From patchwork Mon Nov 24 18:49:46 2014 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: John Harrison X-Patchwork-Id: 5369181 Return-Path: X-Original-To: patchwork-intel-gfx@patchwork.kernel.org Delivered-To: patchwork-parsemail@patchwork2.web.kernel.org Received: from mail.kernel.org (mail.kernel.org [198.145.19.201]) by patchwork2.web.kernel.org (Postfix) with ESMTP id 914F9C11AC for ; Mon, 24 Nov 2014 18:50:39 +0000 (UTC) Received: from mail.kernel.org (localhost [127.0.0.1]) by mail.kernel.org (Postfix) with ESMTP id A9AEB20480 for ; Mon, 24 Nov 2014 18:50:38 +0000 (UTC) Received: from gabe.freedesktop.org (gabe.freedesktop.org [131.252.210.177]) by mail.kernel.org (Postfix) with ESMTP id A7A3220490 for ; Mon, 24 Nov 2014 18:50:37 +0000 (UTC) Received: from gabe.freedesktop.org (localhost [127.0.0.1]) by gabe.freedesktop.org (Postfix) with ESMTP id 5D7C56EE46; Mon, 24 Nov 2014 10:50:36 -0800 (PST) X-Original-To: Intel-GFX@lists.freedesktop.org Delivered-To: Intel-GFX@lists.freedesktop.org Received: from mga09.intel.com (mga09.intel.com [134.134.136.24]) by gabe.freedesktop.org (Postfix) with ESMTP id D943A6EE26 for ; Mon, 24 Nov 2014 10:50:28 -0800 (PST) Received: from orsmga002.jf.intel.com ([10.7.209.21]) by orsmga102.jf.intel.com with ESMTP; 24 Nov 2014 10:48:03 -0800 X-ExtLoop1: 1 X-IronPort-AV: E=Sophos;i="5.07,450,1413270000"; d="scan'208";a="642747928" Received: from johnharr-linux.isw.intel.com ([10.102.226.51]) by orsmga002.jf.intel.com with ESMTP; 24 Nov 2014 10:50:24 -0800 From: John.C.Harrison@Intel.com To: Intel-GFX@Lists.FreeDesktop.Org Date: Mon, 24 Nov 2014 18:49:46 +0000 Message-Id: <1416854990-1920-25-git-send-email-John.C.Harrison@Intel.com> X-Mailer: git-send-email 1.7.9.5 In-Reply-To: <1416854990-1920-1-git-send-email-John.C.Harrison@Intel.com> References: <1416854990-1920-1-git-send-email-John.C.Harrison@Intel.com> Organization: Intel Corporation (UK) Ltd. - Co. Reg. #1134945 - Pipers Way, Swindon SN3 1RJ Subject: [Intel-gfx] [PATCH v3 24/28] drm/i915: Spinlock protection for request list X-BeenThere: intel-gfx@lists.freedesktop.org X-Mailman-Version: 2.1.18 Precedence: list List-Id: Intel graphics driver community testing & development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , MIME-Version: 1.0 Errors-To: intel-gfx-bounces@lists.freedesktop.org Sender: "Intel-gfx" X-Spam-Status: No, score=-4.2 required=5.0 tests=BAYES_00, RCVD_IN_DNSWL_MED, T_RP_MATCHES_RCVD, UNPARSEABLE_RELAY autolearn=unavailable version=3.3.1 X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on mail.kernel.org X-Virus-Scanned: ClamAV using ClamSMTP From: John Harrison The completion status for all entries in the request list is updated on demand. This occurs whenever the code queries the completion status of a given request and a new seqno value has popped out of the hardware. Unfortuntately, not all such queries are done with the driver mutex lock held. Therefore there is a race condition between the query processing and the retired request removal code which can result in a dodgy pointer dereference. The solution is to spinlock around those two points - the actual list entry removal and the potentially asynchronous query. This ensures that the query will never see a node that is in the process of being destroyed. For: VIZ-4377 Signed-off-by: John Harrison Reviewed-by: Thomas Daniel --- drivers/gpu/drm/i915/i915_gem.c | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/drivers/gpu/drm/i915/i915_gem.c b/drivers/gpu/drm/i915/i915_gem.c index ce316fa..71fcbea 100644 --- a/drivers/gpu/drm/i915/i915_gem.c +++ b/drivers/gpu/drm/i915/i915_gem.c @@ -2569,7 +2569,12 @@ static void i915_set_reset_status(struct drm_i915_private *dev_priv, static void i915_gem_free_request(struct drm_i915_gem_request *request) { + unsigned long flags; + + spin_lock_irqsave(&request->ring->reqlist_lock, flags); list_del(&request->list); + spin_unlock_irqrestore(&request->ring->reqlist_lock, flags); + i915_gem_request_remove_from_client(request); i915_gem_request_unreference(request); @@ -2740,6 +2745,7 @@ void i915_gem_complete_requests_ring(struct intel_engine_cs *ring, bool lazy_coherency) { struct drm_i915_gem_request *req; + unsigned long flags; u32 seqno; seqno = ring->get_seqno(ring, lazy_coherency); @@ -2749,6 +2755,7 @@ void i915_gem_complete_requests_ring(struct intel_engine_cs *ring, if (seqno == ring->last_read_seqno) return; + spin_lock_irqsave(&ring->reqlist_lock, flags); list_for_each_entry(req, &ring->request_list, list) { if (req->complete) continue; @@ -2756,6 +2763,7 @@ void i915_gem_complete_requests_ring(struct intel_engine_cs *ring, if (i915_seqno_passed(seqno, req->seqno)) req->complete = true; } + spin_unlock_irqrestore(&ring->reqlist_lock, flags); ring->last_read_seqno = seqno; }