summaryrefslogtreecommitdiff
path: root/drivers/gpu/drm/qxl (follow)
Commit message (Collapse)AuthorAge
* drm: qxl: ensure surf.data is ininitializedColin Ian King2021-07-20
| | | | | | | | | | | | | | | | [ Upstream commit fbbf23ddb2a1cc0c12c9f78237d1561c24006f50 ] The object surf is not fully initialized and the uninitialized field surf.data is being copied by the call to qxl_bo_create via the call to qxl_gem_object_create. Set surf.data to zero to ensure garbage data from the stack is not being copied. Addresses-Coverity: ("Uninitialized scalar variable") Fixes: f64122c1f6ad ("drm: add new QXL driver. (v1.4)") Signed-off-by: Colin Ian King <colin.king@canonical.com> Link: http://patchwork.freedesktop.org/patch/msgid/20210608161313.161922-1-colin.king@canonical.com Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> Signed-off-by: Sasha Levin <sashal@kernel.org>
* drm/qxl: Use correct notify port address when creating cursor ringHuacai Chen2020-06-29
| | | | | | | | | | | | | | | | | | | | | commit 80e5f89da3ab949fbbf1cae01dfaea29f5483a75 upstream. The command ring and cursor ring use different notify port addresses definition: QXL_IO_NOTIFY_CMD and QXL_IO_NOTIFY_CURSOR. However, in qxl_device_init() we use QXL_IO_NOTIFY_CMD to create both command ring and cursor ring. This doesn't cause any problems now, because QEMU's behaviors on QXL_IO_NOTIFY_CMD and QXL_IO_NOTIFY_CURSOR are the same. However, QEMU's behavior may be change in future, so let's fix it. P.S.: In the X.org QXL driver, the notify port address of cursor ring is correct. Signed-off-by: Huacai Chen <chenhc@lemote.com> Cc: <stable@vger.kernel.org> Link: http://patchwork.freedesktop.org/patch/msgid/1585635488-17507-1-git-send-email-chenhc@lemote.com Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
* drm/qxl: lost qxl_bo_kunmap_atomic_page in qxl_image_init_helper()Vasily Averin2020-05-20
| | | | | | | | | | | [ Upstream commit 5b5703dbafae74adfbe298a56a81694172caf5e6 ] v2: removed TODO reminder Signed-off-by: Vasily Averin <vvs@virtuozzo.com> Link: http://patchwork.freedesktop.org/patch/msgid/a4e0ae09-a73c-1c62-04ef-3f990d41bea9@virtuozzo.com Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> Signed-off-by: Sasha Levin <sashal@kernel.org>
* drm/qxl: qxl_release leak in qxl_draw_dirty_fb()Vasily Averin2020-05-10
| | | | | | | | | | | | | | commit 85e9b88af1e6164f19ec71381efd5e2bcfc17620 upstream. ret should be changed to release allocated struct qxl_release Cc: stable@vger.kernel.org Fixes: 8002db6336dd ("qxl: convert qxl driver to proper use for reservations") Signed-off-by: Vasily Averin <vvs@virtuozzo.com> Link: http://patchwork.freedesktop.org/patch/msgid/22cfd55f-07c8-95d0-a2f7-191b7153c3d4@virtuozzo.com Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> Signed-off-by: Vasily Averin <vvs@virtuozzo.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
* drm/qxl: qxl_release use after freeVasily Averin2020-05-10
| | | | | | | | | | | | | | | | | | | | | | commit 933db73351d359f74b14f4af095808260aff11f9 upstream. qxl_release should not be accesses after qxl_push_*_ring_release() calls: userspace driver can process submitted command quickly, move qxl_release into release_ring, generate interrupt and trigger garbage collector. It can lead to crashes in qxl driver or trigger memory corruption in some kmalloc-192 slab object Gerd Hoffmann proposes to swap the qxl_release_fence_buffer_objects() + qxl_push_{cursor,command}_ring_release() calls to close that race window. cc: stable@vger.kernel.org Fixes: f64122c1f6ad ("drm: add new QXL driver. (v1.4)") Signed-off-by: Vasily Averin <vvs@virtuozzo.com> Link: http://patchwork.freedesktop.org/patch/msgid/fa17b338-66ae-f299-68fe-8d32419d9071@virtuozzo.com Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> Signed-off-by: Vasily Averin <vvs@virtuozzo.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
* drm/qxl: qxl_release leak in qxl_hw_surface_alloc()Vasily Averin2020-05-05
| | | | | | | | | | | | commit a65aa9c3676ffccb21361d52fcfedd5b5ff387d7 upstream. Cc: stable@vger.kernel.org Fixes: 8002db6336dd ("qxl: convert qxl driver to proper use for reservations") Signed-off-by: Vasily Averin <vvs@virtuozzo.com> Link: http://patchwork.freedesktop.org/patch/msgid/2e5a13ae-9ab2-5401-aa4d-03d5f5593423@virtuozzo.com Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
* drm: qxl: Don't alloc fbdev if emulation is not supportedGabriel Krisman Bertazi2018-03-22
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | [ Upstream commit 861078381ba56b56808113736000d9e7ead349c8 ] If fbdev emulation is disabled, the QXL shutdown path will try to clean a framebuffer that wasn't initialized, hitting the Oops below. The problem is that even when FBDEV_EMULATION is disabled we allocate the qfbdev strutucture, but we don't initialize it. The fix is to stop allocating the memory, since it won't be used. This allows the existing verification in the cleanup hook to do it's job preventing the oops. Now that we don't allocate the unused fbdev structure, we need to be careful when dereferencing it in the PM suspend hook. [ 24.284684] BUG: unable to handle kernel NULL pointer dereference at 00000000000002e0 [ 24.285627] IP: mutex_lock+0x18/0x30 [ 24.286049] PGD 78cdf067 [ 24.286050] PUD 7940f067 [ 24.286344] PMD 0 [ 24.286649] [ 24.287072] Oops: 0002 [#1] SMP [ 24.287422] Modules linked in: qxl [ 24.287806] CPU: 0 PID: 2328 Comm: bash Not tainted 4.10.0-rc5+ #97 [ 24.288515] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.9.3-20161025_171302-gandalf 04/01/2014 [ 24.289681] task: ffff88007c4c0000 task.stack: ffffc90001b58000 [ 24.290354] RIP: 0010:mutex_lock+0x18/0x30 [ 24.290812] RSP: 0018:ffffc90001b5bcb0 EFLAGS: 00010246 [ 24.291401] RAX: 0000000000000000 RBX: 00000000000002e0 RCX: 0000000000000000 [ 24.292209] RDX: ffff88007c4c0000 RSI: 0000000000000001 RDI: 00000000000002e0 [ 24.292987] RBP: ffffc90001b5bcb8 R08: fffffffffffffffe R09: 0000000000000001 [ 24.293797] R10: ffff880078d80b80 R11: 0000000000011400 R12: 0000000000000000 [ 24.294601] R13: 00000000000002e0 R14: ffffffffa0009c28 R15: 0000000000000060 [ 24.295439] FS: 00007f30e3acbb40(0000) GS:ffff88007fc00000(0000) knlGS:0000000000000000 [ 24.296364] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 24.296997] CR2: 00000000000002e0 CR3: 0000000078c7b000 CR4: 00000000000006f0 [ 24.297813] Call Trace: [ 24.298097] drm_framebuffer_cleanup+0x1f/0x70 [ 24.298612] qxl_fbdev_fini+0x68/0x90 [qxl] [ 24.299074] qxl_modeset_fini+0xd/0x30 [qxl] [ 24.299562] qxl_pci_remove+0x22/0x50 [qxl] [ 24.300025] pci_device_remove+0x34/0xb0 [ 24.300507] device_release_driver_internal+0x150/0x200 [ 24.301082] device_release_driver+0xd/0x10 [ 24.301587] unbind_store+0x108/0x150 [ 24.301993] drv_attr_store+0x20/0x30 [ 24.302402] sysfs_kf_write+0x32/0x40 [ 24.302827] kernfs_fop_write+0x108/0x190 [ 24.303269] __vfs_write+0x23/0x120 [ 24.303678] ? security_file_permission+0x36/0xb0 [ 24.304193] ? rw_verify_area+0x49/0xb0 [ 24.304636] vfs_write+0xb0/0x190 [ 24.305004] SyS_write+0x41/0xa0 [ 24.305362] entry_SYSCALL_64_fastpath+0x1a/0xa9 [ 24.305887] RIP: 0033:0x7f30e31d9620 [ 24.306285] RSP: 002b:00007ffc54b47e68 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 24.307128] RAX: ffffffffffffffda RBX: 00007f30e3497600 RCX: 00007f30e31d9620 [ 24.307928] RDX: 000000000000000d RSI: 0000000000da2008 RDI: 0000000000000001 [ 24.308727] RBP: 000000000070bc60 R08: 00007f30e3498760 R09: 00007f30e3acbb40 [ 24.309504] R10: 0000000000000073 R11: 0000000000000246 R12: 0000000000000001 [ 24.310295] R13: 0000000000000000 R14: 0000000000000000 R15: 00007ffc54b47f34 [ 24.311095] Code: 0e 01 e9 7b fe ff ff 66 90 66 2e 0f 1f 84 00 00 00 00 00 55 48 89 e5 53 48 89 fb e8 83 e8 ff ff 65 48 8b 14 25 40 c4 00 00 31 c0 <3e> 48 0f b1 13 48 85 c0 74 08 48 89 df e8 66 fd ff ff 5b 5d c3 [ 24.313182] RIP: mutex_lock+0x18/0x30 RSP: ffffc90001b5bcb0 [ 24.313811] CR2: 00000000000002e0 [ 24.314208] ---[ end trace 29669c1593cae14b ]--- Signed-off-by: Gabriel Krisman Bertazi <krisman@collabora.co.uk> Link: http://patchwork.freedesktop.org/patch/msgid/20170227203330.18542-1-krisman@collabora.co.uk Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> Signed-off-by: Sasha Levin <alexander.levin@microsoft.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
* qxl: check for kmap failuresDan Carpenter2016-09-30
| | | | | | | | | | | | | commit f4cceb2affcd1285d4ce498089e8a79f4cd2fa66 upstream. If kmap fails, it leads to memory corruption. Fixes: f64122c1f6ad ('drm: add new QXL driver. (v1.4)') Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com> Signed-off-by: Daniel Vetter <daniel.vetter@ffwll.ch> Link: http://patchwork.freedesktop.org/patch/msgid/20160711084633.GA31411@mwanda Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
* drm/qxl: fix cursor position with non-zero hotspotJohn Keeping2016-05-04
| | | | | | | | | | | | | | | | | | | | commit d59a1f71ff1aeda4b4630df92d3ad4e3b1dfc885 upstream. The SPICE protocol considers the position of a cursor to be the location of its active pixel on the display, so the cursor is drawn with its top-left corner at "(x - hot_spot_x, y - hot_spot_y)" but the DRM cursor position gives the location where the top-left corner should be drawn, with the hotspot being a hint for drivers that need it. This fixes the location of the window resize cursors when using Fluxbox with the QXL DRM driver and both the QXL and modesetting X drivers. Signed-off-by: John Keeping <john@metanate.com> Reviewed-by: Daniel Vetter <daniel.vetter@ffwll.ch> Link: http://patchwork.freedesktop.org/patch/msgid/1447845445-2116-1-git-send-email-john@metanate.com Signed-off-by: Jani Nikula <jani.nikula@intel.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
* drm/qxl: use kmalloc_array to alloc reloc_info in qxl_process_single_commandGerd Hoffmann2016-03-03
| | | | | | | | | | | | | | commit 34855706c30d52b0a744da44348b5d1cc39fbe51 upstream. This avoids integer overflows on 32bit machines when calculating reloc_info size, as reported by Alan Cox. Cc: gnomes@lxorguk.ukuu.org.uk Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> Reviewed-by: Daniel Vetter <daniel.vetter@ffwll.ch> Signed-off-by: Dave Airlie <airlied@redhat.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
* Merge tag 'topic/drm-misc-2015-10-19' of ↵Dave Airlie2015-10-20
|\ | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | git://anongit.freedesktop.org/drm-intel into drm-next More drm-misc for 4.4. - fb refcount fix in atomic fbdev - various locking reworks to reduce drm_global_mutex and dev->struct_mutex - rename docbook to gpu.tmpl and include vga_switcheroo stuff, plus more vga_switcheroo (Lukas Wunner) - viewport check fixes for atomic drivers from Ville - DRM_DEBUG_VBL from Ville - non-contentious header fixes from Mikko Rapeli - small things all over * tag 'topic/drm-misc-2015-10-19' of git://anongit.freedesktop.org/drm-intel: (31 commits) drm/fb-helper: Fix fb refcounting in pan_display_atomic drm/fb-helper: Set plane rotation directly drm: fix mutex leak in drm_dp_get_mst_branch_device drm: Check plane src coordinates correctly during page flip for atomic drivers drm: Check crtc viewport correctly with rotated primary plane on atomic drivers drm: Refactor plane src coordinate checks drm: Swap w/h when converting the mode to src coordidates for a rotated primary plane drm: Don't leak fb when plane crtc coodinates are bad ALSA: hda - Spell vga_switcheroo consistently drm/gem: Use kref_get_unless_zero for the weak mmap references drm/vgem: Drop vgem_drm_gem_mmap drm: Fix return value of drm_framebuffer_init() drm/gem: Use container_of in drm_gem_object_free drm/gem: Check locking in drm_gem_object_unreference drm/gem: Drop struct_mutex requirement from drm_gem_mmap_obj drm/i810_drm.h: include drm/drm.h r128_drm.h: include drm/drm.h savage_drm.h: include <drm/drm.h> gpu/doc: Convert to markdown harder gpu/doc: Add vga_switcheroo documentation ...
| * drm/<drivers>: Drop DRM_UNLOCKED from modeset driversDaniel Vetter2015-10-16
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Just one special case (since i915 lost its ums code, yay): - radeon: Has slots for the old ums ioctls which don't have DRM_UNLOCKED, but all filled with drm_invalid_op. So ok to drop it everywhere. Every other kms driver just has DRM_UNLOCKED for all their ioctls, as they should. v2: admgpu happened, include that one too. And i915 lost its UMS support which means we can change all the i915 ioctls too. v3: Rebased on top of new vmwgfx DX interface extensions. v4: Rebase on top of render-node support in exynos. Signed-off-by: Daniel Vetter <daniel.vetter@intel.com> Reviewed-by: David Herrmann <dh.herrmann@gmail.com> Reviewed-by: Christian König <christian.koenig@amd.com> Signed-off-by: Daniel Vetter <daniel.vetter@ffwll.ch>
* | Merge commit '06d1ee32a4d25356a710b49d5e95dbdd68bdf505' of ↵Dave Airlie2015-10-16
|\ \ | |/ |/| | | | | | | | | | | git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux into drm-next Backmerge the drm-fixes pull from Linus's tree into drm-next. This is to fix some conflicts and make future pulls cleaner
| * drm/qxl: avoid dependency lockFrediano Ziglio2015-10-07
| | | | | | | | | | | | | | | | | | | | | | | | qxl_bo_unref calls drm_gem_object_unreference_unlocked which locks dev->struct_mutex. However this lock could be already locked if the call came from qxl_gem_object_free. As we don't need to call qxl_bo_ref/qxl_bo_unref cause qxl_release_list_add will hold a reference by itself avoid to call them and the possible deadlock. Signed-off-by: Frediano Ziglio <fziglio@redhat.com> Signed-off-by: Dave Airlie <airlied@redhat.com>
| * drm/qxl: avoid buffer reservation in qxl_crtc_page_flipFrediano Ziglio2015-10-07
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This avoid a dependency lock error. According to https://lwn.net/Articles/548909/ users of WW mutex API should avoid using different context. When a buffer is reserved with qxl_bo_reserve a ww_mutex_lock without context is used. However during qxl_draw_dirty_fb different locks with specific context are used. This is detected during a machine booting with a debug kernel with lock dependency checking enabled. Like many other function in this file to avoid this problem object pinning is used. Once the object is pinned is not necessary to keep the lock so it can be released avoiding the locking problem. Signed-off-by: Frediano Ziglio <fziglio@redhat.com> Signed-off-by: Dave Airlie <airlied@redhat.com>
| * drm/qxl: fix framebuffer dirty rectangle tracking.Gerd Hoffmann2015-10-07
| | | | | | | | | | | | | | | | | | | | | | Commit "c0fe07a drm/qxl: rewrite framebuffer support" has a bug in the dirty rectangle tracking: Instead of ignoring an empty dirty rectangle when adding a new dirty region the dirty region gets extended to the upper left corner. Fix it. Cc: linux-stable@vger.kernel.org Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> Signed-off-by: Dave Airlie <airlied@redhat.com>
| * drm/qxl: recreate the primary surface when the bo is not primaryFabiano Fidêncio2015-10-01
| | | | | | | | | | | | | | | | | | | | | | When disabling/enabling a crtc the primary area must be updated independently of which crtc has been disabled/enabled. Resolves: https://bugzilla.redhat.com/show_bug.cgi?id=1264735 Signed-off-by: Fabiano Fidêncio <fidencio@redhat.com> Cc: stable@vger.kernel.org Signed-off-by: Dave Airlie <airlied@redhat.com>
* | drm/irq: Use unsigned int pipe in public APIThierry Reding2015-10-06
|/ | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This continues the pattern started in commit cc1ef118fc09 ("drm/irq: Make pipe unsigned and name consistent"). This is applied to the public APIs and driver callbacks, so pretty much all drivers need to be updated to match the new prototypes. Cc: Christian König <christian.koenig@amd.com> Cc: Alex Deucher <alexander.deucher@amd.com> Cc: Russell King <rmk+kernel@arm.linux.org.uk> Cc: Inki Dae <inki.dae@samsung.com> Cc: Jianwei Wang <jianwei.wang.chn@gmail.com> Cc: Alison Wang <alison.wang@freescale.com> Cc: Patrik Jakobsson <patrik.r.jakobsson@gmail.com> Cc: Daniel Vetter <daniel.vetter@intel.com> Cc: Jani Nikula <jani.nikula@linux.intel.com> Cc: Philipp Zabel <p.zabel@pengutronix.de> Cc: David Airlie <airlied@linux.ie> Cc: Rob Clark <robdclark@gmail.com> Cc: Ben Skeggs <bskeggs@redhat.com> Cc: Tomi Valkeinen <tomi.valkeinen@ti.com> Cc: Laurent Pinchart <laurent.pinchart@ideasonboard.com> Cc: Mark Yao <mark.yao@rock-chips.com> Cc: Benjamin Gaignard <benjamin.gaignard@linaro.org> Cc: Vincent Abriou <vincent.abriou@st.com> Cc: Thomas Hellstrom <thellstrom@vmware.com> Signed-off-by: Thierry Reding <treding@nvidia.com> Reviewed-by: Ville Syrjälä <ville.syrjala@linux.intel.com> Signed-off-by: Daniel Vetter <daniel.vetter@ffwll.ch>
* drm/qxl: only report first monitor as connected if we have no stateDave Airlie2015-09-24
| | | | | | | | If the server isn't new enough to give us state, report the first monitor as always connected, otherwise believe the server side. Cc: stable@vger.kernel.org Signed-off-by: Dave Airlie <airlied@redhat.com>
* drm/qxl: validate monitors config modesJonathon Jongsma2015-09-11
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Due to some recent changes in drm_helper_probe_single_connector_modes_merge_bits(), old custom modes were not being pruned properly. In current kernels, drm_mode_validate_basic() is called to sanity-check each mode in the list. If the sanity-check passes, the mode's status gets set to to MODE_OK. In older kernels this check was not done, so old custom modes would still have a status of MODE_UNVERIFIED at this point, and would therefore be pruned later in the function. As a result of this new behavior, the list of modes for a device always includes every custom mode ever configured for the device, with the largest one listed first. Since desktop environments usually choose the first preferred mode when a hotplug event is emitted, this had the result of making it very difficult for the user to reduce the size of the display. The qxl driver did implement the mode_valid connector function, but it was empty. In order to restore the old behavior where old custom modes are pruned, we implement a proper mode_valid function for the qxl driver. This function now checks each mode against the last configured custom mode and the list of standard modes. If the mode doesn't match any of these, its status is set to MODE_BAD so that it will be pruned as expected. Signed-off-by: Jonathon Jongsma <jjongsma@redhat.com> Cc: stable@vger.kernel.org Signed-off-by: Dave Airlie <airlied@redhat.com>
* drm/qxl: Don't take dev->struct_mutex in bo_force_deleteDaniel Vetter2015-08-11
| | | | | | | | | It really doesn't protect anything which doesn't have other locks already. It also doesn't seem to be wired up into the driver unload code fwiw, but that's a different issue. Reviewed-by: Thierry Reding <treding@nvidia.com> Signed-off-by: Daniel Vetter <daniel.vetter@intel.com>
* drm/qxl: Use new drm_fb_helper functionsArchit Taneja2015-08-06
| | | | | | | | | | | | Use the newly created wrapper drm_fb_helper functions instead of calling core fbdev functions directly. They also simplify the fb_info creation. Cc: David Airlie <airlied@linux.ie> Cc: Frediano Ziglio <fziglio@redhat.com> Cc: Maarten Lankhorst <maarten.lankhorst@canonical.com> Signed-off-by: Archit Taneja <architt@codeaurora.org> Signed-off-by: Daniel Vetter <daniel.vetter@ffwll.ch>
* drm/qxl: Propagate correctly errors from qxlhw_handle_to_boFrediano Ziglio2015-06-05
| | | | | | | | | | | | This function could return a NULL pointer in case of handle not present and in case of out of memory conditions however caller function always returned EINVAL error hiding a possible ENOMEM. This patch change the function to return the error instead to be able to propagate the error instead of assuming EINVAL. Signed-off-by: Frediano Ziglio <fziglio@redhat.com> Reviewed-by: Dave Airlie <airlied@redhat.com> Signed-off-by: Dave Airlie <airlied@redhat.com>
* drm/qxl: Simplify cleaning qxl processing commandFrediano Ziglio2015-06-05
| | | | | | | | | | | | In qxlhw_handle_to_bo we incremented counters twice, one time for release object and one for reloc_info. In the main function however reloc_info references was drop much earlier than release so keeping the pointer only on release is safe and make cleaning process easier. Signed-off-by: Frediano Ziglio <fziglio@redhat.com> Reviewed-by: Dave Airlie <airlied@redhat.com> Signed-off-by: Dave Airlie <airlied@redhat.com>
* drm/qxl: Move main reference counter to GEM object instead of TTM onesFrediano Ziglio2015-06-05
| | | | | | | | | | | | | | | | | | qxl_bo structure has two reference counters, one in the GEM object and another in the TTM object. The GEM object keep a counter to the TTM object so when GEM counter reached zero the TTM counter (using qxl_bo_unref) was decremented. The qxl object is fully freed (both GEM and TTM part are cleaned) when the TTM counter reach zero. One issue was that surface idr structure has no owning on qxl_bo objects however it contains a pointer to qxl_bo object. This caused some nasty race condition for instance qxl_bo object was reaped even after counter was already zero. This patch fix these races moving main counter (the one used by qxl_bo_(un)ref) to GEM object which cleanup routine (qxl_gem_object_free) remove the idr pointer (using qxl_surface_evict) when the counters are still valid. Signed-off-by: Frediano Ziglio <fziglio@redhat.com> Reviewed-by: Dave Airlie <airlied@redhat.com> Signed-off-by: Dave Airlie <airlied@redhat.com>
* drm/qxl: Remove format string errorsFrediano Ziglio2015-06-05
| | | | | | | | | | Enable format string checks for qxl_io_log and remove resulting warnings which could lead to memory errors on different platform or just printing wrong information. Signed-off-by: Frediano Ziglio <fziglio@redhat.com> Reviewed-by: Dave Airlie <airlied@redhat.com> Signed-off-by: Dave Airlie <airlied@redhat.com>
* drm/qxl: Handle correctly failures in qxl_alloc_relase_reservedFrediano Ziglio2015-06-05
| | | | | | | | Free resources correctly if function fails Signed-off-by: Frediano Ziglio <fziglio@redhat.com> Reviewed-by: Dave Airlie <airlied@redhat.com> Signed-off-by: Dave Airlie <airlied@redhat.com>
* drm/qxl: Fix return for qxl_release_allocFrediano Ziglio2015-06-05
| | | | | | | | This function return handle to allocated release object which is an int. Signed-off-by: Frediano Ziglio <fziglio@redhat.com> Reviewed-by: Dave Airlie <airlied@redhat.com> Signed-off-by: Dave Airlie <airlied@redhat.com>
* drm/qxl: Handle all errors in qxl_surface_evictFrediano Ziglio2015-06-05
| | | | | | | | | Only EBUSY error was handled. This could cause code to believe reserve was successful while it failed. Signed-off-by: Frediano Ziglio <fziglio@redhat.com> Reviewed-by: Dave Airlie <airlied@redhat.com> Signed-off-by: Dave Airlie <airlied@redhat.com>
* drm/qxl: Avoid double free on errorFrediano Ziglio2015-06-05
| | | | | | | | | | | Is we are not able to get source bo object from handle we free destination bo object and call cleanup code however destination object was already inserted in reloc_info array (num_relocs was already incremented) so on cleanup we free destination again. Signed-off-by: Frediano Ziglio <fziglio@redhat.com> Reviewed-by: Dave Airlie <airlied@redhat.com> Signed-off-by: Dave Airlie <airlied@redhat.com>
* drm/qxl: Fix print statement not using uninitialized variableFrediano Ziglio2015-06-05
| | | | | | | | reloc_info[i] is not still initialized in the print statement. Signed-off-by: Frediano Ziglio <fziglio@redhat.com> Reviewed-by: Dave Airlie <airlied@redhat.com> Signed-off-by: Dave Airlie <airlied@redhat.com>
* drm/qxl: Do not leak memory if qxl_release_list_add failsFrediano Ziglio2015-06-05
| | | | | | | | | | | If the function fails reference counter to the object is not decremented causing leaks. This is hard to spot as it happens only on very low memory situations. Signed-off-by: Frediano Ziglio <fziglio@redhat.com> Cc: stable@vger.kernel.org Reviewed-by: Dave Airlie <airlied@redhat.com> Signed-off-by: Dave Airlie <airlied@redhat.com>
* drm/qxl: Do not cause spice-server to clean our objectsFrediano Ziglio2015-06-05
| | | | | | | | | | | | | If objects are moved back from system memory to VRAM (and spice id created again) memory is already initialized so we need to set flag to not clear memory. If you don't do it after a while using desktop many images turns to black or transparents. Signed-off-by: Frediano Ziglio <fziglio@redhat.com> Cc: stable@vger.kernel.org Reviewed-by: Dave Airlie <airlied@redhat.com> Signed-off-by: Dave Airlie <airlied@redhat.com>
* drm/qxl: rewrite framebuffer supportGerd Hoffmann2015-05-07
| | | | | | | | | | | | | | | | | | | | | | | Completely different approach: Instead of encoding each and every framebuffer update as spice operation simply update the shadow framebuffer and maintain a dirty rectangle. Also schedule a worker to push an update for the dirty rectangle as spice operation. Usually a bunch of dirty rectangle updates are collected before the worker actually runs. What changes: Updates get batched now. Instead of sending tons of small updates a few large ones are sent. When the same region is updated multiple times within a short timeframe (scrolling multiple lines for example) we send a single update only. Spice server has an easier job now: The dependency tree for display operations which spice server maintains for lazy rendering is alot smaller now. Spice server's image compression probably works better too with the larger image blits. Net effect: framebuffer console @ qxldrmfb is an order of magnitude faster now. Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> Signed-off-by: Dave Airlie <airlied@redhat.com>
* drm/qxl: Fix qxl_noop_get_vblank_counter()Mario Kleiner2015-05-04
| | | | | | | | | | | | | | | | | This breaks under the vblank timestamp cleanup patch by Daniel Vetter. Also it is pointless to return anything but zero (or any other constant) if the function doesn't actually query a hw vblank counter. The bogus return of the current drm vblank counter via direct readout or via drm_vblank_count() is found in many of the new kms drivers, but it does exactly nothing different from returning any arbitrary constant - it's a no operation. Let's simply return 0 - Easy and fast. Signed-off-by: Mario Kleiner <mario.kleiner.de@gmail.com> Cc: Dave Airlie <airlied@redhat.com> Signed-off-by: Daniel Vetter <daniel.vetter@ffwll.ch>
* drm/qxl: constify all struct drm_*_helper funcs pointersJani Nikula2015-04-07
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | They are not to be modified. Generated using the semantic patch: @@ @@ ( const struct drm_crtc_helper_funcs * | - struct drm_crtc_helper_funcs * + const struct drm_crtc_helper_funcs * ) @@ @@ ( const struct drm_encoder_helper_funcs * | - struct drm_encoder_helper_funcs * + const struct drm_encoder_helper_funcs * ) @@ @@ ( const struct drm_connector_helper_funcs * | - struct drm_connector_helper_funcs * + const struct drm_connector_helper_funcs * ) @@ @@ ( const struct drm_plane_helper_funcs * | - struct drm_plane_helper_funcs * + const struct drm_plane_helper_funcs * ) Signed-off-by: Jani Nikula <jani.nikula@intel.com> Signed-off-by: Daniel Vetter <daniel.vetter@ffwll.ch>
* drm/fb-helper: Propagate errors from initial config failureThierry Reding2015-01-21
| | | | | | | | | | | | | | | | | | | | | | | | | | Make drm_fb_helper_initial_config() return an int rather than a bool so that the error can be properly propagated. While at it, update drivers to propagate errors further rather than just ignore them. v2: - cirrus: No cleanup is required, the top-level cirrus_driver_load() will do it as part of cirrus_driver_unload() in its cleanup path. Reported-by: Fengguang Wu <fengguang.wu@intel.com> Cc: David Airlie <airlied@linux.ie> Cc: Daniel Vetter <daniel.vetter@ffwll.ch> Cc: Patrik Jakobsson <patrik.r.jakobsson@gmail.com> Cc: Rob Clark <robdclark@gmail.com> Cc: Tomi Valkeinen <tomi.valkeinen@ti.com> Cc: Alex Deucher <alexander.deucher@amd.com> Cc: Christian König <christian.koenig@amd.com> Cc: Ben Skeggs <bskeggs@redhat.com> Signed-off-by: Thierry Reding <treding@nvidia.com> Reviewed-by: Alex Deucher <alexander.deucher@amd.com> Reviewed-by: Patrik Jakobsson <patrik.r.jakobsson@gmail.com> Reviewed-by: Christian König <christian.koenig@amd.com> [danvet: Squash in simplification patch from kbuild.] Signed-off-by: Daniel Vetter <daniel.vetter@ffwll.ch>
* drm/ttm: optionally move duplicates to a separate listChristian König2014-12-03
| | | | | | | | | | This patch adds an optional list_head parameter to ttm_eu_reserve_buffers. If specified duplicates in the execbuf list are no longer reported as errors, but moved to this list instead. Reviewed-by: Thomas Hellstrom <thellstrom@vmware.com> Signed-off-by: Christian König <christian.koenig@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
* drm/qxl: drop unused mode private pointerDave Airlie2014-11-15
| | | | | | This was pointless, forgot to remove the code. Signed-off-by: Dave Airlie <airlied@redhat.com>
* drm/qxl: use suggested x/y offset properties to pass guest prefsDave Airlie2014-11-15
| | | | | | | | This passes the guest preferences for a where to place the outputs through to userspace. Userspace would need to be updated to take note of this information, X server and GNOME. Signed-off-by: Dave Airlie <airlied@redhat.com>
* drm: Move drm_crtc_init from drm_crtc.h to drm_plane_helper.hDaniel Vetter2014-11-05
| | | | | | | | | | | | | | | | | | | Just a bit of OCD cleanup on headers - this function isn't the core interface any more but just a helper for drivers who haven't yet transitioned to universal planes. Put the declaration at the right spot and sprinkle necessary #includes over all drivers. Maybe this helps to encourage driver maintainers to do the switch. v2: Fix #include ordering for tegra, reported by 0-day builder. v3: Include required headers, reported by Thierry. Cc: Matt Roper <matthew.d.roper@intel.com> Cc: Thierry Reding <treding@nvidia.com> Reviewed-by: Matt Roper <matthew.d.roper@intel.com> Reviewed-by: Sean Paul <seanpaul@chromium.org> Signed-off-by: Daniel Vetter <daniel.vetter@intel.com>
* qxl: don't create too large primary surfaceMarc-André Lureau2014-10-22
| | | | | | | | | | | | | | | Limit primary to qemu vgamem size, to avoid reaching qemu guest bug "requested primary larger than framebuffer" on resizing screen too large to fit. Remove unneeded and misleading variables. Related to: https://bugzilla.redhat.com/show_bug.cgi?id=1127552 Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com> Cc: stable@vger.kernel.org Signed-off-by: Dave Airlie <airlied@redhat.com>
* Merge branch 'for-airlied-next' of ↵Dave Airlie2014-10-01
|\ | | | | | | | | | | | | | | | | | | | | | | | | | | git://people.freedesktop.org/~mlankhorst/linux into drm-next fixups for nouveau and fencing * 'for-airlied-next' of git://people.freedesktop.org/~mlankhorst/linux: drm/nouveau: export reservation_object from dmabuf to ttm drm/ttm: add reservation_object as argument to ttm_bo_init drm: Pass dma-buf as argument to gem_prime_import_sg_table drm/nouveau: assign fence_chan->name correctly drm/nouveau: specify if interruptible wait is desired in nouveau_fence_sync drm/nouveau: bump driver patchlevel to 1.2.1
| * drm/ttm: add reservation_object as argument to ttm_bo_initMaarten Lankhorst2014-09-30
| | | | | | | | | | | | This allows importing reservation objects from dma-bufs. Signed-off-by: Maarten Lankhorst <maarten.lankhorst@canonical.com>
| * drm: Pass dma-buf as argument to gem_prime_import_sg_tableMaarten Lankhorst2014-09-30
| | | | | | | | | | | | Allows importing dma_reservation_objects from a dma-buf. Signed-off-by: Maarten Lankhorst <maarten.lankhorst@canonical.com>
* | drm/qxl: use container_of to resolve qxl_fbdev from drm_fb_helperFabian Frederick2014-09-24
|/ | | | | | | Use container_of instead of casting first structure member. Signed-off-by: Fabian Frederick <fabf@skynet.be> Signed-off-by: Daniel Vetter <daniel.vetter@ffwll.ch>
* drm: Extract <drm/drm_gem.h>Daniel Vetter2014-09-24
| | | | | | | | | | | v2: Don't forget git add, noticed by David. Cc: David Herrmann <dh.herrmann@gmail.com> Signed-off-by: Daniel Vetter <daniel.vetter@intel.com> Acked-by: David Herrmann <dh.herrmann@gmail.com> Acked-by: Alex Deucher <alexander.deucher@amd.com> Signed-off-by: Dave Airlie <airlied@redhat.com>
* drm/<ttm-based-drivers>: Don't call drm_mmapDaniel Vetter2014-09-24
| | | | | | | | | | | | | | | | | | | | | | Really, the legacy buffer api should be dead, especially for all these newfangled drivers. I suspect this is copypasta from the transitioning days, which probably originated in radeon. Cc: "Christian König" <christian.koenig@amd.com> Cc: David Herrmann <dh.herrmann@gmail.com> Cc: Rashika <rashika.kheria@gmail.com> Cc: Josh Triplett <josh@joshtriplett.org> Cc: Daniel Vetter <daniel.vetter@ffwll.ch> Cc: Fabian Frederick <fabf@skynet.be> Cc: Gerd Hoffmann <kraxel@redhat.com> Cc: Alexandre Courbot <acourbot@nvidia.com> Cc: Maarten Lankhorst <maarten.lankhorst@canonical.com> Cc: Christian Engelmayer <cengelma@gmx.at> Signed-off-by: Daniel Vetter <daniel.vetter@intel.com> Reviewed-by: David Herrmann <dh.herrmann@gmail.com> Acked-by: Ben Skeggs <bskeggs@redhat.com> Acked-by: Alex Deucher <alexander.deucher@amd.com> Signed-off-by: Dave Airlie <airlied@redhat.com>
* drm/ttm: allow fence to be added as sharedChristian König2014-09-11
| | | | | | | | This patch adds a new flag to the ttm_validate_buffer list to add the fence as shared to the reservation object. Signed-off-by: Christian König <christian.koenig@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
* drm: add driver->set_busid() callbackDavid Herrmann2014-09-10
| | | | | | | | | | | | | | One step closer to dropping all the drm_bus_* code: Add a driver->set_busid() callback and make all drivers use the generic helpers. Nouveau is the only driver that uses two different bus-types with the same drm_driver. This is totally broken if both buses are available on the same machine (unlikely, but lets be safe). Therefore, we create two different drivers for each platform during module_init() and set the set_busid() callback respectively. Signed-off-by: David Herrmann <dh.herrmann@gmail.com> Reviewed-by: Thierry Reding <treding@nvidia.com> Signed-off-by: Dave Airlie <airlied@redhat.com>
generated by cgit v1.2.3 (git 2.25.1) at 2026-01-29 05:32:33 +0000