1. 01 Apr, 2021 1 commit
    • Stephen Boyd's avatar
      drm/msm: Set drvdata to NULL when msm_drm_init() fails · 5620b135
      Stephen Boyd authored
      We should set the platform device's driver data to NULL here so that
      code doesn't assume the struct drm_device pointer is valid when it could
      have been destroyed. The lifetime of this pointer is managed by a kref
      but when msm_drm_init() fails we call drm_dev_put() on the pointer which
      will free the pointer's memory. This driver uses the component model, so
      there's sort of two "probes" in this file, one for the platform device
      i.e. msm_pdev_probe() and one for the component i.e. msm_drm_bind(). The
      msm_drm_bind() code is using the platform device's driver data to store
      struct drm_device so the two functions are intertwined.
      
      This relationship becomes a problem for msm_pdev_shutdown() when it
      tests the NULL-ness of the pointer to see if it should call
      drm_atomic_helper_shutdown(). The NULL test is a proxy check for if the
      pointer has been freed by kref_put(). If the drm_device has been
      destroyed, then we shouldn't call the shutdown helper, and we know that
      is the case if msm_drm_init() failed, therefore set the driver data to
      NULL so that this pointer liveness is tracked properly.
      
      Fixes: 9d5cbf5f ("drm/msm: add shutdown support for display platform_driver")
      Cc: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
      Cc: Fabio Estevam <festevam@gmail.com>
      Cc: Krishna Manikandan <mkrishn@codeaurora.org>
      Signed-off-by: default avatarStephen Boyd <swboyd@chromium.org>
      Message-Id: <20210325212822.3663144-1-swboyd@chromium.org>
      Signed-off-by: default avatarRob Clark <robdclark@chromium.org>
      5620b135
  2. 23 Mar, 2021 1 commit
  3. 21 Mar, 2021 2 commits
    • Fabio Estevam's avatar
      drm/msm: Fix suspend/resume on i.MX5 · a9748134
      Fabio Estevam authored
      When putting iMX5 into suspend, the following flow is
      observed:
      
      [   70.023427] [<c07755f0>] (msm_atomic_commit_tail) from [<c06e7218>]
      (commit_tail+0x9c/0x18c)
      [   70.031890] [<c06e7218>] (commit_tail) from [<c0e2920c>]
      (drm_atomic_helper_commit+0x1a0/0x1d4)
      [   70.040627] [<c0e2920c>] (drm_atomic_helper_commit) from
      [<c06e74d4>] (drm_atomic_helper_disable_all+0x1c4/0x1d4)
      [   70.050913] [<c06e74d4>] (drm_atomic_helper_disable_all) from
      [<c0e2943c>] (drm_atomic_helper_suspend+0xb8/0x170)
      [   70.061198] [<c0e2943c>] (drm_atomic_helper_suspend) from
      [<c06e84bc>] (drm_mode_config_helper_suspend+0x24/0x58)
      
      In the i.MX5 case, priv->kms is not populated (as i.MX5 does not use any
      of the Qualcomm display controllers), causing a NULL pointer
      dereference in msm_atomic_commit_tail():
      
      [   24.268964] 8<--- cut here ---
      [   24.274602] Unable to handle kernel NULL pointer dereference at
      virtual address 00000000
      [   24.283434] pgd = (ptrval)
      [   24.286387] [00000000] *pgd=ca212831
      [   24.290788] Internal error: Oops: 17 [#1] SMP ARM
      [   24.295609] Modules linked in:
      [   24.298777] CPU: 0 PID: 197 Comm: init Not tainted 5.11.0-rc2-next-20210111 #333
      [   24.306276] Hardware name: Freescale i.MX53 (Device Tree Support)
      [   24.312442] PC is at msm_atomic_commit_tail+0x54/0xb9c
      [   24.317743] LR is at commit_tail+0xa4/0x1b0
      
      Fix the problem by calling drm_mode_config_helper_suspend/resume()
      only when priv->kms is available.
      
      Fixes: ca8199f1 ("drm/msm/dpu: ensure device suspend happens during PM sleep")
      Signed-off-by: default avatarFabio Estevam <festevam@gmail.com>
      Signed-off-by: default avatarRob Clark <robdclark@chromium.org>
      a9748134
    • Dmitry Baryshkov's avatar
      drm/msm: fix shutdown hook in case GPU components failed to bind · 623f279c
      Dmitry Baryshkov authored
      If GPU components have failed to bind, shutdown callback would fail with
      the following backtrace. Add safeguard check to stop that oops from
      happening and allow the board to reboot.
      
      [   66.617046] Unable to handle kernel NULL pointer dereference at virtual address 0000000000000000
      [   66.626066] Mem abort info:
      [   66.628939]   ESR = 0x96000006
      [   66.632088]   EC = 0x25: DABT (current EL), IL = 32 bits
      [   66.637542]   SET = 0, FnV = 0
      [   66.640688]   EA = 0, S1PTW = 0
      [   66.643924] Data abort info:
      [   66.646889]   ISV = 0, ISS = 0x00000006
      [   66.650832]   CM = 0, WnR = 0
      [   66.653890] user pgtable: 4k pages, 48-bit VAs, pgdp=0000000107f81000
      [   66.660505] [0000000000000000] pgd=0000000100bb2003, p4d=0000000100bb2003, pud=0000000100897003, pmd=0000000000000000
      [   66.671398] Internal error: Oops: 96000006 [#1] PREEMPT SMP
      [   66.677115] Modules linked in:
      [   66.680261] CPU: 6 PID: 352 Comm: reboot Not tainted 5.11.0-rc2-00309-g79e3faa7 #38
      [   66.688473] Hardware name: Qualcomm Technologies, Inc. Robotics RB5 (DT)
      [   66.695347] pstate: 60400005 (nZCv daif +PAN -UAO -TCO BTYPE=--)
      [   66.701507] pc : msm_atomic_commit_tail+0x78/0x4e0
      [   66.706437] lr : commit_tail+0xa4/0x184
      [   66.710381] sp : ffff8000108f3af0
      [   66.713791] x29: ffff8000108f3af0 x28: ffff418c44337000
      [   66.719242] x27: 0000000000000000 x26: ffff418c40a24490
      [   66.724693] x25: ffffd3a842a4f1a0 x24: 0000000000000008
      [   66.730146] x23: ffffd3a84313f030 x22: ffff418c444ce000
      [   66.735598] x21: ffff418c408a4980 x20: 0000000000000000
      [   66.741049] x19: 0000000000000000 x18: ffff800010710fbc
      [   66.746500] x17: 000000000000000c x16: 0000000000000001
      [   66.751954] x15: 0000000000010008 x14: 0000000000000068
      [   66.757405] x13: 0000000000000001 x12: 0000000000000000
      [   66.762855] x11: 0000000000000001 x10: 00000000000009b0
      [   66.768306] x9 : ffffd3a843192000 x8 : ffff418c44337000
      [   66.773757] x7 : 0000000000000000 x6 : 00000000a401b34e
      [   66.779210] x5 : 00ffffffffffffff x4 : 0000000000000000
      [   66.784660] x3 : 0000000000000000 x2 : ffff418c444ce000
      [   66.790111] x1 : ffffd3a841dce530 x0 : ffff418c444cf000
      [   66.795563] Call trace:
      [   66.798075]  msm_atomic_commit_tail+0x78/0x4e0
      [   66.802633]  commit_tail+0xa4/0x184
      [   66.806217]  drm_atomic_helper_commit+0x160/0x390
      [   66.811051]  drm_atomic_commit+0x4c/0x60
      [   66.815082]  drm_atomic_helper_disable_all+0x1f4/0x210
      [   66.820355]  drm_atomic_helper_shutdown+0x80/0x130
      [   66.825276]  msm_pdev_shutdown+0x14/0x20
      [   66.829303]  platform_shutdown+0x28/0x40
      [   66.833330]  device_shutdown+0x158/0x330
      [   66.837357]  kernel_restart+0x40/0xa0
      [   66.841122]  __do_sys_reboot+0x228/0x250
      [   66.845148]  __arm64_sys_reboot+0x28/0x34
      [   66.849264]  el0_svc_common.constprop.0+0x74/0x190
      [   66.854187]  do_el0_svc+0x24/0x90
      [   66.857595]  el0_svc+0x14/0x20
      [   66.860739]  el0_sync_handler+0x1a4/0x1b0
      [   66.864858]  el0_sync+0x174/0x180
      [   66.868269] Code: 1ac020a0 2a000273 eb02007f 54ffff01 (f9400285)
      [   66.874525] ---[ end trace 20dedb2a3229fec8 ]---
      
      Fixes: 9d5cbf5f ("drm/msm: add shutdown support for display platform_driver")
      Signed-off-by: default avatarDmitry Baryshkov <dmitry.baryshkov@linaro.org>
      Signed-off-by: default avatarFabio Estevam <festevam@gmail.com>
      Signed-off-by: default avatarRob Clark <robdclark@chromium.org>
      623f279c
  4. 17 Mar, 2021 6 commits
  5. 27 Feb, 2021 1 commit
    • Douglas Anderson's avatar
      drm/msm: Fix speed-bin support not to access outside valid memory · 7bf168c8
      Douglas Anderson authored
      When running the latest kernel on an sc7180 with KASAN I got this
      splat:
        BUG: KASAN: slab-out-of-bounds in a6xx_gpu_init+0x618/0x644
        Read of size 4 at addr ffffff8088f36100 by task kworker/7:1/58
        CPU: 7 PID: 58 Comm: kworker/7:1 Not tainted 5.11.0+ #3
        Hardware name: Google Lazor (rev1 - 2) with LTE (DT)
        Workqueue: events deferred_probe_work_func
        Call trace:
         dump_backtrace+0x0/0x3a8
         show_stack+0x24/0x30
         dump_stack+0x174/0x1e0
         print_address_description+0x70/0x2e4
         kasan_report+0x178/0x1bc
         __asan_report_load4_noabort+0x44/0x50
         a6xx_gpu_init+0x618/0x644
         adreno_bind+0x26c/0x438
      
      This is because the speed bin is defined like this:
        gpu_speed_bin: gpu_speed_bin@1d2 {
          reg = <0x1d2 0x2>;
          bits = <5 8>;
        };
      
      As you can see the "length" is 2 bytes. That means that the nvmem
      subsystem allocates only 2 bytes. The GPU code, however, was casting
      the pointer allocated by nvmem to a (u32 *) and dereferencing. That's
      not so good.
      
      Let's fix this to just use the nvmem_cell_read_u16() accessor function
      which simplifies things and also gets rid of the splat.
      
      Let's also put an explicit conversion from little endian in place just
      to make things clear. The nvmem subsystem today is assuming little
      endian and this makes it clear. Specifically, the way the above sc7180
      cell is interpreted:
      
      NVMEM:
       +--------+--------+--------+--------+--------+
       | ...... | 0x1d3  | 0x1d2  | ...... | 0x000  |
       +--------+--------+--------+--------+--------+
                    ^       ^
                   msb     lsb
      
      You can see that the least significant data is at the lower address
      which is little endian.
      
      NOTE: someone who is truly paying attention might wonder about me
      picking the "u16" version of this accessor instead of the "u8" (since
      the value is 8 bits big) or the u32 version (just for fun). At the
      moment you need to pick the accessor that exactly matches the length
      the cell was specified as in the device tree. Hopefully future
      patches to the nvmem subsystem will fix this.
      
      Fixes: fe7952c6 ("drm/msm: Add speed-bin support to a618 gpu")
      Signed-off-by: default avatarDouglas Anderson <dianders@chromium.org>
      Signed-off-by: default avatarRob Clark <robdclark@chromium.org>
      7bf168c8
  6. 23 Feb, 2021 3 commits
  7. 07 Feb, 2021 1 commit
    • Stephen Boyd's avatar
      drm/msm/dp: Add a missing semi-colon · 182b4a2d
      Stephen Boyd authored
      A missing semicolon here causes my external display to stop working.
      Indeed, missing the semicolon on the return statement leads to
      dp_panel_update_tu_timings() not existing because the compiler thinks
      it's part of the return statement of a void function, so it must not be
      important.
      
        $ ./scripts/bloat-o-meter before.o after.o
        add/remove: 1/1 grow/shrink: 0/1 up/down: 7400/-7540 (-140)
        Function                                     old     new   delta
        dp_panel_update_tu_timings                     -    7400   +7400
        _dp_ctrl_calc_tu.constprop                 18024   17900    -124
        dp_panel_update_tu_timings.constprop        7416       -   -7416
        Total: Before=54440, After=54300, chg -0.26%
      
      Add a semicolon so this function works like it used to.
      
      Cc: Sean Paul <sean@poorly.run>
      Cc: Kuogee Hsieh <khsieh@codeaurora.org>
      Cc: linux-arm-msm@vger.kernel.org
      Cc: dri-devel@lists.freedesktop.org
      Cc: freedreno@lists.freedesktop.org
      Cc: Lee Jones <lee.jones@linaro.org>
      Fixes: cc9014bf ("drm/msm/dp/dp_ctrl: Move 'tu' from the stack to the heap")
      Signed-off-by: default avatarStephen Boyd <swboyd@chromium.org>
      Signed-off-by: default avatarRob Clark <robdclark@chromium.org>
      182b4a2d
  8. 06 Feb, 2021 1 commit
  9. 05 Feb, 2021 2 commits
  10. 04 Feb, 2021 1 commit
  11. 01 Feb, 2021 4 commits
  12. 31 Jan, 2021 17 commits