this uses a new entrypoint to invalidate gart entries instead of using 0.
Changed to rather than pointing to 0 address point empty entry to dummy
page. This might help to avoid hard lockup if for some wrong
reasons GPU try to access unmapped GART entry.
I'm not 100% sure this is going to work, we probably need to allocate
a dummy page and point all the GTT entries at it similiar to what AGP does.
but we can test this first I suppose.
Signed-off-by: Jerome Glisse <jglisse@redhat.com>
Signed-off-by: Dave Airlie <airlied@redhat.com>
It's happened time and time again (most recently with the support for EDID
hardcoded in the BIOS ROM) that new code didn't check for rdev->bios being
non-NULL before triggering dereferences of it. This would result in an
oops/panic on setups with no BIOS ROM. Hopefully this central test will be
more robust.
Signed-off-by: Michel Dänzer <daenzer@vmware.com>
Signed-off-by: Dave Airlie <airlied@redhat.com>
This patch add cs checker to r600/r700 hw. Command stream checking
will rewrite some of the cs value in order to restrict GPU access
to BO size. This doesn't break old userspace but just enforce safe
value. It should break any things that was using the r600/r700 cs
ioctl to do forbidden things (malicious software), though we are
not aware of such things.
Here is the list of thing we check :
- enforcing resource size
- enforcing color buffer slice tile max, will restrict cb access
- enforcing db buffer slice tile max, will restrict db access
We don't check for shader bigger than the BO in which they are
supposed to be, such use would lead to GPU lockup and is harmless
from security POV, as far as we can tell (note that even checking
for this wouldn't prevent someone to write bogus shader that lead
to lockup).
This patch has received as much testing as humanly possible with
old userspace to check that it didn't break such configuration.
However not all the applications out there were tested, thus it
might broke some odd, rare applications.
[airlied: fix rules for cs checker for parallel builds]
Signed-off-by: Jerome Glisse <jglisse@redhat.com>
Signed-off-by: Dave Airlie <airlied@redhat.com>
Signed-off-by: Pavel Roskin <proski@gnu.org>
[clemens@ladisch.de: merged into drm_fb_helper]
Signed-off-by: Clemens Ladisch <clemens@ladisch.de>
Signed-off-by: Dave Airlie <airlied@redhat.com>
a patch from Roel was wrong, fix this properly, really
if the fb ptrs are different fb changed shuold be true.
Signed-off-by: Dave Airlie <airlied@redhat.com>
Kernel has simple_strtol() which would be used as atoi().
This is quite the same fix as in 2cb96f8662
("fbdev: drop custom atoi from drivers/video/modedb.c") because code in
drivers/gpu/drm/drm_fb_helper.c is based on drivers/video/modedb.c.
Signed-off-by: Andy Shevchenko <ext-andriy.shevchenko@nokia.com>
Cc: Jesse Barnes <jbarnes@virtuousgeek.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Dave Airlie <airlied@redhat.com>
These ioctls are all protected by their own locking mechanisms so
should be fine to not bother locking around.
Signed-off-by: Dave Airlie <airlied@redhat.com>
Mostly obvious simplifications.
The i915 pread/pwrite ioctls, intel_overlay_put_image and
nouveau_gem_new were incorrectly using the locked versions
without locking: this is also fixed in this patch.
Signed-off-by: Luca Barbieri <luca@luca-barbieri.com>
Signed-off-by: Dave Airlie <airlied@redhat.com>
This patch introduces the drm_gem_object_unreference_unlocked
and drm_gem_object_handle_unreference_unlocked functions that
do not require holding struct_mutex.
drm_gem_object_unreference_unlocked calls the new
->gem_free_object_unlocked entry point if available, and
otherwise just takes struct_mutex and just calls ->gem_free_object
Signed-off-by: Luca Barbieri <luca@luca-barbieri.com>
Signed-off-by: Dave Airlie <airlied@redhat.com>
This patch corrects a userspace pointer dereference in the VGA arbiter
in 2.6.32.1.
copy_from_user() is used at line 822 to copy the contents of buf into
kbuf, but a call to strncmp() on line 964 uses buf rather than kbuf. This
problem led to a GPF in strncmp() when X was started on my x86_32 systems.
X triggered the behavior with a write of "target PCI:0000:01:00.0" to
/dev/vga_arbiter.
The patch has been tested against 2.6.32.1 and observed to correct the GPF
observed when starting X or manually writing the string "target
PCI:0000:01:00.0" to /dev/vga_arbiter.
Signed-off-by: Andy Getzendanner <james.getzendanner@students.olin.edu>
Cc: Jesse Barnes <jbarnes@virtuousgeek.org>
Cc: <stable@kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Dave Airlie <airlied@redhat.com>
* 'drm-radeon-linus' of ../drm-next:
drm/radeon/kms: retry auxch on 0x20 timeout value.
drm/radeon: Skip dma copy test in benchmark if card doesn't have dma engine.
drm/radeon/kms: fix screen clearing before fbcon.
drm/radeon/kms: add quirk for VGA without DDC on rv730 XFX card.
drm/radeon/kms: don't crash if no DDC bus on VGA/DVI connector.
drm/radeon/kms: change Kconfig text to reflect the new option.
drm/radeon/kms: suspend and resume audio stuff
ATOM appears to return 0x20 which seems to mean some sort of timeout.
retry the transaction up to 10 times before failing, this
makes DP->VGA convertor we bought work at least a bit more predictably.
Signed-off-by: Dave Airlie <airlied@redhat.com>
original evergreen patches we against a kernel tree
without my radeon i2c algo changes.
Signed-off-by: Alex Deucher <alexdeucher@gmail.com>
Signed-off-by: Dave Airlie <airlied@redhat.com>
Fix a typo in crtc offset setup that set the crtc
instances wrong for all crtcs except the first.
Signed-off-by: Alex Deucher <alexdeucher@gmail.com>
Signed-off-by: Dave Airlie <airlied@redhat.com>
Pre-pcie chips seem to use the reference clock
rather than the sclk.
Signed-off-by: Alex Deucher <alexdeucher@gmail.com>
Signed-off-by: Dave Airlie <airlied@redhat.com>
radeon_copy_dma is only available for r200 or newer cards.
Call to radeon_copy_dma would result to NULL pointer
dereference if benchmarking asic without dma engine.
Signed-off-by: Pauli Nieminen <suokkos@gmail.com>
Signed-off-by: Dave Airlie <airlied@redhat.com>
* 'nouveau/for-airlied' of /home/airlied/kernel/drm-next:
nouveau: fix state detection with switchable graphics
drm/nouveau: move dereferences after null checks
drm/nv50: make the pgraph irq handler loop like the pre-nv50 version
drm/nv50: delete ramfc object after disabling fifo, not before
drm/nv50: avoid unloading pgraph context when ctxprog is running
drm/nv50: align size of buffer object to the right boundaries.
drm/nv50: disregard dac outputs in nv50_sor_dpms()
drm/nv50: prevent multiple init tables being parsed at the same time
drm/nouveau: make dp auxch xfer len check for reads only
drm/nv40: make INIT_COMPUTE_MEM a NOP, just like nv50
drm/nouveau: Add proper vgaarb support.
drm/nouveau: Fix fbcon on mixed pre-NV50 + NV50 multicard.
drivers/gpu/drm/nouveau/nouveau_grctx.c: correct NULL test
drm/nouveau: call ttm_bo_wait with the bo lock held to prevent hang
drm/nouveau: Fixup semaphores on pre-nv50 cards.
drm/nouveau: Add getparam to get available PGRAPH units.
drm/nouveau: Add module options to disable acceleration.
drm/nouveau: fix non-vram notifier blocks
Even if this bumps the version to 1 it does not mean the driver is
out of staging. From what we know this is the last backwards
incompatible change to the driver.
Signed-off-by: Jakob Bornecrantz <jakob@vmware.com>
Signed-off-by: Thomas Hellstrom <thellstrom@vmware.com>
Signed-off-by: Dave Airlie <airlied@redhat.com>
When time-based throttling is implemented, we need to bump minor.
When the old way of detecting scanout is removed, we need to bump major.
In the meantime, this change should not break existing user-space.
Signed-off-by: Thomas Hellstrom <thellstrom@vmware.com>
Signed-off-by: Jakob Bornecrantz <jakob@vmware.com>
Signed-off-by: Dave Airlie <airlied@redhat.com>
This will prevent things from falling over if the user frees the flip
buffer before we complete the flip, since we'll hold an internal
reference.
Reported-by: Kristian Høgsberg <krh@bitplanet.net>
Signed-off-by: Jesse Barnes <jbarnes@virtuousgeek.org>
Signed-off-by: Eric Anholt <eric@anholt.net>
Commit cbda12d77e (drm/i915: implement
new pm ops for i915) introduced the problem that if s2disk hibernation
is aborted, the system will crash, because i915_pm_freeze() does
nothing, while it should at least reverse some operations carried out
by i915_suspend().
Fix this issue by splitting the i915 suspend into a freeze part a
suspend part, where the latter is not executed before creating a
hibernation image, and the i915 resume into a "low-level" resume part
and a thaw part, where the former is not executed after the image has
been created.
Signed-off-by: Rafael J. Wysocki <rjw@sisk.pl>
Tested-by: Alan Jenkins <alan-jenkins@tuffmail.co.uk>
Signed-off-by: Eric Anholt <eric@anholt.net>
This memset_io was added to debug something way back and got
left behind, memset the fb to black so the borders don't be all white.
Signed-off-by: Dave Airlie <airlied@redhat.com>
The MI_DISPLAY_FLIP command needs to be set the same pipe
source image like in pipe source register, e.g source image
size minus one. This fixes screen corrupt issue on Ironlake.
Signed-off-by: Zhenyu Wang <zhenyuw@linux.intel.com>
Signed-off-by: Eric Anholt <eric@anholt.net>
On Ironlake plane flip interrupt means flip done event already, the
behavior is not like old chips, and perform like other usual interrupt.
So only need to handle flip done event when receiving that interrupt.
Signed-off-by: Zhenyu Wang <zhenyuw@linux.intel.com>
Signed-off-by: Eric Anholt <eric@anholt.net>
When a new page flip is requested, we need to both queue an unpin for
the current framebuffer, and also increment the flip pending count on
the newly submitted buffer.
At flip finish time, we need to unpin the old fb and decrement the flip
pending count on the new buffer.
The old code was conflating the two, and led to hangs when new direct
rendered apps were started, replacing the existing frame buffer. This
patch splits out the buffers and prevents the hangs.
Signed-off-by: Jesse Barnes <jbarnes@virtuousgeek.org>
Reviewed-by: Chris Wilson <chris@chris-wilson.co.uk>
Reviewed-by: Kristian Høgsberg <krh@bitplanet.net>
Signed-off-by: Eric Anholt <eric@anholt.net>
An untiled framebuffer must be aligned to 64k. This is normally handled
by intel_pin_and_fence_fb_obj(), but the intelfb_create() likes to be
different and do the pinning itself. However, it aligns the buffer
object incorrectly for pre-i965 chipsets causing a PGTBL_ERR when it is
installed onto the output.
Fixes:
KMS error message while initializing modesetting -
render error detected: EIR: 0x10 [i915]
http://bugs.freedesktop.org/show_bug.cgi?id=22936
Signed-off-by: Chris Wilson <chris@chris-wilson.co.uk>
Cc: stable@kernel.org
Signed-off-by: Eric Anholt <eric@anholt.net>
Before changing the status of a buffer with a pending write we will await
upon a new flush for that buffer. So we can take advantage of any flushes
posted whilst the buffer is active and pending processing by the GPU, by
clearing its write_domain and updating its last_rendering_seqno -- thus
saving a potential flush in deep queues and improves flushing behaviour
upon eviction for both GTT space and fences.
In order to reduce the time spent searching the active list for matching
write_domains, we move those to a separate list whose elements are
the buffers belong to the active/flushing list with pending writes.
Orignal patch by Chris Wilson <chris@chris-wilson.co.uk>, forward-ported
by me.
In addition to better performance, this also fixes a real bug. Before
this changes, i915_gem_evict_everything didn't work as advertised. When
the gpu was actually busy and processing request, the flush and subsequent
wait would not move active and dirty buffers to the inactive list, but
just to the flushing list. Which triggered the BUG_ON at the end of this
function. With the more tight dirty buffer tracking, all currently busy and
dirty buffers get moved to the inactive list by one i915_gem_flush operation.
I've left the BUG_ON I've used to prove this in there.
References:
Bug 25911 - 2.10.0 causes kernel oops and system hangs
http://bugs.freedesktop.org/show_bug.cgi?id=25911
Bug 26101 - [i915] xf86-video-intel 2.10.0 (and git) triggers kernel oops
within seconds after login
http://bugs.freedesktop.org/show_bug.cgi?id=26101
Signed-off-by: Daniel Vetter <daniel.vetter@ffwll.ch>
Signed-off-by: Chris Wilson <chris@chris-wilson.co.uk>
Tested-by: Adam Lantos <hege@playma.org>
Cc: stable@kernel.org
Signed-off-by: Eric Anholt <eric@anholt.net>
Got Ironlake DPLL parameter table, which reflects the hardware
optimized values. So this one trys to list DPLL parameters for
different output types, should potential fix clock issue seen
on new Arrandale CPUs.
This fixes DPLL setting failure on one 1920x1080 dual channel
LVDS for Ironlake. Test has also been made on LVDS panels with
smaller size and CRT/HDMI/DP ports for different monitors on
their all supported modes.
Update:
- Change name of double LVDS to dual LVDS.
- Fix SSC 120M reference clock to use the right range.
Cc: CSJ <changsijay@gmail.com>
Signed-off-by: Zhenyu Wang <zhenyuw@linux.intel.com>
Signed-off-by: Eric Anholt <eric@anholt.net>
Unset the bit that indicates that a ctxprog can continue at the end.
Signed-off-by: Maarten Maathuis <madman2003@gmail.com>
Signed-off-by: Ben Skeggs <bskeggs@redhat.com>
ramfc is zero'ed upon destruction, so it's safer to do things in the right
order.
Signed-off-by: Maarten Maathuis <madman2003@gmail.com>
Signed-off-by: Ben Skeggs <bskeggs@redhat.com>
- We need to disable pgraph fifo access before checking the current channel,
otherwise we could still hit a running ctxprog.
- The writes to 0x400500 are already handled by pgraph->fifo_access and are
therefore redundant, moreover pgraph fifo access should not be reenabled
before current context is set as invalid. So remove them altogether.
Signed-off-by: Maarten Maathuis <madman2003@gmail.com>
Signed-off-by: Ben Skeggs <bskeggs@redhat.com>
- In the current situation the padding that is added is dangerous to write
to, userspace could potentially overwrite parts of another bo.
- Depth and stencil buffers are supposed to be large enough in general so
the waste of memory should be acceptable.
- Alternatives are hiding the padding from users or splitting vram into 2
zones.
Signed-off-by: Maarten Maathuis <madman2003@gmail.com>
Signed-off-by: Ben Skeggs <bskeggs@redhat.com>
Fixes DVI+VGA on my 9400, and likely a lot of other configurations that
got broken by the previos DVI-over-DP fix.
Signed-off-by: Ben Skeggs <bskeggs@redhat.com>
With DVI and DP plugged, the DVI clock change interrupts being run can
cause DP link training to fail. This adds a spinlock around init table
parsing to prevent this.
Signed-off-by: Ben Skeggs <bskeggs@redhat.com>
machine is compatible is an OF-specific call. It should have
the of_ prefix to protect the global namespace.
Signed-off-by: Grant Likely <grant.likely@secretlab.ca>
Acked-by: Michal Simek <monstr@monstr.eu>
In particular, several occurances of funny versions of 'success',
'unknown', 'therefore', 'acknowledge', 'argument', 'achieve', 'address',
'beginning', 'desirable', 'separate' and 'necessary' are fixed.
Signed-off-by: Daniel Mack <daniel@caiaq.de>
Cc: Joe Perches <joe@perches.com>
Cc: Junio C Hamano <gitster@pobox.com>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
It appears we aren't required to do memory sizing ourselves on nv40
either. NV40 init tables read a strap from PEXTDEV_BOOT_0 into a
CRTC register, and then later use that value to select a memory
configuration (written to PFB_CFG0, just like INIT_COMPUTE_MEM on
earlier cards) with INIT_IO_RESTRICT_PROG.
Signed-off-by: Ben Skeggs <bskeggs@redhat.com>
We used single shared fbops struct and patched it at fb init time with
pointers to the right variant. On mixed multicard, this meant that
it was either sending NV50-style commands to all cards, or NV04-style
commands to all cards.
Signed-off-by: Marcin Kościelnicki <koriakin@0x04.net>
Signed-off-by: Ben Skeggs <bskeggs@redhat.com>
Test the just-allocated value for NULL rather than some other value.
The semantic patch that makes this change is as follows:
(http://coccinelle.lip6.fr/)
// <smpl>
@@
expression x,y;
statement S;
@@
x = \(kmalloc\|kcalloc\|kzalloc\)(...);
(
if ((x) == NULL) S
|
if (
- y
+ x
== NULL)
S
)
// </smpl>
Signed-off-by: Julia Lawall <julia@diku.dk>
Cc: David Airlie <airlied@linux.ie>
Cc: Ben Skeggs <bskeggs@redhat.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Ben Skeggs <bskeggs@redhat.com>
nouveau_gem_ioctl_cpu_prep calls ttm_bo_wait without the bo lock held.
ttm_bo_wait unlocks that lock, and so must be called with it held.
Currently this bug causes libdrm nouveau_bo_busy() to hang the machine.
Signed-off-by: Luca Barbieri <luca at luca-barbieri.com>
Acked-by: Maarten Maathuis <madman2003@gmail.com>
Signed-off-by: Francisco Jerez <currojerez@riseup.net>
Signed-off-by: Ben Skeggs <bskeggs@redhat.com>
