diff options
author | Jan Beulich <jbeulich@novell.com> | 2008-06-18 04:28:00 -0400 |
---|---|---|
committer | Dave Airlie <airlied@redhat.com> | 2008-06-18 19:56:16 -0400 |
commit | da503fa60b84d5945deb3ab74efdd0bec61df4a1 (patch) | |
tree | 9883d28cabdab419567a2c0689d06c938460eaa1 /drivers/char/agp | |
parent | dcd981a77b2b35d169656d4b9cee208096ed7ccf (diff) |
agp: two-stage page destruction issue
besides it apparently being useful only in 2.6.24 (the changes in 2.6.25
really mean that it could be converted back to a single-stage mechanism),
I'm seeing an issue in Xen Dom0 kernels, which is caused by the calling
of gart_to_virt() in the second stage invocations of the destroy function.
I think that besides this being a real issue with Xen (where
unmap_page_from_agp() is not just a page table attribute change), this
also is invalid from a theoretical perspective: One should not assume that
gart_to_virt() is still valid after unmapping a page. So minimally (keeping
the 2-stage mechanism) a patch like the one below would be needed.
Jan
Signed-off-by: Dave Airlie <airlied@redhat.com>
Diffstat (limited to 'drivers/char/agp')
-rw-r--r-- | drivers/char/agp/backend.c | 16 | ||||
-rw-r--r-- | drivers/char/agp/generic.c | 7 | ||||
-rw-r--r-- | drivers/char/agp/intel-agp.c | 6 |
3 files changed, 17 insertions, 12 deletions
diff --git a/drivers/char/agp/backend.c b/drivers/char/agp/backend.c index b1bdd015165c..1ec87104e68c 100644 --- a/drivers/char/agp/backend.c +++ b/drivers/char/agp/backend.c | |||
@@ -188,10 +188,10 @@ static int agp_backend_initialize(struct agp_bridge_data *bridge) | |||
188 | 188 | ||
189 | err_out: | 189 | err_out: |
190 | if (bridge->driver->needs_scratch_page) { | 190 | if (bridge->driver->needs_scratch_page) { |
191 | bridge->driver->agp_destroy_page(gart_to_virt(bridge->scratch_page_real), | 191 | void *va = gart_to_virt(bridge->scratch_page_real); |
192 | AGP_PAGE_DESTROY_UNMAP); | 192 | |
193 | bridge->driver->agp_destroy_page(gart_to_virt(bridge->scratch_page_real), | 193 | bridge->driver->agp_destroy_page(va, AGP_PAGE_DESTROY_UNMAP); |
194 | AGP_PAGE_DESTROY_FREE); | 194 | bridge->driver->agp_destroy_page(va, AGP_PAGE_DESTROY_FREE); |
195 | } | 195 | } |
196 | if (got_gatt) | 196 | if (got_gatt) |
197 | bridge->driver->free_gatt_table(bridge); | 197 | bridge->driver->free_gatt_table(bridge); |
@@ -215,10 +215,10 @@ static void agp_backend_cleanup(struct agp_bridge_data *bridge) | |||
215 | 215 | ||
216 | if (bridge->driver->agp_destroy_page && | 216 | if (bridge->driver->agp_destroy_page && |
217 | bridge->driver->needs_scratch_page) { | 217 | bridge->driver->needs_scratch_page) { |
218 | bridge->driver->agp_destroy_page(gart_to_virt(bridge->scratch_page_real), | 218 | void *va = gart_to_virt(bridge->scratch_page_real); |
219 | AGP_PAGE_DESTROY_UNMAP); | 219 | |
220 | bridge->driver->agp_destroy_page(gart_to_virt(bridge->scratch_page_real), | 220 | bridge->driver->agp_destroy_page(va, AGP_PAGE_DESTROY_UNMAP); |
221 | AGP_PAGE_DESTROY_FREE); | 221 | bridge->driver->agp_destroy_page(va, AGP_PAGE_DESTROY_FREE); |
222 | } | 222 | } |
223 | } | 223 | } |
224 | 224 | ||
diff --git a/drivers/char/agp/generic.c b/drivers/char/agp/generic.c index 7fc0c99a3a58..b6650a63197d 100644 --- a/drivers/char/agp/generic.c +++ b/drivers/char/agp/generic.c | |||
@@ -202,10 +202,13 @@ void agp_free_memory(struct agp_memory *curr) | |||
202 | } | 202 | } |
203 | if (curr->page_count != 0) { | 203 | if (curr->page_count != 0) { |
204 | for (i = 0; i < curr->page_count; i++) { | 204 | for (i = 0; i < curr->page_count; i++) { |
205 | curr->bridge->driver->agp_destroy_page(gart_to_virt(curr->memory[i]), AGP_PAGE_DESTROY_UNMAP); | 205 | curr->memory[i] = (unsigned long)gart_to_virt(curr->memory[i]); |
206 | curr->bridge->driver->agp_destroy_page((void *)curr->memory[i], | ||
207 | AGP_PAGE_DESTROY_UNMAP); | ||
206 | } | 208 | } |
207 | for (i = 0; i < curr->page_count; i++) { | 209 | for (i = 0; i < curr->page_count; i++) { |
208 | curr->bridge->driver->agp_destroy_page(gart_to_virt(curr->memory[i]), AGP_PAGE_DESTROY_FREE); | 210 | curr->bridge->driver->agp_destroy_page((void *)curr->memory[i], |
211 | AGP_PAGE_DESTROY_FREE); | ||
209 | } | 212 | } |
210 | } | 213 | } |
211 | agp_free_key(curr->key); | 214 | agp_free_key(curr->key); |
diff --git a/drivers/char/agp/intel-agp.c b/drivers/char/agp/intel-agp.c index eeea50a1d22a..01b03402ea92 100644 --- a/drivers/char/agp/intel-agp.c +++ b/drivers/char/agp/intel-agp.c | |||
@@ -418,9 +418,11 @@ static void intel_i810_free_by_type(struct agp_memory *curr) | |||
418 | if (curr->page_count == 4) | 418 | if (curr->page_count == 4) |
419 | i8xx_destroy_pages(gart_to_virt(curr->memory[0])); | 419 | i8xx_destroy_pages(gart_to_virt(curr->memory[0])); |
420 | else { | 420 | else { |
421 | agp_bridge->driver->agp_destroy_page(gart_to_virt(curr->memory[0]), | 421 | void *va = gart_to_virt(curr->memory[0]); |
422 | |||
423 | agp_bridge->driver->agp_destroy_page(va, | ||
422 | AGP_PAGE_DESTROY_UNMAP); | 424 | AGP_PAGE_DESTROY_UNMAP); |
423 | agp_bridge->driver->agp_destroy_page(gart_to_virt(curr->memory[0]), | 425 | agp_bridge->driver->agp_destroy_page(va, |
424 | AGP_PAGE_DESTROY_FREE); | 426 | AGP_PAGE_DESTROY_FREE); |
425 | } | 427 | } |
426 | agp_free_page_array(curr); | 428 | agp_free_page_array(curr); |