1 /*
2  * Copyright © 2008-2015 Intel Corporation
3  *
4  * Permission is hereby granted, free of charge, to any person obtaining a
5  * copy of this software and associated documentation files (the "Software"),
6  * to deal in the Software without restriction, including without limitation
7  * the rights to use, copy, modify, merge, publish, distribute, sublicense,
8  * and/or sell copies of the Software, and to permit persons to whom the
9  * Software is furnished to do so, subject to the following conditions:
10  *
11  * The above copyright notice and this permission notice (including the next
12  * paragraph) shall be included in all copies or substantial portions of the
13  * Software.
14  *
15  * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
16  * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
17  * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.  IN NO EVENT SHALL
18  * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
19  * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING
20  * FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS
21  * IN THE SOFTWARE.
22  *
23  */
24 
25 #include <linux/dma-fence-array.h>
26 #include <linux/dma-fence-chain.h>
27 #include <linux/irq_work.h>
28 #include <linux/prefetch.h>
29 #include <linux/sched.h>
30 #include <linux/sched/clock.h>
31 #include <linux/sched/signal.h>
32 
33 #include "gem/i915_gem_context.h"
34 #include "gt/intel_breadcrumbs.h"
35 #include "gt/intel_context.h"
36 #include "gt/intel_ring.h"
37 #include "gt/intel_rps.h"
38 
39 #include "i915_active.h"
40 #include "i915_drv.h"
41 #include "i915_globals.h"
42 #include "i915_trace.h"
43 #include "intel_pm.h"
44 
45 struct execute_cb {
46 	struct irq_work work;
47 	struct i915_sw_fence *fence;
48 	void (*hook)(struct i915_request *rq, struct dma_fence *signal);
49 	struct i915_request *signal;
50 };
51 
52 static struct i915_global_request {
53 	struct i915_global base;
54 	struct kmem_cache *slab_requests;
55 	struct kmem_cache *slab_execute_cbs;
56 } global;
57 
58 static const char *i915_fence_get_driver_name(struct dma_fence *fence)
59 {
60 	return dev_name(to_request(fence)->engine->i915->drm.dev);
61 }
62 
63 static const char *i915_fence_get_timeline_name(struct dma_fence *fence)
64 {
65 	const struct i915_gem_context *ctx;
66 
67 	/*
68 	 * The timeline struct (as part of the ppgtt underneath a context)
69 	 * may be freed when the request is no longer in use by the GPU.
70 	 * We could extend the life of a context to beyond that of all
71 	 * fences, possibly keeping the hw resource around indefinitely,
72 	 * or we just give them a false name. Since
73 	 * dma_fence_ops.get_timeline_name is a debug feature, the occasional
74 	 * lie seems justifiable.
75 	 */
76 	if (test_bit(DMA_FENCE_FLAG_SIGNALED_BIT, &fence->flags))
77 		return "signaled";
78 
79 	ctx = i915_request_gem_context(to_request(fence));
80 	if (!ctx)
81 		return "[" DRIVER_NAME "]";
82 
83 	return ctx->name;
84 }
85 
86 static bool i915_fence_signaled(struct dma_fence *fence)
87 {
88 	return i915_request_completed(to_request(fence));
89 }
90 
91 static bool i915_fence_enable_signaling(struct dma_fence *fence)
92 {
93 	return i915_request_enable_breadcrumb(to_request(fence));
94 }
95 
96 static signed long i915_fence_wait(struct dma_fence *fence,
97 				   bool interruptible,
98 				   signed long timeout)
99 {
100 	return i915_request_wait(to_request(fence),
101 				 interruptible | I915_WAIT_PRIORITY,
102 				 timeout);
103 }
104 
105 struct kmem_cache *i915_request_slab_cache(void)
106 {
107 	return global.slab_requests;
108 }
109 
110 static void i915_fence_release(struct dma_fence *fence)
111 {
112 	struct i915_request *rq = to_request(fence);
113 
114 	/*
115 	 * The request is put onto a RCU freelist (i.e. the address
116 	 * is immediately reused), mark the fences as being freed now.
117 	 * Otherwise the debugobjects for the fences are only marked as
118 	 * freed when the slab cache itself is freed, and so we would get
119 	 * caught trying to reuse dead objects.
120 	 */
121 	i915_sw_fence_fini(&rq->submit);
122 	i915_sw_fence_fini(&rq->semaphore);
123 
124 	/*
125 	 * Keep one request on each engine for reserved use under mempressure
126 	 *
127 	 * We do not hold a reference to the engine here and so have to be
128 	 * very careful in what rq->engine we poke. The virtual engine is
129 	 * referenced via the rq->context and we released that ref during
130 	 * i915_request_retire(), ergo we must not dereference a virtual
131 	 * engine here. Not that we would want to, as the only consumer of
132 	 * the reserved engine->request_pool is the power management parking,
133 	 * which must-not-fail, and that is only run on the physical engines.
134 	 *
135 	 * Since the request must have been executed to be have completed,
136 	 * we know that it will have been processed by the HW and will
137 	 * not be unsubmitted again, so rq->engine and rq->execution_mask
138 	 * at this point is stable. rq->execution_mask will be a single
139 	 * bit if the last and _only_ engine it could execution on was a
140 	 * physical engine, if it's multiple bits then it started on and
141 	 * could still be on a virtual engine. Thus if the mask is not a
142 	 * power-of-two we assume that rq->engine may still be a virtual
143 	 * engine and so a dangling invalid pointer that we cannot dereference
144 	 *
145 	 * For example, consider the flow of a bonded request through a virtual
146 	 * engine. The request is created with a wide engine mask (all engines
147 	 * that we might execute on). On processing the bond, the request mask
148 	 * is reduced to one or more engines. If the request is subsequently
149 	 * bound to a single engine, it will then be constrained to only
150 	 * execute on that engine and never returned to the virtual engine
151 	 * after timeslicing away, see __unwind_incomplete_requests(). Thus we
152 	 * know that if the rq->execution_mask is a single bit, rq->engine
153 	 * can be a physical engine with the exact corresponding mask.
154 	 */
155 	if (is_power_of_2(rq->execution_mask) &&
156 	    !cmpxchg(&rq->engine->request_pool, NULL, rq))
157 		return;
158 
159 	kmem_cache_free(global.slab_requests, rq);
160 }
161 
162 const struct dma_fence_ops i915_fence_ops = {
163 	.get_driver_name = i915_fence_get_driver_name,
164 	.get_timeline_name = i915_fence_get_timeline_name,
165 	.enable_signaling = i915_fence_enable_signaling,
166 	.signaled = i915_fence_signaled,
167 	.wait = i915_fence_wait,
168 	.release = i915_fence_release,
169 };
170 
171 static void irq_execute_cb(struct irq_work *wrk)
172 {
173 	struct execute_cb *cb = container_of(wrk, typeof(*cb), work);
174 
175 	i915_sw_fence_complete(cb->fence);
176 	kmem_cache_free(global.slab_execute_cbs, cb);
177 }
178 
179 static void irq_execute_cb_hook(struct irq_work *wrk)
180 {
181 	struct execute_cb *cb = container_of(wrk, typeof(*cb), work);
182 
183 	cb->hook(container_of(cb->fence, struct i915_request, submit),
184 		 &cb->signal->fence);
185 	i915_request_put(cb->signal);
186 
187 	irq_execute_cb(wrk);
188 }
189 
190 static __always_inline void
191 __notify_execute_cb(struct i915_request *rq, bool (*fn)(struct irq_work *wrk))
192 {
193 	struct execute_cb *cb, *cn;
194 
195 	if (llist_empty(&rq->execute_cb))
196 		return;
197 
198 	llist_for_each_entry_safe(cb, cn,
199 				  llist_del_all(&rq->execute_cb),
200 				  work.node.llist)
201 		fn(&cb->work);
202 }
203 
204 static void __notify_execute_cb_irq(struct i915_request *rq)
205 {
206 	__notify_execute_cb(rq, irq_work_queue);
207 }
208 
209 static bool irq_work_imm(struct irq_work *wrk)
210 {
211 	wrk->func(wrk);
212 	return false;
213 }
214 
215 static void __notify_execute_cb_imm(struct i915_request *rq)
216 {
217 	__notify_execute_cb(rq, irq_work_imm);
218 }
219 
220 static void free_capture_list(struct i915_request *request)
221 {
222 	struct i915_capture_list *capture;
223 
224 	capture = fetch_and_zero(&request->capture_list);
225 	while (capture) {
226 		struct i915_capture_list *next = capture->next;
227 
228 		kfree(capture);
229 		capture = next;
230 	}
231 }
232 
233 static void __i915_request_fill(struct i915_request *rq, u8 val)
234 {
235 	void *vaddr = rq->ring->vaddr;
236 	u32 head;
237 
238 	head = rq->infix;
239 	if (rq->postfix < head) {
240 		memset(vaddr + head, val, rq->ring->size - head);
241 		head = 0;
242 	}
243 	memset(vaddr + head, val, rq->postfix - head);
244 }
245 
246 static void remove_from_engine(struct i915_request *rq)
247 {
248 	struct intel_engine_cs *engine, *locked;
249 
250 	/*
251 	 * Virtual engines complicate acquiring the engine timeline lock,
252 	 * as their rq->engine pointer is not stable until under that
253 	 * engine lock. The simple ploy we use is to take the lock then
254 	 * check that the rq still belongs to the newly locked engine.
255 	 */
256 	locked = READ_ONCE(rq->engine);
257 	spin_lock_irq(&locked->active.lock);
258 	while (unlikely(locked != (engine = READ_ONCE(rq->engine)))) {
259 		spin_unlock(&locked->active.lock);
260 		spin_lock(&engine->active.lock);
261 		locked = engine;
262 	}
263 	list_del_init(&rq->sched.link);
264 
265 	clear_bit(I915_FENCE_FLAG_PQUEUE, &rq->fence.flags);
266 	clear_bit(I915_FENCE_FLAG_HOLD, &rq->fence.flags);
267 
268 	/* Prevent further __await_execution() registering a cb, then flush */
269 	set_bit(I915_FENCE_FLAG_ACTIVE, &rq->fence.flags);
270 
271 	spin_unlock_irq(&locked->active.lock);
272 
273 	__notify_execute_cb_imm(rq);
274 }
275 
276 bool i915_request_retire(struct i915_request *rq)
277 {
278 	if (!i915_request_completed(rq))
279 		return false;
280 
281 	RQ_TRACE(rq, "\n");
282 
283 	GEM_BUG_ON(!i915_sw_fence_signaled(&rq->submit));
284 	trace_i915_request_retire(rq);
285 	i915_request_mark_complete(rq);
286 
287 	/*
288 	 * We know the GPU must have read the request to have
289 	 * sent us the seqno + interrupt, so use the position
290 	 * of tail of the request to update the last known position
291 	 * of the GPU head.
292 	 *
293 	 * Note this requires that we are always called in request
294 	 * completion order.
295 	 */
296 	GEM_BUG_ON(!list_is_first(&rq->link,
297 				  &i915_request_timeline(rq)->requests));
298 	if (IS_ENABLED(CONFIG_DRM_I915_DEBUG_GEM))
299 		/* Poison before we release our space in the ring */
300 		__i915_request_fill(rq, POISON_FREE);
301 	rq->ring->head = rq->postfix;
302 
303 	if (!i915_request_signaled(rq)) {
304 		spin_lock_irq(&rq->lock);
305 		dma_fence_signal_locked(&rq->fence);
306 		spin_unlock_irq(&rq->lock);
307 	}
308 
309 	if (i915_request_has_waitboost(rq)) {
310 		GEM_BUG_ON(!atomic_read(&rq->engine->gt->rps.num_waiters));
311 		atomic_dec(&rq->engine->gt->rps.num_waiters);
312 	}
313 
314 	/*
315 	 * We only loosely track inflight requests across preemption,
316 	 * and so we may find ourselves attempting to retire a _completed_
317 	 * request that we have removed from the HW and put back on a run
318 	 * queue.
319 	 *
320 	 * As we set I915_FENCE_FLAG_ACTIVE on the request, this should be
321 	 * after removing the breadcrumb and signaling it, so that we do not
322 	 * inadvertently attach the breadcrumb to a completed request.
323 	 */
324 	remove_from_engine(rq);
325 	GEM_BUG_ON(!llist_empty(&rq->execute_cb));
326 
327 	__list_del_entry(&rq->link); /* poison neither prev/next (RCU walks) */
328 
329 	intel_context_exit(rq->context);
330 	intel_context_unpin(rq->context);
331 
332 	free_capture_list(rq);
333 	i915_sched_node_fini(&rq->sched);
334 	i915_request_put(rq);
335 
336 	return true;
337 }
338 
339 void i915_request_retire_upto(struct i915_request *rq)
340 {
341 	struct intel_timeline * const tl = i915_request_timeline(rq);
342 	struct i915_request *tmp;
343 
344 	RQ_TRACE(rq, "\n");
345 
346 	GEM_BUG_ON(!i915_request_completed(rq));
347 
348 	do {
349 		tmp = list_first_entry(&tl->requests, typeof(*tmp), link);
350 	} while (i915_request_retire(tmp) && tmp != rq);
351 }
352 
353 static struct i915_request * const *
354 __engine_active(struct intel_engine_cs *engine)
355 {
356 	return READ_ONCE(engine->execlists.active);
357 }
358 
359 static bool __request_in_flight(const struct i915_request *signal)
360 {
361 	struct i915_request * const *port, *rq;
362 	bool inflight = false;
363 
364 	if (!i915_request_is_ready(signal))
365 		return false;
366 
367 	/*
368 	 * Even if we have unwound the request, it may still be on
369 	 * the GPU (preempt-to-busy). If that request is inside an
370 	 * unpreemptible critical section, it will not be removed. Some
371 	 * GPU functions may even be stuck waiting for the paired request
372 	 * (__await_execution) to be submitted and cannot be preempted
373 	 * until the bond is executing.
374 	 *
375 	 * As we know that there are always preemption points between
376 	 * requests, we know that only the currently executing request
377 	 * may be still active even though we have cleared the flag.
378 	 * However, we can't rely on our tracking of ELSP[0] to know
379 	 * which request is currently active and so maybe stuck, as
380 	 * the tracking maybe an event behind. Instead assume that
381 	 * if the context is still inflight, then it is still active
382 	 * even if the active flag has been cleared.
383 	 *
384 	 * To further complicate matters, if there a pending promotion, the HW
385 	 * may either perform a context switch to the second inflight execlists,
386 	 * or it may switch to the pending set of execlists. In the case of the
387 	 * latter, it may send the ACK and we process the event copying the
388 	 * pending[] over top of inflight[], _overwriting_ our *active. Since
389 	 * this implies the HW is arbitrating and not struck in *active, we do
390 	 * not worry about complete accuracy, but we do require no read/write
391 	 * tearing of the pointer [the read of the pointer must be valid, even
392 	 * as the array is being overwritten, for which we require the writes
393 	 * to avoid tearing.]
394 	 *
395 	 * Note that the read of *execlists->active may race with the promotion
396 	 * of execlists->pending[] to execlists->inflight[], overwritting
397 	 * the value at *execlists->active. This is fine. The promotion implies
398 	 * that we received an ACK from the HW, and so the context is not
399 	 * stuck -- if we do not see ourselves in *active, the inflight status
400 	 * is valid. If instead we see ourselves being copied into *active,
401 	 * we are inflight and may signal the callback.
402 	 */
403 	if (!intel_context_inflight(signal->context))
404 		return false;
405 
406 	rcu_read_lock();
407 	for (port = __engine_active(signal->engine);
408 	     (rq = READ_ONCE(*port)); /* may race with promotion of pending[] */
409 	     port++) {
410 		if (rq->context == signal->context) {
411 			inflight = i915_seqno_passed(rq->fence.seqno,
412 						     signal->fence.seqno);
413 			break;
414 		}
415 	}
416 	rcu_read_unlock();
417 
418 	return inflight;
419 }
420 
421 static int
422 __await_execution(struct i915_request *rq,
423 		  struct i915_request *signal,
424 		  void (*hook)(struct i915_request *rq,
425 			       struct dma_fence *signal),
426 		  gfp_t gfp)
427 {
428 	struct execute_cb *cb;
429 
430 	if (i915_request_is_active(signal)) {
431 		if (hook)
432 			hook(rq, &signal->fence);
433 		return 0;
434 	}
435 
436 	cb = kmem_cache_alloc(global.slab_execute_cbs, gfp);
437 	if (!cb)
438 		return -ENOMEM;
439 
440 	cb->fence = &rq->submit;
441 	i915_sw_fence_await(cb->fence);
442 	init_irq_work(&cb->work, irq_execute_cb);
443 
444 	if (hook) {
445 		cb->hook = hook;
446 		cb->signal = i915_request_get(signal);
447 		cb->work.func = irq_execute_cb_hook;
448 	}
449 
450 	/*
451 	 * Register the callback first, then see if the signaler is already
452 	 * active. This ensures that if we race with the
453 	 * __notify_execute_cb from i915_request_submit() and we are not
454 	 * included in that list, we get a second bite of the cherry and
455 	 * execute it ourselves. After this point, a future
456 	 * i915_request_submit() will notify us.
457 	 *
458 	 * In i915_request_retire() we set the ACTIVE bit on a completed
459 	 * request (then flush the execute_cb). So by registering the
460 	 * callback first, then checking the ACTIVE bit, we serialise with
461 	 * the completed/retired request.
462 	 */
463 	if (llist_add(&cb->work.node.llist, &signal->execute_cb)) {
464 		if (i915_request_is_active(signal) ||
465 		    __request_in_flight(signal))
466 			__notify_execute_cb_imm(signal);
467 	}
468 
469 	return 0;
470 }
471 
472 static bool fatal_error(int error)
473 {
474 	switch (error) {
475 	case 0: /* not an error! */
476 	case -EAGAIN: /* innocent victim of a GT reset (__i915_request_reset) */
477 	case -ETIMEDOUT: /* waiting for Godot (timer_i915_sw_fence_wake) */
478 		return false;
479 	default:
480 		return true;
481 	}
482 }
483 
484 void __i915_request_skip(struct i915_request *rq)
485 {
486 	GEM_BUG_ON(!fatal_error(rq->fence.error));
487 
488 	if (rq->infix == rq->postfix)
489 		return;
490 
491 	/*
492 	 * As this request likely depends on state from the lost
493 	 * context, clear out all the user operations leaving the
494 	 * breadcrumb at the end (so we get the fence notifications).
495 	 */
496 	__i915_request_fill(rq, 0);
497 	rq->infix = rq->postfix;
498 }
499 
500 void i915_request_set_error_once(struct i915_request *rq, int error)
501 {
502 	int old;
503 
504 	GEM_BUG_ON(!IS_ERR_VALUE((long)error));
505 
506 	if (i915_request_signaled(rq))
507 		return;
508 
509 	old = READ_ONCE(rq->fence.error);
510 	do {
511 		if (fatal_error(old))
512 			return;
513 	} while (!try_cmpxchg(&rq->fence.error, &old, error));
514 }
515 
516 bool __i915_request_submit(struct i915_request *request)
517 {
518 	struct intel_engine_cs *engine = request->engine;
519 	bool result = false;
520 
521 	RQ_TRACE(request, "\n");
522 
523 	GEM_BUG_ON(!irqs_disabled());
524 	lockdep_assert_held(&engine->active.lock);
525 
526 	/*
527 	 * With the advent of preempt-to-busy, we frequently encounter
528 	 * requests that we have unsubmitted from HW, but left running
529 	 * until the next ack and so have completed in the meantime. On
530 	 * resubmission of that completed request, we can skip
531 	 * updating the payload, and execlists can even skip submitting
532 	 * the request.
533 	 *
534 	 * We must remove the request from the caller's priority queue,
535 	 * and the caller must only call us when the request is in their
536 	 * priority queue, under the active.lock. This ensures that the
537 	 * request has *not* yet been retired and we can safely move
538 	 * the request into the engine->active.list where it will be
539 	 * dropped upon retiring. (Otherwise if resubmit a *retired*
540 	 * request, this would be a horrible use-after-free.)
541 	 */
542 	if (i915_request_completed(request))
543 		goto xfer;
544 
545 	if (unlikely(intel_context_is_closed(request->context) &&
546 		     !intel_engine_has_heartbeat(engine)))
547 		intel_context_set_banned(request->context);
548 
549 	if (unlikely(intel_context_is_banned(request->context)))
550 		i915_request_set_error_once(request, -EIO);
551 
552 	if (unlikely(fatal_error(request->fence.error)))
553 		__i915_request_skip(request);
554 
555 	/*
556 	 * Are we using semaphores when the gpu is already saturated?
557 	 *
558 	 * Using semaphores incurs a cost in having the GPU poll a
559 	 * memory location, busywaiting for it to change. The continual
560 	 * memory reads can have a noticeable impact on the rest of the
561 	 * system with the extra bus traffic, stalling the cpu as it too
562 	 * tries to access memory across the bus (perf stat -e bus-cycles).
563 	 *
564 	 * If we installed a semaphore on this request and we only submit
565 	 * the request after the signaler completed, that indicates the
566 	 * system is overloaded and using semaphores at this time only
567 	 * increases the amount of work we are doing. If so, we disable
568 	 * further use of semaphores until we are idle again, whence we
569 	 * optimistically try again.
570 	 */
571 	if (request->sched.semaphores &&
572 	    i915_sw_fence_signaled(&request->semaphore))
573 		engine->saturated |= request->sched.semaphores;
574 
575 	engine->emit_fini_breadcrumb(request,
576 				     request->ring->vaddr + request->postfix);
577 
578 	trace_i915_request_execute(request);
579 	engine->serial++;
580 	result = true;
581 
582 xfer:
583 	if (!test_and_set_bit(I915_FENCE_FLAG_ACTIVE, &request->fence.flags)) {
584 		list_move_tail(&request->sched.link, &engine->active.requests);
585 		clear_bit(I915_FENCE_FLAG_PQUEUE, &request->fence.flags);
586 	}
587 
588 	/*
589 	 * XXX Rollback bonded-execution on __i915_request_unsubmit()?
590 	 *
591 	 * In the future, perhaps when we have an active time-slicing scheduler,
592 	 * it will be interesting to unsubmit parallel execution and remove
593 	 * busywaits from the GPU until their master is restarted. This is
594 	 * quite hairy, we have to carefully rollback the fence and do a
595 	 * preempt-to-idle cycle on the target engine, all the while the
596 	 * master execute_cb may refire.
597 	 */
598 	__notify_execute_cb_irq(request);
599 
600 	/* We may be recursing from the signal callback of another i915 fence */
601 	if (test_bit(DMA_FENCE_FLAG_ENABLE_SIGNAL_BIT, &request->fence.flags))
602 		i915_request_enable_breadcrumb(request);
603 
604 	return result;
605 }
606 
607 void i915_request_submit(struct i915_request *request)
608 {
609 	struct intel_engine_cs *engine = request->engine;
610 	unsigned long flags;
611 
612 	/* Will be called from irq-context when using foreign fences. */
613 	spin_lock_irqsave(&engine->active.lock, flags);
614 
615 	__i915_request_submit(request);
616 
617 	spin_unlock_irqrestore(&engine->active.lock, flags);
618 }
619 
620 void __i915_request_unsubmit(struct i915_request *request)
621 {
622 	struct intel_engine_cs *engine = request->engine;
623 
624 	/*
625 	 * Only unwind in reverse order, required so that the per-context list
626 	 * is kept in seqno/ring order.
627 	 */
628 	RQ_TRACE(request, "\n");
629 
630 	GEM_BUG_ON(!irqs_disabled());
631 	lockdep_assert_held(&engine->active.lock);
632 
633 	/*
634 	 * Before we remove this breadcrumb from the signal list, we have
635 	 * to ensure that a concurrent dma_fence_enable_signaling() does not
636 	 * attach itself. We first mark the request as no longer active and
637 	 * make sure that is visible to other cores, and then remove the
638 	 * breadcrumb if attached.
639 	 */
640 	GEM_BUG_ON(!test_bit(I915_FENCE_FLAG_ACTIVE, &request->fence.flags));
641 	clear_bit_unlock(I915_FENCE_FLAG_ACTIVE, &request->fence.flags);
642 	if (test_bit(DMA_FENCE_FLAG_ENABLE_SIGNAL_BIT, &request->fence.flags))
643 		i915_request_cancel_breadcrumb(request);
644 
645 	/* We've already spun, don't charge on resubmitting. */
646 	if (request->sched.semaphores && i915_request_started(request))
647 		request->sched.semaphores = 0;
648 
649 	/*
650 	 * We don't need to wake_up any waiters on request->execute, they
651 	 * will get woken by any other event or us re-adding this request
652 	 * to the engine timeline (__i915_request_submit()). The waiters
653 	 * should be quite adapt at finding that the request now has a new
654 	 * global_seqno to the one they went to sleep on.
655 	 */
656 }
657 
658 void i915_request_unsubmit(struct i915_request *request)
659 {
660 	struct intel_engine_cs *engine = request->engine;
661 	unsigned long flags;
662 
663 	/* Will be called from irq-context when using foreign fences. */
664 	spin_lock_irqsave(&engine->active.lock, flags);
665 
666 	__i915_request_unsubmit(request);
667 
668 	spin_unlock_irqrestore(&engine->active.lock, flags);
669 }
670 
671 static int __i915_sw_fence_call
672 submit_notify(struct i915_sw_fence *fence, enum i915_sw_fence_notify state)
673 {
674 	struct i915_request *request =
675 		container_of(fence, typeof(*request), submit);
676 
677 	switch (state) {
678 	case FENCE_COMPLETE:
679 		trace_i915_request_submit(request);
680 
681 		if (unlikely(fence->error))
682 			i915_request_set_error_once(request, fence->error);
683 
684 		/*
685 		 * We need to serialize use of the submit_request() callback
686 		 * with its hotplugging performed during an emergency
687 		 * i915_gem_set_wedged().  We use the RCU mechanism to mark the
688 		 * critical section in order to force i915_gem_set_wedged() to
689 		 * wait until the submit_request() is completed before
690 		 * proceeding.
691 		 */
692 		rcu_read_lock();
693 		request->engine->submit_request(request);
694 		rcu_read_unlock();
695 		break;
696 
697 	case FENCE_FREE:
698 		i915_request_put(request);
699 		break;
700 	}
701 
702 	return NOTIFY_DONE;
703 }
704 
705 static int __i915_sw_fence_call
706 semaphore_notify(struct i915_sw_fence *fence, enum i915_sw_fence_notify state)
707 {
708 	struct i915_request *rq = container_of(fence, typeof(*rq), semaphore);
709 
710 	switch (state) {
711 	case FENCE_COMPLETE:
712 		break;
713 
714 	case FENCE_FREE:
715 		i915_request_put(rq);
716 		break;
717 	}
718 
719 	return NOTIFY_DONE;
720 }
721 
722 static void retire_requests(struct intel_timeline *tl)
723 {
724 	struct i915_request *rq, *rn;
725 
726 	list_for_each_entry_safe(rq, rn, &tl->requests, link)
727 		if (!i915_request_retire(rq))
728 			break;
729 }
730 
731 static noinline struct i915_request *
732 request_alloc_slow(struct intel_timeline *tl,
733 		   struct i915_request **rsvd,
734 		   gfp_t gfp)
735 {
736 	struct i915_request *rq;
737 
738 	/* If we cannot wait, dip into our reserves */
739 	if (!gfpflags_allow_blocking(gfp)) {
740 		rq = xchg(rsvd, NULL);
741 		if (!rq) /* Use the normal failure path for one final WARN */
742 			goto out;
743 
744 		return rq;
745 	}
746 
747 	if (list_empty(&tl->requests))
748 		goto out;
749 
750 	/* Move our oldest request to the slab-cache (if not in use!) */
751 	rq = list_first_entry(&tl->requests, typeof(*rq), link);
752 	i915_request_retire(rq);
753 
754 	rq = kmem_cache_alloc(global.slab_requests,
755 			      gfp | __GFP_RETRY_MAYFAIL | __GFP_NOWARN);
756 	if (rq)
757 		return rq;
758 
759 	/* Ratelimit ourselves to prevent oom from malicious clients */
760 	rq = list_last_entry(&tl->requests, typeof(*rq), link);
761 	cond_synchronize_rcu(rq->rcustate);
762 
763 	/* Retire our old requests in the hope that we free some */
764 	retire_requests(tl);
765 
766 out:
767 	return kmem_cache_alloc(global.slab_requests, gfp);
768 }
769 
770 static void __i915_request_ctor(void *arg)
771 {
772 	struct i915_request *rq = arg;
773 
774 	spin_lock_init(&rq->lock);
775 	i915_sched_node_init(&rq->sched);
776 	i915_sw_fence_init(&rq->submit, submit_notify);
777 	i915_sw_fence_init(&rq->semaphore, semaphore_notify);
778 
779 	dma_fence_init(&rq->fence, &i915_fence_ops, &rq->lock, 0, 0);
780 
781 	rq->capture_list = NULL;
782 
783 	init_llist_head(&rq->execute_cb);
784 }
785 
786 struct i915_request *
787 __i915_request_create(struct intel_context *ce, gfp_t gfp)
788 {
789 	struct intel_timeline *tl = ce->timeline;
790 	struct i915_request *rq;
791 	u32 seqno;
792 	int ret;
793 
794 	might_sleep_if(gfpflags_allow_blocking(gfp));
795 
796 	/* Check that the caller provided an already pinned context */
797 	__intel_context_pin(ce);
798 
799 	/*
800 	 * Beware: Dragons be flying overhead.
801 	 *
802 	 * We use RCU to look up requests in flight. The lookups may
803 	 * race with the request being allocated from the slab freelist.
804 	 * That is the request we are writing to here, may be in the process
805 	 * of being read by __i915_active_request_get_rcu(). As such,
806 	 * we have to be very careful when overwriting the contents. During
807 	 * the RCU lookup, we change chase the request->engine pointer,
808 	 * read the request->global_seqno and increment the reference count.
809 	 *
810 	 * The reference count is incremented atomically. If it is zero,
811 	 * the lookup knows the request is unallocated and complete. Otherwise,
812 	 * it is either still in use, or has been reallocated and reset
813 	 * with dma_fence_init(). This increment is safe for release as we
814 	 * check that the request we have a reference to and matches the active
815 	 * request.
816 	 *
817 	 * Before we increment the refcount, we chase the request->engine
818 	 * pointer. We must not call kmem_cache_zalloc() or else we set
819 	 * that pointer to NULL and cause a crash during the lookup. If
820 	 * we see the request is completed (based on the value of the
821 	 * old engine and seqno), the lookup is complete and reports NULL.
822 	 * If we decide the request is not completed (new engine or seqno),
823 	 * then we grab a reference and double check that it is still the
824 	 * active request - which it won't be and restart the lookup.
825 	 *
826 	 * Do not use kmem_cache_zalloc() here!
827 	 */
828 	rq = kmem_cache_alloc(global.slab_requests,
829 			      gfp | __GFP_RETRY_MAYFAIL | __GFP_NOWARN);
830 	if (unlikely(!rq)) {
831 		rq = request_alloc_slow(tl, &ce->engine->request_pool, gfp);
832 		if (!rq) {
833 			ret = -ENOMEM;
834 			goto err_unreserve;
835 		}
836 	}
837 
838 	rq->context = ce;
839 	rq->engine = ce->engine;
840 	rq->ring = ce->ring;
841 	rq->execution_mask = ce->engine->mask;
842 
843 	kref_init(&rq->fence.refcount);
844 	rq->fence.flags = 0;
845 	rq->fence.error = 0;
846 	INIT_LIST_HEAD(&rq->fence.cb_list);
847 
848 	ret = intel_timeline_get_seqno(tl, rq, &seqno);
849 	if (ret)
850 		goto err_free;
851 
852 	rq->fence.context = tl->fence_context;
853 	rq->fence.seqno = seqno;
854 
855 	RCU_INIT_POINTER(rq->timeline, tl);
856 	RCU_INIT_POINTER(rq->hwsp_cacheline, tl->hwsp_cacheline);
857 	rq->hwsp_seqno = tl->hwsp_seqno;
858 	GEM_BUG_ON(i915_request_completed(rq));
859 
860 	rq->rcustate = get_state_synchronize_rcu(); /* acts as smp_mb() */
861 
862 	/* We bump the ref for the fence chain */
863 	i915_sw_fence_reinit(&i915_request_get(rq)->submit);
864 	i915_sw_fence_reinit(&i915_request_get(rq)->semaphore);
865 
866 	i915_sched_node_reinit(&rq->sched);
867 
868 	/* No zalloc, everything must be cleared after use */
869 	rq->batch = NULL;
870 	GEM_BUG_ON(rq->capture_list);
871 	GEM_BUG_ON(!llist_empty(&rq->execute_cb));
872 
873 	/*
874 	 * Reserve space in the ring buffer for all the commands required to
875 	 * eventually emit this request. This is to guarantee that the
876 	 * i915_request_add() call can't fail. Note that the reserve may need
877 	 * to be redone if the request is not actually submitted straight
878 	 * away, e.g. because a GPU scheduler has deferred it.
879 	 *
880 	 * Note that due to how we add reserved_space to intel_ring_begin()
881 	 * we need to double our request to ensure that if we need to wrap
882 	 * around inside i915_request_add() there is sufficient space at
883 	 * the beginning of the ring as well.
884 	 */
885 	rq->reserved_space =
886 		2 * rq->engine->emit_fini_breadcrumb_dw * sizeof(u32);
887 
888 	/*
889 	 * Record the position of the start of the request so that
890 	 * should we detect the updated seqno part-way through the
891 	 * GPU processing the request, we never over-estimate the
892 	 * position of the head.
893 	 */
894 	rq->head = rq->ring->emit;
895 
896 	ret = rq->engine->request_alloc(rq);
897 	if (ret)
898 		goto err_unwind;
899 
900 	rq->infix = rq->ring->emit; /* end of header; start of user payload */
901 
902 	intel_context_mark_active(ce);
903 	list_add_tail_rcu(&rq->link, &tl->requests);
904 
905 	return rq;
906 
907 err_unwind:
908 	ce->ring->emit = rq->head;
909 
910 	/* Make sure we didn't add ourselves to external state before freeing */
911 	GEM_BUG_ON(!list_empty(&rq->sched.signalers_list));
912 	GEM_BUG_ON(!list_empty(&rq->sched.waiters_list));
913 
914 err_free:
915 	kmem_cache_free(global.slab_requests, rq);
916 err_unreserve:
917 	intel_context_unpin(ce);
918 	return ERR_PTR(ret);
919 }
920 
921 struct i915_request *
922 i915_request_create(struct intel_context *ce)
923 {
924 	struct i915_request *rq;
925 	struct intel_timeline *tl;
926 
927 	tl = intel_context_timeline_lock(ce);
928 	if (IS_ERR(tl))
929 		return ERR_CAST(tl);
930 
931 	/* Move our oldest request to the slab-cache (if not in use!) */
932 	rq = list_first_entry(&tl->requests, typeof(*rq), link);
933 	if (!list_is_last(&rq->link, &tl->requests))
934 		i915_request_retire(rq);
935 
936 	intel_context_enter(ce);
937 	rq = __i915_request_create(ce, GFP_KERNEL);
938 	intel_context_exit(ce); /* active reference transferred to request */
939 	if (IS_ERR(rq))
940 		goto err_unlock;
941 
942 	/* Check that we do not interrupt ourselves with a new request */
943 	rq->cookie = lockdep_pin_lock(&tl->mutex);
944 
945 	return rq;
946 
947 err_unlock:
948 	intel_context_timeline_unlock(tl);
949 	return rq;
950 }
951 
952 static int
953 i915_request_await_start(struct i915_request *rq, struct i915_request *signal)
954 {
955 	struct dma_fence *fence;
956 	int err;
957 
958 	if (i915_request_timeline(rq) == rcu_access_pointer(signal->timeline))
959 		return 0;
960 
961 	if (i915_request_started(signal))
962 		return 0;
963 
964 	fence = NULL;
965 	rcu_read_lock();
966 	spin_lock_irq(&signal->lock);
967 	do {
968 		struct list_head *pos = READ_ONCE(signal->link.prev);
969 		struct i915_request *prev;
970 
971 		/* Confirm signal has not been retired, the link is valid */
972 		if (unlikely(i915_request_started(signal)))
973 			break;
974 
975 		/* Is signal the earliest request on its timeline? */
976 		if (pos == &rcu_dereference(signal->timeline)->requests)
977 			break;
978 
979 		/*
980 		 * Peek at the request before us in the timeline. That
981 		 * request will only be valid before it is retired, so
982 		 * after acquiring a reference to it, confirm that it is
983 		 * still part of the signaler's timeline.
984 		 */
985 		prev = list_entry(pos, typeof(*prev), link);
986 		if (!i915_request_get_rcu(prev))
987 			break;
988 
989 		/* After the strong barrier, confirm prev is still attached */
990 		if (unlikely(READ_ONCE(prev->link.next) != &signal->link)) {
991 			i915_request_put(prev);
992 			break;
993 		}
994 
995 		fence = &prev->fence;
996 	} while (0);
997 	spin_unlock_irq(&signal->lock);
998 	rcu_read_unlock();
999 	if (!fence)
1000 		return 0;
1001 
1002 	err = 0;
1003 	if (!intel_timeline_sync_is_later(i915_request_timeline(rq), fence))
1004 		err = i915_sw_fence_await_dma_fence(&rq->submit,
1005 						    fence, 0,
1006 						    I915_FENCE_GFP);
1007 	dma_fence_put(fence);
1008 
1009 	return err;
1010 }
1011 
1012 static intel_engine_mask_t
1013 already_busywaiting(struct i915_request *rq)
1014 {
1015 	/*
1016 	 * Polling a semaphore causes bus traffic, delaying other users of
1017 	 * both the GPU and CPU. We want to limit the impact on others,
1018 	 * while taking advantage of early submission to reduce GPU
1019 	 * latency. Therefore we restrict ourselves to not using more
1020 	 * than one semaphore from each source, and not using a semaphore
1021 	 * if we have detected the engine is saturated (i.e. would not be
1022 	 * submitted early and cause bus traffic reading an already passed
1023 	 * semaphore).
1024 	 *
1025 	 * See the are-we-too-late? check in __i915_request_submit().
1026 	 */
1027 	return rq->sched.semaphores | READ_ONCE(rq->engine->saturated);
1028 }
1029 
1030 static int
1031 __emit_semaphore_wait(struct i915_request *to,
1032 		      struct i915_request *from,
1033 		      u32 seqno)
1034 {
1035 	const int has_token = INTEL_GEN(to->engine->i915) >= 12;
1036 	u32 hwsp_offset;
1037 	int len, err;
1038 	u32 *cs;
1039 
1040 	GEM_BUG_ON(INTEL_GEN(to->engine->i915) < 8);
1041 	GEM_BUG_ON(i915_request_has_initial_breadcrumb(to));
1042 
1043 	/* We need to pin the signaler's HWSP until we are finished reading. */
1044 	err = intel_timeline_read_hwsp(from, to, &hwsp_offset);
1045 	if (err)
1046 		return err;
1047 
1048 	len = 4;
1049 	if (has_token)
1050 		len += 2;
1051 
1052 	cs = intel_ring_begin(to, len);
1053 	if (IS_ERR(cs))
1054 		return PTR_ERR(cs);
1055 
1056 	/*
1057 	 * Using greater-than-or-equal here means we have to worry
1058 	 * about seqno wraparound. To side step that issue, we swap
1059 	 * the timeline HWSP upon wrapping, so that everyone listening
1060 	 * for the old (pre-wrap) values do not see the much smaller
1061 	 * (post-wrap) values than they were expecting (and so wait
1062 	 * forever).
1063 	 */
1064 	*cs++ = (MI_SEMAPHORE_WAIT |
1065 		 MI_SEMAPHORE_GLOBAL_GTT |
1066 		 MI_SEMAPHORE_POLL |
1067 		 MI_SEMAPHORE_SAD_GTE_SDD) +
1068 		has_token;
1069 	*cs++ = seqno;
1070 	*cs++ = hwsp_offset;
1071 	*cs++ = 0;
1072 	if (has_token) {
1073 		*cs++ = 0;
1074 		*cs++ = MI_NOOP;
1075 	}
1076 
1077 	intel_ring_advance(to, cs);
1078 	return 0;
1079 }
1080 
1081 static int
1082 emit_semaphore_wait(struct i915_request *to,
1083 		    struct i915_request *from,
1084 		    gfp_t gfp)
1085 {
1086 	const intel_engine_mask_t mask = READ_ONCE(from->engine)->mask;
1087 	struct i915_sw_fence *wait = &to->submit;
1088 
1089 	if (!intel_context_use_semaphores(to->context))
1090 		goto await_fence;
1091 
1092 	if (i915_request_has_initial_breadcrumb(to))
1093 		goto await_fence;
1094 
1095 	if (!rcu_access_pointer(from->hwsp_cacheline))
1096 		goto await_fence;
1097 
1098 	/*
1099 	 * If this or its dependents are waiting on an external fence
1100 	 * that may fail catastrophically, then we want to avoid using
1101 	 * sempahores as they bypass the fence signaling metadata, and we
1102 	 * lose the fence->error propagation.
1103 	 */
1104 	if (from->sched.flags & I915_SCHED_HAS_EXTERNAL_CHAIN)
1105 		goto await_fence;
1106 
1107 	/* Just emit the first semaphore we see as request space is limited. */
1108 	if (already_busywaiting(to) & mask)
1109 		goto await_fence;
1110 
1111 	if (i915_request_await_start(to, from) < 0)
1112 		goto await_fence;
1113 
1114 	/* Only submit our spinner after the signaler is running! */
1115 	if (__await_execution(to, from, NULL, gfp))
1116 		goto await_fence;
1117 
1118 	if (__emit_semaphore_wait(to, from, from->fence.seqno))
1119 		goto await_fence;
1120 
1121 	to->sched.semaphores |= mask;
1122 	wait = &to->semaphore;
1123 
1124 await_fence:
1125 	return i915_sw_fence_await_dma_fence(wait,
1126 					     &from->fence, 0,
1127 					     I915_FENCE_GFP);
1128 }
1129 
1130 static bool intel_timeline_sync_has_start(struct intel_timeline *tl,
1131 					  struct dma_fence *fence)
1132 {
1133 	return __intel_timeline_sync_is_later(tl,
1134 					      fence->context,
1135 					      fence->seqno - 1);
1136 }
1137 
1138 static int intel_timeline_sync_set_start(struct intel_timeline *tl,
1139 					 const struct dma_fence *fence)
1140 {
1141 	return __intel_timeline_sync_set(tl, fence->context, fence->seqno - 1);
1142 }
1143 
1144 static int
1145 __i915_request_await_execution(struct i915_request *to,
1146 			       struct i915_request *from,
1147 			       void (*hook)(struct i915_request *rq,
1148 					    struct dma_fence *signal))
1149 {
1150 	int err;
1151 
1152 	GEM_BUG_ON(intel_context_is_barrier(from->context));
1153 
1154 	/* Submit both requests at the same time */
1155 	err = __await_execution(to, from, hook, I915_FENCE_GFP);
1156 	if (err)
1157 		return err;
1158 
1159 	/* Squash repeated depenendices to the same timelines */
1160 	if (intel_timeline_sync_has_start(i915_request_timeline(to),
1161 					  &from->fence))
1162 		return 0;
1163 
1164 	/*
1165 	 * Wait until the start of this request.
1166 	 *
1167 	 * The execution cb fires when we submit the request to HW. But in
1168 	 * many cases this may be long before the request itself is ready to
1169 	 * run (consider that we submit 2 requests for the same context, where
1170 	 * the request of interest is behind an indefinite spinner). So we hook
1171 	 * up to both to reduce our queues and keep the execution lag minimised
1172 	 * in the worst case, though we hope that the await_start is elided.
1173 	 */
1174 	err = i915_request_await_start(to, from);
1175 	if (err < 0)
1176 		return err;
1177 
1178 	/*
1179 	 * Ensure both start together [after all semaphores in signal]
1180 	 *
1181 	 * Now that we are queued to the HW at roughly the same time (thanks
1182 	 * to the execute cb) and are ready to run at roughly the same time
1183 	 * (thanks to the await start), our signaler may still be indefinitely
1184 	 * delayed by waiting on a semaphore from a remote engine. If our
1185 	 * signaler depends on a semaphore, so indirectly do we, and we do not
1186 	 * want to start our payload until our signaler also starts theirs.
1187 	 * So we wait.
1188 	 *
1189 	 * However, there is also a second condition for which we need to wait
1190 	 * for the precise start of the signaler. Consider that the signaler
1191 	 * was submitted in a chain of requests following another context
1192 	 * (with just an ordinary intra-engine fence dependency between the
1193 	 * two). In this case the signaler is queued to HW, but not for
1194 	 * immediate execution, and so we must wait until it reaches the
1195 	 * active slot.
1196 	 */
1197 	if (intel_engine_has_semaphores(to->engine) &&
1198 	    !i915_request_has_initial_breadcrumb(to)) {
1199 		err = __emit_semaphore_wait(to, from, from->fence.seqno - 1);
1200 		if (err < 0)
1201 			return err;
1202 	}
1203 
1204 	/* Couple the dependency tree for PI on this exposed to->fence */
1205 	if (to->engine->schedule) {
1206 		err = i915_sched_node_add_dependency(&to->sched,
1207 						     &from->sched,
1208 						     I915_DEPENDENCY_WEAK);
1209 		if (err < 0)
1210 			return err;
1211 	}
1212 
1213 	return intel_timeline_sync_set_start(i915_request_timeline(to),
1214 					     &from->fence);
1215 }
1216 
1217 static void mark_external(struct i915_request *rq)
1218 {
1219 	/*
1220 	 * The downside of using semaphores is that we lose metadata passing
1221 	 * along the signaling chain. This is particularly nasty when we
1222 	 * need to pass along a fatal error such as EFAULT or EDEADLK. For
1223 	 * fatal errors we want to scrub the request before it is executed,
1224 	 * which means that we cannot preload the request onto HW and have
1225 	 * it wait upon a semaphore.
1226 	 */
1227 	rq->sched.flags |= I915_SCHED_HAS_EXTERNAL_CHAIN;
1228 }
1229 
1230 static int
1231 __i915_request_await_external(struct i915_request *rq, struct dma_fence *fence)
1232 {
1233 	mark_external(rq);
1234 	return i915_sw_fence_await_dma_fence(&rq->submit, fence,
1235 					     i915_fence_context_timeout(rq->engine->i915,
1236 									fence->context),
1237 					     I915_FENCE_GFP);
1238 }
1239 
1240 static int
1241 i915_request_await_external(struct i915_request *rq, struct dma_fence *fence)
1242 {
1243 	struct dma_fence *iter;
1244 	int err = 0;
1245 
1246 	if (!to_dma_fence_chain(fence))
1247 		return __i915_request_await_external(rq, fence);
1248 
1249 	dma_fence_chain_for_each(iter, fence) {
1250 		struct dma_fence_chain *chain = to_dma_fence_chain(iter);
1251 
1252 		if (!dma_fence_is_i915(chain->fence)) {
1253 			err = __i915_request_await_external(rq, iter);
1254 			break;
1255 		}
1256 
1257 		err = i915_request_await_dma_fence(rq, chain->fence);
1258 		if (err < 0)
1259 			break;
1260 	}
1261 
1262 	dma_fence_put(iter);
1263 	return err;
1264 }
1265 
1266 int
1267 i915_request_await_execution(struct i915_request *rq,
1268 			     struct dma_fence *fence,
1269 			     void (*hook)(struct i915_request *rq,
1270 					  struct dma_fence *signal))
1271 {
1272 	struct dma_fence **child = &fence;
1273 	unsigned int nchild = 1;
1274 	int ret;
1275 
1276 	if (dma_fence_is_array(fence)) {
1277 		struct dma_fence_array *array = to_dma_fence_array(fence);
1278 
1279 		/* XXX Error for signal-on-any fence arrays */
1280 
1281 		child = array->fences;
1282 		nchild = array->num_fences;
1283 		GEM_BUG_ON(!nchild);
1284 	}
1285 
1286 	do {
1287 		fence = *child++;
1288 		if (test_bit(DMA_FENCE_FLAG_SIGNALED_BIT, &fence->flags)) {
1289 			i915_sw_fence_set_error_once(&rq->submit, fence->error);
1290 			continue;
1291 		}
1292 
1293 		if (fence->context == rq->fence.context)
1294 			continue;
1295 
1296 		/*
1297 		 * We don't squash repeated fence dependencies here as we
1298 		 * want to run our callback in all cases.
1299 		 */
1300 
1301 		if (dma_fence_is_i915(fence))
1302 			ret = __i915_request_await_execution(rq,
1303 							     to_request(fence),
1304 							     hook);
1305 		else
1306 			ret = i915_request_await_external(rq, fence);
1307 		if (ret < 0)
1308 			return ret;
1309 	} while (--nchild);
1310 
1311 	return 0;
1312 }
1313 
1314 static int
1315 await_request_submit(struct i915_request *to, struct i915_request *from)
1316 {
1317 	/*
1318 	 * If we are waiting on a virtual engine, then it may be
1319 	 * constrained to execute on a single engine *prior* to submission.
1320 	 * When it is submitted, it will be first submitted to the virtual
1321 	 * engine and then passed to the physical engine. We cannot allow
1322 	 * the waiter to be submitted immediately to the physical engine
1323 	 * as it may then bypass the virtual request.
1324 	 */
1325 	if (to->engine == READ_ONCE(from->engine))
1326 		return i915_sw_fence_await_sw_fence_gfp(&to->submit,
1327 							&from->submit,
1328 							I915_FENCE_GFP);
1329 	else
1330 		return __i915_request_await_execution(to, from, NULL);
1331 }
1332 
1333 static int
1334 i915_request_await_request(struct i915_request *to, struct i915_request *from)
1335 {
1336 	int ret;
1337 
1338 	GEM_BUG_ON(to == from);
1339 	GEM_BUG_ON(to->timeline == from->timeline);
1340 
1341 	if (i915_request_completed(from)) {
1342 		i915_sw_fence_set_error_once(&to->submit, from->fence.error);
1343 		return 0;
1344 	}
1345 
1346 	if (to->engine->schedule) {
1347 		ret = i915_sched_node_add_dependency(&to->sched,
1348 						     &from->sched,
1349 						     I915_DEPENDENCY_EXTERNAL);
1350 		if (ret < 0)
1351 			return ret;
1352 	}
1353 
1354 	if (is_power_of_2(to->execution_mask | READ_ONCE(from->execution_mask)))
1355 		ret = await_request_submit(to, from);
1356 	else
1357 		ret = emit_semaphore_wait(to, from, I915_FENCE_GFP);
1358 	if (ret < 0)
1359 		return ret;
1360 
1361 	return 0;
1362 }
1363 
1364 int
1365 i915_request_await_dma_fence(struct i915_request *rq, struct dma_fence *fence)
1366 {
1367 	struct dma_fence **child = &fence;
1368 	unsigned int nchild = 1;
1369 	int ret;
1370 
1371 	/*
1372 	 * Note that if the fence-array was created in signal-on-any mode,
1373 	 * we should *not* decompose it into its individual fences. However,
1374 	 * we don't currently store which mode the fence-array is operating
1375 	 * in. Fortunately, the only user of signal-on-any is private to
1376 	 * amdgpu and we should not see any incoming fence-array from
1377 	 * sync-file being in signal-on-any mode.
1378 	 */
1379 	if (dma_fence_is_array(fence)) {
1380 		struct dma_fence_array *array = to_dma_fence_array(fence);
1381 
1382 		child = array->fences;
1383 		nchild = array->num_fences;
1384 		GEM_BUG_ON(!nchild);
1385 	}
1386 
1387 	do {
1388 		fence = *child++;
1389 		if (test_bit(DMA_FENCE_FLAG_SIGNALED_BIT, &fence->flags)) {
1390 			i915_sw_fence_set_error_once(&rq->submit, fence->error);
1391 			continue;
1392 		}
1393 
1394 		/*
1395 		 * Requests on the same timeline are explicitly ordered, along
1396 		 * with their dependencies, by i915_request_add() which ensures
1397 		 * that requests are submitted in-order through each ring.
1398 		 */
1399 		if (fence->context == rq->fence.context)
1400 			continue;
1401 
1402 		/* Squash repeated waits to the same timelines */
1403 		if (fence->context &&
1404 		    intel_timeline_sync_is_later(i915_request_timeline(rq),
1405 						 fence))
1406 			continue;
1407 
1408 		if (dma_fence_is_i915(fence))
1409 			ret = i915_request_await_request(rq, to_request(fence));
1410 		else
1411 			ret = i915_request_await_external(rq, fence);
1412 		if (ret < 0)
1413 			return ret;
1414 
1415 		/* Record the latest fence used against each timeline */
1416 		if (fence->context)
1417 			intel_timeline_sync_set(i915_request_timeline(rq),
1418 						fence);
1419 	} while (--nchild);
1420 
1421 	return 0;
1422 }
1423 
1424 /**
1425  * i915_request_await_object - set this request to (async) wait upon a bo
1426  * @to: request we are wishing to use
1427  * @obj: object which may be in use on another ring.
1428  * @write: whether the wait is on behalf of a writer
1429  *
1430  * This code is meant to abstract object synchronization with the GPU.
1431  * Conceptually we serialise writes between engines inside the GPU.
1432  * We only allow one engine to write into a buffer at any time, but
1433  * multiple readers. To ensure each has a coherent view of memory, we must:
1434  *
1435  * - If there is an outstanding write request to the object, the new
1436  *   request must wait for it to complete (either CPU or in hw, requests
1437  *   on the same ring will be naturally ordered).
1438  *
1439  * - If we are a write request (pending_write_domain is set), the new
1440  *   request must wait for outstanding read requests to complete.
1441  *
1442  * Returns 0 if successful, else propagates up the lower layer error.
1443  */
1444 int
1445 i915_request_await_object(struct i915_request *to,
1446 			  struct drm_i915_gem_object *obj,
1447 			  bool write)
1448 {
1449 	struct dma_fence *excl;
1450 	int ret = 0;
1451 
1452 	if (write) {
1453 		struct dma_fence **shared;
1454 		unsigned int count, i;
1455 
1456 		ret = dma_resv_get_fences_rcu(obj->base.resv,
1457 							&excl, &count, &shared);
1458 		if (ret)
1459 			return ret;
1460 
1461 		for (i = 0; i < count; i++) {
1462 			ret = i915_request_await_dma_fence(to, shared[i]);
1463 			if (ret)
1464 				break;
1465 
1466 			dma_fence_put(shared[i]);
1467 		}
1468 
1469 		for (; i < count; i++)
1470 			dma_fence_put(shared[i]);
1471 		kfree(shared);
1472 	} else {
1473 		excl = dma_resv_get_excl_rcu(obj->base.resv);
1474 	}
1475 
1476 	if (excl) {
1477 		if (ret == 0)
1478 			ret = i915_request_await_dma_fence(to, excl);
1479 
1480 		dma_fence_put(excl);
1481 	}
1482 
1483 	return ret;
1484 }
1485 
1486 static struct i915_request *
1487 __i915_request_add_to_timeline(struct i915_request *rq)
1488 {
1489 	struct intel_timeline *timeline = i915_request_timeline(rq);
1490 	struct i915_request *prev;
1491 
1492 	/*
1493 	 * Dependency tracking and request ordering along the timeline
1494 	 * is special cased so that we can eliminate redundant ordering
1495 	 * operations while building the request (we know that the timeline
1496 	 * itself is ordered, and here we guarantee it).
1497 	 *
1498 	 * As we know we will need to emit tracking along the timeline,
1499 	 * we embed the hooks into our request struct -- at the cost of
1500 	 * having to have specialised no-allocation interfaces (which will
1501 	 * be beneficial elsewhere).
1502 	 *
1503 	 * A second benefit to open-coding i915_request_await_request is
1504 	 * that we can apply a slight variant of the rules specialised
1505 	 * for timelines that jump between engines (such as virtual engines).
1506 	 * If we consider the case of virtual engine, we must emit a dma-fence
1507 	 * to prevent scheduling of the second request until the first is
1508 	 * complete (to maximise our greedy late load balancing) and this
1509 	 * precludes optimising to use semaphores serialisation of a single
1510 	 * timeline across engines.
1511 	 */
1512 	prev = to_request(__i915_active_fence_set(&timeline->last_request,
1513 						  &rq->fence));
1514 	if (prev && !i915_request_completed(prev)) {
1515 		/*
1516 		 * The requests are supposed to be kept in order. However,
1517 		 * we need to be wary in case the timeline->last_request
1518 		 * is used as a barrier for external modification to this
1519 		 * context.
1520 		 */
1521 		GEM_BUG_ON(prev->context == rq->context &&
1522 			   i915_seqno_passed(prev->fence.seqno,
1523 					     rq->fence.seqno));
1524 
1525 		if (is_power_of_2(READ_ONCE(prev->engine)->mask | rq->engine->mask))
1526 			i915_sw_fence_await_sw_fence(&rq->submit,
1527 						     &prev->submit,
1528 						     &rq->submitq);
1529 		else
1530 			__i915_sw_fence_await_dma_fence(&rq->submit,
1531 							&prev->fence,
1532 							&rq->dmaq);
1533 		if (rq->engine->schedule)
1534 			__i915_sched_node_add_dependency(&rq->sched,
1535 							 &prev->sched,
1536 							 &rq->dep,
1537 							 0);
1538 	}
1539 
1540 	/*
1541 	 * Make sure that no request gazumped us - if it was allocated after
1542 	 * our i915_request_alloc() and called __i915_request_add() before
1543 	 * us, the timeline will hold its seqno which is later than ours.
1544 	 */
1545 	GEM_BUG_ON(timeline->seqno != rq->fence.seqno);
1546 
1547 	return prev;
1548 }
1549 
1550 /*
1551  * NB: This function is not allowed to fail. Doing so would mean the the
1552  * request is not being tracked for completion but the work itself is
1553  * going to happen on the hardware. This would be a Bad Thing(tm).
1554  */
1555 struct i915_request *__i915_request_commit(struct i915_request *rq)
1556 {
1557 	struct intel_engine_cs *engine = rq->engine;
1558 	struct intel_ring *ring = rq->ring;
1559 	u32 *cs;
1560 
1561 	RQ_TRACE(rq, "\n");
1562 
1563 	/*
1564 	 * To ensure that this call will not fail, space for its emissions
1565 	 * should already have been reserved in the ring buffer. Let the ring
1566 	 * know that it is time to use that space up.
1567 	 */
1568 	GEM_BUG_ON(rq->reserved_space > ring->space);
1569 	rq->reserved_space = 0;
1570 	rq->emitted_jiffies = jiffies;
1571 
1572 	/*
1573 	 * Record the position of the start of the breadcrumb so that
1574 	 * should we detect the updated seqno part-way through the
1575 	 * GPU processing the request, we never over-estimate the
1576 	 * position of the ring's HEAD.
1577 	 */
1578 	cs = intel_ring_begin(rq, engine->emit_fini_breadcrumb_dw);
1579 	GEM_BUG_ON(IS_ERR(cs));
1580 	rq->postfix = intel_ring_offset(rq, cs);
1581 
1582 	return __i915_request_add_to_timeline(rq);
1583 }
1584 
1585 void __i915_request_queue(struct i915_request *rq,
1586 			  const struct i915_sched_attr *attr)
1587 {
1588 	/*
1589 	 * Let the backend know a new request has arrived that may need
1590 	 * to adjust the existing execution schedule due to a high priority
1591 	 * request - i.e. we may want to preempt the current request in order
1592 	 * to run a high priority dependency chain *before* we can execute this
1593 	 * request.
1594 	 *
1595 	 * This is called before the request is ready to run so that we can
1596 	 * decide whether to preempt the entire chain so that it is ready to
1597 	 * run at the earliest possible convenience.
1598 	 */
1599 	if (attr && rq->engine->schedule)
1600 		rq->engine->schedule(rq, attr);
1601 	i915_sw_fence_commit(&rq->semaphore);
1602 	i915_sw_fence_commit(&rq->submit);
1603 }
1604 
1605 void i915_request_add(struct i915_request *rq)
1606 {
1607 	struct intel_timeline * const tl = i915_request_timeline(rq);
1608 	struct i915_sched_attr attr = {};
1609 	struct i915_gem_context *ctx;
1610 
1611 	lockdep_assert_held(&tl->mutex);
1612 	lockdep_unpin_lock(&tl->mutex, rq->cookie);
1613 
1614 	trace_i915_request_add(rq);
1615 	__i915_request_commit(rq);
1616 
1617 	/* XXX placeholder for selftests */
1618 	rcu_read_lock();
1619 	ctx = rcu_dereference(rq->context->gem_context);
1620 	if (ctx)
1621 		attr = ctx->sched;
1622 	rcu_read_unlock();
1623 
1624 	__i915_request_queue(rq, &attr);
1625 
1626 	mutex_unlock(&tl->mutex);
1627 }
1628 
1629 static unsigned long local_clock_ns(unsigned int *cpu)
1630 {
1631 	unsigned long t;
1632 
1633 	/*
1634 	 * Cheaply and approximately convert from nanoseconds to microseconds.
1635 	 * The result and subsequent calculations are also defined in the same
1636 	 * approximate microseconds units. The principal source of timing
1637 	 * error here is from the simple truncation.
1638 	 *
1639 	 * Note that local_clock() is only defined wrt to the current CPU;
1640 	 * the comparisons are no longer valid if we switch CPUs. Instead of
1641 	 * blocking preemption for the entire busywait, we can detect the CPU
1642 	 * switch and use that as indicator of system load and a reason to
1643 	 * stop busywaiting, see busywait_stop().
1644 	 */
1645 	*cpu = get_cpu();
1646 	t = local_clock();
1647 	put_cpu();
1648 
1649 	return t;
1650 }
1651 
1652 static bool busywait_stop(unsigned long timeout, unsigned int cpu)
1653 {
1654 	unsigned int this_cpu;
1655 
1656 	if (time_after(local_clock_ns(&this_cpu), timeout))
1657 		return true;
1658 
1659 	return this_cpu != cpu;
1660 }
1661 
1662 static bool __i915_spin_request(struct i915_request * const rq, int state)
1663 {
1664 	unsigned long timeout_ns;
1665 	unsigned int cpu;
1666 
1667 	/*
1668 	 * Only wait for the request if we know it is likely to complete.
1669 	 *
1670 	 * We don't track the timestamps around requests, nor the average
1671 	 * request length, so we do not have a good indicator that this
1672 	 * request will complete within the timeout. What we do know is the
1673 	 * order in which requests are executed by the context and so we can
1674 	 * tell if the request has been started. If the request is not even
1675 	 * running yet, it is a fair assumption that it will not complete
1676 	 * within our relatively short timeout.
1677 	 */
1678 	if (!i915_request_is_running(rq))
1679 		return false;
1680 
1681 	/*
1682 	 * When waiting for high frequency requests, e.g. during synchronous
1683 	 * rendering split between the CPU and GPU, the finite amount of time
1684 	 * required to set up the irq and wait upon it limits the response
1685 	 * rate. By busywaiting on the request completion for a short while we
1686 	 * can service the high frequency waits as quick as possible. However,
1687 	 * if it is a slow request, we want to sleep as quickly as possible.
1688 	 * The tradeoff between waiting and sleeping is roughly the time it
1689 	 * takes to sleep on a request, on the order of a microsecond.
1690 	 */
1691 
1692 	timeout_ns = READ_ONCE(rq->engine->props.max_busywait_duration_ns);
1693 	timeout_ns += local_clock_ns(&cpu);
1694 	do {
1695 		if (dma_fence_is_signaled(&rq->fence))
1696 			return true;
1697 
1698 		if (signal_pending_state(state, current))
1699 			break;
1700 
1701 		if (busywait_stop(timeout_ns, cpu))
1702 			break;
1703 
1704 		cpu_relax();
1705 	} while (!need_resched());
1706 
1707 	return false;
1708 }
1709 
1710 struct request_wait {
1711 	struct dma_fence_cb cb;
1712 	struct task_struct *tsk;
1713 };
1714 
1715 static void request_wait_wake(struct dma_fence *fence, struct dma_fence_cb *cb)
1716 {
1717 	struct request_wait *wait = container_of(cb, typeof(*wait), cb);
1718 
1719 	wake_up_process(fetch_and_zero(&wait->tsk));
1720 }
1721 
1722 /**
1723  * i915_request_wait - wait until execution of request has finished
1724  * @rq: the request to wait upon
1725  * @flags: how to wait
1726  * @timeout: how long to wait in jiffies
1727  *
1728  * i915_request_wait() waits for the request to be completed, for a
1729  * maximum of @timeout jiffies (with MAX_SCHEDULE_TIMEOUT implying an
1730  * unbounded wait).
1731  *
1732  * Returns the remaining time (in jiffies) if the request completed, which may
1733  * be zero or -ETIME if the request is unfinished after the timeout expires.
1734  * May return -EINTR is called with I915_WAIT_INTERRUPTIBLE and a signal is
1735  * pending before the request completes.
1736  */
1737 long i915_request_wait(struct i915_request *rq,
1738 		       unsigned int flags,
1739 		       long timeout)
1740 {
1741 	const int state = flags & I915_WAIT_INTERRUPTIBLE ?
1742 		TASK_INTERRUPTIBLE : TASK_UNINTERRUPTIBLE;
1743 	struct request_wait wait;
1744 
1745 	might_sleep();
1746 	GEM_BUG_ON(timeout < 0);
1747 
1748 	if (dma_fence_is_signaled(&rq->fence))
1749 		return timeout;
1750 
1751 	if (!timeout)
1752 		return -ETIME;
1753 
1754 	trace_i915_request_wait_begin(rq, flags);
1755 
1756 	/*
1757 	 * We must never wait on the GPU while holding a lock as we
1758 	 * may need to perform a GPU reset. So while we don't need to
1759 	 * serialise wait/reset with an explicit lock, we do want
1760 	 * lockdep to detect potential dependency cycles.
1761 	 */
1762 	mutex_acquire(&rq->engine->gt->reset.mutex.dep_map, 0, 0, _THIS_IP_);
1763 
1764 	/*
1765 	 * Optimistic spin before touching IRQs.
1766 	 *
1767 	 * We may use a rather large value here to offset the penalty of
1768 	 * switching away from the active task. Frequently, the client will
1769 	 * wait upon an old swapbuffer to throttle itself to remain within a
1770 	 * frame of the gpu. If the client is running in lockstep with the gpu,
1771 	 * then it should not be waiting long at all, and a sleep now will incur
1772 	 * extra scheduler latency in producing the next frame. To try to
1773 	 * avoid adding the cost of enabling/disabling the interrupt to the
1774 	 * short wait, we first spin to see if the request would have completed
1775 	 * in the time taken to setup the interrupt.
1776 	 *
1777 	 * We need upto 5us to enable the irq, and upto 20us to hide the
1778 	 * scheduler latency of a context switch, ignoring the secondary
1779 	 * impacts from a context switch such as cache eviction.
1780 	 *
1781 	 * The scheme used for low-latency IO is called "hybrid interrupt
1782 	 * polling". The suggestion there is to sleep until just before you
1783 	 * expect to be woken by the device interrupt and then poll for its
1784 	 * completion. That requires having a good predictor for the request
1785 	 * duration, which we currently lack.
1786 	 */
1787 	if (IS_ACTIVE(CONFIG_DRM_I915_MAX_REQUEST_BUSYWAIT) &&
1788 	    __i915_spin_request(rq, state))
1789 		goto out;
1790 
1791 	/*
1792 	 * This client is about to stall waiting for the GPU. In many cases
1793 	 * this is undesirable and limits the throughput of the system, as
1794 	 * many clients cannot continue processing user input/output whilst
1795 	 * blocked. RPS autotuning may take tens of milliseconds to respond
1796 	 * to the GPU load and thus incurs additional latency for the client.
1797 	 * We can circumvent that by promoting the GPU frequency to maximum
1798 	 * before we sleep. This makes the GPU throttle up much more quickly
1799 	 * (good for benchmarks and user experience, e.g. window animations),
1800 	 * but at a cost of spending more power processing the workload
1801 	 * (bad for battery).
1802 	 */
1803 	if (flags & I915_WAIT_PRIORITY && !i915_request_started(rq))
1804 		intel_rps_boost(rq);
1805 
1806 	wait.tsk = current;
1807 	if (dma_fence_add_callback(&rq->fence, &wait.cb, request_wait_wake))
1808 		goto out;
1809 
1810 	/*
1811 	 * Flush the submission tasklet, but only if it may help this request.
1812 	 *
1813 	 * We sometimes experience some latency between the HW interrupts and
1814 	 * tasklet execution (mostly due to ksoftirqd latency, but it can also
1815 	 * be due to lazy CS events), so lets run the tasklet manually if there
1816 	 * is a chance it may submit this request. If the request is not ready
1817 	 * to run, as it is waiting for other fences to be signaled, flushing
1818 	 * the tasklet is busy work without any advantage for this client.
1819 	 *
1820 	 * If the HW is being lazy, this is the last chance before we go to
1821 	 * sleep to catch any pending events. We will check periodically in
1822 	 * the heartbeat to flush the submission tasklets as a last resort
1823 	 * for unhappy HW.
1824 	 */
1825 	if (i915_request_is_ready(rq))
1826 		intel_engine_flush_submission(rq->engine);
1827 
1828 	for (;;) {
1829 		set_current_state(state);
1830 
1831 		if (dma_fence_is_signaled(&rq->fence))
1832 			break;
1833 
1834 		if (signal_pending_state(state, current)) {
1835 			timeout = -ERESTARTSYS;
1836 			break;
1837 		}
1838 
1839 		if (!timeout) {
1840 			timeout = -ETIME;
1841 			break;
1842 		}
1843 
1844 		timeout = io_schedule_timeout(timeout);
1845 	}
1846 	__set_current_state(TASK_RUNNING);
1847 
1848 	if (READ_ONCE(wait.tsk))
1849 		dma_fence_remove_callback(&rq->fence, &wait.cb);
1850 	GEM_BUG_ON(!list_empty(&wait.cb.node));
1851 
1852 out:
1853 	mutex_release(&rq->engine->gt->reset.mutex.dep_map, _THIS_IP_);
1854 	trace_i915_request_wait_end(rq);
1855 	return timeout;
1856 }
1857 
1858 #if IS_ENABLED(CONFIG_DRM_I915_SELFTEST)
1859 #include "selftests/mock_request.c"
1860 #include "selftests/i915_request.c"
1861 #endif
1862 
1863 static void i915_global_request_shrink(void)
1864 {
1865 	kmem_cache_shrink(global.slab_execute_cbs);
1866 	kmem_cache_shrink(global.slab_requests);
1867 }
1868 
1869 static void i915_global_request_exit(void)
1870 {
1871 	kmem_cache_destroy(global.slab_execute_cbs);
1872 	kmem_cache_destroy(global.slab_requests);
1873 }
1874 
1875 static struct i915_global_request global = { {
1876 	.shrink = i915_global_request_shrink,
1877 	.exit = i915_global_request_exit,
1878 } };
1879 
1880 int __init i915_global_request_init(void)
1881 {
1882 	global.slab_requests =
1883 		kmem_cache_create("i915_request",
1884 				  sizeof(struct i915_request),
1885 				  __alignof__(struct i915_request),
1886 				  SLAB_HWCACHE_ALIGN |
1887 				  SLAB_RECLAIM_ACCOUNT |
1888 				  SLAB_TYPESAFE_BY_RCU,
1889 				  __i915_request_ctor);
1890 	if (!global.slab_requests)
1891 		return -ENOMEM;
1892 
1893 	global.slab_execute_cbs = KMEM_CACHE(execute_cb,
1894 					     SLAB_HWCACHE_ALIGN |
1895 					     SLAB_RECLAIM_ACCOUNT |
1896 					     SLAB_TYPESAFE_BY_RCU);
1897 	if (!global.slab_execute_cbs)
1898 		goto err_requests;
1899 
1900 	i915_global_register(&global.base);
1901 	return 0;
1902 
1903 err_requests:
1904 	kmem_cache_destroy(global.slab_requests);
1905 	return -ENOMEM;
1906 }
1907