From patchwork Fri Aug 19 00:29:03 2022 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Danilo Krummrich X-Patchwork-Id: 12948200 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from gabe.freedesktop.org (gabe.freedesktop.org [131.252.210.177]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.lore.kernel.org (Postfix) with ESMTPS id 27184C00140 for ; Fri, 19 Aug 2022 00:29:54 +0000 (UTC) Received: from gabe.freedesktop.org (localhost [127.0.0.1]) by gabe.freedesktop.org (Postfix) with ESMTP id B14E610E497; Fri, 19 Aug 2022 00:29:49 +0000 (UTC) Received: from us-smtp-delivery-124.mimecast.com (us-smtp-delivery-124.mimecast.com [170.10.129.124]) by gabe.freedesktop.org (Postfix) with ESMTPS id 7B1DE10E497 for ; Fri, 19 Aug 2022 00:29:16 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=mimecast20190719; t=1660868955; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=ZdQAnurZVFdXXS4WbKVSyp7TafzRJAbZ0GKKLX98Mwk=; b=F0PZBhESAXU5ec7zYb6EO9HojUmSlABIlBRvowO+y4I1Zs7EPX16OQcMLK5ErVNuqBvOZW /J+gI0FjkU+LCgxKIqZ/wKKqt58cFSR5FMNNDDC66xMCVMoZv92tiHcpOiPeQ/R6EfbHU+ wr8rvbEGMKL2G3dmVnp+kuQV8tXlY8Y= Received: from mail-ej1-f70.google.com (mail-ej1-f70.google.com [209.85.218.70]) by relay.mimecast.com with ESMTP with STARTTLS (version=TLSv1.3, cipher=TLS_AES_128_GCM_SHA256) id us-mta-259-ZMh94aPoOwOt6OjmpjqNfw-1; Thu, 18 Aug 2022 20:29:13 -0400 X-MC-Unique: ZMh94aPoOwOt6OjmpjqNfw-1 Received: by mail-ej1-f70.google.com with SMTP id sc31-20020a1709078a1f00b0073096c2b4e1so1092642ejc.22 for ; Thu, 18 Aug 2022 17:29:12 -0700 (PDT) X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20210112; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-message-state:from:to:cc; bh=ZdQAnurZVFdXXS4WbKVSyp7TafzRJAbZ0GKKLX98Mwk=; b=LtrtZ+txbVWz1XcyTJwF+9vLYq0zX+Znme4VqTy7ANbsUo0PHEhQ+KOuG+t9dbKnkf 9QZ77DebPrROjd33sNWnJ62fsxtQSV0pQT/VI/lE3XVG3/rT22j6rem3r0cZQKHYZrub h/A3j4hB7ZlW+tobp6MvR248lPaMV9JwIURDYlZ0c0B38Ve6O9It3dV0F+xQGiA1Ksts 9EkFhizaRwTJsIehsxSwwP4VAF2wuHwNbwlj8AixqRShzRhxhYmL4fkHz94zHiDONqFS Nyuw9m23Ti80upLmbWnk79kCJmdqn7/Eh2/Ib74M7Z5CXr55EJmwOF00IrIexMtrShfT Zeig== X-Gm-Message-State: ACgBeo2cQ/laA2kcSx9DdnufMisAGSUUteQNqnADZbSpP3mB8rxy822U B+u2GadN0gsmkJA3p2vMqsdSsb5zEOtPEMFX5K5bG07VYdbOHdeZgWPLYpVaBEfxPNXMA85cwGI uoybdoUIwKHIj+wGGUekwfkFk9oMR X-Received: by 2002:a05:6402:554:b0:446:1013:c898 with SMTP id i20-20020a056402055400b004461013c898mr3898707edx.269.1660868951859; Thu, 18 Aug 2022 17:29:11 -0700 (PDT) X-Google-Smtp-Source: AA6agR7vEVnE89EQFAzGx7Rjk8MdzgcItMbGIbKShh9H17mhg7mQ2H1lZaOWswF7giUus2phpUqZew== X-Received: by 2002:a05:6402:554:b0:446:1013:c898 with SMTP id i20-20020a056402055400b004461013c898mr3898697edx.269.1660868951704; Thu, 18 Aug 2022 17:29:11 -0700 (PDT) Received: from pollux.redhat.com ([2a02:810d:4b40:2ee8:642:1aff:fe31:a15c]) by smtp.gmail.com with ESMTPSA id b26-20020aa7cd1a000000b004460b020ffdsm2027913edw.83.2022.08.18.17.29.10 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Thu, 18 Aug 2022 17:29:11 -0700 (PDT) From: Danilo Krummrich To: daniel@ffwll.ch, airlied@linux.ie, tzimmermann@suse.de, mripard@kernel.org Subject: [PATCH drm-misc-next 1/3] drm/vc4: hdmi: unlock mutex when device is unplugged Date: Fri, 19 Aug 2022 02:29:03 +0200 Message-Id: <20220819002905.82095-2-dakr@redhat.com> X-Mailer: git-send-email 2.37.2 In-Reply-To: <20220819002905.82095-1-dakr@redhat.com> References: <20220819002905.82095-1-dakr@redhat.com> MIME-Version: 1.0 X-Mimecast-Spam-Score: 0 X-Mimecast-Originator: redhat.com X-BeenThere: dri-devel@lists.freedesktop.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Direct Rendering Infrastructure - Development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Cc: Danilo Krummrich , linux-kernel@vger.kernel.org, dri-devel@lists.freedesktop.org Errors-To: dri-devel-bounces@lists.freedesktop.org Sender: "dri-devel" In vc4_hdmi_encoder_{pre,post}_crtc_enable() commit cd00ed5187bf ("drm/vc4: hdmi: Protect device resources after removal") missed to unlock the mutex before returning due to drm_dev_enter() indicating the device being unplugged. Fixes: cd00ed5187bf ("drm/vc4: hdmi: Protect device resources after removal") Signed-off-by: Danilo Krummrich --- drivers/gpu/drm/vc4/vc4_hdmi.c | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/drivers/gpu/drm/vc4/vc4_hdmi.c b/drivers/gpu/drm/vc4/vc4_hdmi.c index 84e5a91c2ea7..4d3ff51ad2a8 100644 --- a/drivers/gpu/drm/vc4/vc4_hdmi.c +++ b/drivers/gpu/drm/vc4/vc4_hdmi.c @@ -1425,7 +1425,7 @@ static void vc4_hdmi_encoder_pre_crtc_enable(struct drm_encoder *encoder, mutex_lock(&vc4_hdmi->mutex); if (!drm_dev_enter(drm, &idx)) - return; + goto out; if (vc4_hdmi->variant->csc_setup) vc4_hdmi->variant->csc_setup(vc4_hdmi, conn_state, mode); @@ -1436,6 +1436,7 @@ static void vc4_hdmi_encoder_pre_crtc_enable(struct drm_encoder *encoder, drm_dev_exit(idx); +out: mutex_unlock(&vc4_hdmi->mutex); } @@ -1455,7 +1456,7 @@ static void vc4_hdmi_encoder_post_crtc_enable(struct drm_encoder *encoder, mutex_lock(&vc4_hdmi->mutex); if (!drm_dev_enter(drm, &idx)) - return; + goto out; spin_lock_irqsave(&vc4_hdmi->hw_lock, flags); @@ -1516,6 +1517,8 @@ static void vc4_hdmi_encoder_post_crtc_enable(struct drm_encoder *encoder, vc4_hdmi_enable_scrambling(encoder); drm_dev_exit(idx); + +out: mutex_unlock(&vc4_hdmi->mutex); } From patchwork Fri Aug 19 00:29:04 2022 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Danilo Krummrich X-Patchwork-Id: 12953921 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from gabe.freedesktop.org (gabe.freedesktop.org [131.252.210.177]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.lore.kernel.org (Postfix) with ESMTPS id 70BFAC00140 for ; Wed, 24 Aug 2022 19:14:54 +0000 (UTC) Received: from gabe.freedesktop.org (localhost [127.0.0.1]) by gabe.freedesktop.org (Postfix) with ESMTP id B464BC11AF; Wed, 24 Aug 2022 19:14:02 +0000 (UTC) Received: from us-smtp-delivery-124.mimecast.com (us-smtp-delivery-124.mimecast.com [170.10.133.124]) by gabe.freedesktop.org (Postfix) with ESMTPS id 54E4C10E497 for ; Fri, 19 Aug 2022 00:29:18 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=mimecast20190719; t=1660868957; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=AJnA1gWIAKMVWb7er1TKy0XozOPw4mLsXagd+kCHnAI=; b=QySu4FF0mLj3zWDHJPtDsRyU2i1vTwDNs5lsOsdcmv9u1yvzEBULe3LnkvFYXav0sTcm/j UeKrWhPX2P343DtWAtWZIdEEsm3pHMIvegZ54DPyXaPPkYwsS9i0s2zHU4Q2Se5dSolLN8 91nUSTHRg6efVagaq6hns5aUgZWAwtQ= Received: from mail-ed1-f70.google.com (mail-ed1-f70.google.com [209.85.208.70]) by relay.mimecast.com with ESMTP with STARTTLS (version=TLSv1.3, cipher=TLS_AES_128_GCM_SHA256) id us-mta-318-57_5HBJMNp-vLUnelNovnA-1; Thu, 18 Aug 2022 20:29:14 -0400 X-MC-Unique: 57_5HBJMNp-vLUnelNovnA-1 Received: by mail-ed1-f70.google.com with SMTP id z6-20020a05640240c600b0043e1d52fd98so1867564edb.22 for ; Thu, 18 Aug 2022 17:29:14 -0700 (PDT) X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20210112; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-message-state:from:to:cc; bh=AJnA1gWIAKMVWb7er1TKy0XozOPw4mLsXagd+kCHnAI=; b=5+GqQJsQLTEb/21sLMi11vKUK+V5dzLaRa/jo86G1S/Tg+Jv89WpJiwcfb32522pzx tOKfVYmvXDTQqLcmBI4JTwQTtlmTnDzlXaY2zkMMBmoRScczmJTswO2vjcM9r54kEXyn F01zoSLBUzT9sa0+6tREp2wMOjkRjOKwrSXQ9dN+5q0Gc1dWEWmQ8Oovtjo86pdZJVXD HWACpEw/I9zB7zmQoEOdbMrrKw7iSdbRH4YlBFd3EBcSyCdVvC6ISCU1304puTg5GEIE fgI1EBXu9psRtv69ZfCValvxRqPDd0/qjAQsbt6XYeaWxvT+kSsOOhGXMaGR583Qrfyf L9/w== X-Gm-Message-State: ACgBeo38PcUmsS/ckvvrKAqvpDqpNqzJ9FwYeRMPKDlt3+Xl54Hfw4kU MRp22L4a72TkVCSls62HqIeTHJrJFbMfLRgdma+agzFtXDtdsLdzqih0Oo5cFgoBoCgcaT+w+8J GNr8ZEwNP9+J8ZV6xN8qAidHAQLg9 X-Received: by 2002:a17:907:a07b:b0:735:6744:c6be with SMTP id ia27-20020a170907a07b00b007356744c6bemr3118223ejc.685.1660868953215; Thu, 18 Aug 2022 17:29:13 -0700 (PDT) X-Google-Smtp-Source: AA6agR4bPd1mGGbe4dYNjuUk6IBg2CW64/qzKlChk1S6e92cEUNZnl9nwhQOXUa5thhN1mFXZmO1Mw== X-Received: by 2002:a17:907:a07b:b0:735:6744:c6be with SMTP id ia27-20020a170907a07b00b007356744c6bemr3118217ejc.685.1660868953026; Thu, 18 Aug 2022 17:29:13 -0700 (PDT) Received: from pollux.redhat.com ([2a02:810d:4b40:2ee8:642:1aff:fe31:a15c]) by smtp.gmail.com with ESMTPSA id b26-20020aa7cd1a000000b004460b020ffdsm2027913edw.83.2022.08.18.17.29.11 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Thu, 18 Aug 2022 17:29:12 -0700 (PDT) From: Danilo Krummrich To: daniel@ffwll.ch, airlied@linux.ie, tzimmermann@suse.de, mripard@kernel.org Subject: [PATCH drm-misc-next 2/3] drm/vc4: plane: protect device resources after removal Date: Fri, 19 Aug 2022 02:29:04 +0200 Message-Id: <20220819002905.82095-3-dakr@redhat.com> X-Mailer: git-send-email 2.37.2 In-Reply-To: <20220819002905.82095-1-dakr@redhat.com> References: <20220819002905.82095-1-dakr@redhat.com> MIME-Version: 1.0 X-Mimecast-Spam-Score: 0 X-Mimecast-Originator: redhat.com X-BeenThere: dri-devel@lists.freedesktop.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Direct Rendering Infrastructure - Development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Cc: Danilo Krummrich , linux-kernel@vger.kernel.org, dri-devel@lists.freedesktop.org Errors-To: dri-devel-bounces@lists.freedesktop.org Sender: "dri-devel" (Hardware) resources which are bound to the driver and device lifecycle must not be accessed after the device and driver are unbound. However, the DRM device isn't freed as long as the last user closed it, hence userspace can still call into the driver. Therefore protect the critical sections which are accessing those resources with drm_dev_enter() and drm_dev_exit(). Fixes: 9872c7a31921 ("drm/vc4: plane: Switch to drmm_universal_plane_alloc()") Signed-off-by: Danilo Krummrich --- drivers/gpu/drm/vc4/vc4_drv.h | 1 + drivers/gpu/drm/vc4/vc4_plane.c | 25 +++++++++++++++++++++++++ 2 files changed, 26 insertions(+) diff --git a/drivers/gpu/drm/vc4/vc4_drv.h b/drivers/gpu/drm/vc4/vc4_drv.h index 418a8242691f..80da9a9337cc 100644 --- a/drivers/gpu/drm/vc4/vc4_drv.h +++ b/drivers/gpu/drm/vc4/vc4_drv.h @@ -341,6 +341,7 @@ struct vc4_hvs { struct vc4_plane { struct drm_plane base; + struct drm_device *dev; }; static inline struct vc4_plane * diff --git a/drivers/gpu/drm/vc4/vc4_plane.c b/drivers/gpu/drm/vc4/vc4_plane.c index eff9c63adfa7..cb13bb583546 100644 --- a/drivers/gpu/drm/vc4/vc4_plane.c +++ b/drivers/gpu/drm/vc4/vc4_plane.c @@ -19,6 +19,7 @@ #include #include #include +#include #include #include #include @@ -1218,14 +1219,22 @@ static void vc4_plane_atomic_update(struct drm_plane *plane, u32 vc4_plane_write_dlist(struct drm_plane *plane, u32 __iomem *dlist) { struct vc4_plane_state *vc4_state = to_vc4_plane_state(plane->state); + struct vc4_plane *vc4_plane = to_vc4_plane(plane); int i; + int idx; vc4_state->hw_dlist = dlist; + if (!drm_dev_enter(vc4_plane->dev, &idx)) + goto out; + /* Can't memcpy_toio() because it needs to be 32-bit writes. */ for (i = 0; i < vc4_state->dlist_count; i++) writel(vc4_state->dlist[i], &dlist[i]); + drm_dev_exit(idx); + +out: return vc4_state->dlist_count; } @@ -1243,8 +1252,10 @@ u32 vc4_plane_dlist_size(const struct drm_plane_state *state) void vc4_plane_async_set_fb(struct drm_plane *plane, struct drm_framebuffer *fb) { struct vc4_plane_state *vc4_state = to_vc4_plane_state(plane->state); + struct vc4_plane *vc4_plane = to_vc4_plane(plane); struct drm_gem_dma_object *bo = drm_fb_dma_get_gem_obj(fb, 0); uint32_t addr; + int idx; /* We're skipping the address adjustment for negative origin, * because this is only called on the primary plane. @@ -1252,12 +1263,17 @@ void vc4_plane_async_set_fb(struct drm_plane *plane, struct drm_framebuffer *fb) WARN_ON_ONCE(plane->state->crtc_x < 0 || plane->state->crtc_y < 0); addr = bo->dma_addr + fb->offsets[0]; + if (!drm_dev_enter(vc4_plane->dev, &idx)) + return; + /* Write the new address into the hardware immediately. The * scanout will start from this address as soon as the FIFO * needs to refill with pixels. */ writel(addr, &vc4_state->hw_dlist[vc4_state->ptr0_offset]); + drm_dev_exit(idx); + /* Also update the CPU-side dlist copy, so that any later * atomic updates that don't do a new modeset on our plane * also use our updated address. @@ -1271,6 +1287,8 @@ static void vc4_plane_atomic_async_update(struct drm_plane *plane, struct drm_plane_state *new_plane_state = drm_atomic_get_new_plane_state(state, plane); struct vc4_plane_state *vc4_state, *new_vc4_state; + struct vc4_plane *vc4_plane = to_vc4_plane(plane); + int idx; swap(plane->state->fb, new_plane_state->fb); plane->state->crtc_x = new_plane_state->crtc_x; @@ -1323,6 +1341,9 @@ static void vc4_plane_atomic_async_update(struct drm_plane *plane, vc4_state->dlist[vc4_state->ptr0_offset] = new_vc4_state->dlist[vc4_state->ptr0_offset]; + if (!drm_dev_enter(vc4_plane->dev, &idx)) + return; + /* Note that we can't just call vc4_plane_write_dlist() * because that would smash the context data that the HVS is * currently using. @@ -1333,6 +1354,8 @@ static void vc4_plane_atomic_async_update(struct drm_plane *plane, &vc4_state->hw_dlist[vc4_state->pos2_offset]); writel(vc4_state->dlist[vc4_state->ptr0_offset], &vc4_state->hw_dlist[vc4_state->ptr0_offset]); + + drm_dev_exit(idx); } static int vc4_plane_atomic_async_check(struct drm_plane *plane, @@ -1521,6 +1544,8 @@ struct drm_plane *vc4_plane_init(struct drm_device *dev, modifiers, type, NULL); if (IS_ERR(vc4_plane)) return ERR_CAST(vc4_plane); + + vc4_plane->dev = dev; plane = &vc4_plane->base; if (vc4->is_vc5) From patchwork Fri Aug 19 00:29:05 2022 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Danilo Krummrich X-Patchwork-Id: 12948199 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from gabe.freedesktop.org (gabe.freedesktop.org [131.252.210.177]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.lore.kernel.org (Postfix) with ESMTPS id 29AE0C00140 for ; Fri, 19 Aug 2022 00:29:47 +0000 (UTC) Received: from gabe.freedesktop.org (localhost [127.0.0.1]) by gabe.freedesktop.org (Postfix) with ESMTP id B24C910E5CC; Fri, 19 Aug 2022 00:29:43 +0000 (UTC) Received: from us-smtp-delivery-124.mimecast.com (us-smtp-delivery-124.mimecast.com [170.10.129.124]) by gabe.freedesktop.org (Postfix) with ESMTPS id BFB8010E4DE for ; Fri, 19 Aug 2022 00:29:17 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=mimecast20190719; t=1660868956; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=nZkz/OabS5gsWkkQKjM89j1/6sZadLuGX+5mWMwAoOc=; b=J9+jhZ4INDcnj5LrttbG/pDZpedWMxFLflwku91oIF8MTtK0Ir4iT1uiziY4PeQprZR/0f 9G+zvFYIxEuS2LjKCMh0YcVFzmGcQqqeVfMPx066qo0HGMXkdDiFikj5fVjJx9g4I0B2wc yFGS48y6qnVp5GKS8zLfLgPRlw90J4Y= Received: from mail-ej1-f69.google.com (mail-ej1-f69.google.com [209.85.218.69]) by relay.mimecast.com with ESMTP with STARTTLS (version=TLSv1.3, cipher=TLS_AES_128_GCM_SHA256) id us-mta-597-Xk10_jNWOa2IfGPXa-0SKQ-1; Thu, 18 Aug 2022 20:29:15 -0400 X-MC-Unique: Xk10_jNWOa2IfGPXa-0SKQ-1 Received: by mail-ej1-f69.google.com with SMTP id ga16-20020a1709070c1000b007331af32d3aso1072800ejc.4 for ; Thu, 18 Aug 2022 17:29:15 -0700 (PDT) X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20210112; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-message-state:from:to:cc; bh=nZkz/OabS5gsWkkQKjM89j1/6sZadLuGX+5mWMwAoOc=; b=2B7ixVNYNSm1/yl8p+vUa7YqUTbWn13ihgY7kDn0qy+DLbTU4r7kcsoWfSx4MElx9d 1M1VdORgtHp/gi1/wXW0NaEIAK4zF4AkUFyswt+2z57t/EQ346fqDmBEEYRzr2oMe9le 2E3p5wpnnEY+PLvhaT53OAH5HRrflo8qtBVqlzOrSxnJyl8u3gi7A3+ZrqNIujRu3Y8W bIJsWU+pJ513ZaVB6JyswOo+jrCW7hSRGY0MkXa+gskQSe3rPP/aDJ5YoS/ovYBOlUKh Rz4ODNJNKMViGdYO+tYGFtMPBKv8IqA4PffqjFMPNPCnDQQctjMoPHYM+Q08l2tyjCTl JoVA== X-Gm-Message-State: ACgBeo3VZepDoLchZId6gpInvJWhLvwdYgqw/5R3VcDXMGa+35Q5pXWK DBpHVKCKYGzf4GxiWePdGpWJPUjYuOzjELydKWBmhstoPwiIY/GrfW/fSv7zCACzyMhxXe0Sj31 qzw7pJUxKYiOKi5nnhUwngk/m0wot X-Received: by 2002:a17:907:69b0:b0:730:a1f0:63e7 with SMTP id ra48-20020a17090769b000b00730a1f063e7mr3230743ejc.364.1660868954669; Thu, 18 Aug 2022 17:29:14 -0700 (PDT) X-Google-Smtp-Source: AA6agR69VOlMq30KnwZaAQTSrGpxNLSfPxSOQvLe3+fq+Fwv51y4m04N1qfRfTUdN5d2gTKsUNEPdQ== X-Received: by 2002:a17:907:69b0:b0:730:a1f0:63e7 with SMTP id ra48-20020a17090769b000b00730a1f063e7mr3230736ejc.364.1660868954509; Thu, 18 Aug 2022 17:29:14 -0700 (PDT) Received: from pollux.redhat.com ([2a02:810d:4b40:2ee8:642:1aff:fe31:a15c]) by smtp.gmail.com with ESMTPSA id b26-20020aa7cd1a000000b004460b020ffdsm2027913edw.83.2022.08.18.17.29.13 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Thu, 18 Aug 2022 17:29:14 -0700 (PDT) From: Danilo Krummrich To: daniel@ffwll.ch, airlied@linux.ie, tzimmermann@suse.de, mripard@kernel.org Subject: [PATCH drm-misc-next 3/3] drm/vc4: crtc: protect device resources after removal Date: Fri, 19 Aug 2022 02:29:05 +0200 Message-Id: <20220819002905.82095-4-dakr@redhat.com> X-Mailer: git-send-email 2.37.2 In-Reply-To: <20220819002905.82095-1-dakr@redhat.com> References: <20220819002905.82095-1-dakr@redhat.com> MIME-Version: 1.0 X-Mimecast-Spam-Score: 0 X-Mimecast-Originator: redhat.com X-BeenThere: dri-devel@lists.freedesktop.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Direct Rendering Infrastructure - Development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Cc: Danilo Krummrich , linux-kernel@vger.kernel.org, dri-devel@lists.freedesktop.org Errors-To: dri-devel-bounces@lists.freedesktop.org Sender: "dri-devel" (Hardware) resources which are bound to the driver and device lifecycle must not be accessed after the device and driver are unbound. However, the DRM device isn't freed as long as the last user closed it, hence userspace can still call into the driver. Therefore protect the critical sections which are accessing those resources with drm_dev_enter() and drm_dev_exit(). Fixes: 7cc4214c27cf ("drm/vc4: crtc: Switch to drmm_kzalloc") Signed-off-by: Danilo Krummrich --- drivers/gpu/drm/vc4/vc4_crtc.c | 41 +++++++++++++++++++++++++++++++++- 1 file changed, 40 insertions(+), 1 deletion(-) diff --git a/drivers/gpu/drm/vc4/vc4_crtc.c b/drivers/gpu/drm/vc4/vc4_crtc.c index 2def6e2ad6f0..51daf190196e 100644 --- a/drivers/gpu/drm/vc4/vc4_crtc.c +++ b/drivers/gpu/drm/vc4/vc4_crtc.c @@ -39,6 +39,7 @@ #include #include #include +#include #include #include #include @@ -295,10 +296,17 @@ struct drm_encoder *vc4_get_crtc_encoder(struct drm_crtc *crtc, static void vc4_crtc_pixelvalve_reset(struct drm_crtc *crtc) { struct vc4_crtc *vc4_crtc = to_vc4_crtc(crtc); + struct drm_device *dev = crtc->dev; + int idx; + + if (!drm_dev_enter(dev, &idx)) + return; /* The PV needs to be disabled before it can be flushed */ CRTC_WRITE(PV_CONTROL, CRTC_READ(PV_CONTROL) & ~PV_CONTROL_EN); CRTC_WRITE(PV_CONTROL, CRTC_READ(PV_CONTROL) | PV_CONTROL_FIFO_CLR); + + drm_dev_exit(idx); } static void vc4_crtc_config_pv(struct drm_crtc *crtc, struct drm_encoder *encoder, @@ -321,6 +329,10 @@ static void vc4_crtc_config_pv(struct drm_crtc *crtc, struct drm_encoder *encode u32 format = is_dsi1 ? PV_CONTROL_FORMAT_DSIV_24 : PV_CONTROL_FORMAT_24; u8 ppc = pv_data->pixels_per_clock; bool debug_dump_regs = false; + int idx; + + if (!drm_dev_enter(dev, &idx)) + return; if (debug_dump_regs) { struct drm_printer p = drm_info_printer(&vc4_crtc->pdev->dev); @@ -410,6 +422,8 @@ static void vc4_crtc_config_pv(struct drm_crtc *crtc, struct drm_encoder *encode drm_crtc_index(crtc)); drm_print_regset32(&p, &vc4_crtc->regset); } + + drm_dev_exit(idx); } static void require_hvs_enabled(struct drm_device *dev) @@ -430,13 +444,18 @@ static int vc4_crtc_disable(struct drm_crtc *crtc, struct vc4_crtc *vc4_crtc = to_vc4_crtc(crtc); struct drm_device *dev = crtc->dev; struct vc4_dev *vc4 = to_vc4_dev(dev); - int ret; + int idx, ret; + + if (!drm_dev_enter(dev, &idx)) + return -ENODEV; CRTC_WRITE(PV_V_CONTROL, CRTC_READ(PV_V_CONTROL) & ~PV_VCONTROL_VIDEN); ret = wait_for(!(CRTC_READ(PV_V_CONTROL) & PV_VCONTROL_VIDEN), 1); WARN_ONCE(ret, "Timeout waiting for !PV_VCONTROL_VIDEN\n"); + drm_dev_exit(idx); + /* * This delay is needed to avoid to get a pixel stuck in an * unflushable FIFO between the pixelvalve and the HDMI @@ -588,6 +607,7 @@ static void vc4_crtc_atomic_enable(struct drm_crtc *crtc, struct vc4_crtc *vc4_crtc = to_vc4_crtc(crtc); struct drm_encoder *encoder = vc4_get_crtc_encoder(crtc, new_state); struct vc4_encoder *vc4_encoder = to_vc4_encoder(encoder); + int idx; drm_dbg(dev, "Enabling CRTC %s (%u) connected to Encoder %s (%u)", crtc->name, crtc->base.id, encoder->name, encoder->base.id); @@ -606,6 +626,9 @@ static void vc4_crtc_atomic_enable(struct drm_crtc *crtc, vc4_crtc_config_pv(crtc, encoder, state); + if (!drm_dev_enter(dev, &idx)) + return; + CRTC_WRITE(PV_CONTROL, CRTC_READ(PV_CONTROL) | PV_CONTROL_EN); if (vc4_encoder->pre_crtc_enable) @@ -617,6 +640,8 @@ static void vc4_crtc_atomic_enable(struct drm_crtc *crtc, CRTC_WRITE(PV_V_CONTROL, CRTC_READ(PV_V_CONTROL) | PV_VCONTROL_VIDEN); + drm_dev_exit(idx); + if (vc4_encoder->post_crtc_enable) vc4_encoder->post_crtc_enable(encoder, state); } @@ -711,17 +736,31 @@ static int vc4_crtc_atomic_check(struct drm_crtc *crtc, static int vc4_enable_vblank(struct drm_crtc *crtc) { struct vc4_crtc *vc4_crtc = to_vc4_crtc(crtc); + struct drm_device *dev = crtc->dev; + int idx; + + if (!drm_dev_enter(dev, &idx)) + return -ENODEV; CRTC_WRITE(PV_INTEN, PV_INT_VFP_START); + drm_dev_exit(idx); + return 0; } static void vc4_disable_vblank(struct drm_crtc *crtc) { struct vc4_crtc *vc4_crtc = to_vc4_crtc(crtc); + struct drm_device *dev = crtc->dev; + int idx; + + if (!drm_dev_enter(dev, &idx)) + return; CRTC_WRITE(PV_INTEN, 0); + + drm_dev_exit(idx); } static void vc4_crtc_handle_page_flip(struct vc4_crtc *vc4_crtc)