Skip to content

Commit 43f44f5

Browse files
airliedairlied
committed
Merge tag 'drm-msm-fixes-2021-06-10' of https://gitlab.freedesktop.org/drm/msm into drm-fixes
- NULL ptr deref fix - CP_PROTECT reg programming fix - incorrect register shift fix - DSI blank screen fix Signed-off-by: Dave Airlie <[email protected]> From: Rob Clark <[email protected]> Link: https://patchwork.freedesktop.org/patch/msgid/CAF6AEGvbcz0=QxGYnX9u7cD1SCvFSx20dzrZuOccjtRRBTJd5Q@mail.gmail.com
2 parents 614124b + 170b763 commit 43f44f5

File tree

5 files changed

+124
-42
lines changed

5 files changed

+124
-42
lines changed

‎drivers/gpu/drm/msm/adreno/a6xx_gpu.c

Lines changed: 114 additions & 41 deletions
Original file line numberDiff line numberDiff line change
@@ -157,7 +157,7 @@ static void a6xx_submit(struct msm_gpu *gpu, struct msm_gem_submit *submit)
157157
* GPU registers so we need to add 0x1a800 to the register value on A630
158158
* to get the right value from PM4.
159159
*/
160-
get_stats_counter(ring, REG_A6XX_GMU_ALWAYS_ON_COUNTER_L + 0x1a800,
160+
get_stats_counter(ring, REG_A6XX_CP_ALWAYS_ON_COUNTER_LO,
161161
rbmemptr_stats(ring, index, alwayson_start));
162162

163163
/* Invalidate CCU depth and color */
@@ -187,7 +187,7 @@ static void a6xx_submit(struct msm_gpu *gpu, struct msm_gem_submit *submit)
187187

188188
get_stats_counter(ring, REG_A6XX_RBBM_PERFCTR_CP_0_LO,
189189
rbmemptr_stats(ring, index, cpcycles_end));
190-
get_stats_counter(ring, REG_A6XX_GMU_ALWAYS_ON_COUNTER_L + 0x1a800,
190+
get_stats_counter(ring, REG_A6XX_CP_ALWAYS_ON_COUNTER_LO,
191191
rbmemptr_stats(ring, index, alwayson_end));
192192

193193
/* Write the fence to the scratch register */
@@ -206,8 +206,8 @@ static void a6xx_submit(struct msm_gpu *gpu, struct msm_gem_submit *submit)
206206
OUT_RING(ring, submit->seqno);
207207

208208
trace_msm_gpu_submit_flush(submit,
209-
gmu_read64(&a6xx_gpu->gmu, REG_A6XX_GMU_ALWAYS_ON_COUNTER_L,
210-
REG_A6XX_GMU_ALWAYS_ON_COUNTER_H));
209+
gpu_read64(gpu, REG_A6XX_CP_ALWAYS_ON_COUNTER_LO,
210+
REG_A6XX_CP_ALWAYS_ON_COUNTER_HI));
211211

212212
a6xx_flush(gpu, ring);
213213
}
@@ -462,6 +462,113 @@ static void a6xx_set_hwcg(struct msm_gpu *gpu, bool state)
462462
gpu_write(gpu, REG_A6XX_RBBM_CLOCK_CNTL, state ? clock_cntl_on : 0);
463463
}
464464

465+
/* For a615, a616, a618, A619, a630, a640 and a680 */
466+
static const u32 a6xx_protect[] = {
467+
A6XX_PROTECT_RDONLY(0x00000, 0x04ff),
468+
A6XX_PROTECT_RDONLY(0x00501, 0x0005),
469+
A6XX_PROTECT_RDONLY(0x0050b, 0x02f4),
470+
A6XX_PROTECT_NORDWR(0x0050e, 0x0000),
471+
A6XX_PROTECT_NORDWR(0x00510, 0x0000),
472+
A6XX_PROTECT_NORDWR(0x00534, 0x0000),
473+
A6XX_PROTECT_NORDWR(0x00800, 0x0082),
474+
A6XX_PROTECT_NORDWR(0x008a0, 0x0008),
475+
A6XX_PROTECT_NORDWR(0x008ab, 0x0024),
476+
A6XX_PROTECT_RDONLY(0x008de, 0x00ae),
477+
A6XX_PROTECT_NORDWR(0x00900, 0x004d),
478+
A6XX_PROTECT_NORDWR(0x0098d, 0x0272),
479+
A6XX_PROTECT_NORDWR(0x00e00, 0x0001),
480+
A6XX_PROTECT_NORDWR(0x00e03, 0x000c),
481+
A6XX_PROTECT_NORDWR(0x03c00, 0x00c3),
482+
A6XX_PROTECT_RDONLY(0x03cc4, 0x1fff),
483+
A6XX_PROTECT_NORDWR(0x08630, 0x01cf),
484+
A6XX_PROTECT_NORDWR(0x08e00, 0x0000),
485+
A6XX_PROTECT_NORDWR(0x08e08, 0x0000),
486+
A6XX_PROTECT_NORDWR(0x08e50, 0x001f),
487+
A6XX_PROTECT_NORDWR(0x09624, 0x01db),
488+
A6XX_PROTECT_NORDWR(0x09e70, 0x0001),
489+
A6XX_PROTECT_NORDWR(0x09e78, 0x0187),
490+
A6XX_PROTECT_NORDWR(0x0a630, 0x01cf),
491+
A6XX_PROTECT_NORDWR(0x0ae02, 0x0000),
492+
A6XX_PROTECT_NORDWR(0x0ae50, 0x032f),
493+
A6XX_PROTECT_NORDWR(0x0b604, 0x0000),
494+
A6XX_PROTECT_NORDWR(0x0be02, 0x0001),
495+
A6XX_PROTECT_NORDWR(0x0be20, 0x17df),
496+
A6XX_PROTECT_NORDWR(0x0f000, 0x0bff),
497+
A6XX_PROTECT_RDONLY(0x0fc00, 0x1fff),
498+
A6XX_PROTECT_NORDWR(0x11c00, 0x0000), /* note: infinite range */
499+
};
500+
501+
/* These are for a620 and a650 */
502+
static const u32 a650_protect[] = {
503+
A6XX_PROTECT_RDONLY(0x00000, 0x04ff),
504+
A6XX_PROTECT_RDONLY(0x00501, 0x0005),
505+
A6XX_PROTECT_RDONLY(0x0050b, 0x02f4),
506+
A6XX_PROTECT_NORDWR(0x0050e, 0x0000),
507+
A6XX_PROTECT_NORDWR(0x00510, 0x0000),
508+
A6XX_PROTECT_NORDWR(0x00534, 0x0000),
509+
A6XX_PROTECT_NORDWR(0x00800, 0x0082),
510+
A6XX_PROTECT_NORDWR(0x008a0, 0x0008),
511+
A6XX_PROTECT_NORDWR(0x008ab, 0x0024),
512+
A6XX_PROTECT_RDONLY(0x008de, 0x00ae),
513+
A6XX_PROTECT_NORDWR(0x00900, 0x004d),
514+
A6XX_PROTECT_NORDWR(0x0098d, 0x0272),
515+
A6XX_PROTECT_NORDWR(0x00e00, 0x0001),
516+
A6XX_PROTECT_NORDWR(0x00e03, 0x000c),
517+
A6XX_PROTECT_NORDWR(0x03c00, 0x00c3),
518+
A6XX_PROTECT_RDONLY(0x03cc4, 0x1fff),
519+
A6XX_PROTECT_NORDWR(0x08630, 0x01cf),
520+
A6XX_PROTECT_NORDWR(0x08e00, 0x0000),
521+
A6XX_PROTECT_NORDWR(0x08e08, 0x0000),
522+
A6XX_PROTECT_NORDWR(0x08e50, 0x001f),
523+
A6XX_PROTECT_NORDWR(0x08e80, 0x027f),
524+
A6XX_PROTECT_NORDWR(0x09624, 0x01db),
525+
A6XX_PROTECT_NORDWR(0x09e60, 0x0011),
526+
A6XX_PROTECT_NORDWR(0x09e78, 0x0187),
527+
A6XX_PROTECT_NORDWR(0x0a630, 0x01cf),
528+
A6XX_PROTECT_NORDWR(0x0ae02, 0x0000),
529+
A6XX_PROTECT_NORDWR(0x0ae50, 0x032f),
530+
A6XX_PROTECT_NORDWR(0x0b604, 0x0000),
531+
A6XX_PROTECT_NORDWR(0x0b608, 0x0007),
532+
A6XX_PROTECT_NORDWR(0x0be02, 0x0001),
533+
A6XX_PROTECT_NORDWR(0x0be20, 0x17df),
534+
A6XX_PROTECT_NORDWR(0x0f000, 0x0bff),
535+
A6XX_PROTECT_RDONLY(0x0fc00, 0x1fff),
536+
A6XX_PROTECT_NORDWR(0x18400, 0x1fff),
537+
A6XX_PROTECT_NORDWR(0x1a800, 0x1fff),
538+
A6XX_PROTECT_NORDWR(0x1f400, 0x0443),
539+
A6XX_PROTECT_RDONLY(0x1f844, 0x007b),
540+
A6XX_PROTECT_NORDWR(0x1f887, 0x001b),
541+
A6XX_PROTECT_NORDWR(0x1f8c0, 0x0000), /* note: infinite range */
542+
};
543+
544+
static void a6xx_set_cp_protect(struct msm_gpu *gpu)
545+
{
546+
struct adreno_gpu *adreno_gpu = to_adreno_gpu(gpu);
547+
const u32 *regs = a6xx_protect;
548+
unsigned i, count = ARRAY_SIZE(a6xx_protect), count_max = 32;
549+
550+
BUILD_BUG_ON(ARRAY_SIZE(a6xx_protect) > 32);
551+
BUILD_BUG_ON(ARRAY_SIZE(a650_protect) > 48);
552+
553+
if (adreno_is_a650(adreno_gpu)) {
554+
regs = a650_protect;
555+
count = ARRAY_SIZE(a650_protect);
556+
count_max = 48;
557+
}
558+
559+
/*
560+
* Enable access protection to privileged registers, fault on an access
561+
* protect violation and select the last span to protect from the start
562+
* address all the way to the end of the register address space
563+
*/
564+
gpu_write(gpu, REG_A6XX_CP_PROTECT_CNTL, BIT(0) | BIT(1) | BIT(3));
565+
566+
for (i = 0; i < count - 1; i++)
567+
gpu_write(gpu, REG_A6XX_CP_PROTECT(i), regs[i]);
568+
/* last CP_PROTECT to have "infinite" length on the last entry */
569+
gpu_write(gpu, REG_A6XX_CP_PROTECT(count_max - 1), regs[i]);
570+
}
571+
465572
static void a6xx_set_ubwc_config(struct msm_gpu *gpu)
466573
{
467574
struct adreno_gpu *adreno_gpu = to_adreno_gpu(gpu);
@@ -489,7 +596,7 @@ static void a6xx_set_ubwc_config(struct msm_gpu *gpu)
489596
rgb565_predicator << 11 | amsbc << 4 | lower_bit << 1);
490597
gpu_write(gpu, REG_A6XX_TPL1_NC_MODE_CNTL, lower_bit << 1);
491598
gpu_write(gpu, REG_A6XX_SP_NC_MODE_CNTL,
492-
uavflagprd_inv >> 4 | lower_bit << 1);
599+
uavflagprd_inv << 4 | lower_bit << 1);
493600
gpu_write(gpu, REG_A6XX_UCHE_MODE_CNTL, lower_bit << 21);
494601
}
495602

@@ -776,41 +883,7 @@ static int a6xx_hw_init(struct msm_gpu *gpu)
776883
}
777884

778885
/* Protect registers from the CP */
779-
gpu_write(gpu, REG_A6XX_CP_PROTECT_CNTL, 0x00000003);
780-
781-
gpu_write(gpu, REG_A6XX_CP_PROTECT(0),
782-
A6XX_PROTECT_RDONLY(0x600, 0x51));
783-
gpu_write(gpu, REG_A6XX_CP_PROTECT(1), A6XX_PROTECT_RW(0xae50, 0x2));
784-
gpu_write(gpu, REG_A6XX_CP_PROTECT(2), A6XX_PROTECT_RW(0x9624, 0x13));
785-
gpu_write(gpu, REG_A6XX_CP_PROTECT(3), A6XX_PROTECT_RW(0x8630, 0x8));
786-
gpu_write(gpu, REG_A6XX_CP_PROTECT(4), A6XX_PROTECT_RW(0x9e70, 0x1));
787-
gpu_write(gpu, REG_A6XX_CP_PROTECT(5), A6XX_PROTECT_RW(0x9e78, 0x187));
788-
gpu_write(gpu, REG_A6XX_CP_PROTECT(6), A6XX_PROTECT_RW(0xf000, 0x810));
789-
gpu_write(gpu, REG_A6XX_CP_PROTECT(7),
790-
A6XX_PROTECT_RDONLY(0xfc00, 0x3));
791-
gpu_write(gpu, REG_A6XX_CP_PROTECT(8), A6XX_PROTECT_RW(0x50e, 0x0));
792-
gpu_write(gpu, REG_A6XX_CP_PROTECT(9), A6XX_PROTECT_RDONLY(0x50f, 0x0));
793-
gpu_write(gpu, REG_A6XX_CP_PROTECT(10), A6XX_PROTECT_RW(0x510, 0x0));
794-
gpu_write(gpu, REG_A6XX_CP_PROTECT(11),
795-
A6XX_PROTECT_RDONLY(0x0, 0x4f9));
796-
gpu_write(gpu, REG_A6XX_CP_PROTECT(12),
797-
A6XX_PROTECT_RDONLY(0x501, 0xa));
798-
gpu_write(gpu, REG_A6XX_CP_PROTECT(13),
799-
A6XX_PROTECT_RDONLY(0x511, 0x44));
800-
gpu_write(gpu, REG_A6XX_CP_PROTECT(14), A6XX_PROTECT_RW(0xe00, 0xe));
801-
gpu_write(gpu, REG_A6XX_CP_PROTECT(15), A6XX_PROTECT_RW(0x8e00, 0x0));
802-
gpu_write(gpu, REG_A6XX_CP_PROTECT(16), A6XX_PROTECT_RW(0x8e50, 0xf));
803-
gpu_write(gpu, REG_A6XX_CP_PROTECT(17), A6XX_PROTECT_RW(0xbe02, 0x0));
804-
gpu_write(gpu, REG_A6XX_CP_PROTECT(18),
805-
A6XX_PROTECT_RW(0xbe20, 0x11f3));
806-
gpu_write(gpu, REG_A6XX_CP_PROTECT(19), A6XX_PROTECT_RW(0x800, 0x82));
807-
gpu_write(gpu, REG_A6XX_CP_PROTECT(20), A6XX_PROTECT_RW(0x8a0, 0x8));
808-
gpu_write(gpu, REG_A6XX_CP_PROTECT(21), A6XX_PROTECT_RW(0x8ab, 0x19));
809-
gpu_write(gpu, REG_A6XX_CP_PROTECT(22), A6XX_PROTECT_RW(0x900, 0x4d));
810-
gpu_write(gpu, REG_A6XX_CP_PROTECT(23), A6XX_PROTECT_RW(0x98d, 0x76));
811-
gpu_write(gpu, REG_A6XX_CP_PROTECT(24),
812-
A6XX_PROTECT_RDONLY(0x980, 0x4));
813-
gpu_write(gpu, REG_A6XX_CP_PROTECT(25), A6XX_PROTECT_RW(0xa630, 0x0));
886+
a6xx_set_cp_protect(gpu);
814887

815888
/* Enable expanded apriv for targets that support it */
816889
if (gpu->hw_apriv) {
@@ -1211,7 +1284,7 @@ static int a6xx_pm_suspend(struct msm_gpu *gpu)
12111284
if (ret)
12121285
return ret;
12131286

1214-
if (adreno_gpu->base.hw_apriv || a6xx_gpu->has_whereami)
1287+
if (a6xx_gpu->shadow_bo)
12151288
for (i = 0; i < gpu->nr_rings; i++)
12161289
a6xx_gpu->shadow[i] = 0;
12171290

‎drivers/gpu/drm/msm/adreno/a6xx_gpu.h

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -44,7 +44,7 @@ struct a6xx_gpu {
4444
* REG_CP_PROTECT_REG(n) - this will block both reads and writes for _len
4545
* registers starting at _reg.
4646
*/
47-
#define A6XX_PROTECT_RW(_reg, _len) \
47+
#define A6XX_PROTECT_NORDWR(_reg, _len) \
4848
((1 << 31) | \
4949
(((_len) & 0x3FFF) << 18) | ((_reg) & 0x3FFFF))
5050

‎drivers/gpu/drm/msm/dsi/phy/dsi_phy_10nm.c

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -432,6 +432,7 @@ static unsigned long dsi_pll_10nm_vco_recalc_rate(struct clk_hw *hw,
432432
pll_freq += div_u64(tmp64, multiplier);
433433

434434
vco_rate = pll_freq;
435+
pll_10nm->vco_current_rate = vco_rate;
435436

436437
DBG("DSI PLL%d returning vco rate = %lu, dec = %x, frac = %x",
437438
pll_10nm->phy->id, (unsigned long)vco_rate, dec, frac);

‎drivers/gpu/drm/msm/dsi/phy/dsi_phy_7nm.c

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -460,6 +460,7 @@ static unsigned long dsi_pll_7nm_vco_recalc_rate(struct clk_hw *hw,
460460
pll_freq += div_u64(tmp64, multiplier);
461461

462462
vco_rate = pll_freq;
463+
pll_7nm->vco_current_rate = vco_rate;
463464

464465
DBG("DSI PLL%d returning vco rate = %lu, dec = %x, frac = %x",
465466
pll_7nm->phy->id, (unsigned long)vco_rate, dec, frac);

‎drivers/gpu/drm/msm/msm_gem.c

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1241,6 +1241,13 @@ static struct drm_gem_object *_msm_gem_new(struct drm_device *dev,
12411241

12421242
to_msm_bo(obj)->vram_node = &vma->node;
12431243

1244+
/* Call chain get_pages() -> update_inactive() tries to
1245+
* access msm_obj->mm_list, but it is not initialized yet.
1246+
* To avoid NULL pointer dereference error, initialize
1247+
* mm_list to be empty.
1248+
*/
1249+
INIT_LIST_HEAD(&msm_obj->mm_list);
1250+
12441251
msm_gem_lock(obj);
12451252
pages = get_pages(obj);
12461253
msm_gem_unlock(obj);

0 commit comments

Comments
 (0)