From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-1.web.codeaurora.org [10.30.226.201]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 2B22213C900 for ; Tue, 7 May 2024 07:58:31 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=10.30.226.201 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1715068712; cv=none; b=ilJqsdlNQ30u1HyXkH6C5eLJyuIB7hECGZujh4I5QanhwLJjO3B98ELNsXCXQah4YPxID9/qlTNnnmte0jR4PW/6ZiTjMmASNIVdPexVsvkDkv6UHQHfNvTemNfZH1MHKeS19F9Qex/I5LI0SrEtLdacqIOyGRUGa/p64TceOGo= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1715068712; c=relaxed/simple; bh=89t9B5VtRJzNfp6Wda6X2h6J58Yiwx7TQOCpbZd8Iu8=; h=Date:From:To:Cc:Subject:Message-ID:References:MIME-Version: Content-Type:Content-Disposition:In-Reply-To; b=cjhxf48ikjayABm3/j3E8KViL3euubVgn/6IOJB8bncsKO6y9Da2nVY4wcU62N/Z32pLon0M3UZl3IqIvc7vunMP19ogvje/6WubyBScU/tQPAi2qVNcfSoufUxTDA6SiIkvBHEzPseJsQ71QmlfwHBN25TxVzrVK7QPGCP440E= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b=BygZ6Mnl; arc=none smtp.client-ip=10.30.226.201 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b="BygZ6Mnl" Received: by smtp.kernel.org (Postfix) with ESMTPSA id 5447AC4AF63; Tue, 7 May 2024 07:58:31 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=k20201202; t=1715068711; bh=89t9B5VtRJzNfp6Wda6X2h6J58Yiwx7TQOCpbZd8Iu8=; h=Date:From:To:Cc:Subject:References:In-Reply-To:From; b=BygZ6Mnl8LUBUOC0U0HyPNQ4qRDxoGM3qPH2R+ejDkRM3cBW88z5gVKCk0E/JcVE0 d4PZQQmhV6iWOR0xAT5gUVEXZB553khNpiLpHtl8aRl30G39M0zySiT5koWYH7aX8Q E+ngcLyNg0lAVjttos/kNMyxcRrFRlfj6V/vTF1sk3VkmLBEIdp55uGvVBy+/G7eB5 9sffzofGRbfxw/72ttntxOnV0GjldoUc8i/ItJ9lCs+EXAyOL/wnaeaA7RslA97NSz KL17gfTXiW60Yp5QqfU9nrj6Edvy16th/Fil0CDZ5u1WJ/3Wzr8qu/+sxw+q4h/e3e UT5h4HK/u9Peg== Date: Tue, 7 May 2024 09:58:25 +0200 From: Maxime Ripard To: Laurent Pinchart Cc: Sean Anderson , Tomi Valkeinen , Maarten Lankhorst , Thomas Zimmermann , David Airlie , Daniel Vetter , Michal Simek , dri-devel@lists.freedesktop.org, linux-arm-kernel@lists.infradead.org, linux-kernel@vger.kernel.org Subject: Re: [BUG] drm: zynqmp_dp: Lockup in zynqmp_dp_bridge_detect when device is unbound Message-ID: <20240507-shiny-sophisticated-mustang-bf2d2e@houat> References: <4d8f4c9b-2efb-4774-9a37-2f257f79b2c9@linux.dev> <20240504122118.GB24548@pendragon.ideasonboard.com> <20240506-charcoal-griffin-of-tact-174dde@houat> <20240506073531.GA10260@pendragon.ideasonboard.com> <97811bfe-a1fb-419c-a148-74e3d84aa0e2@linux.dev> <20240506165057.GD29108@pendragon.ideasonboard.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: multipart/signed; micalg=pgp-sha384; protocol="application/pgp-signature"; boundary="b3imapilpypz3bfe" Content-Disposition: inline In-Reply-To: <20240506165057.GD29108@pendragon.ideasonboard.com> --b3imapilpypz3bfe Content-Type: text/plain; charset=us-ascii Content-Disposition: inline Content-Transfer-Encoding: quoted-printable On Mon, May 06, 2024 at 07:50:57PM GMT, Laurent Pinchart wrote: > On Mon, May 06, 2024 at 10:57:17AM -0400, Sean Anderson wrote: > > On 5/6/24 03:35, Laurent Pinchart wrote: > > > On Mon, May 06, 2024 at 09:29:36AM +0200, Maxime Ripard wrote: > > >> Hi Laurent, Sean, > > >>=20 > > >> On Sat, May 04, 2024 at 03:21:18PM GMT, Laurent Pinchart wrote: > > >> > On Fri, May 03, 2024 at 05:54:32PM -0400, Sean Anderson wrote: > > >> > > I have discovered a bug in the displayport driver on drm-misc-ne= xt. To > > >> > > trigger it, run > > >> > >=20 > > >> > > echo fd4a0000.display > /sys/bus/platform/drivers/zynqmp-dpsub/u= nbind > > >> > >=20 > > >> > > The system will become unresponsive and (after a bit) splat with= a hard > > >> > > LOCKUP. One core will be unresponsive at the first zynqmp_dp_rea= d in > > >> > > zynqmp_dp_bridge_detect. > > >> > >=20 > > >> > > I believe the issue is due the registers being unmapped and the = block > > >> > > put into reset in zynqmp_dp_remove instead of zynqmp_dpsub_relea= se. > > >> >=20 > > >> > That is on purpose. Drivers are not allowed to access the device a= t all > > >> > after .remove() returns. > > >>=20 > > >> It's not "on purpose" no. Drivers indeed are not allowed to access t= he > > >> device after remove, but the kernel shouldn't crash. This is exactly > > >> why we have drm_dev_enter / drm_dev_exit. > > >=20 > > > I didn't mean the crash was on purpose :-) It's the registers being > > > unmapped that is, as nothing should touch those registers after > > > .remove() returns. > >=20 > > OK, so then we need to have some kind of flag in the driver or in the d= rm > > subsystem so we know not to access those registers. >=20 > To avoid race conditions, the .remove() function should mark the device > as removed, wait for all ongoing access from userspace to be complete, > and then proceed to unmapping registers and doing other cleanups. > Userspace may still have open file descriptors to the device at that > point. Any new userspace access should be disallowed (by checking the > removed flag), with the only userspace-initiated operations that still > need to run being the release-related operations (unmapping memory, > closing file descriptors, ...). And for the record, this is exactly what drm_dev_unplug and drm_dev_enter/drm_dev_exit does. Maxime --b3imapilpypz3bfe Content-Type: application/pgp-signature; name="signature.asc" -----BEGIN PGP SIGNATURE----- iJUEABMJAB0WIQTkHFbLp4ejekA/qfgnX84Zoj2+dgUCZjnfHAAKCRAnX84Zoj2+ dt4DAX99RTnsezwYkS/RSibP1NcxpL4CCKZoY9wdmzD1LxPobMHewTlZzvejJrXZ QgpabNMBgLzWSoWR5Wi5zbucVnQobQJp7d2zppixk1EbwNiUsNOS+Z9XcAL4Dkfe DWQ6ip9F1w== =oZkN -----END PGP SIGNATURE----- --b3imapilpypz3bfe-- From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from bombadil.infradead.org (bombadil.infradead.org [198.137.202.133]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.lore.kernel.org (Postfix) with ESMTPS id 3B4C4C10F1A for ; Tue, 7 May 2024 07:58:54 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=lists.infradead.org; s=bombadil.20210309; h=Sender:Content-Type: List-Subscribe:List-Help:List-Post:List-Archive:List-Unsubscribe:List-Id: In-Reply-To:MIME-Version:References:Message-ID:Subject:Cc:To:From:Date: Reply-To:Content-Transfer-Encoding:Content-ID:Content-Description:Resent-Date :Resent-From:Resent-Sender:Resent-To:Resent-Cc:Resent-Message-ID:List-Owner; bh=IDM+xcDabHS02bJ366nW3WSs+L3rxHsL0/shoI1wRik=; b=IMPS5UtEcU7pG0eU24gAe3Cu9r Oxtl7sB1KubUTIZiAsOA55lojIwv0APAHzpDY/LXqEpHt5EUeQv1N5TQyLLqe0b+DrX5PE3Y77SsS L5Z/9xjGoSPRWIvpMganfUWa913Z8am2M93ZxwQMLP4NpP2XxhuMQ9Y6gUkikAE/dIlKZLruJGhkv CSV+5dmvOJWRMqpO/XvXGPPCckDJmAjrElwUtXyERED+SnzKqrml8i6xfQsvhR0vuH0L2VcpmqYqS YElH7csDbfG4pFKvP1ZdBk0Ag6sK8yXEgjN1DL692ibx7fP+uBQiNMp/75TRaWHR4/jcrDb4cHakE Q4mYisXQ==; Received: from localhost ([::1] helo=bombadil.infradead.org) by bombadil.infradead.org with esmtp (Exim 4.97.1 #2 (Red Hat Linux)) id 1s4Fig-0000000A3Tk-0wzZ; Tue, 07 May 2024 07:58:38 +0000 Received: from dfw.source.kernel.org ([2604:1380:4641:c500::1]) by bombadil.infradead.org with esmtps (Exim 4.97.1 #2 (Red Hat Linux)) id 1s4Fid-0000000A3S3-1CW9 for linux-arm-kernel@lists.infradead.org; Tue, 07 May 2024 07:58:36 +0000 Received: from smtp.kernel.org (transwarp.subspace.kernel.org [100.75.92.58]) by dfw.source.kernel.org (Postfix) with ESMTP id D202761408; Tue, 7 May 2024 07:58:31 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 5447AC4AF63; Tue, 7 May 2024 07:58:31 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=k20201202; t=1715068711; bh=89t9B5VtRJzNfp6Wda6X2h6J58Yiwx7TQOCpbZd8Iu8=; h=Date:From:To:Cc:Subject:References:In-Reply-To:From; b=BygZ6Mnl8LUBUOC0U0HyPNQ4qRDxoGM3qPH2R+ejDkRM3cBW88z5gVKCk0E/JcVE0 d4PZQQmhV6iWOR0xAT5gUVEXZB553khNpiLpHtl8aRl30G39M0zySiT5koWYH7aX8Q E+ngcLyNg0lAVjttos/kNMyxcRrFRlfj6V/vTF1sk3VkmLBEIdp55uGvVBy+/G7eB5 9sffzofGRbfxw/72ttntxOnV0GjldoUc8i/ItJ9lCs+EXAyOL/wnaeaA7RslA97NSz KL17gfTXiW60Yp5QqfU9nrj6Edvy16th/Fil0CDZ5u1WJ/3Wzr8qu/+sxw+q4h/e3e UT5h4HK/u9Peg== Date: Tue, 7 May 2024 09:58:25 +0200 From: Maxime Ripard To: Laurent Pinchart Cc: Sean Anderson , Tomi Valkeinen , Maarten Lankhorst , Thomas Zimmermann , David Airlie , Daniel Vetter , Michal Simek , dri-devel@lists.freedesktop.org, linux-arm-kernel@lists.infradead.org, linux-kernel@vger.kernel.org Subject: Re: [BUG] drm: zynqmp_dp: Lockup in zynqmp_dp_bridge_detect when device is unbound Message-ID: <20240507-shiny-sophisticated-mustang-bf2d2e@houat> References: <4d8f4c9b-2efb-4774-9a37-2f257f79b2c9@linux.dev> <20240504122118.GB24548@pendragon.ideasonboard.com> <20240506-charcoal-griffin-of-tact-174dde@houat> <20240506073531.GA10260@pendragon.ideasonboard.com> <97811bfe-a1fb-419c-a148-74e3d84aa0e2@linux.dev> <20240506165057.GD29108@pendragon.ideasonboard.com> MIME-Version: 1.0 In-Reply-To: <20240506165057.GD29108@pendragon.ideasonboard.com> X-CRM114-Version: 20100106-BlameMichelson ( TRE 0.8.0 (BSD) ) MR-646709E3 X-CRM114-CacheID: sfid-20240507_005835_453047_59BABAD0 X-CRM114-Status: GOOD ( 26.74 ) X-BeenThere: linux-arm-kernel@lists.infradead.org X-Mailman-Version: 2.1.34 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Content-Type: multipart/mixed; boundary="===============3411151435296579083==" Sender: "linux-arm-kernel" Errors-To: linux-arm-kernel-bounces+linux-arm-kernel=archiver.kernel.org@lists.infradead.org --===============3411151435296579083== Content-Type: multipart/signed; micalg=pgp-sha384; protocol="application/pgp-signature"; boundary="b3imapilpypz3bfe" Content-Disposition: inline --b3imapilpypz3bfe Content-Type: text/plain; charset=us-ascii Content-Disposition: inline Content-Transfer-Encoding: quoted-printable On Mon, May 06, 2024 at 07:50:57PM GMT, Laurent Pinchart wrote: > On Mon, May 06, 2024 at 10:57:17AM -0400, Sean Anderson wrote: > > On 5/6/24 03:35, Laurent Pinchart wrote: > > > On Mon, May 06, 2024 at 09:29:36AM +0200, Maxime Ripard wrote: > > >> Hi Laurent, Sean, > > >>=20 > > >> On Sat, May 04, 2024 at 03:21:18PM GMT, Laurent Pinchart wrote: > > >> > On Fri, May 03, 2024 at 05:54:32PM -0400, Sean Anderson wrote: > > >> > > I have discovered a bug in the displayport driver on drm-misc-ne= xt. To > > >> > > trigger it, run > > >> > >=20 > > >> > > echo fd4a0000.display > /sys/bus/platform/drivers/zynqmp-dpsub/u= nbind > > >> > >=20 > > >> > > The system will become unresponsive and (after a bit) splat with= a hard > > >> > > LOCKUP. One core will be unresponsive at the first zynqmp_dp_rea= d in > > >> > > zynqmp_dp_bridge_detect. > > >> > >=20 > > >> > > I believe the issue is due the registers being unmapped and the = block > > >> > > put into reset in zynqmp_dp_remove instead of zynqmp_dpsub_relea= se. > > >> >=20 > > >> > That is on purpose. Drivers are not allowed to access the device a= t all > > >> > after .remove() returns. > > >>=20 > > >> It's not "on purpose" no. Drivers indeed are not allowed to access t= he > > >> device after remove, but the kernel shouldn't crash. This is exactly > > >> why we have drm_dev_enter / drm_dev_exit. > > >=20 > > > I didn't mean the crash was on purpose :-) It's the registers being > > > unmapped that is, as nothing should touch those registers after > > > .remove() returns. > >=20 > > OK, so then we need to have some kind of flag in the driver or in the d= rm > > subsystem so we know not to access those registers. >=20 > To avoid race conditions, the .remove() function should mark the device > as removed, wait for all ongoing access from userspace to be complete, > and then proceed to unmapping registers and doing other cleanups. > Userspace may still have open file descriptors to the device at that > point. Any new userspace access should be disallowed (by checking the > removed flag), with the only userspace-initiated operations that still > need to run being the release-related operations (unmapping memory, > closing file descriptors, ...). And for the record, this is exactly what drm_dev_unplug and drm_dev_enter/drm_dev_exit does. Maxime --b3imapilpypz3bfe Content-Type: application/pgp-signature; name="signature.asc" -----BEGIN PGP SIGNATURE----- iJUEABMJAB0WIQTkHFbLp4ejekA/qfgnX84Zoj2+dgUCZjnfHAAKCRAnX84Zoj2+ dt4DAX99RTnsezwYkS/RSibP1NcxpL4CCKZoY9wdmzD1LxPobMHewTlZzvejJrXZ QgpabNMBgLzWSoWR5Wi5zbucVnQobQJp7d2zppixk1EbwNiUsNOS+Z9XcAL4Dkfe DWQ6ip9F1w== =oZkN -----END PGP SIGNATURE----- --b3imapilpypz3bfe-- --===============3411151435296579083== Content-Type: text/plain; charset="us-ascii" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit Content-Disposition: inline _______________________________________________ linux-arm-kernel mailing list linux-arm-kernel@lists.infradead.org http://lists.infradead.org/mailman/listinfo/linux-arm-kernel --===============3411151435296579083==--