linux-kernel - Re: drm/vc4: false-positive negative cursor position warning

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <87efjow2vo.fsf@anholt.net>
Date:   Mon, 09 Apr 2018 13:17:47 -0700
From:   Eric Anholt <eric@...olt.net>
To:     Daniel J Blueman <daniel@...ra.org>,
        dri-devel@...ts.freedesktop.org
Cc:     Dave Airlie <airlied@...hat.com>,
        Linux Kernel <linux-kernel@...r.kernel.org>,
        boris.brezillon@...tlin.com
Subject: Re: drm/vc4: false-positive negative cursor position warning

Daniel J Blueman <daniel@...ra.org> writes:

> Hi Eric et al,
>
> In a number of windowing environments (eg GNOME 3) on Raspberry Pi 3B
> on 4.16.0 arm64, the mouse cursor top-left gets down to x,y -4,-4,
> tripping WARN_ON_ONCE(plane->state->crtc_x < 0 || plane->state->crtc_y
> < 0) [1], which therefore seems false-positive.
>
> Git history doesn't turn up any reason, eg it could cause undefined
> hardware behaviour, which it doesn't appear to, so would it be better
> to drop the warning, or adjust it to trip on x or y < -4 or so? If so,
> I'll prepare a patch to adjust it.

Ccing Boris, who's been doing work on the async update path.

Take a look at vc4_plane_setup_clipping_and_scaling(state) -- that has
the corrections necessary for negative x/y.  We're calling that too late
(through the avc4_plane_atomic_check() path) for this function's usage
of the offsets[].

Since it affects the computed src_w/h, we'd have to update those as well
in our async update.  Our async update is racy in a way that makes me
uncomfortable -- the HVS could process our display list at any point in
our writel() sequence, which is not very atomic.  Maybe we should be
using a double-buffered HVS display list per element, and then have the
main display list jump into each element's current display list and back
out, so that we can do async flips to new plane state by just commiting
a single writel() to the new HVS display element list.

Download attachment "signature.asc" of type "application/pgp-signature" (833 bytes)