aboutsummaryrefslogtreecommitdiffstats
path: root/common/recipes-kernel/linux/linux-yocto-4.19.8/0954-drm-amd-display-Skip-fast-cursor-updates-for-fb-chan.patch
diff options
context:
space:
mode:
Diffstat (limited to 'common/recipes-kernel/linux/linux-yocto-4.19.8/0954-drm-amd-display-Skip-fast-cursor-updates-for-fb-chan.patch')
-rw-r--r--common/recipes-kernel/linux/linux-yocto-4.19.8/0954-drm-amd-display-Skip-fast-cursor-updates-for-fb-chan.patch77
1 files changed, 77 insertions, 0 deletions
diff --git a/common/recipes-kernel/linux/linux-yocto-4.19.8/0954-drm-amd-display-Skip-fast-cursor-updates-for-fb-chan.patch b/common/recipes-kernel/linux/linux-yocto-4.19.8/0954-drm-amd-display-Skip-fast-cursor-updates-for-fb-chan.patch
new file mode 100644
index 00000000..52e3ebbb
--- /dev/null
+++ b/common/recipes-kernel/linux/linux-yocto-4.19.8/0954-drm-amd-display-Skip-fast-cursor-updates-for-fb-chan.patch
@@ -0,0 +1,77 @@
+From d3d9ef6e9f295658bb330d8716d64d4549b9e7f1 Mon Sep 17 00:00:00 2001
+From: Nicholas Kazlauskas <nicholas.kazlauskas@amd.com>
+Date: Fri, 14 Dec 2018 12:26:58 -0500
+Subject: [PATCH 0954/2940] drm/amd/display: Skip fast cursor updates for fb
+ changes
+
+[Why]
+The behavior of drm_atomic_helper_cleanup_planes differs depending on
+whether the commit was asynchronous or not. When it's called from
+amdgpu_dm_atomic_commit_tail during a typical atomic commit the
+plane state has been swapped so it calls cleanup_fb on the old plane
+state.
+
+However, in the asynchronous commit codepath the call to
+drm_atomic_helper_commit also calls dm_plane_helper_cleanup_fb after
+atomic_async_update has been called. Since the plane state is updated
+in place and has not been swapped the cleanup_fb call affects the new
+plane state.
+
+This results in a use after free for the given sequence:
+
+- Fast update, fb1 pin/ref, fb1 unpin/unref
+- Fast update, fb2 pin/ref, fb2 unpin/unref
+- Slow update, fb1 pin/ref, fb2 unpin/unref
+- Fast update, fb2 pin/ref -> use after free. bug
+
+[How]
+Disallow framebuffer changes in the fast path. Since this includes
+a NULL framebuffer, this means that only framebuffers that have
+been previously pin+ref at least once will be used, preventing a
+use after free.
+
+This has a significant throughput reduction for cursor updates where
+the framebuffer changes. For most desktop usage this isn't a problem,
+but it does introduce performance regressions for two specific IGT
+tests:
+
+- cursor-vs-flip-toggle
+- cursor-vs-flip-varying-size
+
+Fixes: 2cc751931afc ("drm/amd/display: Add fast path for cursor plane updates")
+Signed-off-by: Nicholas Kazlauskas <nicholas.kazlauskas@amd.com>
+Reviewed-by: Andrey Grodzovsky <andrey.grodzovsky@amd.com>
+Reviewed-by: Harry Wentland <harry.wentland@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+---
+ drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c | 10 ++++++++++
+ 1 file changed, 10 insertions(+)
+
+diff --git a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
+index 6f6d11d98f37..61067d206caf 100644
+--- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
++++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
+@@ -3658,10 +3658,20 @@ static int dm_plane_atomic_check(struct drm_plane *plane,
+ static int dm_plane_atomic_async_check(struct drm_plane *plane,
+ struct drm_plane_state *new_plane_state)
+ {
++ struct drm_plane_state *old_plane_state =
++ drm_atomic_get_old_plane_state(new_plane_state->state, plane);
++
+ /* Only support async updates on cursor planes. */
+ if (plane->type != DRM_PLANE_TYPE_CURSOR)
+ return -EINVAL;
+
++ /*
++ * DRM calls prepare_fb and cleanup_fb on new_plane_state for
++ * async commits so don't allow fb changes.
++ */
++ if (old_plane_state->fb != new_plane_state->fb)
++ return -EINVAL;
++
+ return 0;
+ }
+
+--
+2.17.1
+