2014-06-05 12:01:32 +08:00
|
|
|
/*
|
|
|
|
* Copyright © 2014 Red Hat.
|
|
|
|
*
|
|
|
|
* Permission to use, copy, modify, distribute, and sell this software and its
|
|
|
|
* documentation for any purpose is hereby granted without fee, provided that
|
|
|
|
* the above copyright notice appear in all copies and that both that copyright
|
|
|
|
* notice and this permission notice appear in supporting documentation, and
|
|
|
|
* that the name of the copyright holders not be used in advertising or
|
|
|
|
* publicity pertaining to distribution of the software without specific,
|
|
|
|
* written prior permission. The copyright holders make no representations
|
|
|
|
* about the suitability of this software for any purpose. It is provided "as
|
|
|
|
* is" without express or implied warranty.
|
|
|
|
*
|
|
|
|
* THE COPYRIGHT HOLDERS DISCLAIM ALL WARRANTIES WITH REGARD TO THIS SOFTWARE,
|
|
|
|
* INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS, IN NO
|
|
|
|
* EVENT SHALL THE COPYRIGHT HOLDERS BE LIABLE FOR ANY SPECIAL, INDIRECT OR
|
|
|
|
* CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM LOSS OF USE,
|
|
|
|
* DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR OTHER
|
|
|
|
* TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR PERFORMANCE
|
|
|
|
* OF THIS SOFTWARE.
|
|
|
|
*/
|
|
|
|
#ifndef _DRM_DP_MST_HELPER_H_
|
|
|
|
#define _DRM_DP_MST_HELPER_H_
|
|
|
|
|
|
|
|
#include <linux/types.h>
|
|
|
|
#include <drm/drm_dp_helper.h>
|
2017-04-21 13:51:31 +08:00
|
|
|
#include <drm/drm_atomic.h>
|
2014-06-05 12:01:32 +08:00
|
|
|
|
|
|
|
struct drm_dp_mst_branch;
|
|
|
|
|
|
|
|
/**
|
2014-10-20 22:53:13 +08:00
|
|
|
* struct drm_dp_vcpi - Virtual Channel Payload Identifier
|
2014-06-05 12:01:32 +08:00
|
|
|
* @vcpi: Virtual channel ID.
|
|
|
|
* @pbn: Payload Bandwidth Number for this channel
|
|
|
|
* @aligned_pbn: PBN aligned with slot size
|
|
|
|
* @num_slots: number of slots for this PBN
|
|
|
|
*/
|
|
|
|
struct drm_dp_vcpi {
|
|
|
|
int vcpi;
|
|
|
|
int pbn;
|
|
|
|
int aligned_pbn;
|
|
|
|
int num_slots;
|
|
|
|
};
|
|
|
|
|
|
|
|
/**
|
|
|
|
* struct drm_dp_mst_port - MST port
|
|
|
|
* @port_num: port number
|
|
|
|
* @input: if this port is an input port.
|
|
|
|
* @mcs: message capability status - DP 1.2 spec.
|
|
|
|
* @ddps: DisplayPort Device Plug Status - DP 1.2
|
|
|
|
* @pdt: Peer Device Type
|
|
|
|
* @ldps: Legacy Device Plug Status
|
|
|
|
* @dpcd_rev: DPCD revision of device on this port
|
|
|
|
* @num_sdp_streams: Number of simultaneous streams
|
|
|
|
* @num_sdp_stream_sinks: Number of stream sinks
|
|
|
|
* @available_pbn: Available bandwidth for this port.
|
|
|
|
* @next: link to next port on this branch device
|
|
|
|
* @mstb: branch device attach below this port
|
|
|
|
* @aux: i2c aux transport to talk to device connected to this port.
|
|
|
|
* @parent: branch device parent of this port
|
|
|
|
* @vcpi: Virtual Channel Payload info for this port.
|
|
|
|
* @connector: DRM connector this port is connected to.
|
|
|
|
* @mgr: topology manager this port lives under.
|
|
|
|
*
|
|
|
|
* This structure represents an MST port endpoint on a device somewhere
|
|
|
|
* in the MST topology.
|
|
|
|
*/
|
|
|
|
struct drm_dp_mst_port {
|
drm/dp_mst: Introduce new refcounting scheme for mstbs and ports
The current way of handling refcounting in the DP MST helpers is really
confusing and probably just plain wrong because it's been hacked up many
times over the years without anyone actually going over the code and
seeing if things could be simplified.
To the best of my understanding, the current scheme works like this:
drm_dp_mst_port and drm_dp_mst_branch both have a single refcount. When
this refcount hits 0 for either of the two, they're removed from the
topology state, but not immediately freed. Both ports and branch devices
will reinitialize their kref once it's hit 0 before actually destroying
themselves. The intended purpose behind this is so that we can avoid
problems like not being able to free a remote payload that might still
be active, due to us having removed all of the port/branch device
structures in memory, as per:
commit 91a25e463130 ("drm/dp/mst: deallocate payload on port destruction")
Which may have worked, but then it caused use-after-free errors. Being
new to MST at the time, I tried fixing it;
commit 263efde31f97 ("drm/dp/mst: Get validated port ref in drm_dp_update_payload_part1()")
But, that was broken: both drm_dp_mst_port and drm_dp_mst_branch structs
are validated in almost every DP MST helper function. Simply put, this
means we go through the topology and try to see if the given
drm_dp_mst_branch or drm_dp_mst_port is still attached to something
before trying to use it in order to avoid dereferencing freed memory
(something that has happened a LOT in the past with this library).
Because of this it doesn't actually matter whether or not we keep keep
the ports and branches around in memory as that's not enough, because
any function that validates the branches and ports passed to it will
still reject them anyway since they're no longer in the topology
structure. So, use-after-free errors were fixed but payload deallocation
was completely broken.
Two years later, AMD informed me about this issue and I attempted to
come up with a temporary fix, pending a long-overdue cleanup of this
library:
commit c54c7374ff44 ("drm/dp_mst: Skip validating ports during destruction, just ref")
But then that introduced use-after-free errors, so I quickly reverted
it:
commit 9765635b3075 ("Revert "drm/dp_mst: Skip validating ports during destruction, just ref"")
And in the process, learned that there is just no simple fix for this:
the design is just broken. Unfortunately, the usage of these helpers are
quite broken as well. Some drivers like i915 have been smart enough to
avoid accessing any kind of information from MST port structures, but
others like nouveau have assumed, understandably so, that
drm_dp_mst_port structures are normal and can just be accessed at any
time without worrying about use-after-free errors.
After a lot of discussion, me and Daniel Vetter came up with a better
idea to replace all of this.
To summarize, since this is documented far more indepth in the
documentation this patch introduces, we make it so that drm_dp_mst_port
and drm_dp_mst_branch structures have two different classes of
refcounts: topology_kref, and malloc_kref. topology_kref corresponds to
the lifetime of the given drm_dp_mst_port or drm_dp_mst_branch in it's
given topology. Once it hits zero, any associated connectors are removed
and the branch or port can no longer be validated. malloc_kref
corresponds to the lifetime of the memory allocation for the actual
structure, and will always be non-zero so long as the topology_kref is
non-zero. This gives us a way to allow callers to hold onto port and
branch device structures past their topology lifetime, and dramatically
simplifies the lifetimes of both structures. This also finally fixes the
port deallocation problem, properly.
Additionally: since this now means that we can keep ports and branch
devices allocated in memory for however long we need, we no longer need
a significant amount of the port validation that we currently do.
Additionally, there is one last scenario that this fixes, which couldn't
have been fixed properly beforehand:
- CPU1 unrefs port from topology (refcount 1->0)
- CPU2 refs port in topology(refcount 0->1)
Since we now can guarantee memory safety for ports and branches
as-needed, we also can make our main reference counting functions fix
this problem by using kref_get_unless_zero() internally so that topology
refcounts can only ever reach 0 once.
Changes since v4:
* Change the kernel-figure summary for dp-mst/topology-figure-1.dot a
bit - danvet
* Remove figure numbers - danvet
Changes since v3:
* Remove rebase detritus - danvet
* Split out purely style changes into separate patches - hwentlan
Changes since v2:
* Fix commit message - checkpatch
* s/)-1/) - 1/g - checkpatch
Changes since v1:
* Remove forward declarations - danvet
* Move "Branch device and port refcounting" section from documentation
into kernel-doc comments - danvet
* Export internal topology lifetime functions into their own section in
the kernel-docs - danvet
* s/@/&/g for struct references in kernel-docs - danvet
* Drop the "when they are no longer being used" bits from the kernel
docs - danvet
* Modify diagrams to show how the DRM driver interacts with the topology
and payloads - danvet
* Make suggested documentation changes for
drm_dp_mst_topology_get_mstb() and drm_dp_mst_topology_get_port() -
danvet
* Better explain the relationship between malloc refs and topology krefs
in the documentation for drm_dp_mst_topology_get_port() and
drm_dp_mst_topology_get_mstb() - danvet
* Fix "See also" in drm_dp_mst_topology_get_mstb() - danvet
* Rename drm_dp_mst_topology_get_(port|mstb)() ->
drm_dp_mst_topology_try_get_(port|mstb)() and
drm_dp_mst_topology_ref_(port|mstb)() ->
drm_dp_mst_topology_get_(port|mstb)() - danvet
* s/should/must in docs - danvet
* WARN_ON(refcount == 0) in topology_get_(mstb|port) - danvet
* Move kdocs for mstb/port structs inline - danvet
* Split drm_dp_get_last_connected_port_and_mstb() changes into their own
commit - danvet
Signed-off-by: Lyude Paul <lyude@redhat.com>
Reviewed-by: Harry Wentland <harry.wentland@amd.com>
Reviewed-by: Daniel Vetter <daniel@ffwll.ch>
Cc: David Airlie <airlied@redhat.com>
Cc: Jerry Zuo <Jerry.Zuo@amd.com>
Cc: Juston Li <juston.li@intel.com>
Link: https://patchwork.freedesktop.org/patch/msgid/20190111005343.17443-7-lyude@redhat.com
2019-01-11 08:53:29 +08:00
|
|
|
/**
|
|
|
|
* @topology_kref: refcount for this port's lifetime in the topology,
|
|
|
|
* only the DP MST helpers should need to touch this
|
|
|
|
*/
|
|
|
|
struct kref topology_kref;
|
|
|
|
|
|
|
|
/**
|
|
|
|
* @malloc_kref: refcount for the memory allocation containing this
|
|
|
|
* structure. See drm_dp_mst_get_port_malloc() and
|
|
|
|
* drm_dp_mst_put_port_malloc().
|
|
|
|
*/
|
|
|
|
struct kref malloc_kref;
|
2014-06-05 12:01:32 +08:00
|
|
|
|
|
|
|
u8 port_num;
|
|
|
|
bool input;
|
|
|
|
bool mcs;
|
|
|
|
bool ddps;
|
|
|
|
u8 pdt;
|
|
|
|
bool ldps;
|
|
|
|
u8 dpcd_rev;
|
|
|
|
u8 num_sdp_streams;
|
|
|
|
u8 num_sdp_stream_sinks;
|
|
|
|
uint16_t available_pbn;
|
|
|
|
struct list_head next;
|
|
|
|
struct drm_dp_mst_branch *mstb; /* pointer to an mstb if this port has one */
|
|
|
|
struct drm_dp_aux aux; /* i2c bus for this port? */
|
|
|
|
struct drm_dp_mst_branch *parent;
|
|
|
|
|
|
|
|
struct drm_dp_vcpi vcpi;
|
|
|
|
struct drm_connector *connector;
|
|
|
|
struct drm_dp_mst_topology_mgr *mgr;
|
2014-10-20 14:28:02 +08:00
|
|
|
|
2016-07-16 03:48:04 +08:00
|
|
|
/**
|
|
|
|
* @cached_edid: for DP logical ports - make tiling work by ensuring
|
|
|
|
* that the EDID for all connectors is read immediately.
|
|
|
|
*/
|
|
|
|
struct edid *cached_edid;
|
|
|
|
/**
|
|
|
|
* @has_audio: Tracks whether the sink connector to this port is
|
|
|
|
* audio-capable.
|
|
|
|
*/
|
2015-12-02 14:09:43 +08:00
|
|
|
bool has_audio;
|
2014-06-05 12:01:32 +08:00
|
|
|
};
|
|
|
|
|
|
|
|
/**
|
|
|
|
* struct drm_dp_mst_branch - MST branch device.
|
|
|
|
* @rad: Relative Address to talk to this branch device.
|
|
|
|
* @lct: Link count total to talk to this branch device.
|
|
|
|
* @num_ports: number of ports on the branch.
|
|
|
|
* @msg_slots: one bit per transmitted msg slot.
|
|
|
|
* @ports: linked list of ports on this branch.
|
|
|
|
* @port_parent: pointer to the port parent, NULL if toplevel.
|
|
|
|
* @mgr: topology manager for this branch device.
|
|
|
|
* @tx_slots: transmission slots for this device.
|
|
|
|
* @last_seqno: last sequence number used to talk to this.
|
|
|
|
* @link_address_sent: if a link address message has been sent to this device yet.
|
2016-01-23 06:07:28 +08:00
|
|
|
* @guid: guid for DP 1.2 branch device. port under this branch can be
|
|
|
|
* identified by port #.
|
2014-06-05 12:01:32 +08:00
|
|
|
*
|
|
|
|
* This structure represents an MST branch device, there is one
|
2016-01-23 06:07:28 +08:00
|
|
|
* primary branch device at the root, along with any other branches connected
|
|
|
|
* to downstream port of parent branches.
|
2014-06-05 12:01:32 +08:00
|
|
|
*/
|
|
|
|
struct drm_dp_mst_branch {
|
drm/dp_mst: Introduce new refcounting scheme for mstbs and ports
The current way of handling refcounting in the DP MST helpers is really
confusing and probably just plain wrong because it's been hacked up many
times over the years without anyone actually going over the code and
seeing if things could be simplified.
To the best of my understanding, the current scheme works like this:
drm_dp_mst_port and drm_dp_mst_branch both have a single refcount. When
this refcount hits 0 for either of the two, they're removed from the
topology state, but not immediately freed. Both ports and branch devices
will reinitialize their kref once it's hit 0 before actually destroying
themselves. The intended purpose behind this is so that we can avoid
problems like not being able to free a remote payload that might still
be active, due to us having removed all of the port/branch device
structures in memory, as per:
commit 91a25e463130 ("drm/dp/mst: deallocate payload on port destruction")
Which may have worked, but then it caused use-after-free errors. Being
new to MST at the time, I tried fixing it;
commit 263efde31f97 ("drm/dp/mst: Get validated port ref in drm_dp_update_payload_part1()")
But, that was broken: both drm_dp_mst_port and drm_dp_mst_branch structs
are validated in almost every DP MST helper function. Simply put, this
means we go through the topology and try to see if the given
drm_dp_mst_branch or drm_dp_mst_port is still attached to something
before trying to use it in order to avoid dereferencing freed memory
(something that has happened a LOT in the past with this library).
Because of this it doesn't actually matter whether or not we keep keep
the ports and branches around in memory as that's not enough, because
any function that validates the branches and ports passed to it will
still reject them anyway since they're no longer in the topology
structure. So, use-after-free errors were fixed but payload deallocation
was completely broken.
Two years later, AMD informed me about this issue and I attempted to
come up with a temporary fix, pending a long-overdue cleanup of this
library:
commit c54c7374ff44 ("drm/dp_mst: Skip validating ports during destruction, just ref")
But then that introduced use-after-free errors, so I quickly reverted
it:
commit 9765635b3075 ("Revert "drm/dp_mst: Skip validating ports during destruction, just ref"")
And in the process, learned that there is just no simple fix for this:
the design is just broken. Unfortunately, the usage of these helpers are
quite broken as well. Some drivers like i915 have been smart enough to
avoid accessing any kind of information from MST port structures, but
others like nouveau have assumed, understandably so, that
drm_dp_mst_port structures are normal and can just be accessed at any
time without worrying about use-after-free errors.
After a lot of discussion, me and Daniel Vetter came up with a better
idea to replace all of this.
To summarize, since this is documented far more indepth in the
documentation this patch introduces, we make it so that drm_dp_mst_port
and drm_dp_mst_branch structures have two different classes of
refcounts: topology_kref, and malloc_kref. topology_kref corresponds to
the lifetime of the given drm_dp_mst_port or drm_dp_mst_branch in it's
given topology. Once it hits zero, any associated connectors are removed
and the branch or port can no longer be validated. malloc_kref
corresponds to the lifetime of the memory allocation for the actual
structure, and will always be non-zero so long as the topology_kref is
non-zero. This gives us a way to allow callers to hold onto port and
branch device structures past their topology lifetime, and dramatically
simplifies the lifetimes of both structures. This also finally fixes the
port deallocation problem, properly.
Additionally: since this now means that we can keep ports and branch
devices allocated in memory for however long we need, we no longer need
a significant amount of the port validation that we currently do.
Additionally, there is one last scenario that this fixes, which couldn't
have been fixed properly beforehand:
- CPU1 unrefs port from topology (refcount 1->0)
- CPU2 refs port in topology(refcount 0->1)
Since we now can guarantee memory safety for ports and branches
as-needed, we also can make our main reference counting functions fix
this problem by using kref_get_unless_zero() internally so that topology
refcounts can only ever reach 0 once.
Changes since v4:
* Change the kernel-figure summary for dp-mst/topology-figure-1.dot a
bit - danvet
* Remove figure numbers - danvet
Changes since v3:
* Remove rebase detritus - danvet
* Split out purely style changes into separate patches - hwentlan
Changes since v2:
* Fix commit message - checkpatch
* s/)-1/) - 1/g - checkpatch
Changes since v1:
* Remove forward declarations - danvet
* Move "Branch device and port refcounting" section from documentation
into kernel-doc comments - danvet
* Export internal topology lifetime functions into their own section in
the kernel-docs - danvet
* s/@/&/g for struct references in kernel-docs - danvet
* Drop the "when they are no longer being used" bits from the kernel
docs - danvet
* Modify diagrams to show how the DRM driver interacts with the topology
and payloads - danvet
* Make suggested documentation changes for
drm_dp_mst_topology_get_mstb() and drm_dp_mst_topology_get_port() -
danvet
* Better explain the relationship between malloc refs and topology krefs
in the documentation for drm_dp_mst_topology_get_port() and
drm_dp_mst_topology_get_mstb() - danvet
* Fix "See also" in drm_dp_mst_topology_get_mstb() - danvet
* Rename drm_dp_mst_topology_get_(port|mstb)() ->
drm_dp_mst_topology_try_get_(port|mstb)() and
drm_dp_mst_topology_ref_(port|mstb)() ->
drm_dp_mst_topology_get_(port|mstb)() - danvet
* s/should/must in docs - danvet
* WARN_ON(refcount == 0) in topology_get_(mstb|port) - danvet
* Move kdocs for mstb/port structs inline - danvet
* Split drm_dp_get_last_connected_port_and_mstb() changes into their own
commit - danvet
Signed-off-by: Lyude Paul <lyude@redhat.com>
Reviewed-by: Harry Wentland <harry.wentland@amd.com>
Reviewed-by: Daniel Vetter <daniel@ffwll.ch>
Cc: David Airlie <airlied@redhat.com>
Cc: Jerry Zuo <Jerry.Zuo@amd.com>
Cc: Juston Li <juston.li@intel.com>
Link: https://patchwork.freedesktop.org/patch/msgid/20190111005343.17443-7-lyude@redhat.com
2019-01-11 08:53:29 +08:00
|
|
|
/**
|
|
|
|
* @topology_kref: refcount for this branch device's lifetime in the
|
|
|
|
* topology, only the DP MST helpers should need to touch this
|
|
|
|
*/
|
|
|
|
struct kref topology_kref;
|
|
|
|
|
|
|
|
/**
|
|
|
|
* @malloc_kref: refcount for the memory allocation containing this
|
|
|
|
* structure. See drm_dp_mst_get_mstb_malloc() and
|
|
|
|
* drm_dp_mst_put_mstb_malloc().
|
|
|
|
*/
|
|
|
|
struct kref malloc_kref;
|
|
|
|
|
2014-06-05 12:01:32 +08:00
|
|
|
u8 rad[8];
|
|
|
|
u8 lct;
|
|
|
|
int num_ports;
|
|
|
|
|
|
|
|
int msg_slots;
|
|
|
|
struct list_head ports;
|
|
|
|
|
|
|
|
/* list of tx ops queue for this port */
|
|
|
|
struct drm_dp_mst_port *port_parent;
|
|
|
|
struct drm_dp_mst_topology_mgr *mgr;
|
|
|
|
|
|
|
|
/* slots are protected by mstb->mgr->qlock */
|
|
|
|
struct drm_dp_sideband_msg_tx *tx_slots[2];
|
|
|
|
int last_seqno;
|
|
|
|
bool link_address_sent;
|
2016-01-23 06:07:28 +08:00
|
|
|
|
|
|
|
/* global unique identifier to identify branch devices */
|
|
|
|
u8 guid[16];
|
2014-06-05 12:01:32 +08:00
|
|
|
};
|
|
|
|
|
|
|
|
|
|
|
|
/* sideband msg header - not bit struct */
|
|
|
|
struct drm_dp_sideband_msg_hdr {
|
|
|
|
u8 lct;
|
|
|
|
u8 lcr;
|
|
|
|
u8 rad[8];
|
|
|
|
bool broadcast;
|
|
|
|
bool path_msg;
|
|
|
|
u8 msg_len;
|
|
|
|
bool somt;
|
|
|
|
bool eomt;
|
|
|
|
bool seqno;
|
|
|
|
};
|
|
|
|
|
|
|
|
struct drm_dp_nak_reply {
|
|
|
|
u8 guid[16];
|
|
|
|
u8 reason;
|
|
|
|
u8 nak_data;
|
|
|
|
};
|
|
|
|
|
|
|
|
struct drm_dp_link_address_ack_reply {
|
|
|
|
u8 guid[16];
|
|
|
|
u8 nports;
|
|
|
|
struct drm_dp_link_addr_reply_port {
|
|
|
|
bool input_port;
|
|
|
|
u8 peer_device_type;
|
|
|
|
u8 port_number;
|
|
|
|
bool mcs;
|
|
|
|
bool ddps;
|
|
|
|
bool legacy_device_plug_status;
|
|
|
|
u8 dpcd_revision;
|
|
|
|
u8 peer_guid[16];
|
|
|
|
u8 num_sdp_streams;
|
|
|
|
u8 num_sdp_stream_sinks;
|
|
|
|
} ports[16];
|
|
|
|
};
|
|
|
|
|
|
|
|
struct drm_dp_remote_dpcd_read_ack_reply {
|
|
|
|
u8 port_number;
|
|
|
|
u8 num_bytes;
|
|
|
|
u8 bytes[255];
|
|
|
|
};
|
|
|
|
|
|
|
|
struct drm_dp_remote_dpcd_write_ack_reply {
|
|
|
|
u8 port_number;
|
|
|
|
};
|
|
|
|
|
|
|
|
struct drm_dp_remote_dpcd_write_nak_reply {
|
|
|
|
u8 port_number;
|
|
|
|
u8 reason;
|
|
|
|
u8 bytes_written_before_failure;
|
|
|
|
};
|
|
|
|
|
|
|
|
struct drm_dp_remote_i2c_read_ack_reply {
|
|
|
|
u8 port_number;
|
|
|
|
u8 num_bytes;
|
|
|
|
u8 bytes[255];
|
|
|
|
};
|
|
|
|
|
|
|
|
struct drm_dp_remote_i2c_read_nak_reply {
|
|
|
|
u8 port_number;
|
|
|
|
u8 nak_reason;
|
|
|
|
u8 i2c_nak_transaction;
|
|
|
|
};
|
|
|
|
|
|
|
|
struct drm_dp_remote_i2c_write_ack_reply {
|
|
|
|
u8 port_number;
|
|
|
|
};
|
|
|
|
|
|
|
|
|
|
|
|
struct drm_dp_sideband_msg_rx {
|
|
|
|
u8 chunk[48];
|
|
|
|
u8 msg[256];
|
|
|
|
u8 curchunk_len;
|
|
|
|
u8 curchunk_idx; /* chunk we are parsing now */
|
|
|
|
u8 curchunk_hdrlen;
|
|
|
|
u8 curlen; /* total length of the msg */
|
|
|
|
bool have_somt;
|
|
|
|
bool have_eomt;
|
|
|
|
struct drm_dp_sideband_msg_hdr initial_hdr;
|
|
|
|
};
|
|
|
|
|
2015-12-02 14:09:43 +08:00
|
|
|
#define DRM_DP_MAX_SDP_STREAMS 16
|
2014-06-05 12:01:32 +08:00
|
|
|
struct drm_dp_allocate_payload {
|
|
|
|
u8 port_number;
|
|
|
|
u8 number_sdp_streams;
|
|
|
|
u8 vcpi;
|
|
|
|
u16 pbn;
|
2015-12-02 14:09:43 +08:00
|
|
|
u8 sdp_stream_sink[DRM_DP_MAX_SDP_STREAMS];
|
2014-06-05 12:01:32 +08:00
|
|
|
};
|
|
|
|
|
|
|
|
struct drm_dp_allocate_payload_ack_reply {
|
|
|
|
u8 port_number;
|
|
|
|
u8 vcpi;
|
|
|
|
u16 allocated_pbn;
|
|
|
|
};
|
|
|
|
|
|
|
|
struct drm_dp_connection_status_notify {
|
|
|
|
u8 guid[16];
|
|
|
|
u8 port_number;
|
|
|
|
bool legacy_device_plug_status;
|
|
|
|
bool displayport_device_plug_status;
|
|
|
|
bool message_capability_status;
|
|
|
|
bool input_port;
|
|
|
|
u8 peer_device_type;
|
|
|
|
};
|
|
|
|
|
|
|
|
struct drm_dp_remote_dpcd_read {
|
|
|
|
u8 port_number;
|
|
|
|
u32 dpcd_address;
|
|
|
|
u8 num_bytes;
|
|
|
|
};
|
|
|
|
|
|
|
|
struct drm_dp_remote_dpcd_write {
|
|
|
|
u8 port_number;
|
|
|
|
u32 dpcd_address;
|
|
|
|
u8 num_bytes;
|
|
|
|
u8 *bytes;
|
|
|
|
};
|
|
|
|
|
2015-10-14 16:51:17 +08:00
|
|
|
#define DP_REMOTE_I2C_READ_MAX_TRANSACTIONS 4
|
2014-06-05 12:01:32 +08:00
|
|
|
struct drm_dp_remote_i2c_read {
|
|
|
|
u8 num_transactions;
|
|
|
|
u8 port_number;
|
|
|
|
struct {
|
|
|
|
u8 i2c_dev_id;
|
|
|
|
u8 num_bytes;
|
|
|
|
u8 *bytes;
|
|
|
|
u8 no_stop_bit;
|
|
|
|
u8 i2c_transaction_delay;
|
2015-10-14 16:51:17 +08:00
|
|
|
} transactions[DP_REMOTE_I2C_READ_MAX_TRANSACTIONS];
|
2014-06-05 12:01:32 +08:00
|
|
|
u8 read_i2c_device_id;
|
|
|
|
u8 num_bytes_read;
|
|
|
|
};
|
|
|
|
|
|
|
|
struct drm_dp_remote_i2c_write {
|
|
|
|
u8 port_number;
|
|
|
|
u8 write_i2c_device_id;
|
|
|
|
u8 num_bytes;
|
|
|
|
u8 *bytes;
|
|
|
|
};
|
|
|
|
|
|
|
|
/* this covers ENUM_RESOURCES, POWER_DOWN_PHY, POWER_UP_PHY */
|
|
|
|
struct drm_dp_port_number_req {
|
|
|
|
u8 port_number;
|
|
|
|
};
|
|
|
|
|
|
|
|
struct drm_dp_enum_path_resources_ack_reply {
|
|
|
|
u8 port_number;
|
|
|
|
u16 full_payload_bw_number;
|
|
|
|
u16 avail_payload_bw_number;
|
|
|
|
};
|
|
|
|
|
|
|
|
/* covers POWER_DOWN_PHY, POWER_UP_PHY */
|
|
|
|
struct drm_dp_port_number_rep {
|
|
|
|
u8 port_number;
|
|
|
|
};
|
|
|
|
|
|
|
|
struct drm_dp_query_payload {
|
|
|
|
u8 port_number;
|
|
|
|
u8 vcpi;
|
|
|
|
};
|
|
|
|
|
|
|
|
struct drm_dp_resource_status_notify {
|
|
|
|
u8 port_number;
|
|
|
|
u8 guid[16];
|
|
|
|
u16 available_pbn;
|
|
|
|
};
|
|
|
|
|
|
|
|
struct drm_dp_query_payload_ack_reply {
|
|
|
|
u8 port_number;
|
|
|
|
u8 allocated_pbn;
|
|
|
|
};
|
|
|
|
|
|
|
|
struct drm_dp_sideband_msg_req_body {
|
|
|
|
u8 req_type;
|
|
|
|
union ack_req {
|
|
|
|
struct drm_dp_connection_status_notify conn_stat;
|
|
|
|
struct drm_dp_port_number_req port_num;
|
|
|
|
struct drm_dp_resource_status_notify resource_stat;
|
|
|
|
|
|
|
|
struct drm_dp_query_payload query_payload;
|
|
|
|
struct drm_dp_allocate_payload allocate_payload;
|
|
|
|
|
|
|
|
struct drm_dp_remote_dpcd_read dpcd_read;
|
|
|
|
struct drm_dp_remote_dpcd_write dpcd_write;
|
|
|
|
|
|
|
|
struct drm_dp_remote_i2c_read i2c_read;
|
|
|
|
struct drm_dp_remote_i2c_write i2c_write;
|
|
|
|
} u;
|
|
|
|
};
|
|
|
|
|
|
|
|
struct drm_dp_sideband_msg_reply_body {
|
|
|
|
u8 reply_type;
|
|
|
|
u8 req_type;
|
|
|
|
union ack_replies {
|
|
|
|
struct drm_dp_nak_reply nak;
|
|
|
|
struct drm_dp_link_address_ack_reply link_addr;
|
|
|
|
struct drm_dp_port_number_rep port_number;
|
|
|
|
|
|
|
|
struct drm_dp_enum_path_resources_ack_reply path_resources;
|
|
|
|
struct drm_dp_allocate_payload_ack_reply allocate_payload;
|
|
|
|
struct drm_dp_query_payload_ack_reply query_payload;
|
|
|
|
|
|
|
|
struct drm_dp_remote_dpcd_read_ack_reply remote_dpcd_read_ack;
|
|
|
|
struct drm_dp_remote_dpcd_write_ack_reply remote_dpcd_write_ack;
|
|
|
|
struct drm_dp_remote_dpcd_write_nak_reply remote_dpcd_write_nack;
|
|
|
|
|
|
|
|
struct drm_dp_remote_i2c_read_ack_reply remote_i2c_read_ack;
|
|
|
|
struct drm_dp_remote_i2c_read_nak_reply remote_i2c_read_nack;
|
|
|
|
struct drm_dp_remote_i2c_write_ack_reply remote_i2c_write_ack;
|
|
|
|
} u;
|
|
|
|
};
|
|
|
|
|
|
|
|
/* msg is queued to be put into a slot */
|
|
|
|
#define DRM_DP_SIDEBAND_TX_QUEUED 0
|
|
|
|
/* msg has started transmitting on a slot - still on msgq */
|
|
|
|
#define DRM_DP_SIDEBAND_TX_START_SEND 1
|
|
|
|
/* msg has finished transmitting on a slot - removed from msgq only in slot */
|
|
|
|
#define DRM_DP_SIDEBAND_TX_SENT 2
|
|
|
|
/* msg has received a response - removed from slot */
|
|
|
|
#define DRM_DP_SIDEBAND_TX_RX 3
|
|
|
|
#define DRM_DP_SIDEBAND_TX_TIMEOUT 4
|
|
|
|
|
|
|
|
struct drm_dp_sideband_msg_tx {
|
|
|
|
u8 msg[256];
|
|
|
|
u8 chunk[48];
|
|
|
|
u8 cur_offset;
|
|
|
|
u8 cur_len;
|
|
|
|
struct drm_dp_mst_branch *dst;
|
|
|
|
struct list_head next;
|
|
|
|
int seqno;
|
|
|
|
int state;
|
|
|
|
bool path_msg;
|
|
|
|
struct drm_dp_sideband_msg_reply_body reply;
|
|
|
|
};
|
|
|
|
|
|
|
|
/* sideband msg handler */
|
|
|
|
struct drm_dp_mst_topology_mgr;
|
|
|
|
struct drm_dp_mst_topology_cbs {
|
|
|
|
/* create a connector for a port */
|
2014-05-13 17:38:36 +08:00
|
|
|
struct drm_connector *(*add_connector)(struct drm_dp_mst_topology_mgr *mgr, struct drm_dp_mst_port *port, const char *path);
|
2015-09-16 15:55:23 +08:00
|
|
|
void (*register_connector)(struct drm_connector *connector);
|
2014-06-05 12:01:32 +08:00
|
|
|
void (*destroy_connector)(struct drm_dp_mst_topology_mgr *mgr,
|
|
|
|
struct drm_connector *connector);
|
|
|
|
};
|
|
|
|
|
|
|
|
#define DP_MAX_PAYLOAD (sizeof(unsigned long) * 8)
|
|
|
|
|
|
|
|
#define DP_PAYLOAD_LOCAL 1
|
|
|
|
#define DP_PAYLOAD_REMOTE 2
|
|
|
|
#define DP_PAYLOAD_DELETE_LOCAL 3
|
|
|
|
|
|
|
|
struct drm_dp_payload {
|
|
|
|
int payload_state;
|
|
|
|
int start_slot;
|
|
|
|
int num_slots;
|
2014-08-06 14:26:21 +08:00
|
|
|
int vcpi;
|
2014-06-05 12:01:32 +08:00
|
|
|
};
|
|
|
|
|
2017-07-12 23:51:02 +08:00
|
|
|
#define to_dp_mst_topology_state(x) container_of(x, struct drm_dp_mst_topology_state, base)
|
|
|
|
|
2017-04-21 13:51:31 +08:00
|
|
|
struct drm_dp_mst_topology_state {
|
2017-07-12 23:51:02 +08:00
|
|
|
struct drm_private_state base;
|
2017-04-21 13:51:31 +08:00
|
|
|
int avail_slots;
|
|
|
|
struct drm_dp_mst_topology_mgr *mgr;
|
|
|
|
};
|
|
|
|
|
2017-07-12 23:51:02 +08:00
|
|
|
#define to_dp_mst_topology_mgr(x) container_of(x, struct drm_dp_mst_topology_mgr, base)
|
|
|
|
|
2014-06-05 12:01:32 +08:00
|
|
|
/**
|
|
|
|
* struct drm_dp_mst_topology_mgr - DisplayPort MST manager
|
|
|
|
*
|
|
|
|
* This struct represents the toplevel displayport MST topology manager.
|
|
|
|
* There should be one instance of this for every MST capable DP connector
|
|
|
|
* on the GPU.
|
|
|
|
*/
|
|
|
|
struct drm_dp_mst_topology_mgr {
|
2017-07-12 23:51:02 +08:00
|
|
|
/**
|
|
|
|
* @base: Base private object for atomic
|
|
|
|
*/
|
|
|
|
struct drm_private_obj base;
|
|
|
|
|
2016-07-16 03:48:04 +08:00
|
|
|
/**
|
|
|
|
* @dev: device pointer for adding i2c devices etc.
|
|
|
|
*/
|
2017-01-25 07:49:29 +08:00
|
|
|
struct drm_device *dev;
|
2016-07-16 03:48:04 +08:00
|
|
|
/**
|
|
|
|
* @cbs: callbacks for connector addition and destruction.
|
|
|
|
*/
|
2015-12-31 05:20:30 +08:00
|
|
|
const struct drm_dp_mst_topology_cbs *cbs;
|
2016-07-16 03:48:04 +08:00
|
|
|
/**
|
|
|
|
* @max_dpcd_transaction_bytes: maximum number of bytes to read/write
|
|
|
|
* in one go.
|
|
|
|
*/
|
2014-06-05 12:01:32 +08:00
|
|
|
int max_dpcd_transaction_bytes;
|
2016-07-16 03:48:04 +08:00
|
|
|
/**
|
|
|
|
* @aux: AUX channel for the DP MST connector this topolgy mgr is
|
|
|
|
* controlling.
|
|
|
|
*/
|
|
|
|
struct drm_dp_aux *aux;
|
|
|
|
/**
|
|
|
|
* @max_payloads: maximum number of payloads the GPU can generate.
|
|
|
|
*/
|
2014-06-05 12:01:32 +08:00
|
|
|
int max_payloads;
|
2016-07-16 03:48:04 +08:00
|
|
|
/**
|
|
|
|
* @conn_base_id: DRM connector ID this mgr is connected to. Only used
|
|
|
|
* to build the MST connector path value.
|
|
|
|
*/
|
2014-06-05 12:01:32 +08:00
|
|
|
int conn_base_id;
|
|
|
|
|
2016-07-16 03:48:04 +08:00
|
|
|
/**
|
|
|
|
* @down_rep_recv: Message receiver state for down replies. This and
|
|
|
|
* @up_req_recv are only ever access from the work item, which is
|
|
|
|
* serialised.
|
|
|
|
*/
|
2014-06-05 12:01:32 +08:00
|
|
|
struct drm_dp_sideband_msg_rx down_rep_recv;
|
2016-07-16 03:48:04 +08:00
|
|
|
/**
|
|
|
|
* @up_req_recv: Message receiver state for up requests. This and
|
|
|
|
* @down_rep_recv are only ever access from the work item, which is
|
|
|
|
* serialised.
|
|
|
|
*/
|
2014-06-05 12:01:32 +08:00
|
|
|
struct drm_dp_sideband_msg_rx up_req_recv;
|
|
|
|
|
2016-07-16 03:48:04 +08:00
|
|
|
/**
|
|
|
|
* @lock: protects mst state, primary, dpcd.
|
|
|
|
*/
|
|
|
|
struct mutex lock;
|
2014-06-05 12:01:32 +08:00
|
|
|
|
2016-07-16 03:48:04 +08:00
|
|
|
/**
|
|
|
|
* @mst_state: If this manager is enabled for an MST capable port. False
|
|
|
|
* if no MST sink/branch devices is connected.
|
|
|
|
*/
|
2014-06-05 12:01:32 +08:00
|
|
|
bool mst_state;
|
2016-07-16 03:48:04 +08:00
|
|
|
/**
|
|
|
|
* @mst_primary: Pointer to the primary/first branch device.
|
|
|
|
*/
|
2014-06-05 12:01:32 +08:00
|
|
|
struct drm_dp_mst_branch *mst_primary;
|
2016-01-23 06:07:28 +08:00
|
|
|
|
2016-07-16 03:48:04 +08:00
|
|
|
/**
|
|
|
|
* @dpcd: Cache of DPCD for primary port.
|
|
|
|
*/
|
2014-06-05 12:01:32 +08:00
|
|
|
u8 dpcd[DP_RECEIVER_CAP_SIZE];
|
2016-07-16 03:48:04 +08:00
|
|
|
/**
|
|
|
|
* @sink_count: Sink count from DEVICE_SERVICE_IRQ_VECTOR_ESI0.
|
|
|
|
*/
|
2014-06-05 12:01:32 +08:00
|
|
|
u8 sink_count;
|
2016-07-16 03:48:04 +08:00
|
|
|
/**
|
|
|
|
* @pbn_div: PBN to slots divisor.
|
|
|
|
*/
|
2014-06-05 12:01:32 +08:00
|
|
|
int pbn_div;
|
2017-03-16 15:10:24 +08:00
|
|
|
|
2017-04-21 13:51:31 +08:00
|
|
|
/**
|
|
|
|
* @funcs: Atomic helper callbacks
|
|
|
|
*/
|
|
|
|
const struct drm_private_state_funcs *funcs;
|
|
|
|
|
2016-07-16 03:48:04 +08:00
|
|
|
/**
|
2017-01-25 14:26:43 +08:00
|
|
|
* @qlock: protects @tx_msg_downq, the &drm_dp_mst_branch.txslost and
|
|
|
|
* &drm_dp_sideband_msg_tx.state once they are queued
|
2016-07-16 03:48:04 +08:00
|
|
|
*/
|
2014-06-05 12:01:32 +08:00
|
|
|
struct mutex qlock;
|
2016-07-16 03:48:04 +08:00
|
|
|
/**
|
|
|
|
* @tx_msg_downq: List of pending down replies.
|
|
|
|
*/
|
2014-06-05 12:01:32 +08:00
|
|
|
struct list_head tx_msg_downq;
|
|
|
|
|
2016-07-16 03:48:04 +08:00
|
|
|
/**
|
|
|
|
* @payload_lock: Protect payload information.
|
|
|
|
*/
|
2014-06-05 12:01:32 +08:00
|
|
|
struct mutex payload_lock;
|
2016-07-16 03:48:04 +08:00
|
|
|
/**
|
|
|
|
* @proposed_vcpis: Array of pointers for the new VCPI allocation. The
|
2017-01-25 14:26:43 +08:00
|
|
|
* VCPI structure itself is &drm_dp_mst_port.vcpi.
|
2016-07-16 03:48:04 +08:00
|
|
|
*/
|
2014-06-05 12:01:32 +08:00
|
|
|
struct drm_dp_vcpi **proposed_vcpis;
|
2016-07-16 03:48:04 +08:00
|
|
|
/**
|
|
|
|
* @payloads: Array of payloads.
|
|
|
|
*/
|
2014-06-05 12:01:32 +08:00
|
|
|
struct drm_dp_payload *payloads;
|
2016-07-16 03:48:04 +08:00
|
|
|
/**
|
|
|
|
* @payload_mask: Elements of @payloads actually in use. Since
|
|
|
|
* reallocation of active outputs isn't possible gaps can be created by
|
|
|
|
* disabling outputs out of order compared to how they've been enabled.
|
|
|
|
*/
|
2014-06-05 12:01:32 +08:00
|
|
|
unsigned long payload_mask;
|
2016-07-16 03:48:04 +08:00
|
|
|
/**
|
|
|
|
* @vcpi_mask: Similar to @payload_mask, but for @proposed_vcpis.
|
|
|
|
*/
|
2014-08-06 14:26:21 +08:00
|
|
|
unsigned long vcpi_mask;
|
2014-06-05 12:01:32 +08:00
|
|
|
|
2016-07-16 03:48:04 +08:00
|
|
|
/**
|
|
|
|
* @tx_waitq: Wait to queue stall for the tx worker.
|
|
|
|
*/
|
2014-06-05 12:01:32 +08:00
|
|
|
wait_queue_head_t tx_waitq;
|
2016-07-16 03:48:04 +08:00
|
|
|
/**
|
|
|
|
* @work: Probe work.
|
|
|
|
*/
|
2014-06-05 12:01:32 +08:00
|
|
|
struct work_struct work;
|
2016-07-16 03:48:04 +08:00
|
|
|
/**
|
|
|
|
* @tx_work: Sideband transmit worker. This can nest within the main
|
|
|
|
* @work worker for each transaction @work launches.
|
|
|
|
*/
|
2014-06-05 12:01:32 +08:00
|
|
|
struct work_struct tx_work;
|
2015-06-15 08:34:28 +08:00
|
|
|
|
2016-07-16 03:48:04 +08:00
|
|
|
/**
|
|
|
|
* @destroy_connector_list: List of to be destroyed connectors.
|
|
|
|
*/
|
2015-06-15 08:34:28 +08:00
|
|
|
struct list_head destroy_connector_list;
|
2016-07-16 03:48:04 +08:00
|
|
|
/**
|
|
|
|
* @destroy_connector_lock: Protects @connector_list.
|
|
|
|
*/
|
2015-06-15 08:34:28 +08:00
|
|
|
struct mutex destroy_connector_lock;
|
2016-07-16 03:48:04 +08:00
|
|
|
/**
|
|
|
|
* @destroy_connector_work: Work item to destroy connectors. Needed to
|
|
|
|
* avoid locking inversion.
|
|
|
|
*/
|
2015-06-15 08:34:28 +08:00
|
|
|
struct work_struct destroy_connector_work;
|
2014-06-05 12:01:32 +08:00
|
|
|
};
|
|
|
|
|
2017-01-25 07:49:29 +08:00
|
|
|
int drm_dp_mst_topology_mgr_init(struct drm_dp_mst_topology_mgr *mgr,
|
|
|
|
struct drm_device *dev, struct drm_dp_aux *aux,
|
|
|
|
int max_dpcd_transaction_bytes,
|
|
|
|
int max_payloads, int conn_base_id);
|
2014-06-05 12:01:32 +08:00
|
|
|
|
|
|
|
void drm_dp_mst_topology_mgr_destroy(struct drm_dp_mst_topology_mgr *mgr);
|
|
|
|
|
|
|
|
|
|
|
|
int drm_dp_mst_topology_mgr_set_mst(struct drm_dp_mst_topology_mgr *mgr, bool mst_state);
|
|
|
|
|
|
|
|
|
|
|
|
int drm_dp_mst_hpd_irq(struct drm_dp_mst_topology_mgr *mgr, u8 *esi, bool *handled);
|
|
|
|
|
|
|
|
|
2014-10-20 14:28:02 +08:00
|
|
|
enum drm_connector_status drm_dp_mst_detect_port(struct drm_connector *connector, struct drm_dp_mst_topology_mgr *mgr, struct drm_dp_mst_port *port);
|
2014-06-05 12:01:32 +08:00
|
|
|
|
2015-12-02 14:09:43 +08:00
|
|
|
bool drm_dp_mst_port_has_audio(struct drm_dp_mst_topology_mgr *mgr,
|
|
|
|
struct drm_dp_mst_port *port);
|
2014-06-05 12:01:32 +08:00
|
|
|
struct edid *drm_dp_mst_get_edid(struct drm_connector *connector, struct drm_dp_mst_topology_mgr *mgr, struct drm_dp_mst_port *port);
|
|
|
|
|
|
|
|
|
|
|
|
int drm_dp_calc_pbn_mode(int clock, int bpp);
|
|
|
|
|
|
|
|
|
2017-03-16 15:10:26 +08:00
|
|
|
bool drm_dp_mst_allocate_vcpi(struct drm_dp_mst_topology_mgr *mgr,
|
|
|
|
struct drm_dp_mst_port *port, int pbn, int slots);
|
2014-06-05 12:01:32 +08:00
|
|
|
|
2015-02-24 07:23:55 +08:00
|
|
|
int drm_dp_mst_get_vcpi_slots(struct drm_dp_mst_topology_mgr *mgr, struct drm_dp_mst_port *port);
|
|
|
|
|
2014-06-05 12:01:32 +08:00
|
|
|
|
|
|
|
void drm_dp_mst_reset_vcpi_slots(struct drm_dp_mst_topology_mgr *mgr, struct drm_dp_mst_port *port);
|
|
|
|
|
|
|
|
|
|
|
|
void drm_dp_mst_deallocate_vcpi(struct drm_dp_mst_topology_mgr *mgr,
|
|
|
|
struct drm_dp_mst_port *port);
|
|
|
|
|
|
|
|
|
|
|
|
int drm_dp_find_vcpi_slots(struct drm_dp_mst_topology_mgr *mgr,
|
|
|
|
int pbn);
|
|
|
|
|
|
|
|
|
|
|
|
int drm_dp_update_payload_part1(struct drm_dp_mst_topology_mgr *mgr);
|
|
|
|
|
|
|
|
|
|
|
|
int drm_dp_update_payload_part2(struct drm_dp_mst_topology_mgr *mgr);
|
|
|
|
|
|
|
|
int drm_dp_check_act_status(struct drm_dp_mst_topology_mgr *mgr);
|
|
|
|
|
|
|
|
void drm_dp_mst_dump_topology(struct seq_file *m,
|
|
|
|
struct drm_dp_mst_topology_mgr *mgr);
|
|
|
|
|
|
|
|
void drm_dp_mst_topology_mgr_suspend(struct drm_dp_mst_topology_mgr *mgr);
|
|
|
|
int drm_dp_mst_topology_mgr_resume(struct drm_dp_mst_topology_mgr *mgr);
|
2017-04-21 13:51:31 +08:00
|
|
|
struct drm_dp_mst_topology_state *drm_atomic_get_mst_topology_state(struct drm_atomic_state *state,
|
|
|
|
struct drm_dp_mst_topology_mgr *mgr);
|
2017-04-21 13:51:32 +08:00
|
|
|
int drm_dp_atomic_find_vcpi_slots(struct drm_atomic_state *state,
|
|
|
|
struct drm_dp_mst_topology_mgr *mgr,
|
|
|
|
struct drm_dp_mst_port *port, int pbn);
|
|
|
|
int drm_dp_atomic_release_vcpi_slots(struct drm_atomic_state *state,
|
|
|
|
struct drm_dp_mst_topology_mgr *mgr,
|
|
|
|
int slots);
|
2017-09-07 08:14:58 +08:00
|
|
|
int drm_dp_send_power_updown_phy(struct drm_dp_mst_topology_mgr *mgr,
|
|
|
|
struct drm_dp_mst_port *port, bool power_up);
|
2017-04-21 13:51:31 +08:00
|
|
|
|
drm/dp_mst: Introduce new refcounting scheme for mstbs and ports
The current way of handling refcounting in the DP MST helpers is really
confusing and probably just plain wrong because it's been hacked up many
times over the years without anyone actually going over the code and
seeing if things could be simplified.
To the best of my understanding, the current scheme works like this:
drm_dp_mst_port and drm_dp_mst_branch both have a single refcount. When
this refcount hits 0 for either of the two, they're removed from the
topology state, but not immediately freed. Both ports and branch devices
will reinitialize their kref once it's hit 0 before actually destroying
themselves. The intended purpose behind this is so that we can avoid
problems like not being able to free a remote payload that might still
be active, due to us having removed all of the port/branch device
structures in memory, as per:
commit 91a25e463130 ("drm/dp/mst: deallocate payload on port destruction")
Which may have worked, but then it caused use-after-free errors. Being
new to MST at the time, I tried fixing it;
commit 263efde31f97 ("drm/dp/mst: Get validated port ref in drm_dp_update_payload_part1()")
But, that was broken: both drm_dp_mst_port and drm_dp_mst_branch structs
are validated in almost every DP MST helper function. Simply put, this
means we go through the topology and try to see if the given
drm_dp_mst_branch or drm_dp_mst_port is still attached to something
before trying to use it in order to avoid dereferencing freed memory
(something that has happened a LOT in the past with this library).
Because of this it doesn't actually matter whether or not we keep keep
the ports and branches around in memory as that's not enough, because
any function that validates the branches and ports passed to it will
still reject them anyway since they're no longer in the topology
structure. So, use-after-free errors were fixed but payload deallocation
was completely broken.
Two years later, AMD informed me about this issue and I attempted to
come up with a temporary fix, pending a long-overdue cleanup of this
library:
commit c54c7374ff44 ("drm/dp_mst: Skip validating ports during destruction, just ref")
But then that introduced use-after-free errors, so I quickly reverted
it:
commit 9765635b3075 ("Revert "drm/dp_mst: Skip validating ports during destruction, just ref"")
And in the process, learned that there is just no simple fix for this:
the design is just broken. Unfortunately, the usage of these helpers are
quite broken as well. Some drivers like i915 have been smart enough to
avoid accessing any kind of information from MST port structures, but
others like nouveau have assumed, understandably so, that
drm_dp_mst_port structures are normal and can just be accessed at any
time without worrying about use-after-free errors.
After a lot of discussion, me and Daniel Vetter came up with a better
idea to replace all of this.
To summarize, since this is documented far more indepth in the
documentation this patch introduces, we make it so that drm_dp_mst_port
and drm_dp_mst_branch structures have two different classes of
refcounts: topology_kref, and malloc_kref. topology_kref corresponds to
the lifetime of the given drm_dp_mst_port or drm_dp_mst_branch in it's
given topology. Once it hits zero, any associated connectors are removed
and the branch or port can no longer be validated. malloc_kref
corresponds to the lifetime of the memory allocation for the actual
structure, and will always be non-zero so long as the topology_kref is
non-zero. This gives us a way to allow callers to hold onto port and
branch device structures past their topology lifetime, and dramatically
simplifies the lifetimes of both structures. This also finally fixes the
port deallocation problem, properly.
Additionally: since this now means that we can keep ports and branch
devices allocated in memory for however long we need, we no longer need
a significant amount of the port validation that we currently do.
Additionally, there is one last scenario that this fixes, which couldn't
have been fixed properly beforehand:
- CPU1 unrefs port from topology (refcount 1->0)
- CPU2 refs port in topology(refcount 0->1)
Since we now can guarantee memory safety for ports and branches
as-needed, we also can make our main reference counting functions fix
this problem by using kref_get_unless_zero() internally so that topology
refcounts can only ever reach 0 once.
Changes since v4:
* Change the kernel-figure summary for dp-mst/topology-figure-1.dot a
bit - danvet
* Remove figure numbers - danvet
Changes since v3:
* Remove rebase detritus - danvet
* Split out purely style changes into separate patches - hwentlan
Changes since v2:
* Fix commit message - checkpatch
* s/)-1/) - 1/g - checkpatch
Changes since v1:
* Remove forward declarations - danvet
* Move "Branch device and port refcounting" section from documentation
into kernel-doc comments - danvet
* Export internal topology lifetime functions into their own section in
the kernel-docs - danvet
* s/@/&/g for struct references in kernel-docs - danvet
* Drop the "when they are no longer being used" bits from the kernel
docs - danvet
* Modify diagrams to show how the DRM driver interacts with the topology
and payloads - danvet
* Make suggested documentation changes for
drm_dp_mst_topology_get_mstb() and drm_dp_mst_topology_get_port() -
danvet
* Better explain the relationship between malloc refs and topology krefs
in the documentation for drm_dp_mst_topology_get_port() and
drm_dp_mst_topology_get_mstb() - danvet
* Fix "See also" in drm_dp_mst_topology_get_mstb() - danvet
* Rename drm_dp_mst_topology_get_(port|mstb)() ->
drm_dp_mst_topology_try_get_(port|mstb)() and
drm_dp_mst_topology_ref_(port|mstb)() ->
drm_dp_mst_topology_get_(port|mstb)() - danvet
* s/should/must in docs - danvet
* WARN_ON(refcount == 0) in topology_get_(mstb|port) - danvet
* Move kdocs for mstb/port structs inline - danvet
* Split drm_dp_get_last_connected_port_and_mstb() changes into their own
commit - danvet
Signed-off-by: Lyude Paul <lyude@redhat.com>
Reviewed-by: Harry Wentland <harry.wentland@amd.com>
Reviewed-by: Daniel Vetter <daniel@ffwll.ch>
Cc: David Airlie <airlied@redhat.com>
Cc: Jerry Zuo <Jerry.Zuo@amd.com>
Cc: Juston Li <juston.li@intel.com>
Link: https://patchwork.freedesktop.org/patch/msgid/20190111005343.17443-7-lyude@redhat.com
2019-01-11 08:53:29 +08:00
|
|
|
void drm_dp_mst_get_port_malloc(struct drm_dp_mst_port *port);
|
|
|
|
void drm_dp_mst_put_port_malloc(struct drm_dp_mst_port *port);
|
|
|
|
|
2014-06-05 12:01:32 +08:00
|
|
|
#endif
|