From nobody Thu Apr 10 23:23:22 2025 Received: from bali.collaboradmins.com (bali.collaboradmins.com [148.251.105.195]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 9EFA51F4C84 for ; Thu, 3 Apr 2025 10:47:47 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=148.251.105.195 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1743677269; cv=none; b=uSDiZtalYaoD+I7RxwNzX+qRbwaEpPAKQf4fEb2YL6LMsWrJ7AC0KA0guUxLg+FJWH3ZgOJhMTlZcQQ9NeEGdpHSpc0HEerm1RlM4Sry0J0+vtpqlNr0zOsE9HtvKpFboAtK6xmfPkh1eVdbAHOZX7FBXQPIjnlcJjooUMejI9U= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1743677269; c=relaxed/simple; bh=cdgfmZWt92kl0WT1E+bmMblp1Gwma1GMRb4hLbf+qZI=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=GGZuCClTNyJeAxSPwbVKLuhkZLUFPYRzCg5UJEhT26EAAmR/LSjRQYPXhmBoXF24rfFCCkwAOCuennfytpcNSVFccDMATOsFrii9HcLQPCqDcjG7v0y2AqevTVshRIG+WyQ5VtQC619CHetWfTZkDyasDfSdpgpcG93ibLfhkFQ= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=collabora.com; spf=pass smtp.mailfrom=collabora.com; dkim=pass (2048-bit key) header.d=collabora.com header.i=@collabora.com header.b=FMNfxomS; arc=none smtp.client-ip=148.251.105.195 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=collabora.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=collabora.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=collabora.com header.i=@collabora.com header.b="FMNfxomS" DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=collabora.com; s=mail; t=1743677265; bh=cdgfmZWt92kl0WT1E+bmMblp1Gwma1GMRb4hLbf+qZI=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=FMNfxomSjJQHWBxfx0+elkxR1CNA/+rKzicDqXNq90eXvvjj4CCwqQipyeoAsKcjb fhkQEuLrKWrLhdkh8sEK22esehbTAHbmYgIWmuKAoXp2Zzic7BzvKQth86kvVeIs2n TE58FQOHQtOaLtZA1Gk/rYAIX71fswWbq6msvoh+g9fXydADnudS8kBr8RM/nbVUpD MapphVL208KOwRbpJiJEeQtQPN3DJyFRh+mRJVPSLBvDraAw8/2ZBbAcr/GOVGxLGJ /h1K9jmno5GxNGp+lS/PEB7hQhUBU60lhv0FbvqETzMfCDm0x1HEHG7nC7UBBZZ63M qGQuI4AeWCkbg== Received: from IcarusMOD.eternityproject.eu (2-237-20-237.ip236.fastwebnet.it [2.237.20.237]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256) (No client certificate requested) (Authenticated sender: kholk11) by bali.collaboradmins.com (Postfix) with ESMTPSA id B8F8217E0FCC; Thu, 3 Apr 2025 12:47:44 +0200 (CEST) From: AngeloGioacchino Del Regno To: chunkuang.hu@kernel.org Cc: p.zabel@pengutronix.de, airlied@gmail.com, simona@ffwll.ch, matthias.bgg@gmail.com, angelogioacchino.delregno@collabora.com, nancy.lin@mediatek.com, ck.hu@mediatek.com, djkurtz@chromium.org, littlecvr@chromium.org, bibby.hsieh@mediatek.com, dri-devel@lists.freedesktop.org, linux-mediatek@lists.infradead.org, linux-kernel@vger.kernel.org, linux-arm-kernel@lists.infradead.org, wenst@chromium.org, kernel@collabora.com Subject: [PATCH v2 1/5] drm/mediatek: mtk_drm_drv: Fix kobject put for mtk_mutex device ptr Date: Thu, 3 Apr 2025 12:47:37 +0200 Message-ID: <20250403104741.71045-2-angelogioacchino.delregno@collabora.com> X-Mailer: git-send-email 2.48.1 In-Reply-To: <20250403104741.71045-1-angelogioacchino.delregno@collabora.com> References: <20250403104741.71045-1-angelogioacchino.delregno@collabora.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" This driver is taking a kobject for mtk_mutex only once per mmsys device for each drm-mediatek driver instance, differently from the behavior with other components, but it is decrementing the kobj's refcount in a loop and once per mmsys: this is not right and will result in a refcount_t underflow warning when mediatek-drm returns multiple probe deferrals in one boot (or when manually bound and unbound). Besides that, the refcount for mutex_dev was not decremented for error cases in mtk_drm_bind(), causing another refcount_t warning but this time for overflow, when the failure happens not during driver bind but during component bind. In order to fix one of the reasons why this is happening, remove the put_device(xx->mutex_dev) loop from the mtk_drm_kms_init()'s put_mutex_dev label (and drop the label) and add a single call to correctly free the single incremented refcount of mutex_dev to the mtk_drm_unbind() function to fix the refcount_t underflow. Moreover, add the same call to the error cases in mtk_drm_bind() to fix the refcount_t overflow. Fixes: 1ef7ed48356c ("drm/mediatek: Modify mediatek-drm for mt8195 multi mm= sys support") Reviewed-by: Chen-Yu Tsai Link: https://lore.kernel.org/r/20250402083628.20111-2-angelogioacchino.del= regno@collabora.com Signed-off-by: AngeloGioacchino Del Regno --- drivers/gpu/drm/mediatek/mtk_drm_drv.c | 17 ++++++++++------- 1 file changed, 10 insertions(+), 7 deletions(-) diff --git a/drivers/gpu/drm/mediatek/mtk_drm_drv.c b/drivers/gpu/drm/media= tek/mtk_drm_drv.c index e09578756de0..a8fbccb50c74 100644 --- a/drivers/gpu/drm/mediatek/mtk_drm_drv.c +++ b/drivers/gpu/drm/mediatek/mtk_drm_drv.c @@ -464,7 +464,7 @@ static int mtk_drm_kms_init(struct drm_device *drm) =20 ret =3D drmm_mode_config_init(drm); if (ret) - goto put_mutex_dev; + return ret; =20 drm->mode_config.min_width =3D 64; drm->mode_config.min_height =3D 64; @@ -483,7 +483,7 @@ static int mtk_drm_kms_init(struct drm_device *drm) drm->dev_private =3D private->all_drm_private[i]; ret =3D component_bind_all(private->all_drm_private[i]->dev, drm); if (ret) - goto put_mutex_dev; + return ret; } =20 /* @@ -576,9 +576,6 @@ static int mtk_drm_kms_init(struct drm_device *drm) err_component_unbind: for (i =3D 0; i < private->data->mmsys_dev_num; i++) component_unbind_all(private->all_drm_private[i]->dev, drm); -put_mutex_dev: - for (i =3D 0; i < private->data->mmsys_dev_num; i++) - put_device(private->all_drm_private[i]->mutex_dev); =20 return ret; } @@ -649,8 +646,10 @@ static int mtk_drm_bind(struct device *dev) return 0; =20 drm =3D drm_dev_alloc(&mtk_drm_driver, dev); - if (IS_ERR(drm)) - return PTR_ERR(drm); + if (IS_ERR(drm)) { + ret =3D PTR_ERR(drm); + goto err_put_dev; + } =20 private->drm_master =3D true; drm->dev_private =3D private; @@ -676,6 +675,8 @@ static int mtk_drm_bind(struct device *dev) drm_dev_put(drm); for (i =3D 0; i < private->data->mmsys_dev_num; i++) private->all_drm_private[i]->drm =3D NULL; +err_put_dev: + put_device(private->mutex_dev); return ret; } =20 @@ -688,6 +689,8 @@ static void mtk_drm_unbind(struct device *dev) drm_dev_unregister(private->drm); mtk_drm_kms_deinit(private->drm); drm_dev_put(private->drm); + + put_device(private->mutex_dev); } private->mtk_drm_bound =3D false; private->drm_master =3D false; --=20 2.48.1 From nobody Thu Apr 10 23:23:22 2025 Received: from bali.collaboradmins.com (bali.collaboradmins.com [148.251.105.195]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id A69C6248894 for ; Thu, 3 Apr 2025 10:47:48 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=148.251.105.195 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1743677270; cv=none; b=pq+XlpQ7hVgy6ayPzvPYSg5VkBSJuwS+n1Gyec2dfOgSS/r/Rcchy3sSUY+2FtRIMGsVBOpP4OE27l+rc7t6bSQhZDoBLBYBtJDuZx/G1v8kPwrwbXe6APaKIAWmiZnAQeOkXOPWbqgYX/orb4mAwbB480v1GUHi3a0zsr7tZxA= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1743677270; c=relaxed/simple; bh=XBrGKMq6MS8DZY0zqz/L52BhJguuw7zgExAG55zEXp4=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=DRdtrLvW2vsaAd1rl8NxcWT3VeaPxIJe6t5UeAfXgyw7qCqxVsJbGcMz7j8vcHtee/m33QNjlrUE1C4HpEDudWclBR35ERjAiIjtd/Ag6XMozOMxpDRC1XNrG59r+d4zhUf1rQRp0GQW//svX35MMHxg697SRNdXn/kBVN51azs= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=collabora.com; spf=pass smtp.mailfrom=collabora.com; dkim=pass (2048-bit key) header.d=collabora.com header.i=@collabora.com header.b=JzatnKvV; arc=none smtp.client-ip=148.251.105.195 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=collabora.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=collabora.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=collabora.com header.i=@collabora.com header.b="JzatnKvV" DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=collabora.com; s=mail; t=1743677267; bh=XBrGKMq6MS8DZY0zqz/L52BhJguuw7zgExAG55zEXp4=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=JzatnKvVaaSjwx2dW53q1pzSKu9+T3ikLlZi+2bxyzlRk6z5L2GWCCYZPwvGBWiE0 s1dua18cFeI4SuhGJpgi3L/Ark0BFSNkizKp1uNsDazzmW/j3WNO3c+Kj+MYvB8FIi /9G92AbMaw+DepEwM5Y9/1LpBlwg99XZpIBzVP8vdUM+cBZ255H/FnXwUFzZ3Y2p+s TCOeU3A171q0KfPc9Nt2vDq8Of8zH0FSd6w4ngci6AdDIGk3009GdQVScX4J9cM2cj CbNtqsWhbKKtKDZ3azLn09/yxqwT41USudOGGQxEkVmZHWwzQ3OxWRXGGqAVgX+s8n P7RznR+7VxK0Q== Received: from IcarusMOD.eternityproject.eu (2-237-20-237.ip236.fastwebnet.it [2.237.20.237]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256) (No client certificate requested) (Authenticated sender: kholk11) by bali.collaboradmins.com (Postfix) with ESMTPSA id EBA1E17E0FDC; Thu, 3 Apr 2025 12:47:45 +0200 (CEST) From: AngeloGioacchino Del Regno To: chunkuang.hu@kernel.org Cc: p.zabel@pengutronix.de, airlied@gmail.com, simona@ffwll.ch, matthias.bgg@gmail.com, angelogioacchino.delregno@collabora.com, nancy.lin@mediatek.com, ck.hu@mediatek.com, djkurtz@chromium.org, littlecvr@chromium.org, bibby.hsieh@mediatek.com, dri-devel@lists.freedesktop.org, linux-mediatek@lists.infradead.org, linux-kernel@vger.kernel.org, linux-arm-kernel@lists.infradead.org, wenst@chromium.org, kernel@collabora.com Subject: [PATCH v2 2/5] drm/mediatek: Fix kobject put for component sub-drivers Date: Thu, 3 Apr 2025 12:47:38 +0200 Message-ID: <20250403104741.71045-3-angelogioacchino.delregno@collabora.com> X-Mailer: git-send-email 2.48.1 In-Reply-To: <20250403104741.71045-1-angelogioacchino.delregno@collabora.com> References: <20250403104741.71045-1-angelogioacchino.delregno@collabora.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" In function mtk_drm_get_all_drm_priv(), this driver is incrementing the refcount for the sub-drivers of mediatek-drm with a call to device_find_child() when taking a reference to all of those child devices. When the component bind fails multiple times this results in a refcount_t overflow, as the reference count is never decremented: fix that by adding a call to put_device() for all of the mmsys devices in a loop, in error cases of mtk_drm_bind() and in the mtk_drm_unbind() callback. Fixes: 1ef7ed48356c ("drm/mediatek: Modify mediatek-drm for mt8195 multi mm= sys support") Reviewed-by: Chen-Yu Tsai Link: https://lore.kernel.org/r/20250402083628.20111-3-angelogioacchino.del= regno@collabora.com Signed-off-by: AngeloGioacchino Del Regno --- drivers/gpu/drm/mediatek/mtk_drm_drv.c | 9 +++++++++ 1 file changed, 9 insertions(+) diff --git a/drivers/gpu/drm/mediatek/mtk_drm_drv.c b/drivers/gpu/drm/media= tek/mtk_drm_drv.c index a8fbccb50c74..6b31df587507 100644 --- a/drivers/gpu/drm/mediatek/mtk_drm_drv.c +++ b/drivers/gpu/drm/mediatek/mtk_drm_drv.c @@ -676,6 +676,10 @@ static int mtk_drm_bind(struct device *dev) for (i =3D 0; i < private->data->mmsys_dev_num; i++) private->all_drm_private[i]->drm =3D NULL; err_put_dev: + for (i =3D 0; i < private->data->mmsys_dev_num; i++) { + /* For device_find_child in mtk_drm_get_all_priv() */ + put_device(private->all_drm_private[i]->dev); + } put_device(private->mutex_dev); return ret; } @@ -683,6 +687,7 @@ static int mtk_drm_bind(struct device *dev) static void mtk_drm_unbind(struct device *dev) { struct mtk_drm_private *private =3D dev_get_drvdata(dev); + int i; =20 /* for multi mmsys dev, unregister drm dev in mmsys master */ if (private->drm_master) { @@ -690,6 +695,10 @@ static void mtk_drm_unbind(struct device *dev) mtk_drm_kms_deinit(private->drm); drm_dev_put(private->drm); =20 + for (i =3D 0; i < private->data->mmsys_dev_num; i++) { + /* For device_find_child in mtk_drm_get_all_priv() */ + put_device(private->all_drm_private[i]->dev); + } put_device(private->mutex_dev); } private->mtk_drm_bound =3D false; --=20 2.48.1 From nobody Thu Apr 10 23:23:22 2025 Received: from bali.collaboradmins.com (bali.collaboradmins.com [148.251.105.195]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id D5BF824BC01 for ; Thu, 3 Apr 2025 10:47:49 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=148.251.105.195 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1743677271; cv=none; b=Lzc9ni+9CHivb9UtYO7RY2ItSkKsh34B5FLsp3b2Ia9eBNin6ojDGsnEw52xZFll7DYcFvgTybQc0SAscXV6/WP9KgkRHiKAZpPfSlsGPlRTF+UTPCN6ChyHUIASkEetASgA+Bn1a3W/Q8zx/J+vKc9MGEH41R4b/IkpCqNxxXk= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1743677271; c=relaxed/simple; bh=TWhpXsnRrU8Z0PQfGt/PxD5Exp0UAhzfm4Mm0Yi7U8U=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=E1H7eKFIIpGVgwRWsnYzIhxMS3LKaN0d4SzbHMYB7XC1VuS0Jx02rPWsbxDRXWCHHgT9keCTGk3WJEfsC4XdArbUaOPOiUgw8DR6sSPSMqCko2Tb/e/AwvFRSsF+S3eTqCq0bA4KZFGALJw50zbm9PYyWqeD6nta3sLWSek6Wcg= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=collabora.com; spf=pass smtp.mailfrom=collabora.com; dkim=pass (2048-bit key) header.d=collabora.com header.i=@collabora.com header.b=CVelYyj9; arc=none smtp.client-ip=148.251.105.195 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=collabora.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=collabora.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=collabora.com header.i=@collabora.com header.b="CVelYyj9" DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=collabora.com; s=mail; t=1743677268; bh=TWhpXsnRrU8Z0PQfGt/PxD5Exp0UAhzfm4Mm0Yi7U8U=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=CVelYyj9o+ExGlw4lAPsLPSbcxpwkTm8dYgjCw4bu6ieJmPtAjF9oJGNOdAwH1FBx /X0U5zH5ff7Bgmm5QxNgmt6UoVoxcJvVkILr8S6Y6ZGqVTRWgryuzfPUfAv9lC8V6w l50EpR6V5fHqFBd05NhQaoCAhgv27U4XCq4yTYTPxqxXgUTaxJQ0KQv4Vff6R/kAs+ GYJZuQ5Db8GnZFu+IBpNJlunABdDOeDEHCr6QGOSWQ56fSxxM+gSbIMlg62NX+hAGg kTkxr2SKZDkACyKHzzgOIvkvXDqGffm6iJBmUKa5CKDYlb5jbeY32dH5z1qY2OR06t Xgg3tCBxUmHeA== Received: from IcarusMOD.eternityproject.eu (2-237-20-237.ip236.fastwebnet.it [2.237.20.237]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256) (No client certificate requested) (Authenticated sender: kholk11) by bali.collaboradmins.com (Postfix) with ESMTPSA id 284EF17E1034; Thu, 3 Apr 2025 12:47:47 +0200 (CEST) From: AngeloGioacchino Del Regno To: chunkuang.hu@kernel.org Cc: p.zabel@pengutronix.de, airlied@gmail.com, simona@ffwll.ch, matthias.bgg@gmail.com, angelogioacchino.delregno@collabora.com, nancy.lin@mediatek.com, ck.hu@mediatek.com, djkurtz@chromium.org, littlecvr@chromium.org, bibby.hsieh@mediatek.com, dri-devel@lists.freedesktop.org, linux-mediatek@lists.infradead.org, linux-kernel@vger.kernel.org, linux-arm-kernel@lists.infradead.org, wenst@chromium.org, kernel@collabora.com Subject: [PATCH v2 3/5] drm/mediatek: mtk_drm_drv: Unbind secondary mmsys components on err Date: Thu, 3 Apr 2025 12:47:39 +0200 Message-ID: <20250403104741.71045-4-angelogioacchino.delregno@collabora.com> X-Mailer: git-send-email 2.48.1 In-Reply-To: <20250403104741.71045-1-angelogioacchino.delregno@collabora.com> References: <20250403104741.71045-1-angelogioacchino.delregno@collabora.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" When calling component_bind_all(), if a component that is included in the list fails, all of those that have been successfully bound will be unbound, but this driver has two components lists for two actual devices, as in, each mmsys instance has its own components list. In case mmsys0 (or actually vdosys0) is able to bind all of its components, but the secondary one fails, all of the components of the first are kept bound, while the ones of mmsys1/vdosys1 are correctly cleaned up. This is not right because, in case of a failure, the components are re-bound for all of the mmsys/vdosys instances without caring about the ones that were previously left in a bound state. Fix that by calling component_unbind_all() on all of the previous component masters that succeeded binding all subdevices when any of the other masters errors out. Fixes: 1ef7ed48356c ("drm/mediatek: Modify mediatek-drm for mt8195 multi mm= sys support") Reviewed-by: Chen-Yu Tsai Link: https://lore.kernel.org/r/20250402083628.20111-4-angelogioacchino.del= regno@collabora.com Signed-off-by: AngeloGioacchino Del Regno --- drivers/gpu/drm/mediatek/mtk_drm_drv.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/drivers/gpu/drm/mediatek/mtk_drm_drv.c b/drivers/gpu/drm/media= tek/mtk_drm_drv.c index 6b31df587507..2d6562b29755 100644 --- a/drivers/gpu/drm/mediatek/mtk_drm_drv.c +++ b/drivers/gpu/drm/mediatek/mtk_drm_drv.c @@ -482,8 +482,11 @@ static int mtk_drm_kms_init(struct drm_device *drm) for (i =3D 0; i < private->data->mmsys_dev_num; i++) { drm->dev_private =3D private->all_drm_private[i]; ret =3D component_bind_all(private->all_drm_private[i]->dev, drm); - if (ret) + if (ret) { + while (--i >=3D 0) + component_unbind_all(private->all_drm_private[i]->dev, drm); return ret; + } } =20 /* --=20 2.48.1 From nobody Thu Apr 10 23:23:22 2025 Received: from bali.collaboradmins.com (bali.collaboradmins.com [148.251.105.195]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 189C324BD0C for ; Thu, 3 Apr 2025 10:47:50 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=148.251.105.195 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1743677272; cv=none; b=YfPhRaVcfRbB1pzybm85rfN3EvLjobz+hiI9dneAIPE6hY64SDiZZE5WOe03lp53THLYnrnY0RdM1QVzAGaAFLNIXvpJJrD+L2IqMB9x+QU0r8U8kJ3PpZsTv/gPyVX5hpYVmHYKDpR2UNhpBMZxp8q1KVOPXgZxuD8+1zJOQQU= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1743677272; c=relaxed/simple; bh=hqOJ5Kz8YhGSoWTaIpp84R16eCUbWGlkQG1L8iZgVmI=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=dKr/PkRTiXyJekhSQqr4ToBprzqMppkIgO/YdZ+X4nxR9Sn2HeK/+Ouq3AnpL2K9i7i8KZD9ScB+uVM7+kJLSH2SsVFH2nMxk0WBAz1mREYlEFAe02Z3+RxTss/hZDuLywe5Xppia+0sN9Y/lSHqGdkF+QZAEAVNEEe9sEGG/SE= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=collabora.com; spf=pass smtp.mailfrom=collabora.com; dkim=pass (2048-bit key) header.d=collabora.com header.i=@collabora.com header.b=DVikaTVm; arc=none smtp.client-ip=148.251.105.195 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=collabora.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=collabora.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=collabora.com header.i=@collabora.com header.b="DVikaTVm" DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=collabora.com; s=mail; t=1743677269; bh=hqOJ5Kz8YhGSoWTaIpp84R16eCUbWGlkQG1L8iZgVmI=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=DVikaTVmFfz6be3Zp7wE4SI3jAj0VVsFoAJ1VGqSCIzUzqcJjFu7nYYkTHAKR8ZTx MMbjxu84+OW5xkY3BOfOwbgtcJ65+ZLuQQIZ/ODcQ9C084/LrD4mQ+hI0Yc6PaU7UI aBW0h8z69CwnOGcRV+ih+Zig6PbPB50EWHLH9rQmQgE7nNQdmbFEHNUHOlrnALnZq+ YAQsIx1s4MrDM5asIZHP0qEooji1MlbSaePEac0KiMmeIVV+J0vGQnXu1oaPVNTNg8 fle8ClfUigNUC9oWZma4i06DYbPPMj944o+yfOIy26+7HYk6NWCXyyMF9eY/gjNUXK FihT4UK0EoCjw== Received: from IcarusMOD.eternityproject.eu (2-237-20-237.ip236.fastwebnet.it [2.237.20.237]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256) (No client certificate requested) (Authenticated sender: kholk11) by bali.collaboradmins.com (Postfix) with ESMTPSA id 5826C17E105F; Thu, 3 Apr 2025 12:47:48 +0200 (CEST) From: AngeloGioacchino Del Regno To: chunkuang.hu@kernel.org Cc: p.zabel@pengutronix.de, airlied@gmail.com, simona@ffwll.ch, matthias.bgg@gmail.com, angelogioacchino.delregno@collabora.com, nancy.lin@mediatek.com, ck.hu@mediatek.com, djkurtz@chromium.org, littlecvr@chromium.org, bibby.hsieh@mediatek.com, dri-devel@lists.freedesktop.org, linux-mediatek@lists.infradead.org, linux-kernel@vger.kernel.org, linux-arm-kernel@lists.infradead.org, wenst@chromium.org, kernel@collabora.com Subject: [PATCH v2 4/5] drm/mediatek: mtk_disp_ovl: Enable/disable interrupt on bind/unbind Date: Thu, 3 Apr 2025 12:47:40 +0200 Message-ID: <20250403104741.71045-5-angelogioacchino.delregno@collabora.com> X-Mailer: git-send-email 2.48.1 In-Reply-To: <20250403104741.71045-1-angelogioacchino.delregno@collabora.com> References: <20250403104741.71045-1-angelogioacchino.delregno@collabora.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" The OVL driver is installing an ISR in the probe function but, if the component is not bound yet, the interrupt handler may call the vblank_cb ahead of time (while probing other drivers) or too late (while removing other drivers), possibly accessing memory that it should not try to access by reusing stale pointers. In order to fix this, add a new `irq` member to struct mtk_disp_ovl and then add the IRQF_NO_AUTOEN flag to the irq while installing the ISR to manually call enable_irq() and disable_irq() in the bind and unbind callbacks respectively. Note that since IRQF_TRIGGER_NONE is effectively 0 and doing nothing this (fake) flag was dropped. Fixes: 119f5173628a ("drm/mediatek: Add DRM Driver for Mediatek SoC MT8173.= ") Link: https://lore.kernel.org/r/20250402083628.20111-5-angelogioacchino.del= regno@collabora.com Signed-off-by: AngeloGioacchino Del Regno --- drivers/gpu/drm/mediatek/mtk_disp_ovl.c | 20 +++++++++++++------- 1 file changed, 13 insertions(+), 7 deletions(-) diff --git a/drivers/gpu/drm/mediatek/mtk_disp_ovl.c b/drivers/gpu/drm/medi= atek/mtk_disp_ovl.c index df82cea4bb79..4d42cb3fee15 100644 --- a/drivers/gpu/drm/mediatek/mtk_disp_ovl.c +++ b/drivers/gpu/drm/mediatek/mtk_disp_ovl.c @@ -161,6 +161,7 @@ struct mtk_disp_ovl { struct drm_crtc *crtc; struct clk *clk; void __iomem *regs; + int irq; struct cmdq_client_reg cmdq_reg; const struct mtk_disp_ovl_data *data; void (*vblank_cb)(void *data); @@ -587,12 +588,18 @@ void mtk_ovl_bgclr_in_off(struct device *dev) static int mtk_disp_ovl_bind(struct device *dev, struct device *master, void *data) { + struct mtk_disp_ovl *priv =3D dev_get_drvdata(dev); + + enable_irq(priv->irq); return 0; } =20 static void mtk_disp_ovl_unbind(struct device *dev, struct device *master, void *data) { + struct mtk_disp_ovl *priv =3D dev_get_drvdata(dev); + + disable_irq(priv->irq); } =20 static const struct component_ops mtk_disp_ovl_component_ops =3D { @@ -605,16 +612,15 @@ static int mtk_disp_ovl_probe(struct platform_device = *pdev) struct device *dev =3D &pdev->dev; struct mtk_disp_ovl *priv; struct resource *res; - int irq; int ret; =20 priv =3D devm_kzalloc(dev, sizeof(*priv), GFP_KERNEL); if (!priv) return -ENOMEM; =20 - irq =3D platform_get_irq(pdev, 0); - if (irq < 0) - return irq; + priv->irq =3D platform_get_irq(pdev, 0); + if (priv->irq < 0) + return priv->irq; =20 priv->clk =3D devm_clk_get(dev, NULL); if (IS_ERR(priv->clk)) @@ -635,10 +641,10 @@ static int mtk_disp_ovl_probe(struct platform_device = *pdev) priv->data =3D of_device_get_match_data(dev); platform_set_drvdata(pdev, priv); =20 - ret =3D devm_request_irq(dev, irq, mtk_disp_ovl_irq_handler, - IRQF_TRIGGER_NONE, dev_name(dev), priv); + ret =3D devm_request_irq(dev, priv->irq, mtk_disp_ovl_irq_handler, + IRQF_NO_AUTOEN, dev_name(dev), priv); if (ret < 0) - return dev_err_probe(dev, ret, "Failed to request irq %d\n", irq); + return dev_err_probe(dev, ret, "Failed to request irq %d\n", priv->irq); =20 pm_runtime_enable(dev); =20 --=20 2.48.1 From nobody Thu Apr 10 23:23:22 2025 Received: from bali.collaboradmins.com (bali.collaboradmins.com [148.251.105.195]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id F063624C07C for ; Thu, 3 Apr 2025 10:47:51 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=148.251.105.195 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1743677273; cv=none; b=qu9G+uInc9qUbalpTzDKWGUFOTGA3ApP4FXsQE4xixApTmPEx9fNvHmn5a8shuJM4oE3TK4p8LPh2dgLPCIkhfUB+PmNwsAZYnAsjs/VnuAE5bFwwclLZsIw1BdiUDVH2Y89FqaS3QNVDcWZ8lbPkganbqXKjJ+XGR5BC38pwWs= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1743677273; c=relaxed/simple; bh=x1wtdufQF5A9ff40c172tRf7AZns8UAMMhQfqRaFnN4=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=VRx1NNDxv3Ukw/dEWGYYm8WQRDDwi/rIKxpyf3/ZTzErJmIeGBbEOj2aUiCz1eb84g00i+55F5gmcY7jENZYexlglQEVHU1DN6iiNEnuEto//Tqw4VjAHV/qAIhmkO0HYsEtoDvW50OmiRjrSQsrdqbsVZj4XjJBT37MehiNBeg= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=collabora.com; spf=pass smtp.mailfrom=collabora.com; dkim=pass (2048-bit key) header.d=collabora.com header.i=@collabora.com header.b=nsp7uBpe; arc=none smtp.client-ip=148.251.105.195 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=collabora.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=collabora.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=collabora.com header.i=@collabora.com header.b="nsp7uBpe" DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=collabora.com; s=mail; t=1743677270; bh=x1wtdufQF5A9ff40c172tRf7AZns8UAMMhQfqRaFnN4=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=nsp7uBpe5gwRIweVut4tJQ7obUSye6hB0kimMKqule2r8ctO9aEO+oMxU/x/nvHIu wZ/tOU0XABIePTkwo/gbBbUrUpxShlk+odCVU6ictUi4juIhyklynbntc4PmIhHKbG l9S2Y8NieIaXz8GDa+NkM9hv8EVrYyi6RDteJhOkbfZA24KhvctJO0Euip+K/JqlZc mH5r8gAeNo+gTO/g/4Oe/kXdjeDpnAn7cFSJP3JBbYCgoGACfKboqZHLXhM9BC9e7/ QDFBcOXynMHmQaFZHcg3r8NqpqmXnKhNFI/BOprB5DFcqsZgDEXDoxUiWSDNdLQmp2 /6eWTvhLoUmyw== Received: from IcarusMOD.eternityproject.eu (2-237-20-237.ip236.fastwebnet.it [2.237.20.237]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256) (No client certificate requested) (Authenticated sender: kholk11) by bali.collaboradmins.com (Postfix) with ESMTPSA id 89D8317E0702; Thu, 3 Apr 2025 12:47:49 +0200 (CEST) From: AngeloGioacchino Del Regno To: chunkuang.hu@kernel.org Cc: p.zabel@pengutronix.de, airlied@gmail.com, simona@ffwll.ch, matthias.bgg@gmail.com, angelogioacchino.delregno@collabora.com, nancy.lin@mediatek.com, ck.hu@mediatek.com, djkurtz@chromium.org, littlecvr@chromium.org, bibby.hsieh@mediatek.com, dri-devel@lists.freedesktop.org, linux-mediatek@lists.infradead.org, linux-kernel@vger.kernel.org, linux-arm-kernel@lists.infradead.org, wenst@chromium.org, kernel@collabora.com Subject: [PATCH v2 5/5] drm/mediatek: mtk_disp_rdma: Enable/disable interrupt on bind/unbind Date: Thu, 3 Apr 2025 12:47:41 +0200 Message-ID: <20250403104741.71045-6-angelogioacchino.delregno@collabora.com> X-Mailer: git-send-email 2.48.1 In-Reply-To: <20250403104741.71045-1-angelogioacchino.delregno@collabora.com> References: <20250403104741.71045-1-angelogioacchino.delregno@collabora.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" The RDMA driver is installing an ISR in the probe function but, if the component is not bound yet, the interrupt handler may call the vblank_cb ahead of time (while probing other drivers) or too late (while removing other drivers), possibly accessing memory that it should not try to access by reusing stale pointers. In order to fix this, like done in the OVL driver, add a new `irq` member to struct mtk_disp_ovl and then add the IRQF_NO_AUTOEN flag to the irq while installing the ISR to manually disable and clear the hwirqs with register writes, and enable_irq() and disable_irq() in the bind and unbind callbacks respectively. Also, the call to devm_request_irq() was moved after the platform data and drvdata assignment, but in this specific case it is just to make it cosmetically correct, as with this change the ISR will not execute until the component is bound, hence no dev_get_drvdata happens before that. Note that since IRQF_TRIGGER_NONE is effectively 0 and doing nothing this (fake) flag was dropped. Fixes: 119f5173628a ("drm/mediatek: Add DRM Driver for Mediatek SoC MT8173.= ") Link: https://lore.kernel.org/r/20250402083628.20111-6-angelogioacchino.del= regno@collabora.com Signed-off-by: AngeloGioacchino Del Regno --- drivers/gpu/drm/mediatek/mtk_disp_rdma.c | 34 ++++++++++++++---------- 1 file changed, 20 insertions(+), 14 deletions(-) diff --git a/drivers/gpu/drm/mediatek/mtk_disp_rdma.c b/drivers/gpu/drm/med= iatek/mtk_disp_rdma.c index bf47790e4d6b..c1bc1bbad86d 100644 --- a/drivers/gpu/drm/mediatek/mtk_disp_rdma.c +++ b/drivers/gpu/drm/mediatek/mtk_disp_rdma.c @@ -81,6 +81,7 @@ struct mtk_disp_rdma_data { struct mtk_disp_rdma { struct clk *clk; void __iomem *regs; + int irq; struct cmdq_client_reg cmdq_reg; const struct mtk_disp_rdma_data *data; void (*vblank_cb)(void *data); @@ -295,13 +296,23 @@ void mtk_rdma_layer_config(struct device *dev, unsign= ed int idx, static int mtk_disp_rdma_bind(struct device *dev, struct device *master, void *data) { - return 0; + struct mtk_disp_rdma *priv =3D dev_get_drvdata(dev); + + /* Disable and clear pending interrupts */ + writel(0x0, priv->regs + DISP_REG_RDMA_INT_ENABLE); + writel(0x0, priv->regs + DISP_REG_RDMA_INT_STATUS); + + enable_irq(priv->irq); =20 + return 0; } =20 static void mtk_disp_rdma_unbind(struct device *dev, struct device *master, void *data) { + struct mtk_disp_rdma *priv =3D dev_get_drvdata(dev); + + disable_irq(priv->irq); } =20 static const struct component_ops mtk_disp_rdma_component_ops =3D { @@ -314,16 +325,15 @@ static int mtk_disp_rdma_probe(struct platform_device= *pdev) struct device *dev =3D &pdev->dev; struct mtk_disp_rdma *priv; struct resource *res; - int irq; int ret; =20 priv =3D devm_kzalloc(dev, sizeof(*priv), GFP_KERNEL); if (!priv) return -ENOMEM; =20 - irq =3D platform_get_irq(pdev, 0); - if (irq < 0) - return irq; + priv->irq =3D platform_get_irq(pdev, 0); + if (priv->irq < 0) + return priv->irq; =20 priv->clk =3D devm_clk_get(dev, NULL); if (IS_ERR(priv->clk)) @@ -347,21 +357,17 @@ static int mtk_disp_rdma_probe(struct platform_device= *pdev) if (ret && (ret !=3D -EINVAL)) return dev_err_probe(dev, ret, "Failed to get rdma fifo size\n"); =20 - /* Disable and clear pending interrupts */ - writel(0x0, priv->regs + DISP_REG_RDMA_INT_ENABLE); - writel(0x0, priv->regs + DISP_REG_RDMA_INT_STATUS); - - ret =3D devm_request_irq(dev, irq, mtk_disp_rdma_irq_handler, - IRQF_TRIGGER_NONE, dev_name(dev), priv); - if (ret < 0) - return dev_err_probe(dev, ret, "Failed to request irq %d\n", irq); - priv->data =3D of_device_get_match_data(dev); =20 platform_set_drvdata(pdev, priv); =20 pm_runtime_enable(dev); =20 + ret =3D devm_request_irq(dev, priv->irq, mtk_disp_rdma_irq_handler, + IRQF_NO_AUTOEN, dev_name(dev), priv); + if (ret < 0) + return dev_err_probe(dev, ret, "Failed to request irq %d\n", priv->irq); + ret =3D component_add(dev, &mtk_disp_rdma_component_ops); if (ret) { pm_runtime_disable(dev); --=20 2.48.1