<feed xmlns='http://www.w3.org/2005/Atom'>
<title>linux-toradex.git/include/drm, branch v3.2.7</title>
<subtitle>Linux kernel for Apalis and Colibri modules</subtitle>
<link rel='alternate' type='text/html' href='https://git.toradex.cn/cgit/linux-toradex.git/'/>
<entry>
<title>drm: Fix authentication kernel crash</title>
<updated>2012-02-03T17:21:26+00:00</updated>
<author>
<name>Thomas Hellstrom</name>
<email>thellstrom@vmware.com</email>
</author>
<published>2012-01-24T17:54:21+00:00</published>
<link rel='alternate' type='text/html' href='https://git.toradex.cn/cgit/linux-toradex.git/commit/?id=92d49a0e2967acb2e5ca1457baf10cfe997ce96c'/>
<id>92d49a0e2967acb2e5ca1457baf10cfe997ce96c</id>
<content type='text'>
commit 598781d71119827b454fd75d46f84755bca6f0c6 upstream.

If the master tries to authenticate a client using drm_authmagic and
that client has already closed its drm file descriptor,
either wilfully or because it was terminated, the
call to drm_authmagic will dereference a stale pointer into kmalloc'ed memory
and corrupt it.

Typically this results in a hard system hang.

This patch fixes that problem by removing any authentication tokens
(struct drm_magic_entry) open for a file descriptor when that file
descriptor is closed.

Signed-off-by: Thomas Hellstrom &lt;thellstrom@vmware.com&gt;
Reviewed-by: Daniel Vetter &lt;daniel.vetter@ffwll.ch&gt;
Signed-off-by: Dave Airlie &lt;airlied@redhat.com&gt;
Signed-off-by: Greg Kroah-Hartman &lt;gregkh@linuxfoundation.org&gt;

</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
commit 598781d71119827b454fd75d46f84755bca6f0c6 upstream.

If the master tries to authenticate a client using drm_authmagic and
that client has already closed its drm file descriptor,
either wilfully or because it was terminated, the
call to drm_authmagic will dereference a stale pointer into kmalloc'ed memory
and corrupt it.

Typically this results in a hard system hang.

This patch fixes that problem by removing any authentication tokens
(struct drm_magic_entry) open for a file descriptor when that file
descriptor is closed.

Signed-off-by: Thomas Hellstrom &lt;thellstrom@vmware.com&gt;
Reviewed-by: Daniel Vetter &lt;daniel.vetter@ffwll.ch&gt;
Signed-off-by: Dave Airlie &lt;airlied@redhat.com&gt;
Signed-off-by: Greg Kroah-Hartman &lt;gregkh@linuxfoundation.org&gt;

</pre>
</div>
</content>
</entry>
<entry>
<title>drm/radeon/kms: add some new pci ids</title>
<updated>2011-12-14T12:29:03+00:00</updated>
<author>
<name>Alex Deucher</name>
<email>alexander.deucher@amd.com</email>
</author>
<published>2011-12-12T14:23:48+00:00</published>
<link rel='alternate' type='text/html' href='https://git.toradex.cn/cgit/linux-toradex.git/commit/?id=cd5cfce856684e13b9b57d46b78bb827e9c4da3c'/>
<id>cd5cfce856684e13b9b57d46b78bb827e9c4da3c</id>
<content type='text'>
Fixes:
https://bugs.freedesktop.org/show_bug.cgi?id=43739

Signed-off-by: Alex Deucher &lt;alexander.deucher@amd.com&gt;
Cc: stable@kernel.org
Signed-off-by: Dave Airlie &lt;airlied@redhat.com&gt;
</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
Fixes:
https://bugs.freedesktop.org/show_bug.cgi?id=43739

Signed-off-by: Alex Deucher &lt;alexander.deucher@amd.com&gt;
Cc: stable@kernel.org
Signed-off-by: Dave Airlie &lt;airlied@redhat.com&gt;
</pre>
</div>
</content>
</entry>
<entry>
<title>drm/radeon/kms: add some new pci ids</title>
<updated>2011-12-01T16:34:15+00:00</updated>
<author>
<name>Alex Deucher</name>
<email>alexander.deucher@amd.com</email>
</author>
<published>2011-12-01T16:02:11+00:00</published>
<link rel='alternate' type='text/html' href='https://git.toradex.cn/cgit/linux-toradex.git/commit/?id=2ed4d9d648cbd4fb1c232a646dbdbdfdd373ca94'/>
<id>2ed4d9d648cbd4fb1c232a646dbdbdfdd373ca94</id>
<content type='text'>
Signed-off-by: Alex Deucher &lt;alexander.deucher@amd.com&gt;
Cc: stable@kernel.org
Signed-off-by: Dave Airlie &lt;airlied@redhat.com&gt;
</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
Signed-off-by: Alex Deucher &lt;alexander.deucher@amd.com&gt;
Cc: stable@kernel.org
Signed-off-by: Dave Airlie &lt;airlied@redhat.com&gt;
</pre>
</div>
</content>
</entry>
<entry>
<title>Merge branch 'exynos-drm' of git://git.infradead.org/users/kmpark/linux-samsung into drm-fixes</title>
<updated>2011-11-28T14:17:09+00:00</updated>
<author>
<name>Dave Airlie</name>
<email>airlied@redhat.com</email>
</author>
<published>2011-11-28T14:17:09+00:00</published>
<link rel='alternate' type='text/html' href='https://git.toradex.cn/cgit/linux-toradex.git/commit/?id=b7b996da27e6f8b518a7c7753fa5b6dff2df6899'/>
<id>b7b996da27e6f8b518a7c7753fa5b6dff2df6899</id>
<content type='text'>
* 'exynos-drm' of git://git.infradead.org/users/kmpark/linux-samsung:
  drm/exynos: fixed wrong err ptr usage and destroy call in exeception
  drm/exynos: Add disable of manager
  drm/exynos: include linux/module.h
  drm/exynos: fix vblank bug.
  drm/exynos: changed buffer structure.
  drm/exynos: removed unnecessary variable.
  drm/exynos: use gem create function generically
  drm/exynos: checked for null pointer
  drm/exynos: added crtc dpms for disable crtc
  drm/exynos: removed meaningless parameter from fbdev update
  drm/exynos: restored kernel_fb_list when reiniting fb_helper
  drm/exynos: changed exynos_drm_display to exynos_drm_display_ops
  drm/exynos: added manager object to connector
  drm/exynos: fixed converting between display mode and timing
  drm/exynos: fixed connector flag with hpd and interlace scan for hdmi
  drm/exynos: added kms poll for handling hpd event
</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
* 'exynos-drm' of git://git.infradead.org/users/kmpark/linux-samsung:
  drm/exynos: fixed wrong err ptr usage and destroy call in exeception
  drm/exynos: Add disable of manager
  drm/exynos: include linux/module.h
  drm/exynos: fix vblank bug.
  drm/exynos: changed buffer structure.
  drm/exynos: removed unnecessary variable.
  drm/exynos: use gem create function generically
  drm/exynos: checked for null pointer
  drm/exynos: added crtc dpms for disable crtc
  drm/exynos: removed meaningless parameter from fbdev update
  drm/exynos: restored kernel_fb_list when reiniting fb_helper
  drm/exynos: changed exynos_drm_display to exynos_drm_display_ops
  drm/exynos: added manager object to connector
  drm/exynos: fixed converting between display mode and timing
  drm/exynos: fixed connector flag with hpd and interlace scan for hdmi
  drm/exynos: added kms poll for handling hpd event
</pre>
</div>
</content>
</entry>
<entry>
<title>drm: integer overflow in drm_mode_dirtyfb_ioctl()</title>
<updated>2011-11-23T08:59:28+00:00</updated>
<author>
<name>Xi Wang</name>
<email>xi.wang@gmail.com</email>
</author>
<published>2011-11-23T06:12:01+00:00</published>
<link rel='alternate' type='text/html' href='https://git.toradex.cn/cgit/linux-toradex.git/commit/?id=a5cd335165e31db9dbab636fd29895d41da55dd2'/>
<id>a5cd335165e31db9dbab636fd29895d41da55dd2</id>
<content type='text'>
There is a potential integer overflow in drm_mode_dirtyfb_ioctl()
if userspace passes in a large num_clips.  The call to kmalloc would
allocate a small buffer, and the call to fb-&gt;funcs-&gt;dirty may result
in a memory corruption.

Reported-by: Haogang Chen &lt;haogangchen@gmail.com&gt;
Signed-off-by: Xi Wang &lt;xi.wang@gmail.com&gt;
Cc: stable@kernel.org
Signed-off-by: Dave Airlie &lt;airlied@redhat.com&gt;
</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
There is a potential integer overflow in drm_mode_dirtyfb_ioctl()
if userspace passes in a large num_clips.  The call to kmalloc would
allocate a small buffer, and the call to fb-&gt;funcs-&gt;dirty may result
in a memory corruption.

Reported-by: Haogang Chen &lt;haogangchen@gmail.com&gt;
Signed-off-by: Xi Wang &lt;xi.wang@gmail.com&gt;
Cc: stable@kernel.org
Signed-off-by: Dave Airlie &lt;airlied@redhat.com&gt;
</pre>
</div>
</content>
</entry>
<entry>
<title>drm/radeon/kms: add a CS ioctl flag not to rewrite tiling flags in the CS</title>
<updated>2011-11-20T07:53:13+00:00</updated>
<author>
<name>Marek Olšák</name>
<email>maraeo@gmail.com</email>
</author>
<published>2011-10-24T23:38:45+00:00</published>
<link rel='alternate' type='text/html' href='https://git.toradex.cn/cgit/linux-toradex.git/commit/?id=e70f224c1938af208b64b02c5cec27889fefcaec'/>
<id>e70f224c1938af208b64b02c5cec27889fefcaec</id>
<content type='text'>
This adds a new optional chunk to the CS ioctl that specifies optional flags
to the CS parser. Why this is useful is explained below. Note that some regs
no longer need the NOP relocation packet if this feature is enabled.
Tested on r300g and r600g with this flag disabled and enabled.

Assume there are two contexts sharing the same mipmapped tiled texture.
One context wants to render into the first mipmap and the other one
wants to render into the last mipmap. As you probably know, the hardware
has a MACRO_SWITCH feature, which turns off macro tiling for small mipmaps,
but that only applies to samplers.
(at least on r300-r500, though later hardware likely behaves the same)

So we want to just re-set the tiling flags before rendering (writing
packets), right? ... No. The contexts run in parallel, so they may
set the tiling flags simultaneously and then fire their command streams
also simultaneously. The last one setting the flags wins, the other one
loses.

Another problem is when one context wants to render into the first and
the last mipmap in one CS. Impossible. It must flush before changing
tiling flags and do the rendering into the smaller mipmaps in another CS.

Yet another problem is that writing copy_blit in userspace would be a mess
involving re-setting tiling flags to please the kernel, and causing races
with other contexts at the same time.

The only way out of this is to send tiling flags with each CS, ideally
with each relocation. But we already do that through the registers.
So let's just use what we have in the registers.

Signed-off-by: Marek Olšák &lt;maraeo@gmail.com&gt;
Signed-off-by: Dave Airlie &lt;airlied@redhat.com&gt;
</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
This adds a new optional chunk to the CS ioctl that specifies optional flags
to the CS parser. Why this is useful is explained below. Note that some regs
no longer need the NOP relocation packet if this feature is enabled.
Tested on r300g and r600g with this flag disabled and enabled.

Assume there are two contexts sharing the same mipmapped tiled texture.
One context wants to render into the first mipmap and the other one
wants to render into the last mipmap. As you probably know, the hardware
has a MACRO_SWITCH feature, which turns off macro tiling for small mipmaps,
but that only applies to samplers.
(at least on r300-r500, though later hardware likely behaves the same)

So we want to just re-set the tiling flags before rendering (writing
packets), right? ... No. The contexts run in parallel, so they may
set the tiling flags simultaneously and then fire their command streams
also simultaneously. The last one setting the flags wins, the other one
loses.

Another problem is when one context wants to render into the first and
the last mipmap in one CS. Impossible. It must flush before changing
tiling flags and do the rendering into the smaller mipmaps in another CS.

Yet another problem is that writing copy_blit in userspace would be a mess
involving re-setting tiling flags to please the kernel, and causing races
with other contexts at the same time.

The only way out of this is to send tiling flags with each CS, ideally
with each relocation. But we already do that through the registers.
So let's just use what we have in the registers.

Signed-off-by: Marek Olšák &lt;maraeo@gmail.com&gt;
Signed-off-by: Dave Airlie &lt;airlied@redhat.com&gt;
</pre>
</div>
</content>
</entry>
<entry>
<title>drm/radeon: add some missing FireMV pci ids</title>
<updated>2011-11-15T19:43:06+00:00</updated>
<author>
<name>Alex Deucher</name>
<email>alexander.deucher@amd.com</email>
</author>
<published>2011-11-14T14:33:56+00:00</published>
<link rel='alternate' type='text/html' href='https://git.toradex.cn/cgit/linux-toradex.git/commit/?id=b872a37437e93df9d112ce674752b3b3a0a17020'/>
<id>b872a37437e93df9d112ce674752b3b3a0a17020</id>
<content type='text'>
Noticed by Egbert.

Signed-off-by: Alex Deucher &lt;alexander.deucher@amd.com&gt;
Cc: stable@kernel.org
Cc: Egbert Eich &lt;eich@suse.de&gt;
Signed-off-by: Dave Airlie &lt;airlied@redhat.com&gt;
</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
Noticed by Egbert.

Signed-off-by: Alex Deucher &lt;alexander.deucher@amd.com&gt;
Cc: stable@kernel.org
Cc: Egbert Eich &lt;eich@suse.de&gt;
Signed-off-by: Dave Airlie &lt;airlied@redhat.com&gt;
</pre>
</div>
</content>
</entry>
<entry>
<title>drm/exynos: use gem create function generically</title>
<updated>2011-11-15T05:58:46+00:00</updated>
<author>
<name>Inki Dae</name>
<email>inki.dae@samsung.com</email>
</author>
<published>2011-11-12T05:51:23+00:00</published>
<link rel='alternate' type='text/html' href='https://git.toradex.cn/cgit/linux-toradex.git/commit/?id=f088d5a9c5dd22b6559fa3f3939973bc374c977b'/>
<id>f088d5a9c5dd22b6559fa3f3939973bc374c977b</id>
<content type='text'>
this patch addes exynos_drm_gem_init() creating and initialzing a gem.
allocation functions could use this function to create new gem and
it changes size type of exynos_drm_gem_create structure to 64bit
and also corrects comments to exynos_drm_gem_create structure.

Signed-off-by: Inki Dae &lt;inki.dae@samsung.com&gt;
Signed-off-by: Kyungmin Park &lt;kyungmin.park@samsung.com&gt;
</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
this patch addes exynos_drm_gem_init() creating and initialzing a gem.
allocation functions could use this function to create new gem and
it changes size type of exynos_drm_gem_create structure to 64bit
and also corrects comments to exynos_drm_gem_create structure.

Signed-off-by: Inki Dae &lt;inki.dae@samsung.com&gt;
Signed-off-by: Kyungmin Park &lt;kyungmin.park@samsung.com&gt;
</pre>
</div>
</content>
</entry>
<entry>
<title>drm/exynos: added padding to be 64-bit align.</title>
<updated>2011-11-11T12:01:49+00:00</updated>
<author>
<name>Inki Dae</name>
<email>inki.dae@samsung.com</email>
</author>
<published>2011-11-04T12:09:50+00:00</published>
<link rel='alternate' type='text/html' href='https://git.toradex.cn/cgit/linux-toradex.git/commit/?id=6c3d904b48e44bd9c3121c24efb87c9d39d7736c'/>
<id>6c3d904b48e44bd9c3121c24efb87c9d39d7736c</id>
<content type='text'>
Signed-off-by: Inki Dae &lt;inki.dae@samsung.com&gt;
Signed-off-by: Kyungmin Park &lt;kyungmin.park@samsung.com&gt;
Signed-off-by: Dave Airlie &lt;airlied@redhat.com&gt;
</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
Signed-off-by: Inki Dae &lt;inki.dae@samsung.com&gt;
Signed-off-by: Kyungmin Park &lt;kyungmin.park@samsung.com&gt;
Signed-off-by: Dave Airlie &lt;airlied@redhat.com&gt;
</pre>
</div>
</content>
</entry>
<entry>
<title>drm: serialize access to list of debugfs files</title>
<updated>2011-11-11T11:05:19+00:00</updated>
<author>
<name>Marcin Slusarz</name>
<email>marcin.slusarz@gmail.com</email>
</author>
<published>2011-11-09T21:20:35+00:00</published>
<link rel='alternate' type='text/html' href='https://git.toradex.cn/cgit/linux-toradex.git/commit/?id=b3e067c0b276197b59046d7095b01b99f98b2821'/>
<id>b3e067c0b276197b59046d7095b01b99f98b2821</id>
<content type='text'>
Nouveau, when configured with debugfs, creates debugfs files for every
channel, so structure holding list of files needs to be protected from
simultaneous changes by multiple threads.

Without this patch it's possible to hit kernel oops in
drm_debugfs_remove_files just by running a couple of xterms with
looped glxinfo.

Signed-off-by: Marcin Slusarz &lt;marcin.slusarz@gmail.com&gt;
Reviewed-by: Daniel Vetter &lt;daniel.vetter@ffwll.ch&gt;
Signed-off-by: Dave Airlie &lt;airlied@redhat.com&gt;
</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
Nouveau, when configured with debugfs, creates debugfs files for every
channel, so structure holding list of files needs to be protected from
simultaneous changes by multiple threads.

Without this patch it's possible to hit kernel oops in
drm_debugfs_remove_files just by running a couple of xterms with
looped glxinfo.

Signed-off-by: Marcin Slusarz &lt;marcin.slusarz@gmail.com&gt;
Reviewed-by: Daniel Vetter &lt;daniel.vetter@ffwll.ch&gt;
Signed-off-by: Dave Airlie &lt;airlied@redhat.com&gt;
</pre>
</div>
</content>
</entry>
</feed>
