msm: mdss: protect iommu attached status variable with iommu_lock

Commit dd7ad27eb3de6b088b6525b066c40f5a29ac4c60 ("msm: mdss: fix
race condition between iommu attach and sending DCS cmds") protected
the iommu attach/detach to fix possible race condition between the
display thread and DCS cmd sending from ESD or some other thread with
iommu_lock. But this still leaves possibility of race condition based
on iommu_attached status flag.
  -> Display thread finishes the attach and releases the iommu lock
  -> DCS cmd thread gets the iommu lock and checks iommu_attached
     status before display thread could change it.
Protect the iommu_attached status variable along with iommu
attach/detach to avoid such cases.

Change-Id: I42d0ced5cbfd741cf02ad71c80c4f01dde37f647
Signed-off-by: Veera Sundaram Sankaran <veeras@codeaurora.org>
Signed-off-by: Krishna Manikandan <mkrishn@codeaurora.org>

2 files changed, 21 insertions, 12 deletions

diff --git a/drivers/video/fbdev/msm/mdss_smmu.c b/drivers/video/fbdev/msm/mdss_smmu.c
index 2239791fdad0..a08eec8e1606 100644
--- a/drivers/video/fbdev/msm/mdss_smmu.c
+++ b/drivers/video/fbdev/msm/mdss_smmu.c
@@ -177,7 +177,6 @@ static int mdss_smmu_attach_v2(struct mdss_data_type *mdata)
 	struct mdss_smmu_client *mdss_smmu;
 	int i, rc = 0;
 
-	mutex_lock(&mdp_iommu_lock);
 	for (i = 0; i < MDSS_IOMMU_MAX_DOMAIN; i++) {
 		if (!mdss_smmu_is_valid_domain_type(mdata, i))
 			continue;
@@ -211,11 +210,9 @@ static int mdss_smmu_attach_v2(struct mdss_data_type *mdata)
 			}
 		} else {
 			pr_err("iommu device not attached for domain[%d]\n", i);
-			mutex_unlock(&mdp_iommu_lock);
 			return -ENODEV;
 		}
 	}
-	mutex_unlock(&mdp_iommu_lock);
 
 	return 0;
 
@@ -228,7 +225,6 @@ err:
 			mdss_smmu->domain_attached = false;
 		}
 	}
-	mutex_unlock(&mdp_iommu_lock);
 
 	return rc;
 }
@@ -245,7 +241,6 @@ static int mdss_smmu_detach_v2(struct mdss_data_type *mdata)
 	struct mdss_smmu_client *mdss_smmu;
 	int i;
 
-	mutex_lock(&mdp_iommu_lock);
 	for (i = 0; i < MDSS_IOMMU_MAX_DOMAIN; i++) {
 		if (!mdss_smmu_is_valid_domain_type(mdata, i))
 			continue;
@@ -270,7 +265,6 @@ static int mdss_smmu_detach_v2(struct mdss_data_type *mdata)
 			}
 		}
 	}
-	mutex_unlock(&mdp_iommu_lock);
 
 	return 0;
 }
diff --git a/drivers/video/fbdev/msm/mdss_smmu.h b/drivers/video/fbdev/msm/mdss_smmu.h
index 07b33a9432ae..73b978b72f0e 100644
--- a/drivers/video/fbdev/msm/mdss_smmu.h
+++ b/drivers/video/fbdev/msm/mdss_smmu.h
@@ -150,18 +150,26 @@ static inline int mdss_smmu_attach(struct mdss_data_type *mdata)
 {
 	int rc;
 
+	mdata->mdss_util->iommu_lock();
 	MDSS_XLOG(mdata->iommu_attached);
+
 	if (mdata->iommu_attached) {
 		pr_debug("mdp iommu already attached\n");
-		return 0;
+		rc = 0;
+		goto end;
 	}
 
-	if (!mdata->smmu_ops.smmu_attach)
-		return -ENOSYS;
+	if (!mdata->smmu_ops.smmu_attach) {
+		rc = -ENODEV;
+		goto end;
+	}
 
 	rc =  mdata->smmu_ops.smmu_attach(mdata);
 	if (!rc)
 		mdata->iommu_attached = true;
+
+end:
+	mdata->mdss_util->iommu_unlock();
 	return rc;
 }
 
@@ -169,19 +177,26 @@ static inline int mdss_smmu_detach(struct mdss_data_type *mdata)
 {
 	int rc;
 
+	mdata->mdss_util->iommu_lock();
 	MDSS_XLOG(mdata->iommu_attached);
 
 	if (!mdata->iommu_attached) {
 		pr_debug("mdp iommu already dettached\n");
-		return 0;
+		rc = 0;
+		goto end;
 	}
 
-	if (!mdata->smmu_ops.smmu_detach)
-		return -ENOSYS;
+	if (!mdata->smmu_ops.smmu_detach) {
+		rc = -ENODEV;
+		goto end;
+	}
 
 	rc = mdata->smmu_ops.smmu_detach(mdata);
 	if (!rc)
 		mdata->iommu_attached = false;
+
+end:
+	mdata->mdss_util->iommu_unlock();
 	return rc;
 }