drm: revamp locking around fb creation/destruction

Well, at least step 1. The goal here is that framebuffer objects can
survive outside of the mode_config lock, with just a reference held
as protection. The first step to get there is to introduce a special
fb_lock which protects fb lookup, creation and destruction, to make
them appear atomic.

This new fb_lock can nest within the mode_config lock. But the idea is
(once the reference counting part is completed) that we only quickly
take that fb_lock to lookup a framebuffer and grab a reference,
without any other locks involved.

vmwgfx is the only driver which does framebuffer lookups itself, also
wrap those calls to drm_mode_object_find with the new lock.

Also protect the fb_list walking in i915 and omapdrm with the new lock.

As a slight complication there's also the list of user-created fbs
attached to the file private. The problem now is that at fclose() time
we need to walk that list, eventually do a modeset call to remove the
fb from active usage (and are required to be able to take the
mode_config lock), but in the end we need to grab the new fb_lock to
remove the fb from the list. The easiest solution is to add another
mutex to protect this per-file list.

Currently that new fbs_lock nests within the modeset locks and so
appears redudant. But later patches will switch around this sequence
so that taking the modeset locks in the fb destruction path is
optional in the fastpath. Ultimately the goal is that addfb and rmfb
do not require the mode_config lock, since otherwise they have the
potential to introduce stalls in the pageflip sequence of a compositor
(if the compositor e.g. switches to a fullscreen client or if it
enables a plane). But that requires a few more steps and hoops to jump
through.

Note that framebuffer creation/destruction is now double-protected -
once by the fb_lock and in parts by the idr_lock. The later would be
unnecessariy if framebuffers would have their own idr allocator. But
that's material for another patch (series).

v2: Properly initialize the fb->filp_head list in _init, otherwise the
newly added WARN to check whether the fb isn't on a fpriv list any
more will fail for driver-private objects.

v3: Fixup two error-case unlock bugs spotted by Richard Wilbur.

Reviewed-by: Rob Clark <rob@ti.com>
Signed-off-by: Daniel Vetter <daniel.vetter@ffwll.ch>

7 files changed, 113 insertions, 37 deletions

diff --git a/drivers/gpu/drm/drm_crtc.c b/drivers/gpu/drm/drm_crtc.c
index 4af6a3d5c9a1..13a3d3426961 100644
--- a/drivers/gpu/drm/drm_crtc.c
+++ b/drivers/gpu/drm/drm_crtc.c
@@ -262,15 +262,21 @@ again:
 
         mutex_lock(&dev->mode_config.idr_mutex);
         ret = idr_get_new_above(&dev->mode_config.crtc_idr, obj, 1, &new_id);
+
+        if (!ret) {
+                /*
+                 * Set up the object linking under the protection of the idr
+                 * lock so that other users can't see inconsistent state.
+                 */
+                obj->id = new_id;
+                obj->type = obj_type;
+        }
         mutex_unlock(&dev->mode_config.idr_mutex);
+
         if (ret == -EAGAIN)
                 goto again;
-        else if (ret)
-                return ret;
 
-        obj->id = new_id;
-        obj->type = obj_type;
-        return 0;
+        return ret;
 }
 
 /**
@@ -312,6 +318,12 @@ EXPORT_SYMBOL(drm_mode_object_find);
  * Allocates an ID for the framebuffer's parent mode object, sets its mode
  * functions & device file and adds it to the master fd list.
  *
+ * IMPORTANT:
+ * This functions publishes the fb and makes it available for concurrent access
+ * by other users. Which means by this point the fb _must_ be fully set up -
+ * since all the fb attributes are invariant over its lifetime, no further
+ * locking but only correct reference counting is required.
+ *
  * RETURNS:
  * Zero on success, error code on failure.
  */
@@ -320,16 +332,20 @@ int drm_framebuffer_init(struct drm_device *dev, struct drm_framebuffer *fb,
 {
         int ret;
 
+        mutex_lock(&dev->mode_config.fb_lock);
         kref_init(&fb->refcount);
+        INIT_LIST_HEAD(&fb->filp_head);
+        fb->dev = dev;
+        fb->funcs = funcs;
 
         ret = drm_mode_object_get(dev, &fb->base, DRM_MODE_OBJECT_FB);
         if (ret)
-                return ret;
+                goto out;
 
-        fb->dev = dev;
-        fb->funcs = funcs;
         dev->mode_config.num_fb++;
         list_add(&fb->head, &dev->mode_config.fb_list);
+out:
+        mutex_unlock(&dev->mode_config.fb_lock);
 
         return 0;
 }
@@ -385,8 +401,10 @@ void drm_framebuffer_cleanup(struct drm_framebuffer *fb)
          * this.)
          */
         drm_mode_object_put(dev, &fb->base);
+        mutex_lock(&dev->mode_config.fb_lock);
         list_del(&fb->head);
         dev->mode_config.num_fb--;
+        mutex_unlock(&dev->mode_config.fb_lock);
 }
 EXPORT_SYMBOL(drm_framebuffer_cleanup);
 
@@ -406,6 +424,7 @@ void drm_framebuffer_remove(struct drm_framebuffer *fb)
         int ret;
 
         WARN_ON(!drm_modeset_is_locked(dev));
+        WARN_ON(!list_empty(&fb->filp_head));
 
         /* remove from any CRTC */
         list_for_each_entry(crtc, &dev->mode_config.crtc_list, head) {
@@ -432,8 +451,6 @@ void drm_framebuffer_remove(struct drm_framebuffer *fb)
                 }
         }
 
-        list_del(&fb->filp_head);
-
         drm_framebuffer_unreference(fb);
 }
 EXPORT_SYMBOL(drm_framebuffer_remove);
@@ -989,6 +1006,7 @@ void drm_mode_config_init(struct drm_device *dev)
 {
         mutex_init(&dev->mode_config.mutex);
         mutex_init(&dev->mode_config.idr_mutex);
+        mutex_init(&dev->mode_config.fb_lock);
         INIT_LIST_HEAD(&dev->mode_config.fb_list);
         INIT_LIST_HEAD(&dev->mode_config.crtc_list);
         INIT_LIST_HEAD(&dev->mode_config.connector_list);
@@ -1091,6 +1109,9 @@ void drm_mode_config_cleanup(struct drm_device *dev)
                 drm_property_destroy(dev, property);
         }
 
+        /* Single-threaded teardown context, so it's not requied to grab the
+         * fb_lock to protect against concurrent fb_list access. Contrary, it
+         * would actually deadlock with the drm_framebuffer_cleanup function. */
         list_for_each_entry_safe(fb, fbt, &dev->mode_config.fb_list, head) {
                 drm_framebuffer_remove(fb);
         }
@@ -1220,8 +1241,8 @@ int drm_mode_getresources(struct drm_device *dev, void *data,
         if (!drm_core_check_feature(dev, DRIVER_MODESET))
                 return -EINVAL;
 
-        drm_modeset_lock_all(dev);
 
+        mutex_lock(&file_priv->fbs_lock);
         /*
          * For the non-control nodes we need to limit the list of resources
          * by IDs in the group list for this node
@@ -1229,6 +1250,23 @@ int drm_mode_getresources(struct drm_device *dev, void *data,
         list_for_each(lh, &file_priv->fbs)
                 fb_count++;
 
+        /* handle this in 4 parts */
+        /* FBs */
+        if (card_res->count_fbs >= fb_count) {
+                copied = 0;
+                fb_id = (uint32_t __user *)(unsigned long)card_res->fb_id_ptr;
+                list_for_each_entry(fb, &file_priv->fbs, filp_head) {
+                        if (put_user(fb->base.id, fb_id + copied)) {
+                                mutex_unlock(&file_priv->fbs_lock);
+                                return -EFAULT;
+                        }
+                        copied++;
+                }
+        }
+        card_res->count_fbs = fb_count;
+        mutex_unlock(&file_priv->fbs_lock);
+
+        drm_modeset_lock_all(dev);
         mode_group = &file_priv->master->minor->mode_group;
         if (file_priv->master->minor->type == DRM_MINOR_CONTROL) {