Properly verify that the resulting page aligned end address is larger
than both the start address and the length of the memory area requested.
Both the start and length arguments for ib_umem_get are controlled by
the user. A misbehaving user can provide values which will cause an
integer overflow when calculating the page aligned end address.
This overflow can cause also miscalculation of the number of pages
mapped, and additional logic issues.
Addresses: CVE-2014-8159
Cc: <stable@vger.kernel.org>
Signed-off-by: Shachar Raindel <raindel@mellanox.com>
Signed-off-by: Jack Morgenstein <jackm@mellanox.com>
Signed-off-by: Or Gerlitz <ogerlitz@mellanox.com>
Signed-off-by: Roland Dreier <roland@purestorage.com>
As there isn't a way for the firmware on the Nyan Chromebooks to hand
over the display to the kernel, and the kernel isn't redoing the whole
configuration at present.
With this patch, the SOR is brought to a known state and we get correct
display on every boot.
Signed-off-by: Tomeu Vizoso <tomeu.vizoso@collabora.com>
Signed-off-by: Thierry Reding <treding@nvidia.com>
On 64-bit targets, tegra_gem_mmap() only returns a partial offset to
userspace. As such, subsequent calls to mmap(2) may fail. Change the
arguments to use a 64-bit offset to fix this.
Signed-off-by: Sean Paul <seanpaul@chromium.org>
Acked-by: Erik Faye-Lund <kusmabite@gmail.com>
[treding@nvidia.com: tweak commit message]
Signed-off-by: Thierry Reding <treding@nvidia.com>
This function is called by output drivers so should be documented. While
at it, move it to a more appropriate location.
Signed-off-by: Thierry Reding <treding@nvidia.com>
The ->mode_set() and ->mode_set_base() callbacks are no longer used with
full atomic mode-setting drivers, so remove them.
Signed-off-by: Thierry Reding <treding@nvidia.com>
The tegra_dc_setup_clock() function is unused after the conversion to
atomic mode-setting, so remove it.
Signed-off-by: Thierry Reding <treding@nvidia.com>
Instead of duplicating the code, make use of the newly introduced atomic
state duplicate and destroy helpers. This allows changes to the base
atomic state handling to automatically propagate to the Tegra driver and
thereby prevent breakage resulting from both copies going out of sync.
Signed-off-by: Thierry Reding <treding@nvidia.com>
Drivers that subclass CRTC, plane or connector state need to carefully
duplicate the code that the atomic helpers have. This is bound to cause
breakage eventually because it requires auditing all drivers and update
them when code is added to the helpers.
In order to avoid that, implement new helpers that perform the required
steps when copying and destroying state. These new helpers are exported
so that state-subclassing drivers can use them. The default helpers are
implemented using them as well, providing a single location that needs
to be changed when adding to base atomic states.
Reviewed-by: Daniel Vetter <daniel.vetter@ffwll.ch>
Reviewed-by: Eric Anholt <eric@anholt.net>
Signed-off-by: Thierry Reding <treding@nvidia.com>
The display controller on Tegra can use syncpoints to count VBLANK
events. syncpoints are 32-bit unsigned integers, so well suited as
VBLANK counters.
Signed-off-by: Thierry Reding <treding@nvidia.com>
This function is used to read the current value of the syncpt and is
useful in situations where drivers don't schedule work and wait for the
syncpoint to increment. One particular use-case is using the syncpoint
as a VBLANK counter.
Signed-off-by: Thierry Reding <treding@nvidia.com>
Use a sized unsigned 32-bit data type (u32) to store register contents.
The SOR registers are 32 bits wide irrespective of the architecture's
data width.
Signed-off-by: Thierry Reding <treding@nvidia.com>
The Tegra DRM driver uses a single IO virtual address space for buffer
mappings. Provide a table of the address space usage in debugfs.
Signed-off-by: Thierry Reding <treding@nvidia.com>
Check that the desired parent clock is indeed a valid parent for the
display controller clock. This is purely cosmetic at this point since
the parent clocks are specified in DT and all the currently defined
parents are in fact valid parents of the display controller clock.
Signed-off-by: Thierry Reding <treding@nvidia.com>
Some of the CYCLE_ACTIVITY.* events can only be scheduled on
counter 2. Due to a typo Haswell matched those with
INTEL_EVENT_CONSTRAINT, which lead to the events never
matching as the comparison does not expect anything
in the umask too. Fix the typo.
Signed-off-by: Andi Kleen <ak@linux.intel.com>
Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
Link: http://lkml.kernel.org/r/1425925222-32361-1-git-send-email-andi@firstfloor.org
Signed-off-by: Ingo Molnar <mingo@kernel.org>
For supporting Intel LBR branches filtering, Intel LBR sharing logic
mechanism is introduced from commit b36817e886 ("perf/x86: Add Intel
LBR sharing logic"). It modifies __intel_shared_reg_get_constraints() to
config lbr_sel, which is finally used to set LBR_SELECT.
However, the intel_shared_regs_constraints() function is called after
intel_pebs_constraints(). The PEBS event will return immediately after
intel_pebs_constraints(). So it's impossible to filter branches for PEBS
events.
This patch moves intel_shared_regs_constraints() ahead of
intel_pebs_constraints().
We can safely do that because the intel_shared_regs_constraints() function
only returns empty constraint if its rejecting the event, otherwise it
returns NULL such that we continue calling intel_pebs_constraints() and
x86_get_event_constraint().
Signed-off-by: Kan Liang <kan.liang@intel.com>
Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
Cc: eranian@google.com
Link: http://lkml.kernel.org/r/1427467105-9260-1-git-send-email-kan.liang@intel.com
Signed-off-by: Ingo Molnar <mingo@kernel.org>
We need to wait for all fences, not just the exclusive one.
Signed-off-by: Christian König <christian.koenig@amd.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
We somehow try to free the SG table twice.
Bugs: https://bugs.freedesktop.org/show_bug.cgi?id=89734
Signed-off-by: Christian König <christian.koenig@amd.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
When performing a modeset, use the framebuffer pitch value to set FIMD
IMG_SIZE and Mixer SPAN registers. These are both defined as pitch - the
distance between contiguous lines (bytes for FIMD, pixels for mixer).
Fixes display on Snow (1366x768).
Signed-off-by: Daniel Stone <daniels@collabora.com>
Tested-by: Javier Martinez Canillas <javier.martinez@collabora.co.uk>
Signed-off-by: Inki Dae <inki.dae@samsung.com>
This patch fixes an error in kgdb for x86_64 which would report
the value of dx when asked to give the value of si.
Signed-off-by: Steffen Liebergeld <steffen.liebergeld@kernkonzept.com>
Cc: Jason Wessel <jason.wessel@windriver.com>
Cc: linux-kernel@vger.kernel.org
Signed-off-by: Ingo Molnar <mingo@kernel.org>
When I wrote the opportunistic SYSRET code, I missed an important difference
between SYSRET and IRET.
Both instructions are capable of setting EFLAGS.TF, but they behave differently
when doing so:
- IRET will not issue a #DB trap after execution when it sets TF.
This is critical -- otherwise you'd never be able to make forward progress when
returning to userspace.
- SYSRET, on the other hand, will trap with #DB immediately after
returning to CPL3, and the next instruction will never execute.
This breaks anything that opportunistically SYSRETs to a user
context with TF set. For example, running this code with TF set
and a SIGTRAP handler loaded never gets past 'post_nop':
extern unsigned char post_nop[];
asm volatile ("pushfq\n\t"
"popq %%r11\n\t"
"nop\n\t"
"post_nop:"
: : "c" (post_nop) : "r11");
In my defense, I can't find this documented in the AMD or Intel manual.
Fix it by using IRET to restore TF.
Signed-off-by: Andy Lutomirski <luto@kernel.org>
Cc: Borislav Petkov <bp@alien8.de>
Cc: Borislav Petkov <bp@suse.de>
Cc: Brian Gerst <brgerst@gmail.com>
Cc: Denys Vlasenko <dvlasenk@redhat.com>
Cc: H. Peter Anvin <hpa@zytor.com>
Cc: Linus Torvalds <torvalds@linux-foundation.org>
Cc: Thomas Gleixner <tglx@linutronix.de>
Fixes: 2a23c6b8a9 ("x86_64, entry: Use sysret to return to userspace when possible")
Link: http://lkml.kernel.org/r/9472f1ca4c19a38ecda45bba9c91b7168135fcfa.1427923514.git.luto@kernel.org
Signed-off-by: Ingo Molnar <mingo@kernel.org>
The legcy colorkey ioctls are only implemented for sprite planes, so
reject the ioctl for primary/cursor planes. If we want to support
colorkeying with these planes (assuming we have hw support of course)
we should just move ahead with the colorkey property conversion.
Testcase: kms_legacy_colorkey
Cc: Tommi Rantala <tt.rantala@gmail.com>
Cc: stable@vger.kernel.org
Reference: http://mid.gmane.org/CA+ydwtr+bCo7LJ44JFmUkVRx144UDFgOS+aJTfK6KHtvBDVuAw@mail.gmail.com
Reported-and-tested-by: Tommi Rantala <tt.rantala@gmail.com>
Signed-off-by: Ville Syrjälä <ville.syrjala@linux.intel.com>
Reviewed-by: Daniel Vetter <daniel.vetter@ffwll.ch>
Signed-off-by: Jani Nikula <jani.nikula@intel.com>
This change adds the support in mdp5 kms driver for single
and dual DSI. Dual DSI case depends on the framework API
and sequence change to support dual data path.
v1: Initial change
v2: Address Rob Clark's comment
- Separate command mode encoder to a new file mdp5_cmd_encoder.c
- Rebase to not depend on msm_drm_sub_dev change
Signed-off-by: Hai Li <hali@codeaurora.org>
Signed-off-by: Rob Clark <robdclark@gmail.com>
This change adds the DSI connector support in msm drm driver.
v1: Initial change
v2:
- Address comments from Archit + minor clean-ups
- Rebase to not depend on msm_drm_sub_dev change [Rob's comment]
v3: Fix issues when initialization is failed
Signed-off-by: Hai Li <hali@codeaurora.org>
Signed-off-by: Rob Clark <robdclark@gmail.com>
This change is to add an interface to MDP for connector devices
setting split display information.
Signed-off-by: Hai Li <hali@codeaurora.org>
Signed-off-by: Rob Clark <robdclark@gmail.com>
This change is to make the content in construct_encoder reflect its
name.
Also, DSI connector may be connected to video mode or command mode
encoder, so that 2 different encoders need to be constructed for DSI.
Signed-off-by: Hai Li <hali@codeaurora.org>
Signed-off-by: Rob Clark <robdclark@gmail.com>
Normally these are called from within drm core, from the EDID parsing
code. But for dual-dsi in some drivers (at least drm/msm) we need to
call these from the driver. So they should be exported.
Signed-off-by: Rob Clark <robdclark@gmail.com>
Acked-by: Dave Airlie <airlied@redhat.com>
This TODO can now be removed and replaced by the previous patch
"drm/msm/mdp5: Update headers (add CTL flush bits)"
Signed-off-by: Stephane Viau <sviau@codeaurora.org>
Signed-off-by: Rob Clark <robdclark@gmail.com>
Some upcoming targets have more bits to set in CTL_FLUSH
registers.
Example: msm8x16 needs to set TIMING1 bit so that some of the
INTF1's interface registers get flushed.
Signed-off-by: Stephane Viau <sviau@codeaurora.org>
Signed-off-by: Rob Clark <robdclark@gmail.com>
This change adds the hw configuration for msm8x16 chipsets in
mdp5_cfg module.
Note that only one external display interface is present in this
configuration (DSI) but has not been enabled yet. It will be enabled
once drm/msm driver supports DSI connectors.
v2: add CTL flush register's hardware mask [pointed by Archit]
Signed-off-by: Stephane Viau <sviau@codeaurora.org>
Signed-off-by: Rob Clark <robdclark@gmail.com>
SMP blocks are configured for specific client IDs (ports).
These client IDs can be different from one chip to another for a
given pipe.
e.g.: DMA0 pipe fetch Y component is connected to:
- port #10 for MDP5 v1.3
- port #4 for MDP5 v1.6
In order to be compatible for upcoming versions of MDP5, the
client ID list is passed through the MDP5 config module rather
than using a list of hard-coded enum values.
Signed-off-by: Stephane Viau <sviau@codeaurora.org>
Signed-off-by: Rob Clark <robdclark@gmail.com>
This patch contains the generated header file of the following
change "drm/msm/mdp5: Get SMP client list from mdp5_cfg".
Signed-off-by: Stephane Viau <sviau@codeaurora.org>
Signed-off-by: Rob Clark <robdclark@gmail.com>
MDP block is actually contained inside the MDSS block. For some
chipsets, the base address of the MDP registers is different from the
current (assumed) 0x100 offset.
Like CTL and LM blocks, this changes introduce a dynamic offset
for the MDP instance, which can be found out at runtime, once the
MDSS HW version is read.
Signed-off-by: Stephane Viau <sviau@codeaurora.org>
Signed-off-by: Rob Clark <robdclark@gmail.com>
This change contains the generated header file for the following
change "drm/msm/mdp5: Separate MDP5 domain from MDSS domain".
Signed-off-by: Stephane Viau <sviau@codeaurora.org>
Signed-off-by: Rob Clark <robdclark@gmail.com>
The width and height in SSPP_SRC_IMG_SIZE register should be the
size of the entire source framebuffer, not the fetch size.
Signed-off-by: Hai Li <hali@codeaurora.org>
Signed-off-by: Rob Clark <robdclark@gmail.com>
This change adds the registers in mdp5 ping pong blocks
and split display control registers.
Signed-off-by: Hai Li <hali@codeaurora.org>
Signed-off-by: Rob Clark <robdclark@gmail.com>
Pingpong register base addresses are different across platforms.
This change adds this information to config table and initialize
the values for 8x74 and 8084.
Signed-off-by: Hai Li <hali@codeaurora.org>
Signed-off-by: Rob Clark <robdclark@gmail.com>
Up until now, we assume that eDP is tight to intf_0 and HDMI to
intf_3. This information shall actually come from the mdp5_cfg
module since it can change from one chip to another.
v2: rename macro to mdp5_cfg_intf_is_virtual() [pointed by Archit]
v3: add sanity check before writing in INTF_TIMING_ENGINE_EN registers
Signed-off-by: Stephane Viau <sviau@codeaurora.org>
Signed-off-by: Rob Clark <robdclark@gmail.com>
Some interfaces (WB, DSI Command Mode) need to be kicked off
through a START Signal. This signal needs to be sent at the right
time and requests in some cases to keep track of the pipeline
status (eg: whether pipeline registers are flushed AND output WB
buffers are ready, in case of WB interface).
Signed-off-by: Stephane Viau <sviau@codeaurora.org>
Signed-off-by: Rob Clark <robdclark@gmail.com>
DSI and WB interfaces need a more complex pipeline configuration
than the current mdp5_ctl_set_intf().
For example, memory output connections need to be selected for
WB. Interface mode (Video vs. Command modes) also need to be
configured for DSI.
This change takes care of configuring the whole pipeline as far
as operation mode goes. DSI and WB interfaces will be added
later.
v2: rename macro to mdp5_cfg_intf_is_virtual() [pointed by Archit]
Signed-off-by: Stephane Viau <sviau@codeaurora.org>
[Remove temp bisectability hack -Rob]
Signed-off-by: Rob Clark <robdclark@gmail.com>
Prepare for pipeline operation mode configuration, in particular
for DSI and WB modes.
Signed-off-by: Stephane Viau <sviau@codeaurora.org>
[Throw in a #define temporarily to keep things bisectable -Rob]
Signed-off-by: Rob Clark <robdclark@gmail.com>
MDP5 hardware has some limitation and requires to avoid flushing
registers more than once between two Vblanks.
This change removes all FLUSH operations (except for HW cursor)
beside the one coming from a CRTC's ->atomic_flush().
This avoid this type of behavior (eg: CRTC + 1 plane overlay):
[drm:mdp5_crtc_vblank_irq] vblank
[drm:mdp5_ctl_commit] flush (20048) CTL + LM0 + RGB0
[drm:mdp5_ctl_commit] flush (20040) CTL + LM0
[drm:mdp5_crtc_vblank_irq] blank
[drm:mdp5_ctl_commit] flush (20049) CTL + LM0 + RGB0 + VIG0
[drm:mdp5_crtc_vblank_irq] blank
and replaces it by:
[drm:mdp5_crtc_vblank_irq] vblank
[drm:mdp5_ctl_commit] flush (20048) CTL + LM0 + RGB0
[drm:mdp5_crtc_vblank_irq] blank
[drm:mdp5_ctl_commit] flush (20049) CTL + LM0 + RGB0 + VIG0
[drm:mdp5_crtc_vblank_irq] blank
Only *one* FLUSH is called between Vblanks interrupts.
Signed-off-by: Stephane Viau <sviau@codeaurora.org>
Signed-off-by: Rob Clark <robdclark@gmail.com>
Add support to use the VRAM carveout (if specified in dtb) for fbdev
scanout buffer. This allows drm/msm to take over a bootloader splash-
screen, and avoids corruption on screen that results if the kernel uses
memory that is still being scanned out for itself.
Signed-off-by: Rob Clark <robdclark@gmail.com>
We'll want to extend this a bit to handle also a reserved-memory
("stolen") region, so that drm/msm can take-over bootloader splash
screen. First split it out into it's own fxn to reduce noise in
the following patch.
Signed-off-by: Rob Clark <robdclark@gmail.com>
This patch implements the virtual GEM driver with PRIME sharing which
allows vgem to import a gem object from other drivers for the purpose
of mmap-ing them to userspace. The mmap is done using the mmap
operation exported by other drivers.
v2: remove platform_device and do not attach to dma bufs
v3: use drm helpers for get/put pages
v4: correct dumb create pitch
Reviewed-by: Rob Clark <robdclark@gmail.com> (v3)
Reviewed-by: Stéphane Marchesin <marcheu@chromium.org> (v3)
Signed-off-by: Adam Jackson <ajax@redhat.com>
Signed-off-by: Ben Widawsky <ben@bwidawsk.net>
Signed-off-by: Zach Reizner <zachr@google.com>
Signed-off-by: Dave Airlie <airlied@redhat.com>
* fix a memory leak, we leaked memory each time the module
was loaded.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.11 (GNU/Linux)
iQEcBAABAgAGBQJVHB3DAAoJEG4XJFUm622bLYkH+gMnmUgVD/MQLqhActOwGg/f
YM+gAmHyHW3arwLStkx8MfYrXf2a+Q3A/+Mj61s9fMKdxtH143JwL3Gu/y76S9vH
7bbhoiajwCg83IhrN+lIOpAHjHo/bxodXmjojnZFHTQ0MBT6ftXmLUZ7HBDwaL6A
ct79Yh/k2lhaL8Vk242dIXWjoVmG9HtazVnK7jYB4fX+dIuqZ/53Z4acqTLeKUez
UMRs/R0MYMtjHXhpnNHegiZ/umf4FfhrtVZ4yW2C3PqPR7wor/XkegnbwEXH3TNq
zGACPN5YdFjDPacPslBsMT9FkOQPOwvz9Djzn7GEW6fv7AvGTC0lIXQ2E2I2phQ=
=E1Gh
-----END PGP SIGNATURE-----
Merge tag 'wireless-drivers-for-davem-2015-04-01' of git://git.kernel.org/pub/scm/linux/kernel/git/kvalo/wireless-drivers
Kalle Valo says:
====================
iwlwifi:
* fix a memory leak, we leaked memory each time the module
was loaded.
====================
Signed-off-by: David S. Miller <davem@davemloft.net>
