kernel.git/drivers/gpu/drm/drm_plane.c, branch linux-4.19.y

drm: Don't unref the same fb many times by mistake due to deadlock handling

2024-02-23T07:12:42Z

commit cb4daf271302d71a6b9a7c01bd0b6d76febd8f0c upstream. If we get a deadlock after the fb lookup in drm_mode_page_flip_ioctl() we proceed to unref the fb and then retry the whole thing from the top. But we forget to reset the fb pointer back to NULL, and so if we then get another error during the retry, before the fb lookup, we proceed the unref the same fb again without having gotten another reference. The end result is that the fb will (eventually) end up being freed while it's still in use. Reset fb to NULL once we've unreffed it to avoid doing it again until we've done another fb lookup. This turned out to be pretty easy to hit on a DG2 when doing async flips (and CONFIG_DEBUG_WW_MUTEX_SLOWPATH=y). The first symptom I saw that drm_closefb() simply got stuck in a busy loop while walking the framebuffer list. Fortunately I was able to convince it to oops instead, and from there it was easier to track down the culprit. Cc: stable@vger.kernel.org Signed-off-by: Ville Syrjälä Link: https://patchwork.freedesktop.org/patch/msgid/20231211081625.25704-1-ville.syrjala@linux.intel.com Acked-by: Javier Martinez Canillas Signed-off-by: Greg Kroah-Hartman

drm/plane: Move range check for format_count earlier

2022-06-14T14:59:16Z

[ Upstream commit 4b674dd69701c2e22e8e7770c1706a69f3b17269 ] While the check for format_count > 64 in __drm_universal_plane_init() shouldn't be hit (it's a WARN_ON), in its current position it will then leak the plane->format_types array and fail to call drm_mode_object_unregister() leaking the modeset identifier. Move it to the start of the function to avoid allocating those resources in the first place. Signed-off-by: Steven Price Signed-off-by: Liviu Dudau Link: https://lore.kernel.org/dri-devel/20211203102815.38624-1-steven.price@arm.com/ Signed-off-by: Sasha Levin

drm/lease: Make sure implicit planes are leased

2019-06-09T07:17:23Z

commit 204f640da6914844b3270b41b29c84f6e3b74083 upstream. If userspace doesn't enable universal planes, then we automatically add the primary and cursor planes. But for universal userspace there's no such check (and maybe we only want to give the lessee one plane, maybe not even the primary one), hence we need to check for the implied plane. v2: don't forget setcrtc ioctl. v3: Still allow disabling of the crtc in SETCRTC. Cc: stable@vger.kernel.org Cc: Keith Packard Reviewed-by: Boris Brezillon Signed-off-by: Daniel Vetter Link: https://patchwork.freedesktop.org/patch/msgid/20190228144910.26488-6-daniel.vetter@ffwll.ch Signed-off-by: Greg Kroah-Hartman

drm: Auto-set allow_fb_modifiers when given modifiers at plane init

2019-04-05T20:33:15Z

[ Upstream commit 890880ddfdbe256083170866e49c87618b706ac7 ] When drivers pass non-empty lists of modifiers for initializing their planes, we can infer that they allow framebuffer modifiers and set the driver's allow_fb_modifiers mode config element. In case the allow_fb_modifiers element was not set (some drivers tend to set them after registering planes), the modifiers will still be registered but won't be available to userspace unless the flag is set later. However in that case, the IN_FORMATS blob won't be created. In order to avoid this case and generally reduce the trouble associated with the flag, always set allow_fb_modifiers when a non-empty list of format modifiers is passed at plane init. Reviewed-by: Daniel Vetter Signed-off-by: Paul Kocialkowski Signed-off-by: Maxime Ripard Link: https://patchwork.freedesktop.org/patch/msgid/20190104085610.5829-1-paul.kocialkowski@bootlin.com Signed-off-by: Sasha Levin

drm: Introduce __setplane_atomic()

2018-07-13T14:58:19Z

All the plane->fb/old_fb/crtc dance of __setplane_internal() is pointless on atomic drivers. So let's just introduce a simpler version that skips all that. Ideally we could also skip the __setplane_check() as drm_atomic_plane_check() already checks for everything, but the legacy cursor/"async" .update_plane() tricks bypass that so we still need to call __setplane_check(). Toss in a FIXME to remind someone to clean this up later. v2: Use drm_drv_uses_atomic_modeset() (Daniel) Signed-off-by: Ville Syrjälä Reviewed-by: Daniel Vetter Link: https://patchwork.freedesktop.org/patch/msgid/20180705185907.9524-1-ville.syrjala@linux.intel.com

drm: Extract __setplane_check()

2018-07-13T14:58:19Z

Pull all the error checking out from __set_plane_internal() to a helper function. We'll have another user of this soon. Signed-off-by: Ville Syrjälä Link: https://patchwork.freedesktop.org/patch/msgid/20180628135457.14647-1-ville.syrjala@linux.intel.com Reviewed-by: Rodrigo Vivi Reviewed-by: Daniel Vetter

drm: Add checks for atomic_[duplicate/destroy]_state with atomic drivers

2018-06-18T07:20:51Z

This patch add checks for atomic_[duplicate/destroy]_state of drm_[connector/crtc/plane]_funcs for atomic drivers in the relevant drm_*_init functions since these callback are mandatory for atomic drivers. Update the kerneldoc comments for those callbacks. Signed-off-by: Haneen Mohammed Reviewed-by: Sean Paul Signed-off-by: Daniel Vetter Link: https://patchwork.freedesktop.org/patch/msgid/20180525012555.GA8448@haneen-vb

drm: Stop updating plane->crtc/fb/old_fb on atomic drivers

2018-06-11T17:22:44Z

Stop playing around with plane->crtc/fb/old_fb with atomic drivers. Make life a lot simpler when we don't have to do the magic old_fb vs. fb dance around plane updates. That way we can't risk plane->fb getting out of sync with plane->state->fb and we're less likely to leak any refcounts as well. Signed-off-by: Ville Syrjälä Reviewed-by: Maarten Lankhorst Acked-by: Harry Wentland Link: https://patchwork.freedesktop.org/patch/msgid/20180525185045.29689-14-ville.syrjala@linux.intel.com Reviewed-by: Sinclair Yeh

drm: Trust format_mod_supported() when it OKs a plane modifier.

2018-05-31T18:19:04Z

For parameterized modifiers (Broadcom's SAND and UIF), we need to allow the parameter fields to be filled in, while exposing only the variant of the modifier with the parameter unfilled in the internal arrays and the format blob. Signed-off-by: Eric Anholt Cc: Ville Syrjälä Link: https://patchwork.freedesktop.org/patch/msgid/20180316220435.31416-1-eric@anholt.net Reviewed-by: Ville Syrjälä

drm: Use plane->state->fb over plane->fb

2018-03-29T16:14:21Z

Stop looking at plane->fb on atomic drivers. Use plane->state->fb instead. Signed-off-by: Ville Syrjälä Link: https://patchwork.freedesktop.org/patch/msgid/20180322152313.6561-9-ville.syrjala@linux.intel.com Reviewed-by: Daniel Vetter Reviewed-by: Maarten Lankhorst