aboutsummaryrefslogtreecommitdiff
path: root/include/drm
AgeCommit message (Collapse)Author
2009-06-04drm: Hook up DPMS property handling in drm_crtc.c. Add ↵Keith Packard
drm_helper_connector_dpms. Making the drm_crtc.c code recognize the DPMS property and invoke the connector->dpms function doesn't remove any capability from the driver while reducing code duplication. That just highlighted the problem with the existing DPMS functions which could turn off the connector, but failed to turn off any relevant crtcs. The new drm_helper_connector_dpms function manages all of that, using the drm_helper-specific crtc and encoder dpms functions, automatically computing the appropriate DPMS level for each object in the system. This fixes the current troubles in the i915 driver which left PLLs, pipes and planes running while in DPMS_OFF mode or even while they were unused. Signed-off-by: Keith Packard <keithp@keithp.com> Signed-off-by: Dave Airlie <airlied@redhat.com>
2009-05-19drm/i915: allocate large pointer arrays with vmallocJesse Barnes
For awhile now, many of the GEM code paths have allocated page or object arrays with the slab allocator. This is nice and fast, but won't work well if memory is fragmented, since the slab allocator works with physically contiguous memory (i.e. order > 2 allocations are likely to fail fairly early after booting and doing some work). This patch works around the issue by falling back to vmalloc for >PAGE_SIZE allocations. This is ugly, but much less work than chaining a bunch of pages together by hand (suprisingly there's not a bunch of generic kernel helpers for this yet afaik). vmalloc space is somewhat precious on 32 bit kernels, but our allocations shouldn't be big enough to cause problems, though they're routinely more than a page. Note that this patch doesn't address the unchecked alloc-based-on-ioctl-args in GEM; that needs to be fixed in a separate patch. Also, I've deliberately ignored the DRM's "area" junk. I don't think anyone actually uses it anymore and I'm hoping it gets ripped out soon. [Updated: removed size arg to new free function. We could unify the free functions as well once the DRM mem tracking is ripped out.] fd.o bug #20152 (part 1/3) Signed-off-by: Jesse Barnes <jbarnes@virtuousgeek.org> Signed-off-by: Eric Anholt <eric@anholt.net>
2009-05-14drm/i915: Add new GET_PIPE_FROM_CRTC_ID ioctl.Carl Worth
This allows userlevel code to discover the pipe number corresponding to a given CRTC ID. This is necessary for doing pipe-specific operations such as waiting for vblank on a given CRTC. Failure to use the right pipe mapping can result in GPU hangs, or at least failure to actually sync to vblank. Signed-off-by: Carl Worth <cworth@cworth.org> [anholt: Style touchups from review] Signed-off-by: Eric Anholt <eric@anholt.net>
2009-04-21drm/i915: add support for G41 chipsetZhenyu Wang
This had been delayed for some time due to failure to work on the one piece of G41 hardware we had, and lack of success reports from anybody else. Current hardware appears to be OK. Signed-off-by: Zhenyu Wang <zhenyu.z.wang@intel.com> [anholt: hand-applied due to conflicts with IGD patches] Signed-off-by: Eric Anholt <eric@anholt.net>
2009-04-14Merge branch 'drm-intel-next' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/anholt/drm-intel * 'drm-intel-next' of git://git.kernel.org/pub/scm/linux/kernel/git/anholt/drm-intel: drm/i915: fix scheduling while holding the new active list spinlock drm/i915: Allow tiling of objects with bit 17 swizzling by the CPU. drm/i915: Correctly set the write flag for get_user_pages in pread. drm/i915: Fix use of uninitialized var in 40a5f0de drm/i915: indicate framebuffer restore key in SysRq help message drm/i915: sync hdmi detection by hdmi identifier with 2D drm/i915: Fix a mismerge of the IGD patch (new .find_pll hooks missed) drm/i915: Implement batch and ring buffer dumping
2009-04-13intelfb: support i854Stefan Husemann
Support the Intel 854 Chipset in fbdev. We test and use the patch on a Thomson IP1101 IPTV-Box. On the VGA-Port we get a normal signal. Here is the link to the Mambux-Project: http://www.mambux.de Cc: Keith Packard <keithp@keithp.com> Cc: Dave Airlie <airlied@linux.ie> Cc: Krzysztof Helt <krzysztof.h1@poczta.fm> Signed-off-by: Stefan Husemann <shusemann@googlemail.com> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
2009-04-08drm/i915: Allow tiling of objects with bit 17 swizzling by the CPU.Eric Anholt
Save the bit 17 state of the pages when freeing the page list, and reswizzle them if necessary when rebinding the pages (in case they were swapped out). Since we have userland with expectations that the swizzle enums let it pread and pwrite contents accurately, we can't expose a new swizzle enum for bit 17 (which it would have to GTT map to handle), so we handle it down in pread and pwrite by swizzling the copy when bit 17 of the page address is set. Signed-off-by: Eric Anholt <eric@anholt.net>
2009-04-03drm: remove unused "can_grow" parameter from drm_crtc_helper_initial_configJesse Barnes
Cleanup some leftovers from the X port. Signed-off-by: Jesse Barnes <jbarnes@virtuousgeek.org> Signed-off-by: Dave Airlie <airlied@redhat.com>
2009-04-03DRM: drm_crtc_helper.h doesn't actually need i2c.hJean Delvare
Remove an include that isn't actually needed to prevent needless rebuilds. Signed-off-by: Jean Delvare <khali@linux-fr.org> Signed-off-by: Dave Airlie <airlied@redhat.com>
2009-04-03drm: fix missing inline function on 32-bit powerpc.Dave Airlie
The readq/writeq really need to be static inline on the arches which don't provide them. Reported-by: Benjamin Herrenschmidt <benh@kernel.crashing.org> Signed-off-by: Dave Airlie <airlied@redhat.com>
2009-03-29drm: detect hdmi monitor by hdmi identifier (v3)Ma Ling
Sometime we need to communicate with HDMI monitor by sending audio or video info frame, so we have to know monitor type. However if user utilize HDMI-DVI adapter to connect DVI monitor, hardware detection will incorrectly show the monitor is HDMI. HDMI spec tell us that any device containing IEEE registration Identifier will be treated as HDMI device. The patch intends to detect HDMI monitor by this rule. Signed-off-by: Ma Ling <ling.ma@intel.com> Signed-off-by: Dave Airlie <airlied@redhat.com>
2009-03-29drm: reorder struct drm_ioctl_desc to save space on 64 bit buildsRichard Kennedy
shrinks drm_ioctl_desc from 24 bytes to 16 bytes by reordering members to remove padding. updates DRM_IOCTL_DEF macro to initialise structure members by name to handle the structure reorder. The applied patch reduces data used in drm.ko from 10440 to 9032 Signed-off-by: Richard Kennedy <richard@rsk.demon.co.uk> Signed-off-by: Dave Airlie <airlied@redhat.com>
2009-03-29radeon: add some new pci idsAlex Deucher
This adds some new RS780 pci ids Signed-off-by: Alex Deucher <alexdeucher@gmail.com> Signed-off-by: Dave Airlie <airlied@redhat.com>
2009-03-29drm: read EDID extensions from monitorMa Ling
Usually drm read basic EDID, that is enough for us, but since igital display were introduced i.e. HDMI monitor, sometime we need to interact with monitor by EDID extension information, EDID extensions include audio/video data block, speaker allocation and vendor specific data blocks. This patch intends to read EDID extensions from digital monitor for users. Signed-off-by: Ma Ling <ling.ma@intel.com> Signed-off-by: Dave Airlie <airlied@redhat.com>
2009-03-28drm: merge Linux master into HEADDave Airlie
Conflicts: drivers/gpu/drm/drm_info.c drivers/gpu/drm/drm_proc.c drivers/gpu/drm/i915/i915_gem_debugfs.c
2009-03-27agp/intel: Add support for new intel chipset.Shaohua Li
This is a G33-like desktop and mobile chipset. Signed-off-by: Shaohua Li <shaohua.li@intel.com> Signed-off-by: Eric Anholt <eric@anholt.net>
2009-03-27drm: Convert proc files to seq_file and introduce debugfsBen Gamari
The old mechanism to formatting proc files is extremely ugly. The seq_file API was designed specifically for cases like this and greatly simplifies the process. Also, most of the files in /proc really don't belong there. This patch introduces the infrastructure for putting these into debugfs and exposes all of the proc files in debugfs as well. Signed-off-by: Ben Gamari <bgamari@gmail.com> Signed-off-by: Eric Anholt <eric@anholt.net>
2009-03-26Merge commit 'v2.6.29' into core/header-fixesIngo Molnar
2009-03-26make drm headers use strict integer typesArnd Bergmann
The drm headers are traditionally shared with BSD and could not use the strict linux integer types. This is over now, so we can use our own types now. Cc: David Airlie <airlied@linux.ie> Signed-off-by: Arnd Bergmann <arnd@arndb.de> Signed-off-by: H. Peter Anvin <hpa@linux.intel.com> Signed-off-by: Ingo Molnar <mingo@elte.hu>
2009-03-13drm: add DRM_READ/WRITE64 wrappers around readq/writeq.Dave Airlie
The readq/writeq stuff is from Dave Miller, and he warns users to be careful about using these. Plans are only r600 to use it so far. Signed-off-by: Dave Airlie <airlied@redhat.com>
2009-03-13radeon: add RS600 pci idsAlex Deucher
Signed-off-by: Alex Deucher <alexdeucher@gmail.com> Signed-off-by: Dave Airlie <airlied@redhat.com>
2009-03-13radeon: add R6xx/R7xx pci idsAlex Deucher
Signed-off-by: Alex Deucher <alexdeucher@gmail.com> Signed-off-by: Dave Airlie <airlied@redhat.com>
2009-03-13drm/radeon: prep for r6xx/r7xx supportAlex Deucher
- add r6xx/r7xx regs and macros - add r6xx/r7xx chip families - fix register access for regs with offsets >= 0x10000 Signed-off-by: Alex Deucher <alexdeucher@gmail.com> Signed-off-by: Dave Airlie <airlied@redhat.com>
2009-03-13drm: Convert proc files to seq_file and introduce debugfsBen Gamari
The old mechanism to formatting proc files is extremely ugly. The seq_file API was designed specifically for cases like this and greatly simplifies the process. Also, most of the files in /proc really don't belong there. This patch introduces the infrastructure for putting these into debugfs and exposes all of the proc files in debugfs as well. This contains the i915 hooks rewrite as well, to make bisectability better. Signed-off-by: Ben Gamari <bgamari@gmail.com> Signed-off-by: Eric Anholt <eric@anholt.net> Signed-off-by: Dave Airlie <airlied@redhat.com>
2009-03-13drm: Drop unused and broken dri_library_name sysfs attribute.Kristian Høgsberg
The kernel shouldn't be in the business of telling user space which driver to load. The kernel defers mapping PCI IDs to module names to user space and we should do the same for DRI drivers. And in fact, that's how it does work today. Nothing uses the dri_library_name attribute, and the attribute is in fact broken. For intel devices, it falls back to the default behaviour of returning the kernel module name as the DRI driver name, which doesn't work for i965 devices. Nobody has ever hit this problem or filed a bug about this. Signed-off-by: Kristian Høgsberg <krh@redhat.com> Signed-off-by: Dave Airlie <airlied@linux.ie>
2009-03-13drm: claim PCI device when running in modesetting mode.Kristian Høgsberg
Under kernel modesetting, we manage the device at all times, regardless of VT switching and X servers, so the only decent thing to do is to claim the PCI device. In that case, we call the suspend/resume hooks directly from the pci driver hooks instead of the current class device detour. Signed-off-by: Kristian Høgsberg <krh@redhat.com> Signed-off-by: Dave Airlie <airlied@linux.ie>
2009-03-13drm: Make drm_local_map use a resource_size_t offsetBenjamin Herrenschmidt
This changes drm_local_map to use a resource_size for its "offset" member instead of an unsigned long, thus allowing 32-bit machines with a >32-bit physical address space to be able to store there their register or framebuffer addresses when those are above 4G, such as when using a PCI video card on a recent AMCC 440 SoC. This patch isn't as "trivial" as it sounds: A few functions needed to have some unsigned long/int changed to resource_size_t and a few printk's had to be adjusted. But also, because userspace isn't capable of passing such offsets, I had to modify drm_find_matching_map() to ignore the offset passed in for maps of type _DRM_FRAMEBUFFER or _DRM_REGISTERS. If we ever support multiple _DRM_FRAMEBUFFER or _DRM_REGISTERS maps for a given device, we might have to change that trick, but I don't think that happens on any current driver. Signed-off-by: Benjamin Herrenschmidt <benh@kernel.crashing.org> Signed-off-by: Dave Airlie <airlied@linux.ie>
2009-03-13drm: Split drm_map and drm_local_mapBenjamin Herrenschmidt
Once upon a time, the DRM made the distinction between the drm_map data structure exchanged with user space and the drm_local_map used in the kernel. For some reasons, while the BSD port still has that "feature", the linux part abused drm_map for kernel internal usage as the local map only existed as a typedef of the struct drm_map. This patch fixes it by declaring struct drm_local_map separately (though its content is currently identical to the userspace variant), and changing the kernel code to only use that, except when it's a user<->kernel interface (ie. ioctl). This allows subsequent changes to the in-kernel format I've also replaced the use of drm_local_map_t with struct drm_local_map in a couple of places. Mostly by accident but they are the same (the former is a typedef of the later) and I have some remote plans and half finished patch to completely kill the drm_local_map_t typedef so I left those bits in. Signed-off-by: Benjamin Herrenschmidt <benh@kernel.crashing.org> Acked-by: Eric Anholt <eric@anholt.net> Signed-off-by: Dave Airlie <airlied@linux.ie>
2009-03-13drm: Use resource_size_t for drm_get_resource_{start, len}Benjamin Herrenschmidt
The DRM uses its own wrappers to obtain resources from PCI devices, which currently convert the resource_size_t into an unsigned long. This is broken on 32-bit platforms with >32-bit physical address space. This fixes them, along with a few occurences of unsigned long used to store such a resource in drivers. Signed-off-by: Benjamin Herrenschmidt <benh@kernel.crashing.org> Signed-off-by: Dave Airlie <airlied@linux.ie>
2009-03-11drm: fix EDID parser problem with positive/negative hsync/vsyncPantelis Koukousoulas
Comparing the layouts of struct detail_pixel_timing with x.org's struct detailed_timings and how those are handled, it appears that the hsync_positive and vsync_positive fields are backwards. This patch fixes https://bugs.freedesktop.org/show_bug.cgi?id=20019 for me. It was tested on 2 monitors, LG FLATRON L225WS 22" and a YAKUMO 17" for which more details are unknown. Signed-off-by: Pantelis Koukousoulas <pktoss@gmail.com> Signed-off-by: Dave Airlie <airlied@redhat.com>
2009-02-25drm: disable encoders before re-routing themJesse Barnes
In some cases we may receive a mode config that has a different CRTC<->encoder map that the current configuration. In that case, we need to disable any re-routed encoders before setting the mode, otherwise they may not pick up the new CRTC (if the output types are incompatible for example). Tested-by: Kristian Høgsberg <krh@bitplanet.net> Signed-off-by: Jesse Barnes <jbarnes@virtuousgeek.org> Signed-off-by: Dave Airlie <airlied@linux.ie>
2009-02-25drm: Fix ordering of bit fields in EDID structure leading huge vsync values.Jesse Barnes
Signed-off-by: Jesse Barnes <jbarnes@virtuousgeek.org> Reviewed-by: Eric Anholt <eric@anholt.net> Signed-off-by: Dave Airlie <airlied@linux.ie>
2009-02-20drm/i915: Keep refs on the object over the lifetime of vmas for GTT mmap.Jesse Barnes
This fixes potential fault at fault time if the object was unreferenced while the mapping still existed. Now, while the mmap_offset only lives for the lifetime of the object, the object also stays alive while a vma exists that needs it. Signed-off-by: Jesse Barnes <jbarnes@virtuousgeek.org> Signed-off-by: Eric Anholt <eric@anholt.net> Signed-off-by: Dave Airlie <airlied@redhat.com>
2009-02-20drm: Propagate failure from setting crtc base.Chris Wilson
Check the error paths within intel_pipe_set_base() to first cleanup and then report back the error. Signed-off-by: Chris Wilson <chris@chris-wilson.co.uk> Signed-off-by: Eric Anholt <eric@anholt.net> Signed-off-by: Dave Airlie <airlied@linux.ie>
2009-02-20drm: Release user fbs in drm_releaseKristian Høgsberg
Avoids leaking fbs and associated buffers on release. Signed-off-by: Kristian Høgsberg <krh@redhat.com> Tested-by: Tested-by: Chris Wilson <chris@chris-wilson.co.uk> Signed-off-by: Eric Anholt <eric@anholt.net> Signed-off-by: Dave Airlie <airlied@linux.ie>
2009-02-08drm/i915: add fence register management to execbufJesse Barnes
Adds code to set up fence registers at execbuf time on pre-965 chips as necessary. Also fixes up a few bugs in the pre-965 tile register support (get_order != ffs). The number of fences available to the kernel defaults to the hw limit minus 3 (for legacy X front/back/depth), but a new parameter allows userspace to override that as needed. Signed-off-by: Jesse Barnes <jbarnes@virtuousgeek.org> Signed-off-by: Eric Anholt <eric@anholt.net> Signed-off-by: Dave Airlie <airlied@linux.ie>
2009-01-28drm: Rip out the racy, unused vblank signal code.Eric Anholt
Schedule a vblank signal, kill the process, and we'll go walking over freed memory. Given that no open-source userland exists using this, nor have I ever heard of a consumer, just let this code die. Signed-off-by: Eric Anholt <eric@anholt.net> Requested-by: Linus Torvalds <torvalds@linux-foundation.org> Acked-by: Dave Airlie <airlied@linux.ie> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
2009-01-22drm: create mode_config idr lockJesse Barnes
Create a separate mode_config IDR lock for simplicity. The core DRM config structures (connector, mode, etc. lists) are still protected by the mode_config mutex, but the CRTC IDR (used for the various identifier IDs) is now protected by the mode_config idr_mutex. Simplifies the locking a bit and removes a warning. All objects are protected by the config mutex, we may in the future, split the object further to have reference counts. Signed-off-by: Jesse Barnes <jbarnes@virtuousgeek.org> Signed-off-by: Dave Airlie <airlied@redhat.com>
2009-01-16drm: initial KMS config fixesJesse Barnes
When mode setting is first initialized, the driver will call into drm_helper_initial_config() to set up an initial output and framebuffer configuration. This routine is responsible for probing the available connectors, encoders, and crtcs, looking for modes and putting together something reasonable (where reasonable is defined as "allows kernel messages to be visible on as many displays as possible"). However, the code was a bit too aggressive in setting default modes when none were found on a given connector. Even if some connectors had modes, any connectors found lacking modes would have the default 800x600 mode added to their mode list, which in some cases could cause problems later down the line. In my case, the LVDS was perfectly available, but the initial config code added 800x600 modes to both of the detected but unavailable HDMI connectors (which are on my non-existent docking station). This ended up preventing later code from setting a mode on my LVDS, which is bad. This patch fixes that behavior by making the initial config code walk through the connectors first, counting the available modes, before it decides to add any default modes to a possibly connected output. It also fixes the logic in drm_target_preferred() that was causing zeroed out modes to be set as the preferred mode for a given connector, even if no modes were available. Signed-off-by: Jesse Barnes <jbarnes@virtuousgeek.org> Signed-off-by: Eric Anholt <eric@anholt.net> Signed-off-by: Dave Airlie <airlied@linux.ie>
2008-12-29drm: Add a debug node for vblank state.Eric Anholt
Signed-off-by: Eric Anholt <eric@anholt.net> Signed-off-by: Dave Airlie <airlied@linux.ie>
2008-12-29drm: pin new and unpin old buffer when setting a mode.Kristian Høgsberg
This removes the requirement for user space to pin a buffer before setting a mode that is backed by the pixels from that buffer. Signed-off-by: Kristian Høgsberg <krh@redhat.com> Signed-off-by: Eric Anholt <eric@anholt.net> Signed-off-by: Dave Airlie <airlied@linux.ie>
2008-12-29drm/i915: Add missing userland definitions for gem init/execbuffer.Eric Anholt
fdo bug #19132. Signed-off-by: Eric Anholt <eric@anholt.net> Signed-off-by: Dave Airlie <airlied@redhat.com>
2008-12-29i915/drm: provide compat defines for userspace for certain struct members.Dave Airlie
Painfully userspace started using new names that were never actually to be used from the external repo. Also fill out the gaps in the structure for old/new userspace compat Add compat defines for these structs. Signed-off-by: Dave Airlie <airlied@redhat.com>
2008-12-29drm: drop DRM_IOCTL_MODE_REPLACEFB, add+remove works just as well.Kristian H�gsberg
The replace fb ioctl replaces the backing buffer object for a modesetting framebuffer object. This can be acheived by just creating a new framebuffer backed by the new buffer object, setting that for the crtcs in question and then removing the old framebuffer object. Signed-off-by: Kristian Hogsberg <krh@redhat.com> Acked-by: Jakob Bornecrantz <jakob@vmware.com> Signed-off-by: Dave Airlie <airlied@redhat.com>
2008-12-29drm: sanitise drm modesetting API + remove unused hotplugJakob Bornecrantz
The initially merged modesetting API has some uglies in it, this cleans up the struct members and ioctl ordering for initial submission. It also removes the unneeded hotplug infrastructure. airlied:- I've pulled this patch in from git modesetting-gem tree. Signed-off-by: Dave Airlie <airlied@redhat.com>
2008-12-29DRM: i915: add mode setting supportJesse Barnes
This commit adds i915 driver support for the DRM mode setting APIs. Currently, VGA, LVDS, SDVO DVI & VGA, TV and DVO LVDS outputs are supported. HDMI, DisplayPort and additional SDVO output support will follow. Support for the mode setting code is controlled by the new 'modeset' module option. A new config option, CONFIG_DRM_I915_KMS controls the default behavior, and whether a PCI ID list is built into the module for use by user level module utilities. Note that if mode setting is enabled, user level drivers that access display registers directly or that don't use the kernel graphics memory manager will likely corrupt kernel graphics memory, disrupt output configuration (possibly leading to hangs and/or blank displays), and prevent panic/oops messages from appearing. So use caution when enabling this code; be sure your user level code supports the new interfaces. A new SysRq key, 'g', provides emergency support for switching back to the kernel's framebuffer console; which is useful for testing. Co-authors: Dave Airlie <airlied@linux.ie>, Hong Liu <hong.liu@intel.com> Signed-off-by: Jesse Barnes <jbarnes@virtuousgeek.org> Signed-off-by: Eric Anholt <eric@anholt.net> Signed-off-by: Dave Airlie <airlied@redhat.com>
2008-12-29DRM: add mode setting supportDave Airlie
Add mode setting support to the DRM layer. This is a fairly big chunk of work that allows DRM drivers to provide full output control and configuration capabilities to userspace. It was motivated by several factors: - the fb layer's APIs aren't suited for anything but simple configurations - coordination between the fb layer, DRM layer, and various userspace drivers is poor to non-existent (radeonfb excepted) - user level mode setting drivers makes displaying panic & oops messages more difficult - suspend/resume of graphics state is possible in many more configurations with kernel level support This commit just adds the core DRM part of the mode setting APIs. Driver specific commits using these new structure and APIs will follow. Co-authors: Jesse Barnes <jbarnes@virtuousgeek.org>, Jakob Bornecrantz <jakob@tungstengraphics.com> Contributors: Alan Hourihane <alanh@tungstengraphics.com>, Maarten Maathuis <madman2003@gmail.com> Signed-off-by: Jesse Barnes <jbarnes@virtuousgeek.org> Signed-off-by: Eric Anholt <eric@anholt.net> Signed-off-by: Dave Airlie <airlied@redhat.com>
2008-12-29drm/i915: add GEM GTT mapping supportJesse Barnes
Use the new core GEM object mapping code to allow GTT mapping of GEM objects on i915. The fault handler will make sure a fence register is allocated too, if the object in question is tiled. Signed-off-by: Jesse Barnes <jbarnes@virtuousgeek.org> Signed-off-by: Eric Anholt <eric@anholt.net> Signed-off-by: Dave Airlie <airlied@redhat.com>
2008-12-29drm: GEM mmap supportJesse Barnes
Add core support for mapping of GEM objects. Drivers should provide a vm_operations_struct if they want to support page faulting of objects. The code for handling GEM object offsets was taken from TTM, which was written by Thomas Hellström. Signed-off-by: Jesse Barnes <jbarnes@virtuousgeek.org> Signed-off-by: Eric Anholt <eric@anholt.net> Signed-off-by: Dave Airlie <airlied@redhat.com>
2008-12-29drm: fix leak of uninitialized data to userspaceVegard Nossum
...so drm_getunique() is trying to copy some uninitialized data to userspace. The ECX register contains the number of words that are left to copy -- so there are 5 * 4 = 20 bytes left. The offset of the first uninitialized byte (counting from the start of the string) is also 20 (i.e. 0xf65d2294&((1 << 5)-1) == 20). So somebody tried to copy 40 bytes when the string was only 19 long. In drm_set_busid() we have this code: dev->unique_len = 40; dev->unique = drm_alloc(dev->unique_len + 1, DRM_MEM_DRIVER); ... len = snprintf(dev->unique, dev->unique_len, pci:%04x:%02x:%02x.%d", ...so it seems that dev->unique is never updated to reflect the actual length of the string. The remaining bytes (20 in this case) are random uninitialized bytes that are copied into userspace. This patch fixes the problem by setting dev->unique_len after the snprintf(). airlied- I've had to fix this up to store the alloced size so we have it for drm_free later. Reported-by: Sitsofe Wheeler <sitsofe@yahoo.com> Signed-off-by: Vegard Nossum <vegardno@thuin.ifi.uio.no> Signed-off-by: Dave Airlie <airlied@redhat.com>