From 6a56d09bdab7c9d17ca2cf70c62ec162bbb972f7 Mon Sep 17 00:00:00 2001 From: Daniel Vetter Date: Thu, 21 Jan 2021 12:29:19 +0100 Subject: drm: Update todo.rst Internship season is starting, let's review this. One thing that's pending is Maxime's work to roll out drm_atomic_state pointers to all callbacks, he said he'll remove that entry once it's all done. v2: Fix typos (Maxime) Acked-by: Maxime Ripard Signed-off-by: Daniel Vetter Cc: Maarten Lankhorst Cc: Maxime Ripard Cc: Thomas Zimmermann Cc: David Airlie Cc: Daniel Vetter Link: https://patchwork.freedesktop.org/patch/msgid/20210121112919.1460322-1-daniel.vetter@ffwll.ch --- Documentation/gpu/todo.rst | 28 +++++++++++++++------------- 1 file changed, 15 insertions(+), 13 deletions(-) (limited to 'Documentation/gpu') diff --git a/Documentation/gpu/todo.rst b/Documentation/gpu/todo.rst index 009d8e6c7e3c..dea9082c0e5f 100644 --- a/Documentation/gpu/todo.rst +++ b/Documentation/gpu/todo.rst @@ -577,20 +577,24 @@ Contact: Daniel Vetter Level: Intermediate -KMS cleanups ------------- +Object lifetime fixes +--------------------- + +There's two related issues here + +- Cleanup up the various ->destroy callbacks, which often are all the same + simple code. -Some of these date from the very introduction of KMS in 2008 ... +- Lots of drivers erroneously allocate DRM modeset objects using devm_kzalloc, + which results in use-after free issues on driver unload. This can be serious + trouble even for drivers for hardware integrated on the SoC due to + EPROBE_DEFERRED backoff. -- Make ->funcs and ->helper_private vtables optional. There's a bunch of empty - function tables in drivers, but before we can remove them we need to make sure - that all the users in helpers and drivers do correctly check for a NULL - vtable. +Both these problems can be solved by switching over to drmm_kzalloc(), and the +various convenience wrappers provided, e.g. drmm_crtc_alloc_with_planes(), +drmm_universal_plane_alloc(), ... and so on. -- Cleanup up the various ->destroy callbacks. A lot of them just wrapt the - drm_*_cleanup implementations and can be removed. Some tack a kfree() at the - end, for which we could add drm_*_cleanup_kfree(). And then there's the (for - historical reasons) misnamed drm_primary_helper_destroy() function. +Contact: Daniel Vetter Level: Intermediate @@ -626,8 +630,6 @@ See the documentation of :ref:`VKMS ` for more details. This is an ideal internship task, since it only requires a virtual machine and can be sized to fit the available time. -Contact: Daniel Vetter - Level: See details Backlight Refactoring -- cgit v1.2.3 From 5823cca39d585e4b4a32b1292eed0015da9c3276 Mon Sep 17 00:00:00 2001 From: Daniel Vetter Date: Fri, 22 Jan 2021 14:36:23 +0100 Subject: drm/todo: Add entry for moving to dma_resv_lock MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Requested by Thomas. I think it justifies a new level, since I tried to make some forward progress on this last summer, and gave up (for now). This is very tricky. Acked-by: Thomas Zimmermann Signed-off-by: Daniel Vetter Cc: Maarten Lankhorst Cc: Maxime Ripard Cc: Thomas Zimmermann Cc: David Airlie Cc: Daniel Vetter Cc: Sumit Semwal Cc: "Christian König" Cc: linux-media@vger.kernel.org Cc: linaro-mm-sig@lists.linaro.org Link: https://patchwork.freedesktop.org/patch/msgid/20210122133624.1751802-1-daniel.vetter@ffwll.ch --- Documentation/gpu/todo.rst | 19 +++++++++++++++++++ 1 file changed, 19 insertions(+) (limited to 'Documentation/gpu') diff --git a/Documentation/gpu/todo.rst b/Documentation/gpu/todo.rst index dea9082c0e5f..f872d3d33218 100644 --- a/Documentation/gpu/todo.rst +++ b/Documentation/gpu/todo.rst @@ -23,6 +23,9 @@ Advanced: Tricky tasks that need fairly good understanding of the DRM subsystem and graphics topics. Generally need the relevant hardware for development and testing. +Expert: Only attempt these if you've successfully completed some tricky +refactorings already and are an expert in the specific area + Subsystem-wide refactorings =========================== @@ -168,6 +171,22 @@ Contact: Daniel Vetter, respective driver maintainers Level: Advanced +Move Buffer Object Locking to dma_resv_lock() +--------------------------------------------- + +Many drivers have their own per-object locking scheme, usually using +mutex_lock(). This causes all kinds of trouble for buffer sharing, since +depending which driver is the exporter and importer, the locking hierarchy is +reversed. + +To solve this we need one standard per-object locking mechanism, which is +dma_resv_lock(). This lock needs to be called as the outermost lock, with all +other driver specific per-object locks removed. The problem is tha rolling out +the actual change to the locking contract is a flag day, due to struct dma_buf +buffer sharing. + +Level: Expert + Convert logging to drm_* functions with drm_device paramater ------------------------------------------------------------ -- cgit v1.2.3 From 6dd7b6ce43acd70f75ae285fee8eeb2dd4933dce Mon Sep 17 00:00:00 2001 From: Thomas Zimmermann Date: Mon, 8 Feb 2021 12:55:34 +0100 Subject: drm: Add additional atomic helpers for shadow-buffered planes Several drivers use GEM buffer objects as shadow buffers for the actual framebuffer memory. Right now, drivers do these vmap operations in their commit tail, which is actually not allowed by the locking rules for the dma-buf reservation lock. The involved BO has to be vmapped in the plane's prepare_fb callback and vunmapped in cleanup_fb. This patch introduces atomic helpers for such shadow planes. Plane functions manage the plane state for shadow planes. The provided implementations for prepare_fb and cleanup_fb vmap and vunmap all BOs of struct drm_plane_state.fb. The mappings are afterwards available in the plane's commit-tail functions. For now, all rsp drivers use the simple KMS helpers, so we add the plane callbacks and wrappers for simple KMS. The internal plane functions can later be exported as needed. v3: * documentation fixes v2: * make duplicate_state interface compatible with struct drm_plane_funcs Signed-off-by: Thomas Zimmermann Tested-by: Gerd Hoffmann Acked-by: Gerd Hoffmann Link: https://patchwork.freedesktop.org/patch/msgid/20210208115538.6430-4-tzimmermann@suse.de --- Documentation/gpu/drm-kms-helpers.rst | 12 ++ drivers/gpu/drm/Makefile | 3 +- drivers/gpu/drm/drm_gem_atomic_helper.c | 208 ++++++++++++++++++++++++++++++++ include/drm/drm_gem_atomic_helper.h | 73 +++++++++++ 4 files changed, 295 insertions(+), 1 deletion(-) create mode 100644 drivers/gpu/drm/drm_gem_atomic_helper.c create mode 100644 include/drm/drm_gem_atomic_helper.h (limited to 'Documentation/gpu') diff --git a/Documentation/gpu/drm-kms-helpers.rst b/Documentation/gpu/drm-kms-helpers.rst index b89ddd06dabb..389892f36185 100644 --- a/Documentation/gpu/drm-kms-helpers.rst +++ b/Documentation/gpu/drm-kms-helpers.rst @@ -80,6 +80,18 @@ Atomic State Helper Reference .. kernel-doc:: drivers/gpu/drm/drm_atomic_state_helper.c :export: +GEM Atomic Helper Reference +--------------------------- + +.. kernel-doc:: drivers/gpu/drm/drm_gem_atomic_helper.c + :doc: overview + +.. kernel-doc:: include/drm/drm_gem_atomic_helper.h + :internal: + +.. kernel-doc:: drivers/gpu/drm/drm_gem_atomic_helper.c + :export: + Simple KMS Helper Reference =========================== diff --git a/drivers/gpu/drm/Makefile b/drivers/gpu/drm/Makefile index 926adef289db..02c229392345 100644 --- a/drivers/gpu/drm/Makefile +++ b/drivers/gpu/drm/Makefile @@ -44,7 +44,8 @@ drm_kms_helper-y := drm_bridge_connector.o drm_crtc_helper.o drm_dp_helper.o \ drm_plane_helper.o drm_dp_mst_topology.o drm_atomic_helper.o \ drm_kms_helper_common.o drm_dp_dual_mode_helper.o \ drm_simple_kms_helper.o drm_modeset_helper.o \ - drm_scdc_helper.o drm_gem_framebuffer_helper.o \ + drm_scdc_helper.o drm_gem_atomic_helper.o \ + drm_gem_framebuffer_helper.o \ drm_atomic_state_helper.o drm_damage_helper.o \ drm_format_helper.o drm_self_refresh_helper.o diff --git a/drivers/gpu/drm/drm_gem_atomic_helper.c b/drivers/gpu/drm/drm_gem_atomic_helper.c new file mode 100644 index 000000000000..e27762cef360 --- /dev/null +++ b/drivers/gpu/drm/drm_gem_atomic_helper.c @@ -0,0 +1,208 @@ +// SPDX-License-Identifier: GPL-2.0-or-later + +#include +#include +#include +#include + +#include "drm_internal.h" + +/** + * DOC: overview + * + * The GEM atomic helpers library implements generic atomic-commit + * functions for drivers that use GEM objects. Currently, it provides + * plane state and framebuffer BO mappings for planes with shadow + * buffers. + */ + +/* + * Shadow-buffered Planes + */ + +static struct drm_plane_state * +drm_gem_duplicate_shadow_plane_state(struct drm_plane *plane) +{ + struct drm_plane_state *plane_state = plane->state; + struct drm_shadow_plane_state *new_shadow_plane_state; + + if (!plane_state) + return NULL; + + new_shadow_plane_state = kzalloc(sizeof(*new_shadow_plane_state), GFP_KERNEL); + if (!new_shadow_plane_state) + return NULL; + __drm_atomic_helper_plane_duplicate_state(plane, &new_shadow_plane_state->base); + + return &new_shadow_plane_state->base; +} + +static void drm_gem_destroy_shadow_plane_state(struct drm_plane *plane, + struct drm_plane_state *plane_state) +{ + struct drm_shadow_plane_state *shadow_plane_state = + to_drm_shadow_plane_state(plane_state); + + __drm_atomic_helper_plane_destroy_state(&shadow_plane_state->base); + kfree(shadow_plane_state); +} + +static void drm_gem_reset_shadow_plane(struct drm_plane *plane) +{ + struct drm_shadow_plane_state *shadow_plane_state; + + if (plane->state) { + drm_gem_destroy_shadow_plane_state(plane, plane->state); + plane->state = NULL; /* must be set to NULL here */ + } + + shadow_plane_state = kzalloc(sizeof(*shadow_plane_state), GFP_KERNEL); + if (!shadow_plane_state) + return; + __drm_atomic_helper_plane_reset(plane, &shadow_plane_state->base); +} + +static int drm_gem_prepare_shadow_fb(struct drm_plane *plane, struct drm_plane_state *plane_state) +{ + struct drm_shadow_plane_state *shadow_plane_state = to_drm_shadow_plane_state(plane_state); + struct drm_framebuffer *fb = plane_state->fb; + struct drm_gem_object *obj; + struct dma_buf_map map; + int ret; + size_t i; + + if (!fb) + return 0; + + ret = drm_gem_fb_prepare_fb(plane, plane_state); + if (ret) + return ret; + + for (i = 0; i < ARRAY_SIZE(shadow_plane_state->map); ++i) { + obj = drm_gem_fb_get_obj(fb, i); + if (!obj) + continue; + ret = drm_gem_vmap(obj, &map); + if (ret) + goto err_drm_gem_vunmap; + shadow_plane_state->map[i] = map; + } + + return 0; + +err_drm_gem_vunmap: + while (i) { + --i; + obj = drm_gem_fb_get_obj(fb, i); + if (!obj) + continue; + drm_gem_vunmap(obj, &shadow_plane_state->map[i]); + } + return ret; +} + +static void drm_gem_cleanup_shadow_fb(struct drm_plane *plane, struct drm_plane_state *plane_state) +{ + struct drm_shadow_plane_state *shadow_plane_state = to_drm_shadow_plane_state(plane_state); + struct drm_framebuffer *fb = plane_state->fb; + size_t i = ARRAY_SIZE(shadow_plane_state->map); + struct drm_gem_object *obj; + + if (!fb) + return; + + while (i) { + --i; + obj = drm_gem_fb_get_obj(fb, i); + if (!obj) + continue; + drm_gem_vunmap(obj, &shadow_plane_state->map[i]); + } +} + +/** + * drm_gem_simple_kms_prepare_shadow_fb - prepares shadow framebuffers + * @pipe: the simple display pipe + * @plane_state: the plane state of type struct drm_shadow_plane_state + * + * This function implements struct drm_simple_display_funcs.prepare_fb. It + * maps all buffer objects of the plane's framebuffer into kernel address + * space and stores them in struct drm_shadow_plane_state.map. The + * framebuffer will be synchronized as part of the atomic commit. + * + * See drm_gem_simple_kms_cleanup_shadow_fb() for cleanup. + * + * Returns: + * 0 on success, or a negative errno code otherwise. + */ +int drm_gem_simple_kms_prepare_shadow_fb(struct drm_simple_display_pipe *pipe, + struct drm_plane_state *plane_state) +{ + return drm_gem_prepare_shadow_fb(&pipe->plane, plane_state); +} +EXPORT_SYMBOL(drm_gem_simple_kms_prepare_shadow_fb); + +/** + * drm_gem_simple_kms_cleanup_shadow_fb - releases shadow framebuffers + * @pipe: the simple display pipe + * @plane_state: the plane state of type struct drm_shadow_plane_state + * + * This function implements struct drm_simple_display_funcs.cleanup_fb. + * This function unmaps all buffer objects of the plane's framebuffer. + * + * See drm_gem_simple_kms_prepare_shadow_fb(). + */ +void drm_gem_simple_kms_cleanup_shadow_fb(struct drm_simple_display_pipe *pipe, + struct drm_plane_state *plane_state) +{ + drm_gem_cleanup_shadow_fb(&pipe->plane, plane_state); +} +EXPORT_SYMBOL(drm_gem_simple_kms_cleanup_shadow_fb); + +/** + * drm_gem_simple_kms_reset_shadow_plane - resets a shadow-buffered plane + * @pipe: the simple display pipe + * + * This function implements struct drm_simple_display_funcs.reset_plane + * for shadow-buffered planes. + */ +void drm_gem_simple_kms_reset_shadow_plane(struct drm_simple_display_pipe *pipe) +{ + drm_gem_reset_shadow_plane(&pipe->plane); +} +EXPORT_SYMBOL(drm_gem_simple_kms_reset_shadow_plane); + +/** + * drm_gem_simple_kms_duplicate_shadow_plane_state - duplicates shadow-buffered plane state + * @pipe: the simple display pipe + * + * This function implements struct drm_simple_display_funcs.duplicate_plane_state + * for shadow-buffered planes. It does not duplicate existing mappings of the shadow + * buffers. Mappings are maintained during the atomic commit by the plane's prepare_fb + * and cleanup_fb helpers. + * + * Returns: + * A pointer to a new plane state on success, or NULL otherwise. + */ +struct drm_plane_state * +drm_gem_simple_kms_duplicate_shadow_plane_state(struct drm_simple_display_pipe *pipe) +{ + return drm_gem_duplicate_shadow_plane_state(&pipe->plane); +} +EXPORT_SYMBOL(drm_gem_simple_kms_duplicate_shadow_plane_state); + +/** + * drm_gem_simple_kms_destroy_shadow_plane_state - resets shadow-buffered plane state + * @pipe: the simple display pipe + * @plane_state: the plane state of type struct drm_shadow_plane_state + * + * This function implements struct drm_simple_display_funcs.destroy_plane_state + * for shadow-buffered planes. It expects that mappings of shadow buffers + * have been released already. + */ +void drm_gem_simple_kms_destroy_shadow_plane_state(struct drm_simple_display_pipe *pipe, + struct drm_plane_state *plane_state) +{ + drm_gem_destroy_shadow_plane_state(&pipe->plane, plane_state); +} +EXPORT_SYMBOL(drm_gem_simple_kms_destroy_shadow_plane_state); diff --git a/include/drm/drm_gem_atomic_helper.h b/include/drm/drm_gem_atomic_helper.h new file mode 100644 index 000000000000..08b96ccea325 --- /dev/null +++ b/include/drm/drm_gem_atomic_helper.h @@ -0,0 +1,73 @@ +/* SPDX-License-Identifier: GPL-2.0-or-later */ + +#ifndef __DRM_GEM_ATOMIC_HELPER_H__ +#define __DRM_GEM_ATOMIC_HELPER_H__ + +#include + +#include + +struct drm_simple_display_pipe; + +/* + * Helpers for planes with shadow buffers + */ + +/** + * struct drm_shadow_plane_state - plane state for planes with shadow buffers + * + * For planes that use a shadow buffer, struct drm_shadow_plane_state + * provides the regular plane state plus mappings of the shadow buffer + * into kernel address space. + */ +struct drm_shadow_plane_state { + /** @base: plane state */ + struct drm_plane_state base; + + /* Transitional state - do not export or duplicate */ + + /** + * @map: Mappings of the plane's framebuffer BOs in to kernel address space + * + * The memory mappings stored in map should be established in the plane's + * prepare_fb callback and removed in the cleanup_fb callback. + */ + struct dma_buf_map map[4]; +}; + +/** + * to_drm_shadow_plane_state - upcasts from struct drm_plane_state + * @state: the plane state + */ +static inline struct drm_shadow_plane_state * +to_drm_shadow_plane_state(struct drm_plane_state *state) +{ + return container_of(state, struct drm_shadow_plane_state, base); +} + +int drm_gem_simple_kms_prepare_shadow_fb(struct drm_simple_display_pipe *pipe, + struct drm_plane_state *plane_state); +void drm_gem_simple_kms_cleanup_shadow_fb(struct drm_simple_display_pipe *pipe, + struct drm_plane_state *plane_state); +void drm_gem_simple_kms_reset_shadow_plane(struct drm_simple_display_pipe *pipe); +struct drm_plane_state * +drm_gem_simple_kms_duplicate_shadow_plane_state(struct drm_simple_display_pipe *pipe); +void drm_gem_simple_kms_destroy_shadow_plane_state(struct drm_simple_display_pipe *pipe, + struct drm_plane_state *plane_state); + +/** + * DRM_GEM_SIMPLE_DISPLAY_PIPE_SHADOW_PLANE_FUNCS - + * Initializes struct drm_simple_display_pipe_funcs for shadow-buffered planes + * + * Drivers may use GEM BOs as shadow buffers over the framebuffer memory. This + * macro initializes struct drm_simple_display_pipe_funcs to use the rsp helper + * functions. + */ +#define DRM_GEM_SIMPLE_DISPLAY_PIPE_SHADOW_PLANE_FUNCS \ + .prepare_fb = drm_gem_simple_kms_prepare_shadow_fb, \ + .cleanup_fb = drm_gem_simple_kms_cleanup_shadow_fb, \ + .reset_plane = drm_gem_simple_kms_reset_shadow_plane, \ + .duplicate_plane_state = drm_gem_simple_kms_duplicate_shadow_plane_state, \ + .destroy_plane_state = drm_gem_simple_kms_destroy_shadow_plane_state + +#endif /* __DRM_GEM_ATOMIC_HELPER_H__ */ -- cgit v1.2.3 From c129b49825530942f344ed3e0e6a72568ad3e3e2 Mon Sep 17 00:00:00 2001 From: Maxime Ripard Date: Fri, 19 Feb 2021 13:00:31 +0100 Subject: drm/todo: Remove the drm_atomic_state todo item Only planes' prepare_fb and cleanup_fb, and encoders' atomic_check and atomic_mode_set hooks remain with an object state and not the global drm_atomic_state. prepare_fb and cleanup_fb operate by design on a given state and depending on the calling site can operate on either the old or new state, so it doesn't really make much sense to convert them. The encoders' atomic_check and atomic_mode_set operate on the CRTC and connector state connected to them since encoders don't have a state of their own. Without those state pointers, we would need to get the CRTC through the drm_connector_state crtc pointer. However, in order to get the drm_connector_state pointer, we would need to get the connector itself and while usually we have a single connector connected to the encoder, we can't really get it from the encoder at the moment since it could be behind any number of bridges. While this could be addressed by (for example) listing all the connectors and finding the one that has the encoder as its source, it feels like an unnecessary rework for something that is slowly getting replaced by bridges. Since all the users that matter have been converted, let's remove the TODO item. Acked-by: Daniel Vetter Signed-off-by: Maxime Ripard Acked-by: Thomas Zimmermann Link: https://patchwork.freedesktop.org/patch/msgid/20210219120032.260676-11-maxime@cerno.tech --- Documentation/gpu/todo.rst | 46 ---------------------------------------------- 1 file changed, 46 deletions(-) (limited to 'Documentation/gpu') diff --git a/Documentation/gpu/todo.rst b/Documentation/gpu/todo.rst index f872d3d33218..0631b9b323d5 100644 --- a/Documentation/gpu/todo.rst +++ b/Documentation/gpu/todo.rst @@ -459,52 +459,6 @@ Contact: Emil Velikov, respective driver maintainers Level: Intermediate -Plumb drm_atomic_state all over -------------------------------- - -Currently various atomic functions take just a single or a handful of -object states (eg. plane state). While that single object state can -suffice for some simple cases, we often have to dig out additional -object states for dealing with various dependencies between the individual -objects or the hardware they represent. The process of digging out the -additional states is rather non-intuitive and error prone. - -To fix that most functions should rather take the overall -drm_atomic_state as one of their parameters. The other parameters -would generally be the object(s) we mainly want to interact with. - -For example, instead of - -.. code-block:: c - - int (*atomic_check)(struct drm_plane *plane, struct drm_plane_state *state); - -we would have something like - -.. code-block:: c - - int (*atomic_check)(struct drm_plane *plane, struct drm_atomic_state *state); - -The implementation can then trivially gain access to any required object -state(s) via drm_atomic_get_plane_state(), drm_atomic_get_new_plane_state(), -drm_atomic_get_old_plane_state(), and their equivalents for -other object types. - -Additionally many drivers currently access the object->state pointer -directly in their commit functions. That is not going to work if we -eg. want to allow deeper commit pipelines as those pointers could -then point to the states corresponding to a future commit instead of -the current commit we're trying to process. Also non-blocking commits -execute locklessly so there are serious concerns with dereferencing -the object->state pointers without holding the locks that protect them. -Use of drm_atomic_get_new_plane_state(), drm_atomic_get_old_plane_state(), -etc. avoids these problems as well since they relate to a specific -commit via the passed in drm_atomic_state. - -Contact: Ville Syrjälä, Daniel Vetter - -Level: Intermediate - Use struct dma_buf_map throughout codebase ------------------------------------------ -- cgit v1.2.3