drm/msm: Drop struct_mutex in madvise path

The obj->lock is sufficient for what we need.

This *does* have the implication that userspace can try to shoot
themselves in the foot by racing madvise(DONTNEED) with submit.  But
the result will be about the same if they did madvise(DONTNEED) before
the submit ioctl, ie. they might not get want they want if they race
with shrinker.  But iova fault handling is robust enough, so userspace
is only shooting it's own foot.

Signed-off-by: Rob Clark <robdclark@chromium.org>
Reviewed-by: Kristian H. Kristensen <hoegsberg@google.com>
Signed-off-by: Rob Clark <robdclark@chromium.org>

diff --git a/drivers/gpu/drm/msm/msm_drv.c b/drivers/gpu/drm/msm/msm_drv.c
index 49e6daf30b42bad61182ea1c58e2b3c3401b1a47..f2d58fe25497d030a4d820db76147da1c625971f 100644 (file)
--- a/drivers/gpu/drm/msm/msm_drv.c
+++ b/drivers/gpu/drm/msm/msm_drv.c
@@ -912,14 +912,9 @@ static int msm_ioctl_gem_madvise(struct drm_device *dev, void *data,
                return -EINVAL;
        }
 
-       ret = mutex_lock_interruptible(&dev->struct_mutex);
-       if (ret)
-               return ret;
-
        obj = drm_gem_object_lookup(file, args->handle);
        if (!obj) {
-               ret = -ENOENT;
-               goto unlock;
+               return -ENOENT;
        }
 
        ret = msm_gem_madvise(obj, args->madv);
@@ -928,10 +923,8 @@ static int msm_ioctl_gem_madvise(struct drm_device *dev, void *data,
                ret = 0;
        }
 
-       drm_gem_object_put_locked(obj);
+       drm_gem_object_put(obj);
 
-unlock:
-       mutex_unlock(&dev->struct_mutex);
        return ret;
 }
 

diff --git a/drivers/gpu/drm/msm/msm_gem.c b/drivers/gpu/drm/msm/msm_gem.c
index f12c0cb97171c020efd5b1d32fd7139a74a7e524..81b47c1b60dccf413de1520910c1e56d98e1ffae 100644 (file)
--- a/drivers/gpu/drm/msm/msm_gem.c
+++ b/drivers/gpu/drm/msm/msm_gem.c
@@ -672,8 +672,6 @@ int msm_gem_madvise(struct drm_gem_object *obj, unsigned madv)
 
        msm_gem_lock(obj);
 
-       WARN_ON(!mutex_is_locked(&obj->dev->struct_mutex));
-
        if (msm_obj->madv != __MSM_MADV_PURGED)
                msm_obj->madv = madv;
 
@@ -690,7 +688,6 @@ void msm_gem_purge(struct drm_gem_object *obj)
        struct msm_gem_object *msm_obj = to_msm_bo(obj);
 
        WARN_ON(!mutex_is_locked(&dev->struct_mutex));
-       WARN_ON(!msm_gem_is_locked(obj));
        WARN_ON(!is_purgeable(msm_obj));
        WARN_ON(obj->import_attach);
 
@@ -770,6 +767,7 @@ void msm_gem_active_get(struct drm_gem_object *obj, struct msm_gpu *gpu)
        struct msm_drm_private *priv = obj->dev->dev_private;
 
        might_sleep();
+       WARN_ON(!msm_gem_is_locked(obj));
        WARN_ON(msm_obj->madv != MSM_MADV_WILLNEED);
 
        if (!atomic_fetch_inc(&msm_obj->active_count)) {

diff --git a/drivers/gpu/drm/msm/msm_gem.h b/drivers/gpu/drm/msm/msm_gem.h
index ffa2130ee97d19c30d386d31484d8e65d6a25bfa..d79e7019cc885e2a1909f1f61b4d8910c72c0a3d 100644 (file)
--- a/drivers/gpu/drm/msm/msm_gem.h
+++ b/drivers/gpu/drm/msm/msm_gem.h
@@ -190,8 +190,6 @@ static inline bool is_active(struct msm_gem_object *msm_obj)
 
 static inline bool is_purgeable(struct msm_gem_object *msm_obj)
 {
-       WARN_ON(!msm_gem_is_locked(&msm_obj->base));
-       WARN_ON(!mutex_is_locked(&msm_obj->base.dev->struct_mutex));
        return (msm_obj->madv == MSM_MADV_DONTNEED) && msm_obj->sgt &&
                        !msm_obj->base.dma_buf && !msm_obj->base.import_attach;
 }