Olaf Kirch noticed that the i915_set_status_page() function of the i915
kernel driver calls ioremap with an address offset that is supplied by
userspace via ioctl. The function zeroes the mapped memory via memset
and tells the hardware about the address. Turns out that access to that
ioctl is not restricted to root so users could probably exploit that to
do nasty things. We haven't tried to write actual exploit code though.
It only affects the Intel G33 series and newer.
Approved by: bz (secteam)
Obtained from: Intel drm repo
Security: CVE-2008-3831
but I inadvertently overwrote the change when I synced to git. Commit
the fix in both places, so this doesn't happen again.
Approved by: jhb (mentor)
MFC after: 2 weeks
will ease the identification of memory leaks as the OS will be able to track
allocations for us by malloc type. vmstat -m will show all of the
allocations.
Convert the calls to drm_alloc() and friends, which are used in shared code
to static __inline__ while we are here.
Approved by: jhb (mentor)
from operating on a list with a single item. This code is used much more by
the i915 driver with xorg-7.4. Correct it to match the actual linux
implementation.
Approved by: jhb (mentor)
busmastering support. This also adds register definitions for MSI support,
which we will be using shortly.
Approved by: jhb (mentor)
Obtained from: drm git master
We don't explicity check for error here and M_WAITOK will just put the
process to sleep waiting on resources to become available.
Suggested by jhb@
Approved by: jhb (mentor)
This reverts a private patch which is causing issues with many Intel chipsets.
I will review that patch and see what we need to do to fix it up later, but
for the time being, we will just get these chips working again.
This update contains a lot of code cleanup and is post gem merge
(no, we don't have gem support). It should prove much easier to read the
code now. A lot of thanks goes to vehemens for that work. I have adapted
the code to use cdevpriv for tracking per open file data. That alleviates
the old ugly hack that we used to try and accomplish the task and helped to
clean up the open / close behavior a good bit. This also replaces the hack
that was put in place a year or so ago to prevent radeons from locking up
with AIGLX enabled. I have had a couple of radeon testers report that it
still works as expected, though I no longer have radeon hardware to test with
myself. Other various fixes from the linux crew and Intel, many of
which are muddled in with the gem merge.
Approved by: jhb (mentor)
Obtained from: mesa/drm git master
MFC after: 2 weeks
After I removed all the unit2minor()/minor2unit() calls from the kernel
yesterday, I realised calling minor() everywhere is quite confusing.
Character devices now only have the ability to store a unit number, not
a minor number. Remove the confusion by using dev2unit() everywhere.
This commit could also be considered as a bug fix. A lot of drivers call
minor(), while they should actually be calling dev2unit(). In -CURRENT
this isn't a problem, but it turns out we never had any problem reports
related to that issue in the past. I suspect not many people connect
more than 256 pieces of the same hardware.
Reviewed by: kib
be un-cached. Our previous memory barrier was not sufficient. This patch
allocates the IGP GART tables using the BUS_DMA_NOCACHE flag to get these
cards working.
Approved by: kib
calls to bus_dma. There were multiple paths that held different locks or
no locks at all. This patch ensures that all of the calling paths drop
their lock(s) before calling drm_pci_alloc().
Reviewed by: kib
anholt thinks that he added this check as part of some regression testing,
but it is failing at least some of the time. I don't want to remove it
just yet. I added a bit of debugging to help identify the issue.
Approved by: kib
This is a sync to mesa/drm pre-gem, with a few fixes on top of that.
It also contains one local patch supplied by kib@ that I can't apply to
git.master shared code.
Approved by: flz
Obtained from: mesa/drm git.master
MFC after: 2 weeks
problems when the DRM driver is loaded and the AIXGL extension is loaded
, the AIXGL driver requests a drm_close and this will cause the radeon
driver to fail while starting X windows.
PR: kern/114688
Submitted by: vehemens <vehemens at verizon dot net>
Prodded by: Robert Noland
Approved by: imp (mentor, a while ago already), anholt
MFC After: 1 week
bumped to 800004 to note the change though userland apps should not be
affected since they use <sys/agpio.h> rather than the headers in
sys/dev/agp.
Discussed with: anholt
Repocopy by: simon
non-sleepable lock held. drm_pci_alloc() calls them, thus drm mutex shall
not be held during the call.
Move the drm_pci_alloc() to the start of the i915_initialize() and drop the
the drm mutex around it.
Reported by: Ganbold <ganbold micom mng net>
Reviewed by: anholt
Approved by: re (hrs)
MFC after: 1 week
specific privilege names to a broad range of privileges. These may
require some future tweaking.
Sponsored by: nCircle Network Security, Inc.
Obtained from: TrustedBSD Project
Discussed on: arch@
Reviewed (at least in part) by: mlaier, jmg, pjd, bde, ceri,
Alex Lyashkov <umka at sevcity dot net>,
Skip Ford <skip dot ford at verizon dot net>,
Antoine Brodin <antoine dot brodin at laposte dot net>
- Add support for Intel 965 Express chipsets.
- Add support for R200 vertex programs, along with minor bugfixes.
- Add support for vblank synchronization to pipe B of Intel hardware
(laptop screens).
Radeon memmap code, which with a new DDX driver and DRI drivers should fix
long-term stability issues with Radeons. Also adds support for r200's
ATI_fragment_shader, r300 texrect support and texture caching fixes, i915
vblank support and bugfixes, and new PCI IDs.
the addition of pci_find_extcap().
- Change the drm drivers to attach to vgapci. This is #ifdef'd so the
code can be shared across branches.
- Use pci_find_extcap() to look for AGP and PCIE capabilities in drm.
- GC all the drmsub stuff for i810/i830/i915. The agp and drm devices are
now both children of vgapci.
- S3 Savage driver ported.
- Added support for ATI_fragment_shader registers for r200.
- Improved r300 support, needed for latest r300 DRI driver.
- (possibly) r300 PCIE support, needs X.Org server from CVS.
- Added support for PCI Matrox cards.
- Software fallbacks fixed for Rage 128, which used to render badly or hang.
- Some issues reported by WITNESS are fixed.
- i915 module Makefile added, as the driver may now be working, but is untested.
- Added scripts for copying and preprocessing DRM CVS for inclusion in the
kernel. Thanks to Daniel Stone for getting me started on that.
by Vladimir Dergachev for inclusion in DRM CVS, with minor modifications for
FreeBSD CVS and the appropriate license from Nicolai Haehnle on r300_reg.h.
Fixes hangs when using r300.sf.net userland, tested on a Radeon 9600 on amd64.
handling of pci resources, and mapping framebuffer leading to panics on X
startup. The proper solution involves use of bus_alloc_resource without
RF_ACTIVE, but this code is being rewritten in DRM CVS currently, and disabling
for now doesn't remove any features, so take the easy route.
PR: kern/80718
Approved by: re (scottl)
allowed writing to the registers by any user that can open the DRI device, and
therefore ability to initiate DMA. This came in with the merge from DRI CVS on
2005-04-15.
Approved by: re (scottl)
Obtained from: DRM CVS
- Split core DRM routines back into their own module, rather than using the
nasty templated system like before.
- Development-class R300 support in radeon driver (requires userland pieces, of
course).
- Mach64 driver (haven't tested in a while -- my mach64s no longer fit in the
testbox). Covers Rage Pros, Rage Mobility P/M, Rage XL, and some others.
- i915 driver files, which just need to get drm_drv.c fixed to allow attachment
to the drmsub device. Covers i830 through i915 integrated graphics.
- savage driver files, which should require minimal changes to work. Covers the
Savage3D, Savage IX/MX, Savage 4, ProSavage.
- Support for color and texture tiling and HyperZ features of Radeon.
Thanks to: scottl (much p4 handholding)
Jung-uk Kim (helpful prodding)
PR: [1] kern/76879, [2] kern/72548
Submitted by: [1] Alex, lesha at intercaf dot ru
[2] Shaun Jurrens, shaun at shamz dot net
the type of object represented by the handle argument.
- Allow vm_mmap() to map device memory via cdev objects in addition to
vnodes and anonymous memory. Note that mmaping a cdev directly does not
currently perform any MAC checks like mapping a vnode does.
- Unbreak the DRM getbufs ioctl by having it call vm_mmap() directly on the
cdev the ioctl is acting on rather than trying to find a suitable vnode
to map from.
Reviewed by: alc, arch@
