v1 ran into the right question from Christian: the teardown wait must
stay unbounded, and the real bug is that KFD processes never terminate
on a physically gone device. This series answers that with a captured
reproduction and fixes the termination path so the unbounded wait can
actually complete.
Root cause (full chain captured via hung-task detector on a live
repro, MI50 behind Thunderbolt, pciehp Surprise+ slot power-off):
1. Removal signals the process via terminate event -> SIGBUS.
2. The process exits through elf_core_dump -> get_dump_page ->
__get_user_pages -> do_swap_page on its SVM managed ranges.
3. svm_migrate_vram_to_ram submits an SDMA copy job to a killed
drm_sched entity (refcount_t warns + "Trying to push to a killed
entity"), then svm_migrate_copy_done waits uninterruptibly on a
job fence that can never signal.
4. The dying task holds svms->lock as a reader, so
svm_range_restore_work blocks on the writer side, and the amdkfd
userptr restore worker piles up behind its locks.
5. kfd_processes_count never drains -> teardown waits forever ->
removal thread wedges -> host dies.
Additionally, on the disconnected path amdgpu_device_fini_hw() frees
kfd.dev (and the embedded kfd_processes_count) in
amdgpu_amdkfd_device_fini_sw() *before* teardown runs, so the wait
either NULL-derefs or can never observe the count at all. Process
teardown has to happen while kfd.dev is still valid.
Changes in v3:
- 1/3: reorder - teardown processes before the early fini_sw on the
disconnected path; keep the NULL guard for the second teardown call;
the drain wait is unbounded again (no timeout). Fixes: tags cover
both the premature free (28695ca09d32) and the unguarded count wait
(d12d05c4bc4c).
- 2/3: resubmission, unchanged from the v2 already posted.
- 3/3: new - fail fast with -ENODEV in the SVM migration paths so the
dying task's fault/exit path never submits to or waits on a dead
device.
Validation (pvf, 7.3.0-rc5 + series, MI50/Razer Core X on TB3,
svmhog2 holding ~2GB managed ranges + queues):
slot power off -> finishing device -> SIGBUS to workload
~8s later: workload dead (core dumped), ttm finalized,
pci bus released - removal complete
~60s later: slot re-powered, MI50 re-enumerated, clean re-init
ftrace confirms amdgpu_amdkfd_teardown_processes() runs from
amdgpu_device_fini_hw() before amdgpu_amdkfd_device_fini_sw().
Zero refcount warnings, zero hung tasks, host stays up.
Same repro on unpatched code wedged the box twice.
