The NetBSD Project

CVS log for src/sys/external/bsd/drm2/dist/drm/i915/i915_reg.h

[BACK] Up to [cvs.NetBSD.org] / src / sys / external / bsd / drm2 / dist / drm / i915

Request diff between arbitrary revisions


Default branch: MAIN


Revision 1.19 / (download) - annotate - [select for diffs], Sun Dec 19 12:24:36 2021 UTC (2 years, 3 months ago) by riastradh
Branch: MAIN
CVS Tags: thorpej-ifq-base, thorpej-ifq, thorpej-altq-separation-base, thorpej-altq-separation, netbsd-10-base, netbsd-10-0-RELEASE, netbsd-10-0-RC6, netbsd-10-0-RC5, netbsd-10-0-RC4, netbsd-10-0-RC3, netbsd-10-0-RC2, netbsd-10-0-RC1, netbsd-10, bouyer-sunxi-drm-base, bouyer-sunxi-drm, HEAD
Changes since 1.18: +59 -59 lines
Diff to previous 1.18 (colored)

i915: Remove local diffs obviated by -fwrapv.

Revision 1.18 / (download) - annotate - [select for diffs], Sun Dec 19 11:38:04 2021 UTC (2 years, 3 months ago) by riastradh
Branch: MAIN
Changes since 1.17: +2 -1 lines
Diff to previous 1.17 (colored)

i915: another whack at it

Revision 1.17 / (download) - annotate - [select for diffs], Sun Dec 19 11:14:16 2021 UTC (2 years, 3 months ago) by riastradh
Branch: MAIN
Changes since 1.16: +2 -1 lines
Diff to previous 1.16 (colored)

Fix mangled local change and close parens.


Author: Maya Rashish <maya@NetBSD.org>
Committer: Taylor R Campbell <riastradh@NetBSD.org>

Revision 1.16 / (download) - annotate - [select for diffs], Sun Dec 19 09:58:39 2021 UTC (2 years, 3 months ago) by riastradh
Branch: MAIN
Changes since 1.15: +1 -11 lines
Diff to previous 1.15 (colored)

remove bogus local diff


Author: Maya Rashish <maya@NetBSD.org>

Revision 1.15 / (download) - annotate - [select for diffs], Sat Dec 18 23:45:28 2021 UTC (2 years, 3 months ago) by riastradh
Branch: MAIN
Changes since 1.14: +7446 -3540 lines
Diff to previous 1.14 (colored)

Merge linux-drm-v5-6-rc3

Revision 1.1.1.4 / (download) - annotate - [select for diffs] (vendor branch), Sat Dec 18 20:15:26 2021 UTC (2 years, 3 months ago) by riastradh
Branch: LINUX
CVS Tags: linux-drm-v5-6-rc3
Changes since 1.1.1.3: +7463 -3544 lines
Diff to previous 1.1.1.3 (colored)

Import drm from Linux v5.6-rc3 (commit f8788d86ab28f61f7b46eb6be375f8a726783636)

    drivers/gpu/drm     -> sys/external/bsd/drm2/dist/drm
    include/drm         -> sys/external/bsd/drm2/dist/include/drm
    include/uapi/drm    -> sys/external/bsd/drm2/dist/include/uapi/drm

GPL exclusions in dist/drm:

- amd/amdgpu/amdgpu_atpx_handler.c
- arc/
- arm/
- armada/
- aspeed/
- atmel-hlcdc/
- bochs/
- bridge/
- cirrus/
- drm_dp_cec.c
- drm_dp_mst_topology_internal.h
- drm_edid_load.c
- drm_format_helper.c
- drm_gem_cma_helper.c
- drm_gem_framebuffer_helper.c
- drm_gem_shmem_helper.c
- drm_gem_ttm_helper.c
- drm_gem_vram_helper.c
- drm_hdcp.c
- drm_lease.c
- drm_mipi_dbi.c
- drm_simple_kms_helper.c
- drm_sysfs.c
- drm_trace.h
- drm_vram_helper_common.c
- drm_writeback.c
- etnaviv/
- exynos/
- fsl-dcu/
- gma500/
- hisilicon/
- i2c/tda9950.c
- i2c/tda998x_drv.c
- i915/gt/selftest_context.c
- i915/gt/selftest_engine.c
- i915/gt/selftest_engine.h
- i915/gt/selftest_engine_cs.c
- i915/gt/selftest_engine_pm.c
- i915/i915_trace.h
- i915/selftests/i915_live_selftests.h
- i915/selftests/i915_mock_selftests.h
- i915/selftests/i915_perf_selftests.h
- i915/selftests/lib_sw_fence.h
- imx/
- ingenic/
- lima/
- mcde/
- mediatek/
- meson/
- mgag200/
- msm/
- mxsfb/
- omapdrm/
- panel/
- panfrost/
- pl111/
- radeon/radeon_atpx_handler.c
- rcar-du/
- rockchip/
- selftests/drm_cmdline_selftests.h
- selftests/drm_modeset_selftests.h
- selftests/test-drm_cmdline_parser.c
- selftests/test-drm_damage_helper.c
- selftests/test-drm_dp_mst_helper.c
- selftests/test-drm_format.c
- selftests/test-drm_framebuffer.c
- selftests/test-drm_modeset_common.c
- selftests/test-drm_modeset_common.h
- selftests/test-drm_plane_helper.c
- selftests/test-drm_rect.c
- shmobile/
- sti/
- stm/
- sun4i/
- tegra/
- tilcdc/
- tiny/
- tve200/
- udl/
- v3d/
- vc4/
- virtio/virtgpu_trace.h
- virtio/virtgpu_trace_points.c
- vkms/
- vmwgfx/device_include/vmware_pack_begin.h
- vmwgfx/device_include/vmware_pack_end.h
- zte/

  Exceptions -- these all appear to be files to which someone added
  an SPDX license header automatically by a script that is not aware
  of the default MIT licensing under drivers/gpu/drm:

  - ast/ast_dp501.c
  - ast/ast_dram_tables.h
  - lib/drm_random.c
  - lib/drm_random.h
  - i915/display/intel_acpi.c
  - i915/selftests/mock_gem_device.h
  - i915/selftests/i915_mock_selftests.h
  - i915/selftests/i915_live_selftests.h
  - r128/ati_pcigart.h
  - selftests/drm_mm_selftests.h
  - selftests/test-drm_mm.c
  - vmwgfx/device_include/vm_basic_types.h

GPL exclusions in dist/include/drm:

- bridge
- drm_client.h
- drm_fb_cma_helper.h
- drm_format_helper.h
- drm_gem_cma_helper.h
- drm_gem_shmem_helper.h
- drm_gem_ttm_helper.h
- drm_gem_vram_helper.h
- drm_lease.h
- drm_mipi_dbi.h
- drm_mipi_dsi.h
- drm_of.h
- drm_simple_kms_helper.h
- drm_sysfs.h
- drm_writeback.h
- gma_drm.h
- i2c/tda998x.h
- i915_mei_hdcp_interface.h
- intel-gtt.h

  Exceptions:
  - drm_agpsupport.h - was in original drm; wrong spdx header auto-added

GPL exclusions in dist/include/uapi/drm:

- armada_drm.h
- etnaviv_drm.h
- exynos_drm.h
- lima_drm.h
- omap_drm.h

  Exceptions:
  - i810_drm.h - was in original drm; spdx header is wrong

Revision 1.1.1.2.30.3 / (download) - annotate - [select for diffs], Mon Apr 13 08:04:57 2020 UTC (4 years ago) by martin
Branch: phil-wifi
Changes since 1.1.1.2.30.2: +66 -66 lines
Diff to previous 1.1.1.2.30.2 (colored) to branchpoint 1.1.1.2 (colored) next main 1.1.1.3 (colored)

Mostly merge changes from HEAD upto 20200411

Revision 1.1.1.2.30.2 / (download) - annotate - [select for diffs], Wed Apr 8 14:08:23 2020 UTC (4 years ago) by martin
Branch: phil-wifi
Changes since 1.1.1.2.30.1: +12 -1 lines
Diff to previous 1.1.1.2.30.1 (colored) to branchpoint 1.1.1.2 (colored)

Merge changes from current as of 20200406

Revision 1.7.2.3 / (download) - annotate - [select for diffs], Fri Jan 31 11:28:38 2020 UTC (4 years, 2 months ago) by martin
Branch: netbsd-9
CVS Tags: netbsd-9-3-RELEASE, netbsd-9-2-RELEASE, netbsd-9-1-RELEASE, netbsd-9-0-RELEASE, netbsd-9-0-RC2
Changes since 1.7.2.2: +3 -3 lines
Diff to previous 1.7.2.2 (colored) to branchpoint 1.7 (colored) next main 1.8 (colored)

Pull up following revision(s) (requested by msaitoh in ticket #678):

	sys/external/bsd/drm2/dist/drm/i915/i915_gem_stolen.c: revision 1.12
	sys/external/bsd/drm2/dist/drm/radeon/radeon_atombios_dp.c: revision 1.2
	sys/external/bsd/drm2/dist/drm/i915/i915_reg.h: revision 1.9
	sys/external/bsd/drm2/dist/drm/i915/i915_reg.h: revision 1.12

 Use unsigned to avoid undefined behavior in gen7_get_stolen_reserved().
Found by kUBSan.

 Use unsigned to avoid undefined behavior in g4x_update_wm().

 Avoid undefined behavior in g4x_get_stolen_reserved().

The change is the same as newer i915_gem_stolen.c.

 Don't call memcpy() when the length is 0 (and the source pointer is NULL)
in radeon_dp_aux_transfer_atom() to avoid undefined behavior. Found by kUBSan.

Revision 1.7.2.2 / (download) - annotate - [select for diffs], Fri Jan 31 11:25:09 2020 UTC (4 years, 2 months ago) by martin
Branch: netbsd-9
Changes since 1.7.2.1: +32 -32 lines
Diff to previous 1.7.2.1 (colored) to branchpoint 1.7 (colored)

Pull up following revision(s) (requested by msaitoh in ticket #677):

	sys/external/bsd/drm2/dist/drm/radeon/radeon_uvd_v2_2.c: revision 1.2
	sys/external/bsd/drm2/dist/drm/i915/intel_pm.c: revision 1.18
	sys/external/bsd/drm2/dist/drm/radeon/nid.h: revision 1.3
	sys/external/bsd/drm2/dist/drm/i915/intel_pm.c: revision 1.19
	sys/external/bsd/drm2/dist/drm/radeon/rv770d.h: revision 1.3
	sys/external/bsd/drm2/dist/drm/radeon/cikd.h: revision 1.3
	sys/external/bsd/drm2/dist/drm/radeon/radeon_uvd_v4_2.c: revision 1.2
	sys/external/bsd/drm2/dist/include/drm/drm_fixed.h: revision 1.3
	sys/external/bsd/drm2/dist/drm/radeon/sumod.h: revision 1.3
	sys/external/bsd/drm2/dist/drm/radeon/radeon_reg.h: revision 1.3
	sys/external/bsd/drm2/dist/drm/radeon/radeon_mode.h: revision 1.5
	sys/external/bsd/drm2/dist/drm/radeon/r600d.h: revision 1.3
	sys/external/bsd/drm2/dist/drm/radeon/r600d.h: revision 1.4
	sys/external/bsd/drm2/dist/drm/radeon/radeon_uvd_v1_0.c: revision 1.2
	sys/external/bsd/drm2/dist/drm/radeon/radeon_uvd_v1_0.c: revision 1.3
	sys/external/bsd/drm2/dist/drm/radeon/radeon_r600.c: revision 1.2
	sys/external/bsd/drm2/dist/drm/radeon/evergreend.h: revision 1.3
	sys/external/bsd/drm2/dist/drm/radeon/evergreend.h: revision 1.4
	sys/external/bsd/drm2/dist/drm/i915/i915_reg.h: revision 1.10
	sys/external/bsd/drm2/dist/drm/i915/i915_reg.h: revision 1.8
	sys/external/bsd/drm2/dist/drm/i915/i915_reg.h: revision 1.11
	sys/external/bsd/drm2/dist/drm/i915/i915_reg.h: revision 1.13
	sys/external/bsd/drm2/dist/drm/radeon/rv730d.h: revision 1.3
	sys/external/bsd/drm2/dist/drm/radeon/radeon_rv770_smc.c: revision 1.2
	sys/external/bsd/drm2/dist/drm/radeon/sid.h: revision 1.3
	sys/external/bsd/drm2/dist/drm/radeon/radeon_si_smc.c: revision 1.2
	sys/external/bsd/drm2/dist/drm/radeon/sid.h: revision 1.4

Use unsigned to avoid undefined behavior. Found by kUBSan.

Revision 1.7.2.1 / (download) - annotate - [select for diffs], Thu Dec 12 21:00:32 2019 UTC (4 years, 4 months ago) by martin
Branch: netbsd-9
Changes since 1.7: +12 -1 lines
Diff to previous 1.7 (colored)

Pull up following revision(s) (requested by maya in ticket #548):

	sys/external/bsd/drm2/dist/drm/i915/intel_display.c: revision 1.28
	sys/external/bsd/drm2/dist/drm/i915/i915_drv.h: revision 1.30
	sys/external/bsd/common/include/linux/bitops.h: revision 1.9
	sys/external/bsd/drm2/dist/drm/i915/intel_drv.h: revision 1.11
	sys/external/bsd/drm2/dist/drm/i915/i915_gem_gtt.h: revision 1.8
	sys/external/bsd/drm2/dist/drm/i915/i915_gem_gtt.c: revision 1.16
	sys/external/bsd/drm2/dist/drm/i915/i915_gem_execbuffer.c: revision 1.9
	sys/external/bsd/drm2/dist/drm/i915/i915_dma.c: revision 1.28
	sys/external/bsd/drm2/dist/drm/i915/i915_cmd_parser.c: revision 1.19
	sys/external/bsd/drm2/dist/drm/i915/intel_pm.c: revision 1.20
	sys/external/bsd/drm2/dist/drm/i915/intel_ringbuffer.c: revision 1.11
	sys/external/bsd/drm2/dist/drm/i915/intel_ringbuffer.h: revision 1.7
	sys/external/bsd/drm2/dist/drm/i915/i915_reg.h: revision 1.14
	sys/external/bsd/drm2/dist/drm/i915/i915_cmd_parser.c: revision 1.20
	sys/external/bsd/drm2/dist/drm/i915/i915_gem_context.c: revision 1.10
	sys/external/bsd/drm2/dist/drm/i915/i915_drv.c: revision 1.17

Add what appears to be the fixes to CVE-2019-0154, CVE-2019-0155.

This commit requires review, but I'd also like it to be tested by others
while it is being reviewed.
CVE-2019-0155:

It was discovered that the Intel i915 graphics chipsets allowed userspace
to modify page table entries via writes to MMIO from the Blitter Command
Streamer and expose kernel memory information. A local attacker could use
this to expose sensitive information or possibly elevate privileges.

CVE-2019-0154:
It was discovered that the Intel i915 graphics chipsets could cause
a system hang when userspace performed a read from GT memory mapped
input output (MMIO) when the product is in certain low power states.
A local attacker could use this to cause a denial of service.
From upstream commits to linux-4.4.y:
-------------------
From 6d0cfddc7afc715835f0e17827106f832b14dd2a Mon Sep 17 00:00:00 2001
From: Jon Bloomfield <jon.bloomfield%intel.com@localhost>
Date: Thu, 12 Jul 2018 19:53:10 +0100
Subject: [PATCH] drm/i915/gtt: Add read only pages to gen8_pte_encode
We can set a bit inside the ppGTT PTE to indicate a page is read-only;
writes from the GPU will be discarded. We can use this to protect pages
and in particular support read-only userptr mappings (necessary for
importing PROT_READ vma).
-------------------
From 774b68aa2105c70b40c3b1777feb7ab500d716dd Mon Sep 17 00:00:00 2001
From: Jon Bloomfield <jon.bloomfield%intel.com@localhost>
Date: Mon, 6 Aug 2018 14:10:48 -0700
Subject: [PATCH] drm/i915/gtt: Read-only pages for insert_entries on bdw+
Hook up the flags to allow read-only ppGTT mappings for gen8+
v2: Include a selftest to check that writes to a readonly PTE are
dropped
v3: Don't duplicate cpu_check() as we can just reuse it, and even worse
don't wholesale copy the theory-of-operation comment from igt_ctx_exec
without changing it to explain the intention behind the new test!
v4: Joonas really likes magic mystery values
-------------------
From 3fd1c2e65c60c1c513155e1d1d74138b141aa8a3 Mon Sep 17 00:00:00 2001
From: Chris Wilson <chris%chris-wilson.co.uk@localhost>
Date: Thu, 12 Jul 2018 19:53:12 +0100
Subject: [PATCH] drm/i915/gtt: Disable read-only support under GVT
GVT is not propagating the PTE bits, and is always setting the
read-write bit, thus breaking read-only support.
-------------------
From e5e3c0154c19f2d8213e0af88b7a10d9de7fbafd Mon Sep 17 00:00:00 2001
From: Jon Bloomfield <jon.bloomfield%intel.com@localhost>
Date: Fri, 20 Apr 2018 14:26:01 -0700
Subject: [PATCH] drm/i915: Rename gen7 cmdparser tables
We're about to introduce some new tables for later gens, and the
current naming for the gen7 tables will no longer make sense.
v2: rebase
-------------------
From 3122671a5df3ee13f5cf22b7bdacf422b7b4319a Mon Sep 17 00:00:00 2001
From: Jon Bloomfield <jon.bloomfield%intel.com@localhost>
Date: Fri, 8 Jun 2018 08:53:46 -0700
Subject: [PATCH] drm/i915: Disable Secure Batches for gen6+
Retroactively stop reporting support for secure batches
through the api for gen6+ so that older binaries trigger
the fallback path instead.
Older binaries use secure batches pre gen6 to access resources
that are not available to normal usermode processes. However,
all known userspace explicitly checks for HAS_SECURE_BATCHES
before relying on the secure batch feature.
Since there are no known binaries relying on this for newer gens
we can kill secure batches from gen6, via I915_PARAM_HAS_SECURE_BATCHES.
v2: rebase (Mika)
v3: rebase (Mika)
-------------------
From 544fd7d9d4cfe32357beab2f1dc543637d42e69f Mon Sep 17 00:00:00 2001
From: Jon Bloomfield <jon.bloomfield%intel.com@localhost>
Date: Fri, 8 Jun 2018 10:05:26 -0700
Subject: [PATCH] drm/i915: Remove Master tables from cmdparser
The previous patch has killed support for secure batches
on gen6+, and hence the cmdparsers master tables are
now dead code. Remove them.
-------------------
From 17e89f38212d8b3cba470efca91b997ac03c592c Mon Sep 17 00:00:00 2001
From: Jon Bloomfield <jon.bloomfield%intel.com@localhost>
Date: Wed, 1 Aug 2018 09:33:59 -0700
Subject: [PATCH] drm/i915: Add support for mandatory cmdparsing
The existing cmdparser for gen7 can be bypassed by specifying
batch_len=0 in the execbuf call. This is safe because bypassing
simply reduces the cmd-set available.
In a later patch we will introduce cmdparsing for gen9, as a
security measure, which must be strictly enforced since without
it we are vulnerable to DoS attacks.
Introduce the concept of 'required' cmd parsing that cannot be
bypassed by submitting zero-length bb's.
v2: rebase (Mika)
v2: rebase (Mika)
v3: fix conflict on engine flags (Mika)
-------------------
From 77524398bccea3592a25cbe92a9a54fa555013af Mon Sep 17 00:00:00 2001
From: Jon Bloomfield <jon.bloomfield%intel.com@localhost>
Date: Tue, 22 May 2018 13:59:06 -0700
Subject: [PATCH] drm/i915: Support ro ppgtt mapped cmdparser shadow buffers
For Gen7, the original cmdparser motive was to permit limited
use of register read/write instructions in unprivileged BB's.
This worked by copying the user supplied bb to a kmd owned
bb, and running it in secure mode, from the ggtt, only if
the scanner finds no unsafe commands or registers.
For Gen8+ we can't use this same technique because running bb's
from the ggtt also disables access to ppgtt space. But we also
do not actually require 'secure' execution since we are only
trying to reduce the available command/register set. Instead we
will copy the user buffer to a kmd owned read-only bb in ppgtt,
and run in the usual non-secure mode.
Note that ro pages are only supported by ppgtt (not ggtt), but
luckily that's exactly what we need.
Add the required paths to map the shadow buffer to ppgtt ro for Gen8+
v2: IS_GEN7/IS_GEN (Mika)
v3: rebase
v4: rebase
v5: rebase
-------------------
From 2ac501479a1325d00aca5012887ebfece8358032 Mon Sep 17 00:00:00 2001
From: Jon Bloomfield <jon.bloomfield%intel.com@localhost>
Date: Wed, 1 Aug 2018 09:45:50 -0700
Subject: [PATCH] drm/i915: Allow parsing of unsized batches
In "drm/i915: Add support for mandatory cmdparsing" we introduced the
concept of mandatory parsing. This allows the cmdparser to be invoked
even when user passes batch_len=0 to the execbuf ioctl's.
However, the cmdparser needs to know the extents of the buffer being
scanned. Refactor the code to ensure the cmdparser uses the actual
object size, instead of the incoming length, if user passes 0.
-------------------
From 57c2c8f58ca07e8045f020e4e2548ac3bc3a5aab Mon Sep 17 00:00:00 2001
From: Jon Bloomfield <jon.bloomfield%intel.com@localhost>
Date: Mon, 23 Apr 2018 11:12:15 -0700
Subject: [PATCH] drm/i915: Add gen9 BCS cmdparsing
For gen9 we enable cmdparsing on the BCS ring, specifically
to catch inadvertent accesses to sensitive registers
Unlike gen7/hsw, we use the parser only to block certain
registers. We can rely on h/w to block restricted commands,
so the command tables only provide enough info to allow the
parser to delineate each command, and identify commands that
access registers.
Note: This patch deliberately ignores checkpatch issues in
favour of matching the style of the surrounding code. We'll
correct the entire file in one go in a later patch.
v3: rebase (Mika)
v4: Add RING_TIMESTAMP registers to whitelist (Jon)
-------------------
From d88d2d3fc6076760e903e78135f5bef028e6e813 Mon Sep 17 00:00:00 2001
From: Jon Bloomfield <jon.bloomfield%intel.com@localhost>
Date: Fri, 21 Sep 2018 13:18:09 -0700
Subject: [PATCH] drm/i915/cmdparser: Add support for backward jumps
To keep things manageable, the pre-gen9 cmdparser does not
attempt to track any form of nested BB_START's. This did not
prevent usermode from using nested starts, or even chained
batches because the cmdparser is not strictly enforced pre gen9.
Instead, the existence of a nested BB_START would cause the batch
to be emitted in insecure mode, and any privileged capabilities
would not be available.
For Gen9, the cmdparser becomes mandatory (for BCS at least), and
so not providing any form of nested BB_START support becomes
overly restrictive. Any such batch will simply not run.
We make heavy use of backward jumps in igt, and it is much easier
to add support for this restricted subset of nested jumps, than to
rewrite the whole of our test suite to avoid them.
Add the required logic to support limited backward jumps, to
instructions that have already been validated by the parser.
Note that it's not sufficient to simply approve any BB_START
that jumps backwards in the buffer because this would allow an
attacker to embed a rogue instruction sequence within the
operand words of a harmless instruction (say LRI) and jump to
that.
We introduce a bit array to track every instr offset successfully
validated, and test the target of BB_START against this. If the
target offset hits, it is re-written to the same offset in the
shadow buffer and the BB_START cmd is allowed.
Note: This patch deliberately ignores checkpatch issues in the
cmdtables, in order to match the style of the surrounding code.
We'll correct the entire file in one go in a later patch.
v2: set dispatch secure late (Mika)
v3: rebase (Mika)
v4: Clear whitelist on each parse
Minor review updates (Chris)
v5: Correct backward jump batching
v6: fix compilation error due to struct eb shuffle (Mika)
-------------------
From 362917ebcfacbd9c2b5172d5a5fe8cbef3ab838f Mon Sep 17 00:00:00 2001
From: Jon Bloomfield <jon.bloomfield%intel.com@localhost>
Date: Thu, 20 Sep 2018 09:45:10 -0700
Subject: [PATCH] drm/i915/cmdparser: Ignore Length operands during command
 matching
Some of the gen instruction macros (e.g. MI_DISPLAY_FLIP) have the
length directly encoded in them. Since these are used directly in
the tables, the Length becomes part of the comparison used for
matching during parsing. Thus, if the cmd being parsed has a
different length to that in the table, it is not matched and the
cmd is accepted via the default variable length path.
Fix by masking out everything except the Opcode in the cmd tables
-------------------
From 1433b8d41b1aa346e100b839c19fc033871ac5a6 Mon Sep 17 00:00:00 2001
From: Uma Shankar <uma.shankar%intel.com@localhost>
Date: Tue, 7 Aug 2018 21:15:35 +0530
Subject: [PATCH] drm/i915: Lower RM timeout to avoid DSI hard hangs
In BXT/APL, device 2 MMIO reads from MIPI controller requires its PLL
to be turned ON. When MIPI PLL is turned off (MIPI Display is not
active or connected), and someone (host or GT engine) tries to read
MIPI registers, it causes hard hang. This is a hardware restriction
or limitation.
Driver by itself doesn't read MIPI registers when MIPI display is off.
But any userspace application can submit unprivileged batch buffer for
execution. In that batch buffer there can be mmio reads. And these
reads are allowed even for unprivileged applications. If these
register reads are for MIPI DSI controller and MIPI display is not
active during that time, then the MMIO read operation causes system
hard hang and only way to recover is hard reboot. A genuine
process/application won't submit batch buffer like this and doesn't
cause any issue. But on a compromised system, a malign userspace
process/app can generate such batch buffer and can trigger system
hard hang (denial of service attack).
The fix is to lower the internal MMIO timeout value to an optimum
value of 950us as recommended by hardware team. If the timeout is
beyond 1ms (which will hit for any value we choose if MMIO READ on a
DSI specific register is performed without PLL ON), it causes the
system hang. But if the timeout value is lower than it will be below
the threshold (even if timeout happens) and system will not get into
a hung state. This will avoid a system hang without losing any
programming or GT interrupts, taking the worst case of lowest CDCLK
frequency and early DC5 abort into account.
-------------------
From 284d38667f7ed7171fd8f168c42490f9087c824c Mon Sep 17 00:00:00 2001
From: Imre Deak <imre.deak%intel.com@localhost>
Date: Mon, 9 Jul 2018 18:24:27 +0300
Subject: [PATCH] drm/i915/gen8+: Add RC6 CTX corruption WA
In some circumstances the RC6 context can get corrupted. We can detect
this and take the required action, that is disable RC6 and runtime PM.
The HW recovers from the corrupted state after a system suspend/resume
cycle, so detect the recovery and re-enable RC6 and runtime PM.
v2: rebase (Mika)
v3:
- Move intel_suspend_gt_powersave() to the end of the GEM suspend
  sequence.
- Add commit message.
v4:
- Rebased on intel_uncore_forcewake_put(i915->uncore, ...) API
  change.
v5: rebased on gem/gt split (Mika)
-------------------
From 6dd52bae8a01af77236b88917e84e84dbcfe06db Mon Sep 17 00:00:00 2001
From: Ben Hutchings <ben%decadent.org.uk@localhost>
Date: Mon, 11 Nov 2019 08:13:24 -0800
Subject: [PATCH] drm/i915/cmdparser: Fix jump whitelist clearing
When a jump_whitelist bitmap is reused, it needs to be cleared.
Currently this is done with memset() and the size calculation assumes
bitmaps are made of 32-bit words, not longs.  So on 64-bit
architectures, only the first half of the bitmap is cleared.
If some whitelist bits are carried over between successive batches
submitted on the same context, this will presumably allow embedding
the rogue instructions that we're trying to reject.
Use bitmap_zero() instead, which gets the calculation right.
Use the original linux function rather than my wrong translation.

 -

...Include the header to have it.
Thanks Riastradh!

Revision 1.14 / (download) - annotate - [select for diffs], Thu Dec 5 20:03:09 2019 UTC (4 years, 4 months ago) by maya
Branch: MAIN
CVS Tags: thorpej-i2c-spi-conf2-base, thorpej-i2c-spi-conf2, thorpej-i2c-spi-conf-base, thorpej-i2c-spi-conf, thorpej-futex2-base, thorpej-futex2, thorpej-futex-base, thorpej-futex, thorpej-cfargs2-base, thorpej-cfargs2, thorpej-cfargs-base, thorpej-cfargs, phil-wifi-20200421, phil-wifi-20200411, phil-wifi-20200406, is-mlppp-base, is-mlppp, cjep_sun2x-base1, cjep_sun2x-base, cjep_sun2x, cjep_staticlib_x-base1, cjep_staticlib_x-base, cjep_staticlib_x, bouyer-xenpvh-base2, bouyer-xenpvh-base1, bouyer-xenpvh-base, bouyer-xenpvh, ad-namecache-base3, ad-namecache-base2, ad-namecache-base1, ad-namecache-base, ad-namecache
Changes since 1.13: +12 -1 lines
Diff to previous 1.13 (colored)

Add what appears to be the fixes to CVE-2019-0154, CVE-2019-0155.
This commit requires review, but I'd also like it to be tested by others
while it is being reviewed.

CVE-2019-0155:
It was discovered that the Intel i915 graphics chipsets allowed userspace
to modify page table entries via writes to MMIO from the Blitter Command
Streamer and expose kernel memory information. A local attacker could use
this to expose sensitive information or possibly elevate privileges.

CVE-2019-0154:
It was discovered that the Intel i915 graphics chipsets could cause
a system hang when userspace performed a read from GT memory mapped
input output (MMIO) when the product is in certain low power states.
A local attacker could use this to cause a denial of service.

From upstream commits to linux-4.4.y:

-------------------
From 6d0cfddc7afc715835f0e17827106f832b14dd2a Mon Sep 17 00:00:00 2001
From: Jon Bloomfield <jon.bloomfield@intel.com>
Date: Thu, 12 Jul 2018 19:53:10 +0100
Subject: [PATCH] drm/i915/gtt: Add read only pages to gen8_pte_encode

We can set a bit inside the ppGTT PTE to indicate a page is read-only;
writes from the GPU will be discarded. We can use this to protect pages
and in particular support read-only userptr mappings (necessary for
importing PROT_READ vma).
-------------------
From 774b68aa2105c70b40c3b1777feb7ab500d716dd Mon Sep 17 00:00:00 2001
From: Jon Bloomfield <jon.bloomfield@intel.com>
Date: Mon, 6 Aug 2018 14:10:48 -0700
Subject: [PATCH] drm/i915/gtt: Read-only pages for insert_entries on bdw+

Hook up the flags to allow read-only ppGTT mappings for gen8+

v2: Include a selftest to check that writes to a readonly PTE are
dropped
v3: Don't duplicate cpu_check() as we can just reuse it, and even worse
don't wholesale copy the theory-of-operation comment from igt_ctx_exec
without changing it to explain the intention behind the new test!
v4: Joonas really likes magic mystery values
-------------------
From 3fd1c2e65c60c1c513155e1d1d74138b141aa8a3 Mon Sep 17 00:00:00 2001
From: Chris Wilson <chris@chris-wilson.co.uk>
Date: Thu, 12 Jul 2018 19:53:12 +0100
Subject: [PATCH] drm/i915/gtt: Disable read-only support under GVT

GVT is not propagating the PTE bits, and is always setting the
read-write bit, thus breaking read-only support.
-------------------
From e5e3c0154c19f2d8213e0af88b7a10d9de7fbafd Mon Sep 17 00:00:00 2001
From: Jon Bloomfield <jon.bloomfield@intel.com>
Date: Fri, 20 Apr 2018 14:26:01 -0700
Subject: [PATCH] drm/i915: Rename gen7 cmdparser tables

We're about to introduce some new tables for later gens, and the
current naming for the gen7 tables will no longer make sense.

v2: rebase
-------------------
From 3122671a5df3ee13f5cf22b7bdacf422b7b4319a Mon Sep 17 00:00:00 2001
From: Jon Bloomfield <jon.bloomfield@intel.com>
Date: Fri, 8 Jun 2018 08:53:46 -0700
Subject: [PATCH] drm/i915: Disable Secure Batches for gen6+

Retroactively stop reporting support for secure batches
through the api for gen6+ so that older binaries trigger
the fallback path instead.

Older binaries use secure batches pre gen6 to access resources
that are not available to normal usermode processes. However,
all known userspace explicitly checks for HAS_SECURE_BATCHES
before relying on the secure batch feature.

Since there are no known binaries relying on this for newer gens
we can kill secure batches from gen6, via I915_PARAM_HAS_SECURE_BATCHES.

v2: rebase (Mika)
v3: rebase (Mika)
-------------------
From 544fd7d9d4cfe32357beab2f1dc543637d42e69f Mon Sep 17 00:00:00 2001
From: Jon Bloomfield <jon.bloomfield@intel.com>
Date: Fri, 8 Jun 2018 10:05:26 -0700
Subject: [PATCH] drm/i915: Remove Master tables from cmdparser

The previous patch has killed support for secure batches
on gen6+, and hence the cmdparsers master tables are
now dead code. Remove them.
-------------------
From 17e89f38212d8b3cba470efca91b997ac03c592c Mon Sep 17 00:00:00 2001
From: Jon Bloomfield <jon.bloomfield@intel.com>
Date: Wed, 1 Aug 2018 09:33:59 -0700
Subject: [PATCH] drm/i915: Add support for mandatory cmdparsing

The existing cmdparser for gen7 can be bypassed by specifying
batch_len=0 in the execbuf call. This is safe because bypassing
simply reduces the cmd-set available.

In a later patch we will introduce cmdparsing for gen9, as a
security measure, which must be strictly enforced since without
it we are vulnerable to DoS attacks.

Introduce the concept of 'required' cmd parsing that cannot be
bypassed by submitting zero-length bb's.

v2: rebase (Mika)
v2: rebase (Mika)
v3: fix conflict on engine flags (Mika)
-------------------
From 77524398bccea3592a25cbe92a9a54fa555013af Mon Sep 17 00:00:00 2001
From: Jon Bloomfield <jon.bloomfield@intel.com>
Date: Tue, 22 May 2018 13:59:06 -0700
Subject: [PATCH] drm/i915: Support ro ppgtt mapped cmdparser shadow buffers

For Gen7, the original cmdparser motive was to permit limited
use of register read/write instructions in unprivileged BB's.
This worked by copying the user supplied bb to a kmd owned
bb, and running it in secure mode, from the ggtt, only if
the scanner finds no unsafe commands or registers.

For Gen8+ we can't use this same technique because running bb's
from the ggtt also disables access to ppgtt space. But we also
do not actually require 'secure' execution since we are only
trying to reduce the available command/register set. Instead we
will copy the user buffer to a kmd owned read-only bb in ppgtt,
and run in the usual non-secure mode.

Note that ro pages are only supported by ppgtt (not ggtt), but
luckily that's exactly what we need.

Add the required paths to map the shadow buffer to ppgtt ro for Gen8+

v2: IS_GEN7/IS_GEN (Mika)
v3: rebase
v4: rebase
v5: rebase
-------------------
From 2ac501479a1325d00aca5012887ebfece8358032 Mon Sep 17 00:00:00 2001
From: Jon Bloomfield <jon.bloomfield@intel.com>
Date: Wed, 1 Aug 2018 09:45:50 -0700
Subject: [PATCH] drm/i915: Allow parsing of unsized batches

In "drm/i915: Add support for mandatory cmdparsing" we introduced the
concept of mandatory parsing. This allows the cmdparser to be invoked
even when user passes batch_len=0 to the execbuf ioctl's.

However, the cmdparser needs to know the extents of the buffer being
scanned. Refactor the code to ensure the cmdparser uses the actual
object size, instead of the incoming length, if user passes 0.
-------------------
From 57c2c8f58ca07e8045f020e4e2548ac3bc3a5aab Mon Sep 17 00:00:00 2001
From: Jon Bloomfield <jon.bloomfield@intel.com>
Date: Mon, 23 Apr 2018 11:12:15 -0700
Subject: [PATCH] drm/i915: Add gen9 BCS cmdparsing

For gen9 we enable cmdparsing on the BCS ring, specifically
to catch inadvertent accesses to sensitive registers

Unlike gen7/hsw, we use the parser only to block certain
registers. We can rely on h/w to block restricted commands,
so the command tables only provide enough info to allow the
parser to delineate each command, and identify commands that
access registers.

Note: This patch deliberately ignores checkpatch issues in
favour of matching the style of the surrounding code. We'll
correct the entire file in one go in a later patch.

v3: rebase (Mika)
v4: Add RING_TIMESTAMP registers to whitelist (Jon)
-------------------
From d88d2d3fc6076760e903e78135f5bef028e6e813 Mon Sep 17 00:00:00 2001
From: Jon Bloomfield <jon.bloomfield@intel.com>
Date: Fri, 21 Sep 2018 13:18:09 -0700
Subject: [PATCH] drm/i915/cmdparser: Add support for backward jumps

To keep things manageable, the pre-gen9 cmdparser does not
attempt to track any form of nested BB_START's. This did not
prevent usermode from using nested starts, or even chained
batches because the cmdparser is not strictly enforced pre gen9.

Instead, the existence of a nested BB_START would cause the batch
to be emitted in insecure mode, and any privileged capabilities
would not be available.

For Gen9, the cmdparser becomes mandatory (for BCS at least), and
so not providing any form of nested BB_START support becomes
overly restrictive. Any such batch will simply not run.

We make heavy use of backward jumps in igt, and it is much easier
to add support for this restricted subset of nested jumps, than to
rewrite the whole of our test suite to avoid them.

Add the required logic to support limited backward jumps, to
instructions that have already been validated by the parser.

Note that it's not sufficient to simply approve any BB_START
that jumps backwards in the buffer because this would allow an
attacker to embed a rogue instruction sequence within the
operand words of a harmless instruction (say LRI) and jump to
that.

We introduce a bit array to track every instr offset successfully
validated, and test the target of BB_START against this. If the
target offset hits, it is re-written to the same offset in the
shadow buffer and the BB_START cmd is allowed.

Note: This patch deliberately ignores checkpatch issues in the
cmdtables, in order to match the style of the surrounding code.
We'll correct the entire file in one go in a later patch.

v2: set dispatch secure late (Mika)
v3: rebase (Mika)
v4: Clear whitelist on each parse
Minor review updates (Chris)
v5: Correct backward jump batching
v6: fix compilation error due to struct eb shuffle (Mika)
-------------------
From 362917ebcfacbd9c2b5172d5a5fe8cbef3ab838f Mon Sep 17 00:00:00 2001
From: Jon Bloomfield <jon.bloomfield@intel.com>
Date: Thu, 20 Sep 2018 09:45:10 -0700
Subject: [PATCH] drm/i915/cmdparser: Ignore Length operands during command
 matching

Some of the gen instruction macros (e.g. MI_DISPLAY_FLIP) have the
length directly encoded in them. Since these are used directly in
the tables, the Length becomes part of the comparison used for
matching during parsing. Thus, if the cmd being parsed has a
different length to that in the table, it is not matched and the
cmd is accepted via the default variable length path.

Fix by masking out everything except the Opcode in the cmd tables
-------------------
From 1433b8d41b1aa346e100b839c19fc033871ac5a6 Mon Sep 17 00:00:00 2001
From: Uma Shankar <uma.shankar@intel.com>
Date: Tue, 7 Aug 2018 21:15:35 +0530
Subject: [PATCH] drm/i915: Lower RM timeout to avoid DSI hard hangs

In BXT/APL, device 2 MMIO reads from MIPI controller requires its PLL
to be turned ON. When MIPI PLL is turned off (MIPI Display is not
active or connected), and someone (host or GT engine) tries to read
MIPI registers, it causes hard hang. This is a hardware restriction
or limitation.

Driver by itself doesn't read MIPI registers when MIPI display is off.
But any userspace application can submit unprivileged batch buffer for
execution. In that batch buffer there can be mmio reads. And these
reads are allowed even for unprivileged applications. If these
register reads are for MIPI DSI controller and MIPI display is not
active during that time, then the MMIO read operation causes system
hard hang and only way to recover is hard reboot. A genuine
process/application won't submit batch buffer like this and doesn't
cause any issue. But on a compromised system, a malign userspace
process/app can generate such batch buffer and can trigger system
hard hang (denial of service attack).

The fix is to lower the internal MMIO timeout value to an optimum
value of 950us as recommended by hardware team. If the timeout is
beyond 1ms (which will hit for any value we choose if MMIO READ on a
DSI specific register is performed without PLL ON), it causes the
system hang. But if the timeout value is lower than it will be below
the threshold (even if timeout happens) and system will not get into
a hung state. This will avoid a system hang without losing any
programming or GT interrupts, taking the worst case of lowest CDCLK
frequency and early DC5 abort into account.
-------------------
From 284d38667f7ed7171fd8f168c42490f9087c824c Mon Sep 17 00:00:00 2001
From: Imre Deak <imre.deak@intel.com>
Date: Mon, 9 Jul 2018 18:24:27 +0300
Subject: [PATCH] drm/i915/gen8+: Add RC6 CTX corruption WA

In some circumstances the RC6 context can get corrupted. We can detect
this and take the required action, that is disable RC6 and runtime PM.
The HW recovers from the corrupted state after a system suspend/resume
cycle, so detect the recovery and re-enable RC6 and runtime PM.

v2: rebase (Mika)
v3:
- Move intel_suspend_gt_powersave() to the end of the GEM suspend
  sequence.
- Add commit message.
v4:
- Rebased on intel_uncore_forcewake_put(i915->uncore, ...) API
  change.
v5: rebased on gem/gt split (Mika)
-------------------
From 6dd52bae8a01af77236b88917e84e84dbcfe06db Mon Sep 17 00:00:00 2001
From: Ben Hutchings <ben@decadent.org.uk>
Date: Mon, 11 Nov 2019 08:13:24 -0800
Subject: [PATCH] drm/i915/cmdparser: Fix jump whitelist clearing

When a jump_whitelist bitmap is reused, it needs to be cleared.
Currently this is done with memset() and the size calculation assumes
bitmaps are made of 32-bit words, not longs.  So on 64-bit
architectures, only the first half of the bitmap is cleared.

If some whitelist bits are carried over between successive batches
submitted on the same context, this will presumably allow embedding
the rogue instructions that we're trying to reject.

Use bitmap_zero() instead, which gets the calculation right.

Revision 1.13 / (download) - annotate - [select for diffs], Tue Oct 8 17:41:04 2019 UTC (4 years, 6 months ago) by msaitoh
Branch: MAIN
CVS Tags: phil-wifi-20191119
Changes since 1.12: +4 -4 lines
Diff to previous 1.12 (colored)

 Use unsigned to avoid undefined behavior. Found by kUBSan.

Revision 1.12 / (download) - annotate - [select for diffs], Tue Oct 1 18:41:58 2019 UTC (4 years, 6 months ago) by msaitoh
Branch: MAIN
Changes since 1.11: +2 -2 lines
Diff to previous 1.11 (colored)

 Use unsigned to avoid undefined behavior in g4x_update_wm().

Revision 1.11 / (download) - annotate - [select for diffs], Tue Sep 3 15:05:40 2019 UTC (4 years, 7 months ago) by msaitoh
Branch: MAIN
Changes since 1.10: +7 -7 lines
Diff to previous 1.10 (colored)

 Use unsigned to avoid undefined behavior. Found by kUBSan.

Revision 1.10 / (download) - annotate - [select for diffs], Wed Aug 7 14:58:04 2019 UTC (4 years, 8 months ago) by msaitoh
Branch: MAIN
Changes since 1.9: +4 -4 lines
Diff to previous 1.9 (colored)

Use unsigned to avoid undefined behavior. Found by kUBSan.

Revision 1.9 / (download) - annotate - [select for diffs], Mon Aug 5 13:28:31 2019 UTC (4 years, 8 months ago) by msaitoh
Branch: MAIN
Changes since 1.8: +2 -2 lines
Diff to previous 1.8 (colored)

 Use unsigned to avoid undefined behavior in gen7_get_stolen_reserved().
Found by kUBSan.

Revision 1.8 / (download) - annotate - [select for diffs], Mon Aug 5 10:14:19 2019 UTC (4 years, 8 months ago) by msaitoh
Branch: MAIN
Changes since 1.7: +20 -20 lines
Diff to previous 1.7 (colored)

 Avoid undefined behavior. Found by kUBSan.

Revision 1.7 / (download) - annotate - [select for diffs], Wed Jul 24 15:55:07 2019 UTC (4 years, 8 months ago) by msaitoh
Branch: MAIN
CVS Tags: netbsd-9-base, netbsd-9-0-RC1
Branch point for: netbsd-9
Changes since 1.6: +4 -4 lines
Diff to previous 1.6 (colored)

Use unsigned. Found by KUBSan.

Revision 1.6 / (download) - annotate - [select for diffs], Wed Jul 24 14:57:09 2019 UTC (4 years, 8 months ago) by msaitoh
Branch: MAIN
Changes since 1.5: +31 -31 lines
Diff to previous 1.5 (colored)

Use unsigned. Found by KUBSan.

Revision 1.1.1.2.30.1 / (download) - annotate - [select for diffs], Mon Jun 10 22:08:05 2019 UTC (4 years, 10 months ago) by christos
Branch: phil-wifi
Changes since 1.1.1.2: +2884 -672 lines
Diff to previous 1.1.1.2 (colored)

Sync with HEAD

Revision 1.1.1.2.28.3 / (download) - annotate - [select for diffs], Sun Sep 30 01:45:53 2018 UTC (5 years, 6 months ago) by pgoyette
Branch: pgoyette-compat
CVS Tags: pgoyette-compat-merge-20190127
Changes since 1.1.1.2.28.2: +12 -1 lines
Diff to previous 1.1.1.2.28.2 (colored) to branchpoint 1.1.1.2 (colored) next main 1.1.1.3 (colored)

Ssync with HEAD

Revision 1.5 / (download) - annotate - [select for diffs], Thu Sep 13 08:25:55 2018 UTC (5 years, 7 months ago) by mrg
Branch: MAIN
CVS Tags: phil-wifi-20190609, pgoyette-compat-20190127, pgoyette-compat-20190118, pgoyette-compat-1226, pgoyette-compat-1126, pgoyette-compat-1020, pgoyette-compat-0930, isaki-audio2-base, isaki-audio2
Changes since 1.4: +12 -1 lines
Diff to previous 1.4 (colored)

add support for kabylake and skylake GT4 (untested) GPUs.
largely taken from openbsd and linux 4.13 trees (which
have this code identical), with mimimal porting to netbsd.

i have not installed (and thus tested) the newer referenced
firmware files.

only real local change is to fix IS_BROXTON() macro to check
the things valid in this era of drm.  previous match would
attach on KBL, and then a loop would never exit.

tested on kabylake P630.  needs mesa 11.x or newer for GL
to work.

ok @riastradh.

Revision 1.1.1.2.28.2 / (download) - annotate - [select for diffs], Thu Sep 6 06:56:17 2018 UTC (5 years, 7 months ago) by pgoyette
Branch: pgoyette-compat
Changes since 1.1.1.2.28.1: +2869 -668 lines
Diff to previous 1.1.1.2.28.1 (colored) to branchpoint 1.1.1.2 (colored)

Sync with HEAD

Resolve a couple of conflicts (result of the uimin/uimax changes)

Revision 1.1.1.2.22.1 / (download) - annotate - [select for diffs], Sat Sep 1 06:34:00 2018 UTC (5 years, 7 months ago) by martin
Branch: netbsd-8
CVS Tags: netbsd-8-2-RELEASE, netbsd-8-1-RELEASE, netbsd-8-1-RC1
Changes since 1.1.1.2: +4 -4 lines
Diff to previous 1.1.1.2 (colored) next main 1.1.1.3 (colored)

Pull up following revision(s) (requested by riastradh in ticket #1003):

	sys/external/bsd/drm2/dist/drm/i915/intel_sdvo.c: revision 1.8
	sys/external/bsd/drm2/dist/drm/ttm/ttm_tt.c: revision 1.10
	sys/external/bsd/drm2/drm/drm_scatter.c: revision 1.4
	sys/external/bsd/drm2/dist/drm/i915/i915_reg.h: revision 1.2
	sys/external/bsd/drm2/linux/linux_ww_mutex.c: revision 1.3
	sys/external/bsd/drm2/linux/linux_ww_mutex.c: revision 1.4
	sys/external/bsd/drm2/linux/linux_idr.c: revision 1.6

Pull in upstream commit:
Author: Ville Syrj=E4l=E4 <ville.syrjala%linux.intel.com@localhost>
Date:   Mon Jun 9 16:20:46 2014 +0300
    drm/i915: Avoid div-by-zero when pixel_multiplier is zero
On certain platforms pixel_multiplier is read out in
.get_pipe_config(), but it also gets used to calculate the
pixel clock in intel_sdvo_get_config(). If the pipe is disabled
but some SDVO outputs are active, we may end up dividing by zero
in intel_sdvo_get_config().
Fixes https://bugs.freedesktop.org/show_bug.cgi?id=3D76520
Tweak slightly sketchy logic in linux_idr.
1. idr_preload can fail if you don't set __GFP_WAIT.
2. If idr_preload fails, it is wrong for idr_alloc to assert.
3. There is no way for idr_alloc to know what flags idr_preload got.
Probably won't *fix* any bugs, but if there is a bug with a missing
__GFP_WAIT, then we will learn about a trifle sooner.
Fix error branch in ttm_dma_tt_init to avoid double-free.
Should fix symptom of PR kern/52438, but who knows what underlying
problem causes us to reach the error branch in the first place.
Fix lockdebug_locked annotations.
When thread A grants ownership to thread B waiting with a context,
thread B needs to assert lockdebug_locked; otherwise, when it
releases, lockdebug_unlocked thinks it's releasing an unlocked
ww_mutex.

Fixes LOCKDEBUG failure with radeon noticed by martin@.

more const

XXX: add a NULL init to avoid a GCC 6 maybe uninit warning.

Remove UB from definition of symbols in i915_reg.h
Kernel Undefined Behavior Sanitizer enforces more warnings in build time.
This makes the build fatal in the drm/i915 code in:
 - intel_ddi_put_crtc_pll(),
 - intel_ddi_clock_get(),
 - intel_ddi_pll_enable(),
 - intel_ddi_setup_hw_pll_state().
The error message in all the cases says:
  error: case label does not reduce to an integer constant
Set the type of the value left shifted to unsigned.
This change is required to build NetBSD/amd64 with KUBSan.

Revision 1.4 / (download) - annotate - [select for diffs], Mon Aug 27 07:06:25 2018 UTC (5 years, 7 months ago) by riastradh
Branch: MAIN
CVS Tags: pgoyette-compat-0906
Changes since 1.3: +6 -3 lines
Diff to previous 1.3 (colored)

Need braces around BUILD_BUG_ON_MSG.

Revision 1.3 / (download) - annotate - [select for diffs], Mon Aug 27 04:58:23 2018 UTC (5 years, 7 months ago) by riastradh
Branch: MAIN
Changes since 1.2: +2866 -668 lines
Diff to previous 1.2 (colored)

merge linux-drm-v4-4-143

Revision 1.1.1.3 / (download) - annotate - [select for diffs] (vendor branch), Mon Aug 27 01:34:54 2018 UTC (5 years, 7 months ago) by riastradh
Branch: LINUX
CVS Tags: linux-drm-v4-4-143
Changes since 1.1.1.2: +2866 -668 lines
Diff to previous 1.1.1.2 (colored)

Import drm from Linux v4.4.143 (commit a8ea6276d00555387deaaa5eaeb380cd5c17bdc9).

   drivers/gpu/drm      -> sys/external/bsd/drm2/dist/drm
   include/drm          -> sys/external/bsd/drm2/dist/include/drm
   include/uapi/drm     -> sys/external/bsd/drm2/dist/uapi/drm

GPL sources excluded.

Revision 1.1.1.2.28.1 / (download) - annotate - [select for diffs], Sat Jul 28 04:38:00 2018 UTC (5 years, 8 months ago) by pgoyette
Branch: pgoyette-compat
Changes since 1.1.1.2: +4 -4 lines
Diff to previous 1.1.1.2 (colored)

Sync with HEAD

Revision 1.2 / (download) - annotate - [select for diffs], Fri Jul 6 12:19:56 2018 UTC (5 years, 9 months ago) by kamil
Branch: MAIN
CVS Tags: pgoyette-compat-0728
Changes since 1.1: +1977 -672 lines
Diff to previous 1.1 (colored)

Remove UB from definition of symbols in i915_reg.h

Kernel Undefined Behavior Sanitizer enforces more warnings in build time.
This makes the build fatal in the drm/i915 code in:
 - intel_ddi_put_crtc_pll(),
 - intel_ddi_clock_get(),
 - intel_ddi_pll_enable(),
 - intel_ddi_setup_hw_pll_state().

The error message in all the cases says:

  error: case label does not reduce to an integer constant

Set the type of the value left shifted to unsigned.

This change is required to build NetBSD/amd64 with KUBSan.

Revision 1.1.1.2.4.2 / (download) - annotate - [select for diffs], Wed Aug 20 00:04:09 2014 UTC (9 years, 7 months ago) by tls
Branch: tls-maxphys
Changes since 1.1.1.2.4.1: +5965 -0 lines
Diff to previous 1.1.1.2.4.1 (colored) to branchpoint 1.1.1.2 (colored) next main 1.1.1.3 (colored)

Rebase to HEAD as of a few days ago.

Revision 1.1.1.1.6.1 / (download) - annotate - [select for diffs], Sun Aug 10 06:55:29 2014 UTC (9 years, 8 months ago) by tls
Branch: tls-earlyentropy
Changes since 1.1.1.1: +1974 -669 lines
Diff to previous 1.1.1.1 (colored) next main 1.1.1.2 (colored)

Rebase.

Revision 1.1.1.2.4.1, Wed Jul 16 19:35:25 2014 UTC (9 years, 9 months ago) by tls
Branch: tls-maxphys
Changes since 1.1.1.2: +0 -5965 lines
FILE REMOVED

file i915_reg.h was added on branch tls-maxphys on 2014-08-20 00:04:09 +0000

Revision 1.1.1.2 / (download) - annotate - [select for diffs] (vendor branch), Wed Jul 16 19:35:25 2014 UTC (9 years, 9 months ago) by riastradh
Branch: LINUX
CVS Tags: tls-maxphys-base-20171202, tls-maxphys-base, tls-earlyentropy-base, prg-localcount2-base3, prg-localcount2-base2, prg-localcount2-base1, prg-localcount2-base, prg-localcount2, phil-wifi-base, pgoyette-localcount-base, pgoyette-localcount-20170426, pgoyette-localcount-20170320, pgoyette-localcount-20170107, pgoyette-localcount-20161104, pgoyette-localcount-20160806, pgoyette-localcount-20160726, pgoyette-localcount, pgoyette-compat-base, pgoyette-compat-0625, pgoyette-compat-0521, pgoyette-compat-0502, pgoyette-compat-0422, pgoyette-compat-0415, pgoyette-compat-0407, pgoyette-compat-0330, pgoyette-compat-0322, pgoyette-compat-0315, perseant-stdc-iso10646-base, perseant-stdc-iso10646, nick-nhusb-base-20170825, nick-nhusb-base-20170204, nick-nhusb-base-20161204, nick-nhusb-base-20161004, nick-nhusb-base-20160907, nick-nhusb-base-20160529, nick-nhusb-base-20160422, nick-nhusb-base-20160319, nick-nhusb-base-20151226, nick-nhusb-base-20150921, nick-nhusb-base-20150606, nick-nhusb-base-20150406, nick-nhusb-base, nick-nhusb, netbsd-8-base, netbsd-8-0-RELEASE, netbsd-8-0-RC2, netbsd-8-0-RC1, netbsd-7-nhusb-base-20170116, netbsd-7-nhusb-base, netbsd-7-nhusb, netbsd-7-base, netbsd-7-2-RELEASE, netbsd-7-1-RELEASE, netbsd-7-1-RC2, netbsd-7-1-RC1, netbsd-7-1-2-RELEASE, netbsd-7-1-1-RELEASE, netbsd-7-1, netbsd-7-0-RELEASE, netbsd-7-0-RC3, netbsd-7-0-RC2, netbsd-7-0-RC1, netbsd-7-0-2-RELEASE, netbsd-7-0-1-RELEASE, netbsd-7-0, netbsd-7, matt-nb8-mediatek-base, matt-nb8-mediatek, localcount-20160914, linux-3-15-drm-bsd, jdolecek-ncq-base, jdolecek-ncq, bouyer-socketcan-base1, bouyer-socketcan-base, bouyer-socketcan
Branch point for: tls-maxphys, phil-wifi, pgoyette-compat, netbsd-8
Changes since 1.1.1.1: +1974 -669 lines
Diff to previous 1.1.1.1 (colored)

Import drm from Linux 3.15 (commitid 1860e379875dfe7271c649058aeddffe5afd9d0d).

   drivers/gpu/drm      -> sys/external/bsd/drm2/dist/drm
   include/drm          -> sys/external/bsd/drm2/dist/include/drm
   include/uapi/drm     -> sys/external/bsd/drm2/dist/uapi/drm

GPL sources excluded.

Revision 1.1.1.1.8.2 / (download) - annotate - [select for diffs], Thu May 22 11:40:53 2014 UTC (9 years, 10 months ago) by yamt
Branch: yamt-pagecache
Changes since 1.1.1.1.8.1: +4660 -0 lines
Diff to previous 1.1.1.1.8.1 (colored) to branchpoint 1.1.1.1 (colored) next main 1.1.1.2 (colored)

sync with head.

for a reference, the tree before this commit was tagged
as yamt-pagecache-tag8.

this commit was splitted into small chunks to avoid
a limitation of cvs.  ("Protocol error: too many arguments")

Revision 1.1.1.1.4.2 / (download) - annotate - [select for diffs], Wed Aug 28 23:59:33 2013 UTC (10 years, 7 months ago) by rmind
Branch: rmind-smpnet
Changes since 1.1.1.1.4.1: +4660 -0 lines
Diff to previous 1.1.1.1.4.1 (colored) to branchpoint 1.1.1.1 (colored) next main 1.1.1.2 (colored)

sync with head

Revision 1.1.1.1.2.2 / (download) - annotate - [select for diffs], Tue Jul 23 21:28:22 2013 UTC (10 years, 8 months ago) by riastradh
Branch: riastradh-drm2
Changes since 1.1.1.1.2.1: +4660 -0 lines
Diff to previous 1.1.1.1.2.1 (colored) to branchpoint 1.1.1.1 (colored) next main 1.1.1.2 (colored)

sync with HEAD and actually get the drm2 import

Revision 1.1.1.1.8.1, Tue Jul 23 02:13:14 2013 UTC (10 years, 8 months ago) by yamt
Branch: yamt-pagecache
Changes since 1.1.1.1: +0 -4660 lines
FILE REMOVED

file i915_reg.h was added on branch yamt-pagecache on 2014-05-22 11:40:53 +0000

Revision 1.1.1.1.4.1, Tue Jul 23 02:13:14 2013 UTC (10 years, 8 months ago) by rmind
Branch: rmind-smpnet
Changes since 1.1.1.1: +0 -4660 lines
FILE REMOVED

file i915_reg.h was added on branch rmind-smpnet on 2013-08-28 23:59:33 +0000

Revision 1.1.1.1.2.1, Tue Jul 23 02:13:14 2013 UTC (10 years, 8 months ago) by riastradh
Branch: riastradh-drm2
Changes since 1.1.1.1: +0 -4660 lines
FILE REMOVED

file i915_reg.h was added on branch riastradh-drm2 on 2013-07-23 21:28:22 +0000

Revision 1.1.1.1 / (download) - annotate - [select for diffs] (vendor branch), Tue Jul 23 02:13:14 2013 UTC (10 years, 8 months ago) by riastradh
Branch: LINUX
CVS Tags: yamt-pagecache-base9, rmind-smpnet-nbase, rmind-smpnet-base, riastradh-xf86-video-intel-2-7-1-pre-2-21-15, riastradh-drm2-base3, riastradh-drm2-base2, linux-3-6-rc8-drm2-bsd
Branch point for: yamt-pagecache, tls-earlyentropy, rmind-smpnet, riastradh-drm2
Changes since 1.1: +0 -0 lines
Diff to previous 1.1 (colored)

Import drm sources from Linux v3.8-rc6.
(commit id 88b62b915b0b7e25870eb0604ed9a92ba4bfc9f7)

Linux                   NetBSD
drivers/gpu/drm         sys/external/bsd/drm2/dist/drm
include/drm             sys/external/bsd/drm2/dist/include/drm
include/uapi/drm        sys/external/bsd/drm2/dist/uapi/drm

Files/subtrees excluded because of licence issues, to be either
revisited later (particularly nouveau and radeon, which are mostly
permissively licensed but a number of whose files have no licence
statements), rewritten/ignored, or imported later as kernel modules
under external/gpl2 instead:

   include/drm/drm_fb_cma_helper.h
   include/drm/drm_gem_cma_helper.h
   include/drm/drm_os_linux.h
   include/drm/drm_pciids.h
   include/drm/drm_sysfs.h
   include/drm/drm_usb.h
   include/drm/exynos_drm.h
   include/drm/gma_drm.h
   include/drm/intel-gtt.h
   drm/cirrus
   drm/drm_edid_load.c
   drm/drm_fb_cma_helper.c
   drm/drm_gem_cma_helper.c
   drm/drm_sysfs.c
   drm/drm_trace.h
   drm/drm_trace_points.c
   drm/drm_usb.c
   drm/exynos
   drm/gma500
   drm/i915/i915_trace.h
   drm/i915/i915_trace_points.c
   drm/i915/intel_acpi.c
   drm/mgag200
   drm/nouveau
   drm/radeon
   drm/shmobile
   drm/tegra
   drm/udl
   uapi/exynos_drm.h

Revision 1.1 / (download) - annotate - [select for diffs], Tue Jul 23 02:13:14 2013 UTC (10 years, 8 months ago) by riastradh
Branch: MAIN

Initial revision

This form allows you to request diff's between any two revisions of a file. You may select a symbolic revision name using the selection box or you may type in a numeric name using the type-in text box.




CVSweb <webmaster@jp.NetBSD.org>