R200_EMIT_PP_TXCTLALL_0-5 (replaces R200_EMIT_PP_TXFILTER_0-5, 2 more
regs) and R200_EMIT_ATF_TFACTOR (replaces R200_EMIT_TFACTOR_0 (8 consts
instead of 6)
understandable: preinit -> load postinit -> (removed) presetup ->
firstopen postsetup -> (removed) open_helper -> open prerelease ->
preclose free_filp_priv -> postclose pretakedown -> lastclose
postcleanup -> unload release -> reclaim_buffers_locked version ->
(removed)
postinit and version were replaced with generic code in the Linux DRM
(drivers now set their version numbers and description in the driver
structure, like on BSD). postsetup wasn't used at all. Fixes the savage
hooks for initializing and tearing down mappings at the right times.
Testing involved at least starting X, running glxgears, killing
glxgears, exiting X, and repeating.
Tested on: FreeBSD (g200, g400, r200, r128) Linux (r200, savage4)
privileges on Radeon hardware. Essentially, a malicious program could
submit a packet containing an offset (possibly in main memory) to be
rendered from/to, while a separate thread switched that offset in
userspace rapidly between a valid value and an invalid one.
radeon_check_and_fixup_offset() would pull the offset in from user
space, check it, and spit it back out to user space to be copied in
later by the emit code. It would sometimes catch the bad value, but
sometimes the malicious program could modify it after the check and get
an invalid offset rendered from/to.
Fix this by allocating a temporary buffer and copying the data in at once.
While here, make the cliprects stuff not do the VERIFYAREA_READ and
COPY_FROM_USER_UNCHECKED gymnastics, avoiding a lock order reversal on
FreeBSD. Performance impact is negligible -- no difference on r200 to
~1% improvement on rv200 in quake3 tests (P4 1Ghz, demofour at
1024x768, n=4 or 5).
the 2D driver initializes MC_FB_LOCATION and related registers sanely
the DRM deduces the layout from these registers
clients use the new SETPARAM ioctl to tell the DRM where they think the
framebuffer is located in the card's address space
the DRM uses all this information to check client state and fix it up if
necessary
This is a prerequisite for things like direct rendering with IGP chips and
video capturing.
pageflipping after a mode switch
take current page into account in AdjustFrame(); writing the CRTC offset
via the CP was probably a bad idea as this can happen asynchronously,
reverted
take frame offset into account when flipping pages
handle CRTC2 as well for pageflipping (untested)
preserve GEN_INT_CNTL on mode switches to prevent interrupts from getting
disabled
Dave Airlie
Roland Scheidegger
Eric Anholt
Jon Smirl
Michel Daenzer
Keith Whitwell
Leif Delgass
Brian Paul