From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from gabe.freedesktop.org (gabe.freedesktop.org [131.252.210.177]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.lore.kernel.org (Postfix) with ESMTPS id 59F4CC48260 for ; Thu, 25 Jan 2024 18:18:31 +0000 (UTC) Received: from gabe.freedesktop.org (localhost [127.0.0.1]) by gabe.freedesktop.org (Postfix) with ESMTP id C643A10E2D8; Thu, 25 Jan 2024 18:18:26 +0000 (UTC) Received: from mail-ej1-f52.google.com (mail-ej1-f52.google.com [209.85.218.52]) by gabe.freedesktop.org (Postfix) with ESMTPS id 6561510E91E for ; Thu, 25 Jan 2024 18:18:25 +0000 (UTC) Received: by mail-ej1-f52.google.com with SMTP id a640c23a62f3a-a2e633c5365so191079866b.1 for ; Thu, 25 Jan 2024 10:18:25 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ffwll.ch; s=google; t=1706206644; x=1706811444; darn=lists.freedesktop.org; h=in-reply-to:content-transfer-encoding:content-disposition :mime-version:references:mail-followup-to:message-id:subject:cc:to :from:date:from:to:cc:subject:date:message-id:reply-to; bh=LX2Biyswi3lcTJguDEv72aHM8YWWcEZE57McfhSqDfM=; b=Y1icyBU6jfzFIh9gAqXbIzs8l/etjnt0gK2vo8V4l81BM+8nL0hcBHxhDlFXqt8Se8 Jeqg/VEN6QpvkUK4GTzU0/0T2MBbQRTyAG1OHNKrtgyPAtkkQf1YxdK6osJMn25wrOU4 jiYJZW41U9NcHfPQlXKrFDiur1OISvHP/BCus= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1706206644; x=1706811444; h=in-reply-to:content-transfer-encoding:content-disposition :mime-version:references:mail-followup-to:message-id:subject:cc:to :from:date:x-gm-message-state:from:to:cc:subject:date:message-id :reply-to; bh=LX2Biyswi3lcTJguDEv72aHM8YWWcEZE57McfhSqDfM=; b=psdCxV6C2u4tamdJMpuiHH4XZ9nxYkgZoDt6uhd6/lguJVncQ1J8vg0fMNgCkaU+dI Rf8dt3c1BMrpjrkTnicN+a8ROSqPMZdTV3rEIqLlvX51mM3oeM//8rRTBU7PHktA42or PKEi16rrbic1Tbbkv/gl85NPoaA9Ak5bc4fsVcYXV8zkzBzDAMIxVEGV+rb4KATajEKj ZwLlRQGSbEZVP9lMZoDBmFKl2SvzigDnndzdB/z/nGewc0hyyVVKjQF/27HaSyLErCno u0mklgZ6gcVm3sTNSXmgagJw7Te5OKizync79jmR+VF30Uqfo/BfmI3N5VV/wE4uMPS3 k3xQ== X-Gm-Message-State: AOJu0Yx4nI+rR4mowWSImeYNu+YV92lUPmM9DhxUTuV+MkWXcE2ZsCRf exnz1Zfs2A2OHuDcoD67rO1f0WDFbjRfpax/oJA9IWB3jrDJMs+xtVHWbca4m0s= X-Google-Smtp-Source: AGHT+IFFgR3FnuKNaxcbSF/D45iFGEkVO7DwIYkEGMWwJWTauy+SOrnz8WOVHQePtLtXFKX663PQaQ== X-Received: by 2002:a17:906:a2d6:b0:a31:7e9c:60bf with SMTP id by22-20020a170906a2d600b00a317e9c60bfmr23085ejb.0.1706206643807; Thu, 25 Jan 2024 10:17:23 -0800 (PST) Received: from phenom.ffwll.local ([2a02:168:57f4:0:efd0:b9e5:5ae6:c2fa]) by smtp.gmail.com with ESMTPSA id tl15-20020a170907c30f00b00a3186c2c254sm765083ejc.213.2024.01.25.10.17.22 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Thu, 25 Jan 2024 10:17:23 -0800 (PST) Date: Thu, 25 Jan 2024 19:17:21 +0100 From: Daniel Vetter To: Jason-JH Lin =?utf-8?B?KOael+edv+elpSk=?= Subject: Re: [PATCH] drm/atomic-helpers: remove legacy_cursor_update hacks Message-ID: Mail-Followup-To: Jason-JH Lin =?utf-8?B?KOael+edv+elpSk=?= , "maxime@cerno.tech" , "manasi.d.navare@intel.com" , "linux-mediatek@lists.infradead.org" , "linux-kernel@vger.kernel.org" , "michel@daenzer.net" , "intel-gfx@lists.freedesktop.org" , "chunkuang.hu@kernel.org" , "linux-arm-msm@vger.kernel.org" , "mikita.lipski@amd.com" , "dmitry.baryshkov@linaro.org" , "tzimmermann@suse.de" , "daniel.vetter@intel.com" , "nicholas.kazlauskas@amd.com" , "dri-devel@lists.freedesktop.org" , "quic_abhinavk@quicinc.com" , Project_Global_Chrome_Upstream_Group , "lucas.demarchi@intel.com" , "sean@poorly.run" , "matthias.bgg@gmail.com" , "dmitry.osipenko@collabora.com" , "fshao@chromium.org" , "linux-arm-kernel@lists.infradead.org" , "jani.nikula@intel.com" , "angelogioacchino.delregno@collabora.com" , "freedreno@lists.freedesktop.org" References: <20230216111214.3489223-1-daniel.vetter@ffwll.ch> <20230307145613.xvhru3fpcudlpazt@houat> MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Disposition: inline Content-Transfer-Encoding: 8bit In-Reply-To: X-Operating-System: Linux phenom 6.6.11-amd64 X-BeenThere: intel-gfx@lists.freedesktop.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Intel graphics driver community testing & development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Cc: "fshao@chromium.org" , "daniel.vetter@ffwll.ch" , "dri-devel@lists.freedesktop.org" , "daniel.vetter@intel.com" , Project_Global_Chrome_Upstream_Group , "dmitry.osipenko@collabora.com" , "intel-gfx@lists.freedesktop.org" , "chunkuang.hu@kernel.org" , "jani.nikula@intel.com" , "linux-arm-msm@vger.kernel.org" , "michel@daenzer.net" , "lucas.demarchi@intel.com" , "quic_abhinavk@quicinc.com" , "linux-mediatek@lists.infradead.org" , "maxime@cerno.tech" , "matthias.bgg@gmail.com" , "mikita.lipski@amd.com" , "linux-arm-kernel@lists.infradead.org" , "angelogioacchino.delregno@collabora.com" , "linux-kernel@vger.kernel.org" , "manasi.d.navare@intel.com" , "tzimmermann@suse.de" , "dmitry.baryshkov@linaro.org" , "freedreno@lists.freedesktop.org" , "nicholas.kazlauskas@amd.com" Errors-To: intel-gfx-bounces@lists.freedesktop.org Sender: "Intel-gfx" On Tue, Jan 23, 2024 at 06:09:05AM +0000, Jason-JH Lin (林睿祥) wrote: > Hi Maxime, Daniel, > > We encountered similar issue with mediatek SoCs. > > We have found that in drm_atomic_helper_commit_rpm(), when disabling > the cursor plane, the old_state->legacy_cursor_update in > drm_atomic_wait_for_vblank() is set to true. > As the result, we are not actually waiting for a vlbank to wait for our > hardware to close the cursor plane. Subsequently, the execution > proceeds to drm_atomic_helper_cleanup_planes() to free the cursor > buffer. This can lead to use-after-free issues with our hardware. > > Could you please apply this patch to fix our problem? > Or are there any considerations for not applying this patch? Mostly it needs someone to collect a pile of acks/tested-by and then land it. I'd be _very_ happy if someone else can take care of that ... There's also the potential issue that it might slow down some of the legacy X11 use-cases that really needed a non-blocking cursor, but I think all the drivers where this matters have switched over to the async plane update stuff meanwhile. So hopefully that's good. Cheers, Sima > > Regards, > Jason-JH.Lin > > On Tue, 2023-03-07 at 15:56 +0100, Maxime Ripard wrote: > > Hi, > > > > On Thu, Feb 16, 2023 at 12:12:13PM +0100, Daniel Vetter wrote: > > > The stuff never really worked, and leads to lots of fun because it > > > out-of-order frees atomic states. Which upsets KASAN, among other > > > things. > > > > > > For async updates we now have a more solid solution with the > > > ->atomic_async_check and ->atomic_async_commit hooks. Support for > > > that > > > for msm and vc4 landed. nouveau and i915 have their own commit > > > routines, doing something similar. > > > > > > For everyone else it's probably better to remove the use-after-free > > > bug, and encourage folks to use the async support instead. The > > > affected drivers which register a legacy cursor plane and don't > > > either > > > use the new async stuff or their own commit routine are: amdgpu, > > > atmel, mediatek, qxl, rockchip, sti, sun4i, tegra, virtio, and > > > vmwgfx. > > > > > > Inspired by an amdgpu bug report. > > > > Thanks for submitting that patch. It's been in the downstream RPi > > tree > > for a while, so I'd really like it to be merged eventually :) > > > > Acked-by: Maxime Ripard > > > > Maxime -- Daniel Vetter Software Engineer, Intel Corporation http://blog.ffwll.ch From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail-ej1-f44.google.com (mail-ej1-f44.google.com [209.85.218.44]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 9C5C81350E2 for ; Thu, 25 Jan 2024 18:17:25 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.218.44 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1706206647; cv=none; b=hh0e5CMJu4PRRZIg13pR1JEQmnAPFIbeqmZx6kMcg34BuEbcP/srCWdcnVTsXUh+C8HVc7tGaJ9UxwDidaUGTU9tfA59pYF/rgq0NP/Y2FKtMD2BwEGaf/WBg+Zs3jiHjWSXbyYhKRZKNB1zmd+rxdq2MI6Lv3NmIWb98CvduQQ= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1706206647; c=relaxed/simple; bh=fTH89TljylnA1PFABuOshml81dj6cKrkIPb4PGGYlC8=; h=Date:From:To:Cc:Subject:Message-ID:References:MIME-Version: Content-Type:Content-Disposition:In-Reply-To; b=ciVbjeUdCGjoi2+kEeEuPWwWCvlpsk8FBFl0D5aVJAZmn3e13Gy8iQISp0a7WP22I6FImsjJUgSibAos4eJONPA7L+6+PwEnuMncoU0TT/0GipaDY4q6MklGJ5EwitFwKoEuWP3Z4Hm53pBOKg9CB/J36FW6xCjcF6mNdTT5wF0= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=none (p=none dis=none) header.from=ffwll.ch; spf=none smtp.mailfrom=ffwll.ch; dkim=pass (1024-bit key) header.d=ffwll.ch header.i=@ffwll.ch header.b=DAuVUQIo; arc=none smtp.client-ip=209.85.218.44 Authentication-Results: smtp.subspace.kernel.org; dmarc=none (p=none dis=none) header.from=ffwll.ch Authentication-Results: smtp.subspace.kernel.org; spf=none smtp.mailfrom=ffwll.ch Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=ffwll.ch header.i=@ffwll.ch header.b="DAuVUQIo" Received: by mail-ej1-f44.google.com with SMTP id a640c23a62f3a-a27e7b70152so186490666b.0 for ; Thu, 25 Jan 2024 10:17:25 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ffwll.ch; s=google; t=1706206644; x=1706811444; darn=vger.kernel.org; h=in-reply-to:content-transfer-encoding:content-disposition :mime-version:references:mail-followup-to:message-id:subject:cc:to :from:date:from:to:cc:subject:date:message-id:reply-to; bh=LX2Biyswi3lcTJguDEv72aHM8YWWcEZE57McfhSqDfM=; b=DAuVUQIooh7k9SH4DjCLVVGnJGB7h7IAArZMSV32YaaSfOYdF6U+o2Bi8S01iVuN+H O5Ni/NsmY/brjIPSrvB/Sx5KM/vXbEchMV7euTsAn9PVyeMqxqYY6Up3Qb/oFodVhuSu hmmcWUgC+NaAdCEo3swZPzvRJZhAsg94uXr+M= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1706206644; x=1706811444; h=in-reply-to:content-transfer-encoding:content-disposition :mime-version:references:mail-followup-to:message-id:subject:cc:to :from:date:x-gm-message-state:from:to:cc:subject:date:message-id :reply-to; bh=LX2Biyswi3lcTJguDEv72aHM8YWWcEZE57McfhSqDfM=; b=jBcITqsHAEA/MsPctPIhY5LBNfKgTcn25H1jX1eyEA5y1ll80nItOCROkm204xVF4U qBJ6PSy7T+J1EvbOn4jvwruPmrEyIFsnVkxZszspaL2/EZv6uhVDSD+068555ywgtdPY qjqTd8KSqJbJKIQVwHCtGQJ6Otlpbdv2en0ilES1hluZ4tHLl+1FSfAy73PjNBhSGzHo kh0PiEKcwDuNKnpiBr2CbqjwNlXUok0Y1lRdPXUTHTqXbcG5mO6TBoonZWaXAAyM2lSb CgZVNiX2VOkn4f3lzMLc6b+WdvBu6OAjO0Mf75MA4HK1m9CJU1k34DGk4HPucaLfTR9N lT+w== X-Gm-Message-State: AOJu0YxNsSj6K0jPFey9DbqKR9KZ1s4CCSd2+6iL0JJu+EcBQfBvtlom i0SiRYb3DEPpzfe5TlcemUvKSfaVRnTCymV4lrl2C63mGlfaybZsDRxJd52fujI= X-Google-Smtp-Source: AGHT+IFFgR3FnuKNaxcbSF/D45iFGEkVO7DwIYkEGMWwJWTauy+SOrnz8WOVHQePtLtXFKX663PQaQ== X-Received: by 2002:a17:906:a2d6:b0:a31:7e9c:60bf with SMTP id by22-20020a170906a2d600b00a317e9c60bfmr23085ejb.0.1706206643807; Thu, 25 Jan 2024 10:17:23 -0800 (PST) Received: from phenom.ffwll.local ([2a02:168:57f4:0:efd0:b9e5:5ae6:c2fa]) by smtp.gmail.com with ESMTPSA id tl15-20020a170907c30f00b00a3186c2c254sm765083ejc.213.2024.01.25.10.17.22 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Thu, 25 Jan 2024 10:17:23 -0800 (PST) Date: Thu, 25 Jan 2024 19:17:21 +0100 From: Daniel Vetter To: Jason-JH Lin =?utf-8?B?KOael+edv+elpSk=?= Cc: "maxime@cerno.tech" , "daniel.vetter@ffwll.ch" , "manasi.d.navare@intel.com" , "linux-mediatek@lists.infradead.org" , "linux-kernel@vger.kernel.org" , "michel@daenzer.net" , "intel-gfx@lists.freedesktop.org" , "chunkuang.hu@kernel.org" , "linux-arm-msm@vger.kernel.org" , "mikita.lipski@amd.com" , "dmitry.baryshkov@linaro.org" , "tzimmermann@suse.de" , "daniel.vetter@intel.com" , "nicholas.kazlauskas@amd.com" , "dri-devel@lists.freedesktop.org" , "quic_abhinavk@quicinc.com" , Project_Global_Chrome_Upstream_Group , "lucas.demarchi@intel.com" , "sean@poorly.run" , "matthias.bgg@gmail.com" , "dmitry.osipenko@collabora.com" , "fshao@chromium.org" , "linux-arm-kernel@lists.infradead.org" , "jani.nikula@intel.com" , "angelogioacchino.delregno@collabora.com" , "freedreno@lists.freedesktop.org" Subject: Re: [PATCH] drm/atomic-helpers: remove legacy_cursor_update hacks Message-ID: Mail-Followup-To: Jason-JH Lin =?utf-8?B?KOael+edv+elpSk=?= , "maxime@cerno.tech" , "manasi.d.navare@intel.com" , "linux-mediatek@lists.infradead.org" , "linux-kernel@vger.kernel.org" , "michel@daenzer.net" , "intel-gfx@lists.freedesktop.org" , "chunkuang.hu@kernel.org" , "linux-arm-msm@vger.kernel.org" , "mikita.lipski@amd.com" , "dmitry.baryshkov@linaro.org" , "tzimmermann@suse.de" , "daniel.vetter@intel.com" , "nicholas.kazlauskas@amd.com" , "dri-devel@lists.freedesktop.org" , "quic_abhinavk@quicinc.com" , Project_Global_Chrome_Upstream_Group , "lucas.demarchi@intel.com" , "sean@poorly.run" , "matthias.bgg@gmail.com" , "dmitry.osipenko@collabora.com" , "fshao@chromium.org" , "linux-arm-kernel@lists.infradead.org" , "jani.nikula@intel.com" , "angelogioacchino.delregno@collabora.com" , "freedreno@lists.freedesktop.org" References: <20230216111214.3489223-1-daniel.vetter@ffwll.ch> <20230307145613.xvhru3fpcudlpazt@houat> Precedence: bulk X-Mailing-List: linux-arm-msm@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Disposition: inline Content-Transfer-Encoding: 8bit In-Reply-To: X-Operating-System: Linux phenom 6.6.11-amd64 On Tue, Jan 23, 2024 at 06:09:05AM +0000, Jason-JH Lin (林睿祥) wrote: > Hi Maxime, Daniel, > > We encountered similar issue with mediatek SoCs. > > We have found that in drm_atomic_helper_commit_rpm(), when disabling > the cursor plane, the old_state->legacy_cursor_update in > drm_atomic_wait_for_vblank() is set to true. > As the result, we are not actually waiting for a vlbank to wait for our > hardware to close the cursor plane. Subsequently, the execution > proceeds to drm_atomic_helper_cleanup_planes() to free the cursor > buffer. This can lead to use-after-free issues with our hardware. > > Could you please apply this patch to fix our problem? > Or are there any considerations for not applying this patch? Mostly it needs someone to collect a pile of acks/tested-by and then land it. I'd be _very_ happy if someone else can take care of that ... There's also the potential issue that it might slow down some of the legacy X11 use-cases that really needed a non-blocking cursor, but I think all the drivers where this matters have switched over to the async plane update stuff meanwhile. So hopefully that's good. Cheers, Sima > > Regards, > Jason-JH.Lin > > On Tue, 2023-03-07 at 15:56 +0100, Maxime Ripard wrote: > > Hi, > > > > On Thu, Feb 16, 2023 at 12:12:13PM +0100, Daniel Vetter wrote: > > > The stuff never really worked, and leads to lots of fun because it > > > out-of-order frees atomic states. Which upsets KASAN, among other > > > things. > > > > > > For async updates we now have a more solid solution with the > > > ->atomic_async_check and ->atomic_async_commit hooks. Support for > > > that > > > for msm and vc4 landed. nouveau and i915 have their own commit > > > routines, doing something similar. > > > > > > For everyone else it's probably better to remove the use-after-free > > > bug, and encourage folks to use the async support instead. The > > > affected drivers which register a legacy cursor plane and don't > > > either > > > use the new async stuff or their own commit routine are: amdgpu, > > > atmel, mediatek, qxl, rockchip, sti, sun4i, tegra, virtio, and > > > vmwgfx. > > > > > > Inspired by an amdgpu bug report. > > > > Thanks for submitting that patch. It's been in the downstream RPi > > tree > > for a while, so I'd really like it to be merged eventually :) > > > > Acked-by: Maxime Ripard > > > > Maxime -- Daniel Vetter Software Engineer, Intel Corporation http://blog.ffwll.ch From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from bombadil.infradead.org (bombadil.infradead.org [198.137.202.133]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.lore.kernel.org (Postfix) with ESMTPS id 89522C47258 for ; Thu, 25 Jan 2024 18:17:28 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=lists.infradead.org; s=bombadil.20210309; h=Sender:Cc:List-Subscribe: List-Help:List-Post:List-Archive:List-Unsubscribe:List-Id:In-Reply-To: Content-Transfer-Encoding:Content-Type:MIME-Version:References:Message-ID: Subject:To:From:Date:Reply-To:Content-ID:Content-Description:Resent-Date: Resent-From:Resent-Sender:Resent-To:Resent-Cc:Resent-Message-ID:List-Owner; bh=LX2Biyswi3lcTJguDEv72aHM8YWWcEZE57McfhSqDfM=; b=i/hzuFnyUmZJwZu1pzl03nkbMb fasU5tn3mHR8thMJjCXqvl5vhYHoboLudlRyto5IVv8zQrXXRQHngDYAH6+m42QUcNDyOveqxmN7D DJbZxF98w5gjwSlXppWzvRmTw8tSsJ8S4dFgvOdw+c21c1I7+eNcPnC68f4LUBwa21ePIZwaArLoe rbqz0Iw18QuBrtK27MICI9DqFkHEuex8hEp+DwTvQCXuUB/dWCg5o9EnqLDfUzCZWVCPnNIgk1JiG Hc1KoSwXMU4/6gmWw+bG72SY9fO7KMEvamlqljkM/ERlid8Zha70RcOmFkDgXHcB3JkotwzWO2XBZ twUN7YzQ==; Received: from localhost ([::1] helo=bombadil.infradead.org) by bombadil.infradead.org with esmtp (Exim 4.97.1 #2 (Red Hat Linux)) id 1rT4I4-00000001I64-09nN; Thu, 25 Jan 2024 18:17:28 +0000 Received: from mail-ej1-x62b.google.com ([2a00:1450:4864:20::62b]) by bombadil.infradead.org with esmtps (Exim 4.97.1 #2 (Red Hat Linux)) id 1rT4I1-00000001I4g-1XNC for linux-mediatek@lists.infradead.org; Thu, 25 Jan 2024 18:17:26 +0000 Received: by mail-ej1-x62b.google.com with SMTP id a640c23a62f3a-a27e7b70152so186490866b.0 for ; Thu, 25 Jan 2024 10:17:25 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ffwll.ch; s=google; t=1706206644; x=1706811444; darn=lists.infradead.org; h=in-reply-to:content-transfer-encoding:content-disposition :mime-version:references:mail-followup-to:message-id:subject:cc:to :from:date:from:to:cc:subject:date:message-id:reply-to; bh=LX2Biyswi3lcTJguDEv72aHM8YWWcEZE57McfhSqDfM=; b=XX6eOu9FXnsw7DxiotJ/d4CM6e6eEWe0Ld20L6Av5ugu+1wAnFFIUcgANxWnOJP7Wn 9IpfgM/GKz0/Fb0qu4pkiii7h5YTHrQFA1l0J6Rkvt7zNpaTv6quBOqYKTtYoXLB+GZG 2rSXIDuIZuoevisPr2hojQo7T2zEzC7Z0OZRY= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1706206644; x=1706811444; h=in-reply-to:content-transfer-encoding:content-disposition :mime-version:references:mail-followup-to:message-id:subject:cc:to :from:date:x-gm-message-state:from:to:cc:subject:date:message-id :reply-to; bh=LX2Biyswi3lcTJguDEv72aHM8YWWcEZE57McfhSqDfM=; b=wnYkGOLL8qWHGmt7CxfH0k1paCeiocNNe1icuXkIOUjoGnDRwwkmX59XsXjWWiuOnK 8YpOWyA5nSZhaggKwIByoW4tsmlMr+GEud088c3cyB4NWxmycAlSXgQ+2PAG+vsHIkMJ s6roH9H87Ba4FPH7fE18xaTzPqmoBeSL7XLxHlAWkZtGsEbzHHIUgrb7/6pN4sNBB/Fi 4ez29Uc4VdvrlmQkTVnLsEmOKBUpf2dxLk+G7MdebpZwelk8/Wi8Umcc8UCSoK5B+Oug xpD0I2Fqo3399GAxLp3oHydZgtZdnPwHVqLbzKDBetwRkkTM+FHkyYLRgabUNLuOHfUV 5otQ== X-Gm-Message-State: AOJu0YzD7I68Q1ZpcFbIS5xXg2voeuOb1kVT7ji2u/CjvJiTp640Af86 mpCrQ4H0g2g9rCIvVeJGNHv1pxNd5yykO5+YZfKBicY9/IFUHNe8804QXdCRP44= X-Google-Smtp-Source: AGHT+IFFgR3FnuKNaxcbSF/D45iFGEkVO7DwIYkEGMWwJWTauy+SOrnz8WOVHQePtLtXFKX663PQaQ== X-Received: by 2002:a17:906:a2d6:b0:a31:7e9c:60bf with SMTP id by22-20020a170906a2d600b00a317e9c60bfmr23085ejb.0.1706206643807; Thu, 25 Jan 2024 10:17:23 -0800 (PST) Received: from phenom.ffwll.local ([2a02:168:57f4:0:efd0:b9e5:5ae6:c2fa]) by smtp.gmail.com with ESMTPSA id tl15-20020a170907c30f00b00a3186c2c254sm765083ejc.213.2024.01.25.10.17.22 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Thu, 25 Jan 2024 10:17:23 -0800 (PST) Date: Thu, 25 Jan 2024 19:17:21 +0100 From: Daniel Vetter To: Jason-JH Lin =?utf-8?B?KOael+edv+elpSk=?= Subject: Re: [PATCH] drm/atomic-helpers: remove legacy_cursor_update hacks Message-ID: Mail-Followup-To: Jason-JH Lin =?utf-8?B?KOael+edv+elpSk=?= , "maxime@cerno.tech" , "manasi.d.navare@intel.com" , "linux-mediatek@lists.infradead.org" , "linux-kernel@vger.kernel.org" , "michel@daenzer.net" , "intel-gfx@lists.freedesktop.org" , "chunkuang.hu@kernel.org" , "linux-arm-msm@vger.kernel.org" , "mikita.lipski@amd.com" , "dmitry.baryshkov@linaro.org" , "tzimmermann@suse.de" , "daniel.vetter@intel.com" , "nicholas.kazlauskas@amd.com" , "dri-devel@lists.freedesktop.org" , "quic_abhinavk@quicinc.com" , Project_Global_Chrome_Upstream_Group , "lucas.demarchi@intel.com" , "sean@poorly.run" , "matthias.bgg@gmail.com" , "dmitry.osipenko@collabora.com" , "fshao@chromium.org" , "linux-arm-kernel@lists.infradead.org" , "jani.nikula@intel.com" , "angelogioacchino.delregno@collabora.com" , "freedreno@lists.freedesktop.org" References: <20230216111214.3489223-1-daniel.vetter@ffwll.ch> <20230307145613.xvhru3fpcudlpazt@houat> MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Disposition: inline Content-Transfer-Encoding: 8bit In-Reply-To: X-Operating-System: Linux phenom 6.6.11-amd64 X-CRM114-Version: 20100106-BlameMichelson ( TRE 0.8.0 (BSD) ) MR-646709E3 X-CRM114-CacheID: sfid-20240125_101725_456225_24B3BBE7 X-CRM114-Status: GOOD ( 31.84 ) X-BeenThere: linux-mediatek@lists.infradead.org X-Mailman-Version: 2.1.34 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Cc: "daniel.vetter@ffwll.ch" , "dri-devel@lists.freedesktop.org" , "daniel.vetter@intel.com" , Project_Global_Chrome_Upstream_Group , "dmitry.osipenko@collabora.com" , "intel-gfx@lists.freedesktop.org" , "chunkuang.hu@kernel.org" , "jani.nikula@intel.com" , "linux-arm-msm@vger.kernel.org" , "michel@daenzer.net" , "lucas.demarchi@intel.com" , "quic_abhinavk@quicinc.com" , "linux-mediatek@lists.infradead.org" , "maxime@cerno.tech" , "matthias.bgg@gmail.com" , "mikita.lipski@amd.com" , "sean@poorly.run" , "linux-arm-kernel@lists.infradead.org" , "angelogioacchino.delregno@collabora.com" , "linux-kernel@vger.kernel.org" , "manasi.d.navare@intel.com" , "tzimmermann@suse.de" , "dmitry.baryshkov@linaro.org" , "freedreno@lists.freedesktop.org" , "nicholas.kazlauskas@amd.com" Sender: "Linux-mediatek" Errors-To: linux-mediatek-bounces+linux-mediatek=archiver.kernel.org@lists.infradead.org On Tue, Jan 23, 2024 at 06:09:05AM +0000, Jason-JH Lin (林睿祥) wrote: > Hi Maxime, Daniel, > > We encountered similar issue with mediatek SoCs. > > We have found that in drm_atomic_helper_commit_rpm(), when disabling > the cursor plane, the old_state->legacy_cursor_update in > drm_atomic_wait_for_vblank() is set to true. > As the result, we are not actually waiting for a vlbank to wait for our > hardware to close the cursor plane. Subsequently, the execution > proceeds to drm_atomic_helper_cleanup_planes() to free the cursor > buffer. This can lead to use-after-free issues with our hardware. > > Could you please apply this patch to fix our problem? > Or are there any considerations for not applying this patch? Mostly it needs someone to collect a pile of acks/tested-by and then land it. I'd be _very_ happy if someone else can take care of that ... There's also the potential issue that it might slow down some of the legacy X11 use-cases that really needed a non-blocking cursor, but I think all the drivers where this matters have switched over to the async plane update stuff meanwhile. So hopefully that's good. Cheers, Sima > > Regards, > Jason-JH.Lin > > On Tue, 2023-03-07 at 15:56 +0100, Maxime Ripard wrote: > > Hi, > > > > On Thu, Feb 16, 2023 at 12:12:13PM +0100, Daniel Vetter wrote: > > > The stuff never really worked, and leads to lots of fun because it > > > out-of-order frees atomic states. Which upsets KASAN, among other > > > things. > > > > > > For async updates we now have a more solid solution with the > > > ->atomic_async_check and ->atomic_async_commit hooks. Support for > > > that > > > for msm and vc4 landed. nouveau and i915 have their own commit > > > routines, doing something similar. > > > > > > For everyone else it's probably better to remove the use-after-free > > > bug, and encourage folks to use the async support instead. The > > > affected drivers which register a legacy cursor plane and don't > > > either > > > use the new async stuff or their own commit routine are: amdgpu, > > > atmel, mediatek, qxl, rockchip, sti, sun4i, tegra, virtio, and > > > vmwgfx. > > > > > > Inspired by an amdgpu bug report. > > > > Thanks for submitting that patch. It's been in the downstream RPi > > tree > > for a while, so I'd really like it to be merged eventually :) > > > > Acked-by: Maxime Ripard > > > > Maxime -- Daniel Vetter Software Engineer, Intel Corporation http://blog.ffwll.ch From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from bombadil.infradead.org (bombadil.infradead.org [198.137.202.133]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.lore.kernel.org (Postfix) with ESMTPS id D2F25C47422 for ; Thu, 25 Jan 2024 18:17:39 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=lists.infradead.org; s=bombadil.20210309; h=Sender: Content-Transfer-Encoding:Content-Type:List-Subscribe:List-Help:List-Post: List-Archive:List-Unsubscribe:List-Id:In-Reply-To:MIME-Version:References: Message-ID:Subject:Cc:To:From:Date:Reply-To:Content-ID:Content-Description: Resent-Date:Resent-From:Resent-Sender:Resent-To:Resent-Cc:Resent-Message-ID: List-Owner; bh=9WhdA861KBTSU9xshjzRO9xxpmkSfQjIVD+X5qyeaYw=; b=ynT3Eko35xEFcH 6nxjKK/un0V317ohodb+gqz0w//CGib8CgvefGIANNtKELlU2M+rk9awUz+JnT+Y8Vn9E8ZxzvR6t eerST75tO/sYmpM9VLqZsZHavfLNORq4S8GeI9VIA+iGiE6jVmxAwJpLYcutde4NVbN9VvITcNbs4 JCEBEvRVQOa7g5ulOsrA0zUvBQh35HIdph1E4ghIVJzWtWDPdHx9Ela4PXcj0gGDmG30dXyHL8YJL JBI44f1herQLtlU43r2DQ7M2gv41DyxD8jFwMzpCK63EYtCbARpnoaIh0SNGiqDs8TgdvupU0zTJA PAehamHJ6kFYwSV8s95g==; Received: from localhost ([::1] helo=bombadil.infradead.org) by bombadil.infradead.org with esmtp (Exim 4.97.1 #2 (Red Hat Linux)) id 1rT4I5-00000001I6d-44oQ; Thu, 25 Jan 2024 18:17:29 +0000 Received: from mail-ej1-x62d.google.com ([2a00:1450:4864:20::62d]) by bombadil.infradead.org with esmtps (Exim 4.97.1 #2 (Red Hat Linux)) id 1rT4I2-00000001I4h-2Ii7 for linux-arm-kernel@lists.infradead.org; Thu, 25 Jan 2024 18:17:27 +0000 Received: by mail-ej1-x62d.google.com with SMTP id a640c23a62f3a-a27e7b70152so186491366b.0 for ; Thu, 25 Jan 2024 10:17:25 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ffwll.ch; s=google; t=1706206644; x=1706811444; darn=lists.infradead.org; h=in-reply-to:content-transfer-encoding:content-disposition :mime-version:references:mail-followup-to:message-id:subject:cc:to :from:date:from:to:cc:subject:date:message-id:reply-to; bh=LX2Biyswi3lcTJguDEv72aHM8YWWcEZE57McfhSqDfM=; b=XX6eOu9FXnsw7DxiotJ/d4CM6e6eEWe0Ld20L6Av5ugu+1wAnFFIUcgANxWnOJP7Wn 9IpfgM/GKz0/Fb0qu4pkiii7h5YTHrQFA1l0J6Rkvt7zNpaTv6quBOqYKTtYoXLB+GZG 2rSXIDuIZuoevisPr2hojQo7T2zEzC7Z0OZRY= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1706206644; x=1706811444; h=in-reply-to:content-transfer-encoding:content-disposition :mime-version:references:mail-followup-to:message-id:subject:cc:to :from:date:x-gm-message-state:from:to:cc:subject:date:message-id :reply-to; bh=LX2Biyswi3lcTJguDEv72aHM8YWWcEZE57McfhSqDfM=; b=UwA/yEG5mi9iAvWa7Gc2J4I4qJED0EN3pJIB7osBWS03/XGa4Uuh+2qS5Pj4rcSaSe s3DqbYVS8jf8vpjw//iKxFuoevUMVEjXezaTluYfUdr+xn+oRZAWU2P86bGDv5i0LK+f gX7jRCdzesK6wzrGmHAuzxJItwpwHm7iQS2jZPMK0TIEctnphYw6UjaY6ohNhfDg18dc lsaAU59WCWwsBOqPfdfimBc9n77LLbjWL8icx2lNNJTrTeicnjIjk4bgxvJXfLyHxNb5 smSEQ2JF/DgTNi3Ii8b753+tdEovwdgn4OLh5BRNWq/xPDlpg/rrHSLG1a7JlM66uD9E cDuw== X-Gm-Message-State: AOJu0YwFF7sO7SD5/FwiDvQvbqi3h4meYOG5HIlFQ1tYGld7QL3kBYkK Oum5hEmBsrwkGqkOnjYATF+qr87OZE3xuGU5ctr9bCNFUjUrzF91lQnC/0RFN7M= X-Google-Smtp-Source: AGHT+IFFgR3FnuKNaxcbSF/D45iFGEkVO7DwIYkEGMWwJWTauy+SOrnz8WOVHQePtLtXFKX663PQaQ== X-Received: by 2002:a17:906:a2d6:b0:a31:7e9c:60bf with SMTP id by22-20020a170906a2d600b00a317e9c60bfmr23085ejb.0.1706206643807; Thu, 25 Jan 2024 10:17:23 -0800 (PST) Received: from phenom.ffwll.local ([2a02:168:57f4:0:efd0:b9e5:5ae6:c2fa]) by smtp.gmail.com with ESMTPSA id tl15-20020a170907c30f00b00a3186c2c254sm765083ejc.213.2024.01.25.10.17.22 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Thu, 25 Jan 2024 10:17:23 -0800 (PST) Date: Thu, 25 Jan 2024 19:17:21 +0100 From: Daniel Vetter To: Jason-JH Lin =?utf-8?B?KOael+edv+elpSk=?= Cc: "maxime@cerno.tech" , "daniel.vetter@ffwll.ch" , "manasi.d.navare@intel.com" , "linux-mediatek@lists.infradead.org" , "linux-kernel@vger.kernel.org" , "michel@daenzer.net" , "intel-gfx@lists.freedesktop.org" , "chunkuang.hu@kernel.org" , "linux-arm-msm@vger.kernel.org" , "mikita.lipski@amd.com" , "dmitry.baryshkov@linaro.org" , "tzimmermann@suse.de" , "daniel.vetter@intel.com" , "nicholas.kazlauskas@amd.com" , "dri-devel@lists.freedesktop.org" , "quic_abhinavk@quicinc.com" , Project_Global_Chrome_Upstream_Group , "lucas.demarchi@intel.com" , "sean@poorly.run" , "matthias.bgg@gmail.com" , "dmitry.osipenko@collabora.com" , "fshao@chromium.org" , "linux-arm-kernel@lists.infradead.org" , "jani.nikula@intel.com" , "angelogioacchino.delregno@collabora.com" , "freedreno@lists.freedesktop.org" Subject: Re: [PATCH] drm/atomic-helpers: remove legacy_cursor_update hacks Message-ID: Mail-Followup-To: Jason-JH Lin =?utf-8?B?KOael+edv+elpSk=?= , "maxime@cerno.tech" , "manasi.d.navare@intel.com" , "linux-mediatek@lists.infradead.org" , "linux-kernel@vger.kernel.org" , "michel@daenzer.net" , "intel-gfx@lists.freedesktop.org" , "chunkuang.hu@kernel.org" , "linux-arm-msm@vger.kernel.org" , "mikita.lipski@amd.com" , "dmitry.baryshkov@linaro.org" , "tzimmermann@suse.de" , "daniel.vetter@intel.com" , "nicholas.kazlauskas@amd.com" , "dri-devel@lists.freedesktop.org" , "quic_abhinavk@quicinc.com" , Project_Global_Chrome_Upstream_Group , "lucas.demarchi@intel.com" , "sean@poorly.run" , "matthias.bgg@gmail.com" , "dmitry.osipenko@collabora.com" , "fshao@chromium.org" , "linux-arm-kernel@lists.infradead.org" , "jani.nikula@intel.com" , "angelogioacchino.delregno@collabora.com" , "freedreno@lists.freedesktop.org" References: <20230216111214.3489223-1-daniel.vetter@ffwll.ch> <20230307145613.xvhru3fpcudlpazt@houat> MIME-Version: 1.0 Content-Disposition: inline In-Reply-To: X-Operating-System: Linux phenom 6.6.11-amd64 X-CRM114-Version: 20100106-BlameMichelson ( TRE 0.8.0 (BSD) ) MR-646709E3 X-CRM114-CacheID: sfid-20240125_101726_621780_85BC26A7 X-CRM114-Status: GOOD ( 33.11 ) X-BeenThere: linux-arm-kernel@lists.infradead.org X-Mailman-Version: 2.1.34 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 Sender: "linux-arm-kernel" Errors-To: linux-arm-kernel-bounces+linux-arm-kernel=archiver.kernel.org@lists.infradead.org T24gVHVlLCBKYW4gMjMsIDIwMjQgYXQgMDY6MDk6MDVBTSArMDAwMCwgSmFzb24tSkggTGluICjm npfnnb/npaUpIHdyb3RlOgo+IEhpIE1heGltZSwgRGFuaWVsLAo+IAo+IFdlIGVuY291bnRlcmVk IHNpbWlsYXIgaXNzdWUgd2l0aCBtZWRpYXRlayBTb0NzLgo+IAo+IFdlIGhhdmUgZm91bmQgdGhh dCBpbiBkcm1fYXRvbWljX2hlbHBlcl9jb21taXRfcnBtKCksIHdoZW4gZGlzYWJsaW5nCj4gdGhl IGN1cnNvciBwbGFuZSwgdGhlIG9sZF9zdGF0ZS0+bGVnYWN5X2N1cnNvcl91cGRhdGUgaW4KPiBk cm1fYXRvbWljX3dhaXRfZm9yX3ZibGFuaygpIGlzIHNldCB0byB0cnVlLgo+IEFzIHRoZSByZXN1 bHQsIHdlIGFyZSBub3QgYWN0dWFsbHkgd2FpdGluZyBmb3IgYSB2bGJhbmsgdG8gd2FpdCBmb3Ig b3VyCj4gaGFyZHdhcmUgdG8gY2xvc2UgdGhlIGN1cnNvciBwbGFuZS4gU3Vic2VxdWVudGx5LCB0 aGUgZXhlY3V0aW9uCj4gcHJvY2VlZHMgdG8gZHJtX2F0b21pY19oZWxwZXJfY2xlYW51cF9wbGFu ZXMoKSB0byAgZnJlZSB0aGUgY3Vyc29yCj4gYnVmZmVyLiBUaGlzIGNhbiBsZWFkIHRvIHVzZS1h ZnRlci1mcmVlIGlzc3VlcyB3aXRoIG91ciBoYXJkd2FyZS4KPiAKPiBDb3VsZCB5b3UgcGxlYXNl IGFwcGx5IHRoaXMgcGF0Y2ggdG8gZml4IG91ciBwcm9ibGVtPwo+IE9yIGFyZSB0aGVyZSBhbnkg Y29uc2lkZXJhdGlvbnMgZm9yIG5vdCBhcHBseWluZyB0aGlzIHBhdGNoPwoKTW9zdGx5IGl0IG5l ZWRzIHNvbWVvbmUgdG8gY29sbGVjdCBhIHBpbGUgb2YgYWNrcy90ZXN0ZWQtYnkgYW5kIHRoZW4g bGFuZAppdC4KCkknZCBiZSBfdmVyeV8gaGFwcHkgaWYgc29tZW9uZSBlbHNlIGNhbiB0YWtlIGNh cmUgb2YgdGhhdCAuLi4KClRoZXJlJ3MgYWxzbyB0aGUgcG90ZW50aWFsIGlzc3VlIHRoYXQgaXQg bWlnaHQgc2xvdyBkb3duIHNvbWUgb2YgdGhlCmxlZ2FjeSBYMTEgdXNlLWNhc2VzIHRoYXQgcmVh bGx5IG5lZWRlZCBhIG5vbi1ibG9ja2luZyBjdXJzb3IsIGJ1dCBJIHRoaW5rCmFsbCB0aGUgZHJp dmVycyB3aGVyZSB0aGlzIG1hdHRlcnMgaGF2ZSBzd2l0Y2hlZCBvdmVyIHRvIHRoZSBhc3luYyBw bGFuZQp1cGRhdGUgc3R1ZmYgbWVhbndoaWxlLiBTbyBob3BlZnVsbHkgdGhhdCdzIGdvb2QuCgpD aGVlcnMsIFNpbWEKPiAKPiBSZWdhcmRzLAo+IEphc29uLUpILkxpbgo+IAo+IE9uIFR1ZSwgMjAy My0wMy0wNyBhdCAxNTo1NiArMDEwMCwgTWF4aW1lIFJpcGFyZCB3cm90ZToKPiA+IEhpLAo+ID4g Cj4gPiBPbiBUaHUsIEZlYiAxNiwgMjAyMyBhdCAxMjoxMjoxM1BNICswMTAwLCBEYW5pZWwgVmV0 dGVyIHdyb3RlOgo+ID4gPiBUaGUgc3R1ZmYgbmV2ZXIgcmVhbGx5IHdvcmtlZCwgYW5kIGxlYWRz IHRvIGxvdHMgb2YgZnVuIGJlY2F1c2UgaXQKPiA+ID4gb3V0LW9mLW9yZGVyIGZyZWVzIGF0b21p YyBzdGF0ZXMuIFdoaWNoIHVwc2V0cyBLQVNBTiwgYW1vbmcgb3RoZXIKPiA+ID4gdGhpbmdzLgo+ ID4gPiAKPiA+ID4gRm9yIGFzeW5jIHVwZGF0ZXMgd2Ugbm93IGhhdmUgYSBtb3JlIHNvbGlkIHNv bHV0aW9uIHdpdGggdGhlCj4gPiA+IC0+YXRvbWljX2FzeW5jX2NoZWNrIGFuZCAtPmF0b21pY19h c3luY19jb21taXQgaG9va3MuIFN1cHBvcnQgZm9yCj4gPiA+IHRoYXQKPiA+ID4gZm9yIG1zbSBh bmQgdmM0IGxhbmRlZC4gbm91dmVhdSBhbmQgaTkxNSBoYXZlIHRoZWlyIG93biBjb21taXQKPiA+ ID4gcm91dGluZXMsIGRvaW5nIHNvbWV0aGluZyBzaW1pbGFyLgo+ID4gPiAKPiA+ID4gRm9yIGV2 ZXJ5b25lIGVsc2UgaXQncyBwcm9iYWJseSBiZXR0ZXIgdG8gcmVtb3ZlIHRoZSB1c2UtYWZ0ZXIt ZnJlZQo+ID4gPiBidWcsIGFuZCBlbmNvdXJhZ2UgZm9sa3MgdG8gdXNlIHRoZSBhc3luYyBzdXBw b3J0IGluc3RlYWQuIFRoZQo+ID4gPiBhZmZlY3RlZCBkcml2ZXJzIHdoaWNoIHJlZ2lzdGVyIGEg bGVnYWN5IGN1cnNvciBwbGFuZSBhbmQgZG9uJ3QKPiA+ID4gZWl0aGVyCj4gPiA+IHVzZSB0aGUg bmV3IGFzeW5jIHN0dWZmIG9yIHRoZWlyIG93biBjb21taXQgcm91dGluZSBhcmU6IGFtZGdwdSwK PiA+ID4gYXRtZWwsIG1lZGlhdGVrLCBxeGwsIHJvY2tjaGlwLCBzdGksIHN1bjRpLCB0ZWdyYSwg dmlydGlvLCBhbmQKPiA+ID4gdm13Z2Z4Lgo+ID4gPiAKPiA+ID4gSW5zcGlyZWQgYnkgYW4gYW1k Z3B1IGJ1ZyByZXBvcnQuCj4gPiAKPiA+IFRoYW5rcyBmb3Igc3VibWl0dGluZyB0aGF0IHBhdGNo LiBJdCdzIGJlZW4gaW4gdGhlIGRvd25zdHJlYW0gUlBpCj4gPiB0cmVlCj4gPiBmb3IgYSB3aGls ZSwgc28gSSdkIHJlYWxseSBsaWtlIGl0IHRvIGJlIG1lcmdlZCBldmVudHVhbGx5IDopCj4gPiAK PiA+IEFja2VkLWJ5OiBNYXhpbWUgUmlwYXJkIDxtYXhpbWVAY2Vybm8udGVjaD4KPiA+IAo+ID4g TWF4aW1lCgotLSAKRGFuaWVsIFZldHRlcgpTb2Z0d2FyZSBFbmdpbmVlciwgSW50ZWwgQ29ycG9y YXRpb24KaHR0cDovL2Jsb2cuZmZ3bGwuY2gKCl9fX19fX19fX19fX19fX19fX19fX19fX19fX19f X19fX19fX19fX19fX19fX19fCmxpbnV4LWFybS1rZXJuZWwgbWFpbGluZyBsaXN0CmxpbnV4LWFy bS1rZXJuZWxAbGlzdHMuaW5mcmFkZWFkLm9yZwpodHRwOi8vbGlzdHMuaW5mcmFkZWFkLm9yZy9t YWlsbWFuL2xpc3RpbmZvL2xpbnV4LWFybS1rZXJuZWwK From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from gabe.freedesktop.org (gabe.freedesktop.org [131.252.210.177]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.lore.kernel.org (Postfix) with ESMTPS id 3AD9BC47422 for ; Thu, 25 Jan 2024 18:18:29 +0000 (UTC) Received: from gabe.freedesktop.org (localhost [127.0.0.1]) by gabe.freedesktop.org (Postfix) with ESMTP id 359DB10E246; Thu, 25 Jan 2024 18:18:26 +0000 (UTC) Received: from mail-ej1-f41.google.com (mail-ej1-f41.google.com [209.85.218.41]) by gabe.freedesktop.org (Postfix) with ESMTPS id 5E91010E246 for ; Thu, 25 Jan 2024 18:18:25 +0000 (UTC) Received: by mail-ej1-f41.google.com with SMTP id a640c23a62f3a-a27e7b70152so186490466b.0 for ; Thu, 25 Jan 2024 10:18:25 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ffwll.ch; s=google; t=1706206644; x=1706811444; darn=lists.freedesktop.org; h=in-reply-to:content-transfer-encoding:content-disposition :mime-version:references:mail-followup-to:message-id:subject:cc:to :from:date:from:to:cc:subject:date:message-id:reply-to; bh=LX2Biyswi3lcTJguDEv72aHM8YWWcEZE57McfhSqDfM=; b=Y1icyBU6jfzFIh9gAqXbIzs8l/etjnt0gK2vo8V4l81BM+8nL0hcBHxhDlFXqt8Se8 Jeqg/VEN6QpvkUK4GTzU0/0T2MBbQRTyAG1OHNKrtgyPAtkkQf1YxdK6osJMn25wrOU4 jiYJZW41U9NcHfPQlXKrFDiur1OISvHP/BCus= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1706206644; x=1706811444; h=in-reply-to:content-transfer-encoding:content-disposition :mime-version:references:mail-followup-to:message-id:subject:cc:to :from:date:x-gm-message-state:from:to:cc:subject:date:message-id :reply-to; bh=LX2Biyswi3lcTJguDEv72aHM8YWWcEZE57McfhSqDfM=; b=oei0oufAUmjFKF4fI6AcAnNAPrrpPoSDHO+JuONVhgrU/Yj7TLlIhixC9uM8Ffkyxn Q1rGF4b+Uxt4HGZfLU5BK+aitm8x0YAojfVx/S8GAa5pKj38aPxDQsIzb60IPiaty+BN A2oV/dFh7ghmdWxWbOmteSeC1B9ATITZ83NDtgcjZMpvmxlhUe550nRAHr/azY5UN4H2 YeLbTSkTAZjkT1TAWs5o3X6I4MH0GfbsPenY4zaLxVUCWqjU6eG4tRt8FWGtvfH5ppHd Vu0HoKtE3TEhHl3YUHM6F8/8OilsvVyt6807ztjb40w+7CXlnTSHbzURM/v3rSfmU1oY pNbw== X-Gm-Message-State: AOJu0YzLvjv+wzAvPdbSMB2t9r8FwzoFKd3BU/taoiHVzQ0qK95QyGwW bYal2JEQiBTjTHMxsPe1RUeXLrMWXo+vuwVswU9bn6ukjAd1Jc07+Pp9mxX2dgU= X-Google-Smtp-Source: AGHT+IFFgR3FnuKNaxcbSF/D45iFGEkVO7DwIYkEGMWwJWTauy+SOrnz8WOVHQePtLtXFKX663PQaQ== X-Received: by 2002:a17:906:a2d6:b0:a31:7e9c:60bf with SMTP id by22-20020a170906a2d600b00a317e9c60bfmr23085ejb.0.1706206643807; Thu, 25 Jan 2024 10:17:23 -0800 (PST) Received: from phenom.ffwll.local ([2a02:168:57f4:0:efd0:b9e5:5ae6:c2fa]) by smtp.gmail.com with ESMTPSA id tl15-20020a170907c30f00b00a3186c2c254sm765083ejc.213.2024.01.25.10.17.22 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Thu, 25 Jan 2024 10:17:23 -0800 (PST) Date: Thu, 25 Jan 2024 19:17:21 +0100 From: Daniel Vetter To: Jason-JH Lin =?utf-8?B?KOael+edv+elpSk=?= Subject: Re: [PATCH] drm/atomic-helpers: remove legacy_cursor_update hacks Message-ID: Mail-Followup-To: Jason-JH Lin =?utf-8?B?KOael+edv+elpSk=?= , "maxime@cerno.tech" , "manasi.d.navare@intel.com" , "linux-mediatek@lists.infradead.org" , "linux-kernel@vger.kernel.org" , "michel@daenzer.net" , "intel-gfx@lists.freedesktop.org" , "chunkuang.hu@kernel.org" , "linux-arm-msm@vger.kernel.org" , "mikita.lipski@amd.com" , "dmitry.baryshkov@linaro.org" , "tzimmermann@suse.de" , "daniel.vetter@intel.com" , "nicholas.kazlauskas@amd.com" , "dri-devel@lists.freedesktop.org" , "quic_abhinavk@quicinc.com" , Project_Global_Chrome_Upstream_Group , "lucas.demarchi@intel.com" , "sean@poorly.run" , "matthias.bgg@gmail.com" , "dmitry.osipenko@collabora.com" , "fshao@chromium.org" , "linux-arm-kernel@lists.infradead.org" , "jani.nikula@intel.com" , "angelogioacchino.delregno@collabora.com" , "freedreno@lists.freedesktop.org" References: <20230216111214.3489223-1-daniel.vetter@ffwll.ch> <20230307145613.xvhru3fpcudlpazt@houat> MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Disposition: inline Content-Transfer-Encoding: 8bit In-Reply-To: X-Operating-System: Linux phenom 6.6.11-amd64 X-BeenThere: dri-devel@lists.freedesktop.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Direct Rendering Infrastructure - Development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Cc: "fshao@chromium.org" , "daniel.vetter@ffwll.ch" , "dri-devel@lists.freedesktop.org" , "daniel.vetter@intel.com" , Project_Global_Chrome_Upstream_Group , "dmitry.osipenko@collabora.com" , "intel-gfx@lists.freedesktop.org" , "chunkuang.hu@kernel.org" , "jani.nikula@intel.com" , "linux-arm-msm@vger.kernel.org" , "michel@daenzer.net" , "lucas.demarchi@intel.com" , "quic_abhinavk@quicinc.com" , "linux-mediatek@lists.infradead.org" , "maxime@cerno.tech" , "matthias.bgg@gmail.com" , "mikita.lipski@amd.com" , "sean@poorly.run" , "linux-arm-kernel@lists.infradead.org" , "angelogioacchino.delregno@collabora.com" , "linux-kernel@vger.kernel.org" , "manasi.d.navare@intel.com" , "tzimmermann@suse.de" , "dmitry.baryshkov@linaro.org" , "freedreno@lists.freedesktop.org" , "nicholas.kazlauskas@amd.com" Errors-To: dri-devel-bounces@lists.freedesktop.org Sender: "dri-devel" On Tue, Jan 23, 2024 at 06:09:05AM +0000, Jason-JH Lin (林睿祥) wrote: > Hi Maxime, Daniel, > > We encountered similar issue with mediatek SoCs. > > We have found that in drm_atomic_helper_commit_rpm(), when disabling > the cursor plane, the old_state->legacy_cursor_update in > drm_atomic_wait_for_vblank() is set to true. > As the result, we are not actually waiting for a vlbank to wait for our > hardware to close the cursor plane. Subsequently, the execution > proceeds to drm_atomic_helper_cleanup_planes() to free the cursor > buffer. This can lead to use-after-free issues with our hardware. > > Could you please apply this patch to fix our problem? > Or are there any considerations for not applying this patch? Mostly it needs someone to collect a pile of acks/tested-by and then land it. I'd be _very_ happy if someone else can take care of that ... There's also the potential issue that it might slow down some of the legacy X11 use-cases that really needed a non-blocking cursor, but I think all the drivers where this matters have switched over to the async plane update stuff meanwhile. So hopefully that's good. Cheers, Sima > > Regards, > Jason-JH.Lin > > On Tue, 2023-03-07 at 15:56 +0100, Maxime Ripard wrote: > > Hi, > > > > On Thu, Feb 16, 2023 at 12:12:13PM +0100, Daniel Vetter wrote: > > > The stuff never really worked, and leads to lots of fun because it > > > out-of-order frees atomic states. Which upsets KASAN, among other > > > things. > > > > > > For async updates we now have a more solid solution with the > > > ->atomic_async_check and ->atomic_async_commit hooks. Support for > > > that > > > for msm and vc4 landed. nouveau and i915 have their own commit > > > routines, doing something similar. > > > > > > For everyone else it's probably better to remove the use-after-free > > > bug, and encourage folks to use the async support instead. The > > > affected drivers which register a legacy cursor plane and don't > > > either > > > use the new async stuff or their own commit routine are: amdgpu, > > > atmel, mediatek, qxl, rockchip, sti, sun4i, tegra, virtio, and > > > vmwgfx. > > > > > > Inspired by an amdgpu bug report. > > > > Thanks for submitting that patch. It's been in the downstream RPi > > tree > > for a while, so I'd really like it to be merged eventually :) > > > > Acked-by: Maxime Ripard > > > > Maxime -- Daniel Vetter Software Engineer, Intel Corporation http://blog.ffwll.ch