drm/nouveau: Refactor context destruction to avoid a lock ordering issue.

The destroy_context() engine hooks call gpuobj management functions to
release the channel resources, these functions use HARDIRQ-unsafe locks
whereas destroy_context() is called with the HARDIRQ-safe
context_switch_lock held, that's a lock ordering violation.

Push the engine-specific channel destruction logic into destroy_context()
and let the hardware-specific code lock and unlock when it's actually
needed. Change the engine destruction order to avoid a race in the small
gap between pgraph and pfifo context uninitialization.

Reported-by: Marcin Slusarz <marcin.slusarz@gmail.com>
Signed-off-by: Francisco Jerez <currojerez@riseup.net>
Signed-off-by: Ben Skeggs <bskeggs@redhat.com>

1 files changed, 11 insertions, 0 deletions

diff --git a/drivers/gpu/drm/nouveau/nv50_graph.c b/drivers/gpu/drm/nouveau/nv50_graph.c
index 24a3f8487579..dcc9175fb794 100644
--- a/drivers/gpu/drm/nouveau/nv50_graph.c
+++ b/drivers/gpu/drm/nouveau/nv50_graph.c
@@ -242,17 +242,28 @@ nv50_graph_destroy_context(struct nouveau_channel *chan)
 {
         struct drm_device *dev = chan->dev;
         struct drm_nouveau_private *dev_priv = dev->dev_private;
+        struct nouveau_pgraph_engine *pgraph = &dev_priv->engine.graph;
         int i, hdr = (dev_priv->chipset == 0x50) ? 0x200 : 0x20;
+        unsigned long flags;
 
         NV_DEBUG(dev, "ch%d\n", chan->id);
 
         if (!chan->ramin)
                 return;
 
+        spin_lock_irqsave(&dev_priv->context_switch_lock, flags);
+        pgraph->fifo_access(dev, false);
+
+        if (pgraph->channel(dev) == chan)
+                pgraph->unload_context(dev);
+
         for (i = hdr; i < hdr + 24; i += 4)
                 nv_wo32(chan->ramin, i, 0);
         dev_priv->engine.instmem.flush(dev);
 
+        pgraph->fifo_access(dev, true);
+        spin_unlock_irqrestore(&dev_priv->context_switch_lock, flags);
+
         nouveau_gpuobj_ref(NULL, &chan->ramin_grctx);
 }