#ifndef _VME_BRIDGE_H_ #define _VME_BRIDGE_H_ #include #define VME_CRCSR_BUF_SIZE (508*1024) /* * Resource structures */ struct vme_master_resource { struct list_head list; struct vme_bridge *parent; /* * We are likely to need to access the VME bus in interrupt context, so * protect master routines with a spinlock rather than a mutex. */ spinlock_t lock; int locked; int number; u32 address_attr; u32 cycle_attr; u32 width_attr; struct resource bus_resource; void __iomem *kern_base; }; struct vme_slave_resource { struct list_head list; struct vme_bridge *parent; struct mutex mtx; int locked; int number; u32 address_attr; u32 cycle_attr; }; struct vme_dma_pattern { u32 pattern; u32 type; }; struct vme_dma_pci { dma_addr_t address; }; struct vme_dma_vme { unsigned long long address; u32 aspace; u32 cycle; u32 dwidth; }; struct vme_dma_list { struct list_head list; struct vme_dma_resource *parent; struct list_head entries; struct mutex mtx; }; struct vme_dma_resource { struct list_head list; struct vme_bridge *parent; struct mutex mtx; int locked; int number; struct list_head pending; struct list_head running; u32 route_attr; }; struct vme_lm_resource { struct list_head list; struct vme_bridge *parent; struct mutex mtx; int locked; int number; int monitors; }; struct vme_error_handler { struct list_head list; unsigned long long start; /* Beginning of error window */ unsigned long long end; /* End of error window */ unsigned long long first_error; /* Address of the first error */ u32 aspace; /* Address space of error window*/ unsigned num_errors; /* Number of errors */ }; struct vme_callback { void (*func)(int, int, void*); void *priv_data; }; struct vme_irq { int count; struct vme_callback callback[VME_NUM_STATUSID]; }; /* Allow 16 characters for name (including null character) */ #define VMENAMSIZ 16 /* This structure stores all the information about one bridge * The structure should be dynamically allocated by the driver and one instance * of the structure should be present for each VME chip present in the system. */ struct vme_bridge { char name[VMENAMSIZ]; int num; struct list_head master_resources; struct list_head slave_resources; struct list_head dma_resources; struct list_head lm_resources; /* List for registered errors handlers */ struct list_head vme_error_handlers; /* List of devices on this bridge */ struct list_head devices; /* Bridge Info - XXX Move to private structure? */ struct device *parent; /* Parent device (eg. pdev->dev for PCI) */ void *driver_priv; /* Private pointer for the bridge driver */ struct list_head bus_list; /* list of VME buses */ /* Interrupt callbacks */ struct vme_irq irq[7]; /* Locking for VME irq callback configuration */ struct mutex irq_mtx; /* Slave Functions */ int (*slave_get) (struct vme_slave_resource *, int *, unsigned long long *, unsigned long long *, dma_addr_t *, u32 *, u32 *); int (*slave_set) (struct vme_slave_resource *, int, unsigned long long, unsigned long long, dma_addr_t, u32, u32); /* Master Functions */ int (*master_get) (struct vme_master_resource *, int *, unsigned long long *, unsigned long long *, u32 *, u32 *, u32 *); int (*master_set) (struct vme_master_resource *, int, unsigned long long, unsigned long long, u32, u32, u32); ssize_t (*master_read) (struct vme_master_resource *, void *, size_t, loff_t); ssize_t (*master_write) (struct vme_master_resource *, void *, size_t, loff_t); unsigned int (*master_rmw) (struct vme_master_resource *, unsigned int, unsigned int, unsigned int, loff_t); /* DMA Functions */ int (*dma_list_add) (struct vme_dma_list *, struct vme_dma_attr *, struct vme_dma_attr *, size_t); int (*dma_list_exec) (struct vme_dma_list *); int (*dma_list_empty) (struct vme_dma_list *); /* Interrupt Functions */ void (*irq_set) (struct vme_bridge *, int, int, int); int (*irq_generate) (struct vme_bridge *, int, int); /* Location monitor functions */ int (*lm_set) (struct vme_lm_resource *, unsigned long long, u32, u32); int (*lm_get) (struct vme_lm_resource *, unsigned long long *, u32 *, u32 *); int (*lm_attach)(struct vme_lm_resource *, int, void (*callback)(void *), void *); int (*lm_detach) (struct vme_lm_resource *, int); /* CR/CSR space functions */ int (*slot_get) (struct vme_bridge *); /* Bridge parent interface */ void *(*alloc_consistent)(struct device *dev, size_t size, dma_addr_t *dma); void (*free_consistent)(struct device *dev, size_t size, void *vaddr, dma_addr_t dma); }; void vme_bus_error_handler(struct vme_bridge *bridge, unsigned long long address, int am); void vme_irq_handler(struct vme_bridge *, int, int); struct vme_bridge *vme_init_bridge(struct vme_bridge *); int vme_register_bridge(struct vme_bridge *); void vme_unregister_bridge(struct vme_bridge *); struct vme_error_handler *vme_register_error_handler( struct vme_bridge *bridge, u32 aspace, unsigned long long address, size_t len); void vme_unregister_error_handler(struct vme_error_handler *handler); #endif /* _VME_BRIDGE_H_ */ nux/net-next.git/tree/?id=39cb2c9a316e77f6dfba96c543e55b6672d5a37e'>98fe974ee4e20121253de7f61fc8d01bdb3821c1 /include/net/tso.h parent2c5d9555d6d937966d79d4c6529a5f7b9206e405 (diff)
drm/i915: Check for NULL i915_vma in intel_unpin_fb_obj()
I've seen this trigger twice now, where the i915_gem_object_to_ggtt() call in intel_unpin_fb_obj() returns NULL, resulting in an oops immediately afterwards as the (inlined) call to i915_vma_unpin_fence() tries to dereference it. It seems to be some race condition where the object is going away at shutdown time, since both times happened when shutting down the X server. The call chains were different: - VT ioctl(KDSETMODE, KD_TEXT): intel_cleanup_plane_fb+0x5b/0xa0 [i915] drm_atomic_helper_cleanup_planes+0x6f/0x90 [drm_kms_helper] intel_atomic_commit_tail+0x749/0xfe0 [i915] intel_atomic_commit+0x3cb/0x4f0 [i915] drm_atomic_commit+0x4b/0x50 [drm] restore_fbdev_mode+0x14c/0x2a0 [drm_kms_helper] drm_fb_helper_restore_fbdev_mode_unlocked+0x34/0x80 [drm_kms_helper] drm_fb_helper_set_par+0x2d/0x60 [drm_kms_helper] intel_fbdev_set_par+0x18/0x70 [i915] fb_set_var+0x236/0x460 fbcon_blank+0x30f/0x350 do_unblank_screen+0xd2/0x1a0 vt_ioctl+0x507/0x12a0 tty_ioctl+0x355/0xc30 do_vfs_ioctl+0xa3/0x5e0 SyS_ioctl+0x79/0x90 entry_SYSCALL_64_fastpath+0x13/0x94 - i915 unpin_work workqueue: intel_unpin_work_fn+0x58/0x140 [i915] process_one_work+0x1f1/0x480 worker_thread+0x48/0x4d0 kthread+0x101/0x140 and this patch purely papers over the issue by adding a NULL pointer check and a WARN_ON_ONCE() to avoid the oops that would then generally make the machine unresponsive. Other callers of i915_gem_object_to_ggtt() seem to also check for the returned pointer being NULL and warn about it, so this clearly has happened before in other places. [ Reported it originally to the i915 developers on Jan 8, applying the ugly workaround on my own now after triggering the problem for the second time with no feedback. This is likely to be the same bug reported as https://bugs.freedesktop.org/show_bug.cgi?id=98829 https://bugs.freedesktop.org/show_bug.cgi?id=99134 which has a patch for the underlying problem, but it hasn't gotten to me, so I'm applying the workaround. ] Cc: Daniel Vetter <daniel.vetter@intel.com> Cc: Jani Nikula <jani.nikula@linux.intel.com> Cc: Ville Syrjälä <ville.syrjala@linux.intel.com> Cc: Chris Wilson <chris@chris-wilson.co.uk> Cc: Maarten Lankhorst <maarten.lankhorst@linux.intel.com> Cc: Tvrtko Ursulin <tvrtko.ursulin@intel.com> Cc: Imre Deak <imre.deak@intel.com> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Diffstat (limited to 'include/net/tso.h')