drm/msm/mdp5: fix for crash in disable path

Seems like disable can race with complete_flip() in process of disabling
a crtc, leading to:

[   49.065364] Call trace:
[   49.071441] [<ffffffc00041d5a0>] mdp5_ctl_blend+0x20/0x1c0
[   49.073788] [<ffffffc00041ebcc>] mdp5_crtc_disable+0x3c/0xa8
[   49.079348] [<ffffffc0003e7854>] disable_outputs.isra.4+0x11c/0x220
[   49.085164] [<ffffffc0003e7afc>] drm_atomic_helper_commit_modeset_disables+0x14/0x38
[   49.091155] [<ffffffc000425c80>] complete_commit+0x40/0xb8
[   49.099136] [<ffffffc0004260ac>] msm_atomic_commit+0x364/0x398
[   49.104430] [<ffffffc00040a614>] drm_atomic_commit+0x3c/0x70
[   49.110249] [<ffffffc0003e67b8>] drm_atomic_helper_set_config+0x1b0/0x3e0
[   49.116065] [<ffffffc0003f99bc>] drm_mode_set_config_internal+0x64/0xf8
[   49.122746] [<ffffffc0003fa624>] drm_framebuffer_remove+0xe4/0x128
[   49.129171] [<ffffffc0003feaf8>] drm_mode_rmfb+0xc0/0x100
[   49.135420] [<ffffffc0003efba8>] drm_ioctl+0x258/0x4d0
[   49.140889] [<ffffffc0001b0388>] do_vfs_ioctl+0x338/0x5d0
[   49.145921] [<ffffffc0001b06a8>] SyS_ioctl+0x88/0xa0

It makes no sense to free the ctl without disabling all stages, so lets
just move them together to avoid the crash.

Signed-off-by: Rob Clark <robdclark@gmail.com>

diff --git a/drivers/gpu/drm/msm/mdp/mdp5/mdp5_crtc.c b/drivers/gpu/drm/msm/mdp/mdp5/mdp5_crtc.c
index c1530772187dbd36bf672723af074f0af9a44c5d..13dd7dd853a984354dad9d6d5dfb709e98c189bf 100644 (file)
--- a/drivers/gpu/drm/msm/mdp/mdp5/mdp5_crtc.c
+++ b/drivers/gpu/drm/msm/mdp/mdp5/mdp5_crtc.c
@@ -143,6 +143,8 @@ static void complete_flip(struct drm_crtc *crtc, struct drm_file *file)
        }
 
        if (mdp5_crtc->ctl && !crtc->state->enable) {
+               /* set STAGE_UNUSED for all layers */
+               mdp5_ctl_blend(mdp5_crtc->ctl, mdp5_crtc->lm, 0x00000000);
                mdp5_ctl_release(mdp5_crtc->ctl);
                mdp5_crtc->ctl = NULL;
        }
@@ -274,9 +276,6 @@ static void mdp5_crtc_disable(struct drm_crtc *crtc)
        if (WARN_ON(!mdp5_crtc->enabled))
                return;
 
-       /* set STAGE_UNUSED for all layers */
-       mdp5_ctl_blend(mdp5_crtc->ctl, mdp5_crtc->lm, 0x00000000);
-
        mdp_irq_unregister(&mdp5_kms->base, &mdp5_crtc->err);
        mdp5_disable(mdp5_kms);