summaryrefslogtreecommitdiff
path: root/drivers/gpu/drm
AgeCommit message (Collapse)Author
2012-02-03vmwgfx: Fix assignment in vmw_framebuffer_create_handleRyan Mallon
commit bf9c05d5b6d19b3e4c9fe21047694e94f48db89b upstream. The assignment of handle in vmw_framebuffer_create_handle doesn't actually do anything useful and is incorrectly assigning an integer value to a pointer argument. It appears that this is a typo and should be dereferencing handle rather than assigning to it directly. This fixes a bug where an undefined handle value is potentially returned to user-space. Signed-off-by: Ryan Mallon <rmallon@gmail.com> Reviewed-by: Jakob Bornecrantz<jakob@vmware.com> Signed-off-by: Dave Airlie <airlied@redhat.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2012-02-03drm/i915: Re-enable gen7 RC6 and GPU turbo after resume.Eric Anholt
commit 04115a9dee110b52a8eaa556c574022fa3bf4704 upstream. Signed-off-by: Eric Anholt <eric@anholt.net> Reviewed-by: Keith Packard <keithp@keithp.com> Reviewed-by: Eugeni Dodonov <eugeni.dodonov@intel.com> Reviewed-by: Kenneth Graunke <kenneth@whitecape.org> Signed-off-by: Keith Packard <keithp@keithp.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2012-02-03drm/i915/sdvo: always set positive sync polarityPaulo Zanoni
commit ba68e086223a5f149f37bf8692c8cdbf1b0ba3ef upstream. This is a revert of 81a14b46846fea0741902e8d8dfcc6c6c78154c8. We already set the mode polarity using the SDVO commands with struct intel_sdvo_dtd. We have at least 3 bugs that get fixed with this patch. The documentation, despite not clear, can also be interpreted in a way that suggests this patch is needed. Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=15766 Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=42174 Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=43333 Reviewed-by: Eric Anholt <eric@anholt.net> Reviewed-by: Jesse Barnes <jbarnes@virtuousgeek.org> Signed-off-by: Paulo Zanoni <paulo.r.zanoni@intel.com> Signed-off-by: Keith Packard <keithp@keithp.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2012-02-03drm/i915: paper over missed irq issues with force wake voodooDaniel Vetter
commit 4cd53c0c8b01fc05c3ad5b2acdad02e37d3c2f55 upstream. Two things seem to do the trick on my ivb machine here: - prevent the gt from powering down while waiting for seqno notification interrupts by grabbing the force_wake in get_irq (and dropping it in put_irq again). - ordering writes from the ring's CS by reading a CS register, ACTHD seems to work. Only the blt&bsd ring on ivb seem to be massively affected by this, but for paranoia do this dance also on the render ring and on snb (i.e. all gpus with forcewake). Tested with Eric's glCopyPixels loop which without this patch scores a missed irq every few seconds. This patch needs my forcewake rework to use a spinlock instead of dev->struct_mutex. After crawling through docs a lot I've found the following nugget: Internal doc "SNB GT PM Programming Guide", Section 4.3.1: "GT does not generate interrupts while in RC6 (by design)" So it looks like rc6 and irq generation are indeed related. v2: Improve the comment per Eugeni Dodonov's suggestion. v3: Add the documentation snipped. Also restrict the w/a to ivb only for -fixes, as suggested by Keith Packard. Cc: Eric Anholt <eric@anholt.net> Cc: Kenneth Graunke <kenneth@whitecape.org> Cc: Eugeni Dodonov <eugeni.dodonov@intel.com> Tested-by: Eugeni Dodonov <eugeni.dodonov@intel.com> Reviewed-by: Eugeni Dodonov <eugeni.dodonov@intel.com> Signed-Off-by: Daniel Vetter <daniel.vetter@ffwll.ch> Signed-off-by: Keith Packard <keithp@keithp.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2012-02-03drm: Fix authentication kernel crashThomas Hellstrom
commit 598781d71119827b454fd75d46f84755bca6f0c6 upstream. If the master tries to authenticate a client using drm_authmagic and that client has already closed its drm file descriptor, either wilfully or because it was terminated, the call to drm_authmagic will dereference a stale pointer into kmalloc'ed memory and corrupt it. Typically this results in a hard system hang. This patch fixes that problem by removing any authentication tokens (struct drm_magic_entry) open for a file descriptor when that file descriptor is closed. Signed-off-by: Thomas Hellstrom <thellstrom@vmware.com> Reviewed-by: Daniel Vetter <daniel.vetter@ffwll.ch> Signed-off-by: Dave Airlie <airlied@redhat.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2012-02-03drm/radeon/kms: rework modeset sequence for DCE41 and DCE5Alex Deucher
commit 3a47824d85eeca122895646f027dc63480994199 upstream. dig transmitter control table only has ENABLE/DISABLE actions on DCE4.1/DCE5. Fixes: https://bugs.freedesktop.org/show_bug.cgi?id=44955 Signed-off-by: Alex Deucher <alexander.deucher@amd.com> Signed-off-by: Dave Airlie <airlied@redhat.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2012-02-03drm/radeon/kms: move panel mode setup into encoder mode setAlex Deucher
commit 386d4d751e8e0b4b693bb724f09aae064ee5297d upstream. Needs to happen earlier in the mode set. Signed-off-by: Alex Deucher <alexander.deucher@amd.com> Signed-off-by: Dave Airlie <airlied@redhat.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2012-02-03drm/radeon/kms: Add an MSI quirk for Dell RS690Alex Deucher
commit 44517c44496062180a6376cc704b33129441ce60 upstream. Interrupts only work with MSIs. https://bugs.freedesktop.org/show_bug.cgi?id=37679 Reported-by: Dmitry Podgorny <pasis.uax@gmail.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com> Signed-off-by: Dave Airlie <airlied@redhat.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2012-01-25radeon: Fix disabling PCI bus mastering on big endian hosts.Michel Dänzer
commit 3df96909b75835d487a9178761622b0cbd7310d4 upstream. It would previously write basically random bits to PCI configuration space... Not very surprising that the GPU tended to stop responding completely. The resulting MCE even froze the whole machine sometimes. Now resetting the GPU after a lockup has at least a fighting chance of succeeding. Signed-off-by: Michel Dänzer <michel.daenzer@amd.com> Reviewed-by: Alex Deucher <alexander.deucher@amd.com> Signed-off-by: Dave Airlie <airlied@redhat.com> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
2012-01-25drm/radeon/kms: disable writeback on pre-R300 asicsAlex Deucher
commit 28eebb703e28bc455ba704adb1026f76649b768c upstream. We often end up missing fences on older asics with writeback enabled which leads to delays in the userspace accel code, so just disable it by default on those asics. Reported-by: Helge Deller <deller@gmx.de> Reported-by: Dave Airlie <airlied@redhat.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com> Signed-off-by: Dave Airlie <airlied@redhat.com> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
2012-01-25drm/radeon/kms: workaround invalid AVI infoframe checksum issueRafał Miłecki
commit 92db7f6c860b8190571a9dc1fcbc16d003422fe8 upstream. This change was verified to fix both issues with no video I've investigated. I've also checked checksum calculation with fglrx on: RV620, HD54xx, HD5450, HD6310, HD6320. Signed-off-by: Rafał Miłecki <zajec5@gmail.com> Signed-off-by: Dave Airlie <airlied@redhat.com> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
2012-01-03drm/radeon/kms/atom: fix possible segfault in pm setupAlexander Müller
If we end up with no power states, don't look up current vddc. fixes: https://bugs.freedesktop.org/show_bug.cgi?id=44130 agd5f: fix patch formatting Signed-off-by: Alex Deucher <alexander.deucher@amd.com> Cc: stable@vger.kernel.org Signed-off-by: Dave Airlie <airlied@redhat.com>
2011-12-26drm/i915: Disable RC6 on Sandybridge by defaultKeith Packard
RC6 fails again. > I found my system freeze mostly during starting up X and KDE. Sometimes it > works for some minutes, sometimes it freezes immediatly. When the freeze > happens, everything is dead (even the reset button does not work, I need to > power cycle). > I disabled RC6, and my system runs wonderfully. > The system is a Z68 Pro board with Sandybridge i5-2500K processor, 8 > GB of RAM and UEFI firmware. Reported-by: Kai Krakow <hurikhan77@gmail.com> Signed-off-by: Keith Packard <keithp@keithp.com> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
2011-12-26drm/i915: Disable semaphores by default on SNBKeith Packard
Semaphores still cause problems on some machines: > From Udo Steinberg: > > With Linux-3.2-rc6 I'm frequently seeing GPU hangs when large amounts of > text scroll in an xterm, such as when extracting a tar archive. Such as this > one (note the timestamps): > > I can reproduce it fairly easily with something > as simple as: > > while true; do dmesg; done This patch turns them off on SNB while leaving them on for IVB. Reported-by: Udo Steinberg <udo@hypervisor.org> Cc: Daniel Vetter <daniel@ffwll.ch> Cc: Eugeni Dodonov <eugeni@dodonov.net> Signed-off-by: Keith Packard <keithp@keithp.com> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
2011-12-22vmwgfx: fix incorrect VRAM size check in vmw_kms_fb_create()Xi Wang
Commit e133e737 didn't correctly fix the integer overflow issue. - unsigned int required_size; + u64 required_size; ... required_size = mode_cmd->pitch * mode_cmd->height; - if (unlikely(required_size > dev_priv->vram_size)) { + if (unlikely(required_size > (u64) dev_priv->vram_size)) { Note that both pitch and height are u32. Their product is still u32 and would overflow before being assigned to required_size. A correct way is to convert pitch and height to u64 before the multiplication. required_size = (u64)mode_cmd->pitch * (u64)mode_cmd->height; This patch calls the existing vmw_kms_validate_mode_vram() for validation. Signed-off-by: Xi Wang <xi.wang@gmail.com> Reviewed-and-tested-by: Thomas Hellstrom <thellstrom@vmware.com> Signed-off-by: Dave Airlie <airlied@redhat.com>
2011-12-22drm/radeon/kms: bail on BTC parts if MC ucode is missingAlex Deucher
We already do this for cayman, need to also do it for BTC parts. The default memory and voltage setup is not adequate for advanced operation. Continuing will result in an unusable display. Signed-off-by: Alex Deucher <alexander.deucher@amd.com> Cc: stable@kernel.org Cc: Jean Delvare <khali@linux-fr.org> Signed-off-by: Dave Airlie <airlied@redhat.com>
2011-12-19vmwgfx: Clip cliprects against screen boundaries in present and dirtyJakob Bornecrantz
Signed-off-by: Jakob Bornecrantz <jakob@vmware.com> Reviewed-by: Thomas Hellstrom <thellstrom@vmware.com> Signed-off-by: Dave Airlie <airlied@redhat.com>
2011-12-19vmwgfx: Resend the cursor after legacy modesetJakob Bornecrantz
Signed-off-by: Jakob Bornecrantz <jakob@vmware.com> Reviewed-by: Thomas Hellstrom <thellstrom@vmware.com> Signed-off-by: Dave Airlie <airlied@redhat.com>
2011-12-19vmwgfx: Do better culling of presentsJakob Bornecrantz
Signed-off-by: Jakob Bornecrantz <jakob@vmware.com> Reviewed-by: Thomas Hellstrom <thellstrom@vmware.com> Signed-off-by: Dave Airlie <airlied@redhat.com>
2011-12-19vmwgfx: Refactor kms code to use vmw_user_lookup_handle helperJakob Bornecrantz
Signed-off-by: Jakob Bornecrantz <jakob@vmware.com> Signed-off-by: Thomas Hellstrom <thellstrom@vmware.com> Signed-off-by: Dave Airlie <airlied@redhat.com>
2011-12-19vmwgfx: Add helper function to get surface or dmabufJakob Bornecrantz
Signed-off-by: Jakob Bornecrantz <jakob@vmware.com> Reviewed-by: Thomas Hellstrom <thellstrom@vmware.com> Signed-off-by: Dave Airlie <airlied@redhat.com>
2011-12-19vmwgfx: Refactor cursor updateJakob Bornecrantz
Signed-off-by: Jakob Bornecrantz <jakob@vmware.com> Reviewed-by: Thomas Hellstrom <thellstrom@vmware.com> Signed-off-by: Dave Airlie <airlied@redhat.com>
2011-12-19vmwgfx: Remove dmabuf check in present ioctlJakob Bornecrantz
Doesn't protect any error code and only gets in the way of debugging. Signed-off-by: Jakob Bornecrantz <jakob@vmware.com> Reviewed-by: Thomas Hellstrom <thellstrom@vmware.com> Signed-off-by: Dave Airlie <airlied@redhat.com>
2011-12-19vmwgfx: Use the revised fifo hw version register when presentThomas Hellstrom
The driver implements the needed resource management required to use that register. Signed-off-by: Thomas Hellstrom <thellstrom@vmware.com> Reviewed-by: Jakob Bornecrantz <jakob@vmware.com> Signed-off-by: Dave Airlie <airlied@redhat.com>
2011-12-16Revert "drm/i915: fix infinite recursion on unbind due to ilk vt-d w/a"Linus Torvalds
This reverts commit eb1711bb94991e93669c5a1b5f84f11be2d51ea1. It blows up the i915 seqno tracking, resulting in the BUG_ON(seqno == 0); in i915_wait_request() triggering, which will cause lock-ups. See for example https://bugs.launchpad.net/ubuntu/+source/linux/+bug/903010 https://lkml.org/lkml/2011/12/14/395 Reported-requested-and-tested-by: Dirk Hohndel <dirk@hohndel.org> Reported-by: Richard Eames <Richard.Eames@flinders.edu.au> Reported-by: Rocko Requin <rockorequin@hotmail.com> Acked-by: Daniel Vetter <daniel.vetter@ffwll.ch> Cc: Dave Airlie <airlied@redhat.com> Cc: Chris Wilson <chris@chris-wilson.co.uk> Cc: Keith Packard <keithp@keithp.com> Cc: Eric Anholt <eric@anholt.net> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
2011-12-16Merge branch 'drm-intel-fixes' of git://people.freedesktop.org/~keithp/linuxLinus Torvalds
* 'drm-intel-fixes' of git://people.freedesktop.org/~keithp/linux: drm/i915/dp: Dither down to 6bpc if it makes the mode fit drm/i915: enable semaphores on per-device defaults drm/i915: don't set unpin_work if vblank_get fails drm/i915: By default, enable RC6 on IVB and SNB when reasonable iommu: Export intel_iommu_enabled to signal when iommu is in use drm/i915/sdvo: Include LVDS panels for the IS_DIGITAL check drm/i915: prevent division by zero when asking for chipset power drm/i915: add PCH info to i915_capabilities drm/i915: set the right SDVO transcoder for CPT drm/i915: no-lvds quirk for ASUS AT5NM10T-I drm/i915: Treat pre-gen4 backlight duty cycle value consistently drm/i915: Hook up Ivybridge eDP drm/i915: add multi-threaded forcewake support
2011-12-16drm/i915/dp: Dither down to 6bpc if it makes the mode fitAdam Jackson
Some active adaptors (VGA usually) only have two lanes at 2.7GHz. That's a maximum pixel clock of 144MHz at 8bpc, but 192MHz at 6bpc. Fixes Asus UX31 panel being black at startup due to no valid modes since dc22ee6fc18ce0f15424e753e8473c306ece95c1. v2: Rebased to current code, resulting in the fix applying to EDP panels as well. Also changed from spatio-temporal to just spatial dithering on pre-ironlake, to be conssitent (and less visual flicker) Signed-off-by: Adam Jackson <ajax@redhat.com> Signed-off-by: Eric Anholt <eric@anholt.net> Tested-by: Eric Anholt <eric@anholt.net> Tested-by: Dirk Hohndel <hohndel@infradead.org> Signed-off-by: Keith Packard <keithp@keithp.com>
2011-12-16drm/i915: enable semaphores on per-device defaultsEugeni Dodonov
This adds a default setting for semaphores parameter, and enables semaphores by default on IVB. For now, as semaphores interaction with VTd causes random issues on SNB, we do not enable them by default. But they can still be enabled via the semaphores=1 kernel parameter. v2: enables semaphores on SNB when IO remapping is disabled, with base on Keith Packard patch. CC: Daniel Vetter <daniel.vetter@ffwll.ch> CC: Ben Widawsky <ben@bwidawsk.net> CC: Keith Packard <keithp@keithp.com> CC: Jesse Barnes <jbarnes@virtuousgeek.org> CC: Chris Wilson <chris@chris-wilson.co.uk> Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=42696 Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=40564 Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=41353 Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=38862 Reviewed-by: Chris Wilson <chris@chris-wilson.co.uk> Reviewed-by: Daniel Vetter <daniel.vetter@ffwll.ch> Signed-off-by: Eugeni Dodonov <eugeni.dodonov@intel.com> Signed-off-by: Keith Packard <keithp@keithp.com>
2011-12-16drm/i915: don't set unpin_work if vblank_get failsJesse Barnes
This fixes a race where we may try to finish a page flip and decrement the refcount even if our vblank_get failed and we ended up with a spurious flip pending interrupt. Fixes https://bugs.freedesktop.org/show_bug.cgi?id=34211. Signed-off-by: Jesse Barnes <jbarnes@virtuousgeek.org> Signed-off-by: Keith Packard <keithp@keithp.com>
2011-12-16drm/i915: By default, enable RC6 on IVB and SNB when reasonableKeith Packard
RC6 should always work on IVB, and should work on SNB whenever IO remapping is disabled. RC6 never works on Ironlake. Make the default value for the parameter follow these guidelines. Setting the value to either 0 or 1 will force the specified behavior. Signed-off-by: Keith Packard <keithp@keithp.com> Reviewed-by: Kenneth Graunke <kenneth@whitecape.org> Reviewed-by: Eugeni Dodonov <eugeni.dodonov@intel.com> Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=38567 Cc: Ted Phelps <phelps@gnusto.com> Cc: Peter <pab1612@gmail.com> Cc: Lukas Hejtmanek <xhejtman@fi.muni.cz> Cc: Andrew Lutomirski <luto@mit.edu>
2011-12-16drm/i915/sdvo: Include LVDS panels for the IS_DIGITAL checkChris Wilson
We were checking whether the supplied edid matched the connector it was read from. We do this in case a DDC read returns an EDID for another device on a multifunction or otherwise interesting card. However, we failed to include LVDS as a digital device and so rejecting an otherwise valid EDID. Fixes the detection of the secondary SDVO LVDS panel on the Libretto W105. Signed-off-by: Chris Wilson <chris@chris-wilson.co.uk> Reviewed-by: Adam Jackson <ajax@redhat.com> Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=39216 Signed-off-by: Keith Packard <keithp@keithp.com>
2011-12-16drm/i915: prevent division by zero when asking for chipset powerEugeni Dodonov
This prevents an in-kernel division by zero which happens when we are asking for i915_chipset_val too quickly, or within a race condition between the power monitoring thread and userspace accesses via debugfs. The issue can be reproduced easily via the following command: while ``; do cat /sys/kernel/debug/dri/0/i915_emon_status; done This is particularly dangerous because it can be triggered by a non-privileged user by just reading the debugfs entry. This issue was also found independently by Konstantin Belousov <kostikbel@gmail.com>, who proposed a similar patch. Reported-by: Konstantin Belousov <kostikbel@gmail.com> Acked-by: Jesse Barnes <jbarnes@virtuousgeek.org> Acked-by: Keith Packard <keithp@keithp.com> Reviewed-by: Chris Wilson <chris@chris-wilson.co.uk> Cc: <stable@vger.kernel.org> Signed-off-by: Eugeni Dodonov <eugeni.dodonov@intel.com> Signed-off-by: Keith Packard <keithp@keithp.com>
2011-12-16drm/i915: add PCH info to i915_capabilitiesPaulo Zanoni
Signed-off-by: Chris Wilson <chris@chris-wilson.co.uk> Signed-off-by: Paulo Zanoni <paulo.r.zanoni@intel.com> Signed-off-by: Keith Packard <keithp@keithp.com>
2011-12-16drm/i915: set the right SDVO transcoder for CPTPaulo Zanoni
v2: add a CPT-specific macro, make code cleaner v3: fix commit message Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=41272 Cc: stable@kernel.org Signed-off-by: Paulo Zanoni <paulo.r.zanoni@intel.com> Reviewed-by: Chris Wilson <chris@chris-wilson.co.uk> Signed-off-by: Keith Packard <keithp@keithp.com>
2011-12-16drm/i915: no-lvds quirk for ASUS AT5NM10T-IAdam Jackson
https://bugzilla.redhat.com/show_bug.cgi?id=750006 Signed-off-by: Adam Jackson <ajax@redhat.com> Signed-off-by: Keith Packard <keithp@keithp.com>
2011-12-07vmwgfx: Use kcalloc instead of kzalloc to allocate arrayThomas Meyer
The advantage of kcalloc is, that will prevent integer overflows which could result from the multiplication of number of elements and size and it is also a bit nicer to read. The semantic patch that makes this change is available in https://lkml.org/lkml/2011/11/25/107 Signed-off-by: Thomas Meyer <thomas@m3y3r.de> Reviewed-by: Jakob Bornecrantz <jakob@vmware.com> Signed-off-by: Dave Airlie <airlied@redhat.com>
2011-12-07drm/i915: fix infinite recursion on unbind due to ilk vt-d w/aDaniel Vetter
The recursion loop goes retire_requests->unbind->gpu_idle->retire_reqeusts. Every time we go through this we need a - active object that can be retired - and there are no other references to that object than the one from the active list, so that it gets unbound and freed immediately. Otherwise the recursion stops. So the recursion is only limited by the number of objects that fit these requirements sitting in the active list any time retire_request is called. Issue exercised by tests/gem_unref_active_buffers from i-g-t. There's been a decent bikeshed discussion whether it wouldn't be better to pass around a flag, but imo this is o.k. for such a limited case that only supports a w/a. Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=42180 Signed-Off-by: Daniel Vetter <daniel.vetter@ffwll.ch> Reviewed-by: Chris Wilson <chris@chris-wilson> [ickle- we built better bikesheds, but this keeps the rain off for now] Tested-by: Dave Airlie <airlied@redhat.com> Signed-off-by: Dave Airlie <airlied@redhat.com>
2011-12-07drm/radeon/kms: fix return type for radeon_encoder_get_dp_bridge_encoder_idAlex Deucher
Seems like something got mis-merged here. Noticed by kallisti5 on IRC. Signed-off-by: Alex Deucher <alexander.deucher@amd.com> Signed-off-by: Dave Airlie <airlied@redhat.com>
2011-12-02vmwgfx: integer overflow in vmw_kms_update_layout_ioctl()Xi Wang
There are two issues in vmw_kms_update_layout_ioctl(). First, the for loop forgets to index rects and only checks the first element. Second, there is a potential integer overflow if userspace passes in a large arg->num_outputs. The call to kzalloc() would allocate a small buffer, leading to out-of-bounds read. Reported-by: Haogang Chen <haogangchen@gmail.com> Signed-off-by: Xi Wang <xi.wang@gmail.com> Signed-off-by: Thomas Hellstrom <thellstrom@vmware.com> Signed-off-by: Dave Airlie <airlied@redhat.com>
2011-12-02drm/radeon/kms: fix 2D tiling CS support on EG/CMAlex Deucher
Fixes: https://bugs.freedesktop.org/show_bug.cgi?id=43191 Signed-off-by: Alex Deucher <alexander.deucher@amd.com> Signed-off-by: Dave Airlie <airlied@redhat.com>
2011-12-02drm/radeon/kms: fix scanout of 2D tiled buffers on EG/CMAlex Deucher
Fixes: https://bugs.freedesktop.org/show_bug.cgi?id=43191 Signed-off-by: Alex Deucher <alexander.deucher@amd.com> Signed-off-by: Dave Airlie <airlied@redhat.com>
2011-12-02drm: Fix lack of CRTC disable for drm_crtc_helper_set_config(.fb=NULL)Chris Wilson
Disabling the CRTC by setting its framebuffer to NULL, as used by drm_framebuffer_cleanup(), was failing to pass the current framebuffer to the crtc_func->disable callback. This is because of the dance within drm_crtc_helper_set_config to pass the new_fb (NULL in this case) to the drm_crtc_helper_set_mode with the currently attached fb as a parameter. drm_crtc_helper_set_mode treats this as a no-op and the encoder is still enabled. And so the current fb is forgotten before the call to drm_helper_disable_unused_functions. This patch treats disabling the CRTC as a simple special case rather than adding further complexity into the configuration logic. This fixes a pin-leak of the fb bo on Xserver close. Signed-off-by: Chris Wilson <chris@chris-wilson.co.uk> Signed-off-by: Dave Airlie <airlied@redhat.com>
2011-12-01drm/radeon/kms: Skip ACPI call to ATIF when possibleJean Delvare
I am under the impression that it only makes sense to call the ATIF method if the graphics device has an ACPI handle attached. So we could skip the call altogether if there is no such handle. Signed-off-by: Jean Delvare <jdelvare@suse.de> Reviewed-by: Alex Deucher <alexander.deucher@amd.com> Signed-off-by: Dave Airlie <airlied@redhat.com>
2011-12-01drm/radeon/kms: Hide debugging messageJean Delvare
Use the proper macro to issue the debugging message in radeon_atif_call(). Otherwise we spam the log of many systems with a message which looks like an error message of unknown origin, and could thus confuse the user. Commit dc77de12dde95c8da39e4c417eb70c7d445cf84b was a first step in this direction, but was not sufficient IMHO. Signed-off-by: Jean Delvare <jdelvare@suse.de> Reviewed-by: Alex Deucher <alexander.deucher@amd.com> Signed-off-by: Dave Airlie <airlied@redhat.com>
2011-12-01drm/radeon/kms: add some loop timeouts in pageflip codeAlex Deucher
Avoid infinite loops waiting for surface updates if a GPU reset happens while waiting for a page flip. See: https://bugs.freedesktop.org/show_bug.cgi?id=43191 Signed-off-by: Alex Deucher <alexander.deucher@amd.com> Cc: stable@kernel.org Reviewed-by: Mario Kleiner <mario.kleiner@tuebingen.mpg.de> Tested-by: Simon Farnsworth <simon.farnsworth@onelan.co.uk> Signed-off-by: Dave Airlie <airlied@redhat.com>
2011-12-01Merge branch 'drm-nouveau-fixes' of ↵Dave Airlie
git://git.freedesktop.org/git/nouveau/linux-2.6 into drm-fixes * 'drm-nouveau-fixes' of git://git.freedesktop.org/git/nouveau/linux-2.6: drm/nv50/disp: silence compiler warning drm/nouveau: fix oopses caused by clear being called on unpopulated ttms drm/nouveau: Keep RAMIN heap within the channel. drm/nvd0/disp: fix sor dpms typo, preventing dpms on in some situations drm/nvc0/gr: fix TP init for transform feedback offset queries drm/nouveau: add dumb ioctl support
2011-11-30drm/nv50/disp: silence compiler warningBen Skeggs
NFI why this only started appearing now. The use of the uninitialised var can't actually happen, so perhaps my compiler just got stupider. Signed-off-by: Ben Skeggs <bskeggs@redhat.com>
2011-11-30drm/nouveau: fix oopses caused by clear being called on unpopulated ttmsBen Skeggs
Signed-off-by: Ben Skeggs <bskeggs@redhat.com>
2011-11-30drm/nouveau: Keep RAMIN heap within the channel.Younes Manton
The entire RAMIN is allocated to be 'size', but the heap is specified as 'base' + 'size' inside RAMIN, so it will overflow past RAMIN by 'base' bytes on NV50+ and clobber other allocatons unless it's size is adjusted. Signed-off-by: Younes Manton <younes.m@gmail.com> Signed-off-by: Ben Skeggs <bskeggs@redhat.com>
2011-11-30drm/nvd0/disp: fix sor dpms typo, preventing dpms on in some situationsBen Skeggs
Signed-off-by: Ben Skeggs <bskeggs@redhat.com>