* [PATCH v2] drm/msm/a6xx+: Don't let IB_SIZE overflow
@ 2025-03-14 18:34 Rob Clark
2025-03-14 20:07 ` Akhil P Oommen
0 siblings, 1 reply; 3+ messages in thread
From: Rob Clark @ 2025-03-14 18:34 UTC (permalink / raw)
To: dri-devel
Cc: linux-arm-msm, freedreno, Rob Clark, Connor Abbott, Rob Clark,
Sean Paul, Konrad Dybcio, Abhinav Kumar, Dmitry Baryshkov,
Marijn Suijten, David Airlie, Simona Vetter, Jordan Crouse,
Jonathan Marek, open list
From: Rob Clark <robdclark@chromium.org>
IB_SIZE is only b0..b19. Starting with a6xx gen3, additional fields
were added above the IB_SIZE. Accidentially setting them can cause
badness. Fix this by properly defining the CP_INDIRECT_BUFFER packet
and using the generated builder macro to ensure unintended bits are not
set.
v2: add missing type attribute for IB_BASE
Reported-by: Connor Abbott <cwabbott0@gmail.com>
Fixes: a83366ef19ea ("drm/msm/a6xx: add A640/A650 to gpulist")
Signed-off-by: Rob Clark <robdclark@chromium.org>
---
Backport notes, prior to commit ae22a94997b8 ("drm/msm: import A2xx-A4xx
XML display registers database"), just open code, ie:
OUT_RING(ring, submit->cmd[i].size & 0xfffff);
Prior to commit af66706accdf ("drm/msm/a6xx: Add skeleton A7xx
support"), a7xx_submit() did not exist so that hunk can be dropped.
drivers/gpu/drm/msm/adreno/a6xx_gpu.c | 8 ++++----
drivers/gpu/drm/msm/registers/adreno/adreno_pm4.xml | 7 +++++++
2 files changed, 11 insertions(+), 4 deletions(-)
diff --git a/drivers/gpu/drm/msm/adreno/a6xx_gpu.c b/drivers/gpu/drm/msm/adreno/a6xx_gpu.c
index d3978cfa3f20..ea52b7d0b212 100644
--- a/drivers/gpu/drm/msm/adreno/a6xx_gpu.c
+++ b/drivers/gpu/drm/msm/adreno/a6xx_gpu.c
@@ -245,10 +245,10 @@ static void a6xx_submit(struct msm_gpu *gpu, struct msm_gem_submit *submit)
break;
fallthrough;
case MSM_SUBMIT_CMD_BUF:
- OUT_PKT7(ring, CP_INDIRECT_BUFFER_PFE, 3);
+ OUT_PKT7(ring, CP_INDIRECT_BUFFER, 3);
OUT_RING(ring, lower_32_bits(submit->cmd[i].iova));
OUT_RING(ring, upper_32_bits(submit->cmd[i].iova));
- OUT_RING(ring, submit->cmd[i].size);
+ OUT_RING(ring, A5XX_CP_INDIRECT_BUFFER_3_IB_SIZE(submit->cmd[i].size));
ibs++;
break;
}
@@ -382,10 +382,10 @@ static void a7xx_submit(struct msm_gpu *gpu, struct msm_gem_submit *submit)
break;
fallthrough;
case MSM_SUBMIT_CMD_BUF:
- OUT_PKT7(ring, CP_INDIRECT_BUFFER_PFE, 3);
+ OUT_PKT7(ring, CP_INDIRECT_BUFFER, 3);
OUT_RING(ring, lower_32_bits(submit->cmd[i].iova));
OUT_RING(ring, upper_32_bits(submit->cmd[i].iova));
- OUT_RING(ring, submit->cmd[i].size);
+ OUT_RING(ring, A5XX_CP_INDIRECT_BUFFER_3_IB_SIZE(submit->cmd[i].size));
ibs++;
break;
}
diff --git a/drivers/gpu/drm/msm/registers/adreno/adreno_pm4.xml b/drivers/gpu/drm/msm/registers/adreno/adreno_pm4.xml
index 55a35182858c..a71bc6f16cbf 100644
--- a/drivers/gpu/drm/msm/registers/adreno/adreno_pm4.xml
+++ b/drivers/gpu/drm/msm/registers/adreno/adreno_pm4.xml
@@ -2259,5 +2259,12 @@ opcode: CP_LOAD_STATE4 (30) (4 dwords)
</reg32>
</domain>
+<domain name="CP_INDIRECT_BUFFER" width="32" varset="chip" prefix="chip" variants="A5XX-">
+ <reg64 offset="0" name="IB_BASE" type="address"/>
+ <reg32 offset="3" name="3">
+ <bitfield name="IB_SIZE" low="0" high="19"/>
+ </reg32>
+</domain>
+
</database>
--
2.48.1
^ permalink raw reply related [flat|nested] 3+ messages in thread
* Re: [PATCH v2] drm/msm/a6xx+: Don't let IB_SIZE overflow
2025-03-14 18:34 [PATCH v2] drm/msm/a6xx+: Don't let IB_SIZE overflow Rob Clark
@ 2025-03-14 20:07 ` Akhil P Oommen
2025-03-14 21:08 ` Rob Clark
0 siblings, 1 reply; 3+ messages in thread
From: Akhil P Oommen @ 2025-03-14 20:07 UTC (permalink / raw)
To: Rob Clark, dri-devel
Cc: linux-arm-msm, freedreno, Rob Clark, Connor Abbott, Sean Paul,
Konrad Dybcio, Abhinav Kumar, Dmitry Baryshkov, Marijn Suijten,
David Airlie, Simona Vetter, Jordan Crouse, Jonathan Marek,
open list
On 3/15/2025 12:04 AM, Rob Clark wrote:
> From: Rob Clark <robdclark@chromium.org>
>
> IB_SIZE is only b0..b19. Starting with a6xx gen3, additional fields
> were added above the IB_SIZE. Accidentially setting them can cause
> badness. Fix this by properly defining the CP_INDIRECT_BUFFER packet
> and using the generated builder macro to ensure unintended bits are not
> set.
>
> v2: add missing type attribute for IB_BASE
>
> Reported-by: Connor Abbott <cwabbott0@gmail.com>
> Fixes: a83366ef19ea ("drm/msm/a6xx: add A640/A650 to gpulist")
> Signed-off-by: Rob Clark <robdclark@chromium.org>
> ---
> Backport notes, prior to commit ae22a94997b8 ("drm/msm: import A2xx-A4xx
> XML display registers database"), just open code, ie:
>
> OUT_RING(ring, submit->cmd[i].size & 0xfffff);
>
> Prior to commit af66706accdf ("drm/msm/a6xx: Add skeleton A7xx
> support"), a7xx_submit() did not exist so that hunk can be dropped.
>
> drivers/gpu/drm/msm/adreno/a6xx_gpu.c | 8 ++++----
> drivers/gpu/drm/msm/registers/adreno/adreno_pm4.xml | 7 +++++++
> 2 files changed, 11 insertions(+), 4 deletions(-)
>
> diff --git a/drivers/gpu/drm/msm/adreno/a6xx_gpu.c b/drivers/gpu/drm/msm/adreno/a6xx_gpu.c
> index d3978cfa3f20..ea52b7d0b212 100644
> --- a/drivers/gpu/drm/msm/adreno/a6xx_gpu.c
> +++ b/drivers/gpu/drm/msm/adreno/a6xx_gpu.c
> @@ -245,10 +245,10 @@ static void a6xx_submit(struct msm_gpu *gpu, struct msm_gem_submit *submit)
> break;
> fallthrough;
> case MSM_SUBMIT_CMD_BUF:
> - OUT_PKT7(ring, CP_INDIRECT_BUFFER_PFE, 3);
> + OUT_PKT7(ring, CP_INDIRECT_BUFFER, 3);
> OUT_RING(ring, lower_32_bits(submit->cmd[i].iova));
> OUT_RING(ring, upper_32_bits(submit->cmd[i].iova));
> - OUT_RING(ring, submit->cmd[i].size);
> + OUT_RING(ring, A5XX_CP_INDIRECT_BUFFER_3_IB_SIZE(submit->cmd[i].size));
> ibs++;
> break;
> }
> @@ -382,10 +382,10 @@ static void a7xx_submit(struct msm_gpu *gpu, struct msm_gem_submit *submit)
> break;
> fallthrough;
> case MSM_SUBMIT_CMD_BUF:
> - OUT_PKT7(ring, CP_INDIRECT_BUFFER_PFE, 3);
> + OUT_PKT7(ring, CP_INDIRECT_BUFFER, 3);
> OUT_RING(ring, lower_32_bits(submit->cmd[i].iova));
> OUT_RING(ring, upper_32_bits(submit->cmd[i].iova));
> - OUT_RING(ring, submit->cmd[i].size);
> + OUT_RING(ring, A5XX_CP_INDIRECT_BUFFER_3_IB_SIZE(submit->cmd[i].size));
> ibs++;
> break;
> }
> diff --git a/drivers/gpu/drm/msm/registers/adreno/adreno_pm4.xml b/drivers/gpu/drm/msm/registers/adreno/adreno_pm4.xml
> index 55a35182858c..a71bc6f16cbf 100644
> --- a/drivers/gpu/drm/msm/registers/adreno/adreno_pm4.xml
> +++ b/drivers/gpu/drm/msm/registers/adreno/adreno_pm4.xml
> @@ -2259,5 +2259,12 @@ opcode: CP_LOAD_STATE4 (30) (4 dwords)
> </reg32>
> </domain>
>
> +<domain name="CP_INDIRECT_BUFFER" width="32" varset="chip" prefix="chip" variants="A5XX-">
> + <reg64 offset="0" name="IB_BASE" type="address"/>
> + <reg32 offset="3" name="3">
Why is the offset 3 here? It looks to me that it doesn't match the code
above.
-Akhil.
> + <bitfield name="IB_SIZE" low="0" high="19"/>
> + </reg32>
> +</domain>
> +
> </database>
>
^ permalink raw reply [flat|nested] 3+ messages in thread
* Re: [PATCH v2] drm/msm/a6xx+: Don't let IB_SIZE overflow
2025-03-14 20:07 ` Akhil P Oommen
@ 2025-03-14 21:08 ` Rob Clark
0 siblings, 0 replies; 3+ messages in thread
From: Rob Clark @ 2025-03-14 21:08 UTC (permalink / raw)
To: Akhil P Oommen
Cc: dri-devel, linux-arm-msm, freedreno, Rob Clark, Connor Abbott,
Sean Paul, Konrad Dybcio, Abhinav Kumar, Dmitry Baryshkov,
Marijn Suijten, David Airlie, Simona Vetter, Jordan Crouse,
Jonathan Marek, open list
On Fri, Mar 14, 2025 at 1:07 PM Akhil P Oommen <quic_akhilpo@quicinc.com> wrote:
>
> On 3/15/2025 12:04 AM, Rob Clark wrote:
> > From: Rob Clark <robdclark@chromium.org>
> >
> > IB_SIZE is only b0..b19. Starting with a6xx gen3, additional fields
> > were added above the IB_SIZE. Accidentially setting them can cause
> > badness. Fix this by properly defining the CP_INDIRECT_BUFFER packet
> > and using the generated builder macro to ensure unintended bits are not
> > set.
> >
> > v2: add missing type attribute for IB_BASE
> >
> > Reported-by: Connor Abbott <cwabbott0@gmail.com>
> > Fixes: a83366ef19ea ("drm/msm/a6xx: add A640/A650 to gpulist")
> > Signed-off-by: Rob Clark <robdclark@chromium.org>
> > ---
> > Backport notes, prior to commit ae22a94997b8 ("drm/msm: import A2xx-A4xx
> > XML display registers database"), just open code, ie:
> >
> > OUT_RING(ring, submit->cmd[i].size & 0xfffff);
> >
> > Prior to commit af66706accdf ("drm/msm/a6xx: Add skeleton A7xx
> > support"), a7xx_submit() did not exist so that hunk can be dropped.
> >
> > drivers/gpu/drm/msm/adreno/a6xx_gpu.c | 8 ++++----
> > drivers/gpu/drm/msm/registers/adreno/adreno_pm4.xml | 7 +++++++
> > 2 files changed, 11 insertions(+), 4 deletions(-)
> >
> > diff --git a/drivers/gpu/drm/msm/adreno/a6xx_gpu.c b/drivers/gpu/drm/msm/adreno/a6xx_gpu.c
> > index d3978cfa3f20..ea52b7d0b212 100644
> > --- a/drivers/gpu/drm/msm/adreno/a6xx_gpu.c
> > +++ b/drivers/gpu/drm/msm/adreno/a6xx_gpu.c
> > @@ -245,10 +245,10 @@ static void a6xx_submit(struct msm_gpu *gpu, struct msm_gem_submit *submit)
> > break;
> > fallthrough;
> > case MSM_SUBMIT_CMD_BUF:
> > - OUT_PKT7(ring, CP_INDIRECT_BUFFER_PFE, 3);
> > + OUT_PKT7(ring, CP_INDIRECT_BUFFER, 3);
> > OUT_RING(ring, lower_32_bits(submit->cmd[i].iova));
> > OUT_RING(ring, upper_32_bits(submit->cmd[i].iova));
> > - OUT_RING(ring, submit->cmd[i].size);
> > + OUT_RING(ring, A5XX_CP_INDIRECT_BUFFER_3_IB_SIZE(submit->cmd[i].size));
> > ibs++;
> > break;
> > }
> > @@ -382,10 +382,10 @@ static void a7xx_submit(struct msm_gpu *gpu, struct msm_gem_submit *submit)
> > break;
> > fallthrough;
> > case MSM_SUBMIT_CMD_BUF:
> > - OUT_PKT7(ring, CP_INDIRECT_BUFFER_PFE, 3);
> > + OUT_PKT7(ring, CP_INDIRECT_BUFFER, 3);
> > OUT_RING(ring, lower_32_bits(submit->cmd[i].iova));
> > OUT_RING(ring, upper_32_bits(submit->cmd[i].iova));
> > - OUT_RING(ring, submit->cmd[i].size);
> > + OUT_RING(ring, A5XX_CP_INDIRECT_BUFFER_3_IB_SIZE(submit->cmd[i].size));
> > ibs++;
> > break;
> > }
> > diff --git a/drivers/gpu/drm/msm/registers/adreno/adreno_pm4.xml b/drivers/gpu/drm/msm/registers/adreno/adreno_pm4.xml
> > index 55a35182858c..a71bc6f16cbf 100644
> > --- a/drivers/gpu/drm/msm/registers/adreno/adreno_pm4.xml
> > +++ b/drivers/gpu/drm/msm/registers/adreno/adreno_pm4.xml
> > @@ -2259,5 +2259,12 @@ opcode: CP_LOAD_STATE4 (30) (4 dwords)
> > </reg32>
> > </domain>
> >
> > +<domain name="CP_INDIRECT_BUFFER" width="32" varset="chip" prefix="chip" variants="A5XX-">
> > + <reg64 offset="0" name="IB_BASE" type="address"/>
> > + <reg32 offset="3" name="3">
>
> Why is the offset 3 here? It looks to me that it doesn't match the code
> above.
oh, bad copy/pasta.. it should be 2 (dword offset)
BR,
-R
> -Akhil.
>
> > + <bitfield name="IB_SIZE" low="0" high="19"/>
> > + </reg32>
> > +</domain>
> > +
> > </database>
> >
>
^ permalink raw reply [flat|nested] 3+ messages in thread
end of thread, other threads:[~2025-03-14 21:08 UTC | newest]
Thread overview: 3+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2025-03-14 18:34 [PATCH v2] drm/msm/a6xx+: Don't let IB_SIZE overflow Rob Clark
2025-03-14 20:07 ` Akhil P Oommen
2025-03-14 21:08 ` Rob Clark
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox