BACKPORT:dma-buf/fence: Fix lock inversion within dma-fence-array

Ages ago Rob Clark noted,

"Currently with fence-array, we have a potential deadlock situation.  If
we fence_add_callback() on an array-fence, the array-fence's lock is
acquired first, and in it's ->enable_signaling() callback, it will install
cbs on it's array-member fences, so the array-member's lock is acquired
second.

But in the signal path, the array-member's lock is acquired first, and
the array-fence's lock acquired second."

Rob proposed either extensive changes to dma-fence to unnest the
fence-array signaling, or to defer the signaling onto a workqueue. This
is a more refined version of the later, that should keep the latency
of the fence signaling to a minimum by using an irq-work, which is
executed asap.

Reported-by: Rob Clark <robdclark@gmail.com>
Suggested-by: Rob Clark <robdclark@gmail.com>
References: 1476635975-21981-1-git-send-email-robdclark@gmail.com
Signed-off-by: Chris Wilson <chris@chris-wilson.co.uk>
Cc: Rob Clark <robdclark@gmail.com>
Cc: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
Cc: Sumit Semwal <sumit.semwal@linaro.org>
Cc: Christian König <christian.koenig@amd.com>
Reviewed-by: Christian König <christian.koenig@amd.com>
Signed-off-by: Sumit Semwal <sumit.semwal@linaro.org>
Link: https://patchwork.freedesktop.org/patch/msgid/20171114162719.30958-1-chris@chris-wilson.co.uk
Signed-off-by: Jiyu Yang <Jiyu.Yang@amlogic.com>
Change-Id: Ia08cb17615ff15b18c208cff2000d92344c9f399

3 files changed, 16 insertions, 2 deletions

diff --git a/drivers/base/Kconfig b/drivers/base/Kconfig
index 0651010..4fe2d75 100644
--- a/drivers/base/Kconfig
+++ b/drivers/base/Kconfig
@@ -247,6 +247,7 @@ config DMA_SHARED_BUFFER
 	bool
 	default n
 	select ANON_INODES
+	select IRQ_WORK
 	help
 	  This option enables the framework for buffer-sharing between
 	  multiple drivers. A buffer is associated with a file using driver
diff --git a/drivers/dma-buf/fence-array.c b/drivers/dma-buf/fence-array.c
index f1989fc..f855bd9 100644
--- a/drivers/dma-buf/fence-array.c
+++ b/drivers/dma-buf/fence-array.c
@@ -33,6 +33,14 @@ static const char *fence_array_get_timeline_name(struct fence *fence)
 	return "unbound";
 }
 
+static void irq_fence_array_work(struct irq_work *wrk)
+{
+	struct fence_array *array = container_of(wrk, typeof(*array), work);
+
+	fence_signal(&array->base);
+	fence_put(&array->base);
+}
+
 static void fence_array_cb_func(struct fence *f, struct fence_cb *cb)
 {
 	struct fence_array_cb *array_cb =
@@ -40,8 +48,9 @@ static void fence_array_cb_func(struct fence *f, struct fence_cb *cb)
 	struct fence_array *array = array_cb->array;
 
 	if (atomic_dec_and_test(&array->num_pending))
-		fence_signal(&array->base);
-	fence_put(&array->base);
+		irq_work_queue(&array->work);
+	else
+		fence_put(&array->base);
 }
 
 static bool fence_array_enable_signaling(struct fence *fence)
@@ -135,6 +144,7 @@ struct fence_array *fence_array_create(int num_fences, struct fence **fences,
 	spin_lock_init(&array->lock);
 	fence_init(&array->base, &fence_array_ops, &array->lock,
 		   context, seqno);
+	init_irq_work(&array->work, irq_fence_array_work);
 
 	array->num_fences = num_fences;
 	atomic_set(&array->num_pending, signal_on_any ? 1 : num_fences);
diff --git a/include/linux/fence-array.h b/include/linux/fence-array.h
index a44794e..318342f 100644
--- a/include/linux/fence-array.h
+++ b/include/linux/fence-array.h
@@ -21,6 +21,7 @@
 #define __LINUX_FENCE_ARRAY_H
 
 #include <linux/fence.h>
+#include <linux/irq_work.h>
 
 /**
  * struct fence_array_cb - callback helper for fence array
@@ -47,6 +48,8 @@ struct fence_array {
 	unsigned num_fences;
 	atomic_t num_pending;
 	struct fence **fences;
+
+	struct irq_work work;
 };
 
 extern const struct fence_ops fence_array_ops;