Commit Graph

145520 Commits

Author SHA1 Message Date
yakui_zhao be25ed9c5c drm: Replace DRM_DEBUG with DRM_DEBUG_DRIVER in i915 driver
Replace the DRM_DEBUG with the DRM_DEBUG_DRIVER to print the debug info
in i915 driver.

Signed-off-by: Zhao Yakui <yakui.zhao@intel.com>
Signed-off-by: Dave Airlie <airlied@redhat.com>
2009-06-12 14:59:58 +10:00
yakui_zhao f053185948 drm: Replace DRM_DEBUG with DRM_DEBUG_MODE in drm_mode
Replace the DRM_DEBUG with DRM_DEBUG_MODE macro to print the info in drm_mode.

airlied:- fixed up to remove a conflicting #define
Signed-off-by: Zhao Yakui <yakui.zhao@intel.com>
Signed-off-by: Dave Airlie <airlied@redhat.com>
2009-06-12 14:59:42 +10:00
yakui_zhao 342dc382c4 drm/i915: Replace DRM_DEBUG with DRM_DEBUG_KMS in intel_sdvo
Use the DRM_DEBUG_KMS/DEBUG_LOG_KMS to print the debug info for
SDVO device.

Signed-off-by: Zhao Yakui <yakui.zhao@intel.com>
Signed-off-by: Dave Airlie <airlied@redhat.com>
2009-06-11 18:40:44 +10:00
yakui_zhao 7fb85bfb54 drm/i915: replace DRM_DEBUG with DRM_DEBUG_KMS in intel_lvds
Use the DRM_DEBUG_KMS macro definition to print the debug info for
the LVDS.

Signed-off-by: Zhao Yakui <yakui.zhao@intel.com>
Signed-off-by: Dave Airlie <airlied@redhat.com>
2009-06-11 18:40:36 +10:00
yakui_zhao 4fefcb2705 drm: add separate drm debugging levels
Now all the DRM debug info will be reported if the boot option of
"drm.debug=1" is added. Sometimes it is inconvenient to get the debug
info in KMS mode. We will get too much unrelated info.

This will separate several DRM debug levels and the debug level can be used
to print the different debug info. And the debug level is controlled by the
module parameter of drm.debug

In this patch it is divided into four debug levels;
       	drm_core, drm_driver, drm_kms, drm_mode.

At the same time we can get the different debug info by changing the debug
level. This can be done by adding the module parameter. Of course it can
be changed through the /sys/module/drm/parameters/debug after the system is
booted.

Four debug macro definitions are provided.
	DRM_DEBUG(fmt, args...)
	DRM_DEBUG_DRIVER(prefix, fmt, args...)
	DRM_DEBUG_KMS(prefix, fmt, args...)
	DRM_DEBUG_MODE(prefix, fmt, args...)

When the boot option of "drm.debug=4" is added, it will print the debug info
using DRM_DEBUG_KMS macro definition.
When the boot option of "drm.debug=6" is added, it will print the debug info
using DRM_DEBUG_KMS/DRM_DEBUG_DRIVER.

Sometimes we expect to print the value of an array.
For example: SDVO command,
In such case the following four DRM debug macro definitions are added:
	DRM_LOG(fmt, args...)
	DRM_LOG_DRIVER(fmt, args...)
	DRM_LOG_KMS(fmt, args...)
	DRM_LOG_MODE(fmt, args...)

Signed-off-by: Zhao Yakui <yakui.zhao@intel.com>
Signed-off-by: Dave Airlie <airlied@redhat.com>
2009-06-11 18:36:36 +10:00
Dave Airlie df4f7fe7bd radeon: remove _DRM_DRIVER from the preadded sarea map
This shouldn't be there and is what broke r600 late in the 2.6.30
release cycle with Ben's patch.

Signed-off-by: Dave Airlie <airlied@redhat.com>
2009-06-11 16:16:10 +10:00
Ben Skeggs 2ff2e8a3e1 drm: don't associate _DRM_DRIVER maps with a master
A driver will use the _DRM_DRIVER map flag to indicate that it wants
to be responsible for removing the map itself, bypassing the DRM's
automagic cleanup code.

Since the multi-master changes this has been broken, resulting in some
drivers having their registers unmapped before it's finished with them.

Signed-off-by: Ben Skeggs <bskeggs@redhat.com>
Signed-off-by: Dave Airlie <airlied@redhat.com>
2009-06-11 16:15:29 +10:00
Robert P. J. Day b798b1fe3b drm: simplify kcalloc() call to kzalloc().
Calls to kcalloc() for a single element can be simplified to calls to
kzalloc().

Signed-off-by: Robert P. J. Day <rpjday@crashcourse.ca>
Cc: Dave Airlie <airlied@linux.ie>
Cc: Eric Anholt <eric@anholt.net>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Dave Airlie <airlied@redhat.com>
2009-06-11 16:10:30 +10:00
Pavel Roskin 1bcbf39488 intelfb: fix spelling of "CLOCK"
Signed-off-by: Pavel Roskin <proski@gnu.org>
Cc: Eric Anholt <eric@anholt.net>
Cc: Dave Airlie <airlied@linux.ie>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Dave Airlie <airlied@redhat.com>
2009-06-11 16:10:29 +10:00
Roel Kluin dcae3626d0 drm: fix LOCK_TEST_WITH_RETURN macro
When this macro isn't called with 'file_priv' this will result in a build
failure.

Signed-off-by: Roel Kluin <roel.kluin@gmail.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Dave Airlie <airlied@redhat.com>
2009-06-11 16:10:27 +10:00
Keith Packard 03d6069912 drm/i915: Hook connector to encoder during load detection (fixes tv/vga detect)
With the DRM-driven DPMS code, encoders are considered idle unless a
connector is hooked to them, so mode setting is skipped. This makes load
detection fail as none of the hardware is enabled.

Signed-off-by: Keith Packard <keithp@keithp.com>
Signed-off-by: Eric Anholt <eric@anholt.net>
2009-06-09 15:20:55 -07:00
Chris Wilson 2939e1f533 drm/i915: NOMEM->NOSPC
To differentiate between encountering an out-of-memory error with running
out of space in the aperture, use ENOSPC for the later.

Signed-off-by: Chris Wilson <chris@chris-wilson.co.uk>
Signed-off-by: Eric Anholt <eric@anholt.net>
2009-06-09 14:51:39 -07:00
Chris Wilson 21d509e339 drm/i915: use I915_GEM_GPU_DOMAINS
Signed-off-by: Chris Wilson <chris@chris-wilson.co.uk>
Signed-off-by: Eric Anholt <eric@anholt.net>
2009-06-09 14:51:18 -07:00
Chris Wilson b1ce786cb8 drm/i915: no need to hold mutex for object lookup
Signed-off-by: Chris Wilson <chris@chris-wilson.co.uk>
Signed-off-by: Eric Anholt <eric@anholt.net>
2009-06-09 14:41:37 -07:00
Chris Wilson 1f803ee5ce drm/i915: Call drm_vblank_post_modeset() on error paths.
Ensure that the drm_vblank_pre_modeset() is always balanced by
drm_vblank_post_modeset() within intel_crtc_mode_set().

Signed-off-by: Chris Wilson <chris@chris-wilson.co.uk>
Signed-off-by: Eric Anholt <eric@anholt.net>
2009-06-09 14:41:26 -07:00
Chris Wilson 5f26a2c7ad drm/i915: OR in the COMMAND read domain for the batch buffer.
The batch buffer may be shared with another read buffer, so we should not
ignore any previously set domains, but just or in the command domain (and
check that the buffer is not writable).

Signed-off-by: Chris Wilson <chris@chris-wilson.co.uk>
Signed-off-by: Eric Anholt <eric@anholt.net>
2009-06-09 13:54:05 -07:00
Chris Wilson 83d6079515 drm/i915: Sanity check execbuffer arguments before touching state.
By sending a broken execbuffer (its length was not suitably aligned) I
triggered an operation upon a freed object. The invalid alignment was
discovered after updating the write_domain on the object but before the
object was placed on the active queue. So during the unwind process
following the error, the now freed object attempts to flush its
non-existent, but outstanding, GPU writes causing this use-after-free.

[drm:i915_dispatch_gem_execbuffer] *ERROR* alignment
[drm:i915_gem_execbuffer] *ERROR* dispatch failed -22
WARNING: at lib/kref.c:43 warn_slowpath_null+0x10/0x15()
Modules linked in:
Pid: 4552, comm: lt-csi-drm Not tainted 2.6.30-rc6 #423
Call Trace:
 [<c0119ef3>] warn_slowpath_fmt+0x57/0x6d
 [<c014de24>] ? get_pageblock_migratetype+0x18/0x1e
 [<c014e8fd>] ? free_hot_page+0xa/0xc
 [<c014e915>] ? __free_pages+0x16/0x1f
 [<c0153ebf>] ? shmem_truncate_range+0x63e/0x656
 [<c015fb2f>] ? slob_page_alloc+0x146/0x1c8
 [<c0119f19>] warn_slowpath_null+0x10/0x15
 [<c01f55f2>] kref_get+0x1b/0x21
 [<c02605db>] i915_gem_object_move_to_active+0x1f/0x56
 [<c0261302>] i915_add_request+0x156/0x19a
 [<c026136e>] i915_gem_object_flush_gpu_write_domain+0x28/0x3f
 [<c0261eca>] i915_gem_object_unbind+0x4a/0x124
 [<c0261fd7>] i915_gem_free_object+0x33/0x9b
 [<c0250d6b>] drm_gem_object_free+0x28/0x4a
 [<c0250d43>] ? drm_gem_object_free+0x0/0x4a
 [<c01f55ce>] kref_put+0x38/0x41
 [<c0250cbf>] drm_gem_object_unreference+0x11/0x13
 [<c0250d06>] drm_gem_object_handle_unreference+0x1e/0x21
 [<c0250d13>] drm_gem_object_release_handle+0xa/0xe
 [<c01f3e6b>] idr_for_each+0x5f/0x98
 [<c0250d09>] ? drm_gem_object_release_handle+0x0/0xe
 [<c0250daf>] drm_gem_release+0x22/0x34
 [<c025046f>] drm_release+0x1e8/0x3c4
 [<c0162d25>] __fput+0xaf/0x146
 [<c0162dce>] fput+0x12/0x14
 [<c01605ef>] filp_close+0x48/0x52
 [<c011b182>] put_files_struct+0x57/0x9b
 [<c011b1e4>] exit_files+0x1e/0x20
 [<c011c6b6>] do_exit+0x16d/0x511
 [<c03704ab>] ? __schedule+0x3d4/0x3e5
 [<c0103f0d>] ? handle_irq+0xd/0x69
 [<c011caa7>] do_group_exit+0x4d/0x73
 [<c011cae0>] sys_exit_group+0x13/0x17
 [<c010268c>] sysenter_do_call+0x12/0x2b

Signed-off-by: Chris Wilson <chris@chris-wilson.co.uk>
Signed-off-by: Eric Anholt <eric@anholt.net>
2009-06-09 13:52:57 -07:00
Michael Cousin fa0864b26b drm/i915: Skip lvds with Aopen i945GTt-VFA
Signed-off-by: Michael Cousin <mika.cousin@gmail.com>
Signed-off-by: Eric Anholt <eric@anholt.net>
2009-06-09 11:56:12 -07:00
Zhenyu Wang 80a538e49d drm/i915: Enable probe on new chipset
Signed-off-by: Zhenyu Wang <zhenyuw@linux.intel.com>
Signed-off-by: Eric Anholt <eric@anholt.net>
2009-06-09 11:15:40 -07:00
Zhenyu Wang 036a4a7d92 drm/i915: handle interrupt on new chipset
Update interrupt handling methods for IGDNG with new registers
for display and graphics interrupt functions. As we won't use
irq-based vblank sync in dri2, so display interrupt on new chip
will be used for hotplug only in future.

Signed-off-by: Zhenyu Wang <zhenyuw@linux.intel.com>
Signed-off-by: Eric Anholt <eric@anholt.net>
2009-06-09 11:15:27 -07:00
Jesse Barnes d765898970 drm/i915: enable MCHBAR if needed
Using the new PNP resource checking code, this patch allows the i915
driver to allocate MCHBAR space if needed and use the BAR to determine
current memory settings.

[apw@canonical.com: moved to the new generic PNP resource interface]
Signed-off-by: Jesse Barnes <jbarnes@virtuousgeek.org>
Signed-off-by: Andy Whitcroft <apw@canonical.com>
Signed-off-by: Eric Anholt <eric@anholt.net>

failure to update-index after git-am --reject to hand-apply

Signed-off-by: Eric Anholt <eric@anholt.net>
2009-06-09 11:15:07 -07:00
Bjorn Helgaas 1b8e69662e pnp: add PNP resource range checking function
Add a PNP resource range check function, indicating whether a resource
has been assigned to any device.

Signed-off-by: Bjorn Helgaas <bjorn.helgaas@hp.com>
[apw@canonical.com: fixed up exports et al]
Signed-off-by: Andy Whitcroft <apw@canonical.com>
Signed-off-by: Eric Anholt <eric@anholt.net>
2009-06-05 14:37:41 +00:00
Jesse Barnes b66d18ddb1 drm/i915: avoid non-atomic sysrq execution
The sysrq functions are executed in hardirq context, so we shouldn't be
calling sleeping functions from them, like mutex_locks or memory
allocations.

Fix up the i915 sysrq handler to avoid this.

Signed-off-by: Jesse Barnes <jbarnes@virtuousgeek.org>
Signed-off-by: Eric Anholt <eric@anholt.net>
2009-06-05 14:22:33 +00:00
Jesse Barnes 42c2798b35 drm/i915: apply G45 vblank count code to all G4x chips and fix max_frame_count
All G4x and newer chips use the new style frame count register, with a
full 32 bit frame count.  Update the code to reflect this.

Signed-off-by: Jesse Barnes <jbarnes@virtuousgeek.org>
Signed-off-by: Eric Anholt <eric@anholt.net>
2009-06-05 14:22:31 +00:00
Jarod Wilson 70aa96ca2d drm/i915: add ignore lvds quirk info for AOpen Mini PC
Fix a FIXME in the intel LVDS bring-up code, adding the appropriate
blacklist entry for the AOpen Mini PC, courtesy of a dmidecode
dump from Florian Demmer.

Signed-off-by: Jarod Wilson <jarod@redhat.com>
CC: Florian Demmer <florian@demmer.org>
Signed-off-by: Eric Anholt <eric@anholt.net>
2009-06-05 14:22:30 +00:00
yakui_zhao 714605e4a0 drm/i915: Initialize the SDVO device based on the sdvo info parsed from VBT
http://bugs.freedesktop.org/show_bug.cgi?id=20429

Signed-off-by: Zhao Yakui <yakui.zhao@intel.com>
[anholt: Massive cleanup of the slave addr function]
Signed-off-by: Eric Anholt <eric@anholt.net>
2009-06-05 14:22:19 +00:00
yakui_zhao 9b9d172d06 drm/i915: parse VBT general definition block to get the SDVO device info
The general definition block contains the child device tables, which include
the SDVO device info. For example: device slave address, device dvo port,
device type.

We will get the info of SDVO device by parsing the general definition blocks.
Only when a valid slave address is found, it is regarded as the SDVO device.
And the info of DVO port and slave address is recorded.

http://bugs.freedesktop.org/show_bug.cgi?id=20429

Signed-off-by: Zhao Yakui <yakui.zhao@intel.com>
Signed-off-by: Eric Anholt <eric@anholt.net>
2009-06-05 14:13:05 +00:00
yakui_zhao 59a036cfbd drm/i915: Add the structure of child_device_config in video BIOS tables.
Signed-off-by: Zhao Yakui <yakui.zhao@intel.com>
Signed-off-by: Eric Anholt <eric@anholt.net>
2009-06-05 14:13:02 +00:00
Keith Packard 040d87f15a drm/i915: Add Display Port register defines
This adds the register definitions for the display port enable register
along with those for the GMCH and Link M/N ratios required to drive display
port outputs.

Signed-off-by: Keith Packard <keithp@keithp.com>
Signed-off-by: Eric Anholt <eric@anholt.net>
2009-06-05 14:12:59 +00:00
Keith Packard 2245fda810 drm/i915: Don't trim cursor addresses to 11 bits
We can safely assume that cursor addresses will not extend beyond the
addressable screen dimensions; setting the additional bits is harmless in
any case.

Signed-off-by: Keith Packard <keithp@keithp.com>
Signed-off-by: Eric Anholt <eric@anholt.net>
2009-06-05 13:09:04 +00:00
Ma Ling cb66c692d1 drm/i915: Set correct TV detection voltage level override values
We detect TV connect status by setting DAC voltage level override
values as 0.7 voltage for DAC_A/B/C. The corresponding 2-bits shold be 0x2,
In order correctly to set last bit as 0, at first we must clean it.

It fixed freedesktop.org bug #21204

Signed-off-by: Ma Ling <ling.ma@intel.com>
Signed-off-by: Eric Anholt <eric@anholt.net>
2009-06-05 12:53:26 +00:00
Zhenyu Wang 541998a18b drm/i915: Add LVDS support for IGDNG
Signed-off-by: Zhenyu Wang <zhenyuw@linux.intel.com>
Signed-off-by: Eric Anholt <eric@anholt.net>
2009-06-05 11:35:49 +00:00
Zhenyu Wang 30ad48b733 drm/i915: Add HDMI support on IGDNG
Signed-off-by: Zhenyu Wang <zhenyuw@linux.intel.com>
Signed-off-by: Eric Anholt <eric@anholt.net>
2009-06-05 11:35:17 +00:00
Zhenyu Wang 2c07245fb8 drm/i915: enable kernel modesetting on IGDNG
This adds kernel mode setting on IGDNG with VGA output support.
Note that suspend/resume doesn't work yet.

Signed-off-by: Zhenyu Wang <zhenyuw@linux.intel.com>
Signed-off-by: Eric Anholt <eric@anholt.net>
2009-06-05 11:34:51 +00:00
Zhenyu Wang 2cce0d8740 drm/i915: Disable tiling on IGDNG for now
Swizzle bit detection not working right on it.

Signed-off-by: Zhenyu Wang <zhenyuw@linux.intel.com>
Signed-off-by: Eric Anholt <eric@anholt.net>
2009-06-05 11:34:30 +00:00
Zhenyu Wang e170b030dc drm/i915: Disable opregion on IGDNG for now
Disable OpRegion support for now until verified on new chipsets.

Signed-off-by: Zhenyu Wang <zhenyuw@linux.intel.com>
Signed-off-by: Eric Anholt <eric@anholt.net>
2009-06-05 11:34:16 +00:00
Zhenyu Wang b9055052d3 drm/i915: Add new chipset register definitions
Signed-off-by: Zhenyu Wang <zhenyuw@linux.intel.com>
Signed-off-by: Eric Anholt <eric@anholt.net>
2009-06-05 11:34:01 +00:00
Zhenyu Wang 280da227c8 drm/i915: Add chipset/feature defines for for new chipsets
Signed-off-by: Zhenyu Wang <zhenyuw@linux.intel.com>
[anholt: dropped drm_pciids.h hunk to avoid loading an incomplete driver]
Signed-off-by: Eric Anholt <eric@anholt.net>
2009-06-05 11:34:00 +00:00
Zhenyu Wang 32cb055b57 agp/intel: Add support for new chipsets
Both desktop and mobile versions are added.

Signed-off-by: Zhenyu Wang <zhenyuw@linux.intel.com>
Signed-off-by: Eric Anholt <eric@anholt.net>
2009-06-05 11:19:39 +00:00
Eric Anholt b962442e46 drm/i915: Change GEM throttling to be 20ms like the comment says.
keithp didn't like the original 20ms plan because a cooperative client could
be starved by an uncooperative client.  There may even have been problems
with cooperative clients versus cooperative clients.  So keithp changed
throttle to just wait for the second to last seqno emitted by that client.
It worked well, until we started getting more round-trips to the server
due to DRI2 -- the server throttles in BlockHandler, and so if you did more
than one round trip after finishing your frame, you'd end up unintentionally
syncing to the swap.

Fix this by keeping track of the client's requests, so the client can wait
when it has an outstanding request over 20ms old.  This should have
non-starving behavior, good behavior in the presence of restarts, and less
waiting.  Improves high-settings openarena performance on my GM45 by 50%.

Signed-off-by: Eric Anholt <eric@anholt.net>
Reviewed-by: Jesse Barnes <jbarnes@virtuousgeek.org>
2009-06-04 11:44:22 +00:00
Eric Anholt 1fd1c62436 drm/i915: Save/restore cursor state on suspend/resume.
This may fix cursor corruption in X on resume, which would persist until
the cursor was hidden and then shown again.

V2: Also include the cursor control regs.

Signed-off-by: Eric Anholt <eric@anholt.net>
Reviewed-by: Jesse Barnes <jbarnes@virtuousgeek.org>
2009-06-04 11:43:11 +00:00
Eric Anholt 0e7ddf7eee drm/i915: Remove a bad BUG_ON in the fence management code.
This could be triggered by a gtt mapping fault on 965 that decides to
remove the fence from another object that happens to be active currently.
Since the other object doesn't rely on the fence reg for its execution, we
don't wait for it to finish.  We'll soon be not waiting on 915 most of the
time as well, so just drop the BUG_ON.

Signed-off-by: Eric Anholt <eric@anholt.net>
2009-06-04 11:43:09 +00:00
Linus Torvalds 9fa7eb283c Linux 2.6.30-rc8 2009-06-02 20:07:25 -07:00
Linus Torvalds 6823cfe553 Merge branch 'merge' of git://git.kernel.org/pub/scm/linux/kernel/git/benh/powerpc
* 'merge' of git://git.kernel.org/pub/scm/linux/kernel/git/benh/powerpc:
  powerpc/pmac: Update PowerMac 32-bit defconfig
2009-06-02 18:06:10 -07:00
Alan Cox 05ad709d04 parport: quickfix the proc registration bug
Ideally we should have a directory of drivers and a link to the 'active'
driver. For now just show the first device which is effectively the existing
semantics without a warning.

This is an update on the original buggy patch that I then forgot to
resubmit. Confusingly it was proposed by Red Hat, written by Etched Pixels
fixed and submitted by Intel ...

Resolves-Bug: http://bugzilla.kernel.org/show_bug.cgi?id=9749
Signed-off-by: Alan Cox <alan@linux.intel.com>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
2009-06-02 09:53:22 -07:00
Alan Cox d3ae33efb8 pata_netcell: LBA48 force identify bits correct
This matches Bartlomiej's patch for ide_pci_generic:
c339dfdd65

In the libata case netcell has its own mini driver. I suspect this fix is
actually only needed for some firmware revs but it does no harm either way.

Signed-off-by: Alan Cox <alan@linux.intel.com>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
2009-06-02 09:49:46 -07:00
Linus Torvalds ca55bd7e29 Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-2.6
* git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-2.6:
  net_cls: fix unconfigured struct tcf_proto keeps chaining and avoid kernel panic when we use cls_cgroup
  e1000: add missing length check to e1000 receive routine
  forcedeth: add phy_power_down parameter, leave phy powered up by default (v2)
  Bluetooth: Remove useless flush_work() causing lockdep warnings
2009-06-02 09:49:06 -07:00
Linus Torvalds 4157fd85fc Merge branch 'for-linus' of git://oss.sgi.com/xfs/xfs
* 'for-linus' of git://oss.sgi.com/xfs/xfs:
  xfs: prevent deadlock in xfs_qm_shake()
  xfs: fix overflow in xfs_growfs_data_private
  xfs: fix double unlock in xfs_swap_extents()
2009-06-02 09:47:21 -07:00
Minoru Usui 12186be7d2 net_cls: fix unconfigured struct tcf_proto keeps chaining and avoid kernel panic when we use cls_cgroup
This patch fixes a bug which unconfigured struct tcf_proto keeps
chaining in tc_ctl_tfilter(), and avoids kernel panic in
cls_cgroup_classify() when we use cls_cgroup.

When we execute 'tc filter add', tcf_proto is allocated, initialized
by classifier's init(), and chained.  After it's chained,
tc_ctl_tfilter() calls classifier's change().  When classifier's
change() fails, tc_ctl_tfilter() does not free and keeps tcf_proto.

In addition, cls_cgroup is initialized in change() not in init().  It
accesses unconfigured struct tcf_proto which is chained before
change(), then hits Oops.

Signed-off-by: Minoru Usui <usui@mxm.nes.nec.co.jp>
Signed-off-by: Jarek Poplawski <jarkao2@gmail.com>
Signed-off-by: Jamal Hadi Salim <hadi@cyberus.ca>
Tested-by: Minoru Usui <usui@mxm.nes.nec.co.jp>
Signed-off-by: David S. Miller <davem@davemloft.net>
2009-06-02 02:17:34 -07:00
Neil Horman ea30e11970 e1000: add missing length check to e1000 receive routine
Patch to fix bad length checking in e1000.  E1000 by default does two
things:

1) Spans rx descriptors for packets that don't fit into 1 skb on recieve
2) Strips the crc from a frame by subtracting 4 bytes from the length prior to
doing an skb_put

Since the e1000 driver isn't written to support receiving packets that span
multiple rx buffers, it checks the End of Packet bit of every frame, and
discards it if its not set.  This places us in a situation where, if we have a
spanning packet, the first part is discarded, but the second part is not (since
it is the end of packet, and it passes the EOP bit test).  If the second part of
the frame is small (4 bytes or less), we subtract 4 from it to remove its crc,
underflow the length, and wind up in skb_over_panic, when we try to skb_put a
huge number of bytes into the skb.  This amounts to a remote DOS attack through
careful selection of frame size in relation to interface MTU.  The fix for this
is already in the e1000e driver, as well as the e1000 sourceforge driver, but no
one ever pushed it to e1000.  This is lifted straight from e1000e, and prevents
small frames from causing the underflow described above

Signed-off-by: Neil Horman <nhorman@tuxdriver.com>
Tested-by: Andy Gospodarek <andy@greyhouse.net>
Signed-off-by: David S. Miller <davem@davemloft.net>
2009-06-02 01:29:58 -07:00