From: Arunpravin Paneer Selvam <[email protected]>

Range-restricted allocations (the visible-VRAM aperture) skip
dirty_steer_window() and reach __alloc_range_bias() with no clear/dirty
eligibility guard, so a dirty allocation freely splits clear extents (and
vice versa), interleaving the two classes until no large same-class run
survives and a 4K scanout pin fails with -ENOSPC. Use a two-pass range
search instead: block_incompatible() rejects opposite-class blocks in the
strict pass and relaxes only when the strict pass returns -ENOSPC, so a
request still succeeds when only opposite-class space remains. A KUnit
regression test covers the interleaving pattern and fails without the
guard.

v2: the strict pass can split a block and then reject both children, so
    a split no longer implies a compatible block exists. Sashiko reported
    the resulting leaked splits; fix as suggested by Matthew:
 - Push the parent back on the DFS stack after each split and merge it
   back with unsplit_block() if both children are still free.
 - Make block_incompatible() judge free blocks only (split nodes keep a
   stale clear bit) and take the requested order, so mixed blocks that
   can hold a compatible block are descended instead of skipped.
 - Extend the KUnit test with a coalesced mixed block and a check that
   a rejected split is merged back.

Fixes: 1ad5e807f716 ("gpu/buddy: replace dual-tree/force_merge with decoupled 
dirty tracker")
Assisted-by: LLM
Cc: Matthew Auld <[email protected]>
Cc: Christian König <[email protected]>
Signed-off-by: Arunpravin Paneer Selvam <[email protected]>
---
 drivers/gpu/buddy.c                | 112 ++++++++++++++++++----------
 drivers/gpu/tests/gpu_buddy_test.c | 114 +++++++++++++++++++++++++++++
 2 files changed, 189 insertions(+), 37 deletions(-)

diff --git a/drivers/gpu/buddy.c b/drivers/gpu/buddy.c
index 503f7d5934e4..8eb5835d6944 100644
--- a/drivers/gpu/buddy.c
+++ b/drivers/gpu/buddy.c
@@ -1240,11 +1240,46 @@ static void __gpu_buddy_undo_splits(struct gpu_buddy 
*mm,
        }
 }
 
+static void unsplit_block(struct gpu_buddy *mm,
+                         struct gpu_buddy_block *block)
+{
+       unsigned int child_order = gpu_buddy_block_order(block) - 1;
+
+       rbtree_remove(mm, block->left);
+       rbtree_remove(mm, block->right);
+       mm->free_scoreboard[child_order] -= 2;
+
+       gpu_block_free(mm, block->left);
+       gpu_block_free(mm, block->right);
+       block->left = NULL;
+       block->right = NULL;
+
+       __mark_free(mm, block, gpu_block_cached_state(block));
+}
+
+static bool block_incompatible(struct gpu_buddy_block *block,
+                              unsigned int order,
+                              unsigned long flags)
+{
+       bool needs_clear = flags & GPU_BUDDY_CLEAR_ALLOCATION;
+
+       if (!gpu_buddy_block_is_free(block))
+               return false;
+
+       if (gpu_buddy_block_order(block) == order)
+               return needs_clear ? !gpu_buddy_block_is_clear(block) :
+                                    block->has_clear;
+
+       return needs_clear ? !block->has_clear :
+                            gpu_buddy_block_is_clear(block);
+}
+
 static struct gpu_buddy_block *
 __alloc_range_bias(struct gpu_buddy *mm,
                   u64 start, u64 end,
                   unsigned int order,
-                  unsigned long flags)
+                  unsigned long flags,
+                  bool fallback)
 {
        u64 req_size = mm->chunk_size << order;
        struct gpu_buddy_block *block;
@@ -1258,9 +1293,7 @@ __alloc_range_bias(struct gpu_buddy *mm,
         * This range-constrained search hands back the highest/right-most
         * address that satisfies the request: the roots are seeded high-to-low
         * and the right (higher-address) child is descended first, making
-        * top-down the default placement here. A non-top-down clear request is
-        * the only exception, where the descent is biased towards clear or
-        * clear-containing subtrees to satisfy the clear preference.
+        * top-down the default placement here.
         */
        for (i = mm->n_roots - 1; i >= 0; --i)
                list_add_tail(&mm->roots[i]->tmp_link, &dfs);
@@ -1277,6 +1310,17 @@ __alloc_range_bias(struct gpu_buddy *mm,
 
                list_del(&block->tmp_link);
 
+               /*
+                * We split this block earlier and found nothing compatible in
+                * either child; merge it back before moving on.
+                */
+               if (gpu_buddy_block_is_split(block) &&
+                   gpu_buddy_block_is_free(block->left) &&
+                   gpu_buddy_block_is_free(block->right)) {
+                       unsplit_block(mm, block);
+                       continue;
+               }
+
                if (gpu_buddy_block_order(block) < order)
                        continue;
 
@@ -1298,6 +1342,9 @@ __alloc_range_bias(struct gpu_buddy *mm,
                                continue;
                }
 
+               if (!fallback && block_incompatible(block, order, flags))
+                       continue;
+
                if (contains(start, end, block_start, block_end) &&
                    order == gpu_buddy_block_order(block)) {
                        /*
@@ -1313,40 +1360,13 @@ __alloc_range_bias(struct gpu_buddy *mm,
                        err = split_block(mm, block);
                        if (unlikely(err))
                                goto err_undo;
-               }
-
-               /*
-                * Top-down is a strict address-placement policy, so when it is
-                * requested we ignore clear steering and simply descend the
-                * right (higher-address) child first. Only a non-top-down clear
-                * request biases the descent towards clear/has_clear subtrees.
-                */
-               if ((flags & GPU_BUDDY_CLEAR_ALLOCATION) &&
-                   !(flags & GPU_BUDDY_TOPDOWN_ALLOCATION)) {
-                       struct gpu_buddy_block *prefer;
-
-                       if (gpu_buddy_block_is_clear(block->right))
-                               prefer = block->right;
-                       else if (gpu_buddy_block_is_clear(block->left))
-                               prefer = block->left;
-                       else if (block->right->has_clear)
-                               prefer = block->right;
-                       else if (block->left->has_clear)
-                               prefer = block->left;
-                       else
-                               prefer = block->right;
 
-                       if (prefer == block->right) {
-                               list_add(&block->left->tmp_link, &dfs);
-                               list_add(&block->right->tmp_link, &dfs);
-                       } else {
-                               list_add(&block->right->tmp_link, &dfs);
-                               list_add(&block->left->tmp_link, &dfs);
-                       }
-               } else {
-                       list_add(&block->left->tmp_link, &dfs);
-                       list_add(&block->right->tmp_link, &dfs);
+                       /* Revisit after the children so the split can be 
undone. */
+                       list_add(&block->tmp_link, &dfs);
                }
+
+               list_add(&block->left->tmp_link, &dfs);
+               list_add(&block->right->tmp_link, &dfs);
        } while (1);
 
        return ERR_PTR(-ENOSPC);
@@ -1361,6 +1381,24 @@ __alloc_range_bias(struct gpu_buddy *mm,
        return ERR_PTR(err);
 }
 
+static struct gpu_buddy_block *
+__gpu_buddy_alloc_range_bias(struct gpu_buddy *mm,
+                            u64 start, u64 end,
+                            unsigned int order,
+                            unsigned long flags)
+{
+       struct gpu_buddy_block *block;
+       bool fallback = false;
+
+       block = __alloc_range_bias(mm, start, end, order,
+                                  flags, fallback);
+       if (IS_ERR(block))
+               return __alloc_range_bias(mm, start, end, order,
+                                         flags, !fallback);
+
+       return block;
+}
+
 /* Return the highest-address free block of at least @order. */
 static struct gpu_buddy_block *
 get_maxblock(struct gpu_buddy *mm,
@@ -1924,7 +1962,7 @@ __gpu_buddy_alloc_blocks(struct gpu_buddy *mm,
 
        if (flags & GPU_BUDDY_RANGE_ALLOCATION) {
                /* Allocate traversing within the range */
-               block = __alloc_range_bias(mm, start, end, order, flags);
+               block = __gpu_buddy_alloc_range_bias(mm, start, end, order, 
flags);
                if (!IS_ERR(block) || !steered)
                        return block;
 
diff --git a/drivers/gpu/tests/gpu_buddy_test.c 
b/drivers/gpu/tests/gpu_buddy_test.c
index b75d32ca6ca0..b78e3307958b 100644
--- a/drivers/gpu/tests/gpu_buddy_test.c
+++ b/drivers/gpu/tests/gpu_buddy_test.c
@@ -1597,6 +1597,119 @@ static int gpu_buddy_suite_init(struct kunit_suite 
*suite)
        return 0;
 }
 
+static void gpu_test_buddy_alloc_range_clear_guard(struct kunit *test)
+{
+       const unsigned long chunk = SZ_1M, mm_size = SZ_4M;
+       struct gpu_buddy_block *block;
+       LIST_HEAD(high_clear_a);
+       LIST_HEAD(high_clear_b);
+       LIST_HEAD(low_dirty);
+       struct gpu_buddy mm;
+       LIST_HEAD(barrier);
+       LIST_HEAD(result);
+
+       KUNIT_ASSERT_FALSE_MSG(test, gpu_buddy_init(&mm, mm_size, chunk),
+                              "buddy_init failed\n");
+
+       /*
+        * Lay out a 4 MiB aperture as three regions:
+        *
+        *   [0,  1M)   dirty free
+        *   [1M, 2M)   allocated  (barrier, keeps the two halves un-mergeable)
+        *   [2M, 4M)   clear free (one naturally aligned 2 MiB extent)
+        *
+        * A dirty (non-clear) range allocation must take the low dirty block
+        * and leave the large clear extent intact. Without the guard the
+        * top-down search cuts the higher clear extent instead and returns a
+        * clear block -- the interleaving that fragments the aperture and
+        * ultimately fails a large same-class scanout allocation.
+        */
+       KUNIT_ASSERT_FALSE_MSG(test,
+                              gpu_buddy_alloc_blocks(&mm, 0, chunk, chunk, 
chunk,
+                                                     &low_dirty, 
GPU_BUDDY_RANGE_ALLOCATION),
+                              "alloc [0, 1M) failed\n");
+       KUNIT_ASSERT_FALSE_MSG(test,
+                              gpu_buddy_alloc_blocks(&mm, chunk, 2 * chunk, 
chunk, chunk,
+                                                     &barrier, 
GPU_BUDDY_RANGE_ALLOCATION),
+                              "alloc [1M, 2M) failed\n");
+       KUNIT_ASSERT_FALSE_MSG(test,
+                              gpu_buddy_alloc_blocks(&mm, 2 * chunk, 3 * 
chunk, chunk, chunk,
+                                                     &high_clear_a, 
GPU_BUDDY_RANGE_ALLOCATION),
+                              "alloc [2M, 3M) failed\n");
+       KUNIT_ASSERT_FALSE_MSG(test,
+                              gpu_buddy_alloc_blocks(&mm, 3 * chunk, 4 * 
chunk, chunk, chunk,
+                                                     &high_clear_b, 
GPU_BUDDY_RANGE_ALLOCATION),
+                              "alloc [3M, 4M) failed\n");
+
+       /* [2M, 4M) coalesces into one aligned clear extent; [0, 1M) stays 
dirty. */
+       gpu_buddy_free_list(&mm, &low_dirty, 0);
+       gpu_buddy_free_list(&mm, &high_clear_a, GPU_BUDDY_CLEARED);
+       gpu_buddy_free_list(&mm, &high_clear_b, GPU_BUDDY_CLEARED);
+
+       KUNIT_ASSERT_FALSE_MSG(test,
+                              gpu_buddy_alloc_blocks(&mm, 0, mm_size, chunk, 
chunk,
+                                                     &result, 
GPU_BUDDY_RANGE_ALLOCATION),
+                              "dirty range alloc failed\n");
+
+       block = list_first_entry(&result, struct gpu_buddy_block, link);
+       KUNIT_EXPECT_FALSE_MSG(test, gpu_buddy_block_is_clear(block),
+                              "dirty range alloc cut the clear extent 
(offset=%llx)\n",
+                              gpu_buddy_block_offset(block));
+       KUNIT_EXPECT_EQ(test, gpu_buddy_block_offset(block), 0ULL);
+
+       /*
+        * Coalesced GPU_BLOCK_MIXED subtree:
+        *
+        *   [0,  1M)   allocated (result)
+        *   [1M, 2M)   dirty free
+        *   [2M, 3M)   clear free  } coalesced into [2M, 4M) GPU_BLOCK_MIXED
+        *   [3M, 4M)   dirty free  }
+        *
+        * A dirty range alloc restricted to [1M, 3M) visits [2M, 4M) first,
+        * splits it, rejects the clear [2M, 3M) half and must unsplit
+        * [2M, 4M) before taking [1M, 2M). Otherwise the split leaks.
+        */
+       KUNIT_ASSERT_FALSE_MSG(test,
+                              gpu_buddy_alloc_blocks(&mm, 2 * chunk, 3 * 
chunk, chunk, chunk,
+                                                     &high_clear_a, 
GPU_BUDDY_RANGE_ALLOCATION),
+                              "alloc [2M, 3M) failed\n");
+       KUNIT_ASSERT_FALSE_MSG(test,
+                              gpu_buddy_alloc_blocks(&mm, 3 * chunk, 4 * 
chunk, chunk, chunk,
+                                                     &high_clear_b, 
GPU_BUDDY_RANGE_ALLOCATION),
+                              "alloc [3M, 4M) failed\n");
+       gpu_buddy_free_list(&mm, &barrier, 0);
+       gpu_buddy_free_list(&mm, &high_clear_a, GPU_BUDDY_CLEARED);
+       gpu_buddy_free_list(&mm, &high_clear_b, 0);
+
+       KUNIT_ASSERT_FALSE_MSG(test,
+                              gpu_buddy_alloc_blocks(&mm, chunk, 3 * chunk, 
chunk, chunk,
+                                                     &low_dirty, 
GPU_BUDDY_RANGE_ALLOCATION),
+                              "dirty range alloc [1M, 3M) failed\n");
+       block = list_first_entry(&low_dirty, struct gpu_buddy_block, link);
+       KUNIT_EXPECT_FALSE(test, gpu_buddy_block_is_clear(block));
+       KUNIT_EXPECT_EQ(test, gpu_buddy_block_offset(block), (u64)chunk);
+
+       /* The rejected split of [2M, 4M) must have been merged back. */
+       KUNIT_EXPECT_EQ(test, mm.free_scoreboard[0], 0ULL);
+       KUNIT_EXPECT_EQ(test, mm.free_scoreboard[1], 1ULL);
+
+       /* A clear alloc must descend into the mixed [2M, 4M) block. */
+       KUNIT_ASSERT_FALSE_MSG(test,
+                              gpu_buddy_alloc_blocks(&mm, 0, mm_size, chunk, 
chunk,
+                                                     &high_clear_a,
+                                                     
GPU_BUDDY_RANGE_ALLOCATION |
+                                                     
GPU_BUDDY_CLEAR_ALLOCATION),
+                              "clear range alloc failed\n");
+       block = list_first_entry(&high_clear_a, struct gpu_buddy_block, link);
+       KUNIT_EXPECT_TRUE(test, gpu_buddy_block_is_clear(block));
+       KUNIT_EXPECT_EQ(test, gpu_buddy_block_offset(block), (u64)(2 * chunk));
+
+       gpu_buddy_free_list(&mm, &high_clear_a, GPU_BUDDY_CLEARED);
+       gpu_buddy_free_list(&mm, &low_dirty, 0);
+       gpu_buddy_free_list(&mm, &result, 0);
+       gpu_buddy_fini(&mm);
+}
+
 static struct kunit_case gpu_buddy_tests[] = {
        KUNIT_CASE(gpu_test_buddy_alloc_limit),
        KUNIT_CASE(gpu_test_buddy_alloc_optimistic),
@@ -1606,6 +1719,7 @@ static struct kunit_case gpu_buddy_tests[] = {
        KUNIT_CASE(gpu_test_buddy_alloc_clear),
        KUNIT_CASE(gpu_test_buddy_alloc_range),
        KUNIT_CASE(gpu_test_buddy_alloc_range_bias),
+       KUNIT_CASE(gpu_test_buddy_alloc_range_clear_guard),
        KUNIT_CASE_SLOW(gpu_test_buddy_fragmentation_performance),
        KUNIT_CASE_SLOW(gpu_test_buddy_dirty_tracker_performance),
        KUNIT_CASE(gpu_test_buddy_alloc_exceeds_max_order),

base-commit: b3de601e57d983e4a42e27d499516041c11c2bde
-- 
2.43.0

Reply via email to