rpms/kernel/devel drm-intel-next.patch, 1.3, 1.4 kernel.spec, 1.1287, 1.1288
Kristian Høgsberg
krh at fedoraproject.org
Wed Feb 11 15:28:08 UTC 2009
- Previous message (by thread): rpms/MochiKit/F-9 import.log, NONE, 1.1 .cvsignore, 1.3, 1.4 MochiKit.spec, 1.2, 1.3 sources, 1.3, 1.4
- Next message (by thread): rpms/graphviz/devel graphviz.spec,1.51,1.52
- Messages sorted by:
[ date ]
[ thread ]
[ subject ]
[ author ]
Author: krh
Update of /cvs/pkgs/rpms/kernel/devel
In directory cvs1.fedora.phx.redhat.com:/tmp/cvs-serv13616
Modified Files:
drm-intel-next.patch kernel.spec
Log Message:
* Wed Feb 11 2009 Kristian Høgsberg <krh at redhat.com>
- Rebase drm-intel-next patch.
drm-intel-next.patch:
Index: drm-intel-next.patch
===================================================================
RCS file: /cvs/pkgs/rpms/kernel/devel/drm-intel-next.patch,v
retrieving revision 1.3
retrieving revision 1.4
diff -u -r1.3 -r1.4
--- drm-intel-next.patch 11 Feb 2009 14:55:23 -0000 1.3
+++ drm-intel-next.patch 11 Feb 2009 15:28:08 -0000 1.4
@@ -15,7 +15,8 @@
# Patches follow
-commit 9c408a5b39bdf17ddb6b1c8c76fd918007a64230
+
+commit 6c7aefedd9ebaf1146581dec54f74b29486dae56
Author: Jesse Barnes <jbarnes at virtuousgeek.org>
Date: Wed Feb 4 14:27:01 2009 -0800
@@ -40,7 +41,7 @@
--
Jesse Barnes, Intel Open Source Technology Center
-commit 323505925ddf763b4a839f44fb24838fc08a639f
+commit 4307cccd79e3c2b45304b28d4c629ef08d30f4a1
Author: Kristian Høgsberg <krh at redhat.com>
Date: Tue Feb 3 15:07:02 2009 -0500
@@ -51,6 +52,102 @@
Signed-off-by: Kristian Høgsberg <krh at redhat.com>
+commit 0e2f967303023f7f82a0963b7f7f3980d4c08f20
+Author: Roland Dreier <rdreier at cisco.com>
+Date: Fri Feb 6 17:48:09 2009 -0800
+
+ drm/i915: Fix potential AB-BA deadlock in i915_gem_execbuffer()
+
+ Lockdep warns that i915_gem_execbuffer() can trigger a page fault (which
+ takes mmap_sem) while holding dev->struct_mutex, while drm_vm_open()
+ (which is called with mmap_sem already held) takes dev->struct_mutex.
+ So this is a potential AB-BA deadlock.
+
+ The way that i915_gem_execbuffer() triggers a page fault is by doing
+ copy_to_user() when returning new buffer offsets back to userspace;
+ however there is no reason to hold the struct_mutex when doing this
+ copy, since what is being copied is the contents of an array private to
+ i915_gem_execbuffer() anyway. So we can fix the potential deadlock (and
+ get rid of the lockdep warning) by simply moving the copy_to_user()
+ outside of where struct_mutex is held.
+
+ This fixes <http://bugzilla.kernel.org/show_bug.cgi?id=12491>.
+
+ Reported-by: Jesse Brandeburg <jesse.brandeburg at intel.com>
+ Tested-by: Jesse Brandeburg <jesse.brandeburg at intel.com>
+ Signed-off-by: Roland Dreier <rolandd at cisco.com>
+ Signed-off-by: Eric Anholt <eric at anholt.net>
+
+commit 42fe9ab5fc5e6249386153a7c562b596ed8e25ce
+Author: Chris Wilson <chris at chris-wilson.co.uk>
+Date: Sun Feb 8 19:08:04 2009 +0000
+
+ drm/i915: refleak along pin() error path.
+
+ A missing unreference if the user calls pin() a second time on a pinned
+ buffer.
+
+ Signed-off-by: Chris Wilson <chris at chris-wilson.co.uk>
+ Signed-off-by: Eric Anholt <eric at anholt.net>
+
+commit db4cdf6345df24e43dc46306a6759060c4901d61
+Author: Chris Wilson <chris at chris-wilson.co.uk>
+Date: Sun Feb 8 19:07:51 2009 +0000
+
+ drm/i915: hold mutex for unreference() in i915_gem_tiling.c
+
+ Signed-off-by: Chris Wilson <chris at chris-wilson.co.uk>
+ Signed-off-by: Eric Anholt <eric at anholt.net>
+
+commit f467a5c7200e156d8e253e6f2bbcf80e6b7187d9
+Author: Chris Wilson <chris at chris-wilson.co.uk>
+Date: Fri Feb 6 16:55:20 2009 +0000
+
+ drm/i915: Cleanup trivial leak on execbuffer error path.
+
+ Also spotted by Owain Ainsworth.
+
+ Signed-off-by: Chris Wilson <chris at chris-wilson.co.uk>
+ Signed-off-by: Eric Anholt <eric at anholt.net>
+
+commit d46d509398b3690ababd05bea6b3bcce52c37780
+Author: Chris Wilson <chris at chris-wilson.co.uk>
+Date: Mon Feb 9 11:31:41 2009 +0000
+
+ drm: Free the object ref on error.
+
+ Ensure that the object is unreferenced if we fail to allocate during
+ drm_gem_flink_ioctl().
+
+ Signed-off-by: Chris Wilson <chris at chris-wilson.co.uk>
+ Signed-off-by: Eric Anholt <eric at anholt.net>
+
+commit 821da41f85b1816e9f7d811a4b9733a07a3585a3
+Author: Chris Wilson <chris at chris-wilson.co.uk>
+Date: Mon Feb 9 11:31:41 2009 +0000
+
+ drm: Potential use-after-free on error path.
+
+ Remove the member from the hash table before we free the structure!
+
+ Signed-off-by: Chris Wilson <chris at chris-wilson.co.uk>
+ Signed-off-by: Eric Anholt <eric at anholt.net>
+
+commit cf1573b0f0e79cb0808596589578a4ca60081730
+Author: Tobias Klauser <tklauser at distanz.ch>
+Date: Mon Feb 9 22:02:42 2009 +0100
+
+ drm/i915: Storage class should be before const qualifier
+
+ The C99 specification states in section 6.11.5:
+
+ The placement of a storage-class specifier other than at the beginning
+ of the declaration specifiers in a declaration is an obsolescent
+ feature.
+
+ Signed-off-by: Tobias Klauser <tklauser at distanz.ch>
+ Signed-off-by: Eric Anholt <eric at anholt.net>
+
diff --git a/drivers/gpu/drm/drm_crtc_helper.c b/drivers/gpu/drm/drm_crtc_helper.c
index 964c5eb..40c60de 100644
--- a/drivers/gpu/drm/drm_crtc_helper.c
@@ -197,6 +294,166 @@
fail_no_encoder:
kfree(save_crtcs);
count = 0;
+diff --git a/drivers/gpu/drm/drm_gem.c b/drivers/gpu/drm/drm_gem.c
+index 6915fb8..e5a8ebf 100644
+--- a/drivers/gpu/drm/drm_gem.c
++++ b/drivers/gpu/drm/drm_gem.c
+@@ -104,8 +104,8 @@ drm_gem_init(struct drm_device *dev)
+
+ if (drm_mm_init(&mm->offset_manager, DRM_FILE_PAGE_OFFSET_START,
+ DRM_FILE_PAGE_OFFSET_SIZE)) {
+- drm_free(mm, sizeof(struct drm_gem_mm), DRM_MEM_MM);
+ drm_ht_remove(&mm->offset_hash);
++ drm_free(mm, sizeof(struct drm_gem_mm), DRM_MEM_MM);
+ return -ENOMEM;
+ }
+
+@@ -295,8 +295,10 @@ drm_gem_flink_ioctl(struct drm_device *dev, void *data,
+ return -EBADF;
+
+ again:
+- if (idr_pre_get(&dev->object_name_idr, GFP_KERNEL) == 0)
+- return -ENOMEM;
++ if (idr_pre_get(&dev->object_name_idr, GFP_KERNEL) == 0) {
++ ret = -ENOMEM;
++ goto err;
++ }
+
+ spin_lock(&dev->object_name_lock);
+ if (obj->name) {
+@@ -310,12 +312,8 @@ again:
+ if (ret == -EAGAIN)
+ goto again;
+
+- if (ret != 0) {
+- mutex_lock(&dev->struct_mutex);
+- drm_gem_object_unreference(obj);
+- mutex_unlock(&dev->struct_mutex);
+- return ret;
+- }
++ if (ret != 0)
++ goto err;
+
+ /*
+ * Leave the reference from the lookup around as the
+@@ -324,6 +322,12 @@ again:
+ args->name = (uint64_t) obj->name;
+
+ return 0;
++
++err:
++ mutex_lock(&dev->struct_mutex);
++ drm_gem_object_unreference(obj);
++ mutex_unlock(&dev->struct_mutex);
++ return ret;
+ }
+
+ /**
+diff --git a/drivers/gpu/drm/i915/i915_gem.c b/drivers/gpu/drm/i915/i915_gem.c
+index 8185766..ff0d94d 100644
+--- a/drivers/gpu/drm/i915/i915_gem.c
++++ b/drivers/gpu/drm/i915/i915_gem.c
+@@ -2480,13 +2480,15 @@ i915_gem_execbuffer(struct drm_device *dev, void *data,
+ if (dev_priv->mm.wedged) {
+ DRM_ERROR("Execbuf while wedged\n");
+ mutex_unlock(&dev->struct_mutex);
+- return -EIO;
++ ret = -EIO;
++ goto pre_mutex_err;
+ }
+
+ if (dev_priv->mm.suspended) {
+ DRM_ERROR("Execbuf while VT-switched.\n");
+ mutex_unlock(&dev->struct_mutex);
+- return -EBUSY;
++ ret = -EBUSY;
++ goto pre_mutex_err;
+ }
+
+ /* Look up object handles */
+@@ -2632,15 +2634,6 @@ i915_gem_execbuffer(struct drm_device *dev, void *data,
+
+ i915_verify_inactive(dev, __FILE__, __LINE__);
+
+- /* Copy the new buffer offsets back to the user's exec list. */
+- ret = copy_to_user((struct drm_i915_relocation_entry __user *)
+- (uintptr_t) args->buffers_ptr,
+- exec_list,
+- sizeof(*exec_list) * args->buffer_count);
+- if (ret)
+- DRM_ERROR("failed to copy %d exec entries "
+- "back to user (%d)\n",
+- args->buffer_count, ret);
+ err:
+ for (i = 0; i < pinned; i++)
+ i915_gem_object_unpin(object_list[i]);
+@@ -2650,6 +2643,18 @@ err:
+
+ mutex_unlock(&dev->struct_mutex);
+
++ if (!ret) {
++ /* Copy the new buffer offsets back to the user's exec list. */
++ ret = copy_to_user((struct drm_i915_relocation_entry __user *)
++ (uintptr_t) args->buffers_ptr,
++ exec_list,
++ sizeof(*exec_list) * args->buffer_count);
++ if (ret)
++ DRM_ERROR("failed to copy %d exec entries "
++ "back to user (%d)\n",
++ args->buffer_count, ret);
++ }
++
+ pre_mutex_err:
+ drm_free(object_list, sizeof(*object_list) * args->buffer_count,
+ DRM_MEM_DRIVER);
+@@ -2753,6 +2758,7 @@ i915_gem_pin_ioctl(struct drm_device *dev, void *data,
+ if (obj_priv->pin_filp != NULL && obj_priv->pin_filp != file_priv) {
+ DRM_ERROR("Already pinned in i915_gem_pin_ioctl(): %d\n",
+ args->handle);
++ drm_gem_object_unreference(obj);
+ mutex_unlock(&dev->struct_mutex);
+ return -EINVAL;
+ }
+diff --git a/drivers/gpu/drm/i915/i915_gem_tiling.c b/drivers/gpu/drm/i915/i915_gem_tiling.c
+index fa1685c..7fb4191 100644
+--- a/drivers/gpu/drm/i915/i915_gem_tiling.c
++++ b/drivers/gpu/drm/i915/i915_gem_tiling.c
+@@ -299,9 +299,8 @@ i915_gem_set_tiling(struct drm_device *dev, void *data,
+ }
+ obj_priv->stride = args->stride;
+
+- mutex_unlock(&dev->struct_mutex);
+-
+ drm_gem_object_unreference(obj);
++ mutex_unlock(&dev->struct_mutex);
+
+ return 0;
+ }
+@@ -340,9 +339,8 @@ i915_gem_get_tiling(struct drm_device *dev, void *data,
+ DRM_ERROR("unknown tiling mode\n");
+ }
+
+- mutex_unlock(&dev->struct_mutex);
+-
+ drm_gem_object_unreference(obj);
++ mutex_unlock(&dev->struct_mutex);
+
+ return 0;
+ }
+diff --git a/drivers/gpu/drm/i915/intel_display.c b/drivers/gpu/drm/i915/intel_display.c
+index bbdd729..0c66952 100644
+--- a/drivers/gpu/drm/i915/intel_display.c
++++ b/drivers/gpu/drm/i915/intel_display.c
+@@ -782,6 +782,9 @@ static void intel_crtc_mode_set(struct drm_crtc *crtc,
+ return;
+ }
+
++ DRM_DEBUG("setting mode on crtc %d, is_lvds: %s\n",
++ crtc->base.id, is_lvds ? "true" : "false");
++
+ fp = clock.n << 16 | clock.m1 << 8 | clock.m2;
+
+ dpll = DPLL_VGA_MODE_DIS;
diff --git a/drivers/gpu/drm/i915/intel_fb.c b/drivers/gpu/drm/i915/intel_fb.c
index afd1217..0fd76d4 100644
--- a/drivers/gpu/drm/i915/intel_fb.c
@@ -276,6 +533,32 @@
return 0;
}
EXPORT_SYMBOL(intelfb_remove);
+diff --git a/drivers/gpu/drm/i915/intel_sdvo.c b/drivers/gpu/drm/i915/intel_sdvo.c
+index a30508b..fbe6f39 100644
+--- a/drivers/gpu/drm/i915/intel_sdvo.c
++++ b/drivers/gpu/drm/i915/intel_sdvo.c
+@@ -193,7 +193,7 @@ static bool intel_sdvo_write_byte(struct intel_output *intel_output, int addr,
+
+ #define SDVO_CMD_NAME_ENTRY(cmd) {cmd, #cmd}
+ /** Mapping of command numbers to names, for debug output */
+-const static struct _sdvo_cmd_name {
++static const struct _sdvo_cmd_name {
+ u8 cmd;
+ char *name;
+ } sdvo_cmd_names[] = {
+diff --git a/drivers/gpu/drm/i915/intel_tv.c b/drivers/gpu/drm/i915/intel_tv.c
+index fbb35dc..56485d6 100644
+--- a/drivers/gpu/drm/i915/intel_tv.c
++++ b/drivers/gpu/drm/i915/intel_tv.c
+@@ -411,7 +411,7 @@ struct tv_mode {
+ * These values account for -1s required.
+ */
+
+-const static struct tv_mode tv_modes[] = {
++static const struct tv_mode tv_modes[] = {
+ {
+ .name = "NTSC-M",
+ .clock = 107520,
diff --git a/include/drm/drm_crtc_helper.h b/include/drm/drm_crtc_helper.h
index 0c6f0e1..28ff3ee 100644
--- a/include/drm/drm_crtc_helper.h
Index: kernel.spec
===================================================================
RCS file: /cvs/pkgs/rpms/kernel/devel/kernel.spec,v
retrieving revision 1.1287
retrieving revision 1.1288
diff -u -r1.1287 -r1.1288
--- kernel.spec 11 Feb 2009 14:55:24 -0000 1.1287
+++ kernel.spec 11 Feb 2009 15:28:08 -0000 1.1288
@@ -1749,6 +1749,9 @@
%kernel_variant_files -k vmlinux %{with_kdump} kdump
%changelog
+* Wed Feb 11 2009 Kristian Høgsberg <krh at redhat.com>
+- Rebase drm-intel-next patch.
+
* Wed Feb 11 2009 Jarod Wilson <jarod at redhat.com> 2.6.29-0.107.rc4.git3
- 2.6.29-rc4-git3
- Previous message (by thread): rpms/MochiKit/F-9 import.log, NONE, 1.1 .cvsignore, 1.3, 1.4 MochiKit.spec, 1.2, 1.3 sources, 1.3, 1.4
- Next message (by thread): rpms/graphviz/devel graphviz.spec,1.51,1.52
- Messages sorted by:
[ date ]
[ thread ]
[ subject ]
[ author ]
More information about the fedora-extras-commits
mailing list