diff mbox

drm: rcar-du: Fix plane state free in plane reset handler

Message ID 1438820580-14301-1-git-send-email-laurent.pinchart+renesas@ideasonboard.com (mailing list archive)
State New, archived
Headers show

Commit Message

Laurent Pinchart Aug. 6, 2015, 12:23 a.m. UTC
The plane reset handler frees the plane state and allocates a new
default state, but when doing so attempt to free the plane state using
the base plane state pointer instead of casting it to the
driver-specific state object that has been allocated. Fix it by using
the rcar_du_plane_atomic_destroy_state() function to destroy the plane
state instead of duplicating the code.

Signed-off-by: Laurent Pinchart <laurent.pinchart+renesas@ideasonboard.com>
---
 drivers/gpu/drm/rcar-du/rcar_du_plane.c | 45 ++++++++++++++++-----------------
 1 file changed, 22 insertions(+), 23 deletions(-)

Should the DRM core free the atomic state before calling the reset operation ?
That would simplify drivers.

Comments

Thierry Reding Aug. 7, 2015, 12:53 p.m. UTC | #1
On Thu, Aug 06, 2015 at 03:23:00AM +0300, Laurent Pinchart wrote:
> The plane reset handler frees the plane state and allocates a new
> default state, but when doing so attempt to free the plane state using
> the base plane state pointer instead of casting it to the
> driver-specific state object that has been allocated. Fix it by using
> the rcar_du_plane_atomic_destroy_state() function to destroy the plane
> state instead of duplicating the code.
> 
> Signed-off-by: Laurent Pinchart <laurent.pinchart+renesas@ideasonboard.com>
> ---
>  drivers/gpu/drm/rcar-du/rcar_du_plane.c | 45 ++++++++++++++++-----------------
>  1 file changed, 22 insertions(+), 23 deletions(-)
> 
> Should the DRM core free the atomic state before calling the reset operation ?
> That would simplify drivers.

The core can't do that because drivers might have subclassed the state.

Reviewed-by: Thierry Reding <treding@nvidia.com>
Laurent Pinchart Aug. 7, 2015, 2:30 p.m. UTC | #2
Hi Thierry,

On Friday 07 August 2015 14:53:22 Thierry Reding wrote:
> On Thu, Aug 06, 2015 at 03:23:00AM +0300, Laurent Pinchart wrote:
> > The plane reset handler frees the plane state and allocates a new
> > default state, but when doing so attempt to free the plane state using
> > the base plane state pointer instead of casting it to the
> > driver-specific state object that has been allocated. Fix it by using
> > the rcar_du_plane_atomic_destroy_state() function to destroy the plane
> > state instead of duplicating the code.
> > 
> > Signed-off-by: Laurent Pinchart
> > <laurent.pinchart+renesas@ideasonboard.com>
> > ---
> > 
> >  drivers/gpu/drm/rcar-du/rcar_du_plane.c | 45 ++++++++++++++--------------
> >  1 file changed, 22 insertions(+), 23 deletions(-)
> > 
> > Should the DRM core free the atomic state before calling the reset
> > operation ? That would simplify drivers.
> 
> The core can't do that because drivers might have subclassed the state.

But the core can call the .atomic_destroy_state() operation, can't it ?

> Reviewed-by: Thierry Reding <treding@nvidia.com>
Laurent Pinchart Aug. 13, 2015, 9:19 p.m. UTC | #3
On Friday 07 August 2015 17:30:08 Laurent Pinchart wrote:
> On Friday 07 August 2015 14:53:22 Thierry Reding wrote:
> > On Thu, Aug 06, 2015 at 03:23:00AM +0300, Laurent Pinchart wrote:
> > > The plane reset handler frees the plane state and allocates a new
> > > default state, but when doing so attempt to free the plane state using
> > > the base plane state pointer instead of casting it to the
> > > driver-specific state object that has been allocated. Fix it by using
> > > the rcar_du_plane_atomic_destroy_state() function to destroy the plane
> > > state instead of duplicating the code.
> > > 
> > > Signed-off-by: Laurent Pinchart
> > > <laurent.pinchart+renesas@ideasonboard.com>
> > > ---
> > > 
> > >  drivers/gpu/drm/rcar-du/rcar_du_plane.c | 45 ++++++++++++--------------
> > >  1 file changed, 22 insertions(+), 23 deletions(-)
> > > 
> > > Should the DRM core free the atomic state before calling the reset
> > > operation ? That would simplify drivers.
> > 
> > The core can't do that because drivers might have subclassed the state.
> 
> But the core can call the .atomic_destroy_state() operation, can't it ?

Thierry, Daniel, any comment on this ?

> > Reviewed-by: Thierry Reding <treding@nvidia.com>
Daniel Vetter Aug. 14, 2015, 7:30 a.m. UTC | #4
On Fri, Aug 14, 2015 at 12:19:03AM +0300, Laurent Pinchart wrote:
> On Friday 07 August 2015 17:30:08 Laurent Pinchart wrote:
> > On Friday 07 August 2015 14:53:22 Thierry Reding wrote:
> > > On Thu, Aug 06, 2015 at 03:23:00AM +0300, Laurent Pinchart wrote:
> > > > The plane reset handler frees the plane state and allocates a new
> > > > default state, but when doing so attempt to free the plane state using
> > > > the base plane state pointer instead of casting it to the
> > > > driver-specific state object that has been allocated. Fix it by using
> > > > the rcar_du_plane_atomic_destroy_state() function to destroy the plane
> > > > state instead of duplicating the code.
> > > > 
> > > > Signed-off-by: Laurent Pinchart
> > > > <laurent.pinchart+renesas@ideasonboard.com>
> > > > ---
> > > > 
> > > >  drivers/gpu/drm/rcar-du/rcar_du_plane.c | 45 ++++++++++++--------------
> > > >  1 file changed, 22 insertions(+), 23 deletions(-)
> > > > 
> > > > Should the DRM core free the atomic state before calling the reset
> > > > operation ? That would simplify drivers.
> > > 
> > > The core can't do that because drivers might have subclassed the state.
> > 
> > But the core can call the .atomic_destroy_state() operation, can't it ?
> 
> Thierry, Daniel, any comment on this ?

Doesn't really help you since the kzalloc is still in the helper. Btw this
is all helper code, core won't do here anything at all ;-)

But we could still do it simply as a refactoring and to show drivers how
to implement their _reset with less copypasting.
-Daniel
Laurent Pinchart Aug. 18, 2015, 6:35 a.m. UTC | #5
Hi Daniel,

On Friday 14 August 2015 09:30:15 Daniel Vetter wrote:
> On Fri, Aug 14, 2015 at 12:19:03AM +0300, Laurent Pinchart wrote:
> > On Friday 07 August 2015 17:30:08 Laurent Pinchart wrote:
> > > On Friday 07 August 2015 14:53:22 Thierry Reding wrote:
> > > > On Thu, Aug 06, 2015 at 03:23:00AM +0300, Laurent Pinchart wrote:
> > > > > The plane reset handler frees the plane state and allocates a new
> > > > > default state, but when doing so attempt to free the plane state
> > > > > using the base plane state pointer instead of casting it to the
> > > > > driver-specific state object that has been allocated. Fix it by
> > > > > using the rcar_du_plane_atomic_destroy_state() function to destroy
> > > > > the plane state instead of duplicating the code.
> > > > > 
> > > > > Signed-off-by: Laurent Pinchart
> > > > > <laurent.pinchart+renesas@ideasonboard.com>
> > > > > ---
> > > > > 
> > > > >  drivers/gpu/drm/rcar-du/rcar_du_plane.c | 45 ++++++++++------------
> > > > >  1 file changed, 22 insertions(+), 23 deletions(-)
> > > > > 
> > > > > Should the DRM core free the atomic state before calling the reset
> > > > > operation ? That would simplify drivers.
> > > > 
> > > > The core can't do that because drivers might have subclassed the
> > > > state.
> > > 
> > > But the core can call the .atomic_destroy_state() operation, can't it ?
> > 
> > Thierry, Daniel, any comment on this ?
> 
> Doesn't really help you since the kzalloc is still in the helper. Btw this
> is all helper code, core won't do here anything at all ;-)

Is it ? The .reset() and .atomic_destroy_state() are core plane operations, 
not helper operations.

My point is that, as .reset() needs to allocate the state if no state exists, 
I'm wondering whether it wouldn't be simpler for drivers to free the state in 
the core using .atomic_destroy_state() before calling .reset() and always 
allocate a state in the driver's .reset() implementation.

In peudo-code, drivers currently do (or at least should do)

atomic_destroy_state(state)
{
	driver_state = cast_to_driver_state(state);

	clean up driver_state;
	kfree(driver_state);
}

reset()
{
	if (state) {
		driver_state = cast_to_driver_state(state);

		clean up driver_state;
	} else {
		driver_state = kzalloc(...);
	}

	set all fields of driver_state to default values;
}

Wouldn't it be simpler to have the core call .atomic_destroy_state() before 
.reset() and implement .reset() as

reset()
	driver_state = kzalloc(...);

	set all fields of driver_state to default values;
}

?

> But we could still do it simply as a refactoring and to show drivers how
> to implement their _reset with less copypasting.
Daniel Vetter Aug. 25, 2015, 7:15 a.m. UTC | #6
On Tue, Aug 18, 2015 at 09:35:44AM +0300, Laurent Pinchart wrote:
> Hi Daniel,
> 
> On Friday 14 August 2015 09:30:15 Daniel Vetter wrote:
> > On Fri, Aug 14, 2015 at 12:19:03AM +0300, Laurent Pinchart wrote:
> > > On Friday 07 August 2015 17:30:08 Laurent Pinchart wrote:
> > > > On Friday 07 August 2015 14:53:22 Thierry Reding wrote:
> > > > > On Thu, Aug 06, 2015 at 03:23:00AM +0300, Laurent Pinchart wrote:
> > > > > > The plane reset handler frees the plane state and allocates a new
> > > > > > default state, but when doing so attempt to free the plane state
> > > > > > using the base plane state pointer instead of casting it to the
> > > > > > driver-specific state object that has been allocated. Fix it by
> > > > > > using the rcar_du_plane_atomic_destroy_state() function to destroy
> > > > > > the plane state instead of duplicating the code.
> > > > > > 
> > > > > > Signed-off-by: Laurent Pinchart
> > > > > > <laurent.pinchart+renesas@ideasonboard.com>
> > > > > > ---
> > > > > > 
> > > > > >  drivers/gpu/drm/rcar-du/rcar_du_plane.c | 45 ++++++++++------------
> > > > > >  1 file changed, 22 insertions(+), 23 deletions(-)
> > > > > > 
> > > > > > Should the DRM core free the atomic state before calling the reset
> > > > > > operation ? That would simplify drivers.
> > > > > 
> > > > > The core can't do that because drivers might have subclassed the
> > > > > state.
> > > > 
> > > > But the core can call the .atomic_destroy_state() operation, can't it ?
> > > 
> > > Thierry, Daniel, any comment on this ?
> > 
> > Doesn't really help you since the kzalloc is still in the helper. Btw this
> > is all helper code, core won't do here anything at all ;-)
> 
> Is it ? The .reset() and .atomic_destroy_state() are core plane operations, 
> not helper operations.

Reset not being a helper func is an accident of history I think, it should
be moved.

> My point is that, as .reset() needs to allocate the state if no state exists, 
> I'm wondering whether it wouldn't be simpler for drivers to free the state in 
> the core using .atomic_destroy_state() before calling .reset() and always 
> allocate a state in the driver's .reset() implementation.
> 
> In peudo-code, drivers currently do (or at least should do)
> 
> atomic_destroy_state(state)
> {
> 	driver_state = cast_to_driver_state(state);
> 
> 	clean up driver_state;
> 	kfree(driver_state);
> }
> 
> reset()
> {
> 	if (state) {
> 		driver_state = cast_to_driver_state(state);
> 
> 		clean up driver_state;

Why not call destroy_state here and make the kzalloc unconditional?
Simpler and with that not much point in removing copypasting ...

> 	} else {
> 		driver_state = kzalloc(...);
> 	}
> 
> 	set all fields of driver_state to default values;
> }
> 
> Wouldn't it be simpler to have the core call .atomic_destroy_state() before 
> .reset() and implement .reset() as
> 
> reset()
> 	driver_state = kzalloc(...);
> 
> 	set all fields of driver_state to default values;
> }
> 
> ?

Well all the reset stuff was pretty much stop-gap, ->reset really
shouldn't be a core op. What I eventually wanted to do is lift the hw
state readout logic from i915 as the proper way to do this, since without
this you can't do fastboot. Eric is interested in fastboot for vc4, so we
discussed this a bit at lpc.
-Daniel
Laurent Pinchart Oct. 19, 2015, 10:40 p.m. UTC | #7
Hi Daniel,

On Tuesday 25 August 2015 09:15:16 Daniel Vetter wrote:
> On Tue, Aug 18, 2015 at 09:35:44AM +0300, Laurent Pinchart wrote:
> > On Friday 14 August 2015 09:30:15 Daniel Vetter wrote:
> > > On Fri, Aug 14, 2015 at 12:19:03AM +0300, Laurent Pinchart wrote:
> > > > On Friday 07 August 2015 17:30:08 Laurent Pinchart wrote:
> > > > > On Friday 07 August 2015 14:53:22 Thierry Reding wrote:
> > > > > > On Thu, Aug 06, 2015 at 03:23:00AM +0300, Laurent Pinchart wrote:
> > > > > > > The plane reset handler frees the plane state and allocates a
> > > > > > > new default state, but when doing so attempt to free the plane
> > > > > > > state using the base plane state pointer instead of casting it
> > > > > > > to the driver-specific state object that has been allocated. Fix
> > > > > > > it by using the rcar_du_plane_atomic_destroy_state() function to
> > > > > > > destroy the plane state instead of duplicating the code.
> > > > > > > 
> > > > > > > Signed-off-by: Laurent Pinchart
> > > > > > > <laurent.pinchart+renesas@ideasonboard.com>
> > > > > > > ---
> > > > > > > 
> > > > > > >  drivers/gpu/drm/rcar-du/rcar_du_plane.c | 45 +++++++++---------
> > > > > > >  1 file changed, 22 insertions(+), 23 deletions(-)
> > > > > > > 
> > > > > > > Should the DRM core free the atomic state before calling the
> > > > > > > reset operation ? That would simplify drivers.
> > > > > > 
> > > > > > The core can't do that because drivers might have subclassed the
> > > > > > state.
> > > > > 
> > > > > But the core can call the .atomic_destroy_state() operation, can't
> > > > > it ?
> > > > 
> > > > Thierry, Daniel, any comment on this ?
> > > 
> > > Doesn't really help you since the kzalloc is still in the helper. Btw
> > > this is all helper code, core won't do here anything at all ;-)
> > 
> > Is it ? The .reset() and .atomic_destroy_state() are core plane
> > operations, not helper operations.
> 
> Reset not being a helper func is an accident of history I think, it should
> be moved.

Fine with me.

> > My point is that, as .reset() needs to allocate the state if no state
> > exists, I'm wondering whether it wouldn't be simpler for drivers to free
> > the state in the core using .atomic_destroy_state() before calling
> > .reset() and always allocate a state in the driver's .reset()
> > implementation.
> > 
> > In peudo-code, drivers currently do (or at least should do)
> > 
> > atomic_destroy_state(state)
> > {
> > 	driver_state = cast_to_driver_state(state);
> > 	
> > 	clean up driver_state;
> > 	kfree(driver_state);
> > }
> > 
> > reset()
> > {
> > 	if (state) {
> > 		driver_state = cast_to_driver_state(state);
> > 		
> > 		clean up driver_state;
> 
> Why not call destroy_state here and make the kzalloc unconditional?
> Simpler and with that not much point in removing copypasting ...

So all drivers would have to unconditionally call their atomic_destroy_state() 
handler at the beginning of reset() ? Wouldn't it be simpler to move that call 
in the helpers before calling reset() ?

> > 	} else {
> > 		driver_state = kzalloc(...);
> > 	}
> > 	
> > 	set all fields of driver_state to default values;
> > }
> > 
> > Wouldn't it be simpler to have the core call .atomic_destroy_state()
> > before .reset() and implement .reset() as
> > 
> > reset()
> > 	driver_state = kzalloc(...);
> > 	
> > 	set all fields of driver_state to default values;
> > }
> > 
> > ?
> 
> Well all the reset stuff was pretty much stop-gap, ->reset really
> shouldn't be a core op. What I eventually wanted to do is lift the hw
> state readout logic from i915 as the proper way to do this, since without
> this you can't do fastboot. Eric is interested in fastboot for vc4, so we
> discussed this a bit at lpc.
Daniel Vetter Oct. 20, 2015, 7:25 a.m. UTC | #8
On Tue, Oct 20, 2015 at 01:40:39AM +0300, Laurent Pinchart wrote:
> Hi Daniel,
> 
> On Tuesday 25 August 2015 09:15:16 Daniel Vetter wrote:
> > On Tue, Aug 18, 2015 at 09:35:44AM +0300, Laurent Pinchart wrote:
> > > On Friday 14 August 2015 09:30:15 Daniel Vetter wrote:
> > > > On Fri, Aug 14, 2015 at 12:19:03AM +0300, Laurent Pinchart wrote:
> > > > > On Friday 07 August 2015 17:30:08 Laurent Pinchart wrote:
> > > > > > On Friday 07 August 2015 14:53:22 Thierry Reding wrote:
> > > > > > > On Thu, Aug 06, 2015 at 03:23:00AM +0300, Laurent Pinchart wrote:
> > > > > > > > The plane reset handler frees the plane state and allocates a
> > > > > > > > new default state, but when doing so attempt to free the plane
> > > > > > > > state using the base plane state pointer instead of casting it
> > > > > > > > to the driver-specific state object that has been allocated. Fix
> > > > > > > > it by using the rcar_du_plane_atomic_destroy_state() function to
> > > > > > > > destroy the plane state instead of duplicating the code.
> > > > > > > > 
> > > > > > > > Signed-off-by: Laurent Pinchart
> > > > > > > > <laurent.pinchart+renesas@ideasonboard.com>
> > > > > > > > ---
> > > > > > > > 
> > > > > > > >  drivers/gpu/drm/rcar-du/rcar_du_plane.c | 45 +++++++++---------
> > > > > > > >  1 file changed, 22 insertions(+), 23 deletions(-)
> > > > > > > > 
> > > > > > > > Should the DRM core free the atomic state before calling the
> > > > > > > > reset operation ? That would simplify drivers.
> > > > > > > 
> > > > > > > The core can't do that because drivers might have subclassed the
> > > > > > > state.
> > > > > > 
> > > > > > But the core can call the .atomic_destroy_state() operation, can't
> > > > > > it ?
> > > > > 
> > > > > Thierry, Daniel, any comment on this ?
> > > > 
> > > > Doesn't really help you since the kzalloc is still in the helper. Btw
> > > > this is all helper code, core won't do here anything at all ;-)
> > > 
> > > Is it ? The .reset() and .atomic_destroy_state() are core plane
> > > operations, not helper operations.
> > 
> > Reset not being a helper func is an accident of history I think, it should
> > be moved.
> 
> Fine with me.
> 
> > > My point is that, as .reset() needs to allocate the state if no state
> > > exists, I'm wondering whether it wouldn't be simpler for drivers to free
> > > the state in the core using .atomic_destroy_state() before calling
> > > .reset() and always allocate a state in the driver's .reset()
> > > implementation.
> > > 
> > > In peudo-code, drivers currently do (or at least should do)
> > > 
> > > atomic_destroy_state(state)
> > > {
> > > 	driver_state = cast_to_driver_state(state);
> > > 	
> > > 	clean up driver_state;
> > > 	kfree(driver_state);
> > > }
> > > 
> > > reset()
> > > {
> > > 	if (state) {
> > > 		driver_state = cast_to_driver_state(state);
> > > 		
> > > 		clean up driver_state;
> > 
> > Why not call destroy_state here and make the kzalloc unconditional?
> > Simpler and with that not much point in removing copypasting ...
> 
> So all drivers would have to unconditionally call their atomic_destroy_state() 
> handler at the beginning of reset() ? Wouldn't it be simpler to move that call 
> in the helpers before calling reset() ?

The sequence is roughly:
- Destroy old state if there is one
- kzalloce new one
- init the new state (either with hw state readout or resetting)

First step is fully generic, and parts of the last step (all the core
state) can be reset in a generic way. Problem is the kzalloc in the
middle, which needs to know the allocation size, and that's driver
specific. At that point it gets complicated imo and copypasting is ok.

Adding a call to atomic_destroy_state in the overall reset helper will
likely screw up old drivers using reset for other purposes. And i915,
where we use reset helpers to reset some hw state before we do the atomic
state restore with different means.

There _is_ room though for better reset helpers, but for those I think a
better plan is go right ahead and implement fastboot. I guess we could do
that, but I think shoehorning that into the ->reset callbacks won't work
too well.
-Daniel

> 
> > > 	} else {
> > > 		driver_state = kzalloc(...);
> > > 	}
> > > 	
> > > 	set all fields of driver_state to default values;
> > > }
> > > 
> > > Wouldn't it be simpler to have the core call .atomic_destroy_state()
> > > before .reset() and implement .reset() as
> > > 
> > > reset()
> > > 	driver_state = kzalloc(...);
> > > 	
> > > 	set all fields of driver_state to default values;
> > > }
> > > 
> > > ?
> > 
> > Well all the reset stuff was pretty much stop-gap, ->reset really
> > shouldn't be a core op. What I eventually wanted to do is lift the hw
> > state readout logic from i915 as the proper way to do this, since without
> > this you can't do fastboot. Eric is interested in fastboot for vc4, so we
> > discussed this a bit at lpc.
> 
> -- 
> Regards,
> 
> Laurent Pinchart
>
diff mbox

Patch

diff --git a/drivers/gpu/drm/rcar-du/rcar_du_plane.c b/drivers/gpu/drm/rcar-du/rcar_du_plane.c
index c66986414bb4..ffa583712cd9 100644
--- a/drivers/gpu/drm/rcar-du/rcar_du_plane.c
+++ b/drivers/gpu/drm/rcar-du/rcar_du_plane.c
@@ -273,29 +273,6 @@  static const struct drm_plane_helper_funcs rcar_du_plane_helper_funcs = {
 	.atomic_update = rcar_du_plane_atomic_update,
 };
 
-static void rcar_du_plane_reset(struct drm_plane *plane)
-{
-	struct rcar_du_plane_state *state;
-
-	if (plane->state && plane->state->fb)
-		drm_framebuffer_unreference(plane->state->fb);
-
-	kfree(plane->state);
-	plane->state = NULL;
-
-	state = kzalloc(sizeof(*state), GFP_KERNEL);
-	if (state == NULL)
-		return;
-
-	state->hwindex = -1;
-	state->alpha = 255;
-	state->colorkey = RCAR_DU_COLORKEY_NONE;
-	state->zpos = plane->type == DRM_PLANE_TYPE_PRIMARY ? 0 : 1;
-
-	plane->state = &state->state;
-	plane->state->plane = plane;
-}
-
 static struct drm_plane_state *
 rcar_du_plane_atomic_duplicate_state(struct drm_plane *plane)
 {
@@ -322,6 +299,28 @@  static void rcar_du_plane_atomic_destroy_state(struct drm_plane *plane,
 	kfree(to_rcar_plane_state(state));
 }
 
+static void rcar_du_plane_reset(struct drm_plane *plane)
+{
+	struct rcar_du_plane_state *state;
+
+	if (plane->state) {
+		rcar_du_plane_atomic_destroy_state(plane, plane->state);
+		plane->state = NULL;
+	}
+
+	state = kzalloc(sizeof(*state), GFP_KERNEL);
+	if (state == NULL)
+		return;
+
+	state->hwindex = -1;
+	state->alpha = 255;
+	state->colorkey = RCAR_DU_COLORKEY_NONE;
+	state->zpos = plane->type == DRM_PLANE_TYPE_PRIMARY ? 0 : 1;
+
+	plane->state = &state->state;
+	plane->state->plane = plane;
+}
+
 static int rcar_du_plane_atomic_set_property(struct drm_plane *plane,
 					     struct drm_plane_state *state,
 					     struct drm_property *property,