Commit bd0b8e9f authored by Rob Clark's avatar Rob Clark
Browse files

drm/msm: Drop submit bo_list 



This was only used to detect userspace including the same bo multiple
times in a submit.  But ww_mutex can already tell us this.

When we drop struct_mutex around the submit ioctl, we'd otherwise need
to lock the bo before adding it to the bo_list.  But since ww_mutex can
already tell us this, it is simpler just to remove the bo_list.

Signed-off-by: default avatarRob Clark <robdclark@chromium.org>
Link: https://lore.kernel.org/r/20210728010632.2633470-11-robdclark@gmail.com


Signed-off-by: default avatarRob Clark <robdclark@chromium.org>
parent 1d8a5ca4

drivers/gpu/drm/msm/msm_gem.c

+0 −1
Original line number Diff line number Diff line
@@ -1148,7 +1148,6 @@ static int msm_gem_new_impl(struct drm_device *dev, 
	msm_obj->flags = flags;

	msm_obj->madv = MSM_MADV_WILLNEED;



	INIT_LIST_HEAD(&msm_obj->submit_entry);

	INIT_LIST_HEAD(&msm_obj->vmas);



	*obj = &msm_obj->base;

drivers/gpu/drm/msm/msm_gem.h

+0 −8
Original line number Diff line number Diff line
@@ -88,13 +88,6 @@ struct msm_gem_object { 
	 */

	struct list_head mm_list;



	/* Transiently in the process of submit ioctl, objects associated

	 * with the submit are on submit->bo_list.. this only lasts for

	 * the duration of the ioctl, so one bo can never be on multiple

	 * submit lists.

	 */

	struct list_head submit_entry;



	struct page **pages;

	struct sg_table *sgt;

	void *vaddr;
@@ -316,7 +309,6 @@ struct msm_gem_submit { 
	struct msm_gpu *gpu;

	struct msm_gem_address_space *aspace;

	struct list_head node;   /* node in ring submit list */

	struct list_head bo_list;

	struct ww_acquire_ctx ticket;

	uint32_t seqno;		/* Sequence number of the submit on the ring */

drivers/gpu/drm/msm/msm_gem_submit.c

+13 −15
Original line number Diff line number Diff line
@@ -63,7 +63,6 @@ static struct msm_gem_submit *submit_create(struct drm_device *dev, 
	submit->fault_dumped = false;



	INIT_LIST_HEAD(&submit->node);

	INIT_LIST_HEAD(&submit->bo_list);



	return submit;

}
@@ -143,7 +142,6 @@ static int submit_lookup_objects(struct msm_gem_submit *submit, 


	for (i = 0; i < args->nr_bos; i++) {

		struct drm_gem_object *obj;

		struct msm_gem_object *msm_obj;



		/* normally use drm_gem_object_lookup(), but for bulk lookup

		 * all under single table_lock just hit object_idr directly:
@@ -155,20 +153,9 @@ static int submit_lookup_objects(struct msm_gem_submit *submit, 
			goto out_unlock;

		}



		msm_obj = to_msm_bo(obj);



		if (!list_empty(&msm_obj->submit_entry)) {

			DRM_ERROR("handle %u at index %u already on submit list\n",

					submit->bos[i].handle, i);

			ret = -EINVAL;

			goto out_unlock;

		}



		drm_gem_object_get(obj);



		submit->bos[i].obj = msm_obj;



		list_add_tail(&msm_obj->submit_entry, &submit->bo_list);

		submit->bos[i].obj = to_msm_bo(obj);

	}



out_unlock:
@@ -299,6 +286,12 @@ static int submit_lock_objects(struct msm_gem_submit *submit) 
	return 0;



fail:

	if (ret == -EALREADY) {

		DRM_ERROR("handle %u at index %u already on submit list\n",

				submit->bos[i].handle, i);

		ret = -EINVAL;

	}



	for (; i >= 0; i--)

		submit_unlock_unpin_bo(submit, i);
@@ -315,6 +308,12 @@ static int submit_lock_objects(struct msm_gem_submit *submit) 
			slow_locked = contended;

			goto retry;

		}



		/* Not expecting -EALREADY here, if the bo was already

		 * locked, we should have gotten -EALREADY already from

		 * the dma_resv_lock_interruptable() call.

		 */

		WARN_ON_ONCE(ret == -EALREADY);

	}



	return ret;
@@ -508,7 +507,6 @@ static void submit_cleanup(struct msm_gem_submit *submit, bool error) 
	for (i = 0; i < submit->nr_bos; i++) {

		struct msm_gem_object *msm_obj = submit->bos[i].obj;

		submit_cleanup_bo(submit, i, cleanup_flags);

		list_del_init(&msm_obj->submit_entry);

		if (error)

			drm_gem_object_put(&msm_obj->base);

	}