- 26 Apr, 2024 40 commits
-
-
Alex Hung authored
[WHY] resource_stream_to_stream_idx returns an array index and it return -1 when not found; however, -1 is not a valid array index number. [HOW] When this happens, call ASSERT(), and return a zero instead. This fixes an OVERRUN and an NEGATIVE_RETURNS issues reported by Coverity. Reviewed-by:
Rodrigo Siqueira <rodrigo.siqueira@amd.com> Acked-by:
Wayne Lin <wayne.lin@amd.com> Signed-off-by:
Alex Hung <alex.hung@amd.com> Signed-off-by:
Alex Deucher <alexander.deucher@amd.com>
-
Hersen Wu authored
[WHY] &mode_lib->mp.Watermark and &locals->Watermark are the same address. memcpy may lead to unexpected behavior. [HOW] memmove should be used. Reviewed-by:
Hersen Wu <hersenxs.wu@amd.com> Signed-off-by:
-
Alex Hung authored
[WHY] ENGINE_ID_UNKNOWN = -1 and can not be used as an array index. Plus, it also means it is uninitialized and does not need free audio. [HOW] Skip and return NULL. This fixes 2 OVERRUN issues reported by Coverity. Reviewed-by:
-
Alex Hung authored
pipe_ctx has a size of MAX_PIPES so checking its index before accessing the array. This fixes an OVERRUN issue reported by Coverity. Reviewed-by:
-
Lancelot SIX authored
There are new control registers introduced in gfx10 used to configure hardware watchpoints triggered by SMEM instructions: SQ_WATCH{0,1,2,3}_{CNTL_ADDR_HI,ADDR_L}. Those registers work in a similar way as the TCP_WATCH* registers currently used for gfx9 and above. This patch adds support to program the SQ_WATCH registers for gfx10. The SQ_WATCH?_CNTL.MASK field has one bit more than TCP_WATCH?_CNTL.MASK, so SQ watchpoints can have a finer granularity than TCP_WATCH watchpoints. In this patch, we keep the capabilities advertised to the debugger unchanged (HSA_DBG_WATCH_ADDR_MASK_*_BIT_GFX10) as this reflects what both TCP and SQ watchpoints can do and both watchpoints are configured together. Signed-off-by:Lancelot SIX <lancelot.six@amd.com> Reviewed-by:
Jonathan Kim <jonathan.kim@amd.com> Signed-off-by:
-
Alex Hung authored
[WHAT] msg_id is used as an array index and it cannot be a negative value, and therefore cannot be equal to MOD_HDCP_MESSAGE_ID_INVALID (-1). [HOW] Check whether msg_id is valid before reading and setting. This fixes 4 OVERRUN issues reported by Coverity. Reviewed-by:
-
Srinivasan Shanmugam authored
The function gfx_v9_4_3_init_microcode in gfx_v9_4_3.c was generating about potential truncation of output when using the snprintf function. The issue was due to the size of the buffer 'ucode_prefix' being too small to accommodate the maximum possible length of the string being written into it. The string being written is "amdgpu/%s_mec.bin" or "amdgpu/%s_rlc.bin", where %s is replaced by the value of 'chip_name'. The length of this string without the %s is 16 characters. The warning message indicated that 'chip_name' could be up to 29 characters long, resulting in a total of 45 characters, which exceeds the buffer size of 30 characters. To resolve this issue, the size of the 'ucode_prefix' buffer has been reduced from 30 to 15. This ensures that the maximum possible length of the string being written into the buffer will not exceed its size, thus preventing potential buffer overflow and truncation issues. Fixes the below with gcc W=1: drivers/gpu/drm/amd/amdgpu/gfx_v9_4_3.c: In function ‘gfx_v9_4_3_early_init’: drivers/gpu/drm/amd/amdgpu/gfx_v9_4_3.c:379:52: warning: ‘%s’ directive output may be truncated writing up to 29 bytes into a region of size 23 [-Wformat-truncation=] 379 | snprintf(fw_name, sizeof(fw_name), "amdgpu/%s_rlc.bin", chip_name); | ^~ ...... 439 | r = gfx_v9_4_3_init_rlc_microcode(adev, ucode_prefix); | ~~~~~~~~~~~~ drivers/gpu/drm/amd/amdgpu/gfx_v9_4_3.c:379:9: note: ‘snprintf’ output between 16 and 45 bytes into a destination of size 30 379 | snprintf(fw_name, sizeof(fw_name), "amdgpu/%s_rlc.bin", chip_name); | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ drivers/gpu/drm/amd/amdgpu/gfx_v9_4_3.c:413:52: warning: ‘%s’ directive output may be truncated writing up to 29 bytes into a region of size 23 [-Wformat-truncation=] 413 | snprintf(fw_name, sizeof(fw_name), "amdgpu/%s_mec.bin", chip_name); | ^~ ...... 443 | r = gfx_v9_4_3_init_cp_compute_microcode(adev, ucode_prefix); | ~~~~~~~~~~~~ drivers/gpu/drm/amd/amdgpu/gfx_v9_4_3.c:413:9: note: ‘snprintf’ output between 16 and 45 bytes into a destination of size 30 413 | snprintf(fw_name, sizeof(fw_name), "amdgpu/%s_mec.bin", chip_name); | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Fixes: 86301129 ("drm/amdgpu: split gc v9_4_3 functionality from gc v9_0") Cc: Hawking Zhang <Hawking.Zhang@amd.com> Cc: Christian König <christian.koenig@amd.com> Cc: Alex Deucher <alexander.deucher@amd.com> Cc: Lijo Lazar <lijo.lazar@amd.com> Signed-off-by:Srinivasan Shanmugam <srinivasan.shanmugam@amd.com> Suggested-by:
Lijo Lazar <lijo.lazar@amd.com> Reviewed-by:
-
Hersen Wu authored
[Why & How] Check return pointer of kzalloc before using it. Reviewed-by:
-
George Shen authored
Theoretically rare corner case where ceil(Y) results in rounding up to an integer. If this happens, the 1 should be carried over to the X value. CC: stable@vger.kernel.org Reviewed-by:
George Shen <george.shen@amd.com> Tested-by:
Daniel Wheeler <daniel.wheeler@amd.com> Signed-off-by:
-
YiPeng Chai authored
Fix ras mode2 reset failure in ras aca mode. Signed-off-by:
YiPeng Chai <YiPeng.Chai@amd.com> Reviewed-by:
Yang Wang <kevinyang.wang@amd.com> Signed-off-by:
-
Bob Zhou authored
In amdgpu_umc_bad_page_polling_timeout, the amdgpu_umc_handle_bad_pages will be run many times so that double free err_addr in some special case. So set the err_addr to NULL to avoid the warnings. Signed-off-by:
Bob Zhou <bob.zhou@amd.com> Acked-by:
-
Jesse Zhang authored
The parameter "last_jump_jiffies" should be initialized before being used in the function atom_op_jump. Signed-off-by:
Jesse Zhang <jesse.zhang@amd.com> Reviewed-by:
-
Jesse Zhang authored
Check if ring is not a mes queue before freeing the wb entry, because we only allocate a wb entry when it's not a mes queue. Signed-off-by:
-
Bob Zhou authored
After amdgpu_i2c_get_byte fail, amdgpu_i2c_put_byte shouldn't be conducted to put wrong value. So return and check the i2c transfer result. Signed-off-by:
Christian König <christian.koenig@amd.com> Signed-off-by:
-
Bob Zhou authored
if the sdma_v4_0_irq_id_to_seq return -EINVAL, the process should be stop to avoid out-of-bounds read, so directly return -EINVAL. Signed-off-by:
Le Ma <le.ma@amd.com> Signed-off-by:
-
Ma Jun authored
Initialize the interrupt timestamp for some legacy SOCs to fix the coverity issue "Uninitialized scalar variable" Signed-off-by:
Ma Jun <Jun.Ma2@amd.com> Suggested-by:
-
YiPeng Chai authored
Use new interface to reserve bad page. Signed-off-by:
Tao Zhou <tao.zhou1@amd.com> Signed-off-by:
-
YiPeng Chai authored
retired_page is page frame and should be expanded to the full address when querying status. Signed-off-by:
-
Harish Kasiviswanathan authored
Queue buffer, though it is in system memory, has to be created using the correct amdgpu device. Enforce this as the BO needs to mapped to the GART for MES Hardware scheduler to access it. Signed-off-by:
Harish Kasiviswanathan <Harish.Kasiviswanathan@amd.com> Reviewed-by:
Felix Kuehling <felix.kuehling@amd.com> Reviewed-by:
-
Dmytro Laktyushkin authored
Headless dp 2.0 will take longer to update. Reviewed-by:
Dmytro Laktyushkin <Dmytro.Laktyushkin@amd.com> Tested-by:
-
Rodrigo Siqueira authored
This commit add some missing HDMI control registers to DCN3x. Signed-off-by:
Aurabindo Pillai <aurabindo.pillai@amd.com> Tested-by:
-
YiPeng Chai authored
support ACA logging ecc errors. Signed-off-by:
-
YiPeng Chai authored
Add poison consumption handler. Signed-off-by:
-
YiPeng Chai authored
Prepare to handle pasid poison consumption. Signed-off-by:
-
YiPeng Chai authored
Retire bad pages for umc v12_0. Signed-off-by:
-
YiPeng Chai authored
Add condition check for amdgpu_umc_fill_error_record. Signed-off-by:
-
YiPeng Chai authored
Add delay work to retire bad pages. Signed-off-by:
-
YiPeng Chai authored
1. umc v12_0 logs ecc errors. 2. Reserve newly detected ecc error pages. 3. Add tag for bad pages, so that they can be retired later. Signed-off-by:
-
YiPeng Chai authored
Umc v12_0 converts error address. Signed-off-by:
-
YiPeng Chai authored
Add interface to update umc v12_0 ecc status. Signed-off-by:
-
YiPeng Chai authored
Add poison creation handler. Signed-off-by:
-
YiPeng Chai authored
Prepare for logging ecc errors. Signed-off-by:
-
YiPeng Chai authored
Add message fifo to handle RAS poison events. Signed-off-by:
-
Jesse Zhang authored
Initialize the size before calling amdgpu_vce_cs_reloc, such as case 0x03000001. V2: To really improve the handling we would actually need to have a separate value of 0xffffffff.(Christian) Signed-off-by:
-
Rodrigo Siqueira authored
Add TMDS balancer control to the list of available encoder registers for DCN 30. Signed-off-by:
-
Srinivasan Shanmugam authored
This commit removes an unnecessary NULL check in the `dcn20_set_input_transfer_func` function in the `dcn20_hwseq.c` file. The variable `tf` is assigned the address of `plane_state->in_transfer_func` unconditionally, so it can never be `NULL`. Therefore, the check `if (tf == NULL)` is unnecessary and has been removed. The plane_state->in_transfer_func itself cannot be NULL because it's a structure, not a pointer. When we do tf = &plane_state->in_transfer_func;, we're getting the address of that structure, which will always be valid as long as plane_state itself is not NULL. we've already checked if plane_state is NULL with the line if (dpp_base == NULL || plane_state == NULL) return false;. So, if the code execution gets to the point where tf = &plane_state->in_transfer_func; is called, plane_state is guaranteed to be not NULL, and therefore tf will also not be NULL. drivers/gpu/drm/amd/amdgpu/../display/dc/hwss/dcn20/dcn20_hwseq.c 1094 bool dcn20_set_input_transfer_func(struct dc *dc, 1095 struct pipe_ctx *pipe_ctx, 1096 const struct dc_plane_state *plane_state) 1097 { 1098 struct dce_hwseq *hws = dc->hwseq; 1099 struct dpp *dpp_base = pipe_ctx->plane_res.dpp; 1100 const struct dc_transfer_func *tf = NULL; ^^^^^^^^^ This assignment is not necessary now. 1101 bool result = true; 1102 bool use_degamma_ram = false; 1103 1104 if (dpp_base == NULL || plane_state == NULL) 1105 return false; 1106 1107 hws->funcs.set_shaper_3dlut(pipe_ctx, plane_state); 1108 hws->funcs.set_blend_lut(pipe_ctx, plane_state); 1109 1110 tf = &plane_state->in_transfer_func; ^^^^^ Before there was an if statement but now tf is assigned unconditionally 1111 --> 1112 if (tf == NULL) { ^^^^^^^^^^^^^^^^^ so these conditions are impossible. 1113 dpp_base->funcs->dpp_set_degamma(dpp_base, 1114 IPP_DEGAMMA_MODE_BYPASS); 1115 return true; 1116 } 1117 1118 if (tf->type == TF_TYPE_HWPWL || tf->type == TF_TYPE_DISTRIBUTED_POINTS) 1119 use_degamma_ram = true; 1120 1121 if (use_degamma_ram == true) { 1122 if (tf->type == TF_TYPE_HWPWL) 1123 dpp_base->funcs->dpp_program_degamma_pwl(dpp_base, Fixes the below Smatch static checker warning: drivers/gpu/drm/amd/amdgpu/../display/dc/hwss/dcn20/dcn20_hwseq.c:1112 dcn20_set_input_transfer_func() warn: address of 'plane_state->in_transfer_func' is non-NULL Fixes: 285a7054 ("drm/amd/display: Remove plane and stream pointers from dc scratch") Cc: Wenjing Liu <wenjing.liu@amd.com> Cc: Tom Chung <chiahsuan.chung@amd.com> Cc: Alvin Lee <alvin.lee2@amd.com> Cc: Rodrigo Siqueira <Rodrigo.Siqueira@amd.com> Cc: Roman Li <roman.li@amd.com> Cc: Qingqing Zhuo <Qingqing.Zhuo@amd.com> Cc: Aurabindo Pillai <aurabindo.pillai@amd.com> Cc: Harry Wentland <harry.wentland@amd.com> Suggested-by:Dan Carpenter <dan.carpenter@linaro.org> Signed-off-by:
Harry Wentland <harry.wentland@amd.com> Signed-off-by:
-
Alex Deucher authored
We can't use a shared fence location because each transaction should be considered independently. Reviewed-by:
Shaoyun.liu <shaoyunl@amd.com> Signed-off-by:
-
Rodrigo Siqueira authored
DCN3.0 supports some specific DWB debug registers that are not exposed yet. This commit just adds the missing registers. Signed-off-by:
-
Melissa Wen authored
According to [1]: ``` DTN only logs 'pipe_count' instances of MPCC. However in some cases there are different number of MPCC than DPP (pipe_count). ``` As DTN log still relies on pipe_count to print mpcc state, switch to mpcc_count in all occurrences. [1] https://lore.kernel.org/amd-gfx/20240328195047.2843715-39-Roman.Li@amd.com/Reviewed-by:
Melissa Wen <mwen@igalia.com> Signed-off-by:
-
Alex Deucher authored
As we use wb slots more dynamically, we need to lock access to avoid racing on allocation or free. Reviewed-by:
-
