aboutsummaryrefslogtreecommitdiff
AgeCommit message (Collapse)AuthorFilesLines
2013-11-06drm: remove minor-id during unplugDavid Herrmann1-3/+1
Don't delay minor removal to drm_put_minor(). Otherwise, user-space can still open the minor and cause the kernel to oops. Instead, remove the minor during unplug so any new open() will fail to access this minor. Note that open() and drm_unplug_minor() are both protected by the global DRM mutex so we're fine. Signed-off-by: David Herrmann <[email protected]> Signed-off-by: Dave Airlie <[email protected]>
2013-11-06drm: cleanup debugfs in drm_unplug_minor()David Herrmann1-4/+4
There is no reason to delay debugfs-cleanup to drm_put_minor(). We should forbid any access to debugfs files once the device is dead. Chances they oops once a card was unplugged are very high, anyway. Signed-off-by: David Herrmann <[email protected]> Signed-off-by: Dave Airlie <[email protected]>
2013-11-06drm: make drm_get_minor() staticDavid Herrmann2-9/+11
drm_get_minor() is only used in one file. Make it static and add a kernel-doc comment which documents the current semantics. Signed-off-by: David Herrmann <[email protected]> Signed-off-by: Dave Airlie <[email protected]>
2013-11-06drm: simplify drm_put_minor()David Herrmann2-19/+13
Allow passing NULL as minor to simplify DRM destruction paths. Also remove the double-pointer reset as it is no longer needed. drm_put_minor() is only called when the underlying object is destroyed. Hence, resetting minors to NULL is not necessary. As drm_put_minor() is no longer used by other DRM files, we can make it static, too. Signed-off-by: David Herrmann <[email protected]> Signed-off-by: Dave Airlie <[email protected]>
2013-11-06drm: call drm_unplug_minor() from drm_put_minor()David Herrmann1-9/+24
This protects drm_unplug_minor() against repeated calls so we can use it in drm_put_minor(). This allows us to further simplify it in follow-ups as we no longer do minor-destruction in both functions but only in drm_unplug_minor(). Also add kernel-doc comments about what these calls do. [airlied: fixup for changes to kdev stuff] Signed-off-by: David Herrmann <[email protected]> Signed-off-by: Dave Airlie <[email protected]>
2013-11-06drm: eliminate bit-copy restoration of crtcIlija Hadzic1-25/+8
Bit-copying restoration of CRTC structure in failure-recovery path of drm_crtc_helper_set_config function evokes a subtle and rare, but very dangerous, corruption of CRTC mutex structure. Namely, if drm_crtc_helper_set_config takes the path under 'fail:' label *and* some other process has attempted to grab the crtc mutex (and got blocked), restoring the CRTC structure by bit-copying it will overwrite the CRTC mutex state and the waiters list pointer within the mutex structure. Consequently the blocked process will never be scheduled. This patch fixes the issue by eliminating the bit-copy restoration. The elimination is possible because previous patches have cleaned up the resoration path so that only the fields touched by the drm_crtc_helper_set_config function are saved and restored if necessary. Signed-off-by: Ilija Hadzic <[email protected]> Signed-off-by: Dave Airlie <[email protected]>
2013-11-06drm: do not set crtc enabled field twiceIlija Hadzic1-2/+1
There is no need to set crtc->enabled field in drm_crtc_helper_set_config. This is already done (and properly restored in case of failure) in drm_crtc_helper_set_mode that is called by drm_crtc_helper_set_config. Doing it at only one place makes restoration in case of failure easier. Signed-off-by: Ilija Hadzic <[email protected]> Signed-off-by: Dave Airlie <[email protected]>
2013-11-06drm: fix error recovery path in drm_crtc_helper_set_modeIlija Hadzic1-4/+7
There is no need to save or restore hwmode field, because by the time this function sets this field, it cannot fail any more. However, we should save old enabled field because if the function fails, we want to return with unchanged CRTC. Signed-off-by: Ilija Hadzic <[email protected]> Signed-off-by: Dave Airlie <[email protected]>
2013-11-06drm: restore crtc origin if mode_set_base failsIlija Hadzic1-0/+2
Signed-off-by: Ilija Hadzic <[email protected]> Signed-off-by: Dave Airlie <[email protected]>
2013-11-06drm: eliminate old_fb from drm_crtc_helper_set_configIlija Hadzic1-8/+4
Old framebuffer is stored in save_set.fb and it is the same value that is later stored in old_fb. This makes old_fb redundant so we can replace it with save_set.fb. Signed-off-by: Ilija Hadzic <[email protected]> Signed-off-by: Dave Airlie <[email protected]>
2013-11-06drm: remove redundant if statementIlija Hadzic1-2/+1
Signed-off-by: Ilija Hadzic <[email protected]> Signed-off-by: Dave Airlie <[email protected]>
2013-11-06drm: Compact booleans within struct drm_fileChris Wilson1-7/+6
Replace the sparse array of booleans with a bitfield. Signed-off-by: Chris Wilson <[email protected]> Reviewed-by: David Herrmann <[email protected]> Signed-off-by: Dave Airlie <[email protected]>
2013-11-06drm: Do not drop root privileges for a fancier younger processChris Wilson2-2/+4
When a second process opens the device and master transferrence is complete, we walk the list of open devices and remove their authentication. This also revokes our root privilege. Instead of simply dropping the authentication, this patch reverts the authenticated state back to its original value. Signed-off-by: Chris Wilson <[email protected]> Reviewed-by: David Herrmann <[email protected]> Signed-off-by: Dave Airlie <[email protected]>
2013-11-06nouveau: drop interrupt busy setting.Dave Airlie1-3/+0
This causes problems with never going busy due to ptherm polling, and after talking to Ben I can't see it being required. Signed-off-by: Dave Airlie <[email protected]>
2013-11-06drm/sysfs: Remove stale comments about calling drm_sysfs_connector_add() ↵Ville Syrjälä1-6/+0
multiple times drm_connector_sysfs_add() explicitly checks if connector->kdev is already populated and returns success. So it clearly now allows being called multiple times. Remove some stale comments to the contrary. Signed-off-by: Ville Syrjälä <[email protected]> Reviewed-by: Jani Nikula <[email protected]> Signed-off-by: Dave Airlie <[email protected]>
2013-11-06drm/radeon: fix radeon_fence_wait_empty_lockedChristian König1-0/+3
Don't block forever if there is nothing to wait for. Signed-off-by: Christian König <[email protected]> Tested-by: Rafa? Mi?ecki <[email protected]> Signed-off-by: Dave Airlie <[email protected]>
2013-11-06drm/qxl: add some surface memory loggingGerd Hoffmann2-3/+9
Signed-off-by: Gerd Hoffmann <[email protected]> Signed-off-by: Dave Airlie <[email protected]>
2013-11-06drm/qxl: support 64bit surface barGerd Hoffmann1-7/+25
qxl devices can have a 64bit surface bar, which is quite handy if you need a bit more surface memory. So try to use it if it is present. Note that this bar might be mapped above 4g. QEMU command line to check that out: qemu-system-x86_64 -m 4g \ -vga qxl -global qxl-vga.vram64_size_mb=512 \ $otheroptions Signed-off-by: Gerd Hoffmann <[email protected]> Signed-off-by: Dave Airlie <[email protected]>
2013-11-06drm/cirrus: use drm_set_preferred_modeGerd Hoffmann1-6/+5
Explicitly set 1024x768 as default mode, so the display doesn't come up with the largest supported mode. While being at it drop first three drm_add_modes_noedid calls. As drm_add_modes_noedid fills the mode list with modes from the database *up to* the specified size it is pretty pointless to call it multiple times with different sizes. Signed-off-by: Gerd Hoffmann <[email protected]> Signed-off-by: Dave Airlie <[email protected]>
2013-11-06drm: add drm_set_preferred_modeGerd Hoffmann2-0/+15
New helper function to set the preferred video mode. Can be called after drm_add_modes_noedid if you don't want the largest supported video mode be used by default. Signed-off-by: Gerd Hoffmann <[email protected]> Signed-off-by: Dave Airlie <[email protected]>
2013-11-06drm: Pretty print pixel format in drm_fb_get_bpp_depth() and format_check()Ville Syrjälä1-1/+4
drm_fb_get_bpp_depth() likes to complain about unsupported pixel formats but doesn't bother telling us what the format was. Also format_check() just returns an error when it encouters an invalid format, leaving the user scratching his head trying to figure out why addfb failed. Make life a bit easier by using drm_get_format_name() in both places. Signed-off-by: Ville Syrjälä <[email protected]> Reviewed-by: Alex Deucher <[email protected]> Reviewed-by: Damien Lespiau <[email protected]> Signed-off-by: Dave Airlie <[email protected]>
2013-11-06drm/edid: Yank a helpful comment about EST modes from xf86EdidModes.cVille Syrjälä1-0/+9
I got very confused when I tried to compare the EST modes with the spec. Bring over a comment from xf86EdidModes.c that actually describes some of history where these things came from. Signed-off-by: Ville Syrjälä <[email protected]> Reviewed-by: Alex Deucher <[email protected]> Signed-off-by: Dave Airlie <[email protected]>
2013-11-06drm/edid: Don't skip every eighth EST III modeVille Syrjälä1-1/+1
Also check the est3 modes whose presence is indicated by bit 0. Signed-off-by: Ville Syrjälä <[email protected]> Reviewed-by: Alex Deucher <[email protected]> Signed-off-by: Dave Airlie <[email protected]>
2013-11-06drm/edid: Fix the 1792x1344-75 EST III modeVille Syrjälä1-1/+1
The correct refresh rate for this mode is 75, not 85. Signed-off-by: Ville Syrjälä <[email protected]> Reviewed-by: Alex Deucher <[email protected]> Signed-off-by: Dave Airlie <[email protected]>
2013-11-06drm/vmwgfx: Return -ENOENT when a framebuffer can't be foundVille Syrjälä1-2/+2
Let's be a bit more consistent with our error values. Signed-off-by: Ville Syrjälä <[email protected]> Signed-off-by: Dave Airlie <[email protected]>
2013-11-06drm/vmwgfx: Return -ENOENT when a mode object can't be foundVille Syrjälä1-1/+1
Let's be a bit more consistent with our error values. Signed-off-by: Ville Syrjälä <[email protected]> Signed-off-by: Dave Airlie <[email protected]>
2013-11-06drm/radeon: Return -ENOENT when a mode object can't be foundVille Syrjälä2-2/+2
Let's be a bit more consistent with our error values. Signed-off-by: Ville Syrjälä <[email protected]> Signed-off-by: Dave Airlie <[email protected]>
2013-11-06drm/i915: Return -ENOENT when a mode object can't be foundVille Syrjälä2-3/+3
Let's be a bit more consistent with our error values. Signed-off-by: Ville Syrjälä <[email protected]> Signed-off-by: Dave Airlie <[email protected]>
2013-11-06drm/gma500: Return -ENOENT when a mode object can't be foundVille Syrjälä2-3/+3
Let's be a bit more consistent with our error values. Signed-off-by: Ville Syrjälä <[email protected]> Signed-off-by: Dave Airlie <[email protected]>
2013-11-06drm: Return -ENOENT when a framebuffer can't be foundVille Syrjälä1-5/+7
Return -ENOENT for framebuffers like we do for other mode objects that can't be found. Signed-off-by: Ville Syrjälä <[email protected]> Signed-off-by: Dave Airlie <[email protected]>
2013-11-06drm: Consistently return -ENOENT when a mode object can't be foundVille Syrjälä1-14/+18
We tend to return -EINVAL for everything. Let's try to help poor userland developers a bit by at least returning -ENONET for missing objects. Signed-off-by: Ville Syrjälä <[email protected]> Reviewed-by: Alex Deucher <[email protected]> Signed-off-by: Dave Airlie <[email protected]>
2013-11-06drm: Pass pointers to virt_to_page()Ben Hutchings2-3/+3
Most architectures define virt_to_page() as a macro that casts its argument such that an argument of type unsigned long will be accepted without complaint. However, the proper type is void *, and passing unsigned long results in a warning on MIPS. Compile-tested only. Signed-off-by: Ben Hutchings <[email protected]> Signed-off-by: Dave Airlie <[email protected]>
2013-11-06drm: Do not include page offset in argument to virt_to_page()Ben Hutchings1-1/+1
By definition, the page offset will not affect the result. Compile-tested only. Signed-off-by: Ben Hutchings <[email protected]> Signed-off-by: Dave Airlie <[email protected]>
2013-11-06drm: delete unconsumed pending event list in drm_events_releaseYoungJun Cho1-1/+3
When there are unconsumed pending events, the events are destroyed by calling destroy callback, but the events list are remained, because there is no list_del(). It is possible that the page flip request is handled after drm_events_release() is called and before drm_fb_release(). In this case a drm_pending_event is remained not freed. So exynos driver checks again to remove it in its post close routine. But the file_priv->event_list contains undeleted ones, this can make oops for accessing invalid memory. Signed-off-by: YoungJun Cho <[email protected]> Signed-off-by: Kyungmin Park <[email protected]> Signed-off-by: Dave Airlie <[email protected]>
2013-11-06drm/i915: Make the debugfs structures constLespiau, Damien1-2/+2
Signed-off-by: Damien Lespiau <[email protected]> Reviewed-by: Ville Syrjälä <[email protected]> Signed-off-by: Dave Airlie <[email protected]>
2013-11-06drm: Make drm_debugfs_list constLespiau, Damien1-1/+1
Signed-off-by: Damien Lespiau <[email protected]> Reviewed-by: Ville Syrjälä <[email protected]> Signed-off-by: Dave Airlie <[email protected]>
2013-11-06drm: Remove drm_debugfs_node and drm_debugfs_listLespiau, Damien1-21/+0
Those structures are not used anywhere. Signed-off-by: Damien Lespiau <[email protected]> Reviewed-by: Ville Syrjälä <[email protected]> Signed-off-by: Dave Airlie <[email protected]>
2013-11-06drm: Constify struct drm_info_list * argumentsLespiau, Damien2-6/+7
Those functions are just reading data from those pointers. Signed-off-by: Damien Lespiau <[email protected]> Reviewed-by: Ville Syrjälä <[email protected]> Signed-off-by: Dave Airlie <[email protected]>
2013-11-06DRM: Armada: convert to use simple_open()Duan Jiong1-7/+1
This removes an open coded simple_open() function and replaces file operations references to the function with simple_open() instead. Signed-off-by: Duan Jiong <[email protected]> Signed-off-by: Dave Airlie <[email protected]>
2013-11-06drm: shmobile: Add dependency on BACKLIGHT_CLASS_DEVICELaurent Pinchart1-0/+1
The driver registers a backlight device and thus requires BACKLIGHT_CLASS_DEVICE to be selected to avoid compilation breakages. Cc: [email protected] Reported-by: Russell King <[email protected]> Signed-off-by: Laurent Pinchart <[email protected]> Signed-off-by: Dave Airlie <[email protected]>
2013-11-06drm/intel: Push get_scanout_position() timestamping into kms driver.Mario Kleiner1-11/+43
Move the ktime_get() clock readouts and potential preempt_disable() calls from drm core into kms driver to make it compatible with the api changes in the drm core. The intel-kms driver needs to take the uncore.lock inside i915_get_crtc_scanoutpos() and intel_pipe_in_vblank(). This is incompatible with the preempt_disable() on a PREEMPT_RT patched kernel, as regular spin locks must not be taken within a preempt_disable'd section. Lock contention on the uncore.lock also introduced too much uncertainty in vblank timestamps. Push the ktime_get() timestamping for scanoutpos queries and potential preempt_disable_rt() into i915_get_crtc_scanoutpos(), so these problems can be avoided: 1. First lock the uncore.lock (might sleep on a PREEMPT_RT kernel). 2. preempt_disable_rt() (will be added by the rt-linux folks). 3. ktime_get() a timestamp before scanout pos query. 4. Do all mmio reads as fast as possible without grabbing any new locks! 5. ktime_get() a post-query timestamp. 6. preempt_enable_rt() 7. Unlock the uncore.lock. This reduces timestamp uncertainty on a low-end HP Atom Mini netbook with Intel GMA-950 nicely: Before: 3-8 usecs with spikes > 20 usecs, triggering query retries. After : Typically 1 usec (98% of all samples), occassionally 2 usecs (2% of all samples), with maximum of 3 usecs (a handful). v2: Fix formatting of new multi-line code comments. Signed-off-by: Mario Kleiner <[email protected]> Reviewed-by: Ville Syrjälä <[email protected]> Reviewed-by: Alex Deucher <[email protected]> Signed-off-by: Dave Airlie <[email protected]>
2013-11-06drm/radeon: Push get_scanout_position() timestamping into kms driver.Mario Kleiner4-6/+26
Move the ktime_get() clock readouts and potential preempt_disable() calls from drm core into kms driver to make it compatible with the api changes in the drm core. This should not introduce any change in functionality or behaviour in radeon-kms, just a reshuffling of code. Signed-off-by: Mario Kleiner <[email protected]> Reviewed-by: Ville Syrjälä <[email protected]> Reviewed-by: Alex Deucher <[email protected]> Signed-off-by: Dave Airlie <[email protected]>
2013-11-06drm: Push latency sensitive bits of vblank scanoutpos timestamping into kms ↵Mario Kleiner2-10/+20
drivers. A change in locking of some kms drivers (currently intel-kms) make the old approach too inaccurate and also incompatible with the PREEMPT_RT realtime kernel patchset. The driver->get_scanout_position() method of intel-kms now needs to aquire a spinlock, which clashes badly with the former preempt_disable() calls in the drm, and it also introduces larger delays and timing uncertainty on a contended lock than acceptable. This patch changes the prototype of driver->get_scanout_position() to require/allow kms drivers to perform the ktime_get() system time queries which go along with actual scanout position readout in a way that provides maximum precision and to return those timestamps to the drm. kms drivers implementations of get_scanout_position() are asked to implement timestamping and scanoutpos readout in a way that is as precise as possible and compatible with preempt_disable() on a PREMPT_RT kernel. A driver should follow this pattern in get_scanout_position() for precision and compatibility: spin_lock...(...); preempt_disable_rt(); // On a PREEMPT_RT kernel, otherwise omit. if (stime) *stime = ktime_get(); ... Minimum amount of MMIO register reads to get scanout position ... ... no taking of locks allowed here! ... if (etime) *etime = ktime_get(); preempt_enable_rt(); // On PREEMPT_RT kernel, otherwise omit. spin_unlock...(...); v2: Fix formatting of new multi-line code comments. Signed-off-by: Mario Kleiner <[email protected]> Reviewed-by: Ville Syrjälä <[email protected]> Reviewed-by: Alex Deucher <[email protected]> Signed-off-by: Dave Airlie <[email protected]>
2013-11-06drm: Remove preempt_disable() from vblank timestamping code.Mario Kleiner1-7/+0
Preemption handling will get pushed into the kms drivers in followup patches, to make timestamping more robust and PREEMPT_RT friendly. Signed-off-by: Mario Kleiner <[email protected]> Reviewed-by: Ville Syrjälä <[email protected]> Reviewed-by: Alex Deucher <[email protected]> Signed-off-by: Dave Airlie <[email protected]>
2013-11-05Merge branch 'drm-next-3.13' of git://people.freedesktop.org/~agd5f/linux ↵Dave Airlie40-881/+1561
into drm-next Initial pull request for radeon drm-next 3.13. Highlights: - Enable DPM on a number of asics by default - Enable audio by default - Dynamically power down dGPUs on PowerXpress systems - Lots of bug fixes * 'drm-next-3.13' of git://people.freedesktop.org/~agd5f/linux: (36 commits) drm/radeon: don't share PPLLs on DCE4.1 drm/radeon/dpm: fix typo in setting smc flag drm/radeon: fixup locking inversion between, mmap_sem and reservations drm/radeon: clear the page directory using the DMA drm/radeon: initially clear page tables drm/radeon: drop CP page table updates & cleanup v2 drm/radeon: add vm_set_page tracepoint drm/radeon: rework and fix reset detection v2 drm/radeon: don't use PACKET2 on CIK drm/radeon: fix UVD destroy IB size drm/radeon: activate UVD clocks before sending the destroy msg drm/radeon/si: fix define for MC_SEQ_TRAIN_WAKEUP_CNTL drm/radeon: fix endian handling in rlc buffer setup drm/radeon/dpm: retain user selected performance level across state changes drm/radeon: disable force performance state when thermal state is active drm/radeon: enable DPM by default on r7xx asics drm/radeon: enable DPM by default on evergreen asics drm/radeon: enable DPM by default on BTC asics drm/radeon: enable DPM by default on SI asics drm/radeon: enable DPM by default on SUMO/PALM APUs ...
2013-11-05Merge tag 'drm/for-3.13-rc1' of git://anongit.freedesktop.org/tegra/linux ↵Dave Airlie55-1259/+3362
into drm-next drm/tegra: Changes for v3.13-rc1 The biggest part of the changes is the decoupling of the host1x and DRM drivers followed by the move of Tegra DRM back to drivers/gpu/drm/tegra from whence it came. There is a lot of cleanup as well, and the drivers can now be properly unloaded and reloaded. HDMI support for the Tegra114 SoC was contributed by Mikko Perttunen. gr2d support was extended to Tegra114 and the gr3d driver that has been in the works for quite some time finally made it in. All pieces to run an OpenGL driver on top of an upstream kernel are now available. Support for syncpoint bases was added by Arto Merilainen. This is useful for synchronizing between command streams from different engines such as gr2d and gr3d. Erik Faye-Lund and Wei Yongjun contributed various small fixes. Thanks! * tag 'drm/for-3.13-rc1' of git://anongit.freedesktop.org/tegra/linux: (45 commits) drm/tegra: Reserve syncpoint base for gr3d drm/tegra: Reserve base for gr2d drm/tegra: Deliver syncpoint base to user space gpu: host1x: Add syncpoint base support gpu: host1x: Add 'flags' field to syncpt request drm/tegra: Disable clock on probe failure gpu: host1x: Disable clock on probe failure drm/tegra: Support bottom-up buffer objects drm/tegra: Add support for tiled buffer objects drm/tegra: Add 3D support drm/tegra: Introduce tegra_drm_submit() drm/tegra: Use symbolic names for gr2d registers drm/tegra: Start connectors with correct DPMS mode drm/tegra: hdmi: Enable VDD earlier for hotplug/DDC drm/tegra: hdmi: Fix build warnings drm/tegra: hdmi: Detect DVI-only displays drm/tegra: Add Tegra114 HDMI support drm/tegra: hdmi: Parameterize based on compatible property drm/tegra: hdmi: Rename tegra{2,3} to tegra{20,30} gpu: host1x: Add support for Tegra114 ...
2013-11-04qxl: avoid an oops in the deferred io code.Dave Airlie1-1/+1
If we are using deferred io due to plymouth or X.org fbdev driver we will oops in memcpy due to this pointless multiply here, removing it fixes fbdev to start and not oops. Cc: [email protected] Signed-off-by: Dave Airlie <[email protected]>
2013-11-01drm/radeon: don't share PPLLs on DCE4.1Alex Deucher1-1/+1
Sharing PPLLs seems to cause problems on some boards. Bug: https://bugs.freedesktop.org/show_bug.cgi?id=45334 Signed-off-by: Alex Deucher <[email protected]> Cc: [email protected]
2013-11-01drm/radeon/dpm: fix typo in setting smc flagAlex Deucher1-1/+1
PPSMC_EXTRAFLAGS_AC2DC_GPIO5_POLARITY_HIGH should be set in extraFlags, not systemFlags. Noticed-by: Sylvain BERTRAND <[email protected]> Signed-off-by: Alex Deucher <[email protected]>
2013-11-01drm/radeon: fixup locking inversion between, mmap_sem and reservationsMaarten Lankhorst3-223/+106
op 08-10-13 18:58, Thomas Hellstrom schreef: > On 10/08/2013 06:47 PM, Jerome Glisse wrote: >> On Tue, Oct 08, 2013 at 06:29:35PM +0200, Thomas Hellstrom wrote: >>> On 10/08/2013 04:55 PM, Jerome Glisse wrote: >>>> On Tue, Oct 08, 2013 at 04:45:18PM +0200, Christian König wrote: >>>>> Am 08.10.2013 16:33, schrieb Jerome Glisse: >>>>>> On Tue, Oct 08, 2013 at 04:14:40PM +0200, Maarten Lankhorst wrote: >>>>>>> Allocate and copy all kernel memory before doing reservations. This prevents a locking >>>>>>> inversion between mmap_sem and reservation_class, and allows us to drop the trylocking >>>>>>> in ttm_bo_vm_fault without upsetting lockdep. >>>>>>> >>>>>>> Signed-off-by: Maarten Lankhorst <[email protected]> >>>>>> I would say NAK. Current code only allocate temporary page in AGP case. >>>>>> So AGP case is userspace -> temp page -> cs checker -> radeon ib. >>>>>> >>>>>> Non AGP is directly memcpy to radeon IB. >>>>>> >>>>>> Your patch allocate memory memcpy userspace to it and it will then be >>>>>> memcpy to IB. Which means you introduce an extra memcpy in the process >>>>>> not something we want. >>>>> Totally agree. Additional to that there is no good reason to provide >>>>> anything else than anonymous system memory to the CS ioctl, so the >>>>> dependency between the mmap_sem and reservations are not really >>>>> clear to me. >>>>> >>>>> Christian. >>>> I think is that in other code path you take mmap_sem first then reserve >>>> bo. But here we reserve bo and then we take mmap_sem because of copy >>> >from user. >>>> Cheers, >>>> Jerome >>>> >>> Actually the log message is a little confusing. I think the mmap_sem >>> locking inversion problem is orthogonal to what's being fixed here. >>> >>> This patch fixes the possible recursive bo::reserve caused by >>> malicious user-space handing a pointer to ttm memory so that the ttm >>> fault handler is called when bos are already reserved. That may >>> cause a (possibly interruptible) livelock. >>> >>> Once that is fixed, we are free to choose the mmap_sem -> >>> bo::reserve locking order. Currently it's bo::reserve->mmap_sem(), >>> but the hack required in the ttm fault handler is admittedly a bit >>> ugly. The plan is to change the locking order to >>> mmap_sem->bo::reserve >>> >>> I'm not sure if it applies to this particular case, but it should be >>> possible to make sure that copy_from_user_inatomic() will always >>> succeed, by making sure the pages are present using >>> get_user_pages(), and release the pages after >>> copy_from_user_inatomic() is done. That way there's no need for a >>> double memcpy slowpath, but if the copied data is very fragmented I >>> guess the resulting code may look ugly. The get_user_pages() >>> function will return an error if it hits TTM pages. >>> >>> /Thomas >> get_user_pages + copy_from_user_inatomic is overkill. We should just >> do get_user_pages which fails with ttm memory and then use copy_highpage >> helper. >> >> Cheers, >> Jerome > Yeah, it may well be that that's the preferred solution. > > /Thomas > I still disagree, and shuffled radeon_ib_get around to be called sooner. How does the patch below look? 8<------- Allocate and copy all kernel memory before doing reservations. This prevents a locking inversion between mmap_sem and reservation_class, and allows us to drop the trylocking in ttm_bo_vm_fault without upsetting lockdep. Changes since v1: - Kill extra memcpy for !AGP case. Signed-off-by: Maarten Lankhorst <[email protected]> Reviewed-by: Jerome Glisse <[email protected]> Signed-off-by: Alex Deucher <[email protected]>