Re: [PATCH RFC v2 05/14] firmware: qcom: scm: Configure LPAC aperture

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 2 potential issue(s) to consider:
- [High] drm/msm/adreno: missing lpac_pdev check in adreno_hw_init()
- [Low] firmware: qcom: scm: broken mask macro and unmasked context_bank argument
--

commit ea6cfd100e49bc2229349870a3f6d5f6dfcedd94
Author: Anna Maniscalco <anna.maniscalco2000@gmail.com>

firmware: qcom: scm: Configure LPAC aperture

This commit adds qcom_scm_set_gpu_smmu_lpac_aperture() to configure the
SMMU LPAC aperture via SCM and calls it from adreno_hw_init() when
ADRENO_QUIRK_LPAC is set.

> diff --git a/drivers/firmware/qcom/qcom_scm.c b/drivers/firmware/qcom/qcom_scm.c
> index 9b06a69d3a6d7..92093399f20d9 100644
> --- a/drivers/firmware/qcom/qcom_scm.c
> +++ b/drivers/firmware/qcom/qcom_scm.c
> @@ -1204,6 +1204,7 @@ int qcom_scm_restore_sec_cfg(u32 device_id, u32 spare)
>  EXPORT_SYMBOL_GPL(qcom_scm_restore_sec_cfg);
>  
>  #define QCOM_SCM_CP_APERTURE_CONTEXT_MASK	GENMASK(7, 0)
> +#define QCOM_SCM_LPAC_APERTURE_CONTEXT_MASK	GENMASK(7, 1)
>  
>  bool qcom_scm_set_gpu_smmu_aperture_is_available(void)
>  {
> @@ -1229,6 +1230,23 @@ int qcom_scm_set_gpu_smmu_aperture(unsigned int context_bank)
>  }
>  EXPORT_SYMBOL_GPL(qcom_scm_set_gpu_smmu_aperture);
>  
> +int qcom_scm_set_gpu_smmu_lpac_aperture(unsigned int context_bank)
> +{
> +	struct qcom_scm_desc desc = {
> +		.svc = QCOM_SCM_SVC_MP,
> +		.cmd = QCOM_SCM_MP_CP_SMMU_APERTURE_ID,
> +		.arginfo = QCOM_SCM_ARGS(4),
> +		.args[0] = 0xffff0000 | (1 << 8 | context_bank),
> +		.args[1] = 0xffffffff,
> +		.args[2] = 0xffffffff,
> +		.args[3] = 0xffffffff,
> +		.owner = ARM_SMCCC_OWNER_SIP
> +	};
> +
> +	return qcom_scm_call(__scm->dev, &desc, NULL);
> +}
> +EXPORT_SYMBOL_GPL(qcom_scm_set_gpu_smmu_lpac_aperture);

[Severity: Low]
Should QCOM_SCM_LPAC_APERTURE_CONTEXT_MASK be dropped or defined as BIT(8),
and should context_bank be masked with FIELD_PREP() in
qcom_scm_set_gpu_smmu_lpac_aperture()?

Currently QCOM_SCM_LPAC_APERTURE_CONTEXT_MASK is defined as GENMASK(7, 1)
and never used, while qcom_scm_set_gpu_smmu_aperture() masks context_bank
into bits 7:0:

drivers/firmware/qcom/qcom_scm.c:qcom_scm_set_gpu_smmu_aperture() {
	...
	.args[0] = 0xffff0000 | FIELD_PREP(QCOM_SCM_CP_APERTURE_CONTEXT_MASK, context_bank),
	...
}

In qcom_scm_set_gpu_smmu_lpac_aperture(), ORing an unmasked context_bank
with (1 << 8) could clobber bit 8 or upper bits of args[0] if a caller
passes a value larger than 0xff.

> diff --git a/drivers/gpu/drm/msm/adreno/adreno_gpu.c b/drivers/gpu/drm/msm/adreno/adreno_gpu.c
> index 1dedeb19946ec..65d34d0cfc380 100644
> --- a/drivers/gpu/drm/msm/adreno/adreno_gpu.c
> +++ b/drivers/gpu/drm/msm/adreno/adreno_gpu.c
> @@ -658,6 +658,7 @@ struct drm_gem_object *adreno_fw_create_bo(struct msm_gpu *gpu,
>  int adreno_hw_init(struct msm_gpu *gpu)
>  {
>  	struct adreno_gpu *adreno_gpu = to_adreno_gpu(gpu);
> +	const struct adreno_info *info = adreno_gpu->info;
>  	int ret;
>  
>  	VERB("%s", gpu->name);
> @@ -668,6 +669,11 @@ int adreno_hw_init(struct msm_gpu *gpu)
>  		ret = qcom_scm_set_gpu_smmu_aperture(0);
>  		if (ret)
>  			DRM_DEV_ERROR(gpu->dev->dev, "unable to set SMMU aperture: %d\n", ret);
> +		if (info->quirks & ADRENO_QUIRK_LPAC) {
> +			ret = qcom_scm_set_gpu_smmu_lpac_aperture(1);
> +			if (ret)
> +				DRM_DEV_ERROR(gpu->dev->dev, "unable to set lpac SMMU aperture: %d\n", ret);
> +		}
>  	}

[Severity: High]
Does adreno_hw_init() also need to check gpu->lpac_pdev before calling
qcom_scm_set_gpu_smmu_lpac_aperture(1)?

In adreno_gpu_init(), gpu->lpac_pdev is only populated when the device tree
contains a qcom,lpac child node:

drivers/gpu/drm/msm/adreno/adreno_gpu.c:adreno_gpu_init() {
	...
	lpac_node = of_get_compatible_child(pdev->dev.of_node, "qcom,lpac");
	if (lpac_node)
		gpu->lpac_pdev = of_find_device_by_node(lpac_node);
	...
}

And adreno_iommu_create_vm() only creates the separate LPAC IOMMU domain
(which allocates SMMU context bank 1) when gpu->lpac_pdev is non-NULL:

drivers/gpu/drm/msm/adreno/adreno_gpu.c:adreno_iommu_create_vm() {
	...
	mmu = msm_iommu_gpu_new(&pdev->dev,
				gpu->lpac_pdev ? &gpu->lpac_pdev->dev : NULL,
				gpu, quirks);
	...
}

When booting a GPU with ADRENO_QUIRK_LPAC on an existing DTB that does not
have the qcom,lpac child node, gpu->lpac_pdev is NULL and context bank 1 is
never allocated. Won't calling qcom_scm_set_gpu_smmu_lpac_aperture(1)
unconditionally on ADRENO_QUIRK_LPAC configure the LPAC aperture to an
unallocated context bank?

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20261029-descriptive-name-lpac-upstream-v2-0-a21a5c850961@gmail.com?part=5