From d9c6f546469f33f9aa48ae5991c33da8cd535b37 Mon Sep 17 00:00:00 2001 From: Roel Kluin Date: Thu, 16 Apr 2009 22:57:46 +0200 Subject: drm: count reaches -1 With a postfix decrement in the test count will reach -1 rather than 0, subsequent tests fail. Signed-off-by: Roel Kluin Signed-off-by: Dave Airlie --- drivers/gpu/drm/via/via_dma.c | 12 +++++++----- 1 file changed, 7 insertions(+), 5 deletions(-) (limited to 'drivers') diff --git a/drivers/gpu/drm/via/via_dma.c b/drivers/gpu/drm/via/via_dma.c index 7a339dba6a69..bfb92d283260 100644 --- a/drivers/gpu/drm/via/via_dma.c +++ b/drivers/gpu/drm/via/via_dma.c @@ -481,11 +481,13 @@ static int via_wait_idle(drm_via_private_t * dev_priv) { int count = 10000000; - while (!(VIA_READ(VIA_REG_STATUS) & VIA_VR_QUEUE_BUSY) && count--); + while (!(VIA_READ(VIA_REG_STATUS) & VIA_VR_QUEUE_BUSY) && --count) + ; - while (count-- && (VIA_READ(VIA_REG_STATUS) & + while (count && (VIA_READ(VIA_REG_STATUS) & (VIA_CMD_RGTR_BUSY | VIA_2D_ENG_BUSY | - VIA_3D_ENG_BUSY))) ; + VIA_3D_ENG_BUSY))) + --count; return count; } @@ -705,7 +707,7 @@ static int via_cmdbuf_size(struct drm_device *dev, void *data, struct drm_file * switch (d_siz->func) { case VIA_CMDBUF_SPACE: while (((tmp_size = via_cmdbuf_space(dev_priv)) < d_siz->size) - && count--) { + && --count) { if (!d_siz->wait) { break; } @@ -717,7 +719,7 @@ static int via_cmdbuf_size(struct drm_device *dev, void *data, struct drm_file * break; case VIA_CMDBUF_LAG: while (((tmp_size = via_cmdbuf_lag(dev_priv)) > d_siz->size) - && count--) { + && --count) { if (!d_siz->wait) { break; } -- cgit v1.2.3 From 77d26dc9b9805f322f5a1f6e559b18ad66205bd9 Mon Sep 17 00:00:00 2001 From: Ma Ling Date: Thu, 16 Apr 2009 17:51:25 +0800 Subject: drm: clean dirty memory after device release In current code we register/unregister connector object by drm_sysfs_connector_add/remove function. However under some cases, we need to dynamically register or unregister device multiple times, so we have to go through register -> unregister ->register routine. Because after device_unregister function our memory is dirty, we need to do clean operation in order to re-register the device, otherwise the system will crash. The patch intends to clean device after device release. Signed-off-by: Ma Ling Signed-off-by: Dave Airlie --- drivers/gpu/drm/drm_sysfs.c | 1 + 1 file changed, 1 insertion(+) (limited to 'drivers') diff --git a/drivers/gpu/drm/drm_sysfs.c b/drivers/gpu/drm/drm_sysfs.c index bc0c6849360c..022876ae34f0 100644 --- a/drivers/gpu/drm/drm_sysfs.c +++ b/drivers/gpu/drm/drm_sysfs.c @@ -132,6 +132,7 @@ void drm_sysfs_destroy(void) */ static void drm_sysfs_device_release(struct device *dev) { + memset(dev, 0, sizeof(struct device)); return; } -- cgit v1.2.3 From 6b0084266c1d4917ad9259759a1e7bd623cb3888 Mon Sep 17 00:00:00 2001 From: Jonas Bonn Date: Thu, 16 Apr 2009 09:00:02 +0200 Subject: drm: set/clear is_master when master changed The variable is_master is being used to track the drm_file that is currently master, so its value needs to be updated accordingly when the master is changed. Signed-off-by: Jonas Bonn Signed-off-by: Dave Airlie --- drivers/gpu/drm/drm_stub.c | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-) (limited to 'drivers') diff --git a/drivers/gpu/drm/drm_stub.c b/drivers/gpu/drm/drm_stub.c index d009661781bc..1b3e0ff57b45 100644 --- a/drivers/gpu/drm/drm_stub.c +++ b/drivers/gpu/drm/drm_stub.c @@ -159,6 +159,9 @@ void drm_master_put(struct drm_master **master) int drm_setmaster_ioctl(struct drm_device *dev, void *data, struct drm_file *file_priv) { + if (file_priv->is_master) + return 0; + if (file_priv->minor->master && file_priv->minor->master != file_priv->master) return -EINVAL; @@ -169,6 +172,7 @@ int drm_setmaster_ioctl(struct drm_device *dev, void *data, file_priv->minor->master != file_priv->master) { mutex_lock(&dev->struct_mutex); file_priv->minor->master = drm_master_get(file_priv->master); + file_priv->is_master = 1; mutex_unlock(&dev->struct_mutex); } @@ -178,10 +182,12 @@ int drm_setmaster_ioctl(struct drm_device *dev, void *data, int drm_dropmaster_ioctl(struct drm_device *dev, void *data, struct drm_file *file_priv) { - if (!file_priv->master) + if (!file_priv->is_master) return -EINVAL; + mutex_lock(&dev->struct_mutex); drm_master_put(&file_priv->minor->master); + file_priv->is_master = 0; mutex_unlock(&dev->struct_mutex); return 0; } -- cgit v1.2.3 From 07f1c7a7f6736d9ec2eba57d209c5f48888d841e Mon Sep 17 00:00:00 2001 From: Dave Airlie Date: Mon, 20 Apr 2009 09:32:50 +1000 Subject: drm: check for minor master before allowing drop master. When fast user switching a lot eventually we get to the point, where we were checking for the wrong thing in this function. Signed-off-by: Dave Airlie --- drivers/gpu/drm/drm_stub.c | 3 +++ 1 file changed, 3 insertions(+) (limited to 'drivers') diff --git a/drivers/gpu/drm/drm_stub.c b/drivers/gpu/drm/drm_stub.c index 1b3e0ff57b45..ef878615c49f 100644 --- a/drivers/gpu/drm/drm_stub.c +++ b/drivers/gpu/drm/drm_stub.c @@ -185,6 +185,9 @@ int drm_dropmaster_ioctl(struct drm_device *dev, void *data, if (!file_priv->is_master) return -EINVAL; + if (!file_priv->minor->master) + return -EINVAL; + mutex_lock(&dev->struct_mutex); drm_master_put(&file_priv->minor->master); file_priv->is_master = 0; -- cgit v1.2.3 From 59de2bebabc5027f93df999d59cc65df591c3e6e Mon Sep 17 00:00:00 2001 From: Shaohua Li Date: Mon, 20 Apr 2009 10:08:35 +1000 Subject: agp: zero pages before sending to userspace AGP pages might be mapped into userspace finally, so the pages should be set to zero before userspace can use it. Otherwise there is potential information leakage. Signed-off-by: Shaohua Li Signed-off-by: Dave Airlie --- drivers/char/agp/generic.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) (limited to 'drivers') diff --git a/drivers/char/agp/generic.c b/drivers/char/agp/generic.c index 10d6cbd7c05e..2224b762b7fb 100644 --- a/drivers/char/agp/generic.c +++ b/drivers/char/agp/generic.c @@ -1226,7 +1226,7 @@ int agp_generic_alloc_pages(struct agp_bridge_data *bridge, struct agp_memory *m int i, ret = -ENOMEM; for (i = 0; i < num_pages; i++) { - page = alloc_page(GFP_KERNEL | GFP_DMA32); + page = alloc_page(GFP_KERNEL | GFP_DMA32 | __GFP_ZERO); /* agp_free_memory() needs gart address */ if (page == NULL) goto out; @@ -1257,7 +1257,7 @@ void *agp_generic_alloc_page(struct agp_bridge_data *bridge) { struct page * page; - page = alloc_page(GFP_KERNEL | GFP_DMA32); + page = alloc_page(GFP_KERNEL | GFP_DMA32 | __GFP_ZERO); if (page == NULL) return NULL; -- cgit v1.2.3