...so drm_getunique() is trying to copy some uninitialized data to
userspace. The ECX register contains the number of words that are
left to copy -- so there are 5 * 4 = 20 bytes left. The offset of the
first uninitialized byte (counting from the start of the string) is
also 20 (i.e. 0xf65d2294&((1 << 5)-1) == 20). So somebody tried to
copy 40 bytes when the string was only 19 long.

In drm_set_busid() we have this code:

        dev->unique_len = 40;
        dev->unique = drm_alloc(dev->unique_len + 1, DRM_MEM_DRIVER);
      ...
        len = snprintf(dev->unique, dev->unique_len, pci:%04x:%02x:%02x.%d",

...so it seems that dev->unique is never updated to reflect the
actual length of the string. The remaining bytes (20 in this case)
are random uninitialized bytes that are copied into userspace.

This patch fixes the problem by setting dev->unique_len after the
snprintf().

airlied- I've had to fix this up to store the alloced size so
we have it for drm_free later.
Reported-by: NSitsofe Wheeler <sitsofe@yahoo.com>
Signed-off-by: NVegard Nossum <vegardno@thuin.ifi.uio.no>
Signed-off-by: NDave Airlie <airlied@redhat.com>

This is step one towards having multiple masters sharing a drm
device in order to get fast-user-switching to work.

It splits out the information associated with the drm master
into a separate kref counted structure, and allocates this when
a master opens the device node. It also allows the current master
to abdicate (say while VT switched), and a new master to take over
the hardware.

It moves the Intel and radeon drivers to using the sarea from
within the new master structures.
Signed-off-by: NDave Airlie <airlied@redhat.com>

The current sub-module unload exit path is a mess, it tries
to abuse the idr. Just keep a list of devices per driver struct
and free them in-order on rmmod.
Signed-off-by: NDave Airlie <airlied@redhat.com>

It's not used in any other drivers, and doesn't look like it will be from
drm.git master.
Signed-off-by: NEric Anholt <eric@anholt.net>
Signed-off-by: NDave Airlie <airlied@linux.ie>

Like the last patch but adds a macro to get at the irq value instead of
dereferencing pdev directly.  Should  make things easier for the BSD guys and
if we ever support non-PCI devices.
Signed-off-by: NJesse Barnes <jbarnes@virtuousgeek.org>
Signed-off-by: NDave Airlie <airlied@redhat.com>

GEM allows the creation of persistent buffer objects accessible by the
graphics device through new ioctls for managing execution of commands on the
device.  The userland API is almost entirely driver-specific to ensure that
any driver building on this model can easily map the interface to individual
driver requirements.

GEM is used by the 2d driver for managing its internal state allocations and
will be used for pixmap storage to reduce memory consumption and enable
zero-copy GLX_EXT_texture_from_pixmap, and in the 3d driver is used to enable
GL_EXT_framebuffer_object and GL_ARB_pixel_buffer_object.
Signed-off-by: NEric Anholt <eric@anholt.net>
Signed-off-by: NDave Airlie <airlied@redhat.com>

With the coming of kernel based modesetting and the memory manager stuff,
the everything in one directory approach was getting very ugly and
starting to be unmanageable.

This restructures the drm along the lines of other kernel components.

It creates a drivers/gpu/drm directory and moves the hw drivers into
subdirectores. It moves the includes into an include/drm, and
sets up the unifdef for the userspace headers we should be exporting.
Signed-off-by: NDave Airlie <airlied@redhat.com>

rips out the head crap and replaces it with an idr and drm_minor structure
Signed-off-by: NDave Airlie <airlied@redhat.com>

perhaps bonghits could turn on my bus-mastering because the drm
certainly never bothered doing it before.
Signed-off-by: NDave Airlie <airlied@linux.ie>

needed to intel chipset flushing
Signed-off-by: NDave Airlie <airlied@linux.ie>

Make DRM devices use real Linux devices instead of class devices, which are
going away.  While we're at it, clean up some of the interfaces to take
struct drm_device * or struct device * and use the global drm_class where
needed instead of passing it around.
Signed-off-by: NDave Airlie <airlied@linux.ie>

Signed-off-by: NDave Airlie <airlied@linux.ie>

Brown paper bag for me this patch chunk didn't make it in the first application
Signed-off-by: NDave Airlie <airlied@linux.ie>

some drivers still todo.
Signed-off-by: NDave Airlie <airlied@linux.ie>

Signed-off-by: NDave Airlie <airlied@linux.ie>

This makes the drms use of the list handling macros a lot cleaner
and more along the lines of how they should be used and uses them
in some more places.
Signed-off-by: NDave Airlie <airlied@linux.ie>

Bugzilla Bug #9457

Add refcounting of user waiters to the DRM hardware lock, so that we can use
DRM_LOCK_CONT flag more conservatively.

Also add a kernel waiter refcount that if nonzero transfers the lock for the
kernel context when it is released. This is useful when waiting for idle and can be used for very simple fence object driver implementations for the new memory manager
Signed-off-by: NDave Airlie <airlied@linux.ie>

Signed-off-by: NJeff Garzik <jeff@garzik.org>
Signed-off-by: NAndrew Morton <akpm@osdl.org>
Signed-off-by: NDave Airlie <airlied@linux.ie>

Initialize the spinlock unconditionally when struct drm_device is filled in,
and return early in drm_locked_tasklet() if the driver doesn't support IRQs.
Signed-off-by: NDave Airlie <airlied@linux.ie>

Actually make the existing ioctls for adding and removing drawables do
something useful, and add another ioctl for the X server to update drawable
information. The only kind of drawable information tracked so far is cliprects.

Only reallocate cliprect memory if the number of cliprects changes.
Also improve diagnostic output.

hook up drm ioctl update draw
export drm_get_drawable_info symbol
Signed-off-by: NDave Airlie <airlied@linux.ie>

Signed-off-by: NDave Airlie <airlied@linux.ie>

Keep hashed user tokens, with the following changes:
32-bit physical device addresses are mapped directly to user-tokens. No
    duplicate maps are allowed, and the addresses are assumed to be outside
    of the range 0x10000000 through 0x30000000. The user-token is identical
    to the 32-bit physical start-address of the map.
64-bit physical device addressed are mapped to user-tokens in the range
0x10000000 to 0x30000000 with page-size increments. The user_token should
    not be interpreted as an address.
Other map types, like upcoming TTM maps are mapped to user-tokens in the
    range
0x10000000 to 0x30000000 with page-size increments. The user_token should
    not be interpreted as an address.

Implement hashed map lookups.
Signed-off-by: NDave Airlie <airlied@linux.ie>

This patch removes the pci_domain from the DRM device structure, and
gets it via a macro that either asks the platform or does the alpha special
case. jgarzik asked for this to just use the platform magic, but I've no
alpha experience and I'd rather not just break it and wait for someone to
give out.
Signed-off-by: NDave Airlie <airlied@linux.ie>

The drm keeps a local copy of these for little use.
Signed-off-by: NDave Airlie <airlied@linux.ie>

This patch contains the following possible cleanups:
- make the following needlessly global function static:
 - drm_bufs.c: drm_addbufs_fb()
- remove the following unused EXPORT_SYMBOL's:
 - drm_agpsupport.c: drm_agp_bind_memory
 - drm_bufs.c: drm_rmmap_locked
 - drm_bufs.c: drm_rmmap
 - drm_stub.c: drm_get_dev
Signed-off-by: NAdrian Bunk <bunk@stusta.de>
Signed-off-by: NDave Airlie <airlied@linux.ie>

Current drm code doesn't work with userspace programs that listen only
to the kernel event netlink socket as it is trying to create its own dev
interface.  Turns out lots of code can just be deleted as the driver
core can do all of this work automatically for you.
Signed-off-by: NGreg Kroah-Hartman <gregkh@suse.de>

From: Arjan van de Ven <arjan@infradead.org>

Semaphore to mutex conversion.

The conversion was generated via scripts, and the result was validated
automatically via a script as well.
Signed-off-by: NArjan van de Ven <arjan@infradead.org>
Signed-off-by: NIngo Molnar <mingo@elte.hu>
Signed-off-by: NAndrew Morton <akpm@osdl.org>
Signed-off-by: NDave Airlie <airlied@linux.ie>

This patch pull in a lot of changes from CVS to the main core DRM,
and updates the radeon driver to 1.21.0 that supports r300 texrect
and radeon card type ioctl.
Signed-off-by: NDave Airlie <airlied@linux.ie>

This simplifies the sysfs code for the drm and add a dri_library_name
attribute which can be used by a userspace app to figure out which
library to load.

From: Jon Smirl <jonsmirl@gmail.com>
Signed-off-by: NDave Airlie <airlied@linux.ie>

Rename the driver hooks in the DRM to something a little more understandable:
preinit         ->      load
postinit        ->      (removed)
presetup        ->      firstopen
postsetup       ->      (removed)
open_helper     ->      open
prerelease      ->      preclose
free_filp_priv  ->      postclose
pretakedown     ->      lastclose
postcleanup     ->      unload
release         ->      reclaim_buffers_locked
version         ->      (removed)

postinit and version were replaced with generic code in the Linux DRM (drivers
now set their version numbers and description in the driver structure, like on
BSD).  postsetup wasn't used at all.  Fixes the savage hooks for
initializing and tearing down mappings at the right times.  Testing involved at
least starting X, running glxgears, killing glxgears, exiting X, and repeating.

Tested on:      FreeBSD (g200, g400, r200, r128)
                Linux (r200, savage4)

From: Eric Anholt <anholt@freebsd.org>
Signed-off-by: NDave Airlie <airlied@linux.ie>

Just enables some extra printk's, but still..  Only the sysadmin should
be able to do that.
Signed-off-by: NLinus Torvalds <torvalds@osdl.org>

I've been threatening this for a while, so no point hanging around.
This lindents the DRM code which was always really bad in tabbing department.
I've also fixed some misnamed files in comments and removed some trailing
whitespace.
Signed-off-by: NDave Airlie <airlied@linux.ie>

This is a patch from DRM CVS that cleans up some code that was in CVS
that I never moved to the kernel, this patch produces the result of the
cleanups and puts it into the kernel drm.

From: Eric Anholt <anholt@freebsd.org>, Jon Smirl, Dave Airlie
Signed-off-by: NDave Airlie <airlied@linux.ie>

Added device_is_agp callback to drm_driver.  This function is called by the
platform-specific drm_device_is_agp function.  Added implementation of this
function the the Linux-specific portion of the MGA driver to detect PCI G450
cards.  Added code to the Linux-specific portion of the generic DRM layer to
not initialize AGP infrastructure if the card is not AGP (this matches what
already existed in BSD).

Fix up i810/i830 and i915 drivers to always return AGP as they don't always
report the capability.

Fix the MGA to not report AGP for a card that has an AGP chip behind a PCI
bridge.

From: Ian Romanick, Dave Airlie, Alan Hourihane
Signed-off-by: NDave Airlie <airlied@linux.ie>

This patch contains the following cleanups:
- make needlessly global functions static
- remove the following unused global functions:
 - drm_fops.c: drm_read
 - i915_dma.c: i915_do_cleanup_pageflip
Signed-off-by: NAdrian Bunk <bunk@stusta.de>
Signed-off-by: NDave Airlie <airlied@linux.ie>

Initial git repository build. I'm not bothering with the full history,
even though we have it. We can create a separate "historical" git
archive of that later if we want to, and in the meantime it's about
3.2GB when imported into git - space that would just make the early
git days unnecessarily complicated, when we don't have a lot of good
infrastructure for it.

Let it rip!