linux-stable.git/drivers/char/drm, branch linux-2.6.26.y

drm/i915: fix ioremap of a user address for non-root (CVE-2008-3831)

2008-10-22T21:13:28+00:00

commit 4b40893918203ee1a1f6a114316c2a19c072e9bd upstream

Olaf Kirch noticed that the i915_set_status_page() function of the i915
kernel driver calls ioremap with an address offset that is supplied by
userspace via ioctl. The function zeroes the mapped memory via memset
and tells the hardware about the address. Turns out that access to that
ioctl is not restricted to root so users could probably exploit that to
do nasty things. We haven't tried to write actual exploit code though.

It only affects the Intel G33 series and newer.

Signed-off-by: Dave Airlie 
Signed-off-by: Greg Kroah-Hartman

DRM/i915: only use tiled blits on 965+

2008-07-03T01:42:23+00:00

When scheduled swaps occur, we need to blit between front & back
buffers.  If the buffers are tiled, we need to set the appropriate
XY_SRC_COPY tile bit, but only on 965 chips, since it will cause
corruption on pre-965 (e.g. 945).

Bug reported by and fix tested by Tomas Janousek .

Signed-off-by: Jesse Barnes 
Acked-by: Dave Airlie 
Signed-off-by: Linus Torvalds

enable bus mastering on i915 at resume time

2008-06-24T18:17:25+00:00

On 9xx chips, bus mastering needs to be enabled at resume time for much of the
chip to function.  With this patch, vblank interrupts will work as expected
on resume, along with other chip functions.   Fixes kernel bugzilla #10844.

Signed-off-by: Jie Luo 
Signed-off-by: Jesse Barnes 
Signed-off-by: Linus Torvalds

drm: only trust core drm ioctls - driver ioctls are a mess.

2008-06-20T05:42:38+00:00

So driver ioctls need a full auditing before we can make this change.

Signed-off-by: Dave Airlie

drm/i915: add support for Intel series 4 chipsets.

2008-06-20T02:12:56+00:00

Signed-off-by: Zhenyu Wang 
Signed-off-by: Dave Airlie

drm/radeon: add hier-z registers for r300 and r500 chipsets

2008-06-19T03:01:58+00:00

drm/radeon: use DSTCACHE_CTLSTAT rather than RB2D_DSTCACHE_CTLSTAT

2008-06-19T02:39:23+00:00

According to the hw guys, you should use DSTCACHE_CTLSTAT to flush
the 2D dst cache rather than RB2D_DSTCACHE_CTLSTAT.

Signed-off-by: Dave Airlie

drm/radeon: switch IGP gart to use radeon_write_agp_base()

2008-06-19T02:38:29+00:00

Signed-off-by: Dave Airlie

drm/radeon: Restore sw interrupt on resume

2008-06-19T02:36:55+00:00

Fixes performance drop after suspend/resume on some systems.

Signed-off-by: Dave Airlie

drm/r500: add support for AGP based cards.

2008-06-19T01:40:44+00:00

AGP registers weren't programmed properly for r500 cards.

Signed-off-by: Dave Airlie