[src/netbsd-9]: src/sys/external/bsd/drm2/dist/drm Pull up following revision...

[martin <martin%NetBSD.org@localhost>]

details:   https://anonhg.NetBSD.org/src/rev/a99dcfe63907
branches:  netbsd-9
changeset: 963583:a99dcfe63907
user:      martin <martin%NetBSD.org@localhost>
date:      Fri Jan 31 11:28:38 2020 +0000

description:
Pull up following revision(s) (requested by msaitoh in ticket #678):

        sys/external/bsd/drm2/dist/drm/i915/i915_gem_stolen.c: revision 1.12
        sys/external/bsd/drm2/dist/drm/radeon/radeon_atombios_dp.c: revision 1.2
        sys/external/bsd/drm2/dist/drm/i915/i915_reg.h: revision 1.9
        sys/external/bsd/drm2/dist/drm/i915/i915_reg.h: revision 1.12

 Use unsigned to avoid undefined behavior in gen7_get_stolen_reserved().
Found by kUBSan.

 Use unsigned to avoid undefined behavior in g4x_update_wm().

 Avoid undefined behavior in g4x_get_stolen_reserved().

The change is the same as newer i915_gem_stolen.c.

 Don't call memcpy() when the length is 0 (and the source pointer is NULL)
in radeon_dp_aux_transfer_atom() to avoid undefined behavior. Found by kUBSan.

diffstat:

 sys/external/bsd/drm2/dist/drm/i915/i915_gem_stolen.c      |  17 ++++---------
 sys/external/bsd/drm2/dist/drm/i915/i915_reg.h             |   6 ++--
 sys/external/bsd/drm2/dist/drm/radeon/radeon_atombios_dp.c |   9 ++++---
 3 files changed, 14 insertions(+), 18 deletions(-)

diffs (99 lines):

diff -r 4d2680c2ebcd -r a99dcfe63907 sys/external/bsd/drm2/dist/drm/i915/i915_gem_stolen.c
--- a/sys/external/bsd/drm2/dist/drm/i915/i915_gem_stolen.c     Fri Jan 31 11:25:09 2020 +0000
+++ b/sys/external/bsd/drm2/dist/drm/i915/i915_gem_stolen.c     Fri Jan 31 11:28:38 2020 +0000
@@ -1,4 +1,4 @@
-/*     $NetBSD: i915_gem_stolen.c,v 1.11 2018/09/13 08:25:55 mrg Exp $ */
+/*     $NetBSD: i915_gem_stolen.c,v 1.11.4.1 2020/01/31 11:28:38 martin Exp $  */
 
 /*
  * Copyright © 2008-2012 Intel Corporation
@@ -29,7 +29,7 @@
  */
 
 #include <sys/cdefs.h>
-__KERNEL_RCSID(0, "$NetBSD: i915_gem_stolen.c,v 1.11 2018/09/13 08:25:55 mrg Exp $");
+__KERNEL_RCSID(0, "$NetBSD: i915_gem_stolen.c,v 1.11.4.1 2020/01/31 11:28:38 martin Exp $");
 
 #include <linux/printk.h>
 #include <linux/err.h>
@@ -308,18 +308,13 @@
        unsigned long stolen_top = dev_priv->mm.stolen_base +
                dev_priv->gtt.stolen_size;
 
+       if (!(reg_val & G4X_STOLEN_RESERVED_ADDR2_MASK))
+               return;
+
        *base = (reg_val & G4X_STOLEN_RESERVED_ADDR2_MASK) << 16;
-
        WARN_ON((reg_val & G4X_STOLEN_RESERVED_ADDR1_MASK) < *base);
 
-       /* On these platforms, the register doesn't have a size field, so the
-        * size is the distance between the base and the top of the stolen
-        * memory. We also have the genuine case where base is zero and there's
-        * nothing reserved. */
-       if (*base == 0)
-               *size = 0;
-       else
-               *size = stolen_top - *base;
+       *size = stolen_top - *base;
 }
 
 static void gen6_get_stolen_reserved(struct drm_i915_private *dev_priv,
diff -r 4d2680c2ebcd -r a99dcfe63907 sys/external/bsd/drm2/dist/drm/i915/i915_reg.h
--- a/sys/external/bsd/drm2/dist/drm/i915/i915_reg.h    Fri Jan 31 11:25:09 2020 +0000
+++ b/sys/external/bsd/drm2/dist/drm/i915/i915_reg.h    Fri Jan 31 11:28:38 2020 +0000
@@ -1,4 +1,4 @@
-/*     $NetBSD: i915_reg.h,v 1.7.2.2 2020/01/31 11:25:09 martin Exp $  */
+/*     $NetBSD: i915_reg.h,v 1.7.2.3 2020/01/31 11:28:38 martin Exp $  */
 
 /* Copyright 2003 Tungsten Graphics, Inc., Cedar Park, Texas.
  * All Rights Reserved.
@@ -187,7 +187,7 @@
 
 #define GEN6_STOLEN_RESERVED           0x1082C0
 #define GEN6_STOLEN_RESERVED_ADDR_MASK (0xFFFUL << 20)
-#define GEN7_STOLEN_RESERVED_ADDR_MASK (0x3FFF << 18)
+#define GEN7_STOLEN_RESERVED_ADDR_MASK (0x3FFFUL << 18)
 #define GEN6_STOLEN_RESERVED_SIZE_MASK (3 << 4)
 #define GEN6_STOLEN_RESERVED_1M                (0 << 4)
 #define GEN6_STOLEN_RESERVED_512K      (1 << 4)
@@ -4616,7 +4616,7 @@
 #define   DSPFW_SPRITEA_MASK           (0x7f<<0) /* g4x */
 #define   DSPFW_SPRITEA_MASK_VLV       (0xff<<0) /* vlv/chv */
 #define DSPFW3                 (dev_priv->info.display_mmio_offset + 0x7003c)
-#define   DSPFW_HPLL_SR_EN             (1<<31)
+#define   DSPFW_HPLL_SR_EN             (1U<<31)
 #define   PINEVIEW_SELF_REFRESH_EN     (1<<30)
 #define   DSPFW_CURSOR_SR_SHIFT                24
 #define   DSPFW_CURSOR_SR_MASK         (0x3f<<24)
diff -r 4d2680c2ebcd -r a99dcfe63907 sys/external/bsd/drm2/dist/drm/radeon/radeon_atombios_dp.c
--- a/sys/external/bsd/drm2/dist/drm/radeon/radeon_atombios_dp.c        Fri Jan 31 11:25:09 2020 +0000
+++ b/sys/external/bsd/drm2/dist/drm/radeon/radeon_atombios_dp.c        Fri Jan 31 11:28:38 2020 +0000
@@ -1,4 +1,4 @@
-/*     $NetBSD: radeon_atombios_dp.c,v 1.1 2018/08/27 14:38:20 riastradh Exp $ */
+/*     $NetBSD: radeon_atombios_dp.c,v 1.1.8.1 2020/01/31 11:28:38 martin Exp $        */
 
 /*
  * Copyright 2007-8 Advanced Micro Devices, Inc.
@@ -27,7 +27,7 @@
  *          Jerome Glisse
  */
 #include <sys/cdefs.h>
-__KERNEL_RCSID(0, "$NetBSD: radeon_atombios_dp.c,v 1.1 2018/08/27 14:38:20 riastradh Exp $");
+__KERNEL_RCSID(0, "$NetBSD: radeon_atombios_dp.c,v 1.1.8.1 2020/01/31 11:28:38 martin Exp $");
 
 #include <drm/drmP.h>
 #include <drm/radeon_drm.h>
@@ -196,9 +196,10 @@
                tx_size = HEADER_SIZE + msg->size;
                if (msg->size == 0)
                        tx_buf[3] |= BARE_ADDRESS_SIZE << 4;
-               else
+               else {
                        tx_buf[3] |= tx_size << 4;
-               memcpy(tx_buf + HEADER_SIZE, msg->buffer, msg->size);
+                       memcpy(tx_buf + HEADER_SIZE, msg->buffer, msg->size);
+               }
                ret = radeon_process_aux_ch(chan,
                                            tx_buf, tx_size, NULL, 0, delay, &ack);
                if (ret >= 0)