Commit Graph

102 Commits

Author SHA1 Message Date
Eric Anholt
e47c68e9c5 drm/i915: Make a single set-to-cpu-domain path and use it wherever needed.
This fixes several domain management bugs, including potential lack of cache
invalidation for pread, potential failure to wait for set_domain(CPU, 0),
and more, along with producing more intelligible code.

Signed-off-by: Eric Anholt <eric@anholt.net>
Signed-off-by: Dave Airlie <airlied@redhat.com>
2008-12-04 11:21:55 +10:00
Eric Anholt
2ef7eeaa55 drm/i915: Make a single set-to-gtt-domain path.
This fixes failure to flush caches in the relocation update path, and
failure to wait in the set_domain ioctl, each of which could lead to incorrect
rendering.

Signed-off-by: Eric Anholt <eric@anholt.net>
Signed-off-by: Dave Airlie <airlied@redhat.com>
2008-12-04 11:21:52 +10:00
Eric Anholt
b670d81582 drm/i915: If interrupted while setting object domains, still emit the flush.
Otherwise, we would leave the objects in an inconsistent state, such as
write_domain == 0 but on the flushing list.

Signed-off-by: Dave Airlie <airlied@redhat.com>
2008-12-04 11:21:48 +10:00
Eric Anholt
ce44b0ea3d drm/i915: Move flushing list cleanup from flush request retire to request emit.
obj_priv->write_domain is "write domain if the GPU went idle now", not
"write domain at this moment."  By postponing the clear, we confused the
concept, required more storage, and potentially emitted more flushes than
are required.

Signed-off-by: Eric Anholt <eric@anholt.net>
Signed-off-by: Dave Airlie <airlied@redhat.com>
2008-12-04 11:21:45 +10:00
Eric Anholt
a7f014f2de drm/i915: Respect GM965/GM45 bit-17-instead-of-bit-11 option for swizzling.
This fixes readpixels and buffer corruption when swapped out and in by
disabling tiling on them.

Now that we know that the bit 17 mode isn't just a mistake of older chipsets,
we'll need to work on a clever fix so that we can get the performance of
tiling on these chipsets, but that will require intrusive changes targeted
at the next kernel release, not this one.

Signed-off-by: Eric Anholt <eric@anholt.net>
Signed-off-by: Dave Airlie <airlied@redhat.com>
2008-12-04 11:21:41 +10:00
Andrew Morton
9c84ba4e50 drivers/gpu/drm/i915/i915_irq.c: fix warning
drivers/gpu/drm/i915/i915_irq.c: In function 'i915_disable_pipestat':
drivers/gpu/drm/i915/i915_irq.c:101: warning: control may reach end of non-void function 'i915_pipestat' being inlined

Cc: Dave Airlie <airlied@linux.ie>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
2008-12-01 19:55:25 -08:00
Eric Anholt
151903d546 drm/i915: Fix copy'n'pasteo that broke VT switch if flushing was non-empty.
Introduced in the "Avoid BUG_ONs on VT switch" commit.

Signed-off-by: Eric Anholt <eric@anholt.net>
Signed-off-by: Dave Airlie <airlied@redhat.com>
2008-12-01 10:23:21 +10:00
Peng Li
461cba2d29 drm/i915: Save/restore HWS_PGA on suspend/resume
It fixes suspend/resume failure of xf86-video-intel dri2
branch. As dri2 branch doesn't call I830DRIResume() to restore
hardware status page anymore, we need to preserve
this register across suspend/resume.

Signed-off-by: Peng Li <peng.li@intel.com>
Signed-off-by: Eric Anholt <eric@anholt.net>
Signed-off-by: Dave Airlie <airlied@redhat.com>
2008-11-26 15:47:25 +10:00
Keith Packard
52440211dc drm: move drm vblank initialization/cleanup to driver load/unload
drm vblank initialization keeps track of the changes in driver-supplied
frame counts across vt switch and mode setting, but only if you let it by
not tearing down the drm vblank structure.

Signed-off-by: Keith Packard <keithp@keithp.com>
Signed-off-by: Dave Airlie <airlied@redhat.com>
2008-11-25 09:49:03 +10:00
Keith Packard
6133047aa6 drm/i915: execbuffer pins objects, no need to ensure they're still in the GTT
Before we had the notion of pinning objects, we had a kludge around to make
sure all of the objects were still resident in the GTT before we committed
to executing a batch buffer. We don't need this any longer, and it sticks an
error return in the middle of object domain computations that must be
associated with a subsequent flush/invalidate emmission into the ring.

Signed-off-by: Keith Packard <keithp@keithp.com>
Signed-off-by: Eric Anholt <eric@anholt.net>
Signed-off-by: Dave Airlie <airlied@redhat.com>
2008-11-25 09:28:43 +10:00
Keith Packard
05eff845a2 drm/i915: Always read pipestat in irq_handler
Because we write pipestat before iir, it's possible that a pipestat
interrupt will occur between the pipestat write and the iir write. This
leaves pipestat with an interrupt status not visible in iir. This may cause
an interrupt flood as we never clear the pipestat event.

Signed-off-by: Keith Packard <keithp@keithp.com>
Signed-off-by: Eric Anholt <eric@anholt.net>
Signed-off-by: Dave Airlie <airlied@redhat.com>
2008-11-25 09:28:28 +10:00
Keith Packard
2678d9d696 drm/i915: Subtract total pinned bytes from available aperture size
The old code was wandering through the active list looking for pinned
buffers; there may be other pinned buffers around. Fortunately, we keep a
count of the total amount of pinned memory and can use that instead.

Signed-off-by: Keith Packard <keithp@keithp.com>
Signed-off-by: Eric Anholt <eric@anholt.net>
Signed-off-by: Dave Airlie <airlied@redhat.com>
2008-11-25 09:28:06 +10:00
Eric Anholt
28dfe52a6e drm/i915: Avoid BUG_ONs on VT switch with a wedged chipset.
Instead, just warn that bad things are happening and do our best to clean up
the mess without the GPU's help.

Signed-off-by: Eric Anholt <eric@anholt.net>
Signed-off-by: Dave Airlie <airlied@redhat.com>
2008-11-25 09:27:52 +10:00
Eric Anholt
cdfbc41f6d drm/i915: Remove IMR masking during interrupt handler, and restart it if needed.
The IMR masking was a technique recommended for avoiding getting stuck with
no interrupts generated again in MSI mode.  It kept new IIR bits from getting
set between the IIR read and the IIR write, which would have otherwise
prevented an MSI from ever getting generated again.  However, this caused a
problem for vblank as the IMR mask would keep the pipe event interrupt from
getting reflected in IIR, even after the IMR mask was brought back down.

Instead, just check the state of IIR after we ack the interrupts we're going
to handle, and restart if we didn't get IIR all the way to zero.

Signed-off-by: Eric Anholt <eric@anholt.net>
Signed-off-by: Dave Airlie <airlied@redhat.com>
2008-11-25 09:27:43 +10:00
Keith Packard
7c46358642 drm/i915: Manage PIPESTAT to control vblank interrupts instead of IMR.
The pipestat fields affect reporting of all vblank-related interrupts, so we
have to reset them during the irq_handler, and while enabling vblank
interrupts.  Otherwise, if a pipe status field had been set to non-zero
before enabling reporting, we would never see an interrupt again.

This patch adds i915_enable_pipestat and i915_disable_pipestat to abstract
out the steps needed to change the reported interrupts.

Signed-off-by: Keith Packard <keithp@keithp.com>
Signed-off-by: Eric Anholt <eric@anholt.net>
Signed-off-by: Dave Airlie <airlied@redhat.com>
2008-11-25 09:27:24 +10:00
Keith Packard
0baf823a10 drm/i915: Move legacy breadcrumb out of the reserved status page area
Addresses in the hardware status page below index 0x20 are reserved for use
by the hardware. The legacy breadcrumb was sitting at index 5. Move it to
index 0x21, and make sure everyone uses the defined value instead of
hard-coded constants.

Signed-off-by: Keith Packard <keithp@keithp.com>
Signed-off-by: Dave Airlie <airlied@linux.ie>
2008-11-11 18:03:28 +10:00
Dave Airlie
afa21e0584 drm/i915: Filter pci devices based on PCI_CLASS_DISPLAY_VGA
This fixes hangs on 855-class hardware by avoiding double attachment of the
driver due to the stub second head device having the same pci id as the real
device.

Other DRM drivers probably want this treatment as well, but I'm applying it
just to this one for safety. But we should clean up the drm_pciids.h mess
now so that each driver has its own pci id list header in its own directory.
Lets do that in the next release.

Signed-off-by: Eric Anholt <eric@anholt.net>
Signed-off-by: Dave Airlie <airlied@redhat.com>
2008-11-11 18:02:12 +10:00
Dave Airlie
78538bf149 drm/radeon: map registers at load time
Now that the radeon driver has suspend/resume functions, it needs to map its
registers at load time or it will likely crash if a suspend operation occurs
before the driver has been initialized.

This patch moves the register mapping code from firstopen to load and makes
the mapping into a _DRM_DRIVER one so that the core won't remove it at
lastclose time.

Fixes (at least partially) kernel bz #11891.

Signed-off-by: Jesse Barnes <jbarnes@virtuousgeek.org>
Signed-off-by: Dave Airlie <airlied@linux.ie>
2008-11-11 17:56:16 +10:00
Eric Anholt
5d8e6bb7a2 drm: Remove infrastructure for supporting i915's vblank swapping.
It's not used in any other drivers, and doesn't look like it will be from
drm.git master.

Signed-off-by: Eric Anholt <eric@anholt.net>
Signed-off-by: Dave Airlie <airlied@linux.ie>
2008-11-11 17:44:26 +10:00
Eric Anholt
bd95e0a4a6 i915: Remove racy delayed vblank swap ioctl.
When userland detected that this ioctl was supported (by version number check),
it used it in a racy way -- dispatch delayed swap, wait for vblank, continue
rendering. As there was no mechanism for it to wait for the swap to finish,
sometimes it would render before the swap and garbage would be displayed on
the screen.

By removing the ioctl and returning -EINVAL, userland returns to its previous,
correct rendering path of waiting for a vblank then dispatching a swap.  The
only path that could have used this ioctl correctly was page flipping, which
relied on only one client running and emitting wait-for-vblank-before-rendering
in the command stream.  That path also falls back correctly, at the performance
cost of not being able to queue up rendering before the flip occurs.

Signed-off-by: Eric Anholt <eric@anholt.net>
Signed-off-by: Dave Airlie <airlied@linux.ie>
2008-11-11 17:44:22 +10:00
Eric Anholt
d3e74d0237 i915: Don't whine when pci_enable_msi() fails.
This probably just means the chipset doesn't support MSI, which is fine.

Signed-off-by: Eric Anholt <eric@anholt.net>
Signed-off-by: Dave Airlie <airlied@linux.ie>
2008-11-11 17:44:04 +10:00
Owen Taylor
6a47baa6ce i915: Don't attempt to short-circuit object_wait_rendering by checking domains.
This could return early when reading after writing a buffer, if somebody
had already put it on the flushing list (write domains are 0, but still
active), leading to glReadPixels failure.

Signed-off-by: Eric Anholt <eric@anholt.net>
Signed-off-by: Dave Airlie <airlied@linux.ie>
2008-11-11 17:43:26 +10:00
Keith Packard
ad42ca8f44 i915: Clean up sarea pointers on leavevt
This corresponds to the setup of the sarea pointers in DMA initialization,
though neither is exactly the point at which the sarea is set up or torn down.

Signed-off-by: Keith Packard <keithp@keithp.com>
Signed-off-by: Eric Anholt <eric@anholt.net>
Signed-off-by: Dave Airlie <airlied@linux.ie>
2008-11-11 17:43:14 +10:00
Keith Packard
881ee9889c i915: Save/restore MCHBAR_RENDER_STANDBY on GM965/GM45
This register is set by the 2D driver to prevent lockups, and so it needs to
be preserved across suspend/resume too. This makes my X200s work.

Signed-off-by: Keith Packard <keithp@keithp.com>
Signed-off-by: Eric Anholt <eric@anholt.net>
Signed-off-by: Dave Airlie <airlied@linux.ie>
2008-11-11 17:42:19 +10:00
Linus Torvalds
da4a22cba7 Merge branch 'io-mappings-for-linus-2' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/linux-2.6-tip
* 'io-mappings-for-linus-2' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/linux-2.6-tip:
  io mapping: clean up #ifdefs
  io mapping: improve documentation
  i915: use io-mapping interfaces instead of a variety of mapping kludges
  resources: add io-mapping functions to dynamically map large device apertures
  x86: add iomap_atomic*()/iounmap_atomic() on 32-bit using fixmaps
2008-11-03 10:15:40 -08:00
Linus Torvalds
30ef898c53 Merge branch 'drm-next' of git://git.kernel.org/pub/scm/linux/kernel/git/airlied/drm-2.6
* 'drm-next' of git://git.kernel.org/pub/scm/linux/kernel/git/airlied/drm-2.6:
  i915: Add GEM ioctl to get available aperture size.
  drm/radeon: fixup further bus mastering confusion.
  build fix: CONFIG_DRM_I915=y && CONFIG_ACPI=n
2008-11-03 09:58:40 -08:00
Eric Anholt
5a125c3c79 i915: Add GEM ioctl to get available aperture size.
This will let userland know when to submit its batchbuffers, before they get
too big to fit in the aperture.

Signed-off-by: Eric Anholt <eric@anholt.net>
Signed-off-by: Dave Airlie <airlied@redhat.com>
2008-11-03 10:56:49 +10:00
Al Viro
233e70f422 saner FASYNC handling on file close
As it is, all instances of ->release() for files that have ->fasync()
need to remember to evict file from fasync lists; forgetting that
creates a hole and we actually have a bunch that *does* forget.

So let's keep our lives simple - let __fput() check FASYNC in
file->f_flags and call ->fasync() there if it's been set.  And lose that
crap in ->release() instances - leaving it there is still valid, but we
don't have to bother anymore.

Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
2008-11-01 09:49:46 -07:00
Keith Packard
0839ccb8ac i915: use io-mapping interfaces instead of a variety of mapping kludges
Impact: optimize/clean-up the IO mapping implementation of the i915 DRM driver

Switch the i915 device aperture mapping to the io-mapping interface, taking
advantage of the cleaner API to extend it across all of the mapping uses,
including both pwrite and relocation updates.

This dramatically improves performance on 64-bit kernels which were using
the same slow path as 32-bit non-HIGHMEM kernels prior to this patch.

Signed-off-by: Keith Packard <keithp@keithp.com>
Signed-off-by: Eric Anholt <eric@anholt.net>
Signed-off-by: Ingo Molnar <mingo@elte.hu>
2008-10-31 10:12:40 +01:00
Alex Deucher
4e270e9b8a drm/radeon: fixup further bus mastering confusion.
rs400/480 are like previous chips not like rs6xx chips.

Signed-off-by: Dave Airlie <airlied@redhat.com>
2008-10-28 07:48:34 +10:00
Len Brown
65e082c9a3 build fix: CONFIG_DRM_I915=y && CONFIG_ACPI=n
drivers/gpu/drm/i915/i915_opregion.c:340: error: implicit declaration of function ‘register_acpi_notifier’
drivers/gpu/drm/i915/i915_opregion.c:361: error: implicit declaration of function ‘unregister_acpi_notifier’

Signed-off-by: Len Brown <len.brown@intel.com>
Signed-off-by: Eric Anholt <eric@anholt.net>
Signed-off-by: Dave Airlie <airlied@redhat.com>
2008-10-28 07:46:06 +10:00
Linus Torvalds
70740d6c93 Merge branch 'drm-next' of git://git.kernel.org/pub/scm/linux/kernel/git/airlied/drm-2.6
* 'drm-next' of git://git.kernel.org/pub/scm/linux/kernel/git/airlied/drm-2.6:
  drm: Avoid oops in DRM_IOCTL_RM_DRAW if a bad handle is supplied.
  drm: Add 32-bit compatibility for DRM_IOCTL_UPDATE_DRAW.
  drm/i915: use pipes, not planes to label vblank data
  drm/i915: hold dev->struct_mutex and DRM lock during vblank ring operations
  i915: Fix format string warnings on x86-64.
  i915: Don't dereference HWS in /proc debug files when it isn't initialized.
  i915: Enable IMR passthrough of vblank events before enabling it in pipestat.
  drm: Remove two leaks of vblank reference count in error paths.
  drm: fix leak of cliprects in drm_rmdraw()
  i915: Disable MSI on GM965 (errata says it doesn't work)
  drm: Set cliprects to NULL when changing drawable to having 0 cliprects.
  i915: Protect vblank IRQ reg access with spinlock
2008-10-23 10:18:40 -07:00
Eric Anholt
7e78f72524 drm: Avoid oops in DRM_IOCTL_RM_DRAW if a bad handle is supplied.
Signed-off-by: Eric Anholt <eric@anholt.net>
Acked-by: Michel Dänzer <michel@tungstengraphics.com>
Signed-off-by: Dave Airlie <airlied@redhat.com>
2008-10-23 13:46:54 +10:00
Eric Anholt
4956887370 drm: Add 32-bit compatibility for DRM_IOCTL_UPDATE_DRAW.
This fixes vblank support for a 32-bit X Server on a 64-bit kernel.

Signed-off-by: Eric Anholt <eric@anholt.net>
Signed-off-by: Dave Airlie <airlied@redhat.com>
2008-10-23 13:46:33 +10:00
Keith Packard
42f52ef8d9 drm/i915: use pipes, not planes to label vblank data
vblank in the kernel is far simpler if it deals with pipes instead of
planes, so we're changing both user and kernel side.

Signed-off-by: Keith Packard <keithp@keithp.com>
Signed-off-by: Eric Anholt <eric@anholt.net>
Signed-off-by: Dave Airlie <airlied@redhat.com>
2008-10-23 13:46:17 +10:00
Keith Packard
9e44af790f drm/i915: hold dev->struct_mutex and DRM lock during vblank ring operations
To synchronize clip lists with the X server, the DRM lock must be held while
looking at drawable clip lists. To synchronize with other ring access, the
ring mutex must be held while inserting commands into the ring.  Failure to
do the first resulted in easy visual corruption when moving windows, and the
second could have corrupted the ring with DRI2.

Grabbing the DRM lock involves using the DRM tasklet mechanism, grabbing the
ring mutex means potentially sleeping. Deal with both of these by always
running the tasklet from a work handler.

Also, protect from clip list changes since the vblank request was queued by
making sure the window has at least one rectangle while looking inside,
preventing oopses .

Signed-off-by: Keith Packard <keithp@keithp.com>
Signed-off-by: Eric Anholt <eric@anholt.net>
Signed-off-by: Dave Airlie <airlied@redhat.com>
2008-10-23 13:45:56 +10:00
Linus Torvalds
fe8133dc07 i915: Fix format string warnings on x86-64.
Signed-off-by: Eric Anholt <eric@anholt.net>
Signed-off-by: Dave Airlie <airlied@redhat.com>
2008-10-23 13:42:27 +10:00
Eric Anholt
a2d44cca4f i915: Don't dereference HWS in /proc debug files when it isn't initialized.
Signed-off-by: Eric Anholt <eric@anholt.net>
Acked-by: Keith Packard <keithp@keithp.com>
Signed-off-by: Dave Airlie <airlied@redhat.com>
2008-10-23 13:42:27 +10:00
Eric Anholt
053d7f244a i915: Enable IMR passthrough of vblank events before enabling it in pipestat.
Otherwise, if we lost the race, the pipestat bit would be set without being
reflected in IIR, and we would never clear the pipestat bit so the pipe
event would never be generated again, and all vblank waits would time out.

Signed-off-by: Eric Anholt <eric@anholt.net>
Acked-by: Keith Packard <keithp@keithp.com>
Signed-off-by: Dave Airlie <airlied@redhat.com>
2008-10-23 13:42:27 +10:00
Eric Anholt
35ad68c181 drm: Remove two leaks of vblank reference count in error paths.
If the failing paths were hit, the vblank IRQ would never get turned off
again.

Signed-off-by: Eric Anholt <eric@anholt.net>
Acked-by: Keith Packard <keithp@keithp.com>
Signed-off-by: Dave Airlie <airlied@redhat.com>
2008-10-23 13:42:27 +10:00
Zhenyu Wang
786225eb2f drm: fix leak of cliprects in drm_rmdraw()
Signed-off-by: Zhenyu Wang <zhenyu.z.wang@intel.com>
Signed-off-by: Eric Anholt <eric@anholt.net>
Signed-off-by: Dave Airlie <airlied@redhat.com>
2008-10-23 13:42:26 +10:00
Keith Packard
d1ed629f44 i915: Disable MSI on GM965 (errata says it doesn't work)
Current Intel errata for the GM965 says that using MSI may cause interrupts
to be delayed or lost. The only workaround offered is to not use it.

Signed-off-by: Keith Packard <keithp@keithp.com>
Signed-off-by: Eric Anholt <eric@anholt.net>
Signed-off-by: Dave Airlie <airlied@redhat.com>
2008-10-23 13:42:26 +10:00
Zhenyu Wang
863842736f drm: Set cliprects to NULL when changing drawable to having 0 cliprects.
This avoids setting the cliprects pointer to a zero-sized allocation.

Signed-off-by: Zhenyu Wang <zhenyu.z.wang@intel.com>
Signed-off-by: Eric Anholt <eric@anholt.net>
Signed-off-by: Dave Airlie <airlied@redhat.com>
2008-10-23 13:42:26 +10:00
Keith Packard
e9d21d7f5a i915: Protect vblank IRQ reg access with spinlock
This uses the same spinlock as the user_irq code as it shares the same
register, ensuring that interrupt registers are updated atomically.

Signed-off-by: Keith Packard <keithp@keithp.com>
Signed-off-by: Eric Anholt <eric@anholt.net>
Signed-off-by: Dave Airlie <airlied@redhat.com>
2008-10-23 13:42:26 +10:00
Hugh Dickins
e798ba57e9 Export tiny shmem_file_setup for DRM-GEM
We're trying to keep the !CONFIG_SHMEM tiny-shmem.c (using ramfs without
swap) in synch with CONFIG_SHMEM shmem.c (and mpm is preparing patches
to combine them).  I was glad to see EXPORT_SYMBOL_GPL(shmem_file_setup)
go into shmem.c, but why not support DRM-GEM when !CONFIG_SHMEM too?
But caution says still depend on MMU, since !CONFIG_MMU is.. different.

Signed-off-by: Hugh Dickins <hugh@veritas.com>
Acked-by: Matt Mackall <mpm@selenic.com>
Acked-by: Dave Airlie <airlied@redhat.com>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
2008-10-20 16:17:42 -07:00
Thomas Gleixner
e8848a170f fix CONFIG_HIGHMEM compile error in drivers/gpu/drm/i915/i915_gem.c
commit 9b7530cc32 ("i915: cleanup coding
horrors in i915_gem_gtt_pwrite()")

broke the i386 build for CONFIG_HIGHMEM=y.

Caught by automatic testing http://www.tglx.de/autoqa-logs/000137-0006-0001.log

Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
[ My bad. It's the same patch I sent out earlier, nobody noticed then either.. ]
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
2008-10-20 16:15:14 -07:00
Linus Torvalds
9b7530cc32 i915: cleanup coding horrors in i915_gem_gtt_pwrite()
Yes, this will probably be switched over to a cleaner model anyway, but
in the meantime I don't want to see the 'unused variable' warnings that
come from the disgusting #ifdef code.  Make the special case be a nice
inlien function of its own, clean up the code, and make the warning go
away.

I wish people didn't write code that gets (valid) warnings from the
compiler, but I'll limit my fixes to code that I actually care about (in
this case just because I see the warning and it annoys me).

Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
2008-10-20 14:16:43 -07:00
Linus Torvalds
1ae8778680 Fix sprintf format warnings in drm_proc.c
Use "%zd" for size_t, and make sure to have a space between the numbers
instead of depending on the field width.

I don't like warnings in my default targeted build.

Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
2008-10-20 14:14:25 -07:00
Matthias Hopf
4b40893918 drm/i915: fix ioremap of a user address for non-root (CVE-2008-3831)
Olaf Kirch noticed that the i915_set_status_page() function of the i915
kernel driver calls ioremap with an address offset that is supplied by
userspace via ioctl. The function zeroes the mapped memory via memset
and tells the hardware about the address. Turns out that access to that
ioctl is not restricted to root so users could probably exploit that to
do nasty things. We haven't tried to write actual exploit code though.

It only affects the Intel G33 series and newer.

Signed-off-by: Dave Airlie <airlied@redhat.com>
2008-10-18 07:18:05 +10:00
Dave Airlie
9e0b97e37f drm: make CONFIG_DRM depend on CONFIG_SHMEM.
This can be removed later when DRM doesn't depend on shmem.

Signed-off-by: Dave Airlie <airlied@redhat.com>
2008-10-18 07:10:54 +10:00