So after a lot of digging around in git histories it looks like this
has only ever be used by dri1 render clients. Hence we can fully
disable the entire thing for modesetting drivers and so greatly reduce
the attack surface for potential exploits (or at least tools like
trinity ...).

Also add the drm_legacy prefix for functions which are called from
common code. To further reduce the impact on common code also extract
all the ctx release handling into a function (instead of only
releasing individual handles) and make ctxbitmap_cleanup return void -
it can never fail.
Reviewed-by: NEric Anholt <eric@anholt.net>
Signed-off-by: NDaniel Vetter <daniel.vetter@ffwll.ch>
Signed-off-by: NDave Airlie <airlied@redhat.com>

Only ever assigned in the context code for real, with no readers
anywhere. Remove it.
Signed-off-by: NDaniel Vetter <daniel.vetter@ffwll.ch>
Signed-off-by: NDave Airlie <airlied@gmail.com>

No one ever waits on this waitqueue, so the wake_up call is wasted.
Remove it all.
Signed-off-by: NDaniel Vetter <daniel.vetter@ffwll.ch>
Signed-off-by: NDave Airlie <airlied@gmail.com>

It doesn't do anything, so kill the code.
Signed-off-by: NDaniel Vetter <daniel.vetter@ffwll.ch>
Signed-off-by: NDave Airlie <airlied@gmail.com>

Convert to the much saner new idr interface.

* drm_ctxbitmap_next() error handling in drm_addctx() seems broken.
  drm_ctxbitmap_next() return -errno on failure not -1.

[artem.savkov@gmail.com: missing idr_preload_end in drm_gem_flink_ioctl]
[jslaby@suse.cz: fix drm_gem_flink_ioctl() return value]
Signed-off-by: NTejun Heo <tj@kernel.org>
Acked-by: NDavid Airlie <airlied@linux.ie>
Signed-off-by: NArtem Savkov <artem.savkov@gmail.com>
Signed-off-by: NJiri Slaby <jslaby@suse.cz>
Signed-off-by: NAndrew Morton <akpm@linux-foundation.org>
Signed-off-by: NLinus Torvalds <torvalds@linux-foundation.org>

idr_destroy() can destroy idr by itself and idr_remove_all() is being
deprecated.  Drop its usage.

* drm_ctxbitmap_cleanup() was calling idr_remove_all() but forgetting
  idr_destroy() thus leaking all buffered free idr_layers.  Replace it
  with idr_destroy().
Signed-off-by: NTejun Heo <tj@kernel.org>
Acked-by: NDavid Airlie <airlied@linux.ie>
Cc: Inki Dae <inki.dae@samsung.com>
Cc: Joonyoung Shim <jy0922.shim@samsung.com>
Cc: Seung-Woo Kim <sw0312.kim@samsung.com>
Cc: Kyungmin Park <kyungmin.park@samsung.com>
Signed-off-by: NAndrew Morton <akpm@linux-foundation.org>
Signed-off-by: NLinus Torvalds <torvalds@linux-foundation.org>

Convert #include "..." to #include <path/...> in drivers/gpu/.
Signed-off-by: NDavid Howells <dhowells@redhat.com>
Acked-by: NDave Airlie <airlied@redhat.com>
Acked-by: NArnd Bergmann <arnd@arndb.de>
Acked-by: NThomas Gleixner <tglx@linutronix.de>
Acked-by: NPaul E. McKenney <paulmck@linux.vnet.ibm.com>
Acked-by: NDave Jones <davej@redhat.com>

The error handling code w.r.t. idr usage looks inconsistent.

In the case of drm_mode_object_get() and drm_ctxbitmap_next() the error
handling is also incomplete.

Unify the code to follow the same pattern always.
Signed-off-by: NVille Syrjälä <ville.syrjala@linux.intel.com>
Signed-off-by: NDave Airlie <airlied@redhat.com>

drm_getclient, drm_getstats and drm_getmap (with a few minor
adjustments) do not need global mutex, so fix that and
make the said ioctls DRM_UNLOCKED. Details:

  drm_getclient: the only thing that should be protected here
  is dev->filelist and that is already protected everywhere with
  dev->struct_mutex.

  drm_getstats: there is no need for any mutex here because the
  loop runs through quasi-static (set at load time only)
  data, and the actual count access is done with atomic_read()

  drm_getmap already uses dev->struct_mutex to protect
  dev->maplist, which also used to protect the same structure
  everywhere else except at three places:
  * drm_getsarea, which doesn't grab *any* mutex before
    touching dev->maplist (so no drm_global_mutex doesn't help
    here either; different issue for a different patch).
    However, drivers seem to call it only at
    initialization time so it probably doesn't matter
  * drm_master_destroy, which is called from drm_master_put,
    which in turn is protected with dev->struct_mutex
    everywhere else in drm module, so we are good here too.
  * drm_getsareactx, which releases the dev->struct_mutex
    too early, but this patch includes the fix for that.

v2: * incorporate comments received from Daniel Vetter
    * include the (long) explanation above to make it clear what
      we are doing (and why), also at Daniel Vetter's request
    * tighten up mutex grab/release locations to only
      encompass real critical sections, rather than some
      random code around them
Signed-off-by: NIlija Hadzic <ihadzic@research.bell-labs.com>
Reviewed-by: NDaniel Vetter <daniel.vetter@ffwll.ch>
Signed-off-by: NDave Airlie <airlied@redhat.com>

It's not used by any driver. The destructor callback is unfortunately
used by the via driver in a rather convoluted piece of code used
to reimplement something resembling broken futexes. I didn't dare
to touch this code. But at least kill the needless NULL assignemt
in the sis driver.
Signed-off-by: NDaniel Vetter <daniel.vetter@ffwll.ch>
Signed-off-by: NDave Airlie <airlied@redhat.com>

It hasn't been used in ages, and having the user tell your how much
memory is being freed at free time is a recipe for disaster even if it
was ever used.
Signed-off-by: NEric Anholt <eric@anholt.net>

Once upon a time, the DRM made the distinction between the drm_map
data structure exchanged with user space and the drm_local_map used
in the kernel.

For some reasons, while the BSD port still has that "feature", the
linux part abused drm_map for kernel internal usage as the local
map only existed as a typedef of the struct drm_map.

This patch fixes it by declaring struct drm_local_map separately
(though its content is currently identical to the userspace variant),
and changing the kernel code to only use that, except when it's a
user<->kernel interface (ie. ioctl).

This allows subsequent changes to the in-kernel format

I've also replaced the use of drm_local_map_t with struct drm_local_map
in a couple of places. Mostly by accident but they are the same (the
former is a typedef of the later) and I have some remote plans and
half finished patch to completely kill the drm_local_map_t typedef
so I left those bits in.
Signed-off-by: NBenjamin Herrenschmidt <benh@kernel.crashing.org>
Acked-by: NEric Anholt <eric@anholt.net>
Signed-off-by: NDave Airlie <airlied@linux.ie>

This is step one towards having multiple masters sharing a drm
device in order to get fast-user-switching to work.

It splits out the information associated with the drm master
into a separate kref counted structure, and allocates this when
a master opens the device node. It also allows the current master
to abdicate (say while VT switched), and a new master to take over
the hardware.

It moves the Intel and radeon drivers to using the sarea from
within the new master structures.
Signed-off-by: NDave Airlie <airlied@redhat.com>

With the coming of kernel based modesetting and the memory manager stuff,
the everything in one directory approach was getting very ugly and
starting to be unmanageable.

This restructures the drm along the lines of other kernel components.

It creates a drivers/gpu/drm directory and moves the hw drivers into
subdirectores. It moves the includes into an include/drm, and
sets up the unifdef for the userspace headers we should be exporting.
Signed-off-by: NDave Airlie <airlied@redhat.com>

Signed-off-by: NDave Airlie <airlied@linux.ie>

The data is now in kernel space, copied in/out as appropriate according to t
This results in DRM_COPY_{TO,FROM}_USER going away, and error paths to deal
with those failures.  This also means that XFree86 4.2.0 support for i810 DR
is lost.
Signed-off-by: NDave Airlie <airlied@linux.ie>

As a fallout, replace filp storage with file_priv storage for "unique
identifier of a client" all over the DRM.  There is a 1:1 mapping, so this
should be a noop.  This could be a minor performance improvement, as everyth
on Linux dereferenced filp to get file_priv anyway, while only the mmap ioct
went the other direction.
Signed-off-by: NDave Airlie <airlied@linux.ie>

This converts the drm context allocator to an idr, using the new idr
interface features from Kristian.

Fixes from Kristian Hoegsberg <krh@redhat.com>
Signed-off-by: NDave Airlie <airlied@linux.ie>

Signed-off-by: NDave Airlie <airlied@linux.ie>

some drivers still todo.
Signed-off-by: NDave Airlie <airlied@linux.ie>

This moves a bunch of typedefs into a !defined __KERNEL__ to keep userspace
API compatiblity, it changes all internal usages to structs/enum/unions.
Signed-off-by: NDave Airlie <airlied@linux.ie>

This makes the drms use of the list handling macros a lot cleaner
and more along the lines of how they should be used and uses them
in some more places.
Signed-off-by: NDave Airlie <airlied@linux.ie>

From: Arjan van de Ven <arjan@infradead.org>

Semaphore to mutex conversion.

The conversion was generated via scripts, and the result was validated
automatically via a script as well.
Signed-off-by: NArjan van de Ven <arjan@infradead.org>
Signed-off-by: NIngo Molnar <mingo@elte.hu>
Signed-off-by: NAndrew Morton <akpm@osdl.org>
Signed-off-by: NDave Airlie <airlied@linux.ie>

Bad patch in last version
Signed-off-by: NDave Airlie <airlied@linux.ie>

Signed-off-by: NDave Airlie <airlied@linux.ie>

This fixes a NULL pointer reference in DRM.  The SiS driver tries to
allocate a big chunk of memory, but the return value is never checked.

Reported in Novell bugzilla #132271:
  https://bugzilla.novell.com/show_bug.cgi?id=132271Signed-off-by: NTakashi Iwai <tiwai@suse.de>
Signed-off-by: NLinus Torvalds <torvalds@osdl.org>

Finally cleaned up the sparse warnings for the drm.
Signed-off-by: NDave Airlie <airlied@linux.ie>

I've been threatening this for a while, so no point hanging around.
This lindents the DRM code which was always really bad in tabbing department.
I've also fixed some misnamed files in comments and removed some trailing
whitespace.
Signed-off-by: NDave Airlie <airlied@linux.ie>

This patch contains the following small cleanups:
- make two needlessly global functions static
- drm_sysfs.c: every file should #include the header with the prototypes
              of the global functions it is offering
Signed-off-by: NAdrian Bunk <bunk@stusta.de>
Signed-off-by: NDave Airlie <airlied@linux.ie>

I basically combined Paul's patches with additions that I had made
for PCI scatter gather.
I also tried more carefully to avoid problems with the same token
assigned multiple times while trying to use the base address in the
token if possible to gain as much backward compatibility as possible
for broken DRI clients.

From: Paul Mackerras <paulus@samba.org> and Egbert Eich <eich@suse.de>
Signed-off-by: NDave Airlie <airlied@linux.ie>

This fixes the information copied back to userspace by the get reserved
contexts ioctl.

From: Egbert Eich <eich@suse.de>
Signed-off-by: NDave Airlie <airlied@linux.ie>

This patch contains the following cleanups:
- make needlessly global functions static
- remove the following unused global functions:
 - drm_fops.c: drm_read
 - i915_dma.c: i915_do_cleanup_pageflip
Signed-off-by: NAdrian Bunk <bunk@stusta.de>
Signed-off-by: NDave Airlie <airlied@linux.ie>

The patch is against a 2.6.11 kernel tree.  I am running this with a
32-bit X server (compiled up from X.org CVS as of a couple of weeks
ago) and 32-bit DRI libraries and clients.  All the userland stuff is
identical to what I am using under a 32-bit kernel on my G4 powerbook
(which is a 32-bit machine of course).  I haven't tried compiling up a
64-bit X server or clients yet.

In the compatibility routines I have assumed that the kernel can
safely access user addresses after set_fs(KERNEL_DS).  That is, where
an ioctl argument structure contains pointers to other structures, and
those other structures are already compatible between the 32-bit and
64-bit ABIs (i.e. they only contain things like chars, shorts or
ints), I just check the address with access_ok() and then pass it
through to the 64-bit ioctl code.  I believe this approach may not
work on sparc64, but it does work on ppc64 and x86_64 at least.

One tricky area which may need to be revisited is the question of how
to handle the handles which we pass back to userspace to identify
mappings.  These handles are generated in the ADDMAP ioctl and then
passed in as the offset value to mmap.  However, offset values for
mmap seem to be generated in other ways as well, particularly for AGP
mappings.

The approach I have ended up with is to generate a fake 32-bit handle
only for _DRM_SHM mappings.  The handles for other mappings (AGP, REG,
FB) are physical addresses which are already limited to 32 bits, and
generating fake handles for them created all sorts of problems in the
mmap/nopage code.

This patch has been updated to use the new compatibility ioctls.

From: Paul Mackerras <paulus@samba.org>
Signed-off-by: NDave Airlie <airlied@linux.ie>

Initial git repository build. I'm not bothering with the full history,
even though we have it. We can create a separate "historical" git
archive of that later if we want to, and in the meantime it's about
3.2GB when imported into git - space that would just make the early
git days unnecessarily complicated, when we don't have a lot of good
infrastructure for it.

Let it rip!