diff options
| author | martin <martin@NetBSD.org> | 2020-01-31 11:28:38 +0000 |
|---|---|---|
| committer | martin <martin@NetBSD.org> | 2020-01-31 11:28:38 +0000 |
| commit | 09ef230f8d6fc78fe5f9f4f2477a4e7e161f3fa1 (patch) | |
| tree | 1c75877a8c4037f066023721d3aba4e383bfb7de /sys/external | |
| parent | 850ddff34bf49f8002eb22f137cc5d6daef0fd3d (diff) | |
Pull up following revision(s) (requested by msaitoh in ticket #678):
sys/external/bsd/drm2/dist/drm/i915/i915_gem_stolen.c: revision 1.12
sys/external/bsd/drm2/dist/drm/radeon/radeon_atombios_dp.c: revision 1.2
sys/external/bsd/drm2/dist/drm/i915/i915_reg.h: revision 1.9
sys/external/bsd/drm2/dist/drm/i915/i915_reg.h: revision 1.12
Use unsigned to avoid undefined behavior in gen7_get_stolen_reserved().
Found by kUBSan.
Use unsigned to avoid undefined behavior in g4x_update_wm().
Avoid undefined behavior in g4x_get_stolen_reserved().
The change is the same as newer i915_gem_stolen.c.
Don't call memcpy() when the length is 0 (and the source pointer is NULL)
in radeon_dp_aux_transfer_atom() to avoid undefined behavior. Found by kUBSan.
Diffstat (limited to 'sys/external')
| -rw-r--r-- | sys/external/bsd/drm2/dist/drm/i915/i915_gem_stolen.c | 17 | ||||
| -rw-r--r-- | sys/external/bsd/drm2/dist/drm/i915/i915_reg.h | 6 | ||||
| -rw-r--r-- | sys/external/bsd/drm2/dist/drm/radeon/radeon_atombios_dp.c | 9 |
3 files changed, 14 insertions, 18 deletions
diff --git a/sys/external/bsd/drm2/dist/drm/i915/i915_gem_stolen.c b/sys/external/bsd/drm2/dist/drm/i915/i915_gem_stolen.c index d09f40f5ad1..c6958a90fbd 100644 --- a/sys/external/bsd/drm2/dist/drm/i915/i915_gem_stolen.c +++ b/sys/external/bsd/drm2/dist/drm/i915/i915_gem_stolen.c @@ -1,4 +1,4 @@ -/* $NetBSD: i915_gem_stolen.c,v 1.11 2018/09/13 08:25:55 mrg Exp $ */ +/* $NetBSD: i915_gem_stolen.c,v 1.11.4.1 2020/01/31 11:28:38 martin Exp $ */ /* * Copyright © 2008-2012 Intel Corporation @@ -29,7 +29,7 @@ */ #include <sys/cdefs.h> -__KERNEL_RCSID(0, "$NetBSD: i915_gem_stolen.c,v 1.11 2018/09/13 08:25:55 mrg Exp $"); +__KERNEL_RCSID(0, "$NetBSD: i915_gem_stolen.c,v 1.11.4.1 2020/01/31 11:28:38 martin Exp $"); #include <linux/printk.h> #include <linux/err.h> @@ -308,18 +308,13 @@ static void g4x_get_stolen_reserved(struct drm_i915_private *dev_priv, unsigned long stolen_top = dev_priv->mm.stolen_base + dev_priv->gtt.stolen_size; - *base = (reg_val & G4X_STOLEN_RESERVED_ADDR2_MASK) << 16; + if (!(reg_val & G4X_STOLEN_RESERVED_ADDR2_MASK)) + return; + *base = (reg_val & G4X_STOLEN_RESERVED_ADDR2_MASK) << 16; WARN_ON((reg_val & G4X_STOLEN_RESERVED_ADDR1_MASK) < *base); - /* On these platforms, the register doesn't have a size field, so the - * size is the distance between the base and the top of the stolen - * memory. We also have the genuine case where base is zero and there's - * nothing reserved. */ - if (*base == 0) - *size = 0; - else - *size = stolen_top - *base; + *size = stolen_top - *base; } static void gen6_get_stolen_reserved(struct drm_i915_private *dev_priv, diff --git a/sys/external/bsd/drm2/dist/drm/i915/i915_reg.h b/sys/external/bsd/drm2/dist/drm/i915/i915_reg.h index a6a02e7c299..20e12dd6723 100644 --- a/sys/external/bsd/drm2/dist/drm/i915/i915_reg.h +++ b/sys/external/bsd/drm2/dist/drm/i915/i915_reg.h @@ -1,4 +1,4 @@ -/* $NetBSD: i915_reg.h,v 1.7.2.2 2020/01/31 11:25:09 martin Exp $ */ +/* $NetBSD: i915_reg.h,v 1.7.2.3 2020/01/31 11:28:38 martin Exp $ */ /* Copyright 2003 Tungsten Graphics, Inc., Cedar Park, Texas. * All Rights Reserved. @@ -187,7 +187,7 @@ #define GEN6_STOLEN_RESERVED 0x1082C0 #define GEN6_STOLEN_RESERVED_ADDR_MASK (0xFFFUL << 20) -#define GEN7_STOLEN_RESERVED_ADDR_MASK (0x3FFF << 18) +#define GEN7_STOLEN_RESERVED_ADDR_MASK (0x3FFFUL << 18) #define GEN6_STOLEN_RESERVED_SIZE_MASK (3 << 4) #define GEN6_STOLEN_RESERVED_1M (0 << 4) #define GEN6_STOLEN_RESERVED_512K (1 << 4) @@ -4616,7 +4616,7 @@ enum skl_disp_power_wells { #define DSPFW_SPRITEA_MASK (0x7f<<0) /* g4x */ #define DSPFW_SPRITEA_MASK_VLV (0xff<<0) /* vlv/chv */ #define DSPFW3 (dev_priv->info.display_mmio_offset + 0x7003c) -#define DSPFW_HPLL_SR_EN (1<<31) +#define DSPFW_HPLL_SR_EN (1U<<31) #define PINEVIEW_SELF_REFRESH_EN (1<<30) #define DSPFW_CURSOR_SR_SHIFT 24 #define DSPFW_CURSOR_SR_MASK (0x3f<<24) diff --git a/sys/external/bsd/drm2/dist/drm/radeon/radeon_atombios_dp.c b/sys/external/bsd/drm2/dist/drm/radeon/radeon_atombios_dp.c index 9cb1509b8ff..692f6858825 100644 --- a/sys/external/bsd/drm2/dist/drm/radeon/radeon_atombios_dp.c +++ b/sys/external/bsd/drm2/dist/drm/radeon/radeon_atombios_dp.c @@ -1,4 +1,4 @@ -/* $NetBSD: radeon_atombios_dp.c,v 1.1 2018/08/27 14:38:20 riastradh Exp $ */ +/* $NetBSD: radeon_atombios_dp.c,v 1.1.8.1 2020/01/31 11:28:38 martin Exp $ */ /* * Copyright 2007-8 Advanced Micro Devices, Inc. @@ -27,7 +27,7 @@ * Jerome Glisse */ #include <sys/cdefs.h> -__KERNEL_RCSID(0, "$NetBSD: radeon_atombios_dp.c,v 1.1 2018/08/27 14:38:20 riastradh Exp $"); +__KERNEL_RCSID(0, "$NetBSD: radeon_atombios_dp.c,v 1.1.8.1 2020/01/31 11:28:38 martin Exp $"); #include <drm/drmP.h> #include <drm/radeon_drm.h> @@ -196,9 +196,10 @@ radeon_dp_aux_transfer_atom(struct drm_dp_aux *aux, struct drm_dp_aux_msg *msg) tx_size = HEADER_SIZE + msg->size; if (msg->size == 0) tx_buf[3] |= BARE_ADDRESS_SIZE << 4; - else + else { tx_buf[3] |= tx_size << 4; - memcpy(tx_buf + HEADER_SIZE, msg->buffer, msg->size); + memcpy(tx_buf + HEADER_SIZE, msg->buffer, msg->size); + } ret = radeon_process_aux_ch(chan, tx_buf, tx_size, NULL, 0, delay, &ack); if (ret >= 0) |
