An attempt at not spreading out the file_priv->event_space stuff out quite so far and wide. And I think fixes something in ipp_get_event() that is broken (or if they are doing something more weird/subtle, then breaks it in a fun way).

Based upon a patch from Rob Clark, rebased and polished.

v2: Spelling fixes (Alex).

Cc: Alex Deucher alexdeucher@gmail.com Reviewed-by: Alex Deucher alexander.deucher@amd.com Cc: Rob Clark robdclark@gmail.com Signed-off-by: Daniel Vetter daniel.vetter@intel.com --- drivers/gpu/drm/drm_atomic.c | 44 ++++++++--------------------- drivers/gpu/drm/drm_crtc.c | 36 +++++++----------------- drivers/gpu/drm/drm_fops.c | 67 ++++++++++++++++++++++++++++++++++++++++++++ include/drm/drmP.h | 7 ++++- 4 files changed, 94 insertions(+), 60 deletions(-)

diff --git a/drivers/gpu/drm/drm_atomic.c b/drivers/gpu/drm/drm_atomic.c index 3f74193885f1..8fb469c4e4b8 100644 --- a/drivers/gpu/drm/drm_atomic.c +++ b/drivers/gpu/drm/drm_atomic.c @@ -1347,44 +1347,23 @@ static struct drm_pending_vblank_event *create_vblank_event( struct drm_device *dev, struct drm_file *file_priv, uint64_t user_data) { struct drm_pending_vblank_event *e = NULL; - unsigned long flags; - - spin_lock_irqsave(&dev->event_lock, flags); - if (file_priv->event_space < sizeof e->event) { - spin_unlock_irqrestore(&dev->event_lock, flags); - goto out; - } - file_priv->event_space -= sizeof e->event; - spin_unlock_irqrestore(&dev->event_lock, flags); + int ret;

e = kzalloc(sizeof *e, GFP_KERNEL); - if (e == NULL) { - spin_lock_irqsave(&dev->event_lock, flags); - file_priv->event_space += sizeof e->event; - spin_unlock_irqrestore(&dev->event_lock, flags); - goto out; - } + if (!e) + return NULL;

e->event.base.type = DRM_EVENT_FLIP_COMPLETE; - e->event.base.length = sizeof e->event; + e->event.base.length = sizeof(e->event); e->event.user_data = user_data; - e->base.event = &e->event.base; - e->base.file_priv = file_priv; - e->base.destroy = (void (*) (struct drm_pending_event *)) kfree; - -out: - return e; -}

-static void destroy_vblank_event(struct drm_device *dev, - struct drm_file *file_priv, struct drm_pending_vblank_event *e) -{ - unsigned long flags; + ret = drm_event_reserve_init(dev, file_priv, &e->base, &e->event.base); + if (ret) { + kfree(e); + return NULL; + }

- spin_lock_irqsave(&dev->event_lock, flags); - file_priv->event_space += sizeof e->event; - spin_unlock_irqrestore(&dev->event_lock, flags); - kfree(e); + return e; }

static int atomic_set_prop(struct drm_atomic_state *state, @@ -1646,8 +1625,7 @@ out: if (!crtc_state->event) continue;

- destroy_vblank_event(dev, file_priv, - crtc_state->event); + drm_event_cancel_free(dev, &crtc_state->event->base); } }

diff --git a/drivers/gpu/drm/drm_crtc.c b/drivers/gpu/drm/drm_crtc.c index 1e75a145834a..60a4184d41b7 100644 --- a/drivers/gpu/drm/drm_crtc.c +++ b/drivers/gpu/drm/drm_crtc.c @@ -5264,7 +5264,6 @@ int drm_mode_page_flip_ioctl(struct drm_device *dev, struct drm_crtc *crtc; struct drm_framebuffer *fb = NULL; struct drm_pending_vblank_event *e = NULL; - unsigned long flags; int ret = -EINVAL;

if (page_flip->flags & ~DRM_MODE_PAGE_FLIP_FLAGS || @@ -5315,41 +5314,26 @@ int drm_mode_page_flip_ioctl(struct drm_device *dev, }

if (page_flip->flags & DRM_MODE_PAGE_FLIP_EVENT) { - ret = -ENOMEM; - spin_lock_irqsave(&dev->event_lock, flags); - if (file_priv->event_space < sizeof(e->event)) { - spin_unlock_irqrestore(&dev->event_lock, flags); - goto out; - } - file_priv->event_space -= sizeof(e->event); - spin_unlock_irqrestore(&dev->event_lock, flags); - - e = kzalloc(sizeof(*e), GFP_KERNEL); - if (e == NULL) { - spin_lock_irqsave(&dev->event_lock, flags); - file_priv->event_space += sizeof(e->event); - spin_unlock_irqrestore(&dev->event_lock, flags); + e = kzalloc(sizeof *e, GFP_KERNEL); + if (!e) { + ret = -ENOMEM; goto out; } - e->event.base.type = DRM_EVENT_FLIP_COMPLETE; e->event.base.length = sizeof(e->event); e->event.user_data = page_flip->user_data; - e->base.event = &e->event.base; - e->base.file_priv = file_priv; - e->base.destroy = - (void (*) (struct drm_pending_event *)) kfree; + ret = drm_event_reserve_init(dev, file_priv, &e->base, &e->event.base); + if (ret) { + kfree(e); + goto out; + } }

crtc->primary->old_fb = crtc->primary->fb; ret = crtc->funcs->page_flip(crtc, fb, e, page_flip->flags); if (ret) { - if (page_flip->flags & DRM_MODE_PAGE_FLIP_EVENT) { - spin_lock_irqsave(&dev->event_lock, flags); - file_priv->event_space += sizeof(e->event); - spin_unlock_irqrestore(&dev->event_lock, flags); - kfree(e); - } + if (page_flip->flags & DRM_MODE_PAGE_FLIP_EVENT) + drm_event_cancel_free(dev, &e->base); /* Keep the old fb, don't unref it. */ crtc->primary->old_fb = NULL; } else { diff --git a/drivers/gpu/drm/drm_fops.c b/drivers/gpu/drm/drm_fops.c index 73075a1fa380..476408b638e3 100644 --- a/drivers/gpu/drm/drm_fops.c +++ b/drivers/gpu/drm/drm_fops.c @@ -672,3 +672,70 @@ unsigned int drm_poll(struct file *filp, struct poll_table_struct *wait) return mask; } EXPORT_SYMBOL(drm_poll); + +/** + * drm_event_reserve_init - init a DRM event and reserve space for it + * @dev: DRM device + * @file_priv: DRM file private data + * @p: tracking structure for the pending event + * @e: actual event data to deliver to userspace + * + * This function prepares the passed in event for eventual delivery. If the event + * doesn't get delivered (because the IOCTL fails later on, before queuing up + * anything) then the even must be cancelled and freed using + * drm_event_cancel_free(). + * + * If callers embedded @p into a larger structure it must be allocated with + * kmalloc and @p must be the first member element. + * + * RETURNS: + * + * 0 on success or a negative error code on failure. + */ +int drm_event_reserve_init(struct drm_device *dev, + struct drm_file *file_priv, + struct drm_pending_event *p, + struct drm_event *e) +{ + unsigned long flags; + int ret = 0; + + spin_lock_irqsave(&dev->event_lock, flags); + + if (file_priv->event_space < e->length) { + ret = -ENOMEM; + goto out; + } + + file_priv->event_space -= e->length; + + p->event = e; + p->file_priv = file_priv; + + /* we *could* pass this in as arg, but everyone uses kfree: */ + p->destroy = (void (*) (struct drm_pending_event *)) kfree; + +out: + spin_unlock_irqrestore(&dev->event_lock, flags); + return ret; +} +EXPORT_SYMBOL(drm_event_reserve_init); + +/** + * drm_event_cancel_free - free a DRM event and release it's space + * @dev: DRM device + * @p: tracking structure for the pending event + * + * This function frees the event @p initialized with drm_event_reserve_init() + * and releases any allocated space. + */ +void drm_event_cancel_free(struct drm_device *dev, + struct drm_pending_event *p) +{ + unsigned long flags; + spin_lock_irqsave(&dev->event_lock, flags); + p->file_priv->event_space += p->event->length; + spin_unlock_irqrestore(&dev->event_lock, flags); + p->destroy(p); +} +EXPORT_SYMBOL(drm_event_cancel_free); diff --git a/include/drm/drmP.h b/include/drm/drmP.h index fc9b9ad5b089..ad4d0a31294d 100644 --- a/include/drm/drmP.h +++ b/include/drm/drmP.h @@ -925,8 +925,13 @@ ssize_t drm_read(struct file *filp, char __user *buffer, size_t count, loff_t *offset); int drm_release(struct inode *inode, struct file *filp); int drm_new_set_master(struct drm_device *dev, struct drm_file *fpriv); - unsigned int drm_poll(struct file *filp, struct poll_table_struct *wait); +int drm_event_reserve_init(struct drm_device *dev, + struct drm_file *file_priv, + struct drm_pending_event *p, + struct drm_event *e); +void drm_event_cancel_free(struct drm_device *dev, + struct drm_pending_event *p);

/* Misc. IOCTL support (drm_ioctl.c) */ int drm_noop(struct drm_device *dev, void *data,

Use them in the core vblank code and exynos/vmwgfx drivers.

Note that the difference between wake_up_all and _interruptible in vmwgfx doesn't matter since the only waiter is the core code in drm_fops.c. And that is interruptible.

v2: Adjust existing kerneldoc too.

Reviewed-by: Alex Deucher alexander.deucher@amd.com (v1) Cc: Alex Deucher alexander.deucher@amd.com Cc: Thomas Hellstrom thellstrom@vmware.com Cc: Inki Dae inki.dae@samsung.com Signed-off-by: Daniel Vetter daniel.vetter@ffwll.ch --- drivers/gpu/drm/drm_fops.c | 42 ++++++++++++++++++++++++++++++++- drivers/gpu/drm/drm_irq.c | 7 ++---- drivers/gpu/drm/exynos/exynos_drm_g2d.c | 5 +--- drivers/gpu/drm/exynos/exynos_drm_ipp.c | 5 +--- drivers/gpu/drm/vmwgfx/vmwgfx_fence.c | 3 +-- include/drm/drmP.h | 2 ++ 6 files changed, 48 insertions(+), 16 deletions(-)

diff --git a/drivers/gpu/drm/drm_fops.c b/drivers/gpu/drm/drm_fops.c index 476408b638e3..d85af1b2a238 100644 --- a/drivers/gpu/drm/drm_fops.c +++ b/drivers/gpu/drm/drm_fops.c @@ -683,7 +683,9 @@ EXPORT_SYMBOL(drm_poll); * This function prepares the passed in event for eventual delivery. If the event * doesn't get delivered (because the IOCTL fails later on, before queuing up * anything) then the even must be cancelled and freed using - * drm_event_cancel_free(). + * drm_event_cancel_free(). Successfully initialized events should be sent out + * using drm_send_event() or drm_send_event_locked() to signal completion of the + * asynchronous event to userspace. * * If callers embedded @p into a larger structure it must be allocated with * kmalloc and @p must be the first member element. @@ -739,3 +741,41 @@ void drm_event_cancel_free(struct drm_device *dev, p->destroy(p); } EXPORT_SYMBOL(drm_event_cancel_free); + +/** + * drm_send_event_locked - send DRM event to file descriptor + * @dev: DRM device + * @e: DRM event to deliver + * + * This function sends the event @e, initialized with drm_event_reserve_init(), + * to its associated userspace DRM file. Callers must already hold + * dev->event_lock, see drm_send_event() for the unlocked version. + */ +void drm_send_event_locked(struct drm_device *dev, struct drm_pending_event *e) +{ + assert_spin_locked(&dev->event_lock); + + list_add_tail(&e->link, + &e->file_priv->event_list); + wake_up_interruptible(&e->file_priv->event_wait); +} +EXPORT_SYMBOL(drm_send_event_locked); + +/** + * drm_send_event - send DRM event to file descriptor + * @dev: DRM device + * @e: DRM event to deliver + * + * This function sends the event @e, initialized with drm_event_reserve_init(), + * to its associated userspace DRM file. This function acquires dev->event_lock, + * see drm_send_event_locked() for callers which already hold this lock. + */ +void drm_send_event(struct drm_device *dev, struct drm_pending_event *e) +{ + unsigned long irqflags; + + spin_lock_irqsave(&dev->event_lock, irqflags); + drm_send_event_locked(dev, e); + spin_unlock_irqrestore(&dev->event_lock, irqflags); +} +EXPORT_SYMBOL(drm_send_event); diff --git a/drivers/gpu/drm/drm_irq.c b/drivers/gpu/drm/drm_irq.c index a70b29909974..3fe8dbff6058 100644 --- a/drivers/gpu/drm/drm_irq.c +++ b/drivers/gpu/drm/drm_irq.c @@ -983,15 +983,12 @@ static void send_vblank_event(struct drm_device *dev, struct drm_pending_vblank_event *e, unsigned long seq, struct timeval *now) { - assert_spin_locked(&dev->event_lock); - e->event.sequence = seq; e->event.tv_sec = now->tv_sec; e->event.tv_usec = now->tv_usec;

- list_add_tail(&e->base.link, - &e->base.file_priv->event_list); - wake_up_interruptible(&e->base.file_priv->event_wait); + drm_send_event_locked(dev, &e->base); + trace_drm_vblank_event_delivered(e->base.pid, e->pipe, e->event.sequence); } diff --git a/drivers/gpu/drm/exynos/exynos_drm_g2d.c b/drivers/gpu/drm/exynos/exynos_drm_g2d.c index 82e7f95dfed9..db56c8259f18 100644 --- a/drivers/gpu/drm/exynos/exynos_drm_g2d.c +++ b/drivers/gpu/drm/exynos/exynos_drm_g2d.c @@ -893,10 +893,7 @@ static void g2d_finish_event(struct g2d_data *g2d, u32 cmdlist_no) e->event.tv_usec = now.tv_usec; e->event.cmdlist_no = cmdlist_no;

- spin_lock_irqsave(&drm_dev->event_lock, flags); - list_move_tail(&e->base.link, &e->base.file_priv->event_list); - wake_up_interruptible(&e->base.file_priv->event_wait); - spin_unlock_irqrestore(&drm_dev->event_lock, flags); + drm_send_event(dev, &e->base); }

static irqreturn_t g2d_irq_handler(int irq, void *dev_id) diff --git a/drivers/gpu/drm/exynos/exynos_drm_ipp.c b/drivers/gpu/drm/exynos/exynos_drm_ipp.c index c8819c05e2dd..1f6a6c1881d6 100644 --- a/drivers/gpu/drm/exynos/exynos_drm_ipp.c +++ b/drivers/gpu/drm/exynos/exynos_drm_ipp.c @@ -1520,10 +1520,7 @@ static int ipp_send_event(struct exynos_drm_ippdrv *ippdrv, for_each_ipp_ops(i) e->event.buf_id[i] = tbuf_id[i];

- spin_lock_irqsave(&drm_dev->event_lock, flags); - list_move_tail(&e->base.link, &e->base.file_priv->event_list); - wake_up_interruptible(&e->base.file_priv->event_wait); - spin_unlock_irqrestore(&drm_dev->event_lock, flags); + drm_send_event(dev, &e->base); mutex_unlock(&c_node->event_lock);

DRM_DEBUG_KMS("done cmd[%d]prop_id[%d]buf_id[%d]\n", diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_fence.c b/drivers/gpu/drm/vmwgfx/vmwgfx_fence.c index eda93bf52a6e..e0edf149d9d5 100644 --- a/drivers/gpu/drm/vmwgfx/vmwgfx_fence.c +++ b/drivers/gpu/drm/vmwgfx/vmwgfx_fence.c @@ -880,9 +880,8 @@ static void vmw_event_fence_action_seq_passed(struct vmw_fence_action *action) }

list_del_init(&eaction->fpriv_head); - list_add_tail(&eaction->event->link, &file_priv->event_list); eaction->event = NULL; - wake_up_all(&file_priv->event_wait); + drm_send_event_locked(dev, eaction->event); spin_unlock_irqrestore(&dev->event_lock, irq_flags); }

diff --git a/include/drm/drmP.h b/include/drm/drmP.h index ad4d0a31294d..ae73abf5c2cf 100644 --- a/include/drm/drmP.h +++ b/include/drm/drmP.h @@ -932,6 +932,8 @@ int drm_event_reserve_init(struct drm_device *dev, struct drm_event *e); void drm_event_cancel_free(struct drm_device *dev, struct drm_pending_event *p); +void drm_send_event_locked(struct drm_device *dev, struct drm_pending_event *e); +void drm_send_event(struct drm_device *dev, struct drm_pending_event *e);

/* Misc. IOCTL support (drm_ioctl.c) */ int drm_noop(struct drm_device *dev, void *data,

Hi Daniel,

Thank you for the patch.

On Saturday 09 January 2016 14:28:46 Daniel Vetter wrote:

There's really no reason to not do so, instead of replicating this for every use-case and every driver. Now we can't just nuke the events, since that would still mean that all drm_event users would need to know when that has happened, since calling e.g. drm_send_event isn't allowed any more. Instead just unlink them from the file, and detect this case and handle it appropriately in all functions.

v2: Adjust existing kerneldoc too.

Cc: Alex Deucher alexander.deucher@amd.com Signed-off-by: Daniel Vetter daniel.vetter@ffwll.ch

---

drivers/gpu/drm/drm_fops.c | 35 ++++++++++++++++++++++++++--------- include/drm/drmP.h | 2 ++ 2 files changed, 28 insertions(+), 9 deletions(-)

diff --git a/drivers/gpu/drm/drm_fops.c b/drivers/gpu/drm/drm_fops.c index d85af1b2a238..d32b24c74e08 100644 --- a/drivers/gpu/drm/drm_fops.c +++ b/drivers/gpu/drm/drm_fops.c @@ -264,6 +264,7 @@ static int drm_open_helper(struct file *filp, struct drm_minor *minor) INIT_LIST_HEAD(&priv->fbs); mutex_init(&priv->fbs_lock); INIT_LIST_HEAD(&priv->blobs);

• INIT_LIST_HEAD(&priv->pending_event_list); INIT_LIST_HEAD(&priv->event_list); init_waitqueue_head(&priv->event_wait); priv->event_space = 4096; /* set aside 4k for event buffer */

@@ -353,18 +354,16 @@ static void drm_events_release(struct drm_file *file_priv) { struct drm_device *dev = file_priv->minor->dev; struct drm_pending_event *e, *et;

• struct drm_pending_vblank_event *v, *vt; unsigned long flags;

  spin_lock_irqsave(&dev->event_lock, flags);

• /* Remove pending flips */

• list_for_each_entry_safe(v, vt, &dev->vblank_event_list, base.link)

• if (v->base.file_priv == file_priv) {
  

• 	list_del(&v->base.link);
  

• 	drm_vblank_put(dev, v->pipe);
  

• 	v->base.destroy(&v->base);
  

• }
  

Where does this code go ?

• /* Unlink pending events */

• list_for_each_entry_safe(e, et, &file_priv->pending_event_list,

• 		 pending_link) {
  

• list_del(&e->pending_link);
  

• e->file_priv = NULL;
  

• }

  /* Remove unconsumed events */ list_for_each_entry_safe(e, et, &file_priv->event_list, link) {

@@ -712,6 +711,7 @@ int drm_event_reserve_init(struct drm_device *dev, file_priv->event_space -= e->length;

p->event = e;

• list_add(&p->pending_link, &file_priv->pending_event_list); p->file_priv = file_priv;

  /* we *could* pass this in as arg, but everyone uses kfree: */

@@ -736,7 +736,10 @@ void drm_event_cancel_free(struct drm_device *dev, { unsigned long flags; spin_lock_irqsave(&dev->event_lock, flags);

• p->file_priv->event_space += p->event->length;

• if (p->file_priv) {

• p->file_priv->event_space += p->event->length;
  

• list_del(&p->pending_link);
  

• } spin_unlock_irqrestore(&dev->event_lock, flags); p->destroy(p);

} @@ -750,11 +753,21 @@ EXPORT_SYMBOL(drm_event_cancel_free);

• This function sends the event @e, initialized with

drm_event_reserve_init(),

• to its associated userspace DRM file. Callers must already hold
• dev->event_lock, see drm_send_event() for the unlocked version.

• • Note that the core will take care of unlinking and disarming events when

the

• • corresponding DRM file is closed. Drivers need to worry about that and

s/need to/need not/ ?

can

• • call this function upon completion of the asynchrnous work

s/asynchrnous/asynchronous/

unconditionally. */ void drm_send_event_locked(struct drm_device *dev, struct drm_pending_event *e) { assert_spin_locked(&dev->event_lock);

• if (!e->file_priv) {

I don't think this could happen before this patch as e->file_priv is dereferenced below, and I don't see anything in this patch that makes the condition possible.

• e->destroy(e);
  

• return;
  

• }
• list_del(&e->pending_link); list_add_tail(&e->link, &e->file_priv->event_list); wake_up_interruptible(&e->file_priv->event_wait);

@@ -769,6 +782,10 @@ EXPORT_SYMBOL(drm_send_event_locked);

• This function sends the event @e, initialized with

drm_event_reserve_init(),

• to its associated userspace DRM file. This function acquires

dev->event_lock,

• see drm_send_event_locked() for callers which already hold this lock.

• • Note that the core will take care of unlinking and disarming events when

the

• • corresponding DRM file is closed. Drivers need to worry about that and

s/need to/need not/ ?

can

• • call this function upon completion of the asynchrnous work

s/asynchrnous/asynchronous/

unconditionally. */ void drm_send_event(struct drm_device *dev, struct drm_pending_event *e) { diff --git a/include/drm/drmP.h b/include/drm/drmP.h index ae73abf5c2cf..3d78a7406d54 100644 --- a/include/drm/drmP.h +++ b/include/drm/drmP.h @@ -283,6 +283,7 @@ struct drm_ioctl_desc { struct drm_pending_event { struct drm_event *event; struct list_head link;

• struct list_head pending_link; struct drm_file *file_priv; pid_t pid; /* pid of requester, no guarantee it's valid by the time we deliver the event, for tracing only */

@@ -346,6 +347,7 @@ struct drm_file { struct list_head blobs;

wait_queue_head_t event_wait;

• struct list_head pending_event_list; struct list_head event_list; int event_space;

Hi Daniel,

On Monday 11 January 2016 14:51:46 Daniel Stone wrote:

On 10 January 2016 at 23:48, Laurent Pinchart wrote:

...

On Saturday 09 January 2016 14:28:46 Daniel Vetter wrote:

...

@@ -353,18 +354,16 @@ static void drm_events_release(struct drm_file *file_priv) {

  struct drm_device *dev = file_priv->minor->dev;
  struct drm_pending_event *e, *et;

• struct drm_pending_vblank_event *v, *vt;
  
  unsigned long flags;
  
  spin_lock_irqsave(&dev->event_lock, flags);
  
  

• /* Remove pending flips */
  

• list_for_each_entry_safe(v, vt, &dev->vblank_event_list, base.link)
  

•         if (v->base.file_priv == file_priv) {
  

•                 list_del(&v->base.link);
  

•                 drm_vblank_put(dev, v->pipe);
  

•                 v->base.destroy(&v->base);
  

•         }
  

Where does this code go ?

It doesn't: instead of deleting the events, the helpers to either cancel or send the event just notice that file_priv is NULL and bail out early.

Thank you for the explanation. What bothered me was that the drm_vblank_put() call got dropped. With v2 of this patch series that splits that change to a separate patch it's easier to understand.

...

...

• /* Unlink pending events */
  

• list_for_each_entry_safe(e, et, &file_priv->pending_event_list,
  

•                          pending_link) {
  

•         list_del(&e->pending_link);
  

•         e->file_priv = NULL;
  

• }
  

file_priv gets reset here ...

...

...

@@ -736,7 +736,10 @@ void drm_event_cancel_free(struct drm_device *dev,

{

  unsigned long flags;
  spin_lock_irqsave(&dev->event_lock, flags);

• p->file_priv->event_space += p->event->length;
  

• if (p->file_priv) {
  

•         p->file_priv->event_space += p->event->length;
  

•         list_del(&p->pending_link);
  

• }
  
  spin_unlock_irqrestore(&dev->event_lock, flags);
  p->destroy(p);
  

Allowing us to DTRT here ...

...

...

void drm_send_event_locked(struct drm_device *dev, struct drm_pending_event

*e) {

  assert_spin_locked(&dev->event_lock);

• if (!e->file_priv) {
  

I don't think this could happen before this patch as e->file_priv is dereferenced below, and I don't see anything in this patch that makes the condition possible.

...

•         e->destroy(e);
  

•         return;
  

• }
  

... and now here.

This looks good to me, and a good sight better than doing it in every driver. Still drowning in stuff after three weeks off though, so the best I can offer for the series right now is: Acked-by: Daniel Stone daniels@collabora.com

On Mon, Jan 11, 2016 at 02:03:34AM +0200, Laurent Pinchart wrote:

Hi Daniel,

Thank you for the patch.

On Friday 08 January 2016 21:36:47 Daniel Vetter wrote:

...

Again since the core takes care of this we can remove them. While at it also remove the postclose hook, it's empty.

Cc: Laurent Pinchart laurent.pinchart@ideasonboard.com Cc: Tomi Valkeinen tomi.valkeinen@ti.com Signed-off-by: Daniel Vetter daniel.vetter@intel.com

---

drivers/gpu/drm/omapdrm/omap_drv.c | 29 ----------------------------- 1 file changed, 29 deletions(-)

diff --git a/drivers/gpu/drm/omapdrm/omap_drv.c b/drivers/gpu/drm/omapdrm/omap_drv.c index dfafdb602ad2..e8b5080f6e2d 100644 --- a/drivers/gpu/drm/omapdrm/omap_drv.c +++ b/drivers/gpu/drm/omapdrm/omap_drv.c @@ -787,33 +787,6 @@ static void dev_lastclose(struct drm_device *dev) } }

-static void dev_preclose(struct drm_device *dev, struct drm_file *file) -{

• struct omap_drm_private *priv = dev->dev_private;
• struct drm_pending_event *event;
• unsigned long flags;
• DBG("preclose: dev=%p", dev);
• /*

• * Unlink all pending CRTC events to make sure they won't be queued up
  

• * by a pending asynchronous commit.
  

• */
  

• spin_lock_irqsave(&dev->event_lock, flags);
• list_for_each_entry(event, &priv->commit.events, link) {

• if (event->file_priv == file) {
  

• 	file->event_space += event->event->length;
  

• 	event->file_priv = NULL;
  

• }
  

• }
• spin_unlock_irqrestore(&dev->event_lock, flags);

-}

-static void dev_postclose(struct drm_device *dev, struct drm_file *file) -{

• DBG("postclose: dev=%p, file=%p", dev, file);

-}

You can also nuke the following code from omap_atomic_commit():

    /* Keep track of all CRTC events to unlink them in preclose(). */
    spin_lock_irqsave(&dev->event_lock, flags);
    for (i = 0; i < dev->mode_config.num_crtc; ++i) {
            struct drm_crtc_state *cstate = state->crtc_states[i];

            if (cstate && cstate->event)
                    list_add_tail(&cstate->event->base.link,
                                  &priv->commit.events);
    }
    spin_unlock_irqrestore(&dev->event_lock, flags);

and the priv->commit.events field in omap_drv.h (don't forget the structure kerneldoc).

Oh this is really good, since hunting for related code I noticed that omap doesn't send out the vblank event when the fpriv disappeared. So found even more code to remove. I didn't find any kerneldoc though. -Daniel

...

static const struct vm_operations_struct omap_gem_vm_ops = { .fault = omap_gem_fault, .open = drm_gem_vm_open, @@ -838,8 +811,6 @@ static struct drm_driver omap_drm_driver = { .unload = dev_unload, .open = dev_open, .lastclose = dev_lastclose,

• .preclose = dev_preclose,
• .postclose = dev_postclose, .set_busid = drm_platform_set_busid, .get_vblank_counter = drm_vblank_no_hw_counter, .enable_vblank = omap_irq_enable_vblank,

-- Regards,

Laurent Pinchart

Hi Daniel,

Thank you for the patch.

On Friday 08 January 2016 21:36:48 Daniel Vetter wrote:

Again since the drm core takes care of event unlinking/disarming this is now just needless code.

This looks good to me assuming that the mechanism works in the core, which looks like magic to me at the moment :-) After closing the "[PATCH] drm: Clean up pending events in the core" discussion (and assuming the conclusion is that is works),

Reviewed-by: Laurent Pinchart laurent.pinchart@ideasonboard.com

Cc: Laurent Pinchart laurent.pinchart@ideasonboard.com Signed-off-by: Daniel Vetter daniel.vetter@intel.com

---

drivers/gpu/drm/rcar-du/rcar_du_crtc.c | 20 -------------------- drivers/gpu/drm/rcar-du/rcar_du_crtc.h | 2 -- drivers/gpu/drm/rcar-du/rcar_du_drv.c | 10 ---------- 3 files changed, 32 deletions(-)

diff --git a/drivers/gpu/drm/rcar-du/rcar_du_crtc.c b/drivers/gpu/drm/rcar-du/rcar_du_crtc.c index 88a4b706be16..4ec80ae1fa99 100644 --- a/drivers/gpu/drm/rcar-du/rcar_du_crtc.c +++ b/drivers/gpu/drm/rcar-du/rcar_du_crtc.c @@ -282,26 +282,6 @@ static void rcar_du_crtc_update_planes(struct rcar_du_crtc *rcrtc) * Page Flip */

-void rcar_du_crtc_cancel_page_flip(struct rcar_du_crtc *rcrtc,

• 		   struct drm_file *file)
  

-{

• struct drm_pending_vblank_event *event;
• struct drm_device *dev = rcrtc->crtc.dev;
• unsigned long flags;
• /* Destroy the pending vertical blanking event associated with the

• * pending page flip, if any, and disable vertical blanking interrupts.
  

• */
  

• spin_lock_irqsave(&dev->event_lock, flags);
• event = rcrtc->event;
• if (event && event->base.file_priv == file) {

• rcrtc->event = NULL;
  

• event->base.destroy(&event->base);
  

• drm_crtc_vblank_put(&rcrtc->crtc);
  

• }
• spin_unlock_irqrestore(&dev->event_lock, flags);

-}

static void rcar_du_crtc_finish_page_flip(struct rcar_du_crtc *rcrtc) { struct drm_pending_vblank_event *event; diff --git a/drivers/gpu/drm/rcar-du/rcar_du_crtc.h b/drivers/gpu/drm/rcar-du/rcar_du_crtc.h index 4b95d9d08c49..2bbe3f5aab65 100644 --- a/drivers/gpu/drm/rcar-du/rcar_du_crtc.h +++ b/drivers/gpu/drm/rcar-du/rcar_du_crtc.h @@ -67,8 +67,6 @@ enum rcar_du_output {

int rcar_du_crtc_create(struct rcar_du_group *rgrp, unsigned int index); void rcar_du_crtc_enable_vblank(struct rcar_du_crtc *rcrtc, bool enable); -void rcar_du_crtc_cancel_page_flip(struct rcar_du_crtc *rcrtc,

• 		   struct drm_file *file);
  

void rcar_du_crtc_suspend(struct rcar_du_crtc *rcrtc); void rcar_du_crtc_resume(struct rcar_du_crtc *rcrtc);

diff --git a/drivers/gpu/drm/rcar-du/rcar_du_drv.c b/drivers/gpu/drm/rcar-du/rcar_du_drv.c index 40422f6b645e..0bb2b31555bf 100644 --- a/drivers/gpu/drm/rcar-du/rcar_du_drv.c +++ b/drivers/gpu/drm/rcar-du/rcar_du_drv.c @@ -220,15 +220,6 @@ done: return ret; }

-static void rcar_du_preclose(struct drm_device *dev, struct drm_file *file) -{

• struct rcar_du_device *rcdu = dev->dev_private;
• unsigned int i;
• for (i = 0; i < rcdu->num_crtcs; ++i)

• rcar_du_crtc_cancel_page_flip(&rcdu->crtcs[i], file);
  

-}

static void rcar_du_lastclose(struct drm_device *dev) { struct rcar_du_device *rcdu = dev->dev_private; @@ -271,7 +262,6 @@ static struct drm_driver rcar_du_driver = {

		| DRIVER_ATOMIC,

.load = rcar_du_load, .unload = rcar_du_unload,

• .preclose = rcar_du_preclose, .lastclose = rcar_du_lastclose, .set_busid = drm_platform_set_busid, .get_vblank_counter = drm_vblank_no_hw_counter,

Again since the drm core takes care of event unlinking/disarming this is now just needless code.

v2: Fixup misplaced hunk.

Cc: Laurent Pinchart laurent.pinchart@ideasonboard.com Signed-off-by: Daniel Vetter daniel.vetter@intel.com --- drivers/gpu/drm/shmobile/shmob_drm_crtc.c | 20 -------------------- drivers/gpu/drm/shmobile/shmob_drm_crtc.h | 2 -- drivers/gpu/drm/shmobile/shmob_drm_drv.c | 8 -------- 3 files changed, 30 deletions(-)

diff --git a/drivers/gpu/drm/shmobile/shmob_drm_crtc.c b/drivers/gpu/drm/shmobile/shmob_drm_crtc.c index b80802f55143..de7959a60774 100644 --- a/drivers/gpu/drm/shmobile/shmob_drm_crtc.c +++ b/drivers/gpu/drm/shmobile/shmob_drm_crtc.c @@ -438,26 +438,6 @@ static const struct drm_crtc_helper_funcs crtc_helper_funcs = { .mode_set_base = shmob_drm_crtc_mode_set_base, };

-void shmob_drm_crtc_cancel_page_flip(struct shmob_drm_crtc *scrtc, - struct drm_file *file) -{ - struct drm_pending_vblank_event *event; - struct drm_device *dev = scrtc->crtc.dev; - unsigned long flags; - - /* Destroy the pending vertical blanking event associated with the - * pending page flip, if any, and disable vertical blanking interrupts. - */ - spin_lock_irqsave(&dev->event_lock, flags); - event = scrtc->event; - if (event && event->base.file_priv == file) { - scrtc->event = NULL; - event->base.destroy(&event->base); - drm_vblank_put(dev, 0); - } - spin_unlock_irqrestore(&dev->event_lock, flags); -} - void shmob_drm_crtc_finish_page_flip(struct shmob_drm_crtc *scrtc) { struct drm_pending_vblank_event *event; diff --git a/drivers/gpu/drm/shmobile/shmob_drm_crtc.h b/drivers/gpu/drm/shmobile/shmob_drm_crtc.h index eddad6dcc88a..38ed4ff8aaf2 100644 --- a/drivers/gpu/drm/shmobile/shmob_drm_crtc.h +++ b/drivers/gpu/drm/shmobile/shmob_drm_crtc.h @@ -47,8 +47,6 @@ struct shmob_drm_connector {

int shmob_drm_crtc_create(struct shmob_drm_device *sdev); void shmob_drm_crtc_enable_vblank(struct shmob_drm_device *sdev, bool enable); -void shmob_drm_crtc_cancel_page_flip(struct shmob_drm_crtc *scrtc, - struct drm_file *file); void shmob_drm_crtc_finish_page_flip(struct shmob_drm_crtc *scrtc); void shmob_drm_crtc_suspend(struct shmob_drm_crtc *scrtc); void shmob_drm_crtc_resume(struct shmob_drm_crtc *scrtc); diff --git a/drivers/gpu/drm/shmobile/shmob_drm_drv.c b/drivers/gpu/drm/shmobile/shmob_drm_drv.c index 04e66e3751b4..7700ff172079 100644 --- a/drivers/gpu/drm/shmobile/shmob_drm_drv.c +++ b/drivers/gpu/drm/shmobile/shmob_drm_drv.c @@ -200,13 +200,6 @@ done: return ret; }

-static void shmob_drm_preclose(struct drm_device *dev, struct drm_file *file) -{ - struct shmob_drm_device *sdev = dev->dev_private; - - shmob_drm_crtc_cancel_page_flip(&sdev->crtc, file); -} - static irqreturn_t shmob_drm_irq(int irq, void *arg) { struct drm_device *dev = arg; @@ -266,7 +259,6 @@ static struct drm_driver shmob_drm_driver = { | DRIVER_PRIME, .load = shmob_drm_load, .unload = shmob_drm_unload, - .preclose = shmob_drm_preclose, .set_busid = drm_platform_set_busid, .irq_handler = shmob_drm_irq, .get_vblank_counter = drm_vblank_no_hw_counter,

Again since the drm core takes care of event unlinking/disarming this is now just needless code.

v2: Fixup misplaced hunks.

Cc: Rob Clark robdclark@gmail.com Signed-off-by: Daniel Vetter daniel.vetter@intel.com --- drivers/gpu/drm/tilcdc/tilcdc_crtc.c | 20 -------------------- drivers/gpu/drm/tilcdc/tilcdc_drv.c | 8 -------- drivers/gpu/drm/tilcdc/tilcdc_drv.h | 1 - 3 files changed, 29 deletions(-)

diff --git a/drivers/gpu/drm/tilcdc/tilcdc_crtc.c b/drivers/gpu/drm/tilcdc/tilcdc_crtc.c index 7d07733bdc86..4802da8e6d6f 100644 --- a/drivers/gpu/drm/tilcdc/tilcdc_crtc.c +++ b/drivers/gpu/drm/tilcdc/tilcdc_crtc.c @@ -662,26 +662,6 @@ irqreturn_t tilcdc_crtc_irq(struct drm_crtc *crtc) return IRQ_HANDLED; }

-void tilcdc_crtc_cancel_page_flip(struct drm_crtc *crtc, struct drm_file *file) -{ - struct tilcdc_crtc *tilcdc_crtc = to_tilcdc_crtc(crtc); - struct drm_pending_vblank_event *event; - struct drm_device *dev = crtc->dev; - unsigned long flags; - - /* Destroy the pending vertical blanking event associated with the - * pending page flip, if any, and disable vertical blanking interrupts. - */ - spin_lock_irqsave(&dev->event_lock, flags); - event = tilcdc_crtc->event; - if (event && event->base.file_priv == file) { - tilcdc_crtc->event = NULL; - event->base.destroy(&event->base); - drm_vblank_put(dev, 0); - } - spin_unlock_irqrestore(&dev->event_lock, flags); -} - struct drm_crtc *tilcdc_crtc_create(struct drm_device *dev) { struct tilcdc_crtc *tilcdc_crtc; diff --git a/drivers/gpu/drm/tilcdc/tilcdc_drv.c b/drivers/gpu/drm/tilcdc/tilcdc_drv.c index 4ddb21e7f52f..b39ba213e303 100644 --- a/drivers/gpu/drm/tilcdc/tilcdc_drv.c +++ b/drivers/gpu/drm/tilcdc/tilcdc_drv.c @@ -349,13 +349,6 @@ fail_free_priv: return ret; }

-static void tilcdc_preclose(struct drm_device *dev, struct drm_file *file) -{ - struct tilcdc_drm_private *priv = dev->dev_private; - - tilcdc_crtc_cancel_page_flip(priv->crtc, file); -} - static void tilcdc_lastclose(struct drm_device *dev) { struct tilcdc_drm_private *priv = dev->dev_private; @@ -556,7 +549,6 @@ static struct drm_driver tilcdc_driver = { .driver_features = DRIVER_HAVE_IRQ | DRIVER_GEM | DRIVER_MODESET, .load = tilcdc_load, .unload = tilcdc_unload, - .preclose = tilcdc_preclose, .lastclose = tilcdc_lastclose, .set_busid = drm_platform_set_busid, .irq_handler = tilcdc_irq, diff --git a/drivers/gpu/drm/tilcdc/tilcdc_drv.h b/drivers/gpu/drm/tilcdc/tilcdc_drv.h index e863ad0d26fe..66105d8dc620 100644 --- a/drivers/gpu/drm/tilcdc/tilcdc_drv.h +++ b/drivers/gpu/drm/tilcdc/tilcdc_drv.h @@ -163,7 +163,6 @@ struct tilcdc_panel_info { #define DBG(fmt, ...) DRM_DEBUG(fmt"\n", ##__VA_ARGS__)

struct drm_crtc *tilcdc_crtc_create(struct drm_device *dev); -void tilcdc_crtc_cancel_page_flip(struct drm_crtc *crtc, struct drm_file *file); irqreturn_t tilcdc_crtc_irq(struct drm_crtc *crtc); void tilcdc_crtc_update_clk(struct drm_crtc *crtc); void tilcdc_crtc_set_panel_info(struct drm_crtc *crtc,

Again since the drm core takes care of event unlinking/disarming this is now just needless code.

v2: I've completely missed eaction->fpriv_head and all the related code. We need to nuke that too to avoid accidentally deferencing the freed-up vmwgfx-private fpriv.

v3: Also remove vmw_fpriv->fence_events and unused variables I missed.

Cc: Thomas Hellström thellstrom@vmware.com Signed-off-by: Daniel Vetter daniel.vetter@intel.com --- drivers/gpu/drm/vmwgfx/vmwgfx_drv.c | 11 -------- drivers/gpu/drm/vmwgfx/vmwgfx_drv.h | 1 - drivers/gpu/drm/vmwgfx/vmwgfx_fence.c | 52 ----------------------------------- drivers/gpu/drm/vmwgfx/vmwgfx_fence.h | 2 -- 4 files changed, 66 deletions(-)

diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_drv.c b/drivers/gpu/drm/vmwgfx/vmwgfx_drv.c index c49812b80dd0..c96a2d2d5107 100644 --- a/drivers/gpu/drm/vmwgfx/vmwgfx_drv.c +++ b/drivers/gpu/drm/vmwgfx/vmwgfx_drv.c @@ -971,15 +971,6 @@ static int vmw_driver_unload(struct drm_device *dev) return 0; }

-static void vmw_preclose(struct drm_device *dev, - struct drm_file *file_priv) -{ - struct vmw_fpriv *vmw_fp = vmw_fpriv(file_priv); - struct vmw_private *dev_priv = vmw_priv(dev); - - vmw_event_fence_fpriv_gone(dev_priv->fman, &vmw_fp->fence_events); -} - static void vmw_postclose(struct drm_device *dev, struct drm_file *file_priv) { @@ -1010,7 +1001,6 @@ static int vmw_driver_open(struct drm_device *dev, struct drm_file *file_priv) if (unlikely(vmw_fp == NULL)) return ret;

- INIT_LIST_HEAD(&vmw_fp->fence_events); vmw_fp->tfile = ttm_object_file_init(dev_priv->tdev, 10); if (unlikely(vmw_fp->tfile == NULL)) goto out_no_tfile; @@ -1500,7 +1490,6 @@ static struct drm_driver driver = { .master_set = vmw_master_set, .master_drop = vmw_master_drop, .open = vmw_driver_open, - .preclose = vmw_preclose, .postclose = vmw_postclose, .set_busid = drm_pci_set_busid,

diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_drv.h b/drivers/gpu/drm/vmwgfx/vmwgfx_drv.h index 469cdd520615..5cb1b1687cd4 100644 --- a/drivers/gpu/drm/vmwgfx/vmwgfx_drv.h +++ b/drivers/gpu/drm/vmwgfx/vmwgfx_drv.h @@ -80,7 +80,6 @@ struct vmw_fpriv { struct drm_master *locked_master; struct ttm_object_file *tfile; - struct list_head fence_events; bool gb_aware; };

diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_fence.c b/drivers/gpu/drm/vmwgfx/vmwgfx_fence.c index e0edf149d9d5..ac477863fc07 100644 --- a/drivers/gpu/drm/vmwgfx/vmwgfx_fence.c +++ b/drivers/gpu/drm/vmwgfx/vmwgfx_fence.c @@ -71,7 +71,6 @@ struct vmw_user_fence { */ struct vmw_event_fence_action { struct vmw_fence_action action; - struct list_head fpriv_head;

struct drm_pending_event *event; struct vmw_fence_obj *fence; @@ -808,44 +807,6 @@ int vmw_fence_obj_unref_ioctl(struct drm_device *dev, void *data, }

/** - * vmw_event_fence_fpriv_gone - Remove references to struct drm_file objects - * - * @fman: Pointer to a struct vmw_fence_manager - * @event_list: Pointer to linked list of struct vmw_event_fence_action objects - * with pointers to a struct drm_file object about to be closed. - * - * This function removes all pending fence events with references to a - * specific struct drm_file object about to be closed. The caller is required - * to pass a list of all struct vmw_event_fence_action objects with such - * events attached. This function is typically called before the - * struct drm_file object's event management is taken down. - */ -void vmw_event_fence_fpriv_gone(struct vmw_fence_manager *fman, - struct list_head *event_list) -{ - struct vmw_event_fence_action *eaction; - struct drm_pending_event *event; - unsigned long irq_flags; - - while (1) { - spin_lock_irqsave(&fman->lock, irq_flags); - if (list_empty(event_list)) - goto out_unlock; - eaction = list_first_entry(event_list, - struct vmw_event_fence_action, - fpriv_head); - list_del_init(&eaction->fpriv_head); - event = eaction->event; - eaction->event = NULL; - spin_unlock_irqrestore(&fman->lock, irq_flags); - event->destroy(event); - } -out_unlock: - spin_unlock_irqrestore(&fman->lock, irq_flags); -} - - -/** * vmw_event_fence_action_seq_passed * * @action: The struct vmw_fence_action embedded in a struct @@ -879,7 +840,6 @@ static void vmw_event_fence_action_seq_passed(struct vmw_fence_action *action) *eaction->tv_usec = tv.tv_usec; }

- list_del_init(&eaction->fpriv_head); eaction->event = NULL; drm_send_event_locked(dev, eaction->event); spin_unlock_irqrestore(&dev->event_lock, irq_flags); @@ -898,12 +858,6 @@ static void vmw_event_fence_action_cleanup(struct vmw_fence_action *action) { struct vmw_event_fence_action *eaction = container_of(action, struct vmw_event_fence_action, action); - struct vmw_fence_manager *fman = fman_from_fence(eaction->fence); - unsigned long irq_flags; - - spin_lock_irqsave(&fman->lock, irq_flags); - list_del(&eaction->fpriv_head); - spin_unlock_irqrestore(&fman->lock, irq_flags);

vmw_fence_obj_unreference(&eaction->fence); kfree(eaction); @@ -983,8 +937,6 @@ int vmw_event_fence_action_queue(struct drm_file *file_priv, { struct vmw_event_fence_action *eaction; struct vmw_fence_manager *fman = fman_from_fence(fence); - struct vmw_fpriv *vmw_fp = vmw_fpriv(file_priv); - unsigned long irq_flags;

eaction = kzalloc(sizeof(*eaction), GFP_KERNEL); if (unlikely(eaction == NULL)) @@ -1001,10 +953,6 @@ int vmw_event_fence_action_queue(struct drm_file *file_priv, eaction->tv_sec = tv_sec; eaction->tv_usec = tv_usec;

- spin_lock_irqsave(&fman->lock, irq_flags); - list_add_tail(&eaction->fpriv_head, &vmw_fp->fence_events); - spin_unlock_irqrestore(&fman->lock, irq_flags); - vmw_fence_obj_add_action(fence, &eaction->action);

return 0; diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_fence.h b/drivers/gpu/drm/vmwgfx/vmwgfx_fence.h index 8be6c29f5eb5..83ae301ee141 100644 --- a/drivers/gpu/drm/vmwgfx/vmwgfx_fence.h +++ b/drivers/gpu/drm/vmwgfx/vmwgfx_fence.h @@ -116,8 +116,6 @@ extern int vmw_fence_obj_unref_ioctl(struct drm_device *dev, void *data, struct drm_file *file_priv); extern int vmw_fence_event_ioctl(struct drm_device *dev, void *data, struct drm_file *file_priv); -extern void vmw_event_fence_fpriv_gone(struct vmw_fence_manager *fman, - struct list_head *event_list); extern int vmw_event_fence_action_queue(struct drm_file *filee_priv, struct vmw_fence_obj *fence, struct drm_pending_event *event,

Hi Daniel,

Thank you for the patch.

On Sunday 10 January 2016 23:26:06 Daniel Vetter wrote:

Again since the drm core takes care of event unlinking/disarming this is now just needless code.

v2: Fixup misplaced hunk.

Cc: Laurent Pinchart laurent.pinchart@ideasonboard.com Signed-off-by: Daniel Vetter daniel.vetter@intel.com

This looks good to me assuming that the mechanism works in the core, which looks like magic to me at the moment :-) After closing the "[PATCH] drm: Clean up pending events in the core" discussion (and assuming the conclusion is that is works),

Reviewed-by: Laurent Pinchart laurent.pinchart@ideasonboard.com

---

drivers/gpu/drm/shmobile/shmob_drm_crtc.c | 20 -------------------- drivers/gpu/drm/shmobile/shmob_drm_crtc.h | 2 -- drivers/gpu/drm/shmobile/shmob_drm_drv.c | 8 -------- 3 files changed, 30 deletions(-)

diff --git a/drivers/gpu/drm/shmobile/shmob_drm_crtc.c b/drivers/gpu/drm/shmobile/shmob_drm_crtc.c index b80802f55143..de7959a60774 100644 --- a/drivers/gpu/drm/shmobile/shmob_drm_crtc.c +++ b/drivers/gpu/drm/shmobile/shmob_drm_crtc.c @@ -438,26 +438,6 @@ static const struct drm_crtc_helper_funcs crtc_helper_funcs = { .mode_set_base = shmob_drm_crtc_mode_set_base, };

-void shmob_drm_crtc_cancel_page_flip(struct shmob_drm_crtc *scrtc,

• 		     struct drm_file *file)
  

-{

• struct drm_pending_vblank_event *event;
• struct drm_device *dev = scrtc->crtc.dev;
• unsigned long flags;
• /* Destroy the pending vertical blanking event associated with the

• * pending page flip, if any, and disable vertical blanking interrupts.
  

• */
  

• spin_lock_irqsave(&dev->event_lock, flags);
• event = scrtc->event;
• if (event && event->base.file_priv == file) {

• scrtc->event = NULL;
  

• event->base.destroy(&event->base);
  

• drm_vblank_put(dev, 0);
  

• }
• spin_unlock_irqrestore(&dev->event_lock, flags);

-}

void shmob_drm_crtc_finish_page_flip(struct shmob_drm_crtc *scrtc) { struct drm_pending_vblank_event *event; diff --git a/drivers/gpu/drm/shmobile/shmob_drm_crtc.h b/drivers/gpu/drm/shmobile/shmob_drm_crtc.h index eddad6dcc88a..38ed4ff8aaf2 100644 --- a/drivers/gpu/drm/shmobile/shmob_drm_crtc.h +++ b/drivers/gpu/drm/shmobile/shmob_drm_crtc.h @@ -47,8 +47,6 @@ struct shmob_drm_connector {

int shmob_drm_crtc_create(struct shmob_drm_device *sdev); void shmob_drm_crtc_enable_vblank(struct shmob_drm_device *sdev, bool enable); -void shmob_drm_crtc_cancel_page_flip(struct shmob_drm_crtc *scrtc, - struct drm_file *file); void shmob_drm_crtc_finish_page_flip(struct shmob_drm_crtc *scrtc); void shmob_drm_crtc_suspend(struct shmob_drm_crtc *scrtc); void shmob_drm_crtc_resume(struct shmob_drm_crtc *scrtc); diff --git a/drivers/gpu/drm/shmobile/shmob_drm_drv.c b/drivers/gpu/drm/shmobile/shmob_drm_drv.c index 04e66e3751b4..7700ff172079 100644 --- a/drivers/gpu/drm/shmobile/shmob_drm_drv.c +++ b/drivers/gpu/drm/shmobile/shmob_drm_drv.c @@ -200,13 +200,6 @@ done: return ret; }

-static void shmob_drm_preclose(struct drm_device *dev, struct drm_file *file) -{

• struct shmob_drm_device *sdev = dev->dev_private;
• shmob_drm_crtc_cancel_page_flip(&sdev->crtc, file);

-}

static irqreturn_t shmob_drm_irq(int irq, void *arg) { struct drm_device *dev = arg; @@ -266,7 +259,6 @@ static struct drm_driver shmob_drm_driver = {

		| DRIVER_PRIME,

.load = shmob_drm_load, .unload = shmob_drm_unload,

• .preclose = shmob_drm_preclose, .set_busid = drm_platform_set_busid, .irq_handler = shmob_drm_irq, .get_vblank_counter = drm_vblank_no_hw_counter,

In general, looks good. Two things though.

1) vc4_drv.h looks like it ended up in the wrong patch. 2) Should be able to nuke also struct vmw_fpriv::fence_events and struct vmw_event_fence_action::fpriv_head?

/Thomas

On 01/10/2016 11:02 PM, Daniel Vetter wrote:

Again since the drm core takes care of event unlinking/disarming this is now just needless code.

v2: I've completely missed eaction->fpriv_head and all the related code. We need to nuke that too to avoid accidentally deferencing the freed-up vmwgfx-private fpriv.

Cc: Thomas Hellström thellstrom@vmware.com Signed-off-by: Daniel Vetter daniel.vetter@intel.com

---

drivers/gpu/drm/vc4/vc4_drv.h | 1 - drivers/gpu/drm/vmwgfx/vmwgfx_drv.c | 10 -------- drivers/gpu/drm/vmwgfx/vmwgfx_fence.c | 48 ----------------------------------- drivers/gpu/drm/vmwgfx/vmwgfx_fence.h | 2 -- 4 files changed, 61 deletions(-)

diff --git a/drivers/gpu/drm/vc4/vc4_drv.h b/drivers/gpu/drm/vc4/vc4_drv.h index 080865ec2bae..4c734d087d7f 100644 --- a/drivers/gpu/drm/vc4/vc4_drv.h +++ b/drivers/gpu/drm/vc4/vc4_drv.h @@ -376,7 +376,6 @@ int vc4_bo_stats_debugfs(struct seq_file *m, void *arg); extern struct platform_driver vc4_crtc_driver; int vc4_enable_vblank(struct drm_device *dev, unsigned int crtc_id); void vc4_disable_vblank(struct drm_device *dev, unsigned int crtc_id); -void vc4_cancel_page_flip(struct drm_crtc *crtc, struct drm_file *file); int vc4_crtc_debugfs_regs(struct seq_file *m, void *arg);

/* vc4_debugfs.c */ diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_drv.c b/drivers/gpu/drm/vmwgfx/vmwgfx_drv.c index c49812b80dd0..c04c4d1e2f3e 100644 --- a/drivers/gpu/drm/vmwgfx/vmwgfx_drv.c +++ b/drivers/gpu/drm/vmwgfx/vmwgfx_drv.c @@ -971,15 +971,6 @@ static int vmw_driver_unload(struct drm_device *dev) return 0; }

-static void vmw_preclose(struct drm_device *dev,

• 	 struct drm_file *file_priv)
  

-{

• struct vmw_fpriv *vmw_fp = vmw_fpriv(file_priv);
• struct vmw_private *dev_priv = vmw_priv(dev);
• vmw_event_fence_fpriv_gone(dev_priv->fman, &vmw_fp->fence_events);

-}

static void vmw_postclose(struct drm_device *dev, struct drm_file *file_priv) { @@ -1500,7 +1491,6 @@ static struct drm_driver driver = { .master_set = vmw_master_set, .master_drop = vmw_master_drop, .open = vmw_driver_open,

• .preclose = vmw_preclose, .postclose = vmw_postclose, .set_busid = drm_pci_set_busid,

diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_fence.c b/drivers/gpu/drm/vmwgfx/vmwgfx_fence.c index e0edf149d9d5..bb95bd20d415 100644 --- a/drivers/gpu/drm/vmwgfx/vmwgfx_fence.c +++ b/drivers/gpu/drm/vmwgfx/vmwgfx_fence.c @@ -71,7 +71,6 @@ struct vmw_user_fence { */ struct vmw_event_fence_action { struct vmw_fence_action action;

• struct list_head fpriv_head;

  struct drm_pending_event *event; struct vmw_fence_obj *fence;

@@ -808,44 +807,6 @@ int vmw_fence_obj_unref_ioctl(struct drm_device *dev, void *data, }

/**

• • vmw_event_fence_fpriv_gone - Remove references to struct drm_file objects
• • @fman: Pointer to a struct vmw_fence_manager
• • @event_list: Pointer to linked list of struct vmw_event_fence_action objects
• • with pointers to a struct drm_file object about to be closed.
• • This function removes all pending fence events with references to a
• • specific struct drm_file object about to be closed. The caller is required
• • to pass a list of all struct vmw_event_fence_action objects with such
• • events attached. This function is typically called before the
• • struct drm_file object's event management is taken down.
• */

-void vmw_event_fence_fpriv_gone(struct vmw_fence_manager *fman,

• 		struct list_head *event_list)
  

-{

• struct vmw_event_fence_action *eaction;
• struct drm_pending_event *event;
• unsigned long irq_flags;
• while (1) {

• spin_lock_irqsave(&fman->lock, irq_flags);
  

• if (list_empty(event_list))
  

• 	goto out_unlock;
  

• eaction = list_first_entry(event_list,
  

• 			   struct vmw_event_fence_action,
  

• 			   fpriv_head);
  

• list_del_init(&eaction->fpriv_head);
  

• event = eaction->event;
  

• eaction->event = NULL;
  

• spin_unlock_irqrestore(&fman->lock, irq_flags);
  

• event->destroy(event);
  

• }

-out_unlock:

• spin_unlock_irqrestore(&fman->lock, irq_flags);

-}

-/**

• vmw_event_fence_action_seq_passed
• @action: The struct vmw_fence_action embedded in a struct

@@ -879,7 +840,6 @@ static void vmw_event_fence_action_seq_passed(struct vmw_fence_action *action) *eaction->tv_usec = tv.tv_usec; }

• list_del_init(&eaction->fpriv_head); eaction->event = NULL; drm_send_event_locked(dev, eaction->event); spin_unlock_irqrestore(&dev->event_lock, irq_flags);

@@ -901,10 +861,6 @@ static void vmw_event_fence_action_cleanup(struct vmw_fence_action *action) struct vmw_fence_manager *fman = fman_from_fence(eaction->fence); unsigned long irq_flags;

• spin_lock_irqsave(&fman->lock, irq_flags);
• list_del(&eaction->fpriv_head);
• spin_unlock_irqrestore(&fman->lock, irq_flags);
• vmw_fence_obj_unreference(&eaction->fence); kfree(eaction);

} @@ -1001,10 +957,6 @@ int vmw_event_fence_action_queue(struct drm_file *file_priv, eaction->tv_sec = tv_sec; eaction->tv_usec = tv_usec;

• spin_lock_irqsave(&fman->lock, irq_flags);

• list_add_tail(&eaction->fpriv_head, &vmw_fp->fence_events);

• spin_unlock_irqrestore(&fman->lock, irq_flags);

• vmw_fence_obj_add_action(fence, &eaction->action);

  return 0;

diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_fence.h b/drivers/gpu/drm/vmwgfx/vmwgfx_fence.h index 8be6c29f5eb5..83ae301ee141 100644 --- a/drivers/gpu/drm/vmwgfx/vmwgfx_fence.h +++ b/drivers/gpu/drm/vmwgfx/vmwgfx_fence.h @@ -116,8 +116,6 @@ extern int vmw_fence_obj_unref_ioctl(struct drm_device *dev, void *data, struct drm_file *file_priv); extern int vmw_fence_event_ioctl(struct drm_device *dev, void *data, struct drm_file *file_priv); -extern void vmw_event_fence_fpriv_gone(struct vmw_fence_manager *fman,

• 		       struct list_head *event_list);
  

extern int vmw_event_fence_action_queue(struct drm_file *filee_priv, struct vmw_fence_obj *fence, struct drm_pending_event *event,