From patchwork Fri Oct 12 00:27:43 2018 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Leo Li X-Patchwork-Id: 10637679 Return-Path: Received: from mail.wl.linuxfoundation.org (pdx-wl-mail.web.codeaurora.org [172.30.200.125]) by pdx-korg-patchwork-2.web.codeaurora.org (Postfix) with ESMTP id C57F3112B for ; Fri, 12 Oct 2018 00:28:27 +0000 (UTC) Received: from mail.wl.linuxfoundation.org (localhost [127.0.0.1]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id AE6062BEA8 for ; Fri, 12 Oct 2018 00:28:27 +0000 (UTC) Received: by mail.wl.linuxfoundation.org (Postfix, from userid 486) id A24642BEBA; Fri, 12 Oct 2018 00:28:27 +0000 (UTC) X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on pdx-wl-mail.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-5.2 required=2.0 tests=BAD_ENC_HEADER,BAYES_00, MAILING_LIST_MULTI,RCVD_IN_DNSWL_MED autolearn=ham version=3.3.1 Received: from gabe.freedesktop.org (gabe.freedesktop.org [131.252.210.177]) (using TLSv1.2 with cipher DHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.wl.linuxfoundation.org (Postfix) with ESMTPS id 0D2C42BEA8 for ; Fri, 12 Oct 2018 00:28:26 +0000 (UTC) Received: from gabe.freedesktop.org (localhost [127.0.0.1]) by gabe.freedesktop.org (Postfix) with ESMTP id 42D156E431; Fri, 12 Oct 2018 00:28:25 +0000 (UTC) X-Original-To: dri-devel@lists.freedesktop.org Delivered-To: dri-devel@lists.freedesktop.org Received: from NAM03-CO1-obe.outbound.protection.outlook.com (mail-co1nam03on0060.outbound.protection.outlook.com [104.47.40.60]) by gabe.freedesktop.org (Postfix) with ESMTPS id 04B416E431 for ; Fri, 12 Oct 2018 00:28:23 +0000 (UTC) Received: from DM3PR12CA0081.namprd12.prod.outlook.com (2603:10b6:0:57::25) by BN4PR12MB0739.namprd12.prod.outlook.com (2a01:111:e400:59bc::25) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.1207.28; Fri, 12 Oct 2018 00:28:21 +0000 Received: from DM3NAM03FT065.eop-NAM03.prod.protection.outlook.com (2a01:111:f400:7e49::202) by DM3PR12CA0081.outlook.office365.com (2603:10b6:0:57::25) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384) id 15.20.1228.21 via Frontend Transport; Fri, 12 Oct 2018 00:28:20 +0000 Received-SPF: None (protection.outlook.com: amd.com does not designate permitted sender hosts) Received: from SATLEXCHOV02.amd.com (165.204.84.17) by DM3NAM03FT065.mail.protection.outlook.com (10.152.82.254) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384_P384) id 15.20.1228.17 via Frontend Transport; Fri, 12 Oct 2018 00:28:20 +0000 Received: from leodev.amd.com (10.180.168.240) by SATLEXCHOV02.amd.com (10.181.40.72) with Microsoft SMTP Server id 14.3.389.1; Thu, 11 Oct 2018 19:28:20 -0500 From: To: Subject: [PATCH] drm: Get ref on CRTC commit object when waiting for flip_done Date: Thu, 11 Oct 2018 20:27:43 -0400 Message-ID: <1539304063-9518-1-git-send-email-sunpeng.li@amd.com> X-Mailer: git-send-email 2.7.4 MIME-Version: 1.0 X-EOPAttributedMessage: 0 X-MS-Office365-Filtering-HT: Tenant X-Forefront-Antispam-Report: CIP:165.204.84.17; IPV:NLI; CTRY:US; EFV:NLI; SFV:NSPM; SFS:(10009020)(136003)(376002)(396003)(346002)(39860400002)(2980300002)(428003)(199004)(189003)(186003)(2351001)(5660300001)(81166006)(72206003)(4326008)(26005)(48376002)(77096007)(81156014)(45080400002)(104016004)(8676002)(51416003)(36756003)(7696005)(68736007)(478600001)(8936002)(305945005)(316002)(50466002)(16586007)(54906003)(53416004)(6916009)(105586002)(106466001)(50226002)(2876002)(2906002)(97736004)(86152003)(126002)(47776003)(476003)(2616005)(486006)(1857600001)(426003)(53936002)(14444005)(336012)(6666004)(86362001)(356004); DIR:OUT; SFP:1101; SCL:1; SRVR:BN4PR12MB0739; H:SATLEXCHOV02.amd.com; FPR:; SPF:None; LANG:en; PTR:InfoDomainNonexistent; A:1; MX:1; X-Microsoft-Exchange-Diagnostics: 1; DM3NAM03FT065; 1:EV0kTmcl5j+B9wdBFx2R9d0mpBj5WeD03E0PsQ47pzXo7fqfyxDHrVAAW/1BuL9e/HMMcTGOiFIRbALlglTA7BumORP2zO3oaixXbXEbrkLg7Rhso7xx39QWtZx7E/jX X-MS-PublicTrafficType: Email X-MS-Office365-Filtering-Correlation-Id: 18b8666d-8854-4939-0bd9-08d62fd99d04 X-Microsoft-Antispam: BCL:0; PCL:0; RULEID:(7020095)(4652040)(8989299)(4534185)(4627221)(201703031133081)(201702281549075)(8990200)(5600074)(711020)(2017052603328)(7153060); SRVR:BN4PR12MB0739; X-Microsoft-Exchange-Diagnostics: 1; BN4PR12MB0739; 3:NBBPcZYXCboabq1tRsuOkWScTVURhzvUAlBk1QEQ3ZvUwX5sAmzdWx+aBCdIOwCq4hRP40CFTMmOI9/vknET/m8rqzDm46hO59SnBdoCidwtDq23DfAIFzamAEXI4jT7iFwrXBpEMn0zoYVuIDalbM+QklTXwwCpjOit/vhN6rssCZgJug6on5wQqfO/yj1nuWk1GuZrPHQvbgV8Ta/x/UMhNekSbBttrNOUBTyjE78r0UxeGZK7G0WQgw9y144NeG2oyKQBnCOD6afFIKtE+/X74xE4km6E+1xVRtT5WqOUfGcoeHmIrXATk9WgdqY/RuNJYC9srnB1l/by/9nu+s4VYHblxE/1dg7CVC0H35Y=; 25:G9NrSN30VRm/ZcQc4fwbnsjxxMCmpRS6PQ16B7sVGKchiD53681xkJP8JgQE1Qg9mJvlgKrx2QfaANT5l454ZBQZ94XWB9G3V17Ow6U7t1P6iO3cGKvqD43SiyhhDzill9pucNdPSBYQOUDNvJV/wEeUyl7MAHvpj/yFegntidbQ9yD7EgJcNb3mE7ftZbNRSjAh9JyWomqnfTiDmxECckkLbxzcfy/sgSUprxUtrBn+vkxhqwXgjYRyvA1JDeRJKwq0EPDIjxUFwirkYrCaJZ4g3c6dnUrcCv7e+dweP5D1JcQOKm0yrwrKnS2AnnFtZNd5SqZ3Nbgcym/I7rClTvdjORel1lnZ/ZhiyOs75PI= X-MS-TrafficTypeDiagnostic: BN4PR12MB0739: X-Microsoft-Exchange-Diagnostics: 1; BN4PR12MB0739; 31:2AyJMQCdV7V5lXFw3vrrzY8NOq8cvHkhxHHmmK1miKRQH/YM527gQZOxL/82Gp6pKdVsH4RXLV8AjO4WtPPRTdW/91Pg3rPgeViCFC7nUYyD7WJwt5UUJZB1BSPDR/G8PEuvY+YeGm9nFkXn7/KyNVlnWp5gGGcK8oVp3IzFaJCGsowbB7V3EpRW2IawkEn/jJsF2v6nXOq2Gh+VDvtJjeaCLoLi7EH7oz7sbbMjcBE=; 20:tFkK1+6AuGVwIvP0y/IZi59wKuNCafvKJa+reW2hG/WM2IkOaAMjB4RISTe+AEWAG/Pr0ryertFCDN9+XFCD4viLvz+MCL31i4MRogCa0+dRdq/ICa/JvfwBYqGGVuEbs0TBeo5clFdKdtYNkS3H+nBrGuV6G+p3Qo3Bl16mjAV8nGn36z/ayauiVyUVDzoOOPTt0Xm/V1AFhQUWNndTsnnOz+Dbrj9EWinnCdeAR3LxvjLIgCyJH5V4lRGFCuxgAaXqTZgb0QYTEkAJeQOAUumH+5KHWcB3l4Vc1pIv3Mfc7NYQIH0zIfiSX453cmg8psBSenbYmzq9+IseA8oUrp5U1dhmHK3tPfAirEM+1f7C5VZr1EhcfRPIDKTKlQagldFlC4umSaRN7BeuuSBknugZUkxnyRWmwmyBDt6S0O1E8MwZo8hroCNptdAST+4IEHbE+iCly4XXDg24DdsgzGjrh05r3HGJpie3E82HIUysHPSw0CIIEJ2w57BwDxxa X-Microsoft-Antispam-PRVS: X-Exchange-Antispam-Report-Test: UriScan:(767451399110); X-MS-Exchange-SenderADCheck: 1 X-Exchange-Antispam-Report-CFA-Test: BCL:0; PCL:0; RULEID:(8211001083)(6040522)(2401047)(5005006)(8121501046)(93006095)(93003095)(10201501046)(3231355)(944501410)(52105095)(3002001)(6055026)(149066)(150057)(6041310)(201703131423095)(201702281528075)(20161123555045)(201703061421075)(201703061406153)(20161123564045)(20161123562045)(20161123558120)(20161123560045)(201708071742011)(7699051); SRVR:BN4PR12MB0739; BCL:0; PCL:0; RULEID:; SRVR:BN4PR12MB0739; X-Microsoft-Exchange-Diagnostics: 1; BN4PR12MB0739; 4:hnOVufTt7l1GIG+u29CQI8gowTcGWhdld9YZyknlTooC/hvWZhQpVl/Pv1qVV8o6iNg8oxaM3mPoTFRLrjx21SeVE8UZaCdoeyGnB4hrUnJvVQsSvSWFQZlApe/sdsdFHSzashaXpN7GHWfH7yWjRojA+1Al6F3/2Qa3M4FCLLX6EWOFPfArZEzzR2lw0ChJr61ReJzMvv1jspYLBnc4UD3QqnxdfQKfrR/rxzi/xVjRAwbc1IEANAf+VOnnLlRKDtxeB8BtbJRfB26R8FMrEkBkYj2YVNgtE0WRN34cKYv/+ZWc50Q6AHuB7O9Y/V7s X-Forefront-PRVS: 0823A5777B X-Microsoft-Exchange-Diagnostics: =?us-ascii?Q?1; BN4PR12MB0739; 23:+8RxaU/NZ6inrKsM2KkU9f6dJOnZo6SbaiUeA+3yU?= k+LmrVyFsyQnSieSICA4F7lVPH6zH6o3QhLk4ETcoIr1GAbmAiTo1DSwsdH8SM2V1BVACnmku5hGGkgqJslWGSLxqpr/PpEoRMeNYDvtIMvwE8HNNPHh0SaQUYh4iQ0rBrrOjmohTWmrQIKFRCr5o/LAbc704woxOmk1ivIhfIF3cuk4185rylXF6h8OLNsEZnAM5tgSTVCFLyo3WzostnMppQYQnn0UTi2srC9SShnTNXBeXe2315ERJfMwlba1FeHqtX/mvDLUbVgOCA5Ueu0Hn+2c9iNh2iXSMkwFrOERT8VBYRlaMjzZqylOncix5SEk0MzIhKRmfcij3Un4gc8bBpEUgargrbrr2PeyUh5X0IdwHKebGtaADiBcAEoACe35XjprsgyKAiFguTmmKfzi9fB0pG2675oii/+j7JwVc6qTcW8YmfusWCuDffSASROO0Wo72XC6vM+JBV115bKdFexQ2zs5KFbReQorUN99Xz6m6xdIYcNo2uX3FZL5cyZXZemrwnQuxXFUkHnoXokvr4fKVTnbvXDS2rADl6gESvgDpMfwn8lXA58DqLqHlmauNqIVXdGFkNCqxBpWBaiDvUDpwd+p1KK6AlgEkSa+QnBxkDysciAUshJ+sWmWT/jUJQbLIraHCLgV5oBVrb/egylJ4vN8AIbdj4wjCxI3+uSbobtwjWpBHEb2QuJBT0+zZECMp173CCrmtROGXgq7kd9GjStFeb6/RUzy6GbR6LPM6F+rwmYDhjTR3GL7TlOmen/aCzF8Gnq70WXrCDmo9VwluF8QKpz3FPzVDaRy2r0D3DqN+9ZiC7iAufFaKFlCJqEe5HZedY26huYDAGYzje6IigVjFzZH/7Mjm29zyBPB0uIpEBLTjvQyMAsg50EO/Ju2gKjhR8SaeHwBtzalTUNLtPFRVygkz+wUqg7JjKJCKd7/1y3FBaUwBKuwtREEr6J/pj+C5r8vc8hjApzuUU1yluQs002OjICUdxRIcOCQ7AN2uWIDGjaU2/b3aX9r2pI+dmXU01t3WTEEWorQsvga4Hj7j2Bn8TNnit/NwKyULc6yygYmQ8CssMXu17i/bXT/Z2oNz3DAcx7XJmfbwdWrHqBdGw1pi9xQY0gdnDDXP5k1/gzXLZrs3UWisq6aPqHnhZ7xmif59X01vRuuM+5HlYEAR+QCDUFF00Ufw== X-Microsoft-Antispam-Message-Info: 2LyvqUaRqlJjB39g/1ZnbtK8Utr/id4DWKZOXe0rFrwADkhFjwuro2VsSRs7dZSnckNOUJ7eItYA84T66ZcW7ui74UE5hhZ09pN3j9nnecSz+mIvXTYV9B2vNJfQo4tCkEph1kqGjpqRdWqF+OTCf8eBFTJCSD5wQDvu1xVgOKwZx+0E7NKBFCYe5qmN82Ih31vxw6EBRKOv7G2BzBKlOgWnt53Vjm2v7qz9TtiESG908+0sxyH686+qxV9RsyoOfx3VG+d9jO63DyeUcu/DHfuYgBS7mKsA/zyIcT5Q0qsEIh6TzN6yL3gSh2sJZOpDaG5DpmFOSXSBiDVVvLWZ3wS3uzoSzK2aD8jX6/E/W18= X-Microsoft-Exchange-Diagnostics: 1; BN4PR12MB0739; 6:CyIfQJwQ9Q4u/wCtCM60ar0NVzpDQ5isg17Ld/p9RpnyUobG9HA/FxMnU4hjQAidN051OwGNucDd/oT8sxs92nJh6si3Ksk0MNQG0nweJN6BQl9fdL71JkzKzwnFyK7L1WKpuQzhZgn9jy/mHgJHGvOi8YXxQ2wcnT7oUroW59V91wJLXBD6DCFhdeGwlh2iR9WhqFZLAV54SCd3H1WVEvhLxI9N0YRf7vvuOL5443CMf//poK5QYJtIbU4+uANIifolIEsnT2PP0IS0a7lWheiep9X8thyZutX2yyt81LAlkexC+S3cTs0/FGWmza1Bq2+5oiTy0VHweDLSYoH2wgrFnI9in5E0hjLdly6vx9DL4Zzja5DOi0URk3noAF6ho6RfrCn5WkVurkrgXLZ6gBKmnU8ZWuodLzyd3kEkMEs+JO/UEkSttpU1xuizC46yedQEB+sHokteIOCdSvN4yvQqboKCRV8xEcyVPzCtAzI=; 5:EMzTcFJnrRkdDlUV4nUi7yL1hUxt8jGB8nb1YEXDwP3Q3sRtplSHrOyJ1fiZxOGiSSHI/QGUQIHaS/KLUYaBNxQgnAEinUtIDqsMiFKcifUefQKNNk3eYKNnILEKl0HpAmph6Xzbe+v/vhzDRWZngRPzO9QD0omKTzaXRK2ygvg=; 7:FtADX83hBW8m7SEMvefW/gVhNDrCCWugYUBeylQpry/gR82V32HgCNAqQ2KuM4kY4W7dLG2NZrKPviYKzjns/+00SwwPuLwjuaINsYohQwPdmaoJn3vcGNahaN7M4Pe0EDUsuYvlwBW14UnS+aRmSwTumBc6t1FcmXP52p4Nrn+XnAGsfSvGiyfav3RYLiSLPzRbOpyCfPUpZ5E/GE/KQgwy676y6cIW6p5FYIE9FBG3zRPQ7fkaF0MdGgaERTzY SpamDiagnosticOutput: 1:99 SpamDiagnosticMetadata: NSPM X-Microsoft-Exchange-Diagnostics: 1; BN4PR12MB0739; 20:nwIAuugxRAB/zB9H1SB3wA1l63LdC2XxKPbla4DyZuO7PjN/yDlIjx3Sn5Mt7UVygUVUGSKAahbpI80WqVHJQHtbrUMlYU5zpcyCFvWRpLEHqs2zmdmZI1+mlojMSnI1hhOEDEqbJPzPR8PGhY7dsMcyQhFMd7JZuMNmXFWqAOrgBlVL0sfWisj/UqJThx3uy4j5g9RoRJ1qdXRKrpWnKrwh2V+ZArvCilG4+loueJiryZi7W/hUnaZHnoKSHbHT X-OriginatorOrg: amd.com X-MS-Exchange-CrossTenant-OriginalArrivalTime: 12 Oct 2018 00:28:20.6950 (UTC) X-MS-Exchange-CrossTenant-Network-Message-Id: 18b8666d-8854-4939-0bd9-08d62fd99d04 X-MS-Exchange-CrossTenant-Id: 3dd8961f-e488-4e60-8e11-a82d994e183d X-MS-Exchange-CrossTenant-OriginalAttributedTenantConnectingIp: TenantId=3dd8961f-e488-4e60-8e11-a82d994e183d; Ip=[165.204.84.17]; Helo=[SATLEXCHOV02.amd.com] X-MS-Exchange-CrossTenant-FromEntityHeader: HybridOnPrem X-MS-Exchange-Transport-CrossTenantHeadersStamped: BN4PR12MB0739 X-BeenThere: dri-devel@lists.freedesktop.org X-Mailman-Version: 2.1.23 Precedence: list List-Id: Direct Rendering Infrastructure - Development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Cc: Leo Li Errors-To: dri-devel-bounces@lists.freedesktop.org Sender: "dri-devel" X-Virus-Scanned: ClamAV using ClamSMTP From: Leo Li This fixes a general protection fault, caused by accessing the contents of a flip_done completion object that has already been freed. It occurs due to the preemption of a non-blocking commit worker thread W by another commit thread X. X continues to clear its atomic state at the end, destroying the CRTC commit object that W still needs. Switching back to W and accessing the commit objects then leads to bad results. Worker W becomes preemptable when waiting for flip_done to complete. At this point, a frequently occurring commit thread X can take over. Here's an example where W is a worker thread that flips on both CRTCs, and X does a legacy cursor update on both CRTCs: ... 1. W does flip work 2. W runs commit_hw_done() 3. W waits for flip_done on CRTC 1 4. > flip_done for CRTC 1 completes 5. W finishes waiting for CRTC 1 6. W waits for flip_done on CRTC 2 7. > Preempted by X 8. > flip_done for CRTC 2 completes 9. X atomic_check: hw_done and flip_done are complete on all CRTCs 10. X updates cursor on both CRTCs 11. X destroys atomic state 12. X done 13. > Switch back to W 14. W waits for flip_done on CRTC 2 15. W raises general protection fault The error looks like so: general protection fault: 0000 [#1] PREEMPT SMP PTI **snip** Call Trace: lock_acquire+0xa2/0x1b0 _raw_spin_lock_irq+0x39/0x70 wait_for_completion_timeout+0x31/0x130 drm_atomic_helper_wait_for_flip_done+0x64/0x90 [drm_kms_helper] amdgpu_dm_atomic_commit_tail+0xcae/0xdd0 [amdgpu] commit_tail+0x3d/0x70 [drm_kms_helper] process_one_work+0x212/0x650 worker_thread+0x49/0x420 kthread+0xfb/0x130 ret_from_fork+0x3a/0x50 Modules linked in: x86_pkg_temp_thermal amdgpu(O) chash(O) gpu_sched(O) drm_kms_helper(O) syscopyarea sysfillrect sysimgblt fb_sys_fops ttm(O) drm(O) Note that i915 has this issue masked, since hw_done is signaled after waiting for flip_done. Doing so will block the cursor update from happening until hw_done is signaled, preventing the cursor commit from destroying the state. Signed-off-by: Leo Li --- drivers/gpu/drm/drm_atomic_helper.c | 30 ++++++++++++++++++++++++++---- 1 file changed, 26 insertions(+), 4 deletions(-) diff --git a/drivers/gpu/drm/drm_atomic_helper.c b/drivers/gpu/drm/drm_atomic_helper.c index 80be74d..efdf043 100644 --- a/drivers/gpu/drm/drm_atomic_helper.c +++ b/drivers/gpu/drm/drm_atomic_helper.c @@ -1410,20 +1410,42 @@ void drm_atomic_helper_wait_for_flip_done(struct drm_device *dev, { struct drm_crtc_state *new_crtc_state; struct drm_crtc *crtc; + struct drm_crtc_commit **commits; int i; + int num_crtc = dev->mode_config.num_crtc; + commits = kcalloc(num_crtc, sizeof(*commits), GFP_KERNEL); + + /* + * Because we open ourselves to preemption by calling + * wait_for_completion_timeout(), we need to get our own references to + * the commit objects. This is so that a preempting commit won't free + * them. + */ for_each_new_crtc_in_state(old_state, crtc, new_crtc_state, i) { - struct drm_crtc_commit *commit = new_crtc_state->commit; + commits[i] = new_crtc_state->commit; + if (commits[i]) + drm_crtc_commit_get(commits[i]); + } + + for (i = 0; i < num_crtc; i++) { int ret; - if (!commit) + if (!commits[i]) continue; - ret = wait_for_completion_timeout(&commit->flip_done, 10 * HZ); + ret = wait_for_completion_timeout(&commits[i]->flip_done, + 10 * HZ); if (ret == 0) DRM_ERROR("[CRTC:%d:%s] flip_done timed out\n", - crtc->base.id, crtc->name); + commits[i]->crtc->base.id, + commits[i]->crtc->name); } + + for (i = 0; i < num_crtc; i++) + if (commits[i]) + drm_crtc_commit_put(commits[i]); + kfree(commits); } EXPORT_SYMBOL(drm_atomic_helper_wait_for_flip_done);