From nobody Sun Sep 22 07:32:48 2024 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id EA44AC433F5 for ; Fri, 11 Mar 2022 09:34:42 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1347575AbiCKJfn (ORCPT ); Fri, 11 Mar 2022 04:35:43 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:52064 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1347546AbiCKJfk (ORCPT ); Fri, 11 Mar 2022 04:35:40 -0500 Received: from bhuna.collabora.co.uk (bhuna.collabora.co.uk [46.235.227.227]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id F2C521BE0E9 for ; Fri, 11 Mar 2022 01:34:37 -0800 (PST) Received: from [127.0.0.1] (localhost [127.0.0.1]) (Authenticated sender: rcn) with ESMTPSA id 43B4C1F4649B DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=collabora.com; s=mail; t=1646991276; bh=PEG3axVN//YyYVluyyyZUdTkTfte6RZExlKRrKGNNGg=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=IOIevA2nantASE3yYn/YUjQS5gP8DD6vEldy8ZnQb7KvSWDexaKr23Q1H3WWldHVX ilMRsF/w8dhmsry9dwQLfOy74iekWPbrKv7KmwjLbbymuI2OupBFSkb0a0Yz6wcVYt eJttIa1fKq1b9rKZnUfRuveC31R3UQ4sqv5aNCGlEiO3fcFGAtfhrZJKiLoQ41KAzc BuGtK0m5eqWa4/7L+i4DCr+9g3CzUy7kEfBv/ebnRbUDdEXply9m6eEh/Yo3PKNic4 9wSSwSlwtBBz6x0ComHm5IrbBXghXwrwqHzMnOBxMa+Ep6dqpMnr7Ey5Lh+ediB8wS fxrSGXNY4OdkQ== From: =?UTF-8?q?Ricardo=20Ca=C3=B1uelo?= To: dri-devel@lists.freedesktop.org Cc: linux-kernel@vger.kernel.org, linux-mediatek@lists.infradead.org, kernel@collabora.com, andrzej.hajda@intel.com, narmstrong@baylibre.com, maarten.lankhorst@linux.intel.com, mripard@kernel.org Subject: [PATCH 1/2 RESEND] drm/bridge: parade-ps8640: avoid race condition on driver unbinding Date: Fri, 11 Mar 2022 10:34:05 +0100 Message-Id: <20220311093406.4068019-2-ricardo.canuelo@collabora.com> X-Mailer: git-send-email 2.25.1 In-Reply-To: <20220311093406.4068019-1-ricardo.canuelo@collabora.com> References: <20220311093406.4068019-1-ricardo.canuelo@collabora.com> MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org When unbinding a DRM master driver there's a race condition that sometimes results in an invalid vm access when userspace (gnome-shell) issues a DRM_IOCTL_MODE_GETCONNECTOR ioctl right after a bridge has been removed from an encoder's bridge chain. This means that once a bridge has been disabled and gone through ps8640_post_disable(), if ps8640_bridge_get_edid() runs afterwards as a result of that ioctl call it will call drm_bridge_chain_pre_enable() and drm_bridge_chain_post_disable() again in a bridge that has been already detached. Setting `ps_bridge->pre_enabled =3D false` at a later stage of the bringdown path and calling drm_bridge_chain_pre_enable() inside ps8640_bridge_get_edid() only if needed avoid this, although a proper subsystem-wide fix would be the proper solution, since the same type of race conditions might happen somewhere else. Tested on an Acer Chromebook R13 (Elm, MT8173) with Debian Sid. Signed-off-by: Ricardo Ca=C3=B1uelo Reviewed-by: AngeloGioacchino Del Regno --- drivers/gpu/drm/bridge/parade-ps8640.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/drivers/gpu/drm/bridge/parade-ps8640.c b/drivers/gpu/drm/bridg= e/parade-ps8640.c index 3f17337ee389..a927787a89bf 100644 --- a/drivers/gpu/drm/bridge/parade-ps8640.c +++ b/drivers/gpu/drm/bridge/parade-ps8640.c @@ -434,8 +434,6 @@ static void ps8640_post_disable(struct drm_bridge *brid= ge) { struct ps8640 *ps_bridge =3D bridge_to_ps8640(bridge); =20 - ps_bridge->pre_enabled =3D false; - ps8640_bridge_vdo_control(ps_bridge, DISABLE); pm_runtime_put_sync_suspend(&ps_bridge->page[PAGE0_DP_CNTL]->dev); } @@ -487,6 +485,7 @@ static void ps8640_bridge_detach(struct drm_bridge *bri= dge) drm_dp_aux_unregister(&ps_bridge->aux); if (ps_bridge->link) device_link_del(ps_bridge->link); + ps_bridge->pre_enabled =3D false; } =20 static struct edid *ps8640_bridge_get_edid(struct drm_bridge *bridge, @@ -508,7 +507,8 @@ static struct edid *ps8640_bridge_get_edid(struct drm_b= ridge *bridge, * EDID, for this chip, we need to do a full poweron, otherwise it will * fail. */ - drm_bridge_chain_pre_enable(bridge); + if (poweroff) + drm_bridge_chain_pre_enable(bridge); =20 edid =3D drm_get_edid(connector, ps_bridge->page[PAGE0_DP_CNTL]->adapter); --=20 2.25.1 From nobody Sun Sep 22 07:32:48 2024 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 9F465C433F5 for ; Fri, 11 Mar 2022 09:34:45 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1347585AbiCKJfq (ORCPT ); Fri, 11 Mar 2022 04:35:46 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:52120 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1347553AbiCKJfl (ORCPT ); Fri, 11 Mar 2022 04:35:41 -0500 Received: from bhuna.collabora.co.uk (bhuna.collabora.co.uk [IPv6:2a00:1098:0:82:1000:25:2eeb:e3e3]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id E76089F3B2 for ; Fri, 11 Mar 2022 01:34:38 -0800 (PST) Received: from [127.0.0.1] (localhost [127.0.0.1]) (Authenticated sender: rcn) with ESMTPSA id E511A1F4649E DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=collabora.com; s=mail; t=1646991277; bh=6IuTiAPuhKDYgNwCLKRyc4SunUJTB6ruZFYFsOvvpvs=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=gD8SJkWPQ7AVcDYe+nWxXfobtI4INoYCVxW2ZB+Ymm9w2+8CaNz1q4SOTOz0LYPjz hGE5rXOAurREVi3IW7YQ+311vbeuCvhAZEtGwT1UQ6JGNN4jw9I5SVByaHfedUpRgk 8tl6I1ycOfeVe6h3U6FpZHRJQ4a08lXbIc0faRsAqCq1QccSYUlhyRTPdgqB7lD/KD nlgN6VZ5BncUXMpaEJHhVlgNMh78y/7kD8lLHl4E8MWn0XAm+B4cW/SdglvOY5S+SS JRf3BVt9wetOW7qBA0Od2XtzFbiAg08uBp+EtWKh8s9Wzyz3ipXIE1sm44716SVvX1 7EEsvho0zxjdg== From: =?UTF-8?q?Ricardo=20Ca=C3=B1uelo?= To: dri-devel@lists.freedesktop.org Cc: linux-kernel@vger.kernel.org, linux-mediatek@lists.infradead.org, kernel@collabora.com, andrzej.hajda@intel.com, narmstrong@baylibre.com, maarten.lankhorst@linux.intel.com, mripard@kernel.org Subject: [PATCH 2/2 RESEND] drm/bridge: Add extra checks in pre_enable and post_enable Date: Fri, 11 Mar 2022 10:34:06 +0100 Message-Id: <20220311093406.4068019-3-ricardo.canuelo@collabora.com> X-Mailer: git-send-email 2.25.1 In-Reply-To: <20220311093406.4068019-1-ricardo.canuelo@collabora.com> References: <20220311093406.4068019-1-ricardo.canuelo@collabora.com> MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Depending on the bridge code, certain userspace events during a driver teardown (such as a DRM ioctl call) might cause a race condition where the drm_bridge_chain_pre_enable() and drm_bridge_chain_post_enable() functions could be called for a bridge that has just been detached and removed from the bridge chain of an encoder. This change makes these functions a bit more robust by bailing out if the bridge has already been detached. Tested on an Acer Chromebook R13 (Elm, MT8173) with Debian Sid. Signed-off-by: Ricardo Ca=C3=B1uelo Tested-by: AngeloGioacchino Del Regno --- drivers/gpu/drm/drm_bridge.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/drivers/gpu/drm/drm_bridge.c b/drivers/gpu/drm/drm_bridge.c index c96847fc0ebc..e074aa456dd1 100644 --- a/drivers/gpu/drm/drm_bridge.c +++ b/drivers/gpu/drm/drm_bridge.c @@ -529,7 +529,7 @@ void drm_bridge_chain_post_disable(struct drm_bridge *b= ridge) { struct drm_encoder *encoder; =20 - if (!bridge) + if (!bridge || !bridge->dev) return; =20 encoder =3D bridge->encoder; @@ -585,7 +585,7 @@ void drm_bridge_chain_pre_enable(struct drm_bridge *bri= dge) struct drm_encoder *encoder; struct drm_bridge *iter; =20 - if (!bridge) + if (!bridge || !bridge->dev) return; =20 encoder =3D bridge->encoder; --=20 2.25.1