Commit e92049ae authored by Qu Huang's avatar Qu Huang Committed by Alex Deucher
Browse files

drm/amdkfd: dqm fence memory corruption 



Amdgpu driver uses 4-byte data type as DQM fence memory,
and transmits GPU address of fence memory to microcode
through query status PM4 message. However, query status
PM4 message definition and microcode processing are all
processed according to 8 bytes. Fence memory only allocates
4 bytes of memory, but microcode does write 8 bytes of memory,
so there is a memory corruption.

Changes since v1:
  * Change dqm->fence_addr as a u64 pointer to fix this issue,
also fix up query_status and amdkfd_fence_wait_timeout function
uses 64 bit fence value to make them consistent.

Signed-off-by: default avatarQu Huang <jinsdb@126.com>
Reviewed-by: default avatarFelix Kuehling <Felix.Kuehling@amd.com>
Signed-off-by: default avatarFelix Kuehling <Felix.Kuehling@amd.com>
Signed-off-by: default avatarAlex Deucher <alexander.deucher@amd.com>
Cc: stable@vger.kernel.org
parent 5e61b84f

drivers/gpu/drm/amd/amdkfd/kfd_dbgdev.c

+1 −1
Original line number Diff line number Diff line
@@ -155,7 +155,7 @@ static int dbgdev_diq_submit_ib(struct kfd_dbgdev *dbgdev, 


	/* Wait till CP writes sync code: */

	status = amdkfd_fence_wait_timeout(

			(unsigned int *) rm_state,

			rm_state,

			QUEUESTATE__ACTIVE, 1500);



	kfd_gtt_sa_free(dbgdev->dev, mem_obj);

drivers/gpu/drm/amd/amdkfd/kfd_device_queue_manager.c

+3 −3
Original line number Diff line number Diff line
@@ -1167,7 +1167,7 @@ static int start_cpsch(struct device_queue_manager *dqm) 
	if (retval)

		goto fail_allocate_vidmem;



	dqm->fence_addr = dqm->fence_mem->cpu_ptr;

	dqm->fence_addr = (uint64_t *)dqm->fence_mem->cpu_ptr;

	dqm->fence_gpu_addr = dqm->fence_mem->gpu_addr;



	init_interrupts(dqm);
@@ -1340,8 +1340,8 @@ static int create_queue_cpsch(struct device_queue_manager *dqm, struct queue *q, 
	return retval;

}



int amdkfd_fence_wait_timeout(unsigned int *fence_addr,

				unsigned int fence_value,

int amdkfd_fence_wait_timeout(uint64_t *fence_addr,

				uint64_t fence_value,

				unsigned int timeout_ms)

{

	unsigned long end_jiffies = msecs_to_jiffies(timeout_ms) + jiffies;

drivers/gpu/drm/amd/amdkfd/kfd_device_queue_manager.h

+1 −1
Original line number Diff line number Diff line
@@ -192,7 +192,7 @@ struct device_queue_manager { 
	uint16_t		vmid_pasid[VMID_NUM];

	uint64_t		pipelines_addr;

	uint64_t		fence_gpu_addr;

	unsigned int		*fence_addr;

	uint64_t		*fence_addr;

	struct kfd_mem_obj	*fence_mem;

	bool			active_runlist;

	int			sched_policy;

drivers/gpu/drm/amd/amdkfd/kfd_packet_manager.c

+1 −1
Original line number Diff line number Diff line
@@ -347,7 +347,7 @@ int pm_send_runlist(struct packet_manager *pm, struct list_head *dqm_queues) 
}



int pm_send_query_status(struct packet_manager *pm, uint64_t fence_address,

			uint32_t fence_value)

			uint64_t fence_value)

{

	uint32_t *buffer, size;

	int retval = 0;

drivers/gpu/drm/amd/amdkfd/kfd_packet_manager_v9.c

+1 −1
Original line number Diff line number Diff line
@@ -283,7 +283,7 @@ static int pm_unmap_queues_v9(struct packet_manager *pm, uint32_t *buffer, 
}



static int pm_query_status_v9(struct packet_manager *pm, uint32_t *buffer,

			uint64_t fence_address,	uint32_t fence_value)

			uint64_t fence_address,	uint64_t fence_value)

{

	struct pm4_mes_query_status *packet;