summaryrefslogtreecommitdiff
AgeCommit message (Collapse)Author
2010-08-02drm/i810: fixed coding style issuesNicolas Kaiser
Fixed brace, macro and spacing coding style issues, and a C99 comment. Signed-off-by: Nicolas Kaiser <nikai@nikai.net> Signed-off-by: Dave Airlie <airlied@redhat.com>
2010-08-02drm: Free devname along with master->uniqueChris Wilson
The device name is tightly coupled and created at the same time as the master->unique address, so we need to free it with the master. Currently we overwrite it each time we create a new master: unreferenced object 0xe32c54b0 (size 32): comm "Xorg", pid 1455, jiffies 4294721798 (age 3196.879s) hex dump (first 32 bytes): 69 39 31 35 40 70 63 69 3a 30 30 30 30 3a 30 30 i915@pci:0000:00 3a 30 32 2e 30 00 6b 6b 6b 6b 6b 6b 6b 6b 6b a5 :02.0.kkkkkkkkk. backtrace: [<c04e5657>] create_object+0x124/0x1f1 [<c07cf0f0>] kmemleak_alloc+0x4c/0x90 [<c04db84c>] __kmalloc+0x155/0x175 [<f8316665>] drm_setversion+0x11d/0x1b1 [drm] [<f83148d4>] drm_ioctl+0x29a/0x356 [drm] [<c04f27c4>] vfs_ioctl+0x33/0x91 [<c04f31cf>] do_vfs_ioctl+0x46b/0x496 [<c04f3240>] sys_ioctl+0x46/0x66 [<c040325f>] sysenter_do_call+0x12/0x38 [<ffffffff>] 0xffffffff Signed-off-by: Chris Wilson <chris@chris-wilson.co.uk> Signed-off-by: Dave Airlie <airlied@redhat.com>
2010-08-02drm: Free the idr layers before calling idr_destroy()Chris Wilson
/* A typical clean-up sequence for objects stored in an idr tree, will * use idr_for_each() to free all objects, if necessary, then * idr_remove_all() to remove all ids, and idr_destroy() to free * up the cached idr_layers. */ We were missing the vital idr_rmove_all() step and so were leaking the used layers for every dri client: unreferenced object 0xf32133c0 (size 148): comm "plymouthd", pid 131, jiffies 4294678490 (age 2308.030s) hex dump (first 32 bytes): 04 00 00 00 00 00 00 00 00 00 00 00 00 40 19 f3 .............@.. 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ backtrace: [<c04e5657>] create_object+0x124/0x1f1 [<c07cf100>] kmemleak_alloc+0x4c/0x90 [<c04db6a9>] kmem_cache_alloc+0xee/0x13c [<c05c3d25>] idr_pre_get+0x24/0x61 [<f8315c9c>] drm_gem_handle_create+0x27/0x7f [drm] [<f89925b2>] i915_gem_create_ioctl+0x4f/0x71 [i915] [<f83148ac>] drm_ioctl+0x272/0x356 [drm] [<c04f27c4>] vfs_ioctl+0x33/0x91 [<c04f31cf>] do_vfs_ioctl+0x46b/0x496 [<c04f3240>] sys_ioctl+0x46/0x66 [<c040325f>] sysenter_do_call+0x12/0x38 [<ffffffff>] 0xffffffff Fixes https://bugzilla.kernel.org/show_bug.cgi?id=15803 Signed-off-by: Chris Wilson <chris@chris-wilson.co.uk> Signed-off-by: Dave Airlie <airlied@redhat.com>
2010-08-02drm/nouveau: set TASK_(UN)INTERRUPTIBLE before schedule_timeout()Kulikov Vasiliy
set_current_state() is called only once before the first iteration. After return from schedule_timeout() current state is TASK_RUNNING. If we are going to wait again, set_current_state() must be called. Signed-off-by: Kulikov Vasiliy <segooon@gmail.com> Signed-off-by: Francisco Jerez <currojerez@riseup.net> Signed-off-by: Ben Skeggs <bskeggs@redhat.com>
2010-08-02drm/vmgfx: operation on ‘par->dirty.y1’ may be undefinedChris Wilson
Trivial fix to set y1 = y2 = 0. Signed-off-by: Chris Wilson <chris@chris-wilson.co.uk> Cc: Jakob Bornecrantz <jakob@vmware.com> Signed-off-by: Dave Airlie <airlied@redhat.com>
2010-08-02drm/radeon: remove viewport transform from r6xx/r7xx blit emitAlex Deucher
We aren't using it, so no need. Save additional dwords. Signed-off-by: Alex Deucher <alexdeucher@gmail.com> Signed-off-by: Dave Airlie <airlied@redhat.com>
2010-08-02drm/radeon: group r6xx/r7xx newly sequential blit stateAlex Deucher
group state that is emitted sequentially into fewer packets. This saves a number of dwords. Signed-off-by: Alex Deucher <alexdeucher@gmail.com> Signed-off-by: Dave Airlie <airlied@redhat.com>
2010-08-02drm/radeon: reorder r6xx/r7xx blit state emit to make more regs sequentialAlex Deucher
Signed-off-by: Alex Deucher <alexdeucher@gmail.com> Signed-off-by: Dave Airlie <airlied@redhat.com>
2010-08-02drm/radeon: r6xx/r7xx move vport clipping to a single packetAlex Deucher
Saves lots of dwords in blit emit Signed-off-by: Alex Deucher <alexdeucher@gmail.com> Signed-off-by: Dave Airlie <airlied@redhat.com>
2010-08-02drm/radeon: group r6xx/r7xx sequential blit stateAlex Deucher
group state that is emitted sequentially into fewer packets. This saves a number of dwords. Signed-off-by: Alex Deucher <alexdeucher@gmail.com> Signed-off-by: Dave Airlie <airlied@redhat.com>
2010-08-02drm/radeon: remove duplicate state emit in r6xx/r7xx blitAlex Deucher
Signed-off-by: Alex Deucher <alexdeucher@gmail.com> Signed-off-by: Dave Airlie <airlied@redhat.com>
2010-08-02drm/radeon: add comments to r6xx/r7xx blit stateAlex Deucher
Signed-off-by: Alex Deucher <alexdeucher@gmail.com> Signed-off-by: Dave Airlie <airlied@redhat.com>
2010-08-02drm/radeon/kms/r7xx: add workaround for hw issue with HDP flushAlex Deucher
Use of HDP_*_COHERENCY_FLUSH_CNTL can cause a hang in certain situations. Add workaround. Signed-off-by: Alex Deucher <alexdeucher@gmail.com> Cc: stable@kernel.org Signed-off-by: Dave Airlie <airlied@redhat.com>
2010-08-02drm/radeon/kms: remove rs4xx gart limitAlex Deucher
We used to limit the rs4xx gart aperture to 32 MB, but I suspect that was due to not meeting the alignment requirements of the aperture. This patch should only be applied after: "drm/radeon/kms: fix gtt MC base alignment on rs4xx/rs690/rs740 asics" has been applied. This patch should probably soak for a bit in d-r-t. Signed-off-by: Alex Deucher <alexdeucher@gmail.com> Signed-off-by: Dave Airlie <airlied@redhat.com>
2010-08-02Merge tag 'v2.6.35-rc6' into drm-radeon-nextDave Airlie
Need this to avoid conflicts with future radeon fixes
2010-08-02drm: radeon: fix sign bugDan Carpenter
The "error" variable is unsigned so it's never less than zero. I changed it to check if (freq < current_freq) directly. "best_error" is also unsigned so "best_error - 100" could be a large number instead of a negative. Since "error" is unsigned it is never less than a negative and so the cases where "best_error" is less than or equal to 100 are false. Signed-off-by: Dan Carpenter <error27@gmail.com> Reviewed-by: Alex Deucher <alexdeucher@gmail.com> Signed-off-by: Dave Airlie <airlied@redhat.com>
2010-08-02drm/radeon/kms: check/restore sanity before doing anything else with GPU.Dave Airlie
On systems using kexec, the new kernel is booted straight from the old kernel, without any warning to the graphics driver. So the GPU is basically left as-is in a running state, however the CPU side is completly reset. Without stating the saneness of anyone using kexec on live systems, we should at least try not to crash the GPU. This patch resets 3 registers to 0 that could cause bad things to happen to the running system. This allows kexec to work on a Power6/RN50 system. Signed-off-by: Dave Airlie <airlied@redhat.com>
2010-08-02drm/radeon: fall back to GTT if bo creation/validation in VRAM fails.Michel Dänzer
This fixes a problem where on low VRAM cards we'd run out of space for validation. [airlied: Tested on my M7, Thinkpad T42, compiz works with no problems.] Signed-off-by: Michel Dänzer <daenzer@vmware.com> Cc: stable@kernel.org Signed-off-by: Dave Airlie <airlied@redhat.com>
2010-08-02drm/radeon/kms: add ioport register accessAlex Deucher
This is required for the NB_MISC regs on rs780/rs880 which means HDMI/DVI/DP ports using PCIEPHY won't work without it. It might also help with s/r (asic init) issues on other atombios cards. Fixes: https://bugs.freedesktop.org/show_bug.cgi?id=28774 and similar issues reported by Alberto Milone. [airlied: Squash io fix patch] Signed-off-by: Alex Deucher <alexdeucher@gmail.com> Tested-by: Rafał Miłecki <zajec5@gmail.com> Signed-off-by: Dave Airlie <airlied@redhat.com>
2010-08-02drm/radeon/kms: enable HDMI audio on RS600/RS690/RS740Rafał Miłecki
We will need method of selecting encoder that should receive HDMI block. For now we assign HDMI block to first enabled encoder. Hopefully there are not many RS6x0 chips with two digital encoders. [airlied: add RS740 checks as per Alex suggestion.] Signed-off-by: Rafał Miłecki <zajec5@gmail.com> Signed-off-by: Dave Airlie <airlied@redhat.com>
2010-08-02drm/radeon/kms: track audio engine state, do not use not setup timerRafał Miłecki
This is needed to enable audio support on devices using polling. In case user decides to disable audio (module parameter) we still will try to use timer in r600_audio_enable_polling. This would lead to BUG in kernel/timer.c. Signed-off-by: Rafał Miłecki <zajec5@gmail.com> Signed-off-by: Dave Airlie <airlied@redhat.com>
2010-08-02drm/radeon/kms/r6xx+: add query for tile config (v2)Alex Deucher
Userspace needs this information to access tiled buffers via the CPU. v2: rebased on evergreen accel changes Signed-off-by: Alex Deucher <alexdeucher@gmail.com> Signed-off-by: Dave Airlie <airlied@redhat.com>
2010-08-02drm/radeon/kms: fix CS alignment checking for tiling (v2)Alex Deucher
Covers depth, cb, and textures. Hopefully I got this right. v2: - fix bugs: https://bugs.freedesktop.org/show_bug.cgi?id=28327 https://bugs.freedesktop.org/show_bug.cgi?id=28381 - use ALIGNED(), IS_ALIGNED() macros Signed-off-by: Alex Deucher <alexdeucher@gmail.com> Signed-off-by: Dave Airlie <airlied@redhat.com>
2010-08-02drm/radeon/kms: add tiling support to the cs checker for r6xx/r7xxAlex Deucher
Check for relocs for DB_DEPTH_INFO, CB_COLOR*_INFO, and texture resources. Signed-off-by: Alex Deucher <alexdeucher@gmail.com> Signed-off-by: Dave Airlie <airlied@redhat.com>
2010-08-02drm/radeon/kms: Add crtc tiling setup support for evergreenAlex Deucher
Needed for scanning out of a tiled buffer. Signed-off-by: Alex Deucher <alexdeucher@gmail.com> Signed-off-by: Dave Airlie <airlied@redhat.com>
2010-08-02drm/radeon/kms: Add crtc tiling setup support for r6xx/r7xxAlex Deucher
Needed for scanning out of a tiled buffer. Signed-off-by: Alex Deucher <alexdeucher@gmail.com> Signed-off-by: Dave Airlie <airlied@redhat.com>
2010-08-02drm/radeon/kms: add support for internal thermal sensors (v3)Alex Deucher
rv6xx/rv7xx/evergreen families supported; older asics did not have an internal thermal sensor. Note, not all oems use the internal thermal sensor, so it's only exposed in cases where it is used. Note also, that most laptops use an oem specific ACPI solution for GPU thermal information rather than using the internal thermal sensor directly. v2: export millidegrees celsius, use hwmon device properly. v3: fix Kconfig Signed-off-by: Alex Deucher <alexdeucher@gmail.com> Signed-off-by: Dave Airlie <airlied@redhat.com>
2010-08-02drm/radeon: Add support for the ATIF ACPI method to the radeon driverAlberto Milone
By calling the ATIF method in the radeon driver we can make sure that hotkeys such as the video switch key emit ACPI events when pressed. agd5f: fix warning Signed-off-by: Alberto Milone <alberto.milone@canonical.com> Signed-off-by: Alex Deucher <alexdeucher@gmail.com> Signed-off-by: Dave Airlie <airlied@redhat.com>
2010-08-02drm/radeon/kms/atom: bump atom loop timeout from 1 sec to 5 secsAlex Deucher
Some tables have delays that can cause the timeout to hit even when not intended. Should fix: https://bugs.freedesktop.org/show_bug.cgi?id=27744 and related bugs. Signed-off-by: Alex Deucher <alexdeucher@gmail.com> Signed-off-by: Dave Airlie <airlied@redhat.com>
2010-08-02drm/radeon/kms: minor driver cleanupsAlex Deucher
- Make the logic in r100_pll_errata_after_index() match the other errata functions - Use rdev->family rather than rdev->flags & RADEON_FAMILY_MASK for kms - replace rn50 check using ids with ASIC_IS_RN50 convenience macro Signed-off-by: Alex Deucher <alexdeucher@gmail.com> Signed-off-by: Dave Airlie <airlied@redhat.com>
2010-08-01powerpc/5200/i2c: improve i2c bus error recoveryAlbrecht Dreß
This patch improves the recovery of the MPC's I2C bus from errors like bus hangs resulting in timeouts: 1. make the bus timeout configurable, as it depends on the bus clock and the attached slave chip(s); default is still 1 second; 2. detect any of the cases indicated by the CF, BB and RXAK MSR flags if a timeout occurs, and add a missing (required) MAL reset; 3. use a more reliable method to fixup the bus if a hang has been detected. The sequence is sent 9 times which seems to be necessary if a slave "misses" more than one clock cycle. For 400 kHz bus speed, the fixup is also ~70us (81us vs. 150us) faster. Tested on a custom Lite5200b derived board, with a Dallas RTC, AD sensors and NXP IO expander chips attached to the i2c. Changes vs. v1: - use improved bus fixup sequence for all chips (not only the 5200) - calculate real clock from defaults if no clock is given in the device tree - better description (I hope) of the changes. I didn't split the changes in this file into three parts as recommended by Grant, as they actually belong together (i.e. they address one single problem, just in three places of one single source file). Signed-off-by: Albrecht Dreß <albrecht.dress@arcor.de> [grant.likely@secretlab.ca: fixup for ->node to ->dev.of_node transition] Signed-off-by: Grant Likely <grant.likely@secretlab.ca>
2010-08-01of/xilinxfb: update tft compatible versionsAdrian Alonso
* Add tft display module compatibility for new hardware modules Signed-off-by: Adrian Alonso <aalonso00@gmail.com> Signed-off-by: Grant Likely <grant.likely@secretlab.ca>
2010-08-01powerpc/fsl-diu-fb: Support setting display mode using EDIDAnatolij Gustschin
Adds support for encoding display mode information in the device tree using verbatim EDID block. If the EDID entry in the DIU node is present, the driver will build mode database using EDID data and allow setting the display modes from this database. Otherwise display mode will be set using mode entries from driver's internal database as usual. This patch also updates device tree bindings. Signed-off-by: Anatolij Gustschin <agust@denx.de> Acked-by: Timur Tabi <timur@freescale.com> Signed-off-by: Grant Likely <grant.likely@secretlab.ca>
2010-08-01powerpc/5121: doc/dts-bindings: update doc of FSL DIU bindingsAnatolij Gustschin
Update compatible and interrupt properties description. Furthermore an example for the MPC5121 has been added. Signed-off-by: Anatolij Gustschin <agust@denx.de> Acked-by: Timur Tabi <timur@freescale.com> Signed-off-by: Grant Likely <grant.likely@secretlab.ca>
2010-08-01powerpc/5121: shared DIU framebuffer supportAnatolij Gustschin
MPC5121 DIU configuration/setup as initialized by the boot loader currently will get lost while booting Linux. As a result displaying the boot splash is not possible through the boot process. To prevent this we reserve configured DIU frame buffer address range while booting and preserve AOI descriptor and gamma table so that DIU continues displaying through the whole boot process. On first open from user space DIU frame buffer driver releases the reserved frame buffer area and continues to operate as usual. Signed-off-by: John Rigby <jcrigby@gmail.com> Signed-off-by: Anatolij Gustschin <agust@denx.de> Acked-by: Timur Tabi <timur@freescale.com> Signed-off-by: Grant Likely <grant.likely@secretlab.ca>
2010-08-01powerpc/5121: move fsl-diu-fb.h to include/linuxAnatolij Gustschin
Some DIU structures will be used in platform code in subsequent MPC5121 DIU patch, so we move this header to be able to include it elsewhere. Signed-off-by: Anatolij Gustschin <agust@denx.de> Acked-by: Timur Tabi <timur@freescale.com> Signed-off-by: Grant Likely <grant.likely@secretlab.ca>
2010-08-01powerpc/5121: fsl-diu-fb: fix issue with re-enabling DIU area descriptorAnatolij Gustschin
On MPC5121e Rev 2.0 re-configuring the DIU area descriptor by writing new descriptor address doesn't always work. As a result, DIU continues to display using old area descriptor even if the new one has been written to the descriptor register of the plane. Add the code from Freescale MPC5121EADS BSP for writing descriptor addresses properly. This fixes the problem for Rev 2.0 silicon. Signed-off-by: Anatolij Gustschin <agust@denx.de> Signed-off-by: Grant Likely <grant.likely@secretlab.ca>
2010-08-01powerpc/512x: add clock structure for Video-IN (VIU) unitAnatolij Gustschin
Allows using clk_get()/clk_enable()/clk_disable() for VIU clock in the v4l2 video driver. Signed-off-by: Hongjun Chen <hong-jun.chen@freescale.com> Signed-off-by: Anatolij Gustschin <agust@denx.de> Signed-off-by: Grant Likely <grant.likely@secretlab.ca>
2010-08-01powerpc/5121: add initial support for PDM360NG boardAnatolij Gustschin
Adds IFM PDM360NG device tree and platform code. Currently following is supported: - Spansion S29GL512P 256 MB NOR flash - ST Micro NAND 1 GiB flash - DIU, please use "fbcon=map:5 video=fslfb:800x480-32@60" at the kernel command line to enable PrimeView PM070WL3 Display support. - FEC - I2C - RTC, EEPROM - MSCAN - PSC UART, please pass "console=tty0 console=ttyPSC5,115200" on the kernel command line. - SPI, ADS7845 Touchscreen - USB0/1 Host - USB0 OTG Host/Device - VIU, Overlay/Capture support Signed-off-by: Markus Fischer <markus.fischer.ec@ifm.com> Signed-off-by: Wolfgang Grandegger <wg@denx.de> Signed-off-by: Michael Weiss <michael.weiss@ifm.com> Signed-off-by: Detlev Zundel <dzu@denx.de> Signed-off-by: Anatolij Gustschin <agust@denx.de> Signed-off-by: Grant Likely <grant.likely@secretlab.ca>
2010-08-01powerpc/512x: Group mpc512x board's selection menuAnatolij Gustschin
Allow board selection in a drop-down board sub-menu like many other platforms do. Before the patch: ... [ ] Freescale MPC5121E ADS [ ] Generic support for simple MPC5121 based boards [ ] 52xx-based boards ... Patched: ... [*] 512x-based boards [ ] Freescale MPC5121E ADS [ ] Generic support for simple MPC5121 based boards [ ] 52xx-based boards ... This is a cleanup before adding new board selection entry. Signed-off-by: Anatolij Gustschin <agust@denx.de> Signed-off-by: Grant Likely <grant.likely@secretlab.ca>
2010-08-01Linux 2.6.35v2.6.35Linus Torvalds
2010-08-01NFS: Fix a typo in include/linux/nfs_fs.hTrond Myklebust
nfs_commit_inode() needs to be defined irrespectively of whether or not we are supporting NFSv3 and NFSv4. Allow the compiler to optimise away code in the NFSv2-only case by converting it into an inlined stub function. Reported-and-tested-by: Ingo Molnar <mingo@elte.hu> Signed-off-by: Trond Myklebust <Trond.Myklebust@netapp.com> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
2010-08-01KVM: Remove unnecessary divide operationsJoerg Roedel
This patch converts unnecessary divide and modulo operations in the KVM large page related code into logical operations. This allows to convert gfn_t to u64 while not breaking 32 bit builds. Signed-off-by: Joerg Roedel <joerg.roedel@amd.com> Signed-off-by: Marcelo Tosatti <mtosatti@redhat.com>
2010-08-01KVM: Fix IOMMU memslot reference warningSheng Yang
This patch fixes the following warning. =================================================== [ INFO: suspicious rcu_dereference_check() usage. ] --------------------------------------------------- include/linux/kvm_host.h:259 invoked rcu_dereference_check() without protection! other info that might help us debug this: rcu_scheduler_active = 1, debug_locks = 0 no locks held by qemu-system-x86/29679. stack backtrace: Pid: 29679, comm: qemu-system-x86 Not tainted 2.6.35-rc3+ #200 Call Trace: [<ffffffff810a224e>] lockdep_rcu_dereference+0xa8/0xb1 [<ffffffffa018a06f>] kvm_iommu_unmap_memslots+0xc9/0xde [kvm] [<ffffffffa018a0c4>] kvm_iommu_unmap_guest+0x40/0x4e [kvm] [<ffffffffa018f772>] kvm_arch_destroy_vm+0x1a/0x186 [kvm] [<ffffffffa01800d0>] kvm_put_kvm+0x110/0x167 [kvm] [<ffffffffa0180ecc>] kvm_vcpu_release+0x18/0x1c [kvm] [<ffffffff81156f5d>] fput+0x22a/0x3a0 [<ffffffff81152288>] filp_close+0xb4/0xcd [<ffffffff8106599f>] put_files_struct+0x1b7/0x36b [<ffffffff81065830>] ? put_files_struct+0x48/0x36b [<ffffffff8131ee59>] ? do_raw_spin_unlock+0x118/0x160 [<ffffffff81065bc0>] exit_files+0x6d/0x75 [<ffffffff81068348>] do_exit+0x47d/0xc60 [<ffffffff8177e7b5>] ? _raw_spin_unlock_irq+0x30/0x36 [<ffffffff81068bfa>] do_group_exit+0xcf/0x134 [<ffffffff81080790>] get_signal_to_deliver+0x732/0x81d [<ffffffff81095996>] ? cpu_clock+0x4e/0x60 [<ffffffff81002082>] do_notify_resume+0x117/0xc43 [<ffffffff810a2fa3>] ? trace_hardirqs_on+0xd/0xf [<ffffffff81080d79>] ? sys_rt_sigtimedwait+0x2b5/0x3bf [<ffffffff8177d9f2>] ? trace_hardirqs_off_thunk+0x3a/0x3c [<ffffffff81003221>] ? sysret_signal+0x5/0x3d [<ffffffff8100343b>] int_signal+0x12/0x17 Signed-off-by: Sheng Yang <sheng@linux.intel.com> Signed-off-by: Marcelo Tosatti <mtosatti@redhat.com>
2010-08-01KVM: PPC: Make use of hash based Shadow MMUAlexander Graf
We just introduced generic functions to handle shadow pages on PPC. This patch makes the respective backends make use of them, getting rid of a lot of duplicate code along the way. Signed-off-by: Alexander Graf <agraf@suse.de> Signed-off-by: Marcelo Tosatti <mtosatti@redhat.com>
2010-08-01KVM: PPC: Add generic hpte management functionsAlexander Graf
Currently the shadow paging code keeps an array of entries it knows about. Whenever the guest invalidates an entry, we loop through that entry, trying to invalidate matching parts. While this is a really simple implementation, it is probably the most ineffective one possible. So instead, let's keep an array of lists around that are indexed by a hash. This way each PTE can be added by 4 list_add, removed by 4 list_del invocations and the search only needs to loop through entries that share the same hash. This patch implements said lookup and exports generic functions that both the 32-bit and 64-bit backend can use. Signed-off-by: Alexander Graf <agraf@suse.de> Signed-off-by: Marcelo Tosatti <mtosatti@redhat.com>
2010-08-01KVM: MMU: cleanup FNAME(fetch)() functionsXiao Guangrong
Cleanup this function that we are already get the direct sp's access Signed-off-by: Xiao Guangrong <xiaoguangrong@cn.fujitsu.com> Signed-off-by: Marcelo Tosatti <mtosatti@redhat.com>
2010-08-01KVM: MMU: fix direct sp's access corruptedXiao Guangrong
If the mapping is writable but the dirty flag is not set, we will find the read-only direct sp and setup the mapping, then if the write #PF occur, we will mark this mapping writable in the read-only direct sp, now, other real read-only mapping will happily write it without #PF. It may hurt guest's COW Fixed by re-install the mapping when write #PF occur. Signed-off-by: Xiao Guangrong <xiaoguangrong@cn.fujitsu.com> Signed-off-by: Marcelo Tosatti <mtosatti@redhat.com>
2010-08-01KVM: MMU: fix conflict access permissions in direct spXiao Guangrong
In no-direct mapping, we mark sp is 'direct' when we mapping the guest's larger page, but its access is encoded form upper page-struct entire not include the last mapping, it will cause access conflict. For example, have this mapping: [W] / PDE1 -> |---| P[W] | | LPA \ PDE2 -> |---| [R] P have two children, PDE1 and PDE2, both PDE1 and PDE2 mapping the same lage page(LPA). The P's access is WR, PDE1's access is WR, PDE2's access is RO(just consider read-write permissions here) When guest access PDE1, we will create a direct sp for LPA, the sp's access is from P, is W, then we will mark the ptes is W in this sp. Then, guest access PDE2, we will find LPA's shadow page, is the same as PDE's, and mark the ptes is RO. So, if guest access PDE1, the incorrect #PF is occured. Fixed by encode the last mapping access into direct shadow page Signed-off-by: Xiao Guangrong <xiaoguangrong@cn.fujitsu.com> Signed-off-by: Marcelo Tosatti <mtosatti@redhat.com>
2010-08-01KVM: MMU: fix writable sync sp mappingXiao Guangrong
While we sync many unsync sp at one time(in mmu_sync_children()), we may mapping the spte writable, it's dangerous, if one unsync sp's mapping gfn is another unsync page's gfn. For example: SP1.pte[0] = P SP2.gfn's pfn = P [SP1.pte[0] = SP2.gfn's pfn] First, we write protected SP1 and SP2, but SP1 and SP2 are still the unsync sp. Then, sync SP1 first, it will detect SP1.pte[0].gfn only has one unsync-sp, that is SP2, so it will mapping it writable, but we plan to sync SP2 soon, at this point, the SP2->unsync is not reliable since later we sync SP2 but SP2->gfn is already writable. So the final result is: SP2 is the sync page but SP2.gfn is writable. This bug will corrupt guest's page table, fixed by mark read-only mapping if the mapped gfn has shadow pages. Signed-off-by: Xiao Guangrong <xiaoguangrong@cn.fujitsu.com> Signed-off-by: Marcelo Tosatti <mtosatti@redhat.com>
generated by cgit (git 2.34.1) at 2025-09-15 11:38:54 +0000