Re: [PATCH] drm/amd/gfx11: move the gfx mutex into the caller
On 8/20/2024 8:09 PM, Alex Deucher wrote:
Otherwise we can fail to drop the software mutex when
we fail to take the hardware mutex.
Fixes: 76acba7b7f12 ("drm/amdgpu/gfx11: add a mutex for the gfx semaphore")
Reported-by: Dan Carpenter
Signed-off-by: Alex Deucher
---
drivers/gpu/drm/amd/amdgpu/gfx_v11_0.c | 7 +++
1 file changed, 3 insertions(+), 4 deletions(-)
diff --git a/drivers/gpu/drm/amd/amdgpu/gfx_v11_0.c
b/drivers/gpu/drm/amd/amdgpu/gfx_v11_0.c
index 5704ad25a49d6..aa7fdece8ad42 100644
--- a/drivers/gpu/drm/amd/amdgpu/gfx_v11_0.c
+++ b/drivers/gpu/drm/amd/amdgpu/gfx_v11_0.c
@@ -4747,8 +4747,6 @@ int gfx_v11_0_request_gfx_index_mutex(struct
amdgpu_device *adev,
{
u32 i, tmp, val;
- if (req)
- mutex_lock(&adev->gfx.reset_sem_mutex);
for (i = 0; i < adev->usec_timeout; i++) {
/* Request with MeId=2, PipeId=0 */
tmp = REG_SET_FIELD(0, CP_GFX_INDEX_MUTEX, REQUEST, req);
@@ -4769,8 +4767,6 @@ int gfx_v11_0_request_gfx_index_mutex(struct
amdgpu_device *adev,
}
udelay(1);
}
- if (!req)
- mutex_unlock(&adev->gfx.reset_sem_mutex);
if (i >= adev->usec_timeout)
return -EINVAL;
@@ -4818,8 +4814,10 @@ static int gfx_v11_0_soft_reset(void *handle)
mutex_unlock(&adev->srbm_mutex);
/* Try to acquire the gfx mutex before access to CP_VMID_RESET */
+ mutex_lock(&adev->gfx.reset_sem_mutex);
r = gfx_v11_0_request_gfx_index_mutex(adev, true);
if (r) {
+ mutex_unlock(&adev->gfx.reset_sem_mutex);
DRM_ERROR("Failed to acquire the gfx mutex during soft
reset\n");
return r;
}
@@ -4834,6 +4832,7 @@ static int gfx_v11_0_soft_reset(void *handle)
/* release the gfx mutex */
r = gfx_v11_0_request_gfx_index_mutex(adev, false);
+ mutex_unlock(&adev->gfx.reset_sem_mutex);
if (r) {
DRM_ERROR("Failed to release the gfx mutex during soft
reset\n");
return r;
By moving locking and unlocking of the mutex to the gfx_v11_0_soft_reset
function (the caller). This ensures that the mutex is always unlocked,
regardless of whether (indicated by if (i >= adev->usec_timeout))
succeeds or fails.
Acked-by: Srinivasan Shanmugam
[PATCH] drm/amdgpu/: Add missing kdoc entry in amdgpu_vm_handle_fault function
This commit adds a description for the 'ts' parameter in the amdgpu_vm_handle_fault function's comment block. Fixes the below with gcc W=1: drivers/gpu/drm/amd/amdgpu/amdgpu_vm.c:2781: warning: Function parameter or struct member 'ts' not described in 'amdgpu_vm_handle_fault' Cc: Christian König Cc: Alex Deucher Signed-off-by: Srinivasan Shanmugam --- drivers/gpu/drm/amd/amdgpu/amdgpu_vm.c | 1 + 1 file changed, 1 insertion(+) diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_vm.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_vm.c index ad2e469548c9..0fa165e8fb40 100644 --- a/drivers/gpu/drm/amd/amdgpu/amdgpu_vm.c +++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_vm.c @@ -2766,6 +2766,7 @@ int amdgpu_vm_ioctl(struct drm_device *dev, void *data, struct drm_file *filp) * amdgpu_vm_handle_fault - graceful handling of VM faults. * @adev: amdgpu device pointer * @pasid: PASID of the VM + * @ts: Timestamp of the fault * @vmid: VMID, only used for GFX 9.4.3. * @node_id: Node_id received in IH cookie. Only applicable for * GFX 9.4.3. -- 2.34.1
Re: [PATCH 1/2] drm/amdgpu/gfx11: return early in preempt_ib()
On 8/15/2024 10:30 PM, Alex Deucher wrote: When MES is enabled KIQ is not available. Return an error when someone uses the debugfs preempt test interface in that case. Signed-off-by: Alex Deucher --- drivers/gpu/drm/amd/amdgpu/gfx_v11_0.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/drivers/gpu/drm/amd/amdgpu/gfx_v11_0.c b/drivers/gpu/drm/amd/amdgpu/gfx_v11_0.c index 5685aee479df..5704ad25a49d 100644 --- a/drivers/gpu/drm/amd/amdgpu/gfx_v11_0.c +++ b/drivers/gpu/drm/amd/amdgpu/gfx_v11_0.c @@ -5924,6 +5924,9 @@ static int gfx_v11_0_ring_preempt_ib(struct amdgpu_ring *ring) struct amdgpu_ring *kiq_ring = &kiq->ring; unsigned long flags; + if (adev->enable_mes) + return -EINVAL; + if (!kiq->pmf || !kiq->pmf->kiq_unmap_queues) return -EINVAL; With MES feature enabled, based on allowing multiple command streams to be executed concurrently on the GPU Vs KIQ that is used to send commands to the GPU in a sequential manner, having both of them active at the same time could lead to conflicts. Therefore, when the MES is enabled, the KIQ becomes unavailable. With this understanding, this series is: Acked-by: Srinivasan Shanmugam
[PATCH v2] drm/amdgpu/: Add missing kdoc entry in amdgpu_vm_handle_fault function
This commit adds a description for the 'ts' parameter in the amdgpu_vm_handle_fault function's comment block. Fixes the below with gcc W=1: drivers/gpu/drm/amd/amdgpu/amdgpu_vm.c:2781: warning: Function parameter or struct member 'ts' not described in 'amdgpu_vm_handle_fault' Cc: Xiaogang.Chen Cc: Christian König Cc: Alex Deucher Reported-by: kernel test robot Closes: https://lore.kernel.org/oe-kbuild-all/202408251419.vgzhg3gv-...@intel.com/ Signed-off-by: Srinivasan Shanmugam --- v2: Added Reported-by (Xiaogang) drivers/gpu/drm/amd/amdgpu/amdgpu_vm.c | 1 + 1 file changed, 1 insertion(+) diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_vm.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_vm.c index ad2e469548c9..0fa165e8fb40 100644 --- a/drivers/gpu/drm/amd/amdgpu/amdgpu_vm.c +++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_vm.c @@ -2766,6 +2766,7 @@ int amdgpu_vm_ioctl(struct drm_device *dev, void *data, struct drm_file *filp) * amdgpu_vm_handle_fault - graceful handling of VM faults. * @adev: amdgpu device pointer * @pasid: PASID of the VM + * @ts: Timestamp of the fault * @vmid: VMID, only used for GFX 9.4.3. * @node_id: Node_id received in IH cookie. Only applicable for * GFX 9.4.3. -- 2.34.1
[PATCH] drm/amd/display: Add missing kdoc entry for 'bs_coeffs_updated' in dpp401_dscl_program_isharp
Fixes the below with gcc W=1: drivers/gpu/drm/amd/amdgpu/../display/dc/dpp/dcn401/dcn401_dpp_dscl.c:961: warning: Function parameter or struct member 'bs_coeffs_updated' not described in 'dpp401_dscl_program_isharp' Cc: Tom Chung Cc: Rodrigo Siqueira Cc: Roman Li Cc: Alex Hung Cc: Aurabindo Pillai Cc: Harry Wentland Cc: Hamza Mahfooz Signed-off-by: Srinivasan Shanmugam --- drivers/gpu/drm/amd/display/dc/dpp/dcn401/dcn401_dpp_dscl.c | 1 + 1 file changed, 1 insertion(+) diff --git a/drivers/gpu/drm/amd/display/dc/dpp/dcn401/dcn401_dpp_dscl.c b/drivers/gpu/drm/amd/display/dc/dpp/dcn401/dcn401_dpp_dscl.c index 703d7b51c6c2..3a3745597f0c 100644 --- a/drivers/gpu/drm/amd/display/dc/dpp/dcn401/dcn401_dpp_dscl.c +++ b/drivers/gpu/drm/amd/display/dc/dpp/dcn401/dcn401_dpp_dscl.c @@ -951,6 +951,7 @@ static void dpp401_dscl_set_isharp_filter( * * @dpp_base: High level DPP struct * @scl_data: scalaer_data info + * @bs_coeffs_updated: coeffs update flag * * This is the primary function to program isharp * -- 2.34.1
[PATCH v2] drm/amd/display: Add missing kdoc entry for 'bs_coeffs_updated' in dpp401_dscl_program_isharp
This commit addresses a missing kdoc for the 'bs_coeffs_updated' parameter in the 'dpp401_dscl_program_isharp' function. The 'bs_coeffs_updated' is a flag indicating whether the Blur and Scale Coefficients have been updated. The 'dpp401_dscl_program_isharp' function is responsible for programming the isharp, which includes setting the isharp filter, noise gain, and blur and scale coefficients. If the 'bs_coeffs_updated' flag is set to true, the function updates the blur and scale coefficients. Fixes the below with gcc W=1: drivers/gpu/drm/amd/amdgpu/../display/dc/dpp/dcn401/dcn401_dpp_dscl.c:961: warning: Function parameter or struct member 'bs_coeffs_updated' not described in 'dpp401_dscl_program_isharp' Cc: Tom Chung Cc: Rodrigo Siqueira Cc: Roman Li Cc: Alex Hung Cc: Aurabindo Pillai Cc: Harry Wentland Cc: Hamza Mahfooz Signed-off-by: Srinivasan Shanmugam Suggested-by: Tom Chung --- v2: Updated to "Blur and Scale Coefficients update flag" (Tom) drivers/gpu/drm/amd/display/dc/dpp/dcn401/dcn401_dpp_dscl.c | 1 + 1 file changed, 1 insertion(+) diff --git a/drivers/gpu/drm/amd/display/dc/dpp/dcn401/dcn401_dpp_dscl.c b/drivers/gpu/drm/amd/display/dc/dpp/dcn401/dcn401_dpp_dscl.c index 703d7b51c6c2..4d8de1b8aa62 100644 --- a/drivers/gpu/drm/amd/display/dc/dpp/dcn401/dcn401_dpp_dscl.c +++ b/drivers/gpu/drm/amd/display/dc/dpp/dcn401/dcn401_dpp_dscl.c @@ -951,6 +951,7 @@ static void dpp401_dscl_set_isharp_filter( * * @dpp_base: High level DPP struct * @scl_data: scalaer_data info + * @bs_coeffs_updated: Blur and Scale Coefficients update flag * * This is the primary function to program isharp * -- 2.34.1
[PATCH] drm/amdgpu: Replace 'amdgpu_job_submit_direct' with 'drm_sched_entity' in cleaner shader
This commit replaces the use of amdgpu_job_submit_direct which submits
the job to the ring directly, with drm_sched_entity in the cleaner
shader job submission process. The change allows the GPU scheduler to
manage the cleaner shader job.
- The job is then submitted to the GPU using the
drm_sched_entity_push_job function, which allows the GPU scheduler to
manage the job.
This change improves the reliability of the cleaner shader job
submission process by leveraging the capabilities of the GPU scheduler.
Fixes: f70111466165 ("drm/amdgpu: Add sysfs interface for running cleaner
shader")
Cc: Christian König
Cc: Alex Deucher
Signed-off-by: Srinivasan Shanmugam
Suggested-by: Christian König
---
drivers/gpu/drm/amd/amdgpu/amdgpu_gfx.c | 32 -
drivers/gpu/drm/amd/amdgpu/amdgpu_gfx.h | 1 +
2 files changed, 17 insertions(+), 16 deletions(-)
diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_gfx.c
b/drivers/gpu/drm/amd/amdgpu/amdgpu_gfx.c
index b779d47a546a..149939c4eaed 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_gfx.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_gfx.c
@@ -1397,14 +1397,22 @@ static ssize_t
amdgpu_gfx_get_available_compute_partition(struct device *dev,
static int amdgpu_gfx_run_cleaner_shader_job(struct amdgpu_ring *ring)
{
struct amdgpu_device *adev = ring->adev;
- long timeout = msecs_to_jiffies(1000);
+ struct drm_gpu_scheduler *sched = &ring->sched;
struct dma_fence *f = NULL;
struct amdgpu_job *job;
struct amdgpu_ib *ib;
int i, r;
- r = amdgpu_job_alloc_with_ib(adev, NULL, NULL,
-64, AMDGPU_IB_POOL_DIRECT,
+ /* Initialize the scheduler entity */
+ r = drm_sched_entity_init(&adev->gfx.entity, DRM_SCHED_PRIORITY_NORMAL,
+ &sched, 1, NULL);
+ if (r) {
+ dev_err(adev->dev, "Failed setting up GFX kernel entity.\n");
+ goto err;
+ }
+
+ r = amdgpu_job_alloc_with_ib(ring->adev, &adev->gfx.entity, NULL,
+64, 0,
&job);
if (r)
goto err;
@@ -1416,24 +1424,16 @@ static int amdgpu_gfx_run_cleaner_shader_job(struct
amdgpu_ring *ring)
ib->ptr[i] = ring->funcs->nop;
ib->length_dw = ring->funcs->align_mask + 1;
- r = amdgpu_job_submit_direct(job, ring, &f);
+ f = amdgpu_job_submit(job);
+ r = dma_fence_wait(f, false);
if (r)
- goto err_free;
-
- r = dma_fence_wait_timeout(f, false, timeout);
- if (r == 0)
- r = -ETIMEDOUT;
- else if (r > 0)
- r = 0;
-
- amdgpu_ib_free(adev, ib, f);
+ goto err;
dma_fence_put(f);
+ /* Clean up the scheduler entity */
+ drm_sched_entity_destroy(&adev->gfx.entity);
return 0;
-err_free:
- amdgpu_job_free(job);
- amdgpu_ib_free(adev, ib, f);
err:
return r;
}
diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_gfx.h
b/drivers/gpu/drm/amd/amdgpu/amdgpu_gfx.h
index 5644e10a86a9..3c268476dec8 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_gfx.h
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_gfx.h
@@ -472,6 +472,7 @@ struct amdgpu_gfx {
struct mutexkfd_sch_mutex;
u64 kfd_sch_req_count[MAX_XCP];
boolkfd_sch_inactive[MAX_XCP];
+ struct drm_sched_entity entity;
};
struct amdgpu_gfx_ras_reg_entry {
--
2.34.1
[PATCH] drm/amdgpu: Fix kdoc entry in 'amdgpu_vm_cpu_prepare'
This commit updates described non-existent parameters 'resv' and 'sync_mode', and failed to describe the existing 'sync' parameter. Fixes the below with gcc W=1: drivers/gpu/drm/amd/amdgpu/amdgpu_vm_cpu.c:50: warning: Function parameter or struct member 'sync' not described in 'amdgpu_vm_cpu_prepare' drivers/gpu/drm/amd/amdgpu/amdgpu_vm_cpu.c:50: warning: Excess function parameter 'resv' description in 'amdgpu_vm_cpu_prepare' drivers/gpu/drm/amd/amdgpu/amdgpu_vm_cpu.c:50: warning: Excess function parameter 'sync_mode' description in 'amdgpu_vm_cpu_prepare' Cc: Christian König Cc: Alex Deucher Signed-off-by: Srinivasan Shanmugam --- drivers/gpu/drm/amd/amdgpu/amdgpu_vm_cpu.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_vm_cpu.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_vm_cpu.c index 9ff59a4e6f15..29dbcdfeea8b 100644 --- a/drivers/gpu/drm/amd/amdgpu/amdgpu_vm_cpu.c +++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_vm_cpu.c @@ -39,8 +39,7 @@ static int amdgpu_vm_cpu_map_table(struct amdgpu_bo_vm *table) * amdgpu_vm_cpu_prepare - prepare page table update with the CPU * * @p: see amdgpu_vm_update_params definition - * @resv: reservation object with embedded fence - * @sync_mode: synchronization mode + * @sync: synchronization mode * * Returns: * Negativ errno, 0 for success. -- 2.34.1
[PATCH] drm/amd/display: Add kdoc entry for 'program_isharp_1dlut' in 'dpp401_dscl_program_isharp'
Added a descriptor for the 'program_isharp_1dlut' parameter, which is a flag used to determine whether to program the isharp 1D LUT. Fixes the below with gcc W=1: drivers/gpu/drm/amd/amdgpu/../display/dc/dpp/dcn401/dcn401_dpp_dscl.c:963: warning: Function parameter or struct member 'program_isharp_1dlut' not described in 'dpp401_dscl_program_isharp' Cc: Tom Chung Cc: Rodrigo Siqueira Cc: Roman Li Cc: Alex Hung Cc: Aurabindo Pillai Cc: Harry Wentland Cc: Hamza Mahfooz Signed-off-by: Srinivasan Shanmugam --- drivers/gpu/drm/amd/display/dc/dpp/dcn401/dcn401_dpp_dscl.c | 1 + 1 file changed, 1 insertion(+) diff --git a/drivers/gpu/drm/amd/display/dc/dpp/dcn401/dcn401_dpp_dscl.c b/drivers/gpu/drm/amd/display/dc/dpp/dcn401/dcn401_dpp_dscl.c index 8564369f09b4..5105fd580017 100644 --- a/drivers/gpu/drm/amd/display/dc/dpp/dcn401/dcn401_dpp_dscl.c +++ b/drivers/gpu/drm/amd/display/dc/dpp/dcn401/dcn401_dpp_dscl.c @@ -951,6 +951,7 @@ static void dpp401_dscl_set_isharp_filter( * * @dpp_base: High level DPP struct * @scl_data: scalaer_data info + * @program_isharp_1dlut: flag to program isharp 1D LUT * @bs_coeffs_updated: Blur and Scale Coefficients update flag * * This is the primary function to program isharp -- 2.34.1
[PATCH v2] drm/amdgpu: Replace 'amdgpu_job_submit_direct' with 'drm_sched_entity' in cleaner shader
This commit replaces the use of amdgpu_job_submit_direct which submits
the job to the ring directly, with drm_sched_entity in the cleaner
shader job submission process. The change allows the GPU scheduler to
manage the cleaner shader job.
- The job is then submitted to the GPU using the
drm_sched_entity_push_job function, which allows the GPU scheduler to
manage the job.
This change improves the reliability of the cleaner shader job
submission process by leveraging the capabilities of the GPU scheduler.
Fixes: f70111466165 ("drm/amdgpu: Add sysfs interface for running cleaner
shader")
Cc: Christian König
Cc: Alex Deucher
Signed-off-by: Srinivasan Shanmugam
Suggested-by: Christian König
---
v2:
- Dropped default assignment of f. (Christian)
- Moved drm_sched entity; to stack from amdgpu_gfx structure.
(Christian)
drivers/gpu/drm/amd/amdgpu/amdgpu_gfx.c | 35 ++---
1 file changed, 19 insertions(+), 16 deletions(-)
diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_gfx.c
b/drivers/gpu/drm/amd/amdgpu/amdgpu_gfx.c
index b779d47a546a..83e54697f0ee 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_gfx.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_gfx.c
@@ -1397,14 +1397,23 @@ static ssize_t
amdgpu_gfx_get_available_compute_partition(struct device *dev,
static int amdgpu_gfx_run_cleaner_shader_job(struct amdgpu_ring *ring)
{
struct amdgpu_device *adev = ring->adev;
- long timeout = msecs_to_jiffies(1000);
- struct dma_fence *f = NULL;
+ struct drm_gpu_scheduler *sched = &ring->sched;
+ struct drm_sched_entity entity;
+ struct dma_fence *f;
struct amdgpu_job *job;
struct amdgpu_ib *ib;
int i, r;
- r = amdgpu_job_alloc_with_ib(adev, NULL, NULL,
-64, AMDGPU_IB_POOL_DIRECT,
+ /* Initialize the scheduler entity */
+ r = drm_sched_entity_init(&entity, DRM_SCHED_PRIORITY_NORMAL,
+ &sched, 1, NULL);
+ if (r) {
+ dev_err(adev->dev, "Failed setting up GFX kernel entity.\n");
+ goto err;
+ }
+
+ r = amdgpu_job_alloc_with_ib(ring->adev, &entity, NULL,
+64, 0,
&job);
if (r)
goto err;
@@ -1416,24 +1425,18 @@ static int amdgpu_gfx_run_cleaner_shader_job(struct
amdgpu_ring *ring)
ib->ptr[i] = ring->funcs->nop;
ib->length_dw = ring->funcs->align_mask + 1;
- r = amdgpu_job_submit_direct(job, ring, &f);
- if (r)
- goto err_free;
+ f = amdgpu_job_submit(job);
- r = dma_fence_wait_timeout(f, false, timeout);
- if (r == 0)
- r = -ETIMEDOUT;
- else if (r > 0)
- r = 0;
+ r = dma_fence_wait(f, false);
+ if (r)
+ goto err;
- amdgpu_ib_free(adev, ib, f);
dma_fence_put(f);
+ /* Clean up the scheduler entity */
+ drm_sched_entity_destroy(&entity);
return 0;
-err_free:
- amdgpu_job_free(job);
- amdgpu_ib_free(adev, ib, f);
err:
return r;
}
--
2.34.1
[PATCH] drm/amdgpu/gfx9: Convert `//` to `/* ... */` in cleaner shader code
This commit updates the comment style in the cleaner shader code from `//` to `/* ... */` to adhere to the Linux kernel coding style. The comments describe the operation of the cleaner shader, which is used to clean LDS, SGPRs, and VGPRs. The shader uses two kernels launched separately to clean VGPRs, LDS, and lower SGPRs, and to clean remaining SGPRs. Cc: Christian König Cc: Alex Deucher Signed-off-by: Srinivasan Shanmugam --- .../amd/amdgpu/gfx_v9_4_3_cleaner_shader.asm | 139 +- 1 file changed, 72 insertions(+), 67 deletions(-) diff --git a/drivers/gpu/drm/amd/amdgpu/gfx_v9_4_3_cleaner_shader.asm b/drivers/gpu/drm/amd/amdgpu/gfx_v9_4_3_cleaner_shader.asm index d5325ef80ab0..4a61562b9bab 100644 --- a/drivers/gpu/drm/amd/amdgpu/gfx_v9_4_3_cleaner_shader.asm +++ b/drivers/gpu/drm/amd/amdgpu/gfx_v9_4_3_cleaner_shader.asm @@ -21,47 +21,52 @@ * OTHER DEALINGS IN THE SOFTWARE. */ -// This shader is to clean LDS, SGPRs and VGPRs. It is first 64 Dwords or 256 bytes of 192 Dwords cleaner shader. -//To turn this shader program on for complitaion change this to main and lower shader main to main_1 - -// MI300 : Clear SGPRs, VGPRs and LDS -// Uses two kernels launched separately: -// 1. Clean VGPRs, LDS, and lower SGPRs -//Launches one workgroup per CU, each workgroup with 4x wave64 per SIMD in the CU -//Waves are "wave64" and have 128 VGPRs each, which uses all 512 VGPRs per SIMD -//Waves in the workgroup share the 64KB of LDS -//Each wave clears SGPRs 0 - 95. Because there are 4 waves/SIMD, this is physical SGPRs 0-383 -//Each wave clears 128 VGPRs, so all 512 in the SIMD -//The first wave of the workgroup clears its 64KB of LDS -//The shader starts with "S_BARRIER" to ensure SPI has launched all waves of the workgroup -// before any wave in the workgroup could end. Without this, it is possible not all SGPRs get cleared. -//2. Clean remaining SGPRs -//Launches a workgroup with 24 waves per workgroup, yielding 6 waves per SIMD in each CU -//Waves are allocating 96 SGPRs -// CP sets up SPI_RESOURCE_RESERVE_* registers to prevent these waves from allocating SGPRs 0-223. -// As such, these 6 waves per SIMD are allocated physical SGPRs 224-799 -//Barriers do not work for >16 waves per workgroup, so we cannot start with S_BARRIER -// Instead, the shader starts with an S_SETHALT 1. Once all waves are launched CP will send unhalt command -//The shader then clears all SGPRs allocated to it, cleaning out physical SGPRs 224-799 +/* + * This shader is to clean LDS, SGPRs and VGPRs. It is first 64 Dwords or 256 bytes of 192 Dwords cleaner shader. + * To turn this shader program on for complitaion change this to main and lower shader main to main_1 + * + * MI300 : Clear SGPRs, VGPRs and LDS + * Uses two kernels launched separately: + * 1. Clean VGPRs, LDS, and lower SGPRs + *Launches one workgroup per CU, each workgroup with 4x wave64 per SIMD in the CU + *Waves are "wave64" and have 128 VGPRs each, which uses all 512 VGPRs per SIMD + *Waves in the workgroup share the 64KB of LDS + *Each wave clears SGPRs 0 - 95. Because there are 4 waves/SIMD, this is physical SGPRs 0-383 + *Each wave clears 128 VGPRs, so all 512 in the SIMD + *The first wave of the workgroup clears its 64KB of LDS + *The shader starts with "S_BARRIER" to ensure SPI has launched all waves of the workgroup + * before any wave in the workgroup could end. Without this, it is possible not all SGPRs get cleared. + *2. Clean remaining SGPRs + *Launches a workgroup with 24 waves per workgroup, yielding 6 waves per SIMD in each CU + *Waves are allocating 96 SGPRs + * CP sets up SPI_RESOURCE_RESERVE_* registers to prevent these waves from allocating SGPRs 0-223. + * As such, these 6 waves per SIMD are allocated physical SGPRs 224-799 + * Barriers do not work for >16 waves per workgroup, so we cannot start with S_BARRIER + * Instead, the shader starts with an S_SETHALT 1. Once all waves are launched CP will send unhalt command + * The shader then clears all SGPRs allocated to it, cleaning out physical SGPRs 224-799 + */ shader main asic(MI300) type(CS) wave_size(64) -// Note: original source code from SQ team -// (theorhetical fastest = ~512clks vgpr + 1536 lds + ~128 sgpr = 2176 clks) +/* + * Note: original source code from SQ team + * + * (theorhetical fastest = ~512clks vgpr + 1536 lds + ~128 sgpr = 2176 clks) + */ - s_cmp_eq_u32 s0, 1// Bit0 is set, sgpr0 is set then clear VGPRS and LDS as FW set COMPUTE_USER_DATA_3 - s_cbranch_scc0 label_0023// Clean VGPRs and LDS if sgpr0 of wave is set, scc = (s3 == 1) + s_cmp_eq_u32 s0, 1
[PATCH v2] drm/amdgpu/gfx9: Convert `//` to `/* ... */` in cleaner shader code
This commit updates the comment style in the cleaner shader code from
`//` to `/* ... */` to adhere to the Linux kernel coding style.
The comments describe the operation of the cleaner shader, which is used
to clean LDS, SGPRs, and VGPRs. The shader uses two kernels launched
separately to clean VGPRs, LDS, and lower SGPRs, and to clean remaining
SGPRs.
Fixes: 3b721dfb2c95 ("drm/amdgpu/gfx9: Add cleaner shader for GFX9.4.3")
Cc: Christian König
Cc: Alex Deucher
Signed-off-by: Srinivasan Shanmugam
---
v2:
- Corrected typo for iteraions
- Added fixes tag
.../amd/amdgpu/gfx_v9_4_3_cleaner_shader.asm | 139 +-
1 file changed, 72 insertions(+), 67 deletions(-)
diff --git a/drivers/gpu/drm/amd/amdgpu/gfx_v9_4_3_cleaner_shader.asm
b/drivers/gpu/drm/amd/amdgpu/gfx_v9_4_3_cleaner_shader.asm
index d5325ef80ab0..8951b5a87ae1 100644
--- a/drivers/gpu/drm/amd/amdgpu/gfx_v9_4_3_cleaner_shader.asm
+++ b/drivers/gpu/drm/amd/amdgpu/gfx_v9_4_3_cleaner_shader.asm
@@ -21,47 +21,52 @@
* OTHER DEALINGS IN THE SOFTWARE.
*/
-// This shader is to clean LDS, SGPRs and VGPRs. It is first 64 Dwords or 256
bytes of 192 Dwords cleaner shader.
-//To turn this shader program on for complitaion change this to main and lower
shader main to main_1
-
-// MI300 : Clear SGPRs, VGPRs and LDS
-// Uses two kernels launched separately:
-// 1. Clean VGPRs, LDS, and lower SGPRs
-//Launches one workgroup per CU, each workgroup with 4x wave64 per
SIMD in the CU
-//Waves are "wave64" and have 128 VGPRs each, which uses all 512 VGPRs
per SIMD
-//Waves in the workgroup share the 64KB of LDS
-//Each wave clears SGPRs 0 - 95. Because there are 4 waves/SIMD, this
is physical SGPRs 0-383
-//Each wave clears 128 VGPRs, so all 512 in the SIMD
-//The first wave of the workgroup clears its 64KB of LDS
-//The shader starts with "S_BARRIER" to ensure SPI has launched all
waves of the workgroup
-// before any wave in the workgroup could end. Without this, it is
possible not all SGPRs get cleared.
-//2. Clean remaining SGPRs
-//Launches a workgroup with 24 waves per workgroup, yielding 6 waves
per SIMD in each CU
-//Waves are allocating 96 SGPRs
-// CP sets up SPI_RESOURCE_RESERVE_* registers to prevent these waves
from allocating SGPRs 0-223.
-// As such, these 6 waves per SIMD are allocated physical SGPRs
224-799
-//Barriers do not work for >16 waves per workgroup, so we cannot start
with S_BARRIER
-// Instead, the shader starts with an S_SETHALT 1. Once all waves are
launched CP will send unhalt command
-//The shader then clears all SGPRs allocated to it, cleaning out
physical SGPRs 224-799
+/*
+ * This shader is to clean LDS, SGPRs and VGPRs. It is first 64 Dwords or 256
bytes of 192 Dwords cleaner shader.
+ * To turn this shader program on for complitaion change this to main and
lower shader main to main_1
+ *
+ * MI300 : Clear SGPRs, VGPRs and LDS
+ * Uses two kernels launched separately:
+ * 1. Clean VGPRs, LDS, and lower SGPRs
+ *Launches one workgroup per CU, each workgroup with 4x wave64 per
SIMD in the CU
+ *Waves are "wave64" and have 128 VGPRs each, which uses all 512 VGPRs
per SIMD
+ *Waves in the workgroup share the 64KB of LDS
+ *Each wave clears SGPRs 0 - 95. Because there are 4 waves/SIMD, this
is physical SGPRs 0-383
+ *Each wave clears 128 VGPRs, so all 512 in the SIMD
+ *The first wave of the workgroup clears its 64KB of LDS
+ *The shader starts with "S_BARRIER" to ensure SPI has launched all
waves of the workgroup
+ * before any wave in the workgroup could end. Without this, it is
possible not all SGPRs get cleared.
+ *2. Clean remaining SGPRs
+ *Launches a workgroup with 24 waves per workgroup, yielding 6 waves
per SIMD in each CU
+ *Waves are allocating 96 SGPRs
+ * CP sets up SPI_RESOURCE_RESERVE_* registers to prevent these waves
from allocating SGPRs 0-223.
+ * As such, these 6 waves per SIMD are allocated physical SGPRs
224-799
+ * Barriers do not work for >16 waves per workgroup, so we cannot start
with S_BARRIER
+ * Instead, the shader starts with an S_SETHALT 1. Once all waves are
launched CP will send unhalt command
+ * The shader then clears all SGPRs allocated to it, cleaning out
physical SGPRs 224-799
+ */
shader main
asic(MI300)
type(CS)
wave_size(64)
-// Note: original source code from SQ team
-// (theorhetical fastest = ~512clks vgpr + 1536 lds + ~128 sgpr = 2176 clks)
+/*
+ * Note: original source code from SQ team
+ *
+ * (theorhetical fastest = ~512clks vgpr + 1536 lds + ~128 sgpr = 2176 clks)
+ */
- s_cmp_eq_u32 s0, 1// Bit0 is set, sgpr0 is
set then clear VGPRS and LDS as
[PATCH 1/3] drm/amdgpu: Refactor cleaner shader initialization in amdgpu
This commit refactors the cleaner shader initialization process. The
changes remove unnecessary checks for adev->gfx.enable_cleaner_shader in
the amdgpu_gfx_cleaner_shader_sw_init,
amdgpu_gfx_cleaner_shader_sw_fini, and amdgpu_gfx_cleaner_shader_init
functions. These checks are now performed before these functions are
called, which simplifies the functions and makes the control flow of the
program clearer.
Additionally, the cleaner_shader_size and cleaner_shader_ptr parameters
have been removed from the amdgpu_gfx_cleaner_shader_sw_init and
amdgpu_gfx_cleaner_shader_init functions. These values are now obtained
directly from the adev->gfx structure inside the functions.
Fixes: 63063b6c5a8d ("drm/amdgpu: Add infrastructure for Cleaner Shader
feature")
Cc: Christian König
Cc: Alex Deucher
Signed-off-by: Srinivasan Shanmugam
Suggested-by: Christian König
---
drivers/gpu/drm/amd/amdgpu/amdgpu_gfx.c | 21 ++---
drivers/gpu/drm/amd/amdgpu/amdgpu_gfx.h | 7 ++-
2 files changed, 8 insertions(+), 20 deletions(-)
diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_gfx.c
b/drivers/gpu/drm/amd/amdgpu/amdgpu_gfx.c
index 83e54697f0ee..9891114ae6d4 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_gfx.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_gfx.c
@@ -1655,13 +1655,10 @@ void amdgpu_gfx_sysfs_isolation_shader_fini(struct
amdgpu_device *adev)
device_remove_file(adev->dev, &dev_attr_run_cleaner_shader);
}
-int amdgpu_gfx_cleaner_shader_sw_init(struct amdgpu_device *adev,
- unsigned int cleaner_shader_size)
+int amdgpu_gfx_cleaner_shader_sw_init(struct amdgpu_device *adev)
{
- if (!adev->gfx.enable_cleaner_shader)
- return -EOPNOTSUPP;
- return amdgpu_bo_create_kernel(adev, cleaner_shader_size, PAGE_SIZE,
+ return amdgpu_bo_create_kernel(adev, adev->gfx.cleaner_shader_size,
PAGE_SIZE,
AMDGPU_GEM_DOMAIN_VRAM |
AMDGPU_GEM_DOMAIN_GTT,
&adev->gfx.cleaner_shader_obj,
&adev->gfx.cleaner_shader_gpu_addr,
@@ -1670,24 +1667,18 @@ int amdgpu_gfx_cleaner_shader_sw_init(struct
amdgpu_device *adev,
void amdgpu_gfx_cleaner_shader_sw_fini(struct amdgpu_device *adev)
{
- if (!adev->gfx.enable_cleaner_shader)
- return;
amdgpu_bo_free_kernel(&adev->gfx.cleaner_shader_obj,
&adev->gfx.cleaner_shader_gpu_addr,
(void **)&adev->gfx.cleaner_shader_cpu_ptr);
}
-void amdgpu_gfx_cleaner_shader_init(struct amdgpu_device *adev,
- unsigned int cleaner_shader_size,
- const void *cleaner_shader_ptr)
+void amdgpu_gfx_cleaner_shader_init(struct amdgpu_device *adev)
{
- if (!adev->gfx.enable_cleaner_shader)
- return;
- if (adev->gfx.cleaner_shader_cpu_ptr && cleaner_shader_ptr)
- memcpy_toio(adev->gfx.cleaner_shader_cpu_ptr,
cleaner_shader_ptr,
- cleaner_shader_size);
+ if (adev->gfx.cleaner_shader_cpu_ptr && adev->gfx.cleaner_shader_ptr)
+ memcpy_toio(adev->gfx.cleaner_shader_cpu_ptr,
adev->gfx.cleaner_shader_ptr,
+ adev->gfx.cleaner_shader_size);
}
/**
diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_gfx.h
b/drivers/gpu/drm/amd/amdgpu/amdgpu_gfx.h
index 5644e10a86a9..07bd27c066c3 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_gfx.h
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_gfx.h
@@ -573,12 +573,9 @@ void amdgpu_gfx_ras_error_func(struct amdgpu_device *adev,
void *ras_error_status,
void (*func)(struct amdgpu_device *adev, void *ras_error_status,
int xcc_id));
-int amdgpu_gfx_cleaner_shader_sw_init(struct amdgpu_device *adev,
- unsigned int cleaner_shader_size);
+int amdgpu_gfx_cleaner_shader_sw_init(struct amdgpu_device *adev);
void amdgpu_gfx_cleaner_shader_sw_fini(struct amdgpu_device *adev);
-void amdgpu_gfx_cleaner_shader_init(struct amdgpu_device *adev,
- unsigned int cleaner_shader_size,
- const void *cleaner_shader_ptr);
+void amdgpu_gfx_cleaner_shader_init(struct amdgpu_device *adev);
int amdgpu_gfx_sysfs_isolation_shader_init(struct amdgpu_device *adev);
void amdgpu_gfx_sysfs_isolation_shader_fini(struct amdgpu_device *adev);
void amdgpu_gfx_enforce_isolation_handler(struct work_struct *work);
--
2.34.1
[PATCH 2/3] drm/amdgpu/gfx9: Refactor cleaner shader initialization for GFX9
This commit modifies the initialization only if the cleaner shader
object has been allocated. This is done by adding checks for
adev->gfx.cleaner_shader_obj before calling
amdgpu_gfx_cleaner_shader_init
The changes are made in the gfx_v9_0_hw_init functions These functions
are responsible for initializing software components of the GFX v9.0.
This change prevents unnecessary function calls and makes the control
flow of the program clearer. It also ensures that the cleaner shader is
only initialized when it has been properly allocated.
Fixes: 776ad43d4170 ("drm/amdgpu/gfx9: Implement cleaner shader support for
GFX9 hardware")
Cc: Christian König
Cc: Alex Deucher
Suggested-by: Christian König
Signed-off-by: Srinivasan Shanmugam
---
drivers/gpu/drm/amd/amdgpu/gfx_v9_0.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/drivers/gpu/drm/amd/amdgpu/gfx_v9_0.c
b/drivers/gpu/drm/amd/amdgpu/gfx_v9_0.c
index 23f0573ae47b..d6d07cfd279e 100644
--- a/drivers/gpu/drm/amd/amdgpu/gfx_v9_0.c
+++ b/drivers/gpu/drm/amd/amdgpu/gfx_v9_0.c
@@ -3975,8 +3975,8 @@ static int gfx_v9_0_hw_init(void *handle)
int r;
struct amdgpu_device *adev = (struct amdgpu_device *)handle;
- amdgpu_gfx_cleaner_shader_init(adev, adev->gfx.cleaner_shader_size,
- adev->gfx.cleaner_shader_ptr);
+ if (adev->gfx.cleaner_shader_obj)
+ amdgpu_gfx_cleaner_shader_init(adev);
if (!amdgpu_sriov_vf(adev))
gfx_v9_0_init_golden_registers(adev);
--
2.34.1
[PATCH 3/3] drm/amdgpu/gfx9: Refactor cleaner shader initialization for GFX9.4.3
This commit modifies the initialization only if the cleaner shader
object has been allocated. This is done by adding checks for
adev->gfx.cleaner_shader_obj before calling
amdgpu_gfx_cleaner_shader_init
The changes are made in the gfx_v9_4_3_sw_init, gfx_v9_4_3_sw_fini, and
gfx_v9_4_3_hw_init functions. These functions are responsible for
initializing software components of the GFX v9.4.3 engines.
This change prevents unnecessary function calls and makes the control
flow of the program clearer. It also ensures that the cleaner shader is
only initialized when it has been properly allocated.
Fixes: 1b66421d29b7 ("drm/amdgpu/gfx9: Implement cleaner shader support for
GFX9.4.3 hardware")
Cc: Christian König
Cc: Alex Deucher
Suggested-by: Christian König
Signed-off-by: Srinivasan Shanmugam
---
drivers/gpu/drm/amd/amdgpu/gfx_v9_4_3.c | 17 ++---
1 file changed, 10 insertions(+), 7 deletions(-)
diff --git a/drivers/gpu/drm/amd/amdgpu/gfx_v9_4_3.c
b/drivers/gpu/drm/amd/amdgpu/gfx_v9_4_3.c
index 408e5600bb61..abf934863421 100644
--- a/drivers/gpu/drm/amd/amdgpu/gfx_v9_4_3.c
+++ b/drivers/gpu/drm/amd/amdgpu/gfx_v9_4_3.c
@@ -1061,10 +1061,12 @@ static int gfx_v9_4_3_sw_init(void *handle)
adev->gfx.cleaner_shader_size =
sizeof(gfx_9_4_3_cleaner_shader_hex);
if (adev->gfx.mec_fw_version >= 153) {
adev->gfx.enable_cleaner_shader = true;
- r = amdgpu_gfx_cleaner_shader_sw_init(adev,
adev->gfx.cleaner_shader_size);
- if (r) {
- adev->gfx.enable_cleaner_shader = false;
- dev_err(adev->dev, "Failed to initialize
cleaner shader\n");
+ if (adev->gfx.cleaner_shader_obj) {
+ r = amdgpu_gfx_cleaner_shader_sw_init(adev);
+ if (r) {
+ adev->gfx.enable_cleaner_shader = false;
+ dev_err(adev->dev, "Failed to
initialize cleaner shader\n");
+ }
}
}
break;
@@ -1196,7 +1198,8 @@ static int gfx_v9_4_3_sw_fini(void *handle)
amdgpu_gfx_kiq_fini(adev, i);
}
- amdgpu_gfx_cleaner_shader_sw_fini(adev);
+ if (adev->gfx.cleaner_shader_obj)
+ amdgpu_gfx_cleaner_shader_sw_fini(adev);
gfx_v9_4_3_mec_fini(adev);
amdgpu_bo_unref(&adev->gfx.rlc.clear_state_obj);
@@ -2344,8 +2347,8 @@ static int gfx_v9_4_3_hw_init(void *handle)
int r;
struct amdgpu_device *adev = (struct amdgpu_device *)handle;
- amdgpu_gfx_cleaner_shader_init(adev, adev->gfx.cleaner_shader_size,
- adev->gfx.cleaner_shader_ptr);
+ if (adev->gfx.cleaner_shader_obj)
+ amdgpu_gfx_cleaner_shader_init(adev);
if (!amdgpu_sriov_vf(adev))
gfx_v9_4_3_init_golden_registers(adev);
--
2.34.1
[PATCH v2] drm/amd/display: Fix 'panel_cntl' could be null in 'dcn21_set_backlight_level()'
'panel_cntl' structure used to control the display panel could be null,
dereferencing it could lead to a null pointer access.
Fixes the below:
drivers/gpu/drm/amd/amdgpu/../display/dc/hwss/dcn21/dcn21_hwseq.c:269
dcn21_set_backlight_level() error: we previously assumed 'panel_cntl' could be
null (see line 250)
Fixes: 474ac4a875ca ("drm/amd/display: Implement some asic specific abm call
backs.")
Cc: Yongqiang Sun
Cc: Anthony Koo
Cc: Rodrigo Siqueira
Cc: Aurabindo Pillai
Signed-off-by: Srinivasan Shanmugam
---
v2:
- Add NULL check for timing generator also which controls CRTC (Anthony)
.../amd/display/dc/hwss/dcn21/dcn21_hwseq.c | 39 ++-
1 file changed, 20 insertions(+), 19 deletions(-)
diff --git a/drivers/gpu/drm/amd/display/dc/hwss/dcn21/dcn21_hwseq.c
b/drivers/gpu/drm/amd/display/dc/hwss/dcn21/dcn21_hwseq.c
index 8e88dcaf88f5..5d2d8fd64d98 100644
--- a/drivers/gpu/drm/amd/display/dc/hwss/dcn21/dcn21_hwseq.c
+++ b/drivers/gpu/drm/amd/display/dc/hwss/dcn21/dcn21_hwseq.c
@@ -237,34 +237,35 @@ bool dcn21_set_backlight_level(struct pipe_ctx *pipe_ctx,
{
struct dc_context *dc = pipe_ctx->stream->ctx;
struct abm *abm = pipe_ctx->stream_res.abm;
+ struct timing_generator *tg = pipe_ctx->stream_res.tg;
struct panel_cntl *panel_cntl = pipe_ctx->stream->link->panel_cntl;
+ u32 otg_inst;
+
+ if (!abm && !tg && !panel_cntl)
+ return false;
+
+ otg_inst = tg->inst;
if (dc->dc->res_pool->dmcu) {
dce110_set_backlight_level(pipe_ctx, backlight_pwm_u16_16,
frame_ramp);
return true;
}
- if (abm != NULL) {
- uint32_t otg_inst = pipe_ctx->stream_res.tg->inst;
-
- if (abm && panel_cntl) {
- if (abm->funcs && abm->funcs->set_pipe_ex) {
- abm->funcs->set_pipe_ex(abm,
- otg_inst,
- SET_ABM_PIPE_NORMAL,
- panel_cntl->inst,
- panel_cntl->pwrseq_inst);
- } else {
- dmub_abm_set_pipe(abm,
- otg_inst,
- SET_ABM_PIPE_NORMAL,
- panel_cntl->inst,
-
panel_cntl->pwrseq_inst);
- }
- }
+ if (abm->funcs && abm->funcs->set_pipe_ex) {
+ abm->funcs->set_pipe_ex(abm,
+ otg_inst,
+ SET_ABM_PIPE_NORMAL,
+ panel_cntl->inst,
+ panel_cntl->pwrseq_inst);
+ } else {
+ dmub_abm_set_pipe(abm,
+ otg_inst,
+ SET_ABM_PIPE_NORMAL,
+ panel_cntl->inst,
+ panel_cntl->pwrseq_inst);
}
- if (abm && abm->funcs && abm->funcs->set_backlight_level_pwm)
+ if (abm->funcs && abm->funcs->set_backlight_level_pwm)
abm->funcs->set_backlight_level_pwm(abm, backlight_pwm_u16_16,
frame_ramp, 0, panel_cntl->inst);
else
--
2.34.1
[PATCH] drm/amd/display: Add NULL test for 'timing generator' in 'dcn21_set_pipe()'
In "u32 otg_inst = pipe_ctx->stream_res.tg->inst;"
pipe_ctx->stream_res.tg could be NULL, it is relying on the caller to
ensure the tg is not NULL.
Fixes: 474ac4a875ca ("drm/amd/display: Implement some asic specific abm call
backs.")
Cc: Yongqiang Sun
Cc: Anthony Koo
Cc: Rodrigo Siqueira
Cc: Aurabindo Pillai
Signed-off-by: Srinivasan Shanmugam
---
.../amd/display/dc/hwss/dcn21/dcn21_hwseq.c | 24 +++
1 file changed, 14 insertions(+), 10 deletions(-)
diff --git a/drivers/gpu/drm/amd/display/dc/hwss/dcn21/dcn21_hwseq.c
b/drivers/gpu/drm/amd/display/dc/hwss/dcn21/dcn21_hwseq.c
index 5d2d8fd64d98..4e21af0942ea 100644
--- a/drivers/gpu/drm/amd/display/dc/hwss/dcn21/dcn21_hwseq.c
+++ b/drivers/gpu/drm/amd/display/dc/hwss/dcn21/dcn21_hwseq.c
@@ -206,28 +206,32 @@ void dcn21_set_abm_immediate_disable(struct pipe_ctx
*pipe_ctx)
void dcn21_set_pipe(struct pipe_ctx *pipe_ctx)
{
struct abm *abm = pipe_ctx->stream_res.abm;
- uint32_t otg_inst = pipe_ctx->stream_res.tg->inst;
+ struct timing_generator *tg = pipe_ctx->stream_res.tg;
struct panel_cntl *panel_cntl = pipe_ctx->stream->link->panel_cntl;
struct dmcu *dmcu = pipe_ctx->stream->ctx->dc->res_pool->dmcu;
+ u32 otg_inst;
+
+ if (!abm && !tg && !panel_cntl)
+ return;
+
+ otg_inst = tg->inst;
if (dmcu) {
dce110_set_pipe(pipe_ctx);
return;
}
- if (abm && panel_cntl) {
- if (abm->funcs && abm->funcs->set_pipe_ex) {
- abm->funcs->set_pipe_ex(abm,
+ if (abm->funcs && abm->funcs->set_pipe_ex) {
+ abm->funcs->set_pipe_ex(abm,
otg_inst,
SET_ABM_PIPE_NORMAL,
panel_cntl->inst,
panel_cntl->pwrseq_inst);
- } else {
- dmub_abm_set_pipe(abm, otg_inst,
- SET_ABM_PIPE_NORMAL,
- panel_cntl->inst,
- panel_cntl->pwrseq_inst);
- }
+ } else {
+ dmub_abm_set_pipe(abm, otg_inst,
+ SET_ABM_PIPE_NORMAL,
+ panel_cntl->inst,
+ panel_cntl->pwrseq_inst);
}
}
--
2.34.1
[PATCH v3] drm/amd/display: Fix 'panel_cntl' could be null in 'dcn21_set_backlight_level()'
'panel_cntl' structure used to control the display panel could be null,
dereferencing it could lead to a null pointer access.
Fixes the below:
drivers/gpu/drm/amd/amdgpu/../display/dc/hwss/dcn21/dcn21_hwseq.c:269
dcn21_set_backlight_level() error: we previously assumed 'panel_cntl' could be
null (see line 250)
Fixes: 474ac4a875ca ("drm/amd/display: Implement some asic specific abm call
backs.")
Cc: Yongqiang Sun
Cc: Anthony Koo
Cc: Rodrigo Siqueira
Cc: Aurabindo Pillai
Signed-off-by: Srinivasan Shanmugam
---
v3:
- s/u32/uint32_t for consistency (Anthony)
.../amd/display/dc/hwss/dcn21/dcn21_hwseq.c | 39 ++-
1 file changed, 20 insertions(+), 19 deletions(-)
diff --git a/drivers/gpu/drm/amd/display/dc/hwss/dcn21/dcn21_hwseq.c
b/drivers/gpu/drm/amd/display/dc/hwss/dcn21/dcn21_hwseq.c
index 8323077bba15..5c7f380a84f9 100644
--- a/drivers/gpu/drm/amd/display/dc/hwss/dcn21/dcn21_hwseq.c
+++ b/drivers/gpu/drm/amd/display/dc/hwss/dcn21/dcn21_hwseq.c
@@ -241,34 +241,35 @@ bool dcn21_set_backlight_level(struct pipe_ctx *pipe_ctx,
{
struct dc_context *dc = pipe_ctx->stream->ctx;
struct abm *abm = pipe_ctx->stream_res.abm;
+ struct timing_generator *tg = pipe_ctx->stream_res.tg;
struct panel_cntl *panel_cntl = pipe_ctx->stream->link->panel_cntl;
+ uint32_t otg_inst;
+
+ if (!abm && !tg && !panel_cntl)
+ return false;
+
+ otg_inst = tg->inst;
if (dc->dc->res_pool->dmcu) {
dce110_set_backlight_level(pipe_ctx, backlight_pwm_u16_16,
frame_ramp);
return true;
}
- if (abm != NULL) {
- uint32_t otg_inst = pipe_ctx->stream_res.tg->inst;
-
- if (abm && panel_cntl) {
- if (abm->funcs && abm->funcs->set_pipe_ex) {
- abm->funcs->set_pipe_ex(abm,
- otg_inst,
- SET_ABM_PIPE_NORMAL,
- panel_cntl->inst,
- panel_cntl->pwrseq_inst);
- } else {
- dmub_abm_set_pipe(abm,
- otg_inst,
- SET_ABM_PIPE_NORMAL,
- panel_cntl->inst,
-
panel_cntl->pwrseq_inst);
- }
- }
+ if (abm->funcs && abm->funcs->set_pipe_ex) {
+ abm->funcs->set_pipe_ex(abm,
+ otg_inst,
+ SET_ABM_PIPE_NORMAL,
+ panel_cntl->inst,
+ panel_cntl->pwrseq_inst);
+ } else {
+ dmub_abm_set_pipe(abm,
+ otg_inst,
+ SET_ABM_PIPE_NORMAL,
+ panel_cntl->inst,
+ panel_cntl->pwrseq_inst);
}
- if (abm && abm->funcs && abm->funcs->set_backlight_level_pwm)
+ if (abm->funcs && abm->funcs->set_backlight_level_pwm)
abm->funcs->set_backlight_level_pwm(abm, backlight_pwm_u16_16,
frame_ramp, 0, panel_cntl->inst);
else
--
2.34.1
[PATCH v2] drm/amd/display: Add NULL test for 'timing generator' in 'dcn21_set_pipe()'
In "u32 otg_inst = pipe_ctx->stream_res.tg->inst;"
pipe_ctx->stream_res.tg could be NULL, it is relying on the caller to
ensure the tg is not NULL.
Fixes: 474ac4a875ca ("drm/amd/display: Implement some asic specific abm call
backs.")
Cc: Yongqiang Sun
Cc: Anthony Koo
Cc: Rodrigo Siqueira
Cc: Aurabindo Pillai
Signed-off-by: Srinivasan Shanmugam
---
v2:
- s/u32/uint32_t for consistency (Anthony)
.../amd/display/dc/hwss/dcn21/dcn21_hwseq.c | 24 +++
1 file changed, 14 insertions(+), 10 deletions(-)
diff --git a/drivers/gpu/drm/amd/display/dc/hwss/dcn21/dcn21_hwseq.c
b/drivers/gpu/drm/amd/display/dc/hwss/dcn21/dcn21_hwseq.c
index 8e88dcaf88f5..8323077bba15 100644
--- a/drivers/gpu/drm/amd/display/dc/hwss/dcn21/dcn21_hwseq.c
+++ b/drivers/gpu/drm/amd/display/dc/hwss/dcn21/dcn21_hwseq.c
@@ -206,28 +206,32 @@ void dcn21_set_abm_immediate_disable(struct pipe_ctx
*pipe_ctx)
void dcn21_set_pipe(struct pipe_ctx *pipe_ctx)
{
struct abm *abm = pipe_ctx->stream_res.abm;
- uint32_t otg_inst = pipe_ctx->stream_res.tg->inst;
+ struct timing_generator *tg = pipe_ctx->stream_res.tg;
struct panel_cntl *panel_cntl = pipe_ctx->stream->link->panel_cntl;
struct dmcu *dmcu = pipe_ctx->stream->ctx->dc->res_pool->dmcu;
+ uint32_t otg_inst;
+
+ if (!abm && !tg && !panel_cntl)
+ return;
+
+ otg_inst = tg->inst;
if (dmcu) {
dce110_set_pipe(pipe_ctx);
return;
}
- if (abm && panel_cntl) {
- if (abm->funcs && abm->funcs->set_pipe_ex) {
- abm->funcs->set_pipe_ex(abm,
+ if (abm->funcs && abm->funcs->set_pipe_ex) {
+ abm->funcs->set_pipe_ex(abm,
otg_inst,
SET_ABM_PIPE_NORMAL,
panel_cntl->inst,
panel_cntl->pwrseq_inst);
- } else {
- dmub_abm_set_pipe(abm, otg_inst,
- SET_ABM_PIPE_NORMAL,
- panel_cntl->inst,
- panel_cntl->pwrseq_inst);
- }
+ } else {
+ dmub_abm_set_pipe(abm, otg_inst,
+ SET_ABM_PIPE_NORMAL,
+ panel_cntl->inst,
+ panel_cntl->pwrseq_inst);
}
}
--
2.34.1
[PATCH] drm/amdgpu: Fix potential out-of-bounds access in 'amdgpu_discovery_reg_base_init()'
The issue arises when the array 'adev->vcn.vcn_config' is accessed
before checking if the index 'adev->vcn.num_vcn_inst' is within the
bounds of the array.
The fix involves moving the bounds check before the array access. This
ensures that 'adev->vcn.num_vcn_inst' is within the bounds of the array
before it is used as an index.
Fixes the below:
drivers/gpu/drm/amd/amdgpu/amdgpu_discovery.c:1289
amdgpu_discovery_reg_base_init() error: testing array offset
'adev->vcn.num_vcn_inst' after use.
Cc: Christian König
Cc: Alex Deucher
Signed-off-by: Srinivasan Shanmugam
---
drivers/gpu/drm/amd/amdgpu/amdgpu_discovery.c | 6 +++---
1 file changed, 3 insertions(+), 3 deletions(-)
diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_discovery.c
b/drivers/gpu/drm/amd/amdgpu/amdgpu_discovery.c
index ef800590c1ab..83da46d73f70 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_discovery.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_discovery.c
@@ -1282,11 +1282,11 @@ static int amdgpu_discovery_reg_base_init(struct
amdgpu_device *adev)
* 0b10 : encode is disabled
* 0b01 : decode is disabled
*/
- adev->vcn.vcn_config[adev->vcn.num_vcn_inst] =
- ip->revision & 0xc0;
- ip->revision &= ~0xc0;
if (adev->vcn.num_vcn_inst <
AMDGPU_MAX_VCN_INSTANCES) {
+
adev->vcn.vcn_config[adev->vcn.num_vcn_inst] =
+ ip->revision & 0xc0;
+ ip->revision &= ~0xc0;
adev->vcn.num_vcn_inst++;
adev->vcn.inst_mask |=
(1U << ip->instance_number);
--
2.34.1
[PATCH v2] drm/amdgpu: Fix potential out-of-bounds access in 'amdgpu_discovery_reg_base_init()'
The issue arises when the array 'adev->vcn.vcn_config' is accessed
before checking if the index 'adev->vcn.num_vcn_inst' is within the
bounds of the array.
The fix involves moving the bounds check before the array access. This
ensures that 'adev->vcn.num_vcn_inst' is within the bounds of the array
before it is used as an index.
Fixes the below:
drivers/gpu/drm/amd/amdgpu/amdgpu_discovery.c:1289
amdgpu_discovery_reg_base_init() error: testing array offset
'adev->vcn.num_vcn_inst' after use.
Cc: Christian König
Cc: Alex Deucher
Signed-off-by: Srinivasan Shanmugam
---
v2:
- `ip->revision &= ~0xc0;` should always be executed, not just if the number
of instances < MAX_VCN_INSTANCES. (Alex)
drivers/gpu/drm/amd/amdgpu/amdgpu_discovery.c | 6 +++---
1 file changed, 3 insertions(+), 3 deletions(-)
diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_discovery.c
b/drivers/gpu/drm/amd/amdgpu/amdgpu_discovery.c
index ef800590c1ab..93c84a1c1d3e 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_discovery.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_discovery.c
@@ -1282,11 +1282,10 @@ static int amdgpu_discovery_reg_base_init(struct
amdgpu_device *adev)
* 0b10 : encode is disabled
* 0b01 : decode is disabled
*/
- adev->vcn.vcn_config[adev->vcn.num_vcn_inst] =
- ip->revision & 0xc0;
- ip->revision &= ~0xc0;
if (adev->vcn.num_vcn_inst <
AMDGPU_MAX_VCN_INSTANCES) {
+
adev->vcn.vcn_config[adev->vcn.num_vcn_inst] =
+ ip->revision & 0xc0;
adev->vcn.num_vcn_inst++;
adev->vcn.inst_mask |=
(1U << ip->instance_number);
@@ -1297,6 +1296,7 @@ static int amdgpu_discovery_reg_base_init(struct
amdgpu_device *adev)
adev->vcn.num_vcn_inst + 1,
AMDGPU_MAX_VCN_INSTANCES);
}
+ ip->revision &= ~0xc0;
}
if (le16_to_cpu(ip->hw_id) == SDMA0_HWID ||
le16_to_cpu(ip->hw_id) == SDMA1_HWID ||
--
2.34.1
[PATCH v3] drm/amdgpu: Fix potential out-of-bounds access in 'amdgpu_discovery_reg_base_init()'
The issue arises when the array 'adev->vcn.vcn_config' is accessed
before checking if the index 'adev->vcn.num_vcn_inst' is within the
bounds of the array.
The fix involves moving the bounds check before the array access. This
ensures that 'adev->vcn.num_vcn_inst' is within the bounds of the array
before it is used as an index.
Fixes the below:
drivers/gpu/drm/amd/amdgpu/amdgpu_discovery.c:1289
amdgpu_discovery_reg_base_init() error: testing array offset
'adev->vcn.num_vcn_inst' after use.
Fixes: aaf1090a6cb6 ("drm/amdgpu: Add instance mask for VCN and JPEG")
Cc: Christian König
Cc: Alex Deucher
Signed-off-by: Srinivasan Shanmugam
---
v3:
- Added fixes tag.
drivers/gpu/drm/amd/amdgpu/amdgpu_discovery.c | 6 +++---
1 file changed, 3 insertions(+), 3 deletions(-)
diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_discovery.c
b/drivers/gpu/drm/amd/amdgpu/amdgpu_discovery.c
index ef800590c1ab..93c84a1c1d3e 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_discovery.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_discovery.c
@@ -1282,11 +1282,10 @@ static int amdgpu_discovery_reg_base_init(struct
amdgpu_device *adev)
* 0b10 : encode is disabled
* 0b01 : decode is disabled
*/
- adev->vcn.vcn_config[adev->vcn.num_vcn_inst] =
- ip->revision & 0xc0;
- ip->revision &= ~0xc0;
if (adev->vcn.num_vcn_inst <
AMDGPU_MAX_VCN_INSTANCES) {
+
adev->vcn.vcn_config[adev->vcn.num_vcn_inst] =
+ ip->revision & 0xc0;
adev->vcn.num_vcn_inst++;
adev->vcn.inst_mask |=
(1U << ip->instance_number);
@@ -1297,6 +1296,7 @@ static int amdgpu_discovery_reg_base_init(struct
amdgpu_device *adev)
adev->vcn.num_vcn_inst + 1,
AMDGPU_MAX_VCN_INSTANCES);
}
+ ip->revision &= ~0xc0;
}
if (le16_to_cpu(ip->hw_id) == SDMA0_HWID ||
le16_to_cpu(ip->hw_id) == SDMA1_HWID ||
--
2.34.1
[PATCH] drm/amd/display: Implement bounds check for stream encoder creation in DCN301
'stream_enc_regs' array is an array of dcn10_stream_enc_registers
structures. The array is initialized with four elements, corresponding
to the four calls to stream_enc_regs() in the array initializer. This
means that valid indices for this array are 0, 1, 2, and 3.
The error message 'stream_enc_regs' 4 <= 5 below, is indicating that
there is an attempt to access this array with an index of 5, which is
out of bounds. This could lead to undefined behavior
Here, eng_id is used as an index to access the stream_enc_regs array. If
eng_id is 5, this would result in an out-of-bounds access.
Fixes the below:
drivers/gpu/drm/amd/amdgpu/../display/dc/resource/dcn301/dcn301_resource.c:1011
dcn301_stream_encoder_create() error: buffer overflow 'stream_enc_regs' 4 <= 5
Fixes: 3a83e4e64bb1 ("drm/amd/display: Add dcn3.01 support to DC (v2)")
Cc: Roman Li
Cc: Rodrigo Siqueira
Cc: Aurabindo Pillai
Signed-off-by: Srinivasan Shanmugam
---
.../display/dc/resource/dcn301/dcn301_resource.c | 16
1 file changed, 12 insertions(+), 4 deletions(-)
diff --git a/drivers/gpu/drm/amd/display/dc/resource/dcn301/dcn301_resource.c
b/drivers/gpu/drm/amd/display/dc/resource/dcn301/dcn301_resource.c
index 511ff6b5b985..f915d7c3980e 100644
--- a/drivers/gpu/drm/amd/display/dc/resource/dcn301/dcn301_resource.c
+++ b/drivers/gpu/drm/amd/display/dc/resource/dcn301/dcn301_resource.c
@@ -1006,10 +1006,18 @@ static struct stream_encoder
*dcn301_stream_encoder_create(enum engine_id eng_id
return NULL;
}
- dcn30_dio_stream_encoder_construct(enc1, ctx, ctx->dc_bios,
- eng_id, vpg, afmt,
- &stream_enc_regs[eng_id],
- &se_shift, &se_mask);
+ if (eng_id < ARRAY_SIZE(stream_enc_regs)) {
+ dcn30_dio_stream_encoder_construct(enc1, ctx, ctx->dc_bios,
+ eng_id, vpg, afmt,
+ &stream_enc_regs[eng_id],
+ &se_shift, &se_mask);
+ } else {
+ DRM_ERROR("Invalid engine id: %d\n", eng_id);
+ kfree(enc1);
+ kfree(vpg);
+ kfree(afmt);
+ return NULL;
+ }
return &enc1->base;
}
--
2.34.1
[PATCH v2] drm/amd/display: Implement bounds check for stream encoder creation in DCN301
'stream_enc_regs' array is an array of dcn10_stream_enc_registers
structures. The array is initialized with four elements, corresponding
to the four calls to stream_enc_regs() in the array initializer. This
means that valid indices for this array are 0, 1, 2, and 3.
The error message 'stream_enc_regs' 4 <= 5 below, is indicating that
there is an attempt to access this array with an index of 5, which is
out of bounds. This could lead to undefined behavior
Here, eng_id is used as an index to access the stream_enc_regs array. If
eng_id is 5, this would result in an out-of-bounds access on the
stream_enc_regs array.
Thus fixing Buffer overflow error in dcn301_stream_encoder_create
reported by Smatch:
drivers/gpu/drm/amd/amdgpu/../display/dc/resource/dcn301/dcn301_resource.c:1011
dcn301_stream_encoder_create() error: buffer overflow 'stream_enc_regs' 4 <= 5
Fixes: 3a83e4e64bb1 ("drm/amd/display: Add dcn3.01 support to DC (v2)")
Cc: Roman Li
Cc: Rodrigo Siqueira
Cc: Aurabindo Pillai
Signed-off-by: Srinivasan Shanmugam
---
.../drm/amd/display/dc/resource/dcn301/dcn301_resource.c | 9 -
1 file changed, 4 insertions(+), 5 deletions(-)
diff --git a/drivers/gpu/drm/amd/display/dc/resource/dcn301/dcn301_resource.c
b/drivers/gpu/drm/amd/display/dc/resource/dcn301/dcn301_resource.c
index 511ff6b5b985..4a475a723191 100644
--- a/drivers/gpu/drm/amd/display/dc/resource/dcn301/dcn301_resource.c
+++ b/drivers/gpu/drm/amd/display/dc/resource/dcn301/dcn301_resource.c
@@ -999,7 +999,7 @@ static struct stream_encoder
*dcn301_stream_encoder_create(enum engine_id eng_id
vpg = dcn301_vpg_create(ctx, vpg_inst);
afmt = dcn301_afmt_create(ctx, afmt_inst);
- if (!enc1 || !vpg || !afmt) {
+ if (!enc1 || !vpg || !afmt || eng_id >= ARRAY_SIZE(stream_enc_regs)) {
kfree(enc1);
kfree(vpg);
kfree(afmt);
@@ -1007,10 +1007,9 @@ static struct stream_encoder
*dcn301_stream_encoder_create(enum engine_id eng_id
}
dcn30_dio_stream_encoder_construct(enc1, ctx, ctx->dc_bios,
- eng_id, vpg, afmt,
- &stream_enc_regs[eng_id],
- &se_shift, &se_mask);
-
+ eng_id, vpg, afmt,
+ &stream_enc_regs[eng_id],
+ &se_shift, &se_mask);
return &enc1->base;
}
--
2.34.1
[PATCH] drm/amd/display: Initialize 'wait_time_microsec' variable in link_dp_training_dpia.c
wait_time_microsec = max(wait_time_microsec, (uint32_t)
DPIA_CLK_SYNC_DELAY);
Above line is trying to assign the maximum value between
'wait_time_microsec' and 'DPIA_CLK_SYNC_DELAY' to wait_time_microsec.
However, 'wait_time_microsec' has not been assigned a value before this
line, initialize 'wait_time_microsec' at the point of declaration.
Fixes the below:
drivers/gpu/drm/amd/amdgpu/../display/dc/link/protocols/link_dp_training_dpia.c:697
dpia_training_eq_non_transparent() error: uninitialized symbol
'wait_time_microsec'.
Fixes: 630168a97314 ("drm/amd/display: move dp link training logic to
link_dp_training")
Cc: Wenjing Liu
Cc: Rodrigo Siqueira
Cc: Aurabindo Pillai
Signed-off-by: Srinivasan Shanmugam
---
.../drm/amd/display/dc/link/protocols/link_dp_training_dpia.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git
a/drivers/gpu/drm/amd/display/dc/link/protocols/link_dp_training_dpia.c
b/drivers/gpu/drm/amd/display/dc/link/protocols/link_dp_training_dpia.c
index e8dda44b23cb..5d36bab0029c 100644
--- a/drivers/gpu/drm/amd/display/dc/link/protocols/link_dp_training_dpia.c
+++ b/drivers/gpu/drm/amd/display/dc/link/protocols/link_dp_training_dpia.c
@@ -619,7 +619,7 @@ static enum link_training_result
dpia_training_eq_non_transparent(
uint32_t retries_eq = 0;
enum dc_status status;
enum dc_dp_training_pattern tr_pattern;
- uint32_t wait_time_microsec;
+ uint32_t wait_time_microsec = 0;
enum dc_lane_count lane_count = lt_settings->link_settings.lane_count;
union lane_align_status_updated dpcd_lane_status_updated = {0};
union lane_status dpcd_lane_status[LANE_COUNT_DP_MAX] = {0};
--
2.34.1
[PATCH] drm/amd/display: Fix possible NULL dereference on device remove/driver unload
As part of a cleanup amdgpu_dm_fini() function, which is typically
called when a device is being shut down or a driver is being unloaded
The below error message suggests that there is a potential null pointer
dereference issue with adev->dm.dc.
In the below, line of code where adev->dm.dc is used without a preceding
null check:
for (i = 0; i < adev->dm.dc->caps.max_links; i++) {
To fix this issue, add a null check for adev->dm.dc before this line.
Reported by smatch:
drivers/gpu/drm/amd/amdgpu/../display/amdgpu_dm/amdgpu_dm.c:1959
amdgpu_dm_fini() error: we previously assumed 'adev->dm.dc' could be null (see
line 1943)
Fixes: 006c26a0f1c8 ("drm/amd/display: Fix crash on device remove/driver
unload")
Cc: Andrey Grodzovsky
Cc: Harry Wentland
Cc: Rodrigo Siqueira
Cc: Aurabindo Pillai
Signed-off-by: Srinivasan Shanmugam
---
drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
index b3a5e730be24..d4c1415f4562 100644
--- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
+++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
@@ -1956,7 +1956,7 @@ static void amdgpu_dm_fini(struct amdgpu_device *adev)
&adev->dm.dmub_bo_gpu_addr,
&adev->dm.dmub_bo_cpu_addr);
- if (adev->dm.hpd_rx_offload_wq) {
+ if (adev->dm.hpd_rx_offload_wq && adev->dm.dc) {
for (i = 0; i < adev->dm.dc->caps.max_links; i++) {
if (adev->dm.hpd_rx_offload_wq[i].wq) {
destroy_workqueue(adev->dm.hpd_rx_offload_wq[i].wq);
--
2.34.1
[PATCH] drm/amd/display: Fix possible buffer overflow in 'find_dcfclk_for_voltage()'
when 'find_dcfclk_for_voltage()' function is looping over
VG_NUM_SOC_VOLTAGE_LEVELS (which is 8), but the size of the DcfClocks
array is VG_NUM_DCFCLK_DPM_LEVELS (which is 7).
When the loop variable i reaches 7, the function tries to access
clock_table->DcfClocks[7]. However, since the size of the DcfClocks
array is 7, the valid indices are 0 to 6. Index 7 is beyond the size of
the array, leading to a buffer overflow.
Fixes the below:
drivers/gpu/drm/amd/amdgpu/../display/dc/clk_mgr/dcn301/vg_clk_mgr.c:550
find_dcfclk_for_voltage() error: buffer overflow 'clock_table->DcfClocks' 7 <= 7
Fixes: 3a83e4e64bb1 ("drm/amd/display: Add dcn3.01 support to DC (v2)")
Cc: Roman Li
Cc: Rodrigo Siqueira
Cc: Aurabindo Pillai
Signed-off-by: Srinivasan Shanmugam
---
drivers/gpu/drm/amd/display/dc/clk_mgr/dcn301/vg_clk_mgr.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/drivers/gpu/drm/amd/display/dc/clk_mgr/dcn301/vg_clk_mgr.c
b/drivers/gpu/drm/amd/display/dc/clk_mgr/dcn301/vg_clk_mgr.c
index a5489fe6875f..aa9fd1dc550a 100644
--- a/drivers/gpu/drm/amd/display/dc/clk_mgr/dcn301/vg_clk_mgr.c
+++ b/drivers/gpu/drm/amd/display/dc/clk_mgr/dcn301/vg_clk_mgr.c
@@ -546,6 +546,8 @@ static unsigned int find_dcfclk_for_voltage(const struct
vg_dpm_clocks *clock_ta
int i;
for (i = 0; i < VG_NUM_SOC_VOLTAGE_LEVELS; i++) {
+ if (i >= VG_NUM_DCFCLK_DPM_LEVELS)
+ break;
if (clock_table->SocVoltage[i] == voltage)
return clock_table->DcfClocks[i];
}
--
2.34.1
[PATCH] drm/amd/display: Fix possible use of uninitialized 'max_chunks_fbc_mode' in 'calculate_bandwidth()'
'max_chunks_fbc_mode' is only declared and assigned a value under a
specific condition in the following lines:
if (data->fbc_en[i] == 1) {
max_chunks_fbc_mode = 128 - dmif_chunk_buff_margin;
}
If 'data->fbc_en[i]' is not equal to 1 for any i, max_chunks_fbc_mode
will not be initialized if it's used outside of this for loop.
Ensure that 'max_chunks_fbc_mode' is properly initialized before it's
used. Initialize it to a default value right after its declaration to
ensure that it gets a value assigned under all possible control flow
paths.
Thus fixing the below:
drivers/gpu/drm/amd/amdgpu/../display/dc/basics/dce_calcs.c:914
calculate_bandwidth() error: uninitialized symbol 'max_chunks_fbc_mode'.
drivers/gpu/drm/amd/amdgpu/../display/dc/basics/dce_calcs.c:917
calculate_bandwidth() error: uninitialized symbol 'max_chunks_fbc_mode'.
Fixes: 4562236b3bc0 ("drm/amd/dc: Add dc display driver (v2)")
Cc: Harry Wentland
Cc: Alex Deucher
Cc: Rodrigo Siqueira
Cc: Aurabindo Pillai
Signed-off-by: Srinivasan Shanmugam
---
drivers/gpu/drm/amd/display/dc/basics/dce_calcs.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/gpu/drm/amd/display/dc/basics/dce_calcs.c
b/drivers/gpu/drm/amd/display/dc/basics/dce_calcs.c
index f2dfa96f9ef5..39530b2ea495 100644
--- a/drivers/gpu/drm/amd/display/dc/basics/dce_calcs.c
+++ b/drivers/gpu/drm/amd/display/dc/basics/dce_calcs.c
@@ -94,7 +94,7 @@ static void calculate_bandwidth(
const uint32_t s_high = 7;
const uint32_t dmif_chunk_buff_margin = 1;
- uint32_t max_chunks_fbc_mode;
+ uint32_t max_chunks_fbc_mode = 0;
int32_t num_cursor_lines;
int32_t i, j, k;
--
2.34.1
[PATCH] drm/amd/display: Fix && vs || in 'edp_set_replay_allow_active()'
AND should be OR or it will lead to a NULL dereference.
Fixes the below:
drivers/gpu/drm/amd/amdgpu/../display/dc/link/protocols/link_edp_panel_control.c:895
edp_set_replay_allow_active() error: we previously assumed 'replay' could be
null (see line 887)
Fixes: c7ddc0a800bc ("drm/amd/display: Add Functions to enable Freesync Panel
Replay")
Cc: Bhawanpreet Lakha
Cc: Harry Wentland
Cc: Rodrigo Siqueira
Cc: Aurabindo Pillai
Signed-off-by: Srinivasan Shanmugam
---
.../drm/amd/display/dc/link/protocols/link_edp_panel_control.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git
a/drivers/gpu/drm/amd/display/dc/link/protocols/link_edp_panel_control.c
b/drivers/gpu/drm/amd/display/dc/link/protocols/link_edp_panel_control.c
index 443215b96308..77648228ec60 100644
--- a/drivers/gpu/drm/amd/display/dc/link/protocols/link_edp_panel_control.c
+++ b/drivers/gpu/drm/amd/display/dc/link/protocols/link_edp_panel_control.c
@@ -884,7 +884,7 @@ bool edp_set_replay_allow_active(struct dc_link *link,
const bool *allow_active,
struct dmub_replay *replay = dc->res_pool->replay;
unsigned int panel_inst;
- if (replay == NULL && force_static)
+ if (!replay || force_static)
return false;
if (!dc_get_edp_link_panel_inst(dc, link, &panel_inst))
--
2.34.1
[PATCH] drm/amdgpu/display: Initialize gamma correction mode variable in dcn30_get_gamcor_current()
The dcn30_get_gamcor_current() function is responsible for determining
the current gamma correction mode used by the display controller.
However, the 'mode' variable, which stores the gamma correction mode,
was not initialized before its first usage, leading to an uninitialized
symbol error.
Thus initializes the 'mode' variable with a default value of LUT_BYPASS
before the conditional statements in the function, improves code clarity
and stability, ensuring correct behavior of the
dcn30_get_gamcor_current() function in determining the gamma correction
mode.
Fixes the below:
drivers/gpu/drm/amd/amdgpu/../display/dc/dcn30/dcn30_dpp_cm.c:77
dpp30_get_gamcor_current() error: uninitialized symbol 'mode'.
Fixes: 03f54d7d3448 ("drm/amd/display: Add DCN3 DPP")
Cc: Bhawanpreet Lakha
Cc: Rodrigo Siqueira
Cc: Aurabindo Pillai
Cc: Tom Chung
Signed-off-by: Srinivasan Shanmugam
---
drivers/gpu/drm/amd/display/dc/dcn30/dcn30_dpp_cm.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/gpu/drm/amd/display/dc/dcn30/dcn30_dpp_cm.c
b/drivers/gpu/drm/amd/display/dc/dcn30/dcn30_dpp_cm.c
index 54ec144f7b81..5276b50cf901 100644
--- a/drivers/gpu/drm/amd/display/dc/dcn30/dcn30_dpp_cm.c
+++ b/drivers/gpu/drm/amd/display/dc/dcn30/dcn30_dpp_cm.c
@@ -56,7 +56,7 @@ static void dpp3_enable_cm_block(
static enum dc_lut_mode dpp30_get_gamcor_current(struct dpp *dpp_base)
{
- enum dc_lut_mode mode;
+ enum dc_lut_mode mode = LUT_BYPASS;
uint32_t state_mode;
uint32_t lut_mode;
struct dcn3_dpp *dpp = TO_DCN30_DPP(dpp_base);
--
2.34.1
[PATCH v2] drm/amdgpu/display: Initialize gamma correction mode variable in dcn30_get_gamcor_current()
The dcn30_get_gamcor_current() function is responsible for determining
the current gamma correction mode used by the display controller.
However, the 'mode' variable, which stores the gamma correction mode,
was not initialized before its first usage, leading to an uninitialized
symbol error.
Thus initializes the 'mode' variable with a default value of LUT_BYPASS
before the conditional statements in the function, improves code clarity
and stability, ensuring correct behavior of the
dcn30_get_gamcor_current() function in determining the gamma correction
mode.
Fixes the below:
drivers/gpu/drm/amd/amdgpu/../display/dc/dcn30/dcn30_dpp_cm.c:77
dpp30_get_gamcor_current() error: uninitialized symbol 'mode'.
Fixes: 03f54d7d3448 ("drm/amd/display: Add DCN3 DPP")
Cc: Bhawanpreet Lakha
Cc: Rodrigo Siqueira
Cc: Aurabindo Pillai
Cc: Tom Chung
Signed-off-by: Srinivasan Shanmugam
Suggested-by: Roman Li
---
v2:
- removed the below redundant code (Roman)
if (state_mode == 0)
mode = LUT_BYPASS;
drivers/gpu/drm/amd/display/dc/dcn30/dcn30_dpp_cm.c | 5 +
1 file changed, 1 insertion(+), 4 deletions(-)
diff --git a/drivers/gpu/drm/amd/display/dc/dcn30/dcn30_dpp_cm.c
b/drivers/gpu/drm/amd/display/dc/dcn30/dcn30_dpp_cm.c
index 54ec144f7b81..2f5b3fbd3507 100644
--- a/drivers/gpu/drm/amd/display/dc/dcn30/dcn30_dpp_cm.c
+++ b/drivers/gpu/drm/amd/display/dc/dcn30/dcn30_dpp_cm.c
@@ -56,16 +56,13 @@ static void dpp3_enable_cm_block(
static enum dc_lut_mode dpp30_get_gamcor_current(struct dpp *dpp_base)
{
- enum dc_lut_mode mode;
+ enum dc_lut_mode mode = LUT_BYPASS;
uint32_t state_mode;
uint32_t lut_mode;
struct dcn3_dpp *dpp = TO_DCN30_DPP(dpp_base);
REG_GET(CM_GAMCOR_CONTROL, CM_GAMCOR_MODE_CURRENT, &state_mode);
- if (state_mode == 0)
- mode = LUT_BYPASS;
-
if (state_mode == 2) {//Programmable RAM LUT
REG_GET(CM_GAMCOR_CONTROL, CM_GAMCOR_SELECT_CURRENT, &lut_mode);
if (lut_mode == 0)
--
2.34.1
Re: [PATCH v2] drm/amd/display: Add NULL test for 'timing generator' in 'dcn21_set_pipe()'
On 2/13/2024 12:07 AM, Kees Cook wrote:
On Thu, Feb 01, 2024 at 03:28:45PM +0530, Srinivasan Shanmugam wrote:
In "u32 otg_inst = pipe_ctx->stream_res.tg->inst;"
pipe_ctx->stream_res.tg could be NULL, it is relying on the caller to
ensure the tg is not NULL.
Fixes: 474ac4a875ca ("drm/amd/display: Implement some asic specific abm call
backs.")
Cc: Yongqiang Sun
Cc: Anthony Koo
Cc: Rodrigo Siqueira
Cc: Aurabindo Pillai
Signed-off-by: Srinivasan Shanmugam
---
v2:
- s/u32/uint32_t for consistency (Anthony)
.../amd/display/dc/hwss/dcn21/dcn21_hwseq.c | 24 +++
1 file changed, 14 insertions(+), 10 deletions(-)
diff --git a/drivers/gpu/drm/amd/display/dc/hwss/dcn21/dcn21_hwseq.c
b/drivers/gpu/drm/amd/display/dc/hwss/dcn21/dcn21_hwseq.c
index 8e88dcaf88f5..8323077bba15 100644
--- a/drivers/gpu/drm/amd/display/dc/hwss/dcn21/dcn21_hwseq.c
+++ b/drivers/gpu/drm/amd/display/dc/hwss/dcn21/dcn21_hwseq.c
@@ -206,28 +206,32 @@ void dcn21_set_abm_immediate_disable(struct pipe_ctx
*pipe_ctx)
void dcn21_set_pipe(struct pipe_ctx *pipe_ctx)
{
struct abm *abm = pipe_ctx->stream_res.abm;
- uint32_t otg_inst = pipe_ctx->stream_res.tg->inst;
+ struct timing_generator *tg = pipe_ctx->stream_res.tg;
struct panel_cntl *panel_cntl = pipe_ctx->stream->link->panel_cntl;
struct dmcu *dmcu = pipe_ctx->stream->ctx->dc->res_pool->dmcu;
+ uint32_t otg_inst;
+
+ if (!abm && !tg && !panel_cntl)
+ return;
+
+ otg_inst = tg->inst;
Is the "if" supposed to be using "||"s instead of "&&"s? I noticed
Coverity complained "tg may be NULL" for the "tg->inst" dereference...
-Kees
Thanks Kees!
It is fixed in the below commit:
commit ccc1e78470efb6572a71ba88d70995e8eee2f6e5
Author: Dan Carpenter
Date: Fri Feb 9 16:02:42 2024 +0300
drm/amd/display: Fix && vs || typos
These ANDs should be ORs or it will lead to a NULL dereference.
Fixes: fb5a3d037082 ("drm/amd/display: Add NULL test for 'timing
generator' in 'dcn21_set_pipe()'")
Fixes: 886571d217d7 ("drm/amd/display: Fix 'panel_cntl' could be
null in 'dcn21_set_backlight_level()'")
Reviewed-by: Anthony Koo
Signed-off-by: Dan Carpenter
Signed-off-by: Hamza Mahfooz
-Srini
[PATCH] drm/amdgpu: Drop unused function 'static void amdgpu_choose_low_power_state()' in amdgpu/amdgpu.h
'static void amdgpu_choose_low_power_state() {
}' is nowhere used, thus drop it.
Fixing the below:
In file included from
drivers/gpu/drm/amd/amdgpu/amdgpu.h:1559:13: error:
‘amdgpu_choose_low_power_state’ defined but not used
[-Werror=unused-function] 1559 | static void
amdgpu_choose_low_power_state(struct amdgpu_device *adev) { } |
^ cc1: all warnings being treated as errors
Fixes: c1251e31ec25 ("drm/amd: Stop evicting resources on APUs in suspend")
Cc: Mario Limonciello
Cc: Christian König
Cc: Alex Deucher
Signed-off-by: Srinivasan Shanmugam
---
drivers/gpu/drm/amd/amdgpu/amdgpu.h | 1 -
1 file changed, 1 deletion(-)
diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu.h
b/drivers/gpu/drm/amd/amdgpu/amdgpu.h
index 2a3f12bae823..32ad5c49ab74 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu.h
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu.h
@@ -1556,7 +1556,6 @@ void amdgpu_choose_low_power_state(struct amdgpu_device
*adev);
#else
static inline bool amdgpu_acpi_is_s0ix_active(struct amdgpu_device *adev) {
return false; }
static inline bool amdgpu_acpi_is_s3_active(struct amdgpu_device *adev) {
return false; }
-static void amdgpu_choose_low_power_state(struct amdgpu_device *adev) { }
#endif
#if defined(CONFIG_DRM_AMD_DC)
--
2.34.1
[PATCH] drm/amdgpu: Fix missing parameter descriptions in ih_v7_0.c
Rectifies kdoc warnings related to the 'ih' parameter in the
'ih_v7_0_get_wptr', 'ih_v7_0_irq_rearm', and 'ih_v7_0_set_rptr'
functions within the 'ih_v7_0.c' file.
Fixes the below with gcc W=1:
drivers/gpu/drm/amd/amdgpu/ih_v7_0.c:392: warning: Function parameter or member
'ih' not described in 'ih_v7_0_get_wptr'
drivers/gpu/drm/amd/amdgpu/ih_v7_0.c:432: warning: Function parameter or member
'ih' not described in 'ih_v7_0_irq_rearm'
drivers/gpu/drm/amd/amdgpu/ih_v7_0.c:458: warning: Function parameter or member
'ih' not described in 'ih_v7_0_set_rptr'
Fixes: b6ba7a165b13 ("drm/amdgpu: Add ih v7_0 ip block support")
Cc: Likun Gao
Cc: Hawking Zhang
Cc: Christian König
Cc: Alex Deucher
Signed-off-by: Srinivasan Shanmugam
---
drivers/gpu/drm/amd/amdgpu/ih_v7_0.c | 7 ---
1 file changed, 4 insertions(+), 3 deletions(-)
diff --git a/drivers/gpu/drm/amd/amdgpu/ih_v7_0.c
b/drivers/gpu/drm/amd/amdgpu/ih_v7_0.c
index 236806797b23..16fe428c0722 100644
--- a/drivers/gpu/drm/amd/amdgpu/ih_v7_0.c
+++ b/drivers/gpu/drm/amd/amdgpu/ih_v7_0.c
@@ -378,9 +378,10 @@ static void ih_v7_0_irq_disable(struct amdgpu_device *adev)
}
/**
- * ih_v7_0_get_wptr - get the IH ring buffer wptr
+ * ih_v7_0_get_wptr() - get the IH ring buffer wptr
*
* @adev: amdgpu_device pointer
+ * @ih: IH ring buffer to fetch wptr
*
* Get the IH ring buffer wptr from either the register
* or the writeback memory buffer. Also check for
@@ -425,6 +426,7 @@ static u32 ih_v7_0_get_wptr(struct amdgpu_device *adev,
* ih_v7_0_irq_rearm - rearm IRQ if lost
*
* @adev: amdgpu_device pointer
+ * @ih: IH ring to match
*
*/
static void ih_v7_0_irq_rearm(struct amdgpu_device *adev,
@@ -450,8 +452,7 @@ static void ih_v7_0_irq_rearm(struct amdgpu_device *adev,
* ih_v7_0_set_rptr - set the IH ring buffer rptr
*
* @adev: amdgpu_device pointer
- *
- * Set the IH ring buffer rptr.
+ * @ih: IH ring buffer to set rptr
*/
static void ih_v7_0_set_rptr(struct amdgpu_device *adev,
struct amdgpu_ih_ring *ih)
--
2.34.1
[PATCH] drm/amdgpu/display: Address kdoc for 'is_psr_su' in 'fill_dc_dirty_rects'
The is_psr_su parameter is a boolean flag indicating whether the Panel
Self Refresh Selective Update (PSR SU) feature is enabled which is a
power-saving feature that allows only the updated regions of the screen
to be refreshed, reducing the amount of data that needs to be sent to
the display.
Fixes the below with gcc W=1:
drivers/gpu/drm/amd/amdgpu/../display/amdgpu_dm/amdgpu_dm.c:5257: warning:
Function parameter or member 'is_psr_su' not described in 'fill_dc_dirty_rects'
Fixes: 13d6b0812e58 ("drm/amdgpu: make damage clips support configurable")
Cc: sta...@vger.kernel.org
Cc: Hamza Mahfooz
Cc: Mario Limonciello
Cc: Rodrigo Siqueira
Cc: Aurabindo Pillai
Signed-off-by: Srinivasan Shanmugam
---
drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c | 4
1 file changed, 4 insertions(+)
diff --git a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
index b9ac3d2f8029..1b51f7fb48ea 100644
--- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
+++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
@@ -5234,6 +5234,10 @@ static inline void fill_dc_dirty_rect(struct drm_plane
*plane,
* @new_plane_state: New state of @plane
* @crtc_state: New state of CRTC connected to the @plane
* @flip_addrs: DC flip tracking struct, which also tracts dirty rects
+ * @is_psr_su: Flag indicating whether Panel Self Refresh Selective Update
(PSR SU) is enabled.
+ * If PSR SU is enabled and damage clips are available, only the
regions of the screen
+ * that have changed will be updated. If PSR SU is not enabled,
+ * or if damage clips are not available, the entire screen will be
updated.
* @dirty_regions_changed: dirty regions changed
*
* For PSR SU, DC informs the DMUB uController of dirty rectangle regions
--
2.34.1
[PATCH] drm/amd/display: Add 'replay' NULL check in 'edp_set_replay_allow_active()'
In the first if statement, we're checking if 'replay' is NULL. But in
the second if statement, we're not checking if 'replay' is NULL again
before calling replay->funcs->replay_set_power_opt().
if (replay == NULL && force_static)
return false;
...
if (link->replay_settings.replay_feature_enabled &&
replay->funcs->replay_set_power_opt) {
replay->funcs->replay_set_power_opt(replay, *power_opts, panel_inst);
link->replay_settings.replay_power_opt_active = *power_opts;
}
If 'replay' is NULL, this will cause a null pointer dereference.
Fixes the below found by smatch:
drivers/gpu/drm/amd/amdgpu/../display/dc/link/protocols/link_edp_panel_control.c:895
edp_set_replay_allow_active() error: we previously assumed 'replay' could be
null (see line 887)
Fixes: c7ddc0a800bc ("drm/amd/display: Add Functions to enable Freesync Panel
Replay")
Cc: Bhawanpreet Lakha
Cc: Roman Li
Cc: Rodrigo Siqueira
Cc: Aurabindo Pillai
Cc: Tom Chung
Suggested-by: Tom Chung
Signed-off-by: Srinivasan Shanmugam
---
.../drm/amd/display/dc/link/protocols/link_edp_panel_control.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git
a/drivers/gpu/drm/amd/display/dc/link/protocols/link_edp_panel_control.c
b/drivers/gpu/drm/amd/display/dc/link/protocols/link_edp_panel_control.c
index 443215b96308..acfbbc638cc6 100644
--- a/drivers/gpu/drm/amd/display/dc/link/protocols/link_edp_panel_control.c
+++ b/drivers/gpu/drm/amd/display/dc/link/protocols/link_edp_panel_control.c
@@ -892,7 +892,8 @@ bool edp_set_replay_allow_active(struct dc_link *link,
const bool *allow_active,
/* Set power optimization flag */
if (power_opts && link->replay_settings.replay_power_opt_active !=
*power_opts) {
- if (link->replay_settings.replay_feature_enabled &&
replay->funcs->replay_set_power_opt) {
+ if (replay != NULL &&
link->replay_settings.replay_feature_enabled &&
+ replay->funcs->replay_set_power_opt) {
replay->funcs->replay_set_power_opt(replay,
*power_opts, panel_inst);
link->replay_settings.replay_power_opt_active =
*power_opts;
}
--
2.34.1
[PATCH] drm/amd/display: Fix potential null pointer dereference in dc_dmub_srv
Fixes potential null pointer dereference warnings in the
dc_dmub_srv_cmd_list_queue_execute() and dc_dmub_srv_is_hw_pwr_up()
functions.
In both functions, the 'dc_dmub_srv' variable was being dereferenced
before it was checked for null. This could lead to a null pointer
dereference if 'dc_dmub_srv' is null. The fix is to check if
'dc_dmub_srv' is null before dereferencing it.
Thus moving the null checks for 'dc_dmub_srv' to the beginning of the
functions to ensure that 'dc_dmub_srv' is not null when it is
dereferenced.
Found by smatch & thus fixing the below:
drivers/gpu/drm/amd/amdgpu/../display/dc/dc_dmub_srv.c:133
dc_dmub_srv_cmd_list_queue_execute() warn: variable dereferenced before check
'dc_dmub_srv' (see line 128)
drivers/gpu/drm/amd/amdgpu/../display/dc/dc_dmub_srv.c:1167
dc_dmub_srv_is_hw_pwr_up() warn: variable dereferenced before check
'dc_dmub_srv' (see line 1164)
Fixes: 01fbdc34c687 ("drm/amd/display: decouple dmcub execution to reduce lock
granularity")
Fixes: 65138eb72e1f ("drm/amd/display: Add DCN35 DMUB")
Cc: JinZe.Xu
Cc: Hersen Wu
Cc: Josip Pavic
Cc: Roman Li
Cc: Qingqing Zhuo
Cc: Harry Wentland
Cc: Rodrigo Siqueira
Cc: Aurabindo Pillai
Cc: Tom Chung
Signed-off-by: Srinivasan Shanmugam
---
drivers/gpu/drm/amd/display/dc/dc_dmub_srv.c | 7 +--
1 file changed, 5 insertions(+), 2 deletions(-)
diff --git a/drivers/gpu/drm/amd/display/dc/dc_dmub_srv.c
b/drivers/gpu/drm/amd/display/dc/dc_dmub_srv.c
index 0bc32537e2eb..8bc361e0f404 100644
--- a/drivers/gpu/drm/amd/display/dc/dc_dmub_srv.c
+++ b/drivers/gpu/drm/amd/display/dc/dc_dmub_srv.c
@@ -128,7 +128,7 @@ bool dc_dmub_srv_cmd_list_queue_execute(struct dc_dmub_srv
*dc_dmub_srv,
unsigned int count,
union dmub_rb_cmd *cmd_list)
{
- struct dc_context *dc_ctx = dc_dmub_srv->ctx;
+ struct dc_context *dc_ctx;
struct dmub_srv *dmub;
enum dmub_status status;
int i;
@@ -136,6 +136,7 @@ bool dc_dmub_srv_cmd_list_queue_execute(struct dc_dmub_srv
*dc_dmub_srv,
if (!dc_dmub_srv || !dc_dmub_srv->dmub)
return false;
+ dc_ctx = dc_dmub_srv->ctx;
dmub = dc_dmub_srv->dmub;
for (i = 0 ; i < count; i++) {
@@ -1169,12 +1170,14 @@ void dc_dmub_srv_subvp_save_surf_addr(const struct
dc_dmub_srv *dc_dmub_srv, con
bool dc_dmub_srv_is_hw_pwr_up(struct dc_dmub_srv *dc_dmub_srv, bool wait)
{
- struct dc_context *dc_ctx = dc_dmub_srv->ctx;
+ struct dc_context *dc_ctx;
enum dmub_status status;
if (!dc_dmub_srv || !dc_dmub_srv->dmub)
return true;
+ dc_ctx = dc_dmub_srv->ctx;
+
if (dc_dmub_srv->ctx->dc->debug.dmcub_emulation)
return true;
--
2.34.1
[PATCH v2] drm/amd/display: Fix potential null pointer dereference in dc_dmub_srv
Fixes potential null pointer dereference warnings in the
dc_dmub_srv_cmd_list_queue_execute() and dc_dmub_srv_is_hw_pwr_up()
functions.
In both functions, the 'dc_dmub_srv' variable was being dereferenced
before it was checked for null. This could lead to a null pointer
dereference if 'dc_dmub_srv' is null. The fix is to check if
'dc_dmub_srv' is null before dereferencing it.
Thus moving the null checks for 'dc_dmub_srv' to the beginning of the
functions to ensure that 'dc_dmub_srv' is not null when it is
dereferenced.
Found by smatch & thus fixing the below:
drivers/gpu/drm/amd/amdgpu/../display/dc/dc_dmub_srv.c:133
dc_dmub_srv_cmd_list_queue_execute() warn: variable dereferenced before check
'dc_dmub_srv' (see line 128)
drivers/gpu/drm/amd/amdgpu/../display/dc/dc_dmub_srv.c:1167
dc_dmub_srv_is_hw_pwr_up() warn: variable dereferenced before check
'dc_dmub_srv' (see line 1164)
Fixes: 01fbdc34c687 ("drm/amd/display: decouple dmcub execution to reduce lock
granularity")
Fixes: 65138eb72e1f ("drm/amd/display: Add DCN35 DMUB")
Cc: JinZe.Xu
Cc: Hersen Wu
Cc: Josip Pavic
Cc: Roman Li
Cc: Qingqing Zhuo
Cc: Harry Wentland
Cc: Rodrigo Siqueira
Cc: Aurabindo Pillai
Cc: Tom Chung
Signed-off-by: Srinivasan Shanmugam
---
v2:
- For dc_dmub_srv_is_hw_pwr_up() move 'dc_ctx = dc_dmub_srv->ctx;'
below 'if (dc_dmub_srv->ctx->dc->debug.dmcub_emulation)' (Tom)
drivers/gpu/drm/amd/display/dc/dc_dmub_srv.c | 7 +--
1 file changed, 5 insertions(+), 2 deletions(-)
diff --git a/drivers/gpu/drm/amd/display/dc/dc_dmub_srv.c
b/drivers/gpu/drm/amd/display/dc/dc_dmub_srv.c
index 0bc32537e2eb..a115e1170ef5 100644
--- a/drivers/gpu/drm/amd/display/dc/dc_dmub_srv.c
+++ b/drivers/gpu/drm/amd/display/dc/dc_dmub_srv.c
@@ -128,7 +128,7 @@ bool dc_dmub_srv_cmd_list_queue_execute(struct dc_dmub_srv
*dc_dmub_srv,
unsigned int count,
union dmub_rb_cmd *cmd_list)
{
- struct dc_context *dc_ctx = dc_dmub_srv->ctx;
+ struct dc_context *dc_ctx;
struct dmub_srv *dmub;
enum dmub_status status;
int i;
@@ -136,6 +136,7 @@ bool dc_dmub_srv_cmd_list_queue_execute(struct dc_dmub_srv
*dc_dmub_srv,
if (!dc_dmub_srv || !dc_dmub_srv->dmub)
return false;
+ dc_ctx = dc_dmub_srv->ctx;
dmub = dc_dmub_srv->dmub;
for (i = 0 ; i < count; i++) {
@@ -1169,7 +1170,7 @@ void dc_dmub_srv_subvp_save_surf_addr(const struct
dc_dmub_srv *dc_dmub_srv, con
bool dc_dmub_srv_is_hw_pwr_up(struct dc_dmub_srv *dc_dmub_srv, bool wait)
{
- struct dc_context *dc_ctx = dc_dmub_srv->ctx;
+ struct dc_context *dc_ctx;
enum dmub_status status;
if (!dc_dmub_srv || !dc_dmub_srv->dmub)
@@ -1177,6 +1178,8 @@ bool dc_dmub_srv_is_hw_pwr_up(struct dc_dmub_srv
*dc_dmub_srv, bool wait)
if (dc_dmub_srv->ctx->dc->debug.dmcub_emulation)
return true;
+
+ dc_ctx = dc_dmub_srv->ctx;
if (wait) {
if (dc_dmub_srv->ctx->dc->debug.disable_timeout) {
--
2.34.1
[PATCH] drm/amd/display: Prevent potential buffer overflow in map_hw_resources
Adds a check in the map_hw_resources function to prevent a
potential buffer overflow. The function was accessing arrays using an
index that could potentially be greater than the size of the arrays,
leading to a buffer overflow.
Adds a check to ensure that the index is within the bounds of
the arrays. If the index is out of bounds, an error message is printed
and the function returns early to prevent the buffer overflow.
Reported by smatch:
drivers/gpu/drm/amd/amdgpu/../display/dc/dml2/dml2_wrapper.c:79
map_hw_resources() error: buffer overflow
'dml2->v20.scratch.dml_to_dc_pipe_mapping.disp_cfg_to_stream_id' 6 <= 7
drivers/gpu/drm/amd/amdgpu/../display/dc/dml2/dml2_wrapper.c:81
map_hw_resources() error: buffer overflow
'dml2->v20.scratch.dml_to_dc_pipe_mapping.disp_cfg_to_plane_id' 6 <= 7
Fixes: 482ce89eec1b ("drm/amd/display: Introduce DML2")
Cc: Rodrigo Siqueira
Cc: Roman Li
Cc: Qingqing Zhuo
Cc: Aurabindo Pillai
Cc: Tom Chung
Signed-off-by: Srinivasan Shanmugam
---
drivers/gpu/drm/amd/display/dc/dml2/dml2_wrapper.c | 6 ++
1 file changed, 6 insertions(+)
diff --git a/drivers/gpu/drm/amd/display/dc/dml2/dml2_wrapper.c
b/drivers/gpu/drm/amd/display/dc/dml2/dml2_wrapper.c
index 26307e599614..0531d54b3d68 100644
--- a/drivers/gpu/drm/amd/display/dc/dml2/dml2_wrapper.c
+++ b/drivers/gpu/drm/amd/display/dc/dml2/dml2_wrapper.c
@@ -76,6 +76,12 @@ static void map_hw_resources(struct dml2_context *dml2,
in_out_display_cfg->hw.DLGRefClkFreqMHz = 50;
}
for (j = 0; j < mode_support_info->DPPPerSurface[i]; j++) {
+ if (i >= __DML2_WRAPPER_MAX_STREAMS_PLANES__) {
+ dml_print("DML::%s: Index out of bounds: i=%d,
+
__DML2_WRAPPER_MAX_STREAMS_PLANES__=%d\n",
+ __func__, i,
__DML2_WRAPPER_MAX_STREAMS_PLANES__);
+ return;
+ }
dml2->v20.scratch.dml_to_dc_pipe_mapping.dml_pipe_idx_to_stream_id[num_pipes] =
dml2->v20.scratch.dml_to_dc_pipe_mapping.disp_cfg_to_stream_id[i];
dml2->v20.scratch.dml_to_dc_pipe_mapping.dml_pipe_idx_to_stream_id_valid[num_pipes]
= true;
dml2->v20.scratch.dml_to_dc_pipe_mapping.dml_pipe_idx_to_plane_id[num_pipes] =
dml2->v20.scratch.dml_to_dc_pipe_mapping.disp_cfg_to_plane_id[i];
--
2.34.1
[PATCH v2] drm/amd/display: Prevent potential buffer overflow in map_hw_resources
Adds a check in the map_hw_resources function to prevent a
potential buffer overflow. The function was accessing arrays using an
index that could potentially be greater than the size of the arrays,
leading to a buffer overflow.
Adds a check to ensure that the index is within the bounds of
the arrays. If the index is out of bounds, an error message is printed
and the function returns early to prevent the buffer overflow.
Reported by smatch:
drivers/gpu/drm/amd/amdgpu/../display/dc/dml2/dml2_wrapper.c:79
map_hw_resources() error: buffer overflow
'dml2->v20.scratch.dml_to_dc_pipe_mapping.disp_cfg_to_stream_id' 6 <= 7
drivers/gpu/drm/amd/amdgpu/../display/dc/dml2/dml2_wrapper.c:81
map_hw_resources() error: buffer overflow
'dml2->v20.scratch.dml_to_dc_pipe_mapping.disp_cfg_to_plane_id' 6 <= 7
Fixes: 482ce89eec1b ("drm/amd/display: Introduce DML2")
Cc: Rodrigo Siqueira
Cc: Roman Li
Cc: Qingqing Zhuo
Cc: Aurabindo Pillai
Cc: Tom Chung
Signed-off-by: Srinivasan Shanmugam
---
v2:
- fixes the below warnings due to incorrect line continuation string split
across two lines
/linux/drivers/gpu/drm/amd/amdgpu/../display/dc/dml2/dml2_wrapper.c: In
function ‘map_hw_resources’:
/linux/drivers/gpu/drm/amd/amdgpu/../display/dc/dml2/dml2_wrapper.c:80:15:
error: missing terminating " character [-Werror]
80 | dml_print("DML::%s: Index out of bounds: i=%d,
| ^
/linux/drivers/gpu/drm/amd/amdgpu/../display/dc/dml2/dml2_wrapper.c:81:48:
error: missing terminating " character [-Werror]
81 |__DML2_WRAPPER_MAX_STREAMS_PLANES__=%d\n",
|^
cc1: all warnings being treated as errors
drivers/gpu/drm/amd/display/dc/dml2/dml2_wrapper.c | 5 +
1 file changed, 5 insertions(+)
diff --git a/drivers/gpu/drm/amd/display/dc/dml2/dml2_wrapper.c
b/drivers/gpu/drm/amd/display/dc/dml2/dml2_wrapper.c
index 26307e599614..2ebeb2b384cf 100644
--- a/drivers/gpu/drm/amd/display/dc/dml2/dml2_wrapper.c
+++ b/drivers/gpu/drm/amd/display/dc/dml2/dml2_wrapper.c
@@ -76,6 +76,11 @@ static void map_hw_resources(struct dml2_context *dml2,
in_out_display_cfg->hw.DLGRefClkFreqMHz = 50;
}
for (j = 0; j < mode_support_info->DPPPerSurface[i]; j++) {
+ if (i >= __DML2_WRAPPER_MAX_STREAMS_PLANES__) {
+ dml_print("DML::%s: Index out of bounds: i=%d,
__DML2_WRAPPER_MAX_STREAMS_PLANES__=%d\n",
+ __func__, i,
__DML2_WRAPPER_MAX_STREAMS_PLANES__);
+ return;
+ }
dml2->v20.scratch.dml_to_dc_pipe_mapping.dml_pipe_idx_to_stream_id[num_pipes] =
dml2->v20.scratch.dml_to_dc_pipe_mapping.disp_cfg_to_stream_id[i];
dml2->v20.scratch.dml_to_dc_pipe_mapping.dml_pipe_idx_to_stream_id_valid[num_pipes]
= true;
dml2->v20.scratch.dml_to_dc_pipe_mapping.dml_pipe_idx_to_plane_id[num_pipes] =
dml2->v20.scratch.dml_to_dc_pipe_mapping.disp_cfg_to_plane_id[i];
--
2.34.1
[PATCH v3] drm/amd/display: Prevent potential buffer overflow in map_hw_resources
Adds a check in the map_hw_resources function to prevent a potential
buffer overflow. The function was accessing arrays using an index that
could potentially be greater than the size of the arrays, leading to a
buffer overflow.
Adds a check to ensure that the index is within the bounds of the
arrays. If the index is out of bounds, an error message is printed and
break it will continue execution with just ignoring extra data early to
prevent the buffer overflow.
Reported by smatch:
drivers/gpu/drm/amd/amdgpu/../display/dc/dml2/dml2_wrapper.c:79
map_hw_resources() error: buffer overflow
'dml2->v20.scratch.dml_to_dc_pipe_mapping.disp_cfg_to_stream_id' 6 <= 7
drivers/gpu/drm/amd/amdgpu/../display/dc/dml2/dml2_wrapper.c:81
map_hw_resources() error: buffer overflow
'dml2->v20.scratch.dml_to_dc_pipe_mapping.disp_cfg_to_plane_id' 6 <= 7
Fixes: 482ce89eec1b ("drm/amd/display: Introduce DML2")
Cc: Rodrigo Siqueira
Cc: Roman Li
Cc: Qingqing Zhuo
Cc: Aurabindo Pillai
Cc: Tom Chung
Signed-off-by: Srinivasan Shanmugam
---
v3:
- s/return/break as return may leave the system in a bad state
drivers/gpu/drm/amd/display/dc/dml2/dml2_wrapper.c | 5 +
1 file changed, 5 insertions(+)
diff --git a/drivers/gpu/drm/amd/display/dc/dml2/dml2_wrapper.c
b/drivers/gpu/drm/amd/display/dc/dml2/dml2_wrapper.c
index 26307e599614..2a58a7687bdb 100644
--- a/drivers/gpu/drm/amd/display/dc/dml2/dml2_wrapper.c
+++ b/drivers/gpu/drm/amd/display/dc/dml2/dml2_wrapper.c
@@ -76,6 +76,11 @@ static void map_hw_resources(struct dml2_context *dml2,
in_out_display_cfg->hw.DLGRefClkFreqMHz = 50;
}
for (j = 0; j < mode_support_info->DPPPerSurface[i]; j++) {
+ if (i >= __DML2_WRAPPER_MAX_STREAMS_PLANES__) {
+ dml_print("DML::%s: Index out of bounds: i=%d,
__DML2_WRAPPER_MAX_STREAMS_PLANES__=%d\n",
+ __func__, i,
__DML2_WRAPPER_MAX_STREAMS_PLANES__);
+ break;
+ }
dml2->v20.scratch.dml_to_dc_pipe_mapping.dml_pipe_idx_to_stream_id[num_pipes] =
dml2->v20.scratch.dml_to_dc_pipe_mapping.disp_cfg_to_stream_id[i];
dml2->v20.scratch.dml_to_dc_pipe_mapping.dml_pipe_idx_to_stream_id_valid[num_pipes]
= true;
dml2->v20.scratch.dml_to_dc_pipe_mapping.dml_pipe_idx_to_plane_id[num_pipes] =
dml2->v20.scratch.dml_to_dc_pipe_mapping.disp_cfg_to_plane_id[i];
--
2.34.1
[PATCH] drm/amd/amdgpu: Fix potential ioremap() memory leaks in amdgpu_device_init()
This ensures that the memory mapped by ioremap for adev->rmmio, is
properly handled in amdgpu_device_init(). If the function exits early
due to an error, the memory is unmapped. If the function completes
successfully, the memory remains mapped.
Fixes the below:
drivers/gpu/drm/amd/amdgpu/amdgpu_device.c:4337 amdgpu_device_init() warn:
'adev->rmmio' from ioremap() not released on lines:
4035,4045,4051,4058,4068,4337
Cc: Christian König
Cc: Alex Deucher
Signed-off-by: Srinivasan Shanmugam
---
drivers/gpu/drm/amd/amdgpu/amdgpu_device.c | 18 ++
1 file changed, 14 insertions(+), 4 deletions(-)
diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c
b/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c
index 1ef892bea488..68bf5e910cb8 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c
@@ -4031,8 +4031,10 @@ int amdgpu_device_init(struct amdgpu_device *adev,
* early on during init and before calling to RREG32.
*/
adev->reset_domain = amdgpu_reset_create_reset_domain(SINGLE_DEVICE,
"amdgpu-reset-dev");
- if (!adev->reset_domain)
+ if (!adev->reset_domain) {
+ iounmap(adev->rmmio);
return -ENOMEM;
+ }
/* detect hw virtualization here */
amdgpu_detect_virtualization(adev);
@@ -4042,20 +4044,25 @@ int amdgpu_device_init(struct amdgpu_device *adev,
r = amdgpu_device_get_job_timeout_settings(adev);
if (r) {
dev_err(adev->dev, "invalid lockup_timeout parameter syntax\n");
+ iounmap(adev->rmmio);
return r;
}
/* early init functions */
r = amdgpu_device_ip_early_init(adev);
- if (r)
+ if (r) {
+ iounmap(adev->rmmio);
return r;
+ }
amdgpu_device_set_mcbp(adev);
/* Get rid of things like offb */
r = drm_aperture_remove_conflicting_pci_framebuffers(adev->pdev,
&amdgpu_kms_driver);
- if (r)
+ if (r) {
+ iounmap(adev->rmmio);
return r;
+ }
/* Enable TMZ based on IP_VERSION */
amdgpu_gmc_tmz_set(adev);
@@ -4064,8 +4071,10 @@ int amdgpu_device_init(struct amdgpu_device *adev,
/* Need to get xgmi info early to decide the reset behavior*/
if (adev->gmc.xgmi.supported) {
r = adev->gfxhub.funcs->get_xgmi_info(adev);
- if (r)
+ if (r) {
+ iounmap(adev->rmmio);
return r;
+ }
}
/* enable PCIE atomic ops */
@@ -4334,6 +4343,7 @@ int amdgpu_device_init(struct amdgpu_device *adev,
failed:
amdgpu_vf_error_trans_all(adev);
+ iounmap(adev->rmmio);
return r;
}
--
2.34.1
[PATCH] drm/amdgpu: Fix missing break in ATOM_ARG_IMM Case of atom_get_src_int()
Missing break statement in the ATOM_ARG_IMM case of a switch statement,
adds the missing break statement, ensuring that the program's control
flow is as intended.
Fixes the below:
drivers/gpu/drm/amd/amdgpu/atom.c:323 atom_get_src_int() warn: ignoring
unreachable code.
Fixes: d38ceaf99ed0 ("drm/amdgpu: add core driver (v4)")
Cc: Jammy Zhou
Cc: Christian König
Cc: Alex Deucher
Signed-off-by: Srinivasan Shanmugam
---
drivers/gpu/drm/amd/amdgpu/atom.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/gpu/drm/amd/amdgpu/atom.c
b/drivers/gpu/drm/amd/amdgpu/atom.c
index b888613f653f..72362df352f6 100644
--- a/drivers/gpu/drm/amd/amdgpu/atom.c
+++ b/drivers/gpu/drm/amd/amdgpu/atom.c
@@ -320,7 +320,7 @@ static uint32_t atom_get_src_int(atom_exec_context *ctx,
uint8_t attr,
DEBUG("IMM 0x%02X\n", val);
return val;
}
- return 0;
+ break;
case ATOM_ARG_PLL:
idx = U8(*ptr);
(*ptr)++;
--
2.34.1
[PATCH] drm/amd/display: Improve 'dml32_TruncToValidBPP()' function
Refactors the dml32_TruncToValidBPP function by removing a
redundant return statement.
The function previously had a return statement at the end that was
never executed because all execution paths in the function ended with
a return statement before this line.
Fixes the below:
drivers/gpu/drm/amd/amdgpu/../display/dc/dml/dcn32/display_mode_vba_util_32.c:1680
dml32_TruncToValidBPP() warn: ignoring unreachable code.
Fixes: dda4fb85e433 ("drm/amd/display: DML changes for DCN32/321")
Cc: Rodrigo Siqueira
Cc: Roman Li
Cc: Aurabindo Pillai
Cc: Tom Chung
Signed-off-by: Srinivasan Shanmugam
---
.../gpu/drm/amd/display/dc/dml/dcn32/display_mode_vba_util_32.c | 2 --
1 file changed, 2 deletions(-)
diff --git
a/drivers/gpu/drm/amd/display/dc/dml/dcn32/display_mode_vba_util_32.c
b/drivers/gpu/drm/amd/display/dc/dml/dcn32/display_mode_vba_util_32.c
index 80fccd4999a5..54ac8242f7b0 100644
--- a/drivers/gpu/drm/amd/display/dc/dml/dcn32/display_mode_vba_util_32.c
+++ b/drivers/gpu/drm/amd/display/dc/dml/dcn32/display_mode_vba_util_32.c
@@ -1678,8 +1678,6 @@ double dml32_TruncToValidBPP(
}
*RequiredSlots = dml_ceil(DesiredBPP / MaxLinkBPP * 64, 1);
-
- return BPP_INVALID;
} // TruncToValidBPP
double dml32_RequiredDTBCLK(
--
2.34.1
[PATCH] drm/amd/display: Fix logical operator in get_meta_and_pte_attr()
logical operator in a condition check in the get_meta_and_pte_attr
function bitwise AND operator '&' was used in an 'if' statement, but the
logical AND operator '&&' was likely intended.
The condition check was changed from:
if (!surf_linear & (log2_dpte_req_height_ptes == 0) & surf_vert)
to the below:
if (!surf_linear && (log2_dpte_req_height_ptes == 0) && surf_vert)
This ensures that the 'if' statement will be true only if all three
conditions are met, which is the typical use case in an 'if' statement.
Fixes the below:
drivers/gpu/drm/amd/amdgpu/../display/dc/dml/dcn20/display_rq_dlg_calc_20.c:656
get_meta_and_pte_attr() warn: maybe use && instead of &
drivers/gpu/drm/amd/amdgpu/../display/dc/dml/dcn20/display_rq_dlg_calc_20v2.c:656
get_meta_and_pte_attr() warn: maybe use && instead of &
drivers/gpu/drm/amd/amdgpu/../display/dc/dml/dcn21/display_rq_dlg_calc_21.c:662
get_meta_and_pte_attr() warn: maybe use && instead of &
drivers/gpu/drm/amd/amdgpu/../display/dc/dml/dcn30/display_rq_dlg_calc_30.c:627
get_meta_and_pte_attr() warn: maybe use && instead of &
drivers/gpu/drm/amd/amdgpu/../display/dc/dml/dcn31/display_rq_dlg_calc_31.c:622
get_meta_and_pte_attr() warn: maybe use && instead of &
drivers/gpu/drm/amd/amdgpu/../display/dc/dml/dcn314/display_rq_dlg_calc_314.c:710
get_meta_and_pte_attr() warn: maybe use && instead of &
Cc: Rodrigo Siqueira
Cc: Roman Li
Cc: Aurabindo Pillai
Cc: Tom Chung
Signed-off-by: Srinivasan Shanmugam
---
.../gpu/drm/amd/display/dc/dml/dcn20/display_rq_dlg_calc_20.c | 3 ++-
.../drm/amd/display/dc/dml/dcn20/display_rq_dlg_calc_20v2.c| 3 ++-
.../gpu/drm/amd/display/dc/dml/dcn21/display_rq_dlg_calc_21.c | 3 ++-
.../gpu/drm/amd/display/dc/dml/dcn30/display_rq_dlg_calc_30.c | 3 ++-
.../gpu/drm/amd/display/dc/dml/dcn31/display_rq_dlg_calc_31.c | 3 ++-
.../drm/amd/display/dc/dml/dcn314/display_rq_dlg_calc_314.c| 3 ++-
6 files changed, 12 insertions(+), 6 deletions(-)
diff --git a/drivers/gpu/drm/amd/display/dc/dml/dcn20/display_rq_dlg_calc_20.c
b/drivers/gpu/drm/amd/display/dc/dml/dcn20/display_rq_dlg_calc_20.c
index 548cdef8a8ad..e689afdf9e7b 100644
--- a/drivers/gpu/drm/amd/display/dc/dml/dcn20/display_rq_dlg_calc_20.c
+++ b/drivers/gpu/drm/amd/display/dc/dml/dcn20/display_rq_dlg_calc_20.c
@@ -653,7 +653,8 @@ static void get_meta_and_pte_attr(struct display_mode_lib
*mode_lib,
// the dpte_group_bytes is reduced for the specific case of vertical
// access of a tile surface that has dpte request of 8x1 ptes.
- if (!surf_linear & (log2_dpte_req_height_ptes == 0) & surf_vert)
//reduced, in this case, will have page fault within a group
+ if (!surf_linear && log2_dpte_req_height_ptes == 0 &&
+ surf_vert) //reduced, in this case, will have page fault within a
group
rq_sizing_param->dpte_group_bytes = 512;
else
//full size
diff --git
a/drivers/gpu/drm/amd/display/dc/dml/dcn20/display_rq_dlg_calc_20v2.c
b/drivers/gpu/drm/amd/display/dc/dml/dcn20/display_rq_dlg_calc_20v2.c
index 0fc9f3e3ffae..6d105a8bd4c7 100644
--- a/drivers/gpu/drm/amd/display/dc/dml/dcn20/display_rq_dlg_calc_20v2.c
+++ b/drivers/gpu/drm/amd/display/dc/dml/dcn20/display_rq_dlg_calc_20v2.c
@@ -653,7 +653,8 @@ static void get_meta_and_pte_attr(struct display_mode_lib
*mode_lib,
// the dpte_group_bytes is reduced for the specific case of vertical
// access of a tile surface that has dpte request of 8x1 ptes.
- if (!surf_linear & (log2_dpte_req_height_ptes == 0) & surf_vert)
//reduced, in this case, will have page fault within a group
+ if (!surf_linear && log2_dpte_req_height_ptes == 0 &&
+ surf_vert) //reduced, in this case, will have page fault within a
group
rq_sizing_param->dpte_group_bytes = 512;
else
//full size
diff --git a/drivers/gpu/drm/amd/display/dc/dml/dcn21/display_rq_dlg_calc_21.c
b/drivers/gpu/drm/amd/display/dc/dml/dcn21/display_rq_dlg_calc_21.c
index 618f4b682ab1..5d604f52a948 100644
--- a/drivers/gpu/drm/amd/display/dc/dml/dcn21/display_rq_dlg_calc_21.c
+++ b/drivers/gpu/drm/amd/display/dc/dml/dcn21/display_rq_dlg_calc_21.c
@@ -659,7 +659,8 @@ static void get_meta_and_pte_attr(
if (hostvm_enable)
rq_sizing_param->dpte_group_bytes = 512;
else {
- if (!surf_linear & (log2_dpte_req_height_ptes == 0) &
surf_vert) //reduced, in this case, will have page fault within a group
+ if (!surf_linear && log2_dpte_req_height_ptes == 0 &&
+ surf_vert) //reduced, in this case, will have page fault
within a group
rq_sizing_param->dpte_group_bytes = 512;
else
[PATCH] drm/amd/display: Remove redundant condition in dcn35_calc_blocks_to_gate()
pipe_ctx->plane_res.mpcc_inst is of a type that can only hold values
between 0 and 255, so it's always greater than or equal to 0.
Thus the condition 'pipe_ctx->plane_res.mpcc_inst >= 0' was always true
and has been removed.
Fixes the below:
drivers/gpu/drm/amd/amdgpu/../display/dc/hwss/dcn35/dcn35_hwseq.c:1023
dcn35_calc_blocks_to_gate() warn: always true condition
'(pipe_ctx->plane_res.mpcc_inst >= 0) => (0-255 >= 0)'
Fixes: 6f8b7565cca4 ("drm/amd/display: Add DCN35 HWSEQ")
Cc: Qingqing Zhuo
Cc: Harry Wentland
Cc: Rodrigo Siqueira
Cc: Roman Li
Cc: Aurabindo Pillai
Cc: Tom Chung
Signed-off-by: Srinivasan Shanmugam
---
drivers/gpu/drm/amd/display/dc/hwss/dcn35/dcn35_hwseq.c | 3 +--
1 file changed, 1 insertion(+), 2 deletions(-)
diff --git a/drivers/gpu/drm/amd/display/dc/hwss/dcn35/dcn35_hwseq.c
b/drivers/gpu/drm/amd/display/dc/hwss/dcn35/dcn35_hwseq.c
index 4b92df23ff0d..3dbbf6ea2603 100644
--- a/drivers/gpu/drm/amd/display/dc/hwss/dcn35/dcn35_hwseq.c
+++ b/drivers/gpu/drm/amd/display/dc/hwss/dcn35/dcn35_hwseq.c
@@ -1019,8 +1019,7 @@ void dcn35_calc_blocks_to_gate(struct dc *dc, struct
dc_state *context,
if (pipe_ctx->plane_res.dpp)
update_state->pg_pipe_res_update[PG_DPP][pipe_ctx->plane_res.hubp->inst] =
false;
- if ((pipe_ctx->plane_res.dpp || pipe_ctx->stream_res.opp) &&
- pipe_ctx->plane_res.mpcc_inst >= 0)
+ if (pipe_ctx->plane_res.dpp || pipe_ctx->stream_res.opp)
update_state->pg_pipe_res_update[PG_MPCC][pipe_ctx->plane_res.mpcc_inst] =
false;
if (pipe_ctx->stream_res.dsc)
--
2.34.1
Re: [PATCH] drm/amd/amdgpu: Fix potential ioremap() memory leaks in amdgpu_device_init()
Hi Christian,
On 2/26/2024 1:46 PM, Christian König wrote:
Am 24.02.24 um 07:38 schrieb Srinivasan Shanmugam:
This ensures that the memory mapped by ioremap for adev->rmmio, is
properly handled in amdgpu_device_init(). If the function exits early
due to an error, the memory is unmapped. If the function completes
successfully, the memory remains mapped.
Fixes the below:
drivers/gpu/drm/amd/amdgpu/amdgpu_device.c:4337 amdgpu_device_init()
warn: 'adev->rmmio' from ioremap() not released on lines:
4035,4045,4051,4058,4068,4337
Hui? How do you got that warning?
It was caught by smatch & will update the same in the commit message.
Cc: Christian König
Cc: Alex Deucher
Signed-off-by: Srinivasan Shanmugam
---
drivers/gpu/drm/amd/amdgpu/amdgpu_device.c | 18 ++
1 file changed, 14 insertions(+), 4 deletions(-)
diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c
b/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c
index 1ef892bea488..68bf5e910cb8 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c
@@ -4031,8 +4031,10 @@ int amdgpu_device_init(struct amdgpu_device
*adev,
* early on during init and before calling to RREG32.
*/
adev->reset_domain =
amdgpu_reset_create_reset_domain(SINGLE_DEVICE, "amdgpu-reset-dev");
- if (!adev->reset_domain)
+ if (!adev->reset_domain) {
+ iounmap(adev->rmmio);
return -ENOMEM;
+ }
Please use a goto label and error handling instead. Apart from that
looks good to me.
Thanks a lot for all your reviews, highly appreciate it, will send v2
for this.
Best Wishes,
Srini
Regards,
Christian.
/* detect hw virtualization here */
amdgpu_detect_virtualization(adev);
@@ -4042,20 +4044,25 @@ int amdgpu_device_init(struct amdgpu_device
*adev,
r = amdgpu_device_get_job_timeout_settings(adev);
if (r) {
dev_err(adev->dev, "invalid lockup_timeout parameter
syntax\n");
+ iounmap(adev->rmmio);
return r;
}
/* early init functions */
r = amdgpu_device_ip_early_init(adev);
- if (r)
+ if (r) {
+ iounmap(adev->rmmio);
return r;
+ }
amdgpu_device_set_mcbp(adev);
/* Get rid of things like offb */
r =
drm_aperture_remove_conflicting_pci_framebuffers(adev->pdev,
&amdgpu_kms_driver);
- if (r)
+ if (r) {
+ iounmap(adev->rmmio);
return r;
+ }
/* Enable TMZ based on IP_VERSION */
amdgpu_gmc_tmz_set(adev);
@@ -4064,8 +4071,10 @@ int amdgpu_device_init(struct amdgpu_device
*adev,
/* Need to get xgmi info early to decide the reset behavior*/
if (adev->gmc.xgmi.supported) {
r = adev->gfxhub.funcs->get_xgmi_info(adev);
- if (r)
+ if (r) {
+ iounmap(adev->rmmio);
return r;
+ }
}
/* enable PCIE atomic ops */
@@ -4334,6 +4343,7 @@ int amdgpu_device_init(struct amdgpu_device *adev,
failed:
amdgpu_vf_error_trans_all(adev);
+ iounmap(adev->rmmio);
return r;
}
[PATCH v2] drm/amd/amdgpu: Fix potential ioremap() memory leaks in amdgpu_device_init()
This ensures that the memory mapped by ioremap for adev->rmmio, is
properly handled in amdgpu_device_init(). If the function exits early
due to an error, the memory is unmapped. If the function completes
successfully, the memory remains mapped.
Reported by smatch:
drivers/gpu/drm/amd/amdgpu/amdgpu_device.c:4337 amdgpu_device_init() warn:
'adev->rmmio' from ioremap() not released on lines:
4035,4045,4051,4058,4068,4337
Cc: Christian König
Cc: Alex Deucher
Signed-off-by: Srinivasan Shanmugam
---
v2:
- updated commit message
- use a goto label and error handling instead (Christian)
drivers/gpu/drm/amd/amdgpu/amdgpu_device.c | 16 ++--
1 file changed, 10 insertions(+), 6 deletions(-)
diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c
b/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c
index 1ef892bea488..d0e77bbee60e 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c
@@ -4031,8 +4031,10 @@ int amdgpu_device_init(struct amdgpu_device *adev,
* early on during init and before calling to RREG32.
*/
adev->reset_domain = amdgpu_reset_create_reset_domain(SINGLE_DEVICE,
"amdgpu-reset-dev");
- if (!adev->reset_domain)
- return -ENOMEM;
+ if (!adev->reset_domain) {
+ r = -ENOMEM;
+ goto unmap_memory;
+ }
/* detect hw virtualization here */
amdgpu_detect_virtualization(adev);
@@ -4042,20 +4044,20 @@ int amdgpu_device_init(struct amdgpu_device *adev,
r = amdgpu_device_get_job_timeout_settings(adev);
if (r) {
dev_err(adev->dev, "invalid lockup_timeout parameter syntax\n");
- return r;
+ goto unmap_memory;
}
/* early init functions */
r = amdgpu_device_ip_early_init(adev);
if (r)
- return r;
+ goto unmap_memory;
amdgpu_device_set_mcbp(adev);
/* Get rid of things like offb */
r = drm_aperture_remove_conflicting_pci_framebuffers(adev->pdev,
&amdgpu_kms_driver);
if (r)
- return r;
+ goto unmap_memory;
/* Enable TMZ based on IP_VERSION */
amdgpu_gmc_tmz_set(adev);
@@ -4065,7 +4067,7 @@ int amdgpu_device_init(struct amdgpu_device *adev,
if (adev->gmc.xgmi.supported) {
r = adev->gfxhub.funcs->get_xgmi_info(adev);
if (r)
- return r;
+ goto unmap_memory;
}
/* enable PCIE atomic ops */
@@ -4334,6 +4336,8 @@ int amdgpu_device_init(struct amdgpu_device *adev,
failed:
amdgpu_vf_error_trans_all(adev);
+unmap_memory:
+ iounmap(adev->rmmio);
return r;
}
--
2.34.1
[PATCH] drm/amdgpu: Fix potential truncation by increasing SMU_FW_NAME_LEN
Increases the size of SMU_FW_NAME_LEN from 0x24 (36 in decimal) to 0x2A
(42 in decimal). This change prevents truncation when the snprintf
function writes into the fw_name buffer in the smu_v11_0_init_microcode
function.
Previously, snprintf could write between 12 and 41 bytes into fw_name,
which can only hold 36 bytes. This could lead to truncation if the size
of the string is larger than 36 bytes. By increasing the size of
SMU_FW_NAME_LEN to 42, we ensure that fw_name can accommodate the
maximum possible string size.
Fixes the below with gcc W=1
drivers/gpu/drm/amd/amdgpu/../pm/swsmu/smu11/smu_v11_0.c: In function
‘smu_v11_0_init_microcode’:
drivers/gpu/drm/amd/amdgpu/../pm/swsmu/smu11/smu_v11_0.c:110:54: warning:
‘.bin’ directive output may be truncated writing 4 bytes into a region of size
between 0 and 29 [-Wformat-truncation=]
110 | snprintf(fw_name, sizeof(fw_name), "amdgpu/%s.bin",
ucode_prefix);
| ^~~~
drivers/gpu/drm/amd/amdgpu/../pm/swsmu/smu11/smu_v11_0.c:110:9: note:
‘snprintf’ output between 12 and 41 bytes into a destination of size 36
110 | snprintf(fw_name, sizeof(fw_name), "amdgpu/%s.bin",
ucode_prefix);
|
^
Fixes: 6b54496238cc ("drm/amd: Convert SMUv11 microcode to use
`amdgpu_ucode_ip_version_decode`")
Cc: Mario Limonciello
Cc: Christian König
Cc: Alex Deucher
Cc: Lijo Lazar
Signed-off-by: Srinivasan Shanmugam
---
drivers/gpu/drm/amd/pm/swsmu/inc/amdgpu_smu.h | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/gpu/drm/amd/pm/swsmu/inc/amdgpu_smu.h
b/drivers/gpu/drm/amd/pm/swsmu/inc/amdgpu_smu.h
index a870bdd49a4e..3d98b0e0eec2 100644
--- a/drivers/gpu/drm/amd/pm/swsmu/inc/amdgpu_smu.h
+++ b/drivers/gpu/drm/amd/pm/swsmu/inc/amdgpu_smu.h
@@ -35,7 +35,7 @@
#define SMU_THERMAL_MINIMUM_ALERT_TEMP 0
#define SMU_THERMAL_MAXIMUM_ALERT_TEMP 255
#define SMU_TEMPERATURE_UNITS_PER_CENTIGRADES 1000
-#define SMU_FW_NAME_LEN0x24
+#define SMU_FW_NAME_LEN0x2A
#define SMU_DPM_USER_PROFILE_RESTORE (1 << 0)
#define SMU_CUSTOM_FAN_SPEED_RPM (1 << 1)
--
2.34.1
[PATCH] drm/amdgpu: Fix multiple truncation issues in multiple driver files
Fixes snprintf function by writing more bytes into various buffers than they can hold. In several files - smu_v13_0.c, gfx_v11_0.c, gfx_v10_0.c, gfx_v9_0.c, and amdgpu_mes.c. They were related to different directives, such as '%s', '_pfp.bin', '_me.bin', '_rlc.bin', '_mec.bin', '_mec2', and '_mes.bin'. The buffers sizes have been adjusted to accommodate the maximum possible string size. Fixes the below with gcc W=1: drivers/gpu/drm/amd/amdgpu/../pm/swsmu/smu13/smu_v13_0.c:108:52: warning: ‘%s’ directive output may be truncated writing up to 29 bytes into a region of size 23 [-Wformat-truncation=] drivers/gpu/drm/amd/amdgpu/gfx_v11_0.c:523:54: warning: ‘_pfp.bin’ directive output may be truncated writing 8 bytes into a region of size between 4 and 33 [-Wformat-truncation=] drivers/gpu/drm/amd/amdgpu/gfx_v11_0.c:540:54: warning: ‘_me.bin’ directive output may be truncated writing 7 bytes into a region of size between 4 and 33 [-Wformat-truncation=] drivers/gpu/drm/amd/amdgpu/gfx_v11_0.c:557:70: warning: ‘_rlc.bin’ directive output may be truncated writing 8 bytes into a region of size between 4 and 33 [-Wformat-truncation=] drivers/gpu/drm/amd/amdgpu/gfx_v11_0.c:569:54: warning: ‘_mec.bin’ directive output may be truncated writing 8 bytes into a region of size between 4 and 33 [-Wformat-truncation=] drivers/gpu/drm/amd/amdgpu/gfx_v10_0.c:3979:58: warning: ‘%s’ directive output may be truncated writing up to 4 bytes into a region of size between 0 and 29 [-Wformat-truncation=] drivers/gpu/drm/amd/amdgpu/gfx_v10_0.c:3985:57: warning: ‘%s’ directive output may be truncated writing up to 4 bytes into a region of size between 1 and 30 [-Wformat-truncation=] drivers/gpu/drm/amd/amdgpu/gfx_v10_0.c:3991:57: warning: ‘%s’ directive output may be truncated writing up to 4 bytes into a region of size between 1 and 30 [-Wformat-truncation=] drivers/gpu/drm/amd/amdgpu/gfx_v10_0.c:3998:62: warning: ‘_rlc.bin’ directive output may be truncated writing 8 bytes into a region of size between 4 and 33 [-Wformat-truncation=] drivers/gpu/drm/amd/amdgpu/gfx_v10_0.c:4014:58: warning: ‘%s’ directive output may be truncated writing up to 4 bytes into a region of size between 0 and 29 [-Wformat-truncation=] drivers/gpu/drm/amd/amdgpu/gfx_v10_0.c:4021:54: warning: ‘_mec2’ directive output may be truncated writing 5 bytes into a region of size between 4 and 33 [-Wformat-truncation=] drivers/gpu/drm/amd/amdgpu/gfx_v9_0.c:1255:52: warning: ‘%s’ directive output may be truncated writing up to 29 bytes into a region of size 23 [-Wformat-truncation=] drivers/gpu/drm/amd/amdgpu/gfx_v9_0.c:1261:52: warning: ‘%s’ directive output may be truncated writing up to 29 bytes into a region of size 23 [-Wformat-truncation=] drivers/gpu/drm/amd/amdgpu/gfx_v9_0.c:1267:52: warning: ‘%s’ directive output may be truncated writing up to 29 bytes into a region of size 23 [-Wformat-truncation=] drivers/gpu/drm/amd/amdgpu/gfx_v9_0.c:1303:60: warning: ‘%s’ directive output may be truncated writing up to 29 bytes into a region of size 23 [-Wformat-truncation=] drivers/gpu/drm/amd/amdgpu/gfx_v9_0.c:1309:60: warning: ‘%s’ directive output may be truncated writing up to 29 bytes into a region of size 23 [-Wformat-truncation=] drivers/gpu/drm/amd/amdgpu/gfx_v9_0.c:1311:60: warning: ‘%s’ directive output may be truncated writing up to 29 bytes into a region of size 23 [-Wformat-truncation=] drivers/gpu/drm/amd/amdgpu/gfx_v9_0.c:1344:60: warning: ‘%s’ directive output may be truncated writing up to 29 bytes into a region of size 23 [-Wformat-truncation=] drivers/gpu/drm/amd/amdgpu/gfx_v9_0.c:1346:60: warning: ‘%s’ directive output may be truncated writing up to 29 bytes into a region of size 23 [-Wformat-truncation=] drivers/gpu/drm/amd/amdgpu/gfx_v9_0.c:1356:68: warning: ‘%s’ directive output may be truncated writing up to 29 bytes into a region of size 23 [-Wformat-truncation=] drivers/gpu/drm/amd/amdgpu/gfx_v9_0.c:1358:68: warning: ‘%s’ directive output may be truncated writing up to 29 bytes into a region of size 23 [-Wformat-truncation=] drivers/gpu/drm/amd/amdgpu/amdgpu_mes.c:1486:66: warning: ‘%s’ directive output may be truncated writing up to 1 bytes into a region of size between 0 and 29 [-Wformat-truncation=] drivers/gpu/drm/amd/amdgpu/amdgpu_mes.c:1481:66: warning: ‘%s’ directive output may be truncated writing 1 byte into a region of size between 0 and 29 [-Wformat-truncation=] drivers/gpu/drm/amd/amdgpu/amdgpu_mes.c:1481:66: warning: ‘%s’ directive output may be truncated writing 2 bytes into a region of size between 0 and 29 [-Wformat-truncation=] drivers/gpu/drm/amd/amdgpu/amdgpu_mes.c:1493:62: warning: ‘_mes.bin’ directive output may be truncated writing 8 bytes into a region of size between 4 and 33 [-Wformat-truncation=] Cc: Christian König Cc: Alex Deucher Signed-off-by: Srinivasan Shanmugam --- drivers/gpu/drm/amd/amdg
[PATCH] drm/amd/display: Fix potential index out of bounds in color transformation function
Fixes index out of bounds issue in the color transformation function.
The issue could occur when the index 'i' exceeds the number of transfer
function points (TRANSFER_FUNC_POINTS).
The fix adds a check to ensure 'i' is within bounds before accessing the
transfer function points. If 'i' is out of bounds, an error message is
logged and the function returns false to indicate an error.
Reported by smatch:
drivers/gpu/drm/amd/amdgpu/../display/dc/dcn10/dcn10_cm_common.c:405
cm_helper_translate_curve_to_hw_format() error: buffer overflow
'output_tf->tf_pts.red' 1025 <= s32max
drivers/gpu/drm/amd/amdgpu/../display/dc/dcn10/dcn10_cm_common.c:406
cm_helper_translate_curve_to_hw_format() error: buffer overflow
'output_tf->tf_pts.green' 1025 <= s32max
drivers/gpu/drm/amd/amdgpu/../display/dc/dcn10/dcn10_cm_common.c:407
cm_helper_translate_curve_to_hw_format() error: buffer overflow
'output_tf->tf_pts.blue' 1025 <= s32max
Fixes: b629596072e5 ("drm/amd/display: Build unity lut for shaper")
Cc: Vitaly Prosyak
Cc: Charlene Liu
Cc: Harry Wentland
Cc: Rodrigo Siqueira
Cc: Roman Li
Cc: Aurabindo Pillai
Cc: Tom Chung
Signed-off-by: Srinivasan Shanmugam
---
drivers/gpu/drm/amd/display/dc/dcn10/dcn10_cm_common.c | 5 +
1 file changed, 5 insertions(+)
diff --git a/drivers/gpu/drm/amd/display/dc/dcn10/dcn10_cm_common.c
b/drivers/gpu/drm/amd/display/dc/dcn10/dcn10_cm_common.c
index b7e57aa27361..b0d192c6e63e 100644
--- a/drivers/gpu/drm/amd/display/dc/dcn10/dcn10_cm_common.c
+++ b/drivers/gpu/drm/amd/display/dc/dcn10/dcn10_cm_common.c
@@ -402,6 +402,11 @@ bool cm_helper_translate_curve_to_hw_format(struct
dc_context *ctx,
i += increment) {
if (j == hw_points - 1)
break;
+ if (i >= TRANSFER_FUNC_POINTS) {
+ DC_LOG_ERROR("Index out of bounds: i=%d,
TRANSFER_FUNC_POINTS=%d\n",
+i, TRANSFER_FUNC_POINTS);
+ return false;
+ }
rgb_resulted[j].red = output_tf->tf_pts.red[i];
rgb_resulted[j].green = output_tf->tf_pts.green[i];
rgb_resulted[j].blue = output_tf->tf_pts.blue[i];
--
2.34.1
[PATCH] drm/amdgpu: Fix potential Spectre vulnerability in amdgpu_gfx_parse_disable_cu()
The 'mask' array could be used in a way that would make the code
vulnerable to a Spectre attack. The issue is likely related to the fact
that the 'mask' array is being indexed using values that are derived
from user input (the 'se' and 'sh' variables), which could potentially
be manipulated by an attacker.
The array_index_nospec() function is typically used in these situations
where an array index is derived from user input or other untrusted data.
By sanitizing the index, it helps to ensure that even if an attacker can
influence the index, they cannot use this to read sensitive data from
other parts of the array or memory.
The array indices are now sanitized using the array_index_nospec()
function, which ensures that the index cannot be greater than the size
of the array, helping to mitigate Spectre attacks.
The array_index_nospec() function, takes two parameters: the array index
and the maximum size of the array. It ensures that the array index is
within the bounds of the array, i.e., it is less than the maximum size
of the array.
If the array index is within bounds, the function returns the index. If
the index is out of bounds, the function returns a safe index (usually
0) instead. This prevents out-of-bounds reads that could potentially be
exploited in a speculative execution attack.
Reported by smatch:
drivers/gpu/drm/amd/amdgpu/amdgpu_gfx.c:136 amdgpu_gfx_parse_disable_cu() warn:
potential spectre issue 'mask' [w]
Fixes: 6f8941a23088 ("drm/amdgpu: add disable_cu parameter")
Cc: Nicolai Hähnle
Cc: Christian König
Cc: Alex Deucher
Signed-off-by: Srinivasan Shanmugam
---
drivers/gpu/drm/amd/amdgpu/amdgpu_gfx.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_gfx.c
b/drivers/gpu/drm/amd/amdgpu/amdgpu_gfx.c
index 4835d6d899e7..2ef31dbdbc3d 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_gfx.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_gfx.c
@@ -24,6 +24,7 @@
*/
#include
+#include
#include "amdgpu.h"
#include "amdgpu_gfx.h"
#include "amdgpu_rlc.h"
@@ -132,8 +133,9 @@ void amdgpu_gfx_parse_disable_cu(unsigned int *mask,
unsigned int max_se, unsign
}
if (se < max_se && sh < max_sh && cu < 16) {
+ unsigned int index = array_index_nospec(se * max_sh +
sh, max_se * max_sh);
DRM_INFO("amdgpu: disabling CU %u.%u.%u\n", se, sh, cu);
- mask[se * max_sh + sh] |= 1u << cu;
+ mask[index] |= 1u << cu;
} else {
DRM_ERROR("amdgpu: disable_cu %u.%u.%u is out of
range\n",
se, sh, cu);
--
2.34.1
Re: [PATCH] drm/amdgpu: Fix the iounmap error of rmmio
On 3/15/2024 10:47 AM, Ma Jun wrote:
Setting the rmmio pointer to NULL to fix the following
iounmap error and calltrace.
iounmap: bad address d0b3631f
Fixes: 923f7a82d2e1 ("drm/amd/amdgpu: Fix potential ioremap() memory leaks in
amdgpu_device_init()")
Signed-off-by: Ma Jun
Acked-by: Srinivasan Shanmugam
---
drivers/gpu/drm/amd/amdgpu/amdgpu_device.c | 7 +--
1 file changed, 5 insertions(+), 2 deletions(-)
diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c
b/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c
index 39dd76e57154..d65a6aabefbb 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c
@@ -4383,6 +4383,7 @@ int amdgpu_device_init(struct amdgpu_device *adev,
unmap_memory:
iounmap(adev->rmmio);
+ adev->rmmio = NULL;
return r;
}
@@ -4514,9 +4515,11 @@ void amdgpu_device_fini_sw(struct amdgpu_device *adev)
#endif
if (drm_dev_enter(adev_to_drm(adev), &idx)) {
+ if (adev->rmmio) {
+ iounmap(adev->rmmio);
+ adev->rmmio = NULL;
+ }
- iounmap(adev->rmmio);
- adev->rmmio = NULL;
amdgpu_doorbell_fini(adev);
drm_dev_exit(idx);
}
[PATCH] drm/amdgpu: Fix truncation issues in smu_v13_0_init_microcode
Fixes the below with gcc W=1:
drivers/gpu/drm/amd/amdgpu/../pm/swsmu/smu13/smu_v13_0.c: In function
‘smu_v13_0_init_microcode’:
drivers/gpu/drm/amd/amdgpu/../pm/swsmu/smu13/smu_v13_0.c:108:52: warning: ‘%s’
directive output may be truncated writing up to 29 bytes into a region of size
23 [-Wformat-truncation=]
108 | snprintf(fw_name, sizeof(fw_name), "amdgpu/%s.bin",
ucode_prefix);
|^~
drivers/gpu/drm/amd/amdgpu/../pm/swsmu/smu13/smu_v13_0.c:108:9: note:
‘snprintf’ output between 12 and 41 bytes into a destination of size 30
108 | snprintf(fw_name, sizeof(fw_name), "amdgpu/%s.bin",
ucode_prefix);
|
^
Cc: Alex Deucher
Cc: Christian König
Signed-off-by: Srinivasan Shanmugam
Suggested-by: Lijo Lazar
---
drivers/gpu/drm/amd/pm/swsmu/smu13/smu_v13_0.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/gpu/drm/amd/pm/swsmu/smu13/smu_v13_0.c
b/drivers/gpu/drm/amd/pm/swsmu/smu13/smu_v13_0.c
index 48170bb5112e..ce16f2a08a47 100644
--- a/drivers/gpu/drm/amd/pm/swsmu/smu13/smu_v13_0.c
+++ b/drivers/gpu/drm/amd/pm/swsmu/smu13/smu_v13_0.c
@@ -93,7 +93,7 @@ int smu_v13_0_init_microcode(struct smu_context *smu)
{
struct amdgpu_device *adev = smu->adev;
char fw_name[30];
- char ucode_prefix[30];
+ char ucode_prefix[15];
int err = 0;
const struct smc_firmware_header_v1_0 *hdr;
const struct common_firmware_header *header;
--
2.34.1
[PATCH] drm/amd/display: Address kdoc for commit_minimal_transition_state_in_dc_update()
Adds descriptions for 'new_context', 'srf_updates', and 'surface_count', and removes the excess description for 'context'. Fixes the below with gcc W=1: drivers/gpu/drm/amd/amdgpu/../display/dc/core/dc.c:4411: warning: Function parameter or member 'new_context' not described in 'commit_minimal_transition_state_in_dc_update' drivers/gpu/drm/amd/amdgpu/../display/dc/core/dc.c:4411: warning: Function parameter or member 'srf_updates' not described in 'commit_minimal_transition_state_in_dc_update' drivers/gpu/drm/amd/amdgpu/../display/dc/core/dc.c:4411: warning: Function parameter or member 'surface_count' not described in 'commit_minimal_transition_state_in_dc_update' drivers/gpu/drm/amd/amdgpu/../display/dc/core/dc.c:4411: warning: Excess function parameter 'context' description in 'commit_minimal_transition_state_in_dc_update' Cc: Wenjing Liu Cc: Alex Hung Cc: Rodrigo Siqueira Cc: Roman Li Cc: Aurabindo Pillai Cc: Tom Chung Signed-off-by: Srinivasan Shanmugam --- drivers/gpu/drm/amd/display/dc/core/dc.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/drivers/gpu/drm/amd/display/dc/core/dc.c b/drivers/gpu/drm/amd/display/dc/core/dc.c index 119eee2c97d4..08ca97bb4160 100644 --- a/drivers/gpu/drm/amd/display/dc/core/dc.c +++ b/drivers/gpu/drm/amd/display/dc/core/dc.c @@ -4391,8 +4391,10 @@ static bool commit_minimal_transition_based_on_current_context(struct dc *dc, * on current or new context * * @dc: DC structure, used to get the current state - * @context: New context + * @new_context: New context * @stream: Stream getting the update for the flip + * @srf_updates: Surface updates + * @surface_count: Number of surfaces * * The function takes in current state and new state and determine a minimal * transition state as the intermediate step which could make the transition -- 2.34.1
[PATCH] drm/amdgpu: Fix format character cut-off issues in amdgpu_vcn_early_init()
The issue was present in the lines where 'fw_name' was being formatted.
This fix ensures that the output is not truncated
Fixes the below with gcc W=1:
drivers/gpu/drm/amd/amdgpu/amdgpu_vcn.c: In function ‘amdgpu_vcn_early_init’:
drivers/gpu/drm/amd/amdgpu/amdgpu_vcn.c:102:66: warning: ‘snprintf’ output may
be truncated before the last format character [-Wformat-truncation=]
102 | snprintf(fw_name, sizeof(fw_name), "amdgpu/%s.bin",
ucode_prefix);
| ^
drivers/gpu/drm/amd/amdgpu/amdgpu_vcn.c:102:17: note: ‘snprintf’ output between
12 and 41 bytes into a destination of size 40
102 | snprintf(fw_name, sizeof(fw_name), "amdgpu/%s.bin",
ucode_prefix);
|
^
drivers/gpu/drm/amd/amdgpu/amdgpu_vcn.c:102:66: warning: ‘snprintf’ output may
be truncated before the last format character [-Wformat-truncation=]
102 | snprintf(fw_name, sizeof(fw_name), "amdgpu/%s.bin",
ucode_prefix);
| ^
drivers/gpu/drm/amd/amdgpu/amdgpu_vcn.c:102:17: note: ‘snprintf’ output between
12 and 41 bytes into a destination of size 40
102 | snprintf(fw_name, sizeof(fw_name), "amdgpu/%s.bin",
ucode_prefix);
|
^
drivers/gpu/drm/amd/amdgpu/amdgpu_vcn.c:105:73: warning: ‘.bin’ directive
output may be truncated writing 4 bytes into a region of size between 2 and 31
[-Wformat-truncation=]
105 | snprintf(fw_name, sizeof(fw_name),
"amdgpu/%s_%d.bin", ucode_prefix, i);
|
^~~~
drivers/gpu/drm/amd/amdgpu/amdgpu_vcn.c:105:25: note: ‘snprintf’ output between
14 and 43 bytes into a destination of size 40
105 | snprintf(fw_name, sizeof(fw_name),
"amdgpu/%s_%d.bin", ucode_prefix, i);
|
^~~
Cc: Alex Deucher
Cc: Christian König
Suggested-by: Lijo Lazar
Signed-off-by: Srinivasan Shanmugam
---
drivers/gpu/drm/amd/amdgpu/amdgpu_vcn.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_vcn.c
b/drivers/gpu/drm/amd/amdgpu/amdgpu_vcn.c
index 9c514a606a2f..f994ee6c548d 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_vcn.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_vcn.c
@@ -94,7 +94,7 @@ static void amdgpu_vcn_idle_work_handler(struct work_struct
*work);
int amdgpu_vcn_early_init(struct amdgpu_device *adev)
{
char ucode_prefix[30];
- char fw_name[40];
+ char fw_name[42];
int r, i;
for (i = 0; i < adev->vcn.num_vcn_inst; i++) {
--
2.34.1
Re: [PATCH] drm/amdgpu: Fix format character cut-off issues in amdgpu_vcn_early_init()
On 3/20/2024 3:12 PM, Lazar, Lijo wrote:
On 3/20/2024 2:15 PM, Srinivasan Shanmugam wrote:
The issue was present in the lines where 'fw_name' was being formatted.
This fix ensures that the output is not truncated
Fixes the below with gcc W=1:
drivers/gpu/drm/amd/amdgpu/amdgpu_vcn.c: In function ‘amdgpu_vcn_early_init’:
drivers/gpu/drm/amd/amdgpu/amdgpu_vcn.c:102:66: warning: ‘snprintf’ output may
be truncated before the last format character [-Wformat-truncation=]
102 | snprintf(fw_name, sizeof(fw_name), "amdgpu/%s.bin",
ucode_prefix);
| ^
drivers/gpu/drm/amd/amdgpu/amdgpu_vcn.c:102:17: note: ‘snprintf’ output between
12 and 41 bytes into a destination of size 40
102 | snprintf(fw_name, sizeof(fw_name), "amdgpu/%s.bin",
ucode_prefix);
|
^
drivers/gpu/drm/amd/amdgpu/amdgpu_vcn.c:102:66: warning: ‘snprintf’ output may
be truncated before the last format character [-Wformat-truncation=]
102 | snprintf(fw_name, sizeof(fw_name), "amdgpu/%s.bin",
ucode_prefix);
| ^
drivers/gpu/drm/amd/amdgpu/amdgpu_vcn.c:102:17: note: ‘snprintf’ output between
12 and 41 bytes into a destination of size 40
102 | snprintf(fw_name, sizeof(fw_name), "amdgpu/%s.bin",
ucode_prefix);
|
^
drivers/gpu/drm/amd/amdgpu/amdgpu_vcn.c:105:73: warning: ‘.bin’ directive
output may be truncated writing 4 bytes into a region of size between 2 and 31
[-Wformat-truncation=]
105 | snprintf(fw_name, sizeof(fw_name),
"amdgpu/%s_%d.bin", ucode_prefix, i);
|
^~~~
drivers/gpu/drm/amd/amdgpu/amdgpu_vcn.c:105:25: note: ‘snprintf’ output between
14 and 43 bytes into a destination of size 40
105 | snprintf(fw_name, sizeof(fw_name),
"amdgpu/%s_%d.bin", ucode_prefix, i);
|
^~~
Cc: Alex Deucher
Cc: Christian König
Suggested-by: Lijo Lazar
Signed-off-by: Srinivasan Shanmugam
---
drivers/gpu/drm/amd/amdgpu/amdgpu_vcn.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_vcn.c
b/drivers/gpu/drm/amd/amdgpu/amdgpu_vcn.c
index 9c514a606a2f..f994ee6c548d 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_vcn.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_vcn.c
@@ -94,7 +94,7 @@ static void amdgpu_vcn_idle_work_handler(struct work_struct
*work);
int amdgpu_vcn_early_init(struct amdgpu_device *adev)
{
char ucode_prefix[30];
Hi Srini,
Sorry, if I miscommunicated. Suggestion was to reduce prefix size to 25
as the max prefix length is possibly length of dimgrey_cavefish_vcn.
Hi Lijo,
my mistake, the fw_name size must have been 53.
How 53? -> The size of ucode_prefix is 30, so the maximum length of
ucode_prefix is 29 characters (since one character is needed for the
null terminator). The maximum number of digits in an integer is 10.
Therefore, the maximum possible length of the string written into
fw_name is 14 + 29 + 10 = 53 characters.
On the other hand reducing ucode_prefix to 25 from 30:
1. The length of the string "amdgpu/%s.bin" is 12 characters plus the
length of ucode_prefix. The length of the string "amdgpu/%s_%d.bin" is
14 characters plus the length of ucode_prefix and the number of digits in i.
If ucode_prefix is 25 characters long, the maximum length of the string
written into fw_name is 14 + 25 + 1 (for a single digit i) = 40
characters, which is exactly the size of fw_name.
Is that this solution assumes that i will not be more than 9 (a single
digit)?. If i can be a number with more than one digit, should we need
to increase the size of fw_name accordingly.?
2. If you reduce the size of ucode_prefix to 25, it means that it can
store a version string of up to 24 characters (since one character is
needed for the null terminator).
For example: if tomorrow, if we get something like
dimgrey_cavefish_smc_xxxyyyzz - then in this case yyyzz would be lost?
is that in "amdgpu_ucode_ip_version_decode " &
"amdgpu_ucode_legacy_naming" , is that are we always ensuring that it
will never be longer than 24 characters?
Thanks,
Srini
With fw_name[42] also, you may run into 43 bytes (30 prefix + 13 for
others) warning.
Thanks,
Lijo
- char fw_name[40];
+ char fw_name[42];
int r, i;
for (i = 0; i < adev->vcn.num_vcn_inst; i++) {
[PATCH v2] drm/amdgpu: Fix format character cut-off issues in amdgpu_vcn_early_init()
Reducing the size of ucode_prefix to 25 in the amdgpu_vcn_early_init
function. This would ensure that the total number of characters being
written into fw_name does not exceed its size of 40.
Fixes the below with gcc W=1:
drivers/gpu/drm/amd/amdgpu/amdgpu_vcn.c: In function ‘amdgpu_vcn_early_init’:
drivers/gpu/drm/amd/amdgpu/amdgpu_vcn.c:102:66: warning: ‘snprintf’ output may
be truncated before the last format character [-Wformat-truncation=]
102 | snprintf(fw_name, sizeof(fw_name), "amdgpu/%s.bin",
ucode_prefix);
| ^
drivers/gpu/drm/amd/amdgpu/amdgpu_vcn.c:102:17: note: ‘snprintf’ output between
12 and 41 bytes into a destination of size 40
102 | snprintf(fw_name, sizeof(fw_name), "amdgpu/%s.bin",
ucode_prefix);
|
^
drivers/gpu/drm/amd/amdgpu/amdgpu_vcn.c:102:66: warning: ‘snprintf’ output may
be truncated before the last format character [-Wformat-truncation=]
102 | snprintf(fw_name, sizeof(fw_name), "amdgpu/%s.bin",
ucode_prefix);
| ^
drivers/gpu/drm/amd/amdgpu/amdgpu_vcn.c:102:17: note: ‘snprintf’ output between
12 and 41 bytes into a destination of size 40
102 | snprintf(fw_name, sizeof(fw_name), "amdgpu/%s.bin",
ucode_prefix);
|
^
drivers/gpu/drm/amd/amdgpu/amdgpu_vcn.c:105:73: warning: ‘.bin’ directive
output may be truncated writing 4 bytes into a region of size between 2 and 31
[-Wformat-truncation=]
105 | snprintf(fw_name, sizeof(fw_name),
"amdgpu/%s_%d.bin", ucode_prefix, i);
|
^~~~
drivers/gpu/drm/amd/amdgpu/amdgpu_vcn.c:105:25: note: ‘snprintf’ output between
14 and 43 bytes into a destination of size 40
105 | snprintf(fw_name, sizeof(fw_name),
"amdgpu/%s_%d.bin", ucode_prefix, i);
|
^~~
Cc: Alex Deucher
Cc: Christian König
Suggested-by: Lijo Lazar
Signed-off-by: Srinivasan Shanmugam
---
v2:
- Reduced ucode_prefix instead of changing fw_name (Lijo)
- updated commit message
drivers/gpu/drm/amd/amdgpu/amdgpu_vcn.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_vcn.c
b/drivers/gpu/drm/amd/amdgpu/amdgpu_vcn.c
index 9c514a606a2f..bb85772b1374 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_vcn.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_vcn.c
@@ -93,7 +93,7 @@ static void amdgpu_vcn_idle_work_handler(struct work_struct
*work);
int amdgpu_vcn_early_init(struct amdgpu_device *adev)
{
- char ucode_prefix[30];
+ char ucode_prefix[25];
char fw_name[40];
int r, i;
--
2.34.1
[PATCH] drm/amdgpu: Fix 'fw_name' buffer size to prevent truncations in amdgpu_mes_init_microcode
of(fw_name), "amdgpu/%s_mes.bin", | ^~~~~~~ 1490 | ucode_prefix); | ~ Cc: Alex Deucher Cc: Christian König Suggested-by: Lijo Lazar Signed-off-by: Srinivasan Shanmugam --- drivers/gpu/drm/amd/amdgpu/amdgpu_mes.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_mes.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_mes.c index bc8906403270..78dfd027dc99 100644 --- a/drivers/gpu/drm/amd/amdgpu/amdgpu_mes.c +++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_mes.c @@ -1467,7 +1467,7 @@ int amdgpu_mes_init_microcode(struct amdgpu_device *adev, int pipe) const struct mes_firmware_header_v1_0 *mes_hdr; struct amdgpu_firmware_info *info; char ucode_prefix[30]; - char fw_name[40]; + char fw_name[50]; bool need_retry = false; int r; -- 2.34.1
[PATCH] drm/amdgpu: Fix truncation issues in gfx_v9_0.c
drivers/gpu/drm/amd/amdgpu/gfx_v9_0.c:1344:60: warning: ‘%s’ directive output
may be truncated writing up to 29 bytes into a region of size 23
[-Wformat-truncation=]
1344 | snprintf(fw_name, sizeof(fw_name),
"amdgpu/%s_sjt_mec.bin", chip_name);
|^~
..
1402 | r = gfx_v9_0_init_cp_compute_microcode(adev, ucode_prefix);
|
drivers/gpu/drm/amd/amdgpu/gfx_v9_0.c:1344:17: note: ‘snprintf’ output between
20 and 49 bytes into a destination of size 30
1344 | snprintf(fw_name, sizeof(fw_name),
"amdgpu/%s_sjt_mec.bin", chip_name);
|
^~
drivers/gpu/drm/amd/amdgpu/gfx_v9_0.c:1346:60: warning: ‘%s’ directive output
may be truncated writing up to 29 bytes into a region of size 23
[-Wformat-truncation=]
1346 | snprintf(fw_name, sizeof(fw_name), "amdgpu/%s_mec.bin",
chip_name);
|^~
..
1402 | r = gfx_v9_0_init_cp_compute_microcode(adev, ucode_prefix);
|
drivers/gpu/drm/amd/amdgpu/gfx_v9_0.c:1346:17: note: ‘snprintf’ output between
16 and 45 bytes into a destination of size 30
1346 | snprintf(fw_name, sizeof(fw_name), "amdgpu/%s_mec.bin",
chip_name);
|
^~
drivers/gpu/drm/amd/amdgpu/gfx_v9_0.c:1356:68: warning: ‘%s’ directive output
may be truncated writing up to 29 bytes into a region of size 23
[-Wformat-truncation=]
1356 | snprintf(fw_name, sizeof(fw_name),
"amdgpu/%s_sjt_mec2.bin", chip_name);
|^~
..
1402 | r = gfx_v9_0_init_cp_compute_microcode(adev, ucode_prefix);
|
drivers/gpu/drm/amd/amdgpu/gfx_v9_0.c:1356:25: note: ‘snprintf’ output between
21 and 50 bytes into a destination of size 30
1356 | snprintf(fw_name, sizeof(fw_name),
"amdgpu/%s_sjt_mec2.bin", chip_name);
|
^~~
drivers/gpu/drm/amd/amdgpu/gfx_v9_0.c:1358:68: warning: ‘%s’ directive output
may be truncated writing up to 29 bytes into a region of size 23
[-Wformat-truncation=]
1358 | snprintf(fw_name, sizeof(fw_name),
"amdgpu/%s_mec2.bin", chip_name);
|^~
..
1402 | r = gfx_v9_0_init_cp_compute_microcode(adev, ucode_prefix);
|
drivers/gpu/drm/amd/amdgpu/gfx_v9_0.c:1358:25: note: ‘snprintf’ output between
17 and 46 bytes into a destination of size 30
1358 | snprintf(fw_name, sizeof(fw_name),
"amdgpu/%s_mec2.bin", chip_name);
|
^~~
Cc: Alex Deucher
Cc: Christian König
Suggested-by: Lijo Lazar
Signed-off-by: Srinivasan Shanmugam
---
drivers/gpu/drm/amd/amdgpu/gfx_v9_0.c | 6 +++---
1 file changed, 3 insertions(+), 3 deletions(-)
diff --git a/drivers/gpu/drm/amd/amdgpu/gfx_v9_0.c
b/drivers/gpu/drm/amd/amdgpu/gfx_v9_0.c
index 6f97a6d0e6d0..71b555993b7a 100644
--- a/drivers/gpu/drm/amd/amdgpu/gfx_v9_0.c
+++ b/drivers/gpu/drm/amd/amdgpu/gfx_v9_0.c
@@ -1249,7 +1249,7 @@ static void gfx_v9_0_check_if_need_gfxoff(struct
amdgpu_device *adev)
static int gfx_v9_0_init_cp_gfx_microcode(struct amdgpu_device *adev,
char *chip_name)
{
- char fw_name[30];
+ char fw_name[50];
int err;
snprintf(fw_name, sizeof(fw_name), "amdgpu/%s_pfp.bin", chip_name);
@@ -1282,7 +1282,7 @@ static int gfx_v9_0_init_cp_gfx_microcode(struct
amdgpu_device *adev,
static int gfx_v9_0_init_rlc_microcode(struct amdgpu_device *adev,
char *chip_name)
{
- char fw_name[30];
+ char fw_name[53];
int err;
const struct rlc_firmware_header_v2_0 *rlc_hdr;
uint16_t version_major;
@@ -1337,7 +1337,7 @@ static bool gfx_v9_0_load_mec2_fw_bin_support(struct
amdgpu_device *adev)
static int gfx_v9_0_init_cp_compute_microcode(struct amdgpu_device *adev,
char *chip_name)
{
- char fw_name[30];
+ char fw_name[50];
int err;
if (amdgpu_sriov_vf(adev) && (adev->asic_type == CHIP_ALDEBARAN))
--
2.34.1
[PATCH] drm/amdgpu: Fix truncations in gfx_v11_0_init_microcode()
Reducing the size of ucode_prefix to 25 in the gfx_v11_0_init_microcode
function. This would ensure that the total number of characters being
written into fw_name does not exceed its size of 40.
Fixes the below with gcc W=1:
drivers/gpu/drm/amd/amdgpu/gfx_v11_0.c: In function ‘gfx_v11_0_early_init’:
drivers/gpu/drm/amd/amdgpu/gfx_v11_0.c:523:54: warning: ‘_pfp.bin’ directive
output may be truncated writing 8 bytes into a region of size between 4 and 33
[-Wformat-truncation=]
523 | snprintf(fw_name, sizeof(fw_name), "amdgpu/%s_pfp.bin",
ucode_prefix);
| ^~~~
drivers/gpu/drm/amd/amdgpu/gfx_v11_0.c:523:9: note: ‘snprintf’ output between
16 and 45 bytes into a destination of size 40
523 | snprintf(fw_name, sizeof(fw_name), "amdgpu/%s_pfp.bin",
ucode_prefix);
|
^
drivers/gpu/drm/amd/amdgpu/gfx_v11_0.c:540:54: warning: ‘_me.bin’ directive
output may be truncated writing 7 bytes into a region of size between 4 and 33
[-Wformat-truncation=]
540 | snprintf(fw_name, sizeof(fw_name), "amdgpu/%s_me.bin",
ucode_prefix);
| ^~~
drivers/gpu/drm/amd/amdgpu/gfx_v11_0.c:540:9: note: ‘snprintf’ output between
15 and 44 bytes into a destination of size 40
540 | snprintf(fw_name, sizeof(fw_name), "amdgpu/%s_me.bin",
ucode_prefix);
|
^~~~
drivers/gpu/drm/amd/amdgpu/gfx_v11_0.c:557:70: warning: ‘_rlc.bin’ directive
output may be truncated writing 8 bytes into a region of size between 4 and 33
[-Wformat-truncation=]
557 | snprintf(fw_name, sizeof(fw_name),
"amdgpu/%s_rlc.bin", ucode_prefix);
|
^~~~
drivers/gpu/drm/amd/amdgpu/gfx_v11_0.c:557:25: note: ‘snprintf’ output between
16 and 45 bytes into a destination of size 40
557 | snprintf(fw_name, sizeof(fw_name),
"amdgpu/%s_rlc.bin", ucode_prefix);
|
^
drivers/gpu/drm/amd/amdgpu/gfx_v11_0.c:569:54: warning: ‘_mec.bin’ directive
output may be truncated writing 8 bytes into a region of size between 4 and 33
[-Wformat-truncation=]
569 | snprintf(fw_name, sizeof(fw_name), "amdgpu/%s_mec.bin",
ucode_prefix);
| ^~~~
drivers/gpu/drm/amd/amdgpu/gfx_v11_0.c:569:9: note: ‘snprintf’ output between
16 and 45 bytes into a destination of size 40
569 | snprintf(fw_name, sizeof(fw_name), "amdgpu/%s_mec.bin",
ucode_prefix);
|
^
CC [M]
drivers/gpu/drm/amd/amdgpu/../pm/powerplay/hwmgr/smu7_clockpowergating.o
Cc: Alex Deucher
Cc: Christian König
Suggested-by: Lijo Lazar
Signed-off-by: Srinivasan Shanmugam
---
drivers/gpu/drm/amd/amdgpu/gfx_v11_0.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/gpu/drm/amd/amdgpu/gfx_v11_0.c
b/drivers/gpu/drm/amd/amdgpu/gfx_v11_0.c
index 1770e496c1b7..7a906318e451 100644
--- a/drivers/gpu/drm/amd/amdgpu/gfx_v11_0.c
+++ b/drivers/gpu/drm/amd/amdgpu/gfx_v11_0.c
@@ -510,7 +510,7 @@ static void gfx_v11_0_check_fw_cp_gfx_shadow(struct
amdgpu_device *adev)
static int gfx_v11_0_init_microcode(struct amdgpu_device *adev)
{
char fw_name[40];
- char ucode_prefix[30];
+ char ucode_prefix[25];
int err;
const struct rlc_firmware_header_v2_0 *rlc_hdr;
uint16_t version_major;
--
2.34.1
[PATCH] drm/amdgpu: Fix truncation in gfx_v10_0_init_microcode
The total size of the fw_name buffer is 8 (for "amdgpu/") + 30 (for
ucode_prefix) + 5 (for "_pfp") + 5 (for "_wks") + 5 (for ".bin") = 53
characters.
Fixes the below with gcc W=1:
drivers/gpu/drm/amd/amdgpu/gfx_v10_0.c: In function ‘gfx_v10_0_early_init’:
drivers/gpu/drm/amd/amdgpu/gfx_v10_0.c:3982:58: warning: ‘%s’ directive output
may be truncated writing up to 4 bytes into a region of size between 0 and 29
[-Wformat-truncation=]
3982 | snprintf(fw_name, sizeof(fw_name), "amdgpu/%s_pfp%s.bin",
ucode_prefix, wks);
| ^~
drivers/gpu/drm/amd/amdgpu/gfx_v10_0.c:3982:9: note: ‘snprintf’ output between
16 and 49 bytes into a destination of size 40
3982 | snprintf(fw_name, sizeof(fw_name), "amdgpu/%s_pfp%s.bin",
ucode_prefix, wks);
|
^~~~
drivers/gpu/drm/amd/amdgpu/gfx_v10_0.c:3988:57: warning: ‘%s’ directive output
may be truncated writing up to 4 bytes into a region of size between 1 and 30
[-Wformat-truncation=]
3988 | snprintf(fw_name, sizeof(fw_name), "amdgpu/%s_me%s.bin",
ucode_prefix, wks);
| ^~
drivers/gpu/drm/amd/amdgpu/gfx_v10_0.c:3988:9: note: ‘snprintf’ output between
15 and 48 bytes into a destination of size 40
3988 | snprintf(fw_name, sizeof(fw_name), "amdgpu/%s_me%s.bin",
ucode_prefix, wks);
|
^~~
drivers/gpu/drm/amd/amdgpu/gfx_v10_0.c:3994:57: warning: ‘%s’ directive output
may be truncated writing up to 4 bytes into a region of size between 1 and 30
[-Wformat-truncation=]
3994 | snprintf(fw_name, sizeof(fw_name), "amdgpu/%s_ce%s.bin",
ucode_prefix, wks);
| ^~
drivers/gpu/drm/amd/amdgpu/gfx_v10_0.c:3994:9: note: ‘snprintf’ output between
15 and 48 bytes into a destination of size 40
3994 | snprintf(fw_name, sizeof(fw_name), "amdgpu/%s_ce%s.bin",
ucode_prefix, wks);
|
^~~
drivers/gpu/drm/amd/amdgpu/gfx_v10_0.c:4001:62: warning: ‘_rlc.bin’ directive
output may be truncated writing 8 bytes into a region of size between 4 and 33
[-Wformat-truncation=]
4001 | snprintf(fw_name, sizeof(fw_name), "amdgpu/%s_rlc.bin",
ucode_prefix);
| ^~~~
drivers/gpu/drm/amd/amdgpu/gfx_v10_0.c:4001:17: note: ‘snprintf’ output between
16 and 45 bytes into a destination of size 40
4001 | snprintf(fw_name, sizeof(fw_name), "amdgpu/%s_rlc.bin",
ucode_prefix);
|
^
drivers/gpu/drm/amd/amdgpu/gfx_v10_0.c:4017:58: warning: ‘%s’ directive output
may be truncated writing up to 4 bytes into a region of size between 0 and 29
[-Wformat-truncation=]
4017 | snprintf(fw_name, sizeof(fw_name), "amdgpu/%s_mec%s.bin",
ucode_prefix, wks);
| ^~
drivers/gpu/drm/amd/amdgpu/gfx_v10_0.c:4017:9: note: ‘snprintf’ output between
16 and 49 bytes into a destination of size 40
4017 | snprintf(fw_name, sizeof(fw_name), "amdgpu/%s_mec%s.bin",
ucode_prefix, wks);
|
^~~~
drivers/gpu/drm/amd/amdgpu/gfx_v10_0.c:4024:54: warning: ‘_mec2’ directive
output may be truncated writing 5 bytes into a region of size between 4 and 33
[-Wformat-truncation=]
4024 | snprintf(fw_name, sizeof(fw_name), "amdgpu/%s_mec2%s.bin",
ucode_prefix, wks);
| ^
drivers/gpu/drm/amd/amdgpu/gfx_v10_0.c:4024:9: note: ‘snprintf’ output between
17 and 50 bytes into a destination of size 40
4024 | snprintf(fw_name, sizeof(fw_name), "amdgpu/%s_mec2%s.bin",
ucode_prefix, wks);
|
^~~~~
Cc: Alex Deucher
Cc: Christian König
Suggested-by: Lijo Lazar
Signed-off-by: Srinivasan Shanmugam
---
drivers/gpu/drm/amd/amdgpu/gfx_v10_0.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/gpu/drm/amd/amdgpu/gfx_v10_0.c
b/drivers/gpu/drm/amd/amdgpu/gfx_v10_0.c
index f90905ef32c7..d524f1a353ed 100644
--- a/drivers/gpu/drm/amd/amdgpu/gfx_v10_0.c
+++ b/drivers/gpu/drm/amd/amdgpu/gfx_v10_0.c
@@ -3964,7 +3964,7 @@ static void gfx_v10_0_check_gfxoff_flag(struct
amdgpu_device *adev)
static int gfx_v10_0_init_microcode(struct amdgpu_device *adev)
{
- char fw_name[40];
+ char fw_name[53];
char ucode_prefix[30];
const char *wks = "";
int err;
--
2.34.1
[PATCH] drm/amdgpu: Fix truncation in smu_v11_0_init_microcode
Reducing the size of ucode_prefix to 25 in the smu_v11_0_init_microcode
function. we ensure that fw_name can accommodate the maximum possible
string size
Fixes the below with gcc W=1:
drivers/gpu/drm/amd/amdgpu/../pm/swsmu/smu11/smu_v11_0.c: In function
‘smu_v11_0_init_microcode’:
drivers/gpu/drm/amd/amdgpu/../pm/swsmu/smu11/smu_v11_0.c:110:54: warning:
‘.bin’ directive output may be truncated writing 4 bytes into a region of size
between 0 and 29 [-Wformat-truncation=]
110 | snprintf(fw_name, sizeof(fw_name), "amdgpu/%s.bin",
ucode_prefix);
| ^~~~
drivers/gpu/drm/amd/amdgpu/../pm/swsmu/smu11/smu_v11_0.c:110:9: note:
‘snprintf’ output between 12 and 41 bytes into a destination of size 36
110 | snprintf(fw_name, sizeof(fw_name), "amdgpu/%s.bin",
ucode_prefix);
|
^
Cc: Alex Deucher
Cc: Christian König
Suggested-by: Lijo Lazar
Signed-off-by: Srinivasan Shanmugam
---
drivers/gpu/drm/amd/pm/swsmu/smu11/smu_v11_0.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/gpu/drm/amd/pm/swsmu/smu11/smu_v11_0.c
b/drivers/gpu/drm/amd/pm/swsmu/smu11/smu_v11_0.c
index f6545093bfc1..5e5da9b16718 100644
--- a/drivers/gpu/drm/amd/pm/swsmu/smu11/smu_v11_0.c
+++ b/drivers/gpu/drm/amd/pm/swsmu/smu11/smu_v11_0.c
@@ -93,7 +93,7 @@ static void smu_v11_0_poll_baco_exit(struct smu_context *smu)
int smu_v11_0_init_microcode(struct smu_context *smu)
{
struct amdgpu_device *adev = smu->adev;
- char ucode_prefix[30];
+ char ucode_prefix[25];
char fw_name[SMU_FW_NAME_LEN];
int err = 0;
const struct smc_firmware_header_v1_0 *hdr;
--
2.34.1
[PATCH] drm/amd/display: Add missing parameter desc in dc_commit_streams
This commit removes the lines that describe the 'streams'
and 'stream_count' parameters and adds a line to describe the 'params'
parameter, which was missing from the original comment block.
Fixes the below with gcc W=1:
drivers/gpu/drm/amd/amdgpu/../display/dc/core/dc.c:2138: warning: Function
parameter or member 'params' not described in 'dc_commit_streams'
drivers/gpu/drm/amd/amdgpu/../display/dc/core/dc.c:2138: warning: Excess
function parameter 'streams' description in 'dc_commit_streams'
drivers/gpu/drm/amd/amdgpu/../display/dc/core/dc.c:2138: warning: Excess
function parameter 'stream_count' description in 'dc_commit_streams'
Fixes: 515023b2ce5f ("drm/amd/display: Add handling for DC power mode")
Cc: Joshua Aberback
Cc: Rodrigo Siqueira
Cc: Roman Li
Cc: Aurabindo Pillai
Cc: Tom Chung
Signed-off-by: Srinivasan Shanmugam
---
drivers/gpu/drm/amd/display/dc/core/dc.c | 3 +--
1 file changed, 1 insertion(+), 2 deletions(-)
diff --git a/drivers/gpu/drm/amd/display/dc/core/dc.c
b/drivers/gpu/drm/amd/display/dc/core/dc.c
index 5a93278fa246..0ffa79d83bc7 100644
--- a/drivers/gpu/drm/amd/display/dc/core/dc.c
+++ b/drivers/gpu/drm/amd/display/dc/core/dc.c
@@ -2125,8 +2125,7 @@ static bool commit_minimal_transition_state(struct dc *dc,
* dc_commit_streams - Commit current stream state
*
* @dc: DC object with the commit state to be configured in the hardware
- * @streams: Array with a list of stream state
- * @stream_count: Total of streams
+ * @params: Parameters for the commit, including the streams to be committed
*
* Function responsible for commit streams change to the hardware.
*
--
2.34.1
[PATCH] drm/amd/display: Add null check for 'afb' in amdgpu_dm_update_cursor
This commit adds a null check for the 'afb' variable in the
amdgpu_dm_update_cursor function. Previously, 'afb' was assumed to be
null at line 8388, but was used later in the code without a null check.
This could potentially lead to a null pointer dereference.
Fixes the below:
drivers/gpu/drm/amd/amdgpu/../display/amdgpu_dm/amdgpu_dm.c:8433
amdgpu_dm_update_cursor()
error: we previously assumed 'afb' could be null (see line 8388)
drivers/gpu/drm/amd/amdgpu/../display/amdgpu_dm/amdgpu_dm.c
8379 static void amdgpu_dm_update_cursor(struct drm_plane *plane,
8380 struct drm_plane_state
*old_plane_state,
8381 struct dc_stream_update *update)
8382 {
8383 struct amdgpu_device *adev = drm_to_adev(plane->dev);
8384 struct amdgpu_framebuffer *afb =
to_amdgpu_framebuffer(plane->state->fb);
8385 struct drm_crtc *crtc = afb ? plane->state->crtc :
old_plane_state->crtc;
^
8386 struct dm_crtc_state *crtc_state = crtc ?
to_dm_crtc_state(crtc->state) : NULL;
8387 struct amdgpu_crtc *amdgpu_crtc = to_amdgpu_crtc(crtc);
8388 uint64_t address = afb ? afb->address : 0;
^ Checks for NULL
8389 struct dc_cursor_position position = {0};
8390 struct dc_cursor_attributes attributes;
8391 int ret;
8392
8393 if (!plane->state->fb && !old_plane_state->fb)
8394 return;
8395
8396 drm_dbg_atomic(plane->dev, "crtc_id=%d with size %d to %d\n",
8397amdgpu_crtc->crtc_id, plane->state->crtc_w,
8398plane->state->crtc_h);
8399
8400 ret = amdgpu_dm_plane_get_cursor_position(plane, crtc,
&position);
8401 if (ret)
8402 return;
8403
8404 if (!position.enable) {
8405 /* turn off cursor */
8406 if (crtc_state && crtc_state->stream) {
8407
dc_stream_set_cursor_position(crtc_state->stream,
8408 &position);
8409 update->cursor_position =
&crtc_state->stream->cursor_position;
8410 }
8411 return;
8412 }
8413
8414 amdgpu_crtc->cursor_width = plane->state->crtc_w;
8415 amdgpu_crtc->cursor_height = plane->state->crtc_h;
8416
8417 memset(&attributes, 0, sizeof(attributes));
8418 attributes.address.high_part = upper_32_bits(address);
8419 attributes.address.low_part = lower_32_bits(address);
8420 attributes.width = plane->state->crtc_w;
8421 attributes.height= plane->state->crtc_h;
8422 attributes.color_format =
CURSOR_MODE_COLOR_PRE_MULTIPLIED_ALPHA;
8423 attributes.rotation_angle= 0;
8424 attributes.attribute_flags.value = 0;
8425
8426 /* Enable cursor degamma ROM on DCN3+ for implicit sRGB
degamma in DRM
8427 * legacy gamma setup.
8428 */
8429 if (crtc_state->cm_is_degamma_srgb &&
8430 adev->dm.dc->caps.color.dpp.gamma_corr)
8431 attributes.attribute_flags.bits.ENABLE_CURSOR_DEGAMMA
= 1;
8432
--> 8433 attributes.pitch = afb->base.pitches[0] /
afb->base.format->cpp[0];
^ ^
Unchecked dereferences
8434
8435 if (crtc_state->stream) {
8436 if
(!dc_stream_set_cursor_attributes(crtc_state->stream,
8437 &attributes))
8438 DRM_ERROR("DC failed to set cursor
attributes\n");
8439
8440 update->cursor_attributes =
&crtc_state->stream->cursor_attributes;
8441
8442 if (!dc_stream_set_cursor_position(crtc_state->stream,
8443&position))
8444 DRM_ERROR("DC failed to set cursor
position\n");
8445
8446 update->cursor_position =
&crtc_state->stream->cursor_position;
8447 }
8448 }
Fixes: 66eba12a5482 ("drm/amd/display: Do cursor programming with rest of pipe")
Reported-by: Dan Carpenter
Cc: Tom Chung
Cc: Rodrigo Siqueira
Cc: Roman Li
Cc: Hersen Wu
Cc: Alex Hung
Cc: Aurabindo Pillai
Cc: Harry Wentland
Signed-off-by:
[PATCH] drm/amd/display: Add NULL check for 'afb' before dereferencing in amdgpu_dm_plane_handle_cursor_update
This commit adds a null check for the 'afb' variable in the
amdgpu_dm_plane_handle_cursor_update function. Previously, 'afb' was
assumed to be null, but was used later in the code without a null check.
This could potentially lead to a null pointer dereference.
Fixes the below:
drivers/gpu/drm/amd/amdgpu/../display/amdgpu_dm/amdgpu_dm_plane.c:1298
amdgpu_dm_plane_handle_cursor_update() error: we previously assumed 'afb' could
be null (see line 1252)
Cc: Tom Chung
Cc: Rodrigo Siqueira
Cc: Roman Li
Cc: Hersen Wu
Cc: Alex Hung
Cc: Aurabindo Pillai
Cc: Harry Wentland
Signed-off-by: Srinivasan Shanmugam
---
.../drm/amd/display/amdgpu_dm/amdgpu_dm_plane.c | 16
1 file changed, 12 insertions(+), 4 deletions(-)
diff --git a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_plane.c
b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_plane.c
index a64f20fcddaa..b339642b86c0 100644
--- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_plane.c
+++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_plane.c
@@ -1246,14 +1246,22 @@ void amdgpu_dm_plane_handle_cursor_update(struct
drm_plane *plane,
{
struct amdgpu_device *adev = drm_to_adev(plane->dev);
struct amdgpu_framebuffer *afb =
to_amdgpu_framebuffer(plane->state->fb);
- struct drm_crtc *crtc = afb ? plane->state->crtc :
old_plane_state->crtc;
- struct dm_crtc_state *crtc_state = crtc ? to_dm_crtc_state(crtc->state)
: NULL;
- struct amdgpu_crtc *amdgpu_crtc = to_amdgpu_crtc(crtc);
- uint64_t address = afb ? afb->address : 0;
+ struct drm_crtc *crtc;
+ struct dm_crtc_state *crtc_state;
+ struct amdgpu_crtc *amdgpu_crtc;
+ u64 address;
struct dc_cursor_position position = {0};
struct dc_cursor_attributes attributes;
int ret;
+ if (!afb)
+ return;
+
+ crtc = plane->state->crtc ? plane->state->crtc : old_plane_state->crtc;
+ crtc_state = crtc ? to_dm_crtc_state(crtc->state) : NULL;
+ amdgpu_crtc = to_amdgpu_crtc(crtc);
+ address = afb->address;
+
if (!plane->state->fb && !old_plane_state->fb)
return;
--
2.34.1
[PATCH] drm/amdgpu: Move SR-IOV check into amdgpu_gfx_sysfs_compute_init
Previously, this check was performed in the gfx_v9_4_3_sw_init function,
and the amdgpu_gfx_sysfs_compute_init function was only called if the
GPU was not a VF in SR-IOV mode. This is because the sysfs entries
created by amdgpu_gfx_sysfs_compute_init are specific to compute
partitions, which are only applicable on GFX9 and not on a VF in SR-IOV
mode.
By moving the check into amdgpu_gfx_sysfs_compute_init, we make this
function responsible for deciding whether or not to create the compute
partition sysfs entries.
This change improves the code organization and maintainability. If in
the future the conditions for creating the compute partition sysfs
entries change, we would only need to update the
amdgpu_gfx_sysfs_compute_init function.
Cc: Alex Deucher
Cc: Christian König
Suggested-by: Christian König
Signed-off-by: Srinivasan Shanmugam
---
drivers/gpu/drm/amd/amdgpu/amdgpu_gfx.c | 24 +++-
drivers/gpu/drm/amd/amdgpu/amdgpu_gfx.h | 4 ++--
drivers/gpu/drm/amd/amdgpu/gfx_v9_4_3.c | 11 +--
3 files changed, 22 insertions(+), 17 deletions(-)
diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_gfx.c
b/drivers/gpu/drm/amd/amdgpu/amdgpu_gfx.c
index 19b1817b55d7..72477a5aedca 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_gfx.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_gfx.c
@@ -1376,21 +1376,27 @@ static DEVICE_ATTR(current_compute_partition, 0644,
static DEVICE_ATTR(available_compute_partition, 0444,
amdgpu_gfx_get_available_compute_partition, NULL);
-int amdgpu_gfx_sysfs_init(struct amdgpu_device *adev)
+int amdgpu_gfx_sysfs_compute_init(struct amdgpu_device *adev)
{
int r;
- r = device_create_file(adev->dev, &dev_attr_current_compute_partition);
- if (r)
- return r;
+ if (!amdgpu_sriov_vf(adev)) {
+ r = device_create_file(adev->dev,
&dev_attr_current_compute_partition);
+ if (r)
+ return r;
- r = device_create_file(adev->dev,
&dev_attr_available_compute_partition);
+ r = device_create_file(adev->dev,
&dev_attr_available_compute_partition);
+ if (r)
+ return r;
+ }
- return r;
+ return 0;
}
-void amdgpu_gfx_sysfs_fini(struct amdgpu_device *adev)
+void amdgpu_gfx_sysfs_compute_fini(struct amdgpu_device *adev)
{
- device_remove_file(adev->dev, &dev_attr_current_compute_partition);
- device_remove_file(adev->dev, &dev_attr_available_compute_partition);
+ if (!amdgpu_sriov_vf(adev)) {
+ device_remove_file(adev->dev,
&dev_attr_current_compute_partition);
+ device_remove_file(adev->dev,
&dev_attr_available_compute_partition);
+ }
}
diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_gfx.h
b/drivers/gpu/drm/amd/amdgpu/amdgpu_gfx.h
index 6b0416777c5b..b65c459b3aa9 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_gfx.h
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_gfx.h
@@ -533,8 +533,8 @@ int amdgpu_gfx_poison_consumption_handler(struct
amdgpu_device *adev,
struct amdgpu_iv_entry *entry);
bool amdgpu_gfx_is_master_xcc(struct amdgpu_device *adev, int xcc_id);
-int amdgpu_gfx_sysfs_init(struct amdgpu_device *adev);
-void amdgpu_gfx_sysfs_fini(struct amdgpu_device *adev);
+int amdgpu_gfx_sysfs_compute_init(struct amdgpu_device *adev);
+void amdgpu_gfx_sysfs_compute_fini(struct amdgpu_device *adev);
void amdgpu_gfx_ras_error_func(struct amdgpu_device *adev,
void *ras_error_status,
void (*func)(struct amdgpu_device *adev, void *ras_error_status,
diff --git a/drivers/gpu/drm/amd/amdgpu/gfx_v9_4_3.c
b/drivers/gpu/drm/amd/amdgpu/gfx_v9_4_3.c
index aecc2bcea145..07ce614ef282 100644
--- a/drivers/gpu/drm/amd/amdgpu/gfx_v9_4_3.c
+++ b/drivers/gpu/drm/amd/amdgpu/gfx_v9_4_3.c
@@ -939,11 +939,11 @@ static int gfx_v9_4_3_sw_init(void *handle)
if (r)
return r;
+ r = amdgpu_gfx_sysfs_compute_init(adev);
+ if (r)
+ return r;
- if (!amdgpu_sriov_vf(adev))
- r = amdgpu_gfx_sysfs_init(adev);
-
- return r;
+ return 0;
}
static int gfx_v9_4_3_sw_fini(void *handle)
@@ -964,8 +964,7 @@ static int gfx_v9_4_3_sw_fini(void *handle)
gfx_v9_4_3_mec_fini(adev);
amdgpu_bo_unref(&adev->gfx.rlc.clear_state_obj);
gfx_v9_4_3_free_microcode(adev);
- if (!amdgpu_sriov_vf(adev))
- amdgpu_gfx_sysfs_fini(adev);
+ amdgpu_gfx_sysfs_compute_fini(adev);
return 0;
}
--
2.34.1
Re: [PATCH] drm/amdgpu: Move SR-IOV check into amdgpu_gfx_sysfs_compute_init
On 6/6/2024 10:58 PM, Lazar, Lijo wrote:
On 6/6/2024 5:35 PM, Srinivasan Shanmugam wrote:
Previously, this check was performed in the gfx_v9_4_3_sw_init function,
and the amdgpu_gfx_sysfs_compute_init function was only called if the
GPU was not a VF in SR-IOV mode. This is because the sysfs entries
created by amdgpu_gfx_sysfs_compute_init are specific to compute
partitions, which are only applicable on GFX9 and not on a VF in SR-IOV
mode.
By moving the check into amdgpu_gfx_sysfs_compute_init, we make this
function responsible for deciding whether or not to create the compute
partition sysfs entries.
This change improves the code organization and maintainability. If in
the future the conditions for creating the compute partition sysfs
entries change, we would only need to update the
amdgpu_gfx_sysfs_compute_init function.
This is not correct. If this has to be true, this will reside somewhere
in amdgpu_gfx and you would also need IP version inside this one. If for
a new IP version say gfx v9.4.5 this needs to be created for VF also,
In this case, how about below?
int amdgpu_gfx_sysfs_compute_init(struct amdgpu_device *adev, bool
check_sriov)
{
int r;
if (!check_sriov || !amdgpu_sriov_vf(adev)) {
r = device_create_file(adev->dev,
&dev_attr_current_compute_partition);
if (r)
return r;
r = device_create_file(adev->dev,
&dev_attr_available_compute_partition);
if (r)
return r;
}
return 0;
}
In gfx_v9_4_3_sw_init you would call amdgpu_gfx_sysfs_compute_init(adev,
true),
to perform the check, and in gfx_v9_4_5_sw_init you would call
amdgpu_gfx_sysfs_compute_init(adev, false) to skip the check.
This way, we can control the behavior of the function without needing to
put condition in IP code version.?
But would like have Christian's view also, onto this "a new IP version
say gfx v9.4.5 this needs to be created for VF also,
"
then this check here won't work. This is the specific reason why we put
the conditions inside IP code.
Thanks,
Lijo
Cc: Alex Deucher
Cc: Christian König
Suggested-by: Christian König
Signed-off-by: Srinivasan Shanmugam
---
drivers/gpu/drm/amd/amdgpu/amdgpu_gfx.c | 24 +++-
drivers/gpu/drm/amd/amdgpu/amdgpu_gfx.h | 4 ++--
drivers/gpu/drm/amd/amdgpu/gfx_v9_4_3.c | 11 +--
3 files changed, 22 insertions(+), 17 deletions(-)
diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_gfx.c
b/drivers/gpu/drm/amd/amdgpu/amdgpu_gfx.c
index 19b1817b55d7..72477a5aedca 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_gfx.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_gfx.c
@@ -1376,21 +1376,27 @@ static DEVICE_ATTR(current_compute_partition, 0644,
static DEVICE_ATTR(available_compute_partition, 0444,
amdgpu_gfx_get_available_compute_partition, NULL);
-int amdgpu_gfx_sysfs_init(struct amdgpu_device *adev)
+int amdgpu_gfx_sysfs_compute_init(struct amdgpu_device *adev)
{
int r;
- r = device_create_file(adev->dev, &dev_attr_current_compute_partition);
- if (r)
- return r;
+ if (!amdgpu_sriov_vf(adev)) {
+ r = device_create_file(adev->dev,
&dev_attr_current_compute_partition);
+ if (r)
+ return r;
- r = device_create_file(adev->dev, &dev_attr_available_compute_partition);
+ r = device_create_file(adev->dev,
&dev_attr_available_compute_partition);
+ if (r)
+ return r;
+ }
- return r;
+ return 0;
}
-void amdgpu_gfx_sysfs_fini(struct amdgpu_device *adev)
+void amdgpu_gfx_sysfs_compute_fini(struct amdgpu_device *adev)
{
- device_remove_file(adev->dev, &dev_attr_current_compute_partition);
- device_remove_file(adev->dev, &dev_attr_available_compute_partition);
+ if (!amdgpu_sriov_vf(adev)) {
+ device_remove_file(adev->dev,
&dev_attr_current_compute_partition);
+ device_remove_file(adev->dev,
&dev_attr_available_compute_partition);
+ }
}
diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_gfx.h
b/drivers/gpu/drm/amd/amdgpu/amdgpu_gfx.h
index 6b0416777c5b..b65c459b3aa9 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_gfx.h
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_gfx.h
@@ -533,8 +533,8 @@ int amdgpu_gfx_poison_consumption_handler(struct
amdgpu_device *adev,
struct amdgpu_iv_entry *entry);
bool amdgpu_gfx_is_master_xcc(struct amdgpu_device *adev, int xcc_id);
-int amdgpu_gfx_sysfs_init(struct amdgpu_device *adev);
-void amdgpu_gfx_sysfs_fini(struct amdgpu_device *adev);
+int amdgpu_gfx_sysfs_compute_init(struct amdgpu_device *adev);
+void amdgpu_gfx_sysfs_compute_fini(struct amdgpu_device *adev);
void amdgpu_gfx_ras_error_func(struct amdgpu_device *adev,
void *ras_error_status,
[PATCH] drm/amdgpu: Add NULL check for imu.funcs in gfx_v11_0_rlc_backdoor_autoload_enable
This commit adds a null check for `adev->gfx.imu.funcs` in the
`gfx_v11_0_rlc_backdoor_autoload_enable` function. This prevents
potential null pointer dereferences when calling the `load_microcode`,
`setup_imu`, and `start_imu` functions.
Previously, if `adev->gfx.imu.funcs` was null, it could lead to a null
pointer dereference. With this change, these function calls are only
made if `adev->gfx.imu.funcs` is not null.
Fixes the below:
drivers/gpu/drm/amd/amdgpu/gfx_v11_0.c:4503 gfx_v11_0_hw_init()
error: we previously assumed 'adev->gfx.imu.funcs' could be null (see line 4497)
drivers/gpu/drm/amd/amdgpu/gfx_v11_0.c
4491 static int gfx_v11_0_hw_init(void *handle)
4492 {
4493 int r;
4494 struct amdgpu_device *adev = (struct amdgpu_device *)handle;
4495
4496 if (adev->firmware.load_type ==
AMDGPU_FW_LOAD_RLC_BACKDOOR_AUTO) {
4497 if (adev->gfx.imu.funcs) {
^^^ Check for NULL
4498 /* RLC autoload sequence 1: Program rlc ram */
4499 if (adev->gfx.imu.funcs->program_rlc_ram)
4500
adev->gfx.imu.funcs->program_rlc_ram(adev);
4501 }
4502 /* rlc autoload firmware */
--> 4503 r = gfx_v11_0_rlc_backdoor_autoload_enable(adev);
Unchecked dereference inside the function.
4505 return r;
4506 } else {
Fixes: 3d879e81f0f9 ("drm/amdgpu: add init support for GFX11 (v2)")
Reported-by: Dan Carpenter
Cc: Hawking Zhang
Cc: Alex Deucher
Cc: Christian König
Signed-off-by: Srinivasan Shanmugam
---
drivers/gpu/drm/amd/amdgpu/gfx_v11_0.c | 18 ++
1 file changed, 10 insertions(+), 8 deletions(-)
diff --git a/drivers/gpu/drm/amd/amdgpu/gfx_v11_0.c
b/drivers/gpu/drm/amd/amdgpu/gfx_v11_0.c
index 2a510351dfce..4af4567ba197 100644
--- a/drivers/gpu/drm/amd/amdgpu/gfx_v11_0.c
+++ b/drivers/gpu/drm/amd/amdgpu/gfx_v11_0.c
@@ -1459,14 +1459,16 @@ static int
gfx_v11_0_rlc_backdoor_autoload_enable(struct amdgpu_device *adev)
WREG32_SOC15(GC, 0, regGFX_IMU_RLC_BOOTLOADER_SIZE, rlc_g_size);
- /* RLC autoload sequence 3: load IMU fw */
- if (adev->gfx.imu.funcs->load_microcode)
- adev->gfx.imu.funcs->load_microcode(adev);
- /* RLC autoload sequence 4 init IMU fw */
- if (adev->gfx.imu.funcs->setup_imu)
- adev->gfx.imu.funcs->setup_imu(adev);
- if (adev->gfx.imu.funcs->start_imu)
- adev->gfx.imu.funcs->start_imu(adev);
+ if (adev->gfx.imu.funcs) {
+ /* RLC autoload sequence 3: load IMU fw */
+ if (adev->gfx.imu.funcs->load_microcode)
+ adev->gfx.imu.funcs->load_microcode(adev);
+ /* RLC autoload sequence 4 init IMU fw */
+ if (adev->gfx.imu.funcs->setup_imu)
+ adev->gfx.imu.funcs->setup_imu(adev);
+ if (adev->gfx.imu.funcs->start_imu)
+ adev->gfx.imu.funcs->start_imu(adev);
+ }
/* RLC autoload sequence 5 disable gpa mode */
gfx_v11_0_disable_gpa_mode(adev);
--
2.34.1
[PATCH] drm/amdgpu/acpi: Add NULL check for event->device_class in amdgpu_atif_handler
This commit addresses a NULL dereference issue in the
amdgpu_atif_handler function.
The issue arises when event->device_class is NULL and is passed to the
DRM_DEBUG_DRIVER macro, which attempts to print the NULL string with the
%s format specifier. This constitutes undefined behavior.
To resolve this, a conditional check is added to ensure that
event->device_class is not NULL before it is passed to the
DRM_DEBUG_DRIVER macro. If it is NULL, the string "NULL" is printed
instead, thereby preventing the NULL dereference.
Fixes the below:
In function ‘amdgpu_atif_handler’,
inlined from ‘amdgpu_acpi_event’ at
drivers/gpu/drm/amd/amdgpu/amdgpu_acpi.c:1215:9:
./include/drm/drm_print.h:536:49: warning: ‘%s’ directive argument is null
[-Wformat-overflow=]
536 | #define __drm_dbg(cat, fmt, ...)___drm_dbg(NULL, cat,
fmt, ##__VA_ARGS__)
|
^
./include/drm/drm_print.h:582:9: note: in expansion of macro ‘__drm_dbg’
582 | __drm_dbg(DRM_UT_DRIVER, fmt, ##__VA_ARGS__)
| ^
drivers/gpu/drm/amd/amdgpu/amdgpu_acpi.c:452:9: note: in expansion of macro
‘DRM_DEBUG_DRIVER’
452 | DRM_DEBUG_DRIVER("event, device_class = %s, type = %#x\n",
| ^~~~
drivers/gpu/drm/amd/amdgpu/amdgpu_acpi.c: In function ‘amdgpu_acpi_event’:
drivers/gpu/drm/amd/amdgpu/amdgpu_acpi.c:452:49: note: format string is defined
here
452 | DRM_DEBUG_DRIVER("event, device_class = %s, type = %#x\n",
|
Cc: Alex Deucher
Cc: Christian König
Signed-off-by: Srinivasan Shanmugam
---
drivers/gpu/drm/amd/amdgpu/amdgpu_acpi.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_acpi.c
b/drivers/gpu/drm/amd/amdgpu/amdgpu_acpi.c
index f85ace0384d2..27131ff30579 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_acpi.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_acpi.c
@@ -450,7 +450,7 @@ static int amdgpu_atif_handler(struct amdgpu_device *adev,
int count;
DRM_DEBUG_DRIVER("event, device_class = %s, type = %#x\n",
- event->device_class, event->type);
+ event->device_class ? event->device_class : "NULL",
event->type);
if (strcmp(event->device_class, ACPI_VIDEO_CLASS) != 0)
return NOTIFY_DONE;
--
2.34.1
[PATCH] drm/amd/display: Add checks to prevent buffer overflow in mod_hdcp_dump_binary_message
This commit addresses a buffer overflow issue in the
mod_hdcp_dump_binary_message function in the display/hdcp module
The issue arises when the 'buf' pointer is NULL or the 'buf_pos' index
exceeds the 'buf_size', and is passed to the sprintf function, which
attempts to write to an invalid memory location. This is leading to
undefined behavior
To resolve this, checks are added to ensure that 'buf' is not NULL and
'buf_pos' is within the bounds of 'buf_size' before it is passed to the
sprintf function. This change prevents the buffer overflow.
Fixes the below:
In function ‘mod_hdcp_dump_binary_message’,
inlined from ‘mod_hdcp_dump_binary_message’ at
drivers/gpu/drm/amd/amdgpu/../display/modules/hdcp/hdcp_log.c:29:6,
inlined from ‘mod_hdcp_log_ddc_trace’ at
drivers/gpu/drm/amd/amdgpu/../display/modules/hdcp/hdcp_log.c:107:3:
drivers/gpu/drm/amd/amdgpu/../display/modules/hdcp/hdcp_log.c:47:25: warning:
null destination pointer [-Wformat-overflow=]
47 | sprintf(&buf[buf_pos], "%02X ", msg[i]);
| ^~~
In function ‘mod_hdcp_dump_binary_message’,
inlined from ‘mod_hdcp_dump_binary_message’ at
drivers/gpu/drm/amd/amdgpu/../display/modules/hdcp/hdcp_log.c:29:6,
inlined from ‘mod_hdcp_log_ddc_trace’ at
drivers/gpu/drm/amd/amdgpu/../display/modules/hdcp/hdcp_log.c:122:3:
drivers/gpu/drm/amd/amdgpu/../display/modules/hdcp/hdcp_log.c:47:25: warning:
null destination pointer [-Wformat-overflow=]
47 | sprintf(&buf[buf_pos], "%02X ", msg[i]);
| ^~~
In function ‘mod_hdcp_dump_binary_message’,
inlined from ‘mod_hdcp_dump_binary_message’ at
drivers/gpu/drm/amd/amdgpu/../display/modules/hdcp/hdcp_log.c:29:6,
inlined from ‘mod_hdcp_log_ddc_trace’ at
drivers/gpu/drm/amd/amdgpu/../display/modules/hdcp/hdcp_log.c:61:3:
drivers/gpu/drm/amd/amdgpu/../display/modules/hdcp/hdcp_log.c:47:25: warning:
null destination pointer [-Wformat-overflow=]
47 | sprintf(&buf[buf_pos], "%02X ", msg[i]);
| ^~~
In function ‘mod_hdcp_dump_binary_message’,
inlined from ‘mod_hdcp_dump_binary_message’ at
drivers/gpu/drm/amd/amdgpu/../display/modules/hdcp/hdcp_log.c:29:6,
inlined from ‘mod_hdcp_log_ddc_trace’ at
drivers/gpu/drm/amd/amdgpu/../display/modules/hdcp/hdcp_log.c:70:3:
drivers/gpu/drm/amd/amdgpu/../display/modules/hdcp/hdcp_log.c:47:25: warning:
null destination pointer [-Wformat-overflow=]
47 | sprintf(&buf[buf_pos], "%02X ", msg[i]);
| ^~~
In function ‘mod_hdcp_dump_binary_message’,
inlined from ‘mod_hdcp_dump_binary_message’ at
drivers/gpu/drm/amd/amdgpu/../display/modules/hdcp/hdcp_log.c:29:6,
inlined from ‘mod_hdcp_log_ddc_trace’ at
drivers/gpu/drm/amd/amdgpu/../display/modules/hdcp/hdcp_log.c:73:3:
drivers/gpu/drm/amd/amdgpu/../display/modules/hdcp/hdcp_log.c:47:25: warning:
null destination pointer [-Wformat-overflow=]
47 | sprintf(&buf[buf_pos], "%02X ", msg[i]);
| ^~~
In function ‘mod_hdcp_dump_binary_message’,
inlined from ‘mod_hdcp_dump_binary_message’ at
drivers/gpu/drm/amd/amdgpu/../display/modules/hdcp/hdcp_log.c:29:6,
inlined from ‘mod_hdcp_log_ddc_trace’ at
drivers/gpu/drm/amd/amdgpu/../display/modules/hdcp/hdcp_log.c:70:3:
drivers/gpu/drm/amd/amdgpu/../display/modules/hdcp/hdcp_log.c:47:25: warning:
null destination pointer [-Wformat-overflow=]
47 | sprintf(&buf[buf_pos], "%02X ", msg[i]);
| ^~~
Cc: Wenjing Liu
Cc: Tom Chung
Cc: Rodrigo Siqueira
Cc: Roman Li
Cc: Hersen Wu
Cc: Alex Hung
Cc: Aurabindo Pillai
Cc: Harry Wentland
Signed-off-by: Srinivasan Shanmugam
---
drivers/gpu/drm/amd/display/modules/hdcp/hdcp_log.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/drivers/gpu/drm/amd/display/modules/hdcp/hdcp_log.c
b/drivers/gpu/drm/amd/display/modules/hdcp/hdcp_log.c
index 6b3b5f610907..285251711a2d 100644
--- a/drivers/gpu/drm/amd/display/modules/hdcp/hdcp_log.c
+++ b/drivers/gpu/drm/amd/display/modules/hdcp/hdcp_log.c
@@ -40,9 +40,9 @@ void mod_hdcp_dump_binary_message(uint8_t *msg, uint32_t
msg_size,
uint32_t buf_pos = 0;
uint32_t i = 0;
- if (buf_size >= target_size) {
+ if (buf_size >= target_size && buf) {
for (i = 0; i < msg_size; i++) {
- if (i % bytes_per_line == 0)
+ if (i % bytes_per_line == 0 && buf_pos < bu
[PATCH] drm/amd/display: Add null check for dm_state in create_validate_stream_for_sink
This commit adds a null check for the dm_state variable in the
create_validate_stream_for_sink function. Previously, dm_state was being
checked for nullity at line 7194, but then it was being dereferenced
without any nullity check at line 7200. This could potentially lead to a
null pointer dereference error if dm_state is indeed null.
we now ensure that dm_state is not null before dereferencing it. We do
this by adding a nullity check for dm_state before the call to
create_stream_for_sink at line 7200. If dm_state is null, we log an
error message and return NULL immediately.
This fix prevents a null pointer dereference error.
drivers/gpu/drm/amd/amdgpu/../display/amdgpu_dm/amdgpu_dm.c:7201
create_validate_stream_for_sink()
error: we previously assumed 'dm_state' could be null (see line 7194)
drivers/gpu/drm/amd/amdgpu/../display/amdgpu_dm/amdgpu_dm.c
7185 struct dc_stream_state *
7186 create_validate_stream_for_sink(struct amdgpu_dm_connector *aconnector,
7187 const struct drm_display_mode
*drm_mode,
7188 const struct dm_connector_state
*dm_state,
7189 const struct dc_stream_state
*old_stream)
7190 {
7191 struct drm_connector *connector = &aconnector->base;
7192 struct amdgpu_device *adev = drm_to_adev(connector->dev);
7193 struct dc_stream_state *stream;
7194 const struct drm_connector_state *drm_state = dm_state ?
&dm_state->base : NULL;
^ This used check connector->state
but then we changed it to dm_state instead
7195 int requested_bpc = drm_state ? drm_state->max_requested_bpc :
8;
7196 enum dc_status dc_result = DC_OK;
7197
7198 do {
7199 stream = create_stream_for_sink(connector, drm_mode,
7200 dm_state, old_stream,
But dm_state is dereferenced on the next line without checking. (Presumably
the NULL check can be removed).
--> 7201 requested_bpc);
7202 if (stream == NULL) {
7203 DRM_ERROR("Failed to create stream for
sink!\n");
7204 break;
7205 }
7206
7207 if (aconnector->base.connector_type ==
DRM_MODE_CONNECTOR_WRITEBACK)
Fixes: fa7041d9d2fc ("drm/amd/display: Fix ineffective setting of max bpc
property")
Reported-by: Dan Carpenter
Cc: Tom Chung
Cc: Rodrigo Siqueira
Cc: Roman Li
Cc: Hersen Wu
Cc: Alex Hung
Cc: Aurabindo Pillai
Cc: Harry Wentland
Cc: Hamza Mahfooz
Signed-off-by: Srinivasan Shanmugam
---
drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c | 5 +
1 file changed, 5 insertions(+)
diff --git a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
index d1527c2e46a1..b7eaece455c8 100644
--- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
+++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
@@ -7195,6 +7195,11 @@ create_validate_stream_for_sink(struct
amdgpu_dm_connector *aconnector,
int requested_bpc = drm_state ? drm_state->max_requested_bpc : 8;
enum dc_status dc_result = DC_OK;
+ if (!dm_state) {
+ DRM_ERROR("dm_state is NULL!\n");
+ return NULL;
+ }
+
do {
stream = create_stream_for_sink(connector, drm_mode,
dm_state, old_stream,
--
2.34.1
[PATCH] drm/amd/display: Add null check for set_output_gamma in dcn30_set_output_transfer_func
This commit adds a null check for the set_output_gamma function pointer
in the dcn30_set_output_transfer_func function. Previously,
set_output_gamma was being checked for nullity at line 386, but then it
was being dereferenced without any nullity check at line 401. This
could potentially lead to a null pointer dereference error if
set_output_gamma is indeed null.
To fix this, we now ensure that set_output_gamma is not null before
dereferencing it. We do this by adding a nullity check for
set_output_gamma before the call to set_output_gamma at line 401. If
set_output_gamma is null, we log an error message and do not call the
function.
This fix prevents a potential null pointer dereference error.
drivers/gpu/drm/amd/amdgpu/../display/dc/hwss/dcn30/dcn30_hwseq.c:401
dcn30_set_output_transfer_func()
error: we previously assumed 'mpc->funcs->set_output_gamma' could be null (see
line 386)
drivers/gpu/drm/amd/amdgpu/../display/dc/hwss/dcn30/dcn30_hwseq.c
373 bool dcn30_set_output_transfer_func(struct dc *dc,
374 struct pipe_ctx *pipe_ctx,
375 const struct dc_stream_state *stream)
376 {
377 int mpcc_id = pipe_ctx->plane_res.hubp->inst;
378 struct mpc *mpc =
pipe_ctx->stream_res.opp->ctx->dc->res_pool->mpc;
379 const struct pwl_params *params = NULL;
380 bool ret = false;
381
382 /* program OGAM or 3DLUT only for the top pipe*/
383 if (pipe_ctx->top_pipe == NULL) {
384 /*program rmu shaper and 3dlut in MPC*/
385 ret = dcn30_set_mpc_shaper_3dlut(pipe_ctx, stream);
386 if (ret == false && mpc->funcs->set_output_gamma) {
If
this is NULL
387 if (stream->out_transfer_func.type ==
TF_TYPE_HWPWL)
388 params = &stream->out_transfer_func.pwl;
389 else if
(pipe_ctx->stream->out_transfer_func.type ==
390 TF_TYPE_DISTRIBUTED_POINTS &&
391
cm3_helper_translate_curve_to_hw_format(
392 &stream->out_transfer_func,
393 &mpc->blender_params, false))
394 params = &mpc->blender_params;
395 /* there are no ROM LUTs in OUTGAM */
396 if (stream->out_transfer_func.type ==
TF_TYPE_PREDEFINED)
397 BREAK_TO_DEBUGGER();
398 }
399 }
400
--> 401 mpc->funcs->set_output_gamma(mpc, mpcc_id, params);
Then it will crash
402 return ret;
403 }
Fixes: d99f13878d6f ("drm/amd/display: Add DCN3 HWSEQ")
Reported-by: Dan Carpenter
Cc: Tom Chung
Cc: Rodrigo Siqueira
Cc: Roman Li
Cc: Hersen Wu
Cc: Alex Hung
Cc: Aurabindo Pillai
Cc: Harry Wentland
Cc: Hamza Mahfooz
Signed-off-by: Srinivasan Shanmugam
---
drivers/gpu/drm/amd/display/dc/hwss/dcn30/dcn30_hwseq.c | 6 +-
1 file changed, 5 insertions(+), 1 deletion(-)
diff --git a/drivers/gpu/drm/amd/display/dc/hwss/dcn30/dcn30_hwseq.c
b/drivers/gpu/drm/amd/display/dc/hwss/dcn30/dcn30_hwseq.c
index eaeeade31ed7..bd807eb79786 100644
--- a/drivers/gpu/drm/amd/display/dc/hwss/dcn30/dcn30_hwseq.c
+++ b/drivers/gpu/drm/amd/display/dc/hwss/dcn30/dcn30_hwseq.c
@@ -398,7 +398,11 @@ bool dcn30_set_output_transfer_func(struct dc *dc,
}
}
- mpc->funcs->set_output_gamma(mpc, mpcc_id, params);
+ if (mpc->funcs->set_output_gamma)
+ mpc->funcs->set_output_gamma(mpc, mpcc_id, params);
+ else
+ DRM_ERROR("set_output_gamma function pointer is NULL.\n");
+
return ret;
}
--
2.34.1
[PATCH v2] drm/amd/display: Add null check for dm_state in create_validate_stream_for_sink
This commit adds a null check for the dm_state variable in the
create_validate_stream_for_sink function. Previously, dm_state was being
checked for nullity at line 7194, but then it was being dereferenced
without any nullity check at line 7200. This could potentially lead to a
null pointer dereference error if dm_state is indeed null.
we now ensure that dm_state is not null before dereferencing it. We do
this by adding a nullity check for dm_state before the call to
create_stream_for_sink at line 7200. If dm_state is null, we log an
error message and return NULL immediately.
This fix prevents a null pointer dereference error.
drivers/gpu/drm/amd/amdgpu/../display/amdgpu_dm/amdgpu_dm.c:7201
create_validate_stream_for_sink()
error: we previously assumed 'dm_state' could be null (see line 7194)
drivers/gpu/drm/amd/amdgpu/../display/amdgpu_dm/amdgpu_dm.c
7185 struct dc_stream_state *
7186 create_validate_stream_for_sink(struct amdgpu_dm_connector *aconnector,
7187 const struct drm_display_mode
*drm_mode,
7188 const struct dm_connector_state
*dm_state,
7189 const struct dc_stream_state
*old_stream)
7190 {
7191 struct drm_connector *connector = &aconnector->base;
7192 struct amdgpu_device *adev = drm_to_adev(connector->dev);
7193 struct dc_stream_state *stream;
7194 const struct drm_connector_state *drm_state = dm_state ?
&dm_state->base : NULL;
^ This used check connector->state
but then we changed it to dm_state instead
7195 int requested_bpc = drm_state ? drm_state->max_requested_bpc :
8;
7196 enum dc_status dc_result = DC_OK;
7197
7198 do {
7199 stream = create_stream_for_sink(connector, drm_mode,
7200 dm_state, old_stream,
But dm_state is dereferenced on the next line without checking. (Presumably
the NULL check can be removed).
--> 7201 requested_bpc);
7202 if (stream == NULL) {
7203 DRM_ERROR("Failed to create stream for
sink!\n");
7204 break;
7205 }
7206
7207 if (aconnector->base.connector_type ==
DRM_MODE_CONNECTOR_WRITEBACK)
Fixes: fa7041d9d2fc ("drm/amd/display: Fix ineffective setting of max bpc
property")
Reported-by: Dan Carpenter
Cc: Tom Chung
Cc: Rodrigo Siqueira
Cc: Roman Li
Cc: Hersen Wu
Cc: Alex Hung
Cc: Aurabindo Pillai
Cc: Harry Wentland
Cc: Hamza Mahfooz
Signed-off-by: Srinivasan Shanmugam
---
v2: s/DRM_ERROR/drm_err() (Hamza)
drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c | 5 +
1 file changed, 5 insertions(+)
diff --git a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
index d1527c2e46a1..e7516a2dcb10 100644
--- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
+++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
@@ -7195,6 +7195,11 @@ create_validate_stream_for_sink(struct
amdgpu_dm_connector *aconnector,
int requested_bpc = drm_state ? drm_state->max_requested_bpc : 8;
enum dc_status dc_result = DC_OK;
+ if (!dm_state) {
+ drm_err(&adev->ddev, "dm_state is NULL!\n");
+ return NULL;
+ }
+
do {
stream = create_stream_for_sink(connector, drm_mode,
dm_state, old_stream,
--
2.34.1
Re: [PATCH v2] drm/amd/display: Add null check for dm_state in create_validate_stream_for_sink
I think we can ignore this change, as it already exists in the below
commit of asdn.
commit b90c2f233397f40c757995b9c00f8c6e380c6913
Author: Alex Hung
Date: Thu Jun 27 17:38:16 2024 -0600
drm/amd/display: Check null pointers before using them
On 7/17/2024 8:10 AM, Srinivasan Shanmugam wrote:
This commit adds a null check for the dm_state variable in the
create_validate_stream_for_sink function. Previously, dm_state was being
checked for nullity at line 7194, but then it was being dereferenced
without any nullity check at line 7200. This could potentially lead to a
null pointer dereference error if dm_state is indeed null.
we now ensure that dm_state is not null before dereferencing it. We do
this by adding a nullity check for dm_state before the call to
create_stream_for_sink at line 7200. If dm_state is null, we log an
error message and return NULL immediately.
This fix prevents a null pointer dereference error.
drivers/gpu/drm/amd/amdgpu/../display/amdgpu_dm/amdgpu_dm.c:7201
create_validate_stream_for_sink()
error: we previously assumed 'dm_state' could be null (see line 7194)
drivers/gpu/drm/amd/amdgpu/../display/amdgpu_dm/amdgpu_dm.c
7185 struct dc_stream_state *
7186 create_validate_stream_for_sink(struct amdgpu_dm_connector
*aconnector,
7187 const struct drm_display_mode
*drm_mode,
7188 const struct dm_connector_state
*dm_state,
7189 const struct dc_stream_state
*old_stream)
7190 {
7191 struct drm_connector *connector = &aconnector->base;
7192 struct amdgpu_device *adev = drm_to_adev(connector->dev);
7193 struct dc_stream_state *stream;
7194 const struct drm_connector_state *drm_state = dm_state ?
&dm_state->base : NULL;
^ This used check
connector->state but then we changed it to dm_state instead
7195 int requested_bpc = drm_state ? drm_state->max_requested_bpc
: 8;
7196 enum dc_status dc_result = DC_OK;
7197
7198 do {
7199 stream = create_stream_for_sink(connector, drm_mode,
7200 dm_state, old_stream,
But dm_state is dereferenced on the next line without checking. (Presumably
the NULL check can be removed).
--> 7201 requested_bpc);
7202 if (stream == NULL) {
7203 DRM_ERROR("Failed to create stream for
sink!\n");
7204 break;
7205 }
7206
7207 if (aconnector->base.connector_type ==
DRM_MODE_CONNECTOR_WRITEBACK)
Fixes: fa7041d9d2fc ("drm/amd/display: Fix ineffective setting of max bpc
property")
Reported-by: Dan Carpenter
Cc: Tom Chung
Cc: Rodrigo Siqueira
Cc: Roman Li
Cc: Hersen Wu
Cc: Alex Hung
Cc: Aurabindo Pillai
Cc: Harry Wentland
Cc: Hamza Mahfooz
Signed-off-by: Srinivasan Shanmugam
---
v2: s/DRM_ERROR/drm_err() (Hamza)
drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c | 5 +
1 file changed, 5 insertions(+)
diff --git a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
index d1527c2e46a1..e7516a2dcb10 100644
--- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
+++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
@@ -7195,6 +7195,11 @@ create_validate_stream_for_sink(struct
amdgpu_dm_connector *aconnector,
int requested_bpc = drm_state ? drm_state->max_requested_bpc : 8;
enum dc_status dc_result = DC_OK;
+ if (!dm_state) {
+ drm_err(&adev->ddev, "dm_state is NULL!\n");
+ return NULL;
+ }
+
do {
stream = create_stream_for_sink(connector, drm_mode,
dm_state, old_stream,
[PATCH] drm/amd/display: Add 'pstate_keepout' kdoc entry in 'optc1_program_timing'
Fixes the below with gcc W=1: Function parameter or struct member 'pstate_keepout' not described in 'optc1_program_timing' Cc: Tom Chung Cc: Rodrigo Siqueira Cc: Roman Li Cc: Alex Hung Cc: Aurabindo Pillai Cc: Harry Wentland Cc: Hamza Mahfooz Signed-off-by: Srinivasan Shanmugam --- drivers/gpu/drm/amd/display/dc/optc/dcn10/dcn10_optc.c | 1 + 1 file changed, 1 insertion(+) diff --git a/drivers/gpu/drm/amd/display/dc/optc/dcn10/dcn10_optc.c b/drivers/gpu/drm/amd/display/dc/optc/dcn10/dcn10_optc.c index f00d27b7c6fe..097d06023e64 100644 --- a/drivers/gpu/drm/amd/display/dc/optc/dcn10/dcn10_optc.c +++ b/drivers/gpu/drm/amd/display/dc/optc/dcn10/dcn10_optc.c @@ -148,6 +148,7 @@ void optc1_setup_vertical_interrupt2( * @vstartup_start: Vstartup period. * @vupdate_offset: Vupdate starting position. * @vupdate_width: Vupdate duration. + * @pstate_keepout: determines low power mode timing during refresh * @signal: DC signal types. * @use_vbios: to program timings from BIOS command table. * -- 2.34.1
[PATCH] drm/amd/display: Implement bounds check for stream encoder creation in DCN401
'stream_enc_regs' array is an array of dcn10_stream_enc_registers
structures. The array is initialized with four elements, corresponding
to the four calls to stream_enc_regs() in the array initializer. This
means that valid indices for this array are 0, 1, 2, and 3.
The error message 'stream_enc_regs' 4 <= 5 below, is indicating that
there is an attempt to access this array with an index of 5, which is
out of bounds. This could lead to undefined behavior
Here, eng_id is used as an index to access the stream_enc_regs array. If
eng_id is 5, this would result in an out-of-bounds access on the
stream_enc_regs array.
Thus fixing Buffer overflow error in dcn401_stream_encoder_create
Found by smatch:
drivers/gpu/drm/amd/amdgpu/../display/dc/resource/dcn401/dcn401_resource.c:1209
dcn401_stream_encoder_create() error: buffer overflow 'stream_enc_regs' 4 <= 5
Cc: Tom Chung
Cc: Rodrigo Siqueira
Cc: Roman Li
Cc: Alex Hung
Cc: Aurabindo Pillai
Cc: Harry Wentland
Cc: Hamza Mahfooz
Signed-off-by: Srinivasan Shanmugam
---
.../gpu/drm/amd/display/dc/resource/dcn401/dcn401_resource.c| 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/gpu/drm/amd/display/dc/resource/dcn401/dcn401_resource.c
b/drivers/gpu/drm/amd/display/dc/resource/dcn401/dcn401_resource.c
index d3808c49d298..5ee20753572e 100644
--- a/drivers/gpu/drm/amd/display/dc/resource/dcn401/dcn401_resource.c
+++ b/drivers/gpu/drm/amd/display/dc/resource/dcn401/dcn401_resource.c
@@ -1190,7 +1190,7 @@ static struct stream_encoder
*dcn401_stream_encoder_create(
vpg = dcn401_vpg_create(ctx, vpg_inst);
afmt = dcn401_afmt_create(ctx, afmt_inst);
- if (!enc1 || !vpg || !afmt) {
+ if (!enc1 || !vpg || !afmt || eng_id >= ARRAY_SIZE(stream_enc_regs)) {
kfree(enc1);
kfree(vpg);
kfree(afmt);
--
2.34.1
[PATCH] drm/amd/display: Add NULL check for clk_mgr in dcn32_init_hw
This commit addresses a potential null pointer dereference issue in the `dcn32_init_hw` function. The issue could occur when `dc->clk_mgr` is null. The fix adds a check to ensure `dc->clk_mgr` is not null before accessing its functions. This prevents a potential null pointer dereference. Reported by smatch: drivers/gpu/drm/amd/amdgpu/../display/dc/hwss/dcn32/dcn32_hwseq.c:961 dcn32_init_hw() error: we previously assumed 'dc->clk_mgr' could be null (see line 782) Cc: Tom Chung Cc: Rodrigo Siqueira Cc: Roman Li Cc: Alex Hung Cc: Aurabindo Pillai Cc: Harry Wentland Cc: Hamza Mahfooz Signed-off-by: Srinivasan Shanmugam --- drivers/gpu/drm/amd/display/dc/hwss/dcn32/dcn32_hwseq.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/drivers/gpu/drm/amd/display/dc/hwss/dcn32/dcn32_hwseq.c b/drivers/gpu/drm/amd/display/dc/hwss/dcn32/dcn32_hwseq.c index 7f41eccefe02..96b5362c926d 100644 --- a/drivers/gpu/drm/amd/display/dc/hwss/dcn32/dcn32_hwseq.c +++ b/drivers/gpu/drm/amd/display/dc/hwss/dcn32/dcn32_hwseq.c @@ -958,10 +958,11 @@ void dcn32_init_hw(struct dc *dc) if (!dcb->funcs->is_accelerated_mode(dcb) && dc->res_pool->hubbub->funcs->init_watermarks) dc->res_pool->hubbub->funcs->init_watermarks(dc->res_pool->hubbub); - if (dc->clk_mgr->funcs->notify_wm_ranges) + if (dc->clk_mgr && dc->clk_mgr->funcs->notify_wm_ranges) dc->clk_mgr->funcs->notify_wm_ranges(dc->clk_mgr); - if (dc->clk_mgr->funcs->set_hard_max_memclk && !dc->clk_mgr->dc_mode_softmax_enabled) + if (dc->clk_mgr && dc->clk_mgr->funcs->set_hard_max_memclk && + !dc->clk_mgr->dc_mode_softmax_enabled) dc->clk_mgr->funcs->set_hard_max_memclk(dc->clk_mgr); if (dc->res_pool->hubbub->funcs->force_pstate_change_control) -- 2.34.1
[PATCH] drm/amd/display: Add NULL check for clk_mgr in dcn30_init_hw
This commit addresses a potential null pointer dereference issue in the `dcn30_init_hw` function. The issue could occur when `dc->clk_mgr` is null. The fix adds a check to ensure `dc->clk_mgr` is not null before accessing its functions. This prevents a potential null pointer dereference. Reported by smatch: drivers/gpu/drm/amd/amdgpu/../display/dc/hwss/dcn30/dcn30_hwseq.c:789 dcn30_init_hw() error: we previously assumed 'dc->clk_mgr' could be null (see line 628) Cc: Tom Chung Cc: Rodrigo Siqueira Cc: Roman Li Cc: Alex Hung Cc: Aurabindo Pillai Cc: Harry Wentland Cc: Hamza Mahfooz Signed-off-by: Srinivasan Shanmugam --- drivers/gpu/drm/amd/display/dc/hwss/dcn30/dcn30_hwseq.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/drivers/gpu/drm/amd/display/dc/hwss/dcn30/dcn30_hwseq.c b/drivers/gpu/drm/amd/display/dc/hwss/dcn30/dcn30_hwseq.c index eaeeade31ed7..f3eb6fe6f59b 100644 --- a/drivers/gpu/drm/amd/display/dc/hwss/dcn30/dcn30_hwseq.c +++ b/drivers/gpu/drm/amd/display/dc/hwss/dcn30/dcn30_hwseq.c @@ -786,11 +786,12 @@ void dcn30_init_hw(struct dc *dc) if (!dcb->funcs->is_accelerated_mode(dcb) && dc->res_pool->hubbub->funcs->init_watermarks) dc->res_pool->hubbub->funcs->init_watermarks(dc->res_pool->hubbub); - if (dc->clk_mgr->funcs->notify_wm_ranges) + if (dc->clk_mgr && dc->clk_mgr->funcs->notify_wm_ranges) dc->clk_mgr->funcs->notify_wm_ranges(dc->clk_mgr); //if softmax is enabled then hardmax will be set by a different call - if (dc->clk_mgr->funcs->set_hard_max_memclk && !dc->clk_mgr->dc_mode_softmax_enabled) + if (dc->clk_mgr && dc->clk_mgr->funcs->set_hard_max_memclk && + !dc->clk_mgr->dc_mode_softmax_enabled) dc->clk_mgr->funcs->set_hard_max_memclk(dc->clk_mgr); if (dc->res_pool->hubbub->funcs->force_pstate_change_control) -- 2.34.1
[PATCH] drm/amd/display: Add null check for set_output_gamma in dcn30_set_output_transfer_func
This commit adds a null check for the set_output_gamma function pointer
in the dcn30_set_output_transfer_func function. Previously,
set_output_gamma was being checked for nullity at line 386, but then it
was being dereferenced without any nullity check at line 401. This
could potentially lead to a null pointer dereference error if
set_output_gamma is indeed null.
To fix this, we now ensure that set_output_gamma is not null before
dereferencing it. We do this by adding a nullity check for
set_output_gamma before the call to set_output_gamma at line 401. If
set_output_gamma is null, we log an error message and do not call the
function.
This fix prevents a potential null pointer dereference error.
drivers/gpu/drm/amd/amdgpu/../display/dc/hwss/dcn30/dcn30_hwseq.c:401
dcn30_set_output_transfer_func()
error: we previously assumed 'mpc->funcs->set_output_gamma' could be null (see
line 386)
drivers/gpu/drm/amd/amdgpu/../display/dc/hwss/dcn30/dcn30_hwseq.c
373 bool dcn30_set_output_transfer_func(struct dc *dc,
374 struct pipe_ctx *pipe_ctx,
375 const struct dc_stream_state *stream)
376 {
377 int mpcc_id = pipe_ctx->plane_res.hubp->inst;
378 struct mpc *mpc =
pipe_ctx->stream_res.opp->ctx->dc->res_pool->mpc;
379 const struct pwl_params *params = NULL;
380 bool ret = false;
381
382 /* program OGAM or 3DLUT only for the top pipe*/
383 if (pipe_ctx->top_pipe == NULL) {
384 /*program rmu shaper and 3dlut in MPC*/
385 ret = dcn30_set_mpc_shaper_3dlut(pipe_ctx, stream);
386 if (ret == false && mpc->funcs->set_output_gamma) {
If
this is NULL
387 if (stream->out_transfer_func.type ==
TF_TYPE_HWPWL)
388 params = &stream->out_transfer_func.pwl;
389 else if
(pipe_ctx->stream->out_transfer_func.type ==
390 TF_TYPE_DISTRIBUTED_POINTS &&
391
cm3_helper_translate_curve_to_hw_format(
392 &stream->out_transfer_func,
393 &mpc->blender_params, false))
394 params = &mpc->blender_params;
395 /* there are no ROM LUTs in OUTGAM */
396 if (stream->out_transfer_func.type ==
TF_TYPE_PREDEFINED)
397 BREAK_TO_DEBUGGER();
398 }
399 }
400
--> 401 mpc->funcs->set_output_gamma(mpc, mpcc_id, params);
Then it will crash
402 return ret;
403 }
Fixes: d99f13878d6f ("drm/amd/display: Add DCN3 HWSEQ")
Reported-by: Dan Carpenter
Cc: Tom Chung
Cc: Rodrigo Siqueira
Cc: Roman Li
Cc: Hersen Wu
Cc: Alex Hung
Cc: Aurabindo Pillai
Cc: Harry Wentland
Cc: Hamza Mahfooz
Signed-off-by: Srinivasan Shanmugam
---
drivers/gpu/drm/amd/display/dc/hwss/dcn30/dcn30_hwseq.c | 6 +-
1 file changed, 5 insertions(+), 1 deletion(-)
diff --git a/drivers/gpu/drm/amd/display/dc/hwss/dcn30/dcn30_hwseq.c
b/drivers/gpu/drm/amd/display/dc/hwss/dcn30/dcn30_hwseq.c
index eaeeade31ed7..bd807eb79786 100644
--- a/drivers/gpu/drm/amd/display/dc/hwss/dcn30/dcn30_hwseq.c
+++ b/drivers/gpu/drm/amd/display/dc/hwss/dcn30/dcn30_hwseq.c
@@ -398,7 +398,11 @@ bool dcn30_set_output_transfer_func(struct dc *dc,
}
}
- mpc->funcs->set_output_gamma(mpc, mpcc_id, params);
+ if (mpc->funcs->set_output_gamma)
+ mpc->funcs->set_output_gamma(mpc, mpcc_id, params);
+ else
+ DRM_ERROR("set_output_gamma function pointer is NULL.\n");
+
return ret;
}
--
2.34.1
[PATCH] drm/amd/display: Add NULL check for clk_mgr in dcn401_init_hw
This commit addresses a potential null pointer dereference issue in the
`dcn401_init_hw` function. The issue could occur when `dc->clk_mgr` is
null.
The fix adds a check to ensure `dc->clk_mgr` is not null before
accessing its functions. This prevents a potential null pointer
dereference.
Reported by smatch:
drivers/gpu/drm/amd/amdgpu/../display/dc/hwss/dcn401/dcn401_hwseq.c:416
dcn401_init_hw() error: we previously assumed 'dc->clk_mgr' could be null (see
line 225)
Cc: Tom Chung
Cc: Rodrigo Siqueira
Cc: Roman Li
Cc: Alex Hung
Cc: Aurabindo Pillai
Cc: Harry Wentland
Cc: Hamza Mahfooz
Signed-off-by: Srinivasan Shanmugam
---
.../gpu/drm/amd/display/dc/hwss/dcn401/dcn401_hwseq.c| 9 ++---
1 file changed, 6 insertions(+), 3 deletions(-)
diff --git a/drivers/gpu/drm/amd/display/dc/hwss/dcn401/dcn401_hwseq.c
b/drivers/gpu/drm/amd/display/dc/hwss/dcn401/dcn401_hwseq.c
index f4c1547a368f..16ffb41abc6d 100644
--- a/drivers/gpu/drm/amd/display/dc/hwss/dcn401/dcn401_hwseq.c
+++ b/drivers/gpu/drm/amd/display/dc/hwss/dcn401/dcn401_hwseq.c
@@ -413,10 +413,11 @@ void dcn401_init_hw(struct dc *dc)
if (!dcb->funcs->is_accelerated_mode(dcb) &&
dc->res_pool->hubbub->funcs->init_watermarks)
dc->res_pool->hubbub->funcs->init_watermarks(dc->res_pool->hubbub);
- if (dc->clk_mgr->funcs->notify_wm_ranges)
+ if (dc->clk_mgr && dc->clk_mgr->funcs->notify_wm_ranges)
dc->clk_mgr->funcs->notify_wm_ranges(dc->clk_mgr);
- if (dc->clk_mgr->funcs->set_hard_max_memclk &&
!dc->clk_mgr->dc_mode_softmax_enabled)
+ if (dc->clk_mgr && dc->clk_mgr->funcs->set_hard_max_memclk &&
+ !dc->clk_mgr->dc_mode_softmax_enabled)
dc->clk_mgr->funcs->set_hard_max_memclk(dc->clk_mgr);
if (dc->res_pool->hubbub->funcs->force_pstate_change_control)
@@ -438,7 +439,9 @@ void dcn401_init_hw(struct dc *dc)
dc->debug.fams2_config.bits.enable &=
dc->ctx->dmub_srv->dmub->feature_caps.fw_assisted_mclk_switch_ver == 2;
if (!dc->debug.fams2_config.bits.enable &&
dc->res_pool->funcs->update_bw_bounding_box) {
/* update bounding box if FAMS2 disabled */
- dc->res_pool->funcs->update_bw_bounding_box(dc,
dc->clk_mgr->bw_params);
+ if (dc->clk_mgr)
+ dc->res_pool->funcs->update_bw_bounding_box(dc,
+
dc->clk_mgr->bw_params);
}
}
}
--
2.34.1
[PATCH] drm/amd/display: Fix index out of bounds in DCN30 color transformation
This commit addresses a potential index out of bounds issue in the
`cm3_helper_translate_curve_to_hw_format` function in the DCN30 color
management module. The issue could occur when the index 'i' exceeds the
number of transfer function points (TRANSFER_FUNC_POINTS).
The fix adds a check to ensure 'i' is within bounds before accessing the
transfer function points. If 'i' is out of bounds, the function returns
false to indicate an error.
drivers/gpu/drm/amd/amdgpu/../display/dc/dcn30/dcn30_cm_common.c:180
cm3_helper_translate_curve_to_hw_format() error: buffer overflow
'output_tf->tf_pts.red' 1025 <= s32max
drivers/gpu/drm/amd/amdgpu/../display/dc/dcn30/dcn30_cm_common.c:181
cm3_helper_translate_curve_to_hw_format() error: buffer overflow
'output_tf->tf_pts.green' 1025 <= s32max
drivers/gpu/drm/amd/amdgpu/../display/dc/dcn30/dcn30_cm_common.c:182
cm3_helper_translate_curve_to_hw_format() error: buffer overflow
'output_tf->tf_pts.blue' 1025 <= s32max
Cc: Tom Chung
Cc: Rodrigo Siqueira
Cc: Roman Li
Cc: Alex Hung
Cc: Aurabindo Pillai
Cc: Harry Wentland
Cc: Hamza Mahfooz
Signed-off-by: Srinivasan Shanmugam
---
drivers/gpu/drm/amd/display/dc/dcn30/dcn30_cm_common.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/drivers/gpu/drm/amd/display/dc/dcn30/dcn30_cm_common.c
b/drivers/gpu/drm/amd/display/dc/dcn30/dcn30_cm_common.c
index 685702321d32..ef7d75f6ab93 100644
--- a/drivers/gpu/drm/amd/display/dc/dcn30/dcn30_cm_common.c
+++ b/drivers/gpu/drm/amd/display/dc/dcn30/dcn30_cm_common.c
@@ -177,6 +177,8 @@ bool cm3_helper_translate_curve_to_hw_format(
i += increment) {
if (j == hw_points)
break;
+ if (i >= TRANSFER_FUNC_POINTS)
+ return false;
rgb_resulted[j].red = output_tf->tf_pts.red[i];
rgb_resulted[j].green = output_tf->tf_pts.green[i];
rgb_resulted[j].blue = output_tf->tf_pts.blue[i];
--
2.34.1
[PATCH] drm/amd/display: Fix index out of bounds in DCN30 degamma hardware format translation
This commit addresses a potential index out of bounds issue in the
`cm3_helper_translate_curve_to_degamma_hw_format` function in the DCN30
color management module. The issue could occur when the index 'i'
exceeds the number of transfer function points (TRANSFER_FUNC_POINTS).
The fix adds a check to ensure 'i' is within bounds before accessing the
transfer function points. If 'i' is out of bounds, the function returns
false to indicate an error.
Reported by smatch:
drivers/gpu/drm/amd/amdgpu/../display/dc/dcn30/dcn30_cm_common.c:338
cm3_helper_translate_curve_to_degamma_hw_format() error: buffer overflow
'output_tf->tf_pts.red' 1025 <= s32max
drivers/gpu/drm/amd/amdgpu/../display/dc/dcn30/dcn30_cm_common.c:339
cm3_helper_translate_curve_to_degamma_hw_format() error: buffer overflow
'output_tf->tf_pts.green' 1025 <= s32max
drivers/gpu/drm/amd/amdgpu/../display/dc/dcn30/dcn30_cm_common.c:340
cm3_helper_translate_curve_to_degamma_hw_format() error: buffer overflow
'output_tf->tf_pts.blue' 1025 <= s32max
Cc: Tom Chung
Cc: Rodrigo Siqueira
Cc: Roman Li
Cc: Alex Hung
Cc: Aurabindo Pillai
Cc: Harry Wentland
Cc: Hamza Mahfooz
Signed-off-by: Srinivasan Shanmugam
---
drivers/gpu/drm/amd/display/dc/dcn30/dcn30_cm_common.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/drivers/gpu/drm/amd/display/dc/dcn30/dcn30_cm_common.c
b/drivers/gpu/drm/amd/display/dc/dcn30/dcn30_cm_common.c
index ef7d75f6ab93..f31f0e3abfc0 100644
--- a/drivers/gpu/drm/amd/display/dc/dcn30/dcn30_cm_common.c
+++ b/drivers/gpu/drm/amd/display/dc/dcn30/dcn30_cm_common.c
@@ -337,6 +337,8 @@ bool cm3_helper_translate_curve_to_degamma_hw_format(
i += increment) {
if (j == hw_points - 1)
break;
+ if (i >= TRANSFER_FUNC_POINTS)
+ return false;
rgb_resulted[j].red = output_tf->tf_pts.red[i];
rgb_resulted[j].green = output_tf->tf_pts.green[i];
rgb_resulted[j].blue = output_tf->tf_pts.blue[i];
--
2.34.1
[PATCH] drm/amd/display: Fix index out of bounds in degamma hardware format translation
Fixes index out of bounds issue in
`cm_helper_translate_curve_to_degamma_hw_format` function. The issue
could occur when the index 'i' exceeds the number of transfer function
points (TRANSFER_FUNC_POINTS).
The fix adds a check to ensure 'i' is within bounds before accessing the
transfer function points. If 'i' is out of bounds the function returns
false to indicate an error.
Reported by smatch:
drivers/gpu/drm/amd/amdgpu/../display/dc/dcn10/dcn10_cm_common.c:594
cm_helper_translate_curve_to_degamma_hw_format() error: buffer overflow
'output_tf->tf_pts.red' 1025 <= s32max
drivers/gpu/drm/amd/amdgpu/../display/dc/dcn10/dcn10_cm_common.c:595
cm_helper_translate_curve_to_degamma_hw_format() error: buffer overflow
'output_tf->tf_pts.green' 1025 <= s32max
drivers/gpu/drm/amd/amdgpu/../display/dc/dcn10/dcn10_cm_common.c:596
cm_helper_translate_curve_to_degamma_hw_format() error: buffer overflow
'output_tf->tf_pts.blue' 1025 <= s32max
Cc: Tom Chung
Cc: Rodrigo Siqueira
Cc: Roman Li
Cc: Alex Hung
Cc: Aurabindo Pillai
Cc: Harry Wentland
Cc: Hamza Mahfooz
Signed-off-by: Srinivasan Shanmugam
---
drivers/gpu/drm/amd/display/dc/dcn10/dcn10_cm_common.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/drivers/gpu/drm/amd/display/dc/dcn10/dcn10_cm_common.c
b/drivers/gpu/drm/amd/display/dc/dcn10/dcn10_cm_common.c
index 0b49362f71b0..eaed5d1c398a 100644
--- a/drivers/gpu/drm/amd/display/dc/dcn10/dcn10_cm_common.c
+++ b/drivers/gpu/drm/amd/display/dc/dcn10/dcn10_cm_common.c
@@ -591,6 +591,8 @@ bool cm_helper_translate_curve_to_degamma_hw_format(
i += increment) {
if (j == hw_points - 1)
break;
+ if (i >= TRANSFER_FUNC_POINTS)
+ return false;
rgb_resulted[j].red = output_tf->tf_pts.red[i];
rgb_resulted[j].green = output_tf->tf_pts.green[i];
rgb_resulted[j].blue = output_tf->tf_pts.blue[i];
--
2.34.1
[PATCH 1/2] drm/amd/display: Add null check for head_pipe in dcn201_acquire_free_pipe_for_layer
This commit addresses a potential null pointer dereference issue in the
`dcn201_acquire_free_pipe_for_layer` function. The issue could occur
when `head_pipe` is null.
The fix adds a check to ensure `head_pipe` is not null before asserting
it. If `head_pipe` is null, the function returns NULL to prevent a
potential null pointer dereference.
Reported by smatch:
drivers/gpu/drm/amd/amdgpu/../display/dc/resource/dcn201/dcn201_resource.c:1016
dcn201_acquire_free_pipe_for_layer() error: we previously assumed 'head_pipe'
could be null (see line 1010)
Cc: Tom Chung
Cc: Rodrigo Siqueira
Cc: Roman Li
Cc: Alex Hung
Cc: Aurabindo Pillai
Cc: Harry Wentland
Cc: Hamza Mahfooz
Signed-off-by: Srinivasan Shanmugam
---
.../gpu/drm/amd/display/dc/resource/dcn201/dcn201_resource.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
diff --git a/drivers/gpu/drm/amd/display/dc/resource/dcn201/dcn201_resource.c
b/drivers/gpu/drm/amd/display/dc/resource/dcn201/dcn201_resource.c
index 131d98025bd4..fc54483b9104 100644
--- a/drivers/gpu/drm/amd/display/dc/resource/dcn201/dcn201_resource.c
+++ b/drivers/gpu/drm/amd/display/dc/resource/dcn201/dcn201_resource.c
@@ -1007,8 +1007,10 @@ static struct pipe_ctx
*dcn201_acquire_free_pipe_for_layer(
struct pipe_ctx *head_pipe =
resource_get_otg_master_for_stream(res_ctx, opp_head_pipe->stream);
struct pipe_ctx *idle_pipe =
resource_find_free_secondary_pipe_legacy(res_ctx, pool, head_pipe);
- if (!head_pipe)
+ if (!head_pipe) {
ASSERT(0);
+ return NULL;
+ }
if (!idle_pipe)
return NULL;
--
2.34.1
[PATCH 2/2] drm/amd/display: Add null check for head_pipe in dcn32_acquire_idle_pipe_for_head_pipe_in_layer
This commit addresses a potential null pointer dereference issue in the
`dcn32_acquire_idle_pipe_for_head_pipe_in_layer` function. The issue
could occur when `head_pipe` is null.
The fix adds a check to ensure `head_pipe` is not null before asserting
it. If `head_pipe` is null, the function returns NULL to prevent a
potential null pointer dereference.
Reported by smatch:
drivers/gpu/drm/amd/amdgpu/../display/dc/resource/dcn32/dcn32_resource.c:2690
dcn32_acquire_idle_pipe_for_head_pipe_in_layer() error: we previously assumed
'head_pipe' could be null (see line 2681)
Cc: Tom Chung
Cc: Rodrigo Siqueira
Cc: Roman Li
Cc: Alex Hung
Cc: Aurabindo Pillai
Cc: Harry Wentland
Cc: Hamza Mahfooz
Signed-off-by: Srinivasan Shanmugam
---
.../gpu/drm/amd/display/dc/resource/dcn32/dcn32_resource.c| 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
diff --git a/drivers/gpu/drm/amd/display/dc/resource/dcn32/dcn32_resource.c
b/drivers/gpu/drm/amd/display/dc/resource/dcn32/dcn32_resource.c
index 6eaf3cfebcb7..a124ad9bd108 100644
--- a/drivers/gpu/drm/amd/display/dc/resource/dcn32/dcn32_resource.c
+++ b/drivers/gpu/drm/amd/display/dc/resource/dcn32/dcn32_resource.c
@@ -2678,8 +2678,10 @@ static struct pipe_ctx
*dcn32_acquire_idle_pipe_for_head_pipe_in_layer(
struct resource_context *old_ctx =
&stream->ctx->dc->current_state->res_ctx;
int head_index;
- if (!head_pipe)
+ if (!head_pipe) {
ASSERT(0);
+ return NULL;
+ }
/*
* Modified from dcn20_acquire_idle_pipe_for_layer
--
2.34.1
[PATCH v2] drm/amd/display: Add NULL check for clk_mgr and clk_mgr->funcs in dcn30_init_hw
This commit addresses a potential null pointer dereference issue in the `dcn30_init_hw` function. The issue could occur when `dc->clk_mgr` or `dc->clk_mgr->funcs` is null. The fix adds a check to ensure `dc->clk_mgr` and `dc->clk_mgr->funcs` is not null before accessing its functions. This prevents a potential null pointer dereference. Reported by smatch: drivers/gpu/drm/amd/amdgpu/../display/dc/hwss/dcn30/dcn30_hwseq.c:789 dcn30_init_hw() error: we previously assumed 'dc->clk_mgr' could be null (see line 628) Cc: Tom Chung Cc: Rodrigo Siqueira Cc: Roman Li Cc: Alex Hung Cc: Aurabindo Pillai Cc: Harry Wentland Cc: Hamza Mahfooz Signed-off-by: Srinivasan Shanmugam --- v2: Along with "dc->clk_mgr" add check for even dc->clk_mgr->funcs" (Tom) drivers/gpu/drm/amd/display/dc/hwss/dcn30/dcn30_hwseq.c | 7 --- 1 file changed, 4 insertions(+), 3 deletions(-) diff --git a/drivers/gpu/drm/amd/display/dc/hwss/dcn30/dcn30_hwseq.c b/drivers/gpu/drm/amd/display/dc/hwss/dcn30/dcn30_hwseq.c index fc5936460ac2..98a40d46aaae 100644 --- a/drivers/gpu/drm/amd/display/dc/hwss/dcn30/dcn30_hwseq.c +++ b/drivers/gpu/drm/amd/display/dc/hwss/dcn30/dcn30_hwseq.c @@ -625,7 +625,7 @@ void dcn30_init_hw(struct dc *dc) uint32_t backlight = MAX_BACKLIGHT_LEVEL; uint32_t user_level = MAX_BACKLIGHT_LEVEL; - if (dc->clk_mgr && dc->clk_mgr->funcs->init_clocks) + if (dc->clk_mgr && dc->clk_mgr->funcs && dc->clk_mgr->funcs->init_clocks) dc->clk_mgr->funcs->init_clocks(dc->clk_mgr); // Initialize the dccg @@ -786,11 +786,12 @@ void dcn30_init_hw(struct dc *dc) if (!dcb->funcs->is_accelerated_mode(dcb) && dc->res_pool->hubbub->funcs->init_watermarks) dc->res_pool->hubbub->funcs->init_watermarks(dc->res_pool->hubbub); - if (dc->clk_mgr->funcs->notify_wm_ranges) + if (dc->clk_mgr && dc->clk_mgr->funcs && dc->clk_mgr->funcs->notify_wm_ranges) dc->clk_mgr->funcs->notify_wm_ranges(dc->clk_mgr); //if softmax is enabled then hardmax will be set by a different call - if (dc->clk_mgr->funcs->set_hard_max_memclk && !dc->clk_mgr->dc_mode_softmax_enabled) + if (dc->clk_mgr && dc->clk_mgr->funcs && dc->clk_mgr->funcs->set_hard_max_memclk && + !dc->clk_mgr->dc_mode_softmax_enabled) dc->clk_mgr->funcs->set_hard_max_memclk(dc->clk_mgr); if (dc->res_pool->hubbub->funcs->force_pstate_change_control) -- 2.34.1
[PATCH v2] drm/amd/display: Add NULL check for clk_mgr in dcn32_init_hw
This commit addresses a potential null pointer dereference issue in the `dcn32_init_hw` function. The issue could occur when `dc->clk_mgr` is null. The fix adds a check to ensure `dc->clk_mgr` is not null before accessing its functions. This prevents a potential null pointer dereference. Reported by smatch: drivers/gpu/drm/amd/amdgpu/../display/dc/hwss/dcn32/dcn32_hwseq.c:961 dcn32_init_hw() error: we previously assumed 'dc->clk_mgr' could be null (see line 782) Cc: Tom Chung Cc: Rodrigo Siqueira Cc: Roman Li Cc: Alex Hung Cc: Aurabindo Pillai Cc: Harry Wentland Cc: Hamza Mahfooz Signed-off-by: Srinivasan Shanmugam --- v2: Along with "dc->clk_mgr" add check for even dc->clk_mgr->funcs" (Tom) drivers/gpu/drm/amd/display/dc/hwss/dcn32/dcn32_hwseq.c | 7 --- 1 file changed, 4 insertions(+), 3 deletions(-) diff --git a/drivers/gpu/drm/amd/display/dc/hwss/dcn32/dcn32_hwseq.c b/drivers/gpu/drm/amd/display/dc/hwss/dcn32/dcn32_hwseq.c index a7cb003f1dfb..fcaabad204a2 100644 --- a/drivers/gpu/drm/amd/display/dc/hwss/dcn32/dcn32_hwseq.c +++ b/drivers/gpu/drm/amd/display/dc/hwss/dcn32/dcn32_hwseq.c @@ -779,7 +779,7 @@ void dcn32_init_hw(struct dc *dc) uint32_t backlight = MAX_BACKLIGHT_LEVEL; uint32_t user_level = MAX_BACKLIGHT_LEVEL; - if (dc->clk_mgr && dc->clk_mgr->funcs->init_clocks) + if (dc->clk_mgr && dc->clk_mgr->funcs && dc->clk_mgr->funcs->init_clocks) dc->clk_mgr->funcs->init_clocks(dc->clk_mgr); // Initialize the dccg @@ -958,10 +958,11 @@ void dcn32_init_hw(struct dc *dc) if (!dcb->funcs->is_accelerated_mode(dcb) && dc->res_pool->hubbub->funcs->init_watermarks) dc->res_pool->hubbub->funcs->init_watermarks(dc->res_pool->hubbub); - if (dc->clk_mgr->funcs->notify_wm_ranges) + if (dc->clk_mgr && dc->clk_mgr->funcs && dc->clk_mgr->funcs->notify_wm_ranges) dc->clk_mgr->funcs->notify_wm_ranges(dc->clk_mgr); - if (dc->clk_mgr->funcs->set_hard_max_memclk && !dc->clk_mgr->dc_mode_softmax_enabled) + if (dc->clk_mgr && dc->clk_mgr->funcs && dc->clk_mgr->funcs->set_hard_max_memclk && + !dc->clk_mgr->dc_mode_softmax_enabled) dc->clk_mgr->funcs->set_hard_max_memclk(dc->clk_mgr); if (dc->res_pool->hubbub->funcs->force_pstate_change_control) -- 2.34.1
[PATCH v2] drm/amd/display: Add NULL check for clk_mgr and clk_mgr->funcs in dcn401_init_hw
This commit addresses a potential null pointer dereference issue in the
`dcn401_init_hw` function. The issue could occur when `dc->clk_mgr` or
`dc->clk_mgr->funcs` is null.
The fix adds a check to ensure `dc->clk_mgr` and `dc->clk_mgr->funcs` is
not null before accessing its functions. This prevents a potential null
pointer dereference.
Reported by smatch:
drivers/gpu/drm/amd/amdgpu/../display/dc/hwss/dcn401/dcn401_hwseq.c:416
dcn401_init_hw() error: we previously assumed 'dc->clk_mgr' could be null (see
line 225)
Cc: Tom Chung
Cc: Rodrigo Siqueira
Cc: Roman Li
Cc: Alex Hung
Cc: Aurabindo Pillai
Cc: Harry Wentland
Cc: Hamza Mahfooz
Signed-off-by: Srinivasan Shanmugam
---
v2: Along with "dc->clk_mgr" add check for even dc->clk_mgr->funcs" (Tom)
drivers/gpu/drm/amd/display/dc/hwss/dcn401/dcn401_hwseq.c | 8 +---
1 file changed, 5 insertions(+), 3 deletions(-)
diff --git a/drivers/gpu/drm/amd/display/dc/hwss/dcn401/dcn401_hwseq.c
b/drivers/gpu/drm/amd/display/dc/hwss/dcn401/dcn401_hwseq.c
index 87c5ef579ecb..0fa610590245 100644
--- a/drivers/gpu/drm/amd/display/dc/hwss/dcn401/dcn401_hwseq.c
+++ b/drivers/gpu/drm/amd/display/dc/hwss/dcn401/dcn401_hwseq.c
@@ -222,7 +222,7 @@ void dcn401_init_hw(struct dc *dc)
uint32_t backlight = MAX_BACKLIGHT_LEVEL;
uint32_t user_level = MAX_BACKLIGHT_LEVEL;
- if (dc->clk_mgr && dc->clk_mgr->funcs->init_clocks) {
+ if (dc->clk_mgr && dc->clk_mgr->funcs &&
dc->clk_mgr->funcs->init_clocks) {
dc->clk_mgr->funcs->init_clocks(dc->clk_mgr);
// mark dcmode limits present if any clock has distinct AC and
DC values from SMU
@@ -413,7 +413,7 @@ void dcn401_init_hw(struct dc *dc)
if (!dcb->funcs->is_accelerated_mode(dcb) &&
dc->res_pool->hubbub->funcs->init_watermarks)
dc->res_pool->hubbub->funcs->init_watermarks(dc->res_pool->hubbub);
- if (dc->clk_mgr->funcs->notify_wm_ranges)
+ if (dc->clk_mgr && dc->clk_mgr->funcs &&
dc->clk_mgr->funcs->notify_wm_ranges)
dc->clk_mgr->funcs->notify_wm_ranges(dc->clk_mgr);
if (dc->res_pool->hubbub->funcs->force_pstate_change_control)
@@ -435,7 +435,9 @@ void dcn401_init_hw(struct dc *dc)
dc->debug.fams2_config.bits.enable &=
dc->ctx->dmub_srv->dmub->feature_caps.fw_assisted_mclk_switch_ver == 2;
if (!dc->debug.fams2_config.bits.enable &&
dc->res_pool->funcs->update_bw_bounding_box) {
/* update bounding box if FAMS2 disabled */
- dc->res_pool->funcs->update_bw_bounding_box(dc,
dc->clk_mgr->bw_params);
+ if (dc->clk_mgr)
+ dc->res_pool->funcs->update_bw_bounding_box(dc,
+
dc->clk_mgr->bw_params);
}
}
}
--
2.34.1
[PATCH v2] drm/amd/display: Add null check for set_output_gamma in dcn30_set_output_transfer_func
This commit adds a null check for the set_output_gamma function pointer
in the dcn30_set_output_transfer_func function. Previously,
set_output_gamma was being checked for nullity at line 386, but then it
was being dereferenced without any nullity check at line 401. This
could potentially lead to a null pointer dereference error if
set_output_gamma is indeed null.
To fix this, we now ensure that set_output_gamma is not null before
dereferencing it. We do this by adding a nullity check for
set_output_gamma before the call to set_output_gamma at line 401. If
set_output_gamma is null, we log an error message and do not call the
function.
This fix prevents a potential null pointer dereference error.
drivers/gpu/drm/amd/amdgpu/../display/dc/hwss/dcn30/dcn30_hwseq.c:401
dcn30_set_output_transfer_func()
error: we previously assumed 'mpc->funcs->set_output_gamma' could be null (see
line 386)
drivers/gpu/drm/amd/amdgpu/../display/dc/hwss/dcn30/dcn30_hwseq.c
373 bool dcn30_set_output_transfer_func(struct dc *dc,
374 struct pipe_ctx *pipe_ctx,
375 const struct dc_stream_state *stream)
376 {
377 int mpcc_id = pipe_ctx->plane_res.hubp->inst;
378 struct mpc *mpc =
pipe_ctx->stream_res.opp->ctx->dc->res_pool->mpc;
379 const struct pwl_params *params = NULL;
380 bool ret = false;
381
382 /* program OGAM or 3DLUT only for the top pipe*/
383 if (pipe_ctx->top_pipe == NULL) {
384 /*program rmu shaper and 3dlut in MPC*/
385 ret = dcn30_set_mpc_shaper_3dlut(pipe_ctx, stream);
386 if (ret == false && mpc->funcs->set_output_gamma) {
If
this is NULL
387 if (stream->out_transfer_func.type ==
TF_TYPE_HWPWL)
388 params = &stream->out_transfer_func.pwl;
389 else if
(pipe_ctx->stream->out_transfer_func.type ==
390 TF_TYPE_DISTRIBUTED_POINTS &&
391
cm3_helper_translate_curve_to_hw_format(
392 &stream->out_transfer_func,
393 &mpc->blender_params, false))
394 params = &mpc->blender_params;
395 /* there are no ROM LUTs in OUTGAM */
396 if (stream->out_transfer_func.type ==
TF_TYPE_PREDEFINED)
397 BREAK_TO_DEBUGGER();
398 }
399 }
400
--> 401 mpc->funcs->set_output_gamma(mpc, mpcc_id, params);
Then it will crash
402 return ret;
403 }
Fixes: d99f13878d6f ("drm/amd/display: Add DCN3 HWSEQ")
Reported-by: Dan Carpenter
Cc: Tom Chung
Cc: Rodrigo Siqueira
Cc: Roman Li
Cc: Hersen Wu
Cc: Alex Hung
Cc: Aurabindo Pillai
Cc: Harry Wentland
Cc: Hamza Mahfooz
Signed-off-by: Srinivasan Shanmugam
---
v2: s/DRM_ERROR/DC_LOG_ERROR (Tom)
drivers/gpu/drm/amd/display/dc/hwss/dcn30/dcn30_hwseq.c | 6 +-
1 file changed, 5 insertions(+), 1 deletion(-)
diff --git a/drivers/gpu/drm/amd/display/dc/hwss/dcn30/dcn30_hwseq.c
b/drivers/gpu/drm/amd/display/dc/hwss/dcn30/dcn30_hwseq.c
index 98a40d46aaae..42c52284a868 100644
--- a/drivers/gpu/drm/amd/display/dc/hwss/dcn30/dcn30_hwseq.c
+++ b/drivers/gpu/drm/amd/display/dc/hwss/dcn30/dcn30_hwseq.c
@@ -398,7 +398,11 @@ bool dcn30_set_output_transfer_func(struct dc *dc,
}
}
- mpc->funcs->set_output_gamma(mpc, mpcc_id, params);
+ if (mpc->funcs->set_output_gamma)
+ mpc->funcs->set_output_gamma(mpc, mpcc_id, params);
+ else
+ DC_LOG_ERROR("%s: set_output_gamma function pointer is
NULL.\n", __func__);
+
return ret;
}
--
2.34.1
[PATCH] drm/amd/display: Add kdoc entry for 'bs_coeffs_updated' in dpp401_dscl_program_isharp
Fixes the below with gcc W=1:
drivers/gpu/drm/amd/amdgpu/../display/dc/dpp/dcn401/dcn401_dpp_dscl.c:961:
warning: Function parameter or struct member 'bs_coeffs_updated' not described
in 'dpp401_dscl_program_isharp'
Fixes: 431ae65ea4e1 ("drm/amd/display: ensure EASF and ISHARP coefficients are
programmed together")
Cc: Tom Chung
Cc: Rodrigo Siqueira
Cc: Roman Li
Cc: Alex Hung
Cc: Aurabindo Pillai
Cc: Harry Wentland
Cc: Hamza Mahfooz
Signed-off-by: Srinivasan Shanmugam
---
drivers/gpu/drm/amd/display/dc/dpp/dcn401/dcn401_dpp_dscl.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/drivers/gpu/drm/amd/display/dc/dpp/dcn401/dcn401_dpp_dscl.c
b/drivers/gpu/drm/amd/display/dc/dpp/dcn401/dcn401_dpp_dscl.c
index 703d7b51c6c2..3a3745597f0c 100644
--- a/drivers/gpu/drm/amd/display/dc/dpp/dcn401/dcn401_dpp_dscl.c
+++ b/drivers/gpu/drm/amd/display/dc/dpp/dcn401/dcn401_dpp_dscl.c
@@ -951,6 +951,7 @@ static void dpp401_dscl_set_isharp_filter(
*
* @dpp_base: High level DPP struct
* @scl_data: scalaer_data info
+ * @bs_coeffs_updated: coeffs update flag
*
* This is the primary function to program isharp
*
--
2.34.1
[PATCH] drm/amd/display: Add null check for pipe_ctx->plane_state in dcn20_program_pipe
This commit addresses a null pointer dereference issue in the
`dcn20_program_pipe` function. The issue could occur when
`pipe_ctx->plane_state` is null.
The fix adds a check to ensure `pipe_ctx->plane_state` is not null
before accessing. This prevents a null pointer dereference.
Reported by smatch:
drivers/gpu/drm/amd/amdgpu/../display/dc/hwss/dcn20/dcn20_hwseq.c:1925
dcn20_program_pipe() error: we previously assumed 'pipe_ctx->plane_state' could
be null (see line 1877)
Cc: Tom Chung
Cc: Rodrigo Siqueira
Cc: Roman Li
Cc: Alex Hung
Cc: Aurabindo Pillai
Cc: Harry Wentland
Cc: Hamza Mahfooz
Signed-off-by: Srinivasan Shanmugam
---
.../amd/display/dc/hwss/dcn20/dcn20_hwseq.c | 30 ---
1 file changed, 19 insertions(+), 11 deletions(-)
diff --git a/drivers/gpu/drm/amd/display/dc/hwss/dcn20/dcn20_hwseq.c
b/drivers/gpu/drm/amd/display/dc/hwss/dcn20/dcn20_hwseq.c
index 270e337ae27b..5a6064999033 100644
--- a/drivers/gpu/drm/amd/display/dc/hwss/dcn20/dcn20_hwseq.c
+++ b/drivers/gpu/drm/amd/display/dc/hwss/dcn20/dcn20_hwseq.c
@@ -1922,22 +1922,29 @@ static void dcn20_program_pipe(
dc->res_pool->hubbub,
pipe_ctx->plane_res.hubp->inst, pipe_ctx->hubp_regs.det_size);
}
- if (pipe_ctx->update_flags.raw ||
pipe_ctx->plane_state->update_flags.raw || pipe_ctx->stream->update_flags.raw)
+ if (pipe_ctx->update_flags.raw ||
+ (pipe_ctx->plane_state && pipe_ctx->plane_state->update_flags.raw)
||
+ pipe_ctx->stream->update_flags.raw)
dcn20_update_dchubp_dpp(dc, pipe_ctx, context);
- if (pipe_ctx->update_flags.bits.enable
- || pipe_ctx->plane_state->update_flags.bits.hdr_mult)
+ if (pipe_ctx->update_flags.bits.enable ||
+ (pipe_ctx->plane_state &&
pipe_ctx->plane_state->update_flags.bits.hdr_mult))
hws->funcs.set_hdr_multiplier(pipe_ctx);
if (hws->funcs.populate_mcm_luts) {
- hws->funcs.populate_mcm_luts(dc, pipe_ctx,
pipe_ctx->plane_state->mcm_luts,
- pipe_ctx->plane_state->lut_bank_a);
- pipe_ctx->plane_state->lut_bank_a =
!pipe_ctx->plane_state->lut_bank_a;
+ if (pipe_ctx->plane_state) {
+ hws->funcs.populate_mcm_luts(dc, pipe_ctx,
pipe_ctx->plane_state->mcm_luts,
+
pipe_ctx->plane_state->lut_bank_a);
+ pipe_ctx->plane_state->lut_bank_a =
!pipe_ctx->plane_state->lut_bank_a;
+ }
}
if (pipe_ctx->update_flags.bits.enable ||
- pipe_ctx->plane_state->update_flags.bits.in_transfer_func_change ||
- pipe_ctx->plane_state->update_flags.bits.gamma_change ||
- pipe_ctx->plane_state->update_flags.bits.lut_3d)
+ (pipe_ctx->plane_state &&
+pipe_ctx->plane_state->update_flags.bits.in_transfer_func_change)
||
+ (pipe_ctx->plane_state &&
+pipe_ctx->plane_state->update_flags.bits.gamma_change) ||
+ (pipe_ctx->plane_state &&
+pipe_ctx->plane_state->update_flags.bits.lut_3d))
hws->funcs.set_input_transfer_func(dc, pipe_ctx,
pipe_ctx->plane_state);
/* dcn10_translate_regamma_to_hw_format takes 750us to finish
@@ -1947,7 +1954,8 @@ static void dcn20_program_pipe(
if (pipe_ctx->update_flags.bits.enable ||
pipe_ctx->update_flags.bits.plane_changed ||
pipe_ctx->stream->update_flags.bits.out_tf ||
-
pipe_ctx->plane_state->update_flags.bits.output_tf_change)
+ (pipe_ctx->plane_state &&
+
pipe_ctx->plane_state->update_flags.bits.output_tf_change))
hws->funcs.set_output_transfer_func(dc, pipe_ctx,
pipe_ctx->stream);
/* If the pipe has been enabled or has a different opp, we
@@ -1971,7 +1979,7 @@ static void dcn20_program_pipe(
}
/* Set ABM pipe after other pipe configurations done */
- if (pipe_ctx->plane_state->visible) {
+ if ((pipe_ctx->plane_state && pipe_ctx->plane_state->visible)) {
if (pipe_ctx->stream_res.abm) {
dc->hwss.set_pipe(pipe_ctx);
pipe_ctx->stream_res.abm->funcs->set_abm_level(pipe_ctx->stream_res.abm,
--
2.34.1
[PATCH] drm/amd/display: Add null check for top_pipe_to_program in commit_planes_for_stream
This commit addresses a null pointer dereference issue in the
`commit_planes_for_stream` function at line 4140. The issue could occur
when `top_pipe_to_program` is null.
The fix adds a check to ensure `top_pipe_to_program` is not null before
accessing its stream_res. This prevents a null pointer dereference.
Reported by smatch:
drivers/gpu/drm/amd/amdgpu/../display/dc/core/dc.c:4140
commit_planes_for_stream() error: we previously assumed 'top_pipe_to_program'
could be null (see line 3906)
Cc: Tom Chung
Cc: Rodrigo Siqueira
Cc: Roman Li
Cc: Alex Hung
Cc: Aurabindo Pillai
Cc: Harry Wentland
Cc: Hamza Mahfooz
Signed-off-by: Srinivasan Shanmugam
---
drivers/gpu/drm/amd/display/dc/core/dc.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/drivers/gpu/drm/amd/display/dc/core/dc.c
b/drivers/gpu/drm/amd/display/dc/core/dc.c
index b8a6c062426d..95d6e29d5e47 100644
--- a/drivers/gpu/drm/amd/display/dc/core/dc.c
+++ b/drivers/gpu/drm/amd/display/dc/core/dc.c
@@ -4137,7 +4137,8 @@ static void commit_planes_for_stream(struct dc *dc,
}
if ((update_type != UPDATE_TYPE_FAST) &&
stream->update_flags.bits.dsc_changed)
- if
(top_pipe_to_program->stream_res.tg->funcs->lock_doublebuffer_enable) {
+ if (top_pipe_to_program &&
+
top_pipe_to_program->stream_res.tg->funcs->lock_doublebuffer_enable) {
top_pipe_to_program->stream_res.tg->funcs->wait_for_state(
top_pipe_to_program->stream_res.tg,
CRTC_STATE_VACTIVE);
--
2.34.1
[PATCH] drm/amdkfd: Fix missing error code in kfd_queue_acquire_buffers
The fix involves setting 'err' to '-EINVAL' before each 'goto
out_err_unreserve'.
Fixes the below:
drivers/gpu/drm/amd/amdgpu/../amdkfd/kfd_queue.c:265 kfd_queue_acquire_buffers()
warn: missing error code 'err'
drivers/gpu/drm/amd/amdgpu/../amdkfd/kfd_queue.c
226 int kfd_queue_acquire_buffers(struct kfd_process_device *pdd, struct
queue_properties *properties)
227 {
228 struct kfd_topology_device *topo_dev;
229 struct amdgpu_vm *vm;
230 u32 total_cwsr_size;
231 int err;
232
233 topo_dev = kfd_topology_device_by_id(pdd->dev->id);
234 if (!topo_dev)
235 return -EINVAL;
236
237 vm = drm_priv_to_vm(pdd->drm_priv);
238 err = amdgpu_bo_reserve(vm->root.bo, false);
239 if (err)
240 return err;
241
242 err = kfd_queue_buffer_get(vm, properties->write_ptr,
&properties->wptr_bo, PAGE_SIZE);
243 if (err)
244 goto out_err_unreserve;
245
246 err = kfd_queue_buffer_get(vm, properties->read_ptr,
&properties->rptr_bo, PAGE_SIZE);
247 if (err)
248 goto out_err_unreserve;
249
250 err = kfd_queue_buffer_get(vm, (void
*)properties->queue_address,
251&properties->ring_bo,
properties->queue_size);
252 if (err)
253 goto out_err_unreserve;
254
255 /* only compute queue requires EOP buffer and CWSR area */
256 if (properties->type != KFD_QUEUE_TYPE_COMPUTE)
257 goto out_unreserve;
This is clearly a success path.
258
259 /* EOP buffer is not required for all ASICs */
260 if (properties->eop_ring_buffer_address) {
261 if (properties->eop_ring_buffer_size !=
topo_dev->node_props.eop_buffer_size) {
262 pr_debug("queue eop bo size 0x%lx not equal to
node eop buf size 0x%x\n",
263 properties->eop_buf_bo->tbo.base.size,
264 topo_dev->node_props.eop_buffer_size);
--> 265 goto out_err_unreserve;
This has err in the label name. err = -EINVAL?
266 }
267 err = kfd_queue_buffer_get(vm, (void
*)properties->eop_ring_buffer_address,
268&properties->eop_buf_bo,
269
properties->eop_ring_buffer_size);
270 if (err)
271 goto out_err_unreserve;
272 }
273
274 if (properties->ctl_stack_size !=
topo_dev->node_props.ctl_stack_size) {
275 pr_debug("queue ctl stack size 0x%x not equal to node
ctl stack size 0x%x\n",
276 properties->ctl_stack_size,
277 topo_dev->node_props.ctl_stack_size);
278 goto out_err_unreserve;
err?
279 }
280
281 if (properties->ctx_save_restore_area_size !=
topo_dev->node_props.cwsr_size) {
282 pr_debug("queue cwsr size 0x%x not equal to node cwsr
size 0x%x\n",
283 properties->ctx_save_restore_area_size,
284 topo_dev->node_props.cwsr_size);
285 goto out_err_unreserve;
err? Not sure.
286 }
287
288 total_cwsr_size = (topo_dev->node_props.cwsr_size +
topo_dev->node_props.debug_memory_size)
289 * NUM_XCC(pdd->dev->xcc_mask);
290 total_cwsr_size = ALIGN(total_cwsr_size, PAGE_SIZE);
291
292 err = kfd_queue_buffer_get(vm, (void
*)properties->ctx_save_restore_area_address,
293&properties->cwsr_bo,
total_cwsr_size);
294 if (!err)
295 goto out_unreserve;
296
297 amdgpu_bo_unreserve(vm->root.bo);
298
299 err = kfd_queue_buffer_svm_get(pdd,
properties->ctx_save_restore_area_address,
300total_cwsr_size);
301 if (err)
302 goto out_err_release;
303
304 return 0;
305
306 out_unreserve:
307 amdgpu_bo_unreserve(vm->root.bo);
308 return 0;
309
310 out_err_unreserve:
311 amdgpu_bo_unreserve(vm->root.bo);
312 out_err_release:
313 kfd_queue_release_buffers(pdd, properties);
314 return err;
315 }
Fixes: 629568d25fea ("drm/amdkfd: Validate queue cwsr area and eop buffer siz
[PATCH] drm/amd/display: Handle null 'stream_status' in 'planes_changed_for_existing_stream'
This commit adds a null check for 'stream_status' in the function
'planes_changed_for_existing_stream'. Previously, the code assumed
'stream_status' could be null, but did not handle the case where it was
actually null. This could lead to a null pointer dereference.
Reported by smatch:
drivers/gpu/drm/amd/amdgpu/../display/dc/core/dc_resource.c:3784
planes_changed_for_existing_stream() error: we previously assumed
'stream_status' could be null (see line 3774)
Cc: Tom Chung
Cc: Rodrigo Siqueira
Cc: Roman Li
Cc: Alex Hung
Cc: Aurabindo Pillai
Cc: Harry Wentland
Cc: Hamza Mahfooz
Signed-off-by: Srinivasan Shanmugam
---
drivers/gpu/drm/amd/display/dc/core/dc_resource.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
diff --git a/drivers/gpu/drm/amd/display/dc/core/dc_resource.c
b/drivers/gpu/drm/amd/display/dc/core/dc_resource.c
index 5c9091f2a8b2..60d34c696b18 100644
--- a/drivers/gpu/drm/amd/display/dc/core/dc_resource.c
+++ b/drivers/gpu/drm/amd/display/dc/core/dc_resource.c
@@ -3771,8 +3771,10 @@ static bool planes_changed_for_existing_stream(struct
dc_state *context,
}
}
- if (!stream_status)
+ if (!stream_status) {
ASSERT(0);
+ return false;
+ }
for (i = 0; i < set_count; i++)
if (set[i].stream == stream)
--
2.34.1
[PATCH] drm/amd/display: Align 'dpp401_dscl_program_isharp' with actual function parameters
This commit corrects the function comment for 'dpp401_dscl_program_isharp' in 'dcn401_dpp_dscl.c'. The comment previously included a description for a non-existent parameter 'bs_coeffs_updated'. This parameter description has been removed to reflect the function's actual parameters. Fixes the below with gcc W=1: drivers/gpu/drm/amd/amdgpu/../display/dc/dpp/dcn401/dcn401_dpp_dscl.c:981: warning: Excess function parameter 'bs_coeffs_updated' description in 'dpp401_dscl_program_isharp' Cc: Tom Chung Cc: Rodrigo Siqueira Cc: Roman Li Cc: Alex Hung Cc: Aurabindo Pillai Cc: Harry Wentland Cc: Hamza Mahfooz Signed-off-by: Srinivasan Shanmugam --- drivers/gpu/drm/amd/display/dc/dpp/dcn401/dcn401_dpp_dscl.c | 1 - 1 file changed, 1 deletion(-) diff --git a/drivers/gpu/drm/amd/display/dc/dpp/dcn401/dcn401_dpp_dscl.c b/drivers/gpu/drm/amd/display/dc/dpp/dcn401/dcn401_dpp_dscl.c index 88d24e36fe00..505929800426 100644 --- a/drivers/gpu/drm/amd/display/dc/dpp/dcn401/dcn401_dpp_dscl.c +++ b/drivers/gpu/drm/amd/display/dc/dpp/dcn401/dcn401_dpp_dscl.c @@ -971,7 +971,6 @@ static void dpp401_dscl_set_isharp_filter( * * @dpp_base: High level DPP struct * @scl_data: scalaer_data info - * @bs_coeffs_updated: coeffs update flag * * This is the primary function to program isharp * -- 2.34.1
[PATCH 1/3] drm/amd/display: Add NULL check for function pointer in dcn20_set_output_transfer_func
This commit adds a null check for the set_output_gamma function pointer in the dcn20_set_output_transfer_func function. Previously, set_output_gamma was being checked for null at line 1030, but then it was being dereferenced without any null check at line 1048. This could potentially lead to a null pointer dereference error if set_output_gamma is null. To fix this, we now ensure that set_output_gamma is not null before dereferencing it. We do this by adding a null check for set_output_gamma before the call to set_output_gamma at line 1048. Cc: Tom Chung Cc: Rodrigo Siqueira Cc: Roman Li Cc: Alex Hung Cc: Aurabindo Pillai Cc: Harry Wentland Cc: Hamza Mahfooz Signed-off-by: Srinivasan Shanmugam --- drivers/gpu/drm/amd/display/dc/hwss/dcn20/dcn20_hwseq.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/drivers/gpu/drm/amd/display/dc/hwss/dcn20/dcn20_hwseq.c b/drivers/gpu/drm/amd/display/dc/hwss/dcn20/dcn20_hwseq.c index 5a6064999033..425432ca497f 100644 --- a/drivers/gpu/drm/amd/display/dc/hwss/dcn20/dcn20_hwseq.c +++ b/drivers/gpu/drm/amd/display/dc/hwss/dcn20/dcn20_hwseq.c @@ -1045,7 +1045,8 @@ bool dcn20_set_output_transfer_func(struct dc *dc, struct pipe_ctx *pipe_ctx, /* * if above if is not executed then 'params' equal to 0 and set in bypass */ - mpc->funcs->set_output_gamma(mpc, mpcc_id, params); + if (mpc->funcs->set_output_gamma) + mpc->funcs->set_output_gamma(mpc, mpcc_id, params); return true; } -- 2.34.1
[PATCH 3/3] drm/amd/display: Add NULL check for function pointer in dcn401_set_output_transfer_func
This commit adds a null check for the set_output_gamma function pointer in the dcn401_set_output_transfer_func function. Previously, set_output_gamma was being checked for null, but then it was being dereferenced without any null check. This could lead to a null pointer dereference if set_output_gamma is null. To fix this, we now ensure that set_output_gamma is not null before dereferencing it. We do this by adding a null check for set_output_gamma before the call to set_output_gamma. Cc: Tom Chung Cc: Rodrigo Siqueira Cc: Roman Li Cc: Alex Hung Cc: Aurabindo Pillai Cc: Harry Wentland Cc: Hamza Mahfooz Signed-off-by: Srinivasan Shanmugam --- drivers/gpu/drm/amd/display/dc/hwss/dcn401/dcn401_hwseq.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/drivers/gpu/drm/amd/display/dc/hwss/dcn401/dcn401_hwseq.c b/drivers/gpu/drm/amd/display/dc/hwss/dcn401/dcn401_hwseq.c index ceaaa8df3641..77489bbcda02 100644 --- a/drivers/gpu/drm/amd/display/dc/hwss/dcn401/dcn401_hwseq.c +++ b/drivers/gpu/drm/amd/display/dc/hwss/dcn401/dcn401_hwseq.c @@ -743,7 +743,9 @@ bool dcn401_set_output_transfer_func(struct dc *dc, } } - mpc->funcs->set_output_gamma(mpc, mpcc_id, params); + if (mpc->funcs->set_output_gamma) + mpc->funcs->set_output_gamma(mpc, mpcc_id, params); + return ret; } -- 2.34.1
[PATCH 2/3] drm/amd/display: Add NULL check for function pointer in dcn32_set_output_transfer_func
This commit adds a null check for the set_output_gamma function pointer in the dcn32_set_output_transfer_func function. Previously, set_output_gamma was being checked for null, but then it was being dereferenced without any null check. This could lead to a null pointer dereference if set_output_gamma is null. To fix this, we now ensure that set_output_gamma is not null before dereferencing it. We do this by adding a null check for set_output_gamma before the call to set_output_gamma. Cc: Tom Chung Cc: Rodrigo Siqueira Cc: Roman Li Cc: Alex Hung Cc: Aurabindo Pillai Cc: Harry Wentland Cc: Hamza Mahfooz Signed-off-by: Srinivasan Shanmugam --- drivers/gpu/drm/amd/display/dc/hwss/dcn32/dcn32_hwseq.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/drivers/gpu/drm/amd/display/dc/hwss/dcn32/dcn32_hwseq.c b/drivers/gpu/drm/amd/display/dc/hwss/dcn32/dcn32_hwseq.c index fcaabad204a2..c3bbbfd1be94 100644 --- a/drivers/gpu/drm/amd/display/dc/hwss/dcn32/dcn32_hwseq.c +++ b/drivers/gpu/drm/amd/display/dc/hwss/dcn32/dcn32_hwseq.c @@ -582,7 +582,9 @@ bool dcn32_set_output_transfer_func(struct dc *dc, } } - mpc->funcs->set_output_gamma(mpc, mpcc_id, params); + if (mpc->funcs->set_output_gamma) + mpc->funcs->set_output_gamma(mpc, mpcc_id, params); + return ret; } -- 2.34.1
[PATCH v2 1/2] drm/amd/display: Add null check for 'afb' in amdgpu_dm_update_cursor (v2)
This commit adds a null check for the 'afb' variable in the
amdgpu_dm_update_cursor function. Previously, 'afb' was assumed to be
null at line 8388, but was used later in the code without a null check.
This could potentially lead to a null pointer dereference.
Changes since v1:
- Moved the null check for 'afb' to the line where 'afb' is used. (Alex)
Fixes the below:
drivers/gpu/drm/amd/amdgpu/../display/amdgpu_dm/amdgpu_dm.c:8433
amdgpu_dm_update_cursor()
error: we previously assumed 'afb' could be null (see line 8388)
Cc: Tom Chung
Cc: Rodrigo Siqueira
Cc: Roman Li
Cc: Alex Hung
Cc: Aurabindo Pillai
Cc: Harry Wentland
Co-developed-by: Alex Hung
Signed-off-by: Alex Hung
Signed-off-by: Srinivasan Shanmugam
---
drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
index 293f93d1976c..0fe043df643d 100644
--- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
+++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
@@ -8697,7 +8697,8 @@ static void amdgpu_dm_update_cursor(struct drm_plane
*plane,
adev->dm.dc->caps.color.dpp.gamma_corr)
attributes.attribute_flags.bits.ENABLE_CURSOR_DEGAMMA = 1;
- attributes.pitch = afb->base.pitches[0] / afb->base.format->cpp[0];
+ if (afb)
+ attributes.pitch = afb->base.pitches[0] /
afb->base.format->cpp[0];
if (crtc_state->stream) {
if (!dc_stream_set_cursor_attributes(crtc_state->stream,
--
2.34.1
