Commit 1f2b4a7e authored by Chris Wilson's avatar Chris Wilson

drm/i915: Allow multiple user handles to the same VM

It was noted that we made the same mistake for VM_ID as for object
handles, whereby we ensured that we only allocated a single handle for
one ppgtt. This has the unfortunate consequence for userspace that they
need to reference count the handles to avoid destroying an active ID. If
we allow multiple handles to the same ppgtt, userspace can freely
unreference any handle they own without fear of destroying the same
handle in use elsewhere.
Signed-off-by: default avatarChris Wilson <chris@chris-wilson.co.uk>
Reviewed-by: default avatarTvrtko Ursulin <tvrtko.ursulin@intel.com>
Link: https://patchwork.freedesktop.org/patch/msgid/20190425054333.27299-1-chris@chris-wilson.co.uk
parent 8f2a1057
...@@ -772,8 +772,7 @@ int i915_gem_vm_create_ioctl(struct drm_device *dev, void *data, ...@@ -772,8 +772,7 @@ int i915_gem_vm_create_ioctl(struct drm_device *dev, void *data,
if (err < 0) if (err < 0)
goto err_unlock; goto err_unlock;
GEM_BUG_ON(err == 0); /* reserved for default/unassigned ppgtt */ GEM_BUG_ON(err == 0); /* reserved for invalid/unassigned ppgtt */
ppgtt->user_handle = err;
mutex_unlock(&file_priv->vm_idr_lock); mutex_unlock(&file_priv->vm_idr_lock);
...@@ -811,10 +810,6 @@ int i915_gem_vm_destroy_ioctl(struct drm_device *dev, void *data, ...@@ -811,10 +810,6 @@ int i915_gem_vm_destroy_ioctl(struct drm_device *dev, void *data,
return err; return err;
ppgtt = idr_remove(&file_priv->vm_idr, id); ppgtt = idr_remove(&file_priv->vm_idr, id);
if (ppgtt) {
GEM_BUG_ON(ppgtt->user_handle != id);
ppgtt->user_handle = 0;
}
mutex_unlock(&file_priv->vm_idr_lock); mutex_unlock(&file_priv->vm_idr_lock);
if (!ppgtt) if (!ppgtt)
...@@ -925,18 +920,15 @@ static int get_ppgtt(struct drm_i915_file_private *file_priv, ...@@ -925,18 +920,15 @@ static int get_ppgtt(struct drm_i915_file_private *file_priv,
if (ret) if (ret)
goto err_put; goto err_put;
if (!ppgtt->user_handle) {
ret = idr_alloc(&file_priv->vm_idr, ppgtt, 0, 0, GFP_KERNEL); ret = idr_alloc(&file_priv->vm_idr, ppgtt, 0, 0, GFP_KERNEL);
GEM_BUG_ON(!ret); GEM_BUG_ON(!ret);
if (ret < 0) if (ret < 0)
goto err_unlock; goto err_unlock;
ppgtt->user_handle = ret;
i915_ppgtt_get(ppgtt); i915_ppgtt_get(ppgtt);
}
args->size = 0; args->size = 0;
args->value = ppgtt->user_handle; args->value = ret;
ret = 0; ret = 0;
err_unlock: err_unlock:
...@@ -1027,10 +1019,8 @@ static int set_ppgtt(struct drm_i915_file_private *file_priv, ...@@ -1027,10 +1019,8 @@ static int set_ppgtt(struct drm_i915_file_private *file_priv,
return err; return err;
ppgtt = idr_find(&file_priv->vm_idr, args->value); ppgtt = idr_find(&file_priv->vm_idr, args->value);
if (ppgtt) { if (ppgtt)
GEM_BUG_ON(ppgtt->user_handle != args->value);
i915_ppgtt_get(ppgtt); i915_ppgtt_get(ppgtt);
}
mutex_unlock(&file_priv->vm_idr_lock); mutex_unlock(&file_priv->vm_idr_lock);
if (!ppgtt) if (!ppgtt)
return -ENOENT; return -ENOENT;
......
...@@ -397,8 +397,6 @@ struct i915_hw_ppgtt { ...@@ -397,8 +397,6 @@ struct i915_hw_ppgtt {
struct i915_page_directory_pointer pdp; /* GEN8+ */ struct i915_page_directory_pointer pdp; /* GEN8+ */
struct i915_page_directory pd; /* GEN6-7 */ struct i915_page_directory pd; /* GEN6-7 */
}; };
u32 user_handle;
}; };
struct gen6_hw_ppgtt { struct gen6_hw_ppgtt {
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment