Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.kernel > #1687830

[PATCH for v4.9 LTS 13/87] drm/msm: Ensure that the hardware write pointer is valid

Show all headers | View raw

From: Jordan Crouse <jcrouse@codeaurora.org>

[ Upstream commit 88b333b0ed790f9433ff542b163bf972953b74d3 ]

Currently the value written to CP_RB_WPTR is calculated on the fly as
(rb->next - rb->start). But as the code is designed rb->next is wrapped
before writing the commands so if a series of commands happened to
fit perfectly in the ringbuffer, rb->next would end up being equal to
rb->size / 4 and thus result in an out of bounds address to CP_RB_WPTR.

The easiest way to fix this is to mask WPTR when writing it to the
hardware; it makes the hardware happy and the rest of the ringbuffer
math appears to work and there isn't any point in upsetting anything.

Signed-off-by: Jordan Crouse <jcrouse@codeaurora.org>
[squash in is_power_of_2() check]
Signed-off-by: Rob Clark <robdclark@gmail.com>

Signed-off-by: Sasha Levin <alexander.levin@verizon.com>
---
 drivers/gpu/drm/msm/adreno/adreno_gpu.c | 9 ++++++++-
 drivers/gpu/drm/msm/msm_ringbuffer.c    | 3 ++-
 2 files changed, 10 insertions(+), 2 deletions(-)

diff --git a/drivers/gpu/drm/msm/adreno/adreno_gpu.c b/drivers/gpu/drm/msm/adreno/adreno_gpu.c
index f386f463278d..a904082ed206 100644
--- a/drivers/gpu/drm/msm/adreno/adreno_gpu.c
+++ b/drivers/gpu/drm/msm/adreno/adreno_gpu.c
@@ -210,7 +210,14 @@ void adreno_submit(struct msm_gpu *gpu, struct msm_gem_submit *submit,
 void adreno_flush(struct msm_gpu *gpu)
 {
 	struct adreno_gpu *adreno_gpu = to_adreno_gpu(gpu);
-	uint32_t wptr = get_wptr(gpu->rb);
+	uint32_t wptr;
+
+	/*
+	 * Mask wptr value that we calculate to fit in the HW range. This is
+	 * to account for the possibility that the last command fit exactly into
+	 * the ringbuffer and rb->next hasn't wrapped to zero yet
+	 */
+	wptr = get_wptr(gpu->rb) & ((gpu->rb->size / 4) - 1);
 
 	/* ensure writes to ringbuffer have hit system memory: */
 	mb();
diff --git a/drivers/gpu/drm/msm/msm_ringbuffer.c b/drivers/gpu/drm/msm/msm_ringbuffer.c
index f326cf6a32e6..67b34e069abf 100644
--- a/drivers/gpu/drm/msm/msm_ringbuffer.c
+++ b/drivers/gpu/drm/msm/msm_ringbuffer.c
@@ -23,7 +23,8 @@ struct msm_ringbuffer *msm_ringbuffer_new(struct msm_gpu *gpu, int size)
 	struct msm_ringbuffer *ring;
 	int ret;
 
-	size = ALIGN(size, 4);   /* size should be dword aligned */
+	if (WARN_ON(!is_power_of_2(size)))
+		return ERR_PTR(-EINVAL);
 
 	ring = kzalloc(sizeof(*ring), GFP_KERNEL);
 	if (!ring) {
-- 
2.11.0

Back to linux.kernel | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread

Thread

[PATCH for v4.9 LTS 01/87] x86/mce/AMD: Make the init code more  robust "Levin, Alexander (Sasha Levin)" <alexander.levin@verizon.com> - 2017-07-15 03:50 +0200
  [PATCH for v4.9 LTS 07/87] ARM: dts: n900: Mark eMMC slot with  no-sdio and no-sd flags "Levin, Alexander (Sasha Levin)" <alexander.levin@verizon.com> - 2017-07-15 03:50 +0200
  [PATCH for v4.9 LTS 10/87] net/mlx4_core: Use-after-free causes a  resource leak in flow-steering detach "Levin, Alexander (Sasha Levin)" <alexander.levin@verizon.com> - 2017-07-15 03:50 +0200
  [PATCH for v4.9 LTS 22/87] openrisc: Add _text symbol to fix ksym  build error "Levin, Alexander (Sasha Levin)" <alexander.levin@verizon.com> - 2017-07-15 03:50 +0200
  [PATCH for v4.9 LTS 42/87] video: fbdev: cobalt_lcdfb: Handle return  NULL error from devm_ioremap "Levin, Alexander (Sasha Levin)" <alexander.levin@verizon.com> - 2017-07-15 03:50 +0200
  [PATCH for v4.9 LTS 20/87] ASoC: nau8825: fix invalid configuration  in Pre-Scalar of FLL "Levin, Alexander (Sasha Levin)" <alexander.levin@verizon.com> - 2017-07-15 03:50 +0200
  [PATCH for v4.9 LTS 51/87] ALSA: usb-audio: test EP_FLAG_RUNNING at  urb completion "Levin, Alexander (Sasha Levin)" <alexander.levin@verizon.com> - 2017-07-15 03:50 +0200
  [PATCH for v4.9 LTS 39/87] tools lib traceevent: Fix prev/next_prio  for deadline tasks "Levin, Alexander (Sasha Levin)" <alexander.levin@verizon.com> - 2017-07-15 03:50 +0200
  [PATCH for v4.9 LTS 33/87] usb: gadget: Fix copy/pasted error message "Levin, Alexander (Sasha Levin)" <alexander.levin@verizon.com> - 2017-07-15 03:50 +0200
  [PATCH for v4.9 LTS 29/87] ARM64: zynqmp: Fix i2c node's compatible  string "Levin, Alexander (Sasha Levin)" <alexander.levin@verizon.com> - 2017-07-15 03:50 +0200
  [PATCH for v4.9 LTS 24/87] dmaengine: ioatdma: workaround SKX ioatdma  version "Levin, Alexander (Sasha Levin)" <alexander.levin@verizon.com> - 2017-07-15 03:50 +0200
  [PATCH for v4.9 LTS 13/87] drm/msm: Ensure that the hardware write  pointer is valid "Levin, Alexander (Sasha Levin)" <alexander.levin@verizon.com> - 2017-07-15 03:50 +0200
  [PATCH for v4.9 LTS 26/87] dmaengine: ti-dma-crossbar: Add some  'of_node_put()' in error path. "Levin, Alexander (Sasha Levin)" <alexander.levin@verizon.com> - 2017-07-15 03:50 +0200
  [PATCH for v4.9 LTS 04/87] dt-bindings: power/supply: Update TPS65217  properties "Levin, Alexander (Sasha Levin)" <alexander.levin@verizon.com> - 2017-07-15 03:50 +0200

csiph-web