<feed xmlns='http://www.w3.org/2005/Atom'>
<title>linux-toradex.git/drivers/gpu/drm/vmwgfx, branch v4.1.26</title>
<subtitle>Linux kernel for Apalis and Colibri modules</subtitle>
<link rel='alternate' type='text/html' href='https://git.toradex.cn/cgit/linux-toradex.git/'/>
<entry>
<title>drm/vmwgfx: respect 'nomodeset'</title>
<updated>2016-02-15T20:45:26+00:00</updated>
<author>
<name>Rob Clark</name>
<email>robdclark@gmail.com</email>
</author>
<published>2014-10-15T19:00:47+00:00</published>
<link rel='alternate' type='text/html' href='https://git.toradex.cn/cgit/linux-toradex.git/commit/?id=c4bbd2785e0ed7ed3e8c16776194ea9181fc3454'/>
<id>c4bbd2785e0ed7ed3e8c16776194ea9181fc3454</id>
<content type='text'>
[ Upstream commit 96c5d076f0a5e2023ecdb44d8261f87641ee71e0 ]

Signed-off-by: Rob Clark &lt;robdclark@gmail.com&gt;
Reviewed-by: Thomas Hellstrom &lt;thellstrom@vmware.com&gt;.
Cc: stable@vger.kernel.org
Signed-off-by: Dave Airlie &lt;airlied@redhat.com&gt;
Signed-off-by: Sasha Levin &lt;sasha.levin@oracle.com&gt;
</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
[ Upstream commit 96c5d076f0a5e2023ecdb44d8261f87641ee71e0 ]

Signed-off-by: Rob Clark &lt;robdclark@gmail.com&gt;
Reviewed-by: Thomas Hellstrom &lt;thellstrom@vmware.com&gt;.
Cc: stable@vger.kernel.org
Signed-off-by: Dave Airlie &lt;airlied@redhat.com&gt;
Signed-off-by: Sasha Levin &lt;sasha.levin@oracle.com&gt;
</pre>
</div>
</content>
</entry>
<entry>
<title>drm/vmwgfx: Fix up user_dmabuf refcounting</title>
<updated>2015-11-09T22:33:39+00:00</updated>
<author>
<name>Thomas Hellstrom</name>
<email>thellstrom@vmware.com</email>
</author>
<published>2015-09-14T08:13:11+00:00</published>
<link rel='alternate' type='text/html' href='https://git.toradex.cn/cgit/linux-toradex.git/commit/?id=435d5d7f3a0dd62dc1465c314e338f159fb7d43a'/>
<id>435d5d7f3a0dd62dc1465c314e338f159fb7d43a</id>
<content type='text'>
commit 54c12bc374408faddbff75dbf1a6167c19af39c4 upstream.

If user space calls unreference on a user_dmabuf it will typically
kill the struct ttm_base_object member which is responsible for the
user-space visibility. However the dmabuf part may still be alive and
refcounted. In some situations, like for shared guest-backed surface
referencing/opening, the driver may try to reference the
struct ttm_base_object member again, causing an immediate kernel warning
and a later kernel NULL pointer dereference.

Fix this by always maintaining a reference on the struct
ttm_base_object member, in situations where it might subsequently be
referenced.

Signed-off-by: Thomas Hellstrom &lt;thellstrom@vmware.com&gt;
Reviewed-by: Brian Paul &lt;brianp@vmware.com&gt;
Reviewed-by: Sinclair Yeh &lt;syeh@vmware.com&gt;
Signed-off-by: Greg Kroah-Hartman &lt;gregkh@linuxfoundation.org&gt;

</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
commit 54c12bc374408faddbff75dbf1a6167c19af39c4 upstream.

If user space calls unreference on a user_dmabuf it will typically
kill the struct ttm_base_object member which is responsible for the
user-space visibility. However the dmabuf part may still be alive and
refcounted. In some situations, like for shared guest-backed surface
referencing/opening, the driver may try to reference the
struct ttm_base_object member again, causing an immediate kernel warning
and a later kernel NULL pointer dereference.

Fix this by always maintaining a reference on the struct
ttm_base_object member, in situations where it might subsequently be
referenced.

Signed-off-by: Thomas Hellstrom &lt;thellstrom@vmware.com&gt;
Reviewed-by: Brian Paul &lt;brianp@vmware.com&gt;
Reviewed-by: Sinclair Yeh &lt;syeh@vmware.com&gt;
Signed-off-by: Greg Kroah-Hartman &lt;gregkh@linuxfoundation.org&gt;

</pre>
</div>
</content>
</entry>
<entry>
<title>drm/vmwgfx: Fix execbuf locking issues</title>
<updated>2015-09-13T16:07:42+00:00</updated>
<author>
<name>Thomas Hellstrom</name>
<email>thellstrom@vmware.com</email>
</author>
<published>2015-08-12T05:31:17+00:00</published>
<link rel='alternate' type='text/html' href='https://git.toradex.cn/cgit/linux-toradex.git/commit/?id=3f52099b9579b39c8e6bfbbd1a92edc303c6d9fd'/>
<id>3f52099b9579b39c8e6bfbbd1a92edc303c6d9fd</id>
<content type='text'>
commit 3e04e2fe6d87807d27521ad6ebb9e7919d628f25 upstream.

This addresses two issues that cause problems with viewperf maya-03 in
situation with memory pressure.

The first issue causes attempts to unreserve buffers if batched
reservation fails due to, for example, a signal pending. While previously
the ttm_eu api was resistant against this type of error, it is no longer
and the lockdep code will complain about attempting to unreserve buffers
that are not reserved. The issue is resolved by avoid calling
ttm_eu_backoff_reservation in the buffer reserve error path.

The second issue is that the binding_mutex may be held when user-space
fence objects are created and hence during memory reclaims. This may cause
recursive attempts to grab the binding mutex. The issue is resolved by not
holding the binding mutex across fence creation and submission.

Signed-off-by: Thomas Hellstrom &lt;thellstrom@vmware.com&gt;
Reviewed-by: Sinclair Yeh &lt;syeh@vmware.com&gt;
Signed-off-by: Dave Airlie &lt;airlied@redhat.com&gt;
Signed-off-by: Greg Kroah-Hartman &lt;gregkh@linuxfoundation.org&gt;

</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
commit 3e04e2fe6d87807d27521ad6ebb9e7919d628f25 upstream.

This addresses two issues that cause problems with viewperf maya-03 in
situation with memory pressure.

The first issue causes attempts to unreserve buffers if batched
reservation fails due to, for example, a signal pending. While previously
the ttm_eu api was resistant against this type of error, it is no longer
and the lockdep code will complain about attempting to unreserve buffers
that are not reserved. The issue is resolved by avoid calling
ttm_eu_backoff_reservation in the buffer reserve error path.

The second issue is that the binding_mutex may be held when user-space
fence objects are created and hence during memory reclaims. This may cause
recursive attempts to grab the binding mutex. The issue is resolved by not
holding the binding mutex across fence creation and submission.

Signed-off-by: Thomas Hellstrom &lt;thellstrom@vmware.com&gt;
Reviewed-by: Sinclair Yeh &lt;syeh@vmware.com&gt;
Signed-off-by: Dave Airlie &lt;airlied@redhat.com&gt;
Signed-off-by: Greg Kroah-Hartman &lt;gregkh@linuxfoundation.org&gt;

</pre>
</div>
</content>
</entry>
<entry>
<title>Merge tag 'topic/drm-misc-2015-03-31' of git://anongit.freedesktop.org/drm-intel into drm-next</title>
<updated>2015-03-31T22:23:25+00:00</updated>
<author>
<name>Dave Airlie</name>
<email>airlied@redhat.com</email>
</author>
<published>2015-03-31T22:23:25+00:00</published>
<link rel='alternate' type='text/html' href='https://git.toradex.cn/cgit/linux-toradex.git/commit/?id=53d8858bb81ccf47ddca8b94d21f39972549e166'/>
<id>53d8858bb81ccf47ddca8b94d21f39972549e166</id>
<content type='text'>
Final drm-misc pull for 4.0, just various things all over, including a few
more important atomic fixes. btw I didn't pick up the vmwgfx patch from
Ville's series, but one patch has one hunk touching vmwgfx and
Thomas/Jakob didn't get around to ack it. I figured it's simple enough to
be ok though.

* tag 'topic/drm-misc-2015-03-31' of git://anongit.freedesktop.org/drm-intel:
  drm: line wrap DRM_IOCTL_DEF* macros
  drm/atomic: Don't try to free a NULL state
  drm/atomic: Clear crtcs, connectors and planes when clearing state
  drm: Rewrite drm_ioctl_flags() to resemble the new drm_ioctl() code
  drm: Use max() to make the ioctl alloc size code cleaner
  drm: Simplify core vs. drv ioctl handling
  drm: Drop ioctl-&gt;cmd_drv
  drm: Fix DRM_IOCTL_DEF_DRV()
  drm/atomic-helpers: Properly avoid full modeset dance
  drm: atomic: Allow setting CRTC active property
  drm: atomic: Expose CRTC active property
  drm: crtc_helper: Update hwmode before mode_set call
  drm: mode: Allow NULL modes for equality check
  drm: fb_helper: Simplify exit condition
  drm: mode: Fix typo in kerneldoc
  drm/dp: Print the number of bytes processed for aux nacks
</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
Final drm-misc pull for 4.0, just various things all over, including a few
more important atomic fixes. btw I didn't pick up the vmwgfx patch from
Ville's series, but one patch has one hunk touching vmwgfx and
Thomas/Jakob didn't get around to ack it. I figured it's simple enough to
be ok though.

* tag 'topic/drm-misc-2015-03-31' of git://anongit.freedesktop.org/drm-intel:
  drm: line wrap DRM_IOCTL_DEF* macros
  drm/atomic: Don't try to free a NULL state
  drm/atomic: Clear crtcs, connectors and planes when clearing state
  drm: Rewrite drm_ioctl_flags() to resemble the new drm_ioctl() code
  drm: Use max() to make the ioctl alloc size code cleaner
  drm: Simplify core vs. drv ioctl handling
  drm: Drop ioctl-&gt;cmd_drv
  drm: Fix DRM_IOCTL_DEF_DRV()
  drm/atomic-helpers: Properly avoid full modeset dance
  drm: atomic: Allow setting CRTC active property
  drm: atomic: Expose CRTC active property
  drm: crtc_helper: Update hwmode before mode_set call
  drm: mode: Allow NULL modes for equality check
  drm: fb_helper: Simplify exit condition
  drm: mode: Fix typo in kerneldoc
  drm/dp: Print the number of bytes processed for aux nacks
</pre>
</div>
</content>
</entry>
<entry>
<title>drm: Drop ioctl-&gt;cmd_drv</title>
<updated>2015-03-27T15:08:34+00:00</updated>
<author>
<name>Ville Syrjälä</name>
<email>ville.syrjala@linux.intel.com</email>
</author>
<published>2015-03-27T13:51:56+00:00</published>
<link rel='alternate' type='text/html' href='https://git.toradex.cn/cgit/linux-toradex.git/commit/?id=7e7392a6e854a29016377b87bebe5ae263f65e5c'/>
<id>7e7392a6e854a29016377b87bebe5ae263f65e5c</id>
<content type='text'>
ioctl-&gt;cmd_drv is pointless and we can just as well stick the full ioctl
definition into ioctl-&gt;cmd.

Cc: Jakob Bornecrantz &lt;jakob@vmware.com&gt;
Cc: Thomas Hellstrom &lt;thellstrom@vmware.com&gt;
Signed-off-by: Ville Syrjälä &lt;ville.syrjala@linux.intel.com&gt;
Signed-off-by: Daniel Vetter &lt;daniel.vetter@ffwll.ch&gt;
</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
ioctl-&gt;cmd_drv is pointless and we can just as well stick the full ioctl
definition into ioctl-&gt;cmd.

Cc: Jakob Bornecrantz &lt;jakob@vmware.com&gt;
Cc: Thomas Hellstrom &lt;thellstrom@vmware.com&gt;
Signed-off-by: Ville Syrjälä &lt;ville.syrjala@linux.intel.com&gt;
Signed-off-by: Daniel Vetter &lt;daniel.vetter@ffwll.ch&gt;
</pre>
</div>
</content>
</entry>
<entry>
<title>drm/vmwgfx: Fix an issue with the device losing its irq line on module unload</title>
<updated>2015-03-11T18:47:41+00:00</updated>
<author>
<name>Thomas Hellstrom</name>
<email>thellstrom@vmware.com</email>
</author>
<published>2015-03-10T18:07:40+00:00</published>
<link rel='alternate' type='text/html' href='https://git.toradex.cn/cgit/linux-toradex.git/commit/?id=fd3e4d6e26288d12b566912f692e278e8db15b82'/>
<id>fd3e4d6e26288d12b566912f692e278e8db15b82</id>
<content type='text'>
Starting with commit b4b55cda5874
("x86/PCI: Refine the way to release PCI IRQ resources")

the device lost its irq resource on module unload. While that's ok and
apparently intentional, the driver never got the resource back on module load

The code apparently wants drivers to disable the pci device at pci device
driver removal, so lets do that. That fixes the issue.

Signed-off-by: Thomas Hellstrom &lt;thellstrom@vmware.com&gt;
Reviewed-by: Brian Paul &lt;brianp@vmware.com&gt;
</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
Starting with commit b4b55cda5874
("x86/PCI: Refine the way to release PCI IRQ resources")

the device lost its irq resource on module unload. While that's ok and
apparently intentional, the driver never got the resource back on module load

The code apparently wants drivers to disable the pci device at pci device
driver removal, so lets do that. That fixes the issue.

Signed-off-by: Thomas Hellstrom &lt;thellstrom@vmware.com&gt;
Reviewed-by: Brian Paul &lt;brianp@vmware.com&gt;
</pre>
</div>
</content>
</entry>
<entry>
<title>drm/vmwgfx: Correctly NULLify dma buffer pointer on failure</title>
<updated>2015-03-11T18:47:41+00:00</updated>
<author>
<name>Colin Ian King</name>
<email>colin.king@canonical.com</email>
</author>
<published>2015-01-22T15:17:07+00:00</published>
<link rel='alternate' type='text/html' href='https://git.toradex.cn/cgit/linux-toradex.git/commit/?id=da5efffc42222d09079a3427b60374a68200d798'/>
<id>da5efffc42222d09079a3427b60374a68200d798</id>
<content type='text'>
cppcheck on lines 917 and 977 show an ineffective assignment
to the dma buffer pointer:

[drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c:917]:
[drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c:977]:
  (warning) Assignment of function parameter has no effect
  outside the function. Did you forget dereferencing it?

On a successful DMA buffer lookup, the dma buffer pointer is
assigned, however, on failure it currently is left in an
undefined state.

The original intention in the error exit path was to nullify
the pointer on an error (which the original code failed to
do properly). This patch fixes this also ensures all failure
paths nullify the buffer pointer on the error return.

Fortunately the callers to vmw_translate_mob_ptr and
vmw_translate_guest_ptr are checking on a return status and not
on the dma buffer pointer, so the original code worked.

Reviewed-by: Thomas Hellstrom &lt;thellstrom@vmware.com&gt;
Signed-off-by: Colin Ian King &lt;colin.king@canonical.com&gt;
</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
cppcheck on lines 917 and 977 show an ineffective assignment
to the dma buffer pointer:

[drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c:917]:
[drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c:977]:
  (warning) Assignment of function parameter has no effect
  outside the function. Did you forget dereferencing it?

On a successful DMA buffer lookup, the dma buffer pointer is
assigned, however, on failure it currently is left in an
undefined state.

The original intention in the error exit path was to nullify
the pointer on an error (which the original code failed to
do properly). This patch fixes this also ensures all failure
paths nullify the buffer pointer on the error return.

Fortunately the callers to vmw_translate_mob_ptr and
vmw_translate_guest_ptr are checking on a return status and not
on the dma buffer pointer, so the original code worked.

Reviewed-by: Thomas Hellstrom &lt;thellstrom@vmware.com&gt;
Signed-off-by: Colin Ian King &lt;colin.king@canonical.com&gt;
</pre>
</div>
</content>
</entry>
<entry>
<title>drm/vmwgfx: Reorder device takedown somewhat</title>
<updated>2015-03-11T18:47:40+00:00</updated>
<author>
<name>Thomas Hellstrom</name>
<email>thellstrom@vmware.com</email>
</author>
<published>2015-03-05T10:33:24+00:00</published>
<link rel='alternate' type='text/html' href='https://git.toradex.cn/cgit/linux-toradex.git/commit/?id=3458390b9f0ba784481d23134798faee27b5f16f'/>
<id>3458390b9f0ba784481d23134798faee27b5f16f</id>
<content type='text'>
To take down the MOB and GMR memory types, the driver may have to issue
fence objects and thus make sure that the fence manager is taken down
after those memory types.
Reorder device init accordingly.

Cc: &lt;stable@vger.kernel.org&gt;
Signed-off-by: Thomas Hellstrom &lt;thellstrom@vmware.com&gt;
Reviewed-by: Sinclair Yeh &lt;syeh@vmware.com&gt;
</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
To take down the MOB and GMR memory types, the driver may have to issue
fence objects and thus make sure that the fence manager is taken down
after those memory types.
Reorder device init accordingly.

Cc: &lt;stable@vger.kernel.org&gt;
Signed-off-by: Thomas Hellstrom &lt;thellstrom@vmware.com&gt;
Reviewed-by: Sinclair Yeh &lt;syeh@vmware.com&gt;
</pre>
</div>
</content>
</entry>
<entry>
<title>drm/vmwgfx: Fix a couple of lock dependency violations</title>
<updated>2015-03-11T18:47:40+00:00</updated>
<author>
<name>Thomas Hellstrom</name>
<email>thellstrom@vmware.com</email>
</author>
<published>2015-03-09T08:56:21+00:00</published>
<link rel='alternate' type='text/html' href='https://git.toradex.cn/cgit/linux-toradex.git/commit/?id=5151adb37a5918957f4c33a8d8e7629c0fb00563'/>
<id>5151adb37a5918957f4c33a8d8e7629c0fb00563</id>
<content type='text'>
Experimental lockdep annotation added to the TTM lock has unveiled a
couple of lock dependency violations in the vmwgfx driver. In both
cases it turns out that the device_private::reservation_sem is not
needed so the offending code is moved out of that lock.

Cc: &lt;stable@vger.kernel.org&gt;
Acked-by: Sinclair Yeh &lt;syeh@vmware.com&gt;
Signed-off-by: Thomas Hellstrom &lt;thellstrom@vmware.com&gt;
</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
Experimental lockdep annotation added to the TTM lock has unveiled a
couple of lock dependency violations in the vmwgfx driver. In both
cases it turns out that the device_private::reservation_sem is not
needed so the offending code is moved out of that lock.

Cc: &lt;stable@vger.kernel.org&gt;
Acked-by: Sinclair Yeh &lt;syeh@vmware.com&gt;
Signed-off-by: Thomas Hellstrom &lt;thellstrom@vmware.com&gt;
</pre>
</div>
</content>
</entry>
<entry>
<title>drm/vmwgfx: Replace the hw mutex with a hw spinlock</title>
<updated>2015-01-19T11:02:13+00:00</updated>
<author>
<name>Thomas Hellstrom</name>
<email>thellstrom@vmware.com</email>
</author>
<published>2015-01-14T10:33:39+00:00</published>
<link rel='alternate' type='text/html' href='https://git.toradex.cn/cgit/linux-toradex.git/commit/?id=496eb6fd2c3fd13f4b914e537598e5c86ce4f52a'/>
<id>496eb6fd2c3fd13f4b914e537598e5c86ce4f52a</id>
<content type='text'>
Fixes a case where we call vmw_fifo_idle() from within a wait function with
task state !TASK_RUNNING, which is illegal.

In addition, make the locking fine-grained, so that it is performed once
for every read- and write operation. This is of course more costly, but we
don't perform much register access in the timing critical paths anyway. Instead
we have the extra benefit of being sure that we don't forget the hw lock around
register accesses. I think currently the kms code was quite buggy w r t this.

This fixes Red Hat Bugzilla Bug 1180796

Cc: stable@vger.kernel.org
Signed-off-by: Thomas Hellstrom &lt;thellstrom@vmware.com&gt;
Reviewed-by: Jakob Bornecrantz &lt;jakob@vmware.com&gt;
</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
Fixes a case where we call vmw_fifo_idle() from within a wait function with
task state !TASK_RUNNING, which is illegal.

In addition, make the locking fine-grained, so that it is performed once
for every read- and write operation. This is of course more costly, but we
don't perform much register access in the timing critical paths anyway. Instead
we have the extra benefit of being sure that we don't forget the hw lock around
register accesses. I think currently the kms code was quite buggy w r t this.

This fixes Red Hat Bugzilla Bug 1180796

Cc: stable@vger.kernel.org
Signed-off-by: Thomas Hellstrom &lt;thellstrom@vmware.com&gt;
Reviewed-by: Jakob Bornecrantz &lt;jakob@vmware.com&gt;
</pre>
</div>
</content>
</entry>
</feed>
