drm/i915: Add request to execbuf params and add explicit cleanup

Rather than just having a local request variable in the execbuff code, the
request pointer is now stored in the execbuff params structure. Also added
explicit cleanup of the request (plus wiping the OLR to match) in the error
case. This means that the execbuff code is no longer dependent upon the OLR
keeping track of the request so as to not leak it when things do go wrong. Note
that in the success case, the i915_add_request() at the end of the submission
function will tidy up the request and clear the OLR.

For: VIZ-5115
Signed-off-by: John Harrison <John.C.Harrison@Intel.com>
Reviewed-by: Tomas Elf <tomas.elf@intel.com>
Signed-off-by: Daniel Vetter <daniel.vetter@ffwll.ch>

drivers/gpu/drm/i915/i915_drv.h

@@ -1657,6 +1657,7 @@ struct i915_execbuffer_params {
 	struct intel_engine_cs          *ring;
 	struct drm_i915_gem_object      *batch_obj;
 	struct intel_context            *ctx;
+	struct drm_i915_gem_request     *request;
 };
 
 struct drm_i915_private {

drivers/gpu/drm/i915/i915_gem_execbuffer.c

@@ -1415,7 +1415,6 @@ i915_gem_do_execbuffer(struct drm_device *dev, void *data,
 	struct i915_address_space *vm;
 	struct i915_execbuffer_params params_master; /* XXX: will be removed later */
 	struct i915_execbuffer_params *params = &params_master;
-	struct drm_i915_gem_request *request;
 	const u32 ctx_id = i915_execbuffer2_get_context_id(*args);
 	u32 dispatch_flags;
 	int ret;
@@ -1615,7 +1614,7 @@ i915_gem_do_execbuffer(struct drm_device *dev, void *data,
 		params->batch_obj_vm_offset = i915_gem_obj_offset(batch_obj, vm);
 
 	/* Allocate a request for this batch buffer nice and early. */
-	ret = i915_gem_request_alloc(ring, ctx, &request);
+	ret = i915_gem_request_alloc(ring, ctx, &params->request);
 	if (ret)
 		goto err_batch_unpin;
 
@@ -1649,6 +1648,16 @@ i915_gem_do_execbuffer(struct drm_device *dev, void *data,
 	i915_gem_context_unreference(ctx);
 	eb_destroy(eb);
 
+	/*
+	 * If the request was created but not successfully submitted then it
+	 * must be freed again. If it was submitted then it is being tracked
+	 * on the active request list and no clean up is required here.
+	 */
+	if (ret && params->request) {
+		i915_gem_request_cancel(params->request);
+		ring->outstanding_lazy_request = NULL;
+	}
+
 	mutex_unlock(&dev->struct_mutex);
 
 pre_mutex_err: