linux.git/drivers/gpu/drm/vkms, branch v5.4.64

drm/vkms: Hold gem object while still in-use

2020-06-17T14:40:36+00:00

commit 0ea2ea42b31abc1141f2fd3911f952a97d401fcb upstream.

We need to keep the reference to the drm_gem_object
until the last access by vkms_dumb_create.

Therefore, the put the object after it is used.

This fixes a use-after-free issue reported by syzbot.

While here, change vkms_gem_create() symbol to static.

Reported-and-tested-by: syzbot+e3372a2afe1e7ef04bc7@syzkaller.appspotmail.com
Signed-off-by: Ezequiel Garcia 
Reviewed-by: Rodrigo Siqueira 
Signed-off-by: Rodrigo Siqueira 
Link: https://patchwork.freedesktop.org/patch/msgid/20200427214405.13069-1-ezequiel@collabora.com
Signed-off-by: Greg Kroah-Hartman

drm/vkms: drop use of drmP.h

2019-07-15T16:11:30+00:00

Drop use of the deprecated drmP.h header.
Replace it with the necessary includes in the individual .c files.
The header files was self-contained, and extra includes were not added
there.

Signed-off-by: Sam Ravnborg 
Reviewed-by: Rodrigo Siqueira 
Acked-by: Emil Velikov 
Cc: Haneen Mohammed 
Cc: Daniel Vetter 
Cc: David Airlie 
Link: https://patchwork.freedesktop.org/patch/msgid/20190630061922.7254-13-sam@ravnborg.org

drm/vkms: Rename vkms_crc.c into vkms_composer.c

2019-07-12T03:46:02+00:00

As a preparation work for introducing writeback to vkms, this patch
renames the file vkms_crc.c into vkms_composer.c. Accordingly, it also
adjusts the functions and data structures to match the changes.

No functional change.

Signed-off-by: Rodrigo Siqueira 
Acked-by: Daniel Vetter 
Link: https://patchwork.freedesktop.org/patch/msgid/dea62063077ebf5cc1dfce8876e56788d15367e6.1561491964.git.rodrigosiqueiramelo@gmail.com

drm/vkms: Avoid assigning 0 for possible_crtc

2019-07-12T03:45:49+00:00

When vkms invoke drm_universal_plane_init(), it sets 0 for
possible_crtcs parameter which means that planes can't be attached to
any CRTC. It currently works due to some safeguard in the drm_crtc file;
however, it is possible to identify the problem by trying to append a
second connector. This patch fixes this issue by modifying
vkms_plane_init() to accept an index parameter which makes the code a
little bit more flexible and avoid set zero to possible_crtcs.

Signed-off-by: Rodrigo Siqueira 
Reviewed-by: Daniel Vetter 
Link: https://patchwork.freedesktop.org/patch/msgid/d67849c62a8d8ace1a0af455998b588798a4c45f.1561491964.git.rodrigosiqueiramelo@gmail.com

drm/vkms: No need for ->pages_lock in crc work anymore

2019-06-27T02:19:22+00:00

We're now guaranteed to no longer race against prepare_fb/cleanup_fb,
which means we can access ->vaddr without having to hold a lock.

Before the previous patches it was fairly easy to observe the cursor
->vaddr being invalid, but that's now gone, so we can upgrade to a
full WARN_ON.

Cc: Rodrigo Siqueira 
Cc: Haneen Mohammed 
Cc: Daniel Vetter 
Signed-off-by: Daniel Vetter 
Reviewed-by: Rodrigo Siqueira 
Tested-by: Rodrigo Siqueira 
Signed-off-by: Rodrigo Siqueira 
Link: https://patchwork.freedesktop.org/patch/msgid/20190606222751.32567-11-daniel.vetter@ffwll.ch

drm/vkms: totally reworked crc data tracking

2019-06-27T02:15:35+00:00

The crc computation worker needs to be able to get at some data
structures and framebuffer mappings, while potentially more atomic
updates are going on. The solution thus far is to copy relevant bits
around, but that's very tedious.

Here's a new approach, which tries to be more clever, but relies on a
few not-so-obvious things:
- crtc_state is always updated when a plane_state changes. Therefore
  we can just stuff plane_state pointers into a crtc_state. That
  solves the problem of easily getting at the needed plane_states.
- with the flushing changes from previous patches the above also holds
  without races due to the next atomic update being a bit eager with
  cleaning up pending work - we always wait for all crc work items to
  complete before unmapping framebuffers.
- we also need to make sure that the hrtimer fires off the right
  worker. Keep a new distinct crc_state pointer, under the
  vkms_output->lock protection for this. Note that crtc->state is
  updated very early in the atomic commit, way before we arm the
  vblank event - the vblank event should always match the buffers we
  use to compute the crc. This also solves an issue in the hrtimer,
  where we've accessed drm_crtc->state without holding the right locks
  (we held none - oops).
- in the worker itself we can then just access the plane states we
  need, again solving a bunch of ordering and locking issues.
  Accessing plane->state requires locks, accessing the private
  vkms_crtc_state->active_planes pointer only requires that the memory
  doesn't get freed too early.

The idea behind vkms_crtc_state->active_planes is that this would
contain all visible planes, in z-order, as a first step towards a more
generic blending implementation.

Note that this patch also fixes races between prepare_fb/cleanup_fb
and the crc worker accessing ->vaddr.

Cc: Rodrigo Siqueira 
Cc: Haneen Mohammed 
Cc: Daniel Vetter 
Signed-off-by: Daniel Vetter 
Reviewed-by: Rodrigo Siqueira 
Tested-by: Rodrigo Siqueira 
Signed-off-by: Rodrigo Siqueira 
Link: https://patchwork.freedesktop.org/patch/msgid/20190606222751.32567-10-daniel.vetter@ffwll.ch

drm/vkms: No _irqsave within spin_lock_irq needed

2019-06-27T02:14:24+00:00

irqs are already off.

Signed-off-by: Daniel Vetter 
Reviewed-by: Rodrigo Siqueira 
Tested-by: Rodrigo Siqueira 
Signed-off-by: Rodrigo Siqueira 
Link: https://patchwork.freedesktop.org/patch/msgid/20190606222751.32567-9-daniel.vetter@ffwll.ch

drm/vkms: Dont flush crc worker when we change crc status

2019-06-27T02:13:10+00:00

The crc core code can cope with some late crc, the race is kinda
unavoidable. So no need to flush pending workers, they'll complete in
time.

Cc: Rodrigo Siqueira 
Cc: Haneen Mohammed 
Cc: Daniel Vetter 
Signed-off-by: Daniel Vetter 
Reviewed-by: Rodrigo Siqueira 
Tested-by: Rodrigo Siqueira 
Signed-off-by: Rodrigo Siqueira 
Link: https://patchwork.freedesktop.org/patch/msgid/20190606222751.32567-8-daniel.vetter@ffwll.ch

drm/vkms: flush crc workers earlier in commit flow

2019-06-27T02:10:35+00:00

Currently, we flush pending CRC workers very late in the commit flow,
when we destroy all the old crtc states. Unfortunately, at that point,
the framebuffers are already unpinned (and our vaddr possible gone), so
this isn't good. Also, the plane_states we need might also already be
cleaned up, since cleanup order of state structures isn't well defined.

Fix this by waiting for all CRC workers of the old state to complete
before we start any of the cleanup work. For correct ordering and
avoiding races, we can only flush_work after
drm_atomic_helper_wait_for_vblanks() since we know that all subsequent
queue_work will be for the new state. Only once that's done is
flush_work() useful, before that we might flush the work, and then right
after the hrtimer that simulates vblank queues it again. Every time you
have a flush_work before cleaning up the work structure, the following
sequence must be obeyed, or it can go wrong:

1. Make sure no one else can re-queue the work anymore (in our case
that's done by a combination of first updating output->crc_state and
then waiting for the vblank to pass to make sure the hrtimer has noticed
that change).
2. flush_work()
3. Actually clean up stuff (which isn't done here).

Doing the flush_work before we even completed the output->state update,
much less waited for the vblank to make sure that's happened, missed the
point.

Note that this is not yet race-free because of the hrtimer and crc
worker look at the wrong state pointers, but that will be fixed in
subsequent patches.

Cc: Rodrigo Siqueira 
Cc: Haneen Mohammed 
Cc: Daniel Vetter 
Signed-off-by: Daniel Vetter 
Reviewed-by: Rodrigo Siqueira 
Tested-by: Rodrigo Siqueira 
Signed-off-by: Rodrigo Siqueira 
Link: https://patchwork.freedesktop.org/patch/msgid/20190606222751.32567-7-daniel.vetter@ffwll.ch

drm/vkms: Add our own commit_tail

2019-06-27T02:01:37+00:00

Just prep work, more will be done here in following patches.

Cc: Rodrigo Siqueira 
Cc: Haneen Mohammed 
Cc: Daniel Vetter 
Signed-off-by: Daniel Vetter 
Reviewed-by: Rodrigo Siqueira 
Tested-by: Rodrigo Siqueira 
Signed-off-by: Rodrigo Siqueira 
Link: https://patchwork.freedesktop.org/patch/msgid/20190606222751.32567-6-daniel.vetter@ffwll.ch