a97f28f0235f161316b29f8234f437295]
> [ 3443.179850] pci_pm_runtime_suspend+0x6e/0x1f0
> [ 3443.179870] ? __pfx_pci_pm_runtime_suspend+0x10/0x10
> [ 3443.179886] __rpm_callback+0x48/0x130
> [ 3443.179899] rpm_callback+0x64/0x70
> [ 3443.179911] rpm_suspend+0x12c/0x630
> [ 3443.179922] ? __schedule+0x4be/0x16b0
> [ 3443.179941] pm_runtime_work+0xca/0xf0
> [ 3443.179955] process_one_work+0x188/0x3d0
> [ 3443.179971] worker_thread+0x2b9/0x3c0
> [ 3443.179984] kthread+0xfb/0x220
> [ 3443.180001] ? __pfx_worker_thread+0x10/0x10
> [ 3443.180013] ? __pfx_kthread+0x10/0x10
> [ 3443.180029] ret_from_fork+0x47/0x70
> [ 3443.180044] ? __pfx_kthread+0x10/0x10
> [ 3443.180059] ret_from_fork_asm+0x1a/0x30
>
> User space thread:
> [ 3443.180128] Call Trace:
> [ 3443.180138] __schedule+0x4b6/0x16b0
> [ 3443.180159] schedule+0x2f/0x140
> [ 3443.180163] rpm_resume+0x1a7/0x6a0
> [ 3443.180165] ? __pfx_autoremove_wake_function+0x10/0x10
> [ 3443.180169] __pm_runtime_resume+0x56/0x90
> [ 3443.180171] ivpu_rpm_get+0x28/0xb0 [intel_vpu a9bd091a97f28f0235f161316b29f8234f437295]
> [ 3443.180181] ivpu_ipc_send_receive+0x6d/0x120 [intel_vpu a9bd091a97f28f0235f161316b29f8234f437295]
> [ 3443.180193] ? free_frozen_pages+0x395/0x670
> [ 3443.180199] ? __free_pages+0xa7/0xc0
> [ 3443.180202] ivpu_jsm_hws_destroy_cmdq+0x76/0xf0 [intel_vpu a9bd091a97f28f0235f161316b29f8234f437295]
> [ 3443.180213] ? locks_dispose_list+0x6c/0xa0
> [ 3443.180219] ? kmem_cache_free+0x342/0x470
> [ 3443.180222] ? vm_area_free+0x19/0x30
> [ 3443.180225] ? xas_load+0x17/0xf0
> [ 3443.180229] ? xa_load+0x72/0xb0
> [ 3443.180230] ivpu_cmdq_unregister.isra.0+0xb1/0x100 [intel_vpu a9bd091a97f28f0235f161316b29f8234f437295]
> [ 3443.180241] ivpu_cmdq_destroy_ioctl+0x8d/0x130 [intel_vpu a9bd091a97f28f0235f161316b29f8234f437295]
> [ 3443.180251] ? __pfx_ivpu_cmdq_destroy_ioctl+0x10/0x10 [intel_vpu a9bd091a97f28f0235f161316b29f8234f437295]
> [ 3443.180260] drm_ioctl_kernel+0xb3/0x110
> [ 3443.180265] drm_ioctl+0x2ca/0x580
> [ 3443.180266] ? __pfx_ivpu_cmdq_destroy_ioctl+0x10/0x10 [intel_vpu a9bd091a97f28f0235f161316b29f8234f437295]
> [ 3443.180275] ? __fput+0x1ae/0x2f0
> [ 3443.180279] ? kmem_cache_free+0x342/0x470
> [ 3443.180282] __x64_sys_ioctl+0xa9/0xe0
> [ 3443.180286] x64_sys_call+0x13b7/0x26f0
> [ 3443.180289] do_syscall_64+0x62/0x180
> [ 3443.180291] entry_SYSCALL_64_after_hwframe+0x71/0x79
>
> Fixes: 465a3914b254 ("accel/ivpu: Add API for command queue create/destroy/submit")
> Signed-off-by: Jacek Lawrynowicz <jacek.lawrynowicz at linux.intel.com>
> ---
> drivers/accel/ivpu/ivpu_job.c | 33 ++++++++++++++++++++++++---------
> 1 file changed, 24 insertions(+), 9 deletions(-)
>
> diff --git a/drivers/accel/ivpu/ivpu_job.c b/drivers/accel/ivpu/ivpu_job.c
> index 863e3cd6ace51..e17b3deda2012 100644
> --- a/drivers/accel/ivpu/ivpu_job.c
> +++ b/drivers/accel/ivpu/ivpu_job.c
> @@ -874,15 +874,21 @@ int ivpu_cmdq_submit_ioctl(struct drm_device *dev, void *data, struct drm_file *
> int ivpu_cmdq_create_ioctl(struct drm_device *dev, void *data, struct drm_file *file)
> {
> struct ivpu_file_priv *file_priv = file->driver_priv;
> + struct ivpu_device *vdev = file_priv->vdev;
> struct drm_ivpu_cmdq_create *args = data;
> struct ivpu_cmdq *cmdq;
> + int ret;
>
> - if (!ivpu_is_capable(file_priv->vdev, DRM_IVPU_CAP_MANAGE_CMDQ))
> + if (!ivpu_is_capable(vdev, DRM_IVPU_CAP_MANAGE_CMDQ))
> return -ENODEV;
>
> if (args->priority > DRM_IVPU_JOB_PRIORITY_REALTIME)
> return -EINVAL;
>
> + ret = ivpu_rpm_get(vdev);
> + if (ret < 0)
> + return ret;
> +
> mutex_lock(&file_priv->lock);
>
> cmdq = ivpu_cmdq_create(file_priv, ivpu_job_to_jsm_priority(args->priority), false);
> @@ -891,6 +897,8 @@ int ivpu_cmdq_create_ioctl(struct drm_device *dev, void *data, struct drm_file *
>
> mutex_unlock(&file_priv->lock);
>
> + ivpu_rpm_put(vdev);
> +
> return cmdq ? 0 : -ENOMEM;
> }
>
> @@ -900,28 +908,35 @@ int ivpu_cmdq_destroy_ioctl(struct drm_device *dev, void *data, struct drm_file
> struct ivpu_device *vdev = file_priv->vdev;
> struct drm_ivpu_cmdq_destroy *args = data;
> struct ivpu_cmdq *cmdq;
> - u32 cmdq_id;
> + u32 cmdq_id = 0;
> int ret;
>
> if (!ivpu_is_capable(vdev, DRM_IVPU_CAP_MANAGE_CMDQ))
> return -ENODEV;
>
> + ret = ivpu_rpm_get(vdev);
> + if (ret < 0)
> + return ret;
> +
> mutex_lock(&file_priv->lock);
>
> cmdq = xa_load(&file_priv->cmdq_xa, args->cmdq_id);
> if (!cmdq || cmdq->is_legacy) {
> ret = -ENOENT;
> - goto err_unlock;
> + } else {
> + cmdq_id = cmdq->id;
> + ivpu_cmdq_destroy(file_priv, cmdq);
> + ret = 0;
> }
>
> - cmdq_id = cmdq->id;
> - ivpu_cmdq_destroy(file_priv, cmdq);
> mutex_unlock(&file_priv->lock);
> - ivpu_cmdq_abort_all_jobs(vdev, file_priv->ctx.id, cmdq_id);
> - return 0;
>
> -err_unlock:
> - mutex_unlock(&file_priv->lock);
> + /* Abort any pending jobs only if cmdq was destroyed */
> + if (!ret)
> + ivpu_cmdq_abort_all_jobs(vdev, file_priv->ctx.id, cmdq_id);
> +
> + ivpu_rpm_put(vdev);
> +
> return ret;
> }
>
More information about the dri-devel
mailing list