similar to: [PATCH v2 1/2] drm/qxl: reorder calls in qxl_device_fini().

Move final cleanups to qxl_drm_release() callback. Add drm_atomic_helper_shutdown() call to qxl_pci_remove(). Reorder calls in qxl_device_fini(). Cleaning up gem & ttm might trigger qxl commands, so we should do that before releaseing command rings. Signed-off-by: Gerd Hoffmann <kraxel at redhat.com> --- drivers/gpu/drm/qxl/qxl_drv.c | 21 ++++++++++++++-------

> > Move final cleanups to qxl_drm_release() callback. Can you explain in the commit why this is better or preferable? > Add drm_atomic_helper_shutdown() call to qxl_pci_remove(). I suppose this is to replace the former manual cleanup calls, which were moved to qxl_drm_release, I think this could be added in the commit message ("why"), I don't see much value in

Move final cleanups to qxl_drm_release() callback. Add drm_atomic_helper_shutdown() call to qxl_pci_remove(). Reorder calls in qxl_device_fini(). Cleaning up gem & ttm might trigger qxl commands, so we should do that before releaseing command rings. Signed-off-by: Gerd Hoffmann <kraxel at redhat.com> --- drivers/gpu/drm/qxl/qxl_drv.c | 21 ++++++++++++++-------

If qxl_device_init fails on creating resources and does not report it, then qxl module will catch null pointer exception on remove, or on probe's error path. The patch adds error path with resources release into qxl_device_init. Found by Linux Driver Verification project (linuxtesting.org). Signed-off-by: Anton Vasilyev <vasilyev at ispras.ru> --- drivers/gpu/drm/qxl/qxl_kms.c | 80

qxl expects that list_first_entry(release->bos) returns the first element qxl added to the list. ttm_eu_reserve_buffers() may reorder the list though. Add a release_bo field to struct qxl_release and use that instead. Signed-off-by: Gerd Hoffmann <kraxel at redhat.com> --- drivers/gpu/drm/qxl/qxl_drv.h | 1 + drivers/gpu/drm/qxl/qxl_cmd.c | 6 ++----

Drop pointless indirection, remove the mem_slots array and index variables, drop dynamic allocation. Store memslots in qxl_device instead. Signed-off-by: Gerd Hoffmann <kraxel at redhat.com> --- drivers/gpu/drm/qxl/qxl_drv.h | 15 +++++---- drivers/gpu/drm/qxl/qxl_kms.c | 72 +++++++++++++++++-------------------------- 2 files changed, 36 insertions(+), 51 deletions(-) diff --git

Signed-off-by: Gerd Hoffmann <kraxel at redhat.com> --- drivers/gpu/drm/qxl/qxl_drv.h | 7 ------- 1 file changed, 7 deletions(-) diff --git a/drivers/gpu/drm/qxl/qxl_drv.h b/drivers/gpu/drm/qxl/qxl_drv.h index 38c5a8b1df..7eabf4a9ed 100644 --- a/drivers/gpu/drm/qxl/qxl_drv.h +++ b/drivers/gpu/drm/qxl/qxl_drv.h @@ -308,13 +308,6 @@ void qxl_ring_free(struct qxl_ring *ring); void

On Sat, Apr 18, 2020 at 02:39:17PM +0800, Caicai wrote: > When a qxl resource is released, the list that needs to be released is > fetched from the linked list ring and cleared. When you empty the list, > instead of trying to determine whether the ttm buffer object for each > qxl in the list is locked, you release the qxl object and remove the > element from the list until the list

On Wed, Apr 29, 2020 at 12:01:24PM +0300, Vasily Averin wrote: > qxl_release should not be accesses after qxl_push_*_ring_release() calls: > userspace driver can process submitted command quickly, move qxl_release > into release_ring, generate interrupt and trigger garbage collector. > > It can lead to crashes in qxl driver or trigger memory corruption > in some kmalloc-192 slab

Lovely diffstat, thanks to the new generic fbdev emulation. drm/qxl/Makefile | 2 drm/qxl/qxl_draw.c | 232 ---------------------------------------- drm/qxl/qxl_drv.h | 21 --- drm/qxl/qxl_fb.c | 300 ----------------------------------------------------- Signed-off-by: Gerd Hoffmann <kraxel at redhat.com> --- drivers/gpu/drm/qxl/qxl_drv.h | 21 ---

On Fri, Jun 01, 2018 at 04:05:32PM -0400, Jeremy Cline wrote: > "qxl_bo_unref" may sleep, but calling "qxl_release_map" causes > "preempt_disable()" to be called and "preempt_enable()" isn't called > until "qxl_release_unmap" is used. Move the call to "qxl_bo_unref" out > from in between the two to avoid sleeping from an

On Tue, Mar 20, 2018 at 11:29:27AM -0700, Santha Meena Ramamoorthy wrote: > Replace drm_gem_object_reference/unreference function with *_get/put() > suffixes, because it is shorter and consistent with the kernel > kref_get/put() functions. The following Coccinelle script was used: > > @@ > expression e; > @@ > > ( > -drm_gem_object_reference(e); >

Drop drm_gem_object from qxl_bo, use the ttm_buffer_object.base instead. Signed-off-by: Gerd Hoffmann <kraxel at redhat.com> --- drivers/gpu/drm/qxl/qxl_drv.h | 6 +++--- drivers/gpu/drm/qxl/qxl_object.h | 4 ++-- drivers/gpu/drm/qxl/qxl_cmd.c | 4 ++-- drivers/gpu/drm/qxl/qxl_debugfs.c | 2 +- drivers/gpu/drm/qxl/qxl_display.c | 8 ++++---- drivers/gpu/drm/qxl/qxl_gem.c

Drop drm_gem_object from qxl_bo, use the ttm_buffer_object.base instead. Signed-off-by: Gerd Hoffmann <kraxel at redhat.com> --- drivers/gpu/drm/qxl/qxl_drv.h | 6 +++--- drivers/gpu/drm/qxl/qxl_object.h | 4 ++-- drivers/gpu/drm/qxl/qxl_cmd.c | 4 ++-- drivers/gpu/drm/qxl/qxl_debugfs.c | 2 +- drivers/gpu/drm/qxl/qxl_display.c | 8 ++++---- drivers/gpu/drm/qxl/qxl_gem.c

Drop drm_gem_object from qxl_bo, use the ttm_buffer_object.base instead. Signed-off-by: Gerd Hoffmann <kraxel at redhat.com> Acked-by: Christian K?nig <christian.koenig at amd.com> --- drivers/gpu/drm/qxl/qxl_drv.h | 6 +++--- drivers/gpu/drm/qxl/qxl_object.h | 4 ++-- drivers/gpu/drm/qxl/qxl_cmd.c | 4 ++-- drivers/gpu/drm/qxl/qxl_debugfs.c | 2 +-

Drop drm_gem_object from qxl_bo, use the ttm_buffer_object.base instead. Signed-off-by: Gerd Hoffmann <kraxel at redhat.com> Acked-by: Christian K?nig <christian.koenig at amd.com> --- drivers/gpu/drm/qxl/qxl_drv.h | 6 +++--- drivers/gpu/drm/qxl/qxl_object.h | 4 ++-- drivers/gpu/drm/qxl/qxl_cmd.c | 4 ++-- drivers/gpu/drm/qxl/qxl_debugfs.c | 2 +-

Drop drm_gem_object from qxl_bo, use the ttm_buffer_object.base instead. Signed-off-by: Gerd Hoffmann <kraxel at redhat.com> Acked-by: Christian K?nig <christian.koenig at amd.com> --- drivers/gpu/drm/qxl/qxl_drv.h | 6 +++--- drivers/gpu/drm/qxl/qxl_object.h | 4 ++-- drivers/gpu/drm/qxl/qxl_cmd.c | 4 ++-- drivers/gpu/drm/qxl/qxl_debugfs.c | 2 +-

Drop drm_gem_object from qxl_bo, use the ttm_buffer_object.base instead. Signed-off-by: Gerd Hoffmann <kraxel at redhat.com> Acked-by: Christian K?nig <christian.koenig at amd.com> --- drivers/gpu/drm/qxl/qxl_drv.h | 6 +++--- drivers/gpu/drm/qxl/qxl_object.h | 4 ++-- drivers/gpu/drm/qxl/qxl_cmd.c | 4 ++-- drivers/gpu/drm/qxl/qxl_debugfs.c | 2 +-

Hi Daniel On Wed, Apr 15, 2020 at 09:40:01AM +0200, Daniel Vetter wrote: > Also need to remove the drm_dev_put from the remove hook. > > Acked-by: Gerd Hoffmann <kraxel at redhat.com> > Signed-off-by: Daniel Vetter <daniel.vetter at intel.com> > Cc: Dave Airlie <airlied at redhat.com> > Cc: Gerd Hoffmann <kraxel at redhat.com> > Cc: virtualization at

Am 03.04.20 um 15:58 schrieb Daniel Vetter: > Also need to remove the drm_dev_put from the remove hook. > > Signed-off-by: Daniel Vetter <daniel.vetter at intel.com> > Cc: Dave Airlie <airlied at redhat.com> > Cc: Gerd Hoffmann <kraxel at redhat.com> > Cc: virtualization at lists.linux-foundation.org > Cc: spice-devel at lists.freedesktop.org > --- >