| Age | Commit message (Collapse) | Author |
|---|
|
(v2)
With the current screwed but its ABI, ioctls for the drm, Linus pointed out that we could allow userspace to specify the allocation size, but we pass it to the driver which then uses it blindly to store a struct. Now if userspace specifies the allocation size as smaller than the driver needs, the driver can possibly overwrite memory.
This patch restructures the driver ioctls so we store the structure size we are expecting, and make sure we allocate at least that size. The copy from/to userspace are still restricted to the size the user specifies, this allows ioctl structs to grow on both sides of the equation.
Up until now we didn't really use the DRM_IOCTL defines in the kernel, so this cleans them up and adds them for nouveau.
v2:
fix nouveau pushbuf arg (thanks to Ben for pointing it out)
Reported-by: Linus Torvalds <torvalds@linuxfoundation.org>
Signed-off-by: Dave Airlie <airlied@redhat.com>
|
|
non-critical issue, CVE-2010-2803
Userspace controls the amount of memory to be allocate, so it can
get the ioctl to allocate more memory than the kernel uses, and get
access to kernel stack. This can only be done for processes authenticated
to the X server for DRI access, and if the user has DRI access.
Fix is to just memset the data to 0 if the user doesn't copy into
it in the first place.
Reported-by: Kees Cook <kees@ubuntu.com>
Signed-off-by: Dave Airlie <airlied@redhat.com>
|
|
nouveau starting using these APIs, the first on non-x86 hw, and this
include isn't required on anything with real amounts of vmalloc space.
this fixes a build problem on powerpc.
Signed-off-by: Dave Airlie <airlied@redhat.com>
|
|
We don't actually need this include on any platform.
built on powerpc + x86, reported on m68k.
Reported-by: Geert Uytterhoeven <geert@linux-m68k.org>
Signed-off-by: Dave Airlie <airlied@redhat.com>
|
|
When we find no ROM we understand and a device-tree is present, see
if we can retreive clock info from there.
Signed-off-by: Benjamin Herrenschmidt <benh@kernel.crashing.org>
Signed-off-by: Dave Airlie <airlied@redhat.com>
|
|
This never really got fixed in mesa, and the kernel deals with the problem
just fine, so don't got reporting things that confuse people.
Signed-off-by: Dave Airlie <airlied@redhat.com>
|
|
0 is a valid DMA address from pci_map_page(), use pci_dma_mapping_error()
instead to check for errors
[airlied: fix warning + two other places with errors.]
Signed-off-by: Benjamin Herrenschmidt <benh@kernel.crashing.org>
Signed-off-by: Dave Airlie <airlied@redhat.com>
|
|
When removing of the BKL the locking around lastclose() was rearranged
and resulted in the holding of the open_count spinlock over the call
into drm_lastclose(). The drivers were not ready for this path to be
atomic - it may indeed involve long waits to release old objects and
cleanup the GPU - and so we ended up scheduling whilst atomic.
[ 54.625598] BUG: scheduling while atomic: X/3546/0x00000002
[ 54.625600] Modules linked in: sco bridge stp llc input_polldev rfcomm bnep l2cap crc16 sch_sfq ipv6 md_mod acpi_cpufreq mperf cryptd aes_x86_64 aes_generic xts gf128mul dm_crypt dm_mod btusb bluetooth usbhid hid zaurus cdc_ether usbnet mii cdc_wdm cdc_acm uvcvideo videodev v4l1_compat v4l2_compat_ioctl32 snd_hda_codec_conexant arc4 pcmcia ecb snd_hda_intel joydev sdhci_pci sdhci snd_hda_codec tpm_tis firewire_ohci mmc_core e1000e uhci_hcd thinkpad_acpi nvram yenta_socket pcmcia_rsrc pcmcia_core tpm wmi sr_mod firewire_core iwlagn ehci_hcd snd_hwdep snd_pcm usbcore tpm_bios thermal led_class snd_timer iwlcore snd soundcore ac snd_page_alloc pcspkr psmouse serio_raw battery sg mac80211 evdev cfg80211 i2c_i801 iTCO_wdt iTCO_vendor_support cdrom processor crc_itu_t rfkill xfs exportfs sd_mod crc_t10dif ahci libahci libata scsi_mod [last unloaded: scsi_wait_scan]
[ 54.625663] Pid: 3546, comm: X Not tainted 2.6.35-04771-g1787985 #301
[ 54.625665] Call Trace:
[ 54.625671] [<ffffffff8102d599>] __schedule_bug+0x57/0x5c
[ 54.625675] [<ffffffff81384141>] schedule+0xe5/0x832
[ 54.625679] [<ffffffff81163e77>] ? put_dec+0x20/0x3c
[ 54.625682] [<ffffffff81384dd4>] schedule_timeout+0x275/0x29f
[ 54.625686] [<ffffffff810455e1>] ? process_timeout+0x0/0xb
[ 54.625688] [<ffffffff81384e17>] schedule_timeout_uninterruptible+0x19/0x1b
[ 54.625691] [<ffffffff81045893>] msleep+0x16/0x1d
[ 54.625695] [<ffffffff812a2e53>] i9xx_crtc_dpms+0x273/0x2ae
[ 54.625698] [<ffffffff812a18be>] intel_crtc_dpms+0x28/0xe7
[ 54.625702] [<ffffffff811ec0fa>] drm_helper_disable_unused_functions+0xf0/0x118
[ 54.625705] [<ffffffff811ecde3>] drm_crtc_helper_set_config+0x644/0x7c8
[ 54.625708] [<ffffffff811f12dd>] ? drm_copy_field+0x40/0x50
[ 54.625711] [<ffffffff811ebca2>] drm_fb_helper_force_kernel_mode+0x3e/0x85
[ 54.625713] [<ffffffff811ebcf2>] drm_fb_helper_restore+0x9/0x24
[ 54.625717] [<ffffffff81290a41>] i915_driver_lastclose+0x2b/0x5c
[ 54.625720] [<ffffffff811f14a7>] drm_lastclose+0x44/0x2ad
[ 54.625722] [<ffffffff811f1ed2>] drm_release+0x5c6/0x609
[ 54.625726] [<ffffffff810d1275>] fput+0x109/0x1c7
[ 54.625728] [<ffffffff810ce5e4>] filp_close+0x61/0x6b
[ 54.625731] [<ffffffff810ce680>] sys_close+0x92/0xd4
[ 54.625734] [<ffffffff81002a2b>] system_call_fastpath+0x16/0x1b
v2: The spinlock is actually superfluous as access to open_count is
entirely serialised by drm_global_mutex and so can be dropped. The
count_lock spinlock instead appears to be used to protect access to
dev->buf_alloc and dev->buf_use.
Signed-off-by: Chris Wilson <chris@chris-wilson.co.uk>
Signed-off-by: Dave Airlie <airlied@redhat.com>
|
|
This is a CS checker fix. I need this for FP16 alpha-test.
Signed-off-by: Marek Olšák <maraeo@gmail.com>
Signed-off-by: Dave Airlie <airlied@redhat.com>
|
|
add default case for buffer formats
Signed-off-by: Alex Deucher <alexdeucher@gmail.com>
Cc: Andre Maasikas <amaasikas@gmail.com>
Signed-off-by: Dave Airlie <airlied@redhat.com>
|
|
Currently most, if not all, memory allocation in drm_bufs.c is followed by initializing the memory with 0.
Replace the use of kmalloc+memset with kzalloc.
Signed-off-by: Davidlohr Bueso <dave@gnu.org>
Signed-off-by: Dave Airlie <airlied@redhat.com>
|
|
Expand the crtc_gamma_set function to accept a starting offset. The
reason for this is to eventually use this function for setcolreg from
drm_fb_helper.c. The fbdev colormap function can start at any offset in
the color map.
Signed-by: James Simmons <jsimmons@infradead.org>
Signed-off-by: Dave Airlie <airlied@redhat.com>
|
|
... of the code, not of the mode lists.
Signed-off-by: Adam Jackson <ajax@redhat.com>
Signed-off-by: Dave Airlie <airlied@redhat.com>
|
|
This brings us in line with the EDID spec recommendation for mode
priority sorting. We still don't extract all the modes we could from
VTB, but VTB is so rare in the wild that I'm not really concerned.
Signed-off-by: Adam Jackson <ajax@redhat.com>
Signed-off-by: Dave Airlie <airlied@redhat.com>
|
|
Signed-off-by: Adam Jackson <ajax@redhat.com>
Signed-off-by: Dave Airlie <airlied@redhat.com>
|
|
Signed-off-by: Adam Jackson <ajax@redhat.com>
Signed-off-by: Dave Airlie <airlied@redhat.com>
|
|
Signed-off-by: Adam Jackson <ajax@redhat.com>
Signed-off-by: Dave Airlie <airlied@redhat.com>
|
|
This is consistent with trying to access a filename that not exist
within a directory which is a good analogy here. The main reason for the
change is that it is easy to confuse the error code of EBADF as an
performing an ioctl on an invalid file descriptor (rather than an
unknown object).
Signed-off-by: Chris Wilson <chris@chris-wilson.co.uk>
Signed-off-by: Dave Airlie <airlied@redhat.com>
|
|
Fixes lack of power saving with multiple heads on
some desktop cards.
Fixes:
https://bugzilla.kernel.org/show_bug.cgi?id=16474
Signed-off-by: Alex Deucher <alexdeucher@gmail.com>
Signed-off-by: Dave Airlie <airlied@redhat.com>
|
|
Signed-off-by: Chris Wilson <chris@chris-wilson.co.uk>
Signed-off-by: Dave Airlie <airlied@redhat.com>
|
|
HPD pins are reversed
Fixes:
https://bugs.freedesktop.org/show_bug.cgi?id=29387
Signed-off-by: Alex Deucher <alexdeucher@gmail.com>
Cc: stable@kernel.org
Signed-off-by: Dave Airlie <airlied@redhat.com>
|
|
Change the interface to expect a PTR_ERR specifing the real error code
as opposed to assuming a NULL return => -EINVAL. Just once the user may
not be at fault!
Signed-off-by: Chris Wilson <chris@chris-wilson.co.uk>
Signed-off-by: Dave Airlie <airlied@redhat.com>
|
|
Smatch complained that the ERR_PTR from hwmon_device_register() wasn't
handled. I added some error handling in radeon_hwmon_init() to silence
the warning.
Unfortunately errors from radeon_pm_init() aren't handled so this
doesn't really make a difference beyond silencing the warning.
Also I changed DRM_ERROR() to dev_err() which is the new preferred
method.
Signed-off-by: Dan Carpenter <error27@gmail.com>
Signed-off-by: Dave Airlie <airlied@redhat.com>
|
|
router objects are found on systems that use a mux to control
ddc line to connector routing or to control the actual clock and data
routing from the chip to the connectors. This patch implements ddc line
routing.
Signed-off-by: Alex Deucher <alexdeucher@gmail.com>
Signed-off-by: Dave Airlie <airlied@redhat.com>
|
|
Handle asic specific table to hw mappings in
combios_setup_i2c_bus() directly. This allows us
to remove most of the combios quirks and clean up
the i2c bus setup.
Signed-off-by: Alex Deucher <alexdeucher@gmail.com>
Signed-off-by: Dave Airlie <airlied@redhat.com>
|
|
Previously we added i2c buses as needed when enumerating connectors
power management, etc. This only exposed the actual buses used and
could have lead to the same buse getting created more than once if
one buses was used for more than one purpose. This patch sets up
all i2c buses on the card in one place and users of the buses just
point back to the one instance.
Signed-off-by: Alex Deucher <alexdeucher@gmail.com>
Signed-off-by: Dave Airlie <airlied@redhat.com>
|
|
- buffer offsets in the base regs are 256b aligned so
shift properly when comparing, fixed by Andre Maasikas
- mipmap size was calculated wrong when nlevel=0
- texture bo offsets were used after the bo base address was added
- vertex resource size register is size - 1, not size
Signed-off-by: Alex Deucher <alexdeucher@gmail.com>
Cc: Andre Maasikas <amaasikas@gmail.com>
Signed-off-by: Dave Airlie <airlied@redhat.com>
|
|
Signed-off-by: Marek Olšák <maraeo@gmail.com>
Signed-off-by: Dave Airlie <airlied@redhat.com>
|
|
(For some reason I thought that went in ages ago ...)
This fixes support for PCI domains in what should hopefully be a backward
compatible way along with a change to libdrm.
When the interface version is set to 1.4, we assume userspace understands
domains and the world is at peace. We thus pass proper domain numbers
instead of 0 to userspace.
The newer libdrm will then try 1.4 first, and fallback to 1.1, along with
ignoring domains in the later case (well, except on alpha of course)
Signed-off-by: Benjamin Herrenschmidt <benh@kernel.crashing.org>
Signed-off-by: Dave Airlie <airlied@redhat.com>
|
|
drm-core-next
* 'nouveau/for-airlied' of /ssd/git/drm-nouveau-next: (27 commits)
drm/nvc0: fix typo in PRAMIN flush
drm/nouveau: Fix DCB TMDS config parsing.
drm/nv30: Fix PFB init for nv31.
drm/nv04: Fix up SGRAM density detection.
drm/i2c/ch7006: Don't use POWER_LEVEL_FULL_POWER_OFF on early chip versions.
drm/nouveau: Init dcb->or on cards that have no usable DCB table.
drm/nouveau: reduce severity of some "error" messages
drm/nvc0: backup bar3 channel on suspend
drm/nouveau: implement init table opcodex 0x5e and 0x9a
drm/nouveau: implement init table op 0x57, INIT_LTIME
drm/nvc0: implement crtc pll setting
drm/nvc0: fix evo dma object so we display something
drm/nvc0: rudimentary instmem support
drm/nvc0: implement memory detection
drm/nvc0: allow INIT_GPIO
drm/nvc0: starting point for GF100 support, everything stubbed
drm/nv30: Workaround dual TMDS brain damage.
drm/nouveau: No need to set slave TV encoder configs explicitly.
drm/nv17-nv4x: Attempt to init some external TMDS transmitters.
drm/nv10: Fix up switching of NV10TCL_DMA_VTXBUF.
...
|
|
This hasn't mattered up until the ioctl started using the value, and it fell
apart.
fixes fd.o 29340, Ubuntu LP 606081
[airlied: cleaned up whitespace and don't need an error before pushing]
Signed-off-by: Dr. David Alan Gilbert <linux@treblig.org>
Cc: stable@kernel.org
Signed-off-by: Dave Airlie <airlied@redhat.com>
|
|
Signed-off-by: Ben Skeggs <bskeggs@redhat.com>
|
|
Thinko caused by 43bda05428a3d2021f3c12220073e0251c65df8b.
Signed-off-by: Francisco Jerez <currojerez@riseup.net>
|
|
Fixes a regression introduced by 58bbb63720c8997e0136fe1884101e7ca40d68fd
(fdo bug 29324).
Reported-by: Johannes Obermayr <johannesobermayr@gmx.de>
Signed-off-by: Francisco Jerez <currojerez@riseup.net>
Signed-off-by: Ben Skeggs <bskeggs@redhat.com>
|
|
Signed-off-by: Francisco Jerez <currojerez@riseup.net>
Signed-off-by: Ben Skeggs <bskeggs@redhat.com>
|
|
Signed-off-by: Francisco Jerez <currojerez@riseup.net>
Signed-off-by: Ben Skeggs <bskeggs@redhat.com>
|
|
We need a valid OR value because there're a few nv17 cards with DCB v1.4.
Signed-off-by: Francisco Jerez <currojerez@riseup.net>
Signed-off-by: Ben Skeggs <bskeggs@redhat.com>
|
|
There's some known configurations where the lack of these tables/scripts
is perfectly normal, reduce visibilty of complaint messages to debug.
Signed-off-by: Ben Skeggs <bskeggs@redhat.com>
|
|
Signed-off-by: Ben Skeggs <bskeggs@redhat.com>
|
|
Signed-off-by: Ben Skeggs <bskeggs@redhat.com>
Signed-off-by: Marcin Kościelnicki <koriakin@0x04.net>
|
|
Signed-off-by: Ben Skeggs <bskeggs@redhat.com>
Signed-off-by: Marcin Kościelnicki <koriakin@0x04.net>
|
|
Signed-off-by: Ben Skeggs <bskeggs@redhat.com>
|
|
Signed-off-by: Ben Skeggs <bskeggs@redhat.com>
|
|
Signed-off-by: Ben Skeggs <bskeggs@redhat.com>
|
|
Signed-off-by: Ben Skeggs <bskeggs@redhat.com>
|
|
Signed-off-by: Ben Skeggs <bskeggs@redhat.com>
|
|
Signed-off-by: Ben Skeggs <bskeggs@redhat.com>
|
|
Signed-off-by: Francisco Jerez <currojerez@riseup.net>
Signed-off-by: Ben Skeggs <bskeggs@redhat.com>
|
|
Signed-off-by: Francisco Jerez <currojerez@riseup.net>
Signed-off-by: Ben Skeggs <bskeggs@redhat.com>
|
|
sil164 and friends are the most common, usually they just need to be
poked once because a fixed configuration is enough for any modes and
clocks, so they worked without this patch if the BIOS had done a good
job on POST. Display couldn't survive a suspend/resume cycle though.
Unfortunately, BIOS scripts are useless here.
Signed-off-by: Francisco Jerez <currojerez@riseup.net>
Signed-off-by: Ben Skeggs <bskeggs@redhat.com>
|
