target/linux/brcm2708/patches-4.9/0166-drm-vc4-Fix-race-between-page-flip-completion-event-.patch

   1 From d7f32f81cf7579ac7d13127db88e789ea864824c Mon Sep 17 00:00:00 2001
   2 From: Derek Foreman <derekf@osg.samsung.com>
   3 Date: Thu, 24 Nov 2016 12:11:55 -0600
   4 Subject: [PATCH] drm/vc4: Fix race between page flip completion event and
   5  clean-up
   6
   7 There was a small window where a userspace program could submit
   8 a pageflip after receiving a pageflip completion event yet still
   9 receive EBUSY.
  10
  11 Signed-off-by: Derek Foreman <derekf@osg.samsung.com>
  12 Signed-off-by: Eric Anholt <eric@anholt.net>
  13 Reviewed-by: Eric Anholt <eric@anholt.net>
  14 Reviewed-by: Daniel Stone <daniels@collabora.com>
  15 (cherry picked from commit 26fc78f6fef39b9d7a15def5e7e9826ff68303f4)
  16 ---
  17  drivers/gpu/drm/vc4/vc4_crtc.c |  8 ++++++++
  18  drivers/gpu/drm/vc4/vc4_drv.h  |  1 +
  19  drivers/gpu/drm/vc4/vc4_kms.c  | 33 +++++++++++++++++++++++++--------
  20  3 files changed, 34 insertions(+), 8 deletions(-)
  21
  22 --- a/drivers/gpu/drm/vc4/vc4_crtc.c
  23 +++ b/drivers/gpu/drm/vc4/vc4_crtc.c
  24 @@ -682,6 +682,14 @@ void vc4_disable_vblank(struct drm_devic
  25         CRTC_WRITE(PV_INTEN, 0);
  26  }
  27
  28 +/* Must be called with the event lock held */
  29 +bool vc4_event_pending(struct drm_crtc *crtc)
  30 +{
  31 +       struct vc4_crtc *vc4_crtc = to_vc4_crtc(crtc);
  32 +
  33 +       return !!vc4_crtc->event;
  34 +}
  35 +
  36  static void vc4_crtc_handle_page_flip(struct vc4_crtc *vc4_crtc)
  37  {
  38         struct drm_crtc *crtc = &vc4_crtc->base;
  39 --- a/drivers/gpu/drm/vc4/vc4_drv.h
  40 +++ b/drivers/gpu/drm/vc4/vc4_drv.h
  41 @@ -445,6 +445,7 @@ int vc4_bo_stats_debugfs(struct seq_file
  42  extern struct platform_driver vc4_crtc_driver;
  43  int vc4_enable_vblank(struct drm_device *dev, unsigned int crtc_id);
  44  void vc4_disable_vblank(struct drm_device *dev, unsigned int crtc_id);
  45 +bool vc4_event_pending(struct drm_crtc *crtc);
  46  int vc4_crtc_debugfs_regs(struct seq_file *m, void *arg);
  47  int vc4_crtc_get_scanoutpos(struct drm_device *dev, unsigned int crtc_id,
  48                             unsigned int flags, int *vpos, int *hpos,
  49 --- a/drivers/gpu/drm/vc4/vc4_kms.c
  50 +++ b/drivers/gpu/drm/vc4/vc4_kms.c
  51 @@ -119,17 +119,34 @@ static int vc4_atomic_commit(struct drm_
  52
  53         /* Make sure that any outstanding modesets have finished. */
  54         if (nonblock) {
  55 -               ret = down_trylock(&vc4->async_modeset);
  56 -               if (ret) {
  57 +               struct drm_crtc *crtc;
  58 +               struct drm_crtc_state *crtc_state;
  59 +               unsigned long flags;
  60 +               bool busy = false;
  61 +
  62 +               /*
  63 +                * If there's an undispatched event to send then we're
  64 +                * obviously still busy.  If there isn't, then we can
  65 +                * unconditionally wait for the semaphore because it
  66 +                * shouldn't be contended (for long).
  67 +                *
  68 +                * This is to prevent a race where queuing a new flip
  69 +                * from userspace immediately on receipt of an event
  70 +                * beats our clean-up and returns EBUSY.
  71 +                */
  72 +               spin_lock_irqsave(&dev->event_lock, flags);
  73 +               for_each_crtc_in_state(state, crtc, crtc_state, i)
  74 +                       busy |= vc4_event_pending(crtc);
  75 +               spin_unlock_irqrestore(&dev->event_lock, flags);
  76 +               if (busy) {
  77                         kfree(c);
  78                         return -EBUSY;
  79                 }
  80 -       } else {
  81 -               ret = down_interruptible(&vc4->async_modeset);
  82 -               if (ret) {
  83 -                       kfree(c);
  84 -                       return ret;
  85 -               }
  86 +       }
  87 +       ret = down_interruptible(&vc4->async_modeset);
  88 +       if (ret) {
  89 +               kfree(c);
  90 +               return ret;
  91         }
  92
  93         ret = drm_atomic_helper_prepare_planes(dev, state);