Commit febe8030 authored by Daniel Vetter's avatar Daniel Vetter
Browse files

Merge tag 'drm-intel-fixes-2019-06-13' of... 

Merge tag 'drm-intel-fixes-2019-06-13' of git://anongit.freedesktop.org/drm/drm-intel

 into drm-fixes

drm/i915 fixes for v5.2-rc5:
- Fix DMC firmware input validation to avoid buffer overflow
- Fix perf register access whitelist for userspace
- Fix DSI panel on GPD MicroPC
- Fix per-pixel alpha with CCS
- Fix HDMI audio for SDVO

Signed-off-by: default avatarDaniel Vetter <daniel.vetter@ffwll.ch>
From: Jani Nikula <jani.nikula@intel.com>
Link: https://patchwork.freedesktop.org/patch/msgid/87y325x22w.fsf@intel.com
parents 76509d6b c5cc0bf8

drivers/gpu/drm/i915/i915_perf.c

+1 −0
Original line number Diff line number Diff line
@@ -3005,6 +3005,7 @@ static bool gen8_is_valid_mux_addr(struct drm_i915_private *dev_priv, u32 addr) 
static bool gen10_is_valid_mux_addr(struct drm_i915_private *dev_priv, u32 addr)

{

	return gen8_is_valid_mux_addr(dev_priv, addr) ||

		addr == i915_mmio_reg_offset(GEN10_NOA_WRITE_HIGH) ||

		(addr >= i915_mmio_reg_offset(OA_PERFCNT3_LO) &&

		 addr <= i915_mmio_reg_offset(OA_PERFCNT4_HI));

}

drivers/gpu/drm/i915/i915_reg.h

+1 −0
Original line number Diff line number Diff line
@@ -1062,6 +1062,7 @@ static inline bool i915_mmio_reg_valid(i915_reg_t reg) 


#define NOA_DATA	    _MMIO(0x986C)

#define NOA_WRITE	    _MMIO(0x9888)

#define GEN10_NOA_WRITE_HIGH _MMIO(0x9884)



#define _GEN7_PIPEA_DE_LOAD_SL	0x70068

#define _GEN7_PIPEB_DE_LOAD_SL	0x71068

drivers/gpu/drm/i915/intel_csr.c

+18 −0
Original line number Diff line number Diff line
@@ -303,10 +303,17 @@ static u32 *parse_csr_fw(struct drm_i915_private *dev_priv, 
	u32 dmc_offset = CSR_DEFAULT_FW_OFFSET, readcount = 0, nbytes;

	u32 i;

	u32 *dmc_payload;

	size_t fsize;



	if (!fw)

		return NULL;



	fsize = sizeof(struct intel_css_header) +

		sizeof(struct intel_package_header) +

		sizeof(struct intel_dmc_header);

	if (fsize > fw->size)

		goto error_truncated;



	/* Extract CSS Header information*/

	css_header = (struct intel_css_header *)fw->data;

	if (sizeof(struct intel_css_header) !=
@@ -366,6 +373,9 @@ static u32 *parse_csr_fw(struct drm_i915_private *dev_priv, 
	/* Convert dmc_offset into number of bytes. By default it is in dwords*/

	dmc_offset *= 4;

	readcount += dmc_offset;

	fsize += dmc_offset;

	if (fsize > fw->size)

		goto error_truncated;



	/* Extract dmc_header information. */

	dmc_header = (struct intel_dmc_header *)&fw->data[readcount];
@@ -397,6 +407,10 @@ static u32 *parse_csr_fw(struct drm_i915_private *dev_priv, 


	/* fw_size is in dwords, so multiplied by 4 to convert into bytes. */

	nbytes = dmc_header->fw_size * 4;

	fsize += nbytes;

	if (fsize > fw->size)

		goto error_truncated;



	if (nbytes > csr->max_fw_size) {

		DRM_ERROR("DMC FW too big (%u bytes)\n", nbytes);

		return NULL;
@@ -410,6 +424,10 @@ static u32 *parse_csr_fw(struct drm_i915_private *dev_priv, 
	}



	return memcpy(dmc_payload, &fw->data[readcount], nbytes);



error_truncated:

	DRM_ERROR("Truncated DMC firmware, rejecting.\n");

	return NULL;

}



static void intel_csr_runtime_pm_get(struct drm_i915_private *dev_priv)

drivers/gpu/drm/i915/intel_display.c

+9 −5
Original line number Diff line number Diff line
@@ -2432,10 +2432,14 @@ static unsigned int intel_fb_modifier_to_tiling(u64 fb_modifier) 
 * main surface.

 */

static const struct drm_format_info ccs_formats[] = {

	{ .format = DRM_FORMAT_XRGB8888, .depth = 24, .num_planes = 2, .cpp = { 4, 1, }, .hsub = 8, .vsub = 16, },

	{ .format = DRM_FORMAT_XBGR8888, .depth = 24, .num_planes = 2, .cpp = { 4, 1, }, .hsub = 8, .vsub = 16, },

	{ .format = DRM_FORMAT_ARGB8888, .depth = 32, .num_planes = 2, .cpp = { 4, 1, }, .hsub = 8, .vsub = 16, },

	{ .format = DRM_FORMAT_ABGR8888, .depth = 32, .num_planes = 2, .cpp = { 4, 1, }, .hsub = 8, .vsub = 16, },

	{ .format = DRM_FORMAT_XRGB8888, .depth = 24, .num_planes = 2,

	  .cpp = { 4, 1, }, .hsub = 8, .vsub = 16, },

	{ .format = DRM_FORMAT_XBGR8888, .depth = 24, .num_planes = 2,

	  .cpp = { 4, 1, }, .hsub = 8, .vsub = 16, },

	{ .format = DRM_FORMAT_ARGB8888, .depth = 32, .num_planes = 2,

	  .cpp = { 4, 1, }, .hsub = 8, .vsub = 16, .has_alpha = true, },

	{ .format = DRM_FORMAT_ABGR8888, .depth = 32, .num_planes = 2,

	  .cpp = { 4, 1, }, .hsub = 8, .vsub = 16, .has_alpha = true, },

};



static const struct drm_format_info *
@@ -11942,7 +11946,7 @@ encoder_retry: 
	return 0;

}



static bool intel_fuzzy_clock_check(int clock1, int clock2)

bool intel_fuzzy_clock_check(int clock1, int clock2)

{

	int diff;

drivers/gpu/drm/i915/intel_drv.h

+1 −0
Original line number Diff line number Diff line
@@ -1742,6 +1742,7 @@ int vlv_force_pll_on(struct drm_i915_private *dev_priv, enum pipe pipe, 
		     const struct dpll *dpll);

void vlv_force_pll_off(struct drm_i915_private *dev_priv, enum pipe pipe);

int lpt_get_iclkip(struct drm_i915_private *dev_priv);

bool intel_fuzzy_clock_check(int clock1, int clock2);



/* modesetting asserts */

void assert_panel_unlocked(struct drm_i915_private *dev_priv,

CRA Git | Maintained and supported by SUSTech CRA and CCSE