drm/nouveau/fence: fix a race where fence->channel can disappear

Signed-off-by: Ben Skeggs <bskeggs@redhat.com>

6 files changed, 26 insertions, 15 deletions

diff --git a/drivers/gpu/drm/nouveau/nouveau_fence.c b/drivers/gpu/drm/nouveau/nouveau_fence.c
index 4ba41a45114f..3c180493dab8 100644
--- a/drivers/gpu/drm/nouveau/nouveau_fence.c
+++ b/drivers/gpu/drm/nouveau/nouveau_fence.c
@@ -147,15 +147,19 @@ nouveau_fence_wait(struct nouveau_fence *fence, bool lazy, bool intr)
 int
 nouveau_fence_sync(struct nouveau_fence *fence, struct nouveau_channel *chan)
 {
-        struct nouveau_channel *prev = fence ? fence->channel : NULL;
         struct drm_device *dev = chan->dev;
         struct nouveau_fence_priv *priv = nv_engine(dev, NVOBJ_ENGINE_FENCE);
+        struct nouveau_channel *prev;
         int ret = 0;
 
-        if (unlikely(prev && prev != chan && !nouveau_fence_done(fence))) {
-                ret = priv->sync(fence, chan);
-                if (unlikely(ret))
-                        ret = nouveau_fence_wait(fence, true, false);
+        prev = fence ? nouveau_channel_get_unlocked(fence->channel) : NULL;
+        if (prev) {
+                if (unlikely(prev != chan && !nouveau_fence_done(fence))) {
+                        ret = priv->sync(fence, prev, chan);
+                        if (unlikely(ret))
+                                ret = nouveau_fence_wait(fence, true, false);
+                }
+                nouveau_channel_put_unlocked(&prev);
         }
 
         return ret;
diff --git a/drivers/gpu/drm/nouveau/nouveau_fence.h b/drivers/gpu/drm/nouveau/nouveau_fence.h
index ec9afa775ea7..82ba733393ae 100644
--- a/drivers/gpu/drm/nouveau/nouveau_fence.h
+++ b/drivers/gpu/drm/nouveau/nouveau_fence.h
@@ -34,7 +34,8 @@ struct nouveau_fence_chan {
 struct nouveau_fence_priv {
         struct nouveau_exec_engine engine;
         int (*emit)(struct nouveau_fence *);
-        int (*sync)(struct nouveau_fence *, struct nouveau_channel *);
+        int (*sync)(struct nouveau_fence *, struct nouveau_channel *,
+                    struct nouveau_channel *);
         u32 (*read)(struct nouveau_channel *);
 };
 
diff --git a/drivers/gpu/drm/nouveau/nv04_fence.c b/drivers/gpu/drm/nouveau/nv04_fence.c
index 08bd2ceaefef..abe89db6de24 100644
--- a/drivers/gpu/drm/nouveau/nv04_fence.c
+++ b/drivers/gpu/drm/nouveau/nv04_fence.c
@@ -51,7 +51,8 @@ nv04_fence_emit(struct nouveau_fence *fence)
 }
 
 static int
-nv04_fence_sync(struct nouveau_fence *fence, struct nouveau_channel *chan)
+nv04_fence_sync(struct nouveau_fence *fence,
+                struct nouveau_channel *prev, struct nouveau_channel *chan)
 {
         return -ENODEV;
 }
diff --git a/drivers/gpu/drm/nouveau/nv10_fence.c b/drivers/gpu/drm/nouveau/nv10_fence.c
index 10831eaff958..8a1b75009185 100644
--- a/drivers/gpu/drm/nouveau/nv10_fence.c
+++ b/drivers/gpu/drm/nouveau/nv10_fence.c
@@ -52,17 +52,19 @@ nv10_fence_emit(struct nouveau_fence *fence)
         return ret;
 }
 
+
 static int
-nv10_fence_sync(struct nouveau_fence *fence, struct nouveau_channel *chan)
+nv10_fence_sync(struct nouveau_fence *fence,
+                struct nouveau_channel *prev, struct nouveau_channel *chan)
 {
         return -ENODEV;
 }
 
 static int
-nv17_fence_sync(struct nouveau_fence *fence, struct nouveau_channel *chan)
+nv17_fence_sync(struct nouveau_fence *fence,
+                struct nouveau_channel *prev, struct nouveau_channel *chan)
 {
         struct nv10_fence_priv *priv = nv_engine(chan->dev, NVOBJ_ENGINE_FENCE);
-        struct nouveau_channel *prev = fence->channel;
         u32 value;
         int ret;
 
diff --git a/drivers/gpu/drm/nouveau/nv84_fence.c b/drivers/gpu/drm/nouveau/nv84_fence.c
index d23dbc06f436..0ac98c0efc71 100644
--- a/drivers/gpu/drm/nouveau/nv84_fence.c
+++ b/drivers/gpu/drm/nouveau/nv84_fence.c
@@ -55,16 +55,18 @@ nv84_fence_emit(struct nouveau_fence *fence)
         return ret;
 }
 
+
 static int
-nv84_fence_sync(struct nouveau_fence *fence, struct nouveau_channel *chan)
+nv84_fence_sync(struct nouveau_fence *fence,
+                struct nouveau_channel *prev, struct nouveau_channel *chan)
 {
         int ret = RING_SPACE(chan, 7);
         if (ret == 0) {
                 BEGIN_NV04(chan, 0, NV11_SUBCHAN_DMA_SEMAPHORE, 1);
                 OUT_RING  (chan, NvSema);
                 BEGIN_NV04(chan, 0, NV84_SUBCHAN_SEMAPHORE_ADDRESS_HIGH, 4);
-                OUT_RING  (chan, upper_32_bits(fence->channel->id * 16));
-                OUT_RING  (chan, lower_32_bits(fence->channel->id * 16));
+                OUT_RING  (chan, upper_32_bits(prev->id * 16));
+                OUT_RING  (chan, lower_32_bits(prev->id * 16));
                 OUT_RING  (chan, fence->sequence);
                 OUT_RING  (chan, NV84_SUBCHAN_SEMAPHORE_TRIGGER_ACQUIRE_GEQUAL);
                 FIRE_RING (chan);
diff --git a/drivers/gpu/drm/nouveau/nvc0_fence.c b/drivers/gpu/drm/nouveau/nvc0_fence.c
index 41545f15c4d0..817228cd1a95 100644
--- a/drivers/gpu/drm/nouveau/nvc0_fence.c
+++ b/drivers/gpu/drm/nouveau/nvc0_fence.c
@@ -60,10 +60,11 @@ nvc0_fence_emit(struct nouveau_fence *fence)
 }
 
 static int
-nvc0_fence_sync(struct nouveau_fence *fence, struct nouveau_channel *chan)
+nvc0_fence_sync(struct nouveau_fence *fence,
+                struct nouveau_channel *prev, struct nouveau_channel *chan)
 {
         struct nvc0_fence_chan *fctx = chan->engctx[NVOBJ_ENGINE_FENCE];
-        u64 addr = fctx->vma.offset + fence->channel->id * 16;
+        u64 addr = fctx->vma.offset + prev->id * 16;
         int ret;
 
         ret = RING_SPACE(chan, 5);