[PATCH 0/6] Cursor Fault Fixes

[PATCH 0/6] Cursor Fault Fixes

[Chaitanya Kumar Borah]

This series is based on top of [1] floated by Maarten.
To fix regressions seen in CI, following changes were made on top of the
original series.

1. add a check in the plane state destroy hook to not move forward if the vblank worker is scheduled.
2. add checks before accessing frame buffer object (we are not sure yet how much this helps but we have found that this operation causes dump stacks)
3. do not defer the intel atomic cleanup into a work queue, instead execute it at the end of atomic commit tail.

While this series is in noway a complete or proper solution it is meant to trigger a discussion to arrive at one.

[1] https://patchwork.freedesktop.org/series/126934/

v2: Add missing patch

Chaitanya Kumar Borah (3):
  drm/i915: do not destroy plane state if cursor unpin worker is
    scheduled
  drm/i915: Add sanity checks before accessing fb buffer object
  drm/i915: do not defer cleanup work

Maarten Lankhorst (2):
  drm: Add drm_vblank_work_flush_all().
  drm/i915: Use the same vblank worker for atomic unpin

Ville Syrjälä (1):
  drm/i915: Use vblank worker to unpin old legacy cursor fb safely

 drivers/gpu/drm/drm_vblank_work.c             | 22 ++++++++
 .../gpu/drm/i915/display/intel_atomic_plane.c | 55 ++++++++++++++++++-
 .../gpu/drm/i915/display/intel_atomic_plane.h |  4 ++
 drivers/gpu/drm/i915/display/intel_crtc.c     | 27 +++++++++
 drivers/gpu/drm/i915/display/intel_cursor.c   | 26 ++++++++-
 drivers/gpu/drm/i915/display/intel_cursor.h   |  3 +
 drivers/gpu/drm/i915/display/intel_display.c  | 11 ++--
 .../drm/i915/display/intel_display_types.h    |  3 +
 include/drm/drm_vblank_work.h                 |  2 +
 9 files changed, 144 insertions(+), 9 deletions(-)

-- 
2.25.1

[PATCH 0/6] Cursor Fault Fixes

[Chaitanya Kumar Borah]

This series is based on top of [1] floated by Maarten.
To fix regressions seen in CI, following changes were made on top of the
original series.

1. add a check in the plane state destroy hook to not move forward if the vblank worker is scheduled.
2. add checks before accessing frame buffer object (we are not sure yet how much this helps but we have found that this operation causes dump stacks)
3. do not defer the intel atomic cleanup into a work queue, instead execute it at the end of atomic commit tail.

While this series is in noway a complete or proper solution it is meant to trigger a discussion to arrive at one.

[1] https://patchwork.freedesktop.org/series/126934/

v2: Add missing patch
v3: Remove misleading error log
    Change condition to access fb object

Chaitanya Kumar Borah (3):
  drm/i915: do not destroy plane state if cursor unpin worker is
    scheduled
  drm/i915: Add sanity check before accessing fb buffer object
  drm/i915: do not defer cleanup work

Maarten Lankhorst (2):
  drm: Add drm_vblank_work_flush_all().
  drm/i915: Use the same vblank worker for atomic unpin

Ville Syrjälä (1):
  drm/i915: Use vblank worker to unpin old legacy cursor fb safely

 drivers/gpu/drm/drm_vblank_work.c             | 22 ++++++++
 .../gpu/drm/i915/display/intel_atomic_plane.c | 53 ++++++++++++++++++-
 .../gpu/drm/i915/display/intel_atomic_plane.h |  4 ++
 drivers/gpu/drm/i915/display/intel_crtc.c     | 27 ++++++++++
 drivers/gpu/drm/i915/display/intel_cursor.c   | 26 ++++++++-
 drivers/gpu/drm/i915/display/intel_cursor.h   |  3 ++
 drivers/gpu/drm/i915/display/intel_display.c  | 11 ++--
 .../drm/i915/display/intel_display_types.h    |  3 ++
 include/drm/drm_vblank_work.h                 |  2 +
 9 files changed, 142 insertions(+), 9 deletions(-)

-- 
2.25.1

[PATCH 1/6] drm: Add drm_vblank_work_flush_all().

[Chaitanya Kumar Borah]

From: Maarten Lankhorst <maarten.lankhorst@linux.intel.com>

In some cases we want to flush all vblank work, right before vblank_off
for example. Add a simple function to make this possible.

Signed-off-by: Maarten Lankhorst <maarten.lankhorst@linux.intel.com>
---
 drivers/gpu/drm/drm_vblank_work.c | 22 ++++++++++++++++++++++
 include/drm/drm_vblank_work.h     |  2 ++
 2 files changed, 24 insertions(+)

diff --git a/drivers/gpu/drm/drm_vblank_work.c b/drivers/gpu/drm/drm_vblank_work.c
index 43cd5c0f4f6f..ff86f2b2e052 100644
--- a/drivers/gpu/drm/drm_vblank_work.c
+++ b/drivers/gpu/drm/drm_vblank_work.c
@@ -232,6 +232,28 @@ void drm_vblank_work_flush(struct drm_vblank_work *work)
 }
 EXPORT_SYMBOL(drm_vblank_work_flush);
 
+/**
+ * drm_vblank_work_flush_all - flush all currently pending vblank work on crtc.
+ * @crtc: crtc for which vblank work to flush
+ *
+ * Wait until all currently queued vblank work on @crtc
+ * has finished executing once.
+ */
+void drm_vblank_work_flush_all(struct drm_crtc *crtc)
+{
+	struct drm_device *dev = crtc->dev;
+	struct drm_vblank_crtc *vblank = &dev->vblank[drm_crtc_index(crtc)];
+
+	spin_lock_irq(&dev->event_lock);
+	wait_event_lock_irq(vblank->work_wait_queue,
+			    waitqueue_active(&vblank->work_wait_queue),
+			    dev->event_lock);
+	spin_unlock_irq(&dev->event_lock);
+
+	kthread_flush_worker(vblank->worker);
+}
+EXPORT_SYMBOL(drm_vblank_work_flush_all);
+
 /**
  * drm_vblank_work_init - initialize a vblank work item
  * @work: vblank work item
diff --git a/include/drm/drm_vblank_work.h b/include/drm/drm_vblank_work.h
index eb41d0810c4f..e04d436b7297 100644
--- a/include/drm/drm_vblank_work.h
+++ b/include/drm/drm_vblank_work.h
@@ -17,6 +17,7 @@ struct drm_crtc;
  * drm_vblank_work_init()
  * drm_vblank_work_cancel_sync()
  * drm_vblank_work_flush()
+ * drm_vblank_work_flush_all()
  */
 struct drm_vblank_work {
 	/**
@@ -67,5 +68,6 @@ void drm_vblank_work_init(struct drm_vblank_work *work, struct drm_crtc *crtc,
 			  void (*func)(struct kthread_work *work));
 bool drm_vblank_work_cancel_sync(struct drm_vblank_work *work);
 void drm_vblank_work_flush(struct drm_vblank_work *work);
+void drm_vblank_work_flush_all(struct drm_crtc *crtc);
 
 #endif /* !_DRM_VBLANK_WORK_H_ */
-- 
2.25.1

[PATCH 2/6] drm/i915: Use vblank worker to unpin old legacy cursor fb safely

[Chaitanya Kumar Borah]

From: Ville Syrjälä <ville.syrjala@linux.intel.com>

The cursor hardware only does sync updates, and thus the hardware
will be scanning out from the old fb until the next start of vblank.
So in order to make the legacy cursor fastpath actually safe we
should not unpin the old fb until we're sure the hardware has
ceased accessing it. The simplest approach is to just use a vblank
work here to do the delayed unpin.

Not 100% sure it's a good idea to put this onto the same high
priority vblank worker as eg. our timing critical gamma updates.
But let's keep it simple for now, and it we later discover that
this is causing problems we can think about adding a lower
priority worker for such things.

This patch is slightly reworked by Maarten

Cc: Maarten Lankhorst <maarten.lankhorst@linux.intel.com>
Signed-off-by: Ville Syrjälä <ville.syrjala@linux.intel.com>
Signed-off-by: Maarten Lankhorst <maarten.lankhorst@linux.intel.com>
---
 drivers/gpu/drm/i915/display/intel_cursor.c   | 26 +++++++++++++++++--
 drivers/gpu/drm/i915/display/intel_display.c  |  3 +++
 .../drm/i915/display/intel_display_types.h    |  3 +++
 3 files changed, 30 insertions(+), 2 deletions(-)

diff --git a/drivers/gpu/drm/i915/display/intel_cursor.c b/drivers/gpu/drm/i915/display/intel_cursor.c
index f8b33999d43f..9021c0c1683d 100644
--- a/drivers/gpu/drm/i915/display/intel_cursor.c
+++ b/drivers/gpu/drm/i915/display/intel_cursor.c
@@ -654,6 +654,17 @@ static bool intel_cursor_format_mod_supported(struct drm_plane *_plane,
 	return format == DRM_FORMAT_ARGB8888;
 }
 
+static void intel_cursor_unpin_work(struct kthread_work *base)
+{
+	struct drm_vblank_work *work = to_drm_vblank_work(base);
+	struct intel_plane_state *plane_state =
+		container_of(work, typeof(*plane_state), unpin_work);
+	struct intel_plane *plane = to_intel_plane(plane_state->uapi.plane);
+
+	intel_plane_unpin_fb(plane_state);
+	intel_plane_destroy_state(&plane->base, &plane_state->uapi);
+}
+
 static int
 intel_legacy_cursor_update(struct drm_plane *_plane,
 			   struct drm_crtc *_crtc,
@@ -797,14 +808,25 @@ intel_legacy_cursor_update(struct drm_plane *_plane,
 
 	intel_psr_unlock(crtc_state);
 
-	intel_plane_unpin_fb(old_plane_state);
+	if (old_plane_state->ggtt_vma != new_plane_state->ggtt_vma) {
+		drm_vblank_work_init(&old_plane_state->unpin_work, &crtc->base,
+				     intel_cursor_unpin_work);
+
+		drm_vblank_work_schedule(&old_plane_state->unpin_work,
+					 drm_crtc_accurate_vblank_count(&crtc->base) + 1,
+					 false);
+
+		old_plane_state = NULL;
+	} else {
+		intel_plane_unpin_fb(old_plane_state);
+	}
 
 out_free:
 	if (new_crtc_state)
 		intel_crtc_destroy_state(&crtc->base, &new_crtc_state->uapi);
 	if (ret)
 		intel_plane_destroy_state(&plane->base, &new_plane_state->uapi);
-	else
+	else if (old_plane_state)
 		intel_plane_destroy_state(&plane->base, &old_plane_state->uapi);
 	return ret;
 
diff --git a/drivers/gpu/drm/i915/display/intel_display.c b/drivers/gpu/drm/i915/display/intel_display.c
index 7fb0f71652ac..bf684c4d1732 100644
--- a/drivers/gpu/drm/i915/display/intel_display.c
+++ b/drivers/gpu/drm/i915/display/intel_display.c
@@ -64,6 +64,7 @@
 #include "intel_crt.h"
 #include "intel_crtc.h"
 #include "intel_crtc_state_dump.h"
+#include "intel_cursor.h"
 #include "intel_ddi.h"
 #include "intel_de.h"
 #include "intel_display_driver.h"
@@ -6780,6 +6781,8 @@ static void intel_commit_modeset_disables(struct intel_atomic_state *state)
 			continue;
 
 		intel_crtc_disable_planes(state, crtc);
+
+		drm_vblank_work_flush_all(&crtc->base);
 	}
 
 	/* Only disable port sync and MST slaves */
diff --git a/drivers/gpu/drm/i915/display/intel_display_types.h b/drivers/gpu/drm/i915/display/intel_display_types.h
index ae2e8cff9d69..5fdb9eccab5a 100644
--- a/drivers/gpu/drm/i915/display/intel_display_types.h
+++ b/drivers/gpu/drm/i915/display/intel_display_types.h
@@ -713,6 +713,9 @@ struct intel_plane_state {
 
 	struct intel_fb_view view;
 
+	/* for legacy cursor fb unpin */
+	struct drm_vblank_work unpin_work;
+
 	/* Plane pxp decryption state */
 	bool decrypt;
 
-- 
2.25.1

[PATCH 3/6] drm/i915: Use the same vblank worker for atomic unpin

[Chaitanya Kumar Borah]

From: Maarten Lankhorst <maarten.lankhorst@linux.intel.com>

In case of legacy cursor update, the cursor VMA needs to be unpinned
only after vblank. This exceeds the lifetime of the whole atomic commit.

Any trick I attempted to keep the atomic commit alive didn't work, as
drm_atomic_helper_setup_commit() force throttles on any old commit that
wasn't cleaned up.

The only option remaining is to remove the plane from the atomic commit,
and use the same path as the legacy cursor update to clean the state
after vblank.

Signed-off-by: Maarten Lankhorst <maarten.lankhorst@linux.intel.com>
---
 .../gpu/drm/i915/display/intel_atomic_plane.c | 28 ++++++++++++++++++-
 .../gpu/drm/i915/display/intel_atomic_plane.h |  2 ++
 drivers/gpu/drm/i915/display/intel_crtc.c     | 27 ++++++++++++++++++
 drivers/gpu/drm/i915/display/intel_cursor.c   |  2 +-
 drivers/gpu/drm/i915/display/intel_cursor.h   |  3 ++
 5 files changed, 60 insertions(+), 2 deletions(-)

diff --git a/drivers/gpu/drm/i915/display/intel_atomic_plane.c b/drivers/gpu/drm/i915/display/intel_atomic_plane.c
index 76d77d5a0409..06c5d8262443 100644
--- a/drivers/gpu/drm/i915/display/intel_atomic_plane.c
+++ b/drivers/gpu/drm/i915/display/intel_atomic_plane.c
@@ -42,6 +42,7 @@
 #include "i915_reg.h"
 #include "intel_atomic_plane.h"
 #include "intel_cdclk.h"
+#include "intel_cursor.h"
 #include "intel_display_rps.h"
 #include "intel_display_trace.h"
 #include "intel_display_types.h"
@@ -1163,7 +1164,21 @@ intel_cleanup_plane_fb(struct drm_plane *plane,
 
 	intel_display_rps_mark_interactive(dev_priv, state, false);
 
-	/* Should only be called after a successful intel_prepare_plane_fb()! */
+	/*
+	 * This branch can only ever be called after plane update is succesful,
+	 * the error path will not cause unpin_work to be set.
+	 */
+	if (old_plane_state->unpin_work.vblank) {
+		int i = drm_plane_index(old_plane_state->uapi.plane);
+
+		/*
+		 * Remove plane from atomic commit,
+		 * free is done from vblank worker
+		 */
+		memset(&state->base.planes[i], 0, sizeof(*state->base.planes));
+		return;
+	}
+
 	intel_plane_unpin_fb(old_plane_state);
 }
 
@@ -1176,3 +1191,14 @@ void intel_plane_helper_add(struct intel_plane *plane)
 {
 	drm_plane_helper_add(&plane->base, &intel_plane_helper_funcs);
 }
+
+void intel_plane_init_cursor_vblank_work(struct intel_plane_state *old_plane_state,
+					 struct intel_plane_state *new_plane_state)
+{
+	if (!old_plane_state->ggtt_vma ||
+	    old_plane_state->ggtt_vma == new_plane_state->ggtt_vma)
+		return;
+
+	drm_vblank_work_init(&old_plane_state->unpin_work, old_plane_state->uapi.crtc,
+			     intel_cursor_unpin_work);
+}
diff --git a/drivers/gpu/drm/i915/display/intel_atomic_plane.h b/drivers/gpu/drm/i915/display/intel_atomic_plane.h
index 191dad0efc8e..5a897cf6fa02 100644
--- a/drivers/gpu/drm/i915/display/intel_atomic_plane.h
+++ b/drivers/gpu/drm/i915/display/intel_atomic_plane.h
@@ -66,5 +66,7 @@ int intel_plane_check_src_coordinates(struct intel_plane_state *plane_state);
 void intel_plane_set_invisible(struct intel_crtc_state *crtc_state,
 			       struct intel_plane_state *plane_state);
 void intel_plane_helper_add(struct intel_plane *plane);
+void intel_plane_init_cursor_vblank_work(struct intel_plane_state *old_plane_state,
+					 struct intel_plane_state *new_plane_state);
 
 #endif /* __INTEL_ATOMIC_PLANE_H__ */
diff --git a/drivers/gpu/drm/i915/display/intel_crtc.c b/drivers/gpu/drm/i915/display/intel_crtc.c
index 25593f6aae7d..a7fb7f5ace07 100644
--- a/drivers/gpu/drm/i915/display/intel_crtc.c
+++ b/drivers/gpu/drm/i915/display/intel_crtc.c
@@ -501,6 +501,18 @@ void intel_pipe_update_start(struct intel_atomic_state *state,
 		intel_crtc_vblank_work_init(new_crtc_state);
 
 	intel_vblank_evade_init(old_crtc_state, new_crtc_state, &evade);
+	if (state->base.legacy_cursor_update) {
+		struct intel_plane *plane;
+		struct intel_plane_state *old_plane_state, *new_plane_state;
+		int i;
+
+		for_each_oldnew_intel_plane_in_state(state, plane, old_plane_state,
+						     new_plane_state, i) {
+			if (old_plane_state->uapi.crtc == &crtc->base)
+				intel_plane_init_cursor_vblank_work(old_plane_state,
+								    new_plane_state);
+		}
+	}
 
 	if (drm_WARN_ON(&dev_priv->drm, drm_crtc_vblank_get(&crtc->base)))
 		goto irq_disable;
@@ -616,6 +628,21 @@ void intel_pipe_update_end(struct intel_atomic_state *state,
 		new_crtc_state->uapi.event = NULL;
 	}
 
+	if (state->base.legacy_cursor_update) {
+		struct intel_plane *plane;
+		struct intel_plane_state *old_plane_state;
+		int i;
+
+		for_each_old_intel_plane_in_state(state, plane, old_plane_state, i) {
+			if (old_plane_state->uapi.crtc == &crtc->base &&
+			    old_plane_state->unpin_work.vblank) {
+				drm_vblank_work_schedule(&old_plane_state->unpin_work,
+							 drm_crtc_accurate_vblank_count(&crtc->base) + 1,
+							 false);
+			}
+		}
+	}
+
 	/*
 	 * Send VRR Push to terminate Vblank. If we are already in vblank
 	 * this has to be done _after_ sampling the frame counter, as
diff --git a/drivers/gpu/drm/i915/display/intel_cursor.c b/drivers/gpu/drm/i915/display/intel_cursor.c
index 9021c0c1683d..dbb26a212800 100644
--- a/drivers/gpu/drm/i915/display/intel_cursor.c
+++ b/drivers/gpu/drm/i915/display/intel_cursor.c
@@ -654,7 +654,7 @@ static bool intel_cursor_format_mod_supported(struct drm_plane *_plane,
 	return format == DRM_FORMAT_ARGB8888;
 }
 
-static void intel_cursor_unpin_work(struct kthread_work *base)
+void intel_cursor_unpin_work(struct kthread_work *base)
 {
 	struct drm_vblank_work *work = to_drm_vblank_work(base);
 	struct intel_plane_state *plane_state =
diff --git a/drivers/gpu/drm/i915/display/intel_cursor.h b/drivers/gpu/drm/i915/display/intel_cursor.h
index ce333bf4c2d5..e2d9ec710a86 100644
--- a/drivers/gpu/drm/i915/display/intel_cursor.h
+++ b/drivers/gpu/drm/i915/display/intel_cursor.h
@@ -9,9 +9,12 @@
 enum pipe;
 struct drm_i915_private;
 struct intel_plane;
+struct kthread_work;
 
 struct intel_plane *
 intel_cursor_plane_create(struct drm_i915_private *dev_priv,
 			  enum pipe pipe);
 
+void intel_cursor_unpin_work(struct kthread_work *base);
+
 #endif
-- 
2.25.1

[PATCH 4/6] drm/i915: do not destroy plane state if cursor unpin worker is scheduled

[Chaitanya Kumar Borah]

The plane destroy hook can be called asynchronously even when vblank
worker responsible for unpinning the cursor fb is scheduled. Since
the vblank worker destroys the plane state, do not destroy the plane
state if it is scheduled.

Signed-off-by: Chaitanya Kumar Borah <chaitanya.kumar.borah@intel.com>
---
 .../gpu/drm/i915/display/intel_atomic_plane.c | 19 +++++++++++++++++++
 .../gpu/drm/i915/display/intel_atomic_plane.h |  2 ++
 drivers/gpu/drm/i915/display/intel_cursor.c   |  2 +-
 3 files changed, 22 insertions(+), 1 deletion(-)

diff --git a/drivers/gpu/drm/i915/display/intel_atomic_plane.c b/drivers/gpu/drm/i915/display/intel_atomic_plane.c
index 06c5d8262443..a585e4aca309 100644
--- a/drivers/gpu/drm/i915/display/intel_atomic_plane.c
+++ b/drivers/gpu/drm/i915/display/intel_atomic_plane.c
@@ -136,6 +136,25 @@ intel_plane_destroy_state(struct drm_plane *plane,
 {
 	struct intel_plane_state *plane_state = to_intel_plane_state(state);
 
+	/* Do not proceed if vblank unpin worker is yet to be executed */
+	if (plane_state->unpin_work.vblank)
+		return;
+
+	drm_WARN_ON(plane->dev, plane_state->ggtt_vma);
+	drm_WARN_ON(plane->dev, plane_state->dpt_vma);
+
+	__drm_atomic_helper_plane_destroy_state(&plane_state->uapi);
+	if (plane_state->hw.fb)
+		drm_framebuffer_put(plane_state->hw.fb);
+	kfree(plane_state);
+}
+
+void
+intel_cursor_destroy_state(struct drm_plane *plane,
+			   struct drm_plane_state *state)
+{
+	struct intel_plane_state *plane_state = to_intel_plane_state(state);
+
 	drm_WARN_ON(plane->dev, plane_state->ggtt_vma);
 	drm_WARN_ON(plane->dev, plane_state->dpt_vma);
 
diff --git a/drivers/gpu/drm/i915/display/intel_atomic_plane.h b/drivers/gpu/drm/i915/display/intel_atomic_plane.h
index 5a897cf6fa02..1e165b709a80 100644
--- a/drivers/gpu/drm/i915/display/intel_atomic_plane.h
+++ b/drivers/gpu/drm/i915/display/intel_atomic_plane.h
@@ -45,6 +45,8 @@ void intel_plane_free(struct intel_plane *plane);
 struct drm_plane_state *intel_plane_duplicate_state(struct drm_plane *plane);
 void intel_plane_destroy_state(struct drm_plane *plane,
 			       struct drm_plane_state *state);
+void intel_cursor_destroy_state(struct drm_plane *plane,
+				struct drm_plane_state *state);
 void intel_crtc_planes_update_noarm(struct intel_atomic_state *state,
 				    struct intel_crtc *crtc);
 void intel_crtc_planes_update_arm(struct intel_atomic_state *state,
diff --git a/drivers/gpu/drm/i915/display/intel_cursor.c b/drivers/gpu/drm/i915/display/intel_cursor.c
index dbb26a212800..32f9bb753331 100644
--- a/drivers/gpu/drm/i915/display/intel_cursor.c
+++ b/drivers/gpu/drm/i915/display/intel_cursor.c
@@ -662,7 +662,7 @@ void intel_cursor_unpin_work(struct kthread_work *base)
 	struct intel_plane *plane = to_intel_plane(plane_state->uapi.plane);
 
 	intel_plane_unpin_fb(plane_state);
-	intel_plane_destroy_state(&plane->base, &plane_state->uapi);
+	intel_cursor_destroy_state(&plane->base, &plane_state->uapi);
 }
 
 static int
-- 
2.25.1

[PATCH v2 5/6] drm/i915: Add sanity check before accessing fb buffer object

[Chaitanya Kumar Borah]

Now that cursor plane fb unpinning can be deferred to vblank work
access the fb object only when vblank unpin worker is not scheduled.

v2: - Remove misleading error log
    - Change condition for accessing fb object

Signed-off-by: Chaitanya Kumar Borah <chaitanya.kumar.borah@intel.com>
---
 drivers/gpu/drm/i915/display/intel_atomic_plane.c | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/drivers/gpu/drm/i915/display/intel_atomic_plane.c b/drivers/gpu/drm/i915/display/intel_atomic_plane.c
index a585e4aca309..8395cba243dd 100644
--- a/drivers/gpu/drm/i915/display/intel_atomic_plane.c
+++ b/drivers/gpu/drm/i915/display/intel_atomic_plane.c
@@ -1171,12 +1171,16 @@ static void
 intel_cleanup_plane_fb(struct drm_plane *plane,
 		       struct drm_plane_state *_old_plane_state)
 {
+	struct drm_i915_private *i915 = to_i915(_old_plane_state->plane->dev);
 	struct intel_plane_state *old_plane_state =
 		to_intel_plane_state(_old_plane_state);
 	struct intel_atomic_state *state =
 		to_intel_atomic_state(old_plane_state->uapi.state);
 	struct drm_i915_private *dev_priv = to_i915(plane->dev);
-	struct drm_i915_gem_object *obj = intel_fb_obj(old_plane_state->hw.fb);
+	struct drm_i915_gem_object *obj = NULL;
+
+	if (!old_plane_state->unpin_work.vblank)
+		obj = intel_fb_obj(old_plane_state->hw.fb);
 
 	if (!obj)
 		return;
-- 
2.25.1

[PATCH 6/6] drm/i915: do not defer cleanup work

[Chaitanya Kumar Borah]

After we move the cursor fb unpin to a vblank work, we encounter
race conditions between the vblank work and the atomic clean up
work leading to dump stacks[1]. Let's serialize the clean up
to avoid theses races.

[1]

   [  278.748767] Workqueue: events_highpri intel_atomic_cleanup_work [i915]
   [  278.749115] RIP: 0010:intel_display_rps_mark_interactive+0x4/0x40 [i915]
   [  278.749425] Code: 92 cb 20 e1 e9 49 ff ff ff 5b 48 89 ef 5d 41 5c e9 11 23 44 e1 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 66 0f 1f 00 <38> 96 a5 05 00 00 74 2a 55 48 89 f5 0f b6 f2 53 48 8b bf 40 37 00
   [  278.749428] RSP: 0018:ffffc9000029fdc8 EFLAGS: 00010246
   [  278.749433] RAX: 0000000000000060 RBX: 0000000000000000 RCX: 0000000000000000
   [  278.749435] RDX: 0000000000000000 RSI: 0000000000000000 RDI: ffff888124d70000
   [  278.749438] RBP: ffff88810394c000 R08: 0000000000000000 R09: ffffc9000029fc80
   [  278.749441] R10: 0000000000f6d950 R11: 0000000000f6da18 R12: ffff888124d70000
   [  278.749443] R13: ffff88814c952000 R14: ffff8881000aac05 R15: ffff8881059baf10
   [  278.749446] FS:  0000000000000000(0000) GS:ffff88817bd80000(0000) knlGS:0000000000000000
   [  278.749449] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
   [  278.749452] CR2: 00000000000005a5 CR3: 0000000104078000 CR4: 0000000000350ef0
   [  278.749454] Call Trace:
   [  278.749458]  <TASK>
   [  278.749461]  ? __die_body+0x1a/0x60
   [  278.749469]  ? page_fault_oops+0x156/0x450
   [  278.749474]  ? do_user_addr_fault+0x65/0x9e0
   [  278.749479]  ? exc_page_fault+0x68/0x1a0
   [  278.749486]  ? asm_exc_page_fault+0x26/0x30
   [  278.749494]  ? intel_display_rps_mark_interactive+0x4/0x40 [i915]
   [  278.749802]  intel_cleanup_plane_fb+0x6f/0xc0 [i915]
   [  278.750114]  drm_atomic_helper_cleanup_planes+0x42/0x60
   [  278.750122]  intel_atomic_cleanup_work+0x70/0xc0 [i915]
   [  278.750433]  ? process_scheduled_works+0x264/0x530
   [  278.750438]  process_scheduled_works+0x2db/0x530
   [  278.750444]  ? __pfx_worker_thread+0x10/0x10
   [  278.750448]  worker_thread+0x18c/0x350
   [  278.750452]  ? __pfx_worker_thread+0x10/0x10
   [  278.750455]  kthread+0xfe/0x130
   [  278.750460]  ? __pfx_kthread+0x10/0x10
   [  278.750464]  ret_from_fork+0x2c/0x50
   [  278.750468]  ? __pfx_kthread+0x10/0x10
   [  278.750472]  ret_from_fork_asm+0x1b/0x30

Signed-off-by: Chaitanya Kumar Borah <chaitanya.kumar.borah@intel.com>
---
 drivers/gpu/drm/i915/display/intel_display.c | 8 +++-----
 1 file changed, 3 insertions(+), 5 deletions(-)

diff --git a/drivers/gpu/drm/i915/display/intel_display.c b/drivers/gpu/drm/i915/display/intel_display.c
index bf684c4d1732..b0e89036508e 100644
--- a/drivers/gpu/drm/i915/display/intel_display.c
+++ b/drivers/gpu/drm/i915/display/intel_display.c
@@ -7006,10 +7006,8 @@ static void intel_atomic_commit_fence_wait(struct intel_atomic_state *intel_stat
 	}
 }
 
-static void intel_atomic_cleanup_work(struct work_struct *work)
+static void intel_atomic_cleanup_work(struct intel_atomic_state *state)
 {
-	struct intel_atomic_state *state =
-		container_of(work, struct intel_atomic_state, base.commit_work);
 	struct drm_i915_private *i915 = to_i915(state->base.dev);
 	struct intel_crtc_state *old_crtc_state;
 	struct intel_crtc *crtc;
@@ -7283,8 +7281,8 @@ static void intel_atomic_commit_tail(struct intel_atomic_state *state)
 	 * schedule point (cond_resched()) here anyway to keep latencies
 	 * down.
 	 */
-	INIT_WORK(&state->base.commit_work, intel_atomic_cleanup_work);
-	queue_work(system_highpri_wq, &state->base.commit_work);
+
+	intel_atomic_cleanup_work(state);
 }
 
 static void intel_atomic_commit_work(struct work_struct *work)
-- 
2.25.1

✗ Fi.CI.BUILD: failure for Cursor Fault Fixes (rev3)

[Patchwork]

== Series Details ==

Series: Cursor Fault Fixes (rev3)
URL   : https://patchwork.freedesktop.org/series/129517/
State : failure

== Summary ==

Error: make failed
  CALL    scripts/checksyscalls.sh
  DESCEND objtool
  INSTALL libsubcmd_headers
  CC [M]  drivers/gpu/drm/i915/display/intel_atomic_plane.o
drivers/gpu/drm/i915/display/intel_atomic_plane.c: In function ‘intel_cleanup_plane_fb’:
drivers/gpu/drm/i915/display/intel_atomic_plane.c:1174:27: error: unused variable ‘i915’ [-Werror=unused-variable]
 1174 |  struct drm_i915_private *i915 = to_i915(_old_plane_state->plane->dev);
      |                           ^~~~
cc1: all warnings being treated as errors
make[6]: *** [scripts/Makefile.build:243: drivers/gpu/drm/i915/display/intel_atomic_plane.o] Error 1
make[5]: *** [scripts/Makefile.build:481: drivers/gpu/drm/i915] Error 2
make[4]: *** [scripts/Makefile.build:481: drivers/gpu/drm] Error 2
make[3]: *** [scripts/Makefile.build:481: drivers/gpu] Error 2
make[2]: *** [scripts/Makefile.build:481: drivers] Error 2
make[1]: *** [/home/kbuild/kernel/Makefile:1921: .] Error 2
make: *** [Makefile:240: __sub-make] Error 2
Build failed, no error log produced

[PATCH 0/6] Cursor Fault Fixes

[Chaitanya Kumar Borah]

This series is based on top of [1] floated by Maarten.
To fix regressions seen in CI, following changes were made on top of the
original series.

1. add a check in the plane state destroy hook to not move forward if the vblank worker is scheduled.
2. add checks before accessing frame buffer object (we are not sure yet how much this helps but we have found that this operation causes dump stacks)
3. do not defer the intel atomic cleanup into a work queue, instead execute it at the end of atomic commit tail.

While this series is in noway a complete or proper solution it is meant to trigger a discussion to arrive at one.

[1] https://patchwork.freedesktop.org/series/126934/

v2: Add missing patch
v3: Remove misleading error log
    Change condition to access fb object
v4: Remove unused variables

Chaitanya Kumar Borah (3):
  drm/i915: do not destroy plane state if cursor unpin worker is
    scheduled
  drm/i915: Add sanity check before accessing fb buffer object
  drm/i915: do not defer cleanup work

Maarten Lankhorst (2):
  drm: Add drm_vblank_work_flush_all().
  drm/i915: Use the same vblank worker for atomic unpin

Ville Syrjälä (1):
  drm/i915: Use vblank worker to unpin old legacy cursor fb safely

 drivers/gpu/drm/drm_vblank_work.c             | 22 ++++++++
 .../gpu/drm/i915/display/intel_atomic_plane.c | 52 ++++++++++++++++++-
 .../gpu/drm/i915/display/intel_atomic_plane.h |  4 ++
 drivers/gpu/drm/i915/display/intel_crtc.c     | 27 ++++++++++
 drivers/gpu/drm/i915/display/intel_cursor.c   | 26 +++++++++-
 drivers/gpu/drm/i915/display/intel_cursor.h   |  3 ++
 drivers/gpu/drm/i915/display/intel_display.c  | 11 ++--
 .../drm/i915/display/intel_display_types.h    |  3 ++
 include/drm/drm_vblank_work.h                 |  2 +
 9 files changed, 141 insertions(+), 9 deletions(-)

-- 
2.25.1

Re: [PATCH 0/6] Cursor Fault Fixes

[Jani Nikula]

On Mon, 05 Feb 2024, Chaitanya Kumar Borah <chaitanya.kumar.borah@intel.com> wrote:
> This series is based on top of [1] floated by Maarten.
> To fix regressions seen in CI, following changes were made on top of the
> original series.

You've sent at least three versions of this in the past 24 hours, with
no indication of the version. Please use the -vN parameter in git
format-patch or git send-email to indicate the series version number in
patch subjects, so it's easier for people to track.

Thanks,
Jani.



>
> 1. add a check in the plane state destroy hook to not move forward if the vblank worker is scheduled.
> 2. add checks before accessing frame buffer object (we are not sure yet how much this helps but we have found that this operation causes dump stacks)
> 3. do not defer the intel atomic cleanup into a work queue, instead execute it at the end of atomic commit tail.
>
> While this series is in noway a complete or proper solution it is meant to trigger a discussion to arrive at one.
>
> [1] https://patchwork.freedesktop.org/series/126934/
>
> v2: Add missing patch
> v3: Remove misleading error log
>     Change condition to access fb object
>
> Chaitanya Kumar Borah (3):
>   drm/i915: do not destroy plane state if cursor unpin worker is
>     scheduled
>   drm/i915: Add sanity check before accessing fb buffer object
>   drm/i915: do not defer cleanup work
>
> Maarten Lankhorst (2):
>   drm: Add drm_vblank_work_flush_all().
>   drm/i915: Use the same vblank worker for atomic unpin
>
> Ville Syrjälä (1):
>   drm/i915: Use vblank worker to unpin old legacy cursor fb safely
>
>  drivers/gpu/drm/drm_vblank_work.c             | 22 ++++++++
>  .../gpu/drm/i915/display/intel_atomic_plane.c | 53 ++++++++++++++++++-
>  .../gpu/drm/i915/display/intel_atomic_plane.h |  4 ++
>  drivers/gpu/drm/i915/display/intel_crtc.c     | 27 ++++++++++
>  drivers/gpu/drm/i915/display/intel_cursor.c   | 26 ++++++++-
>  drivers/gpu/drm/i915/display/intel_cursor.h   |  3 ++
>  drivers/gpu/drm/i915/display/intel_display.c  | 11 ++--
>  .../drm/i915/display/intel_display_types.h    |  3 ++
>  include/drm/drm_vblank_work.h                 |  2 +
>  9 files changed, 142 insertions(+), 9 deletions(-)

-- 
Jani Nikula, Intel

RE: [PATCH 0/6] Cursor Fault Fixes

[Borah, Chaitanya Kumar]

> -----Original Message-----
> From: Jani Nikula <jani.nikula@linux.intel.com>
> Sent: Monday, February 5, 2024 6:52 PM
> To: Borah, Chaitanya Kumar <chaitanya.kumar.borah@intel.com>; intel-
> gfx@lists.freedesktop.org
> Cc: Shankar, Uma <uma.shankar@intel.com>; Borah, Chaitanya Kumar
> <chaitanya.kumar.borah@intel.com>; maarten.lankhorst@linux.intel.com;
> ville.syrjala@linux.intel.com
> Subject: Re: [PATCH 0/6] Cursor Fault Fixes
> 
> On Mon, 05 Feb 2024, Chaitanya Kumar Borah
> <chaitanya.kumar.borah@intel.com> wrote:
> > This series is based on top of [1] floated by Maarten.
> > To fix regressions seen in CI, following changes were made on top of
> > the original series.
> 
> You've sent at least three versions of this in the past 24 hours, with no
> indication of the version. Please use the -vN parameter in git format-patch or
> git send-email to indicate the series version number in patch subjects, so it's
> easier for people to track.

Noted. For now, the reviewers can refer to the version history in the body of the cover letter. I will take care to add it into the subject as and when there is a next version.

Thank you.

Regards

Chaitanya

> 
> Thanks,
> Jani.
> 
> 
> 
> >
> > 1. add a check in the plane state destroy hook to not move forward if the
> vblank worker is scheduled.
> > 2. add checks before accessing frame buffer object (we are not sure
> > yet how much this helps but we have found that this operation causes
> dump stacks) 3. do not defer the intel atomic cleanup into a work queue,
> instead execute it at the end of atomic commit tail.
> >
> > While this series is in noway a complete or proper solution it is meant to
> trigger a discussion to arrive at one.
> >
> > [1] https://patchwork.freedesktop.org/series/126934/
> >
> > v2: Add missing patch
> > v3: Remove misleading error log
> >     Change condition to access fb object
> >
> > Chaitanya Kumar Borah (3):
> >   drm/i915: do not destroy plane state if cursor unpin worker is
> >     scheduled
> >   drm/i915: Add sanity check before accessing fb buffer object
> >   drm/i915: do not defer cleanup work
> >
> > Maarten Lankhorst (2):
> >   drm: Add drm_vblank_work_flush_all().
> >   drm/i915: Use the same vblank worker for atomic unpin
> >
> > Ville Syrjälä (1):
> >   drm/i915: Use vblank worker to unpin old legacy cursor fb safely
> >
> >  drivers/gpu/drm/drm_vblank_work.c             | 22 ++++++++
> >  .../gpu/drm/i915/display/intel_atomic_plane.c | 53
> > ++++++++++++++++++-  .../gpu/drm/i915/display/intel_atomic_plane.h |  4
> ++
> >  drivers/gpu/drm/i915/display/intel_crtc.c     | 27 ++++++++++
> >  drivers/gpu/drm/i915/display/intel_cursor.c   | 26 ++++++++-
> >  drivers/gpu/drm/i915/display/intel_cursor.h   |  3 ++
> >  drivers/gpu/drm/i915/display/intel_display.c  | 11 ++--
> >  .../drm/i915/display/intel_display_types.h    |  3 ++
> >  include/drm/drm_vblank_work.h                 |  2 +
> >  9 files changed, 142 insertions(+), 9 deletions(-)
> 
> --
> Jani Nikula, Intel