rpms/kernel/devel drm-intel-next.patch, 1.3, 1.4 kernel.spec, 1.1287, 1.1288

[Kristian Høgsberg]

Author: krh

Update of /cvs/pkgs/rpms/kernel/devel
In directory cvs1.fedora.phx.redhat.com:/tmp/cvs-serv13616

Modified Files:
	drm-intel-next.patch kernel.spec 
Log Message:
* Wed Feb 11 2009 Kristian Høgsberg <krh at redhat.com>
- Rebase drm-intel-next patch.


drm-intel-next.patch:

Index: drm-intel-next.patch
===================================================================
RCS file: /cvs/pkgs/rpms/kernel/devel/drm-intel-next.patch,v
retrieving revision 1.3
retrieving revision 1.4
diff -u -r1.3 -r1.4
--- drm-intel-next.patch	11 Feb 2009 14:55:23 -0000	1.3
+++ drm-intel-next.patch	11 Feb 2009 15:28:08 -0000	1.4
@@ -15,7 +15,8 @@
 
 # Patches follow
 
-commit 9c408a5b39bdf17ddb6b1c8c76fd918007a64230
+
+commit 6c7aefedd9ebaf1146581dec54f74b29486dae56
 Author: Jesse Barnes <jbarnes at virtuousgeek.org>
 Date:   Wed Feb 4 14:27:01 2009 -0800
 
@@ -40,7 +41,7 @@
     --
     Jesse Barnes, Intel Open Source Technology Center
 
-commit 323505925ddf763b4a839f44fb24838fc08a639f
+commit 4307cccd79e3c2b45304b28d4c629ef08d30f4a1
 Author: Kristian Høgsberg <krh at redhat.com>
 Date:   Tue Feb 3 15:07:02 2009 -0500
 
@@ -51,6 +52,102 @@
     
     Signed-off-by: Kristian Høgsberg <krh at redhat.com>
 
+commit 0e2f967303023f7f82a0963b7f7f3980d4c08f20
+Author: Roland Dreier <rdreier at cisco.com>
+Date:   Fri Feb 6 17:48:09 2009 -0800
+
+    drm/i915: Fix potential AB-BA deadlock in i915_gem_execbuffer()
+    
+    Lockdep warns that i915_gem_execbuffer() can trigger a page fault (which
+    takes mmap_sem) while holding dev->struct_mutex, while drm_vm_open()
+    (which is called with mmap_sem already held) takes dev->struct_mutex.
+    So this is a potential AB-BA deadlock.
+    
+    The way that i915_gem_execbuffer() triggers a page fault is by doing
+    copy_to_user() when returning new buffer offsets back to userspace;
+    however there is no reason to hold the struct_mutex when doing this
+    copy, since what is being copied is the contents of an array private to
+    i915_gem_execbuffer() anyway.  So we can fix the potential deadlock (and
+    get rid of the lockdep warning) by simply moving the copy_to_user()
+    outside of where struct_mutex is held.
+    
+    This fixes <http://bugzilla.kernel.org/show_bug.cgi?id=12491>.
+    
+    Reported-by: Jesse Brandeburg <jesse.brandeburg at intel.com>
+    Tested-by: Jesse Brandeburg <jesse.brandeburg at intel.com>
+    Signed-off-by: Roland Dreier <rolandd at cisco.com>
+    Signed-off-by: Eric Anholt <eric at anholt.net>
+
+commit 42fe9ab5fc5e6249386153a7c562b596ed8e25ce
+Author: Chris Wilson <chris at chris-wilson.co.uk>
+Date:   Sun Feb 8 19:08:04 2009 +0000
+
+    drm/i915: refleak along pin() error path.
+    
+    A missing unreference if the user calls pin() a second time on a pinned
+    buffer.
+    
+    Signed-off-by: Chris Wilson <chris at chris-wilson.co.uk>
+    Signed-off-by: Eric Anholt <eric at anholt.net>
+
+commit db4cdf6345df24e43dc46306a6759060c4901d61
+Author: Chris Wilson <chris at chris-wilson.co.uk>
+Date:   Sun Feb 8 19:07:51 2009 +0000
+
+    drm/i915: hold mutex for unreference() in i915_gem_tiling.c
+    
+    Signed-off-by: Chris Wilson <chris at chris-wilson.co.uk>
+    Signed-off-by: Eric Anholt <eric at anholt.net>
+
+commit f467a5c7200e156d8e253e6f2bbcf80e6b7187d9
+Author: Chris Wilson <chris at chris-wilson.co.uk>
+Date:   Fri Feb 6 16:55:20 2009 +0000
+
+    drm/i915: Cleanup trivial leak on execbuffer error path.
+    
+    Also spotted by Owain Ainsworth.
+    
+    Signed-off-by: Chris Wilson <chris at chris-wilson.co.uk>
+    Signed-off-by: Eric Anholt <eric at anholt.net>
+
+commit d46d509398b3690ababd05bea6b3bcce52c37780
+Author: Chris Wilson <chris at chris-wilson.co.uk>
+Date:   Mon Feb 9 11:31:41 2009 +0000
+
+    drm: Free the object ref on error.
+    
+    Ensure that the object is unreferenced if we fail to allocate during
+    drm_gem_flink_ioctl().
+    
+    Signed-off-by: Chris Wilson <chris at chris-wilson.co.uk>
+    Signed-off-by: Eric Anholt <eric at anholt.net>
+
+commit 821da41f85b1816e9f7d811a4b9733a07a3585a3
+Author: Chris Wilson <chris at chris-wilson.co.uk>
+Date:   Mon Feb 9 11:31:41 2009 +0000
+
+    drm: Potential use-after-free on error path.
+    
+    Remove the member from the hash table before we free the structure!
+    
+    Signed-off-by: Chris Wilson <chris at chris-wilson.co.uk>
+    Signed-off-by: Eric Anholt <eric at anholt.net>
+
+commit cf1573b0f0e79cb0808596589578a4ca60081730
+Author: Tobias Klauser <tklauser at distanz.ch>
+Date:   Mon Feb 9 22:02:42 2009 +0100
+
+    drm/i915: Storage class should be before const qualifier
+    
+    The C99 specification states in section 6.11.5:
+    
+    The placement of a storage-class specifier other than at the beginning
+    of the declaration specifiers in a declaration is an obsolescent
+    feature.
+    
+    Signed-off-by: Tobias Klauser <tklauser at distanz.ch>
+    Signed-off-by: Eric Anholt <eric at anholt.net>
+
 diff --git a/drivers/gpu/drm/drm_crtc_helper.c b/drivers/gpu/drm/drm_crtc_helper.c
 index 964c5eb..40c60de 100644
 --- a/drivers/gpu/drm/drm_crtc_helper.c
@@ -197,6 +294,166 @@
  fail_no_encoder:
  	kfree(save_crtcs);
  	count = 0;
+diff --git a/drivers/gpu/drm/drm_gem.c b/drivers/gpu/drm/drm_gem.c
+index 6915fb8..e5a8ebf 100644
+--- a/drivers/gpu/drm/drm_gem.c
++++ b/drivers/gpu/drm/drm_gem.c
+@@ -104,8 +104,8 @@ drm_gem_init(struct drm_device *dev)
+ 
+ 	if (drm_mm_init(&mm->offset_manager, DRM_FILE_PAGE_OFFSET_START,
+ 			DRM_FILE_PAGE_OFFSET_SIZE)) {
+-		drm_free(mm, sizeof(struct drm_gem_mm), DRM_MEM_MM);
+ 		drm_ht_remove(&mm->offset_hash);
++		drm_free(mm, sizeof(struct drm_gem_mm), DRM_MEM_MM);
+ 		return -ENOMEM;
+ 	}
+ 
+@@ -295,8 +295,10 @@ drm_gem_flink_ioctl(struct drm_device *dev, void *data,
+ 		return -EBADF;
+ 
+ again:
+-	if (idr_pre_get(&dev->object_name_idr, GFP_KERNEL) == 0)
+-		return -ENOMEM;
++	if (idr_pre_get(&dev->object_name_idr, GFP_KERNEL) == 0) {
++		ret = -ENOMEM;
++		goto err;
++	}
+ 
+ 	spin_lock(&dev->object_name_lock);
+ 	if (obj->name) {
+@@ -310,12 +312,8 @@ again:
+ 	if (ret == -EAGAIN)
+ 		goto again;
+ 
+-	if (ret != 0) {
+-		mutex_lock(&dev->struct_mutex);
+-		drm_gem_object_unreference(obj);
+-		mutex_unlock(&dev->struct_mutex);
+-		return ret;
+-	}
++	if (ret != 0)
++		goto err;
+ 
+ 	/*
+ 	 * Leave the reference from the lookup around as the
+@@ -324,6 +322,12 @@ again:
+ 	args->name = (uint64_t) obj->name;
+ 
+ 	return 0;
++
++err:
++	mutex_lock(&dev->struct_mutex);
++	drm_gem_object_unreference(obj);
++	mutex_unlock(&dev->struct_mutex);
++	return ret;
+ }
+ 
+ /**
+diff --git a/drivers/gpu/drm/i915/i915_gem.c b/drivers/gpu/drm/i915/i915_gem.c
+index 8185766..ff0d94d 100644
+--- a/drivers/gpu/drm/i915/i915_gem.c
++++ b/drivers/gpu/drm/i915/i915_gem.c
+@@ -2480,13 +2480,15 @@ i915_gem_execbuffer(struct drm_device *dev, void *data,
+ 	if (dev_priv->mm.wedged) {
+ 		DRM_ERROR("Execbuf while wedged\n");
+ 		mutex_unlock(&dev->struct_mutex);
+-		return -EIO;
++		ret = -EIO;
++		goto pre_mutex_err;
+ 	}
+ 
+ 	if (dev_priv->mm.suspended) {
+ 		DRM_ERROR("Execbuf while VT-switched.\n");
+ 		mutex_unlock(&dev->struct_mutex);
+-		return -EBUSY;
++		ret = -EBUSY;
++		goto pre_mutex_err;
+ 	}
+ 
+ 	/* Look up object handles */
+@@ -2632,15 +2634,6 @@ i915_gem_execbuffer(struct drm_device *dev, void *data,
+ 
+ 	i915_verify_inactive(dev, __FILE__, __LINE__);
+ 
+-	/* Copy the new buffer offsets back to the user's exec list. */
+-	ret = copy_to_user((struct drm_i915_relocation_entry __user *)
+-			   (uintptr_t) args->buffers_ptr,
+-			   exec_list,
+-			   sizeof(*exec_list) * args->buffer_count);
+-	if (ret)
+-		DRM_ERROR("failed to copy %d exec entries "
+-			  "back to user (%d)\n",
+-			   args->buffer_count, ret);
+ err:
+ 	for (i = 0; i < pinned; i++)
+ 		i915_gem_object_unpin(object_list[i]);
+@@ -2650,6 +2643,18 @@ err:
+ 
+ 	mutex_unlock(&dev->struct_mutex);
+ 
++	if (!ret) {
++		/* Copy the new buffer offsets back to the user's exec list. */
++		ret = copy_to_user((struct drm_i915_relocation_entry __user *)
++				   (uintptr_t) args->buffers_ptr,
++				   exec_list,
++				   sizeof(*exec_list) * args->buffer_count);
++		if (ret)
++			DRM_ERROR("failed to copy %d exec entries "
++				  "back to user (%d)\n",
++				  args->buffer_count, ret);
++	}
++
+ pre_mutex_err:
+ 	drm_free(object_list, sizeof(*object_list) * args->buffer_count,
+ 		 DRM_MEM_DRIVER);
+@@ -2753,6 +2758,7 @@ i915_gem_pin_ioctl(struct drm_device *dev, void *data,
+ 	if (obj_priv->pin_filp != NULL && obj_priv->pin_filp != file_priv) {
+ 		DRM_ERROR("Already pinned in i915_gem_pin_ioctl(): %d\n",
+ 			  args->handle);
++		drm_gem_object_unreference(obj);
+ 		mutex_unlock(&dev->struct_mutex);
+ 		return -EINVAL;
+ 	}
+diff --git a/drivers/gpu/drm/i915/i915_gem_tiling.c b/drivers/gpu/drm/i915/i915_gem_tiling.c
+index fa1685c..7fb4191 100644
+--- a/drivers/gpu/drm/i915/i915_gem_tiling.c
++++ b/drivers/gpu/drm/i915/i915_gem_tiling.c
+@@ -299,9 +299,8 @@ i915_gem_set_tiling(struct drm_device *dev, void *data,
+ 	}
+ 	obj_priv->stride = args->stride;
+ 
+-	mutex_unlock(&dev->struct_mutex);
+-
+ 	drm_gem_object_unreference(obj);
++	mutex_unlock(&dev->struct_mutex);
+ 
+ 	return 0;
+ }
+@@ -340,9 +339,8 @@ i915_gem_get_tiling(struct drm_device *dev, void *data,
+ 		DRM_ERROR("unknown tiling mode\n");
+ 	}
+ 
+-	mutex_unlock(&dev->struct_mutex);
+-
+ 	drm_gem_object_unreference(obj);
++	mutex_unlock(&dev->struct_mutex);
+ 
+ 	return 0;
+ }
+diff --git a/drivers/gpu/drm/i915/intel_display.c b/drivers/gpu/drm/i915/intel_display.c
+index bbdd729..0c66952 100644
+--- a/drivers/gpu/drm/i915/intel_display.c
++++ b/drivers/gpu/drm/i915/intel_display.c
+@@ -782,6 +782,9 @@ static void intel_crtc_mode_set(struct drm_crtc *crtc,
+ 		return;
+ 	}
+ 
++	DRM_DEBUG("setting mode on crtc %d, is_lvds: %s\n",
++		  crtc->base.id, is_lvds ? "true" : "false");
++
+ 	fp = clock.n << 16 | clock.m1 << 8 | clock.m2;
+ 
+ 	dpll = DPLL_VGA_MODE_DIS;
 diff --git a/drivers/gpu/drm/i915/intel_fb.c b/drivers/gpu/drm/i915/intel_fb.c
 index afd1217..0fd76d4 100644
 --- a/drivers/gpu/drm/i915/intel_fb.c
@@ -276,6 +533,32 @@
  	return 0;
  }
  EXPORT_SYMBOL(intelfb_remove);
+diff --git a/drivers/gpu/drm/i915/intel_sdvo.c b/drivers/gpu/drm/i915/intel_sdvo.c
+index a30508b..fbe6f39 100644
+--- a/drivers/gpu/drm/i915/intel_sdvo.c
++++ b/drivers/gpu/drm/i915/intel_sdvo.c
+@@ -193,7 +193,7 @@ static bool intel_sdvo_write_byte(struct intel_output *intel_output, int addr,
+ 
+ #define SDVO_CMD_NAME_ENTRY(cmd) {cmd, #cmd}
+ /** Mapping of command numbers to names, for debug output */
+-const static struct _sdvo_cmd_name {
++static const struct _sdvo_cmd_name {
+ 	u8 cmd;
+ 	char *name;
+ } sdvo_cmd_names[] = {
+diff --git a/drivers/gpu/drm/i915/intel_tv.c b/drivers/gpu/drm/i915/intel_tv.c
+index fbb35dc..56485d6 100644
+--- a/drivers/gpu/drm/i915/intel_tv.c
++++ b/drivers/gpu/drm/i915/intel_tv.c
+@@ -411,7 +411,7 @@ struct tv_mode {
+  * These values account for -1s required.
+  */
+ 
+-const static struct tv_mode tv_modes[] = {
++static const struct tv_mode tv_modes[] = {
+ 	{
+ 		.name		= "NTSC-M",
+ 		.clock		= 107520,
 diff --git a/include/drm/drm_crtc_helper.h b/include/drm/drm_crtc_helper.h
 index 0c6f0e1..28ff3ee 100644
 --- a/include/drm/drm_crtc_helper.h


Index: kernel.spec
===================================================================
RCS file: /cvs/pkgs/rpms/kernel/devel/kernel.spec,v
retrieving revision 1.1287
retrieving revision 1.1288
diff -u -r1.1287 -r1.1288
--- kernel.spec	11 Feb 2009 14:55:24 -0000	1.1287
+++ kernel.spec	11 Feb 2009 15:28:08 -0000	1.1288
@@ -1749,6 +1749,9 @@
 %kernel_variant_files -k vmlinux %{with_kdump} kdump
 
 %changelog
+* Wed Feb 11 2009 Kristian Høgsberg <krh at redhat.com>
+- Rebase drm-intel-next patch.
+
 * Wed Feb 11 2009 Jarod Wilson <jarod at redhat.com> 2.6.29-0.107.rc4.git3
 - 2.6.29-rc4-git3