#ifndef _LAPB_H #define _LAPB_H #include #define LAPB_HEADER_LEN 20 /* LAPB over Ethernet + a bit more */ #define LAPB_ACK_PENDING_CONDITION 0x01 #define LAPB_REJECT_CONDITION 0x02 #define LAPB_PEER_RX_BUSY_CONDITION 0x04 /* Control field templates */ #define LAPB_I 0x00 /* Information frames */ #define LAPB_S 0x01 /* Supervisory frames */ #define LAPB_U 0x03 /* Unnumbered frames */ #define LAPB_RR 0x01 /* Receiver ready */ #define LAPB_RNR 0x05 /* Receiver not ready */ #define LAPB_REJ 0x09 /* Reject */ #define LAPB_SABM 0x2F /* Set Asynchronous Balanced Mode */ #define LAPB_SABME 0x6F /* Set Asynchronous Balanced Mode Extended */ #define LAPB_DISC 0x43 /* Disconnect */ #define LAPB_DM 0x0F /* Disconnected mode */ #define LAPB_UA 0x63 /* Unnumbered acknowledge */ #define LAPB_FRMR 0x87 /* Frame reject */ #define LAPB_ILLEGAL 0x100 /* Impossible to be a real frame type */ #define LAPB_SPF 0x10 /* Poll/final bit for standard LAPB */ #define LAPB_EPF 0x01 /* Poll/final bit for extended LAPB */ #define LAPB_FRMR_W 0x01 /* Control field invalid */ #define LAPB_FRMR_X 0x02 /* I field invalid */ #define LAPB_FRMR_Y 0x04 /* I field too long */ #define LAPB_FRMR_Z 0x08 /* Invalid N(R) */ #define LAPB_POLLOFF 0 #define LAPB_POLLON 1 /* LAPB C-bit */ #define LAPB_COMMAND 1 #define LAPB_RESPONSE 2 #define LAPB_ADDR_A 0x03 #define LAPB_ADDR_B 0x01 #define LAPB_ADDR_C 0x0F #define LAPB_ADDR_D 0x07 /* Define Link State constants. */ enum { LAPB_STATE_0, /* Disconnected State */ LAPB_STATE_1, /* Awaiting Connection State */ LAPB_STATE_2, /* Awaiting Disconnection State */ LAPB_STATE_3, /* Data Transfer State */ LAPB_STATE_4 /* Frame Reject State */ }; #define LAPB_DEFAULT_MODE (LAPB_STANDARD | LAPB_SLP | LAPB_DTE) #define LAPB_DEFAULT_WINDOW 7 /* Window=7 */ #define LAPB_DEFAULT_T1 (5 * HZ) /* T1=5s */ #define LAPB_DEFAULT_T2 (1 * HZ) /* T2=1s */ #define LAPB_DEFAULT_N2 20 /* N2=20 */ #define LAPB_SMODULUS 8 #define LAPB_EMODULUS 128 /* * Information about the current frame. */ struct lapb_frame { unsigned short type; /* Parsed type */ unsigned short nr, ns; /* N(R), N(S) */ unsigned char cr; /* Command/Response */ unsigned char pf; /* Poll/Final */ unsigned char control[2]; /* Original control data*/ }; /* * The per LAPB connection control structure. */ struct lapb_cb { struct list_head node; struct net_device *dev; /* Link status fields */ unsigned int mode; unsigned char state; unsigned short vs, vr, va; unsigned char condition; unsigned short n2, n2count; unsigned short t1, t2; struct timer_list t1timer, t2timer; /* Internal control information */ struct sk_buff_head write_queue; struct sk_buff_head ack_queue; unsigned char window; const struct lapb_register_struct *callbacks; /* FRMR control information */ struct lapb_frame frmr_data; unsigned char frmr_type; atomic_t refcnt; }; /* lapb_iface.c */ void lapb_connect_confirmation(struct lapb_cb *lapb, int); void lapb_connect_indication(struct lapb_cb *lapb, int); void lapb_disconnect_confirmation(struct lapb_cb *lapb, int); void lapb_disconnect_indication(struct lapb_cb *lapb, int); int lapb_data_indication(struct lapb_cb *lapb, struct sk_buff *); int lapb_data_transmit(struct lapb_cb *lapb, struct sk_buff *); /* lapb_in.c */ void lapb_data_input(struct lapb_cb *lapb, struct sk_buff *); /* lapb_out.c */ void lapb_kick(struct lapb_cb *lapb); void lapb_transmit_buffer(struct lapb_cb *lapb, struct sk_buff *, int); void lapb_establish_data_link(struct lapb_cb *lapb); void lapb_enquiry_response(struct lapb_cb *lapb); void lapb_timeout_response(struct lapb_cb *lapb); void lapb_check_iframes_acked(struct lapb_cb *lapb, unsigned short); void lapb_check_need_response(struct lapb_cb *lapb, int, int); /* lapb_subr.c */ void lapb_clear_queues(struct lapb_cb *lapb); void lapb_frames_acked(struct lapb_cb *lapb, unsigned short); void lapb_requeue_frames(struct lapb_cb *lapb); int lapb_validate_nr(struct lapb_cb *lapb, unsigned short); int lapb_decode(struct lapb_cb *lapb, struct sk_buff *, struct lapb_frame *); void lapb_send_control(struct lapb_cb *lapb, int, int, int); void lapb_transmit_frmr(struct lapb_cb *lapb); /* lapb_timer.c */ void lapb_start_t1timer(struct lapb_cb *lapb); void lapb_start_t2timer(struct lapb_cb *lapb); void lapb_stop_t1timer(struct lapb_cb *lapb); void lapb_stop_t2timer(struct lapb_cb *lapb); int lapb_t1timer_running(struct lapb_cb *lapb); /* * Debug levels. * 0 = Off * 1 = State Changes * 2 = Packets I/O and State Changes * 3 = Hex dumps, Packets I/O and State Changes. */ #define LAPB_DEBUG 0 #define lapb_dbg(level, fmt, ...) \ do { \ if (level < LAPB_DEBUG) \ pr_debug(fmt, ##__VA_ARGS__); \ } while (0) #endif lect>
authorLinus Torvalds <torvalds@linux-foundation.org>2017-01-29 13:50:06 -0800
committerLinus Torvalds <torvalds@linux-foundation.org>2017-01-29 13:50:06 -0800
commit39cb2c9a316e77f6dfba96c543e55b6672d5a37e (patch)
tree98fe974ee4e20121253de7f61fc8d01bdb3821c1 /include/sound/hda_regmap.h
parent2c5d9555d6d937966d79d4c6529a5f7b9206e405 (diff)
drm/i915: Check for NULL i915_vma in intel_unpin_fb_obj()
I've seen this trigger twice now, where the i915_gem_object_to_ggtt() call in intel_unpin_fb_obj() returns NULL, resulting in an oops immediately afterwards as the (inlined) call to i915_vma_unpin_fence() tries to dereference it. It seems to be some race condition where the object is going away at shutdown time, since both times happened when shutting down the X server. The call chains were different: - VT ioctl(KDSETMODE, KD_TEXT): intel_cleanup_plane_fb+0x5b/0xa0 [i915] drm_atomic_helper_cleanup_planes+0x6f/0x90 [drm_kms_helper] intel_atomic_commit_tail+0x749/0xfe0 [i915] intel_atomic_commit+0x3cb/0x4f0 [i915] drm_atomic_commit+0x4b/0x50 [drm] restore_fbdev_mode+0x14c/0x2a0 [drm_kms_helper] drm_fb_helper_restore_fbdev_mode_unlocked+0x34/0x80 [drm_kms_helper] drm_fb_helper_set_par+0x2d/0x60 [drm_kms_helper] intel_fbdev_set_par+0x18/0x70 [i915] fb_set_var+0x236/0x460 fbcon_blank+0x30f/0x350 do_unblank_screen+0xd2/0x1a0 vt_ioctl+0x507/0x12a0 tty_ioctl+0x355/0xc30 do_vfs_ioctl+0xa3/0x5e0 SyS_ioctl+0x79/0x90 entry_SYSCALL_64_fastpath+0x13/0x94 - i915 unpin_work workqueue: intel_unpin_work_fn+0x58/0x140 [i915] process_one_work+0x1f1/0x480 worker_thread+0x48/0x4d0 kthread+0x101/0x140 and this patch purely papers over the issue by adding a NULL pointer check and a WARN_ON_ONCE() to avoid the oops that would then generally make the machine unresponsive. Other callers of i915_gem_object_to_ggtt() seem to also check for the returned pointer being NULL and warn about it, so this clearly has happened before in other places. [ Reported it originally to the i915 developers on Jan 8, applying the ugly workaround on my own now after triggering the problem for the second time with no feedback. This is likely to be the same bug reported as https://bugs.freedesktop.org/show_bug.cgi?id=98829 https://bugs.freedesktop.org/show_bug.cgi?id=99134 which has a patch for the underlying problem, but it hasn't gotten to me, so I'm applying the workaround. ] Cc: Daniel Vetter <daniel.vetter@intel.com> Cc: Jani Nikula <jani.nikula@linux.intel.com> Cc: Ville Syrjälä <ville.syrjala@linux.intel.com> Cc: Chris Wilson <chris@chris-wilson.co.uk> Cc: Maarten Lankhorst <maarten.lankhorst@linux.intel.com> Cc: Tvrtko Ursulin <tvrtko.ursulin@intel.com> Cc: Imre Deak <imre.deak@intel.com> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Diffstat (limited to 'include/sound/hda_regmap.h')