linux-stable.git/drivers/gpu/drm/drm_fops.c, branch v3.3.4

drm: Fix authentication kernel crash

2012-01-25T09:27:45+00:00

If the master tries to authenticate a client using drm_authmagic and
that client has already closed its drm file descriptor,
either wilfully or because it was terminated, the
call to drm_authmagic will dereference a stale pointer into kmalloc'ed memory
and corrupt it.

Typically this results in a hard system hang.

This patch fixes that problem by removing any authentication tokens
(struct drm_magic_entry) open for a file descriptor when that file
descriptor is closed.

Signed-off-by: Thomas Hellstrom 
Reviewed-by: Daniel Vetter 
Cc: stable@vger.kernel.org
Signed-off-by: Dave Airlie

drm: Make the per-driver file_operations struct const

2011-11-11T11:14:47+00:00

From fdf1fdebaa00f81de18c227f32f8074c8b352d50 Mon Sep 17 00:00:00 2001
From: Arjan van de Ven 
Date: Sun, 30 Oct 2011 19:06:07 -0700
Subject: [PATCH] drm: Make the per-driver file_operations struct const

The DRM layer keeps a copy of struct file_operations inside its
big driver struct... which prevents it from being consistent and static.
For consistency (and the general security objective of having such things
static), it's desirable to get this fixed.

This patch splits out the file_operations field to its own struct,
which is then "static const", and just stick a pointer to this into
the driver struct, making it more consistent with how the rest of the
kernel does this.

Signed-off-by: Arjan van de Ven 
Signed-off-by: Dave Airlie

gpu: add module.h to drivers/gpu files as required.

2011-10-31T23:32:03+00:00

So that we don't get build failures once the implicit module.h
presence is removed.

Signed-off-by: Paul Gortmaker

drm/switcheroo: track state of switch in drivers.

2011-01-05T03:45:30+00:00

We need to track the state of the switch in drivers, so that after s/r
we don't resume the card we've explicitly switched off before. Also
don't allow a userspace open to occur if we've switched the gpu off.

Signed-off-by: Dave Airlie

BKL: remove extraneous #include

2010-11-17T16:59:32+00:00

The big kernel lock has been removed from all these files at some point,
leaving only the #include.

Remove this too as a cleanup.

Signed-off-by: Arnd Bergmann 
Signed-off-by: Linus Torvalds

Merge remote branch 'nouveau/for-airlied' of /ssd/git/drm-nouveau-next into drm-fixes

2010-08-26T23:09:46+00:00

* 'nouveau/for-airlied' of /ssd/git/drm-nouveau-next:
  drm/nouveau: drop drm_global_mutex before sleeping in submission path
  drm: export drm_global_mutex for drivers to use
  drm/nv20: Don't use pushbuf calls on the original nv20.
  drm/nouveau: Fix TMDS on some DCB1.5 boards.
  drm/nouveau: Fix backlight control on PPC machines with an internal TMDS panel.
  drm/nv30: Apply modesetting to the correct slave encoder
  drm/nouveau: Use a helper function to match PCI device/subsystem IDs.
  drm/nv50: add dcb type 14 to enum to prevent compiler complaint

drm: export drm_global_mutex for drivers to use

2010-08-26T22:39:22+00:00

Nouveau needs to be able to drop the mutex before sleeping to prevent a
deadlock from occuring.

Signed-off-by: Ben Skeggs

drm: Remove count_lock for calling lastclose() after 58474713 (v2)

2010-08-11T23:22:19+00:00

When removing of the BKL the locking around lastclose() was rearranged
and resulted in the holding of the open_count spinlock over the call
into drm_lastclose(). The drivers were not ready for this path to be
atomic - it may indeed involve long waits to release old objects and
cleanup the GPU - and so we ended up scheduling whilst atomic.

[   54.625598] BUG: scheduling while atomic: X/3546/0x00000002
[   54.625600] Modules linked in: sco bridge stp llc input_polldev rfcomm bnep l2cap crc16 sch_sfq ipv6 md_mod acpi_cpufreq mperf cryptd aes_x86_64 aes_generic xts gf128mul dm_crypt dm_mod btusb bluetooth usbhid hid zaurus cdc_ether usbnet mii cdc_wdm cdc_acm uvcvideo videodev v4l1_compat v4l2_compat_ioctl32 snd_hda_codec_conexant arc4 pcmcia ecb snd_hda_intel joydev sdhci_pci sdhci snd_hda_codec tpm_tis firewire_ohci mmc_core e1000e uhci_hcd thinkpad_acpi nvram yenta_socket pcmcia_rsrc pcmcia_core tpm wmi sr_mod firewire_core iwlagn ehci_hcd snd_hwdep snd_pcm usbcore tpm_bios thermal led_class snd_timer iwlcore snd soundcore ac snd_page_alloc pcspkr psmouse serio_raw battery sg mac80211 evdev cfg80211 i2c_i801 iTCO_wdt iTCO_vendor_support cdrom processor crc_itu_t rfkill xfs exportfs sd_mod crc_t10dif ahci libahci libata scsi_mod [last unloaded: scsi_wait_scan]
[   54.625663] Pid: 3546, comm: X Not tainted 2.6.35-04771-g1787985 #301
[   54.625665] Call Trace:
[   54.625671]  [] __schedule_bug+0x57/0x5c
[   54.625675]  [] schedule+0xe5/0x832
[   54.625679]  [] ? put_dec+0x20/0x3c
[   54.625682]  [] schedule_timeout+0x275/0x29f
[   54.625686]  [] ? process_timeout+0x0/0xb
[   54.625688]  [] schedule_timeout_uninterruptible+0x19/0x1b
[   54.625691]  [] msleep+0x16/0x1d
[   54.625695]  [] i9xx_crtc_dpms+0x273/0x2ae
[   54.625698]  [] intel_crtc_dpms+0x28/0xe7
[   54.625702]  [] drm_helper_disable_unused_functions+0xf0/0x118
[   54.625705]  [] drm_crtc_helper_set_config+0x644/0x7c8
[   54.625708]  [] ? drm_copy_field+0x40/0x50
[   54.625711]  [] drm_fb_helper_force_kernel_mode+0x3e/0x85
[   54.625713]  [] drm_fb_helper_restore+0x9/0x24
[   54.625717]  [] i915_driver_lastclose+0x2b/0x5c
[   54.625720]  [] drm_lastclose+0x44/0x2ad
[   54.625722]  [] drm_release+0x5c6/0x609
[   54.625726]  [] fput+0x109/0x1c7
[   54.625728]  [] filp_close+0x61/0x6b
[   54.625731]  [] sys_close+0x92/0xd4
[   54.625734]  [] system_call_fastpath+0x16/0x1b

v2: The spinlock is actually superfluous as access to open_count is
entirely serialised by drm_global_mutex and so can be dropped. The
count_lock spinlock instead appears to be used to protect access to
dev->buf_alloc and dev->buf_use.

Signed-off-by: Chris Wilson 
Signed-off-by: Dave Airlie

drm: kill BKL from common code

2010-08-05T01:54:40+00:00

This restricts the use of the big kernel lock to the i830 and i810
device drivers. The three remaining users in common code (open, ioctl
and release) get converted to a new mutex, the drm_global_mutex,
making the locking stricter than the big kernel lock.

This may have a performance impact, but only in those cases that
currently don't use DRM_UNLOCKED flag in the ioctl list and would
benefit from that anyway.

The reason why i810 and i830 cannot use drm_global_mutex in their
mmap functions is a lock-order inversion problem between the current
use of the BKL and mmap_sem in these drivers. Since the BKL has
release-on-sleep semantics, it's harmless but it would cause trouble
if we replace the BKL with a mutex.

Instead, these drivers get their own ioctl wrappers that take the
BKL around every ioctl call and then set their own handlers as
DRM_UNLOCKED.

Signed-off-by: Arnd Bergmann 
Cc: David Airlie 
Cc: dri-devel@lists.freedesktop.org
Signed-off-by: Dave Airlie

drivers/gpu/drm: Use kzalloc

2010-05-18T05:57:05+00:00

Use kzalloc rather than the combination of kmalloc and memset.

The semantic patch that makes this change is as follows:
(http://coccinelle.lip6.fr/)

// 
@@
expression x,size,flags;
statement S;
@@

-x = kmalloc(size,flags);
+x = kzalloc(size,flags);
 if (x == NULL) S
-memset(x, 0, size);
// 

Signed-off-by: Julia Lawall 
Reviewed-by: Corbin Simpson 
Reviewed-by: Matt Turner 
Signed-off-by: Dave Airlie