linux-stable.git/drivers/gpu/drm/vkms, branch linux-5.0.y

drm/vkms: Bugfix extra vblank frame

2019-04-05T20:34:44+00:00

[ Upstream commit def35e7c592616bc09be328de8795e5e624a3cf8 ]

kms_flip tests are breaking on vkms when simulate vblank because vblank
event sequence count returns one extra frame after arm vblank event to
make a page flip.

When vblank interrupt happens, userspace processes the vblank event and
issues the next page flip command. Kernel calls queue_work to call
commit_planes and arm the new page flip. The next vblank picks up the
newly armed vblank event and vblank interrupt happens again.

The arm and vblank event are asynchronous, then, on the next vblank, we
receive x+2 from `get_vblank_timestamp`, instead x+1, although timestamp
and vblank seqno matches.

Function `get_vblank_timestamp` is reached by 2 ways:

- from `drm_mode_page_flip_ioctl`: driver is doing one atomic
operation to synchronize planes in the same output. There is no
vblank simulation, the `drm_crtc_arm_vblank_event` function adds 1
on vblank count, and the variable in_vblank_irq is false
- from `vkms_vblank_simulate`: since the driver is doing a vblank
simulation, the variable in_vblank_irq is true.

Fix this problem subtracting one vblank period from vblank_time when
`get_vblank_timestamp` is called from trace `drm_mode_page_flip_ioctl`,
i.e., is not a real vblank interrupt, and getting the timestamp and
vblank seqno when it is a real vblank interrupt.

The reason for all this is that get_vblank_timestamp always supplies the
timestamp for the next vblank event. The hrtimer is the vblank
simulator, and it needs the correct previous value to present the next
vblank. Since this is how hw timestamp registers work and what the
vblank core expects.

Signed-off-by: Shayenne Moura
Signed-off-by: Daniel Vetter
Reviewed-by: Rodrigo Siqueira
Signed-off-by: Rodrigo Siqueira
Link: https://patchwork.freedesktop.org/patch/msgid/171e6e1c239cbca0c3df7183ed8acdfeeace9cf4.1548856186.git.shayenneluzmoura@gmail.com
Signed-off-by: Sasha Levin

drm/vkms: Bugfix racing hrtimer vblank handle

2019-04-05T20:34:43+00:00

[ Upstream commit ba420afab565bdc7b028ddd4f222260f2de7a1db ]

When the vblank irq happens, kernel time subsystem executes
`vkms_vblank_simulate`. In parallel or not, it prepares all stuff
necessary to the next vblank with arm, and it must flush these stuff
before the next vblank irq. However, vblank counter is ahead when arm is
executed in parallel with handle vblank.

CPU 0:					CPU 1:
 |					 |
atomic_commit_tail is ongoing		 |
 |					 |
 |					hrtimer: vkms_vblank_simulate()
 |					 |
 |					drm_crtc_handle_vblank()
 |					 |
drm_crtc_arm_vblank()			 |
 |					 |
->get_vblank_timestamp()		 |
 |					 |
 |					hrtimer_forward_now()

Then, we should guarantee that the vblank interval time is correct (not
changed) before finish the vblank handle.

Fix the bug including the call to `hrtimer_forward_now()` in the same
lock of `drm_crtc_handle_vblank()` to ensure that the timestamp update
is correct when finish the vblank handle.

Signed-off-by: Shayenne Moura 
Signed-off-by: Daniel Vetter 
Reviewed-by: Rodrigo Siqueira 
Signed-off-by: Rodrigo Siqueira 
Link: https://patchwork.freedesktop.org/patch/msgid/e2e4b8f3a5cab7b2dba75bf1930f86b0a4ee08c9.1548856186.git.shayenneluzmoura@gmail.com
Signed-off-by: Sasha Levin

drm/vkms: fix use-after-free when drm_gem_handle_create() fails

2019-04-03T04:27:34+00:00

commit 36b6c9ed45afe89045973e8dee1b004dd5372d40 upstream.

If drm_gem_handle_create() fails in vkms_gem_create(), then the
vkms_gem_object is freed twice: once when the reference is dropped by
drm_gem_object_put_unlocked(), and again by the extra calls to
drm_gem_object_release() and kfree().

Fix it by skipping the second release and free.

This bug was originally found in the vgem driver by syzkaller using
fault injection, but I noticed it's also present in the vkms driver.

Fixes: 559e50fd34d1 ("drm/vkms: Add dumb operations")
Cc: Rodrigo Siqueira 
Cc: Haneen Mohammed 
Cc: Daniel Vetter 
Cc: Chris Wilson 
Cc: stable@vger.kernel.org
Signed-off-by: Eric Biggers 
Reviewed-by: Chris Wilson 
Reviewed-by: Rodrigo Siqueira 
Signed-off-by: Rodrigo Siqueira 
Link: https://patchwork.freedesktop.org/patch/msgid/20190226220858.214438-1-ebiggers@kernel.org
Signed-off-by: Maxime Ripard 
Signed-off-by: Greg Kroah-Hartman

drm/vkms: Fix flush_work() without INIT_WORK().

2019-03-27T05:17:58+00:00

commit b30b61ff6b1dc37f276cf56a8328b80086a3ffca upstream.

syzbot is hitting a lockdep warning [1] because flush_work() is called
without INIT_WORK() after kzalloc() at vkms_atomic_crtc_reset().

Commit 6c234fe37c57627a ("drm/vkms: Implement CRC debugfs API") added
INIT_WORK() to only vkms_atomic_crtc_duplicate_state() side. Assuming
that lifecycle of crc_work is appropriately managed, fix this problem
by adding INIT_WORK() to vkms_atomic_crtc_reset() side.

[1] https://syzkaller.appspot.com/bug?id=a5954455fcfa51c29ca2ab55b203076337e1c770

Reported-and-tested-by: syzbot 
Signed-off-by: Tetsuo Handa 
Reviewed-by: Shayenne Moura 
Signed-off-by: Daniel Vetter 
Link: https://patchwork.freedesktop.org/patch/msgid/1547829823-9877-1-git-send-email-penguin-kernel@I-love.SAKURA.ne.jp
Signed-off-by: Greg Kroah-Hartman

drm/vkms: Fix license inconsistent

2019-02-10T12:23:06+00:00

Fixes license inconsistent related to the VKMS driver and remove the
redundant boilerplate comment.

Fixes: 854502fa0a38 ("drm/vkms: Add basic CRTC initialization")

Cc: stable@vger.kernel.org
Signed-off-by: Rodrigo Siqueira 
Acked-by: Daniel Vetter 
Link: https://patchwork.freedesktop.org/patch/msgid/20190206140116.7qvy2lpwbcd7wds6@smtp.gmail.com

drm/vkms: Remove set but not used variable 'vkms_obj'

2018-12-04T10:47:27+00:00

Fixes gcc '-Wunused-but-set-variable' warning:

drivers/gpu/drm/vkms/vkms_plane.c: In function 'vkms_prepare_fb':
drivers/gpu/drm/vkms/vkms_plane.c:144:26: warning:
 variable 'vkms_obj' set but not used [-Wunused-but-set-variable]

It never used since introduction in commit
8ce1bb0b5337 ("drm/vkms: map/unmap buffers in [prepare/cleanup]_fb hooks")

Signed-off-by: YueHaibing 
Signed-off-by: Daniel Vetter 
Link: https://patchwork.freedesktop.org/patch/msgid/1543634444-186448-1-git-send-email-yuehaibing@huawei.com

drm/vkms: Fix plane duplicate_state

2018-11-29T09:30:39+00:00

We need to handle allocation failures and bail out. While at it, tune
the allocation failures down to debug level.

syzbot injected an allocation failure and then hit this WARN_ON.

Reported-by: syzbot+eb6e5365f23c02517dda@syzkaller.appspotmail.com
Signed-off-by: Daniel Vetter 
Cc: Haneen Mohammed 
Cc: Sean Paul 
Cc: Daniel Vetter 
Cc: Rodrigo Siqueira 
Cc: Gustavo Padovan 
Reviewed-by: Eric Anholt 
Link: https://patchwork.freedesktop.org/patch/msgid/20181128101033.4840-1-daniel.vetter@ffwll.ch

drm/vkms: Drop custom vkms_dumb_map().

2018-11-27T20:23:32+00:00

This is the same as the default drm_gem_dumb_map_offset()
implementation, except that this one missed the ban on userspace
mapping an imported dmabuf (which seems like intended common behavior
for drivers).

Signed-off-by: Eric Anholt 
Link: https://patchwork.freedesktop.org/patch/msgid/20181126215929.20546-1-eric@anholt.net
Acked-by: Daniel Vetter

drm/vkms: provide a parent device to drm_dev_init()

2018-10-29T11:13:40+00:00

Earlier commit updated the vgem driver to improve the topology, by
passing a platform device as parent to drm_dev_init(). Shortly
afterwords we updated the core function to BUG() in order to catch any
buggy drivers passing NULL as parent.

While I missed the vkms driver (as the patch predates vkms by a few
months), the BUG caught the issue within couple of hours.

Swap the drm_dev_init <> platform_device_register_simple order, to
the driver back to life.

Fixes: f08877e79485 ("drm: BUG_ON if passing NULL parent to drm_dev_init")
Cc: Daniel Vetter 
Cc: Deepak Sharma 
Cc: Maarten Lankhorst 
Cc: Maxime Ripard 
Cc: Sean Paul 
Cc: Haneen Mohammed 
Cc: Rodrigo Siqueira 
Reported-by: Daniel Vetter 
Signed-off-by: Emil Velikov 
Reviewed-by: Daniel Vetter 
Link: https://patchwork.freedesktop.org/patch/msgid/20181026100550.625-1-emil.l.velikov@gmail.com

drm/vkms: Fix possible memory leak in _vkms_get_crc()

2018-09-21T08:50:45+00:00

'vaddr_out' is malloced in _vkms_get_crc() and should be freed before
leaving from the error handling cases, otherwise it will cause memory
leak.

Fixes: db7f419c06d7 ("drm/vkms: Compute CRC with Cursor Plane")
Signed-off-by: Wei Yongjun 
Signed-off-by: Daniel Vetter 
Link: https://patchwork.freedesktop.org/patch/msgid/1536976399-1295-1-git-send-email-weiyongjun1@huawei.com