Linux kernel mirror (for testing)
git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
kernel
os
linux
Merge tag 'drm-misc-next-fixes-2025-11-26' of https://gitlab.freedesktop.org/drm/misc/kernel into drm-next
drm-misc-next-fixes for v6.19:
- Restrict the pointer size of flush pages to prevent a regression.
Signed-off-by: Dave Airlie <airlied@redhat.com>
From: Maarten Lankhorst <maarten.lankhorst@linux.intel.com>
Link: https://patch.msgid.link/0090a4fc-9cc4-4c03-bfe5-d1b1f0cc7e05@linux.intel.com
+16
-1
+1
-1
drivers/gpu/drm/nouveau/nvkm/subdev/fb/base.c
+1
-1
drivers/gpu/drm/nouveau/nvkm/subdev/fb/base.c
···
279
279
mutex_init(&fb->tags.mutex);
280
280
281
281
if (func->sysmem.flush_page_init) {
282
-
fb->sysmem.flush_page = alloc_page(GFP_KERNEL | __GFP_ZERO);
282
+
fb->sysmem.flush_page = alloc_page(GFP_KERNEL | GFP_DMA32 | __GFP_ZERO);
283
283
if (!fb->sysmem.flush_page)
284
284
return -ENOMEM;
285
285
+3
drivers/gpu/drm/nouveau/nvkm/subdev/fb/gb100.c
+3
drivers/gpu/drm/nouveau/nvkm/subdev/fb/gb100.c
···
15
15
const u32 hshub = DRF_LO(NV_PFB_HSHUB0);
16
16
struct nvkm_device *device = fb->subdev.device;
17
17
18
+
// Ensure that the address is within hardware limits
19
+
WARN_ON(fb->sysmem.flush_page_addr > DMA_BIT_MASK(52));
20
+
18
21
nvkm_wr32(device, hshub + NV_PFB_HSHUB_PCIE_FLUSH_SYSMEM_ADDR_HI, addr_hi);
19
22
nvkm_wr32(device, hshub + NV_PFB_HSHUB_PCIE_FLUSH_SYSMEM_ADDR_LO, addr_lo);
20
23
nvkm_wr32(device, hshub + NV_PFB_HSHUB_EG_PCIE_FLUSH_SYSMEM_ADDR_HI, addr_hi);
+3
drivers/gpu/drm/nouveau/nvkm/subdev/fb/gb202.c
+3
drivers/gpu/drm/nouveau/nvkm/subdev/fb/gb202.c
···
13
13
struct nvkm_device *device = fb->subdev.device;
14
14
const u64 addr = fb->sysmem.flush_page_addr;
15
15
16
+
// Ensure that the address is within hardware limits
17
+
WARN_ON(fb->sysmem.flush_page_addr > DMA_BIT_MASK(52));
18
+
16
19
nvkm_wr32(device, NV_PFB_FBHUB0_PCIE_FLUSH_SYSMEM_ADDR_HI, upper_32_bits(addr));
17
20
nvkm_wr32(device, NV_PFB_FBHUB0_PCIE_FLUSH_SYSMEM_ADDR_LO, lower_32_bits(addr));
18
21
}
+3
drivers/gpu/drm/nouveau/nvkm/subdev/fb/gf100.c
+3
drivers/gpu/drm/nouveau/nvkm/subdev/fb/gf100.c
···
80
80
void
81
81
gf100_fb_sysmem_flush_page_init(struct nvkm_fb *fb)
82
82
{
83
+
// Ensure that the address can actually fit in the register
84
+
WARN_ON(fb->sysmem.flush_page_addr > DMA_BIT_MASK(40));
85
+
83
86
nvkm_wr32(fb->subdev.device, 0x100c10, fb->sysmem.flush_page_addr >> 8);
84
87
}
85
88
+3
drivers/gpu/drm/nouveau/nvkm/subdev/fb/gh100.c
+3
drivers/gpu/drm/nouveau/nvkm/subdev/fb/gh100.c
···
13
13
const u64 addr = fb->sysmem.flush_page_addr >> NV_PFB_NISO_FLUSH_SYSMEM_ADDR_SHIFT;
14
14
struct nvkm_device *device = fb->subdev.device;
15
15
16
+
// Ensure that the address is within hardware limits
17
+
WARN_ON(fb->sysmem.flush_page_addr > DMA_BIT_MASK(52));
18
+
16
19
nvkm_wr32(device, NV_PFB_FBHUB_PCIE_FLUSH_SYSMEM_ADDR_HI, upper_32_bits(addr));
17
20
nvkm_wr32(device, NV_PFB_FBHUB_PCIE_FLUSH_SYSMEM_ADDR_LO, lower_32_bits(addr));
18
21
}
+3
drivers/gpu/drm/nouveau/nvkm/subdev/fb/nv50.c
+3
drivers/gpu/drm/nouveau/nvkm/subdev/fb/nv50.c
···
214
214
static void
215
215
nv50_fb_sysmem_flush_page_init(struct nvkm_fb *fb)
216
216
{
217
+
// Ensure that the address can actually fit in the register
218
+
WARN_ON(fb->sysmem.flush_page_addr > DMA_BIT_MASK(40));
219
+
217
220
nvkm_wr32(fb->subdev.device, 0x100c08, fb->sysmem.flush_page_addr >> 8);
218
221
}
219
222