[PATCH v2] drm/msm/dpu: Correct dpu destroy and disable order

[Doug Anderson]

Hi,

On Fri, Nov 2, 2018 at 5:49 AM Jayant Shekhar <jshekhar at codeaurora.org> wrote:
>
> In case of msm drm bind failure, dpu_mdss_destroy is triggered.
> In this function, resources are freed and pm runtime disable is
> called, which triggers dpu_mdss_disable. Now in dpu_mdss_disable,
> driver tries to access a memory which is already freed. This
> results in kernel panic. Fix this by ensuring proper sequence
> of dpu destroy and disable calls.
>
> Changes in v2:
>    - Removed double spacings [Jeykumar]
>
> Signed-off-by: Jayant Shekhar <jshekhar at codeaurora.org>
> ---
>  drivers/gpu/drm/msm/disp/dpu1/dpu_mdss.c | 5 +----
>  1 file changed, 1 insertion(+), 4 deletions(-)

I can confirm that this fixes a crash I was running into.
Specifically it looked like this:

---

msm_dsi ae94000.dsi: ae94000.dsi supply gdsc not found, using dummy regulator
msm_dsi ae94000.dsi: Linked as a consumer to regulator.0
msm_dsi ae94000.dsi: Dropping the link to regulator.0
msm_dsi ae94000.dsi: Linked as a consumer to regulator.35
msm_dsi_manager_register: failed to register mipi dsi host for DSI 0
msm_dsi ae94000.dsi: Dropping the link to regulator.35
msm ae00000.mdss: failed to bind ae94000.dsi (ops dsi_ops): -517
Unable to handle kernel paging request at virtual address 006b6b6b6b6b6b6b
...
Workqueue: pm pm_runtime_work
...
Call trace:
 clk_disable+0x24/0x4c
 msm_dss_enable_clk+0xec/0x164
 dpu_mdss_disable+0x2c/0x84
 msm_runtime_suspend+0x50/0x5c
 pm_generic_runtime_suspend+0x3c/0x48
 genpd_runtime_suspend+0xf4/0x1cc
 __rpm_callback+0x128/0x1a4
 rpm_callback+0x70/0x90
 rpm_suspend+0x2f4/0x564
 rpm_idle+0x3c0/0x3d8
 pm_runtime_work+0x6c/0xa0
 process_one_work+0x38c/0x634
 worker_thread+0x218/0x360
 kthread+0x130/0x138
 ret_from_fork+0x10/0x18

---

Thus:

Tested-by: Douglas Anderson <dianders at chromium.org>


>
> diff --git a/drivers/gpu/drm/msm/disp/dpu1/dpu_mdss.c b/drivers/gpu/drm/msm/disp/dpu1/dpu_mdss.c
> index fd9c893..902bb4c 100644
> --- a/drivers/gpu/drm/msm/disp/dpu1/dpu_mdss.c
> +++ b/drivers/gpu/drm/msm/disp/dpu1/dpu_mdss.c
> @@ -156,18 +156,15 @@ static void dpu_mdss_destroy(struct drm_device *dev)
>         struct dpu_mdss *dpu_mdss = to_dpu_mdss(priv->mdss);
>         struct dss_module_power *mp = &dpu_mdss->mp;
>
> +       pm_runtime_disable(dev->dev);
>         _dpu_mdss_irq_domain_fini(dpu_mdss);
> -
>         free_irq(platform_get_irq(pdev, 0), dpu_mdss);
> -
>         msm_dss_put_clk(mp->clk_config, mp->num_clk);
>         devm_kfree(&pdev->dev, mp->clk_config);
>
>         if (dpu_mdss->mmio)
>                 devm_iounmap(&pdev->dev, dpu_mdss->mmio);
>         dpu_mdss->mmio = NULL;
> -
> -       pm_runtime_disable(dev->dev);
>         priv->mdss = NULL;
>  }
>
> --
> The Qualcomm Innovation Center, Inc. is a member of the Code Aurora Forum,
> a Linux Foundation Collaborative Project
>