<feed xmlns='http://www.w3.org/2005/Atom'>
<title>litmus-rt.git/include/drm, branch wip-fmlp-dequeue</title>
<subtitle>The LITMUS^RT kernel.</subtitle>
<link rel='alternate' type='text/html' href='http://rtsrv.cs.unc.edu/cgit/cgit.cgi/litmus-rt.git/'/>
<entry>
<title>drm/ttm: Fix two race conditions + fix busy codepaths</title>
<updated>2010-10-05T23:04:43+00:00</updated>
<author>
<name>Thomas Hellstrom</name>
<email>thellstrom@vmware.com</email>
</author>
<published>2010-09-30T10:36:45+00:00</published>
<link rel='alternate' type='text/html' href='http://rtsrv.cs.unc.edu/cgit/cgit.cgi/litmus-rt.git/commit/?id=1df6a2ebd75067aefbdf07482bf8e3d0584e04ee'/>
<id>1df6a2ebd75067aefbdf07482bf8e3d0584e04ee</id>
<content type='text'>
This fixes a race pointed out by Dave Airlie where we don't take a buffer
object about to be destroyed off the LRU lists properly. It also fixes a rare
case where a buffer object could be destroyed in the middle of an
accelerated eviction.

The patch also adds a utility function that can be used to prematurely
release GPU memory space usage of an object waiting to be destroyed.
For example during eviction or swapout.

The above mentioned commit didn't queue the buffer on the delayed destroy
list under some rare circumstances. It also didn't completely honor the
remove_all parameter.

Fixes:
https://bugzilla.redhat.com/show_bug.cgi?id=615505
http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=591061

Signed-off-by: Thomas Hellstrom &lt;thellstrom@vmware.com&gt;
Signed-off-by: Dave Airlie &lt;airlied@redhat.com&gt;
</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
This fixes a race pointed out by Dave Airlie where we don't take a buffer
object about to be destroyed off the LRU lists properly. It also fixes a rare
case where a buffer object could be destroyed in the middle of an
accelerated eviction.

The patch also adds a utility function that can be used to prematurely
release GPU memory space usage of an object waiting to be destroyed.
For example during eviction or swapout.

The above mentioned commit didn't queue the buffer on the delayed destroy
list under some rare circumstances. It also didn't completely honor the
remove_all parameter.

Fixes:
https://bugzilla.redhat.com/show_bug.cgi?id=615505
http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=591061

Signed-off-by: Thomas Hellstrom &lt;thellstrom@vmware.com&gt;
Signed-off-by: Dave Airlie &lt;airlied@redhat.com&gt;
</pre>
</div>
</content>
</entry>
<entry>
<title>drm: Hold the mutex when dropping the last GEM reference (v2)</title>
<updated>2010-10-01T11:08:45+00:00</updated>
<author>
<name>Chris Wilson</name>
<email>chris@chris-wilson.co.uk</email>
</author>
<published>2010-09-30T08:10:26+00:00</published>
<link rel='alternate' type='text/html' href='http://rtsrv.cs.unc.edu/cgit/cgit.cgi/litmus-rt.git/commit/?id=39b4d07aa3583ceefe73622841303a0a3e942ca1'/>
<id>39b4d07aa3583ceefe73622841303a0a3e942ca1</id>
<content type='text'>
In order to be fully threadsafe we need to check that the drm_gem_object
refcount is still 0 after acquiring the mutex in order to call the free
function. Otherwise, we may encounter scenarios like:

Thread A:                                        Thread B:
drm_gem_close
unreference_unlocked
kref_put                                         mutex_lock
...                                              i915_gem_evict
...                                              kref_get -&gt; BUG
...                                              i915_gem_unbind
...                                              kref_put
...                                              i915_gem_object_free
...                                              mutex_unlock
mutex_lock
i915_gem_object_free -&gt; BUG
i915_gem_object_unbind
kfree
mutex_unlock

Note that no driver is currently using the free_unlocked vfunc and it is
scheduled for removal, hasten that process.

Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=30454
Reported-and-Tested-by: Magnus Kessler &lt;Magnus.Kessler@gmx.net&gt;
Signed-off-by: Chris Wilson &lt;chris@chris-wilson.co.uk&gt;
Cc: stable@kernel.org
Signed-off-by: Dave Airlie &lt;airlied@redhat.com&gt;
</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
In order to be fully threadsafe we need to check that the drm_gem_object
refcount is still 0 after acquiring the mutex in order to call the free
function. Otherwise, we may encounter scenarios like:

Thread A:                                        Thread B:
drm_gem_close
unreference_unlocked
kref_put                                         mutex_lock
...                                              i915_gem_evict
...                                              kref_get -&gt; BUG
...                                              i915_gem_unbind
...                                              kref_put
...                                              i915_gem_object_free
...                                              mutex_unlock
mutex_lock
i915_gem_object_free -&gt; BUG
i915_gem_object_unbind
kfree
mutex_unlock

Note that no driver is currently using the free_unlocked vfunc and it is
scheduled for removal, hasten that process.

Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=30454
Reported-and-Tested-by: Magnus Kessler &lt;Magnus.Kessler@gmx.net&gt;
Signed-off-by: Chris Wilson &lt;chris@chris-wilson.co.uk&gt;
Cc: stable@kernel.org
Signed-off-by: Dave Airlie &lt;airlied@redhat.com&gt;
</pre>
</div>
</content>
</entry>
<entry>
<title>drm/gem: handlecount isn't really a kref so don't make it one.</title>
<updated>2010-09-30T23:17:44+00:00</updated>
<author>
<name>Dave Airlie</name>
<email>airlied@redhat.com</email>
</author>
<published>2010-09-27T06:17:17+00:00</published>
<link rel='alternate' type='text/html' href='http://rtsrv.cs.unc.edu/cgit/cgit.cgi/litmus-rt.git/commit/?id=29d08b3efddca628b0360411ab2b85f7b1723f48'/>
<id>29d08b3efddca628b0360411ab2b85f7b1723f48</id>
<content type='text'>
There were lots of places being inconsistent since handle count
looked like a kref but it really wasn't.

Fix this my just making handle count an atomic on the object,
and have it increase the normal object kref.

Now i915/radeon/nouveau drivers can drop the normal reference on
userspace object creation, and have the handle hold it.

This patch fixes a memory leak or corruption on unload, because
the driver had no way of knowing if a handle had been actually
added for this object, and the fbcon object needed to know this
to clean itself up properly.

Reviewed-by: Chris Wilson &lt;chris@chris-wilson.co.uk&gt;
Signed-off-by: Dave Airlie &lt;airlied@redhat.com&gt;
</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
There were lots of places being inconsistent since handle count
looked like a kref but it really wasn't.

Fix this my just making handle count an atomic on the object,
and have it increase the normal object kref.

Now i915/radeon/nouveau drivers can drop the normal reference on
userspace object creation, and have the handle hold it.

This patch fixes a memory leak or corruption on unload, because
the driver had no way of knowing if a handle had been actually
added for this object, and the fbcon object needed to know this
to clean itself up properly.

Reviewed-by: Chris Wilson &lt;chris@chris-wilson.co.uk&gt;
Signed-off-by: Dave Airlie &lt;airlied@redhat.com&gt;
</pre>
</div>
</content>
</entry>
<entry>
<title>drm: Prune GEM vma entries</title>
<updated>2010-09-27T23:14:34+00:00</updated>
<author>
<name>Chris Wilson</name>
<email>chris@chris-wilson.co.uk</email>
</author>
<published>2010-09-27T20:28:30+00:00</published>
<link rel='alternate' type='text/html' href='http://rtsrv.cs.unc.edu/cgit/cgit.cgi/litmus-rt.git/commit/?id=31dfbc93923c0aaa0440b809f80ff2830c6a531a'/>
<id>31dfbc93923c0aaa0440b809f80ff2830c6a531a</id>
<content type='text'>
Hook the GEM vm open/close ops into the generic drm vm open/close so
that the private vma entries are created and destroy appropriately.
Fixes the leak of the drm_vma_entries during the lifetime of the filp.

Reported-by: Matt Mackall &lt;mpm@selenic.com&gt;
Cc: Jesse Barnes &lt;jbarnes@virtuousgeek.org&gt;
Signed-off-by: Chris Wilson &lt;chris@chris-wilson.co.uk&gt;
Acked-by: Jesse Barnes &lt;jbarnes@virtuousgeek.org&gt;
Cc: stable@kernel.org
Signed-off-by: Dave Airlie &lt;airlied@redhat.com&gt;
</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
Hook the GEM vm open/close ops into the generic drm vm open/close so
that the private vma entries are created and destroy appropriately.
Fixes the leak of the drm_vma_entries during the lifetime of the filp.

Reported-by: Matt Mackall &lt;mpm@selenic.com&gt;
Cc: Jesse Barnes &lt;jbarnes@virtuousgeek.org&gt;
Signed-off-by: Chris Wilson &lt;chris@chris-wilson.co.uk&gt;
Acked-by: Jesse Barnes &lt;jbarnes@virtuousgeek.org&gt;
Cc: stable@kernel.org
Signed-off-by: Dave Airlie &lt;airlied@redhat.com&gt;
</pre>
</div>
</content>
</entry>
<entry>
<title>drm/radeon: fix PCI ID 5657 to be an RV410</title>
<updated>2010-09-26T23:21:28+00:00</updated>
<author>
<name>Dave Airlie</name>
<email>airlied@redhat.com</email>
</author>
<published>2010-09-25T07:45:50+00:00</published>
<link rel='alternate' type='text/html' href='http://rtsrv.cs.unc.edu/cgit/cgit.cgi/litmus-rt.git/commit/?id=f459ffbdfd04edb4a8ce6eea33170eb057a5e695'/>
<id>f459ffbdfd04edb4a8ce6eea33170eb057a5e695</id>
<content type='text'>
fixes https://bugzilla.kernel.org/show_bug.cgi?id=19012

cc: stable@kernel.org
Signed-off-by: Dave Airlie &lt;airlied@redhat.com&gt;
</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
fixes https://bugzilla.kernel.org/show_bug.cgi?id=19012

cc: stable@kernel.org
Signed-off-by: Dave Airlie &lt;airlied@redhat.com&gt;
</pre>
</div>
</content>
</entry>
<entry>
<title>drm: Use a nondestructive mode for output detect when polling (v2)</title>
<updated>2010-09-14T10:38:48+00:00</updated>
<author>
<name>Chris Wilson</name>
<email>chris@chris-wilson.co.uk</email>
</author>
<published>2010-09-14T10:07:23+00:00</published>
<link rel='alternate' type='text/html' href='http://rtsrv.cs.unc.edu/cgit/cgit.cgi/litmus-rt.git/commit/?id=930a9e283516a3a3595c0c515113f1b78d07f695'/>
<id>930a9e283516a3a3595c0c515113f1b78d07f695</id>
<content type='text'>
v2: Julien Cristau pointed out that @nondestructive results in
double-negatives and confusion when trying to interpret the parameter,
so use @force instead. Much easier to type as well. ;-)

And fix the miscompilation of vmgfx reported by Sedat Dilek.

Signed-off-by: Chris Wilson &lt;chris@chris-wilson.co.uk&gt;
Cc: stable@kernel.org
Signed-off-by: Dave Airlie &lt;airlied@redhat.com&gt;
</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
v2: Julien Cristau pointed out that @nondestructive results in
double-negatives and confusion when trying to interpret the parameter,
so use @force instead. Much easier to type as well. ;-)

And fix the miscompilation of vmgfx reported by Sedat Dilek.

Signed-off-by: Chris Wilson &lt;chris@chris-wilson.co.uk&gt;
Cc: stable@kernel.org
Signed-off-by: Dave Airlie &lt;airlied@redhat.com&gt;
</pre>
</div>
</content>
</entry>
<entry>
<title>drm: Use a nondestructive mode for output detect when polling</title>
<updated>2010-09-13T10:29:11+00:00</updated>
<author>
<name>Chris Wilson</name>
<email>chris@chris-wilson.co.uk</email>
</author>
<published>2010-09-09T22:51:02+00:00</published>
<link rel='alternate' type='text/html' href='http://rtsrv.cs.unc.edu/cgit/cgit.cgi/litmus-rt.git/commit/?id=7b334fcb45b757ffb093696ca3de1b0c8b4a33f1'/>
<id>7b334fcb45b757ffb093696ca3de1b0c8b4a33f1</id>
<content type='text'>
Destructive load-detection is very expensive and due to failings
elsewhere can trigger system wide stalls of up to 600ms. A simple
first step to correcting this is not to invoke such an expensive
and destructive load-detection operation automatically.

Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=29536
Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=16265
Reported-by: Bruno Prémont &lt;bonbons@linux-vserver.org&gt;
Tested-by: Sitsofe Wheeler &lt;sitsofe@yahoo.com&gt;
Signed-off-by: Chris Wilson &lt;chris@chris-wilson.co.uk&gt;
Cc: stable@kernel.org
Signed-off-by: Dave Airlie &lt;airlied@redhat.com&gt;
</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
Destructive load-detection is very expensive and due to failings
elsewhere can trigger system wide stalls of up to 600ms. A simple
first step to correcting this is not to invoke such an expensive
and destructive load-detection operation automatically.

Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=29536
Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=16265
Reported-by: Bruno Prémont &lt;bonbons@linux-vserver.org&gt;
Tested-by: Sitsofe Wheeler &lt;sitsofe@yahoo.com&gt;
Signed-off-by: Chris Wilson &lt;chris@chris-wilson.co.uk&gt;
Cc: stable@kernel.org
Signed-off-by: Dave Airlie &lt;airlied@redhat.com&gt;
</pre>
</div>
</content>
</entry>
<entry>
<title>Merge branch 'drm-core-next' of git://git.kernel.org/pub/scm/linux/kernel/git/airlied/drm-2.6</title>
<updated>2010-08-24T01:28:03+00:00</updated>
<author>
<name>Linus Torvalds</name>
<email>torvalds@linux-foundation.org</email>
</author>
<published>2010-08-24T01:28:03+00:00</published>
<link rel='alternate' type='text/html' href='http://rtsrv.cs.unc.edu/cgit/cgit.cgi/litmus-rt.git/commit/?id=ee005577aa3b89f5291fe73be2054d375d23f5eb'/>
<id>ee005577aa3b89f5291fe73be2054d375d23f5eb</id>
<content type='text'>
* 'drm-core-next' of git://git.kernel.org/pub/scm/linux/kernel/git/airlied/drm-2.6: (33 commits)
  drm/radeon/kms: fix typo in radeon_compute_pll_gain
  drm/radeon/kms: try to detect tv vs monitor for underscan
  drm/radeon/kms: fix sideport detection on newer rs880 boards
  drm/radeon: fix passing wrong type to gem object create.
  drm/radeon/kms: set encoder type to DVI for HDMI on evergreen
  drm/radeon/kms: add back missing break in info ioctl
  drm/radeon/kms: don't enable MSIs on AGP boards
  drm/radeon/kms: fix agp mode setup on cards that use pcie bridges
  drm: move dereference below check
  drm: fix end of loop test
  drm/radeon/kms: rework radeon_dp_detect() logic
  drm/radeon/kms: add missing asic callback assignment for evergreen
  drm/radeon/kms/DCE3+: switch pads to ddc mode when going i2c
  drm/radeon/kms/pm: bail early if nothing's changing
  drm/radeon/kms/atom: clean up dig atom handling
  drm/radeon/kms: DCE3/4 transmitter fixes
  drm/radeon/kms: rework encoder handling
  drm/radeon/kms: DCE3/4 AdjustPixelPll updates
  drm/radeon: Fix stack data leak
  drm/radeon/kms: fix GTT/VRAM overlapping test
  ...
</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
* 'drm-core-next' of git://git.kernel.org/pub/scm/linux/kernel/git/airlied/drm-2.6: (33 commits)
  drm/radeon/kms: fix typo in radeon_compute_pll_gain
  drm/radeon/kms: try to detect tv vs monitor for underscan
  drm/radeon/kms: fix sideport detection on newer rs880 boards
  drm/radeon: fix passing wrong type to gem object create.
  drm/radeon/kms: set encoder type to DVI for HDMI on evergreen
  drm/radeon/kms: add back missing break in info ioctl
  drm/radeon/kms: don't enable MSIs on AGP boards
  drm/radeon/kms: fix agp mode setup on cards that use pcie bridges
  drm: move dereference below check
  drm: fix end of loop test
  drm/radeon/kms: rework radeon_dp_detect() logic
  drm/radeon/kms: add missing asic callback assignment for evergreen
  drm/radeon/kms/DCE3+: switch pads to ddc mode when going i2c
  drm/radeon/kms/pm: bail early if nothing's changing
  drm/radeon/kms/atom: clean up dig atom handling
  drm/radeon/kms: DCE3/4 transmitter fixes
  drm/radeon/kms: rework encoder handling
  drm/radeon/kms: DCE3/4 AdjustPixelPll updates
  drm/radeon: Fix stack data leak
  drm/radeon/kms: fix GTT/VRAM overlapping test
  ...
</pre>
</div>
</content>
</entry>
<entry>
<title>drm: block userspace under allocating buffer and having drivers overwrite it (v2)</title>
<updated>2010-08-17T04:52:25+00:00</updated>
<author>
<name>Dave Airlie</name>
<email>airlied@redhat.com</email>
</author>
<published>2010-08-14T10:20:34+00:00</published>
<link rel='alternate' type='text/html' href='http://rtsrv.cs.unc.edu/cgit/cgit.cgi/litmus-rt.git/commit/?id=1b2f1489633888d4a06028315dc19d65768a1c05'/>
<id>1b2f1489633888d4a06028315dc19d65768a1c05</id>
<content type='text'>
With the current screwed but its ABI, ioctls for the drm, Linus pointed out that we could allow userspace to specify the allocation size, but we pass it to the driver which then uses it blindly to store a struct. Now if userspace specifies the allocation size as smaller than the driver needs, the driver can possibly overwrite memory.

This patch restructures the driver ioctls so we store the structure size we are expecting, and make sure we allocate at least that size. The copy from/to userspace are still restricted to the size the user specifies, this allows ioctl structs to grow on both sides of the equation.

Up until now we didn't really use the DRM_IOCTL defines in the kernel, so this cleans them up and adds them for nouveau.

v2:
fix nouveau pushbuf arg (thanks to Ben for pointing it out)

Reported-by: Linus Torvalds &lt;torvalds@linuxfoundation.org&gt;
Signed-off-by: Dave Airlie &lt;airlied@redhat.com&gt;
</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
With the current screwed but its ABI, ioctls for the drm, Linus pointed out that we could allow userspace to specify the allocation size, but we pass it to the driver which then uses it blindly to store a struct. Now if userspace specifies the allocation size as smaller than the driver needs, the driver can possibly overwrite memory.

This patch restructures the driver ioctls so we store the structure size we are expecting, and make sure we allocate at least that size. The copy from/to userspace are still restricted to the size the user specifies, this allows ioctl structs to grow on both sides of the equation.

Up until now we didn't really use the DRM_IOCTL defines in the kernel, so this cleans them up and adds them for nouveau.

v2:
fix nouveau pushbuf arg (thanks to Ben for pointing it out)

Reported-by: Linus Torvalds &lt;torvalds@linuxfoundation.org&gt;
Signed-off-by: Dave Airlie &lt;airlied@redhat.com&gt;
</pre>
</div>
</content>
</entry>
<entry>
<title>include: replace unifdef-y with header-y</title>
<updated>2010-08-14T20:26:51+00:00</updated>
<author>
<name>Sam Ravnborg</name>
<email>sam@ravnborg.org</email>
</author>
<published>2010-08-14T08:15:12+00:00</published>
<link rel='alternate' type='text/html' href='http://rtsrv.cs.unc.edu/cgit/cgit.cgi/litmus-rt.git/commit/?id=60641aa1f379820e99ac7f45a38b43795670c741'/>
<id>60641aa1f379820e99ac7f45a38b43795670c741</id>
<content type='text'>
unifdef-y and header-y has same semantic.
So there is no need to have both.

Drop the unifdef-y variant and sort all lines again

Signed-off-by: Sam Ravnborg &lt;sam@ravnborg.org&gt;
</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
unifdef-y and header-y has same semantic.
So there is no need to have both.

Drop the unifdef-y variant and sort all lines again

Signed-off-by: Sam Ravnborg &lt;sam@ravnborg.org&gt;
</pre>
</div>
</content>
</entry>
</feed>
