[Cbe-oss-dev] [PATCH] spufs: fix SPU runqueue corruption

[Akinobu Mita]

It is possible that two processes simultaneously try to
make one SPU context runnable. Then both process is trying to add
the context to runqueue and break runqueue list.

For example, one process is blocking at run_spu() and waiting for idle SPU.
another process is reading its psmap.

This patch prevents the SPU context which is already in runqueue
to be queueed runqueue again and check whether the context already
has been runnable or being destroyed after spu_prio_wait().

I'm not sure this patch doing right thing to fix. But it prevents
Oops by runqueue corruption.

This is reproducible by direct_ps on PS3.
direct_ps is the sample program in Cell SDK
(/opt/ibm/cell-sdk/prototype/src/tests/direct_problem_state/direct_ps.c)

Signed-off-by: Akinobu Mita <mita at fixstars.com>

---
 arch/powerpc/platforms/cell/spufs/sched.c |   14 +++++++++-----
 1 file changed, 9 insertions(+), 5 deletions(-)

Index: 2.6-git-ps3/arch/powerpc/platforms/cell/spufs/sched.c
===================================================================
--- 2.6-git-ps3.orig/arch/powerpc/platforms/cell/spufs/sched.c
+++ 2.6-git-ps3/arch/powerpc/platforms/cell/spufs/sched.c
@@ -240,8 +240,10 @@ static void __spu_add_to_rq(struct spu_c
 {
 	int prio = ctx->prio;
 
-	list_add_tail(&ctx->rq, &spu_prio->runq[prio]);
-	set_bit(prio, spu_prio->bitmap);
+	if (list_empty(&ctx->rq)) {
+		list_add_tail(&ctx->rq, &spu_prio->runq[prio]);
+		set_bit(prio, spu_prio->bitmap);
+	}
 }
 
 static void __spu_del_from_rq(struct spu_context *ctx)
@@ -405,12 +407,14 @@ static struct spu *find_victim(struct sp
 int spu_activate(struct spu_context *ctx, unsigned long flags)
 {
 
-	if (ctx->spu)
-		return 0;
-
 	do {
 		struct spu *spu;
 
+		if (ctx->spu)
+			return 0;
+		if (!ctx->owner)
+			return -EINVAL;
+
 		spu = spu_get_idle(ctx);
 		/*
 		 * If this is a realtime thread we try to get it running by