Dave Airlie [Sat, 14 Aug 2010 10:20:34 +0000 (20:20 +1000)]
drm: block userspace under allocating buffer and having drivers overwrite it (v2)
With the current screwed but its ABI, ioctls for the drm, Linus pointed out that we could allow userspace to specify the allocation size, but we pass it to the driver which then uses it blindly to store a struct. Now if userspace specifies the allocation size as smaller than the driver needs, the driver can possibly overwrite memory.
This patch restructures the driver ioctls so we store the structure size we are expecting, and make sure we allocate at least that size. The copy from/to userspace are still restricted to the size the user specifies, this allows ioctl structs to grow on both sides of the equation.
Up until now we didn't really use the DRM_IOCTL defines in the kernel, so this cleans them up and adds them for nouveau.
v2:
fix nouveau pushbuf arg (thanks to Ben for pointing it out)
Reported-by: Linus Torvalds <torvalds@linuxfoundation.org> Signed-off-by: Dave Airlie <airlied@redhat.com>
Dave Airlie [Tue, 17 Aug 2010 04:46:00 +0000 (14:46 +1000)]
drm: stop information leak of old kernel stack.
non-critical issue, CVE-2010-2803
Userspace controls the amount of memory to be allocate, so it can
get the ioctl to allocate more memory than the kernel uses, and get
access to kernel stack. This can only be done for processes authenticated
to the X server for DRI access, and if the user has DRI access.
Fix is to just memset the data to 0 if the user doesn't copy into
it in the first place.
Reported-by: Kees Cook <kees@ubuntu.com> Signed-off-by: Dave Airlie <airlied@redhat.com>
Chris Wilson [Wed, 11 Aug 2010 13:41:16 +0000 (14:41 +0100)]
drm: Remove count_lock for calling lastclose() after 58474713 (v2)
When removing of the BKL the locking around lastclose() was rearranged
and resulted in the holding of the open_count spinlock over the call
into drm_lastclose(). The drivers were not ready for this path to be
atomic - it may indeed involve long waits to release old objects and
cleanup the GPU - and so we ended up scheduling whilst atomic.
v2: The spinlock is actually superfluous as access to open_count is
entirely serialised by drm_global_mutex and so can be dropped. The
count_lock spinlock instead appears to be used to protect access to
dev->buf_alloc and dev->buf_use.
Signed-off-by: Chris Wilson <chris@chris-wilson.co.uk> Signed-off-by: Dave Airlie <airlied@redhat.com>
James Simmons [Tue, 3 Aug 2010 00:33:19 +0000 (01:33 +0100)]
drm: expand gamma_set
Expand the crtc_gamma_set function to accept a starting offset. The
reason for this is to eventually use this function for setcolreg from
drm_fb_helper.c. The fbdev colormap function can start at any offset in
the color map.
Signed-by: James Simmons <jsimmons@infradead.org> Signed-off-by: Dave Airlie <airlied@redhat.com>
Adam Jackson [Tue, 3 Aug 2010 18:38:19 +0000 (14:38 -0400)]
drm/edid: Rewrite mode parse to use the generic detailed block walk
This brings us in line with the EDID spec recommendation for mode
priority sorting. We still don't extract all the modes we could from
VTB, but VTB is so rare in the wild that I'm not really concerned.
Signed-off-by: Adam Jackson <ajax@redhat.com> Signed-off-by: Dave Airlie <airlied@redhat.com>
Chris Wilson [Wed, 4 Aug 2010 13:19:46 +0000 (14:19 +0100)]
drm: Use ENOENT consistently for the error return for an unmatched handle.
This is consistent with trying to access a filename that not exist
within a directory which is a good analogy here. The main reason for the
change is that it is easy to confuse the error code of EBADF as an
performing an ioctl on an invalid file descriptor (rather than an
unknown object).
Signed-off-by: Chris Wilson <chris@chris-wilson.co.uk> Signed-off-by: Dave Airlie <airlied@redhat.com>
Chris Wilson [Sun, 8 Aug 2010 12:36:38 +0000 (13:36 +0100)]
drm: Propagate error code from fb_create()
Change the interface to expect a PTR_ERR specifing the real error code
as opposed to assuming a NULL return => -EINVAL. Just once the user may
not be at fault!
Signed-off-by: Chris Wilson <chris@chris-wilson.co.uk> Signed-off-by: Dave Airlie <airlied@redhat.com>
Dan Carpenter [Mon, 9 Aug 2010 19:59:42 +0000 (21:59 +0200)]
radeon: handle errors in radeon_hwmon_init()
Smatch complained that the ERR_PTR from hwmon_device_register() wasn't
handled. I added some error handling in radeon_hwmon_init() to silence
the warning.
Unfortunately errors from radeon_pm_init() aren't handled so this
doesn't really make a difference beyond silencing the warning.
Also I changed DRM_ERROR() to dev_err() which is the new preferred
method.
Signed-off-by: Dan Carpenter <error27@gmail.com> Signed-off-by: Dave Airlie <airlied@redhat.com>
Alex Deucher [Fri, 6 Aug 2010 01:21:18 +0000 (21:21 -0400)]
drm/radeon/kms: add support for router objects
router objects are found on systems that use a mux to control
ddc line to connector routing or to control the actual clock and data
routing from the chip to the connectors. This patch implements ddc line
routing.
Signed-off-by: Alex Deucher <alexdeucher@gmail.com> Signed-off-by: Dave Airlie <airlied@redhat.com>
Alex Deucher [Fri, 6 Aug 2010 01:21:17 +0000 (21:21 -0400)]
drm/radeon/kms: rework combios i2c handling
Handle asic specific table to hw mappings in
combios_setup_i2c_bus() directly. This allows us
to remove most of the combios quirks and clean up
the i2c bus setup.
Signed-off-by: Alex Deucher <alexdeucher@gmail.com> Signed-off-by: Dave Airlie <airlied@redhat.com>
Alex Deucher [Fri, 6 Aug 2010 01:21:16 +0000 (21:21 -0400)]
drm/radeon/kms: unify i2c handling
Previously we added i2c buses as needed when enumerating connectors
power management, etc. This only exposed the actual buses used and
could have lead to the same buse getting created more than once if
one buses was used for more than one purpose. This patch sets up
all i2c buses on the card in one place and users of the buses just
point back to the one instance.
Signed-off-by: Alex Deucher <alexdeucher@gmail.com> Signed-off-by: Dave Airlie <airlied@redhat.com>
Alex Deucher [Fri, 6 Aug 2010 06:54:05 +0000 (02:54 -0400)]
drm/radeon/kms: r600 CS parser fixes
- buffer offsets in the base regs are 256b aligned so
shift properly when comparing, fixed by Andre Maasikas
- mipmap size was calculated wrong when nlevel=0
- texture bo offsets were used after the bo base address was added
- vertex resource size register is size - 1, not size
Signed-off-by: Alex Deucher <alexdeucher@gmail.com> Cc: Andre Maasikas <amaasikas@gmail.com> Signed-off-by: Dave Airlie <airlied@redhat.com>
(For some reason I thought that went in ages ago ...)
This fixes support for PCI domains in what should hopefully be a backward
compatible way along with a change to libdrm.
When the interface version is set to 1.4, we assume userspace understands
domains and the world is at peace. We thus pass proper domain numbers
instead of 0 to userspace.
The newer libdrm will then try 1.4 first, and fallback to 1.1, along with
ignoring domains in the later case (well, except on alpha of course)
Signed-off-by: Benjamin Herrenschmidt <benh@kernel.crashing.org> Signed-off-by: Dave Airlie <airlied@redhat.com>
Dave Airlie [Mon, 9 Aug 2010 22:17:50 +0000 (08:17 +1000)]
Merge remote branch 'nouveau/for-airlied' of /ssd/git/drm-nouveau-next into drm-core-next
* 'nouveau/for-airlied' of /ssd/git/drm-nouveau-next: (27 commits)
drm/nvc0: fix typo in PRAMIN flush
drm/nouveau: Fix DCB TMDS config parsing.
drm/nv30: Fix PFB init for nv31.
drm/nv04: Fix up SGRAM density detection.
drm/i2c/ch7006: Don't use POWER_LEVEL_FULL_POWER_OFF on early chip versions.
drm/nouveau: Init dcb->or on cards that have no usable DCB table.
drm/nouveau: reduce severity of some "error" messages
drm/nvc0: backup bar3 channel on suspend
drm/nouveau: implement init table opcodex 0x5e and 0x9a
drm/nouveau: implement init table op 0x57, INIT_LTIME
drm/nvc0: implement crtc pll setting
drm/nvc0: fix evo dma object so we display something
drm/nvc0: rudimentary instmem support
drm/nvc0: implement memory detection
drm/nvc0: allow INIT_GPIO
drm/nvc0: starting point for GF100 support, everything stubbed
drm/nv30: Workaround dual TMDS brain damage.
drm/nouveau: No need to set slave TV encoder configs explicitly.
drm/nv17-nv4x: Attempt to init some external TMDS transmitters.
drm/nv10: Fix up switching of NV10TCL_DMA_VTXBUF.
...
Reported-by: Johannes Obermayr <johannesobermayr@gmx.de> Signed-off-by: Francisco Jerez <currojerez@riseup.net> Signed-off-by: Ben Skeggs <bskeggs@redhat.com>
Francisco Jerez [Tue, 20 Jul 2010 14:48:08 +0000 (16:48 +0200)]
drm/nv17-nv4x: Attempt to init some external TMDS transmitters.
sil164 and friends are the most common, usually they just need to be
poked once because a fixed configuration is enough for any modes and
clocks, so they worked without this patch if the BIOS had done a good
job on POST. Display couldn't survive a suspend/resume cycle though.
Unfortunately, BIOS scripts are useless here.
Signed-off-by: Francisco Jerez <currojerez@riseup.net> Signed-off-by: Ben Skeggs <bskeggs@redhat.com>
Dan Carpenter [Fri, 30 Jul 2010 15:04:32 +0000 (17:04 +0200)]
drm/nouveau: unwind on load errors
nouveau_load() just returned directly if there was an error instead of
releasing resources.
Signed-off-by: Dan Carpenter <error27@gmail.com> Reviewed-by: Marcin Slusarz <marcin.slusarz@gmail.com> Signed-off-by: Francisco Jerez <currojerez@riseup.net> Signed-off-by: Ben Skeggs <bskeggs@redhat.com>
Francisco Jerez [Fri, 30 Jul 2010 11:57:54 +0000 (13:57 +0200)]
drm/nouveau: Fix AGP reset when AGP FW is already enabled on init.
Previously nouveau_mem_reset_agp() was only disabling AGP fast writes
when coming back from suspend. However, the "locked out of the card
because of FW" problem can also be reproduced on init if you
unload/reload nouveau.ko several times. This patch makes the AGP code
reset FW on init.
Signed-off-by: Francisco Jerez <currojerez@riseup.net> Signed-off-by: Ben Skeggs <bskeggs@redhat.com>
This restricts the use of the big kernel lock to the i830 and i810
device drivers. The three remaining users in common code (open, ioctl
and release) get converted to a new mutex, the drm_global_mutex,
making the locking stricter than the big kernel lock.
This may have a performance impact, but only in those cases that
currently don't use DRM_UNLOCKED flag in the ioctl list and would
benefit from that anyway.
The reason why i810 and i830 cannot use drm_global_mutex in their
mmap functions is a lock-order inversion problem between the current
use of the BKL and mmap_sem in these drivers. Since the BKL has
release-on-sleep semantics, it's harmless but it would cause trouble
if we replace the BKL with a mutex.
Instead, these drivers get their own ioctl wrappers that take the
BKL around every ioctl call and then set their own handlers as
DRM_UNLOCKED.
Signed-off-by: Arnd Bergmann <arnd@arndb.de> Cc: David Airlie <airlied@linux.ie> Cc: dri-devel@lists.freedesktop.org Signed-off-by: Dave Airlie <airlied@redhat.com>
Francisco Jerez [Thu, 22 Jul 2010 15:07:38 +0000 (17:07 +0200)]
drm/kms: Simplify setup of the initial I2C encoder config.
In most use cases the driver will be using the same static config all
the time: interpreting i2c_board_info::platform_data as the default
config we can can save the GPU driver a redundant set_config() call.
Signed-off-by: Francisco Jerez <currojerez@riseup.net> Signed-off-by: Dave Airlie <airlied@redhat.com>
Chris Wilson [Wed, 4 Aug 2010 10:09:42 +0000 (11:09 +0100)]
drm: Cleanup after failing to create master->unique and dev->name
v2: Userspace (notably xf86-video-{intel,ati}) became confused when
drmSetInterfaceVersion() started returning -EBUSY as they used a second
call (the first done in drmOpen()) to check their master credentials.
Since userspace wants to be able to repeatedly call
drmSetInterfaceVersion() allow them to do so.
v3: Rebase to drm-core-next.
Signed-off-by: Chris Wilson <chris@chris-wilson.co.uk> Signed-off-by: Dave Airlie <airlied@redhat.com>
Alex Deucher [Tue, 3 Aug 2010 23:59:20 +0000 (19:59 -0400)]
drm/radeon/kms: enable underscan option for digital connectors
This connector attribute allows you to enable or disable underscan
on a digital output to compensate for panels that automatically
overscan (e.g., many HDMI TVs). Valid values for the attribute are:
off - forces underscan off
on - forces underscan on
auto - enables underscan if an HDMI TV is connected, off otherwise
default value is auto.
Signed-off-by: Alex Deucher <alexdeucher@gmail.com> Signed-off-by: Dave Airlie <airlied@redhat.com>
Dave Airlie [Tue, 3 Aug 2010 23:51:27 +0000 (09:51 +1000)]
Merge remote branch 'intel/drm-intel-next' of /ssd/git/drm-next into drm-core-next
* 'intel/drm-intel-next' of /ssd/git/drm-next: (230 commits)
drm/i915: Clear the Ironlake dithering flags when the pipe doesn't want it.
drm/agp/i915: trim stolen space to 32M
drm/i915: Unset cursor if out-of-bounds upon mode change (v4)
drm/i915: Unreference object not handle on creation
drm/i915: Attempt to uncouple object after catastrophic failure in unbind
drm/i915: Repeat unbinding during free if interrupted (v6)
drm/i915: Refactor i915_gem_retire_requests()
drm/i915: Warn if we run out of FIFO space for a mode
drm/i915: Round up the watermark entries (v3)
drm/i915: Typo in (unused) register mask for overlay.
drm/i915: Check overlay stride errata for i830 and i845
drm/i915: Validate the mode for eDP by using fixed panel size
drm/i915: Always use the fixed panel timing for eDP
drm/i915: Enable panel fitting for eDP
drm/i915: Add fixed panel mode parsed from EDID for eDP without fixed mode in VBT
drm/i915/sdvo: Set sync polarity based on actual mode
drm/i915/hdmi: Set sync polarity based on actual mode
drm/i915/pch: Set transcoder sync polarity for DP based on actual mode
drm/i915: Initialize LVDS and eDP outputs before anything else
drm/i915/dp: Correctly report eDP in the core connector type
...
Dave Airlie [Tue, 9 Mar 2010 00:56:52 +0000 (10:56 +1000)]
drm: move ttm global code to core drm
I wrote this for the prime sharing work, but I also noticed other external
non-upstream drivers from a large company carrying a similiar patch, so I
may as well ship it in master.
Alex Deucher [Thu, 8 Jul 2010 16:24:52 +0000 (12:24 -0400)]
drm/radeon/kms: make sure rio_mem is valid before unmapping it
If we were not able to map the io bar in device init, don't attempt
to unmap it in device fini. All radeons should have a io bar, so
I doubt this would ever trigger, but just to be on the safe side...
Pointed out by: Alberto Milone <alberto.milone@canonical.com> Signed-off-by: Alex Deucher <alexdeucher@gmail.com> Signed-off-by: Dave Airlie <airlied@redhat.com>
Some BIOSes will claim a large chunk of stolen space. Unless we
reclaim it, our aperture for remapping buffer objects will be
constrained. So clamp the stolen space to 32M and ignore the rest.
Fixes https://bugzilla.kernel.org/show_bug.cgi?id=15469 among others.
Adding the ignored stolen memory back into the general pool using the
memory hotplug code is left as an exercise for the reader.
Signed-off-by: Jesse Barnes <jbarnes@virtuousgeek.org> Reviewed-by: Simon Farnsworth <simon.farnsworth@onelan.com> Tested-by: Artem S. Tashkinov <t.artem@mailcity.com> Signed-off-by: Eric Anholt <eric@anholt.net>
Chris Wilson [Fri, 9 Jul 2010 07:45:04 +0000 (08:45 +0100)]
drm/i915: Unset cursor if out-of-bounds upon mode change (v4)
The docs warn that to position the cursor such that no part of it is
visible on the pipe is an undefined operation. Avoid such circumstances
upon changing the mode, or at any other time, by unsetting the cursor if
it moves out of bounds.
"For normal high resolution display modes, the cursor must have at least a
single pixel positioned over the active screen.” (p143, p148 of the hardware
registers docs).
Fixes:
Bug 24748 - [965G] Graphics crashes when resolution is changed with KMS
enabled
https://bugs.freedesktop.org/show_bug.cgi?id=24748
v2: Only update the cursor registers if they change.
v3: Fix the unsigned comparision of x,y against width,height.
v4: Always set CUR.BASE or else the cursor may become corrupt.
Signed-off-by: Chris Wilson <chris@chris-wilson.co.uk> Reported-by: Christian Eggers <ceggers@gmx.de> Cc: Christopher James Halse Rogers <chalserogers@gmail.com> Cc: stable@kernel.org Signed-off-by: Eric Anholt <eric@anholt.net>
Chris Wilson [Sat, 24 Jul 2010 20:03:49 +0000 (21:03 +0100)]
drm/i915: Unreference object not handle on creation
When creating an object, we create the handle by which it is known to
the process and which own the reference to the object. That reference to
the new handle is what we want to transfer to the process, not the lost
reference to the object; so free the local object reference *not* the
process's handle reference.
This brings i915_gem_object_create_ioctl() into line with
drm_gem_open_ioctl()
Signed-off-by: Chris Wilson <chris@chris-wilson.co.uk> Signed-off-by: Eric Anholt <eric@anholt.net>
Chris Wilson [Fri, 23 Jul 2010 22:18:51 +0000 (23:18 +0100)]
drm/i915: Attempt to uncouple object after catastrophic failure in unbind
If we fail to flush outstanding GPU writes but return the memory to the
system, we risk corrupting memory should the GPU recovery and complete
those writes. On the other hand, if we bail early and free the object
then we have a definite use-after-free and real memory corruption.
Choose the lesser of two evils, since in order to recover from the hung
GPU we need to completely reset it, those pending writes should
never happen.
Signed-off-by: Chris Wilson <chris@chris-wilson.co.uk> Signed-off-by: Eric Anholt <eric@anholt.net>
Chris Wilson [Fri, 23 Jul 2010 22:18:50 +0000 (23:18 +0100)]
drm/i915: Repeat unbinding during free if interrupted (v6)
If during the freeing of an object the unbind is interrupted by a system
call, which is quite possible if we have outstanding GPU writes that
must be flushed, the unbind is silently aborted. This still leaves the
AGP region and backing pages allocated, and perhaps more importantly,
the object remains upon the various lists exposing us to memory
corruption.
I think this is the cause behind the use-after-free, such as
Bug 15664 - Graphics hang and kernel backtrace when starting Azureus
with Compiz enabled
https://bugzilla.kernel.org/show_bug.cgi?id=15664
v2: Daniel Vetter reminded me that kernel space programming is never easy.
We cannot simply spin to clear the pending signal and so must deferred
the freeing of the object until later.
v3: Run from the top level retire requests.
v4: Tested with P(return -ERESTARTSYS)=.5 from i915_gem_do_wait_request()
v5: Rebase against Eric's for-linus tree.
v6: Refactor, split and add a comment about avoiding unbounded recursion.
Signed-off-by: Chris Wilson <chris@chris-wilson.co.uk> Cc: Daniel Vetter <daniel@ffwll.ch> Signed-off-by: Eric Anholt <eric@anholt.net>
Chris Wilson [Fri, 23 Jul 2010 22:18:49 +0000 (23:18 +0100)]
drm/i915: Refactor i915_gem_retire_requests()
Combine the iteration over active render rings into a common function.
This is in preparation for reusing the idle function to also retire
deferred free requests.
Signed-off-by: Chris Wilson <chris@chris-wilson.co.uk> Signed-off-by: Eric Anholt <eric@anholt.net>
drm/i915: Validate the mode for eDP by using fixed panel size
Signed-off-by: Zhao Yakui <yakui.zhao@intel.com> Reviewed-by: Chris Wilson <chris@chris-wilson.co.uk> Cc: stable@kernel.org Signed-off-by: Eric Anholt <eric@anholt.net>
drm/i915: Always use the fixed panel timing for eDP
Signed-off-by: Zhao Yakui <yakui.zhao@intel.com> Reviewed-by: Chris Wilson <chris@chris-wilson.co.uk> Cc: stable@kernel.org Signed-off-by: Eric Anholt <eric@anholt.net>
When trying to set other display mode besides the fixed panel mode, the
panel fitting should be enabled. This is similar to LVDS.
Signed-off-by: Zhao Yakui <yakui.zhao@intel.com> Reviewed-by: Chris Wilson <chris@chris-wilson.co.uk> Cc: stable@kernel.org Signed-off-by: Eric Anholt <eric@anholt.net>
drm/i915: Add fixed panel mode parsed from EDID for eDP without fixed mode in VBT
Signed-off-by: Zhao Yakui <yakui.zhao@intel.com> Reviewed-by: Chris Wilson <chris@chris-wilson.co.uk> Cc: stable@kernel.org Signed-off-by: Eric Anholt <eric@anholt.net>
Adam Jackson [Fri, 16 Jul 2010 18:46:29 +0000 (14:46 -0400)]
drm/i915: Initialize LVDS and eDP outputs before anything else
This makes them sort to the front in X, which makes them likely to be
the primary outputs if you haven't specified a preference in your DE,
which is likely to be what you want.
Signed-off-by: Adam Jackson <ajax@redhat.com> Signed-off-by: Eric Anholt <eric@anholt.net>
Chris Wilson [Sun, 18 Jul 2010 11:05:54 +0000 (12:05 +0100)]
drm/i915: Refactor panel fitting on the LVDS. (v2)
Move the common routines into separate functions to not only increase
readability, but also throwaway surplus code.
In doing so, we review the calculation of the aspect preserving scaling
and avoid the use of fixed-point until we need to calculate the accurate
scale factor.
Signed-off-by: Chris Wilson <chris@chris-wilson.co.uk> Reviewed-by: Jesse Barnes <jbarnes@virtuousgeek.org> Signed-off-by: Eric Anholt <eric@anholt.net>
Chris Wilson [Sat, 24 Jul 2010 17:29:37 +0000 (18:29 +0100)]
agp/intel: Destroy the scatterlist on allocation failure
A side-effect of being able to use custom page allocations with the
sg_table is that it cannot reap the partially constructed scatterlist if
fails to allocate a page. So we need to call sg_free_table() ourselves
if sg_alloc_table() fails.
Signed-off-by: Chris Wilson <chris@chris-wilson.co.uk>
Cc Dave Airlie <airlied@redhat.com> Signed-off-by: Eric Anholt <eric@anholt.net>
projects / mv-sheeva.git / log