From nobody Sun Sep 22 07:31:04 2024 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 0A72FC433F5 for ; Fri, 25 Feb 2022 13:45:46 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S241640AbiBYNqQ (ORCPT ); Fri, 25 Feb 2022 08:46:16 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:33442 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S234303AbiBYNqO (ORCPT ); Fri, 25 Feb 2022 08:46:14 -0500 Received: from bhuna.collabora.co.uk (bhuna.collabora.co.uk [IPv6:2a00:1098:0:82:1000:25:2eeb:e3e3]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 3EB18210D74 for ; Fri, 25 Feb 2022 05:45:42 -0800 (PST) Received: from [127.0.0.1] (localhost [127.0.0.1]) (Authenticated sender: rcn) with ESMTPSA id 7A6AF1F45F92 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=collabora.com; s=mail; t=1645796741; bh=PEG3axVN//YyYVluyyyZUdTkTfte6RZExlKRrKGNNGg=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=V/oym2rKqKgD8WS1WPUP98b3I3JMruzcQzkNhu3PgRNVN3ZTTJw+3GtVTL7aQoSOC ptLBuP3f9+pjoz9+9FnrgPRUlPo8VUleDaWCGLiwJzBpw/YoZOPgnqe50SuZ7CI3JM cBm7FrVwATP5cHVP41V99XezDyNEe+JLDXvRQJT3FOB6nF4qJGptcikBkNbiOeKqrq cYst4IN9RE4IHAGzU7XZe4bZk0uzpZw6GGOlQiX6xQ8R2LTgwiYm/vHddpjkOwekzs 5rJVyJdqyqIFY/UJ48Ojz3PCzr+Plzv/pWZts6M45eVOhHQ9qPvjsnEhpEV4N01hB+ hqRo5dsRtjmaQ== From: =?UTF-8?q?Ricardo=20Ca=C3=B1uelo?= To: dri-devel@lists.freedesktop.org Cc: =?UTF-8?q?Ricardo=20Ca=C3=B1uelo?= , linux-kernel@vger.kernel.org, linux-mediatek@lists.infradead.org, kernel@collabora.com, andrzej.hajda@intel.com, narmstrong@baylibre.com, maarten.lankhorst@linux.intel.com, mripard@kernel.org Subject: [PATCH 1/2] drm/bridge: parade-ps8640: avoid race condition on driver unbinding Date: Fri, 25 Feb 2022 14:45:03 +0100 Message-Id: <20220225134504.457245-2-ricardo.canuelo@collabora.com> X-Mailer: git-send-email 2.25.1 In-Reply-To: <20220225134504.457245-1-ricardo.canuelo@collabora.com> References: <20220225134504.457245-1-ricardo.canuelo@collabora.com> MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org When unbinding a DRM master driver there's a race condition that sometimes results in an invalid vm access when userspace (gnome-shell) issues a DRM_IOCTL_MODE_GETCONNECTOR ioctl right after a bridge has been removed from an encoder's bridge chain. This means that once a bridge has been disabled and gone through ps8640_post_disable(), if ps8640_bridge_get_edid() runs afterwards as a result of that ioctl call it will call drm_bridge_chain_pre_enable() and drm_bridge_chain_post_disable() again in a bridge that has been already detached. Setting `ps_bridge->pre_enabled =3D false` at a later stage of the bringdown path and calling drm_bridge_chain_pre_enable() inside ps8640_bridge_get_edid() only if needed avoid this, although a proper subsystem-wide fix would be the proper solution, since the same type of race conditions might happen somewhere else. Tested on an Acer Chromebook R13 (Elm, MT8173) with Debian Sid. Signed-off-by: Ricardo Ca=C3=B1uelo --- drivers/gpu/drm/bridge/parade-ps8640.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/drivers/gpu/drm/bridge/parade-ps8640.c b/drivers/gpu/drm/bridg= e/parade-ps8640.c index 3f17337ee389..a927787a89bf 100644 --- a/drivers/gpu/drm/bridge/parade-ps8640.c +++ b/drivers/gpu/drm/bridge/parade-ps8640.c @@ -434,8 +434,6 @@ static void ps8640_post_disable(struct drm_bridge *brid= ge) { struct ps8640 *ps_bridge =3D bridge_to_ps8640(bridge); =20 - ps_bridge->pre_enabled =3D false; - ps8640_bridge_vdo_control(ps_bridge, DISABLE); pm_runtime_put_sync_suspend(&ps_bridge->page[PAGE0_DP_CNTL]->dev); } @@ -487,6 +485,7 @@ static void ps8640_bridge_detach(struct drm_bridge *bri= dge) drm_dp_aux_unregister(&ps_bridge->aux); if (ps_bridge->link) device_link_del(ps_bridge->link); + ps_bridge->pre_enabled =3D false; } =20 static struct edid *ps8640_bridge_get_edid(struct drm_bridge *bridge, @@ -508,7 +507,8 @@ static struct edid *ps8640_bridge_get_edid(struct drm_b= ridge *bridge, * EDID, for this chip, we need to do a full poweron, otherwise it will * fail. */ - drm_bridge_chain_pre_enable(bridge); + if (poweroff) + drm_bridge_chain_pre_enable(bridge); =20 edid =3D drm_get_edid(connector, ps_bridge->page[PAGE0_DP_CNTL]->adapter); --=20 2.25.1 From nobody Sun Sep 22 07:31:04 2024 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id D3FFBC433FE for ; Fri, 25 Feb 2022 13:45:48 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S241645AbiBYNqT (ORCPT ); Fri, 25 Feb 2022 08:46:19 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:33454 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S241631AbiBYNqO (ORCPT ); Fri, 25 Feb 2022 08:46:14 -0500 Received: from bhuna.collabora.co.uk (bhuna.collabora.co.uk [IPv6:2a00:1098:0:82:1000:25:2eeb:e3e3]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 0402B210D75 for ; Fri, 25 Feb 2022 05:45:43 -0800 (PST) Received: from [127.0.0.1] (localhost [127.0.0.1]) (Authenticated sender: rcn) with ESMTPSA id 38B651F45F94 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=collabora.com; s=mail; t=1645796741; bh=6IuTiAPuhKDYgNwCLKRyc4SunUJTB6ruZFYFsOvvpvs=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=furnXzpdMdgCyVoYEJ4jDsNkBjXVwWUIBhNi74Q0yGH4QrCYy2xcC23hpHNo4n5G1 y8Ob0c1jgVIFTYAcUYS0VgI+V4cihoITEyo8tyqT6WCgnBVRZAwEIIomHmYKBxSzBt Dht/iRxyKUmfqcBqP4xEmfexO2cMyX4S0ivgJEH+iaqsHPSzatnnyPqq1iRfrV4b4u qfp/5GFOhhwNbEnaYRe9iWYSMgpbdoygnLQc8OU1T8IM4sTQQYPQz75DX31oGd8161 ibLHJGZwlRfOAm0FWAFpDkxesQSeTlLajZta2f58kEj2pvFTU9sy/6WHJQ3UtXQ8ic 0d/WRZ7lQBuGw== From: =?UTF-8?q?Ricardo=20Ca=C3=B1uelo?= To: dri-devel@lists.freedesktop.org Cc: =?UTF-8?q?Ricardo=20Ca=C3=B1uelo?= , linux-kernel@vger.kernel.org, linux-mediatek@lists.infradead.org, kernel@collabora.com, andrzej.hajda@intel.com, narmstrong@baylibre.com, maarten.lankhorst@linux.intel.com, mripard@kernel.org Subject: [PATCH 2/2] drm/bridge: Add extra checks in pre_enable and post_enable Date: Fri, 25 Feb 2022 14:45:04 +0100 Message-Id: <20220225134504.457245-3-ricardo.canuelo@collabora.com> X-Mailer: git-send-email 2.25.1 In-Reply-To: <20220225134504.457245-1-ricardo.canuelo@collabora.com> References: <20220225134504.457245-1-ricardo.canuelo@collabora.com> MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Depending on the bridge code, certain userspace events during a driver teardown (such as a DRM ioctl call) might cause a race condition where the drm_bridge_chain_pre_enable() and drm_bridge_chain_post_enable() functions could be called for a bridge that has just been detached and removed from the bridge chain of an encoder. This change makes these functions a bit more robust by bailing out if the bridge has already been detached. Tested on an Acer Chromebook R13 (Elm, MT8173) with Debian Sid. Signed-off-by: Ricardo Ca=C3=B1uelo --- drivers/gpu/drm/drm_bridge.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/drivers/gpu/drm/drm_bridge.c b/drivers/gpu/drm/drm_bridge.c index c96847fc0ebc..e074aa456dd1 100644 --- a/drivers/gpu/drm/drm_bridge.c +++ b/drivers/gpu/drm/drm_bridge.c @@ -529,7 +529,7 @@ void drm_bridge_chain_post_disable(struct drm_bridge *b= ridge) { struct drm_encoder *encoder; =20 - if (!bridge) + if (!bridge || !bridge->dev) return; =20 encoder =3D bridge->encoder; @@ -585,7 +585,7 @@ void drm_bridge_chain_pre_enable(struct drm_bridge *bri= dge) struct drm_encoder *encoder; struct drm_bridge *iter; =20 - if (!bridge) + if (!bridge || !bridge->dev) return; =20 encoder =3D bridge->encoder; --=20 2.25.1