diff options
Diffstat (limited to 'common/recipes-kernel/linux/linux-yocto-4.19.8/0954-drm-amd-display-Skip-fast-cursor-updates-for-fb-chan.patch')
-rw-r--r-- | common/recipes-kernel/linux/linux-yocto-4.19.8/0954-drm-amd-display-Skip-fast-cursor-updates-for-fb-chan.patch | 77 |
1 files changed, 77 insertions, 0 deletions
diff --git a/common/recipes-kernel/linux/linux-yocto-4.19.8/0954-drm-amd-display-Skip-fast-cursor-updates-for-fb-chan.patch b/common/recipes-kernel/linux/linux-yocto-4.19.8/0954-drm-amd-display-Skip-fast-cursor-updates-for-fb-chan.patch new file mode 100644 index 00000000..52e3ebbb --- /dev/null +++ b/common/recipes-kernel/linux/linux-yocto-4.19.8/0954-drm-amd-display-Skip-fast-cursor-updates-for-fb-chan.patch @@ -0,0 +1,77 @@ +From d3d9ef6e9f295658bb330d8716d64d4549b9e7f1 Mon Sep 17 00:00:00 2001 +From: Nicholas Kazlauskas <nicholas.kazlauskas@amd.com> +Date: Fri, 14 Dec 2018 12:26:58 -0500 +Subject: [PATCH 0954/2940] drm/amd/display: Skip fast cursor updates for fb + changes + +[Why] +The behavior of drm_atomic_helper_cleanup_planes differs depending on +whether the commit was asynchronous or not. When it's called from +amdgpu_dm_atomic_commit_tail during a typical atomic commit the +plane state has been swapped so it calls cleanup_fb on the old plane +state. + +However, in the asynchronous commit codepath the call to +drm_atomic_helper_commit also calls dm_plane_helper_cleanup_fb after +atomic_async_update has been called. Since the plane state is updated +in place and has not been swapped the cleanup_fb call affects the new +plane state. + +This results in a use after free for the given sequence: + +- Fast update, fb1 pin/ref, fb1 unpin/unref +- Fast update, fb2 pin/ref, fb2 unpin/unref +- Slow update, fb1 pin/ref, fb2 unpin/unref +- Fast update, fb2 pin/ref -> use after free. bug + +[How] +Disallow framebuffer changes in the fast path. Since this includes +a NULL framebuffer, this means that only framebuffers that have +been previously pin+ref at least once will be used, preventing a +use after free. + +This has a significant throughput reduction for cursor updates where +the framebuffer changes. For most desktop usage this isn't a problem, +but it does introduce performance regressions for two specific IGT +tests: + +- cursor-vs-flip-toggle +- cursor-vs-flip-varying-size + +Fixes: 2cc751931afc ("drm/amd/display: Add fast path for cursor plane updates") +Signed-off-by: Nicholas Kazlauskas <nicholas.kazlauskas@amd.com> +Reviewed-by: Andrey Grodzovsky <andrey.grodzovsky@amd.com> +Reviewed-by: Harry Wentland <harry.wentland@amd.com> +Signed-off-by: Alex Deucher <alexander.deucher@amd.com> +--- + drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c | 10 ++++++++++ + 1 file changed, 10 insertions(+) + +diff --git a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c +index 6f6d11d98f37..61067d206caf 100644 +--- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c ++++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c +@@ -3658,10 +3658,20 @@ static int dm_plane_atomic_check(struct drm_plane *plane, + static int dm_plane_atomic_async_check(struct drm_plane *plane, + struct drm_plane_state *new_plane_state) + { ++ struct drm_plane_state *old_plane_state = ++ drm_atomic_get_old_plane_state(new_plane_state->state, plane); ++ + /* Only support async updates on cursor planes. */ + if (plane->type != DRM_PLANE_TYPE_CURSOR) + return -EINVAL; + ++ /* ++ * DRM calls prepare_fb and cleanup_fb on new_plane_state for ++ * async commits so don't allow fb changes. ++ */ ++ if (old_plane_state->fb != new_plane_state->fb) ++ return -EINVAL; ++ + return 0; + } + +-- +2.17.1 + |