The display snapshot work is queued on kms->dump_worker by the IOMMU
fault handler of the KMS and by the DPU interrupt handlers, but neither
of them follows the lifetime of the worker:
- the fault handler is registered by msm_kms_init_vm() in the middle of
kms_init() and is never unregistered, so a fault during kms_init(),
or in the error path of msm_drm_kms_init(), dumps a KMS which is
still being set up or already being torn down, and a fault after
msm_drm_kms_uninit() queues the work on a destroyed worker;
- msm_drm_kms_uninit() destroys the worker before it uninstalls the
interrupt handlers, so an underrun or a timeout in between queues the
work on a destroyed worker as well.
Start the sources only once the KMS is fully set up and stop them before
the worker goes away: register the fault handler as the last step of
msm_drm_kms_init(), unregister it first thing in msm_drm_kms_uninit(),
and destroy the worker after the interrupts have been uninstalled but
before the KMS itself, so that the dumps still pending run against an
intact KMS.
A fault during kms_init() therefore no longer produces a dump; the KMS
is not complete enough to describe one at that point. The handler is
cleared with the kms argument left in place, so that a fault handler
already running still gets a valid one.
Fixes: 2ec5b3dc18ba ("drm/msm: add disp snapshot points across dpu driver")
Fixes: eabba31a839a ("drm/msm: register a fault handler for display mmu faults")
Assisted-by: LLM
Signed-off-by: Dmitry Baryshkov <[email protected]>
---
drivers/gpu/drm/msm/msm_kms.c | 12 ++++++------
1 file changed, 6 insertions(+), 6 deletions(-)
diff --git a/drivers/gpu/drm/msm/msm_kms.c b/drivers/gpu/drm/msm/msm_kms.c
index f3e39c3907a9..a94d2888a21e 100644
--- a/drivers/gpu/drm/msm/msm_kms.c
+++ b/drivers/gpu/drm/msm/msm_kms.c
@@ -182,8 +182,6 @@ struct drm_gpuvm *msm_kms_init_vm(struct drm_device *dev,
struct device *mdss_de
struct drm_gpuvm *vm;
struct msm_mmu *mmu;
struct device *mdp_dev = dev->dev;
- struct msm_drm_private *priv = dev->dev_private;
- struct msm_kms *kms = priv->kms;
struct device *iommu_dev;
/*
@@ -211,8 +209,6 @@ struct drm_gpuvm *msm_kms_init_vm(struct drm_device *dev,
struct device *mdss_de
return vm;
}
- msm_mmu_set_fault_handler(to_msm_vm(vm)->mmu, kms,
msm_kms_fault_handler);
-
return vm;
}
@@ -245,6 +241,8 @@ void msm_drm_kms_uninit(struct device *dev)
BUG_ON(!kms);
+ msm_mmu_set_fault_handler(to_msm_vm(kms->vm)->mmu, kms, NULL);
+
/* We must cancel and cleanup any pending vblank enable/disable
* work before msm_irq_uninstall() to avoid work re-enabling an
* irq after uninstall has disabled it.
@@ -256,12 +254,12 @@ void msm_drm_kms_uninit(struct device *dev)
drm_kms_helper_poll_fini(ddev);
- msm_disp_snapshot_destroy(ddev);
-
pm_runtime_get_sync(dev);
msm_irq_uninstall(ddev);
pm_runtime_put_sync(dev);
+ msm_disp_snapshot_destroy(ddev);
+
if (kms && kms->funcs)
kms->funcs->destroy(kms);
}
@@ -339,6 +337,8 @@ int msm_drm_kms_init(struct device *dev, const struct
drm_driver *drv)
drm_mode_config_reset(ddev);
+ msm_mmu_set_fault_handler(to_msm_vm(kms->vm)->mmu, kms,
msm_kms_fault_handler);
+
return 0;
err_destroy_event_threads:
--
2.47.3
