From patchwork Thu Oct 30 18:41:17 2014 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: John Harrison X-Patchwork-Id: 5199851 Return-Path: X-Original-To: patchwork-intel-gfx@patchwork.kernel.org Delivered-To: patchwork-parsemail@patchwork2.web.kernel.org Received: from mail.kernel.org (mail.kernel.org [198.145.19.201]) by patchwork2.web.kernel.org (Postfix) with ESMTP id 95FFDC11AD for ; Thu, 30 Oct 2014 18:42:04 +0000 (UTC) Received: from mail.kernel.org (localhost [127.0.0.1]) by mail.kernel.org (Postfix) with ESMTP id BA4D72021B for ; Thu, 30 Oct 2014 18:42:03 +0000 (UTC) Received: from gabe.freedesktop.org (gabe.freedesktop.org [131.252.210.177]) by mail.kernel.org (Postfix) with ESMTP id 77C452022D for ; Thu, 30 Oct 2014 18:42:02 +0000 (UTC) Received: from gabe.freedesktop.org (localhost [127.0.0.1]) by gabe.freedesktop.org (Postfix) with ESMTP id 609DC6E5C9; Thu, 30 Oct 2014 11:42:01 -0700 (PDT) X-Original-To: Intel-GFX@lists.freedesktop.org Delivered-To: Intel-GFX@lists.freedesktop.org Received: from mga01.intel.com (mga01.intel.com [192.55.52.88]) by gabe.freedesktop.org (Postfix) with ESMTP id 18A7C6E55C for ; Thu, 30 Oct 2014 11:41:54 -0700 (PDT) Received: from fmsmga002.fm.intel.com ([10.253.24.26]) by fmsmga101.fm.intel.com with ESMTP; 30 Oct 2014 11:41:53 -0700 X-ExtLoop1: 1 X-IronPort-AV: E=Sophos;i="5.07,287,1413270000"; d="scan'208";a="623664510" Received: from johnharr-linux.isw.intel.com ([10.102.226.51]) by fmsmga002.fm.intel.com with ESMTP; 30 Oct 2014 11:41:52 -0700 From: John.C.Harrison@Intel.com To: Intel-GFX@Lists.FreeDesktop.Org Date: Thu, 30 Oct 2014 18:41:17 +0000 Message-Id: <1414694481-15724-26-git-send-email-John.C.Harrison@Intel.com> X-Mailer: git-send-email 1.7.9.5 In-Reply-To: <1414694481-15724-1-git-send-email-John.C.Harrison@Intel.com> References: <1414694481-15724-1-git-send-email-John.C.Harrison@Intel.com> Organization: Intel Corporation (UK) Ltd. - Co. Reg. #1134945 - Pipers Way, Swindon SN3 1RJ Subject: [Intel-gfx] [PATCH 25/29] drm/i915: Spinlock protection for request list X-BeenThere: intel-gfx@lists.freedesktop.org X-Mailman-Version: 2.1.18 Precedence: list List-Id: Intel graphics driver community testing & development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , MIME-Version: 1.0 Errors-To: intel-gfx-bounces@lists.freedesktop.org Sender: "Intel-gfx" X-Spam-Status: No, score=-4.8 required=5.0 tests=BAYES_00, RCVD_IN_DNSWL_MED, RP_MATCHES_RCVD, UNPARSEABLE_RELAY autolearn=unavailable version=3.3.1 X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on mail.kernel.org X-Virus-Scanned: ClamAV using ClamSMTP From: John Harrison The completion status for all entries in the request list is updated on demand. This occurs whenever the code queries the completion status of a given request and a new seqno value has popped out of the hardware. Unfortuntately, not all such queries are done with the driver mutex lock held. Therefore there is a race condition between the query processing and the retired request removal code which can result in a dodgy pointer dereference. The solution is to spinlock around those two points - the actual list entry removal and the potentially asynchronous query. This ensures that the query will never see a node that is in the process of being destroyed. For: VIZ-4377 Signed-off-by: John Harrison --- drivers/gpu/drm/i915/i915_gem.c | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/drivers/gpu/drm/i915/i915_gem.c b/drivers/gpu/drm/i915/i915_gem.c index 035735a..c4facbd 100644 --- a/drivers/gpu/drm/i915/i915_gem.c +++ b/drivers/gpu/drm/i915/i915_gem.c @@ -2491,7 +2491,12 @@ static void i915_set_reset_status(struct drm_i915_private *dev_priv, static void i915_gem_free_request(struct drm_i915_gem_request *request) { + unsigned long flags; + + spin_lock_irqsave(&request->ring->reqlist_lock, flags); list_del(&request->list); + spin_unlock_irqrestore(&request->ring->reqlist_lock, flags); + i915_gem_request_remove_from_client(request); i915_gem_request_unreference(request); @@ -2647,12 +2652,14 @@ void i915_gem_complete_requests_ring(struct intel_engine_cs *ring, bool lazy_coherency) { struct drm_i915_gem_request *req; + unsigned long flags; u32 seqno; seqno = ring->get_seqno(ring, lazy_coherency); if (seqno == ring->last_read_seqno) return; + spin_lock_irqsave(&ring->reqlist_lock, flags); list_for_each_entry(req, &ring->request_list, list) { if (req->complete) continue; @@ -2660,6 +2667,7 @@ void i915_gem_complete_requests_ring(struct intel_engine_cs *ring, if (i915_seqno_passed(seqno, req->seqno)) req->complete = true; } + spin_unlock_irqrestore(&ring->reqlist_lock, flags); ring->last_read_seqno = seqno; }