linux/drivers/gpu, branch v2.6.27.25

drm/i915: add support for G41 chipset

2009-05-08T21:54:33Z

commit 72021788678523047161e97b3dfed695e802a5fd upstream. This had been delayed for some time due to failure to work on the one piece of G41 hardware we had, and lack of success reports from anybody else. Current hardware appears to be OK. Signed-off-by: Zhenyu Wang [anholt: hand-applied due to conflicts with IGD patches] Signed-off-by: Eric Anholt Signed-off-by: Greg Kroah-Hartman

drm/i915: fix ioremap of a user address for non-root (CVE-2008-3831)

2008-10-22T21:21:29Z

commit 4b40893918203ee1a1f6a114316c2a19c072e9bd upstream Olaf Kirch noticed that the i915_set_status_page() function of the i915 kernel driver calls ioremap with an address offset that is supplied by userspace via ioctl. The function zeroes the mapped memory via memset and tells the hardware about the address. Turns out that access to that ioctl is not restricted to root so users could probably exploit that to do nasty things. We haven't tried to write actual exploit code though. It only affects the Intel G33 series and newer. Signed-off-by: Dave Airlie Signed-off-by: Greg Kroah-Hartman

drm/radeon: downgrade debug message from info to debug.

2008-08-31T22:51:52Z

If this triggers its bad, however some machines seem to have been triggering it for ages and we didn't know until we added the debug. So downgrade the debug now so people don't call this a regression. Signed-off-by: Dave Airlie

Merge branch 'drm-patches' of git://git.kernel.org/pub/scm/linux/kernel/git/airlied/drm-2.6

2008-08-27T21:28:45Z

* 'drm-patches' of git://git.kernel.org/pub/scm/linux/kernel/git/airlied/drm-2.6: drm: don't set the signal blocker on the master process. drm: don't call the vblank tasklet with irqs disabled. r300: Fix cliprect emit drm/radeon: r300_cmdbuf: Always emit INDX_BUFFER immediately after DRAW_INDEX radeon: fix some hard lockups on r3/4/500s

drm: don't set the signal blocker on the master process.

2008-08-24T20:35:33Z

There is a problem with debugging the X server and gdb crashes in the xkb startup code. This avoids the problem by allowing the master process to get signals. It should be safe as the signal blocker is mainly so that you can Ctrl-Z a 3D application without locking up the whole box. Ctrl-Z the X server isn't something many people do. Signed-off-by: Dave Airlie

drm: don't call the vblank tasklet with irqs disabled.

2008-08-24T20:35:21Z

If a specific tasklet shares data with irq context, it needs to take a private irq-blocking spinlock within the tasklet itself. Signed-off-by: Dave Airlie

r300: Fix cliprect emit

2008-08-24T20:35:12Z

This makes our handling of cliprects sane. drm_clip_rect always has exclusiv bottom-right corners, but the hardware expects inclusive bottom-right corner so we adjust this here. This complements Michel Daenzer's commit 57aea290e1e0a26d1e74df6cff777eb9f03 to Mesa. See also http://bugs.freedesktop.org/show_bug.cgi?id=16123 Signed-off-by: Dave Airlie

drm/radeon: r300_cmdbuf: Always emit INDX_BUFFER immediately after DRAW_INDEX

2008-08-24T20:35:05Z

DRAW_INDEX writes a vertex count to VAP_VF_CNTL. Docs say that behaviour is undefined (i.e. lockups happen) when this write is not followed by the right number of vertex indices. Thus we used to do the wrong thing when drawing across many cliprects was necessary, because we emitted a sequence DRAW_INDEX, DRAW_INDEX, INDX_BUFFER, INDX_BUFFER instead of DRAW_INDEX, INDX_BUFFER, DRAW_INDEX, INDX_BUFFER The latter is what we're doing now and which ought to be correct. Signed-off-by: Dave Airlie

radeon: fix some hard lockups on r3/4/500s

2008-08-24T20:34:58Z

This patch should fix hard lockup and convert them in softlockup (ie you can ssh the box but the gpu is busted and we are waiting in loop for it to come back to reason). Signed-off-by: Dave Airlie

Remove newline from the description of module parameters

2008-08-01T19:46:41Z

Some module parameters with only one line have the '\n' at the end of the description. This is not needed nor wanted as after the description the type (i.e. int) is followed by a newline. Some modules contain a multi-line description, these are not affected by this patch. Signed-off-by: Niels de Vos Acked-by: Randy Dunlap Cc: John W. Linville Cc: Ed L. Cashin Cc: Dave Airlie Cc: Roland Dreier Acked-by: Mauro Carvalho Chehab Cc: Jeff Garzik Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds