linux.git/drivers/char/agp, branch v3.0 Linux kernel source tree agp/intel: Fix typo in G4x_GMCH_SIZE_VT_2M 2011-07-13T06:44:27+00:00 Chris Wilson chris@chris-wilson.co.uk 2011-07-12T22:38:18+00:00 780d7cc44524cd396a34757127f51ecb8ccaf2da Konstantin Belousov found an error in the define of G4x_GMCH_SIZE_VT_2M relative to the GMCH specs, and confirmed that indeed one of his users with a Q45 reports 0xb not 0xc for a 2/2MiB GATT. Signed-off-by: Chris Wilson <chris@chris-wilson.co.uk> Cc: Konstantin Belousov <kostikbel@gmail.com> Cc: Daniel Vetter <daniel.vetter@ffwll.ch> Acked-by: Daniel Vetter <daniel.vetter@ffwll.ch> Signed-off-by: Dave Airlie <airlied@redhat.com> 
Konstantin Belousov found an error in the define of G4x_GMCH_SIZE_VT_2M
relative to the GMCH specs, and confirmed that indeed one of his users
with a Q45 reports 0xb not 0xc for a 2/2MiB GATT.

Signed-off-by: Chris Wilson <chris@chris-wilson.co.uk>
Cc: Konstantin Belousov <kostikbel@gmail.com>
Cc: Daniel Vetter <daniel.vetter@ffwll.ch>
Acked-by: Daniel Vetter <daniel.vetter@ffwll.ch>
Signed-off-by: Dave Airlie <airlied@redhat.com>
agp/uninorth: Fix lockups with radeon KMS and >1x. 2011-05-22T10:23:09+00:00 Michel Dänzer daenzer@vmware.com 2011-05-19T14:08:39+00:00 5613beb46d54da6ef7f1c4589e9f2e60eeb10721 This was based on a description by Ben Herrenschmidt: > I've removed that SBA reset from the normal TLB invalidation path and > left it only once after turning AGP on. About six months ago, he said: > I did it a bit differently, but yeah, you get the idea. I'm doing a > patch series so don't bother pushing things too hard yet. But I haven't seen anything from him about this since then, and people are regularly hitting these lockups, so here we are... Signed-off-by: Michel Dänzer <daenzer@vmware.com> Acked-by: Benjamin Herrenschmidt <benh@kernel.crashing.org> Signed-off-by: Dave Airlie <airlied@gmail.com> 
This was based on a description by Ben Herrenschmidt:

> I've removed that SBA reset from the normal TLB invalidation path and
> left it only once after turning AGP on.

About six months ago, he said:

> I did it a bit differently, but yeah, you get the idea. I'm doing a
> patch series so don't bother pushing things too hard yet.

But I haven't seen anything from him about this since then, and people are
regularly hitting these lockups, so here we are...

Signed-off-by: Michel Dänzer <daenzer@vmware.com>
Acked-by: Benjamin Herrenschmidt <benh@kernel.crashing.org>
Signed-off-by: Dave Airlie <airlied@gmail.com>
agp/intel: add Ivy Bridge support 2011-05-14T00:11:13+00:00 Jesse Barnes jbarnes@virtuousgeek.org 2011-02-17T19:50:19+00:00 246d08b8f94a5545077611ab5bfb9d47014ede75 Just use the Sandy Bridge routines. Signed-off-by: Jesse Barnes <jbarnes@virtuousgeek.org> Reviewed-by: Keith Packard <keithp@keithp.com> Signed-off-by: Keith Packard <keithp@keithp.com> 
Just use the Sandy Bridge routines.

Signed-off-by: Jesse Barnes <jbarnes@virtuousgeek.org>
Reviewed-by: Keith Packard <keithp@keithp.com>
Signed-off-by: Keith Packard <keithp@keithp.com>
agp: fix arbitrary kernel memory writes 2011-04-21T02:16:55+00:00 Vasiliy Kulikov segoon@openwall.com 2011-04-14T16:55:16+00:00 194b3da873fd334ef183806db751473512af29ce pg_start is copied from userspace on AGPIOC_BIND and AGPIOC_UNBIND ioctl cmds of agp_ioctl() and passed to agpioc_bind_wrap(). As said in the comment, (pg_start + mem->page_count) may wrap in case of AGPIOC_BIND, and it is not checked at all in case of AGPIOC_UNBIND. As a result, user with sufficient privileges (usually "video" group) may generate either local DoS or privilege escalation. Signed-off-by: Vasiliy Kulikov <segoon@openwall.com> Signed-off-by: Dave Airlie <airlied@redhat.com> 
pg_start is copied from userspace on AGPIOC_BIND and AGPIOC_UNBIND ioctl
cmds of agp_ioctl() and passed to agpioc_bind_wrap().  As said in the
comment, (pg_start + mem->page_count) may wrap in case of AGPIOC_BIND,
and it is not checked at all in case of AGPIOC_UNBIND.  As a result, user
with sufficient privileges (usually "video" group) may generate either
local DoS or privilege escalation.

Signed-off-by: Vasiliy Kulikov <segoon@openwall.com>
Signed-off-by: Dave Airlie <airlied@redhat.com>
agp: fix OOM and buffer overflow 2011-04-21T01:51:04+00:00 Vasiliy Kulikov segoon@openwall.com 2011-04-14T16:55:19+00:00 b522f02184b413955f3bc952e3776ce41edc6355 page_count is copied from userspace. agp_allocate_memory() tries to check whether this number is too big, but doesn't take into account the wrap case. Also agp_create_user_memory() doesn't check whether alloc_size is calculated from num_agp_pages variable without overflow. This may lead to allocation of too small buffer with following buffer overflow. Another problem in agp code is not addressed in the patch - kernel memory exhaustion (AGPIOC_RESERVE and AGPIOC_ALLOCATE ioctls). It is not checked whether requested pid is a pid of the caller (no check in agpioc_reserve_wrap()). Each allocation is limited to 16KB, though, there is no per-process limit. This might lead to OOM situation, which is not even solved in case of the caller death by OOM killer - the memory is allocated for another (faked) process. Signed-off-by: Vasiliy Kulikov <segoon@openwall.com> Signed-off-by: Dave Airlie <airlied@redhat.com> 
page_count is copied from userspace.  agp_allocate_memory() tries to
check whether this number is too big, but doesn't take into account the
wrap case.  Also agp_create_user_memory() doesn't check whether
alloc_size is calculated from num_agp_pages variable without overflow.
This may lead to allocation of too small buffer with following buffer
overflow.

Another problem in agp code is not addressed in the patch - kernel memory
exhaustion (AGPIOC_RESERVE and AGPIOC_ALLOCATE ioctls).  It is not checked
whether requested pid is a pid of the caller (no check in agpioc_reserve_wrap()).
Each allocation is limited to 16KB, though, there is no per-process limit.
This might lead to OOM situation, which is not even solved in case of the
caller death by OOM killer - the memory is allocated for another (faked) process.

Signed-off-by: Vasiliy Kulikov <segoon@openwall.com>
Signed-off-by: Dave Airlie <airlied@redhat.com>
Fix common misspellings 2011-03-31T14:26:23+00:00 Lucas De Marchi lucas.demarchi@profusion.mobi 2011-03-31T01:57:33+00:00 25985edcedea6396277003854657b5f3cb31a628 Fixes generated by 'codespell' and manually reviewed. Signed-off-by: Lucas De Marchi <lucas.demarchi@profusion.mobi> 
Fixes generated by 'codespell' and manually reviewed.

Signed-off-by: Lucas De Marchi <lucas.demarchi@profusion.mobi>
Merge branch 'drm-intel-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/ickle/drm-intel into drm-fixes 2011-02-24T02:19:43+00:00 Dave Airlie airlied@redhat.com 2011-02-24T02:19:43+00:00 fbf92bea68830c12da9099d7c8a60812194efc4e * 'drm-intel-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/ickle/drm-intel: drm/i915: fix corruptions on i8xx due to relaxed fencing drm/i915: skip FDI & PCH enabling for DP_A agp/intel: Experiment with a 855GM GWB bit drm/i915: don't enable FDI & transcoder interrupts after all drm/i915: Ignore a hung GPU when flushing the framebuffer prior to a switch 
* 'drm-intel-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/ickle/drm-intel:
  drm/i915: fix corruptions on i8xx due to relaxed fencing
  drm/i915: skip FDI & PCH enabling for DP_A
  agp/intel: Experiment with a 855GM GWB bit
  drm/i915: don't enable FDI & transcoder interrupts after all
  drm/i915: Ignore a hung GPU when flushing the framebuffer prior to a switch
amd64-agp: fix crash at second module load 2011-02-23T08:29:17+00:00 Florian Mickler florian@mickler.org 2011-02-07T22:29:31+00:00 49495d44dfa4ba76cf7d1ed8fe84746dd9552255 The module forgot to sometimes unregister some resources. This fixes Bug #22882. [Patch updated to 2.6.38-rc3 by Randy Dunlap.] Tested-by: Randy Dunlap <randy.dunlap@oracle.com> Signed-off-by: Florian Mickler <florian@mickler.org> Signed-off-by: Dave Airlie <airlied@redhat.com> 
The module forgot to sometimes unregister some resources.

This fixes Bug #22882.

[Patch updated to 2.6.38-rc3 by Randy Dunlap.]
Tested-by: Randy Dunlap <randy.dunlap@oracle.com>
Signed-off-by: Florian Mickler <florian@mickler.org>
Signed-off-by: Dave Airlie <airlied@redhat.com>
agp/intel: Experiment with a 855GM GWB bit 2011-02-22T15:52:41+00:00 Chris Wilson chris@chris-wilson.co.uk 2010-12-22T11:37:09+00:00 bdb8b975fc66e081c3f39be6267701f8226d11aa Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=27187 Tested-by: Thorsten Vollmer <thorsten@thvo.de> (DFI-ACP G5M150-N w/852GME) Tested-by: Moritz Brunner <2points@gmx.org> (Asus M2400N/i855GM) Tested-by: Indan Zupancic <indan@nul.nu> (Thinkpad X40/855GM rev 02) Tested-by: Eric Anholt <eric@anholt.net> (865G) Signed-off-by: Chris Wilson <chris@chris-wilson.co.uk> 
Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=27187
Tested-by: Thorsten Vollmer <thorsten@thvo.de> (DFI-ACP G5M150-N w/852GME)
Tested-by: Moritz Brunner <2points@gmx.org> (Asus M2400N/i855GM)
Tested-by: Indan Zupancic <indan@nul.nu> (Thinkpad X40/855GM rev 02)
Tested-by: Eric Anholt <eric@anholt.net> (865G)
Signed-off-by: Chris Wilson <chris@chris-wilson.co.uk>
agp: ensure GART has an address before enabling it 2011-02-03T23:43:57+00:00 Stephen Kitt steve@sk2.org 2011-01-31T22:25:43+00:00 a70b95c017e8b518e1e069853355e4e497453dbb Some BIOSs (eg. the AMI BIOS on the Asus P4P800 motherboard) don't initialise the GART address, and pcibios_assign_resources() can ignore it because it can be marked as a host bridge (see https://bugzilla.kernel.org/show_bug.cgi?id=24392#c5 for details). This was handled correctly up to 2.6.35, but the pci_enable_device() cleanup in 2.6.36 96576a9e1a0cdb8 ("agp: intel-agp: do not use PCI resources before pci_enable_device()") means that the kernel tries to enable the GART before assigning it an address; in such cases the GART overlaps with other device assignments and ends up being disabled. This patch fixes https://bugzilla.kernel.org/show_bug.cgi?id=24392 Note that I imagine efficeon-agp.c probably has the same problem, but I can't test that and I'd like to make sure this patch is suitable for -stable (since 2.6.36 and 2.6.37 are affected). Signed-off-by: Stephen Kitt <steve@sk2.org> Cc: Bjorn Helgaas <bjorn.helgaas@hp.com> Cc: Maciej Rutecki <maciej.rutecki@gmail.com> Cc: "Rafael J. Wysocki" <rjw@sisk.pl> Cc: Kulikov Vasiliy <segooon@gmail.com> Cc: Florian Mickler <florian@mickler.org> Cc: <stable@kernel.org> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Dave Airlie <airlied@redhat.com> 
Some BIOSs (eg.  the AMI BIOS on the Asus P4P800 motherboard) don't
initialise the GART address, and pcibios_assign_resources() can ignore it
because it can be marked as a host bridge (see
https://bugzilla.kernel.org/show_bug.cgi?id=24392#c5 for details).  This
was handled correctly up to 2.6.35, but the pci_enable_device() cleanup in
2.6.36 96576a9e1a0cdb8 ("agp: intel-agp: do not use PCI resources before
pci_enable_device()") means that the kernel tries to enable the GART
before assigning it an address; in such cases the GART overlaps with other
device assignments and ends up being disabled.

This patch fixes https://bugzilla.kernel.org/show_bug.cgi?id=24392

Note that I imagine efficeon-agp.c probably has the same problem, but
I can't test that and I'd like to make sure this patch is suitable for
-stable (since 2.6.36 and 2.6.37 are affected).

Signed-off-by: Stephen Kitt <steve@sk2.org>
Cc: Bjorn Helgaas <bjorn.helgaas@hp.com>
Cc: Maciej Rutecki <maciej.rutecki@gmail.com>
Cc: "Rafael J. Wysocki" <rjw@sisk.pl>
Cc: Kulikov Vasiliy <segooon@gmail.com>
Cc: Florian Mickler <florian@mickler.org>
Cc: <stable@kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Dave Airlie <airlied@redhat.com>