1) Security fix: Stopped possible MMIO access to PCI DMA area for the
unichrome Pro.
2) Fixed an odd cpu usage problem by padding small AGP DMA submissions.
Bumped patchlevel.
New PCI command parser. Moved from via_dma.c to via_verifier.c so functions
with similar functionality are close to eachother.
Moved video related functions to via_video.c, which might be extended in
the future, as new video functionality is added.
New device-specific generic IRQ IOCTL, similar to the general VBLANK IOCTL,
but with support for multiple device IRQ sources and functionality.
Support for Unichrome Pro PM800/CN400 video DMA commands in verifier and
PCI parser.
Support for Unichrome Pro PM800/CN400 HQV IRQs in the new generic IRQ
IOCTL.
Bumped minor. New version 2.6.0.
what wait_event_interruptible_timeout() does, use the function and just
change the return values appropriately.
Signed-off-by: Nishanth Aravamudan <nacc@us.ibm.com>
so we need to consult the EFI memory map before we try to set the write
combine attribute of a page. This patch will try to map a page write
combined if it's not an AGP page and the EFI memory map says it's ok,
otherwise it falls back to a regular, uncached mapping. Can someone
please apply this to the drm tree?
From: Jesse Barnes
1. Initialize futex locks to zero on device init.
2. Remove some stray defines from via_drm.h
3. Prepare via_drm.h for drm client inclusion. The goal is to share a
common file with common definitions.
4. Sync shared / shared-core via_drm.h
5. Bump minor, because of the futex lock initialization.
after ~5min: buffer aging was subtly broken. Part of this may have also
affected vertex DMA buffer aging and client-side texture heap aging,
though with less fatal consequences. Bumped minor version and driver
date.
command and vertex DMA don't work at the same time. Command DMA
performance is superior and works with all vertex formats. Bumped minor
version and driver date.
event counters in the SAVAGE_EVENT_EMIT/WAIT ioctls. This is needed for
reliable client-side texture heap aging. Slightly simplified DMA buffer
aging while at it. Bumped minor version and driver date.
privileges on Radeon hardware. Essentially, a malicious program could
submit a packet containing an offset (possibly in main memory) to be
rendered from/to, while a separate thread switched that offset in
userspace rapidly between a valid value and an invalid one.
radeon_check_and_fixup_offset() would pull the offset in from user
space, check it, and spit it back out to user space to be copied in
later by the emit code. It would sometimes catch the bad value, but
sometimes the malicious program could modify it after the check and get
an invalid offset rendered from/to.
Fix this by allocating a temporary buffer and copying the data in at once.
While here, make the cliprects stuff not do the VERIFYAREA_READ and
COPY_FROM_USER_UNCHECKED gymnastics, avoiding a lock order reversal on
FreeBSD. Performance impact is negligible -- no difference on r200 to
~1% improvement on rv200 in quake3 tests (P4 1Ghz, demofour at
1024x768, n=4 or 5).
Dave Airlie
Thomas Hellstrom
Eric Anholt
Adam Jackson
Alan Hourihane
Michel Daenzer
Roland Scheidegger
Felix Kuehling
Keith Whitwell