Op 30-08-17 om 14:43 schreef Daniel Vetter:

On Wed, Aug 30, 2017 at 02:17:48PM +0200, Maarten Lankhorst wrote:

...

The next commit removes the wait for flip_done in in drm_atomic_helper_commit_cleanup_done, but we need it for the tests to pass. Instead of using complicated vblank tracking which ends up being ignored anyway, call the correct atomic helper. :)

RFC because I'm not completely sure what we want to do with the vblank waiting, I think for now this patch is the right way to go until we decide because it preserves the status quo when drm_crtc_commit was introduced.

Signed-off-by: Maarten Lankhorst maarten.lankhorst@linux.intel.com

drivers/gpu/drm/i915/i915_drv.h | 3 +- drivers/gpu/drm/i915/intel_display.c | 83 +++--------------------------------- 2 files changed, 8 insertions(+), 78 deletions(-)

diff --git a/drivers/gpu/drm/i915/i915_drv.h b/drivers/gpu/drm/i915/i915_drv.h index cbbafbfb0a55..de19621864a9 100644 --- a/drivers/gpu/drm/i915/i915_drv.h +++ b/drivers/gpu/drm/i915/i915_drv.h @@ -707,8 +707,7 @@ struct drm_i915_display_funcs { struct drm_atomic_state *old_state); void (*crtc_disable)(struct intel_crtc_state *old_crtc_state, struct drm_atomic_state *old_state);

• void (*update_crtcs)(struct drm_atomic_state *state,

• 	     unsigned int *crtc_vblank_mask);
  

• void (*update_crtcs)(struct drm_atomic_state *state); void (*audio_codec_enable)(struct drm_connector *connector, struct intel_encoder *encoder, const struct drm_display_mode *adjusted_mode);

diff --git a/drivers/gpu/drm/i915/intel_display.c b/drivers/gpu/drm/i915/intel_display.c index 52c73b4dabaa..3f3cb96aa11e 100644 --- a/drivers/gpu/drm/i915/intel_display.c +++ b/drivers/gpu/drm/i915/intel_display.c @@ -12114,73 +12114,10 @@ u32 intel_crtc_get_vblank_counter(struct intel_crtc *crtc) return dev->driver->get_vblank_counter(dev, crtc->pipe); }

-static void intel_atomic_wait_for_vblanks(struct drm_device *dev,

• 			  struct drm_i915_private *dev_priv,
  

• 			  unsigned crtc_mask)
  

-{

• unsigned last_vblank_count[I915_MAX_PIPES];
• enum pipe pipe;
• int ret;
• if (!crtc_mask)

• return;
  

• for_each_pipe(dev_priv, pipe) {

• struct intel_crtc *crtc = intel_get_crtc_for_pipe(dev_priv,
  

• 						  pipe);
  

• if (!((1 << pipe) & crtc_mask))
  

• 	continue;
  

• ret = drm_crtc_vblank_get(&crtc->base);
  

• if (WARN_ON(ret != 0)) {
  

• 	crtc_mask &= ~(1 << pipe);
  

• 	continue;
  

• }
  

• last_vblank_count[pipe] = drm_crtc_vblank_count(&crtc->base);
  

• }
• for_each_pipe(dev_priv, pipe) {

• struct intel_crtc *crtc = intel_get_crtc_for_pipe(dev_priv,
  

• 						  pipe);
  

• long lret;
  

• if (!((1 << pipe) & crtc_mask))
  

• 	continue;
  

• lret = wait_event_timeout(dev->vblank[pipe].queue,
  

• 		last_vblank_count[pipe] !=
  

• 			drm_crtc_vblank_count(&crtc->base),
  

• 		msecs_to_jiffies(50));
  

• WARN(!lret, "pipe %c vblank wait timed out\n", pipe_name(pipe));
  

• drm_crtc_vblank_put(&crtc->base);
  

• }

-}

-static bool needs_vblank_wait(struct intel_crtc_state *crtc_state) -{

• /* fb updated, need to unpin old fb */
• if (crtc_state->fb_changed)

• return true;
  

• /* wm changes, need vblank before final wm's */
• if (crtc_state->update_wm_post)

• return true;
  

• if (crtc_state->wm.need_postvbl_update)

• return true;
  

• return false;

-}

static void intel_update_crtc(struct drm_crtc *crtc, struct drm_atomic_state *state, struct drm_crtc_state *old_crtc_state,

• 	      struct drm_crtc_state *new_crtc_state,
  

• 	      unsigned int *crtc_vblank_mask)
  

• 	      struct drm_crtc_state *new_crtc_state)
  

{ struct drm_device *dev = crtc->dev; struct drm_i915_private *dev_priv = to_i915(dev); @@ -12203,13 +12140,9 @@ static void intel_update_crtc(struct drm_crtc *crtc, }

drm_atomic_helper_commit_planes_on_crtc(old_crtc_state);

• if (needs_vblank_wait(pipe_config))

• *crtc_vblank_mask |= drm_crtc_mask(crtc);
  

}

-static void intel_update_crtcs(struct drm_atomic_state *state,

• 	       unsigned int *crtc_vblank_mask)
  

+static void intel_update_crtcs(struct drm_atomic_state *state) { struct drm_crtc *crtc; struct drm_crtc_state *old_crtc_state, *new_crtc_state; @@ -12220,12 +12153,11 @@ static void intel_update_crtcs(struct drm_atomic_state *state, continue;

intel_update_crtc(crtc, state, old_crtc_state,

• 		  new_crtc_state, crtc_vblank_mask);
  

• 		  new_crtc_state);
  

  }

}

-static void skl_update_crtcs(struct drm_atomic_state *state,

• 	     unsigned int *crtc_vblank_mask)
  

+static void skl_update_crtcs(struct drm_atomic_state *state) { struct drm_i915_private *dev_priv = to_i915(state->dev); struct intel_atomic_state *intel_state = to_intel_atomic_state(state); @@ -12284,7 +12216,7 @@ static void skl_update_crtcs(struct drm_atomic_state *state, vbl_wait = true;

	intel_update_crtc(crtc, state, old_crtc_state,

• 			  new_crtc_state, crtc_vblank_mask);
  

• 			  new_crtc_state);
  
  if (vbl_wait)
  	intel_wait_for_vblank(dev_priv, pipe);
  

@@ -12346,7 +12278,6 @@ static void intel_atomic_commit_tail(struct drm_atomic_state *state) struct intel_crtc_state *intel_cstate; bool hw_check = intel_state->modeset; u64 put_domains[I915_MAX_PIPES] = {};

• unsigned crtc_vblank_mask = 0; int i;

  intel_atomic_commit_fence_wait(intel_state);

@@ -12438,7 +12369,7 @@ static void intel_atomic_commit_tail(struct drm_atomic_state *state) pm_qos_update_request(&dev_priv->pm_qos_atomic, 0);

/* Now enable the clocks, plane, pipe, and connectors that we set up. */

• dev_priv->display.update_crtcs(state, &crtc_vblank_mask);

• dev_priv->display.update_crtcs(state);

  /* FIXME: We should call drm_atomic_helper_commit_hw_done() here

  • already, but still need the state for the delayed optimization. To

@@ -12450,7 +12381,7 @@ static void intel_atomic_commit_tail(struct drm_atomic_state *state) * we don't need out special handling any more. */ if (!state->legacy_cursor_update)

I think this if is dead code, since either we use the fastpath in intel_legacy_cursor_update, which means no atomic commit. Or we don't, and then we clear this hack (on most platforms at least) since it just wreaks complete havoc.

We should probably do this logic in the async helpers, i.e. if async helpers reject a cursor update, clear state->legacy_cursor_update.

Since I think we don't necessarily need this patch in this series, I think it'd be better in a separate series to straighten out the async_update story. Which would then include moving i915 over to the core support.

Erm, not sure what you mean here, isn't state->legacy_cursor_update mostly false, which means in most cases we'll wait?

~Maarten

Op 30-08-17 om 15:40 schreef Daniel Vetter:

On Wed, Aug 30, 2017 at 02:54:28PM +0200, Maarten Lankhorst wrote:

...

Op 30-08-17 om 14:43 schreef Daniel Vetter:

...

On Wed, Aug 30, 2017 at 02:17:48PM +0200, Maarten Lankhorst wrote:

...

The next commit removes the wait for flip_done in in drm_atomic_helper_commit_cleanup_done, but we need it for the tests to pass. Instead of using complicated vblank tracking which ends up being ignored anyway, call the correct atomic helper. :)

RFC because I'm not completely sure what we want to do with the vblank waiting, I think for now this patch is the right way to go until we decide because it preserves the status quo when drm_crtc_commit was introduced.

Signed-off-by: Maarten Lankhorst maarten.lankhorst@linux.intel.com

drivers/gpu/drm/i915/i915_drv.h | 3 +- drivers/gpu/drm/i915/intel_display.c | 83 +++--------------------------------- 2 files changed, 8 insertions(+), 78 deletions(-)

diff --git a/drivers/gpu/drm/i915/i915_drv.h b/drivers/gpu/drm/i915/i915_drv.h index cbbafbfb0a55..de19621864a9 100644 --- a/drivers/gpu/drm/i915/i915_drv.h +++ b/drivers/gpu/drm/i915/i915_drv.h @@ -707,8 +707,7 @@ struct drm_i915_display_funcs { struct drm_atomic_state *old_state); void (*crtc_disable)(struct intel_crtc_state *old_crtc_state, struct drm_atomic_state *old_state);

• void (*update_crtcs)(struct drm_atomic_state *state,

• 	     unsigned int *crtc_vblank_mask);
  

• void (*update_crtcs)(struct drm_atomic_state *state); void (*audio_codec_enable)(struct drm_connector *connector, struct intel_encoder *encoder, const struct drm_display_mode *adjusted_mode);

diff --git a/drivers/gpu/drm/i915/intel_display.c b/drivers/gpu/drm/i915/intel_display.c index 52c73b4dabaa..3f3cb96aa11e 100644 --- a/drivers/gpu/drm/i915/intel_display.c +++ b/drivers/gpu/drm/i915/intel_display.c @@ -12114,73 +12114,10 @@ u32 intel_crtc_get_vblank_counter(struct intel_crtc *crtc) return dev->driver->get_vblank_counter(dev, crtc->pipe); }

-static void intel_atomic_wait_for_vblanks(struct drm_device *dev,

• 			  struct drm_i915_private *dev_priv,
  

• 			  unsigned crtc_mask)
  

-{

• unsigned last_vblank_count[I915_MAX_PIPES];
• enum pipe pipe;
• int ret;
• if (!crtc_mask)

• return;
  

• for_each_pipe(dev_priv, pipe) {

• struct intel_crtc *crtc = intel_get_crtc_for_pipe(dev_priv,
  

• 						  pipe);
  

• if (!((1 << pipe) & crtc_mask))
  

• 	continue;
  

• ret = drm_crtc_vblank_get(&crtc->base);
  

• if (WARN_ON(ret != 0)) {
  

• 	crtc_mask &= ~(1 << pipe);
  

• 	continue;
  

• }
  

• last_vblank_count[pipe] = drm_crtc_vblank_count(&crtc->base);
  

• }
• for_each_pipe(dev_priv, pipe) {

• struct intel_crtc *crtc = intel_get_crtc_for_pipe(dev_priv,
  

• 						  pipe);
  

• long lret;
  

• if (!((1 << pipe) & crtc_mask))
  

• 	continue;
  

• lret = wait_event_timeout(dev->vblank[pipe].queue,
  

• 		last_vblank_count[pipe] !=
  

• 			drm_crtc_vblank_count(&crtc->base),
  

• 		msecs_to_jiffies(50));
  

• WARN(!lret, "pipe %c vblank wait timed out\n", pipe_name(pipe));
  

• drm_crtc_vblank_put(&crtc->base);
  

• }

-}

-static bool needs_vblank_wait(struct intel_crtc_state *crtc_state) -{

• /* fb updated, need to unpin old fb */
• if (crtc_state->fb_changed)

• return true;
  

• /* wm changes, need vblank before final wm's */
• if (crtc_state->update_wm_post)

• return true;
  

• if (crtc_state->wm.need_postvbl_update)

• return true;
  

• return false;

-}

static void intel_update_crtc(struct drm_crtc *crtc, struct drm_atomic_state *state, struct drm_crtc_state *old_crtc_state,

• 	      struct drm_crtc_state *new_crtc_state,
  

• 	      unsigned int *crtc_vblank_mask)
  

• 	      struct drm_crtc_state *new_crtc_state)
  

{ struct drm_device *dev = crtc->dev; struct drm_i915_private *dev_priv = to_i915(dev); @@ -12203,13 +12140,9 @@ static void intel_update_crtc(struct drm_crtc *crtc, }

drm_atomic_helper_commit_planes_on_crtc(old_crtc_state);

• if (needs_vblank_wait(pipe_config))

• *crtc_vblank_mask |= drm_crtc_mask(crtc);
  

}

-static void intel_update_crtcs(struct drm_atomic_state *state,

• 	       unsigned int *crtc_vblank_mask)
  

+static void intel_update_crtcs(struct drm_atomic_state *state) { struct drm_crtc *crtc; struct drm_crtc_state *old_crtc_state, *new_crtc_state; @@ -12220,12 +12153,11 @@ static void intel_update_crtcs(struct drm_atomic_state *state, continue;

intel_update_crtc(crtc, state, old_crtc_state,

• 		  new_crtc_state, crtc_vblank_mask);
  

• 		  new_crtc_state);
  

  }

}

-static void skl_update_crtcs(struct drm_atomic_state *state,

• 	     unsigned int *crtc_vblank_mask)
  

+static void skl_update_crtcs(struct drm_atomic_state *state) { struct drm_i915_private *dev_priv = to_i915(state->dev); struct intel_atomic_state *intel_state = to_intel_atomic_state(state); @@ -12284,7 +12216,7 @@ static void skl_update_crtcs(struct drm_atomic_state *state, vbl_wait = true;

	intel_update_crtc(crtc, state, old_crtc_state,

• 			  new_crtc_state, crtc_vblank_mask);
  

• 			  new_crtc_state);
  
  if (vbl_wait)
  	intel_wait_for_vblank(dev_priv, pipe);
  

@@ -12346,7 +12278,6 @@ static void intel_atomic_commit_tail(struct drm_atomic_state *state) struct intel_crtc_state *intel_cstate; bool hw_check = intel_state->modeset; u64 put_domains[I915_MAX_PIPES] = {};

• unsigned crtc_vblank_mask = 0; int i;

  intel_atomic_commit_fence_wait(intel_state);

@@ -12438,7 +12369,7 @@ static void intel_atomic_commit_tail(struct drm_atomic_state *state) pm_qos_update_request(&dev_priv->pm_qos_atomic, 0);

/* Now enable the clocks, plane, pipe, and connectors that we set up. */

• dev_priv->display.update_crtcs(state, &crtc_vblank_mask);

• dev_priv->display.update_crtcs(state);

  /* FIXME: We should call drm_atomic_helper_commit_hw_done() here

  • already, but still need the state for the delayed optimization. To

@@ -12450,7 +12381,7 @@ static void intel_atomic_commit_tail(struct drm_atomic_state *state) * we don't need out special handling any more. */ if (!state->legacy_cursor_update)

I think this if is dead code, since either we use the fastpath in intel_legacy_cursor_update, which means no atomic commit. Or we don't, and then we clear this hack (on most platforms at least) since it just wreaks complete havoc.

We should probably do this logic in the async helpers, i.e. if async helpers reject a cursor update, clear state->legacy_cursor_update.

Since I think we don't necessarily need this patch in this series, I think it'd be better in a separate series to straighten out the async_update story. Which would then include moving i915 over to the core support.

Erm, not sure what you mean here, isn't state->legacy_cursor_update mostly false, which means in most cases we'll wait?

Yup. And the few cases where it's true should be handled by the fastpath/async plane update logic. Would allow us to ditch a few conditions all over the code. -Daniel

I've done some more tests, and it seems this patch is required.

Without this we may not always wait, and that could result in spurious failures of page flip with -EBUSY. I'd love to hide this from userspace, but I don't think that's possible yet. It's best to always call drm_atomic_helper_wait_for_flip_done() for now. It's a noop for legacy_cursor_update anyway. commit->flip_done is always set early.

~Maarten

Op 04-09-17 om 09:30 schreef Daniel Vetter:

On Thu, Aug 31, 2017 at 05:18:06PM +0200, Maarten Lankhorst wrote:

...

Op 30-08-17 om 15:40 schreef Daniel Vetter:

...

On Wed, Aug 30, 2017 at 02:54:28PM +0200, Maarten Lankhorst wrote:

...

Op 30-08-17 om 14:43 schreef Daniel Vetter:

...

On Wed, Aug 30, 2017 at 02:17:48PM +0200, Maarten Lankhorst wrote:

...

The next commit removes the wait for flip_done in in drm_atomic_helper_commit_cleanup_done, but we need it for the tests to pass. Instead of using complicated vblank tracking which ends up being ignored anyway, call the correct atomic helper. :)

RFC because I'm not completely sure what we want to do with the vblank waiting, I think for now this patch is the right way to go until we decide because it preserves the status quo when drm_crtc_commit was introduced.

Signed-off-by: Maarten Lankhorst maarten.lankhorst@linux.intel.com

drivers/gpu/drm/i915/i915_drv.h | 3 +- drivers/gpu/drm/i915/intel_display.c | 83 +++--------------------------------- 2 files changed, 8 insertions(+), 78 deletions(-)

diff --git a/drivers/gpu/drm/i915/i915_drv.h b/drivers/gpu/drm/i915/i915_drv.h index cbbafbfb0a55..de19621864a9 100644 --- a/drivers/gpu/drm/i915/i915_drv.h +++ b/drivers/gpu/drm/i915/i915_drv.h @@ -707,8 +707,7 @@ struct drm_i915_display_funcs { struct drm_atomic_state *old_state); void (*crtc_disable)(struct intel_crtc_state *old_crtc_state, struct drm_atomic_state *old_state);

• void (*update_crtcs)(struct drm_atomic_state *state,

• 	     unsigned int *crtc_vblank_mask);
  

• void (*update_crtcs)(struct drm_atomic_state *state); void (*audio_codec_enable)(struct drm_connector *connector, struct intel_encoder *encoder, const struct drm_display_mode *adjusted_mode);

diff --git a/drivers/gpu/drm/i915/intel_display.c b/drivers/gpu/drm/i915/intel_display.c index 52c73b4dabaa..3f3cb96aa11e 100644 --- a/drivers/gpu/drm/i915/intel_display.c +++ b/drivers/gpu/drm/i915/intel_display.c @@ -12114,73 +12114,10 @@ u32 intel_crtc_get_vblank_counter(struct intel_crtc *crtc) return dev->driver->get_vblank_counter(dev, crtc->pipe); }

-static void intel_atomic_wait_for_vblanks(struct drm_device *dev,

• 			  struct drm_i915_private *dev_priv,
  

• 			  unsigned crtc_mask)
  

-{

• unsigned last_vblank_count[I915_MAX_PIPES];
• enum pipe pipe;
• int ret;
• if (!crtc_mask)

• return;
  

• for_each_pipe(dev_priv, pipe) {

• struct intel_crtc *crtc = intel_get_crtc_for_pipe(dev_priv,
  

• 						  pipe);
  

• if (!((1 << pipe) & crtc_mask))
  

• 	continue;
  

• ret = drm_crtc_vblank_get(&crtc->base);
  

• if (WARN_ON(ret != 0)) {
  

• 	crtc_mask &= ~(1 << pipe);
  

• 	continue;
  

• }
  

• last_vblank_count[pipe] = drm_crtc_vblank_count(&crtc->base);
  

• }
• for_each_pipe(dev_priv, pipe) {

• struct intel_crtc *crtc = intel_get_crtc_for_pipe(dev_priv,
  

• 						  pipe);
  

• long lret;
  

• if (!((1 << pipe) & crtc_mask))
  

• 	continue;
  

• lret = wait_event_timeout(dev->vblank[pipe].queue,
  

• 		last_vblank_count[pipe] !=
  

• 			drm_crtc_vblank_count(&crtc->base),
  

• 		msecs_to_jiffies(50));
  

• WARN(!lret, "pipe %c vblank wait timed out\n", pipe_name(pipe));
  

• drm_crtc_vblank_put(&crtc->base);
  

• }

-}

-static bool needs_vblank_wait(struct intel_crtc_state *crtc_state) -{

• /* fb updated, need to unpin old fb */
• if (crtc_state->fb_changed)

• return true;
  

• /* wm changes, need vblank before final wm's */
• if (crtc_state->update_wm_post)

• return true;
  

• if (crtc_state->wm.need_postvbl_update)

• return true;
  

• return false;

-}

static void intel_update_crtc(struct drm_crtc *crtc, struct drm_atomic_state *state, struct drm_crtc_state *old_crtc_state,

• 	      struct drm_crtc_state *new_crtc_state,
  

• 	      unsigned int *crtc_vblank_mask)
  

• 	      struct drm_crtc_state *new_crtc_state)
  

{ struct drm_device *dev = crtc->dev; struct drm_i915_private *dev_priv = to_i915(dev); @@ -12203,13 +12140,9 @@ static void intel_update_crtc(struct drm_crtc *crtc, }

drm_atomic_helper_commit_planes_on_crtc(old_crtc_state);

• if (needs_vblank_wait(pipe_config))

• *crtc_vblank_mask |= drm_crtc_mask(crtc);
  

}

-static void intel_update_crtcs(struct drm_atomic_state *state,

• 	       unsigned int *crtc_vblank_mask)
  

+static void intel_update_crtcs(struct drm_atomic_state *state) { struct drm_crtc *crtc; struct drm_crtc_state *old_crtc_state, *new_crtc_state; @@ -12220,12 +12153,11 @@ static void intel_update_crtcs(struct drm_atomic_state *state, continue;

intel_update_crtc(crtc, state, old_crtc_state,

• 		  new_crtc_state, crtc_vblank_mask);
  

• 		  new_crtc_state);
  

  }

}

-static void skl_update_crtcs(struct drm_atomic_state *state,

• 	     unsigned int *crtc_vblank_mask)
  

+static void skl_update_crtcs(struct drm_atomic_state *state) { struct drm_i915_private *dev_priv = to_i915(state->dev); struct intel_atomic_state *intel_state = to_intel_atomic_state(state); @@ -12284,7 +12216,7 @@ static void skl_update_crtcs(struct drm_atomic_state *state, vbl_wait = true;

	intel_update_crtc(crtc, state, old_crtc_state,

• 			  new_crtc_state, crtc_vblank_mask);
  

• 			  new_crtc_state);
  
  if (vbl_wait)
  	intel_wait_for_vblank(dev_priv, pipe);
  

@@ -12346,7 +12278,6 @@ static void intel_atomic_commit_tail(struct drm_atomic_state *state) struct intel_crtc_state *intel_cstate; bool hw_check = intel_state->modeset; u64 put_domains[I915_MAX_PIPES] = {};

• unsigned crtc_vblank_mask = 0; int i;

  intel_atomic_commit_fence_wait(intel_state);

@@ -12438,7 +12369,7 @@ static void intel_atomic_commit_tail(struct drm_atomic_state *state) pm_qos_update_request(&dev_priv->pm_qos_atomic, 0);

/* Now enable the clocks, plane, pipe, and connectors that we set up. */

• dev_priv->display.update_crtcs(state, &crtc_vblank_mask);

• dev_priv->display.update_crtcs(state);

  /* FIXME: We should call drm_atomic_helper_commit_hw_done() here

  • already, but still need the state for the delayed optimization. To

@@ -12450,7 +12381,7 @@ static void intel_atomic_commit_tail(struct drm_atomic_state *state) * we don't need out special handling any more. */ if (!state->legacy_cursor_update)

I think this if is dead code, since either we use the fastpath in intel_legacy_cursor_update, which means no atomic commit. Or we don't, and then we clear this hack (on most platforms at least) since it just wreaks complete havoc.

We should probably do this logic in the async helpers, i.e. if async helpers reject a cursor update, clear state->legacy_cursor_update.

Since I think we don't necessarily need this patch in this series, I think it'd be better in a separate series to straighten out the async_update story. Which would then include moving i915 over to the core support.

Erm, not sure what you mean here, isn't state->legacy_cursor_update mostly false, which means in most cases we'll wait?

Yup. And the few cases where it's true should be handled by the fastpath/async plane update logic. Would allow us to ditch a few conditions all over the code. -Daniel

I've done some more tests, and it seems this patch is required.

Without this we may not always wait, and that could result in spurious failures of page flip with -EBUSY. I'd love to hide this from userspace, but I don't think that's possible yet. It's best to always call drm_atomic_helper_wait_for_flip_done() for now. It's a noop for legacy_cursor_update anyway. commit->flip_done is always set early.

I think we have a mistunderstanding here, I meant to say that you should imo remove the if (state->legacy_cursor_update) check and call the wait_for_flips_done helper unconditionally, not remove the call to the function itself. That should work, and since we have a separate cursor fastpath, also not cause troubles.

True. The if is even a noop because setup_commit completes flip_done immediately.. Should be harmless to remove..

~Maarten

Op 30-08-17 om 15:09 schreef Laurent Pinchart:

Hi Maarten,

Thank you for the patch.

On Wednesday, 30 August 2017 15:17:50 EEST Maarten Lankhorst wrote:

...

Most code only cares about the current commit or previous commit. Fortuantely we already have a place to track those. Move it to drm_crtc_state where it belongs. :)

The per-crtc commit_list is kept for places where we have to look deeper than the current or previous commit for checking whether to stall on unpin. This is used in drm_atomic_helper_setup_commit and intel_has_pending_fb_unpin.

Changes since v1:

• Update kerneldoc for drm_crtc.commit_list. (danvet)

Signed-off-by: Maarten Lankhorst maarten.lankhorst@linux.intel.com Reviewed-by: Daniel Vetter daniel.vetter@ffwll.ch

---

drivers/gpu/drm/drm_atomic.c | 7 --- drivers/gpu/drm/drm_atomic_helper.c | 92 +++++++++------------------------- include/drm/drm_atomic.h | 1 - include/drm/drm_crtc.h | 23 ++++++++-- 4 files changed, 42 insertions(+), 81 deletions(-)

diff --git a/drivers/gpu/drm/drm_atomic.c b/drivers/gpu/drm/drm_atomic.c index 2fd383d7253a..2cce48f203e0 100644 --- a/drivers/gpu/drm/drm_atomic.c +++ b/drivers/gpu/drm/drm_atomic.c @@ -163,13 +163,6 @@ void drm_atomic_state_default_clear(struct drm_atomic_state *state) crtc->funcs->atomic_destroy_state(crtc, state->crtcs[i].state);

• if (state->crtcs[i].commit) {
  

• 	kfree(state->crtcs[i].commit->event);
  

• 	state->crtcs[i].commit->event = NULL;
  

• 	drm_crtc_commit_put(state->crtcs[i].commit);
  

• }
  

• state->crtcs[i].commit = NULL;
  

  state->crtcs[i].ptr = NULL; state->crtcs[i].state = NULL; }

diff --git a/drivers/gpu/drm/drm_atomic_helper.c b/drivers/gpu/drm/drm_atomic_helper.c index 11d0e94a2181..8ccb8b6536c0 100644 --- a/drivers/gpu/drm/drm_atomic_helper.c +++ b/drivers/gpu/drm/drm_atomic_helper.c @@ -1262,12 +1262,12 @@ EXPORT_SYMBOL(drm_atomic_helper_wait_for_vblanks); void drm_atomic_helper_wait_for_flip_done(struct drm_device *dev, struct drm_atomic_state *old_state) {

• struct drm_crtc_state *unused;

• struct drm_crtc_state *new_crtc_state; struct drm_crtc *crtc; int i;

• for_each_new_crtc_in_state(old_state, crtc, unused, i) {

• struct drm_crtc_commit *commit = old_state->crtcs[i].commit;
  

• for_each_new_crtc_in_state(old_state, crtc, new_crtc_state, i) {

• struct drm_crtc_commit *commit = new_crtc_state->commit;
  

  int ret;

  if (!commit)

@@ -1388,11 +1388,10 @@ int drm_atomic_helper_async_check(struct drm_device *dev, { struct drm_crtc *crtc; struct drm_crtc_state *crtc_state;

• struct drm_crtc_commit *commit; struct drm_plane *__plane, *plane = NULL; struct drm_plane_state *__plane_state, *plane_state = NULL; const struct drm_plane_helper_funcs *funcs;
• int i, j, n_planes = 0;

• int i, n_planes = 0;

  for_each_new_crtc_in_state(state, crtc, crtc_state, i) { if (drm_atomic_crtc_needs_modeset(crtc_state))

@@ -1420,33 +1419,10 @@ int drm_atomic_helper_async_check(struct drm_device *dev, return -EINVAL;

/*

• * Don't do an async update if there is an outstanding commit modifying
  

• * TODO: Don't do an async update if there is an outstanding commit
  

modifying * the plane. This prevents our async update's changes from getting * overridden by a previous synchronous update's state. */

As mentioned in a comment to your previous patch, this is unrelated to $SUBJECT. You should mention and explain this change in the commit message (possibly splitting it out in a separate commit if you think that would make more sense, up to you).

I'm all for removing this, it doesn't work.. But I g uess it can be kept in for now and I'll drop this hunk.

On Wed, Aug 30, 2017 at 02:17:51PM +0200, Maarten Lankhorst wrote:

Currently we neatly track the crtc state, but forget to look at plane/connector state.

When doing a nonblocking modeset, immediately followed by a setprop before the modeset completes, the setprop will see the modesets new state as the old state and free it.

This has to be solved by waiting for hw_done on the connector, even if it's not assigned to a crtc. When a connector is unbound we take the last crtc commit, and when it stays unbound we create a new fake crtc commit for that gets signaled on hw_done for all the planes/connectors.

We wait for it the same way as we do for crtc's, which will make sure we never run into a use-after-free situation.

Changes since v1:

• Only create a single disable commit. (danvet)
• Fix leak in intel_legacy_cursor_update.

Signed-off-by: Maarten Lankhorst maarten.lankhorst@linux.intel.com Testcase: kms_atomic_transition.plane-use-after-nonblocking-unbind* Cc: Laurent Pinchart laurent.pinchart@ideasonboard.com

---

drivers/gpu/drm/drm_atomic.c | 4 + drivers/gpu/drm/drm_atomic_helper.c | 156 +++++++++++++++++++++++++++++++++-- drivers/gpu/drm/i915/intel_display.c | 2 + include/drm/drm_atomic.h | 12 +++ include/drm/drm_connector.h | 7 ++ include/drm/drm_plane.h | 7 ++ 6 files changed, 182 insertions(+), 6 deletions(-)

diff --git a/drivers/gpu/drm/drm_atomic.c b/drivers/gpu/drm/drm_atomic.c index 2cce48f203e0..75f5f74de9bf 100644 --- a/drivers/gpu/drm/drm_atomic.c +++ b/drivers/gpu/drm/drm_atomic.c @@ -192,6 +192,10 @@ void drm_atomic_state_default_clear(struct drm_atomic_state *state) } state->num_private_objs = 0;

• if (state->fake_commit) {

• drm_crtc_commit_put(state->fake_commit);
  

• state->fake_commit = NULL;
  

• }

} EXPORT_SYMBOL(drm_atomic_state_default_clear);

diff --git a/drivers/gpu/drm/drm_atomic_helper.c b/drivers/gpu/drm/drm_atomic_helper.c index 8ccb8b6536c0..034f563fb130 100644 --- a/drivers/gpu/drm/drm_atomic_helper.c +++ b/drivers/gpu/drm/drm_atomic_helper.c @@ -1644,6 +1644,40 @@ static void release_crtc_commit(struct completion *completion) drm_crtc_commit_put(commit); }

+static void init_commit(struct drm_crtc_commit *commit, struct drm_crtc *crtc) +{

• init_completion(&commit->flip_done);
• init_completion(&commit->hw_done);
• init_completion(&commit->cleanup_done);
• INIT_LIST_HEAD(&commit->commit_entry);
• kref_init(&commit->ref);
• commit->crtc = crtc;

+}

+static struct drm_crtc_commit * +fake_or_crtc_commit(struct drm_atomic_state *state, struct drm_crtc *crtc) +{

• struct drm_crtc_commit *commit;
• if (crtc) {

• struct drm_crtc_state *new_crtc_state;
  

• new_crtc_state = drm_atomic_get_new_crtc_state(state, crtc);
  

• commit = new_crtc_state->commit;
  

• } else if (!state->fake_commit) {

• state->fake_commit = commit = kzalloc(sizeof(*commit), GFP_KERNEL);
  

• if (!commit)
  

• 	return NULL;
  

• init_commit(commit, NULL);
  

• } else

• commit = state->fake_commit;
  

• drm_crtc_commit_get(commit);

Double refcount for the case where you call init_commit? Aka I think this leaks.

• return commit;

+}

/**

• drm_atomic_helper_setup_commit - setup possibly nonblocking commit
• @state: new modeset state to be committed

@@ -1692,6 +1726,10 @@ int drm_atomic_helper_setup_commit(struct drm_atomic_state *state, { struct drm_crtc *crtc; struct drm_crtc_state *old_crtc_state, *new_crtc_state;

• struct drm_connector *conn;
• struct drm_connector_state *old_conn_state, *new_conn_state;
• struct drm_plane *plane;
• struct drm_plane_state *old_plane_state, *new_plane_state; struct drm_crtc_commit *commit; int i, ret;

@@ -1700,12 +1738,7 @@ int drm_atomic_helper_setup_commit(struct drm_atomic_state *state, if (!commit) return -ENOMEM;

• init_completion(&commit->flip_done);
  

• init_completion(&commit->hw_done);
  

• init_completion(&commit->cleanup_done);
  

• INIT_LIST_HEAD(&commit->commit_entry);
  

• kref_init(&commit->ref);
  

• commit->crtc = crtc;
  

• init_commit(commit, crtc);
  
  

  new_crtc_state->commit = commit;

@@ -1741,6 +1774,36 @@ int drm_atomic_helper_setup_commit(struct drm_atomic_state *state, drm_crtc_commit_get(commit); }

• for_each_oldnew_connector_in_state(state, conn, old_conn_state, new_conn_state, i) {

Maybe a commen there like /* commit tracked through the crtc_state->commit */ Feels at least a bit non-obvious how this works.

• if (new_conn_state->crtc)
  

• 	continue;
  

Please add the

/* Userspace is not allowed to get ahead of the previous * commit with nonblocking ones. */

comment from stall_checks here and below. Even better if we could extract this, but macro is ugly and functions wont work.

• if (nonblock && old_conn_state->commit &&
  

•     !try_wait_for_completion(&old_conn_state->commit->flip_done))
  

• 	return -EBUSY;
  

• commit = fake_or_crtc_commit(state, old_conn_state->crtc);
  

• if (!commit)
  

• 	return -ENOMEM;
  

• new_conn_state->commit = commit;
  

• }
• for_each_oldnew_plane_in_state(state, plane, old_plane_state, new_plane_state, i) {

• if (new_plane_state->crtc)
  

• 	continue;
  

• if (nonblock && old_plane_state->commit &&
  

•     !try_wait_for_completion(&old_plane_state->commit->flip_done))
  

• 	return -EBUSY;
  

• commit = fake_or_crtc_commit(state, old_plane_state->crtc);
  

• if (!commit)
  

• 	return -ENOMEM;
  

• new_plane_state->commit = commit;
  

• }
• return 0;

} EXPORT_SYMBOL(drm_atomic_helper_setup_commit); @@ -1761,6 +1824,10 @@ void drm_atomic_helper_wait_for_dependencies(struct drm_atomic_state *old_state) { struct drm_crtc *crtc; struct drm_crtc_state *old_crtc_state;

• struct drm_plane *plane;
• struct drm_plane_state *old_plane_state;
• struct drm_connector *conn;
• struct drm_connector_state *old_conn_state; struct drm_crtc_commit *commit; int i; long ret;

@@ -1785,6 +1852,48 @@ void drm_atomic_helper_wait_for_dependencies(struct drm_atomic_state *old_state) DRM_ERROR("[CRTC:%d:%s] flip_done timed out\n", crtc->base.id, crtc->name); }

• for_each_old_connector_in_state(old_state, conn, old_conn_state, i) {

• commit = old_conn_state->commit;
  

• if (!commit)
  

• 	continue;
  

• ret = wait_for_completion_timeout(&commit->hw_done,
  

• 				  10*HZ);
  

• if (ret == 0)
  

• 	DRM_ERROR("[CONNECTOR:%d:%s] hw_done timed out\n",
  

• 		  conn->base.id, conn->name);
  

• /* Currently no support for overwriting flips, hence
  

•  * stall for previous one to execute completely. */
  

• ret = wait_for_completion_timeout(&commit->flip_done,
  

• 				  10*HZ);
  

• if (ret == 0)
  

• 	DRM_ERROR("[CONNECTOR:%d:%s] flip_done timed out\n",
  

• 		  conn->base.id, conn->name);
  

• }
• for_each_old_plane_in_state(old_state, plane, old_plane_state, i) {

• commit = old_plane_state->commit;
  

• if (!commit)
  

• 	continue;
  

• ret = wait_for_completion_timeout(&commit->hw_done,
  

• 				  10*HZ);
  

• if (ret == 0)
  

• 	DRM_ERROR("[PLANE:%d:%s] hw_done timed out\n",
  

• 		  plane->base.id, plane->name);
  

• /* Currently no support for overwriting flips, hence
  

•  * stall for previous one to execute completely. */
  

• ret = wait_for_completion_timeout(&commit->flip_done,
  

• 				  10*HZ);
  

• if (ret == 0)
  

• 	DRM_ERROR("[PLANE:%d:%s] flip_done timed out\n",
  

• 		  plane->base.id, plane->name);
  

• }

} EXPORT_SYMBOL(drm_atomic_helper_wait_for_dependencies);

@@ -1819,6 +1928,11 @@ void drm_atomic_helper_commit_hw_done(struct drm_atomic_state *old_state) WARN_ON(new_crtc_state->event); complete_all(&commit->hw_done); }

• if (old_state->fake_commit) {

• complete_all(&old_state->fake_commit->hw_done);
  

• complete_all(&old_state->fake_commit->flip_done);
  

• }

Just to avoid surprises, I think we should also complete_all(cleanup_done) on the fake commit in cleanup_done().

} EXPORT_SYMBOL(drm_atomic_helper_commit_hw_done);

@@ -2241,6 +2355,28 @@ int drm_atomic_helper_swap_state(struct drm_atomic_state *state, if (ret) return ret; }

• for_each_old_connector_in_state(state, connector, old_conn_state, i) {
  

• 	commit = old_conn_state->commit;
  

• 	if (!commit)
  

• 		continue;
  

• 	ret = wait_for_completion_interruptible(&commit->hw_done);
  

• 	if (ret)
  

• 		return ret;
  

• }
  

• for_each_old_plane_in_state(state, plane, old_plane_state, i) {
  

• 	commit = old_plane_state->commit;
  

• 	if (!commit)
  

• 		continue;
  

• 	ret = wait_for_completion_interruptible(&commit->hw_done);
  

• 	if (ret)
  

• 		return ret;
  

• }
  

  }

  for_each_oldnew_connector_in_state(state, connector, old_conn_state, new_conn_state, i) {

@@ -3223,6 +3359,7 @@ void __drm_atomic_helper_plane_duplicate_state(struct drm_plane *plane, drm_framebuffer_get(state->fb);

state->fence = NULL;

• state->commit = NULL;

} EXPORT_SYMBOL(__drm_atomic_helper_plane_duplicate_state);

@@ -3264,6 +3401,9 @@ void __drm_atomic_helper_plane_destroy_state(struct drm_plane_state *state)

if (state->fence) dma_fence_put(state->fence);

• if (state->commit)

• drm_crtc_commit_put(state->commit);
  

} EXPORT_SYMBOL(__drm_atomic_helper_plane_destroy_state);

@@ -3342,6 +3482,7 @@ __drm_atomic_helper_connector_duplicate_state(struct drm_connector *connector, memcpy(state, connector->state, sizeof(*state)); if (state->crtc) drm_connector_get(connector);

• state->commit = NULL;

} EXPORT_SYMBOL(__drm_atomic_helper_connector_duplicate_state);

@@ -3468,6 +3609,9 @@ __drm_atomic_helper_connector_destroy_state(struct drm_connector_state *state) { if (state->crtc) drm_connector_put(state->connector);

• if (state->commit)

• drm_crtc_commit_put(state->commit);
  

} EXPORT_SYMBOL(__drm_atomic_helper_connector_destroy_state);

diff --git a/drivers/gpu/drm/i915/intel_display.c b/drivers/gpu/drm/i915/intel_display.c index 3f3cb96aa11e..70ce02753177 100644 --- a/drivers/gpu/drm/i915/intel_display.c +++ b/drivers/gpu/drm/i915/intel_display.c @@ -13109,8 +13109,10 @@ intel_legacy_cursor_update(struct drm_plane *plane,

/* Swap plane state */ new_plane_state->fence = old_plane_state->fence;

• new_plane_state->commit = old_plane_state->commit; *to_intel_plane_state(old_plane_state) = *to_intel_plane_state(new_plane_state); new_plane_state->fence = NULL;
• new_plane_state->commit = NULL;

Would be good if we could switch to Gustavo's async work and push these tricks into shared code ...

new_plane_state->fb = old_fb; to_intel_plane_state(new_plane_state)->vma = NULL;

diff --git a/include/drm/drm_atomic.h b/include/drm/drm_atomic.h index e76d9f95c191..ba976f4a4938 100644 --- a/include/drm/drm_atomic.h +++ b/include/drm/drm_atomic.h @@ -236,6 +236,18 @@ struct drm_atomic_state { struct drm_modeset_acquire_ctx *acquire_ctx;

/**

• * @fake_commit:
  

• *
  

• * Used for signaling unbound planes/connectors.
  

• * When a connector or plane is not bound to any CRTC, it's still important
  

• * to preserve linearity to prevent the atomic states from being freed to early.
  

s/to early/too early/.

• *
  

• * This commit (if set) is not bound to any crtc, but will be completed when
  

• * drm_atomic_helper_commit_hw_done() is called.
  

... and drm_atomic_helper_cleanup_done() ...

• */
  

• struct drm_crtc_commit *fake_commit;
• /**
  • @commit_work:
  • Work item which can be used by the driver or helpers to execute the

diff --git a/include/drm/drm_connector.h b/include/drm/drm_connector.h index ea8da401c93c..8837649d16e8 100644 --- a/include/drm/drm_connector.h +++ b/include/drm/drm_connector.h @@ -347,6 +347,13 @@ struct drm_connector_state {

struct drm_atomic_state *state;

• /**

• * @commit: Tracks the pending commit to prevent use-after-free conditions.
  

• *
  

• * Is only set when @crtc is NULL.
  

• */
  

• struct drm_crtc_commit *commit;

• struct drm_tv_connector_state tv;

  /**

diff --git a/include/drm/drm_plane.h b/include/drm/drm_plane.h index 73f90f9d057f..7d96116fd4c4 100644 --- a/include/drm/drm_plane.h +++ b/include/drm/drm_plane.h @@ -123,6 +123,13 @@ struct drm_plane_state { */ bool visible;

• /**

• * @commit: Tracks the pending commit to prevent use-after-free conditions.
  

• *
  

• * Is only set when @crtc is NULL.
  

• */
  

• struct drm_crtc_commit *commit;
• struct drm_atomic_state *state;

};

With the above nits addressed:

Reviewed-by: Daniel Vetter daniel.vetter@ffwll.ch

-- 2.11.0

---

Intel-gfx mailing list Intel-gfx@lists.freedesktop.org https://lists.freedesktop.org/mailman/listinfo/intel-gfx

Hi Maarten,

Thank you for the patch.

On Wednesday, 30 August 2017 15:17:51 EEST Maarten Lankhorst wrote:

Currently we neatly track the crtc state, but forget to look at plane/connector state.

When doing a nonblocking modeset, immediately followed by a setprop before the modeset completes, the setprop will see the modesets new state as the old state and free it.

This has to be solved by waiting for hw_done on the connector, even if it's not assigned to a crtc. When a connector is unbound we take the last crtc commit, and when it stays unbound we create a new fake crtc commit for that gets signaled on hw_done for all the planes/connectors.

We wait for it the same way as we do for crtc's, which will make sure we never run into a use-after-free situation.

Changes since v1:

• Only create a single disable commit. (danvet)
• Fix leak in intel_legacy_cursor_update.

Signed-off-by: Maarten Lankhorst maarten.lankhorst@linux.intel.com Testcase: kms_atomic_transition.plane-use-after-nonblocking-unbind* Cc: Laurent Pinchart laurent.pinchart@ideasonboard.com

---

drivers/gpu/drm/drm_atomic.c | 4 + drivers/gpu/drm/drm_atomic_helper.c | 156 ++++++++++++++++++++++++++++++-- drivers/gpu/drm/i915/intel_display.c | 2 + include/drm/drm_atomic.h | 12 +++ include/drm/drm_connector.h | 7 ++ include/drm/drm_plane.h | 7 ++ 6 files changed, 182 insertions(+), 6 deletions(-)

diff --git a/drivers/gpu/drm/drm_atomic.c b/drivers/gpu/drm/drm_atomic.c index 2cce48f203e0..75f5f74de9bf 100644 --- a/drivers/gpu/drm/drm_atomic.c +++ b/drivers/gpu/drm/drm_atomic.c @@ -192,6 +192,10 @@ void drm_atomic_state_default_clear(struct drm_atomic_state *state) } state->num_private_objs = 0;

• if (state->fake_commit) {

• drm_crtc_commit_put(state->fake_commit);
  

• state->fake_commit = NULL;
  

• }

} EXPORT_SYMBOL(drm_atomic_state_default_clear);

diff --git a/drivers/gpu/drm/drm_atomic_helper.c b/drivers/gpu/drm/drm_atomic_helper.c index 8ccb8b6536c0..034f563fb130 100644 --- a/drivers/gpu/drm/drm_atomic_helper.c +++ b/drivers/gpu/drm/drm_atomic_helper.c @@ -1644,6 +1644,40 @@ static void release_crtc_commit(struct completion *completion) drm_crtc_commit_put(commit); }

+static void init_commit(struct drm_crtc_commit *commit, struct drm_crtc *crtc) +{

You could allocate the commit in this function too, the kzalloc() is currently duplicated. The function should probably be called alloc_commit() then.

• init_completion(&commit->flip_done);
• init_completion(&commit->hw_done);
• init_completion(&commit->cleanup_done);
• INIT_LIST_HEAD(&commit->commit_entry);
• kref_init(&commit->ref);
• commit->crtc = crtc;

+}

+static struct drm_crtc_commit * +fake_or_crtc_commit(struct drm_atomic_state *state, struct drm_crtc *crtc) +{

• struct drm_crtc_commit *commit;
• if (crtc) {

• struct drm_crtc_state *new_crtc_state;
  

• new_crtc_state = drm_atomic_get_new_crtc_state(state, crtc);
  

• commit = new_crtc_state->commit;
  

• } else if (!state->fake_commit) {

• state->fake_commit = commit = kzalloc(sizeof(*commit), GFP_KERNEL);
  

• if (!commit)
  

• 	return NULL;
  

• init_commit(commit, NULL);
  

• } else

• commit = state->fake_commit;
  

• drm_crtc_commit_get(commit);

I believe the reference counting is right. The double reference in the second case (kref_init() when initializing the commit and drm_crtc_commit_get()) should not cause a leak. The kref_init() takes a reference to store the commit in state->fake_commit, released in drm_atomic_state_default_clear(), and the drm_crtc_commit_get() takes a reference returned by the function, stored in new_*_state->commit by the caller.

This being said, I think the reference counting is confusing, as proved by Daniel thinking there was a leak here (or by me thinking there's no leak while there's one :-)). To make the implementation clearer, I propose turning the definition of drm_crtc_commit_get() to

static inline struct drm_crtc_commit * drm_crtc_commit_get(struct drm_crtc_commit *commit) { kref_get(&commit->ref); return commit; }

and writing this function as

/* Return a new reference to the commit object */ static struct drm_crtc_commit * fake_or_crtc_commit(struct drm_atomic_state *state, struct drm_crtc *crtc) { struct drm_crtc_commit *commit;

if (crtc) { struct drm_crtc_state *new_crtc_state;

new_crtc_state = drm_atomic_get_new_crtc_state(state, crtc);

commit = new_crtc_state->commit; } else { if (!state->fake_commit) state->fake_commit = alloc_commit(NULL);

commit = state->fake_commit; }

return drm_crtc_commit_get(commit); }

• return commit;

+}

/**

• drm_atomic_helper_setup_commit - setup possibly nonblocking commit
• @state: new modeset state to be committed

@@ -1692,6 +1726,10 @@ int drm_atomic_helper_setup_commit(struct drm_atomic_state *state, { struct drm_crtc *crtc; struct drm_crtc_state *old_crtc_state, *new_crtc_state;

• struct drm_connector *conn;
• struct drm_connector_state *old_conn_state, *new_conn_state;
• struct drm_plane *plane;
• struct drm_plane_state *old_plane_state, *new_plane_state; struct drm_crtc_commit *commit; int i, ret;

@@ -1700,12 +1738,7 @@ int drm_atomic_helper_setup_commit(struct drm_atomic_state *state, if (!commit) return -ENOMEM;

• init_completion(&commit->flip_done);
  

• init_completion(&commit->hw_done);
  

• init_completion(&commit->cleanup_done);
  

• INIT_LIST_HEAD(&commit->commit_entry);
  

• kref_init(&commit->ref);
  

• commit->crtc = crtc;
  

• init_commit(commit, crtc);
  
  

  new_crtc_state->commit = commit;

@@ -1741,6 +1774,36 @@ int drm_atomic_helper_setup_commit(struct drm_atomic_state *state, drm_crtc_commit_get(commit); }

• for_each_oldnew_connector_in_state(state, conn, old_conn_state,

new_conn_state, i) {

• if (new_conn_state->crtc)
  

• 	continue;
  

• if (nonblock && old_conn_state->commit &&
  

•     !try_wait_for_completion(&old_conn_state->commit->flip_done))
  

• 	return -EBUSY;
  

flip_done only, not hw_done ? A comment that explains why would be helpful.

• commit = fake_or_crtc_commit(state, old_conn_state->crtc);
  

• if (!commit)
  

• 	return -ENOMEM;
  

• new_conn_state->commit = commit;
  

• }
• for_each_oldnew_plane_in_state(state, plane, old_plane_state,

new_plane_state, i) {

• if (new_plane_state->crtc)
  

• 	continue;
  

• if (nonblock && old_plane_state->commit &&
  

•     !try_wait_for_completion(&old_plane_state->commit->flip_done))
  

• 	return -EBUSY;
  

Same here.

• commit = fake_or_crtc_commit(state, old_plane_state->crtc);
  

• if (!commit)
  

• 	return -ENOMEM;
  

• new_plane_state->commit = commit;
  

• }
• return 0;

} EXPORT_SYMBOL(drm_atomic_helper_setup_commit); @@ -1761,6 +1824,10 @@ void drm_atomic_helper_wait_for_dependencies(struct drm_atomic_state *old_state) { struct drm_crtc *crtc; struct drm_crtc_state *old_crtc_state;

• struct drm_plane *plane;
• struct drm_plane_state *old_plane_state;
• struct drm_connector *conn;
• struct drm_connector_state *old_conn_state; struct drm_crtc_commit *commit; int i; long ret;

@@ -1785,6 +1852,48 @@ void drm_atomic_helper_wait_for_dependencies(struct drm_atomic_state *old_state) DRM_ERROR("[CRTC:%d:%s] flip_done timed out\n", crtc->base.id, crtc->name); }

• for_each_old_connector_in_state(old_state, conn, old_conn_state, i) {

• commit = old_conn_state->commit;
  

• if (!commit)
  

• 	continue;
  

• ret = wait_for_completion_timeout(&commit->hw_done,
  

• 				  10*HZ);
  

• if (ret == 0)
  

• 	DRM_ERROR("[CONNECTOR:%d:%s] hw_done timed out\n",
  

• 		  conn->base.id, conn->name);
  

• /* Currently no support for overwriting flips, hence
  

•  * stall for previous one to execute completely. */
  

• ret = wait_for_completion_timeout(&commit->flip_done,
  

• 				  10*HZ);
  

• if (ret == 0)
  

• 	DRM_ERROR("[CONNECTOR:%d:%s] flip_done timed out\n",
  

• 		  conn->base.id, conn->name);
  

There's probably something I don't get, but given that the connector state -

commit pointer is only set for commits that have no CRTC, do we have a

guarantee that there will be a page flip to be signalled ? Can't we for instance disable a connector without a page flip ? Or set a property on an already disabled connector ?

• }
• for_each_old_plane_in_state(old_state, plane, old_plane_state, i) {

• commit = old_plane_state->commit;
  

• if (!commit)
  

• 	continue;
  

• ret = wait_for_completion_timeout(&commit->hw_done,
  

• 				  10*HZ);
  

• if (ret == 0)
  

• 	DRM_ERROR("[PLANE:%d:%s] hw_done timed out\n",
  

• 		  plane->base.id, plane->name);
  

• /* Currently no support for overwriting flips, hence
  

•  * stall for previous one to execute completely. */
  

• ret = wait_for_completion_timeout(&commit->flip_done,
  

• 				  10*HZ);
  

• if (ret == 0)
  

• 	DRM_ERROR("[PLANE:%d:%s] flip_done timed out\n",
  

• 		  plane->base.id, plane->name);
  

• }

} EXPORT_SYMBOL(drm_atomic_helper_wait_for_dependencies);

@@ -1819,6 +1928,11 @@ void drm_atomic_helper_commit_hw_done(struct drm_atomic_state *old_state) WARN_ON(new_crtc_state->event); complete_all(&commit->hw_done); }

• if (old_state->fake_commit) {

• complete_all(&old_state->fake_commit->hw_done);
  

• complete_all(&old_state->fake_commit->flip_done);
  

• }

} EXPORT_SYMBOL(drm_atomic_helper_commit_hw_done);

@@ -2241,6 +2355,28 @@ int drm_atomic_helper_swap_state(struct drm_atomic_state *state, if (ret) return ret; }

A comment would be helpful here too. In particular explaining why you wait on hw_done only isn't straightforward.

• for_each_old_connector_in_state(state, connector, old_conn_state, i) {
  

• 	commit = old_conn_state->commit;
  

• 	if (!commit)
  

• 		continue;
  

• 	ret = wait_for_completion_interruptible(&commit->hw_done);
  

• 	if (ret)
  

• 		return ret;
  

• }
  

• for_each_old_plane_in_state(state, plane, old_plane_state, i) {
  

• 	commit = old_plane_state->commit;
  

• 	if (!commit)
  

• 		continue;
  

• 	ret = wait_for_completion_interruptible(&commit->hw_done);
  

• 	if (ret)
  

• 		return ret;
  

• }
  

  }

  for_each_oldnew_connector_in_state(state, connector, old_conn_state,

new_conn_state, i) { @@ -3223,6 +3359,7 @@ void __drm_atomic_helper_plane_duplicate_state(struct drm_plane *plane, drm_framebuffer_get(state->fb);

state->fence = NULL;

• state->commit = NULL;

} EXPORT_SYMBOL(__drm_atomic_helper_plane_duplicate_state);

@@ -3264,6 +3401,9 @@ void __drm_atomic_helper_plane_destroy_state(struct drm_plane_state *state)

if (state->fence) dma_fence_put(state->fence);

• if (state->commit)

• drm_crtc_commit_put(state->commit);
  

} EXPORT_SYMBOL(__drm_atomic_helper_plane_destroy_state);

@@ -3342,6 +3482,7 @@ __drm_atomic_helper_connector_duplicate_state(struct drm_connector *connector, memcpy(state, connector->state, sizeof(*state)); if (state->crtc) drm_connector_get(connector);

• state->commit = NULL;

} EXPORT_SYMBOL(__drm_atomic_helper_connector_duplicate_state);

@@ -3468,6 +3609,9 @@ __drm_atomic_helper_connector_destroy_state(struct drm_connector_state *state) { if (state->crtc) drm_connector_put(state->connector);

• if (state->commit)

• drm_crtc_commit_put(state->commit);
  

} EXPORT_SYMBOL(__drm_atomic_helper_connector_destroy_state);

diff --git a/drivers/gpu/drm/i915/intel_display.c b/drivers/gpu/drm/i915/intel_display.c index 3f3cb96aa11e..70ce02753177 100644 --- a/drivers/gpu/drm/i915/intel_display.c +++ b/drivers/gpu/drm/i915/intel_display.c @@ -13109,8 +13109,10 @@ intel_legacy_cursor_update(struct drm_plane *plane,

/* Swap plane state */ new_plane_state->fence = old_plane_state->fence;

• new_plane_state->commit = old_plane_state->commit; *to_intel_plane_state(old_plane_state) =

*to_intel_plane_state(new_plane_state); new_plane_state->fence = NULL;

• new_plane_state->commit = NULL; new_plane_state->fb = old_fb; to_intel_plane_state(new_plane_state)->vma = NULL;

diff --git a/include/drm/drm_atomic.h b/include/drm/drm_atomic.h index e76d9f95c191..ba976f4a4938 100644 --- a/include/drm/drm_atomic.h +++ b/include/drm/drm_atomic.h @@ -236,6 +236,18 @@ struct drm_atomic_state { struct drm_modeset_acquire_ctx *acquire_ctx;

/**

• * @fake_commit:
  

• *
  

• * Used for signaling unbound planes/connectors.
  

• * When a connector or plane is not bound to any CRTC, it's still
  

important

• * to preserve linearity to prevent the atomic states from being freed to
  

early.

• *
  

• * This commit (if set) is not bound to any crtc, but will be completed
  

when

• * drm_atomic_helper_commit_hw_done() is called.
  

• */
  

• struct drm_crtc_commit *fake_commit;
• /**
  • @commit_work:
  • Work item which can be used by the driver or helpers to execute the

diff --git a/include/drm/drm_connector.h b/include/drm/drm_connector.h index ea8da401c93c..8837649d16e8 100644 --- a/include/drm/drm_connector.h +++ b/include/drm/drm_connector.h @@ -347,6 +347,13 @@ struct drm_connector_state {

struct drm_atomic_state *state;

• /**

• * @commit: Tracks the pending commit to prevent use-after-free
  

conditions.

• *
  

• * Is only set when @crtc is NULL.
  

• */
  

• struct drm_crtc_commit *commit;

• struct drm_tv_connector_state tv;

  /**

diff --git a/include/drm/drm_plane.h b/include/drm/drm_plane.h index 73f90f9d057f..7d96116fd4c4 100644 --- a/include/drm/drm_plane.h +++ b/include/drm/drm_plane.h @@ -123,6 +123,13 @@ struct drm_plane_state { */ bool visible;

• /**

• * @commit: Tracks the pending commit to prevent use-after-free
  

conditions.

• *
  

• * Is only set when @crtc is NULL.
  

• */
  

• struct drm_crtc_commit *commit;
• struct drm_atomic_state *state;

};

On Wednesday, 30 August 2017 17:17:36 EEST Daniel Vetter wrote:

On Wed, Aug 30, 2017 at 05:10:43PM +0300, Laurent Pinchart wrote:

...

Hi Maarten,

Thank you for the patch.

On Wednesday, 30 August 2017 15:17:51 EEST Maarten Lankhorst wrote:

...

Currently we neatly track the crtc state, but forget to look at plane/connector state.

When doing a nonblocking modeset, immediately followed by a setprop before the modeset completes, the setprop will see the modesets new state as the old state and free it.

This has to be solved by waiting for hw_done on the connector, even if it's not assigned to a crtc. When a connector is unbound we take the last crtc commit, and when it stays unbound we create a new fake crtc commit for that gets signaled on hw_done for all the planes/connectors.

We wait for it the same way as we do for crtc's, which will make sure we never run into a use-after-free situation.

Changes since v1:

• Only create a single disable commit. (danvet)
• Fix leak in intel_legacy_cursor_update.

Signed-off-by: Maarten Lankhorst maarten.lankhorst@linux.intel.com Testcase: kms_atomic_transition.plane-use-after-nonblocking-unbind* Cc: Laurent Pinchart laurent.pinchart@ideasonboard.com

---

drivers/gpu/drm/drm_atomic.c | 4 + drivers/gpu/drm/drm_atomic_helper.c | 156 ++++++++++++++++++++++++++++++-- drivers/gpu/drm/i915/intel_display.c | 2 + include/drm/drm_atomic.h | 12 +++ include/drm/drm_connector.h | 7 ++ include/drm/drm_plane.h | 7 ++ 6 files changed, 182 insertions(+), 6 deletions(-)

diff --git a/drivers/gpu/drm/drm_atomic.c b/drivers/gpu/drm/drm_atomic.c index 2cce48f203e0..75f5f74de9bf 100644 --- a/drivers/gpu/drm/drm_atomic.c +++ b/drivers/gpu/drm/drm_atomic.c @@ -192,6 +192,10 @@ void drm_atomic_state_default_clear(struct drm_atomic_state *state) }

state->num_private_objs = 0;

• if (state->fake_commit) {

• drm_crtc_commit_put(state->fake_commit);
  

• state->fake_commit = NULL;
  

• }

} EXPORT_SYMBOL(drm_atomic_state_default_clear);

diff --git a/drivers/gpu/drm/drm_atomic_helper.c b/drivers/gpu/drm/drm_atomic_helper.c index 8ccb8b6536c0..034f563fb130 100644 --- a/drivers/gpu/drm/drm_atomic_helper.c +++ b/drivers/gpu/drm/drm_atomic_helper.c @@ -1644,6 +1644,40 @@ static void release_crtc_commit(struct completion *completion) drm_crtc_commit_put(commit);

}

+static void init_commit(struct drm_crtc_commit *commit, struct drm_crtc *crtc) +{

You could allocate the commit in this function too, the kzalloc() is currently duplicated. The function should probably be called alloc_commit() then.>

...

• init_completion(&commit->flip_done);
• init_completion(&commit->hw_done);
• init_completion(&commit->cleanup_done);
• INIT_LIST_HEAD(&commit->commit_entry);
• kref_init(&commit->ref);
• commit->crtc = crtc;

+}

+static struct drm_crtc_commit * +fake_or_crtc_commit(struct drm_atomic_state *state, struct drm_crtc *crtc) +{

• struct drm_crtc_commit *commit;
• if (crtc) {

• struct drm_crtc_state *new_crtc_state;
  

• new_crtc_state = drm_atomic_get_new_crtc_state(state, crtc);
  

• commit = new_crtc_state->commit;
  

• } else if (!state->fake_commit) {

• state->fake_commit = commit = kzalloc(sizeof(*commit), 
  

GFP_KERNEL);

...

...

• if (!commit)
  

• 	return NULL;
  

• init_commit(commit, NULL);
  

• } else

• commit = state->fake_commit;
  

• drm_crtc_commit_get(commit);

I believe the reference counting is right. The double reference in the second case (kref_init() when initializing the commit and drm_crtc_commit_get()) should not cause a leak. The kref_init() takes a reference to store the commit in state->fake_commit, released in drm_atomic_state_default_clear(), and the drm_crtc_commit_get() takes a reference returned by the function, stored in new_*_state->commit by the caller.

This being said, I think the reference counting is confusing, as proved by Daniel thinking there was a leak here (or by me thinking there's no leak while there's one :-)). To make the implementation clearer, I propose turning the definition of drm_crtc_commit_get() to

static inline struct drm_crtc_commit * drm_crtc_commit_get(struct drm_crtc_commit *commit) {

kref_get(&commit->ref); return commit;

}

and writing this function as

/* Return a new reference to the commit object */ static struct drm_crtc_commit * fake_or_crtc_commit(struct drm_atomic_state *state, struct drm_crtc *crtc) {

struct drm_crtc_commit *commit;

if (crtc) {

struct drm_crtc_state *new_crtc_state;

new_crtc_state = drm_atomic_get_new_crtc_state(state, crtc); commit = new_crtc_state->commit;

} else {

if (!state->fake_commit)

state->fake_commit = alloc_commit(NULL); commit = state->fake_commit;

}

return drm_crtc_commit_get(commit);

}

+1 on something like this, the compressed layout with assigning both commit and ->fake_commit is what tricked me into seeing a leak.

What I think makes it clearer is to store the return value of functions returning a reference directly in the pointer that stores the reference. That's why I prefer

1. if (!state->fake_commit) 2. state->fake_commit = alloc_commit(NULL); 3. 4. commit = state->fake_commit;

Line 2 stores the pointer in an object that thus requires a reference, which is returned by alloc_commit(). Line 4 stores the pointer in a local variable, and thus doesn't require a reference.

On Wed, Aug 30, 2017 at 02:17:52PM +0200, Maarten Lankhorst wrote:

By always keeping track of the last commit in plane_state, we know whether there is an active update on the plane or not. With that information we can reject the fast update, and force the slowpath to be used as was originally intended.

Cc: Gustavo Padovan gustavo.padovan@collabora.com Signed-off-by: Maarten Lankhorst maarten.lankhorst@linux.intel.com

Makes sense, but I think like patch 1 it would be better to do this in a separate series. Which would then include a patch to move i915 over to the async plane support.

One more comment below.

---

drivers/gpu/drm/drm_atomic_helper.c | 25 +++++++++++-------------- drivers/gpu/drm/i915/intel_display.c | 8 ++++++++ include/drm/drm_plane.h | 5 +++-- 3 files changed, 22 insertions(+), 16 deletions(-)

diff --git a/drivers/gpu/drm/drm_atomic_helper.c b/drivers/gpu/drm/drm_atomic_helper.c index 034f563fb130..384d99347bb3 100644 --- a/drivers/gpu/drm/drm_atomic_helper.c +++ b/drivers/gpu/drm/drm_atomic_helper.c @@ -1388,8 +1388,8 @@ int drm_atomic_helper_async_check(struct drm_device *dev, { struct drm_crtc *crtc; struct drm_crtc_state *crtc_state;

• struct drm_plane *__plane, *plane = NULL;
• struct drm_plane_state *__plane_state, *plane_state = NULL;

• struct drm_plane *plane;
• struct drm_plane_state *old_plane_state, *new_plane_state; const struct drm_plane_helper_funcs *funcs; int i, n_planes = 0;

@@ -1398,33 +1398,33 @@ int drm_atomic_helper_async_check(struct drm_device *dev, return -EINVAL; }

• for_each_new_plane_in_state(state, __plane, __plane_state, i) {

• for_each_oldnew_plane_in_state(state, plane, old_plane_state, new_plane_state, i) n_planes++;

• plane = __plane;
  

• plane_state = __plane_state;
  

• }

  /* FIXME: we support only single plane updates for now */

• if (!plane || n_planes != 1)

• if (n_planes != 1) return -EINVAL;

• if (!plane_state->crtc)

• if (!new_plane_state->crtc) return -EINVAL;

  funcs = plane->helper_private; if (!funcs->atomic_async_update) return -EINVAL;

• if (plane_state->fence)

• if (new_plane_state->fence) return -EINVAL;

  /*

• * TODO: Don't do an async update if there is an outstanding commit modifying
  

• * Don't do an async update if there is an outstanding commit modifying
  

  • the plane. This prevents our async update's changes from getting
  • overridden by a previous synchronous update's state.
  */
• if (old_plane_state->commit &&

•    !try_wait_for_completion(&old_plane_state->commit->hw_done))
  

• return -EBUSY;
  

Instead of forcing us to always set the plane_state->commit pointer (bunch of pointles refcounting), perhaps just check plane_state->crtc->state->commit? We do hold the necessary locks to at least look at that. -Daniel

• return funcs->atomic_async_check(plane, plane_state);

• return funcs->atomic_async_check(plane, new_plane_state);

} EXPORT_SYMBOL(drm_atomic_helper_async_check);

@@ -1790,9 +1790,6 @@ int drm_atomic_helper_setup_commit(struct drm_atomic_state *state, }

for_each_oldnew_plane_in_state(state, plane, old_plane_state, new_plane_state, i) {

• if (new_plane_state->crtc)
  

• 	continue;
  

• if (nonblock && old_plane_state->commit && !try_wait_for_completion(&old_plane_state->commit->flip_done)) return -EBUSY;

diff --git a/drivers/gpu/drm/i915/intel_display.c b/drivers/gpu/drm/i915/intel_display.c index 70ce02753177..cf21ec4ce920 100644 --- a/drivers/gpu/drm/i915/intel_display.c +++ b/drivers/gpu/drm/i915/intel_display.c @@ -13043,6 +13043,14 @@ intel_legacy_cursor_update(struct drm_plane *plane, goto slow;

old_plane_state = plane->state;

• /*

• * Don't do an async update if there is an outstanding commit modifying
  

• * the plane.  This prevents our async update's changes from getting
  

• * overridden by a previous synchronous update's state.
  

• */
  

• if (old_plane_state->commit &&

•    !try_wait_for_completion(&old_plane_state->commit->hw_done))
  

• goto slow;
  
  

  /*

  • If any parameters change that may affect watermarks,

diff --git a/include/drm/drm_plane.h b/include/drm/drm_plane.h index 7d96116fd4c4..feb9941d0cdb 100644 --- a/include/drm/drm_plane.h +++ b/include/drm/drm_plane.h @@ -124,9 +124,10 @@ struct drm_plane_state { bool visible;

/**

• * @commit: Tracks the pending commit to prevent use-after-free conditions.
  

• * @commit: Tracks the pending commit to prevent use-after-free conditions,
  

• * and for async plane updates.
  

• * Is only set when @crtc is NULL.
  

• * May be NULL.
  

  */ struct drm_crtc_commit *commit;

-- 2.11.0

---

dri-devel mailing list dri-devel@lists.freedesktop.org https://lists.freedesktop.org/mailman/listinfo/dri-devel

On Wed, Aug 30, 2017 at 02:53:43PM +0200, Maarten Lankhorst wrote:

Op 30-08-17 om 14:46 schreef Daniel Vetter:

...

On Wed, Aug 30, 2017 at 02:17:52PM +0200, Maarten Lankhorst wrote:

...

By always keeping track of the last commit in plane_state, we know whether there is an active update on the plane or not. With that information we can reject the fast update, and force the slowpath to be used as was originally intended.

Cc: Gustavo Padovan gustavo.padovan@collabora.com Signed-off-by: Maarten Lankhorst maarten.lankhorst@linux.intel.com

Makes sense, but I think like patch 1 it would be better to do this in a separate series. Which would then include a patch to move i915 over to the async plane support.

One more comment below.

...

---

drivers/gpu/drm/drm_atomic_helper.c | 25 +++++++++++-------------- drivers/gpu/drm/i915/intel_display.c | 8 ++++++++ include/drm/drm_plane.h | 5 +++-- 3 files changed, 22 insertions(+), 16 deletions(-)

diff --git a/drivers/gpu/drm/drm_atomic_helper.c b/drivers/gpu/drm/drm_atomic_helper.c index 034f563fb130..384d99347bb3 100644 --- a/drivers/gpu/drm/drm_atomic_helper.c +++ b/drivers/gpu/drm/drm_atomic_helper.c @@ -1388,8 +1388,8 @@ int drm_atomic_helper_async_check(struct drm_device *dev, { struct drm_crtc *crtc; struct drm_crtc_state *crtc_state;

• struct drm_plane *__plane, *plane = NULL;
• struct drm_plane_state *__plane_state, *plane_state = NULL;

• struct drm_plane *plane;
• struct drm_plane_state *old_plane_state, *new_plane_state; const struct drm_plane_helper_funcs *funcs; int i, n_planes = 0;

@@ -1398,33 +1398,33 @@ int drm_atomic_helper_async_check(struct drm_device *dev, return -EINVAL; }

• for_each_new_plane_in_state(state, __plane, __plane_state, i) {

• for_each_oldnew_plane_in_state(state, plane, old_plane_state, new_plane_state, i) n_planes++;

• plane = __plane;
  

• plane_state = __plane_state;
  

• }

  /* FIXME: we support only single plane updates for now */

• if (!plane || n_planes != 1)

• if (n_planes != 1) return -EINVAL;

• if (!plane_state->crtc)

• if (!new_plane_state->crtc) return -EINVAL;

  funcs = plane->helper_private; if (!funcs->atomic_async_update) return -EINVAL;

• if (plane_state->fence)

• if (new_plane_state->fence) return -EINVAL;

  /*

• * TODO: Don't do an async update if there is an outstanding commit modifying
  

• * Don't do an async update if there is an outstanding commit modifying
  

  • the plane. This prevents our async update's changes from getting
  • overridden by a previous synchronous update's state.
  */
• if (old_plane_state->commit &&

•    !try_wait_for_completion(&old_plane_state->commit->hw_done))
  

• return -EBUSY;
  

Instead of forcing us to always set the plane_state->commit pointer (bunch of pointles refcounting), perhaps just check plane_state->crtc->state->commit? We do hold the necessary locks to at least look at that.

Then we'd always take the slowpath?

The point here was to check whether the current plane was part of the most recent commit, to know this we must either add a flip_planes mask member to drm_crtc_commit, or add a pointer in plane_state to the most recent commit it was part of.

Hm right, that would block us against ongoing page_flips ... I guess tracking commits at the plane level makes sense. If you can add that to the commit message please, since otherwise I'll forget again? -Daniel