From patchwork Fri Sep 9 15:28:56 2022 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Fabien Parent X-Patchwork-Id: 12971941 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id A978DECAAD3 for ; Fri, 9 Sep 2022 15:30:03 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S229478AbiIIPaB (ORCPT ); Fri, 9 Sep 2022 11:30:01 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:33054 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S231638AbiIIP36 (ORCPT ); Fri, 9 Sep 2022 11:29:58 -0400 Received: from mail-wr1-x430.google.com (mail-wr1-x430.google.com [IPv6:2a00:1450:4864:20::430]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 4F3236550 for ; Fri, 9 Sep 2022 08:29:22 -0700 (PDT) Received: by mail-wr1-x430.google.com with SMTP id t14so3360683wrx.8 for ; Fri, 09 Sep 2022 08:29:22 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linaro.org; s=google; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:from:to:cc:subject:date; bh=x5KrfZMUqk39SoEPHLkAPrMFfPRI1D3FajlqzTwrI2w=; b=oSYpl/Gb1s9dRqBo3A5bgCA72v4jIqY5p2bmNk/vF4s4Z3Ej+MlZWJsUyTGVNwZ/yL 80TFASgEwfo3yvcFMYRdBstqzyu3kpN57pNe+DqjU8T1t5aIe6g+UheTJwf4quTfGohg dIECs/DMEDAnA6Z/89eBhe+EPGIjU3BGLmeGSbWEHr/afbL8jo2GOosPz7te/ia1zXqc ViZLMeW/bckHzNGye3KqZHyv26ATnWeXHJ9RDz7Ar1pQyEhVa1XXJ98OQvOJ2T5Y8pRs 005yXvVrRb7ofk+0Y56L42BjxJn4xzM7xbGKTY9PgS/MXHUxNbbPkdkU5aut49H1VH18 fRgg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20210112; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:x-gm-message-state:from:to:cc:subject:date; bh=x5KrfZMUqk39SoEPHLkAPrMFfPRI1D3FajlqzTwrI2w=; b=RF2NIvgqk7TBbFUjpkpo+UiVFOW0xygNUibGUDgwcJodv4Ns6KOeL6RvTUJs9CClac OkebRsvBpgXxS6tXmrebqvMduswLWjR4iy4VrZtRQhgXdJFqgq8ZUp99tLvPw64XKfXW Pe+7II6u+ZnBbrQfLw1uX2m4qYQqjXESEZCKhEfZ2q86oEFLWnO8dO8ilko342Ev4+4z 5ZeoQ+Dwt9iXDJLt2EohtEc2xupZ9Jbq083YdBaTY/TZ7zXWZ4k3bTe70tth5HvnIPHK nZfTGP7ejNkdqwa9w56fTae06D1WvOQPjSG9xakgDXI4QGppkPCdnElx7W34mJ3cNU+V Aj7w== X-Gm-Message-State: ACgBeo1LDj4WsAmrZBZ8d0JmoGH2Dxoch5V3aVYcvRnNTWAFHmXroYus HuohIfoI2eFMb5YmqsSRTM71Dg== X-Google-Smtp-Source: AA6agR6wb87riPAljaE4mS1gw1MnP9z5tVpez/1x2jPhB3Ig+9QVEo4MAY76WVxvchFw/nzKIBqD1w== X-Received: by 2002:a5d:6481:0:b0:228:dc1f:4f95 with SMTP id o1-20020a5d6481000000b00228dc1f4f95mr8415352wri.298.1662737351151; Fri, 09 Sep 2022 08:29:11 -0700 (PDT) Received: from radium.lan ([88.160.162.107]) by smtp.gmail.com with ESMTPSA id o12-20020a5d4a8c000000b002285f73f11dsm956931wrq.81.2022.09.09.08.29.09 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Fri, 09 Sep 2022 08:29:10 -0700 (PDT) From: Fabien Parent To: robdclark@gmail.com, quic_abhinavk@quicinc.com, dmitry.baryshkov@linaro.org Cc: airlied@linux.ie, daniel@ffwll.ch, dianders@chromium.org, linux-arm-msm@vger.kernel.org, dri-devel@lists.freedesktop.org, freedreno@lists.freedesktop.org, linux-kernel@vger.kernel.org, Fabien Parent Subject: [PATCH] drm/msm/mdp5: fix kernel panic during shutdown Date: Fri, 9 Sep 2022 17:28:56 +0200 Message-Id: <20220909152856.149291-1-fabien.parent@linaro.org> X-Mailer: git-send-email 2.37.2 MIME-Version: 1.0 Precedence: bulk List-ID: X-Mailing-List: linux-arm-msm@vger.kernel.org The kernel is panicking when rebooting on MSM8939: # reboot -f [ 87.280853] Unable to handle kernel write to read-only memory at virtual address ffff800008ed5810 ... snip ... [ 87.445142] Call trace: [ 87.452253] mutex_lock+0x1c/0x50 [ 87.454511] msm_drv_shutdown+0x28/0x40 [ 87.457984] platform_shutdown+0x28/0x40 [ 87.461629] device_shutdown+0x14c/0x240 [ 87.465796] __do_sys_reboot+0x180/0x274 [ 87.469703] __arm64_sys_reboot+0x28/0x3c [ 87.473608] invoke_syscall+0x54/0x124 [ 87.477515] el0_svc_common.constprop.0+0x44/0xec [ 87.481163] do_el0_svc+0x90/0xe0 [ 87.485934] el0_svc+0x50/0xa4 [ 87.489232] el0t_64_sync_handler+0x11c/0x150 [ 87.492185] el0t_64_sync+0x190/0x194 [ 87.496618] Code: f9800011 c85ffc03 ca010064 b5000064 (c8047c02) [ 87.500264] ---[ end trace 0000000000000000 ]--- Segmentation fault The issue comes from the fact that mdp5_init() is calling platform_set_drvdata() and consequently overwriting the driver data previously set by msm_drv_probe. msm_drv_shutdown was casting the driver data as "struct msm_drm_private" while it was actually a "struct mdp5_kms". This commit fixes the issue by having mdp5_init() not override the platform driver data, and instead use a series of to_mdp5_kms(to_mdp_kms(priv->kms)) to retrieve the mdp5_kms from the pdata. Fixes: 54199009958f ("drm/msm: Fix shutdown") Signed-off-by: Fabien Parent --- drivers/gpu/drm/msm/disp/mdp5/mdp5_kms.c | 18 +++++++++++------- 1 file changed, 11 insertions(+), 7 deletions(-) diff --git a/drivers/gpu/drm/msm/disp/mdp5/mdp5_kms.c b/drivers/gpu/drm/msm/disp/mdp5/mdp5_kms.c index d2a48caf9d27..17aeabeedfeb 100644 --- a/drivers/gpu/drm/msm/disp/mdp5/mdp5_kms.c +++ b/drivers/gpu/drm/msm/disp/mdp5/mdp5_kms.c @@ -634,7 +634,8 @@ static int mdp5_kms_init(struct drm_device *dev) static void mdp5_destroy(struct platform_device *pdev) { - struct mdp5_kms *mdp5_kms = platform_get_drvdata(pdev); + struct msm_drm_private *priv = platform_get_drvdata(pdev); + struct mdp5_kms *mdp5_kms = to_mdp5_kms(to_mdp_kms(priv->kms)); int i; if (mdp5_kms->ctlm) @@ -797,7 +798,8 @@ static int mdp5_init(struct platform_device *pdev, struct drm_device *dev) goto fail; } - platform_set_drvdata(pdev, mdp5_kms); + /* set uninit-ed kms */ + priv->kms = &mdp5_kms->base.base; spin_lock_init(&mdp5_kms->resource_lock); @@ -890,13 +892,13 @@ static int mdp5_init(struct platform_device *pdev, struct drm_device *dev) if (ret) goto fail; - /* set uninit-ed kms */ - priv->kms = &mdp5_kms->base.base; - return 0; fail: if (mdp5_kms) mdp5_destroy(pdev); + + priv->kms = NULL; + return ret; } @@ -956,7 +958,8 @@ static int mdp5_dev_remove(struct platform_device *pdev) static __maybe_unused int mdp5_runtime_suspend(struct device *dev) { struct platform_device *pdev = to_platform_device(dev); - struct mdp5_kms *mdp5_kms = platform_get_drvdata(pdev); + struct msm_drm_private *priv = platform_get_drvdata(pdev); + struct mdp5_kms *mdp5_kms = to_mdp5_kms(to_mdp_kms(priv->kms)); DBG(""); @@ -966,7 +969,8 @@ static __maybe_unused int mdp5_runtime_suspend(struct device *dev) static __maybe_unused int mdp5_runtime_resume(struct device *dev) { struct platform_device *pdev = to_platform_device(dev); - struct mdp5_kms *mdp5_kms = platform_get_drvdata(pdev); + struct msm_drm_private *priv = platform_get_drvdata(pdev); + struct mdp5_kms *mdp5_kms = to_mdp5_kms(to_mdp_kms(priv->kms)); DBG("");