Jerome Glisse [Mon, 18 Jan 2010 12:01:36 +0000 (13:01 +0100)]
drm/radeon: r6xx/r7xx possible security issue, system ram access
This patch workaround a possible security issue which can allow
user to abuse drm on r6xx/r7xx hw to access any system ram memory.
This patch doesn't break userspace, it detect "valid" old use of
CB_COLOR[0-7]_FRAG & CB_COLOR[0-7]_TILE registers and overwritte
the address these registers are pointing to with the one of the
last color buffer. This workaround will work for old mesa &
xf86-video-ati and any old user which did use similar register
programming pattern as those (we expect that there is no others
user of those ioctl except possibly a malicious one). This patch
add a warning if it detects such usage, warning encourage people
to update their mesa & xf86-video-ati. New userspace will submit
proper relocation.
Fix for xf86-video-ati / mesa (this kernel patch is enough to
prevent abuse, fix for userspace are to set proper cs stream and
avoid kernel warning) :
http://cgit.freedesktop.org/xorg/driver/xf86-video-ati/commit/?id=95d63e408cc88b6934bec84a0b1ef94dfe8bee7b
http://cgit.freedesktop.org/mesa/mesa/commit/?id=46dc6fd3ed5ef96cda53641a97bc68c3bc104a9f
Abusing this register to perform system ram memory is not easy,
here is outline on how it could be achieve. First attacker must
have access to the drm device and be able to submit command stream
throught cs ioctl. Then attacker must build a proper command stream
for r6xx/r7xx hw which will abuse the FRAG or TILE buffer to
overwrite the GPU GART which is in VRAM. To achieve so attacker
as to setup CB_COLOR[0-7]_FRAG or CB_COLOR[0-7]_TILE to point
to the GPU GART, then it has to find a way to write predictable
value into those buffer (with little cleverness i believe this
can be done but this is an hard task). Once attacker have such
program it can overwritte GPU GART to program GPU gart to point
anywhere in system memory. It then can reusse same method as he
used to reprogram GART to overwritte the system ram through the
GART mapping. In the process the attacker has to be carefull to
not overwritte any sensitive area of the GART table, like ring
or IB gart entry as it will more then likely lead to GPU lockup.
Bottom line is that i think it's very hard to use this flaw
to get system ram access but in theory one can achieve so.
Side note: I am not aware of anyone ever using the GPU as an
attack vector, nevertheless we take great care in the opensource
driver to try to detect and forbid malicious use of GPU. I don't
think the closed source driver are as cautious as we are.
Signed-off-by: Jerome Glisse <jglisse@redhat.com> Signed-off-by: Dave Airlie <airlied@linux.ie>
Jerome Glisse [Sun, 17 Jan 2010 20:21:41 +0000 (21:21 +0100)]
drm/radeon/kms: Forbid creation of framebuffer with no valid GEM object
This will avoid oops if at later point the fb is use. Trying to create
a framebuffer with no valid GEM object is bogus and should be forbidden
as this patch does.
Signed-off-by: Jerome Glisse <jglisse@redhat.com> Signed-off-by: Dave Airlie <airlied@linux.ie>
Jerome Glisse [Fri, 15 Jan 2010 13:44:39 +0000 (14:44 +0100)]
drm/radeon/kms: r600 handle irq vector ring overflow
In some rare case i faced an irq overflow quickly followed by
a GPU lockup (hard hang) this patch try to deal with irq vector
ring overflow, so far haven't been able to reproduce it with
the patch.
Signed-off-by: Jerome Glisse <jglisse@redhat.com> Reviewed-by: Alex Deucher <alexdeucher@gmail.com> Signed-off-by: Dave Airlie <airlied@linux.ie>
Jerome Glisse [Fri, 15 Jan 2010 13:44:38 +0000 (14:44 +0100)]
drm/radeon/kms: r600/r700 don't process IRQ if not initialized
In some rare case the wptr returned from the hw wasn't 0 and leaded
to trick r600_process_irq that their were irq to process. Add a
check to bail out if irq hasn't been initialized this will avoid
oops provoqued by the rare wptr != 0 on initialization.
Signed-off-by: Jerome Glisse <jglisse@redhat.com> Reviewed-by: Alex Deucher <alexdeucher@gmail.com> Signed-off-by: Dave Airlie <airlied@linux.ie>
Alex Deucher [Wed, 20 Jan 2010 21:22:53 +0000 (16:22 -0500)]
drm/radeon/kms/r4xx: cleanup atom path
most of radeon_legacy_atom_set_surface() is taken care
of in atombios_set_base(), so remove the duplicate
setup and move the remaining bits (DISP_MERGE setup and
FP2 sync) to atombios_crtc.c where they are used.
Signed-off-by: Alex Deucher <alexdeucher@gmail.com> Signed-off-by: Dave Airlie <airlied@linux.ie>
Alex Deucher [Tue, 19 Jan 2010 21:34:01 +0000 (16:34 -0500)]
drm/radeon/kms: fix atombios_crtc_set_base
Make it call the proper backend depending on the
GPU family. Right now r4xx cards with atombios modesetting
enabled were using the avivo crtc base code. This also
allows us to add support for new asics more easily.
Signed-off-by: Alex Deucher <alexdeucher@gmail.com> Signed-off-by: Dave Airlie <airlied@linux.ie>
Alex Deucher [Tue, 19 Jan 2010 17:38:48 +0000 (12:38 -0500)]
drm/radeon/kms/atom: fix some parser bugs
- add support for inline src params
- fix shift_left/shift_right and shl/shr ops
shift_* ops use inline src params, shl/r use full params
- fix mask op (uses inline params)
Signed-off-by: Alex Deucher <alexdeucher@gmail.com> Signed-off-by: Dave Airlie <airlied@linux.ie>
Alex Deucher [Tue, 19 Jan 2010 01:20:07 +0000 (20:20 -0500)]
drm/radeon/kms/r100: fix bug in CS parser
The first dword of PACKET3_3D_DRAW_IMMD maps to
SE_VTX_FMT so the vertex size is part of the draw
packet.
This patch fixes a possible case where you have a
command buffer that does not contain SE_VTX_FMT
register write, but does contain PACKET3_3D_DRAW_IMMD.
Signed-off-by: Alex Deucher <alexdeucher@gmail.com> Signed-off-by: Dave Airlie <airlied@linux.ie>
Jerome Glisse [Wed, 13 Jan 2010 14:16:38 +0000 (15:16 +0100)]
drm/radeon/kms: Use radeon_agp_disable when disabling AGP
Use same common function to disable agp so we replace the GART
callback by the proper one when we do so. This fix oops if
radeon_agp_init report failure.
This patch also move radeon_agp_init out of *_mc_init for r600
& rv770 so that we can have a similar behavior than for previous
hw, ie if agp_init fails it will fallback to GPU GART and disable
AGP.
Signed-off-by: Jerome Glisse <jglisse@redhat.com> Signed-off-by: Dave Airlie <airlied@redhat.com>
Jerome Glisse [Wed, 13 Jan 2010 14:16:39 +0000 (15:16 +0100)]
drm/radeon/kms: Disable AGP is aperture size < 32M
radeon KMS need a GART of at least 32M to properly work. This patch
check the AGP aperture size and disable if it's less than 32M. Note
than unlike non KMS path we don't staticaly allocate AGP memory so
we are not wasting memory not used by graphic processing.
Signed-off-by: Jerome Glisse <jglisse@redhat.com> Signed-off-by: Dave Airlie <airlied@redhat.com>
Jerome Glisse [Wed, 13 Jan 2010 09:29:27 +0000 (10:29 +0100)]
drm/radeon/kms: Fix r600 blit cleanup path
r600 blit cleanup path need to check if a bo was allocated before
trying to free or unpin it. This patch add this check and avoid
oops when the initialization on r6xx or r7xx hw fails.
Signed-off-by: Jerome Glisse <jglisse@redhat.com> Signed-off-by: Dave Airlie <airlied@redhat.com>
Jerome Glisse [Wed, 13 Jan 2010 11:32:36 +0000 (12:32 +0100)]
drm/radeon/kms: Do not unpin buffer in fb destruction
It's not necessary to unpin buffer in fb destruction. pin/unpin
need to be balanced and we don't pin in fb creation. We pin when
an fb is associated to a crtc and unpin when the fb is disassociated
from the crtc.
Note:
Maybe we should take reference on fb in set_base callback so fb
doesn't disappear until it's unbind from ctrc.
Signed-off-by: Jerome Glisse <jglisse@redhat.com> Signed-off-by: Dave Airlie <airlied@redhat.com>
It appears that attempting AUXCH DDC breaks the subsequent attempt
to do DDC over the i2c lines, so use the sink type to determine
if we should be doing AUXCH or i2c DDC.
This fixes my DVI monitor plugged into DP->DVI convertor.
Alex Deucher [Tue, 12 Jan 2010 16:16:57 +0000 (11:16 -0500)]
drm/radeon/kms: fix up LVDS handling on macs (v2)
Based on radeonfb code and recent ddx fix.
v2: minor formatting fix from Michel Dänzer
Signed-off-by: Alex Deucher <alexdeucher@gmail.com> Reviewed-by: Michel Dänzer <michel@daenzer.net> Tested-by: Michel Dänzer <michel@daenzer.net> Signed-off-by: Dave Airlie <airlied@redhat.com>
Jerome Glisse [Thu, 7 Jan 2010 14:39:14 +0000 (15:39 +0100)]
drm/radeon/kms: Don't try to enable IRQ if we have no handler installed
If for any reason we haven't installed handler we shouldn't try to
enable IRQ/MSI on the hw so we don't get unhandled IRQ/MSI which
makes the kernel sad.
Signed-off-by: Jerome Glisse <jglisse@redhat.com> Signed-off-by: Dave Airlie <airlied@redhat.com>
Jerome Glisse [Thu, 7 Jan 2010 14:39:13 +0000 (15:39 +0100)]
drm: Avoid calling vblank function is vblank wasn't initialized
In some case vblank might not be initialized and we shouldn't
try to use associated function. This patch make sure this is
the case. It also export drm_vblank_cleanup so driver can cleanup
vblank if for any reason IRQ/MSI is not working.
Signed-off-by: Jerome Glisse <jglisse@redhat.com> Signed-off-by: Dave Airlie <airlied@redhat.com>
Jerome Glisse [Thu, 7 Jan 2010 15:08:32 +0000 (16:08 +0100)]
drm/radeon/kms: Make sure we release AGP device if we acquired it
In some case we weren't releasing the AGP device at module unloading.
This leaded to unfunctional AGP at next module load. This patch make
sure we release the AGP bus if we acquire it.
Signed-off-by: Jerome Glisse <jglisse@redhat.com> Signed-off-by: Dave Airlie <airlied@redhat.com>
Jerome Glisse [Thu, 7 Jan 2010 11:39:21 +0000 (12:39 +0100)]
drm/radeon/kms: Schedule host path read cache flush through the ring V2
R300 family will hard lockup if host path read cache flush is
done through MMIO to HOST_PATH_CNTL. But scheduling same flush
through ring seems harmless. This patch remove the hdp_flush
callback and add a flush after each fence emission which means
a flush after each IB schedule. Thus we should have same behavior
without the hard lockup.
Tested on R100,R200,R300,R400,R500,R600,R700 family.
V2: Adjust fence counts in r600_blit_prepare_copy()
Signed-off-by: Jerome Glisse <jglisse@redhat.com> Reviewed-by: Alex Deucher <alexdeucher@gmail.com> Signed-off-by: Dave Airlie <airlied@redhat.com>
Long story short, this fixes sporadic hardlocks with my rv410 during
times of intense 2D acceleration (Flash on Fx3).
V2: Fix indentation and move errata_fini to suspend function so we
don't leak scratch register over suspend/resume cycle.
V3: Move scratch_reg to asic specific structure (aim is to slowly
move stuff to asic specific structure and avoid poluting
radeon_device struct with asic specific variables)
Darren Jenkins [Thu, 7 Jan 2010 06:35:21 +0000 (01:35 -0500)]
drm/radeon: fix a couple of array index errors
There are a couple of array overruns, and some associated confusion in
the code.
This is just a wild guess at what the code should actually look like.
Coverity CID: 13305 13306
agd5f: fix up the original intent of the timing code
Signed-off-by: Darren Jenkins <darrenrjenkins@gmail.com> Signed-off-by: Alex Deucher <alexdeucher@gmail.com> Signed-off-by: Dave Airlie <airlied@redhat.com>
Alex Deucher [Sat, 19 Dec 2009 17:45:12 +0000 (12:45 -0500)]
drm/radeon/kms: add definitions for v4 power tables
[airlied: just adding this for completeness to avoid drift between
public atombios.h files] Signed-off-by: Alex Deucher <alexdeucher@gmail.com> Signed-off-by: Dave Airlie <airlied@redhat.com>
Jerome Glisse [Fri, 11 Dec 2009 19:36:19 +0000 (20:36 +0100)]
drm/radeon/kms: Avoid crash when trying to cleanup uninitialized structure
Add boolean to record if some part of the driver are initialized or
not this allow to avoid a crash when trying to cleanup uninitialized
structure members.
Signed-off-by: Jerome Glisse <jglisse@redhat.com> Signed-off-by: Dave Airlie <airlied@redhat.com>
Alex Deucher [Tue, 22 Dec 2009 15:06:49 +0000 (10:06 -0500)]
drm/radeon/kms: add cvt mode if we only have lvds w/h and no edid (v4)
This fixes LVDS on some mac laptops without a panel edid.
v2 - Set proper mode type flags
v3 - Note that this is not neceesarily the exact panel mode,
but an approximation based on the cvt formula. For these
systems we should ideally read the mode info out of the
registers or add a mode table, but this works and is much
simpler.
v4 - Update comments and debug message.
Signed-off-by: Alex Deucher <alexdeucher@gmail.com> Signed-off-by: Dave Airlie <airlied@redhat.com>
Marek Olšák [Thu, 17 Dec 2009 05:02:28 +0000 (06:02 +0100)]
drm/radeon/kms: allow rendering while no colorbuffer is set on r300
Because hardware cannot disable all colorbuffers directly to do depth-only
rendering, a user should:
- disable reading from a colorbuffer in blending
- disable fastfill
- set the color channel mask to 0 to prevent writing to a colorbuffer
drm/vmwgfx: Return -ERESTARTSYS when interrupted by a signal.
Fixes for TTM API change.
Signed-off-by: Thomas Hellstrom <thellstrom@vmware.com> Signed-off-by: Jakob Bornecrantz <jakob@vmware.com> Signed-off-by: Dave Airlie <airlied@redhat.com>
drm/vmwgfx: Fix unlocked ioctl and add proper access control
This fixes up vmwgfx for the unlocked ioctl code to avoid
doing it in the driver. Also adds ioctl flags.
Signed-off-by: Thomas Hellstrom <thellstrom@vmware.com> Signed-off-by: Jakob Bornecrantz <jakob@vmware.com> Signed-off-by: Dave Airlie <airlied@redhat.com>
Andi Kleen [Mon, 21 Dec 2009 01:24:47 +0000 (02:24 +0100)]
DRM: Rename clamp variable
linux/kernel.h has a "clamp" macro, but r300_cmdbuf also uses a variable
with the same name. Right now it doesn't seem to include the header,
but sooner or later someone will. So better rename the variable
now.
Signed-off-by: Andi Kleen <ak@linux.intel.com> Signed-off-by: Dave Airlie <airlied@redhat.com>
Arnd Bergmann [Wed, 16 Dec 2009 22:17:09 +0000 (22:17 +0000)]
drm: convert drm_ioctl to unlocked_ioctl
drm_ioctl is called with the Big Kernel Lock held,
which shows up very high in statistics on vfs_ioctl.
Moving the lock into the drm_ioctl function itself
makes sure we blame the right subsystem and it gets
us one step closer to eliminating the locked version
of fops->ioctl.
Since drm_ioctl does not require the lock itself,
we only need to hold it while calling the specific
handler. The 32 bit conversion handlers do not
interact with any other code, so they don't need
the BKL here either and can just call drm_ioctl.
As a bonus, this cleans up all the other users
of drm_ioctl which now no longer have to find
the inode or call lock_kernel.
[airlied: squashed the non-driver bits
of the second patch in here, this provides
the flag for drivers to use to select unlocked
ioctls - but doesn't modify any drivers].
Signed-off-by: Arnd Bergmann <arnd@arndb.de> Cc: David Airlie <airlied@linux.ie> Cc: dri-devel@lists.sourceforge.net Cc: Frederic Weisbecker <fweisbec@gmail.com> Cc: Thomas Gleixner <tglx@linutronix.de> Signed-off-by: Dave Airlie <airlied@redhat.com>
Dave Airlie [Wed, 16 Dec 2009 05:52:21 +0000 (15:52 +1000)]
Merge remote branch 'nouveau/for-airlied' of /ssd/git/drm-nouveau-next into drm-linus
* 'nouveau/for-airlied' of /ssd/git/drm-nouveau-next:
drm/nouveau: remove use of -ERESTART
nouveau: Fix endianness with new context program loader
drm/nouveau: fix build with CONFIG_AGP=n
drm/nouveau: fix ch7006 build
Jerome Glisse [Tue, 15 Dec 2009 17:23:23 +0000 (18:23 +0100)]
drm/radeon/kms: Return to userspace on ERESTARTSYS
radeon_object.h wasn't converted to ERESTARTSYS change. No
each time we got an ERESTARTSYS we return to userspace (ie
we were interrupted by a signal and we let the userspace
reschedule the ioctl).
Signed-off-by: Jerome Glisse <jglisse@redhat.com> Signed-off-by: Dave Airlie <airlied@redhat.com>
Jerome Glisse [Fri, 11 Dec 2009 14:13:22 +0000 (15:13 +0100)]
drm/radeon/kms: If no placement is supplied fallback to system
Do as we did before rework, if no placement is supplied at bo
creation time, fallback to allocating bo from system ram. This
will fix most of the creation failed issue report we got since
the rework get merged.
Signed-off-by: Jerome Glisse <jglisse@redhat.com> Signed-off-by: Dave Airlie <airlied@redhat.com>
Jerome Glisse [Thu, 10 Dec 2009 17:07:26 +0000 (18:07 +0100)]
drm/ttm: Fix memory type manager debug information printing
System memory type doesn't have a drm_mm manager associated to
it. This patch avoid trying to call drm_mm_debug on unitialized
drm_mm when printing debug info on the system memory manager.
Signed-off-by: Jerome Glisse <jglisse@redhat.com> Signed-off-by: Dave Airlie <airlied@redhat.com>
1) The function was previously called with a potentially empty
LRU list which would have lead to an OOPS or servere corruption.
2) In rare cases, after reservation has succeeded, another process may
already have evicted it or even pinned it. We must revalidate the
buffer status after releasing the lru lock.
Signed-off-by: Thomas Hellstrom <thellstrom@vmware.com> Signed-off-by: Dave Airlie <airlied@redhat.com>
1) Remove from lru before reserving so we avoid competing with
evicting processes.
2) Avoid calling kref_put() on bo::list_kref while spinlocked.
3) Additional refcounting bug-checking.
Signed-off-by: Thomas Hellstrom <thellstrom@vmware.com> Signed-off-by: Dave Airlie <airlied@redhat.com>
Dave Airlie [Mon, 14 Dec 2009 04:51:35 +0000 (14:51 +1000)]
drm/ttm: fix two bugs in new placement routines.
a) the loops were going to <= not <, leading to illegal memory access
b) the busy placement checks were using the placement arrays not the
busy placement ones.
Acked-by: Jerome Glisse <jglisse@redhat.com> Signed-off-by: Dave Airlie <airlied@redhat.com>
nouveau: Fix endianness with new context program loader
When switching to request_firmware() to load the context programs,
some endian fixes need to be applied. This makes it work again on
my quad g5 nvidia 6600.
Signed-off-by: Benjamin Herrenschmidt <benh@kernel.crashing.org> Signed-off-by: Ben Skeggs <bskeggs@redhat.com>
This commit adds the vmwgfx driver for the VWware Virtual GPU aka SVGA.
The driver is under staging the same as Nouveau and Radeon KMS. Hopefully
the 2D ioctls are bug free and don't need changing, so that part of the
API should be stable. But there there is a pretty big chance that the 3D API
will change in the future.
Signed-off-by: Thomas Hellström <thellstrom@vmware.com> Signed-off-by: Jakob Bornecrantz <jakob@vmware.com> Signed-off-by: Dave Airlie <airlied@redhat.com>
These headers are shared between multiple place where
different coding standards apply. They will be fixed
up at a later time.
Signed-off-by: Thomas Hellström <thellstrom@vmware.com> Signed-off-by: Jakob Bornecrantz <jakob@vmware.com> Signed-off-by: Dave Airlie <airlied@redhat.com>
Ben Skeggs [Fri, 11 Dec 2009 09:24:15 +0000 (19:24 +1000)]
drm/nouveau: Add DRM driver for NVIDIA GPUs
This adds a drm/kms staging non-API stable driver for GPUs from NVIDIA.
This driver is a KMS-based driver and requires a compatible nouveau
userspace libdrm and nouveau X.org driver.
This driver requires firmware files not available in this kernel tree,
interested parties can find them via the nouveau project git archive.
This driver is reverse engineered, and is in no way supported by nVidia.
Support for nearly the complete range of nvidia hw from nv04->g80 (nv50)
is available, and the kms driver should support driving nearly all
output types (displayport is under development still) along with supporting
suspend/resume.
This work is all from the upstream nouveau project found at
nouveau.freedesktop.org.
The original authors list from nouveau git tree is:
Anssi Hannula <anssi.hannula@iki.fi>
Ben Skeggs <bskeggs@redhat.com>
Francisco Jerez <currojerez@riseup.net>
Maarten Maathuis <madman2003@gmail.com>
Marcin Kościelnicki <koriakin@0x04.net>
Matthew Garrett <mjg@redhat.com>
Matt Parnell <mparnell@gmail.com>
Patrice Mandin <patmandin@gmail.com>
Pekka Paalanen <pq@iki.fi>
Xavier Chantry <shiningxc@gmail.com>
along with project founder Stephane Marchesin <marchesin@icps.u-strasbg.fr>
Signed-off-by: Ben Skeggs <bskeggs@redhat.com> Signed-off-by: Dave Airlie <airlied@redhat.com>
Jerome Glisse [Thu, 10 Dec 2009 16:16:27 +0000 (17:16 +0100)]
drm/ttm: Convert ttm_buffer_object_init to use ttm_placement
Convert ttm_buffer_object_init to use struct ttm_placement and
rename to ttm_bo_init for consistency with function naming. This
allow to give more complex placement at buffer creation. For
instance you ask to allocate bo into vram first but if there is
not enough vram you can give system as a second possible
placement. It also allow to create buffer in a specific range.
Also rename ttm_buffer_object_validate to ttm_bo_validate.
Signed-off-by: Jerome Glisse <jglisse@redhat.com> Signed-off-by: Dave Airlie <airlied@redhat.com>