Commit 9d78f025 authored by Rob Clark's avatar Rob Clark
Browse files

drm/msm/a6xx+: Don't let IB_SIZE overflow 



IB_SIZE is only b0..b19.  Starting with a6xx gen3, additional fields
were added above the IB_SIZE.  Accidentially setting them can cause
badness.  Fix this by properly defining the CP_INDIRECT_BUFFER packet
and using the generated builder macro to ensure unintended bits are not
set.

v2: add missing type attribute for IB_BASE
v3: fix offset attribute in xml

Reported-by: default avatarConnor Abbott <cwabbott0@gmail.com>
Fixes: a83366ef ("drm/msm/a6xx: add A640/A650 to gpulist")
Signed-off-by: default avatarRob Clark <robdclark@chromium.org>
Patchwork: https://patchwork.freedesktop.org/patch/643396/
parent ddfa00af

drivers/gpu/drm/msm/adreno/a6xx_gpu.c

+4 −4
Original line number Diff line number Diff line
@@ -242,10 +242,10 @@ static void a6xx_submit(struct msm_gpu *gpu, struct msm_gem_submit *submit) 
				break;

			fallthrough;

		case MSM_SUBMIT_CMD_BUF:

			OUT_PKT7(ring, CP_INDIRECT_BUFFER_PFE, 3);

			OUT_PKT7(ring, CP_INDIRECT_BUFFER, 3);

			OUT_RING(ring, lower_32_bits(submit->cmd[i].iova));

			OUT_RING(ring, upper_32_bits(submit->cmd[i].iova));

			OUT_RING(ring, submit->cmd[i].size);

			OUT_RING(ring, A5XX_CP_INDIRECT_BUFFER_2_IB_SIZE(submit->cmd[i].size));

			ibs++;

			break;

		}
@@ -377,10 +377,10 @@ static void a7xx_submit(struct msm_gpu *gpu, struct msm_gem_submit *submit) 
				break;

			fallthrough;

		case MSM_SUBMIT_CMD_BUF:

			OUT_PKT7(ring, CP_INDIRECT_BUFFER_PFE, 3);

			OUT_PKT7(ring, CP_INDIRECT_BUFFER, 3);

			OUT_RING(ring, lower_32_bits(submit->cmd[i].iova));

			OUT_RING(ring, upper_32_bits(submit->cmd[i].iova));

			OUT_RING(ring, submit->cmd[i].size);

			OUT_RING(ring, A5XX_CP_INDIRECT_BUFFER_2_IB_SIZE(submit->cmd[i].size));

			ibs++;

			break;

		}

drivers/gpu/drm/msm/registers/adreno/adreno_pm4.xml

+7 −0
Original line number Diff line number Diff line
@@ -2259,5 +2259,12 @@ opcode: CP_LOAD_STATE4 (30) (4 dwords) 
	</reg32>

</domain>



<domain name="CP_INDIRECT_BUFFER" width="32" varset="chip" prefix="chip" variants="A5XX-">

	<reg64 offset="0" name="IB_BASE" type="address"/>

	<reg32 offset="2" name="2">

		<bitfield name="IB_SIZE" low="0" high="19"/>

	</reg32>

</domain>



</database>