If you feed the tool a suitable bogus register map you can break it
in arbitary (code executing) ways. While this isn't a particularly
exciting or probable attack vector we still ought to fix it.
One of a set of sscanf issues reported by Jackie Chang
Signed-off-by: Alan Cox <alan@linux.intel.com>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
Correct spelling typo in various part of kernel
Signed-off-by: Masanari Iida <standby24x7@gmail.com>
Acked-by: Randy Dunlap <rdunlap@infradead.org>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
Reformat the help text to follow the style of the other Kconfig files,
and also fix indentation for the "select" lines.
Signed-off-by: Antonio Ospite <ospite@studenti.unina.it>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
Some additional fixes for 3.13. Regression fixes for audio and hw_i2c,
vram fix for some SI PX cards, race fix in the hwmon code, and a few other
odds and ends.
* 'drm-fixes-3.13' of git://people.freedesktop.org/~agd5f/linux:
drm/radeon/atom: fix bus probes when hw_i2c is set (v2)
drm/radeon: fix null pointer dereference in dce6+ audio code
drm/radeon: fixup bad vram size on SI
drm/radeon: fix VGT_GS_INSTANCE_CNT register
drm/radeon: Fix a typo in Cayman and Evergreen registers
drm/radeon/dpm: simplify state adjust logic for NI
drm/radeon: add radeon_vm_bo_update trace point
drm/radeon: add VMID allocation trace point
drm/radeon/dpm: Convert to use devm_hwmon_register_with_groups
drm/radeon: program DCE2 audio dto just like DCE3
drm/radeon: fix typo in fetching mpll params
Ensure the side-by-side (half) flag is added to any existing flags when
adding modes from 3D_Structure_ALL.
Signed-off-by: Thomas Wood <thomas.wood@intel.com>
Reviewed-by: Ville Syrjälä <ville.syrjala@linux.intel.com>
Signed-off-by: Dave Airlie <airlied@redhat.com>
Signed-off-by: Thomas Wood <thomas.wood@intel.com>
Reviewed-by: Ville Syrjälä <ville.syrjala@linux.intel.com>
Signed-off-by: Dave Airlie <airlied@redhat.com>
Some boards seem to have garbage in the upper
16 bits of the vram size register. Check for
this and clamp the size properly. Fixes
boards reporting bogus amounts of vram.
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Cc: stable@vger.kernel.org
Just flushing out my pile of bugfixes, most of them for regressions/cc:
stable. Nothing really serious going on.
For outstanding issues we still have the S4 fun due to the hsw S4
duct-tape pending (seems like I need to switch into angry maintainer mode
on that one). And there's the mode merging revert to make my g33 work
again still pending for drm core. For that one I don't have any more clue
(and it looks like no one else has a good idea either). And apparently the
locking WARN fix in here also needs to be replicated for boot, still
confirming that one though.
* tag 'drm-intel-fixes-2013-12-02' of git://people.freedesktop.org/~danvet/drm-intel:
drm/i915: Pin pages whilst allocating for dma-buf vmap()
drm/i915: MI_PREDICATE_RESULT_2 is HSW only
drm/i915: Make the DERRMR SRM target global GTT
drm/i915: use the correct force_wake function at the PC8 code
drm/i915: Fix pipe CSC post offset calculation
drm/i915: Simplify DP vs. eDP detection
drm/i915: Check VBT for eDP ports on VLV
drm/i915: use crtc_htotal in watermark calculations to match fastboot v2
drm/i915: Pin relocations for the duration of constructing the execbuffer
drm/i915: take mode config lock around crtc disable at suspend
drm/i915: Prefer setting PTE cache age to 3
drm/i915/ddi: set sink to power down mode on dp disable
This assortment of patches fix a few build and sparse warnings and make
sure to always return -EFAULT on copy_from_user() failures. Finally the
upcasting from struct drm_crtc to struct tegra_dc is made safer to
prevent potential segmentation faults.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2.0.22 (GNU/Linux)
iQIcBAABAgAGBQJSnaLrAAoJEN0jrNd/PrOhm+YP/jXPCBWuyMzbw6Sld0U9gs7c
xjxBuH7CwU5CCEA1OzBoQOf5ANrlbZ7rnbNoJzqPktss1TWADhBs8Yvn/SsOClwe
L+5yiVZ21pKXPOXpX2e4NlIrNqyq+USb+Ve3SfhNoWIcZyIjKosy66sQJBijo5ap
Kz+EpFcGjYePt3zhyIR4JOEtfjJd0gk2e72MBPFUtnteS9ecNt+ZGZaTse27xVn3
ogyvef7Vp2r097OO5QS9PnohPQffJMmU36dzfzzKIcvn7vg+3xuO7sZdzdEvErHh
eNXXJoFIpUA1xbrmrNLl0HcnCkwun+nrpEd29ceszqd0Pspz6TUdTj6Og5vjbCrZ
LhVBZQydTpQQoMmI9l12GmePvEhjgWDc68bRCjhuIlRa84+nXWglJ29cgrvEdBJA
/V1dRE1WAL+TkBK83LcjiwihrM/KKqILjgl8ta6D6Jyi0JGEjUQBY2JEYedt2/T6
y9nhZ8pwI/rbROS71AXWgMjHoKhS/D939jwCMo+3bLjn2Vi4QyyDJeahbVsiGNze
kUCcKVvWh3eJNSZYEnpWPNFQaFDxZhFPtr+kPCG9AB1w3yji/dluEOe8r/pUvHnn
KK87Jfcu8UaiusILW/k6h9skZAPbC/t8I9S50JgSeO1jDVMN8lqlv1IP32cGFVXm
j9ZbTEyeJN8VFVMs5r2E
=Du68
-----END PGP SIGNATURE-----
Merge tag 'drm/for-3.13-rc3' of git://anongit.freedesktop.org/tegra/linux into drm-fixes
drm/tegra: Fixes for v3.13-rc3
This assortment of patches fix a few build and sparse warnings and make
sure to always return -EFAULT on copy_from_user() failures. Finally the
upcasting from struct drm_crtc to struct tegra_dc is made safer to
prevent potential segmentation faults.
* tag 'drm/for-3.13-rc3' of git://anongit.freedesktop.org/tegra/linux:
drm/tegra: return -EFAULT if copy_from_user() fails
gpu: host1x: Fix a few sparse warnings
drm/tegra: Force cast to __iomem to make sparse happy
drm/tegra: Make tegra_drm_driver static
drm/tegra: Fix address space mismatches
drm/tegra: Tightly bind RGB output to DC
drm/tegra: Make CRTC upcasting safer
gpu: host1x: Silence a few warnings with LPAE=y
5dc9e1e8 was a bit over-ambitious, and accidentially removed handling
for imported prime buffers.
Signed-off-by: Rob Clark <robdclark@gmail.com>
Cc: stable@vger.kernel.org
Signed-off-by: Dave Airlie <airlied@redhat.com>
Fix some pageflip, oopses and some better clock support for some chipsets
* 'drm-nouveau-next' of git://anongit.freedesktop.org/git/nouveau/linux-2.6:
drm/nv50/disp: min/max are reversed in nv50_crtc_gamma_set()
drm/nouveau/sw: fix oops if gpu has its display block disabled
drm/nouveau: unreference fence after syncing
drm/nouveau/kms: send timestamp data for correct head in flip completion events
drm/nouveau/clk: Add support for NVAA/NVAC
drm/nouveau/fifo: Hook up pause and resume for NV50 and NV84+
drm/nv10/plane: some chipsets don't support NV12
drm/nv10/plane: add downscaling restrictions
drm/nv10/plane: fix format computation
drm/nv04-nv30/clk: provide an empty domain list
Some user-space apps expects to find them there.
Signed-off-by: Thomas Hellstrom <thellstrom@vmware.com>
Reviewed-by: Jakob Bornecrantz <jakob@vmware.com>
Also request kernel ttm_buffer objects for buffer objects that obviously
aren't visible to user-space, and save some device address space.
The accounting was broken in a couple of ways:
1) We did not differentiate between user dma buffers and kernel dma buffers.
2) The ttm_bo_acc_size function is broken in that it
a) Doesn't take into account the size of the optional dma address array,
b) Doesn't take into account the fact that drivers typically embed the
ttm_tt structure.
This needs to be fixed in ttm, but meanwhile provide a vmwgfx-specific
function to do the job.
Signed-off-by: Thomas Hellstrom <thellstrom@vmware.com>
Reviewed-by: Jakob Bornecrantz <jakob@vmware.com>
Allocation was duplicating code. Comments were missing.
Signed-off-by: Thomas Hellstrom <thellstrom@vmware.com>
Reviewed-by: Jakob Bornecrantz <jakob@vmware.com>
Failure to do this would make the drm_mode_get_crtc ioctl return
without crtc mode info, indicating that no mode was set.
Signed-off-by: Thomas Hellstrom <thellstrom@vmware.com>
Reviewed-by: Jakob Bornecrantz <jakob@vmware.com>
We should be taking the minimum here instead of the max. It could lead
to a buffer overflow.
Fixes: 438d99e3b1 ('drm/nvd0/disp: initial crtc object implementation')
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
a/drm/nv50_display.c b/drm/nv50_display.c
index f8e66c08b11a..4e384a2f99c3 100644
Otherwise none of the format checks pass, since the width was still in
16.16 encoding.
Signed-off-by: Ilia Mirkin <imirkin@alum.mit.edu>
Signed-off-by: Ben Skeggs <bskeggs@redhat.com>
copy_from_user() returns the number of bytes remaining if it fails, but
we want to return -EFAULT here.
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Thierry Reding <treding@nvidia.com>
The fbdev screen memory pointer is annotated __iomem, so cast the kernel
virtual address to that address space to make the warning go away.
Signed-off-by: Thierry Reding <treding@nvidia.com>
Previously the association to a DC was done via the encoder's .crtc
field. That has the disadvantage that when an encoder is detached from
its CRTC, that field is set to NULL, leading to situations where it is
impossible to access the DC registers required by the RGB output.
However, the coupling between DC and RGB output is really fixed on
Tegra. While they can be detached logically in DRM, the RGB output can
rely on the DC's existence.
Signed-off-by: Thierry Reding <treding@nvidia.com>
When upcasting a NULL CRTC object, propagate the NULL pointer instead of
some invalid pointer. This allows subsequent code to check that the cast
object is valid.
Signed-off-by: Thierry Reding <treding@nvidia.com>
This register was incorrect for evergreen and cayman.
Signed-off-by: Dave Airlie <airlied@redhat.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
According to documentation, 0x00008A60 should be PA_SU_LINE_STIPPLE_VALUE.
Signed-off-by: Alexandre Demers <alexandre.f.demers@gmail.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
This is based on a similar patch from Alexandre Demers.
While fixing up some warnings with that patch I saw some
additional cleanups that could be applied. This patch
simplifies the logic for patching the power state.
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Cc: Alexandre Demers <alexandre.f.demers@gmail.com>
Also rename the function to better reflect what it is doing.
agd5f: fix argument size warning
Signed-off-by: Christian König <christian.koenig@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Simplify the code and fix race condition seen because
attribute files were created after hwmon device registration.
Signed-off-by: Guenter Roeck <linux@roeck-us.net>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Copy-paste typo. Value should be 0-2, not 0-1.
Noticed-by: Sylvain BERTRAND <sylware@legeek.net>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Cc: stable@vger.kernel.org
This patch resolves a dead lock issue that could be incurred when
exynos_drm_crtc_dpms function was called.
The exynos_drm_crtc_dpms function waits for the completion of pended
page flip events. However, preclose callback - this releases all unhandled
page flip events - is called prior to the exynos_drm_crtc_dpms function call
when drm is closed. So at this time, this will make the exynos_drm_crtc_dpms
to wait infiniately for the completion of the page flip events.
This patch releases the unhandled page flip events at postclose instead
of preclose so that exynos_drm_crtc_dpms function can be waked up.
Changelog v2:
- fix a memory leak when drm is closed.
. it has a memory leak when a requeste page flip is handled after
drm_events_release() is called and before drm_fb_release()
is called. At this time, a drm_pending_event will not be freed.
So also this chage releases the drm_pending_event at postclose().
And it calls drm_vblank_put() for pair if there is any unhandled page
flip event.
Signed-off-by: Inki Dae <inki.dae@samsung.com>
Signed-off-by: Kyungmin Park <kyungmin.park@samsung.com>
During the vmap() routine for the dma-buf, we first grab the pages and
then try to allocate a temporary array to pass to the vmap(). However,
the shrinker can and will reap any object that is unbound if the
allocation for the array first fails. This includes the object which we
are attempting to vmap(). The solution is to mark the object's pages as
pinned whilst we try the allocation to prevent the use-after-free
introduced by the potential shrinkage.
Signed-off-by: Chris Wilson <chris@chris-wilson.co.uk>
Signed-off-by: Daniel Vetter <daniel.vetter@ffwll.ch>
The MI_PREDICATE_RESULT_2 register exits only on HSW. On other
platforms the same offset is either reserved, or contains some
other register. So write the register only on HSW.
This regression has been introduced in
commit 9435373ef8
Author: Rodrigo Vivi <rodrigo.vivi@gmail.com>
Date: Wed Aug 28 16:45:46 2013 -0300
drm/i915: Report enabled slices on Haswell GT3
Signed-off-by: Ville Syrjälä <ville.syrjala@linux.intel.com>
[danvet: Add regression notice.]
Signed-off-by: Daniel Vetter <daniel.vetter@ffwll.ch>
The ring scratch pages don't have a PPGTT mapping, so the DERRM SRM
should target the global GTT instead.
v2: Add MI_SRM_LRM_GLOBAL_GTT define for -fixes
Reviewed-by: Chris Wilson <chris@chris-wilson.co.uk>
Signed-off-by: Ville Syrjälä <ville.syrjala@linux.intel.com>
Signed-off-by: Daniel Vetter <daniel.vetter@ffwll.ch>
