summaryrefslogtreecommitdiff
path: root/drivers/gpu/drm
AgeCommit message (Collapse)Author
2010-02-01drm/radeon/kms: move radeon KMS on/off switch out of staging.Dave Airlie
We are happy enough that the KMS driver is stable enough for enough people for the kms enable/disable to leave staging. Distros can now contemplate turning this on. Signed-off-by: Dave Airlie <airlied@redhat.com>
2010-02-01drm/radeon/kms: Bailout of blit if error happen & protect with mutex V3Jerome Glisse
If an error happen in r600_blit_prepare_copy report it rather than WARNING and keeping execution. For instance if ib allocation failed we did just warn about but then latter tried to access NULL ib ptr causing oops. This patch also protect r600_copy_blit with a mutex as otherwise one process might overwrite blit temporary data with new one possibly leading to GPU lockup. Should partialy or totaly fix: https://bugzilla.redhat.com/show_bug.cgi?id=553279 V2 failing blit initialization is not fatal, fallback to memcpy when this happen V3 init blit before startup as we pin in startup, remove duplicate code (this one was actualy tested unlike V2) Signed-off-by: Jerome Glisse <jglisse@redhat.com> Signed-off-by: Dave Airlie <airlied@redhat.com>
2010-02-01drm/vmwgfx: Don't send bad flags to the hostJakob Bornecrantz
Signed-off-by: Jakob Bornecrantz <jakob@vmware.com> Signed-off-by: Dave Airlie <airlied@redhat.com>
2010-02-01drm/vmwgfx: Request SVGA version 2 and bail if not foundPeter Hanzel
This fixes the driver not loading on older versions of VMware. Signed-off-by: Peter Hanzel <hanzelpeter@gmail.com> Signed-off-by: Jakob Bornecrantz <jakob@vmware.com> Signed-off-by: Dave Airlie <airlied@redhat.com>
2010-02-01drm/vmwgfx: Correctly detect 3DJakob Bornecrantz
Signed-off-by: Jakob Bornecrantz <jakob@vmware.com> Signed-off-by: Dave Airlie <airlied@redhat.com>
2010-02-01drm/ttm: remove unnecessary save_flags and ttm_flag_masked in ttm_bo_util.cAustin Yuan
Signed-off-by: Austin Yuan <shengquan.yuan@gmail.com> Acked-by: Thomas Hellstrom <thellstrom@vmware.com> Signed-off-by: Dave Airlie <airlied@redhat.com>
2010-02-01drm/ttm: remove padding from ttm_ref_object on 64bit buildsRichard Kennedy
Re-order structure ttm_ref_object to remove 8 bytes of alignment padding on 64 bit builds, so shrinking its size from 72 to 64 bytes allowing it to fit into a smaller slab. Signed-off-by: Richard Kennedy <richard@rsk.demon.co.uk> Acked-by: Thomas Hellstrom <thellstrom@vmware.com> Signed-off-by: Dave Airlie <airlied@redhat.com>
2010-02-01drm/radeon/kms: release agp on error.Dave Airlie
if we get an error, release the AGP if we've acquired it already. Signed-off-by: Dave Airlie <airlied@redhat.com>
2010-02-01drm/kms/radeon/agp: Move the check of the aper_size after drm_acp_acquire ↵John Kacur
and drm_agp_info First call drm_agp_acquire to check if agp has been acquired. Second call drm_agp_info to fill in the info data struct, including aper_size. Finally do the check to see if the aper_size makes sense. Signed-off-by: John Kacur <jkacur@redhat.com> Signed-off-by: Dave Airlie <airlied@redhat.com>
2010-02-01drm/kms/radeon/agp: Fix warning, format ‘%d’ expects type ‘int’, but ↵John Kacur
argument 4 has type ‘size_t’ - Fix warning by using %zu instead of %d for size_t - Fix spelling mistake, "to" should be "too". Signed-off-by: John Kacur <jkacur@redhat.com> Signed-off-by: Dave Airlie <airlied@redhat.com>
2010-02-01drm/ttm: Avoid conflicting reserve_memtype during ttm_tt_set_page_caching.Francisco Jerez
Fixes errors like: > reserve_ram_pages_type failed 0x15b7a000-0x15b7b000, track 0x8, req 0x10 when a BO is moved between WC and UC areas. Reported-by: Xavier Chantry <shiningxc@gmail.com> Signed-off-by: Francisco Jerez <currojerez@riseup.net> Acked-by: Thomas Hellstrom <thellstrom@vmware.com> Signed-off-by: Dave Airlie <airlied@redhat.com>
2010-02-01drm/kms/radeon: pick digitial encoders smarter. (v3)Dave Airlie
booting a Lenovo W500 with LVDS + DP outputs showed up a TODO we had on our list, to pick a correct digital encoder block. The LVTMA encoder requires the second digital encoder, all others can use any encoder at all. This fixes the digital encoder selection logic to enable LVDS/DP combos to work okay. V2: fix silly addition of connector dig_block and cleanup the other places in the code that pick the encoder. V3: rename to dig_encoder and clean up further - also fix the picking algorithm. tested on Lenovo W500 + desktop 3650 cards. Signed-off-by: Dave Airlie <airlied@redhat.com>
2010-02-01drm/radeon/kms: use active device to pick connector for encoderDave Airlie
On the W500 we have UNIPHY routed to both DVI and DP, this seems to always pick the DVI connector which means link training fails. Switch to using active device to pick the connector, this seems like it should be safe from a code review, and it fixes things a bit more here. Signed-off-by: Dave Airlie <airlied@redhat.com>
2010-02-01drm/radeon/kms: fix incorrect logic in DP vs eDP connector checking.Dave Airlie
This makes displayport work again here. Signed-off-by: Dave Airlie <airlied@redhat.com>
2010-01-29drm/i915: page flip support for IronlakeJesse Barnes
This patch adds support for page flipping on Ironlake, which uses different interrupt bits for triggering flip submit IRQs. Signed-off-by: Jesse Barnes <jbarnes@virtuousgeek.org> [anholt: hand-resolved for rebasing off of render power saving patch] Signed-off-by: Eric Anholt <eric@anholt.net>
2010-01-29drm/i915: Fix the incorrect DMI string for Samsung SX20S laptopZhao Yakui
Signed-off-by: Zhao Yakui <yakui.zhao@intel.com> Reported-by: Philipp Kohlbecher <xt28@gmx.de> Signed-off-by: Eric Anholt <eric@anholt.net>
2010-01-29drm/i915: Add support for SDVO composite TVZhao Yakui
Signed-off-by: Zhao Yakui <yakui.zhao@intel.com> Signed-off-by: Eric Anholt <eric@anholt.net>
2010-01-29drm/i915: don't trigger ironlake vblank interrupt at irq installLi Peng
Zhenyu noticed that the ironlake vblank enabling patch has one issue that it will trigger vblank starting from irq postinstall, this isn't necessary. This patch addresses this issue by only adding the vblank into DEIER but mask them in DEIMR, so that it won't trigger vblank interrupt at irq install. Signed-off-by: Li Peng <peng.li@intel.com> Acked-by: Zhenyu Wang <zhenyuw@linux.intel.com> Signed-off-by: Eric Anholt <eric@anholt.net>
2010-01-27drm/i915: Selectively enable self-reclaimChris Wilson
Having missed the ENOMEM return via i915_gem_fault(), there are probably other paths that I also missed. By not enabling NORETRY by default these paths can run the shrinker and take memory from the system (but not from our own inactive lists because our shrinker can not run whilst we hold the struct mutex) and this may allow the system to survive a little longer whilst our drivers consume all available memory. References: OOM killer unexpectedly called with kernel 2.6.32 http://bugzilla.kernel.org/show_bug.cgi?id=14933 v2: Pass gfp into page mapping. v3: Use new read_cache_page_gfp() instead of open-coding. Signed-off-by: Chris Wilson <chris@chris-wilson.co.uk> Cc: KOSAKI Motohiro <kosaki.motohiro@jp.fujitsu.com> Cc: Hugh Dickins <hugh.dickins@tiscali.co.uk> Cc: Jesse Barnes <jbarnes@virtuousgeek.org> Cc: Eric Anholt <eric@anholt.net> Cc: stable@kernel.org Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
2010-01-25drm/i915: handle non-flip pending case when unpinning the scanout bufferJesse Barnes
The first page flip queued will replace the current front buffer, which should have a 0 pending flip count. So at finish time we need to handle that case (i.e. if the flip count is 0 *or* dec_and_test is 0 we need to wake the waiters). Also fix up an error path in the queue function and add some debug output (only enabled with driver debugging). Signed-off-by: Jesse Barnes <jbarnes@virtuousgeek.org> Signed-off-by: Eric Anholt <eric@anholt.net>
2010-01-25Merge branch 'drm-linus' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/airlied/drm-2.6 * 'drm-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/airlied/drm-2.6: (95 commits) drm/radeon/kms: preface warning printk with driver name drm/radeon/kms: drop unnecessary printks. drm: fix regression in fb blank handling drm/radeon/kms: make hibernate work on IGPs drm/vmwgfx: Optimize memory footprint for DMA buffers. drm/ttm: Allow system memory as a busy placement. drm/ttm: Fix race condition in ttm_bo_delayed_delete (v3, final) drm/nv50: prevent switching off SOR when in use for DVI-over-DP drm/nv50: fail auxch transaction if reply count not what we expect drm/nouveau: fix failure path if userspace specifies no valid memtypes drm/nouveau: report LVDS as disconnected if lid closed drm/radeon/kms: fix legacy get_engine/memory clock drm/radeon/kms/atom: atom parser fixes drm/radeon/kms: clean up atombios pll code drm/radeon/kms: clean up pll struct drm/radeon/kms/atom: fix crtc lock ordering drm/radeon: r6xx/r7xx possible security issue, system ram access drm/radeon/kms: r600/r700 don't test ib if ib initialization fails drm/radeon/kms: Forbid creation of framebuffer with no valid GEM object drm/radeon/kms: r600 handle irq vector ring overflow ...
2010-01-25drm/i915: Fix the device info of PineviewLi Peng
Pineview doesn't has CXSR and need GTT-based hardware status page. It fixes a X boot hung issue on Pinview since commit cfdf1f Signed-off-by: Li Peng <peng.li@intel.com> Acked-by: Zhao Yakui <yakui.zhao@intel.com> Signed-off-by: Eric Anholt <eric@anholt.net>
2010-01-25drm/i915: enable vblank interrupt on ironlakeLi Peng
so far vblank interrupt on ironlake is disabled, this would cause bad gfx performance if userspace calls drm_wait_vblank. This patch enables vblank interrupt on ironlake and follows vblank get/put model. Signed-off-by: Li Peng <peng.li@intel.com> Acked-by: Zhenyu Wang <zhenyuw@linux.intel.com> Signed-off-by: Eric Anholt <eric@anholt.net>
2010-01-25drm/i915: Prevent use of uninitialized pointers along error path.Chris Wilson
X.org hang with [drm:i915_gem_do_execbuffer] *ERROR* in dmesg http://bugzilla.kernel.org/show_bug.cgi?id=15114 Matej found he was hitting an error path within i915_gem_do_execbuffer() that led to the attempt to dereference an uninitialised pointer during cleanup. This path used to be safe as we used to calloc the object lists, but this was changed in c8e0f93. Daniel Vetter had also spotted this error and proposed a similar patch. [ 6379.732892] [drm:i915_gem_do_execbuffer] *ERROR* Object ffff880098cd6540 appears more than once in object list [ 6379.740976] [drm:i915_gem_do_execbuffer] *ERROR* Object ffff880098cd6540 appears more than once in object list [ 6379.740995] BUG: unable to handle kernel NULL pointer dereference at 00000000000000a0 [ 6379.740998] IP: [<ffffffff8122ddb5>] i915_gem_do_execbuffer+0xba5/0x1260 [ 6379.741006] PGD babab067 PUD bb435067 PMD 0 [ 6379.741010] Oops: 0002 [#1] PREEMPT SMP [ 6379.741014] last sysfs file: /sys/devices/pci0000:00/0000:00:1c.2/0000:06:00.0/ieee80211/phy0/rfkill0/state [ 6379.741017] CPU 1 [ 6379.741021] Pid: 2186, comm: X Not tainted 2.6.33-rc4-00399-g24bc734 #142 M11D/ESPRIMO Mobile M9400 [ 6379.741023] RIP: 0010:[<ffffffff8122ddb5>] [<ffffffff8122ddb5>] i915_gem_do_execbuffer+0xba5/0x1260 [ 6379.741027] RSP: 0018:ffff8800b9047b78 EFLAGS: 00213206 [ 6379.741029] RAX: 0000000000000000 RBX: 000000000000004f RCX: ffff880098cac800 [ 6379.741032] RDX: ffff880098caca78 RSI: ffff8800b9047c98 RDI: ffff880098cd6540 [ 6379.741034] RBP: ffff8800b9047c78 R08: ffffffff814b96b5 R09: 0000000000000006 [ 6379.741036] R10: 0000000000000000 R11: 0000000000000003 R12: 000000000000004e [ 6379.741038] R13: 00000000fffffff7 R14: 0000000000000000 R15: 0000000000000001 [ 6379.741041] FS: 0000000000000000(0000) GS:ffff880001900000(0063) knlGS:00000000f72636c0 [ 6379.741043] CS: 0010 DS: 002b ES: 002b CR0: 0000000080050033 [ 6379.741041] FS: 0000000000000000(0000) GS:ffff880001900000(0063) knlGS:00000000f72636c0 [ 6379.741043] CS: 0010 DS: 002b ES: 002b CR0: 0000000080050033 [ 6379.741045] CR2: 00000000000000a0 CR3: 00000000b9000000 CR4: 00000000000006e0 [ 6379.741048] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 6379.741050] DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000400 [ 6379.741052] Process X (pid: 2186, threadinfo ffff8800b9046000, task ffff8800bb5d8000) [ 6379.741054] Stack: [ 6379.741055] ffffc90023f57000 ffffc90023f56fff ffffc90023f56fff ffffc90023f55000 [ 6379.741059] <0> ffff8800b9047c98 ffff8800bb43c840 ffff8800bf1de800 ffff8800bf1de820 [ 6379.741063] <0> ffff8800b9047bd8 ffff880098cac800 0000000000000000 0000000000000002 [ 6379.741068] Call Trace: [ 6379.741072] [<ffffffff8122e6cb>] ? i915_gem_execbuffer+0x6b/0x370 [ 6379.741077] [<ffffffff810a5f52>] ? __vmalloc_node+0xa2/0xb0 [ 6379.741080] [<ffffffff8122e6cb>] ? i915_gem_execbuffer+0x6b/0x370 [ 6379.741083] [<ffffffff8122e816>] i915_gem_execbuffer+0x1b6/0x370 [ 6379.741086] [<ffffffff8120cd55>] drm_ioctl+0x1d5/0x460 [ 6379.741089] [<ffffffff8122e660>] ? i915_gem_execbuffer+0x0/0x370 [ 6379.741093] [<ffffffff81248c35>] i915_compat_ioctl+0x45/0x50 [ 6379.741097] [<ffffffff810f1659>] compat_sys_ioctl+0xa9/0x1570 [ 6379.741102] [<ffffffff810b1d5c>] ? vfs_read+0x13c/0x1a0 [ 6379.741106] [<ffffffff81028424>] sysenter_dispatch+0x7/0x2b [ 6379.741108] Code: 08 85 c0 74 52 31 db 0f 1f 80 00 00 00 00 48 63 c3 48 8b 8d 68 ff ff ff 48 8d 14 c1 48 8b 02 48 85 c0 74 25 48 8b 80 80 00 00 00 <c7> 80 a0 00 00 00 00 00 00 00 48 8b 3a 48 85 ff 74 0c 48 c7 c6 [ 6379.741142] RIP [<ffffffff8122ddb5>] i915_gem_do_execbuffer+0xba5/0x1260 [ 6379.741145] RSP <ffff8800b9047b78> [ 6379.741147] CR2: 00000000000000a0 [ 6379.741159] ---[ end trace 0598809afa4c31db ]--- Reported-by: Matej Laitl <strohel@gmail.com> Signed-off-by: Chris Wilson <chris@chris-wilson.co.uk> Signed-off-by: Eric Anholt <eric@anholt.net>
2010-01-25drm/i915: disable hotplug detect before Ironlake CRT detectZhenyu Wang
This tries to fix CRT detect loop hang seen on some Ironlake form factor, to clear up hotplug detect state before taking CRT detect to make sure next hotplug detect cycle is consistent. Cc: Stable Team <stable@kernel.org> Signed-off-by: Zhenyu Wang <zhenyuw@linux.intel.com> Signed-off-by: Eric Anholt <eric@anholt.net>
2010-01-25drm/radeon/kms: preface warning printk with driver nameDave Airlie
This just adds a little more info to the warning for old -ati/mesa userspaces. Signed-off-by: Dave Airlie <airlied@redhat.com>
2010-01-25drm/radeon/kms: drop unnecessary printks.Dave Airlie
These printks aren't required anymore. Signed-off-by: Dave Airlie <airlied@redhat.com>
2010-01-25drm: fix regression in fb blank handlingZhenyu Wang
commit 731b5a15a3b1474a41c2ca29b4c32b0f21bc852e Author: James Simmons <jsimmons@infradead.org> Date: Thu Oct 29 20:39:07 2009 +0000 drm/kms: properly handle fbdev blanking uses DRM_MODE_DPMS_ON for FB_BLANK_NORMAL, but DRM_MODE_DPMS_ON is actually for turning output on instead of blank. This makes fb blank broken on my T61, it put LVDS on but leave pipe disabled which made screen totally white or caused some 'burning' effect. [airlied: James objects to this but at this point in 2.6.33, I can't see a patch that will fix this properly like he wants coming in time and otherwise this is a regression - proper fix for 2.6.34 hopefully.] Cc: James Simmons <jsimmons@infradead.org> Signed-off-by: Zhenyu Wang <zhenyuw@linux.intel.com> Signed-off-by: Dave Airlie <airlied@redhat.com>
2010-01-25drm/radeon/kms: make hibernate work on IGPsDave Airlie
This is the least invasive fix without migrating the radeon driver to pm_ops from what I can see. We just always migrate VRAM objects on IGPs for now and we can fix it up later to migrate depending on STR vs STD. Signed-off-by: Dave Airlie <airlied@redhat.com>
2010-01-25drm/vmwgfx: Optimize memory footprint for DMA buffers.Thomas Hellstrom
Use VRAM whenever there is free space for DMA buffers, but use system GMR memory if using VRAM would cause an eviction. This significantly reduces the guest system memory usage for VMs with a large amount of VRAM allocated. Signed-off-by: Thomas Hellstrom <thellstrom@vmware.com> Signed-off-by: Dave Airlie <airlied@redhat.com>
2010-01-25drm/ttm: Allow system memory as a busy placement.Thomas Hellstrom
This is needed to fix a vmwgfx memory usage bug. Signed-off-by: Thomas Hellstrom <thellstrom@vmware.com> Signed-off-by: Dave Airlie <airlied@redhat.com>
2010-01-25Merge remote branch 'korg/drm-radeon-next' into drm-linusDave Airlie
* korg/drm-radeon-next: drm/radeon/kms: fix legacy get_engine/memory clock drm/radeon/kms/atom: atom parser fixes drm/radeon/kms: clean up atombios pll code drm/radeon/kms: clean up pll struct drm/radeon/kms/atom: fix crtc lock ordering drm/radeon: r6xx/r7xx possible security issue, system ram access drm/radeon/kms: r600/r700 don't test ib if ib initialization fails drm/radeon/kms: Forbid creation of framebuffer with no valid GEM object drm/radeon/kms: r600 handle irq vector ring overflow drm/radeon/kms: r600/r700 don't process IRQ if not initialized drm/radeon/kms: r600/r700 disable irq at suspend drm/radeon/kms/r4xx: cleanup atom path drm/radeon/kms: fix atombios_crtc_set_base drm/radeon/kms/atom: upstream parser updates drm/radeon/kms/atom: fix some parser bugs drm/radeon/kms: fix hardcoded mmio size in register functions drm/radeon/kms/r100: fix bug in CS parser drm/radeon/kms/r200: fix bug in CS parser drm/radeon/kms/r200: fix bug in CS parser
2010-01-25Merge remote branch 'nouveau/for-airlied' of ../drm-nouveau-next into drm-linusDave Airlie
* 'nouveau/for-airlied' of ../drm-nouveau-next: drm/nv50: prevent switching off SOR when in use for DVI-over-DP drm/nv50: fail auxch transaction if reply count not what we expect drm/nouveau: fix failure path if userspace specifies no valid memtypes drm/nouveau: report LVDS as disconnected if lid closed drm/nv50: prevent accidently turning off encoders we're actually using drm/nv50: fix alignment of per-channel fifo cache drm/nouveau: Evict buffers in VRAM before freeing sgdma drm/nouveau: Acknowledge DMA_VTX_PROTECTION PGRAPH interrupts drm/nouveau: fix thinko in nv04_instmem.c drm/nouveau: fix a race condition in nouveau_dma_wait()
2010-01-25drm/ttm: Fix race condition in ttm_bo_delayed_delete (v3, final)Luca Barbieri
Resending this with Thomas Hellstrom's signoff for merging into 2.6.33 ttm_bo_delayed_delete has a race condition, because after we do: kref_put(&nentry->list_kref, ttm_bo_release_list); we are not holding the list lock and not holding any reference to objects, and thus every bo in the list can be removed and freed at this point. However, we then use the next pointer we stored, which is not guaranteed to be valid. This was apparently the cause of some Nouveau oopses I experienced. This patch rewrites the function so that it keeps the reference to nentry until nentry itself is freed and we already got a reference to nentry->next. v2 updated by me according to Thomas Hellstrom's feedback. v3 proposed by Thomas Hellstrom. Commit comment updated by me. Both updates fixed minor efficiency/style issues only and all three versions should be correct. Signed-off-by: Luca Barbieri <luca@luca-barbieri.com> Signed-off-by: Thomas Hellstrom <thellstrom@vmware.com> Signed-off-by: Dave Airlie <airlied@redhat.com>
2010-01-25drm/nv50: prevent switching off SOR when in use for DVI-over-DPBen Skeggs
Another hack because of us exposing each encoder block's function as an encoder rather than exposing a single encoder that deals with them all. A proper fix will come, it's just rather invasive so this hack will do until then. Signed-off-by: Ben Skeggs <bskeggs@redhat.com>
2010-01-25drm/nv50: fail auxch transaction if reply count not what we expectBen Skeggs
Signed-off-by: Ben Skeggs <bskeggs@redhat.com>
2010-01-25drm/nouveau: fix failure path if userspace specifies no valid memtypesBen Skeggs
We need to add the buffer to the list even if we fail, otherwise the validate_fini() call won't unreserve + unreference the GEM object, making TTM very unhappy. Signed-off-by: Ben Skeggs <bskeggs@redhat.com>
2010-01-25drm/nouveau: report LVDS as disconnected if lid closedBen Skeggs
Also adds a module option to ignore the status reported via ACPI, in case we hit systems with broken ACPI. Signed-off-by: Ben Skeggs <bskeggs@redhat.com>
2010-01-24drm/radeon/kms: fix legacy get_engine/memory clockAlex Deucher
Fix a bad shift in the post div. Should fix fdo bug 26145 Signed-off-by: Alex Deucher <alexdeucher@gmail.com> Signed-off-by: Dave Airlie <airlied@redhat.com>
2010-01-24drm/radeon/kms/atom: atom parser fixesAlex Deucher
Only reset the reg block on the initial execute table call; nested calls require the reg block not be reset on each call. Also reset the fb window and io mode. This matches the upstream parser behavior. Signed-off-by: Alex Deucher <alexdeucher@gmail.com> Signed-off-by: Dave Airlie <airlied@redhat.com>
2010-01-24drm/radeon/kms: clean up atombios pll codeAlex Deucher
- split pll adjust into a separate function - use a union for SetPixelClock params Signed-off-by: Alex Deucher <alexdeucher@gmail.com> Signed-off-by: Dave Airlie <airlied@redhat.com>
2010-01-24drm/radeon/kms: clean up pll structAlex Deucher
- add a new flag for fixed post div - pull the pll flags into the struct Signed-off-by: Alex Deucher <alexdeucher@gmail.com> Signed-off-by: Dave Airlie <airlied@redhat.com>
2010-01-24drm/radeon/kms/atom: fix crtc lock orderingAlex Deucher
This makes crtc_prepare and crtc_commit match. Signed-off-by: Alex Deucher <alexdeucher@gmail.com> Signed-off-by: Dave Airlie <airlied@redhat.com>
2010-01-21drm/radeon: r6xx/r7xx possible security issue, system ram accessJerome Glisse
This patch workaround a possible security issue which can allow user to abuse drm on r6xx/r7xx hw to access any system ram memory. This patch doesn't break userspace, it detect "valid" old use of CB_COLOR[0-7]_FRAG & CB_COLOR[0-7]_TILE registers and overwritte the address these registers are pointing to with the one of the last color buffer. This workaround will work for old mesa & xf86-video-ati and any old user which did use similar register programming pattern as those (we expect that there is no others user of those ioctl except possibly a malicious one). This patch add a warning if it detects such usage, warning encourage people to update their mesa & xf86-video-ati. New userspace will submit proper relocation. Fix for xf86-video-ati / mesa (this kernel patch is enough to prevent abuse, fix for userspace are to set proper cs stream and avoid kernel warning) : http://cgit.freedesktop.org/xorg/driver/xf86-video-ati/commit/?id=95d63e408cc88b6934bec84a0b1ef94dfe8bee7b http://cgit.freedesktop.org/mesa/mesa/commit/?id=46dc6fd3ed5ef96cda53641a97bc68c3bc104a9f Abusing this register to perform system ram memory is not easy, here is outline on how it could be achieve. First attacker must have access to the drm device and be able to submit command stream throught cs ioctl. Then attacker must build a proper command stream for r6xx/r7xx hw which will abuse the FRAG or TILE buffer to overwrite the GPU GART which is in VRAM. To achieve so attacker as to setup CB_COLOR[0-7]_FRAG or CB_COLOR[0-7]_TILE to point to the GPU GART, then it has to find a way to write predictable value into those buffer (with little cleverness i believe this can be done but this is an hard task). Once attacker have such program it can overwritte GPU GART to program GPU gart to point anywhere in system memory. It then can reusse same method as he used to reprogram GART to overwritte the system ram through the GART mapping. In the process the attacker has to be carefull to not overwritte any sensitive area of the GART table, like ring or IB gart entry as it will more then likely lead to GPU lockup. Bottom line is that i think it's very hard to use this flaw to get system ram access but in theory one can achieve so. Side note: I am not aware of anyone ever using the GPU as an attack vector, nevertheless we take great care in the opensource driver to try to detect and forbid malicious use of GPU. I don't think the closed source driver are as cautious as we are. Signed-off-by: Jerome Glisse <jglisse@redhat.com> Signed-off-by: Dave Airlie <airlied@linux.ie>
2010-01-21drm/radeon/kms: r600/r700 don't test ib if ib initialization failsJerome Glisse
If ib initialization failed don't try to test ib as it will result in an oops (accessing NULL ib buffer ptr). Signed-off-by: Jerome Glisse <jglisse@redhat.com> Signed-off-by: Dave Airlie <airlied@linux.ie>
2010-01-21drm/radeon/kms: Forbid creation of framebuffer with no valid GEM objectJerome Glisse
This will avoid oops if at later point the fb is use. Trying to create a framebuffer with no valid GEM object is bogus and should be forbidden as this patch does. Signed-off-by: Jerome Glisse <jglisse@redhat.com> Signed-off-by: Dave Airlie <airlied@linux.ie>
2010-01-21drm/radeon/kms: r600 handle irq vector ring overflowJerome Glisse
In some rare case i faced an irq overflow quickly followed by a GPU lockup (hard hang) this patch try to deal with irq vector ring overflow, so far haven't been able to reproduce it with the patch. Signed-off-by: Jerome Glisse <jglisse@redhat.com> Reviewed-by: Alex Deucher <alexdeucher@gmail.com> Signed-off-by: Dave Airlie <airlied@linux.ie>
2010-01-21drm/radeon/kms: r600/r700 don't process IRQ if not initializedJerome Glisse
In some rare case the wptr returned from the hw wasn't 0 and leaded to trick r600_process_irq that their were irq to process. Add a check to bail out if irq hasn't been initialized this will avoid oops provoqued by the rare wptr != 0 on initialization. Signed-off-by: Jerome Glisse <jglisse@redhat.com> Reviewed-by: Alex Deucher <alexdeucher@gmail.com> Signed-off-by: Dave Airlie <airlied@linux.ie>
2010-01-21drm/radeon/kms: r600/r700 disable irq at suspendJerome Glisse
To avoid hw doing anythings after we disabled PCIE GART, fully disable IRQ at suspend. Also cleanup a bit the ih structure and process function. Signed-off-by: Jerome Glisse <jglisse@redhat.com> Reviewed-by: Alex Deucher <alexdeucher@gmail.com> Signed-off-by: Dave Airlie <airlied@linux.ie>
2010-01-21drm/radeon/kms/r4xx: cleanup atom pathAlex Deucher
most of radeon_legacy_atom_set_surface() is taken care of in atombios_set_base(), so remove the duplicate setup and move the remaining bits (DISP_MERGE setup and FP2 sync) to atombios_crtc.c where they are used. Signed-off-by: Alex Deucher <alexdeucher@gmail.com> Signed-off-by: Dave Airlie <airlied@linux.ie>
generated by cgit v1.2.3 (git 2.25.1) at 2024-11-05 16:47:32 +0000