Commit a92d1a91 authored by Imre Deak's avatar Imre Deak

drm/i915: Sanitize stolen memory size calculation

On GEN8+ (not counting CHV) the calculation can in theory result in an
incorrect sign extension with all upper bits set. In practice this is
unlikely to happen since it would require 4GB of stolen memory set
aside. For consistency still prevent the sign extension explicitly
everywhere.
Signed-off-by: default avatarImre Deak <imre.deak@intel.com>
Reviewed-by: default avatarVille Syrjälä <ville.syrjala@linux.intel.com>
Link: http://patchwork.freedesktop.org/patch/msgid/1494408113-379-6-git-send-email-imre.deak@intel.com
parent 0290cf3f
...@@ -2577,14 +2577,14 @@ static size_t gen6_get_stolen_size(u16 snb_gmch_ctl) ...@@ -2577,14 +2577,14 @@ static size_t gen6_get_stolen_size(u16 snb_gmch_ctl)
{ {
snb_gmch_ctl >>= SNB_GMCH_GMS_SHIFT; snb_gmch_ctl >>= SNB_GMCH_GMS_SHIFT;
snb_gmch_ctl &= SNB_GMCH_GMS_MASK; snb_gmch_ctl &= SNB_GMCH_GMS_MASK;
return snb_gmch_ctl << 25; /* 32 MB units */ return (size_t)snb_gmch_ctl << 25; /* 32 MB units */
} }
static size_t gen8_get_stolen_size(u16 bdw_gmch_ctl) static size_t gen8_get_stolen_size(u16 bdw_gmch_ctl)
{ {
bdw_gmch_ctl >>= BDW_GMCH_GMS_SHIFT; bdw_gmch_ctl >>= BDW_GMCH_GMS_SHIFT;
bdw_gmch_ctl &= BDW_GMCH_GMS_MASK; bdw_gmch_ctl &= BDW_GMCH_GMS_MASK;
return bdw_gmch_ctl << 25; /* 32 MB units */ return (size_t)bdw_gmch_ctl << 25; /* 32 MB units */
} }
static size_t chv_get_stolen_size(u16 gmch_ctrl) static size_t chv_get_stolen_size(u16 gmch_ctrl)
...@@ -2598,11 +2598,11 @@ static size_t chv_get_stolen_size(u16 gmch_ctrl) ...@@ -2598,11 +2598,11 @@ static size_t chv_get_stolen_size(u16 gmch_ctrl)
* 0x17 to 0x1d: 4MB increments start at 36MB * 0x17 to 0x1d: 4MB increments start at 36MB
*/ */
if (gmch_ctrl < 0x11) if (gmch_ctrl < 0x11)
return gmch_ctrl << 25; return (size_t)gmch_ctrl << 25;
else if (gmch_ctrl < 0x17) else if (gmch_ctrl < 0x17)
return (gmch_ctrl - 0x11 + 2) << 22; return (size_t)(gmch_ctrl - 0x11 + 2) << 22;
else else
return (gmch_ctrl - 0x17 + 9) << 22; return (size_t)(gmch_ctrl - 0x17 + 9) << 22;
} }
static size_t gen9_get_stolen_size(u16 gen9_gmch_ctl) static size_t gen9_get_stolen_size(u16 gen9_gmch_ctl)
...@@ -2611,10 +2611,10 @@ static size_t gen9_get_stolen_size(u16 gen9_gmch_ctl) ...@@ -2611,10 +2611,10 @@ static size_t gen9_get_stolen_size(u16 gen9_gmch_ctl)
gen9_gmch_ctl &= BDW_GMCH_GMS_MASK; gen9_gmch_ctl &= BDW_GMCH_GMS_MASK;
if (gen9_gmch_ctl < 0xf0) if (gen9_gmch_ctl < 0xf0)
return gen9_gmch_ctl << 25; /* 32 MB units */ return (size_t)gen9_gmch_ctl << 25; /* 32 MB units */
else else
/* 4MB increments starting at 0xf0 for 4MB */ /* 4MB increments starting at 0xf0 for 4MB */
return (gen9_gmch_ctl - 0xf0 + 1) << 22; return (size_t)(gen9_gmch_ctl - 0xf0 + 1) << 22;
} }
static int ggtt_probe_common(struct i915_ggtt *ggtt, u64 size) static int ggtt_probe_common(struct i915_ggtt *ggtt, u64 size)
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment