From: Alyssa Rosenzweig <alyssa@collabora.com>
To: Steven Price <steven.price@arm.com>
Cc: Alyssa Rosenzweig <alyssa.rosenzweig@collabora.com>,
dri-devel@lists.freedesktop.org, Rob Herring <robh@kernel.org>,
Tomeu Vizoso <tomeu.vizoso@collabora.com>,
David Airlie <airlied@linux.ie>, Daniel Vetter <daniel@ffwll.ch>,
linux-kernel@vger.kernel.org,
Chris Morgan <macromorgan@hotmail.com>,
stable@vger.kernel.org
Subject: Re: [PATCH 1/3] drm/panfrost: Simplify lock_region calculation
Date: Mon, 23 Aug 2021 17:09:08 -0400 [thread overview]
Message-ID: <YSQOdDyLqiUccBq8@maud> (raw)
In-Reply-To: <192e5a1b-2caf-11a8-f090-ec5649ea16b5@arm.com>
[-- Warning: decoded text below may be mangled, UTF-8 assumed --]
[-- Attachment #1: Type: text/plain; charset=unknown-8bit, Size: 1855 bytes --]
> > In lock_region, simplify the calculation of the region_width parameter.
> > This field is the size, but encoded as log2(ceil(size)) - 1.
> > log2(ceil(size)) may be computed directly as fls(size - 1). However, we
> > want to use the 64-bit versions as the amount to lock can exceed
> > 32-bits.
> >
> > This avoids undefined behaviour when locking all memory (size ~0),
> > caught by UBSAN.
>
> It might have been useful to mention what it is that UBSAN specifically
> picked up (it took me a while to spot) - but anyway I think there's a
> bigger issue with it being completely wrong when size == ~0 (see below).
Indeed. I've updated the commit message in v2 to explain what goes
wrong (your analysis was spot on, but a mailing list message is more
ephermal than a commit message). I'll send out v2 tomorrow assuming
nobody objects to v1 in the mean time.
Thanks for the review.
> There is potentially a third bug which kbase only recently attempted to
> fix. The lock address is effectively rounded down by the hardware (the
> bottom bits are ignored). So if you have mask=(1<<region_width)-1 but
> (iova & mask) != ((iova + size) & mask) then you are potentially failing
> to lock the end of the intended region. kbase has added some code to
> handle this:
>
> > /* Round up if some memory pages spill into the next region. */
> > region_frame_number_start = pfn >> (lockaddr_size_log2 - PAGE_SHIFT);
> > region_frame_number_end =
> > (pfn + num_pages - 1) >> (lockaddr_size_log2 - PAGE_SHIFT);
> >
> > if (region_frame_number_start < region_frame_number_end)
> > lockaddr_size_log2 += 1;
>
> I guess we should too?
Oh, I missed this one. Guess we have 4 bugs with this code instead of
just 3, yikes. How could such a short function be so deeply and horribly
broken? 😃
Should I add a fourth patch to the series to fix this?
next prev parent reply other threads:[~2021-08-23 21:09 UTC|newest]
Thread overview: 13+ messages / expand[flat|nested] mbox.gz Atom feed top
2021-08-20 21:31 [PATCH 0/3] drm/panfrost: Bug fixes for lock_region Alyssa Rosenzweig
2021-08-20 21:31 ` [PATCH 1/3] drm/panfrost: Simplify lock_region calculation Alyssa Rosenzweig
2021-08-23 9:40 ` Steven Price
2021-08-23 21:09 ` Alyssa Rosenzweig [this message]
2021-08-23 21:54 ` Steven Price
2021-08-20 21:31 ` [PATCH 2/3] drm/panfrost: Use u64 for size in lock_region Alyssa Rosenzweig
2021-08-23 9:40 ` Steven Price
2021-08-23 21:11 ` Alyssa Rosenzweig
2021-08-23 21:57 ` Steven Price
2021-08-20 21:31 ` [PATCH 3/3] drm/panfrost: Clamp lock region to Bifrost minimum Alyssa Rosenzweig
2021-08-23 9:40 ` Steven Price
2021-08-23 21:13 ` Alyssa Rosenzweig
2021-08-23 22:02 ` Steven Price
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=YSQOdDyLqiUccBq8@maud \
--to=alyssa@collabora.com \
--cc=airlied@linux.ie \
--cc=alyssa.rosenzweig@collabora.com \
--cc=daniel@ffwll.ch \
--cc=dri-devel@lists.freedesktop.org \
--cc=linux-kernel@vger.kernel.org \
--cc=macromorgan@hotmail.com \
--cc=robh@kernel.org \
--cc=stable@vger.kernel.org \
--cc=steven.price@arm.com \
--cc=tomeu.vizoso@collabora.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.