From d9c6f546469f33f9aa48ae5991c33da8cd535b37 Mon Sep 17 00:00:00 2001 From: Roel Kluin Date: Thu, 16 Apr 2009 22:57:46 +0200 Subject: drm: count reaches -1 With a postfix decrement in the test count will reach -1 rather than 0, subsequent tests fail. Signed-off-by: Roel Kluin Signed-off-by: Dave Airlie --- drivers/gpu/drm/via/via_dma.c | 12 +++++++----- 1 file changed, 7 insertions(+), 5 deletions(-) diff --git a/drivers/gpu/drm/via/via_dma.c b/drivers/gpu/drm/via/via_dma.c index 7a339dba6a6..bfb92d28326 100644 --- a/drivers/gpu/drm/via/via_dma.c +++ b/drivers/gpu/drm/via/via_dma.c @@ -481,11 +481,13 @@ static int via_wait_idle(drm_via_private_t * dev_priv) { int count = 10000000; - while (!(VIA_READ(VIA_REG_STATUS) & VIA_VR_QUEUE_BUSY) && count--); + while (!(VIA_READ(VIA_REG_STATUS) & VIA_VR_QUEUE_BUSY) && --count) + ; - while (count-- && (VIA_READ(VIA_REG_STATUS) & + while (count && (VIA_READ(VIA_REG_STATUS) & (VIA_CMD_RGTR_BUSY | VIA_2D_ENG_BUSY | - VIA_3D_ENG_BUSY))) ; + VIA_3D_ENG_BUSY))) + --count; return count; } @@ -705,7 +707,7 @@ static int via_cmdbuf_size(struct drm_device *dev, void *data, struct drm_file * switch (d_siz->func) { case VIA_CMDBUF_SPACE: while (((tmp_size = via_cmdbuf_space(dev_priv)) < d_siz->size) - && count--) { + && --count) { if (!d_siz->wait) { break; } @@ -717,7 +719,7 @@ static int via_cmdbuf_size(struct drm_device *dev, void *data, struct drm_file * break; case VIA_CMDBUF_LAG: while (((tmp_size = via_cmdbuf_lag(dev_priv)) > d_siz->size) - && count--) { + && --count) { if (!d_siz->wait) { break; } -- cgit From 77d26dc9b9805f322f5a1f6e559b18ad66205bd9 Mon Sep 17 00:00:00 2001 From: Ma Ling Date: Thu, 16 Apr 2009 17:51:25 +0800 Subject: drm: clean dirty memory after device release In current code we register/unregister connector object by drm_sysfs_connector_add/remove function. However under some cases, we need to dynamically register or unregister device multiple times, so we have to go through register -> unregister ->register routine. Because after device_unregister function our memory is dirty, we need to do clean operation in order to re-register the device, otherwise the system will crash. The patch intends to clean device after device release. Signed-off-by: Ma Ling Signed-off-by: Dave Airlie --- drivers/gpu/drm/drm_sysfs.c | 1 + 1 file changed, 1 insertion(+) diff --git a/drivers/gpu/drm/drm_sysfs.c b/drivers/gpu/drm/drm_sysfs.c index bc0c6849360..022876ae34f 100644 --- a/drivers/gpu/drm/drm_sysfs.c +++ b/drivers/gpu/drm/drm_sysfs.c @@ -132,6 +132,7 @@ void drm_sysfs_destroy(void) */ static void drm_sysfs_device_release(struct device *dev) { + memset(dev, 0, sizeof(struct device)); return; } -- cgit From 6b0084266c1d4917ad9259759a1e7bd623cb3888 Mon Sep 17 00:00:00 2001 From: Jonas Bonn Date: Thu, 16 Apr 2009 09:00:02 +0200 Subject: drm: set/clear is_master when master changed The variable is_master is being used to track the drm_file that is currently master, so its value needs to be updated accordingly when the master is changed. Signed-off-by: Jonas Bonn Signed-off-by: Dave Airlie --- drivers/gpu/drm/drm_stub.c | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-) diff --git a/drivers/gpu/drm/drm_stub.c b/drivers/gpu/drm/drm_stub.c index d009661781b..1b3e0ff57b4 100644 --- a/drivers/gpu/drm/drm_stub.c +++ b/drivers/gpu/drm/drm_stub.c @@ -159,6 +159,9 @@ void drm_master_put(struct drm_master **master) int drm_setmaster_ioctl(struct drm_device *dev, void *data, struct drm_file *file_priv) { + if (file_priv->is_master) + return 0; + if (file_priv->minor->master && file_priv->minor->master != file_priv->master) return -EINVAL; @@ -169,6 +172,7 @@ int drm_setmaster_ioctl(struct drm_device *dev, void *data, file_priv->minor->master != file_priv->master) { mutex_lock(&dev->struct_mutex); file_priv->minor->master = drm_master_get(file_priv->master); + file_priv->is_master = 1; mutex_unlock(&dev->struct_mutex); } @@ -178,10 +182,12 @@ int drm_setmaster_ioctl(struct drm_device *dev, void *data, int drm_dropmaster_ioctl(struct drm_device *dev, void *data, struct drm_file *file_priv) { - if (!file_priv->master) + if (!file_priv->is_master) return -EINVAL; + mutex_lock(&dev->struct_mutex); drm_master_put(&file_priv->minor->master); + file_priv->is_master = 0; mutex_unlock(&dev->struct_mutex); return 0; } -- cgit From 07f1c7a7f6736d9ec2eba57d209c5f48888d841e Mon Sep 17 00:00:00 2001 From: Dave Airlie Date: Mon, 20 Apr 2009 09:32:50 +1000 Subject: drm: check for minor master before allowing drop master. When fast user switching a lot eventually we get to the point, where we were checking for the wrong thing in this function. Signed-off-by: Dave Airlie --- drivers/gpu/drm/drm_stub.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/drivers/gpu/drm/drm_stub.c b/drivers/gpu/drm/drm_stub.c index 1b3e0ff57b4..ef878615c49 100644 --- a/drivers/gpu/drm/drm_stub.c +++ b/drivers/gpu/drm/drm_stub.c @@ -185,6 +185,9 @@ int drm_dropmaster_ioctl(struct drm_device *dev, void *data, if (!file_priv->is_master) return -EINVAL; + if (!file_priv->minor->master) + return -EINVAL; + mutex_lock(&dev->struct_mutex); drm_master_put(&file_priv->minor->master); file_priv->is_master = 0; -- cgit From 59de2bebabc5027f93df999d59cc65df591c3e6e Mon Sep 17 00:00:00 2001 From: Shaohua Li Date: Mon, 20 Apr 2009 10:08:35 +1000 Subject: agp: zero pages before sending to userspace AGP pages might be mapped into userspace finally, so the pages should be set to zero before userspace can use it. Otherwise there is potential information leakage. Signed-off-by: Shaohua Li Signed-off-by: Dave Airlie --- drivers/char/agp/generic.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/drivers/char/agp/generic.c b/drivers/char/agp/generic.c index 10d6cbd7c05..2224b762b7f 100644 --- a/drivers/char/agp/generic.c +++ b/drivers/char/agp/generic.c @@ -1226,7 +1226,7 @@ int agp_generic_alloc_pages(struct agp_bridge_data *bridge, struct agp_memory *m int i, ret = -ENOMEM; for (i = 0; i < num_pages; i++) { - page = alloc_page(GFP_KERNEL | GFP_DMA32); + page = alloc_page(GFP_KERNEL | GFP_DMA32 | __GFP_ZERO); /* agp_free_memory() needs gart address */ if (page == NULL) goto out; @@ -1257,7 +1257,7 @@ void *agp_generic_alloc_page(struct agp_bridge_data *bridge) { struct page * page; - page = alloc_page(GFP_KERNEL | GFP_DMA32); + page = alloc_page(GFP_KERNEL | GFP_DMA32 | __GFP_ZERO); if (page == NULL) return NULL; -- cgit