summaryrefslogtreecommitdiff
path: root/sys/external
diff options
context:
space:
mode:
authormartin <martin@NetBSD.org>2020-01-31 11:28:38 +0000
committermartin <martin@NetBSD.org>2020-01-31 11:28:38 +0000
commit09ef230f8d6fc78fe5f9f4f2477a4e7e161f3fa1 (patch)
tree1c75877a8c4037f066023721d3aba4e383bfb7de /sys/external
parent850ddff34bf49f8002eb22f137cc5d6daef0fd3d (diff)
Pull up following revision(s) (requested by msaitoh in ticket #678):
sys/external/bsd/drm2/dist/drm/i915/i915_gem_stolen.c: revision 1.12 sys/external/bsd/drm2/dist/drm/radeon/radeon_atombios_dp.c: revision 1.2 sys/external/bsd/drm2/dist/drm/i915/i915_reg.h: revision 1.9 sys/external/bsd/drm2/dist/drm/i915/i915_reg.h: revision 1.12 Use unsigned to avoid undefined behavior in gen7_get_stolen_reserved(). Found by kUBSan. Use unsigned to avoid undefined behavior in g4x_update_wm(). Avoid undefined behavior in g4x_get_stolen_reserved(). The change is the same as newer i915_gem_stolen.c. Don't call memcpy() when the length is 0 (and the source pointer is NULL) in radeon_dp_aux_transfer_atom() to avoid undefined behavior. Found by kUBSan.
Diffstat (limited to 'sys/external')
-rw-r--r--sys/external/bsd/drm2/dist/drm/i915/i915_gem_stolen.c17
-rw-r--r--sys/external/bsd/drm2/dist/drm/i915/i915_reg.h6
-rw-r--r--sys/external/bsd/drm2/dist/drm/radeon/radeon_atombios_dp.c9
3 files changed, 14 insertions, 18 deletions
diff --git a/sys/external/bsd/drm2/dist/drm/i915/i915_gem_stolen.c b/sys/external/bsd/drm2/dist/drm/i915/i915_gem_stolen.c
index d09f40f5ad1..c6958a90fbd 100644
--- a/sys/external/bsd/drm2/dist/drm/i915/i915_gem_stolen.c
+++ b/sys/external/bsd/drm2/dist/drm/i915/i915_gem_stolen.c
@@ -1,4 +1,4 @@
-/* $NetBSD: i915_gem_stolen.c,v 1.11 2018/09/13 08:25:55 mrg Exp $ */
+/* $NetBSD: i915_gem_stolen.c,v 1.11.4.1 2020/01/31 11:28:38 martin Exp $ */
/*
* Copyright © 2008-2012 Intel Corporation
@@ -29,7 +29,7 @@
*/
#include <sys/cdefs.h>
-__KERNEL_RCSID(0, "$NetBSD: i915_gem_stolen.c,v 1.11 2018/09/13 08:25:55 mrg Exp $");
+__KERNEL_RCSID(0, "$NetBSD: i915_gem_stolen.c,v 1.11.4.1 2020/01/31 11:28:38 martin Exp $");
#include <linux/printk.h>
#include <linux/err.h>
@@ -308,18 +308,13 @@ static void g4x_get_stolen_reserved(struct drm_i915_private *dev_priv,
unsigned long stolen_top = dev_priv->mm.stolen_base +
dev_priv->gtt.stolen_size;
- *base = (reg_val & G4X_STOLEN_RESERVED_ADDR2_MASK) << 16;
+ if (!(reg_val & G4X_STOLEN_RESERVED_ADDR2_MASK))
+ return;
+ *base = (reg_val & G4X_STOLEN_RESERVED_ADDR2_MASK) << 16;
WARN_ON((reg_val & G4X_STOLEN_RESERVED_ADDR1_MASK) < *base);
- /* On these platforms, the register doesn't have a size field, so the
- * size is the distance between the base and the top of the stolen
- * memory. We also have the genuine case where base is zero and there's
- * nothing reserved. */
- if (*base == 0)
- *size = 0;
- else
- *size = stolen_top - *base;
+ *size = stolen_top - *base;
}
static void gen6_get_stolen_reserved(struct drm_i915_private *dev_priv,
diff --git a/sys/external/bsd/drm2/dist/drm/i915/i915_reg.h b/sys/external/bsd/drm2/dist/drm/i915/i915_reg.h
index a6a02e7c299..20e12dd6723 100644
--- a/sys/external/bsd/drm2/dist/drm/i915/i915_reg.h
+++ b/sys/external/bsd/drm2/dist/drm/i915/i915_reg.h
@@ -1,4 +1,4 @@
-/* $NetBSD: i915_reg.h,v 1.7.2.2 2020/01/31 11:25:09 martin Exp $ */
+/* $NetBSD: i915_reg.h,v 1.7.2.3 2020/01/31 11:28:38 martin Exp $ */
/* Copyright 2003 Tungsten Graphics, Inc., Cedar Park, Texas.
* All Rights Reserved.
@@ -187,7 +187,7 @@
#define GEN6_STOLEN_RESERVED 0x1082C0
#define GEN6_STOLEN_RESERVED_ADDR_MASK (0xFFFUL << 20)
-#define GEN7_STOLEN_RESERVED_ADDR_MASK (0x3FFF << 18)
+#define GEN7_STOLEN_RESERVED_ADDR_MASK (0x3FFFUL << 18)
#define GEN6_STOLEN_RESERVED_SIZE_MASK (3 << 4)
#define GEN6_STOLEN_RESERVED_1M (0 << 4)
#define GEN6_STOLEN_RESERVED_512K (1 << 4)
@@ -4616,7 +4616,7 @@ enum skl_disp_power_wells {
#define DSPFW_SPRITEA_MASK (0x7f<<0) /* g4x */
#define DSPFW_SPRITEA_MASK_VLV (0xff<<0) /* vlv/chv */
#define DSPFW3 (dev_priv->info.display_mmio_offset + 0x7003c)
-#define DSPFW_HPLL_SR_EN (1<<31)
+#define DSPFW_HPLL_SR_EN (1U<<31)
#define PINEVIEW_SELF_REFRESH_EN (1<<30)
#define DSPFW_CURSOR_SR_SHIFT 24
#define DSPFW_CURSOR_SR_MASK (0x3f<<24)
diff --git a/sys/external/bsd/drm2/dist/drm/radeon/radeon_atombios_dp.c b/sys/external/bsd/drm2/dist/drm/radeon/radeon_atombios_dp.c
index 9cb1509b8ff..692f6858825 100644
--- a/sys/external/bsd/drm2/dist/drm/radeon/radeon_atombios_dp.c
+++ b/sys/external/bsd/drm2/dist/drm/radeon/radeon_atombios_dp.c
@@ -1,4 +1,4 @@
-/* $NetBSD: radeon_atombios_dp.c,v 1.1 2018/08/27 14:38:20 riastradh Exp $ */
+/* $NetBSD: radeon_atombios_dp.c,v 1.1.8.1 2020/01/31 11:28:38 martin Exp $ */
/*
* Copyright 2007-8 Advanced Micro Devices, Inc.
@@ -27,7 +27,7 @@
* Jerome Glisse
*/
#include <sys/cdefs.h>
-__KERNEL_RCSID(0, "$NetBSD: radeon_atombios_dp.c,v 1.1 2018/08/27 14:38:20 riastradh Exp $");
+__KERNEL_RCSID(0, "$NetBSD: radeon_atombios_dp.c,v 1.1.8.1 2020/01/31 11:28:38 martin Exp $");
#include <drm/drmP.h>
#include <drm/radeon_drm.h>
@@ -196,9 +196,10 @@ radeon_dp_aux_transfer_atom(struct drm_dp_aux *aux, struct drm_dp_aux_msg *msg)
tx_size = HEADER_SIZE + msg->size;
if (msg->size == 0)
tx_buf[3] |= BARE_ADDRESS_SIZE << 4;
- else
+ else {
tx_buf[3] |= tx_size << 4;
- memcpy(tx_buf + HEADER_SIZE, msg->buffer, msg->size);
+ memcpy(tx_buf + HEADER_SIZE, msg->buffer, msg->size);
+ }
ret = radeon_process_aux_ch(chan,
tx_buf, tx_size, NULL, 0, delay, &ack);
if (ret >= 0)