linux-kernel - Re: [PATCH] drm/exynos: fix vblank handling during dpms off

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:	Thu, 9 Oct 2014 14:43:02 +0900
From:	Alexandre Courbot <acourbot@...dia.com>
To:	Andrzej Hajda <a.hajda@...sung.com>,
	Inki Dae <inki.dae@...sung.com>,
	Joonyoung Shim <jy0922.shim@...sung.com>,
	Thierry Reding <treding@...dia.com>
CC:	<linux-samsung-soc@...r.kernel.org>,
	Daniel Vetter <daniel.vetter@...ll.ch>,
	Seung-Woo Kim <sw0312.kim@...sung.com>,
	<linux-kernel@...r.kernel.org>, <dri-devel@...ts.freedesktop.org>,
	Kyungmin Park <kyungmin.park@...sung.com>,
	Kukjin Kim <kgene.kim@...sung.com>,
	Benjamin Gaignard <benjamin.gaignard@...aro.org>,
	Russell King <rmk+kernel@....linux.org.uk>,
	Ville Syrjälä <ville.syrjala@...ux.intel.com>,
	"linux-tegra@...r.kernel.org" <linux-tegra@...r.kernel.org>
Subject: Re: [PATCH] drm/exynos: fix vblank handling during dpms off

On 10/02/2014 08:52 PM, Andrzej Hajda wrote:
> Hi,
>
> +CC possible victims
>
> On 10/02/2014 12:52 PM, Inki Dae wrote:
>> On 2014년 10월 02일 17:58, Joonyoung Shim wrote:
>>> Hi Andrzej,
>>>
>>> On 10/01/2014 05:14 PM, Andrzej Hajda wrote:
>>>> The patch disables vblanks during dpms off only if pagefilp has
>>>> not been finished. It also replaces drm_vblank_off with drm_crtc_vblank_put.
>>>> It fixes issue with page_flip ioctl not being able to acquire vblank counter.
>>> This problem isn't related with pageflip, it just causes from
>>> 7ffd7a68511c710b84db3548a1997fd2625f580a commit (drm: Always reject
>>> drm_vblank_get() after drm_vblank_off()).
>>>
>>> We need to use drm_vblank_on() as a counterpart to drm_vblank_off()
>>> after the commit .
>
> This patch should break also other drivers, it seems at least following
> drms could be affected:
> armada, sti, tegra.

Indeed we (tegra) have just been hit by this. The problem seems to come 
from the fact that we have been using drm_vblank_pre_modeset, 
drm_vblank_post_modeset and drm_vblank_off conjointly. All these 
functions depend on the value of vblank->inmodeset, and 7ffd7a68511 
increases the vblank reference counter only in drm_vblank_off, which can 
result in the acquired reference never being released.

The following seems to fix this for Tegra, by stopping using 
drm_vblank_pre/post_modeset and relying on drm_vblank_off/on instead:

diff --git a/drivers/gpu/drm/tegra/dc.c b/drivers/gpu/drm/tegra/dc.c
index b08df07cad47..3955d81236d0 100644
--- a/drivers/gpu/drm/tegra/dc.c
+++ b/drivers/gpu/drm/tegra/dc.c
@@ -739,7 +739,6 @@ static const struct drm_crtc_funcs tegra_crtc_funcs = {

  static void tegra_crtc_disable(struct drm_crtc *crtc)
  {
-       struct tegra_dc *dc = to_tegra_dc(crtc);
         struct drm_device *drm = crtc->dev;
         struct drm_plane *plane;

@@ -755,7 +754,7 @@ static void tegra_crtc_disable(struct drm_crtc *crtc)
                 }
         }

-       drm_vblank_off(drm, dc->pipe);
+       drm_crtc_vblank_off(crtc);
  }

  static bool tegra_crtc_mode_fixup(struct drm_crtc *crtc,
@@ -844,7 +843,7 @@ static int tegra_crtc_mode_set(struct drm_crtc *crtc,
         u32 value;
         int err;

-       drm_vblank_pre_modeset(crtc->dev, dc->pipe);
+       drm_crtc_vblank_off(crtc);

         err = tegra_crtc_setup_clk(crtc, mode);
         if (err) {
@@ -946,7 +945,7 @@ static void tegra_crtc_commit(struct drm_crtc *crtc)
         value = GENERAL_ACT_REQ | WIN_A_ACT_REQ;
         tegra_dc_writel(dc, value, DC_CMD_STATE_CONTROL);

-       drm_vblank_post_modeset(crtc->dev, dc->pipe);
+       drm_crtc_vblank_on(crtc);
  }

  static void tegra_crtc_load_lut(struct drm_crtc *crtc)

Thierry, does this look ok to you?

But there might be another issue, which is that calls to 
drm_vblank_get() will return -EINVAL if invoked between drm_blank_off 
and drm_blank_on. Is this really the desired behavior? Can it at least 
happen? If so, how are drivers supposed to react to this situation?
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/