drm/i915: Lock the gem_context->active_list while dropping the link

On unpinning the intel_context, we remove it from the active list
inside the GEM context. This list is supposed to be guarded by the GEM
context mutex, so remember to take it!

Fixes: 7e3d9a59410d ("drm/i915: Track active engines within a context")
Signed-off-by: Chris Wilson <chris@chris-wilson.co.uk>
Reviewed-by: Tvrtko Ursulin <tvrtko.ursulin@intel.com>
Link: https://patchwork.freedesktop.org/patch/msgid/20190318212347.30146-1-chris@chris-wilson.co.uk

diff --git a/drivers/gpu/drm/i915/intel_context.c b/drivers/gpu/drm/i915/intel_context.c
index 5a16c9bb27780e17639c9f88385e98695c932342..0ab894a058f6eeae445df648b5574c77909a8453 100644 (file)
--- a/drivers/gpu/drm/i915/intel_context.c
+++ b/drivers/gpu/drm/i915/intel_context.c
@@ -165,13 +165,13 @@ intel_context_pin(struct i915_gem_context *ctx,
                if (err)
                        goto err;
 
+               i915_gem_context_get(ctx);
+               GEM_BUG_ON(ce->gem_context != ctx);
+
                mutex_lock(&ctx->mutex);
                list_add(&ce->active_link, &ctx->active_engines);
                mutex_unlock(&ctx->mutex);
 
-               i915_gem_context_get(ctx);
-               GEM_BUG_ON(ce->gem_context != ctx);
-
                smp_mb__before_atomic(); /* flush pin before it is visible */
        }
 
@@ -194,9 +194,16 @@ void intel_context_unpin(struct intel_context *ce)
        /* We may be called from inside intel_context_pin() to evict another */
        mutex_lock_nested(&ce->pin_mutex, SINGLE_DEPTH_NESTING);
 
-       if (likely(atomic_dec_and_test(&ce->pin_count)))
+       if (likely(atomic_dec_and_test(&ce->pin_count))) {
                ce->ops->unpin(ce);
 
+               mutex_lock(&ce->gem_context->mutex);
+               list_del(&ce->active_link);
+               mutex_unlock(&ce->gem_context->mutex);
+
+               i915_gem_context_put(ce->gem_context);
+       }
+
        mutex_unlock(&ce->pin_mutex);
 }
 

diff --git a/drivers/gpu/drm/i915/intel_lrc.c b/drivers/gpu/drm/i915/intel_lrc.c
index 8d1cb81ba0f52fea11a6c301b00126cfa89624f3..c949af7be8bddb40cba2bd0b6747e7baf92cb06e 100644 (file)
--- a/drivers/gpu/drm/i915/intel_lrc.c
+++ b/drivers/gpu/drm/i915/intel_lrc.c
@@ -1277,9 +1277,6 @@ static void execlists_context_unpin(struct intel_context *ce)
        ce->state->obj->pin_global--;
        i915_gem_object_unpin_map(ce->state->obj);
        i915_vma_unpin(ce->state);
-
-       list_del(&ce->active_link);
-       i915_gem_context_put(ce->gem_context);
 }
 
 static int __context_pin(struct i915_vma *vma)

diff --git a/drivers/gpu/drm/i915/intel_ringbuffer.c b/drivers/gpu/drm/i915/intel_ringbuffer.c
index 5137f014066424805fe0f63242967616270758c0..81b32bac2bcdf6de595e14656e639f9f7334afc9 100644 (file)
--- a/drivers/gpu/drm/i915/intel_ringbuffer.c
+++ b/drivers/gpu/drm/i915/intel_ringbuffer.c
@@ -1430,9 +1430,6 @@ static void ring_context_unpin(struct intel_context *ce)
 {
        __context_unpin_ppgtt(ce->gem_context);
        __context_unpin(ce);
-
-       list_del(&ce->active_link);
-       i915_gem_context_put(ce->gem_context);
 }
 
 static struct i915_vma *

diff --git a/drivers/gpu/drm/i915/selftests/mock_engine.c b/drivers/gpu/drm/i915/selftests/mock_engine.c
index 881450c694e94c7630ca444a311037faabcc52e7..7641b74ada98c4cfe858c1c6eb6c5ec6ef702e1a 100644 (file)
--- a/drivers/gpu/drm/i915/selftests/mock_engine.c
+++ b/drivers/gpu/drm/i915/selftests/mock_engine.c
@@ -126,8 +126,6 @@ static void hw_delay_complete(struct timer_list *t)
 static void mock_context_unpin(struct intel_context *ce)
 {
        mock_timeline_unpin(ce->ring->timeline);
-       list_del(&ce->active_link);
-       i915_gem_context_put(ce->gem_context);
 }
 
 static void mock_context_destroy(struct intel_context *ce)