From patchwork Fri Aug 26 14:19:27 2022 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Andrzej Hajda X-Patchwork-Id: 12956072 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from gabe.freedesktop.org (gabe.freedesktop.org [131.252.210.177]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.lore.kernel.org (Postfix) with ESMTPS id CBFBEECAAA3 for ; Fri, 26 Aug 2022 14:20:21 +0000 (UTC) Received: from gabe.freedesktop.org (localhost [127.0.0.1]) by gabe.freedesktop.org (Postfix) with ESMTP id 55DE010E933; Fri, 26 Aug 2022 14:20:09 +0000 (UTC) Received: from mga02.intel.com (mga02.intel.com [134.134.136.20]) by gabe.freedesktop.org (Postfix) with ESMTPS id DB26D10E927; Fri, 26 Aug 2022 14:19:50 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=intel.com; i=@intel.com; q=dns/txt; s=Intel; t=1661523590; x=1693059590; h=from:to:cc:subject:date:message-id:in-reply-to: references:mime-version:content-transfer-encoding; bh=c+pXcbsPx/rMzdeWU+Wdyx39q2fdykDrG2BhCL1DuEc=; b=STkbRpvXHaTMiOGD9XMWc1s5ZzMyyJgVcSqzDqP3+giRok9DCStux6H9 DslMZV2d/QKecqAOJxzXAFN7bZsR1OSUt+vzJlA+JofHjnQjgI0f5uydO ILsyOM5cG7yYIzcQp/E2MznmB1ncQGg1rSqk7Z3blebcgZoDCkxG3U/UB JiOYh0go1q/nP5p6J4uZWTRikOw9pDyhpQgRBZCAGA+GmYzArYAsWKeZW wL9blf9p/SdZgi8PocBdGeJRxR7KdGI0mMmFcunTgbBRizZvUHe/lWNcV 6huXQpu9QLckZqAY/E3kSlbJeHcjMPRkVHIg5oYnlA8jtbq4qEFe7wBfP g==; X-IronPort-AV: E=McAfee;i="6500,9779,10451"; a="281485729" X-IronPort-AV: E=Sophos;i="5.93,265,1654585200"; d="scan'208";a="281485729" Received: from orsmga006.jf.intel.com ([10.7.209.51]) by orsmga101.jf.intel.com with ESMTP/TLS/ECDHE-RSA-AES256-GCM-SHA384; 26 Aug 2022 07:19:50 -0700 X-IronPort-AV: E=Sophos;i="5.93,265,1654585200"; d="scan'208";a="587313659" Received: from lab-ah.igk.intel.com ([10.91.215.196]) by orsmga006-auth.jf.intel.com with ESMTP/TLS/ECDHE-RSA-AES256-GCM-SHA384; 26 Aug 2022 07:19:47 -0700 From: Andrzej Hajda To: Jani Nikula , =?utf-8?b?VmlsbGUgU3lyasOk?= =?utf-8?b?bMOk?= , Arun R Murthy , Imre Deak Subject: [PATCH v7 1/3] drm/i915/hpd: suspend MST at the end of intel_modeset_driver_remove Date: Fri, 26 Aug 2022 16:19:27 +0200 Message-Id: <20220826141929.189681-2-andrzej.hajda@intel.com> X-Mailer: git-send-email 2.25.1 In-Reply-To: <20220826141929.189681-1-andrzej.hajda@intel.com> References: <20220826141929.189681-1-andrzej.hajda@intel.com> MIME-Version: 1.0 Organization: Intel Technology Poland sp. z o.o. - ul. Slowackiego 173, 80-298 Gdansk - KRS 101882 - NIP 957-07-52-316 X-BeenThere: dri-devel@lists.freedesktop.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Direct Rendering Infrastructure - Development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Cc: Tvrtko Ursulin , Andrzej Hajda , intel-gfx@lists.freedesktop.org, dri-devel@lists.freedesktop.org, Rodrigo Vivi Errors-To: dri-devel-bounces@lists.freedesktop.org Sender: "dri-devel" i915->hotplug.dig_port_work can be queued from intel_hpd_irq_handler called by IRQ handler or by intel_hpd_trigger_irq called from dp_mst. Since dp_mst is suspended after irq handler uninstall, a cleaner approach is to cancel hpd work after intel_dp_mst_suspend, otherwise we risk use-after-free. It should fix following WARNINGS: [283.405824] cpu_latency_qos_update_request called for unknown object [283.405866] WARNING: CPU: 2 PID: 240 at kernel/power/qos.c:296 cpu_latency_qos_update_request+0x2d/0x100 [283.405912] CPU: 2 PID: 240 Comm: kworker/u64:9 Not tainted 5.18.0-rc6-Patchwork_103738v3-g1672d1c43e43+ #1 [283.405915] Hardware name: Intel Corporation Raptor Lake Client Platform/RPL-S ADP-S DDR5 UDIMM CRB, BIOS RPLSFWI1.R00.2397.A01.2109300731 09/30/2021 [283.405916] Workqueue: i915-dp i915_digport_work_func [i915] [283.406020] RIP: 0010:cpu_latency_qos_update_request+0x2d/0x100 ... [283.406040] Call Trace: [283.406041] [283.406044] intel_dp_aux_xfer+0x60e/0x8e0 [i915] [283.406131] ? finish_swait+0x80/0x80 [283.406139] intel_dp_aux_transfer+0xc5/0x2b0 [i915] [283.406218] drm_dp_dpcd_access+0x79/0x130 [drm_display_helper] [283.406227] drm_dp_dpcd_read+0xe2/0xf0 [drm_display_helper] [283.406233] intel_dp_hpd_pulse+0x134/0x570 [i915] [283.406308] ? __down_killable+0x70/0x140 [283.406313] i915_digport_work_func+0xba/0x150 [i915] Closes: https://gitlab.freedesktop.org/drm/intel/-/issues/4586 Closes: https://gitlab.freedesktop.org/drm/intel/-/issues/5558 Signed-off-by: Andrzej Hajda Reviewed-by: Arun R Murthy Reviewed-by: Imre Deak --- drivers/gpu/drm/i915/display/intel_display.c | 14 +++++++------- 1 file changed, 7 insertions(+), 7 deletions(-) diff --git a/drivers/gpu/drm/i915/display/intel_display.c b/drivers/gpu/drm/i915/display/intel_display.c index a0f84cbe974fc3..524c4580ae6bc9 100644 --- a/drivers/gpu/drm/i915/display/intel_display.c +++ b/drivers/gpu/drm/i915/display/intel_display.c @@ -9000,6 +9000,13 @@ void intel_modeset_driver_remove(struct drm_i915_private *i915) flush_work(&i915->atomic_helper.free_work); drm_WARN_ON(&i915->drm, !llist_empty(&i915->atomic_helper.free_list)); + + /* + * MST topology needs to be suspended so we don't have any calls to + * fbdev after it's finalized. MST will be destroyed later as part of + * drm_mode_config_cleanup() + */ + intel_dp_mst_suspend(i915); } /* part #2: call after irq uninstall */ @@ -9014,13 +9021,6 @@ void intel_modeset_driver_remove_noirq(struct drm_i915_private *i915) */ intel_hpd_poll_fini(i915); - /* - * MST topology needs to be suspended so we don't have any calls to - * fbdev after it's finalized. MST will be destroyed later as part of - * drm_mode_config_cleanup() - */ - intel_dp_mst_suspend(i915); - /* poll work can call into fbdev, hence clean that up afterwards */ intel_fbdev_fini(i915); From patchwork Fri Aug 26 14:19:28 2022 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Andrzej Hajda X-Patchwork-Id: 12956073 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from gabe.freedesktop.org (gabe.freedesktop.org [131.252.210.177]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.lore.kernel.org (Postfix) with ESMTPS id B4931ECAAD4 for ; Fri, 26 Aug 2022 14:20:27 +0000 (UTC) Received: from gabe.freedesktop.org (localhost [127.0.0.1]) by gabe.freedesktop.org (Postfix) with ESMTP id 16AD410E93B; Fri, 26 Aug 2022 14:20:12 +0000 (UTC) Received: from mga02.intel.com (mga02.intel.com [134.134.136.20]) by gabe.freedesktop.org (Postfix) with ESMTPS id 7C63210E928; Fri, 26 Aug 2022 14:19:53 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=intel.com; i=@intel.com; q=dns/txt; s=Intel; t=1661523593; x=1693059593; h=from:to:cc:subject:date:message-id:in-reply-to: references:mime-version:content-transfer-encoding; bh=4u8UcdUnSUTqOK5gPr0VsPZIYWCrrxhDPAInuAqR8T0=; b=L29F6a/ithx3lZmt0C8DwKer1c9dFerO+hJyBkNOpfLiAjAGqpLAfkDL pa2ol2FBx0uzSlA/9ElOnufCkuqYpU4EzYJxUbQM7T/3jLkTM3X8/VvRS sqL2FOJCq0CRkUzKC8ZqQrUD6h5r8+Xelmvyo2STaN/L21Jy1FPgjjASS zrefUd6JjgsaxYwcjS2zgO7xriO/o+se0ARTMmAInuL2zfSPzEiqgllck v/bvKOofUNSHKNphZcLWEGiFZHfPSX72uCoxNtI3j6LY+CU1somrGEq35 D7fdFscWaeKxDaXI3nNllZHWJyunREo4JOgK2dfU7hVzggpeVvFzBr/Nf w==; X-IronPort-AV: E=McAfee;i="6500,9779,10451"; a="281485751" X-IronPort-AV: E=Sophos;i="5.93,265,1654585200"; d="scan'208";a="281485751" Received: from orsmga006.jf.intel.com ([10.7.209.51]) by orsmga101.jf.intel.com with ESMTP/TLS/ECDHE-RSA-AES256-GCM-SHA384; 26 Aug 2022 07:19:53 -0700 X-IronPort-AV: E=Sophos;i="5.93,265,1654585200"; d="scan'208";a="587313687" Received: from lab-ah.igk.intel.com ([10.91.215.196]) by orsmga006-auth.jf.intel.com with ESMTP/TLS/ECDHE-RSA-AES256-GCM-SHA384; 26 Aug 2022 07:19:50 -0700 From: Andrzej Hajda To: Jani Nikula , =?utf-8?b?VmlsbGUgU3lyasOk?= =?utf-8?b?bMOk?= , Arun R Murthy , Imre Deak Subject: [PATCH v7 2/3] drm/i915/fbdev: suspend HPD before fbdev unregistration Date: Fri, 26 Aug 2022 16:19:28 +0200 Message-Id: <20220826141929.189681-3-andrzej.hajda@intel.com> X-Mailer: git-send-email 2.25.1 In-Reply-To: <20220826141929.189681-1-andrzej.hajda@intel.com> References: <20220826141929.189681-1-andrzej.hajda@intel.com> MIME-Version: 1.0 Organization: Intel Technology Poland sp. z o.o. - ul. Slowackiego 173, 80-298 Gdansk - KRS 101882 - NIP 957-07-52-316 X-BeenThere: dri-devel@lists.freedesktop.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Direct Rendering Infrastructure - Development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Cc: Tvrtko Ursulin , Andrzej Hajda , intel-gfx@lists.freedesktop.org, dri-devel@lists.freedesktop.org, Rodrigo Vivi Errors-To: dri-devel-bounces@lists.freedesktop.org Sender: "dri-devel" HPD event after fbdev unregistration can cause registration of deferred fbdev which will not be unregistered later, causing use-after-free. To avoid it HPD handling should be suspended before fbdev unregistration. It should fix following GPF: [272.634530] general protection fault, probably for non-canonical address 0x6b6b6b6b6b6b6b6b: 0000 [#1] PREEMPT SMP NOPTI [272.634536] CPU: 0 PID: 6030 Comm: i915_selftest Tainted: G U 5.18.0-rc5-CI_DRM_11603-g12dccf4f5eef+ #1 [272.634541] Hardware name: Intel Corporation Raptor Lake Client Platform/RPL-S ADP-S DDR5 UDIMM CRB, BIOS RPLSFWI1.R00.2397.A01.2109300731 09/30/2021 [272.634545] RIP: 0010:fb_do_apertures_overlap.part.14+0x26/0x60 ... [272.634582] Call Trace: [272.634583] [272.634585] do_remove_conflicting_framebuffers+0x59/0xa0 [272.634589] remove_conflicting_framebuffers+0x2d/0xc0 [272.634592] remove_conflicting_pci_framebuffers+0xc8/0x110 [272.634595] drm_aperture_remove_conflicting_pci_framebuffers+0x52/0x70 [272.634604] i915_driver_probe+0x63a/0xdd0 [i915] Closes: https://gitlab.freedesktop.org/drm/intel/-/issues/5329 Closes: https://gitlab.freedesktop.org/drm/intel/-/issues/5510 Signed-off-by: Andrzej Hajda Reviewed-by: Arun R Murthy Reviewed-by: Imre Deak --- drivers/gpu/drm/i915/display/intel_fbdev.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/drivers/gpu/drm/i915/display/intel_fbdev.c b/drivers/gpu/drm/i915/display/intel_fbdev.c index 221336178991f0..2903b9cfa0f834 100644 --- a/drivers/gpu/drm/i915/display/intel_fbdev.c +++ b/drivers/gpu/drm/i915/display/intel_fbdev.c @@ -573,7 +573,8 @@ void intel_fbdev_unregister(struct drm_i915_private *dev_priv) if (!ifbdev) return; - cancel_work_sync(&dev_priv->fbdev_suspend_work); + intel_fbdev_set_suspend(&dev_priv->drm, FBINFO_STATE_SUSPENDED, true); + if (!current_is_async()) intel_fbdev_sync(ifbdev); @@ -618,7 +619,7 @@ void intel_fbdev_set_suspend(struct drm_device *dev, int state, bool synchronous struct fb_info *info; if (!ifbdev || !ifbdev->vma) - return; + goto set_suspend; info = ifbdev->helper.fbdev; @@ -661,6 +662,7 @@ void intel_fbdev_set_suspend(struct drm_device *dev, int state, bool synchronous drm_fb_helper_set_suspend(&ifbdev->helper, state); console_unlock(); +set_suspend: intel_fbdev_hpd_set_suspend(dev_priv, state); } From patchwork Fri Aug 26 14:19:29 2022 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Andrzej Hajda X-Patchwork-Id: 12956071 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from gabe.freedesktop.org (gabe.freedesktop.org [131.252.210.177]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.lore.kernel.org (Postfix) with ESMTPS id A6B06ECAAA3 for ; Fri, 26 Aug 2022 14:20:15 +0000 (UTC) Received: from gabe.freedesktop.org (localhost [127.0.0.1]) by gabe.freedesktop.org (Postfix) with ESMTP id BD67D10E932; Fri, 26 Aug 2022 14:20:08 +0000 (UTC) Received: from mga02.intel.com (mga02.intel.com [134.134.136.20]) by gabe.freedesktop.org (Postfix) with ESMTPS id 08C9810E932; Fri, 26 Aug 2022 14:19:55 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=intel.com; i=@intel.com; q=dns/txt; s=Intel; t=1661523596; x=1693059596; h=from:to:cc:subject:date:message-id:in-reply-to: references:mime-version:content-transfer-encoding; bh=QFGZCnBk1me3JF1oaygoGELsobT7o3LQUFAm0hBAXJw=; b=kD+9ltiaiVu9i2jfOoDIpwJHydPz1KwIwXy9H1Tq4D/ZLzLjc2fvVTQG nVj95vYDQKFv0GiGO3GWnNllXZMaggJLUo7GoU+S3wsXWYK2ea1mWoEuV N7J9suWhNj/qp662ugYo8fNe6qv9tuSq/mrRzX5ZetjdYdfBmtEgwXG1h i4RY5fzeBGZGLwXsD9Ku9czX888S/y9laIaAo0WJeZiF2m66FaqYx3BCj qjjWD7zTuVBq+HrPk3d5Ol58OpF3kiiiBEyUrjfWfdt0UKYCC3hQrc2Iq rOHCbmw1JUka2SHZh/ERyc2mUVfe88GvEgsS6IkbkGASbj1KKOJ/L5zgA Q==; X-IronPort-AV: E=McAfee;i="6500,9779,10451"; a="281485767" X-IronPort-AV: E=Sophos;i="5.93,265,1654585200"; d="scan'208";a="281485767" Received: from orsmga006.jf.intel.com ([10.7.209.51]) by orsmga101.jf.intel.com with ESMTP/TLS/ECDHE-RSA-AES256-GCM-SHA384; 26 Aug 2022 07:19:55 -0700 X-IronPort-AV: E=Sophos;i="5.93,265,1654585200"; d="scan'208";a="587313694" Received: from lab-ah.igk.intel.com ([10.91.215.196]) by orsmga006-auth.jf.intel.com with ESMTP/TLS/ECDHE-RSA-AES256-GCM-SHA384; 26 Aug 2022 07:19:53 -0700 From: Andrzej Hajda To: Jani Nikula , =?utf-8?b?VmlsbGUgU3lyasOk?= =?utf-8?b?bMOk?= , Arun R Murthy , Imre Deak Subject: [PATCH v7 3/3] drm/i915/fbdev: do not create fbdev if HPD is suspended Date: Fri, 26 Aug 2022 16:19:29 +0200 Message-Id: <20220826141929.189681-4-andrzej.hajda@intel.com> X-Mailer: git-send-email 2.25.1 In-Reply-To: <20220826141929.189681-1-andrzej.hajda@intel.com> References: <20220826141929.189681-1-andrzej.hajda@intel.com> MIME-Version: 1.0 Organization: Intel Technology Poland sp. z o.o. - ul. Slowackiego 173, 80-298 Gdansk - KRS 101882 - NIP 957-07-52-316 X-BeenThere: dri-devel@lists.freedesktop.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Direct Rendering Infrastructure - Development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Cc: Tvrtko Ursulin , Andrzej Hajda , intel-gfx@lists.freedesktop.org, dri-devel@lists.freedesktop.org, Rodrigo Vivi Errors-To: dri-devel-bounces@lists.freedesktop.org Sender: "dri-devel" In case of deferred FB setup core can try to create new framebuffer. Disallow it if hpd_suspended flag is set. Signed-off-by: Andrzej Hajda Reviewed-by: Imre Deak --- drivers/gpu/drm/i915/display/intel_fbdev.c | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/drivers/gpu/drm/i915/display/intel_fbdev.c b/drivers/gpu/drm/i915/display/intel_fbdev.c index 2903b9cfa0f834..f287362dbdc68a 100644 --- a/drivers/gpu/drm/i915/display/intel_fbdev.c +++ b/drivers/gpu/drm/i915/display/intel_fbdev.c @@ -210,6 +210,12 @@ static int intelfb_create(struct drm_fb_helper *helper, struct drm_i915_gem_object *obj; int ret; + mutex_lock(&ifbdev->hpd_lock); + ret = ifbdev->hpd_suspended ? -EAGAIN : 0; + mutex_unlock(&ifbdev->hpd_lock); + if (ret) + return ret; + if (intel_fb && (sizes->fb_width > intel_fb->base.width || sizes->fb_height > intel_fb->base.height)) {