From: Boris Brezillon <boris.brezillon@collabora.com>
To: Steven Price <steven.price@arm.com>, Liviu Dudau <liviu.dudau@arm.com>
Cc: Maarten Lankhorst <maarten.lankhorst@linux.intel.com>,
Maxime Ripard <mripard@kernel.org>,
Thomas Zimmermann <tzimmermann@suse.de>,
David Airlie <airlied@gmail.com>,
Simona Vetter <simona@ffwll.ch>,
dri-devel@lists.freedesktop.org, linux-kernel@vger.kernel.org,
Boris Brezillon <boris.brezillon@collabora.com>
Subject: [PATCH v2 14/17] drm/panthor: Track user owned groups
Date: Tue, 11 Aug 2026 12:17:48 +0200 [thread overview]
Message-ID: <20260811-panthor-unplug-fixes-v2-14-6b583e37f9ae@collabora.com> (raw)
In-Reply-To: <20260811-panthor-unplug-fixes-v2-0-6b583e37f9ae@collabora.com>
A group can outlive its user handle because of internal refs. In order
to fix the unplug logic, we need to keep track of groups that have a
valid user handle so we can release the references that were owned by
the user processes in the unplug path.
This is the prep work to keep track of user owned groups. Note that
the destroyed attribute is dropped because it's equivalent to checking
whether the group is inserted in the user_owned list now.
Signed-off-by: Boris Brezillon <boris.brezillon@collabora.com>
---
drivers/gpu/drm/panthor/panthor_sched.c | 39 +++++++++++++++++++++++----------
1 file changed, 27 insertions(+), 12 deletions(-)
diff --git a/drivers/gpu/drm/panthor/panthor_sched.c b/drivers/gpu/drm/panthor/panthor_sched.c
index f18b2e03f2fd..756c3fa7a242 100644
--- a/drivers/gpu/drm/panthor/panthor_sched.c
+++ b/drivers/gpu/drm/panthor/panthor_sched.c
@@ -252,6 +252,15 @@ struct panthor_scheduler {
* This list is evaluated in the @sync_upd_work work.
*/
struct list_head waiting;
+
+ /**
+ * @user_owned: List of groups that have a valid user handle.
+ *
+ * All groups are inserted in this list at creation time through their
+ * panthor_group;:user_node, and evicted from this list when
+ * panthor_group_destroy() is called.
+ */
+ struct list_head user_owned;
} groups;
/**
@@ -587,15 +596,6 @@ struct panthor_group {
*/
int csg_id;
- /**
- * @destroyed: True when the group has been destroyed.
- *
- * If a group is destroyed it becomes useless: no further jobs can be submitted
- * to its queues. We simply wait for all references to be dropped so we can
- * release the group object.
- */
- bool destroyed;
-
/**
* @timedout: True when a timeout occurred on any of the queues owned by
* this group.
@@ -705,6 +705,17 @@ struct panthor_group {
* panthor_group::groups::waiting list.
*/
struct list_head wait_node;
+
+ /**
+ * @user_node: Used to insert the group in the panthor_scheduler::groups::user_owned list.
+ *
+ * When the group is created, it's inserted in panthor_scheduler::groups::user_owned,
+ * and when panthor_group_destroy, the group is remove from this list.
+ *
+ * When the device is unplugged, all groups that remain in this list must have an extra
+ * put_group() called on them to release the reference owned by the per-file group pool.
+ */
+ struct list_head user_node;
};
struct panthor_job_profiling_data {
@@ -967,6 +978,7 @@ static void group_release(struct kref *kref)
struct panthor_device *ptdev = group->ptdev;
drm_WARN_ON(&ptdev->base, group->csg_id >= 0);
+ drm_WARN_ON(&ptdev->base, !list_empty(&group->user_node));
drm_WARN_ON(&ptdev->base, !list_empty(&group->run_node));
drm_WARN_ON(&ptdev->base, !list_empty(&group->wait_node));
@@ -1082,7 +1094,7 @@ group_can_run(struct panthor_group *group)
{
return group->state != PANTHOR_CS_GROUP_TERMINATED &&
group->state != PANTHOR_CS_GROUP_UNKNOWN_STATE &&
- !group->destroyed && group->fatal_queues == 0 &&
+ !list_empty(&group->user_node) && group->fatal_queues == 0 &&
!group->timedout;
}
@@ -2403,7 +2415,7 @@ tick_ctx_apply(struct panthor_scheduler *sched, struct panthor_sched_tick_ctx *c
* re-evaluate as soon as possible and get rid of
* this dangling group.
*/
- if (group->destroyed)
+ if (list_empty(&group->user_node))
ctx->immediate_tick = true;
group_put(group);
}
@@ -3691,6 +3703,7 @@ int panthor_group_create(struct panthor_file *pfile,
group->tiler_core_mask = group_args->tiler_core_mask;
group->priority = group_args->priority;
+ INIT_LIST_HEAD(&group->user_node);
INIT_LIST_HEAD(&group->wait_node);
INIT_LIST_HEAD(&group->run_node);
INIT_WORK(&group->term_work, group_term_work);
@@ -3764,6 +3777,7 @@ int panthor_group_create(struct panthor_file *pfile,
mutex_lock(&sched->lock);
list_add_tail(&group->run_node,
&sched->groups.idle[group->priority]);
+ list_add_tail(&group->user_node, &sched->groups.user_owned);
mutex_unlock(&sched->lock);
}
mutex_unlock(&sched->reset.lock);
@@ -3801,7 +3815,7 @@ int panthor_group_destroy(struct panthor_file *pfile, u32 group_handle)
mutex_lock(&sched->reset.lock);
mutex_lock(&sched->lock);
- group->destroyed = true;
+ list_del_init(&group->user_node);
if (group->csg_id >= 0) {
sched_queue_delayed_work(sched, tick, 0);
} else if (!atomic_read(&sched->reset.in_progress)) {
@@ -4167,6 +4181,7 @@ int panthor_sched_init(struct panthor_device *ptdev)
INIT_LIST_HEAD(&sched->groups.idle[prio]);
}
INIT_LIST_HEAD(&sched->groups.waiting);
+ INIT_LIST_HEAD(&sched->groups.user_owned);
ret = drmm_mutex_init(&ptdev->base, &sched->reset.lock);
if (ret)
--
2.55.0
next prev parent reply other threads:[~2026-08-11 10:18 UTC|newest]
Thread overview: 18+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-08-11 10:17 [PATCH v2 00/17] drm/panthor: Fix the unplug logic Boris Brezillon
2026-08-11 10:17 ` [PATCH v2 01/17] drm/panthor: Disable reset work before unplug Boris Brezillon
2026-08-11 10:17 ` [PATCH v2 02/17] drm/panthor: Further delay reset work enablement Boris Brezillon
2026-08-11 10:17 ` [PATCH v2 03/17] drm/panthor: Make sure reset requests in the resume path are not lost Boris Brezillon
2026-08-11 10:17 ` [PATCH v2 04/17] drm/panthor: Make sure reset requests in the post reset " Boris Brezillon
2026-08-11 10:17 ` [PATCH v2 05/17] drm/panthor: Flush the cleanup_wq in the unplug path Boris Brezillon
2026-08-11 10:17 ` [PATCH v2 06/17] drm/panthor: Drop unused vm argument passed to panthor_vm_prepare_sync_only_op_ctx() Boris Brezillon
2026-08-11 10:17 ` [PATCH v2 07/17] drm/panthor: Move the debugfs initialization to panthor_device.c Boris Brezillon
2026-08-11 10:17 ` [PATCH v2 08/17] drm/panthor: Split panthor_vm Boris Brezillon
2026-08-11 10:17 ` [PATCH v2 09/17] drm/panthor: Add fine-grained restrictions on VMs Boris Brezillon
2026-08-11 10:17 ` [PATCH v2 10/17] drm/panthor: Check AS state before disabling Boris Brezillon
2026-08-11 10:17 ` [PATCH v2 11/17] drm/panthor: Don't pre-allocate VMAs or page tables when preparing a full VM unmap Boris Brezillon
2026-08-11 10:17 ` [PATCH v2 12/17] drm/panthor: Make the VM cleanup path more robust against UAF Boris Brezillon
2026-08-11 10:17 ` [PATCH v2 13/17] drm/panthor: Track user owned VMs Boris Brezillon
2026-08-11 10:17 ` Boris Brezillon [this message]
2026-08-11 10:17 ` [PATCH v2 15/17] drm/panthor: Fix the unplug logic Boris Brezillon
2026-08-11 10:17 ` [PATCH v2 16/17] drm/panthor: Add a debugfs knob to simulate unplug failures Boris Brezillon
2026-08-11 10:17 ` [PATCH v2 17/17] drm/panthor: Add a debugfs knobs to simulate reset failures Boris Brezillon
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20260811-panthor-unplug-fixes-v2-14-6b583e37f9ae@collabora.com \
--to=boris.brezillon@collabora.com \
--cc=airlied@gmail.com \
--cc=dri-devel@lists.freedesktop.org \
--cc=linux-kernel@vger.kernel.org \
--cc=liviu.dudau@arm.com \
--cc=maarten.lankhorst@linux.intel.com \
--cc=mripard@kernel.org \
--cc=simona@ffwll.ch \
--cc=steven.price@arm.com \
--cc=tzimmermann@suse.de \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox
all inboxes | Powered by JetHome®