drm/i915: Hold reference to intel_context over life of i915_request

	i915_sw_fence_fini(&rq->semaphore);

	/*

	 * Keep one request on each engine for reserved use under mempressure

	 *

	 * We do not hold a reference to the engine here and so have to be

	 * very careful in what rq->engine we poke. The virtual engine is

	 * referenced via the rq->context and we released that ref during

	 * i915_request_retire(), ergo we must not dereference a virtual

	 * engine here. Not that we would want to, as the only consumer of

	 * the reserved engine->request_pool is the power management parking,

	 * which must-not-fail, and that is only run on the physical engines.

	 *

	 * Since the request must have been executed to be have completed,

	 * we know that it will have been processed by the HW and will

	 * not be unsubmitted again, so rq->engine and rq->execution_mask

	 * at this point is stable. rq->execution_mask will be a single

	 * bit if the last and _only_ engine it could execution on was a

	 * physical engine, if it's multiple bits then it started on and

	 * could still be on a virtual engine. Thus if the mask is not a

	 * power-of-two we assume that rq->engine may still be a virtual

	 * engine and so a dangling invalid pointer that we cannot dereference

	 *

	 * For example, consider the flow of a bonded request through a virtual

	 * engine. The request is created with a wide engine mask (all engines

	 * that we might execute on). On processing the bond, the request mask

	 * is reduced to one or more engines. If the request is subsequently

	 * bound to a single engine, it will then be constrained to only

	 * execute on that engine and never returned to the virtual engine

	 * after timeslicing away, see __unwind_incomplete_requests(). Thus we

	 * know that if the rq->execution_mask is a single bit, rq->engine

	 * can be a physical engine with the exact corresponding mask.

	 * Keep one request on each engine for reserved use under mempressure,

	 * do not use with virtual engines as this really is only needed for

	 * kernel contexts.

	 */

	if (is_power_of_2(rq->execution_mask) &&

	    !cmpxchg(&rq->engine->request_pool, NULL, rq))

	if (!intel_engine_is_virtual(rq->engine) &&

	    !cmpxchg(&rq->engine->request_pool, NULL, rq)) {

		intel_context_put(rq->context);

		return;

	}

	intel_context_put(rq->context);

	kmem_cache_free(global.slab_requests, rq);

}

		}

	}

	rq->context = ce;

	/*

	 * Hold a reference to the intel_context over life of an i915_request.

	 * Without this an i915_request can exist after the context has been

	 * destroyed (e.g. request retired, context closed, but user space holds

	 * a reference to the request from an out fence). In the case of GuC

	 * submission + virtual engine, the engine that the request references

	 * is also destroyed which can trigger bad pointer dref in fence ops

	 * (e.g. i915_fence_get_driver_name). We could likely change these

	 * functions to avoid touching the engine but let's just be safe and

	 * hold the intel_context reference. In execlist mode the request always

	 * eventually points to a physical engine so this isn't an issue.

	 */

	rq->context = intel_context_get(ce);

	rq->engine = ce->engine;

	rq->ring = ce->ring;

	rq->execution_mask = ce->engine->mask;

	GEM_BUG_ON(!list_empty(&rq->sched.waiters_list));

err_free:

	intel_context_put(ce);

	kmem_cache_free(global.slab_requests, rq);

err_unreserve:

	intel_context_unpin(ce);