tjh.dev / kernel
Linux kernel mirror (for testing) git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
kernel os linux
fork atom

drm/msm/a6xx+: Don't let IB_SIZE overflow

IB_SIZE is only b0..b19. Starting with a6xx gen3, additional fields
were added above the IB_SIZE. Accidentially setting them can cause
badness. Fix this by properly defining the CP_INDIRECT_BUFFER packet
and using the generated builder macro to ensure unintended bits are not
set.

v2: add missing type attribute for IB_BASE
v3: fix offset attribute in xml

Reported-by: Connor Abbott <cwabbott0@gmail.com>
Fixes: a83366ef19ea ("drm/msm/a6xx: add A640/A650 to gpulist")
Signed-off-by: Rob Clark <robdclark@chromium.org>
Patchwork: https://patchwork.freedesktop.org/patch/643396/

Rob Clark 9d78f025 ddfa00af

+11 -4
unified split
+4 -4
drivers/gpu/drm/msm/adreno/a6xx_gpu.c
··· 242 break; 243 fallthrough; 244 case MSM_SUBMIT_CMD_BUF: 245 - OUT_PKT7(ring, CP_INDIRECT_BUFFER_PFE, 3); 246 OUT_RING(ring, lower_32_bits(submit->cmd[i].iova)); 247 OUT_RING(ring, upper_32_bits(submit->cmd[i].iova)); 248 - OUT_RING(ring, submit->cmd[i].size); 249 ibs++; 250 break; 251 } ··· 377 break; 378 fallthrough; 379 case MSM_SUBMIT_CMD_BUF: 380 - OUT_PKT7(ring, CP_INDIRECT_BUFFER_PFE, 3); 381 OUT_RING(ring, lower_32_bits(submit->cmd[i].iova)); 382 OUT_RING(ring, upper_32_bits(submit->cmd[i].iova)); 383 - OUT_RING(ring, submit->cmd[i].size); 384 ibs++; 385 break; 386 }
··· 242 break; 243 fallthrough; 244 case MSM_SUBMIT_CMD_BUF: 245 + OUT_PKT7(ring, CP_INDIRECT_BUFFER, 3); 246 OUT_RING(ring, lower_32_bits(submit->cmd[i].iova)); 247 OUT_RING(ring, upper_32_bits(submit->cmd[i].iova)); 248 + OUT_RING(ring, A5XX_CP_INDIRECT_BUFFER_2_IB_SIZE(submit->cmd[i].size)); 249 ibs++; 250 break; 251 } ··· 377 break; 378 fallthrough; 379 case MSM_SUBMIT_CMD_BUF: 380 + OUT_PKT7(ring, CP_INDIRECT_BUFFER, 3); 381 OUT_RING(ring, lower_32_bits(submit->cmd[i].iova)); 382 OUT_RING(ring, upper_32_bits(submit->cmd[i].iova)); 383 + OUT_RING(ring, A5XX_CP_INDIRECT_BUFFER_2_IB_SIZE(submit->cmd[i].size)); 384 ibs++; 385 break; 386 }
+7
drivers/gpu/drm/msm/registers/adreno/adreno_pm4.xml
··· 2259 </reg32> 2260 </domain> 2261 2262 </database> 2263
··· 2259 </reg32> 2260 </domain> 2261 2262 + <domain name="CP_INDIRECT_BUFFER" width="32" varset="chip" prefix="chip" variants="A5XX-"> 2263 + <reg64 offset="0" name="IB_BASE" type="address"/> 2264 + <reg32 offset="2" name="2"> 2265 + <bitfield name="IB_SIZE" low="0" high="19"/> 2266 + </reg32> 2267 + </domain> 2268 + 2269 </database> 2270