linux/include/drm/drm_fb_helper.h
Javier Martinez Canillas d6591da5f3
drm/fb-helper: Use a per-driver FB deferred I/O handler
The DRM fbdev emulation layer sets the struct fb_info .fbdefio field to
a struct fb_deferred_io pointer, that is shared across all drivers that
use the generic drm_fbdev_generic_setup() helper function.

It is a problem because the fbdev core deferred I/O logic assumes that
the struct fb_deferred_io data is not shared between devices, and it's
stored there state such as the list of pages touched and a mutex that
is use to synchronize between the fb_deferred_io_track_page() function
that track the dirty pages and fb_deferred_io_work() workqueue handler
doing the actual deferred I/O.

The latter can lead to the following error, since it may happen that two
drivers are probed and then one is removed, which causes the mutex bo be
destroyed and not existing anymore by the time the other driver tries to
grab it for the fbdev deferred I/O logic:

[  369.756553] ------------[ cut here ]------------
[  369.756604] DEBUG_LOCKS_WARN_ON(lock->magic != lock)
[  369.756631] WARNING: CPU: 2 PID: 1023 at kernel/locking/mutex.c:582 __mutex_lock+0x348/0x424
[  369.756744] Modules linked in: nf_conntrack_netbios_ns nf_conntrack_broadcast nft_fib_inet nft_fib_ipv4 nft_fib_ipv6 nft_fib nft_reject_inet nf_reject_ipv4 nf_reject_ipv6 nft_reject nft_ct nft_chain_nat nf_nat nf_conntrack nf_defrag_ip
v6 nf_defrag_ipv4 ip_set nf_tables nfnetlink qrtr btsdio bluetooth sunrpc brcmfmac snd_soc_hdmi_codec cpufreq_dt cfg80211 vfat fat vc4 rfkill brcmutil raspberrypi_cpufreq i2c_bcm2835 iproc_rng200 bcm2711_thermal snd_soc_core snd_pcm_dmaen
gine leds_gpio nvmem_rmem joydev hid_cherry uas usb_storage gpio_raspberrypi_exp v3d snd_pcm raspberrypi_hwmon gpu_sched bcm2835_wdt broadcom bcm_phy_lib snd_timer genet snd mdio_bcm_unimac clk_bcm2711_dvp soundcore drm_display_helper pci
e_brcmstb cec ip6_tables ip_tables fuse
[  369.757400] CPU: 2 PID: 1023 Comm: fbtest Not tainted 5.19.0-rc6+ #94
[  369.757455] Hardware name: raspberrypi,4-model-b Raspberry Pi 4 Model B Rev 1.4/Raspberry Pi 4 Model B Rev 1.4, BIOS 2022.10 10/01/2022
[  369.757538] pstate: 00400005 (nzcv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--)
[  369.757596] pc : __mutex_lock+0x348/0x424
[  369.757635] lr : __mutex_lock+0x348/0x424
[  369.757672] sp : ffff80000953bb00
[  369.757703] x29: ffff80000953bb00 x28: ffff17fdc087c000 x27: 0000000000000002
[  369.757771] x26: ffff17fdc349f9b0 x25: fffffc5ff72e0100 x24: 0000000000000000
[  369.757838] x23: 0000000000000000 x22: 0000000000000002 x21: ffffa618df636f10
[  369.757903] x20: ffff80000953bb68 x19: ffffa618e0f18138 x18: 0000000000000001
[  369.757968] x17: 0000000020000000 x16: 0000000000000002 x15: 0000000000000000
[  369.758032] x14: 0000000000000000 x13: 284e4f5f4e524157 x12: 5f534b434f4c5f47
[  369.758097] x11: 00000000ffffdfff x10: ffffa618e0c79f88 x9 : ffffa618de472484
[  369.758162] x8 : 000000000002ffe8 x7 : c0000000ffffdfff x6 : 00000000000affa8
[  369.758227] x5 : 0000000000001fff x4 : 0000000000000000 x3 : 0000000000000027
[  369.758292] x2 : 0000000000000001 x1 : ffff17fdc087c000 x0 : 0000000000000028
[  369.758357] Call trace:
[  369.758383]  __mutex_lock+0x348/0x424
[  369.758420]  mutex_lock_nested+0x4c/0x5c
[  369.758459]  fb_deferred_io_mkwrite+0x78/0x1d8
[  369.758507]  do_page_mkwrite+0x5c/0x19c
[  369.758550]  wp_page_shared+0x70/0x1a0
[  369.758590]  do_wp_page+0x3d0/0x510
[  369.758628]  handle_pte_fault+0x1c0/0x1e0
[  369.758670]  __handle_mm_fault+0x250/0x380
[  369.758712]  handle_mm_fault+0x17c/0x3a4
[  369.758753]  do_page_fault+0x158/0x530
[  369.758792]  do_mem_abort+0x50/0xa0
[  369.758831]  el0_da+0x78/0x19c
[  369.758864]  el0t_64_sync_handler+0xbc/0x150
[  369.758904]  el0t_64_sync+0x190/0x194
[  369.758942] irq event stamp: 11395
[  369.758973] hardirqs last  enabled at (11395): [<ffffa618de472554>] __up_console_sem+0x74/0x80
[  369.759042] hardirqs last disabled at (11394): [<ffffa618de47254c>] __up_console_sem+0x6c/0x80
[  369.760554] softirqs last  enabled at (11392): [<ffffa618de330a74>] __do_softirq+0x4c4/0x6b8
[  369.762060] softirqs last disabled at (11383): [<ffffa618de3c9124>] __irq_exit_rcu+0x104/0x214
[  369.763564] ---[ end trace 0000000000000000 ]---

Fixes: d536540f30 ("drm/fb-helper: Add generic fbdev emulation .fb_probe function")
Signed-off-by: Javier Martinez Canillas <javierm@redhat.com>
Reviewed-by: Thomas Zimmermann <tzimmermann@suse.de>
Link: https://patchwork.freedesktop.org/patch/msgid/20230121192418.2814955-4-javierm@redhat.com
2023-01-24 11:13:08 +01:00

496 lines
14 KiB
C

/*
* Copyright (c) 2006-2009 Red Hat Inc.
* Copyright (c) 2006-2008 Intel Corporation
* Copyright (c) 2007 Dave Airlie <airlied@linux.ie>
*
* DRM framebuffer helper functions
*
* Permission to use, copy, modify, distribute, and sell this software and its
* documentation for any purpose is hereby granted without fee, provided that
* the above copyright notice appear in all copies and that both that copyright
* notice and this permission notice appear in supporting documentation, and
* that the name of the copyright holders not be used in advertising or
* publicity pertaining to distribution of the software without specific,
* written prior permission. The copyright holders make no representations
* about the suitability of this software for any purpose. It is provided "as
* is" without express or implied warranty.
*
* THE COPYRIGHT HOLDERS DISCLAIM ALL WARRANTIES WITH REGARD TO THIS SOFTWARE,
* INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS, IN NO
* EVENT SHALL THE COPYRIGHT HOLDERS BE LIABLE FOR ANY SPECIAL, INDIRECT OR
* CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM LOSS OF USE,
* DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR OTHER
* TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR PERFORMANCE
* OF THIS SOFTWARE.
*
* Authors:
* Dave Airlie <airlied@linux.ie>
* Jesse Barnes <jesse.barnes@intel.com>
*/
#ifndef DRM_FB_HELPER_H
#define DRM_FB_HELPER_H
struct drm_clip_rect;
struct drm_fb_helper;
#include <linux/fb.h>
#include <drm/drm_client.h>
enum mode_set_atomic {
LEAVE_ATOMIC_MODE_SET,
ENTER_ATOMIC_MODE_SET,
};
/**
* struct drm_fb_helper_surface_size - describes fbdev size and scanout surface size
* @fb_width: fbdev width
* @fb_height: fbdev height
* @surface_width: scanout buffer width
* @surface_height: scanout buffer height
* @surface_bpp: scanout buffer bpp
* @surface_depth: scanout buffer depth
*
* Note that the scanout surface width/height may be larger than the fbdev
* width/height. In case of multiple displays, the scanout surface is sized
* according to the largest width/height (so it is large enough for all CRTCs
* to scanout). But the fbdev width/height is sized to the minimum width/
* height of all the displays. This ensures that fbcon fits on the smallest
* of the attached displays. fb_width/fb_height is used by
* drm_fb_helper_fill_info() to fill out the &fb_info.var structure.
*/
struct drm_fb_helper_surface_size {
u32 fb_width;
u32 fb_height;
u32 surface_width;
u32 surface_height;
u32 surface_bpp;
u32 surface_depth;
};
/**
* struct drm_fb_helper_funcs - driver callbacks for the fbdev emulation library
*
* Driver callbacks used by the fbdev emulation helper library.
*/
struct drm_fb_helper_funcs {
/**
* @fb_probe:
*
* Driver callback to allocate and initialize the fbdev info structure.
* Furthermore it also needs to allocate the DRM framebuffer used to
* back the fbdev.
*
* This callback is mandatory.
*
* RETURNS:
*
* The driver should return 0 on success and a negative error code on
* failure.
*/
int (*fb_probe)(struct drm_fb_helper *helper,
struct drm_fb_helper_surface_size *sizes);
/**
* @fb_dirty:
*
* Driver callback to update the framebuffer memory. If set, fbdev
* emulation will invoke this callback in regular intervals after
* the framebuffer has been written.
*
* This callback is optional.
*
* Returns:
* 0 on success, or an error code otherwise.
*/
int (*fb_dirty)(struct drm_fb_helper *helper, struct drm_clip_rect *clip);
};
/**
* struct drm_fb_helper - main structure to emulate fbdev on top of KMS
* @fb: Scanout framebuffer object
* @dev: DRM device
* @funcs: driver callbacks for fb helper
* @info: emulated fbdev device info struct
* @pseudo_palette: fake palette of 16 colors
* @damage_clip: clip rectangle used with deferred_io to accumulate damage to
* the screen buffer
* @damage_lock: spinlock protecting @damage_clip
* @damage_work: worker used to flush the framebuffer
* @resume_work: worker used during resume if the console lock is already taken
*
* This is the main structure used by the fbdev helpers. Drivers supporting
* fbdev emulation should embedded this into their overall driver structure.
* Drivers must also fill out a &struct drm_fb_helper_funcs with a few
* operations.
*/
struct drm_fb_helper {
/**
* @client:
*
* DRM client used by the generic fbdev emulation.
*/
struct drm_client_dev client;
/**
* @buffer:
*
* Framebuffer used by the generic fbdev emulation.
*/
struct drm_client_buffer *buffer;
struct drm_framebuffer *fb;
struct drm_device *dev;
const struct drm_fb_helper_funcs *funcs;
struct fb_info *info;
u32 pseudo_palette[17];
struct drm_clip_rect damage_clip;
spinlock_t damage_lock;
struct work_struct damage_work;
struct work_struct resume_work;
/**
* @lock:
*
* Top-level FBDEV helper lock. This protects all internal data
* structures and lists, such as @connector_info and @crtc_info.
*
* FIXME: fbdev emulation locking is a mess and long term we want to
* protect all helper internal state with this lock as well as reduce
* core KMS locking as much as possible.
*/
struct mutex lock;
/**
* @kernel_fb_list:
*
* Entry on the global kernel_fb_helper_list, used for kgdb entry/exit.
*/
struct list_head kernel_fb_list;
/**
* @delayed_hotplug:
*
* A hotplug was received while fbdev wasn't in control of the DRM
* device, i.e. another KMS master was active. The output configuration
* needs to be reprobe when fbdev is in control again.
*/
bool delayed_hotplug;
/**
* @deferred_setup:
*
* If no outputs are connected (disconnected or unknown) the FB helper
* code will defer setup until at least one of the outputs shows up.
* This field keeps track of the status so that setup can be retried
* at every hotplug event until it succeeds eventually.
*
* Protected by @lock.
*/
bool deferred_setup;
/**
* @preferred_bpp:
*
* Temporary storage for the driver's preferred BPP setting passed to
* FB helper initialization. This needs to be tracked so that deferred
* FB helper setup can pass this on.
*
* See also: @deferred_setup
*/
int preferred_bpp;
/**
* @hint_leak_smem_start:
*
* Hint to the fbdev emulation to store the framebuffer's physical
* address in struct &fb_info.fix.smem_start. If the hint is unset,
* the smem_start field should always be cleared to zero.
*/
bool hint_leak_smem_start;
#ifdef CONFIG_FB_DEFERRED_IO
/**
* @fbdefio:
*
* Temporary storage for the driver's FB deferred I/O handler. If the
* driver uses the DRM fbdev emulation layer, this is set by the core
* to a generic deferred I/O handler if a driver is preferring to use
* a shadow buffer.
*/
struct fb_deferred_io fbdefio;
#endif
};
static inline struct drm_fb_helper *
drm_fb_helper_from_client(struct drm_client_dev *client)
{
return container_of(client, struct drm_fb_helper, client);
}
/**
* define DRM_FB_HELPER_DEFAULT_OPS - helper define for drm drivers
*
* Helper define to register default implementations of drm_fb_helper
* functions. To be used in struct fb_ops of drm drivers.
*/
#define DRM_FB_HELPER_DEFAULT_OPS \
.fb_check_var = drm_fb_helper_check_var, \
.fb_set_par = drm_fb_helper_set_par, \
.fb_setcmap = drm_fb_helper_setcmap, \
.fb_blank = drm_fb_helper_blank, \
.fb_pan_display = drm_fb_helper_pan_display, \
.fb_debug_enter = drm_fb_helper_debug_enter, \
.fb_debug_leave = drm_fb_helper_debug_leave, \
.fb_ioctl = drm_fb_helper_ioctl
#ifdef CONFIG_DRM_FBDEV_EMULATION
void drm_fb_helper_prepare(struct drm_device *dev, struct drm_fb_helper *helper,
const struct drm_fb_helper_funcs *funcs);
int drm_fb_helper_init(struct drm_device *dev, struct drm_fb_helper *helper);
void drm_fb_helper_fini(struct drm_fb_helper *helper);
int drm_fb_helper_blank(int blank, struct fb_info *info);
int drm_fb_helper_pan_display(struct fb_var_screeninfo *var,
struct fb_info *info);
int drm_fb_helper_set_par(struct fb_info *info);
int drm_fb_helper_check_var(struct fb_var_screeninfo *var,
struct fb_info *info);
int drm_fb_helper_restore_fbdev_mode_unlocked(struct drm_fb_helper *fb_helper);
struct fb_info *drm_fb_helper_alloc_info(struct drm_fb_helper *fb_helper);
void drm_fb_helper_unregister_info(struct drm_fb_helper *fb_helper);
void drm_fb_helper_fill_info(struct fb_info *info,
struct drm_fb_helper *fb_helper,
struct drm_fb_helper_surface_size *sizes);
void drm_fb_helper_deferred_io(struct fb_info *info, struct list_head *pagereflist);
ssize_t drm_fb_helper_sys_read(struct fb_info *info, char __user *buf,
size_t count, loff_t *ppos);
ssize_t drm_fb_helper_sys_write(struct fb_info *info, const char __user *buf,
size_t count, loff_t *ppos);
void drm_fb_helper_sys_fillrect(struct fb_info *info,
const struct fb_fillrect *rect);
void drm_fb_helper_sys_copyarea(struct fb_info *info,
const struct fb_copyarea *area);
void drm_fb_helper_sys_imageblit(struct fb_info *info,
const struct fb_image *image);
ssize_t drm_fb_helper_cfb_read(struct fb_info *info, char __user *buf,
size_t count, loff_t *ppos);
ssize_t drm_fb_helper_cfb_write(struct fb_info *info, const char __user *buf,
size_t count, loff_t *ppos);
void drm_fb_helper_cfb_fillrect(struct fb_info *info,
const struct fb_fillrect *rect);
void drm_fb_helper_cfb_copyarea(struct fb_info *info,
const struct fb_copyarea *area);
void drm_fb_helper_cfb_imageblit(struct fb_info *info,
const struct fb_image *image);
void drm_fb_helper_set_suspend(struct drm_fb_helper *fb_helper, bool suspend);
void drm_fb_helper_set_suspend_unlocked(struct drm_fb_helper *fb_helper,
bool suspend);
int drm_fb_helper_setcmap(struct fb_cmap *cmap, struct fb_info *info);
int drm_fb_helper_ioctl(struct fb_info *info, unsigned int cmd,
unsigned long arg);
int drm_fb_helper_hotplug_event(struct drm_fb_helper *fb_helper);
int drm_fb_helper_initial_config(struct drm_fb_helper *fb_helper, int bpp_sel);
int drm_fb_helper_debug_enter(struct fb_info *info);
int drm_fb_helper_debug_leave(struct fb_info *info);
void drm_fb_helper_lastclose(struct drm_device *dev);
void drm_fb_helper_output_poll_changed(struct drm_device *dev);
#else
static inline void drm_fb_helper_prepare(struct drm_device *dev,
struct drm_fb_helper *helper,
const struct drm_fb_helper_funcs *funcs)
{
}
static inline int drm_fb_helper_init(struct drm_device *dev,
struct drm_fb_helper *helper)
{
/* So drivers can use it to free the struct */
helper->dev = dev;
dev->fb_helper = helper;
return 0;
}
static inline void drm_fb_helper_fini(struct drm_fb_helper *helper)
{
if (helper && helper->dev)
helper->dev->fb_helper = NULL;
}
static inline int drm_fb_helper_blank(int blank, struct fb_info *info)
{
return 0;
}
static inline int drm_fb_helper_pan_display(struct fb_var_screeninfo *var,
struct fb_info *info)
{
return 0;
}
static inline int drm_fb_helper_set_par(struct fb_info *info)
{
return 0;
}
static inline int drm_fb_helper_check_var(struct fb_var_screeninfo *var,
struct fb_info *info)
{
return 0;
}
static inline int
drm_fb_helper_restore_fbdev_mode_unlocked(struct drm_fb_helper *fb_helper)
{
return 0;
}
static inline struct fb_info *
drm_fb_helper_alloc_info(struct drm_fb_helper *fb_helper)
{
return NULL;
}
static inline void drm_fb_helper_unregister_info(struct drm_fb_helper *fb_helper)
{
}
static inline void
drm_fb_helper_fill_info(struct fb_info *info,
struct drm_fb_helper *fb_helper,
struct drm_fb_helper_surface_size *sizes)
{
}
static inline int drm_fb_helper_setcmap(struct fb_cmap *cmap,
struct fb_info *info)
{
return 0;
}
static inline int drm_fb_helper_ioctl(struct fb_info *info, unsigned int cmd,
unsigned long arg)
{
return 0;
}
static inline void drm_fb_helper_deferred_io(struct fb_info *info,
struct list_head *pagelist)
{
}
static inline int drm_fb_helper_defio_init(struct drm_fb_helper *fb_helper)
{
return -ENODEV;
}
static inline ssize_t drm_fb_helper_sys_read(struct fb_info *info,
char __user *buf, size_t count,
loff_t *ppos)
{
return -ENODEV;
}
static inline ssize_t drm_fb_helper_sys_write(struct fb_info *info,
const char __user *buf,
size_t count, loff_t *ppos)
{
return -ENODEV;
}
static inline void drm_fb_helper_sys_fillrect(struct fb_info *info,
const struct fb_fillrect *rect)
{
}
static inline void drm_fb_helper_sys_copyarea(struct fb_info *info,
const struct fb_copyarea *area)
{
}
static inline void drm_fb_helper_sys_imageblit(struct fb_info *info,
const struct fb_image *image)
{
}
static inline ssize_t drm_fb_helper_cfb_read(struct fb_info *info, char __user *buf,
size_t count, loff_t *ppos)
{
return -ENODEV;
}
static inline ssize_t drm_fb_helper_cfb_write(struct fb_info *info, const char __user *buf,
size_t count, loff_t *ppos)
{
return -ENODEV;
}
static inline void drm_fb_helper_cfb_fillrect(struct fb_info *info,
const struct fb_fillrect *rect)
{
}
static inline void drm_fb_helper_cfb_copyarea(struct fb_info *info,
const struct fb_copyarea *area)
{
}
static inline void drm_fb_helper_cfb_imageblit(struct fb_info *info,
const struct fb_image *image)
{
}
static inline void drm_fb_helper_set_suspend(struct drm_fb_helper *fb_helper,
bool suspend)
{
}
static inline void
drm_fb_helper_set_suspend_unlocked(struct drm_fb_helper *fb_helper, bool suspend)
{
}
static inline int drm_fb_helper_hotplug_event(struct drm_fb_helper *fb_helper)
{
return 0;
}
static inline int drm_fb_helper_initial_config(struct drm_fb_helper *fb_helper,
int bpp_sel)
{
return 0;
}
static inline int drm_fb_helper_debug_enter(struct fb_info *info)
{
return 0;
}
static inline int drm_fb_helper_debug_leave(struct fb_info *info)
{
return 0;
}
static inline void drm_fb_helper_lastclose(struct drm_device *dev)
{
}
static inline void drm_fb_helper_output_poll_changed(struct drm_device *dev)
{
}
#endif
#endif