[PATCH 0/4] drm/msm: fix GPU recovery deadlocks, add a8xx crash dumps

[Nico Angelo Dela Cruz]

On an Adreno 830 (SM8750, OnePlus Pad 3), GMU wedges sometimes left the
screen frozen until a reboot. The wedge itself is a separate, still open
issue; this series fixes the recovery side, which should clear a wedge
but could deadlock instead, and adds the crash dumps a8xx was missing.

Patch 1: if a CP page fault arrives while recover_worker() holds
gpu->lock, the fault handler reinitializes fault_coredump_done and then
waits for gpu->lock, while recovery's GMU waits (HFI and OOB) wait on
that completion forever. Recovery now skips the wait, and the fault
handler skips the capture, while recovery is running. On the A830,
3 of 3 recoveries that took such a fault hung before this; with it,
3 natural ones all completed.

Patch 2: when devcoredump is disabled or can't allocate,
dev_coredumpm() frees the dump synchronously, and msm's free callback
takes gpu->lock, which the capture path already holds. The put now runs
from a work item.

Patch 3: a8xx had no gpu_state_get, so it never produced a
devcoredump. It now takes a memory-only one (rings, GMU log/HFI/debug,
HFI history), without reading any register, since the GMU may be wedged
and GX off. The GMU part is a pure move shared with a6xx/a7xx.

Patch 4: adreno_show_object() ascii85-encodes buffers in place on first
show, without a lock, so two readers of one devcoredump can double-free
a buffer (free_large_kmalloc "Not a kmalloc allocation" warnings).
Rendering is now serialized.

Patches 1, 2 and 4 carry Fixes: tags and Cc: stable.

Testing, all on the A830 with the series on a 7.3-rc5 based tree. It
is based on msm-next, where drivers/gpu/drm/msm builds W=1-clean:
 - IGT msm_recovery gpu-fault: 6/6 recover, each with a complete
   devcoredump; with /sys/class/devcoredump/disabled set, it recovers
   instead of hanging.
 - Natural GMU wedges during Bluetooth audio playback: 8 in about
   47 minutes, 3 with a CP page fault during recovery, all recovered in
   about 0.15 s, no hung tasks, dumps saved.
 - Two concurrent devcoredump readers: 16 kvfree warnings in one boot
   before patch 4, none after.

a6xx/a7xx: build and pure-move review only for patch 3, I have no such
hardware. Tested-by welcome.

Not addressed here: msm never calls dev_coredump_put() on unbind, so a
devcoredump still registered then can call the free callback after the
GPU is gone. That predates this series.

The fault_coredump_done wait was introduced in the review at:
Link: https://lore.kernel.org/all/CACu1E7EApr6Ne3XxFv4cUa2JuwNW2kfo1c5wSsAUN78iWyQ2sg@xxxxxxxxxxxxxx/

Nico Angelo Dela Cruz (4):
  drm/msm: don't wait for a fault devcoredump during GPU recovery
  drm/msm: free the crash state asynchronously
  drm/msm/a8xx: add a memory-only GPU crash state
  drm/msm: serialize devcoredump reads of the crash state

 drivers/gpu/drm/msm/adreno/a6xx_gmu.c       |  7 ++-
 drivers/gpu/drm/msm/adreno/a6xx_gpu.c       |  7 +++
 drivers/gpu/drm/msm/adreno/a6xx_gpu.h       |  1 +
 drivers/gpu/drm/msm/adreno/a6xx_gpu_state.c | 47 ++++++++++++++++-----
 drivers/gpu/drm/msm/adreno/a6xx_hfi.c       |  7 ++-
 drivers/gpu/drm/msm/adreno/adreno_gpu.c     |  3 +-
 drivers/gpu/drm/msm/msm_gpu.c               | 33 ++++++++++++++-
 drivers/gpu/drm/msm/msm_gpu.h               | 23 ++++++++++
 8 files changed, 112 insertions(+), 16 deletions(-)


base-commit: d024361c631b3f020a26c07d683e5103404b0fbf
-- 
2.53.0