| Age | Commit message (Collapse) | Author |
|---|
|
into drm-next
First radeon and amdgpu pull request for 4.6. Highlights:
- ACP support for APUs with i2s audio
- CS ioctl optimizations
- GPU scheduler optimizations
- GPUVM optimizations
- Initial GPU reset support (not enabled yet)
- New powerplay sysfs interface for manually selecting clocks
- Powerplay fixes
- Virtualization fixes
- Removal of hw semaphore support
- Lots of other misc fixes and cleanups
* 'drm-next-4.6' of git://people.freedesktop.org/~agd5f/linux: (118 commits)
drm/amdgpu: Don't call interval_tree_remove in amdgpu_mn_destroy
drm/amdgpu: Fix race condition in amdgpu_mn_unregister
drm/amdgpu: cleanup gem init/finit
drm/amdgpu: rework GEM info printing
drm/amdgpu: print the GPU offset as well in gem_info
drm/amdgpu: optionally print the pin count in gem_info as well
drm/amdgpu: print the BO size only once in amdgpu_gem_info
drm/amdgpu: print pid as integer
drm/amdgpu: remove page flip work queue v3
drm/amdgpu: stop blocking for page filp fences
drm/amdgpu: stop calling amdgpu_gpu_reset from the flip code
drm/amdgpu: remove fence reset detection leftovers
drm/amdgpu: Fix race condition in MMU notifier release
drm/radeon: Fix WARN_ON if DRM_DP_AUX_CHARDEV is enabled
drm/amdgpu/vi: move uvd tiling config setup into uvd code
drm/amdgpu/vi: move sdma tiling config setup into sdma code
drm/amdgpu/cik: move uvd tiling config setup into uvd code
drm/amdgpu/cik: move sdma tiling config setup into sdma code
drm/amdgpu/gfx7: rework gpu_init()
drm/amdgpu/gfx: clean up harvest configuration (v2)
...
|
|
git://anongit.freedesktop.org/drm-intel into drm-next
Misc stuff all over:
- more mode_fixup removal from Carlos, there's another final pile still
left.
- final bits of vgaswitcheroo from Lukas for apple gmux, we're still
discussing an api cleanup patch to make it a bit more abuse-safe as a
follow-up
- dp aux interface for userspace for tools&tests from Rafael Antognolli
- actual interface parts for dma-buf flushing for userspace mmap
- few small bits all over
- vgaswitcheroo support for apple gmux from Lukas Wunner
- checks for ->mode_fixup in non-atomic helpers from Carlos Palminha, plus
removing dummy funcs from drivers. Carlos promised to follow up with
more, since there's lots more silly dummy functions around.
- dma-buf patches from Tiago, except the ioctl itself (that needed a
respin to address review from David Herrmann)
- encoder mask for atomic from Maarten
- bunch of random things all over.
* tag 'topic/drm-misc-2016-02-18' of git://anongit.freedesktop.org/drm-intel: (57 commits)
drm/udl: Use module_usb_driver
drm: fixes crct set_mode when crtc mode_fixup is null.
drm/tilcdc: removed optional dummy encoder mode_fixup function.
drm/sti: removed optional dummy encoder mode_fixup function.
drm/rockchip: removed optional dummy encoder mode_fixup function.
drm/qxl: removed optional dummy encoder mode_fixup function.
drm/mgag200: removed optional dummy encoder mode_fixup function.
drm/msm/mdp: removed optional dummy encoder mode_fixup function.
drm/imx: removed optional dummy encoder mode_fixup function.
drm/gma500: removed optional dummy encoder mode_fixup function.
drm/radeon: removed optional dummy encoder mode_fixup function.
drm/cirrus: removed optional dummy encoder mode_fixup function.
drm/bochs: removed optional dummy encoder mode_fixup function.
drm/ast: removed optional dummy encoder mode_fixup function.
drm/amdgpu: removed optional dummy encoder mode_fixup function.
drm/exynos: removed optional dummy encoder mode_fixup function.
drm/udl: removed optional dummy encoder mode_fixup function.
drm/virtio: removed optional dummy encoder mode_fixup function.
drm/fb_helper: Use add_one_connector in add_all_connectors.
drm/fb_helper: Use correct allocation count for arrays.
...
|
|
Signed-off-by: Yakir Yang <ykk@rock-chips.com>
Acked-by: Rob Herring <robh@kernel.org>
|
|
The Innosilicon HDMI is a low power HDMI 1.4 transmitter
IP, and it have been integrated on some rockchip CPUs
(like RK3036, RK312x).
Signed-off-by: Yakir Yang <ykk@rock-chips.com>
Tested-by: Heiko Stuebner <heiko@sntech.de>
|
|
rbtree_postorder_for_each_entry_safe can skip over some entries if
the tree is rebalanced in interval_tree_remove. interval_tree_remove
is also redundant when the tree is just about to be freed.
Signed-off-by: Felix Kuehling <Felix.Kuehling@amd.com>
Reviewed-by: Christian König <christian.koenig@amd.com>
|
|
Exchange locking order of adev->mn_lock and mm_sem, so that
rmn->mm->mmap_sem can be taken safely, protected by adev->mn_lock,
when amdgpu_mn_destroy runs concurrently.
Signed-off-by: Felix Kuehling <Felix.Kuehling@amd.com>
Reviewed-by: Christian König <christian.koenig@amd.com>
|
|
Macro module_usb_driver is used for drivers whose init and exit paths
only register and unregister to usb API. So remove boilerplate code to
make code simpler by using module_usb_driver.
This change was made with the help of the following Coccinelle
semantic patch:
//<smpl>
@a@
identifier f, x;
@@
-static f(...) { return usb_register(&x); }
@b depends on a@
identifier e, a.x;
@@
-static e(...) { usb_deregister(&x); }
@c depends on a && b@
identifier a.f;
declarer name module_init;
@@
-module_init(f);
@d depends on a && b && c@
identifier b.e, a.x;
declarer name module_exit;
declarer name module_usb_driver;
@@
-module_exit(e);
+module_usb_driver(x);
//</smpl>
Signed-off-by: Amitoj Kaur Chawla <amitoj1606@gmail.com>
Signed-off-by: Daniel Vetter <daniel.vetter@ffwll.ch>
Link: http://patchwork.freedesktop.org/patch/msgid/20160217121327.GA29682@amitoj-Inspiron-3542
|
|
Pull in pile of patches from Carlos to remove now redundant mode_fixup
hooks for encoders.
Signed-off-by: Daniel Vetter <daniel.vetter@intel.com>
|
|
Remove the double housekeeping and use something sane to
forcefuly delete BOs on unload.
Signed-off-by: Christian König <christian.koenig@amd.com>
Reviewed-by: Alex Deucher <alexander.deucher@amd.com>
|
|
Print BOs grouped per client.
Signed-off-by: Christian König <christian.koenig@amd.com>
Reviewed-by: Alex Deucher <alexander.deucher@amd.com>
|
|
To easily find which memory is used.
Signed-off-by: Christian König <christian.koenig@amd.com>
Reviewed-by: Alex Deucher <alexander.deucher@amd.com>
|
|
Usefull when debugging page flipping.
Signed-off-by: Christian König <christian.koenig@amd.com>
Reviewed-by: Alex Deucher <alexander.deucher@amd.com>
|
|
Splitting it into KB/MB is just confusing.
Signed-off-by: Christian König <christian.koenig@amd.com>
Reviewed-by: Alex Deucher <alexander.deucher@amd.com>
|
|
Not sure why somebody thought that this is a long.
Signed-off-by: Christian König <christian.koenig@amd.com>
Reviewed-by: Alex Deucher <alexander.deucher@amd.com>
|
|
Just use the system queue now that we don't block any more.
v2: handle DAL as well.
v3: agd: split DAL changes out
Signed-off-by: Christian König <christian.koenig@amd.com>
Reviewed-by: Mykola Lysenko <mykola.lysenko@amd.com>
Acked-by: Alex Deucher <alexander.deucher@amd.com> (v1)
|
|
Just register an callback and reschedule the work item if necessary.
Signed-off-by: Christian König <christian.koenig@amd.com>
Acked-by: Alex Deucher <alexander.deucher@amd.com>
|
|
We don't return -EDEADLK any more.
Signed-off-by: Christian König <christian.koenig@amd.com>
Acked-by: Alex Deucher <alexander.deucher@amd.com>
|
|
wait_event() never returns before the fence was signaled.
Signed-off-by: Christian König <christian.koenig@amd.com>
Acked-by: Alex Deucher <alexander.deucher@amd.com>
|
|
The release notifier can get called a second time from
mmu_notifier_unregister depending on a race between
__mmu_notifier_release and amdgpu_mn_destroy. Use
mmu_notifier_unregister_no_release to avoid this.
Signed-off-by: Felix Kuehling <Felix.Kuehling@amd.com>
Reviewed-by: Christian König <christian.koenig@amd.com>
|
|
This supports 420 and 422 subsampling with 2 or 3 planes, tested with
modetest. It doesn't set up chroma subsampling position (which it
appears KMS doesn't deal with yet).
The LBM memory is overallocated in many cases, but apparently the docs
aren't quite correct and I'll probably need to look at the hardware
source to really figure it out.
Signed-off-by: Eric Anholt <eric@anholt.net>
|
|
These were all touch-tested with modetest.
Signed-off-by: Eric Anholt <eric@anholt.net>
|
|
This implements a simple policy for choosing scaling modes
(trapezoidal for decimation, PPF for magnification), and a single PPF
filter (Mitchell/Netravali's recommendation).
Signed-off-by: Eric Anholt <eric@anholt.net>
|
|
This doesn't matter yet since we only allow 1:1 scaling, but the
comment clearly says we should be using the source size.
Signed-off-by: Eric Anholt <eric@anholt.net>
|
|
Previously we only did the primary and cursor plane, but overlay
planes are useful and just require this setup to add, since all planes
go into the HVS display list in the same way.
Signed-off-by: Eric Anholt <eric@anholt.net>
|
|
So far, we've only ever lit up one CRTC, so this has been fine. To
extend to more displays or more planes, we need to make sure we don't
run our display lists into each other.
Signed-off-by: Eric Anholt <eric@anholt.net>
|
|
Previously, on every modeset we would allocate new display list
memory, recompute changed planes, write all of them to the new memory,
and pointed scanout at the new list (which will latch approximately at
the next line of scanout). We let
drm_atomic_helper_wait_for_vblanks() decide whether we needed to wait
for a vblank after a modeset before cleaning up the old state and
letting the next modeset proceed, and on legacy cursor updates we
wouldn't wait. If you moved the cursor fast enough, we could
potentially wrap around the display list memory area and overwrite the
existing display list while it was still being scanned out, resulting
in the HVS scanning out garbage or just halting.
Instead of making cursor updates wait for scanout to move to the new
display list area (which introduces significant cursor lag in X), we
just rewrite our current display list.
Signed-off-by: Eric Anholt <eric@anholt.net>
|
|
As we add actual scaling, this is going to get way more complicated.
Signed-off-by: Eric Anholt <eric@anholt.net>
|
|
This is the pointer to the HVS device's memory where we stored the
contents of *dlist.
Signed-off-by: Eric Anholt <eric@anholt.net>
|
|
Signed-off-by: Eric Anholt <eric@anholt.net>
|
|
This patch set nukes all the dummy crtc mode_fixup implementations.
(made on top of Daniel topic/drm-misc branch)
Signed-off-by: Carlos Palminha <palminha@synopsys.com>
Signed-off-by: Daniel Vetter <daniel.vetter@ffwll.ch>
Link: http://patchwork.freedesktop.org/patch/msgid/9d41105dee6632b4bb50e9555f2196ac249b9fce.1455630967.git.palminha@synopsys.com
|
|
mode_fixup function for encoder drivers became optional with patch
http://patchwork.freedesktop.org/patch/msgid/1455106522-32307-1-git-send-email-palminha@synopsys.com
This patch set nukes all the dummy mode_fixup implementations.
(made on top of Daniel topic/drm-misc branch)
Signed-off-by: Carlos Palminha <palminha@synopsys.com>
Signed-off-by: Daniel Vetter <daniel.vetter@ffwll.ch>
Link: http://patchwork.freedesktop.org/patch/msgid/4d838f580cf81068a4df2500a096d66f06f3ad37.1455540137.git.palminha@synopsys.com
|
|
mode_fixup function for encoder drivers became optional with patch
http://patchwork.freedesktop.org/patch/msgid/1455106522-32307-1-git-send-email-palminha@synopsys.com
This patch set nukes all the dummy mode_fixup implementations.
(made on top of Daniel topic/drm-misc branch)
Signed-off-by: Carlos Palminha <palminha@synopsys.com>
Acked-by: Vincent Abriou <vincent.abriou@st.com>
Signed-off-by: Daniel Vetter <daniel.vetter@ffwll.ch>
Link: http://patchwork.freedesktop.org/patch/msgid/7f47c6a7b00e4f16af672ebf3a277e31ad117e21.1455540137.git.palminha@synopsys.com
|
|
mode_fixup function for encoder drivers became optional with patch
http://patchwork.freedesktop.org/patch/msgid/1455106522-32307-1-git-send-email-palminha@synopsys.com
This patch set nukes all the dummy mode_fixup implementations.
(made on top of Daniel topic/drm-misc branch)
Signed-off-by: Carlos Palminha <palminha@synopsys.com>
Acked-by: Mark Yao <mark.yao@rock-chips.com>
Signed-off-by: Daniel Vetter <daniel.vetter@ffwll.ch>
Link: http://patchwork.freedesktop.org/patch/msgid/cae559aa2c04a906c21ed5ebe4861f92440e6910.1455540137.git.palminha@synopsys.com
|
|
mode_fixup function for encoder drivers became optional with patch
http://patchwork.freedesktop.org/patch/msgid/1455106522-32307-1-git-send-email-palminha@synopsys.com
This patch set nukes all the dummy mode_fixup implementations.
(made on top of Daniel topic/drm-misc branch)
Signed-off-by: Carlos Palminha <palminha@synopsys.com>
Signed-off-by: Daniel Vetter <daniel.vetter@ffwll.ch>
Link: http://patchwork.freedesktop.org/patch/msgid/f35bc322f7af69ba0fea734d58b4daf5e0cd9786.1455540137.git.palminha@synopsys.com
|
|
mode_fixup function for encoder drivers became optional with patch
http://patchwork.freedesktop.org/patch/msgid/1455106522-32307-1-git-send-email-palminha@synopsys.com
This patch set nukes all the dummy mode_fixup implementations.
(made on top of Daniel topic/drm-misc branch)
Signed-off-by: Carlos Palminha <palminha@synopsys.com>
Signed-off-by: Daniel Vetter <daniel.vetter@ffwll.ch>
Link: http://patchwork.freedesktop.org/patch/msgid/c5852d59a8890c3570ce97d16c0714a71eb61651.1455540137.git.palminha@synopsys.com
|
|
mode_fixup function for encoder drivers became optional with patch
http://patchwork.freedesktop.org/patch/msgid/1455106522-32307-1-git-send-email-palminha@synopsys.com
This patch set nukes all the dummy mode_fixup implementations.
(made on top of Daniel topic/drm-misc branch)
Signed-off-by: Carlos Palminha <palminha@synopsys.com>
Signed-off-by: Daniel Vetter <daniel.vetter@ffwll.ch>
Link: http://patchwork.freedesktop.org/patch/msgid/77692d9d34c2ed6a035f36d377d3544dbe100114.1455540137.git.palminha@synopsys.com
|
|
mode_fixup function for encoder drivers became optional with patch
http://patchwork.freedesktop.org/patch/msgid/1455106522-32307-1-git-send-email-palminha@synopsys.com
This patch set nukes all the dummy mode_fixup implementations.
(made on top of Daniel topic/drm-misc branch)
Signed-off-by: Carlos Palminha <palminha@synopsys.com>
Acked-by: Philipp Zabel <p.zabel@pengutronix.de>
Signed-off-by: Daniel Vetter <daniel.vetter@ffwll.ch>
Link: http://patchwork.freedesktop.org/patch/msgid/8bf274e8f6908142a9f940d3f2913e4a735e0caa.1455540137.git.palminha@synopsys.com
|
|
mode_fixup function for encoder drivers became optional with patch
http://patchwork.freedesktop.org/patch/msgid/1455106522-32307-1-git-send-email-palminha@synopsys.com
This patch set nukes all the dummy mode_fixup implementations.
(made on top of Daniel topic/drm-misc branch)
Signed-off-by: Carlos Palminha <palminha@synopsys.com>
Reviewed-by: Patrik Jakobsson <patrik.r.jakobsson@gmail.com>
Signed-off-by: Daniel Vetter <daniel.vetter@ffwll.ch>
Link: http://patchwork.freedesktop.org/patch/msgid/b704458dc68a73cfb5507933c1df0c2a79e186eb.1455540137.git.palminha@synopsys.com
|
|
mode_fixup function for encoder drivers became optional with patch
http://patchwork.freedesktop.org/patch/msgid/1455106522-32307-1-git-send-email-palminha@synopsys.com
This patch set nukes all the dummy mode_fixup implementations.
(made on top of Daniel topic/drm-misc branch)
Signed-off-by: Carlos Palminha <palminha@synopsys.com>
Reviewed-by: Alex Deucher <alexander.deucher@amd.com>
Reviewed-by: Christian König <christian.koenig@amd.com>
Signed-off-by: Daniel Vetter <daniel.vetter@ffwll.ch>
Link: http://patchwork.freedesktop.org/patch/msgid/1b99680b8cf81977597dec5daedff9b684d3ed19.1455540137.git.palminha@synopsys.com
|
|
mode_fixup function for encoder drivers became optional with patch
http://patchwork.freedesktop.org/patch/msgid/1455106522-32307-1-git-send-email-palminha@synopsys.com
This patch set nukes all the dummy mode_fixup implementations.
(made on top of Daniel topic/drm-misc branch)
Signed-off-by: Carlos Palminha <palminha@synopsys.com>
Signed-off-by: Daniel Vetter <daniel.vetter@ffwll.ch>
Link: http://patchwork.freedesktop.org/patch/msgid/a53767402bd4a69c3d2a546b7f4d4d122134b545.1455540137.git.palminha@synopsys.com
|
|
mode_fixup function for encoder drivers became optional with patch
http://patchwork.freedesktop.org/patch/msgid/1455106522-32307-1-git-send-email-palminha@synopsys.com
This patch set nukes all the dummy mode_fixup implementations.
(made on top of Daniel topic/drm-misc branch)
Signed-off-by: Carlos Palminha <palminha@synopsys.com>
Signed-off-by: Daniel Vetter <daniel.vetter@ffwll.ch>
Link: http://patchwork.freedesktop.org/patch/msgid/d8b87edea28c8211e1711348143e4c355764a8c4.1455540137.git.palminha@synopsys.com
|
|
mode_fixup function for encoder drivers became optional with patch
http://patchwork.freedesktop.org/patch/msgid/1455106522-32307-1-git-send-email-palminha@synopsys.com
This patch set nukes all the dummy mode_fixup implementations.
(made on top of Daniel topic/drm-misc branch)
Signed-off-by: Carlos Palminha <palminha@synopsys.com>
Signed-off-by: Daniel Vetter <daniel.vetter@ffwll.ch>
Link: http://patchwork.freedesktop.org/patch/msgid/12e1e900724c890166b88b0f4d67baba387482af.1455540137.git.palminha@synopsys.com
|
|
mode_fixup function for encoder drivers became optional with patch
http://patchwork.freedesktop.org/patch/msgid/1455106522-32307-1-git-send-email-palminha@synopsys.com
This patch set nukes all the dummy mode_fixup implementations.
(made on top of Daniel topic/drm-misc branch)
Signed-off-by: Carlos Palminha <palminha@synopsys.com>
Reviewed-by: Alex Deucher <alexander.deucher@amd.com>
Reviewed-by: Christian König <christian.koenig@amd.com>
Signed-off-by: Daniel Vetter <daniel.vetter@ffwll.ch>
Link: http://patchwork.freedesktop.org/patch/msgid/8c4710ee930d2ab3a505b8d3cd724f4f4c79b3df.1455540137.git.palminha@synopsys.com
|
|
mode_fixup function for encoder drivers became optional with patch
http://patchwork.freedesktop.org/patch/msgid/1455106522-32307-1-git-send-email-palminha@synopsys.com
This patch set nukes all the dummy mode_fixup implementations.
(made on top of Daniel topic/drm-misc branch)
Signed-off-by: Carlos Palminha <palminha@synopsys.com>
[danvet: Squash in 2nd exynos patch.]
Link: http://patchwork.freedesktop.org/patch/msgid/3768b670931572de51fca1102efa18d20dd770ee.1455540137.git.palminha@synopsys.com
Link: http://patchwork.freedesktop.org/patch/msgid/4906a9925eebbe55489b1005c449b426a61c09bd.1455540137.git.palminha@synopsys.com
Signed-off-by: Daniel Vetter <daniel.vetter@ffwll.ch>
|
|
mode_fixup function for encoder drivers became optional with patch
http://patchwork.freedesktop.org/patch/msgid/1455106522-32307-1-git-send-email-palminha@synopsys.com
This patch set nukes all the dummy mode_fixup implementations.
(made on top of Daniel topic/drm-misc branch)
Signed-off-by: Carlos Palminha <palminha@synopsys.com>
Signed-off-by: Daniel Vetter <daniel.vetter@ffwll.ch>
Link: http://patchwork.freedesktop.org/patch/msgid/a7ebfb6c6c333056d0a77d2684c539107ee63589.1455540137.git.palminha@synopsys.com
|
|
mode_fixup function for encoder drivers became optional with patch
http://patchwork.freedesktop.org/patch/msgid/1455106522-32307-1-git-send-email-palminha@synopsys.com
This patch set nukes all the dummy mode_fixup implementations.
(made on top of Daniel topic/drm-misc branch)
Signed-off-by: Carlos Palminha <palminha@synopsys.com>
Signed-off-by: Daniel Vetter <daniel.vetter@ffwll.ch>
Link: http://patchwork.freedesktop.org/patch/msgid/85230bc1356eb52257aaa1e1965adae2f00db5cd.1455540137.git.palminha@synopsys.com
|
|
Currently, it is initializing the driver name using the wrong
name ("usb"). Use the generic function, as its logic works
best, and avoids repeating the very same code everywhere.
Signed-off-by: Mauro Carvalho Chehab <mchehab@osg.samsung.com>
|
|
smscore_getbuffer() calls internally wait_event(), with can sleep.
As smsusb_onresponse() is called on interrupt context, this causes
the following warning:
BUG: sleeping function called from invalid context at drivers/media/common/siano/smscoreapi.c:1653
in_atomic(): 1, irqs_disabled(): 1, pid: 11084, name: systemd-udevd
INFO: lockdep is turned off.
irq event stamp: 0
hardirqs last enabled at (0): [< (null)>] (null)
hardirqs last disabled at (0): [<ffffffff811480f7>] copy_process.part.7+0x10e7/0x56d0
softirqs last enabled at (0): [<ffffffff81148193>] copy_process.part.7+0x1183/0x56d0
softirqs last disabled at (0): [< (null)>] (null)
CPU: 2 PID: 11084 Comm: systemd-udevd Tainted: G B W 4.5.0-rc3+ #47
Hardware name: /NUC5i7RYB, BIOS RYBDWi35.86A.0350.2015.0812.1722 08/12/2015
0000000000000000 ffff8803c6907a80 ffffffff81933901 ffff8802bd916000
ffff8802bd9165c8 ffff8803c6907aa8 ffffffff811c6af5 ffff8802bd916000
ffffffffa0ce9b60 0000000000000675 ffff8803c6907ae8 ffffffff811c6ce5
Call Trace:
<IRQ> [<ffffffff81933901>] dump_stack+0x85/0xc4
[<ffffffff811c6af5>] ___might_sleep+0x245/0x3a0
[<ffffffff811c6ce5>] __might_sleep+0x95/0x1a0
[<ffffffffa0ce020a>] ? list_add_locked+0xca/0x140 [smsmdtv]
[<ffffffffa0ce3b8d>] smscore_getbuffer+0x7d/0x120 [smsmdtv]
[<ffffffff8123819d>] ? trace_hardirqs_off+0xd/0x10
[<ffffffffa0ce3b10>] ? smscore_sendrequest_and_wait.isra.5+0x120/0x120 [smsmdtv]
[<ffffffffa0ce020a>] ? list_add_locked+0xca/0x140 [smsmdtv]
[<ffffffffa0ce13ca>] ? smscore_putbuffer+0x3a/0x40 [smsmdtv]
[<ffffffffa0d107bc>] smsusb_submit_urb+0x2ec/0x4f0 [smsusb]
[<ffffffffa0d10e36>] smsusb_onresponse+0x476/0x720 [smsusb]
Let's add a work queue to handle the bottom half, preventing this
problem.
Signed-off-by: Mauro Carvalho Chehab <mchehab@osg.samsung.com>
|
|
As pointed by KASAN:
BUG: KASAN: slab-out-of-bounds in memcpy+0x1d/0x40 at addr ffff880000038d8c
Read of size 128 by task systemd-udevd/2536
page:ffffea0000000800 count:1 mapcount:0 mapping: (null) index:0x0 compound_mapcount: 0
flags: 0xffff8000004000(head)
page dumped because: kasan: bad access detected
CPU: 1 PID: 2536 Comm: systemd-udevd Not tainted 4.5.0-rc3+ #47
Hardware name: /NUC5i7RYB, BIOS RYBDWi35.86A.0350.2015.0812.1722 08/12/2015
ffff880000038d8c ffff8803b0f1f1e8 ffffffff81933901 0000000000000080
ffff8803b0f1f280 ffff8803b0f1f270 ffffffff815602c5 ffffffff8284cf93
ffffffff822ddc00 0000000000000282 0000000000000001 ffff88009c7c6000
Call Trace:
[<ffffffff81933901>] dump_stack+0x85/0xc4
[<ffffffff815602c5>] kasan_report_error+0x525/0x550
[<ffffffff815606e9>] kasan_report+0x39/0x40
[<ffffffff8155f84d>] memcpy+0x1d/0x40
[<ffffffffa120cb90>] smscore_set_device_mode+0xee0/0x2560 [smsmdtv]
Such error happens at the memcpy code below:
0x4bc0 is in smscore_set_device_mode (drivers/media/common/siano/smscoreapi.c:975).
970 sizeof(u32) + payload_size));
971
972 data_msg->mem_addr = mem_address;
973 memcpy(data_msg->payload, payload, payload_size);
974
975 rc = smscore_sendrequest_and_wait(coredev, data_msg,
976 data_msg->x_msg_header.msg_length,
977 &coredev->data_download_done);
978
979 payload += payload_size;
The problem is that the Siano driver uses a header to store the firmware,
with requires a few more bytes than allocated.
Tested with:
PCTV 77e (2013:0257)
Hauppauge WinTV MiniStick (2040:5510)
Signed-off-by: Mauro Carvalho Chehab <mchehab@osg.samsung.com>
|
|
Some macros were changed/removed at the material for v4.5. We need
to sync with those changes here, in order to avoid troubles.
* v4l_for_linus:
[media] media.h: get rid of MEDIA_ENT_F_CONN_TEST
[media] [for,v4.5] media.h: increase the spacing between function ranges
[media] media: i2c/adp1653: probe: fix erroneous return value
[media] media: davinci_vpfe: fix missing unlock on error in vpfe_prepare_pipeline()
|
