RP1 VEC and DPI drivers both can crash if they fail to map hardware registers

[njhollinghurst]

Describe the bug

RP1's VEC and DPI drivers aren't intended to be used together (because of contention for PLL / clock resources). So rather lazily, they also share a common block of registers. Only one driver will probe successfully.

So far as intended; except that when probe fails, during cleanup the driver tries to write to an unmapped register, resulting in an Oops.

Steps to reproduce the behaviour

On Raspberry Pi 5, enable both composite video and load vc4-kms-vga666 or vc4-kms-dpi-generic overlay.

Device (s)

Raspberry Pi 5

System

6.6

Logs

[    3.400047] drm-rp1-dpi 1f00148000.dpi: rp1dpi_platform_probe
[    3.400102] drm-rp1-dpi 1f00148000.dpi: can't request region for resource [mem 0x1f00140000-0x1f00140fff]
[    3.400107] drm-rp1-dpi 1f00148000.dpi: Error memory mapping regs[1]
[    3.400110] drm-rp1-dpi 1f00148000.dpi: rp1dpi_platform_probe fail -16
[    3.400128] Unable to handle kernel NULL pointer dereference at virtual address 0000000000000008
[    3.409173] Mem abort info:
[    3.412200]   ESR = 0x0000000096000045
[    3.416035]   EC = 0x25: DABT (current EL), IL = 32 bits
[    3.421461]   SET = 0, FnV = 0
[    3.424638]   EA = 0, S1PTW = 0
[    3.427862]   FSC = 0x05: level 1 translation fault
[    3.433075] Data abort info:
[    3.435456] [drm] Initialized v3d 1.0.0 20180419 for 1002000000.v3d on minor 2
[    3.438390]   ISV = 0, ISS = 0x00000045, ISS2 = 0x00000000
[    3.444697] [drm] Initialized drm-rp1-vec 1.0.0 0 for 1f00144000.vec on minor 0
[    3.445476]   CM = 0, WnR = 1, TnD = 0, TagAccess = 0
[    3.450649]   GCS = 0, Overlay = 0, DirtyBit = 0, Xs = 0
[    3.450654] user pgtable: 16k pages, 47-bit VAs, pgdp=0000000104ff4000
[    3.450658] [0000000000000008] pgd=0000000000000000, p4d=0000000000000000, pud=0000000000000000
[    3.450664] Internal error: Oops: 0000000096000045 [#1] PREEMPT SMP
[    3.450668] Modules linked in: videobuf2_common v3d drm_rp1_vec(+) gpio_keys spi_bcm2835 drm_rp1_dpi(+) mc gpu_sched panel_simple pwm_fan drm_shmem_helper drm_dma_helper drm_kms_helper rp1_adc raspberrypi_gpiomem nvmem_rmem uio_pdrv_genirq uio i2c_dev drm fuse drm_panel_orientation_quirks dm_mod backlight ip_tables x_tables ipv6
[    3.450704] CPU: 3 PID: 320 Comm: (udev-worker) Not tainted 6.6.13-v8-16k+ #2
[    3.450709] Hardware name: Raspberry Pi 5 Model B Rev 1.0 (DT)
[    3.450710] pstate: 40400009 (nZcv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--)
[    3.450714] pc : rp1dpi_vidout_poweroff+0x14/0x40 [drm_rp1_dpi]
[    3.450738] lr : rp1dpi_stopall+0x50/0x88 [drm_rp1_dpi]
[    3.450746] sp : ffffc00080c73830
[    3.450748] x29: ffffc00080c73830 x28: ffffc00080c73d88 x27: 0000000000000000
[    3.450753] x26: ffff800106d60400 x25: 0000000000000001 x24: ffff80010781a080
[    3.450759] x23: ffff8001008c6000 x22: ffff800106df14c0 x21: ffffd00061814040
[    3.450763] x20: ffff800106d60410 x19: ffff80010781a080 x18: 0000000000000001
[    3.450769] x17: 6d5b20656372756f x16: ffffd00084864b88 x15: ffff800106df1a40
[    3.450772] x14: 0000000000000000 x13: 36312d206c696166 x12: 2065626f72705f6d
[    3.450776] x11: 00000000ffffefff x10: 00000000ffffefff x9 : ffffd000617ec058
[    3.450780] x8 : 0000000000017fe8 x7 : c0000000ffffefff x6 : 000000000000bff4
[    3.450783] x5 : ffff8001ffb42d48 x4 : 0000000000000000 x3 : ffffb0017a870000
[    3.450787] x2 : 0000000000000001 x1 : 0000000000000008 x0 : ffff80010781a080
[    3.450793] Call trace:
[    3.450797]  rp1dpi_vidout_poweroff+0x14/0x40 [drm_rp1_dpi]
[    3.450807]  drm_dev_release+0x30/0x58 [drm]
[    3.450948]  drm_dev_put+0x7c/0xa0 [drm]
[    3.451014]  rp1dpi_platform_probe+0x218/0x3f0 [drm_rp1_dpi]
[    3.451024]  platform_probe+0x70/0xe8
[    3.451031]  really_probe+0x118/0x290
[    3.451037]  __driver_probe_device+0x80/0x140
[    3.451042]  driver_probe_device+0x44/0x130
[    3.451046]  __driver_attach+0x7c/0x138
[    3.451051]  bus_for_each_dev+0x80/0xf0
[    3.451056]  driver_attach+0x2c/0x40
[    3.451060]  bus_add_driver+0xec/0x1f8
[    3.451064]  driver_register+0x68/0x138
[    3.451069]  __platform_driver_register+0x30/0x48
[    3.451071]  rp1dpi_platform_driver_init+0x28/0x3ff8 [drm_rp1_dpi]
[    3.451080]  do_one_initcall+0x50/0x2a0
[    3.451084]  do_init_module+0x60/0x218
[    3.451088]  load_module+0x1bac/0x1d18
[    3.451090]  __do_sys_init_module+0x194/0x208
[    3.451093]  __arm64_sys_init_module+0x24/0x38
[    3.451097]  invoke_syscall+0x4c/0x118
[    3.451102]  el0_svc_common.constprop.0+0xc8/0xf0
[    3.451107]  do_el0_svc+0x24/0x38
[    3.451111]  el0_svc+0x40/0xe8
[    3.451118]  el0t_64_sync_handler+0xc0/0xc8
[    3.451121]  el0t_64_sync+0x190/0x198
[    3.451128] Code: d503201f f9464001 91006021 d50332bf (b900003f)

Additional context

No response

[njhollinghurst]

Not sure why this didn't close itself. Closing issue now.