The overflows could cause valid offsets to get rejected under some
circumstances, e.g. when the framebuffer resides at the very end of the card's
address space.
0x00 EXE fence. Signals when command stream interpreter has reached the point
where the fence was emitted.
0x01 FLUSH fence. Signals when command stream interpreter has reached the point
where the fence was emitted, and all previous drawing operations have been
completed and flushed.
Implements busy wait (for fastest response time / high CPU) and
lazy wait (User interrupt or timer driven).
Commit 2a47f6bfec caused the CHIP_IS_AGP flag to
get 'restored' with PCI(e) cards. I can't think of a way to fix this without
introducing a (otherwise redundant) CHIP_IS_PCI flag.
Not doing this might waste bus bandwidth or even cause memory corruption or
system crashes on systems that check bus transfers. No such incident has been
reported though.
32-bit physical device addresses are mapped directly to user-tokens. No
duplicate maps are allowed, and the addresses are assumed to be outside
of the range 0x10000000 through 0x30000000. The user-token is identical
to the 32-bit physical start-address of the map.
64-bit physical device addressed are mapped to user-tokens in the range
0x10000000 to 0x30000000 with page-size increments. The user_token should
not be interpreted as an address.
Other map types, like upcoming TTM maps are mapped to user-tokens in the
range
0x10000000 to 0x30000000 with page-size increments. The user_token should
not be interpreted as an address.
This keeps compatibility with buggy drivers, while still implementing a
hashed map lookup. The SiS and via device driver major bumps are
reverted.
0x10000000 to 0x90000000 in PAGE_SIZE increments.
Implement hashed map lookups.
This potentially breaks both 2D and 3D drivers. If so, the corresponding
2D and 3D driver should be fixed, and it's corresponding drm device driver
should have its major bumped as soon as possible.
Bump sis and via drm device driver majors.
The SiS and Unichrome 3D drivers are fixed in Mesa CVS HEAD and
mesa_6_4_branch.
i915 vblanks can be generated from either pipe a or b, however a disabled
pipe generates no interrupts. This change allows the X server to select
which pipe generates vblank interrupts.
more problems with flickering (bug #6637). drm may not be appropriate
place for this, since doing that flush there might both be overkill and
insufficient in some cases. However, it's hard to figure out when that
flush is needed, so this has to suffice. There does not seem to be a
performance penalty associated with it.
Linux, which broke on FreeBSD. DRM_COPY_*_IOCTL checks for the size
parameter matching the ioctl's command size there, since the copin/out
happened earlier.
chips may be problematic). Leave the existing entries for new chips in
though. Remove ids not known by ddx (secondary ids, non-existant,...).
Correct some entries (name/family). Make the radeon family enum look
more alike the ddx/dri versions. See #5413
that particular file. Its contents have changed a good bit since the
original sis code, and the original sis code didn't care much about
attribution since it routinely disclaims Precision Insight/VA Linux
from responsibility. Also, adjust formatting around license headers
(have a comment open immediately before the "Copyright" line, not as a
runon of any previous comments) for automatic processing into FreeBSD,
where /*- is used to signal the beginning of license headers for
automatic compilation of license lists.
single DRM_COPY_FROM_USER rather than DRM_VERIFYAREA_READ followed by
tons of DRM_COPY_FROM_USER_UNCHECKED. I don't like the look of the
temporary space allocation, but I like the simplification in the rest
of the file. Tested with glxgears, tuxracer, and q3 on a savage4.
drm_mtrr_{add,del} for handling the MTRR setup. Still has a LOR issue
with DRM_VERIFYAREA_READ/DRM_COPY_FROM_USER_UNCHECKED in savage_bci.c
-- this won't work with the fine-grained locking in use, and just doing
a single copyin to a temporary will probably work fine. Also note that
the module leaks approximately 4 kb on unload.
up a good bit, I think. Also, remove the agp_uninit() function which
has lain around as a noop for years now. The FreeBSD DRM is now all
compiling, with the exception of via. One known sleeping-with-lock-held
issue remains.
radeon_cp.c to use a drm_local_map_t-type mapping (drm_core_ioremap
rather than drm_ioremap), which contains private device mapping
information on BSD. I also changed the ati_pcigart interface to use
"void *" for pointers to kva rather than "unsigned long". While PCIGART
support appears to be broken on FreeBSD currently, I think this is not
new, and BusType PCI remains working on my r100 in Linux.
drm_agp_foo_ioctl pair. Modifies the MGA DRM to use the drm_agp_foo
functions instead of the drm_foo_agp functions. The drm_foo_agp
functions are no longer exported by drm.ko.
Ensures that dma->seg_count and dma->page_count are properly set in
drm_addbufs_{agp,sg,fb}. drm_addbufs_pci was already correct.
Ensures that mga_do_agp_dma_bootstrap correctly sets agp_buffer_token.
At this point PCI DMA is still broken.
Xorg bug: #4797 Reviewed by: Dave Airlie, Eric Anholt Signed-off-by: Ian
Romanick <idr@us.ibm.com>
mga_do_agp_dma_bootstrap fails causes problems if
mga_do_pci_dma_bootstrap succeeds. This commit makes it possible to do
a "minimal" clean up instead. I'm still trying to figure out what is
causing the failures in mga_do_agp_dma_bootstrap...
Signed-off-by: Ian Romanick <idr@us.ibm.com>
R200_EMIT_PP_TXCTLALL_0-5 (replaces R200_EMIT_PP_TXFILTER_0-5, 2 more
regs) and R200_EMIT_ATF_TFACTOR (replaces R200_EMIT_TFACTOR_0 (8 consts
instead of 6)
- Comment out the "is this mapping/bufs in allocated AGP" bits in BSD
because they break mga (which uses AGP allocation that doesn't track
entries). It's not a security issue when we still have the related
ioctls marked root-only.
- Apply some power-of-two alignment restrictions to hopefully avoid some
panicing in bad cases of drm_pci_alloc() on FreeBSD.
- Add verbosity to some error handling that I found useful while debugging.
me to match other drivers and avoid ifdeffing. The linux via_drv.c will
be moved from shared-core to linux-core soon by repocopy.
Submitted by: Jake Burkholder <jake@FreeBSD.org> Tested by: unichrome
caller on fb / agp memory alloc and free. Otherwise malicious clients
can register allocations on other clients or free memory used by other
clients which will lead to severe memory manager inconsistensies.
understandable: preinit -> load postinit -> (removed) presetup ->
firstopen postsetup -> (removed) open_helper -> open prerelease ->
preclose free_filp_priv -> postclose pretakedown -> lastclose
postcleanup -> unload release -> reclaim_buffers_locked version ->
(removed)
postinit and version were replaced with generic code in the Linux DRM
(drivers now set their version numbers and description in the driver
structure, like on BSD). postsetup wasn't used at all. Fixes the savage
hooks for initializing and tearing down mappings at the right times.
Testing involved at least starting X, running glxgears, killing
glxgears, exiting X, and repeating.
Tested on: FreeBSD (g200, g400, r200, r128) Linux (r200, savage4)
driver's preinit routine, and by using DRM_COPY_TO_USER_IOCTL when
copying out to an ioctl's data pointer. Pulled from the latest version
of my drm-hook-rename.diff and only compile-tested after that.
code duplication, and it also hands you the map pointer so you don't
need to re-find it.
- Remove the permanent maps flag. Instead, for register and framebuffer
maps, we always check whether there's already a map of that type and
offset around. Move the Radeon map initialization into presetup (first
open) so it happens again after every takedown.
- Remove the split cleanup of maps between driver takedown (last close) and
cleanup (module unload). Instead, always tear down maps on takedown,
and drivers can recreate them on first open.
- Make MGA always use addmap, instead of allocating consistent memory in
the PCI case and then faking up a map for it, which accomplished nearly
the same thing, in a different order. Note that the maps are exposed to
the user again: we may want to expose a flag to avoid this, but it's
not a security concern, and saves us a lot of code.
- Remove rmmaps in the MGA driver. Since the function is only called during
takedown anyway, we can let them die a natural death.
- Make removal of maps happen in one function, which is called by both
drm_takedown and drm_rmmap_ioctl.
Reviewed by: idr (previous revision) Tested on: mga (old/new/pci dma),
radeon, savage
zero does not mean no privs, instead it grants write access
_DRM_READ_ONLY only applies to non-root users. Problem is only in CVS,
initmaps are not in the kernel yet.
zero does not mean no privs, instead it grants write access
_DRM_READ_ONLY only applies to non-root users. Problem is only in CVS,
initmaps are not in the kernel yet.
This patch adds serveral new ioctls and a new query to get_param query to
support PCI MGA cards.
Two ioctls were added to implement interrupt based waiting. With this
change, the client-side driver no longer needs to map the primary DMA
region or the MMIO region. Previously, end-of-frame waiting was done by
busy waiting in the client-side driver until one of the MMIO registers
(the current DMA pointer) matched a pointer to the end of primary DMA
space. By using interrupts, the busy waiting and the extra mappings are
removed.
A third ioctl was added to bootstrap DMA. This ioctl, which is used by the
X-server, moves a *LOT* of code from the X-server into the kernel. This
allows the kernel to do whatever needs to be done to setup DMA buffers.
The entire process and the locations of the buffers are hidden from
user-mode.
Additionally, a get_param query was added to differentiate between G4x0
cards and G550 cards. A gap was left in the numbering sequence so that,
if needed, G450 cards could be distinguished from G400 cards. According
to Ville Syrjälä, the G4x0 cards and the G550 cards handle
anisotropic filtering differently. This seems the most compatible way
to let the client-side driver know which card it's own. Doing this very
small change now eliminates the need to bump the DRM minor version
twice.
http://marc.theaimsgroup.com/?l=dri-devel&m=106625815319773&w=2
A number of ioctl handlers in linux-core were also modified so that they
could be called in-kernel. In these cases, the in-kernel callable
version kept the existing name (e.g., drm_agp_acquire) and the ioctl
handler added _ioctl to the name (e.g., drm_agp_acquire_ioctl).
This patch also replaces the drm_agp_do_release function with
drm_agp_release. drm_agp_release (drm_core_agp_release in the previous
patch) is very similar to drm_agp_do_release, and I saw no reason to
have both.
This commit *breaks the build* on BSD. Eric said that he would make the
required updates to the BSD side soon.
Xorg bug: 3259 Reviewed by: Eric Anholt
There were two problems. First, the 'warp' and 'primary' pointers weren't
cleared, so mga_do_cleanup_dma, which gets called multiple times, would
try to ioremapfree them multiple times. This resulted in the new error
messages to syslog. The second problem was the, since the dev_private
structure isn't reallocated and cleaned out in mga_do_init_dma, when
the server is reloaded idle-waits would wait for impossible values.
I have given this patch some more riggorous testing. This includes:
- Load module, start server, run GL app, stop server, unload module.
- Load module, start server, run GL app, stop server, unload module, reload
module, restart server, run GL app.
- Load module, start server, run GL app, stop server, restart server, run
GL app, stop server, unload module.
In all three cases, everything worked as expected. Please let me know if
there are any further regressions with this patch.
Xorg bug: 3408 Reported by: Chris Rankin
the driver is loaded and is always expected to be around, it should
only be deallocated when the driver is unloaded.
Xorg bug: #3408 Reported by: Chris Rankin
There's two choices when fb is or isn't loaded as we treat ourselves as a
PCI driver in the latter case.
If we are a PCI driver, then register the suspend/resume functions
directly. If not, then we register as a sysdev and pick up the
suspend/resume actions and pump them down into a generic *power
function.
It'll be nice when this little mess is sorted out with regard to being a
real PCI driver ;-/
that a device absolutely is, absolutely is not, or may or may not be
AGP. Modify the i915 DRM to use this to force all i9x5 devices to be
"AGP" (even the PCI-e devices).
Reported by: Lukas Hejtmanek
two routines (one for G200 and one for G400) were replaced with static
const variables and a single function that returns the correct size.
The code to generate an error if the allocated WARP region is too small
was refactored from mga_warp_install_{g200,g400}_microcode to
mga_wrap_install_microcode.
mga_warp_microcode_size is global to the MGA DRM because it will soon be
used by code in another file.
is now allocated (and partially filled in) by the new
mga_driver_preinit function.
This allows the driver to detect the type of card (i.e., G200 class vs.
G400 class) on its own. The chipset value passed to mga_dma_init is now
ignored. This same technique is used by the radeon DRM.
As a result of this, mga_driver_pretakedown was converted to
mga_driver_postcleanup. This routine gets called in some other places
than might be expected, and it sets the dev_private pointer to NULL.
That little gem took over an hour to track down. :(
platform-specific drm_device_is_agp function. Added implementation of
this function the the Linux-specific portion of the MGA driver to
detect PCI G450 cards. Added code to the Linux-specific portion of the
generic DRM layer to not initialize AGP infrastructure if the card is
not AGP (this matches what already existed in BSD).
Bumped the driver date and the driver patch-level for MGA.
This mostly fixes bugzilla #3248. The BSD side still needs an
implementation of mga_driver_device_is_agp.
with IOMMUs and such. There is one usage of the forbidden vtophys()
left in drm_scatter.c which will be fixed up soon. This required a KPI
change for drm_pci_alloc/free() to return/use a drm_dma_handle_t that
keeps track of os-specific bits, rather than just passing around the
vaddr/busaddr/size.
Submitted by: Tonnerre Lombard (partially) Tested on: FreeBSD: Rage128
AGP/PCI Linux: Savage4 AGP/PCI
1) Security fix: Stopped possible MMIO access to PCI DMA area for the
unichrome Pro.
2) Fixed an odd cpu usage problem by padding small AGP DMA submissions.
Bumped patchlevel.
New PCI command parser. Moved from via_dma.c to via_verifier.c so functions
with similar functionality are close to eachother.
Moved video related functions to via_video.c, which might be extended in
the future, as new video functionality is added.
New device-specific generic IRQ IOCTL, similar to the general VBLANK IOCTL,
but with support for multiple device IRQ sources and functionality.
Support for Unichrome Pro PM800/CN400 video DMA commands in verifier and
PCI parser.
Support for Unichrome Pro PM800/CN400 HQV IRQs in the new generic IRQ
IOCTL.
Bumped minor. New version 2.6.0.
1. Initialize futex locks to zero on device init.
2. Remove some stray defines from via_drm.h
3. Prepare via_drm.h for drm client inclusion. The goal is to share a
common file with common definitions.
4. Sync shared / shared-core via_drm.h
5. Bump minor, because of the futex lock initialization.
after ~5min: buffer aging was subtly broken. Part of this may have also
affected vertex DMA buffer aging and client-side texture heap aging,
though with less fatal consequences. Bumped minor version and driver
date.
command and vertex DMA don't work at the same time. Command DMA
performance is superior and works with all vertex formats. Bumped minor
version and driver date.
event counters in the SAVAGE_EVENT_EMIT/WAIT ioctls. This is needed for
reliable client-side texture heap aging. Slightly simplified DMA buffer
aging while at it. Bumped minor version and driver date.
privileges on Radeon hardware. Essentially, a malicious program could
submit a packet containing an offset (possibly in main memory) to be
rendered from/to, while a separate thread switched that offset in
userspace rapidly between a valid value and an invalid one.
radeon_check_and_fixup_offset() would pull the offset in from user
space, check it, and spit it back out to user space to be copied in
later by the emit code. It would sometimes catch the bad value, but
sometimes the malicious program could modify it after the check and get
an invalid offset rendered from/to.
Fix this by allocating a temporary buffer and copying the data in at once.
While here, make the cliprects stuff not do the VERIFYAREA_READ and
COPY_FROM_USER_UNCHECKED gymnastics, avoiding a lock order reversal on
FreeBSD. Performance impact is negligible -- no difference on r200 to
~1% improvement on rv200 in quake3 tests (P4 1Ghz, demofour at
1024x768, n=4 or 5).
FreeBSD. Add drm_get_resource_{start|len} so linux-specific stuff
doesn't need to be in shared code.
- Fix mach64 build by using __DECONST to work around passing a const
pointer to useracc, which is unfortunately not marked const.
- Get rid of a lot of maplist code by not having dev->maplist be a pointer,
and by sticking the link entries directly in drm_local_map_t rather
than having a separate structure for the linked list.
- Factor out map uninit and removal into its own routine, rather than
duplicating in both drm_takedown() and drm_rmmap().
- Hook up more driver functions, and correct FreeBSD-specific bits of
radeon_cp.c, making radeon work.
- Baby steps towards using bus_space as we should.
Implemented SAVAGE_CMD_DMA_IDX and SAVAGE_CMD_VB_IDX for ELTs support in
the _savage_render_stage of the 3D driver
Bumped minor version and driver date
The attached patch adds a new buffer type DRM_FB_BUFFER. It works like AGP
memory but uses video memory.
From: austinyuan@viatech.com.cn (fd.o bug 1668) Signed-off-by: Dave Airlie
<airlied@linux.ie>
passed to the cmdbuf ioctl (try xeyes on top of glxgears ;-)
Tightened the texture state check
Bumped Savage DRM version to 2.1.0 so that DRI driver can (theoretically)
depend on the DRM to manage the scissor registers
Release video futexes when context is destroyed (This was previously done
by the X server).
Added New Unichrome Pro VIDEO DMA commands to the verifier.
Added Quiescent heavyweight lock mode.
Thomas Hellstrom
Dave Airlie
Dave Airlie
Michel Dänzer
Alan Hourihane
Adam Jackson
Thomas Hellstrom
Keith Packard
Roland Scheidegger
Brian Paul
Eric Anholt
Adam Jackson
Aapo Tahkola
Thomas Hellstrom
Keith Whitwell
Alan Hourihane
Ian Romanick
Vladimir Dergachev
Jon Smirl
Michel Daenzer
Felix Kuehling
Jose Fonseca