Commit graph

1449 commits

Author SHA1 Message Date
Matthias Hopf
1d930fc75b drm/i915: fix ioremap of a user address for non-root (CVE-2008-3831)
Olaf Kirch noticed that the i915_set_status_page() function of the i915
kernel driver calls ioremap with an address offset that is supplied by
userspace via ioctl. The function zeroes the mapped memory via memset
and tells the hardware about the address. Turns out that access to that
ioctl is not restricted to root so users could probably exploit that to
do nasty things. We haven't tried to write actual exploit code though.

It only affects the Intel G33 series and newer.
2008-10-25 12:15:50 -04:00
Robert Noland
a8f73c214d i915: Cleanup interrupt handling 2008-10-09 22:11:55 -04:00
Alex Deucher
728d8e226f radeon: add comment to clarify bus mastering on PCIE chips 2008-10-06 12:12:49 -04:00
Alex Deucher
6f9dfa098f radeon: fix duplicate define in my last commit
That's what I get for committing at 3 AM.
2008-10-06 12:01:11 -04:00
Dave Airlie
8e5f5ed189 radeon: PCIE cards don't appear to have explicit bus master 2008-10-07 04:47:54 +10:00
Alex Deucher
4b98f6d74f radeon: fix bus master enabled bits on newer asics 2008-10-06 03:08:27 -04:00
Mihail Zenkov
5a36cce349 radeon: fix missing bit from rs740 patch
See bug 17908
2008-10-06 00:49:15 -04:00
Alex Deucher
ce40261012 radeon: Add support for HD2100 IGP (RS740) 2008-10-04 20:43:21 -04:00
Ben Skeggs
ee6bcabc50 nv50: add initial context for chipset 0xaa
This just doesn't look right..
2008-09-17 22:18:03 +10:00
Ben Skeggs
d55e8090fa nv50: add initial context to match ctxprog for chipset 0x50 2008-09-17 22:03:38 +10:00
Ben Skeggs
4d2f1257fa nv50: add ctxprog for chipset 0x50 2008-09-17 15:13:27 +10:00
Ben Skeggs
301be1dc9b nv50: add ctxprog for chipset 0xaa 2008-09-17 15:02:54 +10:00
Ben Skeggs
f152482bde nv50: add support for chipset 0x92 2008-09-17 14:52:22 +10:00
Robert Noland
6f2479c674 [FreeBSD] Ensure that drm_pci_alloc is never called while locks are held. 2008-09-06 18:37:06 -04:00
Robert Noland
3f915f68e8 i915: fix i915_ring_validate() 2008-09-05 12:38:41 -04:00
Stephane Marchesin
ce84511f4d nouveau: 8200 cards are 0xA0 family. 2008-09-05 00:17:52 +02:00
Dave Airlie
cd7d71f19c radeon: make writeback work after suspend/resume.
While re-writing this for modesetting, I find we disable writeback on
resume.
2008-08-31 07:27:26 +10:00
vehemens
71f0a3e389 [FreeBSD] Replace typedefs on bsd.
Signed-off-by: Robert Noland <rnoland@2hip.net>
2008-08-29 15:46:05 -04:00
Robert Noland
c8fd8d3a0d i915: Fix i915 build on FreeBSD
ifdef out all the gem stuff for now.  Also, the msi stuff isn't portable
the way it is... I'll try and fix that up sometime soon.
2008-08-24 15:53:17 -04:00
Robert Noland
d0acbe4553 i915: Convert vblank on disabled pipe DRM_ERROR to DRM_DEBUG. 2008-08-24 15:25:20 -04:00
Robert Noland
739b01dde4 i915: Clear sarea_priv during lastclose.
sarea_priv needs to be NULL before i915_initialized is called to
properly reset it.  The stale value produces a panic any time something
opens/closes drm without calling initialize.  i.e. version checking
2008-08-24 15:25:20 -04:00
Robert Noland
1f3c4dd938 i915: Free dev->dev_private on unload. 2008-08-24 15:25:19 -04:00
Robert Noland
16c1a87580 i915: Move spinlock init / destroy to load / unload time.
This resolves the panic on FreeBSD during VT switch, without attempting
any of the more lofty goals for the time being.
2008-08-24 15:25:19 -04:00
root
0da66c27fa nouveau: fifo and graphics engine suspend and resume for nv04-nv4x
Corresponding DDX patch at http://people.freedesktop.org/~stuart/nv0x-nv4x_suspend/
2008-08-19 02:01:14 +01:00
Maarten Maathuis
a5381cac55 nouveau: make it compile under 2.6.27 2008-08-17 00:41:50 +02:00
Eric Anholt
e1b8e79796 Merge branch 'drm-gem'
Conflicts:

	shared-core/i915_dma.c

This brings in kernel support and userland interface for intel GEM.
2008-08-08 14:05:01 -07:00
Stuart Bennett
0c47151a57 nouveau: wait for pgraph idle after loading or saving a context
the nvidia driver does this, and it stops the error message appearing on nv40
2008-08-08 16:25:05 +01:00
Dave Airlie
4585787bd1 Revert "i915: Move all of the irq install/uninstall to load time."
This reverts commit 965a72202b.

Please re-do over properly
2008-08-01 07:43:58 +10:00
Eric Anholt
ccbaad52f7 intel-gem: Replace version bump signalling GEM with I915_PARAM_HAS_GEM. 2008-07-30 14:10:36 -07:00
Eric Anholt
33c8e03787 Revert "Rename drm_mm.c and its fuctions to drm_memrange."
This reverts commit 3ad8db2071.

We ended up not needing that namespace, and I'd rather not have the churn
for producing diffs.
2008-07-30 11:25:34 -07:00
Dave Airlie
95c02743c9 i915: more version checks 2008-07-30 16:52:13 +10:00
Dave Airlie
02b09d271c i915: add version checks for opregion on old kernels 2008-07-30 16:26:59 +10:00
Nicolai Haehnle
90b90c65dc r300: Fix cliprect emit
This makes our handling of cliprects sane. drm_clip_rect always has exclusive
bottom-right corners, but the hardware expects inclusive bottom-right corners,
so we adjust this here.

This complements Michel Daenzer's commit 57aea290e1e0a26d1e74df6cff777eb9f038f1f8
to Mesa. See also http://bugs.freedesktop.org/show_bug.cgi?id=16123 .
2008-07-29 19:59:08 +02:00
Eric Anholt
0e49e49c9f intel: Fix typo in unused register definition name. 2008-07-28 23:14:47 -07:00
Eric Anholt
1d2bb68d28 Merge commit 'origin/master' into drm-gem
Conflicts:

	linux-core/Makefile.kernel
	shared-core/i915_dma.c
	shared-core/i915_drv.h
	shared-core/i915_irq.c
2008-07-28 23:12:26 -07:00
Stuart Bennett
6b903f5edf nouveau: fix nv04 fifo context save to save reg contents, not reg offset
clearly the function had never been used :)
2008-07-29 02:32:13 +01:00
Stuart Bennett
591f6bcba3 nouveau: fix bad rename from 5a072f32c8 2008-07-29 02:26:34 +01:00
Eric Anholt
487c42bd42 intel-gem: Another checkpatch.pl pass. 2008-07-28 11:45:22 -07:00
Eric Anholt
f85fd1b42d intel-gem: Speed up tiled readpixels by tracking which pages have been flushed.
This is around 3x or so speedup, since we would read wide rows at a time, and
clflush each tile 8 times as a result.  We'll want code related to this anyway
when we do fault-based per-page clflushing for sw fallbacks.
2008-07-28 11:25:19 -07:00
Eric Anholt
04ae66db1c intel-gem: Move debug-only functions to a separate file. 2008-07-26 19:52:47 -07:00
Nicolai Haehnle
c3d463840c r300_cmdbuf: Always emit INDX_BUFFER immediately after DRAW_INDEX
DRAW_INDEX writes a vertex count to VAP_VF_CNTL. Docs say that behaviour
is undefined (i.e. lockups happen) when this write is not followed by the
right number of vertex indices.

Thus we used to do the wrong thing when drawing across many cliprects was
necessary, because we emitted a sequence
 DRAW_INDEX, DRAW_INDEX, INDX_BUFFER, INDX_BUFFER
instead of
 DRAW_INDEX, INDX_BUFFER, DRAW_INDEX, INDX_BUFFER
The latter is what we're doing now and which ought to be correct.
2008-07-26 16:40:51 +02:00
Robert Noland
965a72202b i915: Move all of the irq install/uninstall to load time.
This resolves a panic on FreeBSD which was caused by trying
to re-initialize the swap lock.  It's just much easier to
initialize all of the locks at load time.  It should also
ensure that the vblank structures are available earlier.
2008-07-23 19:55:06 -04:00
Dave Airlie
589f968173 radeon: fix typo with a better typo 2008-07-22 18:47:27 +10:00
Dave Airlie
c669489813 radeon: fix type DST vs Z cache flush 2008-07-22 18:10:03 +10:00
Eric Anholt
67d1521566 intel-gem: Set up HWS when it needs a vaddr during GEM init.
This requires an updated 2D driver to not try to set it up as well.
2008-07-21 14:19:53 -07:00
Michel Dänzer
b5cddbcc15 Remove accidental leftover tests.
Thanks to Nicolai Haehnle for pointing this out on IRC.
2008-07-21 13:43:12 +02:00
Michel Dänzer
e4feaf506d radeon: Post-vblank-rework-rework cleanups.
Thanks to the reworked vblank-rework, we can just use the hardware frame
counter directly, and make the RADEON_PARAM_VBLANK_CRTC getparam just return
what was set by the corresponding setparam.
2008-07-21 08:16:59 +02:00
Jesse Barnes
04893aa99a i915: convert to using drm_vblank_get/put around vblank counter usage
All interrupt off vblank count updates are done in drm_vblank_get/put
now, so convert users of the vblank counter over to that interface.
2008-07-19 13:21:38 -04:00
Dave Airlie
7cfdba2b30 radeon: remove microcode version 2008-07-18 14:36:47 +10:00
Dave Airlie
ed7e170915 drm/radeon: fixup 0 vs NULL 2008-07-18 14:32:46 +10:00