aboutsummaryrefslogtreecommitdiffstats
path: root/drivers/char/agp
diff options
context:
space:
mode:
authorJan Beulich <jbeulich@novell.com>2008-06-18 04:28:00 -0400
committerDave Airlie <airlied@redhat.com>2008-06-18 19:56:16 -0400
commitda503fa60b84d5945deb3ab74efdd0bec61df4a1 (patch)
tree9883d28cabdab419567a2c0689d06c938460eaa1 /drivers/char/agp
parentdcd981a77b2b35d169656d4b9cee208096ed7ccf (diff)
agp: two-stage page destruction issue
besides it apparently being useful only in 2.6.24 (the changes in 2.6.25 really mean that it could be converted back to a single-stage mechanism), I'm seeing an issue in Xen Dom0 kernels, which is caused by the calling of gart_to_virt() in the second stage invocations of the destroy function. I think that besides this being a real issue with Xen (where unmap_page_from_agp() is not just a page table attribute change), this also is invalid from a theoretical perspective: One should not assume that gart_to_virt() is still valid after unmapping a page. So minimally (keeping the 2-stage mechanism) a patch like the one below would be needed. Jan Signed-off-by: Dave Airlie <airlied@redhat.com>
Diffstat (limited to 'drivers/char/agp')
-rw-r--r--drivers/char/agp/backend.c16
-rw-r--r--drivers/char/agp/generic.c7
-rw-r--r--drivers/char/agp/intel-agp.c6
3 files changed, 17 insertions, 12 deletions
diff --git a/drivers/char/agp/backend.c b/drivers/char/agp/backend.c
index b1bdd015165c..1ec87104e68c 100644
--- a/drivers/char/agp/backend.c
+++ b/drivers/char/agp/backend.c
@@ -188,10 +188,10 @@ static int agp_backend_initialize(struct agp_bridge_data *bridge)
188 188
189err_out: 189err_out:
190 if (bridge->driver->needs_scratch_page) { 190 if (bridge->driver->needs_scratch_page) {
191 bridge->driver->agp_destroy_page(gart_to_virt(bridge->scratch_page_real), 191 void *va = gart_to_virt(bridge->scratch_page_real);
192 AGP_PAGE_DESTROY_UNMAP); 192
193 bridge->driver->agp_destroy_page(gart_to_virt(bridge->scratch_page_real), 193 bridge->driver->agp_destroy_page(va, AGP_PAGE_DESTROY_UNMAP);
194 AGP_PAGE_DESTROY_FREE); 194 bridge->driver->agp_destroy_page(va, AGP_PAGE_DESTROY_FREE);
195 } 195 }
196 if (got_gatt) 196 if (got_gatt)
197 bridge->driver->free_gatt_table(bridge); 197 bridge->driver->free_gatt_table(bridge);
@@ -215,10 +215,10 @@ static void agp_backend_cleanup(struct agp_bridge_data *bridge)
215 215
216 if (bridge->driver->agp_destroy_page && 216 if (bridge->driver->agp_destroy_page &&
217 bridge->driver->needs_scratch_page) { 217 bridge->driver->needs_scratch_page) {
218 bridge->driver->agp_destroy_page(gart_to_virt(bridge->scratch_page_real), 218 void *va = gart_to_virt(bridge->scratch_page_real);
219 AGP_PAGE_DESTROY_UNMAP); 219
220 bridge->driver->agp_destroy_page(gart_to_virt(bridge->scratch_page_real), 220 bridge->driver->agp_destroy_page(va, AGP_PAGE_DESTROY_UNMAP);
221 AGP_PAGE_DESTROY_FREE); 221 bridge->driver->agp_destroy_page(va, AGP_PAGE_DESTROY_FREE);
222 } 222 }
223} 223}
224 224
diff --git a/drivers/char/agp/generic.c b/drivers/char/agp/generic.c
index 7fc0c99a3a58..b6650a63197d 100644
--- a/drivers/char/agp/generic.c
+++ b/drivers/char/agp/generic.c
@@ -202,10 +202,13 @@ void agp_free_memory(struct agp_memory *curr)
202 } 202 }
203 if (curr->page_count != 0) { 203 if (curr->page_count != 0) {
204 for (i = 0; i < curr->page_count; i++) { 204 for (i = 0; i < curr->page_count; i++) {
205 curr->bridge->driver->agp_destroy_page(gart_to_virt(curr->memory[i]), AGP_PAGE_DESTROY_UNMAP); 205 curr->memory[i] = (unsigned long)gart_to_virt(curr->memory[i]);
206 curr->bridge->driver->agp_destroy_page((void *)curr->memory[i],
207 AGP_PAGE_DESTROY_UNMAP);
206 } 208 }
207 for (i = 0; i < curr->page_count; i++) { 209 for (i = 0; i < curr->page_count; i++) {
208 curr->bridge->driver->agp_destroy_page(gart_to_virt(curr->memory[i]), AGP_PAGE_DESTROY_FREE); 210 curr->bridge->driver->agp_destroy_page((void *)curr->memory[i],
211 AGP_PAGE_DESTROY_FREE);
209 } 212 }
210 } 213 }
211 agp_free_key(curr->key); 214 agp_free_key(curr->key);
diff --git a/drivers/char/agp/intel-agp.c b/drivers/char/agp/intel-agp.c
index eeea50a1d22a..01b03402ea92 100644
--- a/drivers/char/agp/intel-agp.c
+++ b/drivers/char/agp/intel-agp.c
@@ -418,9 +418,11 @@ static void intel_i810_free_by_type(struct agp_memory *curr)
418 if (curr->page_count == 4) 418 if (curr->page_count == 4)
419 i8xx_destroy_pages(gart_to_virt(curr->memory[0])); 419 i8xx_destroy_pages(gart_to_virt(curr->memory[0]));
420 else { 420 else {
421 agp_bridge->driver->agp_destroy_page(gart_to_virt(curr->memory[0]), 421 void *va = gart_to_virt(curr->memory[0]);
422
423 agp_bridge->driver->agp_destroy_page(va,
422 AGP_PAGE_DESTROY_UNMAP); 424 AGP_PAGE_DESTROY_UNMAP);
423 agp_bridge->driver->agp_destroy_page(gart_to_virt(curr->memory[0]), 425 agp_bridge->driver->agp_destroy_page(va,
424 AGP_PAGE_DESTROY_FREE); 426 AGP_PAGE_DESTROY_FREE);
425 } 427 }
426 agp_free_page_array(curr); 428 agp_free_page_array(curr);