Ben Skeggs [Fri, 23 Apr 2010 17:05:56 +0000 (03:05 +1000)]
drm/nv50: store full dcb i2c entry from vbios
Signed-off-by: Ben Skeggs <bskeggs@redhat.com>
Ben Skeggs [Thu, 22 Apr 2010 22:21:48 +0000 (08:21 +1000)]
drm/nv50: fix suspend/resume with DP outputs
Signed-off-by: Ben Skeggs <bskeggs@redhat.com>
Ben Skeggs [Thu, 22 Apr 2010 17:53:42 +0000 (03:53 +1000)]
drm/nv50: output calculated crtc pll when debugging on
Signed-off-by: Ben Skeggs <bskeggs@redhat.com>
Ben Skeggs [Thu, 22 Apr 2010 17:08:02 +0000 (03:08 +1000)]
drm/nouveau: dump pll limits entries when debugging is on
Signed-off-by: Ben Skeggs <bskeggs@redhat.com>
Ben Skeggs [Mon, 19 Apr 2010 16:28:37 +0000 (02:28 +1000)]
drm/nouveau: bios parser fixes for eDP boards
Signed-off-by: Ben Skeggs <bskeggs@redhat.com>
Ben Skeggs [Thu, 15 Apr 2010 04:42:34 +0000 (14:42 +1000)]
drm/nouveau: fix a nouveau_bo dereference after it's been destroyed
Signed-off-by: Ben Skeggs <bskeggs@redhat.com>
Ben Skeggs [Mon, 12 Apr 2010 03:35:10 +0000 (13:35 +1000)]
drm/nv40: remove some completed ctxprog TODOs
I actually thought these were gone already when the initial commit was
done.. I guess not!
Signed-off-by: Ben Skeggs <bskeggs@redhat.com>
Marcin Kościelnicki [Sun, 11 Apr 2010 18:41:38 +0000 (18:41 +0000)]
drm/nv04: Implement missing nv04 PGRAPH methods in software.
Signed-off-by: Marcin Kościelnicki <koriakin@0x04.net>
Signed-off-by: Ben Skeggs <bskeggs@redhat.com>
Marcin Kościelnicki [Sun, 11 Apr 2010 18:16:21 +0000 (18:16 +0000)]
drm/nouveau: Use 0x5f instead of 0x9f as imageblit on original NV10.
Signed-off-by: Marcin Kościelnicki <koriakin@0x04.net>
Signed-off-by: Ben Skeggs <bskeggs@redhat.com>
Dave Airlie [Wed, 19 May 2010 00:35:02 +0000 (10:35 +1000)]
drm/radeon: fix hdmi offset bug reported by smatch.
Reported-by: Dan Carpenter
Signed-off-by: Dave Airlie <airlied@redhat.com>
Alex Deucher [Tue, 18 May 2010 23:26:47 +0000 (19:26 -0400)]
drm/radeon/kms: hpd cleanup
- Use radeon hpd enum consistently (in both hotplug and dp)
- Legacy r100 with DVI should be HPD_1 not NONE
Signed-off-by: Alex Deucher <alexdeucher@gmail.com>
Signed-off-by: Dave Airlie <airlied@redhat.com>
Alex Deucher [Tue, 18 May 2010 23:26:46 +0000 (19:26 -0400)]
drm/radeon/kms: reset ddc_bus in object header parsing
Some LVDS connectors don't have a ddc bus, so reset the
ddc bus to invalid before parsing the next connector
to avoid using stale ddc bus data. Should fix
fdo bug 28164.
Signed-off-by: Alex Deucher <alexdeucher@gmail.com>
Cc: stable@kernel.org
Signed-off-by: Dave Airlie <airlied@redhat.com>
Ben Hutchings [Wed, 24 Mar 2010 03:36:31 +0000 (03:36 +0000)]
amd64-agp: Probe unknown AGP devices the right way
The current initialisation code probes 'unsupported' AGP devices
simply by calling its own probe function. It does not lock these
devices or even check whether another driver is already bound to
them.
We must use the device core to manage this. So if the specific
device id table didn't match anything and agp_try_unsupported=1,
switch the device id table and call driver_attach() again.
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
Signed-off-by: Dave Airlie <airlied@redhat.com>
Ben Hutchings [Wed, 24 Mar 2010 03:33:48 +0000 (03:33 +0000)]
sis-agp: Remove SIS 760, handled by amd64-agp
SIS 760 is listed in the device tables for both amd64-agp and sis-agp.
amd64-agp is apparently preferable since it has workarounds for some
BIOS misconfigurations that sis-agp doesn't handle.
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
Signed-off-by: Dave Airlie <airlied@redhat.com>
Dave Airlie [Tue, 18 May 2010 23:35:51 +0000 (09:35 +1000)]
Merge remote branch 'anholt/drm-intel-next' into drm-next
* anholt/drm-intel-next: (515 commits)
drm/i915: Fix out of tree builds
drm/i915: move fence lru to struct drm_i915_fence_reg
drm/i915: don't allow tiling changes on pinned buffers v2
drm/i915: Be extra careful about A/D matching for multifunction SDVO
drm/i915: Fix DDC bus selection for multifunction SDVO
drm/i915: cleanup mode setting before unmapping registers
drm/i915: Make fbc control wrapper functions
drm/i915: Wait for the GPU whilst shrinking, if truly desperate.
drm/i915: Use spatio-temporal dithering on PCH
[MTD] Remove zero-length files mtdbdi.c and internal.ho
pata_pcmcia / ide-cs: Fix bad hashes for Transcend and kingston IDs
libata: Fix several inaccuracies in developer's guide
slub: Fix bad boundary check in init_kmem_cache_nodes()
raid6: fix recovery performance regression
KEYS: call_sbin_request_key() must write lock keyrings before modifying them
KEYS: Use RCU dereference wrappers in keyring key type code
KEYS: find_keyring_by_name() can gain access to a freed keyring
ALSA: hda: Fix 0 dB for Packard Bell models using Conexant CX20549 (Venice)
ALSA: hda - Add quirk for Dell Inspiron 19T using a Conexant CX20582
ALSA: take tu->qlock with irqs disabled
...
Dave Airlie [Tue, 18 May 2010 09:00:14 +0000 (19:00 +1000)]
drm/radeon/pm: fix device_create_file return value checks.
print an error if these fail.
Signed-off-by: Dave Airlie <airlied@redhat.com>
Alex Deucher [Mon, 17 May 2010 23:41:26 +0000 (19:41 -0400)]
drm/radeon/kms/pm: fix r6xx+ profile setup
This patch is a combination of the previous two profile
patches, but without the index bugs. It cleans up and
fixes some issues with pm profile setup on r6xx chips.
Some tables have different orderings for the power states,
also, r600 only has 1 clock mode per power state. On
desktop cards there are no battery modes, so the low and high
power states are the same. For the low profile case, choose
the lower clock mode.
Signed-off-by: Alex Deucher <alexdeucher@gmail.com>
Signed-off-by: Dave Airlie <airlied@redhat.com>
Alex Deucher [Fri, 7 May 2010 20:58:27 +0000 (16:58 -0400)]
drm/radeon/kms/pm: make pm spam debug only
Signed-off-by: Alex Deucher <alexdeucher@gmail.com>
Signed-off-by: Dave Airlie <airlied@redhat.com>
Alex Deucher [Fri, 7 May 2010 19:10:16 +0000 (15:10 -0400)]
drm/radeon/kms/pm: rework power management
- Separate dynpm and profile based power management methods. You can select the pm method
by echoing the selected method ("dynpm" or "profile") to power_method in sysfs.
- Expose basic 4 profile in profile method
"default" - default clocks
"auto" - select between low and high based on ac/dc state
"low" - DC, low power mode
"high" - AC, performance mode
The current base profile is "default", but it should switched to "auto" once we've tested
on more systems. Switching the state is a matter of echoing the requested profile to
power_profile in sysfs. The lowest power states are selected automatically when dpms turns
the monitors off in all states but default.
- Remove dynamic fence-based reclocking for the moment. We can revisit this later once we
have basic pm in.
- Move pm init/fini to modesetting path. pm is tightly coupled with display state. Make sure
display side is initialized before pm.
- Add pm suspend/resume functions to make sure pm state is properly reinitialized on resume.
- Remove dynpm module option. It's now selectable via sysfs.
Signed-off-by: Alex Deucher <alexdeucher@gmail.com>
Signed-off-by: Dave Airlie <airlied@redhat.com>
Alex Deucher [Mon, 3 May 2010 05:13:14 +0000 (01:13 -0400)]
drm/radeon/kms/pm: add support for no display power states
The lowest power states often cause display problems, so only enable
them when all displays are off.
Signed-off-by: Alex Deucher <alexdeucher@gmail.com>
Signed-off-by: Dave Airlie <airlied@redhat.com>
Alex Deucher [Thu, 6 May 2010 15:02:24 +0000 (11:02 -0400)]
drm/radeon/kms: fix lock ordering in ring, ib handling
Signed-off-by: Alex Deucher <alexdeucher@gmail.com>
Signed-off-by: Dave Airlie <airlied@redhat.com>
Matthew Garrett [Fri, 30 Apr 2010 19:48:23 +0000 (15:48 -0400)]
radeon: Use fences to gate entry to reclocking on <r600
GUI idle interrupts don't seem to work terribly well on r500 and earlier,
so let's use a fence instead.
Signed-off-by: Matthew Garrett <mjg@redhat.com>
Signed-off-by: Dave Airlie <airlied@redhat.com>
Matthew Garrett [Fri, 30 Apr 2010 19:24:17 +0000 (15:24 -0400)]
radeon: Split out ring locking and allocation
We need to handle the ring while we've already locked it, so split out
the allocation and commit functions in order to allow them to be used.
Signed-off-by: Matthew Garrett <mjg@redhat.com>
Signed-off-by: Dave Airlie <airlied@redhat.com>
Alex Deucher [Fri, 30 Apr 2010 19:34:12 +0000 (15:34 -0400)]
drm/radeon/kms: enable misc pm power state features on r1xx-r4xx
voltage drop, dynamic voltage, dynamic sclk, pcie lane adjust, etc,
Signed-off-by: Alex Deucher <alexdeucher@gmail.com>
Signed-off-by: Dave Airlie <airlied@redhat.com>
Alex Deucher [Thu, 29 Apr 2010 20:33:38 +0000 (16:33 -0400)]
drm/radeon/kms: enable misc pm power state features on r5xx, rs6xx
voltage drop, dynamic voltage, dynamic sclk, pcie lane adjust, etc,
Signed-off-by: Alex Deucher <alexdeucher@gmail.com>
Signed-off-by: Dave Airlie <airlied@redhat.com>
Alex Deucher [Thu, 29 Apr 2010 20:14:02 +0000 (16:14 -0400)]
drm/radeon/kms: re-enable gui idle interrupts on r6xx+
Signed-off-by: Alex Deucher <alexdeucher@gmail.com>
Signed-off-by: Dave Airlie <airlied@redhat.com>
Dave Airlie [Thu, 29 Apr 2010 08:37:59 +0000 (18:37 +1000)]
drm/radeon/kms: take vram mutex pointer before derefing object.
since derefing the object might free it.
Signed-off-by: Dave Airlie <airlied@redhat.com>
Alex Deucher [Thu, 29 Apr 2010 04:22:43 +0000 (00:22 -0400)]
drm/radeon/kms: more pm fixes
- disable gui idle interrupt use
Seems to hang some r5xx chips
- move vbl range check into
existing vbl check function in
radeon_pm.c
- disable crtc mc acccess for the
whole reclocking process
Signed-off-by: Alex Deucher <alexdeucher@gmail.com>
Signed-off-by: Dave Airlie <airlied@redhat.com>
Ben Skeggs [Wed, 28 Apr 2010 01:46:42 +0000 (11:46 +1000)]
drm: move radeon_fixed.h to shared drm_fixed.h header
Will be used by nouveau driver also in the near future.
Signed-off-by: Ben Skeggs <bskeggs@redhat.com>
Signed-off-by: Dave Airlie <airlied@redhat.com>
Matthew Garrett [Wed, 28 Apr 2010 18:45:05 +0000 (14:45 -0400)]
radeon: Enable memory reclocking on r100-500
This seems to be relatively stable now, so enable it for these chipsets
too.
Signed-off-by: Matthew Garrett <mjg@redhat.com>
Signed-off-by: Dave Airlie <airlied@redhat.com>
Matthew Garrett [Wed, 28 Apr 2010 16:13:06 +0000 (12:13 -0400)]
radeon: Try harder to ensure we reclock in vblank
The vblank interrupt on r600 doesn't seem to be especially reliable, so
perform some sanity checks before the actual reclock.
Signed-off-by: Matthew Garrett <mjg@redhat.com>
Signed-off-by: Dave Airlie <airlied@redhat.com>
Matthew Garrett [Tue, 27 Apr 2010 21:16:58 +0000 (17:16 -0400)]
radeon: Fix locking in power management paths
The ttm code could take vram_mutex followed by cp_mutex, while the
reclocking code would do the reverse. Hilarity could ensue.
Signed-off-by: Matthew Garrett <mjg@redhat.com>
Signed-off-by: Dave Airlie <airlied@redhat.com>
Matthew Garrett [Tue, 27 Apr 2010 17:58:46 +0000 (13:58 -0400)]
radeon: Make sure that we determine the correct PM state before transition
We need to choose the correct PM state to transition into before starting
the actual change. Call radeon_get_power_state() at the top of the clock
setting to do so.
Signed-off-by: Matthew Garrett <mjg@redhat.com>
Signed-off-by: Dave Airlie <airlied@redhat.com>
Matthew Garrett [Mon, 26 Apr 2010 21:01:16 +0000 (17:01 -0400)]
radeon: Enable memory reclockong on r600
With luck, dynamic memory reclocking on r600 should be stable with
the previous patches. Enable it.
Signed-off-by: Matthew Garrett <mjg@redhat.com>
Signed-off-by: Dave Airlie <airlied@redhat.com>
Matthew Garrett [Mon, 26 Apr 2010 20:02:26 +0000 (16:02 -0400)]
radeon: Stop the ttm workqueue while reclocking
The ttm bo workqueue may touch objects while we're reclocking, so make
sure it's blocked until we're done.
Signed-off-by: Matthew Garrett <mjg@redhat.com>
Signed-off-by: Dave Airlie <airlied@redhat.com>
Matthew Garrett [Mon, 26 Apr 2010 20:00:09 +0000 (16:00 -0400)]
ttm: Provide an API for starting and stopping the delayed workqueue
We want to be able to prevent the delayed workqueue from changing state
while we're reclocking, so add an API to block and unblock it.
Signed-off-by: Matthew Garrett <mjg@redhat.com>
Signed-off-by: Dave Airlie <airlied@redhat.com>
Matthew Garrett [Mon, 26 Apr 2010 19:57:01 +0000 (15:57 -0400)]
radeon: Take drm struct_mutex over reclocking
We need to block the drm core from doing anything that may touch our vram
during reclock, so take the drm mutex for the duration.
Signed-off-by: Matthew Garrett <mjg@redhat.com>
Signed-off-by: Dave Airlie <airlied@redhat.com>
Matthew Garrett [Mon, 26 Apr 2010 19:52:20 +0000 (15:52 -0400)]
radeon: Unmap vram pages when reclocking
Touching vram while the card is reclocking can lead to lockups. Unmap
any pages that could be touched by the CPU and block any accesses to
vram until the reclocking is complete.
Signed-off-by: Matthew Garrett <mjg@redhat.com>
Signed-off-by: Dave Airlie <airlied@redhat.com>
Matthew Garrett [Mon, 26 Apr 2010 19:45:23 +0000 (15:45 -0400)]
radeon: Unify PM entry paths
There's a moderate amount of effort involved in setting the card up for
clock transitions, so unify the codepaths to make it easier to implement.
Signed-off-by: Matthew Garrett <mjg@redhat.com>
Signed-off-by: Dave Airlie <airlied@redhat.com>
Alex Deucher [Sat, 24 Apr 2010 18:50:23 +0000 (14:50 -0400)]
drm/radeon/kms/pm: rework power management
Add two new sysfs attributes:
- dynpm
- power_state
Echoing 0/1 to dynpm disables/enables dynamic power management.
The driver scales the sclk dynamically based on the number of
queued fences. dynpm only scales sclk dynamically in single head
mode.
Echoing x.y to power_state selects a static power state (x) and clock
mode (y). This allows you to statically select a power state and clock
mode. Selecting a static clock mode will disable dynpm.
Signed-off-by: Alex Deucher <alexdeucher@gmail.com>
Signed-off-by: Dave Airlie <airlied@redhat.com>
Alex Deucher [Fri, 23 Apr 2010 21:57:27 +0000 (17:57 -0400)]
drm/radeon/kms/pm: add additional asic callbacks
- pm_misc() - handles voltage, pcie lanes, and other non
clock related power mode settings. Currently disabled.
Needs further debugging
- pm_prepare() - disables crtc mem requests right now.
All memory clients need to be disabled when changing
memory clocks. This function can be expanded to include
disabling fb access as well.
- pm_finish() - enable active memory clients.
Signed-off-by: Alex Deucher <alexdeucher@gmail.com>
Signed-off-by: Dave Airlie <airlied@redhat.com>
Alex Deucher [Mon, 22 Mar 2010 17:31:08 +0000 (13:31 -0400)]
drm/radeon/kms/pm: restore default power state on exit
Signed-off-by: Alex Deucher <alexdeucher@gmail.com>
Signed-off-by: Dave Airlie <airlied@redhat.com>
Alex Deucher [Thu, 22 Apr 2010 18:25:19 +0000 (14:25 -0400)]
drm/radeon/kms: minor pm cleanups
- remove non_clock_info struct
- track power state misc flags
Signed-off-by: Alex Deucher <alexdeucher@gmail.com>
Signed-off-by: Dave Airlie <airlied@redhat.com>
Alex Deucher [Mon, 5 Apr 2010 19:26:43 +0000 (15:26 -0400)]
drm/radeon/kms/pm: clean power state printing
Signed-off-by: Alex Deucher <alexdeucher@gmail.com>
Signed-off-by: Dave Airlie <airlied@redhat.com>
Alex Deucher [Wed, 24 Mar 2010 15:32:29 +0000 (11:32 -0400)]
drm/radeon/kms/pm: don't enable pm if there is only on power state
Just adds overhead when the power state will never change.
Signed-off-by: Alex Deucher <alexdeucher@gmail.com>
Signed-off-by: Dave Airlie <airlied@redhat.com>
Alex Deucher [Thu, 22 Apr 2010 18:17:56 +0000 (14:17 -0400)]
drm/radeon/kms/atom: load hwmon drivers
Hook the atom table parsing up to module loading, so we can automatically
load the appropriate hwmon drivers.
Based on initial patch for r6xx from Matthew Garrett
Signed-off-by: Alex Deucher <alexdeucher@gmail.com>
Signed-off-by: Dave Airlie <airlied@redhat.com>
Alex Deucher [Mon, 22 Mar 2010 17:34:22 +0000 (13:34 -0400)]
drm/radeon/kms/pm: update display watermarks with power state changes
Signed-off-by: Alex Deucher <alexdeucher@gmail.com>
Signed-off-by: Dave Airlie <airlied@redhat.com>
Alex Deucher [Thu, 22 Apr 2010 18:03:55 +0000 (14:03 -0400)]
drm/radeon/kms/pm: add asic specific callbacks for getting power state (v2)
This also simplifies the code and enables reclocking with multiple heads
active by tracking whether the power states are single or multi-head
capable.
Eventually, we will want to select a power state based on external
factors (AC/DC state, user selection, etc.).
(v2) Update for evergreen
Signed-off-by: Alex Deucher <alexdeucher@gmail.com>
Signed-off-by: Dave Airlie <airlied@redhat.com>
Alex Deucher [Thu, 22 Apr 2010 17:38:05 +0000 (13:38 -0400)]
drm/radeon/kms/pm: add asic specific callbacks for setting power state (v2)
(v2) Add evergreen vbl checks
Signed-off-by: Alex Deucher <alexdeucher@gmail.com>
Signed-off-by: Dave Airlie <airlied@redhat.com>
Alex Deucher [Tue, 16 Mar 2010 21:42:46 +0000 (17:42 -0400)]
drm/radeon/kms/pm: move pm state update to crtc functions
crtcs are what we ultimately care about wrt to pm.
Signed-off-by: Alex Deucher <alexdeucher@gmail.com>
Signed-off-by: Dave Airlie <airlied@redhat.com>
Alex Deucher [Mon, 15 Mar 2010 21:09:05 +0000 (17:09 -0400)]
drm/radeon/kms/pm: interate across crtcs for vblank
Signed-off-by: Alex Deucher <alexdeucher@gmail.com>
Signed-off-by: Dave Airlie <airlied@redhat.com>
Alex Deucher [Thu, 22 Apr 2010 17:25:06 +0000 (13:25 -0400)]
drm/radeon/kms/atom/pm: rework power mode parsing
On pre-r6xx, the power mode array is usually ordered:
low
...
high
default
On r6xx+:
default
low
...
high
Signed-off-by: Alex Deucher <alexdeucher@gmail.com>
Signed-off-by: Dave Airlie <airlied@redhat.com>
Alex Deucher [Wed, 17 Mar 2010 18:29:15 +0000 (14:29 -0400)]
drm/radeon/kms: wait for gpu idle before changing power mode
set proper wait condition as noted by Rafał Miłecki.
Signed-off-by: Alex Deucher <alexdeucher@gmail.com>
Signed-off-by: Dave Airlie <airlied@redhat.com>
Alex Deucher [Thu, 22 Apr 2010 16:52:11 +0000 (12:52 -0400)]
drm/radeon/kms: add support for gui idle interrupts (v4)
Useful for certain power management operations. You
need to wait for the GUI engine (2D, 3D, CP, etc.) to be
idle before changing clocks or adjusting engine parameters.
(v2) Fix gui idle enable on pre-r6xx asics
(v3) The gui idle interrrupt status bit is permanently asserted
on pre-r6xx chips, but the interrrupt is still generated.
workaround it in the driver.
(v4) Add support for evergreen
Signed-off-by: Alex Deucher <alexdeucher@gmail.com>
Signed-off-by: Dave Airlie <airlied@redhat.com>
Alex Deucher [Thu, 22 Apr 2010 16:39:58 +0000 (12:39 -0400)]
drm/radeon/kms: add gui_idle callback
Check to see if the GUI engine and related blocks
(2D, 3D, CP, etc) are idle or not. There are a number
of cases when we need to know if the drawing engine
is busy.
Signed-off-by: Alex Deucher <alexdeucher@gmail.com>
Signed-off-by: Dave Airlie <airlied@redhat.com>
Dave Airlie [Fri, 7 May 2010 05:02:30 +0000 (05:02 +0000)]
drm/fbdev: fix cloning on fbcon
Simple cloning rules compared to server:
(a) single crtc
(b) > 1 connector active
(c) check command line mode
(d) try and find 1024x768 DMT mode if no command line.
(e) fail to clone
Signed-off-by: Dave Airlie <airlied@redhat.com>
Dave Airlie [Fri, 7 May 2010 06:42:51 +0000 (06:42 +0000)]
drm/fbdev: rework output polling to be back in the core. (v4)
After thinking it over a lot it made more sense for the core to deal with
the output polling especially so it can notify X.
v2: drop plans for fake connector - per Michel's comments - fix X patch sent to xorg-devel, add intel polled/hpd setting, add initial nouveau polled/hpd settings.
v3: add config lock take inside polling, add intel/nouveau poll init/fini calls
v4: config lock was a bit agressive, only needed around connector list reading.
otherwise it could re-enter.
glisse: discard drm_helper_hpd_irq_event
v3: Reviewed-by: Michel Dänzer <michel@daenzer.net>
Signed-off-by: Dave Airlie <airlied@redhat.com>
Dan Carpenter [Fri, 7 May 2010 08:38:20 +0000 (08:38 +0000)]
drm: off by one in drm_edid.c
m == num_est3_modes is one past the end of the est3_modes[].
Signed-off-by: Dan Carpenter <error27@gmail.com>
Reviewed-by: Adam Jackson <ajax@redhat.com>
Signed-off-by: Dave Airlie <airlied@redhat.com>
Marcin Slusarz [Sun, 16 May 2010 15:33:09 +0000 (17:33 +0200)]
vga16fb, drm: vga16fb->drm handoff
let vga16fb claim 0xA0000+0x10000 region as its aperture;
drm drivers don't use it, so we have to detect it and kick
vga16fb manually - but only if drm is driving the primary card
Signed-off-by: Marcin Slusarz <marcin.slusarz@gmail.com>
Cc: James Simmons <jsimmons@infradead.org>
Cc: Dave Airlie <airlied@redhat.com>
Cc: Ben Skeggs <bskeggs@redhat.com>
Signed-off-by: Dave Airlie <airlied@redhat.com>
Marcin Slusarz [Sun, 16 May 2010 15:29:56 +0000 (17:29 +0200)]
fbmem, drm/nouveau: kick firmware framebuffers as soon as possible
Currently vesafb/efifb/... is kicked when hardware driver is registering
framebuffer. To do it hardware must be fully functional, so there's a short
window between start of initialisation and framebuffer registration when
two drivers touch the hardware. Unfortunately sometimes it breaks nouveau
initialisation.
Fix it by kicking firmware driver(s) before we start touching the hardware.
Reported-by: Didier Spaier <didier.spaier@epsm.fr>
Tested-by: Didier Spaier <didier.spaier@epsm.fr>
Signed-off-by: Marcin Slusarz <marcin.slusarz@gmail.com>
Cc: Ben Skeggs <bskeggs@redhat.com>
Cc: Peter Jones <pjones@redhat.com>
Cc: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Dave Airlie <airlied@redhat.com>
Marcin Slusarz [Sun, 16 May 2010 15:27:03 +0000 (17:27 +0200)]
fbdev: allow passing more than one aperture for handoff
It removes a hack from nouveau code which had to detect which
region to pass to kick vesafb/efifb.
Signed-off-by: Marcin Slusarz <marcin.slusarz@gmail.com>
Cc: Eric Anholt <eric@anholt.net>
Cc: Ben Skeggs <bskeggs@redhat.com>
Cc: Thomas Hellstrom <thellstrom@vmware.com>
Cc: Dave Airlie <airlied@redhat.com>
Cc: Peter Jones <pjones@redhat.com>
Cc: Benjamin Herrenschmidt <benh@kernel.crashing.org>
Signed-off-by: Dave Airlie <airlied@redhat.com>
Kirill Smelkov [Fri, 14 May 2010 15:45:16 +0000 (19:45 +0400)]
drm: Prefix info printk about registering panic notifier with 'drm'
Recently I've studied my system dmesg and seen this:
<lots of stuff before>
1 [ 0.478416] ACPI: Battery Slot [C1B4] (battery present)
2 [ 0.478648] ACPI: Battery Slot [C1B3] (battery absent)
3 [ 0.906678] [drm] initialized overlay support
4 [ 1.762304] Console: switching to colour frame buffer device 128x48
5 [ 1.765211] fb0: inteldrmfb frame buffer device
6 [ 1.765242] registered panic notifier
7 [ 1.765272] [drm] Initialized i915 1.6.0
20080730 for 0000:00:02.0 on minor 0
8 [ 1.765372] Serial: 8250/16550 driver, 4 ports, IRQ sharing enabled
<lots of stuff after>
and it was not evident who registered that panic notifier on line 6.
I'd bought it as some low-level stuff needed by kernel itself, but the
time was inappropriate -- too late for such things.
So I had to study sources to see it was drm who was registering
switch-to-fb on panic.
Let's avoid possible confusion and mark this message as going from drm
subsystem.
(I'm a bit unsure whether to use '[drm]:' or 'drm:' -- the rest of the
kernel just uses 'topic:', and even in drm_fb_helper.c we use 'fb%d:'
without [] brackets. Either way is ok with me.)
Signed-off-by: Kirill Smelkov <kirr@landau.phys.spbu.ru>
Signed-off-by: Dave Airlie <airlied@redhat.com>
Jerome Glisse [Wed, 12 May 2010 16:01:13 +0000 (18:01 +0200)]
drm/radeon/kms: add query for crtc hw id from crtc id to get info V2
Userspace need to know the hw crtc id (0, 1, 2, ...) from the drm
crtc id. Bump the minor version so userspace can enable conditionaly
features depend on this.
V2 use num_crtc and avoid DRM_ERROR
Signed-off-by: Jerome Glisse <jglisse@redhat.com>
Signed-off-by: Dave Airlie <airlied@redhat.com>
Adam Jackson [Thu, 13 May 2010 18:55:28 +0000 (14:55 -0400)]
drm/edid: Fix 1024x768@85Hz
Having hsync both start and end on pixel 1072 ain't gonna work very
well. Matches the X server's list.
Signed-off-by: Adam Jackson <ajax@redhat.com>
Tested-By: Michael Tokarev <mjt@tls.msk.ru>
Cc: stable@kernel.org
Signed-off-by: Dave Airlie <airlied@redhat.com>
Julia Lawall [Thu, 13 May 2010 19:58:56 +0000 (21:58 +0200)]
drivers/gpu/drm: Use kzalloc
Use kzalloc rather than the combination of kmalloc and memset.
The semantic patch that makes this change is as follows:
(http://coccinelle.lip6.fr/)
// <smpl>
@@
expression x,size,flags;
statement S;
@@
-x = kmalloc(size,flags);
+x = kzalloc(size,flags);
if (x == NULL) S
-memset(x, 0, size);
// </smpl>
Signed-off-by: Julia Lawall <julia@diku.dk>
Reviewed-by: Corbin Simpson <MostAwesomeDude@gmail.com>
Reviewed-by: Matt Turner <mattst88@gmail.com>
Signed-off-by: Dave Airlie <airlied@redhat.com>
Dan Carpenter [Fri, 14 May 2010 11:06:19 +0000 (13:06 +0200)]
drm_edid: There should be 6 Standard Timings
Smatch complained that we initialize 6 elements in add_detailed_modes()
but the timings[] array is declared with 5 elements. Adam Jackson
verified that 6 is the correct number of timings.
On Mon, May 10, 2010 at 12:08:24PM -0400, Adam Jackson wrote:
> > > struct std_timing timings[5];
> > > ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
>
> This decl is wrong, should be 6. From the 1.4 spec:
>
> "Six additional Standard Timings may be listed as a display descriptor
> (tag #FAh)."
>
> The 1.3 spec is a little less explicit about it, but does show 6
> standard timing codes in the 0xFA detailed subblock, terminated by 0x0A
> in the 18th byte. I don't have the docs for 1.2 or earlier, but we're
> paranoid enough about not adding broken timings that we should be fine.
This patch is basically a clean up, because timings[] is declared inside
a union and increasing the number of elements here doesn't change the
overall size of the union.
Signed-off-by: Dan Carpenter <error27@gmail.com>
Signed-off-by: Dave Airlie <airlied@redhat.com>
Julia Lawall [Sat, 15 May 2010 21:17:40 +0000 (23:17 +0200)]
drivers/gpu/drm: Use kmemdup
Use kmemdup when some other buffer is immediately copied into the
allocated region.
A simplified version of the semantic patch that makes this change is as
follows: (http://coccinelle.lip6.fr/)
// <smpl>
@@
expression from,to,size,flag;
statement S;
@@
- to = \(kmalloc\|kzalloc\)(size,flag);
+ to = kmemdup(from,size,flag);
if (to==NULL || ...) S
- memcpy(to, from, size);
// </smpl>
Signed-off-by: Julia Lawall <julia@diku.dk>
Signed-off-by: Dave Airlie <airlied@redhat.com>
Randy Dunlap [Mon, 17 May 2010 17:54:04 +0000 (10:54 -0700)]
vga: fix kconfig text typos
Fix typos in vga/Kconfig file
and use GPU (upper case) consistently.
Signed-off-by: Randy Dunlap <randy.dunlap@oracle.com>
Cc: dri-devel@lists.freedesktop.org
Signed-off-by: Dave Airlie <airlied@redhat.com>
Dan Carpenter [Sun, 16 May 2010 06:27:52 +0000 (08:27 +0200)]
drm/edid: remove an unneeded variable
We don't use timing_level any more after:
9cf00977da0 "drm/edid: Unify
detailed block parsing between base and extension blocks".
Signed-off-by: Dan Carpenter <error27@gmail.com>
Signed-off-by: Dave Airlie <airlied@redhat.com>
Alex Deucher [Tue, 18 May 2010 04:30:05 +0000 (00:30 -0400)]
drm/radeon/kms/combios: match lvds panel info parsing to ddx
Should work better on some panels.
Signed-off-by: Alex Deucher <alexdeucher@gmail.com>
Signed-off-by: Dave Airlie <airlied@redhat.com>
Alex Deucher [Tue, 18 May 2010 04:23:15 +0000 (00:23 -0400)]
drm/radeon/kms/atom: fix typo in LVDS panel info parsing
Fixes LVDS issues on some laptops; notably laptops with
2048x1536 panels.
Signed-off-by: Alex Deucher <alexdeucher@gmail.com>
Cc: stable@kernel.org
Signed-off-by: Dave Airlie <airlied@redhat.com>
Alex Deucher [Sat, 8 May 2010 03:17:20 +0000 (23:17 -0400)]
drm/radeon/kms: fix copy pasto in disable encoders patch
Signed-off-by: Alex Deucher <alexdeucher@gmail.com>
Signed-off-by: Dave Airlie <airlied@redhat.com>
Peter Clifton [Mon, 3 May 2010 12:24:41 +0000 (13:24 +0100)]
drm/i915: Fix out of tree builds
Fixes up include paths for i915_trace.h by setting additional CFLAGS
for i915_trace_points.c to include the $src directory. The required
TRACE_INCLUDE_PATH is then "."
Signed-off-by: Peter Clifton <pcjc2@cam.ac.uk>
Signed-off-by: Eric Anholt <eric@anholt.net>
Daniel Vetter [Wed, 28 Apr 2010 09:02:31 +0000 (11:02 +0200)]
drm/i915: move fence lru to struct drm_i915_fence_reg
This lru tracks fences, not objects, so move it to where it belongs.
As a side effect, this nicely shrinks drm_i915_gem_object by two
pointers.
Signed-off-by: Daniel Vetter <daniel.vetter@ffwll.ch>
Signed-off-by: Eric Anholt <eric@anholt.net>
Daniel Vetter [Fri, 23 Apr 2010 21:01:01 +0000 (23:01 +0200)]
drm/i915: don't allow tiling changes on pinned buffers v2
Makes no sense and complicates matters for pipelined tiling changes.
So don't allow it and return -EBUSY.
v2: Fix reference leak. Thanks to Owain Ainsworth for spotting this.
Signed-off-by: Daniel Vetter <daniel.vetter@ffwll.ch>
Signed-off-by: Eric Anholt <eric@anholt.net>
Adam Jackson [Thu, 29 Apr 2010 18:05:18 +0000 (14:05 -0400)]
drm/i915: Be extra careful about A/D matching for multifunction SDVO
If we're both RGB and TMDS capable, we'll have set up one connector for
each. When determining connectivity, require analog/digital state in
the EDID block to match analog/digital support in the connector.
Otherwise, both DVI and VGA will appear to be connected.
Signed-off-by: Adam Jackson <ajax@redhat.com>
Signed-off-by: Eric Anholt <eric@anholt.net>
Adam Jackson [Fri, 23 Apr 2010 20:07:40 +0000 (16:07 -0400)]
drm/i915: Fix DDC bus selection for multifunction SDVO
Multifunction SDVO cards stopped working after
14571b4, and would report
something that looked remarkably like an ADD2 SPD ROM instead of EDID.
This appears to be because DDC bus selection was utterly horked by that
commit; controlled_output was no longer always a single bit, so
intel_sdvo_select_ddc_bus would pick bus 0, which is (unsurprisingly)
the SPD ROM bus, not a DDC bus.
So, instead of that, let's just use the DDC bus the child device table
tells us to use. I'm guessing at the bitmask and shifting from VBIOS
dumps, but it can't possibly be worse.
cf. https://bugzilla.redhat.com/584229
Signed-off-by: Adam Jackson <ajax@redhat.com>
Signed-off-by: Eric Anholt <eric@anholt.net>
Eric Anholt [Fri, 7 May 2010 21:30:03 +0000 (14:30 -0700)]
Merge remote branch 'origin/master' into drm-intel-next
Conflicts:
drivers/gpu/drm/i915/i915_dma.c
drivers/gpu/drm/i915/i915_drv.h
drivers/gpu/drm/radeon/r300.c
The BSD ringbuffer support that is landing in this branch
significantly conflicts with the Ironlake PIPE_CONTROL fix on master,
and requires it to be tested successfully anyway.
Alex Deucher [Fri, 7 May 2010 21:05:22 +0000 (17:05 -0400)]
drm/radeon/kms/atom: disable the encoders in encoder_disable
Previously we just set them to dpms off. This should save
additional power.
Signed-off-by: Alex Deucher <alexdeucher@gmail.com>
Signed-off-by: Dave Airlie <airlied@redhat.com>
Jesse Barnes [Fri, 26 Mar 2010 18:07:21 +0000 (11:07 -0700)]
drm/i915: cleanup mode setting before unmapping registers
We'll turn off outputs etc at unload time, so don't unmap the registers
before doing it.
Signed-off-by: Jesse Barnes <jbarnes@virtuousgeek.org>
Signed-off-by: Eric Anholt <eric@anholt.net>
Adam Jackson [Fri, 23 Apr 2010 15:17:39 +0000 (11:17 -0400)]
drm/i915: Make fbc control wrapper functions
Signed-off-by: Adam Jackson <ajax@redhat.com>
Signed-off-by: Eric Anholt <eric@anholt.net>
Chris Wilson [Tue, 20 Apr 2010 16:10:35 +0000 (17:10 +0100)]
drm/i915: Wait for the GPU whilst shrinking, if truly desperate.
By idling the GPU and discarding everything we can when under extreme
memory pressure, the number of OOM-killer events is dramatically
reduced. For instance, this makes it possible to run
firefox-planet-gnome.trace again on my swapless 512MiB i915.
Signed-off-by: Chris Wilson <chris@chris-wilson.co.uk>
Signed-off-by: Eric Anholt <eric@anholt.net>
Adam Jackson [Mon, 19 Apr 2010 19:57:25 +0000 (15:57 -0400)]
drm/i915: Use spatio-temporal dithering on PCH
Spatial dither is better than nothing, but ST is even better.
(from ajax's followup message:)
I noticed this with:
http://ajax.fedorapeople.org/YellowFlower.jpg
set as my desktop background in Gnome on a 1280x800 machine (in
particular, a Sony Vaio VPCB1 with 6-bit panel and a rather bright black
level). Easiest way to test this is by poking at PIPEACONF with
intel_reg_write directly:
% sudo intel_reg_write 0x70008 0xc0000040 # no dither
% sudo intel_reg_write 0x70008 0xc0000050 # spatial
% sudo intel_reg_write 0x70008 0xc0000054 # ST
I notice it especially strongly in the relatively flat dark area in the
top left. Closer than about 18" I can see a noticeable checkerboard
pattern with plain spatial dithering. ST smooths that out; I can still
tell that it's lacking color precision, but it's not offensive.
Signed-off-by: Adam Jackson <ajax@redhat.com>
Signed-off-by: Eric Anholt <eric@anholt.net>
Jerome Glisse [Wed, 5 May 2010 09:02:44 +0000 (11:02 +0200)]
drm/ttm: fix, avoid iomapping system memory
If the memory is not iomem we should not try to
ioremap it. Should fix :
https://bugs.freedesktop.org/show_bug.cgi?id=27822
Signed-off-by: Jerome Glisse <jglisse@redhat.com>
Tested-by: Rafał Miłecki <zajec5@gmail.com>
Signed-off-by: Dave Airlie <airlied@redhat.com>
Linus Torvalds [Wed, 5 May 2010 22:48:13 +0000 (15:48 -0700)]
Merge branch 'zerolen' of git://git./linux/kernel/git/jgarzik/misc-2.6
* 'zerolen' of git://git.kernel.org/pub/scm/linux/kernel/git/jgarzik/misc-2.6:
[MTD] Remove zero-length files mtdbdi.c and internal.ho
Linus Torvalds [Wed, 5 May 2010 22:47:57 +0000 (15:47 -0700)]
Merge branch 'upstream-linus' of git://git./linux/kernel/git/jgarzik/libata-dev
* 'upstream-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jgarzik/libata-dev:
pata_pcmcia / ide-cs: Fix bad hashes for Transcend and kingston IDs
libata: Fix several inaccuracies in developer's guide
Jeff Garzik [Wed, 5 May 2010 19:25:12 +0000 (15:25 -0400)]
[MTD] Remove zero-length files mtdbdi.c and internal.ho
Both were "removed" in commit
a33eb6b91034c95b9b08576f68be170f995b2c7d.
Signed-off-by: Jeff Garzik <jgarzik@redhat.com>
Kristoffer Ericson [Sun, 2 May 2010 19:48:24 +0000 (21:48 +0200)]
pata_pcmcia / ide-cs: Fix bad hashes for Transcend and kingston IDs
This patch fixes the bad hashes for one Kingston and one Transcend card.
Thanks to komuro for pointing this out.
Signed-off-by: Kristoffer Ericson <kristoffer.ericson@gmail.com>
Signed-off-by: Jeff Garzik <jgarzik@redhat.com>
Sergei Shtylyov [Wed, 5 May 2010 13:27:10 +0000 (17:27 +0400)]
libata: Fix several inaccuracies in developer's guide
Commit
6bfff31e77cfa1b13490337e5a4dbaa3407e83ac (libata: kill probe_ent
and related helpers) killed ata_device_add() but didn't remove references
to it from the libata developer's guide.
Commits
9363c3825ea9ad76561eb48a395349dd29211ed6 (libata: rename SFF
functions) and
5682ed33aae05d10a25c95633ef9d9c062825888 (libata: rename
SFF port ops) renamed the taskfile access methods but didn't update the
developer's guide. Commit
c9f75b04ed5ed65a058d18a8a8dda50632a96de8
(libata: kill ata_noop_dev_select()) didn't update the developer's
guide as well.
The guide also refers to the long gone ata_pio_data_xfer_noirq(),
ata_pio_data_xfer(), and ata_mmio_data_xfer() -- replace those by
the modern ata_sff_data_xfer_noirq(), ata_sff_data_xfer(), and
ata_sff_data_xfer32().
Also, remove the reference to non-existant ata_port_stop()...
Signed-off-by: Sergei Shtylyov <sshtylyov@ru.mvista.com>
Signed-off-by: Jeff Garzik <jgarzik@redhat.com>
Linus Torvalds [Wed, 5 May 2010 18:18:16 +0000 (11:18 -0700)]
Merge branch 'slab-for-linus' of git://git./linux/kernel/git/penberg/slab-2.6
* 'slab-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/penberg/slab-2.6:
slub: Fix bad boundary check in init_kmem_cache_nodes()
Zhang, Yanmin [Thu, 1 Apr 2010 09:32:30 +0000 (17:32 +0800)]
slub: Fix bad boundary check in init_kmem_cache_nodes()
Function init_kmem_cache_nodes is incorrect when checking upper limitation of
kmalloc_caches. The breakage was introduced by commit
91efd773c74bb26b5409c85ad755d536448e229c ("dma kmalloc handling fixes").
Acked-by: Christoph Lameter <cl@linux-foundation.org>
Signed-off-by: Pekka Enberg <penberg@cs.helsinki.fi>
Linus Torvalds [Wed, 5 May 2010 16:06:24 +0000 (09:06 -0700)]
Merge branch 'for-linus' of git://git./linux/kernel/git/jmorris/security-testing-2.6
* 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jmorris/security-testing-2.6:
KEYS: call_sbin_request_key() must write lock keyrings before modifying them
KEYS: Use RCU dereference wrappers in keyring key type code
KEYS: find_keyring_by_name() can gain access to a freed keyring
Linus Torvalds [Wed, 5 May 2010 14:56:36 +0000 (07:56 -0700)]
Merge branch 'for-linus' of git://git./linux/kernel/git/tj/wq
* 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tj/wq:
workqueue: flush_delayed_work: keep the original workqueue for re-queueing
Linus Torvalds [Wed, 5 May 2010 14:55:07 +0000 (07:55 -0700)]
Merge git://git./linux/kernel/git/davem/net-2.6
* git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-2.6:
FEC: Fix kernel panic in fec_set_mac_address.
ipv6: Fix default multicast hops setting.
net: ep93xx_eth stops receiving packets
drivers/net/phy: micrel phy driver
dm9601: fix phy/eeprom write routine
ppp_generic: handle non-linear skbs when passing them to pppd
ppp_generic: pull 2 bytes so that PPP_PROTO(skb) is valid
net: fix compile error due to double return type in SOCK_DEBUG
net/usb: initiate sync sequence in sierra_net.c driver
net/usb: remove default in Kconfig for sierra_net driver
r8169: Fix rtl8169_rx_interrupt()
e1000e: Fix oops caused by ASPM patch.
net/sb1250: register mdio bus in probe
sctp: Fix skb_over_panic resulting from multiple invalid parameter errors (CVE-2010-1173) (v4)
p54pci: fix bugs in p54p_check_tx_ring
Linus Torvalds [Wed, 5 May 2010 14:54:22 +0000 (07:54 -0700)]
Merge branch 'for-linus' of git://git./linux/kernel/git/tiwai/sound-2.6
* 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound-2.6:
ALSA: hda: Fix 0 dB for Packard Bell models using Conexant CX20549 (Venice)
ALSA: hda - Add quirk for Dell Inspiron 19T using a Conexant CX20582
ALSA: take tu->qlock with irqs disabled
ALSA: hda: Use olpc-xo-1_5 quirk for Toshiba Satellite P500-PSPGSC-01800T
ALSA: hda: Use olpc-xo-1_5 quirk for Toshiba Satellite Pro T130-15F
ALSA: hda - fix array indexing while creating inputs for Cirrus codecs
ALSA: es968: fix wrong PnP dma index
Linus Torvalds [Wed, 5 May 2010 14:53:18 +0000 (07:53 -0700)]
Merge branch 'for-linus' of git://git./linux/kernel/git/dtor/input
* 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/dtor/input:
Input: joydev - allow binding to button-only devices
Input: elantech - ignore high bits in the position coordinates
Input: elantech - allow forcing Elantech protocol
Input: elantech - fix firmware version check
Input: ati_remote - add some missing devices from lirc_atiusb
Input: eeti_ts - cancel pending work when going to suspend
Input: Add support of Synaptics Clickpad device
Revert "Input: ALPS - add signature for HP Pavilion dm3 laptops"
Input: psmouse - ignore parity error for basic protocols
Dan Williams [Wed, 5 May 2010 03:41:56 +0000 (20:41 -0700)]
raid6: fix recovery performance regression
The raid6 recovery code should immediately drop back to the optimized
synchronous path when a p+q dma resource is not available. Otherwise we
run the non-optimized/multi-pass async code in sync mode.
Verified with raid6test (NDISKS=255)
Applies to kernels >= 2.6.32.
Cc: <stable@kernel.org>
Acked-by: NeilBrown <neilb@suse.de>
Reported-by: H. Peter Anvin <hpa@zytor.com>
Signed-off-by: Dan Williams <dan.j.williams@intel.com>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
David Howells [Fri, 30 Apr 2010 13:32:23 +0000 (14:32 +0100)]
KEYS: call_sbin_request_key() must write lock keyrings before modifying them
call_sbin_request_key() creates a keyring and then attempts to insert a link to
the authorisation key into that keyring, but does so without holding a write
lock on the keyring semaphore.
It will normally get away with this because it hasn't told anyone that the
keyring exists yet. The new keyring, however, has had its serial number
published, which means it can be accessed directly by that handle.
This was found by a previous patch that adds RCU lockdep checks to the code
that reads the keyring payload pointer, which includes a check that the keyring
semaphore is actually locked.
Without this patch, the following command:
keyctl request2 user b a @s
will provoke the following lockdep warning is displayed in dmesg:
===================================================
[ INFO: suspicious rcu_dereference_check() usage. ]
---------------------------------------------------
security/keys/keyring.c:727 invoked rcu_dereference_check() without protection!
other info that might help us debug this:
rcu_scheduler_active = 1, debug_locks = 0
2 locks held by keyctl/2076:
#0: (key_types_sem){.+.+.+}, at: [<
ffffffff811a5b29>] key_type_lookup+0x1c/0x71
#1: (keyring_serialise_link_sem){+.+.+.}, at: [<
ffffffff811a6d1e>] __key_link+0x4d/0x3c5
stack backtrace:
Pid: 2076, comm: keyctl Not tainted 2.6.34-rc6-cachefs #54
Call Trace:
[<
ffffffff81051fdc>] lockdep_rcu_dereference+0xaa/0xb2
[<
ffffffff811a6d1e>] ? __key_link+0x4d/0x3c5
[<
ffffffff811a6e6f>] __key_link+0x19e/0x3c5
[<
ffffffff811a5952>] ? __key_instantiate_and_link+0xb1/0xdc
[<
ffffffff811a59bf>] ? key_instantiate_and_link+0x42/0x5f
[<
ffffffff811aa0dc>] call_sbin_request_key+0xe7/0x33b
[<
ffffffff8139376a>] ? mutex_unlock+0x9/0xb
[<
ffffffff811a5952>] ? __key_instantiate_and_link+0xb1/0xdc
[<
ffffffff811a59bf>] ? key_instantiate_and_link+0x42/0x5f
[<
ffffffff811aa6fa>] ? request_key_auth_new+0x1c2/0x23c
[<
ffffffff810aaf15>] ? cache_alloc_debugcheck_after+0x108/0x173
[<
ffffffff811a9d00>] ? request_key_and_link+0x146/0x300
[<
ffffffff810ac568>] ? kmem_cache_alloc+0xe1/0x118
[<
ffffffff811a9e45>] request_key_and_link+0x28b/0x300
[<
ffffffff811a89ac>] sys_request_key+0xf7/0x14a
[<
ffffffff81052c0b>] ? trace_hardirqs_on_caller+0x10c/0x130
[<
ffffffff81394fb9>] ? trace_hardirqs_on_thunk+0x3a/0x3f
[<
ffffffff81001eeb>] system_call_fastpath+0x16/0x1b
Signed-off-by: David Howells <dhowells@redhat.com>
Signed-off-by: James Morris <jmorris@namei.org>
David Howells [Fri, 30 Apr 2010 13:32:18 +0000 (14:32 +0100)]
KEYS: Use RCU dereference wrappers in keyring key type code
The keyring key type code should use RCU dereference wrappers, even when it
holds the keyring's key semaphore.
Reported-by: Vegard Nossum <vegard.nossum@gmail.com>
Signed-off-by: David Howells <dhowells@redhat.com>
Acked-by: Serge Hallyn <serue@us.ibm.com>
Signed-off-by: James Morris <jmorris@namei.org>
Toshiyuki Okajima [Fri, 30 Apr 2010 13:32:13 +0000 (14:32 +0100)]
KEYS: find_keyring_by_name() can gain access to a freed keyring
find_keyring_by_name() can gain access to a keyring that has had its reference
count reduced to zero, and is thus ready to be freed. This then allows the
dead keyring to be brought back into use whilst it is being destroyed.
The following timeline illustrates the process:
|(cleaner) (user)
|
| free_user(user) sys_keyctl()
| | |
| key_put(user->session_keyring) keyctl_get_keyring_ID()
| || //=> keyring->usage = 0 |
| |schedule_work(&key_cleanup_task) lookup_user_key()
| || |
| kmem_cache_free(,user) |
| . |[KEY_SPEC_USER_KEYRING]
| . install_user_keyrings()
| . ||
| key_cleanup() [<= worker_thread()] ||
| | ||
| [spin_lock(&key_serial_lock)] |[mutex_lock(&key_user_keyr..mutex)]
| | ||
| atomic_read() == 0 ||
| |{ rb_ease(&key->serial_node,) } ||
| | ||
| [spin_unlock(&key_serial_lock)] |find_keyring_by_name()
| | |||
| keyring_destroy(keyring) ||[read_lock(&keyring_name_lock)]
| || |||
| |[write_lock(&keyring_name_lock)] ||atomic_inc(&keyring->usage)
| |. ||| *** GET freeing keyring ***
| |. ||[read_unlock(&keyring_name_lock)]
| || ||
| |list_del() |[mutex_unlock(&key_user_k..mutex)]
| || |
| |[write_unlock(&keyring_name_lock)] ** INVALID keyring is returned **
| | .
| kmem_cache_free(,keyring) .
| .
| atomic_dec(&keyring->usage)
v *** DESTROYED ***
TIME
If CONFIG_SLUB_DEBUG=y then we may see the following message generated:
=============================================================================
BUG key_jar: Poison overwritten
-----------------------------------------------------------------------------
INFO: 0xffff880197a7e200-0xffff880197a7e200. First byte 0x6a instead of 0x6b
INFO: Allocated in key_alloc+0x10b/0x35f age=25 cpu=1 pid=5086
INFO: Freed in key_cleanup+0xd0/0xd5 age=12 cpu=1 pid=10
INFO: Slab 0xffffea000592cb90 objects=16 used=2 fp=0xffff880197a7e200 flags=0x200000000000c3
INFO: Object 0xffff880197a7e200 @offset=512 fp=0xffff880197a7e300
Bytes b4 0xffff880197a7e1f0: 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a ZZZZZZZZZZZZZZZZ
Object 0xffff880197a7e200: 6a 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b jkkkkkkkkkkkkkkk
Alternatively, we may see a system panic happen, such as:
BUG: unable to handle kernel NULL pointer dereference at
0000000000000001
IP: [<
ffffffff810e61a3>] kmem_cache_alloc+0x5b/0xe9
PGD
6b2b4067 PUD
6a80d067 PMD 0
Oops: 0000 [#1] SMP
last sysfs file: /sys/kernel/kexec_crash_loaded
CPU 1
...
Pid: 31245, comm: su Not tainted 2.6.34-rc5-nofixed-nodebug #2 D2089/PRIMERGY
RIP: 0010:[<
ffffffff810e61a3>] [<
ffffffff810e61a3>] kmem_cache_alloc+0x5b/0xe9
RSP: 0018:
ffff88006af3bd98 EFLAGS:
00010002
RAX:
0000000000000000 RBX:
0000000000000001 RCX:
ffff88007d19900b
RDX:
0000000100000000 RSI:
00000000000080d0 RDI:
ffffffff81828430
RBP:
ffffffff81828430 R08:
ffff88000a293750 R09:
0000000000000000
R10:
0000000000000001 R11:
0000000000100000 R12:
00000000000080d0
R13:
00000000000080d0 R14:
0000000000000296 R15:
ffffffff810f20ce
FS:
00007f97116bc700(0000) GS:
ffff88000a280000(0000) knlGS:
0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0:
0000000080050033
CR2:
0000000000000001 CR3:
000000006a91c000 CR4:
00000000000006e0
DR0:
0000000000000000 DR1:
0000000000000000 DR2:
0000000000000000
DR3:
0000000000000000 DR6:
00000000ffff0ff0 DR7:
0000000000000400
Process su (pid: 31245, threadinfo
ffff88006af3a000, task
ffff8800374414c0)
Stack:
0000000512e0958e 0000000000008000 ffff880037f8d180 0000000000000001
0000000000000000 0000000000008001 ffff88007d199000 ffffffff810f20ce
0000000000008000 ffff88006af3be48 0000000000000024 ffffffff810face3
Call Trace:
[<
ffffffff810f20ce>] ? get_empty_filp+0x70/0x12f
[<
ffffffff810face3>] ? do_filp_open+0x145/0x590
[<
ffffffff810ce208>] ? tlb_finish_mmu+0x2a/0x33
[<
ffffffff810ce43c>] ? unmap_region+0xd3/0xe2
[<
ffffffff810e4393>] ? virt_to_head_page+0x9/0x2d
[<
ffffffff81103916>] ? alloc_fd+0x69/0x10e
[<
ffffffff810ef4ed>] ? do_sys_open+0x56/0xfc
[<
ffffffff81008a02>] ? system_call_fastpath+0x16/0x1b
Code: 0f 1f 44 00 00 49 89 c6 fa 66 0f 1f 44 00 00 65 4c 8b 04 25 60 e8 00 00 48 8b 45 00 49 01 c0 49 8b 18 48 85 db 74 0d 48 63 45 18 <48> 8b 04 03 49 89 00 eb 14 4c 89 f9 83 ca ff 44 89 e6 48 89 ef
RIP [<
ffffffff810e61a3>] kmem_cache_alloc+0x5b/0xe9
This problem is that find_keyring_by_name does not confirm that the keyring is
valid before accepting it.
Skipping keyrings that have been reduced to a zero count seems the way to go.
To this end, use atomic_inc_not_zero() to increment the usage count and skip
the candidate keyring if that returns false.
The following script _may_ cause the bug to happen, but there's no guarantee
as the window of opportunity is small:
#!/bin/sh
LOOP=100000
USER=dummy_user
/bin/su -c "exit;" $USER || { /usr/sbin/adduser -m $USER; add=1; }
for ((i=0; i<LOOP; i++))
do
/bin/su -c "echo '$i' > /dev/null" $USER
done
(( add == 1 )) && /usr/sbin/userdel -r $USER
exit
Note that the nominated user must not be in use.
An alternative way of testing this may be:
for ((i=0; i<100000; i++))
do
keyctl session foo /bin/true || break
done >&/dev/null
as that uses a keyring named "foo" rather than relying on the user and
user-session named keyrings.
Reported-by: Toshiyuki Okajima <toshi.okajima@jp.fujitsu.com>
Signed-off-by: David Howells <dhowells@redhat.com>
Tested-by: Toshiyuki Okajima <toshi.okajima@jp.fujitsu.com>
Acked-by: Serge Hallyn <serue@us.ibm.com>
Signed-off-by: James Morris <jmorris@namei.org>
projects / GitHub / moto-9609 / android_kernel_motorola_exynos9610.git / log