drm/msm: Drop submit bo_list

This was only used to detect userspace including the same bo multiple
times in a submit.  But ww_mutex can already tell us this.

When we drop struct_mutex around the submit ioctl, we'd otherwise need
to lock the bo before adding it to the bo_list.  But since ww_mutex can
already tell us this, it is simpler just to remove the bo_list.

Signed-off-by: Rob Clark <robdclark@chromium.org>
Link: https://lore.kernel.org/r/20210728010632.2633470-11-robdclark@gmail.com
Signed-off-by: Rob Clark <robdclark@chromium.org>

diff --git a/drivers/gpu/drm/msm/msm_gem.c b/drivers/gpu/drm/msm/msm_gem.c
index 3ab5c86..cfcca39 100644 (file)
--- a/drivers/gpu/drm/msm/msm_gem.c
+++ b/drivers/gpu/drm/msm/msm_gem.c
@@ -1148,7 +1148,6 @@ static int msm_gem_new_impl(struct drm_device *dev,
        msm_obj->flags = flags;
        msm_obj->madv = MSM_MADV_WILLNEED;
 
-       INIT_LIST_HEAD(&msm_obj->submit_entry);
        INIT_LIST_HEAD(&msm_obj->vmas);
 
        *obj = &msm_obj->base;

diff --git a/drivers/gpu/drm/msm/msm_gem.h b/drivers/gpu/drm/msm/msm_gem.h
index a481140..f9e3ffb 100644 (file)
--- a/drivers/gpu/drm/msm/msm_gem.h
+++ b/drivers/gpu/drm/msm/msm_gem.h
@@ -88,13 +88,6 @@ struct msm_gem_object {
         */
        struct list_head mm_list;
 
-       /* Transiently in the process of submit ioctl, objects associated
-        * with the submit are on submit->bo_list.. this only lasts for
-        * the duration of the ioctl, so one bo can never be on multiple
-        * submit lists.
-        */
-       struct list_head submit_entry;
-
        struct page **pages;
        struct sg_table *sgt;
        void *vaddr;
@@ -316,7 +309,6 @@ struct msm_gem_submit {
        struct msm_gpu *gpu;
        struct msm_gem_address_space *aspace;
        struct list_head node;   /* node in ring submit list */
-       struct list_head bo_list;
        struct ww_acquire_ctx ticket;
        uint32_t seqno;         /* Sequence number of the submit on the ring */
 

diff --git a/drivers/gpu/drm/msm/msm_gem_submit.c b/drivers/gpu/drm/msm/msm_gem_submit.c
index 2b15843..e11e4bb 100644 (file)
--- a/drivers/gpu/drm/msm/msm_gem_submit.c
+++ b/drivers/gpu/drm/msm/msm_gem_submit.c
@@ -63,7 +63,6 @@ static struct msm_gem_submit *submit_create(struct drm_device *dev,
        submit->fault_dumped = false;
 
        INIT_LIST_HEAD(&submit->node);
-       INIT_LIST_HEAD(&submit->bo_list);
 
        return submit;
 }
@@ -143,7 +142,6 @@ static int submit_lookup_objects(struct msm_gem_submit *submit,
 
        for (i = 0; i < args->nr_bos; i++) {
                struct drm_gem_object *obj;
-               struct msm_gem_object *msm_obj;
 
                /* normally use drm_gem_object_lookup(), but for bulk lookup
                 * all under single table_lock just hit object_idr directly:
@@ -155,20 +153,9 @@ static int submit_lookup_objects(struct msm_gem_submit *submit,
                        goto out_unlock;
                }
 
-               msm_obj = to_msm_bo(obj);
-
-               if (!list_empty(&msm_obj->submit_entry)) {
-                       DRM_ERROR("handle %u at index %u already on submit list\n",
-                                       submit->bos[i].handle, i);
-                       ret = -EINVAL;
-                       goto out_unlock;
-               }
-
                drm_gem_object_get(obj);
 
-               submit->bos[i].obj = msm_obj;
-
-               list_add_tail(&msm_obj->submit_entry, &submit->bo_list);
+               submit->bos[i].obj = to_msm_bo(obj);
        }
 
 out_unlock:
@@ -299,6 +286,12 @@ retry:
        return 0;
 
 fail:
+       if (ret == -EALREADY) {
+               DRM_ERROR("handle %u at index %u already on submit list\n",
+                               submit->bos[i].handle, i);
+               ret = -EINVAL;
+       }
+
        for (; i >= 0; i--)
                submit_unlock_unpin_bo(submit, i);
 
@@ -315,6 +308,12 @@ fail:
                        slow_locked = contended;
                        goto retry;
                }
+
+               /* Not expecting -EALREADY here, if the bo was already
+                * locked, we should have gotten -EALREADY already from
+                * the dma_resv_lock_interruptable() call.
+                */
+               WARN_ON_ONCE(ret == -EALREADY);
        }
 
        return ret;
@@ -508,7 +507,6 @@ static void submit_cleanup(struct msm_gem_submit *submit, bool error)
        for (i = 0; i < submit->nr_bos; i++) {
                struct msm_gem_object *msm_obj = submit->bos[i].obj;
                submit_cleanup_bo(submit, i, cleanup_flags);
-               list_del_init(&msm_obj->submit_entry);
                if (error)
                        drm_gem_object_put(&msm_obj->base);
        }