[PATCH 0/3] Fix the issues caused by CMDQ refinement of mtk-drm

Because mtk_drm_crtc_create_pkt didn't assign pkt->cl, it will
crash at using pkt->cl->chan in cmdq_pkt_finalize.

So add struct cmdq_client and let mtk_drm_crtc instance define
cmdq_client as:

struct mtk_drm_crtc {
        /* client instance data */
        struct cmdq_client cmdq_client;
};

and in rx_callback function can use pkt->cl to get
struct cmdq_client.

Fixes: f4be17cd5b14 ("drm/mediatek: Remove struct cmdq_client")
Signed-off-by: jason-jh.lin <redacted>
---
 drivers/gpu/drm/mediatek/mtk_drm_crtc.c | 73 +++++++++++++------------
 1 file changed, 38 insertions(+), 35 deletions(-)

diff --git a/drivers/gpu/drm/mediatek/mtk_drm_crtc.c b/drivers/gpu/drm/mediatek/mtk_drm_crtc.c
index 5f81489fc60c..e98871a8c961 100644
--- a/drivers/gpu/drm/mediatek/mtk_drm_crtc.c
+++ b/drivers/gpu/drm/mediatek/mtk_drm_crtc.c

@@ -52,8 +52,7 @@ struct mtk_drm_crtc {
        bool                            pending_async_planes;

 #if IS_REACHABLE(CONFIG_MTK_CMDQ)
-       struct mbox_client              cmdq_cl;
-       struct mbox_chan                *cmdq_chan;
+       struct cmdq_client              cmdq_client;
        struct cmdq_pkt                 cmdq_handle;
        u32                             cmdq_event;
        u32                             cmdq_vblank_cnt;

@@ -227,8 +226,8 @@ struct mtk_ddp_comp *mtk_drm_ddp_comp_for_plane(struct drm_crtc *crtc,
 }

 #if IS_REACHABLE(CONFIG_MTK_CMDQ)
-static int mtk_drm_cmdq_pkt_create(struct mbox_chan *chan, struct cmdq_pkt *pkt,
-                                   size_t size)
+static int mtk_drm_cmdq_pkt_create(struct cmdq_client *client, struct cmdq_pkt *pkt,
+                                  size_t size)
 {
        struct device *dev;
        dma_addr_t dma_addr;

@@ -239,8 +238,9 @@ static int mtk_drm_cmdq_pkt_create(struct mbox_chan *chan, struct cmdq_pkt *pkt,
                return -ENOMEM;
        }
        pkt->buf_size = size;
+       pkt->cl = (void *)client;

-       dev = chan->mbox->dev;
+       dev = client->chan->mbox->dev;
        dma_addr = dma_map_single(dev, pkt->va_base, pkt->buf_size,
                                  DMA_TO_DEVICE);
        if (dma_mapping_error(dev, dma_addr)) {

@@ -255,9 +255,11 @@ static int mtk_drm_cmdq_pkt_create(struct mbox_chan *chan, struct cmdq_pkt *pkt,
        return 0;
 }

-static void mtk_drm_cmdq_pkt_destroy(struct mbox_chan *chan, struct cmdq_pkt *pkt)
+static void mtk_drm_cmdq_pkt_destroy(struct cmdq_pkt *pkt)
 {
-       dma_unmap_single(chan->mbox->dev, pkt->pa_base, pkt->buf_size,
+       struct cmdq_client *client = (struct cmdq_client *)pkt->cl;
+
+       dma_unmap_single(client->chan->mbox->dev, pkt->pa_base, pkt->buf_size,
                         DMA_TO_DEVICE);
        kfree(pkt->va_base);
        kfree(pkt);

@@ -265,8 +267,9 @@ static void mtk_drm_cmdq_pkt_destroy(struct mbox_chan *chan, struct cmdq_pkt *pk

 static void ddp_cmdq_cb(struct mbox_client *cl, void *mssg)
 {
-       struct mtk_drm_crtc *mtk_crtc = container_of(cl, struct mtk_drm_crtc, cmdq_cl);
        struct cmdq_cb_data *data = mssg;
+       struct cmdq_pkt *pkt = data->pkt;
+       struct mtk_drm_crtc *mtk_crtc = container_of(pkt->cl, struct mtk_drm_crtc, cmdq_client);

        struct mtk_crtc_state *state;
        unsigned int i;

@@ -299,7 +302,7 @@ static void ddp_cmdq_cb(struct mbox_client *cl, void *mssg)
        }

        mtk_crtc->cmdq_vblank_cnt = 0;
-       mtk_drm_cmdq_pkt_destroy(mtk_crtc->cmdq_chan, data->pkt);
+       mtk_drm_cmdq_pkt_destroy(pkt);

 }
 #endif

@@ -550,24 +553,24 @@ static void mtk_drm_crtc_update_config(struct mtk_drm_crtc *mtk_crtc,
                mtk_mutex_release(mtk_crtc->mutex);
        }
 #if IS_REACHABLE(CONFIG_MTK_CMDQ)
-       if (mtk_crtc->cmdq_chan) {
-               mbox_flush(mtk_crtc->cmdq_chan, 2000);
+       if (mtk_crtc->cmdq_client.chan) {
+               mbox_flush(mtk_crtc->cmdq_client.chan, 2000);
                cmdq_handle->cmd_buf_size = 0;
                cmdq_pkt_clear_event(cmdq_handle, mtk_crtc->cmdq_event);
                cmdq_pkt_wfe(cmdq_handle, mtk_crtc->cmdq_event, false);
                mtk_crtc_ddp_config(crtc, cmdq_handle);
                cmdq_pkt_finalize(cmdq_handle);
-               dma_sync_single_for_device(mtk_crtc->cmdq_chan->mbox->dev,
-                                           cmdq_handle->pa_base,
-                                           cmdq_handle->cmd_buf_size,
-                                           DMA_TO_DEVICE);
+               dma_sync_single_for_device(mtk_crtc->cmdq_client.chan->mbox->dev,
+                                          cmdq_handle->pa_base,
+                                          cmdq_handle->cmd_buf_size,
+                                          DMA_TO_DEVICE);
                /*
                 * CMDQ command should execute in next vblank,
                 * If it fail to execute in next 2 vblank, timeout happen.
                 */
                mtk_crtc->cmdq_vblank_cnt = 2;
-               mbox_send_message(mtk_crtc->cmdq_chan, cmdq_handle);
-               mbox_client_txdone(mtk_crtc->cmdq_chan, 0);
+               mbox_send_message(mtk_crtc->cmdq_client.chan, cmdq_handle);
+               mbox_client_txdone(mtk_crtc->cmdq_client.chan, 0);
        }
 #endif
        mtk_crtc->config_updating = false;

@@ -581,7 +584,7 @@ static void mtk_crtc_ddp_irq(void *data)
        struct mtk_drm_private *priv = crtc->dev->dev_private;

 #if IS_REACHABLE(CONFIG_MTK_CMDQ)
-       if (!priv->data->shadow_register && !mtk_crtc->cmdq_chan)
+       if (!priv->data->shadow_register && !mtk_crtc->cmdq_client.chan)
                mtk_crtc_ddp_config(crtc, NULL);
        else if (mtk_crtc->cmdq_vblank_cnt > 0 && --mtk_crtc->cmdq_vblank_cnt == 0)
                DRM_ERROR("mtk_crtc %d CMDQ execute command timeout!\n",

@@ -924,20 +927,20 @@ int mtk_drm_crtc_create(struct drm_device *drm_dev,
        mutex_init(&mtk_crtc->hw_lock);

 #if IS_REACHABLE(CONFIG_MTK_CMDQ)
-       mtk_crtc->cmdq_cl.dev = mtk_crtc->mmsys_dev;
-       mtk_crtc->cmdq_cl.tx_block = false;
-       mtk_crtc->cmdq_cl.knows_txdone = true;
-       mtk_crtc->cmdq_cl.rx_callback = ddp_cmdq_cb;
-       mtk_crtc->cmdq_chan =
-                       mbox_request_channel(&mtk_crtc->cmdq_cl,
-                                             drm_crtc_index(&mtk_crtc->base));
-       if (IS_ERR(mtk_crtc->cmdq_chan)) {
+       mtk_crtc->cmdq_client.client.dev = mtk_crtc->mmsys_dev;
+       mtk_crtc->cmdq_client.client.tx_block = false;
+       mtk_crtc->cmdq_client.client.knows_txdone = true;
+       mtk_crtc->cmdq_client.client.rx_callback = ddp_cmdq_cb;
+       mtk_crtc->cmdq_client.chan =
+                       mbox_request_channel(&mtk_crtc->cmdq_client.client,
+                                            drm_crtc_index(&mtk_crtc->base));
+       if (IS_ERR(mtk_crtc->cmdq_client.chan)) {
                dev_dbg(dev, "mtk_crtc %d failed to create mailbox client, writing register by CPU now\n",
                        drm_crtc_index(&mtk_crtc->base));
-               mtk_crtc->cmdq_chan = NULL;
+               mtk_crtc->cmdq_client.chan = NULL;
        }

-       if (mtk_crtc->cmdq_chan) {
+       if (mtk_crtc->cmdq_client.chan) {
                ret = of_property_read_u32_index(priv->mutex_node,
                                                 "mediatek,gce-events",
                                                 drm_crtc_index(&mtk_crtc->base),

@@ -945,17 +948,17 @@ int mtk_drm_crtc_create(struct drm_device *drm_dev,
                if (ret) {
                        dev_dbg(dev, "mtk_crtc %d failed to get mediatek,gce-events property\n",
                                drm_crtc_index(&mtk_crtc->base));
-                       mbox_free_channel(mtk_crtc->cmdq_chan);
-                       mtk_crtc->cmdq_chan = NULL;
+                       mbox_free_channel(mtk_crtc->cmdq_client.chan);
+                       mtk_crtc->cmdq_client.chan = NULL;
                } else {
-                       ret = mtk_drm_cmdq_pkt_create(mtk_crtc->cmdq_chan,
-                                                      &mtk_crtc->cmdq_handle,
-                                                      PAGE_SIZE);
+                       ret = mtk_drm_cmdq_pkt_create(&mtk_crtc->cmdq_client,
+                                                     &mtk_crtc->cmdq_handle,
+                                                     PAGE_SIZE);
                        if (ret) {
                                dev_dbg(dev, "mtk_crtc %d failed to create cmdq packet\n",
                                        drm_crtc_index(&mtk_crtc->base));
-                               mbox_free_channel(mtk_crtc->cmdq_chan);
-                               mtk_crtc->cmdq_chan = NULL;
+                               mbox_free_channel(mtk_crtc->cmdq_client.chan);
+                               mtk_crtc->cmdq_client.chan = NULL;
                        }
                }
        }
--

2.18.0

Fixes: bc9241be73d9 ("drm/mediatek: Add cmdq_handle in mtk_crtc")
Signed-off-by: jason-jh.lin <redacted>
---
 drivers/gpu/drm/mediatek/mtk_drm_crtc.c | 29 +++++++++++++++----------
 1 file changed, 18 insertions(+), 11 deletions(-)

diff --git a/drivers/gpu/drm/mediatek/mtk_drm_crtc.c b/drivers/gpu/drm/mediatek/mtk_drm_crtc.c
index e98871a8c961..06342df2a0be 100644
--- a/drivers/gpu/drm/mediatek/mtk_drm_crtc.c
+++ b/drivers/gpu/drm/mediatek/mtk_drm_crtc.c

@@ -108,12 +108,30 @@ static void mtk_drm_finish_page_flip(struct mtk_drm_crtc *mtk_crtc)
        }
 }

+#if IS_REACHABLE(CONFIG_MTK_CMDQ)
+static void mtk_drm_cmdq_pkt_destroy(struct cmdq_pkt *pkt)
+{
+       struct cmdq_client *client = (struct cmdq_client *)pkt->cl;
+
+       dma_unmap_single(client->chan->mbox->dev, pkt->pa_base, pkt->buf_size,
+                        DMA_TO_DEVICE);
+       kfree(pkt->va_base);
+       kfree(pkt);
+}
+#endif
+
 static void mtk_drm_crtc_destroy(struct drm_crtc *crtc)
 {
        struct mtk_drm_crtc *mtk_crtc = to_mtk_crtc(crtc);

        mtk_mutex_put(mtk_crtc->mutex);
+#if IS_REACHABLE(CONFIG_MTK_CMDQ)
+       mtk_drm_cmdq_pkt_destroy(&mtk_crtc->cmdq_handle);

+       if (mtk_crtc->cmdq_client.chan)
+               mbox_free_channel(mtk_crtc->cmdq_client.chan);
+                                 mtk_crtc->cmdq_client.chan = NULL;
+#endif
        drm_crtc_cleanup(crtc);
 }

@@ -255,16 +273,6 @@ static int mtk_drm_cmdq_pkt_create(struct cmdq_client *client, struct cmdq_pkt *
        return 0;
 }

-static void mtk_drm_cmdq_pkt_destroy(struct cmdq_pkt *pkt)
-{
-       struct cmdq_client *client = (struct cmdq_client *)pkt->cl;
-
-       dma_unmap_single(client->chan->mbox->dev, pkt->pa_base, pkt->buf_size,
-                        DMA_TO_DEVICE);
-       kfree(pkt->va_base);
-       kfree(pkt);
-}
-
 static void ddp_cmdq_cb(struct mbox_client *cl, void *mssg)
 {
        struct cmdq_cb_data *data = mssg;

@@ -302,7 +310,6 @@ static void ddp_cmdq_cb(struct mbox_client *cl, void *mssg)
        }

        mtk_crtc->cmdq_vblank_cnt = 0;
-       mtk_drm_cmdq_pkt_destroy(pkt);
 }
 #endif

--

2.18.0

If cursor plane has updated but primary plane config task is not
finished, mtk_drm_crtc_update_config will call mbox_flush() to clear
all task in current GCE thread and let cursor plane re-send a new
GCE task with cursor + primary plane config to replace the unfinished
GCE task.

So the plane config flag should not be cleared when mailbox callback
with a error status.

Fixes: 9efb16c2fdd6 ("drm/mediatek: Clear pending flag when cmdq packet is done")
Signed-off-by: jason-jh.lin <redacted>
---
 drivers/gpu/drm/mediatek/mtk_drm_crtc.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/drivers/gpu/drm/mediatek/mtk_drm_crtc.c b/drivers/gpu/drm/mediatek/mtk_drm_crtc.c
index 06342df2a0be..fb0d9424acec 100644
--- a/drivers/gpu/drm/mediatek/mtk_drm_crtc.c
+++ b/drivers/gpu/drm/mediatek/mtk_drm_crtc.c

@@ -281,6 +281,9 @@ static void ddp_cmdq_cb(struct mbox_client *cl, void *mssg)
        struct mtk_crtc_state *state;
        unsigned int i;

+       if (data->sta != 0)