drm/exynos: fix pending update handling

Exynos DRM devices update their registers at vblank time. Exynos-DRM uses
custom mechanism to wait for vblank. This mechanism is error prone -
variables are not updated atomically. As a result in certain circumstances
user space can try to free buffers which are still in use by hardware,
in such cases IOMMU can throw OOPS.
The patch instead of fixing the mechanism replaces it with drm core helper.

Signed-off-by: Andrzej Hajda <a.hajda@samsung.com>
Reviewed-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
Signed-off-by: Inki Dae <inki.dae@samsung.com>

1 files changed, 1 insertions, 15 deletions

diff --git a/drivers/gpu/drm/exynos/exynos_drm_crtc.c b/drivers/gpu/drm/exynos/exynos_drm_crtc.c
index 785ffa6cc309..5b6845bc18fc 100644
--- a/drivers/gpu/drm/exynos/exynos_drm_crtc.c
+++ b/drivers/gpu/drm/exynos/exynos_drm_crtc.c
@@ -134,8 +134,6 @@ struct exynos_drm_crtc *exynos_drm_crtc_create(struct drm_device *drm_dev,
 	exynos_crtc->ops = ops;
 	exynos_crtc->ctx = ctx;
 
-	init_waitqueue_head(&exynos_crtc->wait_update);
-
 	crtc = &exynos_crtc->base;
 
 	private->crtc[pipe] = crtc;
@@ -175,13 +173,6 @@ void exynos_drm_crtc_disable_vblank(struct drm_device *dev, unsigned int pipe)
 		exynos_crtc->ops->disable_vblank(exynos_crtc);
 }
 
-void exynos_drm_crtc_wait_pending_update(struct exynos_drm_crtc *exynos_crtc)
-{
-	wait_event_timeout(exynos_crtc->wait_update,
-			   (atomic_read(&exynos_crtc->pending_update) == 0),
-			   msecs_to_jiffies(50));
-}
-
 void exynos_drm_crtc_finish_update(struct exynos_drm_crtc *exynos_crtc,
 				struct exynos_drm_plane *exynos_plane)
 {
@@ -190,9 +181,6 @@ void exynos_drm_crtc_finish_update(struct exynos_drm_crtc *exynos_crtc,
 
 	exynos_plane->pending_fb = NULL;
 
-	if (atomic_dec_and_test(&exynos_crtc->pending_update))
-		wake_up(&exynos_crtc->wait_update);
-
 	spin_lock_irqsave(&crtc->dev->event_lock, flags);
 	if (exynos_crtc->event)
 		drm_crtc_send_vblank_event(crtc, exynos_crtc->event);
@@ -235,10 +223,8 @@ void exynos_drm_crtc_cancel_page_flip(struct drm_crtc *crtc,
 	spin_lock_irqsave(&crtc->dev->event_lock, flags);
 
 	e = exynos_crtc->event;
-	if (e && e->base.file_priv == file) {
+	if (e && e->base.file_priv == file)
 		exynos_crtc->event = NULL;
-		atomic_dec(&exynos_crtc->pending_update);
-	}
 
 	spin_unlock_irqrestore(&crtc->dev->event_lock, flags);