From patchwork Fri Nov 14 12:19:15 2014 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: John Harrison X-Patchwork-Id: 5305551 Return-Path: X-Original-To: patchwork-intel-gfx@patchwork.kernel.org Delivered-To: patchwork-parsemail@patchwork2.web.kernel.org Received: from mail.kernel.org (mail.kernel.org [198.145.19.201]) by patchwork2.web.kernel.org (Postfix) with ESMTP id 0C8B7C11AC for ; Fri, 14 Nov 2014 12:19:54 +0000 (UTC) Received: from mail.kernel.org (localhost [127.0.0.1]) by mail.kernel.org (Postfix) with ESMTP id 408722017D for ; Fri, 14 Nov 2014 12:19:53 +0000 (UTC) Received: from gabe.freedesktop.org (gabe.freedesktop.org [131.252.210.177]) by mail.kernel.org (Postfix) with ESMTP id 6DF9F20176 for ; Fri, 14 Nov 2014 12:19:52 +0000 (UTC) Received: from gabe.freedesktop.org (localhost [127.0.0.1]) by gabe.freedesktop.org (Postfix) with ESMTP id F23A06EDC8; Fri, 14 Nov 2014 04:19:51 -0800 (PST) X-Original-To: Intel-GFX@lists.freedesktop.org Delivered-To: Intel-GFX@lists.freedesktop.org Received: from mga02.intel.com (mga02.intel.com [134.134.136.20]) by gabe.freedesktop.org (Postfix) with ESMTP id 1F0436EDDA for ; Fri, 14 Nov 2014 04:19:48 -0800 (PST) Received: from orsmga002.jf.intel.com ([10.7.209.21]) by orsmga101.jf.intel.com with ESMTP; 14 Nov 2014 04:19:47 -0800 X-ExtLoop1: 1 X-IronPort-AV: E=Sophos;i="5.07,385,1413270000"; d="scan'208";a="636945198" Received: from johnharr-linux.isw.intel.com ([10.102.226.51]) by orsmga002.jf.intel.com with ESMTP; 14 Nov 2014 04:19:47 -0800 From: John.C.Harrison@Intel.com To: Intel-GFX@Lists.FreeDesktop.Org Date: Fri, 14 Nov 2014 12:19:15 +0000 Message-Id: <1415967559-17074-25-git-send-email-John.C.Harrison@Intel.com> X-Mailer: git-send-email 1.7.9.5 In-Reply-To: <1415967559-17074-1-git-send-email-John.C.Harrison@Intel.com> References: <1415967559-17074-1-git-send-email-John.C.Harrison@Intel.com> Organization: Intel Corporation (UK) Ltd. - Co. Reg. #1134945 - Pipers Way, Swindon SN3 1RJ Subject: [Intel-gfx] [PATCH v2 24/28] drm/i915: Spinlock protection for request list X-BeenThere: intel-gfx@lists.freedesktop.org X-Mailman-Version: 2.1.18 Precedence: list List-Id: Intel graphics driver community testing & development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , MIME-Version: 1.0 Errors-To: intel-gfx-bounces@lists.freedesktop.org Sender: "Intel-gfx" X-Spam-Status: No, score=-4.2 required=5.0 tests=BAYES_00, RCVD_IN_DNSWL_MED, T_RP_MATCHES_RCVD, UNPARSEABLE_RELAY autolearn=unavailable version=3.3.1 X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on mail.kernel.org X-Virus-Scanned: ClamAV using ClamSMTP From: John Harrison The completion status for all entries in the request list is updated on demand. This occurs whenever the code queries the completion status of a given request and a new seqno value has popped out of the hardware. Unfortuntately, not all such queries are done with the driver mutex lock held. Therefore there is a race condition between the query processing and the retired request removal code which can result in a dodgy pointer dereference. The solution is to spinlock around those two points - the actual list entry removal and the potentially asynchronous query. This ensures that the query will never see a node that is in the process of being destroyed. For: VIZ-4377 Signed-off-by: John Harrison --- drivers/gpu/drm/i915/i915_gem.c | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/drivers/gpu/drm/i915/i915_gem.c b/drivers/gpu/drm/i915/i915_gem.c index b6c75b0..edf712b 100644 --- a/drivers/gpu/drm/i915/i915_gem.c +++ b/drivers/gpu/drm/i915/i915_gem.c @@ -2573,7 +2573,12 @@ static void i915_set_reset_status(struct drm_i915_private *dev_priv, static void i915_gem_free_request(struct drm_i915_gem_request *request) { + unsigned long flags; + + spin_lock_irqsave(&request->ring->reqlist_lock, flags); list_del(&request->list); + spin_unlock_irqrestore(&request->ring->reqlist_lock, flags); + i915_gem_request_remove_from_client(request); i915_gem_request_unreference(request); @@ -2730,6 +2735,7 @@ void i915_gem_complete_requests_ring(struct intel_engine_cs *ring, bool lazy_coherency) { struct drm_i915_gem_request *req; + unsigned long flags; u32 seqno; seqno = ring->get_seqno(ring, lazy_coherency); @@ -2739,6 +2745,7 @@ void i915_gem_complete_requests_ring(struct intel_engine_cs *ring, if (seqno == ring->last_read_seqno) return; + spin_lock_irqsave(&ring->reqlist_lock, flags); list_for_each_entry(req, &ring->request_list, list) { if (req->complete) continue; @@ -2746,6 +2753,7 @@ void i915_gem_complete_requests_ring(struct intel_engine_cs *ring, if (i915_seqno_passed(seqno, req->seqno)) req->complete = true; } + spin_unlock_irqrestore(&ring->reqlist_lock, flags); ring->last_read_seqno = seqno; }