| Message ID | 1398176385-32174-1-git-send-email-daniel.vetter@ffwll.ch (mailing list archive) |
|---|---|
| State | New, archived |
| Headers | show |
On Tue, Apr 22, 2014 at 04:19:45PM +0200, Daniel Vetter wrote: > The introduction of primary planes has apparently caused a bit of fb > refcounting fun for people. That makes it a good time to clean up the > arcane rules and slight differences between ->update_plane and > ->set_config. The new rules are: > > - The core holds a reference for both the new and the old fb (if > they're non-NULL of course) while calling into the driver through > either ->update_plane or ->set_config. > > - Drivers may not clobber plane->fb if their callback fails. If they > do that, they need to store a pointer to the old fb in it again. > When calling into the driver plane->fb still points at the current > (old) framebuffer. > > - The core will update the plane->fb pointer on success. Drivers can > do that themselves too, but aren't required to any more for the > primary plane. > > - The core will update fb refcounts for the plane->fb pointer, > presuming the drivers hold up their end of the bargain. > > v2: Remove now unused tmpfb (Thierry) > > v3: Drop broken changes from drm_mode_setplane (Ville). Also polish > the commit message a bit. It looks like we might have some problems around setplane with fbid=0. It looks like we're assuming that disabling a plane always succeeds (which is no longer true for helper-based primary planes --- they just return -EINVAL on disable now), so we wind up setting old_fb to the currently scanned out framebuffer and then unref it at the end of the function if I'm reading things correctly. We also clobber the plane->crtc and plane->fb pointers too when this happens. I think the real problem here was introduced on b6ccd7b9 and I gave you an r-b tag on that email, so that's my bad for not catching it before. :-( Matt > > Cc: Thierry Reding <treding@nvidia.com> > Cc: Ville Syrjälä <ville.syrjala@linux.intel.com> > Signed-off-by: Daniel Vetter <daniel.vetter@ffwll.ch> > --- > drivers/gpu/drm/drm_crtc.c | 8 ++++---- > drivers/gpu/drm/drm_plane_helper.c | 16 ---------------- > 2 files changed, 4 insertions(+), 20 deletions(-) > > diff --git a/drivers/gpu/drm/drm_crtc.c b/drivers/gpu/drm/drm_crtc.c > index d8b7099abece..a76000ee2a43 100644 > --- a/drivers/gpu/drm/drm_crtc.c > +++ b/drivers/gpu/drm/drm_crtc.c > @@ -2187,16 +2187,18 @@ int drm_mode_setplane(struct drm_device *dev, void *data, > } > > drm_modeset_lock_all(dev); > + old_fb = plane->fb; > ret = plane->funcs->update_plane(plane, crtc, fb, > plane_req->crtc_x, plane_req->crtc_y, > plane_req->crtc_w, plane_req->crtc_h, > plane_req->src_x, plane_req->src_y, > plane_req->src_w, plane_req->src_h); > if (!ret) { > - old_fb = plane->fb; > plane->crtc = crtc; > plane->fb = fb; > fb = NULL; > + } else { > + old_fb = NULL; > } > drm_modeset_unlock_all(dev); > > @@ -2239,9 +2241,7 @@ int drm_mode_set_config_internal(struct drm_mode_set *set) > ret = crtc->funcs->set_config(set); > if (ret == 0) { > crtc->primary->crtc = crtc; > - > - /* crtc->fb must be updated by ->set_config, enforces this. */ > - WARN_ON(fb != crtc->primary->fb); > + crtc->primary->fb = fb; > } > > list_for_each_entry(tmp, &crtc->dev->mode_config.crtc_list, head) { > diff --git a/drivers/gpu/drm/drm_plane_helper.c b/drivers/gpu/drm/drm_plane_helper.c > index 9540ff9f97fe..b72736d5541d 100644 > --- a/drivers/gpu/drm/drm_plane_helper.c > +++ b/drivers/gpu/drm/drm_plane_helper.c > @@ -124,7 +124,6 @@ int drm_primary_helper_update(struct drm_plane *plane, struct drm_crtc *crtc, > .y2 = crtc->mode.vdisplay, > }; > struct drm_connector **connector_list; > - struct drm_framebuffer *tmpfb; > int num_connectors, ret; > > if (!crtc->enabled) { > @@ -177,22 +176,7 @@ int drm_primary_helper_update(struct drm_plane *plane, struct drm_crtc *crtc, > set.connectors = connector_list; > set.num_connectors = num_connectors; > > - /* > - * set_config() adjusts crtc->primary->fb; however the DRM setplane > - * code that called us expects to handle the framebuffer update and > - * reference counting; save and restore the current fb before > - * calling it. > - * > - * N.B., we call set_config() directly here rather than using > - * drm_mode_set_config_internal. We're reprogramming the same > - * connectors that were already in use, so we shouldn't need the extra > - * cross-CRTC fb refcounting to accomodate stealing connectors. > - * drm_mode_setplane() already handles the basic refcounting for the > - * framebuffers involved in this operation. > - */ I think there's still some value in the part of this comment that explains why we're choosing not to call drm_mode_set_config_internal(). > - tmpfb = plane->fb; > ret = crtc->funcs->set_config(&set); > - plane->fb = tmpfb; > > kfree(connector_list); > return ret; > -- > 1.9.2 > > _______________________________________________ > dri-devel mailing list > dri-devel@lists.freedesktop.org > http://lists.freedesktop.org/mailman/listinfo/dri-devel
On Wed, Apr 23, 2014 at 3:08 AM, Matt Roper <matthew.d.roper@intel.com> wrote: > On Tue, Apr 22, 2014 at 04:19:45PM +0200, Daniel Vetter wrote: >> The introduction of primary planes has apparently caused a bit of fb >> refcounting fun for people. That makes it a good time to clean up the >> arcane rules and slight differences between ->update_plane and >> ->set_config. The new rules are: >> >> - The core holds a reference for both the new and the old fb (if >> they're non-NULL of course) while calling into the driver through >> either ->update_plane or ->set_config. >> >> - Drivers may not clobber plane->fb if their callback fails. If they >> do that, they need to store a pointer to the old fb in it again. >> When calling into the driver plane->fb still points at the current >> (old) framebuffer. >> >> - The core will update the plane->fb pointer on success. Drivers can >> do that themselves too, but aren't required to any more for the >> primary plane. >> >> - The core will update fb refcounts for the plane->fb pointer, >> presuming the drivers hold up their end of the bargain. >> >> v2: Remove now unused tmpfb (Thierry) >> >> v3: Drop broken changes from drm_mode_setplane (Ville). Also polish >> the commit message a bit. > > It looks like we might have some problems around setplane with fbid=0. > It looks like we're assuming that disabling a plane always succeeds > (which is no longer true for helper-based primary planes --- they just > return -EINVAL on disable now), so we wind up setting old_fb to the > currently scanned out framebuffer and then unref it at the end of the > function if I'm reading things correctly. We also clobber the > plane->crtc and plane->fb pointers too when this happens. > > I think the real problem here was introduced on b6ccd7b9 and I gave you > an r-b tag on that email, so that's my bad for not catching it before. > :-( Hm, that's indeed a bit fishy. Otoh I don't understand how this blows up with existing userspace since we should only hit this if userspace does an explicit disable call on the primary plane through the ioctl. It's a bug for sure though. -Daniel
On Wed, Apr 23, 2014 at 8:36 AM, Daniel Vetter <daniel.vetter@ffwll.ch> wrote: > Hm, that's indeed a bit fishy. Otoh I don't understand how this blows > up with existing userspace since we should only hit this if userspace > does an explicit disable call on the primary plane through the ioctl. > It's a bug for sure though. Actually even before commit b6ccd7b9873dc46becd11838c885d5c783784156 Author: Daniel Vetter <daniel.vetter@ffwll.ch> Date: Tue Apr 15 10:02:43 2014 +0200 drm/plane-helper: Don't fake-implement primary plane disabling this was broken since if any other plane was enabled it would return -EBUSY. So this might actually explain the refcounting woes since the above patch isn't yet merged into any of the upstream drm trees. -Daniel
diff --git a/drivers/gpu/drm/drm_crtc.c b/drivers/gpu/drm/drm_crtc.c index d8b7099abece..a76000ee2a43 100644 --- a/drivers/gpu/drm/drm_crtc.c +++ b/drivers/gpu/drm/drm_crtc.c @@ -2187,16 +2187,18 @@ int drm_mode_setplane(struct drm_device *dev, void *data, } drm_modeset_lock_all(dev); + old_fb = plane->fb; ret = plane->funcs->update_plane(plane, crtc, fb, plane_req->crtc_x, plane_req->crtc_y, plane_req->crtc_w, plane_req->crtc_h, plane_req->src_x, plane_req->src_y, plane_req->src_w, plane_req->src_h); if (!ret) { - old_fb = plane->fb; plane->crtc = crtc; plane->fb = fb; fb = NULL; + } else { + old_fb = NULL; } drm_modeset_unlock_all(dev); @@ -2239,9 +2241,7 @@ int drm_mode_set_config_internal(struct drm_mode_set *set) ret = crtc->funcs->set_config(set); if (ret == 0) { crtc->primary->crtc = crtc; - - /* crtc->fb must be updated by ->set_config, enforces this. */ - WARN_ON(fb != crtc->primary->fb); + crtc->primary->fb = fb; } list_for_each_entry(tmp, &crtc->dev->mode_config.crtc_list, head) { diff --git a/drivers/gpu/drm/drm_plane_helper.c b/drivers/gpu/drm/drm_plane_helper.c index 9540ff9f97fe..b72736d5541d 100644 --- a/drivers/gpu/drm/drm_plane_helper.c +++ b/drivers/gpu/drm/drm_plane_helper.c @@ -124,7 +124,6 @@ int drm_primary_helper_update(struct drm_plane *plane, struct drm_crtc *crtc, .y2 = crtc->mode.vdisplay, }; struct drm_connector **connector_list; - struct drm_framebuffer *tmpfb; int num_connectors, ret; if (!crtc->enabled) { @@ -177,22 +176,7 @@ int drm_primary_helper_update(struct drm_plane *plane, struct drm_crtc *crtc, set.connectors = connector_list; set.num_connectors = num_connectors; - /* - * set_config() adjusts crtc->primary->fb; however the DRM setplane - * code that called us expects to handle the framebuffer update and - * reference counting; save and restore the current fb before - * calling it. - * - * N.B., we call set_config() directly here rather than using - * drm_mode_set_config_internal. We're reprogramming the same - * connectors that were already in use, so we shouldn't need the extra - * cross-CRTC fb refcounting to accomodate stealing connectors. - * drm_mode_setplane() already handles the basic refcounting for the - * framebuffers involved in this operation. - */ - tmpfb = plane->fb; ret = crtc->funcs->set_config(&set); - plane->fb = tmpfb; kfree(connector_list); return ret;
The introduction of primary planes has apparently caused a bit of fb refcounting fun for people. That makes it a good time to clean up the arcane rules and slight differences between ->update_plane and ->set_config. The new rules are: - The core holds a reference for both the new and the old fb (if they're non-NULL of course) while calling into the driver through either ->update_plane or ->set_config. - Drivers may not clobber plane->fb if their callback fails. If they do that, they need to store a pointer to the old fb in it again. When calling into the driver plane->fb still points at the current (old) framebuffer. - The core will update the plane->fb pointer on success. Drivers can do that themselves too, but aren't required to any more for the primary plane. - The core will update fb refcounts for the plane->fb pointer, presuming the drivers hold up their end of the bargain. v2: Remove now unused tmpfb (Thierry) v3: Drop broken changes from drm_mode_setplane (Ville). Also polish the commit message a bit. Cc: Thierry Reding <treding@nvidia.com> Cc: Ville Syrjälä <ville.syrjala@linux.intel.com> Signed-off-by: Daniel Vetter <daniel.vetter@ffwll.ch> --- drivers/gpu/drm/drm_crtc.c | 8 ++++---- drivers/gpu/drm/drm_plane_helper.c | 16 ---------------- 2 files changed, 4 insertions(+), 20 deletions(-)