drm: qxl: Consolidate bo reservation when pinning

Every attempt to pin/unpin objects in memory requires
qxl_bo_reserve/unreserve calls around the pinning operation to protect
the object from concurrent access, which causes that call sequence to be
reproduced every place where pinning is needed.  In some cases, that
sequence was not executed correctly, resulting in potential unprotected
pinning operations.

This commit encapsulates the reservation inside a new wrapper to make
sure it is always handled properly.  In cases where reservation must be
done beforehand, for some reason, one can use the unprotected version
__qxl_bo_pin/unpin.

Signed-off-by: Gabriel Krisman Bertazi <krisman@collabora.co.uk>
Reviewed-by: Gustavo Padovan <gustavo.padovan@collabora.com>
Link: http://patchwork.freedesktop.org/patch/msgid/20170227204328.18761-3-krisman@collabora.co.uk
Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>

drivers/gpu/drm/qxl/qxl_display.c

@@ -286,11 +286,7 @@ static int qxl_crtc_page_flip(struct drm_crtc *crtc,
 	bo_old->is_primary = false;
 	bo->is_primary = true;
 
-	ret = qxl_bo_reserve(bo, false);
-	if (ret)
-		return ret;
 	ret = qxl_bo_pin(bo, bo->type, NULL);
-	qxl_bo_unreserve(bo);
 	if (ret)
 		return ret;
 
@@ -306,11 +302,7 @@ static int qxl_crtc_page_flip(struct drm_crtc *crtc,
 	}
 	drm_crtc_vblank_put(crtc);
 
-	ret = qxl_bo_reserve(bo, false);
-	if (!ret) {
-		qxl_bo_unpin(bo);
-		qxl_bo_unreserve(bo);
-	}
+	qxl_bo_unpin(bo);
 
 	return 0;
 }
@@ -417,12 +409,7 @@ static int qxl_crtc_cursor_set2(struct drm_crtc *crtc,
 
 	user_bo = gem_to_qxl_bo(obj);
 
-	ret = qxl_bo_reserve(user_bo, false);
-	if (ret)
-		goto out_unref;
-
 	ret = qxl_bo_pin(user_bo, QXL_GEM_DOMAIN_CPU, NULL);
-	qxl_bo_unreserve(user_bo);
 	if (ret)
 		goto out_unref;
 
@@ -485,11 +472,8 @@ static int qxl_crtc_cursor_set2(struct drm_crtc *crtc,
 	qxl_release_fence_buffer_objects(release);
 
 	/* finish with the userspace bo */
-	ret = qxl_bo_reserve(user_bo, false);
-	if (!ret) {
-		qxl_bo_unpin(user_bo);
-		qxl_bo_unreserve(user_bo);
-	}
+	qxl_bo_unpin(user_bo);
+
 	drm_gem_object_unreference_unlocked(obj);
 
 	qxl_bo_unref (&qcrtc->cursor_bo);
@@ -747,15 +731,10 @@ static int qxl_crtc_mode_set(struct drm_crtc *crtc,
 		return -EINVAL;
         }
 
-	ret = qxl_bo_reserve(bo, false);
-	if (ret != 0)
-		return ret;
 	ret = qxl_bo_pin(bo, bo->type, NULL);
-	if (ret != 0) {
-		qxl_bo_unreserve(bo);
+	if (ret != 0)
 		return -EINVAL;
-	}
-	qxl_bo_unreserve(bo);
+
 	if (recreate_primary) {
 		qxl_io_destroy_primary(qdev);
 		qxl_io_log(qdev,
@@ -781,9 +760,7 @@ static int qxl_crtc_mode_set(struct drm_crtc *crtc,
 
 	if (old_bo && old_bo != bo) {
 		old_bo->is_primary = false;
-		ret = qxl_bo_reserve(old_bo, false);
 		qxl_bo_unpin(old_bo);
-		qxl_bo_unreserve(old_bo);
 	}
 
 	qxl_monitors_config_set(qdev, qcrtc->index, x, y,
@@ -812,10 +789,8 @@ static void qxl_crtc_disable(struct drm_crtc *crtc)
 	if (crtc->primary->fb) {
 		struct qxl_framebuffer *qfb = to_qxl_framebuffer(crtc->primary->fb);
 		struct qxl_bo *bo = gem_to_qxl_bo(qfb->obj);
-		int ret;
-		ret = qxl_bo_reserve(bo, false);
+
 		qxl_bo_unpin(bo);
-		qxl_bo_unreserve(bo);
 		crtc->primary->fb = NULL;
 	}
 
@@ -1144,17 +1119,9 @@ int qxl_create_monitors_object(struct qxl_device *qdev)
 	}
 	qdev->monitors_config_bo = gem_to_qxl_bo(gobj);
 
-	ret = qxl_bo_reserve(qdev->monitors_config_bo, false);
-	if (ret)
-		return ret;
-
 	ret = qxl_bo_pin(qdev->monitors_config_bo, QXL_GEM_DOMAIN_VRAM, NULL);
-	if (ret) {
-		qxl_bo_unreserve(qdev->monitors_config_bo);
+	if (ret)
 		return ret;
-	}
-
-	qxl_bo_unreserve(qdev->monitors_config_bo);
 
 	qxl_bo_kmap(qdev->monitors_config_bo, NULL);
 
@@ -1175,13 +1142,10 @@ int qxl_destroy_monitors_object(struct qxl_device *qdev)
 	qdev->ram_header->monitors_config = 0;
 
 	qxl_bo_kunmap(qdev->monitors_config_bo);
-	ret = qxl_bo_reserve(qdev->monitors_config_bo, false);
+	ret = qxl_bo_unpin(qdev->monitors_config_bo);
 	if (ret)
 		return ret;
 
-	qxl_bo_unpin(qdev->monitors_config_bo);
-	qxl_bo_unreserve(qdev->monitors_config_bo);
-
 	qxl_bo_unref(&qdev->monitors_config_bo);
 	return 0;
 }

drivers/gpu/drm/qxl/qxl_fb.c

@@ -90,14 +90,10 @@ static struct fb_ops qxlfb_ops = {
 static void qxlfb_destroy_pinned_object(struct drm_gem_object *gobj)
 {
 	struct qxl_bo *qbo = gem_to_qxl_bo(gobj);
-	int ret;
 
-	ret = qxl_bo_reserve(qbo, false);
-	if (likely(ret == 0)) {
-		qxl_bo_kunmap(qbo);
-		qxl_bo_unpin(qbo);
-		qxl_bo_unreserve(qbo);
-	}
+	qxl_bo_kunmap(qbo);
+	qxl_bo_unpin(qbo);
+
 	drm_gem_object_unreference_unlocked(gobj);
 }
 
@@ -148,16 +144,13 @@ static int qxlfb_create_pinned_object(struct qxl_fbdev *qfbdev,
 	qbo->surf.height = mode_cmd->height;
 	qbo->surf.stride = mode_cmd->pitches[0];
 	qbo->surf.format = SPICE_SURFACE_FMT_32_xRGB;
-	ret = qxl_bo_reserve(qbo, false);
-	if (unlikely(ret != 0))
-		goto out_unref;
+
 	ret = qxl_bo_pin(qbo, QXL_GEM_DOMAIN_SURFACE, NULL);
 	if (ret) {
-		qxl_bo_unreserve(qbo);
 		goto out_unref;
 	}
 	ret = qxl_bo_kmap(qbo, NULL);
-	qxl_bo_unreserve(qbo); /* unreserve, will be mmaped */
+
 	if (ret)
 		goto out_unref;
 
@@ -322,12 +315,8 @@ static int qxlfb_create(struct qxl_fbdev *qfbdev,
 
 out_unref:
 	if (qbo) {
-		ret = qxl_bo_reserve(qbo, false);
-		if (likely(ret == 0)) {
-			qxl_bo_kunmap(qbo);
-			qxl_bo_unpin(qbo);
-			qxl_bo_unreserve(qbo);
-		}
+		qxl_bo_kunmap(qbo);
+		qxl_bo_unpin(qbo);
 	}
 	if (fb && ret) {
 		drm_gem_object_unreference_unlocked(gobj);

drivers/gpu/drm/qxl/qxl_object.c

@@ -221,7 +221,7 @@ struct qxl_bo *qxl_bo_ref(struct qxl_bo *bo)
 	return bo;
 }
 
-int qxl_bo_pin(struct qxl_bo *bo, u32 domain, u64 *gpu_addr)
+int __qxl_bo_pin(struct qxl_bo *bo, u32 domain, u64 *gpu_addr)
 {
 	struct drm_device *ddev = bo->gem_base.dev;
 	int r;
@@ -244,7 +244,7 @@ int qxl_bo_pin(struct qxl_bo *bo, u32 domain, u64 *gpu_addr)
 	return r;
 }
 
-int qxl_bo_unpin(struct qxl_bo *bo)
+int __qxl_bo_unpin(struct qxl_bo *bo)
 {
 	struct drm_device *ddev = bo->gem_base.dev;
 	int r, i;
@@ -264,6 +264,43 @@ int qxl_bo_unpin(struct qxl_bo *bo)
 	return r;
 }
 
+
+/*
+ * Reserve the BO before pinning the object.  If the BO was reserved
+ * beforehand, use the internal version directly __qxl_bo_pin.
+ *
+ */
+int qxl_bo_pin(struct qxl_bo *bo, u32 domain, u64 *gpu_addr)
+{
+	int r;
+
+	r = qxl_bo_reserve(bo, false);
+	if (r)
+		return r;
+
+	r = __qxl_bo_pin(bo, bo->type, NULL);
+	qxl_bo_unreserve(bo);
+	return r;
+}
+
+/*
+ * Reserve the BO before pinning the object.  If the BO was reserved
+ * beforehand, use the internal version directly __qxl_bo_unpin.
+ *
+ */
+int qxl_bo_unpin(struct qxl_bo *bo)
+{
+	int r;
+
+	r = qxl_bo_reserve(bo, false);
+	if (r)
+		return r;
+
+	r = __qxl_bo_unpin(bo);
+	qxl_bo_unreserve(bo);
+	return r;
+}
+
 void qxl_bo_force_delete(struct qxl_device *qdev)
 {
 	struct qxl_bo *bo, *n;