drm/i915: Hold reference to intel_context over life of i915_request

Hold a reference to the intel_context over life of an i915_request.
Without this an i915_request can exist after the context has been
destroyed (e.g. request retired, context closed, but user space holds a
reference to the request from an out fence). In the case of GuC
submission + virtual engine, the engine that the request references is
also destroyed which can trigger bad pointer dref in fence ops (e.g.
i915_fence_get_driver_name). We could likely change
i915_fence_get_driver_name to avoid touching the engine but let's just
be safe and hold the intel_context reference.

v2:
 (John Harrison)
  - Update comment explaining how GuC mode and execlists mode deal with
    virtual engines differently

Signed-off-by: Matthew Brost <matthew.brost@intel.com>
Reviewed-by: John Harrison <John.C.Harrison@Intel.com>
Signed-off-by: John Harrison <John.C.Harrison@Intel.com>
Link: https://patchwork.freedesktop.org/patch/msgid/20210727002348.97202-4-matthew.brost@intel.com

diff --git a/drivers/gpu/drm/i915/i915_request.c b/drivers/gpu/drm/i915/i915_request.c
index 39a21d96577e83bcd27344f24ec7d5cf737fd08e..57c9187aff74c2528de0ecc5491e807052e9ee1b 100644 (file)
--- a/drivers/gpu/drm/i915/i915_request.c
+++ b/drivers/gpu/drm/i915/i915_request.c
@@ -125,39 +125,17 @@ static void i915_fence_release(struct dma_fence *fence)
        i915_sw_fence_fini(&rq->semaphore);
 
        /*
-        * Keep one request on each engine for reserved use under mempressure
-        *
-        * We do not hold a reference to the engine here and so have to be
-        * very careful in what rq->engine we poke. The virtual engine is
-        * referenced via the rq->context and we released that ref during
-        * i915_request_retire(), ergo we must not dereference a virtual
-        * engine here. Not that we would want to, as the only consumer of
-        * the reserved engine->request_pool is the power management parking,
-        * which must-not-fail, and that is only run on the physical engines.
-        *
-        * Since the request must have been executed to be have completed,
-        * we know that it will have been processed by the HW and will
-        * not be unsubmitted again, so rq->engine and rq->execution_mask
-        * at this point is stable. rq->execution_mask will be a single
-        * bit if the last and _only_ engine it could execution on was a
-        * physical engine, if it's multiple bits then it started on and
-        * could still be on a virtual engine. Thus if the mask is not a
-        * power-of-two we assume that rq->engine may still be a virtual
-        * engine and so a dangling invalid pointer that we cannot dereference
-        *
-        * For example, consider the flow of a bonded request through a virtual
-        * engine. The request is created with a wide engine mask (all engines
-        * that we might execute on). On processing the bond, the request mask
-        * is reduced to one or more engines. If the request is subsequently
-        * bound to a single engine, it will then be constrained to only
-        * execute on that engine and never returned to the virtual engine
-        * after timeslicing away, see __unwind_incomplete_requests(). Thus we
-        * know that if the rq->execution_mask is a single bit, rq->engine
-        * can be a physical engine with the exact corresponding mask.
+        * Keep one request on each engine for reserved use under mempressure,
+        * do not use with virtual engines as this really is only needed for
+        * kernel contexts.
         */
-       if (is_power_of_2(rq->execution_mask) &&
-           !cmpxchg(&rq->engine->request_pool, NULL, rq))
+       if (!intel_engine_is_virtual(rq->engine) &&
+           !cmpxchg(&rq->engine->request_pool, NULL, rq)) {
+               intel_context_put(rq->context);
                return;
+       }
+
+       intel_context_put(rq->context);
 
        kmem_cache_free(global.slab_requests, rq);
 }
@@ -956,7 +934,19 @@ __i915_request_create(struct intel_context *ce, gfp_t gfp)
                }
        }
 
-       rq->context = ce;
+       /*
+        * Hold a reference to the intel_context over life of an i915_request.
+        * Without this an i915_request can exist after the context has been
+        * destroyed (e.g. request retired, context closed, but user space holds
+        * a reference to the request from an out fence). In the case of GuC
+        * submission + virtual engine, the engine that the request references
+        * is also destroyed which can trigger bad pointer dref in fence ops
+        * (e.g. i915_fence_get_driver_name). We could likely change these
+        * functions to avoid touching the engine but let's just be safe and
+        * hold the intel_context reference. In execlist mode the request always
+        * eventually points to a physical engine so this isn't an issue.
+        */
+       rq->context = intel_context_get(ce);
        rq->engine = ce->engine;
        rq->ring = ce->ring;
        rq->execution_mask = ce->engine->mask;
@@ -1033,6 +1023,7 @@ err_unwind:
        GEM_BUG_ON(!list_empty(&rq->sched.waiters_list));
 
 err_free:
+       intel_context_put(ce);
        kmem_cache_free(global.slab_requests, rq);
 err_unreserve:
        intel_context_unpin(ce);