Merge tag 'drm/tegra/for-4.12-rc1' of git://anongit.freedesktop.org/tegra/linux into drm-next

drm/tegra: Changes for v4.12-rc1

This contains various fixes to the host1x driver as well as a plug for a
leak of kernel pointers to userspace.

A fairly big addition this time around is the Video Image Composer (VIC)
support that can be used to accelerate some 2D and image compositing
operations.

Furthermore the driver now supports FB modifiers, so we no longer rely
on a custom IOCTL to set those.

Finally this contains a few preparatory patches for Tegra186 support
which unfortunately didn't quite make it this time, but will hopefully
be ready for v4.13.

* tag 'drm/tegra/for-4.12-rc1' of git://anongit.freedesktop.org/tegra/linux:
  gpu: host1x: Fix host1x driver shutdown
  gpu: host1x: Support module reset
  gpu: host1x: Sort includes alphabetically
  drm/tegra: Add VIC support
  dt-bindings: Add bindings for the Tegra VIC
  drm/tegra: Add falcon helper library
  drm/tegra: Add Tegra DRM allocation API
  drm/tegra: Add tiling FB modifiers
  drm/tegra: Don't leak kernel pointer to userspace
  drm/tegra: Protect IOMMU operations by mutex
  drm/tegra: Enable IOVA API when IOMMU support is enabled
  gpu: host1x: Add IOMMU support
  gpu: host1x: Fix potential out-of-bounds access
  iommu/iova: Fix compile error with CONFIG_IOMMU_IOVA=m
  iommu: Add dummy implementations for !IOMMU_IOVA
  MAINTAINERS: Add related headers to IOMMU section
  iommu/iova: Consolidate code for adding new node to iovad domain rbtree

1 files changed, 10 insertions, 2 deletions

diff --git a/drivers/gpu/drm/tegra/gem.c b/drivers/gpu/drm/tegra/gem.c
index 8672f5d2f237..424569b53e57 100644
--- a/drivers/gpu/drm/tegra/gem.c
+++ b/drivers/gpu/drm/tegra/gem.c
@@ -128,12 +128,14 @@ static int tegra_bo_iommu_map(struct tegra_drm *tegra, struct tegra_bo *bo)
         if (!bo->mm)
                 return -ENOMEM;
 
+        mutex_lock(&tegra->mm_lock);
+
         err = drm_mm_insert_node_generic(&tegra->mm,
                                          bo->mm, bo->gem.size, PAGE_SIZE, 0, 0);
         if (err < 0) {
                 dev_err(tegra->drm->dev, "out of I/O virtual memory: %zd\n",
                         err);
-                goto free;
+                goto unlock;
         }
 
         bo->paddr = bo->mm->start;
@@ -147,11 +149,14 @@ static int tegra_bo_iommu_map(struct tegra_drm *tegra, struct tegra_bo *bo)
 
         bo->size = err;
 
+        mutex_unlock(&tegra->mm_lock);
+
         return 0;
 
 remove:
         drm_mm_remove_node(bo->mm);
-free:
+unlock:
+        mutex_unlock(&tegra->mm_lock);
         kfree(bo->mm);
         return err;
 }
@@ -161,8 +166,11 @@ static int tegra_bo_iommu_unmap(struct tegra_drm *tegra, struct tegra_bo *bo)
         if (!bo->mm)
                 return 0;
 
+        mutex_lock(&tegra->mm_lock);
         iommu_unmap(tegra->domain, bo->paddr, bo->size);
         drm_mm_remove_node(bo->mm);
+        mutex_unlock(&tegra->mm_lock);
+
         kfree(bo->mm);
 
         return 0;