OSDN Git Service
Matthias Hopf [Sat, 25 Oct 2008 16:11:44 +0000 (12:11 -0400)]
drm/i915: fix ioremap of a user address for non-root (CVE-2008-3831)
Olaf Kirch noticed that the i915_set_status_page() function of the i915
kernel driver calls ioremap with an address offset that is supplied by
userspace via ioctl. The function zeroes the mapped memory via memset
and tells the hardware about the address. Turns out that access to that
ioctl is not restricted to root so users could probably exploit that to
do nasty things. We haven't tried to write actual exploit code though.
It only affects the Intel G33 series and newer.
Xiang, Haihao [Fri, 24 Oct 2008 08:35:00 +0000 (16:35 +0800)]
intel: Also total child_size of the target_bos. Partial fix #17964.
Robert Noland [Thu, 23 Oct 2008 19:46:32 +0000 (15:46 -0400)]
[FreeBSD] We should use dev2unit() rather than minor()
Robert Noland [Thu, 23 Oct 2008 19:42:49 +0000 (15:42 -0400)]
[FreeBSD] This check isn't correct and causes at least mga to lockup.
Keith Packard [Fri, 17 Oct 2008 04:15:01 +0000 (21:15 -0700)]
intel: ioctl is not defined to return -errno
Don't count on ioctl returning -errno; use errno directly.
Signed-off-by: Keith Packard <keithp@keithp.com>
Signed-off-by: Eric Anholt <eric@anholt.net>
Xiang, Haihao [Thu, 16 Oct 2008 02:37:30 +0000 (10:37 +0800)]
intel: avoid deadlock in intel_bufmgr_fake.
Eric Anholt [Tue, 14 Oct 2008 20:33:38 +0000 (13:33 -0700)]
intel: Fix compile warning.
Eric Anholt [Tue, 14 Oct 2008 20:18:11 +0000 (13:18 -0700)]
intel: Add interface for getting tiling mode of a bo.
Julien Cristau [Mon, 13 Oct 2008 23:25:57 +0000 (01:25 +0200)]
link libdrm_intel properly
libdrm_intel needs symbols from libdrm, so link against it.
Eric Anholt [Mon, 13 Oct 2008 20:41:10 +0000 (13:41 -0700)]
intel: Avoid pthread mutex recursion in bufmgr_fake.
Bug #18035. Fixes deadlock in glean texCube testcase.
Dave Airlie [Sun, 12 Oct 2008 21:16:33 +0000 (07:16 +1000)]
libdrm: don't depend or link to libdrm_intel
Robert Noland [Fri, 10 Oct 2008 22:23:11 +0000 (18:23 -0400)]
[FreeBSD] Plug memory leak in drm_rmdraw() and drm_drawable_free_all()
Robert Noland [Fri, 10 Oct 2008 17:06:22 +0000 (13:06 -0400)]
[FreeBSD] Rework all of the memory allocations
Allocate memory from different pools. This allows the OS to track memory
allocations for us, much like the linux memory debugging. This will ease
tracking down memory leaks since the OS can track the number of allocations
from each pool and help to point us in the right direction. Also replace
drm_alloc and friends with static __inline__ versions while we are here.
Robert Noland [Fri, 10 Oct 2008 02:13:26 +0000 (22:13 -0400)]
[FreeBSD] Fix linux list compat list_for_each_safe()
linux_for_each_safe would not handle lists with a single entry.
Robert Noland [Fri, 10 Oct 2008 02:11:55 +0000 (22:11 -0400)]
i915: Cleanup interrupt handling
Keith Packard [Thu, 9 Oct 2008 21:30:56 +0000 (14:30 -0700)]
Manage fences in user-mode bufmgr_fake to clean buffers
When using bufmgr_fake without DRM, the X server idles the ring whenever it
wants to wait for something to complete (brutal, but effective). In this
case, bufmgr_fake must treat the pending fence as having passed. However, it
wasn't recording the fences as it emitted them, nor cleaning buffers as they
passed.
Signed-off-by: Keith Packard <keithp@keithp.com>
Eric Anholt [Fri, 13 Jun 2008 06:22:26 +0000 (23:22 -0700)]
intel: Protect bufmgr objects with a pthread mutex.
We want to be able to use the bufmgr from multiple threads for GL, and thus
we need to protect the internal structures.
The pthread-stubs package is used so that programs not linked against
pthreads get weak symbols to stubs and don't eat most of the cost.
Xiang, Haihao [Thu, 9 Oct 2008 03:57:13 +0000 (11:57 +0800)]
intel: fix for write_domain and static BOs.
http://bugs.freedesktop.org/show_bug.cgi?id=17705
Alex Deucher [Mon, 6 Oct 2008 16:12:49 +0000 (12:12 -0400)]
radeon: add comment to clarify bus mastering on PCIE chips
Alex Deucher [Mon, 6 Oct 2008 16:01:11 +0000 (12:01 -0400)]
radeon: fix duplicate define in my last commit
That's what I get for committing at 3 AM.
Dave Airlie [Mon, 6 Oct 2008 18:47:54 +0000 (04:47 +1000)]
radeon: PCIE cards don't appear to have explicit bus master
Dave Airlie [Tue, 16 Sep 2008 17:00:02 +0000 (03:00 +1000)]
drm: add create gpu tree script
Alex Deucher [Mon, 6 Oct 2008 07:08:27 +0000 (03:08 -0400)]
radeon: fix bus master enabled bits on newer asics
Mihail Zenkov [Mon, 6 Oct 2008 04:49:15 +0000 (00:49 -0400)]
radeon: fix missing bit from rs740 patch
See bug 17908
Alex Deucher [Sun, 5 Oct 2008 00:43:21 +0000 (20:43 -0400)]
radeon: Add support for HD2100 IGP (RS740)
Robert Noland [Fri, 3 Oct 2008 18:11:20 +0000 (14:11 -0400)]
[FreeBSD] Don't explicitly bzero driver softc.
This is already handled for us.
Suggested by John Baldwin
Robert Noland [Fri, 3 Oct 2008 18:05:45 +0000 (14:05 -0400)]
[FreeBSD] Use M_WAITOK when allocating driver memory.
We don't explicitly check for error here and M_WAITOK will just put the
process to sleep waiting on resources to become available.
Suggested by John Baldwin
Robert Noland [Fri, 3 Oct 2008 17:56:50 +0000 (13:56 -0400)]
[FreeBSD] Do a bit of optimization on drm_order()
Robert Noland [Sat, 20 Sep 2008 22:34:57 +0000 (18:34 -0400)]
Use devfs_get_cdevpriv in mmap as well.
d_mmap gets called twice and we are only able to associate the file_priv
during the first call. The second call will return EBADF and we need to
assume that the call was succesful. d_mmap will not tolerate having an
error returned for the second call.
Xiang, Haihao [Sat, 27 Sep 2008 03:01:24 +0000 (11:01 +0800)]
intel: Copy data from card memory back to backing store when mapping.
Fixes http://bugs.freedesktop.org/show_bug.cgi?id=17705
Eric Anholt [Wed, 24 Sep 2008 00:06:01 +0000 (17:06 -0700)]
intel: Allow up to 15 seconds chewing on one buffer before acknowledging -EBUSY.
The gltestperf demo in some cases took over seven seconds to make it through
one batchbuffer on a GM965.
Bug #17004.
Eric Anholt [Tue, 23 Sep 2008 17:48:39 +0000 (10:48 -0700)]
intel: Replace wraparound test logic in bufmgr_fake. Again.
I'd swapped the operands, so if we weren't in lockstep with the hardware we
said the sequence was always passed. Additionally, a race was available that
we might have failed at recovering from. Instead, I've replaced the logic
with new stuff that should be more robust and not rely on all the parties in
userland following the same IRQ_EMIT() == 1 protocol. Also, in a radical
departure from past efforts, include a long comment describing the failure
modes and how we're working around them.
Thanks to haihao for catching the original issue.
Eric Anholt [Tue, 23 Sep 2008 17:47:21 +0000 (10:47 -0700)]
intel: Do strerror on errno, not on the -1 return value from ioctl.
Xiang, Haihao [Mon, 22 Sep 2008 02:16:19 +0000 (10:16 +0800)]
intel: Fix driver-supplied argument to exec function (fd.o bug #17653).
Robert Noland [Thu, 18 Sep 2008 03:10:15 +0000 (23:10 -0400)]
[FreeBSD] Convert to using cdevpriv for file_priv tracking
Ben Skeggs [Wed, 17 Sep 2008 12:18:03 +0000 (22:18 +1000)]
nv50: add initial context for chipset 0xaa
This just doesn't look right..
Ben Skeggs [Wed, 17 Sep 2008 12:03:38 +0000 (22:03 +1000)]
nv50: add initial context to match ctxprog for chipset 0x50
Ben Skeggs [Wed, 17 Sep 2008 05:13:27 +0000 (15:13 +1000)]
nv50: add ctxprog for chipset 0x50
Ben Skeggs [Wed, 17 Sep 2008 05:02:54 +0000 (15:02 +1000)]
nv50: add ctxprog for chipset 0xaa
Ben Skeggs [Wed, 17 Sep 2008 04:49:04 +0000 (14:49 +1000)]
nv50: add support for chipset 0x92
vehemens [Tue, 9 Sep 2008 05:06:09 +0000 (22:06 -0700)]
Remove incomplete and obsolete free/net/open code.
Signed-off-by: Robert Noland <rnoland@2hip.net>
Eric Anholt [Thu, 11 Sep 2008 03:04:42 +0000 (20:04 -0700)]
Add missing \ to libdrm_la_SOURCES
Reported by jcristau.
Eric Anholt [Wed, 10 Sep 2008 20:54:34 +0000 (13:54 -0700)]
intel: don't forget to include config.h in bufmgr code.
Thanks to airlied for catching this.
Eric Anholt [Mon, 8 Sep 2008 15:51:40 +0000 (08:51 -0700)]
intel: move drm calls to exec buffers to libdrm_intel.
This avoids duplicating the effort in 3 places. Also, added emit/wait fence
callbacks back in bufmgr_fake since we need it for non-drm 2d. Sigh.
Eric Anholt [Sat, 6 Sep 2008 02:07:41 +0000 (03:07 +0100)]
intel: Move IRQ emit/wait from callbacks into the bufmgr.
In the process, work around the glaring bugs of the kernel irq wait function.
Eric Anholt [Fri, 5 Sep 2008 09:35:32 +0000 (10:35 +0100)]
Move intel libdrm stuff to libdrm_intel.so
dri_bufmgr.h is replaced by intel_bufmgr.h, and several functions are renamed,
though the structures and many functions remain dri_bufmgr_* and dri_bo_*
Eric Anholt [Wed, 3 Sep 2008 22:05:16 +0000 (23:05 +0100)]
drm: Add tests for GEM_FLINK ioctl.
Robert Noland [Mon, 8 Sep 2008 20:40:52 +0000 (16:40 -0400)]
[FreeBSD] We need to call drm_detach before we free dev->driver.
The driver is in control of the show, so when you try and unload a module
the driver detach routine is called first. It is what drives the whole
unload process and so lots of panics occur if dev->driver is already
free.
Robert Noland [Sun, 7 Sep 2008 16:44:02 +0000 (12:44 -0400)]
[FreeBSD] Implement drm_ioremap_wc() to set a range of mem to write-combining
Robert Noland [Sun, 7 Sep 2008 01:08:33 +0000 (21:08 -0400)]
[FreeBSD] IGP gart needs to be un-cached.
Airlied inadvertently discovered that the IGP gart needs to be un-cached
for radeon rs485 and rs690 to work. Initial tests by placing a wbinvd()
after allocating the gart were successful. This is an attempt at a more
appropriate method of achieving success.
vehemens [Sun, 7 Sep 2008 01:02:31 +0000 (18:02 -0700)]
Free temp_pagelist on error. Free in reverse order. Noticed by open.
Signed-off-by: Robert Noland <rnoland@2hip.net>
vehemens [Sat, 6 Sep 2008 22:33:47 +0000 (15:33 -0700)]
Pass lock data like linux and open.
Signed-off-by: Robert Noland <rnoland@2hip.net>
vehemens [Sat, 6 Sep 2008 21:19:32 +0000 (14:19 -0700)]
Move order to end like linux.
Signed-off-by: Robert Noland <rnoland@2hip.net>
vehemens [Sat, 6 Sep 2008 21:16:51 +0000 (14:16 -0700)]
Style white space cleanup part 2.
Signed-off-by: Robert Noland <rnoland@2hip.net>
Robert Noland [Sat, 6 Sep 2008 22:37:06 +0000 (18:37 -0400)]
[FreeBSD] Ensure that drm_pci_alloc is never called while locks are held.
vehemens [Tue, 2 Sep 2008 20:56:35 +0000 (13:56 -0700)]
Reorder lock functions like linux.
Signed-off-by: Robert Noland <rnoland@2hip.net>
vehemens [Tue, 2 Sep 2008 11:57:36 +0000 (04:57 -0700)]
Style white space cleanup.
Signed-off-by: Robert Noland <rnoland@2hip.net>
vehemens [Tue, 2 Sep 2008 09:43:19 +0000 (02:43 -0700)]
Need M_NOWAIT for malloc.
Signed-off-by: Robert Noland <rnoland@2hip.net>
Robert Noland [Fri, 5 Sep 2008 15:52:53 +0000 (11:52 -0400)]
i915: fix i915_ring_validate()
Stephane Marchesin [Thu, 4 Sep 2008 22:17:52 +0000 (00:17 +0200)]
nouveau: 8200 cards are 0xA0 family.
Dave Airlie [Tue, 2 Sep 2008 00:07:14 +0000 (10:07 +1000)]
drm: fix sysfs error path.
Pointed out by Roel Kluin on dri-devel.
Signed-off-by: Dave Airlie <airlied@redhat.com>
Dave Airlie [Sat, 30 Aug 2008 21:27:26 +0000 (07:27 +1000)]
radeon: make writeback work after suspend/resume.
While re-writing this for modesetting, I find we disable writeback on
resume.
vehemens [Thu, 28 Aug 2008 02:11:04 +0000 (19:11 -0700)]
[FreeBSD] Use driver features macros and flags
Signed-off-by: Robert Noland <rnoland@2hip.net>
vehemens [Fri, 29 Aug 2008 17:18:54 +0000 (13:18 -0400)]
[FreeBSD] Convert drm_driver to a pointer like linux.
Signed-off-by: Robert Noland <rnoland@2hip.net>
vehemens [Fri, 29 Aug 2008 16:47:00 +0000 (12:47 -0400)]
[FreeBSD] Replace typedefs on bsd.
Signed-off-by: Robert Noland <rnoland@2hip.net>
vehemens [Fri, 29 Aug 2008 16:40:30 +0000 (12:40 -0400)]
[FreeBSD] Catch up to vblank rework for via.
(No, we don't build via right now.)
Signed-off-by: Robert Noland <rnoland@2hip.net>
vehemens [Fri, 29 Aug 2008 16:37:29 +0000 (12:37 -0400)]
[FreeBSD] Correct debug message
Signed-off-by: Robert Noland <rnoland@2hip.net>
Robert Noland [Fri, 29 Aug 2008 16:29:50 +0000 (12:29 -0400)]
[FreeBSD] Fix a couple of locking problems.
Robert Noland [Fri, 29 Aug 2008 16:23:35 +0000 (12:23 -0400)]
[FreeBSD] Increase debugging output for vblank code.
Doing my part to make DRM_DEBUG more chatty...
Tomas Carnecky [Thu, 28 Aug 2008 22:43:19 +0000 (00:43 +0200)]
Fix drm_realloc when you're reallocing into something smaller.
Stephane Marchesin [Wed, 27 Aug 2008 00:27:10 +0000 (02:27 +0200)]
Change git-describe into git describe.
Kristian Høgsberg [Tue, 26 Aug 2008 18:28:08 +0000 (14:28 -0400)]
[intel_bufmgr_gem] Remember global name when creating buffer from name.
Robert Noland [Sun, 24 Aug 2008 19:53:17 +0000 (15:53 -0400)]
i915: Fix i915 build on FreeBSD
ifdef out all the gem stuff for now. Also, the msi stuff isn't portable
the way it is... I'll try and fix that up sometime soon.
Robert Noland [Sat, 23 Aug 2008 01:45:41 +0000 (21:45 -0400)]
[FreeBSD] Add drm_drawable_free_all()
Robert Noland [Sat, 23 Aug 2008 01:34:25 +0000 (21:34 -0400)]
[FreeBSD] Fix long standing memory leak in drm_remove_magic.
We shuffled all the links around to disconnect the entry, but
never free it. We would incorrectly free the last entry in the
hash chain if nothing matched.
Robert Noland [Sat, 23 Aug 2008 01:32:37 +0000 (21:32 -0400)]
i915: Convert vblank on disabled pipe DRM_ERROR to DRM_DEBUG.
Robert Noland [Wed, 20 Aug 2008 21:20:31 +0000 (17:20 -0400)]
i915: Clear sarea_priv during lastclose.
sarea_priv needs to be NULL before i915_initialized is called to
properly reset it. The stale value produces a panic any time something
opens/closes drm without calling initialize. i.e. version checking
Robert Noland [Wed, 20 Aug 2008 21:15:46 +0000 (17:15 -0400)]
i915: Free dev->dev_private on unload.
vehemens [Wed, 13 Aug 2008 21:19:35 +0000 (17:19 -0400)]
[FreeBSD] Move vblank bits into their own structure.
Signed-off-by: Robert Noland <rnoland@2hip.net>
vehemens [Wed, 13 Aug 2008 21:17:05 +0000 (17:17 -0400)]
[FreeBSD] Fix lock leak.
Signed-off-by: Robert Noland <rnoland@2hip.net>
Robert Noland [Wed, 13 Aug 2008 21:05:59 +0000 (17:05 -0400)]
i915: Move spinlock init / destroy to load / unload time.
This resolves the panic on FreeBSD during VT switch, without attempting
any of the more lofty goals for the time being.
Dave Airlie [Sun, 24 Aug 2008 06:54:43 +0000 (16:54 +1000)]
libdrm: add udev support.
This patch allows you to --enable-udev, and will avoid having libdrm
make device nodes. If you are using udev, you should really --enable-udev
your libdrm.
root [Tue, 6 May 2008 22:04:55 +0000 (23:04 +0100)]
nouveau: fifo and graphics engine suspend and resume for nv04-nv4x
Corresponding DDX patch at http://people.freedesktop.org/~stuart/nv0x-nv4x_suspend/
Coleman Kane [Mon, 18 Aug 2008 21:08:21 +0000 (17:08 -0400)]
Change prototype of drmIoctl to unsigned long request.
This resolves and issue on amd64 FreeBSD and it looks like the
linux ioctl syscall should be unsigned long as well.
Signed-off-by: Robert Noland <rnoland@2hip.net>
Maarten Maathuis [Sat, 16 Aug 2008 22:41:50 +0000 (00:41 +0200)]
nouveau: make it compile under 2.6.27
Maarten Maathuis [Thu, 14 Aug 2008 17:35:55 +0000 (19:35 +0200)]
linux: on_each_cpu has 3 args on 2.6.27
Thomas Hellstrom [Wed, 13 Aug 2008 08:04:21 +0000 (10:04 +0200)]
Don't call the vblank tasklet with irqs disabled.
If a specific tasklet shares data with irq context,
it needs to take a private irq-blocking spinlock within
the tasklet itself.
Kristian Høgsberg [Wed, 13 Aug 2008 02:22:15 +0000 (22:22 -0400)]
[intel_bufmgr_gem] Fix flink buffer name caching (#17085, #17092).
Store the global name in global_name, don't overwrite the gem_handle.
Matthieu Herrb [Mon, 11 Aug 2008 17:44:39 +0000 (10:44 -0700)]
libdrm: Allow build outside of source tree.
Dave Airlie [Mon, 11 Aug 2008 00:58:41 +0000 (10:58 +1000)]
drm_vm: fix for build on 2.6.22
thanks to malc0 for pointing it out
Dave Airlie [Mon, 11 Aug 2008 00:47:00 +0000 (10:47 +1000)]
drm: add OS_HAS_GEM option.
To build i915 driver pass OS_HAS_GEM=1 to make for now
Dave Airlie [Sat, 9 Aug 2008 07:19:16 +0000 (17:19 +1000)]
drm: TRUE/true
Eric Anholt [Fri, 8 Aug 2008 22:55:34 +0000 (15:55 -0700)]
Drop TTM interfaces from the userland library.
Eric Anholt [Fri, 8 Aug 2008 21:08:43 +0000 (14:08 -0700)]
Fix compile warning from check_aperture change.
Eric Anholt [Fri, 8 Aug 2008 21:05:01 +0000 (14:05 -0700)]
Merge branch 'drm-gem'
Conflicts:
shared-core/i915_dma.c
This brings in kernel support and userland interface for intel GEM.
Eric Anholt [Fri, 8 Aug 2008 20:13:46 +0000 (13:13 -0700)]
Replace the check_aperture API with one we can make thread-safe.
While the bufmgr isn't thread-safe at the moment, we need it to be for shared
objects between contexts.
Stuart Bennett [Fri, 8 Aug 2008 15:20:52 +0000 (16:20 +0100)]
nouveau: wait for pgraph idle after loading or saving a context
the nvidia driver does this, and it stops the error message appearing on nv40
Keith Packard [Thu, 7 Aug 2008 22:26:30 +0000 (15:26 -0700)]
Make flink save the kernel-assigned name and return it instead of creating another name
Keith Packard [Tue, 5 Aug 2008 06:33:03 +0000 (23:33 -0700)]
Switch from shmem_getpage to read_mapping_page
Keith Packard [Tue, 5 Aug 2008 23:06:40 +0000 (16:06 -0700)]
[gem-intel] Retiring flush requests should clear flushed write_domains
When i915_gem_retire_request has a flush which matches an object write
domain, clear the write domain. This will move the object to the inactive
list rather than the flushing list, avoiding trouble with objects left stuck
on the flushing list.