Re: [PATCH] drm/amdgpu: Fix type mismatch in amdgpu_gfx_kiq_init_ring

[SRINIVASAN SHANMUGAM]

Ping!?

On 5/25/2024 7:40 AM, Srinivasan Shanmugam wrote:

This commit fixes a type mismatch in the amdgpu_gfx_kiq_init_ring
function triggered by the snprintf function expecting unsigned char
arguments due to the '%hhu' format specifier, but receiving int and u32
arguments.

The issue occurred because the arguments xcc_id, ring->me, ring->pipe,
and ring->queue were of type int and u32, not unsigned char. This led to
a type mismatch when these arguments were passed to snprintf.

To resolve this, the snprintf line was modified to cast these arguments
to unsigned char. This ensures that the arguments are of the correct
type for the '%hhu' format specifier and resolves the warning.

Fixes the below:

drivers/gpu/drm/amd/amdgpu/amdgpu_gfx.c:333:4: warning: format
specifies type 'unsigned char' but the argument has type 'int'
[-Wformat]

 xcc_id, ring->me, ring->pipe, ring->queue);
 ^~

drivers/gpu/drm/amd/amdgpu/amdgpu_gfx.c:333:12: warning: format
specifies type 'unsigned char' but the argument has type 'u32' (aka
'unsigned int') [-Wformat]

 xcc_id, ring->me, ring->pipe, ring->queue);
 ^~~~
drivers/gpu/drm/amd/amdgpu/amdgpu_gfx.c:333:22: warning: format specifies 
type 'unsigned char' but the argument has type 'u32' (aka 'unsigned int') 
[-Wformat]
 xcc_id, ring->me, ring->pipe, ring->queue);
   ^~
drivers/gpu/drm/amd/amdgpu/amdgpu_gfx.c:333:34: warning: format specifies 
type 'unsigned char' but the argument has type 'u32' (aka 'unsigned int') 
[-Wformat]
 xcc_id, ring->me, ring->pipe, ring->queue);
   ^~~
4 warnings generated.

Fixes: 0eb430076172 ("drm/amdgpu: Fix snprintf usage in 
amdgpu_gfx_kiq_init_ring")
Reported-by: kernel test robot 
Closes: 
https://lore.kernel.org/oe-kbuild-all/202405250446.xeawe66u-...@intel.com/
Cc: Lijo Lazar 
Cc: Alex Deucher 
Cc: Christian König 
Signed-off-by: Srinivasan Shanmugam 
---
  drivers/gpu/drm/amd/amdgpu/amdgpu_gfx.c | 3 ++-
  1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_gfx.c 
b/drivers/gpu/drm/amd/amdgpu/amdgpu_gfx.c
index 68505eaa92f9..19b1817b55d7 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_gfx.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_gfx.c
@@ -330,7 +330,8 @@ int amdgpu_gfx_kiq_init_ring(struct amdgpu_device *adev, 
int xcc_id)
ring->eop_gpu_addr = kiq->eop_gpu_addr;
ring->no_scheduler = true;
snprintf(ring->name, sizeof(ring->name), "kiq_%hhu.%hhu.%hhu.%hhu",
-xcc_id, ring->me, ring->pipe, ring->queue);
+(unsigned char)xcc_id, (unsigned char)ring->me,
+(unsigned char)ring->pipe, (unsigned char)ring->queue);
r = amdgpu_ring_init(adev, ring, 1024, irq, AMDGPU_CP_KIQ_IRQ_DRIVER0,
 AMDGPU_RING_PRIO_DEFAULT, NULL);
if (r)

[PATCH] drm/amdgpu: Fix missing error code in amdgpu_od_set_init

[Srinivasan Shanmugam]

This commit ensures that an error code -EINVAL is set in the
amdgpu_od_set_init function when the od_kobj_list has only one entry,
indicating that the list is not in the expected state.

Fixes the below:
drivers/gpu/drm/amd/amdgpu/../pm/amdgpu_pm.c:4355 amdgpu_od_set_init() warn: 
missing error code 'ret'

Fixes: d9a3a5e770dc ("drm/amdgpu/pm: Remove gpu_od if it's an empty directory")
Cc: Ma Jun 
Cc: Yang Wang 
Cc: Lijo Lazar 
Cc: Alex Deucher 
Cc: Christian König 
Signed-off-by: Srinivasan Shanmugam 
---
 drivers/gpu/drm/amd/pm/amdgpu_pm.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/drivers/gpu/drm/amd/pm/amdgpu_pm.c 
b/drivers/gpu/drm/amd/pm/amdgpu_pm.c
index d5d6ab484e5a..86118fbfc33c 100644
--- a/drivers/gpu/drm/amd/pm/amdgpu_pm.c
+++ b/drivers/gpu/drm/amd/pm/amdgpu_pm.c
@@ -4463,8 +4463,10 @@ static int amdgpu_od_set_init(struct amdgpu_device *adev)
 * If gpu_od is the only member in the list, that means gpu_od is an
 * empty directory, so remove it.
 */
-   if (list_is_singular(>pm.od_kobj_list))
+   if (list_is_singular(>pm.od_kobj_list)) {
+   ret = -EINVAL;
goto err_out;
+   }
 
return 0;
 
-- 
2.34.1

[PATCH] drm/amd/display: Add null checks for 'stream' and 'plane' before dereferencing

[Srinivasan Shanmugam]

This commit adds null checks for the 'stream' and 'plane' variables in
the dcn30_apply_idle_power_optimizations function. These variables were
previously assumed to be null at line 922, but they were used later in
the code without checking if they were null. This could potentially lead
to a null pointer dereference, which would cause a crash.

The null checks ensure that 'stream' and 'plane' are not null before
they are used, preventing potential crashes.

Fixes the below static smatch checker:
drivers/gpu/drm/amd/amdgpu/../display/dc/hwss/dcn30/dcn30_hwseq.c:938 
dcn30_apply_idle_power_optimizations() error: we previously assumed 'stream' 
could be null (see line 922)
drivers/gpu/drm/amd/amdgpu/../display/dc/hwss/dcn30/dcn30_hwseq.c:940 
dcn30_apply_idle_power_optimizations() error: we previously assumed 'plane' 
could be null (see line 922)

Cc: Tom Chung 
Cc: Nicholas Kazlauskas 
Cc: Bhawanpreet Lakha 
Cc: Rodrigo Siqueira 
Cc: Roman Li 
Cc: Hersen Wu 
Cc: Alex Hung 
Cc: Aurabindo Pillai 
Cc: Harry Wentland 
Signed-off-by: Srinivasan Shanmugam 
---
 drivers/gpu/drm/amd/display/dc/hwss/dcn30/dcn30_hwseq.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/drivers/gpu/drm/amd/display/dc/hwss/dcn30/dcn30_hwseq.c 
b/drivers/gpu/drm/amd/display/dc/hwss/dcn30/dcn30_hwseq.c
index 29d1f150846a..4c4706153305 100644
--- a/drivers/gpu/drm/amd/display/dc/hwss/dcn30/dcn30_hwseq.c
+++ b/drivers/gpu/drm/amd/display/dc/hwss/dcn30/dcn30_hwseq.c
@@ -919,6 +919,9 @@ bool dcn30_apply_idle_power_optimizations(struct dc *dc, 
bool enable)
stream = dc->current_state->streams[0];
plane = (stream ? 
dc->current_state->stream_status[0].plane_states[0] : NULL);
 
+   if (!stream || !plane)
+   return false;
+
if (stream && plane) {
cursor_cache_enable = 
stream->cursor_position.enable &&

plane->address.grph.cursor_cache_addr.quad_part;
-- 
2.34.1

[PATCH] drm/amdgpu: Fix type mismatch in amdgpu_gfx_kiq_init_ring

[Srinivasan Shanmugam]

This commit fixes a type mismatch in the amdgpu_gfx_kiq_init_ring
function triggered by the snprintf function expecting unsigned char
arguments due to the '%hhu' format specifier, but receiving int and u32
arguments.

The issue occurred because the arguments xcc_id, ring->me, ring->pipe,
and ring->queue were of type int and u32, not unsigned char. This led to
a type mismatch when these arguments were passed to snprintf.

To resolve this, the snprintf line was modified to cast these arguments
to unsigned char. This ensures that the arguments are of the correct
type for the '%hhu' format specifier and resolves the warning.

Fixes the below:
>> drivers/gpu/drm/amd/amdgpu/amdgpu_gfx.c:333:4: warning: format
>> specifies type 'unsigned char' but the argument has type 'int'
>> [-Wformat]
xcc_id, ring->me, ring->pipe, ring->queue);
^~
>> drivers/gpu/drm/amd/amdgpu/amdgpu_gfx.c:333:12: warning: format
>> specifies type 'unsigned char' but the argument has type 'u32' (aka
>> 'unsigned int') [-Wformat]
xcc_id, ring->me, ring->pipe, ring->queue);
^~~~
   drivers/gpu/drm/amd/amdgpu/amdgpu_gfx.c:333:22: warning: format specifies 
type 'unsigned char' but the argument has type 'u32' (aka 'unsigned int') 
[-Wformat]
xcc_id, ring->me, ring->pipe, ring->queue);
  ^~
   drivers/gpu/drm/amd/amdgpu/amdgpu_gfx.c:333:34: warning: format specifies 
type 'unsigned char' but the argument has type 'u32' (aka 'unsigned int') 
[-Wformat]
xcc_id, ring->me, ring->pipe, ring->queue);
  ^~~
   4 warnings generated.

Fixes: 0eb430076172 ("drm/amdgpu: Fix snprintf usage in 
amdgpu_gfx_kiq_init_ring")
Reported-by: kernel test robot 
Closes: 
https://lore.kernel.org/oe-kbuild-all/202405250446.xeawe66u-...@intel.com/
Cc: Lijo Lazar 
Cc: Alex Deucher 
Cc: Christian König 
Signed-off-by: Srinivasan Shanmugam 
---
 drivers/gpu/drm/amd/amdgpu/amdgpu_gfx.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_gfx.c 
b/drivers/gpu/drm/amd/amdgpu/amdgpu_gfx.c
index 68505eaa92f9..19b1817b55d7 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_gfx.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_gfx.c
@@ -330,7 +330,8 @@ int amdgpu_gfx_kiq_init_ring(struct amdgpu_device *adev, 
int xcc_id)
ring->eop_gpu_addr = kiq->eop_gpu_addr;
ring->no_scheduler = true;
snprintf(ring->name, sizeof(ring->name), "kiq_%hhu.%hhu.%hhu.%hhu",
-xcc_id, ring->me, ring->pipe, ring->queue);
+(unsigned char)xcc_id, (unsigned char)ring->me,
+(unsigned char)ring->pipe, (unsigned char)ring->queue);
r = amdgpu_ring_init(adev, ring, 1024, irq, AMDGPU_CP_KIQ_IRQ_DRIVER0,
 AMDGPU_RING_PRIO_DEFAULT, NULL);
if (r)
-- 
2.34.1

[RFC PATCH] drm/amdgpu: Refactor sysfs attr functions in AMDGPU for reusability

[Srinivasan Shanmugam]

This commit refactors the sysfs attribute management functions
(`amdgpu_device_attr_create`, `amdgpu_device_attr_remove`,
`amdgpu_device_attr_create_groups`, `amdgpu_device_attr_remove_groups`)
into `amdgpu_sysfs.c`, which were originally in `amdgpu_pm.c`. This
change allows these functions to be reused by other modules like gfx,
pm, etc.

Additionally, the attribute update logic is now encapsulated in the
`pm_update_sysfs_attr` function, which is located in amdgpu_pm.c. This
function is specific to the pm module and is invoked by
amdgpu_device_attr_create for each attribute before the attribute is
created.

The `amdgpu_device_attr_create_groups` function has also been updated to
use `pm_update_syfs_attr`. This ensures that the attribute update logic
is consistently applied to all attributes.

This refactoring enhances the modularity and maintainability of the
code. It also increases the reusability of the attribute management
functions, allowing them to be used by multiple modules.

Cc: Lijo Lazar 
Cc: Alex Deucher 
Cc: Christian König 
Suggested-by: Alex Deucher 
Signed-off-by: Srinivasan Shanmugam 
---
 drivers/gpu/drm/amd/amdgpu/Makefile   |   3 +-
 drivers/gpu/drm/amd/amdgpu/amdgpu_sysfs.c | 112 
 drivers/gpu/drm/amd/amdgpu/amdgpu_sysfs.h |  99 ++
 drivers/gpu/drm/amd/pm/amdgpu_pm.c| 150 +++---
 drivers/gpu/drm/amd/pm/inc/amdgpu_pm.h|  59 -
 5 files changed, 256 insertions(+), 167 deletions(-)
 create mode 100644 drivers/gpu/drm/amd/amdgpu/amdgpu_sysfs.c
 create mode 100644 drivers/gpu/drm/amd/amdgpu/amdgpu_sysfs.h

diff --git a/drivers/gpu/drm/amd/amdgpu/Makefile 
b/drivers/gpu/drm/amd/amdgpu/Makefile
index 1f6b56ec99f6..8c782e26dfcb 100644
--- a/drivers/gpu/drm/amd/amdgpu/Makefile
+++ b/drivers/gpu/drm/amd/amdgpu/Makefile
@@ -81,7 +81,8 @@ amdgpu-y += amdgpu_device.o amdgpu_doorbell_mgr.o 
amdgpu_kms.o \
amdgpu_umc.o smu_v11_0_i2c.o amdgpu_fru_eeprom.o amdgpu_rap.o \
amdgpu_fw_attestation.o amdgpu_securedisplay.o \
amdgpu_eeprom.o amdgpu_mca.o amdgpu_psp_ta.o amdgpu_lsdma.o \
-   amdgpu_ring_mux.o amdgpu_xcp.o amdgpu_seq64.o amdgpu_aca.o 
amdgpu_dev_coredump.o
+   amdgpu_ring_mux.o amdgpu_xcp.o amdgpu_seq64.o amdgpu_aca.o 
amdgpu_dev_coredump.o \
+   amdgpu_sysfs.o
 
 amdgpu-$(CONFIG_PROC_FS) += amdgpu_fdinfo.o
 
diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_sysfs.c 
b/drivers/gpu/drm/amd/amdgpu/amdgpu_sysfs.c
new file mode 100644
index ..bbdf3e8966d5
--- /dev/null
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_sysfs.c
@@ -0,0 +1,112 @@
+// SPDX-License-Identifier: MIT
+/*
+ * Copyright 2017 Advanced Micro Devices, Inc.
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining a
+ * copy of this software and associated documentation files (the "Software"),
+ * to deal in the Software without restriction, including without limitation
+ * the rights to use, copy, modify, merge, publish, distribute, sublicense,
+ * and/or sell copies of the Software, and to permit persons to whom the
+ * Software is furnished to do so, subject to the following conditions:
+ *
+ * The above copyright notice and this permission notice shall be included in
+ * all copies or substantial portions of the Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+ * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.  IN NO EVENT SHALL
+ * THE COPYRIGHT HOLDER(S) OR AUTHOR(S) BE LIABLE FOR ANY CLAIM, DAMAGES OR
+ * OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE,
+ * ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR
+ * OTHER DEALINGS IN THE SOFTWARE.
+ */
+
+#include "amdgpu.h"
+#include "amdgpu_dpm.h"
+#include "amdgpu_drv.h"
+#include "amdgpu_reset.h"
+#include "amdgpu_sysfs.h"
+#include "atom.h"
+#include 
+#include 
+#include 
+#include 
+#include 
+#include 
+
+int amdgpu_sysfs_attr_create(struct amdgpu_device *adev,
+struct amdgpu_device_attr *attr,
+u32 mask, struct list_head *attr_list)
+{
+   int ret;
+   struct amdgpu_device_attr_entry *attr_entry;
+   struct device_attribute *dev_attr;
+   const char *name;
+
+   if (!attr)
+   return -EINVAL;
+
+   dev_attr = >dev_attr;
+   name = dev_attr->attr.name;
+
+   ret = device_create_file(adev->dev, dev_attr);
+   if (ret) {
+   dev_err(adev->dev, "failed to create device file %s, ret = 
%d\n",
+   name, ret);
+   }
+
+   attr_entry = kmalloc(sizeof(*attr_entry), GFP_KERNEL);
+   if (!attr_entry)
+   return -ENOMEM;
+
+   attr_entry->attr = attr;
+   INIT_LIST_HEAD(_entry->entry);
+
+   list_add_tail(_entry-&g

[PATCH] drm/amdgpu/display: Fix null pointer dereference in dc_stream_program_cursor_position

[Srinivasan Shanmugam]

The fix involves adding a null check for 'stream' at the beginning of
the function. If 'stream' is NULL, the function immediately returns
false. This ensures that 'stream' is not NULL when we dereference it to
access 'ctx' in 'dc = stream->ctx->dc;' the function.

Fixes the below:
drivers/gpu/drm/amd/amdgpu/../display/dc/core/dc_stream.c:398 
dc_stream_program_cursor_position()
error: we previously assumed 'stream' could be null (see line 397)

drivers/gpu/drm/amd/amdgpu/../display/dc/core/dc_stream.c
389 bool dc_stream_program_cursor_position(
390 struct dc_stream_state *stream,
391 const struct dc_cursor_position *position)
392 {
393 struct dc *dc;
394 bool reset_idle_optimizations = false;
395 const struct dc_cursor_position *old_position;
396
397 old_position = stream ? >cursor_position : NULL;
   
The patch adds a NULL check

--> 398 dc = stream->ctx->dc;
 
The old code didn't check

399
400 if (dc_stream_set_cursor_position(stream, position)) {
401 dc_z10_restore(dc);
402
403 /* disable idle optimizations if enabling cursor */
404 if (dc->idle_optimizations_allowed &&
405 (!old_position->enable || 
dc->debug.exit_idle_opt_for_cursor_updates) &&
406 position->enable) {
407 dc_allow_idle_optimizations(dc, false);

Fixes: f63f86b5affc ("drm/amd/display: Separate setting and programming of 
cursor")
Reported-by: Dan Carpenter 
Cc: Harry Wentland 
Cc: Tom Chung 
Cc: Rodrigo Siqueira 
Cc: Roman Li 
Cc: Aurabindo Pillai 
Signed-off-by: Srinivasan Shanmugam 
---
 drivers/gpu/drm/amd/display/dc/core/dc_stream.c | 5 -
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/drivers/gpu/drm/amd/display/dc/core/dc_stream.c 
b/drivers/gpu/drm/amd/display/dc/core/dc_stream.c
index de48084eac25..55e1c19b97f1 100644
--- a/drivers/gpu/drm/amd/display/dc/core/dc_stream.c
+++ b/drivers/gpu/drm/amd/display/dc/core/dc_stream.c
@@ -394,7 +394,10 @@ bool dc_stream_program_cursor_position(
bool reset_idle_optimizations = false;
const struct dc_cursor_position *old_position;
 
-   old_position = stream ? >cursor_position : NULL;
+   if (!stream)
+   return false;
+
+   old_position = >cursor_position;
dc = stream->ctx->dc;
 
if (dc_stream_set_cursor_position(stream, position)) {
-- 
2.34.1

[PATCH v2] drm/amdgpu: Fix snprintf usage in amdgpu_gfx_kiq_init_ring

[Srinivasan Shanmugam]

This commit fixes a format truncation issue arosed by the snprintf
function potentially writing more characters into the ring->name buffer
than it can hold, in the amdgpu_gfx_kiq_init_ring function 
  
The issue occurred because the '%d' format specifier could write between
1 and 10 bytes into a region of size between 0 and 8, depending on the
values of xcc_id, ring->me, ring->pipe, and ring->queue. The snprintf
function could output between 12 and 41 bytes into a destination of size
16, leading to potential truncation.  
  
To resolve this, the snprintf line was modified to use the '%hhu' format
specifier for ring->me, ring->pipe, and ring->queue. The '%hhu'
specifier is used for unsigned char variables and ensures that these
values are printed as unsigned decimal integers.

Fixes the below with gcc W=1:
drivers/gpu/drm/amd/amdgpu/amdgpu_gfx.c: In function ‘amdgpu_gfx_kiq_init_ring’:
drivers/gpu/drm/amd/amdgpu/amdgpu_gfx.c:332:61: warning: ‘%d’ directive output 
may be truncated writing between 1 and 10 bytes into a region of size between 0 
and 8 [-Wformat-truncation=]
  332 | snprintf(ring->name, sizeof(ring->name), "kiq_%d.%d.%d.%d",
  | ^~
drivers/gpu/drm/amd/amdgpu/amdgpu_gfx.c:332:50: note: directive argument in the 
range [0, 2147483647]
  332 | snprintf(ring->name, sizeof(ring->name), "kiq_%d.%d.%d.%d",
  |  ^
drivers/gpu/drm/amd/amdgpu/amdgpu_gfx.c:332:9: note: ‘snprintf’ output between 
12 and 41 bytes into a destination of size 16
  332 | snprintf(ring->name, sizeof(ring->name), "kiq_%d.%d.%d.%d",
  | ^~~
  333 |  xcc_id, ring->me, ring->pipe, ring->queue);
  |  ~~

Fixes: 345a36c4f1ba ("drm/amdgpu: prefer snprintf over sprintf")
Cc: Alex Deucher 
Cc: Christian König 
Signed-off-by: Srinivasan Shanmugam 
---
v2:
 - Removed width specifiers %3, %1, typecasting of unsigned char,
   s/hhd/hhu (Lijo)

 drivers/gpu/drm/amd/amdgpu/amdgpu_gfx.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_gfx.c 
b/drivers/gpu/drm/amd/amdgpu/amdgpu_gfx.c
index 9b7dc61c331d..0f14d4a11441 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_gfx.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_gfx.c
@@ -329,7 +329,7 @@ int amdgpu_gfx_kiq_init_ring(struct amdgpu_device *adev, 
int xcc_id)
 
ring->eop_gpu_addr = kiq->eop_gpu_addr;
ring->no_scheduler = true;
-   snprintf(ring->name, sizeof(ring->name), "kiq_%d.%d.%d.%d",
+   snprintf(ring->name, sizeof(ring->name), "kiq_%d.%hhu.%hhu.%hhu",
 xcc_id, ring->me, ring->pipe, ring->queue);
r = amdgpu_ring_init(adev, ring, 1024, irq, AMDGPU_CP_KIQ_IRQ_DRIVER0,
 AMDGPU_RING_PRIO_DEFAULT, NULL);
-- 
2.34.1

[PATCH] drm/amdgpu: Fix snprintf usage in amdgpu_gfx_kiq_init_ring

[Srinivasan Shanmugam]

This commit fixes a format truncation issue arosed by the snprintf
function potentially writing more characters into the ring->name buffer
than it can hold, in the amdgpu_gfx_kiq_init_ring function

The issue occurred because the '%d' format specifier could write between
1 and 10 bytes into a region of size between 0 and 8, depending on the
  values of xcc_id, ring->me, ring->pipe, and ring->queue. The snprintf
function could output between 12 and 41 bytes into a destination of size
16, leading to potential truncation.

To resolve this, the snprintf line was modified to use the '%3d' and
'%1hhd' format specifiers. The '%3d' specifier is used for xcc_id and
ensures that it is always printed with a width of 3 characters. The
'%1hhd' specifier is used for ring->me, ring->pipe, and ring->queue, and
ensures that these values are printed as single digit numbers. This is
achieved by casting these values to unsigned char before passing them to
snprintf, which ensures that these values will always be in the range of
0 to 9.

Fixes the below with gcc W=1:
drivers/gpu/drm/amd/amdgpu/amdgpu_gfx.c: In function ‘amdgpu_gfx_kiq_init_ring’:
drivers/gpu/drm/amd/amdgpu/amdgpu_gfx.c:332:61: warning: ‘%d’ directive output 
may be truncated writing between 1 and 10 bytes into a region of size between 0 
and 8 [-Wformat-truncation=]
  332 | snprintf(ring->name, sizeof(ring->name), "kiq_%d.%d.%d.%d",
  | ^~
drivers/gpu/drm/amd/amdgpu/amdgpu_gfx.c:332:50: note: directive argument in the 
range [0, 2147483647]
  332 | snprintf(ring->name, sizeof(ring->name), "kiq_%d.%d.%d.%d",
  |  ^
drivers/gpu/drm/amd/amdgpu/amdgpu_gfx.c:332:9: note: ‘snprintf’ output between 
12 and 41 bytes into a destination of size 16
  332 | snprintf(ring->name, sizeof(ring->name), "kiq_%d.%d.%d.%d",
  | ^~~
  333 |  xcc_id, ring->me, ring->pipe, ring->queue);
  |  ~~

Fixes: 345a36c4f1ba ("drm/amdgpu: prefer snprintf over sprintf")
Cc: Alex Deucher 
Cc: Christian König 
Signed-off-by: Srinivasan Shanmugam 
---
 drivers/gpu/drm/amd/amdgpu/amdgpu_gfx.c | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_gfx.c 
b/drivers/gpu/drm/amd/amdgpu/amdgpu_gfx.c
index 9b7dc61c331d..88da17c0340b 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_gfx.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_gfx.c
@@ -329,8 +329,9 @@ int amdgpu_gfx_kiq_init_ring(struct amdgpu_device *adev, 
int xcc_id)
 
ring->eop_gpu_addr = kiq->eop_gpu_addr;
ring->no_scheduler = true;
-   snprintf(ring->name, sizeof(ring->name), "kiq_%d.%d.%d.%d",
-xcc_id, ring->me, ring->pipe, ring->queue);
+   snprintf(ring->name, sizeof(ring->name), "kiq_%3d.%1hhd.%1hhd.%1hhd",
+xcc_id, (unsigned char)ring->me, (unsigned char)ring->pipe,
+(unsigned char)ring->queue);
r = amdgpu_ring_init(adev, ring, 1024, irq, AMDGPU_CP_KIQ_IRQ_DRIVER0,
 AMDGPU_RING_PRIO_DEFAULT, NULL);
if (r)
-- 
2.34.1

[PATCH] drm/amdgpu: Remove duplicate check for *is_queue_unmap in sdma_v7_0_ring_set_wptr

[Srinivasan Shanmugam]

This commit removes a duplicate check for *is_queue_unmap in the
sdma_v7_0_ring_set_wptr function. The check at line 171 was considered
dead code because at this point in the code, we already know that
*is_queue_unmap is false due to the check at line 161.

By removing this unnecessary check, improves the readability of the code

Fixes the below:
drivers/gpu/drm/amd/amdgpu/sdma_v7_0.c:171 sdma_v7_0_ring_set_wptr()
warn: duplicate check '*is_queue_unmap' (previous on line 161)

drivers/gpu/drm/amd/amdgpu/sdma_v7_0.c
140 static void sdma_v7_0_ring_set_wptr(struct amdgpu_ring *ring)
141 {
142 struct amdgpu_device *adev = ring->adev;
143 uint32_t *wptr_saved;
144 uint32_t *is_queue_unmap;
145 uint64_t aggregated_db_index;
146 uint32_t mqd_size = adev->mqds[AMDGPU_HW_IP_DMA].mqd_size;
147
148 DRM_DEBUG("Setting write pointer\n");
149
150 if (ring->is_mes_queue) {
151 wptr_saved = (uint32_t *)(ring->mqd_ptr + mqd_size);
152 is_queue_unmap = (uint32_t *)(ring->mqd_ptr + mqd_size +
 Set here

153   sizeof(uint32_t));
154 aggregated_db_index =
155 amdgpu_mes_get_aggregated_doorbell_index(adev,
156  ring->hw_prio);
157
158 atomic64_set((atomic64_t *)ring->wptr_cpu_addr,
159  ring->wptr << 2);
160 *wptr_saved = ring->wptr << 2;
161 if (*is_queue_unmap) {
^^^ Checked here

162 WDOORBELL64(aggregated_db_index, ring->wptr << 
2);
163 DRM_DEBUG("calling WDOORBELL64(0x%08x, 
0x%016llx)\n",
164 ring->doorbell_index, 
ring->wptr << 2);
165 WDOORBELL64(ring->doorbell_index, ring->wptr << 
2);
166 } else {
167 DRM_DEBUG("calling WDOORBELL64(0x%08x, 
0x%016llx)\n",
168 ring->doorbell_index, 
ring->wptr << 2);
169 WDOORBELL64(ring->doorbell_index, ring->wptr << 
2);
170
--> 171 if (*is_queue_unmap)
^^^ This is dead code.  We know 
it's false.

172 WDOORBELL64(aggregated_db_index,
173 ring->wptr << 2);
174 }
175 } else {
176 if (ring->use_doorbell) {
177 DRM_DEBUG("Using doorbell -- "
178   "wptr_offs == 0x%08x "

Fixes: 6d9c711786e6 ("drm/amdgpu: Add sdma v7_0 ip block support (v7)")
Cc: Likun Gao 
Cc: Hawking Zhang 
Cc: Christian König 
Cc: Alex Deucher 
Reported-by: Dan Carpenter 
Signed-off-by: Srinivasan Shanmugam 
---
 drivers/gpu/drm/amd/amdgpu/sdma_v7_0.c | 4 
 1 file changed, 4 deletions(-)

diff --git a/drivers/gpu/drm/amd/amdgpu/sdma_v7_0.c 
b/drivers/gpu/drm/amd/amdgpu/sdma_v7_0.c
index 4a5252e08883..ab1dea77be6e 100644
--- a/drivers/gpu/drm/amd/amdgpu/sdma_v7_0.c
+++ b/drivers/gpu/drm/amd/amdgpu/sdma_v7_0.c
@@ -167,10 +167,6 @@ static void sdma_v7_0_ring_set_wptr(struct amdgpu_ring 
*ring)
DRM_DEBUG("calling WDOORBELL64(0x%08x, 0x%016llx)\n",
ring->doorbell_index, ring->wptr << 2);
WDOORBELL64(ring->doorbell_index, ring->wptr << 2);
-
-   if (*is_queue_unmap)
-   WDOORBELL64(aggregated_db_index,
-   ring->wptr << 2);
}
} else {
if (ring->use_doorbell) {
-- 
2.34.1

[PATCH] drm/amdgpu/display: Update kdoc for 'optc35_set_odm_combine'

[Srinivasan Shanmugam]

The parameters segment_width and last_segment_width are used to control
the configuration of the Output Plane Processor (OPP), specifically the
width of each segment that the display is divided into and the width of
the last segment

Fixes the below with gcc W=1:
drivers/gpu/drm/amd/amdgpu/../display/dc/optc/dcn35/dcn35_optc.c:59: warning: 
Function parameter or struct member 'segment_width' not described in 
'optc35_set_odm_combine'
drivers/gpu/drm/amd/amdgpu/../display/dc/optc/dcn35/dcn35_optc.c:59: warning: 
Function parameter or struct member 'last_segment_width' not described in 
'optc35_set_odm_combine'
drivers/gpu/drm/amd/amdgpu/../display/dc/optc/dcn35/dcn35_optc.c:59: warning: 
Excess function parameter 'timing' description in 'optc35_set_odm_combine'

Cc: Tom Chung 
Cc: Rodrigo Siqueira 
Cc: Roman Li 
Cc: Aurabindo Pillai 
Signed-off-by: Srinivasan Shanmugam 
---
 drivers/gpu/drm/amd/display/dc/optc/dcn35/dcn35_optc.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/drivers/gpu/drm/amd/display/dc/optc/dcn35/dcn35_optc.c 
b/drivers/gpu/drm/amd/display/dc/optc/dcn35/dcn35_optc.c
index 7c9faa507ec2..dfa9364fe5a6 100644
--- a/drivers/gpu/drm/amd/display/dc/optc/dcn35/dcn35_optc.c
+++ b/drivers/gpu/drm/amd/display/dc/optc/dcn35/dcn35_optc.c
@@ -50,7 +50,8 @@
  * @optc: Output Pipe Timing Combine instance reference.
  * @opp_id: Output Plane Processor instance ID.
  * @opp_cnt: Output Plane Processor count.
- * @timing: Timing parameters used to configure DCN blocks.
+ * @segment_width: Width of the segment.
+ * @last_segment_width: Width of the last segment.
  *
  * Return: void.
  */
-- 
2.34.1

[PATCH v3] drm/amd/display: Refactor construct_phy function in dc/link/link_factory.c

[Srinivasan Shanmugam]

This commit modifies the construct_phy function to handle the case where
`bios->integrated_info` is NULL and to address a compiler warning about
a large stack allocation.

Upon examination, it was found that the local `integrated_info`
structure was just used to copy values which is large and was being
declared directly on the stack which could potentially lead to
performance issues. This commit changes the code to use
`bios->integrated_info` directly, which avoids the need for a large
stack allocation.

The function now checks if `bios->integrated_info` is NULL before
entering a for loop that uses it. If `bios->integrated_info` is NULL,
the function skips the for loop and continues executing the rest of the
code. This ensures that the function behaves correctly when
`bios->integrated_info` is NULL and improves compatibility with dGPUs.

Fixes the below with gcc W=1:
drivers/gpu/drm/amd/amdgpu/../display/dc/link/link_factory.c: In function 
‘construct_phy’:
drivers/gpu/drm/amd/amdgpu/../display/dc/link/link_factory.c:743:1: warning: 
the frame size of 1056 bytes is larger than 1024 bytes [-Wframe-larger-than=]

Cc: Wenjing Liu 
Cc: Jerry Zuo 
Cc: Qingqing Zhuo 
Cc: Tom Chung 
Cc: Alvin Lee 
Cc: Rodrigo Siqueira 
Cc: Roman Li 
Cc: Hersen Wu 
Cc: Alex Hung 
Cc: Aurabindo Pillai 
Cc: Harry Wentland 
Signed-off-by: Srinivasan Shanmugam 
Suggested-by: Wenjing Liu 
---
v3:
 - Directly used bios->integrated_info instead of integrated_info to
   avoid large copying (Wenjing)

 .../drm/amd/display/dc/link/link_factory.c| 67 ++-
 1 file changed, 34 insertions(+), 33 deletions(-)

diff --git a/drivers/gpu/drm/amd/display/dc/link/link_factory.c 
b/drivers/gpu/drm/amd/display/dc/link/link_factory.c
index 2c3f5d662285..8073fdae9cb1 100644
--- a/drivers/gpu/drm/amd/display/dc/link/link_factory.c
+++ b/drivers/gpu/drm/amd/display/dc/link/link_factory.c
@@ -456,7 +456,6 @@ static bool construct_phy(struct dc_link *link,
struct dc_context *dc_ctx = init_params->ctx;
struct encoder_init_data enc_init_data = { 0 };
struct panel_cntl_init_data panel_cntl_init_data = { 0 };
-   struct integrated_info info = { 0 };
struct dc_bios *bios = init_params->dc->ctx->dc_bios;
const struct dc_vbios_funcs *bp_funcs = bios->funcs;
struct bp_disp_connector_caps_info disp_connect_caps_info = { 0 };
@@ -671,42 +670,44 @@ static bool construct_phy(struct dc_link *link,
break;
}
 
-   if (bios->integrated_info)
-   info = *bios->integrated_info;
-
-   /* Look for channel mapping corresponding to connector and device tag */
-   for (i = 0; i < MAX_NUMBER_OF_EXT_DISPLAY_PATH; i++) {
-   struct external_display_path *path =
-   _disp_conn_info.path[i];
-
-   if (path->device_connector_id.enum_id == link->link_id.enum_id 
&&
-   path->device_connector_id.id == link->link_id.id &&
-   path->device_connector_id.type == link->link_id.type) {
-   if (link->device_tag.acpi_device != 0 &&
-   path->device_acpi_enum == 
link->device_tag.acpi_device) {
-   link->ddi_channel_mapping = 
path->channel_mapping;
-   link->chip_caps = path->caps;
-   DC_LOG_DC("BIOS object table - 
ddi_channel_mapping: 0x%04X", link->ddi_channel_mapping.raw);
-   DC_LOG_DC("BIOS object table - chip_caps: %d", 
link->chip_caps);
-   } else if (path->device_tag ==
-  link->device_tag.dev_id.raw_device_tag) {
-   link->ddi_channel_mapping = 
path->channel_mapping;
-   link->chip_caps = path->caps;
-   DC_LOG_DC("BIOS object table - 
ddi_channel_mapping: 0x%04X", link->ddi_channel_mapping.raw);
-   DC_LOG_DC("BIOS object table - chip_caps: %d", 
link->chip_caps);
-   }
+   if (bios->integrated_info) {
+   /* Look for channel mapping corresponding to connector and 
device tag */
+   for (i = 0; i < MAX_NUMBER_OF_EXT_DISPLAY_PATH; i++) {
+   struct external_display_path *path =
+   
>integrated_info->ext_disp_conn_info.path[i];
+
+   if (path->device_connector_id.enum_id == 
link->link_id.enum_id &&
+   path->device_connector_id.id == link->link_id.id &&
+   path->device_connector_id.type == 
link->link_id.type) {
+   if (link->device_tag.acpi_device != 0 &&

[PATCH] drm/amdgpu: Fix truncation by resizing ucode_prefix in imu_v12_0_init_microcode

[Srinivasan Shanmugam]

This commit fixes potential truncation when writing the string _imu.bin
into the fw_name buffer in the imu_v12_0_init_microcode function in the
imu_v12_0.c file

The ucode_prefix size was reduced from 30 to 15 to ensure the snprintf
function does not exceed the size of the fw_name buffer.

Thus fixing the below with gcc W=1:
drivers/gpu/drm/amd/amdgpu/imu_v12_0.c: In function ‘imu_v12_0_init_microcode’:
drivers/gpu/drm/amd/amdgpu/imu_v12_0.c:51:54: warning: ‘_imu.bin’ directive 
output may be truncated writing 8 bytes into a region of size between 4 and 33 
[-Wformat-truncation=]
   51 | snprintf(fw_name, sizeof(fw_name), "amdgpu/%s_imu.bin", 
ucode_prefix);
  |  ^~~~
drivers/gpu/drm/amd/amdgpu/imu_v12_0.c:51:9: note: ‘snprintf’ output between 16 
and 45 bytes into a destination of size 40
   51 | snprintf(fw_name, sizeof(fw_name), "amdgpu/%s_imu.bin", 
ucode_prefix);
  | 
^

Cc: Lijo Lazar 
Cc: Christian König 
Cc: Alex Deucher 
Signed-off-by: Srinivasan Shanmugam 
---
 drivers/gpu/drm/amd/amdgpu/imu_v12_0.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/gpu/drm/amd/amdgpu/imu_v12_0.c 
b/drivers/gpu/drm/amd/amdgpu/imu_v12_0.c
index ec2a4613567a..032ae12b2be2 100644
--- a/drivers/gpu/drm/amd/amdgpu/imu_v12_0.c
+++ b/drivers/gpu/drm/amd/amdgpu/imu_v12_0.c
@@ -39,7 +39,7 @@ MODULE_FIRMWARE("amdgpu/gc_12_0_1_imu.bin");
 static int imu_v12_0_init_microcode(struct amdgpu_device *adev)
 {
char fw_name[40];
-   char ucode_prefix[30];
+   char ucode_prefix[15];
int err;
const struct imu_firmware_header_v1_0 *imu_hdr;
struct amdgpu_firmware_info *info = NULL;
-- 
2.34.1

[PATCH] drm/amdgpu: Fix buffer size to prevent truncation in gfx_v12_0_init_microcode

[Srinivasan Shanmugam]

This commit addresses multiple warnings in the gfx_v12_0_init_microcode
function in the gfx_v12_0.c file. The warnings were related to potential
truncation when writing the strings _pfp.bin, _me.bin, _rlc.bin, and
_mec.bin into the fw_name buffer.

This commit fixes multiple potential truncations when writing the
strings _pfp.bin, _me.bin, _rlc.bin, and _mec.bin into the fw_name
buffer in the gfx_v12_0_init_microcode function in the gfx_v12_0.c file

The ucode_prefix size was reduced from 30 to 15 to ensure the snprintf
function does not exceed the size of the fw_name buffer.

Thus fixing the below with gcc W=1:
drivers/gpu/drm/amd/amdgpu/gfx_v12_0.c: In function ‘gfx_v12_0_early_init’:
drivers/gpu/drm/amd/amdgpu/gfx_v12_0.c:421:54: warning: ‘_pfp.bin’ directive 
output may be truncated writing 8 bytes into a region of size between 4 and 33 
[-Wformat-truncation=]
  421 | snprintf(fw_name, sizeof(fw_name), "amdgpu/%s_pfp.bin", 
ucode_prefix);
  |  ^~~~
drivers/gpu/drm/amd/amdgpu/gfx_v12_0.c:421:9: note: ‘snprintf’ output between 
16 and 45 bytes into a destination of size 40
  421 | snprintf(fw_name, sizeof(fw_name), "amdgpu/%s_pfp.bin", 
ucode_prefix);
  | 
^
drivers/gpu/drm/amd/amdgpu/gfx_v12_0.c:428:54: warning: ‘_me.bin’ directive 
output may be truncated writing 7 bytes into a region of size between 4 and 33 
[-Wformat-truncation=]
  428 | snprintf(fw_name, sizeof(fw_name), "amdgpu/%s_me.bin", 
ucode_prefix);
  |  ^~~
drivers/gpu/drm/amd/amdgpu/gfx_v12_0.c:428:9: note: ‘snprintf’ output between 
15 and 44 bytes into a destination of size 40
  428 | snprintf(fw_name, sizeof(fw_name), "amdgpu/%s_me.bin", 
ucode_prefix);
  | 
^~~~
drivers/gpu/drm/amd/amdgpu/gfx_v12_0.c:436:62: warning: ‘_rlc.bin’ directive 
output may be truncated writing 8 bytes into a region of size between 4 and 33 
[-Wformat-truncation=]
  436 | snprintf(fw_name, sizeof(fw_name), "amdgpu/%s_rlc.bin", 
ucode_prefix);
  |  ^~~~
drivers/gpu/drm/amd/amdgpu/gfx_v12_0.c:436:17: note: ‘snprintf’ output between 
16 and 45 bytes into a destination of size 40
  436 | snprintf(fw_name, sizeof(fw_name), "amdgpu/%s_rlc.bin", 
ucode_prefix);
  | 
^
drivers/gpu/drm/amd/amdgpu/gfx_v12_0.c:448:54: warning: ‘_mec.bin’ directive 
output may be truncated writing 8 bytes into a region of size between 4 and 33 
[-Wformat-truncation=]
  448 | snprintf(fw_name, sizeof(fw_name), "amdgpu/%s_mec.bin", 
ucode_prefix);
  |  ^~~~
drivers/gpu/drm/amd/amdgpu/gfx_v12_0.c:448:9: note: ‘snprintf’ output between 
16 and 45 bytes into a destination of size 40
  448 | snprintf(fw_name, sizeof(fw_name), "amdgpu/%s_mec.bin", 
ucode_prefix);
  | 
^

Cc: Lijo Lazar 
Cc: Christian König 
Cc: Alex Deucher 
Signed-off-by: Srinivasan Shanmugam 
---
 drivers/gpu/drm/amd/amdgpu/gfx_v12_0.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/gpu/drm/amd/amdgpu/gfx_v12_0.c 
b/drivers/gpu/drm/amd/amdgpu/gfx_v12_0.c
index b53ca25012e6..b6e5a2230622 100644
--- a/drivers/gpu/drm/amd/amdgpu/gfx_v12_0.c
+++ b/drivers/gpu/drm/amd/amdgpu/gfx_v12_0.c
@@ -408,7 +408,7 @@ static int gfx_v12_0_init_toc_microcode(struct 
amdgpu_device *adev, const char *
 static int gfx_v12_0_init_microcode(struct amdgpu_device *adev)
 {
char fw_name[40];
-   char ucode_prefix[30];
+   char ucode_prefix[15];
int err;
const struct rlc_firmware_header_v2_0 *rlc_hdr;
uint16_t version_major;
-- 
2.34.1

[PATCH v2] drm/amd/display: Refactor construct_phy function in dc/link/link_factory.c

[Srinivasan Shanmugam]

This commit refactors the construct_phy function. The original function
was large and complex.

The following functions were created:

- initialize_link: Handles the initial setup of the link object.
- handle_connector_type: Sets the connector_signal and irq_source_hpd_rx
  based on the link_id.id.
- initialize_ddc_service: Initializes the ddc_service for the link.
- initialize_link_encoder: Initializes the link_encoder for the link.

Additionally, the error handling code that was originally in
construct_phy has been moved to the new functions. Each function now
returns a boolean value indicating whether the operation was successful.
If an error occurs, the construct_phy function jumps to the appropriate
label for error handling.

This refactoring reduces the size of the stack frame for each individual
function, fixes about the frame size being larger than 1024 bytes.

Fixes the below with gcc W=1:
drivers/gpu/drm/amd/amdgpu/../display/dc/link/link_factory.c: In function 
‘construct_phy’:
drivers/gpu/drm/amd/amdgpu/../display/dc/link/link_factory.c:743:1: warning: 
the frame size of 1056 bytes is larger than 1024 bytes [-Wframe-larger-than=]

Cc: Wenjing Liu 
Cc: Qingqing Zhuo 
Cc: Tom Chung 
Cc: Alvin Lee 
Cc: Rodrigo Siqueira 
Cc: Roman Li 
Cc: Hersen Wu 
Cc: Alex Hung 
Cc: Aurabindo Pillai 
Cc: Harry Wentland 
Signed-off-by: Srinivasan Shanmugam 
---
v2:
 - "The handle_connector_type function is called within the
construct_phy function. If it encounters an unsupported connector
type, it returns false, maintained same as original logic before
refactoring"

 .../drm/amd/display/dc/link/link_factory.c| 223 ++
 1 file changed, 124 insertions(+), 99 deletions(-)

diff --git a/drivers/gpu/drm/amd/display/dc/link/link_factory.c 
b/drivers/gpu/drm/amd/display/dc/link/link_factory.c
index cf22b8f28ba6..4ed8e170ebc5 100644
--- a/drivers/gpu/drm/amd/display/dc/link/link_factory.c
+++ b/drivers/gpu/drm/amd/display/dc/link/link_factory.c
@@ -448,73 +448,74 @@ static enum channel_id get_ddc_line(struct dc_link *link)
return channel;
 }
 
-static bool construct_phy(struct dc_link *link,
- const struct link_init_data *init_params)
+static bool initialize_link_encoder(struct dc_link *link,
+   struct dc_context *dc_ctx,
+   const struct dc_vbios_funcs *bp_funcs)
 {
-   uint8_t i;
-   struct ddc_service_init_data ddc_service_init_data = { 0 };
-   struct dc_context *dc_ctx = init_params->ctx;
struct encoder_init_data enc_init_data = { 0 };
-   struct panel_cntl_init_data panel_cntl_init_data = { 0 };
-   struct integrated_info info = { 0 };
-   struct dc_bios *bios = init_params->dc->ctx->dc_bios;
-   const struct dc_vbios_funcs *bp_funcs = bios->funcs;
-   struct bp_disp_connector_caps_info disp_connect_caps_info = { 0 };
 
-   DC_LOGGER_INIT(dc_ctx->logger);
+   enc_init_data.ctx = dc_ctx;
+   bp_funcs->get_src_obj(dc_ctx->dc_bios, link->link_id, 0, 
_init_data.encoder);
+   enc_init_data.connector = link->link_id;
+   enc_init_data.channel = get_ddc_line(link);
+   enc_init_data.hpd_source = get_hpd_line(link);
 
-   link->irq_source_hpd = DC_IRQ_SOURCE_INVALID;
-   link->irq_source_hpd_rx = DC_IRQ_SOURCE_INVALID;
-   link->link_status.dpcd_caps = >dpcd_caps;
+   link->hpd_src = enc_init_data.hpd_source;
 
-   link->dc = init_params->dc;
-   link->ctx = dc_ctx;
-   link->link_index = init_params->link_index;
+   enc_init_data.transmitter = 
translate_encoder_to_transmitter(enc_init_data.encoder);
+   link->link_enc = link->dc->res_pool->funcs->link_enc_create(dc_ctx, 
_init_data);
 
-   memset(>preferred_training_settings, 0,
-  sizeof(struct dc_link_training_overrides));
-   memset(>preferred_link_setting, 0,
-  sizeof(struct dc_link_settings));
-
-   link->link_id =
-   bios->funcs->get_connector_id(bios, 
init_params->connector_index);
+   DC_LOG_DC("BIOS object table - DP_IS_USB_C: %d",
+ link->link_enc->features.flags.bits.DP_IS_USB_C);
+   DC_LOG_DC("BIOS object table - IS_DP2_CAPABLE: %d",
+ link->link_enc->features.flags.bits.IS_DP2_CAPABLE);
 
-   link->ep_type = DISPLAY_ENDPOINT_PHY;
+   if (!link->link_enc) {
+   DC_ERROR("Failed to create link encoder!\n");
+   return false;
+   }
 
-   DC_LOG_DC("BIOS object table - link_id: %d", link->link_id.id);
+   /* Update link encoder tracking variables. These are used for the 
dynamic
+* assignment of link encoders to streams.
+*/
+   link->eng_id = link->link_enc->preferred_engine;
+   link->dc->

[PATCH] drm/amd/display: Refactor construct_phy function in dc/link/link_factory.c

[Srinivasan Shanmugam]

This commit refactors the construct_phy function. The original function
was large and complex.

The following functions were created:

- initialize_link: Handles the initial setup of the link object.
- handle_connector_type: Sets the connector_signal and irq_source_hpd_rx
  based on the link_id.id.
- initialize_ddc_service: Initializes the ddc_service for the link.
- initialize_link_encoder: Initializes the link_encoder for the link.

Additionally, the error handling code that was originally in
construct_phy has been moved to the new functions. Each function now
returns a boolean value indicating whether the operation was successful.
If an error occurs, the construct_phy function jumps to the appropriate
label for error handling.

This refactoring reduces the size of the stack frame for each individual
function, fixes about the frame size being larger than 1024 bytes.

Fixes the below with gcc W=1:
drivers/gpu/drm/amd/amdgpu/../display/dc/link/link_factory.c: In function 
‘construct_phy’:
drivers/gpu/drm/amd/amdgpu/../display/dc/link/link_factory.c:743:1: warning: 
the frame size of 1056 bytes is larger than 1024 bytes [-Wframe-larger-than=]

Cc: Wenjing Liu 
Cc: Qingqing Zhuo 
Cc: Tom Chung 
Cc: Alvin Lee 
Cc: Rodrigo Siqueira 
Cc: Roman Li 
Cc: Hersen Wu 
Cc: Alex Hung 
Cc: Aurabindo Pillai 
Cc: Harry Wentland 
Signed-off-by: Srinivasan Shanmugam 
---
 .../drm/amd/display/dc/link/link_factory.c| 221 ++
 1 file changed, 122 insertions(+), 99 deletions(-)

diff --git a/drivers/gpu/drm/amd/display/dc/link/link_factory.c 
b/drivers/gpu/drm/amd/display/dc/link/link_factory.c
index cf22b8f28ba6..af373824db8c 100644
--- a/drivers/gpu/drm/amd/display/dc/link/link_factory.c
+++ b/drivers/gpu/drm/amd/display/dc/link/link_factory.c
@@ -448,73 +448,74 @@ static enum channel_id get_ddc_line(struct dc_link *link)
return channel;
 }
 
-static bool construct_phy(struct dc_link *link,
- const struct link_init_data *init_params)
+static bool initialize_link_encoder(struct dc_link *link,
+   struct dc_context *dc_ctx,
+   const struct dc_vbios_funcs *bp_funcs)
 {
-   uint8_t i;
-   struct ddc_service_init_data ddc_service_init_data = { 0 };
-   struct dc_context *dc_ctx = init_params->ctx;
struct encoder_init_data enc_init_data = { 0 };
-   struct panel_cntl_init_data panel_cntl_init_data = { 0 };
-   struct integrated_info info = { 0 };
-   struct dc_bios *bios = init_params->dc->ctx->dc_bios;
-   const struct dc_vbios_funcs *bp_funcs = bios->funcs;
-   struct bp_disp_connector_caps_info disp_connect_caps_info = { 0 };
 
-   DC_LOGGER_INIT(dc_ctx->logger);
+   enc_init_data.ctx = dc_ctx;
+   bp_funcs->get_src_obj(dc_ctx->dc_bios, link->link_id, 0, 
_init_data.encoder);
+   enc_init_data.connector = link->link_id;
+   enc_init_data.channel = get_ddc_line(link);
+   enc_init_data.hpd_source = get_hpd_line(link);
 
-   link->irq_source_hpd = DC_IRQ_SOURCE_INVALID;
-   link->irq_source_hpd_rx = DC_IRQ_SOURCE_INVALID;
-   link->link_status.dpcd_caps = >dpcd_caps;
+   link->hpd_src = enc_init_data.hpd_source;
 
-   link->dc = init_params->dc;
-   link->ctx = dc_ctx;
-   link->link_index = init_params->link_index;
+   enc_init_data.transmitter = 
translate_encoder_to_transmitter(enc_init_data.encoder);
+   link->link_enc = link->dc->res_pool->funcs->link_enc_create(dc_ctx, 
_init_data);
 
-   memset(>preferred_training_settings, 0,
-  sizeof(struct dc_link_training_overrides));
-   memset(>preferred_link_setting, 0,
-  sizeof(struct dc_link_settings));
-
-   link->link_id =
-   bios->funcs->get_connector_id(bios, 
init_params->connector_index);
+   DC_LOG_DC("BIOS object table - DP_IS_USB_C: %d",
+ link->link_enc->features.flags.bits.DP_IS_USB_C);
+   DC_LOG_DC("BIOS object table - IS_DP2_CAPABLE: %d",
+ link->link_enc->features.flags.bits.IS_DP2_CAPABLE);
 
-   link->ep_type = DISPLAY_ENDPOINT_PHY;
+   if (!link->link_enc) {
+   DC_ERROR("Failed to create link encoder!\n");
+   return false;
+   }
 
-   DC_LOG_DC("BIOS object table - link_id: %d", link->link_id.id);
+   /* Update link encoder tracking variables. These are used for the 
dynamic
+* assignment of link encoders to streams.
+*/
+   link->eng_id = link->link_enc->preferred_engine;
+   link->dc->res_pool->link_encoders[link->eng_id - ENGINE_ID_DIGA] = 
link->link_enc;
+   link->dc->res_pool->dig_link_enc_count++;
 
-   if (bios->funcs->get_disp_connector_caps_info) {
-   bios->funcs-&

[PATCH v2] drm/amdgpu: Fix buffer size in gfx_v9_4_3_init_ cp_compute_microcode() and rlc_microcode()

[Srinivasan Shanmugam]

The function gfx_v9_4_3_init_microcode in gfx_v9_4_3.c was generating
about potential truncation of output when using the snprintf function.
The issue was due to the size of the buffer 'ucode_prefix' being too
small to accommodate the maximum possible length of the string being
written into it.

The string being written is "amdgpu/%s_mec.bin" or "amdgpu/%s_rlc.bin",
where %s is replaced by the value of 'chip_name'. The length of this
string without the %s is 16 characters. The warning message indicated
that 'chip_name' could be up to 29 characters long, resulting in a total
of 45 characters, which exceeds the buffer size of 30 characters.

To resolve this issue, the size of the 'ucode_prefix' buffer has been
reduced from 30 to 15. This ensures that the maximum possible length of
the string being written into the buffer will not exceed its size, thus
preventing potential buffer overflow and truncation issues.

Fixes the below with gcc W=1:
drivers/gpu/drm/amd/amdgpu/gfx_v9_4_3.c: In function ‘gfx_v9_4_3_early_init’:
drivers/gpu/drm/amd/amdgpu/gfx_v9_4_3.c:379:52: warning: ‘%s’ directive output 
may be truncated writing up to 29 bytes into a region of size 23 
[-Wformat-truncation=]
  379 | snprintf(fw_name, sizeof(fw_name), "amdgpu/%s_rlc.bin", 
chip_name);
  |^~
..
  439 | r = gfx_v9_4_3_init_rlc_microcode(adev, ucode_prefix);
  | 
drivers/gpu/drm/amd/amdgpu/gfx_v9_4_3.c:379:9: note: ‘snprintf’ output between 
16 and 45 bytes into a destination of size 30
  379 | snprintf(fw_name, sizeof(fw_name), "amdgpu/%s_rlc.bin", 
chip_name);
  | 
^~
drivers/gpu/drm/amd/amdgpu/gfx_v9_4_3.c:413:52: warning: ‘%s’ directive output 
may be truncated writing up to 29 bytes into a region of size 23 
[-Wformat-truncation=]
  413 | snprintf(fw_name, sizeof(fw_name), "amdgpu/%s_mec.bin", 
chip_name);
  |^~
..
  443 | r = gfx_v9_4_3_init_cp_compute_microcode(adev, ucode_prefix);
  |
drivers/gpu/drm/amd/amdgpu/gfx_v9_4_3.c:413:9: note: ‘snprintf’ output between 
16 and 45 bytes into a destination of size 30
  413 | snprintf(fw_name, sizeof(fw_name), "amdgpu/%s_mec.bin", 
chip_name);
  | 
^~

Fixes: 86301129698b ("drm/amdgpu: split gc v9_4_3 functionality from gc v9_0")
Cc: Hawking Zhang 
Cc: Christian König 
Cc: Alex Deucher 
Cc: Lijo Lazar 
Signed-off-by: Srinivasan Shanmugam 
Suggested-by: Lijo Lazar 
---
v2:
 - reduced the size in ucode_prefix to 15 instead of changing size in
   fw_name (Lijo)

 drivers/gpu/drm/amd/amdgpu/gfx_v9_4_3.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/gpu/drm/amd/amdgpu/gfx_v9_4_3.c 
b/drivers/gpu/drm/amd/amdgpu/gfx_v9_4_3.c
index 0e429b7ed036..7b16e8cca86a 100644
--- a/drivers/gpu/drm/amd/amdgpu/gfx_v9_4_3.c
+++ b/drivers/gpu/drm/amd/amdgpu/gfx_v9_4_3.c
@@ -431,7 +431,7 @@ static int gfx_v9_4_3_init_cp_compute_microcode(struct 
amdgpu_device *adev,
 
 static int gfx_v9_4_3_init_microcode(struct amdgpu_device *adev)
 {
-   char ucode_prefix[30];
+   char ucode_prefix[15];
int r;
 
amdgpu_ucode_ip_version_decode(adev, GC_HWIP, ucode_prefix, 
sizeof(ucode_prefix));
-- 
2.34.1

[PATCH v2] drm/amd/display: Remove redundant NULL check in dcn10_set_input_transfer_func

[Srinivasan Shanmugam]

This commit removes an unnecessary NULL check in the
`dcn10_set_input_transfer_func` function in the `dcn10_hwseq.c` file.
The variable `tf` is assigned the address of
`plane_state->in_transfer_func` unconditionally, so it can never be
`NULL`. Therefore, the check `if (tf == NULL)` is unnecessary and has
been removed.

Fixes the below smatch warning:
drivers/gpu/drm/amd/amdgpu/../display/dc/hwss/dcn10/dcn10_hwseq.c:1839 
dcn10_set_input_transfer_func() warn: address of 
'plane_state->in_transfer_func' is non-NULL

Fixes: 285a7054bf81 ("drm/amd/display: Remove plane and stream pointers from dc 
scratch")
Cc: Wenjing Liu 
Cc: Tom Chung 
Cc: Alvin Lee 
Cc: Rodrigo Siqueira 
Cc: Roman Li 
Cc: Hersen Wu 
Cc: Alex Hung 
Cc: Aurabindo Pillai 
Cc: Harry Wentland 
Suggested-by: Dan Carpenter 
Signed-off-by: Srinivasan Shanmugam 
---
v2:
  - s/dcn20/dcn10 in commit title

 drivers/gpu/drm/amd/display/dc/hwss/dcn10/dcn10_hwseq.c | 4 +---
 1 file changed, 1 insertion(+), 3 deletions(-)

diff --git a/drivers/gpu/drm/amd/display/dc/hwss/dcn10/dcn10_hwseq.c 
b/drivers/gpu/drm/amd/display/dc/hwss/dcn10/dcn10_hwseq.c
index 32a07ab74c51..f258914a4838 100644
--- a/drivers/gpu/drm/amd/display/dc/hwss/dcn10/dcn10_hwseq.c
+++ b/drivers/gpu/drm/amd/display/dc/hwss/dcn10/dcn10_hwseq.c
@@ -1837,9 +1837,7 @@ bool dcn10_set_input_transfer_func(struct dc *dc, struct 
pipe_ctx *pipe_ctx,
&& dce_use_lut(plane_state->format))
dpp_base->funcs->dpp_program_input_lut(dpp_base, 
_state->gamma_correction);
 
-   if (tf == NULL)
-   dpp_base->funcs->dpp_set_degamma(dpp_base, 
IPP_DEGAMMA_MODE_BYPASS);
-   else if (tf->type == TF_TYPE_PREDEFINED) {
+   if (tf->type == TF_TYPE_PREDEFINED) {
switch (tf->tf) {
case TRANSFER_FUNCTION_SRGB:
dpp_base->funcs->dpp_set_degamma(dpp_base, 
IPP_DEGAMMA_MODE_HW_sRGB);
-- 
2.34.1

[PATCH] drm/amd/display: Remove redundant NULL check in dce110_set_input_transfer_func

[Srinivasan Shanmugam]

This commit removes a redundant NULL check in the
`dce110_set_input_transfer_func` function in the `dce110_hwseq.c` file.
The variable `tf` is assigned the address of
`plane_state->in_transfer_func` unconditionally, so it can never be
`NULL`. Therefore, the check `if (tf == NULL)` is unnecessary and has
been removed.

Fixes the below smatch warning:
drivers/gpu/drm/amd/amdgpu/../display/dc/hwss/dce110/dce110_hwseq.c:301 
dce110_set_input_transfer_func() warn: address of 
'plane_state->in_transfer_func' is non-NULL

Fixes: 285a7054bf81 ("drm/amd/display: Remove plane and stream pointers from dc 
scratch")
Cc: Wenjing Liu 
Cc: Tom Chung 
Cc: Alvin Lee 
Cc: Rodrigo Siqueira 
Cc: Roman Li 
Cc: Hersen Wu 
Cc: Alex Hung 
Cc: Aurabindo Pillai 
Cc: Harry Wentland 
Suggested-by: Dan Carpenter 
Signed-off-by: Srinivasan Shanmugam 
---
 drivers/gpu/drm/amd/display/dc/hwss/dce110/dce110_hwseq.c | 5 +
 1 file changed, 1 insertion(+), 4 deletions(-)

diff --git a/drivers/gpu/drm/amd/display/dc/hwss/dce110/dce110_hwseq.c 
b/drivers/gpu/drm/amd/display/dc/hwss/dce110/dce110_hwseq.c
index 5920d1825a4c..8e50a5432d33 100644
--- a/drivers/gpu/drm/amd/display/dc/hwss/dce110/dce110_hwseq.c
+++ b/drivers/gpu/drm/amd/display/dc/hwss/dce110/dce110_hwseq.c
@@ -298,10 +298,7 @@ dce110_set_input_transfer_func(struct dc *dc, struct 
pipe_ctx *pipe_ctx,
dce_use_lut(plane_state->format))
ipp->funcs->ipp_program_input_lut(ipp, 
_state->gamma_correction);
 
-   if (tf == NULL) {
-   /* Default case if no input transfer function specified */
-   ipp->funcs->ipp_set_degamma(ipp, IPP_DEGAMMA_MODE_HW_sRGB);
-   } else if (tf->type == TF_TYPE_PREDEFINED) {
+   if (tf->type == TF_TYPE_PREDEFINED) {
switch (tf->tf) {
case TRANSFER_FUNCTION_SRGB:
ipp->funcs->ipp_set_degamma(ipp, 
IPP_DEGAMMA_MODE_HW_sRGB);
-- 
2.34.1

[PATCH] drm/amd/display: Remove redundant NULL check in dcn20_set_input_transfer_func

[Srinivasan Shanmugam]

This commit removes an unnecessary NULL check in the
`dcn10_set_input_transfer_func` function in the `dcn10_hwseq.c` file.
The variable `tf` is assigned the address of
`plane_state->in_transfer_func` unconditionally, so it can never be
`NULL`. Therefore, the check `if (tf == NULL)` is unnecessary and has
been removed.

Fixes the below smatch warning:
drivers/gpu/drm/amd/amdgpu/../display/dc/hwss/dcn10/dcn10_hwseq.c:1839 
dcn10_set_input_transfer_func() warn: address of 
'plane_state->in_transfer_func' is non-NULL

Fixes: 285a7054bf81 ("drm/amd/display: Remove plane and stream pointers from dc 
scratch")
Cc: Wenjing Liu 
Cc: Tom Chung 
Cc: Alvin Lee 
Cc: Rodrigo Siqueira 
Cc: Roman Li 
Cc: Hersen Wu 
Cc: Alex Hung 
Cc: Aurabindo Pillai 
Cc: Harry Wentland 
Suggested-by: Dan Carpenter 
Signed-off-by: Srinivasan Shanmugam 
---
 drivers/gpu/drm/amd/display/dc/hwss/dcn10/dcn10_hwseq.c | 4 +---
 1 file changed, 1 insertion(+), 3 deletions(-)

diff --git a/drivers/gpu/drm/amd/display/dc/hwss/dcn10/dcn10_hwseq.c 
b/drivers/gpu/drm/amd/display/dc/hwss/dcn10/dcn10_hwseq.c
index 36f7b19c01ca..42f4bb45180c 100644
--- a/drivers/gpu/drm/amd/display/dc/hwss/dcn10/dcn10_hwseq.c
+++ b/drivers/gpu/drm/amd/display/dc/hwss/dcn10/dcn10_hwseq.c
@@ -1837,9 +1837,7 @@ bool dcn10_set_input_transfer_func(struct dc *dc, struct 
pipe_ctx *pipe_ctx,
&& dce_use_lut(plane_state->format))
dpp_base->funcs->dpp_program_input_lut(dpp_base, 
_state->gamma_correction);
 
-   if (tf == NULL)
-   dpp_base->funcs->dpp_set_degamma(dpp_base, 
IPP_DEGAMMA_MODE_BYPASS);
-   else if (tf->type == TF_TYPE_PREDEFINED) {
+   if (tf->type == TF_TYPE_PREDEFINED) {
switch (tf->tf) {
case TRANSFER_FUNCTION_SRGB:
dpp_base->funcs->dpp_set_degamma(dpp_base, 
IPP_DEGAMMA_MODE_HW_sRGB);
-- 
2.34.1

[PATCH] drm/amd/display: Remove unnecessary NULL check in dcn20_set_input_transfer_func

[Srinivasan Shanmugam]

This commit removes an unnecessary NULL check in the
`dcn20_set_input_transfer_func` function in the `dcn20_hwseq.c` file.
The variable `tf` is assigned the address of
`plane_state->in_transfer_func` unconditionally, so it can never be
`NULL`. Therefore, the check `if (tf == NULL)` is unnecessary and has
been removed.

The plane_state->in_transfer_func itself cannot be NULL because it's a
structure, not a pointer. When we do tf =
_state->in_transfer_func;, we're getting the address of that
structure, which will always be valid as long as plane_state itself is
not NULL.

we've already checked if plane_state is NULL with the line if (dpp_base
== NULL || plane_state == NULL) return false;. So, if the code execution
gets to the point where tf = _state->in_transfer_func; is called,
plane_state is guaranteed to be not NULL, and therefore tf will also not
be NULL.

drivers/gpu/drm/amd/amdgpu/../display/dc/hwss/dcn20/dcn20_hwseq.c
1094 bool dcn20_set_input_transfer_func(struct dc *dc,
1095 struct pipe_ctx *pipe_ctx,
1096 const struct dc_plane_state 
*plane_state)
1097 {
1098 struct dce_hwseq *hws = dc->hwseq;
1099 struct dpp *dpp_base = pipe_ctx->plane_res.dpp;
1100 const struct dc_transfer_func *tf = NULL;
^ This assignment is 
not necessary now.

1101 bool result = true;
1102 bool use_degamma_ram = false;
1103 
1104 if (dpp_base == NULL || plane_state == NULL)
1105 return false;
1106 
1107 hws->funcs.set_shaper_3dlut(pipe_ctx, plane_state);
1108 hws->funcs.set_blend_lut(pipe_ctx, plane_state);
1109 
1110 tf = _state->in_transfer_func;
 ^
Before there was an if statement but now tf is assigned unconditionally

 
--> 1112 if (tf == NULL) {
 ^
so these conditions are impossible.

1113 dpp_base->funcs->dpp_set_degamma(dpp_base,
1114 IPP_DEGAMMA_MODE_BYPASS);
1115 return true;
1116 }
1117 
1118 if (tf->type == TF_TYPE_HWPWL || tf->type == 
TF_TYPE_DISTRIBUTED_POINTS)
1119 use_degamma_ram = true;
1120 
1121 if (use_degamma_ram == true) {
1122 if (tf->type == TF_TYPE_HWPWL)
1123 
dpp_base->funcs->dpp_program_degamma_pwl(dpp_base,

Fixes the below Smatch static checker warning:
drivers/gpu/drm/amd/amdgpu/../display/dc/hwss/dcn20/dcn20_hwseq.c:1112 
dcn20_set_input_transfer_func() warn: address of 
'plane_state->in_transfer_func' is non-NULL

Fixes: 285a7054bf81 ("drm/amd/display: Remove plane and stream pointers from dc 
scratch")
Cc: Wenjing Liu 
Cc: Tom Chung 
Cc: Alvin Lee 
Cc: Rodrigo Siqueira 
Cc: Roman Li 
Cc: Qingqing Zhuo 
Cc: Aurabindo Pillai 
Cc: Harry Wentland 
Suggested-by: Dan Carpenter 
Signed-off-by: Srinivasan Shanmugam 
---
 drivers/gpu/drm/amd/display/dc/hwss/dcn20/dcn20_hwseq.c | 6 --
 1 file changed, 6 deletions(-)

diff --git a/drivers/gpu/drm/amd/display/dc/hwss/dcn20/dcn20_hwseq.c 
b/drivers/gpu/drm/amd/display/dc/hwss/dcn20/dcn20_hwseq.c
index b60ba2a110f7..58fbdd535068 100644
--- a/drivers/gpu/drm/amd/display/dc/hwss/dcn20/dcn20_hwseq.c
+++ b/drivers/gpu/drm/amd/display/dc/hwss/dcn20/dcn20_hwseq.c
@@ -1109,12 +1109,6 @@ bool dcn20_set_input_transfer_func(struct dc *dc,
 
tf = _state->in_transfer_func;
 
-   if (tf == NULL) {
-   dpp_base->funcs->dpp_set_degamma(dpp_base,
-   IPP_DEGAMMA_MODE_BYPASS);
-   return true;
-   }
-
if (tf->type == TF_TYPE_HWPWL || tf->type == TF_TYPE_DISTRIBUTED_POINTS)
use_degamma_ram = true;
 
-- 
2.34.1

[PATCH] drm/amd/display: Address kdoc for 'Enable CRTC' in optc401_enable_crtc

[Srinivasan Shanmugam]

This commit fixes the kdoc for 'Enable CRTC' in `optc401_enable_crtc`
function.

Fixes the below with gcc W=1:
drivers/gpu/drm/amd/amdgpu/../display/dc/optc/dcn401/dcn401_optc.c:177: 
warning: This comment starts with '/**', but isn't a kernel-doc comment. Refer 
Documentation/doc-guide/kernel-doc.rst
 * Enable CRTC

Fixes: 96c23c8cb3fb ("drm/amd/display: Add new DCN401 sources")
Cc: Rodrigo Siqueira 
Cc: Roman Li 
Cc: Qingqing Zhuo 
Cc: Aurabindo Pillai 
Cc: Tom Chung 
Signed-off-by: Srinivasan Shanmugam 
---
 drivers/gpu/drm/amd/display/dc/optc/dcn401/dcn401_optc.c | 8 ++--
 1 file changed, 6 insertions(+), 2 deletions(-)

diff --git a/drivers/gpu/drm/amd/display/dc/optc/dcn401/dcn401_optc.c 
b/drivers/gpu/drm/amd/display/dc/optc/dcn401/dcn401_optc.c
index 3c7b0624acea..5d65d8376f50 100644
--- a/drivers/gpu/drm/amd/display/dc/optc/dcn401/dcn401_optc.c
+++ b/drivers/gpu/drm/amd/display/dc/optc/dcn401/dcn401_optc.c
@@ -174,8 +174,12 @@ static void optc401_set_h_timing_div_manual_mode(struct 
timing_generator *optc,
OTG_H_TIMING_DIV_MODE_MANUAL, manual_mode ? 1 : 0);
 }
 /**
- * Enable CRTC
- * Enable CRTC - call ASIC Control Object to enable Timing generator.
+ * optc401_enable_crtc() - Enable CRTC
+ * @optc: Pointer to the timing generator structure
+ *
+ * This function calls ASIC Control Object to enable Timing generator.
+ *
+ * Return: Always returns true
  */
 static bool optc401_enable_crtc(struct timing_generator *optc)
 {
-- 
2.34.1

[PATCH] drm/amdgpu: Fix buffer size in gfx_v9_4_3_init_ cp_compute_microcode() and rlc_microcode()

[Srinivasan Shanmugam]

The buffer size is determined by the declaration char fw_name[30]; This
means fw_name can hold up to 30 characters, including the null character
that marks the end of the string.

The string to be written is "amdgpu/%s_mec.bin" or "amdgpu/%s_rlc.bin",
where %s will be replaced by the value of chip_name.

The length of the string "amdgpu/%s_mec.bin" or "amdgpu/%s_rlc.bin"
without the %s is 16 characters.

The warning message is saying that the chip_name could be up to 29
characters long. If we add the 16 characters from the string
"amdgpu/%s_mec.bin" or "amdgpu/%s_rlc.bin", we get a total of 45
characters.

This is potentially longer than the buffer size of 30 characters.

if chip_name is longer than 14 characters (30 buffer size - 16
characters from the string), the resulting string will not fit into the
fw_name buffer, Thus increasing fw_name buffer size to 50

Fixes the below with gcc W=1:
drivers/gpu/drm/amd/amdgpu/gfx_v9_4_3.c: In function ‘gfx_v9_4_3_early_init’:
drivers/gpu/drm/amd/amdgpu/gfx_v9_4_3.c:379:52: warning: ‘%s’ directive output 
may be truncated writing up to 29 bytes into a region of size 23 
[-Wformat-truncation=]
  379 | snprintf(fw_name, sizeof(fw_name), "amdgpu/%s_rlc.bin", 
chip_name);
  |^~
..
  439 | r = gfx_v9_4_3_init_rlc_microcode(adev, ucode_prefix);
  | 
drivers/gpu/drm/amd/amdgpu/gfx_v9_4_3.c:379:9: note: ‘snprintf’ output between 
16 and 45 bytes into a destination of size 30
  379 | snprintf(fw_name, sizeof(fw_name), "amdgpu/%s_rlc.bin", 
chip_name);
  | 
^~
drivers/gpu/drm/amd/amdgpu/gfx_v9_4_3.c:413:52: warning: ‘%s’ directive output 
may be truncated writing up to 29 bytes into a region of size 23 
[-Wformat-truncation=]
  413 | snprintf(fw_name, sizeof(fw_name), "amdgpu/%s_mec.bin", 
chip_name);
  |^~
..
  443 | r = gfx_v9_4_3_init_cp_compute_microcode(adev, ucode_prefix);
  |
drivers/gpu/drm/amd/amdgpu/gfx_v9_4_3.c:413:9: note: ‘snprintf’ output between 
16 and 45 bytes into a destination of size 30
  413 | snprintf(fw_name, sizeof(fw_name), "amdgpu/%s_mec.bin", 
chip_name);
  | 
^~

Fixes: 86301129698b ("drm/amdgpu: split gc v9_4_3 functionality from gc v9_0")
Cc: Hawking Zhang 
Cc: Christian König 
Cc: Alex Deucher 
Cc: Lijo Lazar 
Signed-off-by: Srinivasan Shanmugam 
---
 drivers/gpu/drm/amd/amdgpu/gfx_v9_4_3.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/drivers/gpu/drm/amd/amdgpu/gfx_v9_4_3.c 
b/drivers/gpu/drm/amd/amdgpu/gfx_v9_4_3.c
index 0e429b7ed036..1c46d5f6677f 100644
--- a/drivers/gpu/drm/amd/amdgpu/gfx_v9_4_3.c
+++ b/drivers/gpu/drm/amd/amdgpu/gfx_v9_4_3.c
@@ -370,7 +370,7 @@ static void gfx_v9_4_3_free_microcode(struct amdgpu_device 
*adev)
 static int gfx_v9_4_3_init_rlc_microcode(struct amdgpu_device *adev,
  const char *chip_name)
 {
-   char fw_name[30];
+   char fw_name[50];
int err;
const struct rlc_firmware_header_v2_0 *rlc_hdr;
uint16_t version_major;
@@ -407,7 +407,7 @@ static void gfx_v9_4_3_check_if_need_gfxoff(struct 
amdgpu_device *adev)
 static int gfx_v9_4_3_init_cp_compute_microcode(struct amdgpu_device *adev,
  const char *chip_name)
 {
-   char fw_name[30];
+   char fw_name[50];
int err;
 
snprintf(fw_name, sizeof(fw_name), "amdgpu/%s_mec.bin", chip_name);
-- 
2.34.1

[PATCH] drm/amdgpu: Fix buffer size in gfx_v9_4_3_init_ cp_compute_microcode() and rlc_microcode()

[Srinivasan Shanmugam]

The buffer size is determined by the declaration char fw_name[30]; This
means fw_name can hold up to 30 characters, including the null character
that marks the end of the string.

The string to be written is "amdgpu/%s_mec.bin" or "amdgpu/%s_rlc.bin",
where %s will be replaced by the value of chip_name.

The length of the string "amdgpu/%s_mec.bin" or "amdgpu/%s_rlc.bin"
without the %s is 16 characters.

The warning message is saying that the chip_name could be up to 29
characters long. If we add the 16 characters from the string
"amdgpu/%s_mec.bin" or "amdgpu/%s_rlc.bin", we get a total of 45
characters.

This is potentially longer than the buffer size of 30 characters.

if chip_name is longer than 14 characters (30 buffer size - 16
characters from the string), the resulting string will not fit into the
fw_name buffer, Thus increasing fw_name buffer size to 50

Fixes the below with gcc W=1:
drivers/gpu/drm/amd/amdgpu/gfx_v9_4_3.c: In function ‘gfx_v9_4_3_early_init’:
drivers/gpu/drm/amd/amdgpu/gfx_v9_4_3.c:379:52: warning: ‘%s’ directive output 
may be truncated writing up to 29 bytes into a region of size 23 
[-Wformat-truncation=]
  379 | snprintf(fw_name, sizeof(fw_name), "amdgpu/%s_rlc.bin", 
chip_name);
  |^~
..
  439 | r = gfx_v9_4_3_init_rlc_microcode(adev, ucode_prefix);
  | 
drivers/gpu/drm/amd/amdgpu/gfx_v9_4_3.c:379:9: note: ‘snprintf’ output between 
16 and 45 bytes into a destination of size 30
  379 | snprintf(fw_name, sizeof(fw_name), "amdgpu/%s_rlc.bin", 
chip_name);
  | 
^~
drivers/gpu/drm/amd/amdgpu/gfx_v9_4_3.c:413:52: warning: ‘%s’ directive output 
may be truncated writing up to 29 bytes into a region of size 23 
[-Wformat-truncation=]
  413 | snprintf(fw_name, sizeof(fw_name), "amdgpu/%s_mec.bin", 
chip_name);
  |^~
..
  443 | r = gfx_v9_4_3_init_cp_compute_microcode(adev, ucode_prefix);
  |
drivers/gpu/drm/amd/amdgpu/gfx_v9_4_3.c:413:9: note: ‘snprintf’ output between 
16 and 45 bytes into a destination of size 30
  413 | snprintf(fw_name, sizeof(fw_name), "amdgpu/%s_mec.bin", 
chip_name);
  | 
^~

Fixes: 86301129698b ("drm/amdgpu: split gc v9_4_3 functionality from gc v9_0")
Cc: Hawking Zhang 
Cc: Christian König 
Cc: Alex Deucher 
Cc: Lijo Lazar 
Signed-off-by: Srinivasan Shanmugam 
---
 drivers/gpu/drm/amd/amdgpu/gfx_v9_4_3.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/drivers/gpu/drm/amd/amdgpu/gfx_v9_4_3.c 
b/drivers/gpu/drm/amd/amdgpu/gfx_v9_4_3.c
index 0e429b7ed036..1c46d5f6677f 100644
--- a/drivers/gpu/drm/amd/amdgpu/gfx_v9_4_3.c
+++ b/drivers/gpu/drm/amd/amdgpu/gfx_v9_4_3.c
@@ -370,7 +370,7 @@ static void gfx_v9_4_3_free_microcode(struct amdgpu_device 
*adev)
 static int gfx_v9_4_3_init_rlc_microcode(struct amdgpu_device *adev,
  const char *chip_name)
 {
-   char fw_name[30];
+   char fw_name[50];
int err;
const struct rlc_firmware_header_v2_0 *rlc_hdr;
uint16_t version_major;
@@ -407,7 +407,7 @@ static void gfx_v9_4_3_check_if_need_gfxoff(struct 
amdgpu_device *adev)
 static int gfx_v9_4_3_init_cp_compute_microcode(struct amdgpu_device *adev,
  const char *chip_name)
 {
-   char fw_name[30];
+   char fw_name[50];
int err;
 
snprintf(fw_name, sizeof(fw_name), "amdgpu/%s_mec.bin", chip_name);
-- 
2.34.1

[PATCH v4] drm/amdgpu: Fix snprintf buffer size in smu_v14_0_init_microcode

[Srinivasan Shanmugam]

This commit addresses buffer overflow in the smu_v14_0_init_microcode
function. The issue was about the snprintf function writing more bytes
into the fw_name buffer than it can hold.

The line of code is:

snprintf(fw_name, sizeof(fw_name), "amdgpu/%s.bin", ucode_prefix);

Here, snprintf is used to write a formatted string into fw_name. The
format is "amdgpu/%s.bin", where %s is a placeholder for the string
ucode_prefix. The sizeof(fw_name) argument tells snprintf the maximum
number of bytes it can write into fw_name, including the
null-terminating character. In the original code, fw_name is an array of
30 characters.

The string "amdgpu/%s.bin" could be up to 41 bytes long, which exceeds
the 30 bytes allocated for fw_name. This is because %s could be replaced
by ucode_prefix, which can be up to 29 characters long. Adding the 12
characters from "amdgpu/" and ".bin", the total length could be 41
characters.

To address this, the size of ucode_prefix has been reduced to 15
characters. This ensures that the maximum length of the string written
into fw_name does not exceed its capacity.

As smu_13/14 etc. don't follow legacy scheme ie.,
amdgpu_ucode_legacy_naming

Fixes the below with gcc W=1:
drivers/gpu/drm/amd/amdgpu/../pm/swsmu/smu14/smu_v14_0.c: In function 
‘smu_v14_0_init_microcode’:
drivers/gpu/drm/amd/amdgpu/../pm/swsmu/smu14/smu_v14_0.c:80:52: warning: ‘%s’ 
directive output may be truncated writing up to 29 bytes into a region of size 
23 [-Wformat-truncation=]
   80 | snprintf(fw_name, sizeof(fw_name), "amdgpu/%s.bin", 
ucode_prefix);
  |^~   
drivers/gpu/drm/amd/amdgpu/../pm/swsmu/smu14/smu_v14_0.c:80:9: note: ‘snprintf’ 
output between 12 and 41 bytes into a destination of size 30
   80 | snprintf(fw_name, sizeof(fw_name), "amdgpu/%s.bin", 
ucode_prefix);
  | 
^

Fixes: fe6cd9152464 ("drm/amd/swsmu: add smu14 ip support")
Cc: Li Ma 
Cc: Likun Gao 
Cc: Lijo Lazar 
Cc: Kenneth Feng 
Cc: Alex Deucher 
Cc: Christian König 
Signed-off-by: Srinivasan Shanmugam 
---
v4:
 - Reduced ucode_prefix to 15 instead of fw_name size increasing as
   smu_13/14 etc. don't follow legacy scheme ie.,
   amdgpu_ucode_legacy_naming (Lijo) 

 drivers/gpu/drm/amd/pm/swsmu/smu14/smu_v14_0.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/gpu/drm/amd/pm/swsmu/smu14/smu_v14_0.c 
b/drivers/gpu/drm/amd/pm/swsmu/smu14/smu_v14_0.c
index 7d2055b9d19f..68b9bf822e8d 100644
--- a/drivers/gpu/drm/amd/pm/swsmu/smu14/smu_v14_0.c
+++ b/drivers/gpu/drm/amd/pm/swsmu/smu14/smu_v14_0.c
@@ -65,7 +65,7 @@ int smu_v14_0_init_microcode(struct smu_context *smu)
 {
struct amdgpu_device *adev = smu->adev;
char fw_name[30];
-   char ucode_prefix[30];
+   char ucode_prefix[15];
int err = 0;
const struct smc_firmware_header_v1_0 *hdr;
const struct common_firmware_header *header;
-- 
2.34.1

[PATCH v3] drm/amdgpu: Fix snprintf buffer size in smu_v14_0_init_microcode

[Srinivasan Shanmugam]

This commit addresses buffer overflow in the smu_v14_0_init_microcode
function. The issue was about the snprintf function writing more bytes
into the fw_name buffer than it can hold.

The line of code is:

snprintf(fw_name, sizeof(fw_name), "amdgpu/%s.bin", ucode_prefix);

Here, snprintf is used to write a formatted string into fw_name. The
format is "amdgpu/%s.bin", where %s is a placeholder for the string
ucode_prefix. The sizeof(fw_name) argument tells snprintf the maximum
number of bytes it can write into fw_name, including the
null-terminating character. In the original code, fw_name is an array of
30 characters.

The string "amdgpu/%s.bin" could be up to 41 bytes long, which exceeds
the 30 bytes allocated for fw_name. This is because %s could be replaced
by ucode_prefix, which can be up to 29 characters long. Adding the 12
characters from "amdgpu/" and ".bin", the total length could be 41
characters.

To address this, the size of ucode_prefix has been reduced to 15
characters. This ensures that the maximum length of the string written
into fw_name does not exceed its capacity.

As smu_13/14 etc. don't follow legacy scheme ie.,
amdgpu_ucode_legacy_naming

Fixes the below with gcc W=1:
drivers/gpu/drm/amd/amdgpu/../pm/swsmu/smu14/smu_v14_0.c: In function 
‘smu_v14_0_init_microcode’:
drivers/gpu/drm/amd/amdgpu/../pm/swsmu/smu14/smu_v14_0.c:80:52: warning: ‘%s’ 
directive output may be truncated writing up to 29 bytes into a region of size 
23 [-Wformat-truncation=]
   80 | snprintf(fw_name, sizeof(fw_name), "amdgpu/%s.bin", 
ucode_prefix);
  |^~   
drivers/gpu/drm/amd/amdgpu/../pm/swsmu/smu14/smu_v14_0.c:80:9: note: ‘snprintf’ 
output between 12 and 41 bytes into a destination of size 30
   80 | snprintf(fw_name, sizeof(fw_name), "amdgpu/%s.bin", 
ucode_prefix);
  | 
^

Fixes: fe6cd9152464 ("drm/amd/swsmu: add smu14 ip support")
Cc: Li Ma 
Cc: Likun Gao 
Cc: Lijo Lazar 
Cc: Kenneth Feng 
Cc: Alex Deucher 
Cc: Christian König 
Signed-off-by: Srinivasan Shanmugam 
Suggested-by: Lijo Lazar 
---
v3:
 - Reduced ucode_prefix to 15 instead of fw_name size increasing as
   smu_13/14 etc. don't follow legacy scheme ie.,
   amdgpu_ucode_legacy_naming (Lijo) 

 drivers/gpu/drm/amd/pm/swsmu/smu14/smu_v14_0.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/gpu/drm/amd/pm/swsmu/smu14/smu_v14_0.c 
b/drivers/gpu/drm/amd/pm/swsmu/smu14/smu_v14_0.c
index 7d2055b9d19f..5d9335cb8530 100644
--- a/drivers/gpu/drm/amd/pm/swsmu/smu14/smu_v14_0.c
+++ b/drivers/gpu/drm/amd/pm/swsmu/smu14/smu_v14_0.c
@@ -64,7 +64,7 @@ MODULE_FIRMWARE("amdgpu/smu_14_0_3.bin");
 int smu_v14_0_init_microcode(struct smu_context *smu)
 {
struct amdgpu_device *adev = smu->adev;
-   char fw_name[30];
+   char fw_name[50];
char ucode_prefix[30];
int err = 0;
const struct smc_firmware_header_v1_0 *hdr;
-- 
2.34.1

[PATCH v2] drm/amdgpu: Fix snprintf buffer size in smu_v14_0_init_microcode

[Srinivasan Shanmugam]

This commit addresses buffer overflow in the smu_v14_0_init_microcode
function. The issue was about the snprintf function writing more bytes
into the fw_name buffer than it can hold.

The line of code is:

snprintf(fw_name, sizeof(fw_name), "amdgpu/%s.bin", ucode_prefix);

Here, snprintf is used to write a formatted string into fw_name. The
format is "amdgpu/%s.bin", where %s is a placeholder for the string
ucode_prefix. The sizeof(fw_name) argument tells snprintf the maximum
number of bytes it can write into fw_name, including the
null-terminating character. In the original code, fw_name is an array of
30 characters.

The string "amdgpu/%s.bin" could be up to 41 bytes long, which exceeds
the 30 bytes allocated for fw_name. This is because %s could be replaced
by ucode_prefix, which can be up to 29 characters long. Adding the 12
characters from "amdgpu/" and ".bin", the total length could be 41
characters.

To address this, the size of fw_name has been increased to 50
characters.

Fixes the below with gcc W=1:
drivers/gpu/drm/amd/amdgpu/../pm/swsmu/smu14/smu_v14_0.c: In function 
‘smu_v14_0_init_microcode’:
drivers/gpu/drm/amd/amdgpu/../pm/swsmu/smu14/smu_v14_0.c:80:52: warning: ‘%s’ 
directive output may be truncated writing up to 29 bytes into a region of size 
23 [-Wformat-truncation=]
   80 | snprintf(fw_name, sizeof(fw_name), "amdgpu/%s.bin", 
ucode_prefix);
  |^~   
drivers/gpu/drm/amd/amdgpu/../pm/swsmu/smu14/smu_v14_0.c:80:9: note: ‘snprintf’ 
output between 12 and 41 bytes into a destination of size 30
   80 | snprintf(fw_name, sizeof(fw_name), "amdgpu/%s.bin", 
ucode_prefix);
  | 
^

Fixes: fe6cd9152464 ("drm/amd/swsmu: add smu14 ip support")
Cc: Li Ma 
Cc: Likun Gao 
Cc: Lijo Lazar 
Cc: Kenneth Feng 
Cc: Alex Deucher 
Cc: Christian König 
Signed-off-by: Srinivasan Shanmugam 
---
v2:
- Updated commit message

 drivers/gpu/drm/amd/pm/swsmu/smu14/smu_v14_0.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/gpu/drm/amd/pm/swsmu/smu14/smu_v14_0.c 
b/drivers/gpu/drm/amd/pm/swsmu/smu14/smu_v14_0.c
index 7d2055b9d19f..5d9335cb8530 100644
--- a/drivers/gpu/drm/amd/pm/swsmu/smu14/smu_v14_0.c
+++ b/drivers/gpu/drm/amd/pm/swsmu/smu14/smu_v14_0.c
@@ -64,7 +64,7 @@ MODULE_FIRMWARE("amdgpu/smu_14_0_3.bin");
 int smu_v14_0_init_microcode(struct smu_context *smu)
 {
struct amdgpu_device *adev = smu->adev;
-   char fw_name[30];
+   char fw_name[50];
char ucode_prefix[30];
int err = 0;
const struct smc_firmware_header_v1_0 *hdr;
-- 
2.34.1

[PATCH] drm/amdgpu: Fix snprintf buffer size in smu_v14_0_init_microcode

[Srinivasan Shanmugam]

This commit addresses buffer overflow in the smu_v14_0_init_microcode
function. The issue was about the snprintf function writing more bytes
into the fw_name buffer than it can hold.

The line of code is:

snprintf(fw_name, sizeof(fw_name), "amdgpu/%s.bin", ucode_prefix);

Here, snprintf is used to write a formatted string into fw_name. The
format is "amdgpu/%s.bin", where %s is a placeholder for the string
ucode_prefix. The sizeof(fw_name) argument tells snprintf the maximum
number of bytes it can write into fw_name, including the
null-terminating character. In the original code, fw_name is an array of
30 characters.

The string "amdgpu/%s.bin" could be up to 41 bytes long, which exceeds
the 30 bytes allocated for fw_name. This is because %s could be replaced
by ucode_prefix, which can be up to 29 characters long. Adding the 12
characters from "amdgpu/" and ".bin", the total length could be 41
characters.

To address this, the size of fw_name has been increased to 50
characters.

Fixes: fe6cd9152464 ("drm/amd/swsmu: add smu14 ip support")
Cc: Li Ma 
Cc: Likun Gao 
Cc: Lijo Lazar 
Cc: Kenneth Feng 
Cc: Alex Deucher 
Cc: Christian König 
Signed-off-by: Srinivasan Shanmugam 
---
 drivers/gpu/drm/amd/pm/swsmu/smu14/smu_v14_0.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/gpu/drm/amd/pm/swsmu/smu14/smu_v14_0.c 
b/drivers/gpu/drm/amd/pm/swsmu/smu14/smu_v14_0.c
index 7d2055b9d19f..5d9335cb8530 100644
--- a/drivers/gpu/drm/amd/pm/swsmu/smu14/smu_v14_0.c
+++ b/drivers/gpu/drm/amd/pm/swsmu/smu14/smu_v14_0.c
@@ -64,7 +64,7 @@ MODULE_FIRMWARE("amdgpu/smu_14_0_3.bin");
 int smu_v14_0_init_microcode(struct smu_context *smu)
 {
struct amdgpu_device *adev = smu->adev;
-   char fw_name[30];
+   char fw_name[50];
char ucode_prefix[30];
int err = 0;
const struct smc_firmware_header_v1_0 *hdr;
-- 
2.34.1

[PATCH] drm/amd/display: Add missing parameter desc in dc_commit_streams

[Srinivasan Shanmugam]

This commit removes the lines that describe the 'streams'
and 'stream_count' parameters and adds a line to describe the 'params'
parameter, which was missing from the original comment block.

Fixes the below with gcc W=1:
drivers/gpu/drm/amd/amdgpu/../display/dc/core/dc.c:2138: warning: Function 
parameter or member 'params' not described in 'dc_commit_streams'
drivers/gpu/drm/amd/amdgpu/../display/dc/core/dc.c:2138: warning: Excess 
function parameter 'streams' description in 'dc_commit_streams'
drivers/gpu/drm/amd/amdgpu/../display/dc/core/dc.c:2138: warning: Excess 
function parameter 'stream_count' description in 'dc_commit_streams'

Fixes: 515023b2ce5f ("drm/amd/display: Add handling for DC power mode")
Cc: Joshua Aberback 
Cc: Rodrigo Siqueira 
Cc: Roman Li 
Cc: Aurabindo Pillai 
Cc: Tom Chung 
Signed-off-by: Srinivasan Shanmugam 
---
 drivers/gpu/drm/amd/display/dc/core/dc.c | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/drivers/gpu/drm/amd/display/dc/core/dc.c 
b/drivers/gpu/drm/amd/display/dc/core/dc.c
index 5a93278fa246..0ffa79d83bc7 100644
--- a/drivers/gpu/drm/amd/display/dc/core/dc.c
+++ b/drivers/gpu/drm/amd/display/dc/core/dc.c
@@ -2125,8 +2125,7 @@ static bool commit_minimal_transition_state(struct dc *dc,
  * dc_commit_streams - Commit current stream state
  *
  * @dc: DC object with the commit state to be configured in the hardware
- * @streams: Array with a list of stream state
- * @stream_count: Total of streams
+ * @params: Parameters for the commit, including the streams to be committed
  *
  * Function responsible for commit streams change to the hardware.
  *
-- 
2.34.1

[PATCH] drm/amdgpu: Fix truncation in smu_v11_0_init_microcode

[Srinivasan Shanmugam]

Reducing the size of ucode_prefix to 25 in the smu_v11_0_init_microcode
function. we ensure that fw_name can accommodate the maximum possible
string size

Fixes the below with gcc W=1:
drivers/gpu/drm/amd/amdgpu/../pm/swsmu/smu11/smu_v11_0.c: In function 
‘smu_v11_0_init_microcode’:
drivers/gpu/drm/amd/amdgpu/../pm/swsmu/smu11/smu_v11_0.c:110:54: warning: 
‘.bin’ directive output may be truncated writing 4 bytes into a region of size 
between 0 and 29 [-Wformat-truncation=]
  110 | snprintf(fw_name, sizeof(fw_name), "amdgpu/%s.bin", 
ucode_prefix);
  |  ^~~~
drivers/gpu/drm/amd/amdgpu/../pm/swsmu/smu11/smu_v11_0.c:110:9: note: 
‘snprintf’ output between 12 and 41 bytes into a destination of size 36
  110 | snprintf(fw_name, sizeof(fw_name), "amdgpu/%s.bin", 
ucode_prefix);
  | 
^

Cc: Alex Deucher 
Cc: Christian König 
Suggested-by: Lijo Lazar 
Signed-off-by: Srinivasan Shanmugam 
---
 drivers/gpu/drm/amd/pm/swsmu/smu11/smu_v11_0.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/gpu/drm/amd/pm/swsmu/smu11/smu_v11_0.c 
b/drivers/gpu/drm/amd/pm/swsmu/smu11/smu_v11_0.c
index f6545093bfc1..5e5da9b16718 100644
--- a/drivers/gpu/drm/amd/pm/swsmu/smu11/smu_v11_0.c
+++ b/drivers/gpu/drm/amd/pm/swsmu/smu11/smu_v11_0.c
@@ -93,7 +93,7 @@ static void smu_v11_0_poll_baco_exit(struct smu_context *smu)
 int smu_v11_0_init_microcode(struct smu_context *smu)
 {
struct amdgpu_device *adev = smu->adev;
-   char ucode_prefix[30];
+   char ucode_prefix[25];
char fw_name[SMU_FW_NAME_LEN];
int err = 0;
const struct smc_firmware_header_v1_0 *hdr;
-- 
2.34.1

[PATCH] drm/amdgpu: Fix truncation in gfx_v10_0_init_microcode

[Srinivasan Shanmugam]

The total size of the fw_name buffer is 8 (for "amdgpu/") + 30 (for
ucode_prefix) + 5 (for "_pfp") + 5 (for "_wks") + 5 (for ".bin") = 53
characters.

Fixes the below with gcc W=1:
drivers/gpu/drm/amd/amdgpu/gfx_v10_0.c: In function ‘gfx_v10_0_early_init’:
drivers/gpu/drm/amd/amdgpu/gfx_v10_0.c:3982:58: warning: ‘%s’ directive output 
may be truncated writing up to 4 bytes into a region of size between 0 and 29 
[-Wformat-truncation=]
 3982 | snprintf(fw_name, sizeof(fw_name), "amdgpu/%s_pfp%s.bin", 
ucode_prefix, wks);
  |  ^~
drivers/gpu/drm/amd/amdgpu/gfx_v10_0.c:3982:9: note: ‘snprintf’ output between 
16 and 49 bytes into a destination of size 40
 3982 | snprintf(fw_name, sizeof(fw_name), "amdgpu/%s_pfp%s.bin", 
ucode_prefix, wks);
  | 
^~~~
drivers/gpu/drm/amd/amdgpu/gfx_v10_0.c:3988:57: warning: ‘%s’ directive output 
may be truncated writing up to 4 bytes into a region of size between 1 and 30 
[-Wformat-truncation=]
 3988 | snprintf(fw_name, sizeof(fw_name), "amdgpu/%s_me%s.bin", 
ucode_prefix, wks);
  | ^~
drivers/gpu/drm/amd/amdgpu/gfx_v10_0.c:3988:9: note: ‘snprintf’ output between 
15 and 48 bytes into a destination of size 40
 3988 | snprintf(fw_name, sizeof(fw_name), "amdgpu/%s_me%s.bin", 
ucode_prefix, wks);
  | 
^~~
drivers/gpu/drm/amd/amdgpu/gfx_v10_0.c:3994:57: warning: ‘%s’ directive output 
may be truncated writing up to 4 bytes into a region of size between 1 and 30 
[-Wformat-truncation=]
 3994 | snprintf(fw_name, sizeof(fw_name), "amdgpu/%s_ce%s.bin", 
ucode_prefix, wks);
  | ^~
drivers/gpu/drm/amd/amdgpu/gfx_v10_0.c:3994:9: note: ‘snprintf’ output between 
15 and 48 bytes into a destination of size 40
 3994 | snprintf(fw_name, sizeof(fw_name), "amdgpu/%s_ce%s.bin", 
ucode_prefix, wks);
  | 
^~~
drivers/gpu/drm/amd/amdgpu/gfx_v10_0.c:4001:62: warning: ‘_rlc.bin’ directive 
output may be truncated writing 8 bytes into a region of size between 4 and 33 
[-Wformat-truncation=]
 4001 | snprintf(fw_name, sizeof(fw_name), "amdgpu/%s_rlc.bin", 
ucode_prefix);
  |  ^~~~
drivers/gpu/drm/amd/amdgpu/gfx_v10_0.c:4001:17: note: ‘snprintf’ output between 
16 and 45 bytes into a destination of size 40
 4001 | snprintf(fw_name, sizeof(fw_name), "amdgpu/%s_rlc.bin", 
ucode_prefix);
  | 
^
drivers/gpu/drm/amd/amdgpu/gfx_v10_0.c:4017:58: warning: ‘%s’ directive output 
may be truncated writing up to 4 bytes into a region of size between 0 and 29 
[-Wformat-truncation=]
 4017 | snprintf(fw_name, sizeof(fw_name), "amdgpu/%s_mec%s.bin", 
ucode_prefix, wks);
  |  ^~
drivers/gpu/drm/amd/amdgpu/gfx_v10_0.c:4017:9: note: ‘snprintf’ output between 
16 and 49 bytes into a destination of size 40
 4017 | snprintf(fw_name, sizeof(fw_name), "amdgpu/%s_mec%s.bin", 
ucode_prefix, wks);
  | 
^~~~
drivers/gpu/drm/amd/amdgpu/gfx_v10_0.c:4024:54: warning: ‘_mec2’ directive 
output may be truncated writing 5 bytes into a region of size between 4 and 33 
[-Wformat-truncation=]
 4024 | snprintf(fw_name, sizeof(fw_name), "amdgpu/%s_mec2%s.bin", 
ucode_prefix, wks);
  |  ^
drivers/gpu/drm/amd/amdgpu/gfx_v10_0.c:4024:9: note: ‘snprintf’ output between 
17 and 50 bytes into a destination of size 40
 4024 | snprintf(fw_name, sizeof(fw_name), "amdgpu/%s_mec2%s.bin", 
ucode_prefix, wks);
  | 
^~~~~

Cc: Alex Deucher 
Cc: Christian König 
Suggested-by: Lijo Lazar 
Signed-off-by: Srinivasan Shanmugam 
---
 drivers/gpu/drm/amd/amdgpu/gfx_v10_0.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/gpu/drm/amd/amdgpu/gfx_v10_0.c 
b/drivers/gpu/drm/amd/amdgpu/gfx_v10_0.c
index f90905ef32c7..d524f1a353ed 100644
--- a/drivers/gpu/drm/amd/amdgpu/gfx_v10_0.c
+++ b/drivers/gpu/drm/amd/amdgpu/gfx_v10_0.c
@@ -3964,7 +3964,7 @@ static void gfx_v10_0_check_gfxoff_flag(struct 
amdgpu_device *adev)
 
 static int gfx_v10_0_init_microcode(struct amdgpu_device *adev)
 {
-   char fw_name[40];
+   char fw_name[53];
char ucode_prefix[30];
const char *wks = "";
int err;
-- 
2.34.1

[PATCH] drm/amdgpu: Fix truncations in gfx_v11_0_init_microcode()

[Srinivasan Shanmugam]

Reducing the size of ucode_prefix to 25 in the gfx_v11_0_init_microcode
function. This would ensure that the total number of characters being
written into fw_name does not exceed its size of 40.

Fixes the below with gcc W=1:
drivers/gpu/drm/amd/amdgpu/gfx_v11_0.c: In function ‘gfx_v11_0_early_init’:
drivers/gpu/drm/amd/amdgpu/gfx_v11_0.c:523:54: warning: ‘_pfp.bin’ directive 
output may be truncated writing 8 bytes into a region of size between 4 and 33 
[-Wformat-truncation=]
  523 | snprintf(fw_name, sizeof(fw_name), "amdgpu/%s_pfp.bin", 
ucode_prefix);
  |  ^~~~
drivers/gpu/drm/amd/amdgpu/gfx_v11_0.c:523:9: note: ‘snprintf’ output between 
16 and 45 bytes into a destination of size 40
  523 | snprintf(fw_name, sizeof(fw_name), "amdgpu/%s_pfp.bin", 
ucode_prefix);
  | 
^
drivers/gpu/drm/amd/amdgpu/gfx_v11_0.c:540:54: warning: ‘_me.bin’ directive 
output may be truncated writing 7 bytes into a region of size between 4 and 33 
[-Wformat-truncation=]
  540 | snprintf(fw_name, sizeof(fw_name), "amdgpu/%s_me.bin", 
ucode_prefix);
  |  ^~~
drivers/gpu/drm/amd/amdgpu/gfx_v11_0.c:540:9: note: ‘snprintf’ output between 
15 and 44 bytes into a destination of size 40
  540 | snprintf(fw_name, sizeof(fw_name), "amdgpu/%s_me.bin", 
ucode_prefix);
  | 
^~~~
drivers/gpu/drm/amd/amdgpu/gfx_v11_0.c:557:70: warning: ‘_rlc.bin’ directive 
output may be truncated writing 8 bytes into a region of size between 4 and 33 
[-Wformat-truncation=]
  557 | snprintf(fw_name, sizeof(fw_name), 
"amdgpu/%s_rlc.bin", ucode_prefix);
  |  
^~~~
drivers/gpu/drm/amd/amdgpu/gfx_v11_0.c:557:25: note: ‘snprintf’ output between 
16 and 45 bytes into a destination of size 40
  557 | snprintf(fw_name, sizeof(fw_name), 
"amdgpu/%s_rlc.bin", ucode_prefix);
  | 
^
drivers/gpu/drm/amd/amdgpu/gfx_v11_0.c:569:54: warning: ‘_mec.bin’ directive 
output may be truncated writing 8 bytes into a region of size between 4 and 33 
[-Wformat-truncation=]
  569 | snprintf(fw_name, sizeof(fw_name), "amdgpu/%s_mec.bin", 
ucode_prefix);
  |  ^~~~
drivers/gpu/drm/amd/amdgpu/gfx_v11_0.c:569:9: note: ‘snprintf’ output between 
16 and 45 bytes into a destination of size 40
  569 | snprintf(fw_name, sizeof(fw_name), "amdgpu/%s_mec.bin", 
ucode_prefix);
  | 
^
  CC [M]  
drivers/gpu/drm/amd/amdgpu/../pm/powerplay/hwmgr/smu7_clockpowergating.o

Cc: Alex Deucher 
Cc: Christian König 
Suggested-by: Lijo Lazar 
Signed-off-by: Srinivasan Shanmugam 
---
 drivers/gpu/drm/amd/amdgpu/gfx_v11_0.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/gpu/drm/amd/amdgpu/gfx_v11_0.c 
b/drivers/gpu/drm/amd/amdgpu/gfx_v11_0.c
index 1770e496c1b7..7a906318e451 100644
--- a/drivers/gpu/drm/amd/amdgpu/gfx_v11_0.c
+++ b/drivers/gpu/drm/amd/amdgpu/gfx_v11_0.c
@@ -510,7 +510,7 @@ static void gfx_v11_0_check_fw_cp_gfx_shadow(struct 
amdgpu_device *adev)
 static int gfx_v11_0_init_microcode(struct amdgpu_device *adev)
 {
char fw_name[40];
-   char ucode_prefix[30];
+   char ucode_prefix[25];
int err;
const struct rlc_firmware_header_v2_0 *rlc_hdr;
uint16_t version_major;
-- 
2.34.1

[PATCH] drm/amdgpu: Fix truncation issues in gfx_v9_0.c

[Srinivasan Shanmugam]

drivers/gpu/drm/amd/amdgpu/gfx_v9_0.c:1344:60: warning: ‘%s’ directive output 
may be truncated writing up to 29 bytes into a region of size 23 
[-Wformat-truncation=]
 1344 | snprintf(fw_name, sizeof(fw_name), 
"amdgpu/%s_sjt_mec.bin", chip_name);
  |^~
..
 1402 | r = gfx_v9_0_init_cp_compute_microcode(adev, ucode_prefix);
  |  
drivers/gpu/drm/amd/amdgpu/gfx_v9_0.c:1344:17: note: ‘snprintf’ output between 
20 and 49 bytes into a destination of size 30
 1344 | snprintf(fw_name, sizeof(fw_name), 
"amdgpu/%s_sjt_mec.bin", chip_name);
  | 
^~
drivers/gpu/drm/amd/amdgpu/gfx_v9_0.c:1346:60: warning: ‘%s’ directive output 
may be truncated writing up to 29 bytes into a region of size 23 
[-Wformat-truncation=]
 1346 | snprintf(fw_name, sizeof(fw_name), "amdgpu/%s_mec.bin", 
chip_name);
  |^~
..
 1402 | r = gfx_v9_0_init_cp_compute_microcode(adev, ucode_prefix);
  |  
drivers/gpu/drm/amd/amdgpu/gfx_v9_0.c:1346:17: note: ‘snprintf’ output between 
16 and 45 bytes into a destination of size 30
 1346 | snprintf(fw_name, sizeof(fw_name), "amdgpu/%s_mec.bin", 
chip_name);
  | 
^~
drivers/gpu/drm/amd/amdgpu/gfx_v9_0.c:1356:68: warning: ‘%s’ directive output 
may be truncated writing up to 29 bytes into a region of size 23 
[-Wformat-truncation=]
 1356 | snprintf(fw_name, sizeof(fw_name), 
"amdgpu/%s_sjt_mec2.bin", chip_name);
  |^~
..
 1402 | r = gfx_v9_0_init_cp_compute_microcode(adev, ucode_prefix);
  |  
drivers/gpu/drm/amd/amdgpu/gfx_v9_0.c:1356:25: note: ‘snprintf’ output between 
21 and 50 bytes into a destination of size 30
 1356 | snprintf(fw_name, sizeof(fw_name), 
"amdgpu/%s_sjt_mec2.bin", chip_name);
  | 
^~~
drivers/gpu/drm/amd/amdgpu/gfx_v9_0.c:1358:68: warning: ‘%s’ directive output 
may be truncated writing up to 29 bytes into a region of size 23 
[-Wformat-truncation=]
 1358 | snprintf(fw_name, sizeof(fw_name), 
"amdgpu/%s_mec2.bin", chip_name);
  |^~
..
 1402 | r = gfx_v9_0_init_cp_compute_microcode(adev, ucode_prefix);
  |  
drivers/gpu/drm/amd/amdgpu/gfx_v9_0.c:1358:25: note: ‘snprintf’ output between 
17 and 46 bytes into a destination of size 30
 1358 | snprintf(fw_name, sizeof(fw_name), 
"amdgpu/%s_mec2.bin", chip_name);
  | 
^~~

Cc: Alex Deucher 
Cc: Christian König 
Suggested-by: Lijo Lazar 
Signed-off-by: Srinivasan Shanmugam 
---
 drivers/gpu/drm/amd/amdgpu/gfx_v9_0.c | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/drivers/gpu/drm/amd/amdgpu/gfx_v9_0.c 
b/drivers/gpu/drm/amd/amdgpu/gfx_v9_0.c
index 6f97a6d0e6d0..71b555993b7a 100644
--- a/drivers/gpu/drm/amd/amdgpu/gfx_v9_0.c
+++ b/drivers/gpu/drm/amd/amdgpu/gfx_v9_0.c
@@ -1249,7 +1249,7 @@ static void gfx_v9_0_check_if_need_gfxoff(struct 
amdgpu_device *adev)
 static int gfx_v9_0_init_cp_gfx_microcode(struct amdgpu_device *adev,
  char *chip_name)
 {
-   char fw_name[30];
+   char fw_name[50];
int err;
 
snprintf(fw_name, sizeof(fw_name), "amdgpu/%s_pfp.bin", chip_name);
@@ -1282,7 +1282,7 @@ static int gfx_v9_0_init_cp_gfx_microcode(struct 
amdgpu_device *adev,
 static int gfx_v9_0_init_rlc_microcode(struct amdgpu_device *adev,
   char *chip_name)
 {
-   char fw_name[30];
+   char fw_name[53];
int err;
const struct rlc_firmware_header_v2_0 *rlc_hdr;
uint16_t version_major;
@@ -1337,7 +1337,7 @@ static bool gfx_v9_0_load_mec2_fw_bin_support(struct 
amdgpu_device *adev)
 static int gfx_v9_0_init_cp_compute_microcode(struct amdgpu_device *adev,
  char *chip_name)
 {
-   char fw_name[30];
+   char fw_name[50];
int err;
 
if (amdgpu_sriov_vf(adev) && (adev->asic_type == CHIP_ALDEBARAN))
-- 
2.34.1

[PATCH] drm/amdgpu: Fix 'fw_name' buffer size to prevent truncations in amdgpu_mes_init_microcode

[Srinivasan Shanmugam]

of(fw_name), "amdgpu/%s_mes.bin",
  | ^~~~~~~
 1490 |  ucode_prefix);
  |  ~

Cc: Alex Deucher 
Cc: Christian König 
Suggested-by: Lijo Lazar 
Signed-off-by: Srinivasan Shanmugam 
---
 drivers/gpu/drm/amd/amdgpu/amdgpu_mes.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_mes.c 
b/drivers/gpu/drm/amd/amdgpu/amdgpu_mes.c
index bc8906403270..78dfd027dc99 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_mes.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_mes.c
@@ -1467,7 +1467,7 @@ int amdgpu_mes_init_microcode(struct amdgpu_device *adev, 
int pipe)
const struct mes_firmware_header_v1_0 *mes_hdr;
struct amdgpu_firmware_info *info;
char ucode_prefix[30];
-   char fw_name[40];
+   char fw_name[50];
bool need_retry = false;
int r;
 
-- 
2.34.1

[PATCH v2] drm/amdgpu: Fix format character cut-off issues in amdgpu_vcn_early_init()

[Srinivasan Shanmugam]

Reducing the size of ucode_prefix to 25 in the amdgpu_vcn_early_init
function. This would ensure that the total number of characters being
written into fw_name does not exceed its size of 40.

Fixes the below with gcc W=1:
drivers/gpu/drm/amd/amdgpu/amdgpu_vcn.c: In function ‘amdgpu_vcn_early_init’:
drivers/gpu/drm/amd/amdgpu/amdgpu_vcn.c:102:66: warning: ‘snprintf’ output may 
be truncated before the last format character [-Wformat-truncation=]
  102 | snprintf(fw_name, sizeof(fw_name), "amdgpu/%s.bin", 
ucode_prefix);
  |  ^
drivers/gpu/drm/amd/amdgpu/amdgpu_vcn.c:102:17: note: ‘snprintf’ output between 
12 and 41 bytes into a destination of size 40
  102 | snprintf(fw_name, sizeof(fw_name), "amdgpu/%s.bin", 
ucode_prefix);
  | 
^
drivers/gpu/drm/amd/amdgpu/amdgpu_vcn.c:102:66: warning: ‘snprintf’ output may 
be truncated before the last format character [-Wformat-truncation=]
  102 | snprintf(fw_name, sizeof(fw_name), "amdgpu/%s.bin", 
ucode_prefix);
  |  ^
drivers/gpu/drm/amd/amdgpu/amdgpu_vcn.c:102:17: note: ‘snprintf’ output between 
12 and 41 bytes into a destination of size 40
  102 | snprintf(fw_name, sizeof(fw_name), "amdgpu/%s.bin", 
ucode_prefix);
  | 
^
drivers/gpu/drm/amd/amdgpu/amdgpu_vcn.c:105:73: warning: ‘.bin’ directive 
output may be truncated writing 4 bytes into a region of size between 2 and 31 
[-Wformat-truncation=]
  105 | snprintf(fw_name, sizeof(fw_name), 
"amdgpu/%s_%d.bin", ucode_prefix, i);
  | 
^~~~
drivers/gpu/drm/amd/amdgpu/amdgpu_vcn.c:105:25: note: ‘snprintf’ output between 
14 and 43 bytes into a destination of size 40
  105 | snprintf(fw_name, sizeof(fw_name), 
"amdgpu/%s_%d.bin", ucode_prefix, i);
  | 
^~~

Cc: Alex Deucher 
Cc: Christian König 
Suggested-by: Lijo Lazar 
Signed-off-by: Srinivasan Shanmugam 
---
v2:
   - Reduced ucode_prefix instead of changing fw_name (Lijo)
   - updated commit message

 drivers/gpu/drm/amd/amdgpu/amdgpu_vcn.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_vcn.c 
b/drivers/gpu/drm/amd/amdgpu/amdgpu_vcn.c
index 9c514a606a2f..bb85772b1374 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_vcn.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_vcn.c
@@ -93,7 +93,7 @@ static void amdgpu_vcn_idle_work_handler(struct work_struct 
*work);
 
 int amdgpu_vcn_early_init(struct amdgpu_device *adev)
 {
-   char ucode_prefix[30];
+   char ucode_prefix[25];
char fw_name[40];
int r, i;
 
-- 
2.34.1

Re: [PATCH] drm/amdgpu: Fix format character cut-off issues in amdgpu_vcn_early_init()

[SRINIVASAN SHANMUGAM]

On 3/20/2024 3:12 PM, Lazar, Lijo wrote:


On 3/20/2024 2:15 PM, Srinivasan Shanmugam wrote:

The issue was present in the lines where 'fw_name' was being formatted.
This fix ensures that the output is not truncated

Fixes the below with gcc W=1:
drivers/gpu/drm/amd/amdgpu/amdgpu_vcn.c: In function ‘amdgpu_vcn_early_init’:
drivers/gpu/drm/amd/amdgpu/amdgpu_vcn.c:102:66: warning: ‘snprintf’ output may 
be truncated before the last format character [-Wformat-truncation=]
   102 | snprintf(fw_name, sizeof(fw_name), "amdgpu/%s.bin", 
ucode_prefix);
   |  ^
drivers/gpu/drm/amd/amdgpu/amdgpu_vcn.c:102:17: note: ‘snprintf’ output between 
12 and 41 bytes into a destination of size 40
   102 | snprintf(fw_name, sizeof(fw_name), "amdgpu/%s.bin", 
ucode_prefix);
   | 
^
drivers/gpu/drm/amd/amdgpu/amdgpu_vcn.c:102:66: warning: ‘snprintf’ output may 
be truncated before the last format character [-Wformat-truncation=]
   102 | snprintf(fw_name, sizeof(fw_name), "amdgpu/%s.bin", 
ucode_prefix);
   |  ^
drivers/gpu/drm/amd/amdgpu/amdgpu_vcn.c:102:17: note: ‘snprintf’ output between 
12 and 41 bytes into a destination of size 40
   102 | snprintf(fw_name, sizeof(fw_name), "amdgpu/%s.bin", 
ucode_prefix);
   | 
^
drivers/gpu/drm/amd/amdgpu/amdgpu_vcn.c:105:73: warning: ‘.bin’ directive 
output may be truncated writing 4 bytes into a region of size between 2 and 31 
[-Wformat-truncation=]
   105 | snprintf(fw_name, sizeof(fw_name), 
"amdgpu/%s_%d.bin", ucode_prefix, i);
   |
 ^~~~
drivers/gpu/drm/amd/amdgpu/amdgpu_vcn.c:105:25: note: ‘snprintf’ output between 
14 and 43 bytes into a destination of size 40
   105 | snprintf(fw_name, sizeof(fw_name), 
"amdgpu/%s_%d.bin", ucode_prefix, i);
   | 
^~~

Cc: Alex Deucher 
Cc: Christian König 
Suggested-by: Lijo Lazar 
Signed-off-by: Srinivasan Shanmugam 
---
  drivers/gpu/drm/amd/amdgpu/amdgpu_vcn.c | 2 +-
  1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_vcn.c 
b/drivers/gpu/drm/amd/amdgpu/amdgpu_vcn.c
index 9c514a606a2f..f994ee6c548d 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_vcn.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_vcn.c
@@ -94,7 +94,7 @@ static void amdgpu_vcn_idle_work_handler(struct work_struct 
*work);
  int amdgpu_vcn_early_init(struct amdgpu_device *adev)
  {
char ucode_prefix[30];

Hi Srini,

Sorry, if I miscommunicated. Suggestion was to reduce prefix size to 25
as the max prefix length is possibly length of dimgrey_cavefish_vcn.

Hi Lijo,

my mistake, the fw_name size must have been 53.

How 53? -> The size of ucode_prefix is 30, so the maximum length of 
ucode_prefix is 29 characters (since one character is needed for the 
null terminator). The maximum number of digits in an integer is 10. 
Therefore, the maximum possible length of the string written into 
fw_name is 14 + 29 + 10 = 53 characters.


On the other hand reducing ucode_prefix to 25 from 30:

1. The length of the string "amdgpu/%s.bin" is 12 characters plus the 
length of ucode_prefix. The length of the string "amdgpu/%s_%d.bin" is 
14 characters plus the length of ucode_prefix and the number of digits in i.


If ucode_prefix is 25 characters long, the maximum length of the string 
written into fw_name is 14 + 25 + 1 (for a single digit i) = 40 
characters, which is exactly the size of fw_name.


Is that this solution assumes that i will not be more than 9 (a single 
digit)?. If i can be a number with more than one digit, should we need 
to increase the size of fw_name accordingly.?


2. If you reduce the size of ucode_prefix to 25, it means that it can 
store a version string of up to 24 characters (since one character is 
needed for the null terminator).


For example: if tomorrow, if we get something like 
dimgrey_cavefish_smc_xxxyyyzz - then in this case yyyzz would be lost? 
is that in "amdgpu_ucode_ip_version_decode " & 
"amdgpu_ucode_legacy_naming" , is that are we always ensuring that it 
will never be longer than 24 characters?


Thanks,
Srini


With fw_name[42] also, you may run into 43 bytes (30 prefix + 13 for
others) warning.

Thanks,
Lijo


-   char fw_name[40];
+   char fw_name[42];
int r, i;
  
  	for (i = 0; i < adev->vcn.num_vcn_inst; i++) {

[PATCH] drm/amdgpu: Fix format character cut-off issues in amdgpu_vcn_early_init()

[Srinivasan Shanmugam]

The issue was present in the lines where 'fw_name' was being formatted.
This fix ensures that the output is not truncated

Fixes the below with gcc W=1:
drivers/gpu/drm/amd/amdgpu/amdgpu_vcn.c: In function ‘amdgpu_vcn_early_init’:
drivers/gpu/drm/amd/amdgpu/amdgpu_vcn.c:102:66: warning: ‘snprintf’ output may 
be truncated before the last format character [-Wformat-truncation=]
  102 | snprintf(fw_name, sizeof(fw_name), "amdgpu/%s.bin", 
ucode_prefix);
  |  ^
drivers/gpu/drm/amd/amdgpu/amdgpu_vcn.c:102:17: note: ‘snprintf’ output between 
12 and 41 bytes into a destination of size 40
  102 | snprintf(fw_name, sizeof(fw_name), "amdgpu/%s.bin", 
ucode_prefix);
  | 
^
drivers/gpu/drm/amd/amdgpu/amdgpu_vcn.c:102:66: warning: ‘snprintf’ output may 
be truncated before the last format character [-Wformat-truncation=]
  102 | snprintf(fw_name, sizeof(fw_name), "amdgpu/%s.bin", 
ucode_prefix);
  |  ^
drivers/gpu/drm/amd/amdgpu/amdgpu_vcn.c:102:17: note: ‘snprintf’ output between 
12 and 41 bytes into a destination of size 40
  102 | snprintf(fw_name, sizeof(fw_name), "amdgpu/%s.bin", 
ucode_prefix);
  | 
^
drivers/gpu/drm/amd/amdgpu/amdgpu_vcn.c:105:73: warning: ‘.bin’ directive 
output may be truncated writing 4 bytes into a region of size between 2 and 31 
[-Wformat-truncation=]
  105 | snprintf(fw_name, sizeof(fw_name), 
"amdgpu/%s_%d.bin", ucode_prefix, i);
  | 
^~~~
drivers/gpu/drm/amd/amdgpu/amdgpu_vcn.c:105:25: note: ‘snprintf’ output between 
14 and 43 bytes into a destination of size 40
  105 | snprintf(fw_name, sizeof(fw_name), 
"amdgpu/%s_%d.bin", ucode_prefix, i);
  | 
^~~

Cc: Alex Deucher 
Cc: Christian König 
Suggested-by: Lijo Lazar 
Signed-off-by: Srinivasan Shanmugam 
---
 drivers/gpu/drm/amd/amdgpu/amdgpu_vcn.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_vcn.c 
b/drivers/gpu/drm/amd/amdgpu/amdgpu_vcn.c
index 9c514a606a2f..f994ee6c548d 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_vcn.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_vcn.c
@@ -94,7 +94,7 @@ static void amdgpu_vcn_idle_work_handler(struct work_struct 
*work);
 int amdgpu_vcn_early_init(struct amdgpu_device *adev)
 {
char ucode_prefix[30];
-   char fw_name[40];
+   char fw_name[42];
int r, i;
 
for (i = 0; i < adev->vcn.num_vcn_inst; i++) {
-- 
2.34.1

[PATCH] drm/amd/display: Address kdoc for commit_minimal_transition_state_in_dc_update()

[Srinivasan Shanmugam]

Adds descriptions for 'new_context', 'srf_updates', and 'surface_count',
and removes the excess description for 'context'.

Fixes the below with gcc W=1:
drivers/gpu/drm/amd/amdgpu/../display/dc/core/dc.c:4411: warning: Function 
parameter or member 'new_context' not described in 
'commit_minimal_transition_state_in_dc_update'
drivers/gpu/drm/amd/amdgpu/../display/dc/core/dc.c:4411: warning: Function 
parameter or member 'srf_updates' not described in 
'commit_minimal_transition_state_in_dc_update'
drivers/gpu/drm/amd/amdgpu/../display/dc/core/dc.c:4411: warning: Function 
parameter or member 'surface_count' not described in 
'commit_minimal_transition_state_in_dc_update'
drivers/gpu/drm/amd/amdgpu/../display/dc/core/dc.c:4411: warning: Excess 
function parameter 'context' description in 
'commit_minimal_transition_state_in_dc_update'

Cc: Wenjing Liu 
Cc: Alex Hung 
Cc: Rodrigo Siqueira 
Cc: Roman Li 
Cc: Aurabindo Pillai 
Cc: Tom Chung 
Signed-off-by: Srinivasan Shanmugam 
---
 drivers/gpu/drm/amd/display/dc/core/dc.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/drivers/gpu/drm/amd/display/dc/core/dc.c 
b/drivers/gpu/drm/amd/display/dc/core/dc.c
index 119eee2c97d4..08ca97bb4160 100644
--- a/drivers/gpu/drm/amd/display/dc/core/dc.c
+++ b/drivers/gpu/drm/amd/display/dc/core/dc.c
@@ -4391,8 +4391,10 @@ static bool 
commit_minimal_transition_based_on_current_context(struct dc *dc,
  * on current or new context
  *
  * @dc: DC structure, used to get the current state
- * @context: New context
+ * @new_context: New context
  * @stream: Stream getting the update for the flip
+ * @srf_updates: Surface updates
+ * @surface_count: Number of surfaces
  *
  * The function takes in current state and new state and determine a minimal
  * transition state as the intermediate step which could make the transition
-- 
2.34.1

[PATCH] drm/amdgpu: Fix truncation issues in smu_v13_0_init_microcode

[Srinivasan Shanmugam]

Fixes the below with gcc W=1:
drivers/gpu/drm/amd/amdgpu/../pm/swsmu/smu13/smu_v13_0.c: In function 
‘smu_v13_0_init_microcode’:
drivers/gpu/drm/amd/amdgpu/../pm/swsmu/smu13/smu_v13_0.c:108:52: warning: ‘%s’ 
directive output may be truncated writing up to 29 bytes into a region of size 
23 [-Wformat-truncation=]
  108 | snprintf(fw_name, sizeof(fw_name), "amdgpu/%s.bin", 
ucode_prefix);
  |^~   
drivers/gpu/drm/amd/amdgpu/../pm/swsmu/smu13/smu_v13_0.c:108:9: note: 
‘snprintf’ output between 12 and 41 bytes into a destination of size 30
  108 | snprintf(fw_name, sizeof(fw_name), "amdgpu/%s.bin", 
ucode_prefix);
  | 
^

Cc: Alex Deucher 
Cc: Christian König 
Signed-off-by: Srinivasan Shanmugam 
Suggested-by: Lijo Lazar 
---
 drivers/gpu/drm/amd/pm/swsmu/smu13/smu_v13_0.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/gpu/drm/amd/pm/swsmu/smu13/smu_v13_0.c 
b/drivers/gpu/drm/amd/pm/swsmu/smu13/smu_v13_0.c
index 48170bb5112e..ce16f2a08a47 100644
--- a/drivers/gpu/drm/amd/pm/swsmu/smu13/smu_v13_0.c
+++ b/drivers/gpu/drm/amd/pm/swsmu/smu13/smu_v13_0.c
@@ -93,7 +93,7 @@ int smu_v13_0_init_microcode(struct smu_context *smu)
 {
struct amdgpu_device *adev = smu->adev;
char fw_name[30];
-   char ucode_prefix[30];
+   char ucode_prefix[15];
int err = 0;
const struct smc_firmware_header_v1_0 *hdr;
const struct common_firmware_header *header;
-- 
2.34.1

Re: [PATCH] drm/amdgpu: Fix the iounmap error of rmmio

[SRINIVASAN SHANMUGAM]

On 3/15/2024 10:47 AM, Ma Jun wrote:

Setting the rmmio pointer to NULL to fix the following
iounmap error and calltrace.
iounmap: bad address d0b3631f

Fixes: 923f7a82d2e1 ("drm/amd/amdgpu: Fix potential ioremap() memory leaks in 
amdgpu_device_init()")
Signed-off-by: Ma Jun 

Acked-by: Srinivasan Shanmugam 

---
  drivers/gpu/drm/amd/amdgpu/amdgpu_device.c | 7 +--
  1 file changed, 5 insertions(+), 2 deletions(-)

diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c 
b/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c
index 39dd76e57154..d65a6aabefbb 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c
@@ -4383,6 +4383,7 @@ int amdgpu_device_init(struct amdgpu_device *adev,
  
  unmap_memory:

iounmap(adev->rmmio);
+   adev->rmmio = NULL;
return r;
  }
  
@@ -4514,9 +4515,11 @@ void amdgpu_device_fini_sw(struct amdgpu_device *adev)

  #endif
  
  	if (drm_dev_enter(adev_to_drm(adev), )) {

+   if (adev->rmmio) {
+   iounmap(adev->rmmio);
+   adev->rmmio = NULL;
+   }
  
-		iounmap(adev->rmmio);

-   adev->rmmio = NULL;
amdgpu_doorbell_fini(adev);
drm_dev_exit(idx);
}

[PATCH] drm/amdgpu: Fix potential Spectre vulnerability in amdgpu_gfx_parse_disable_cu()

[Srinivasan Shanmugam]

The 'mask' array could be used in a way that would make the code
vulnerable to a Spectre attack. The issue is likely related to the fact
that the 'mask' array is being indexed using values that are derived
from user input (the 'se' and 'sh' variables), which could potentially
be manipulated by an attacker.

The array_index_nospec() function is typically used in these situations
where an array index is derived from user input or other untrusted data.
By sanitizing the index, it helps to ensure that even if an attacker can
influence the index, they cannot use this to read sensitive data from
other parts of the array or memory.

The array indices are now sanitized using the array_index_nospec()
function, which ensures that the index cannot be greater than the size
of the array, helping to mitigate Spectre attacks.

The array_index_nospec() function, takes two parameters: the array index
and the maximum size of the array. It ensures that the array index is
within the bounds of the array, i.e., it is less than the maximum size
of the array.

If the array index is within bounds, the function returns the index. If
the index is out of bounds, the function returns a safe index (usually
0) instead. This prevents out-of-bounds reads that could potentially be
exploited in a speculative execution attack.

Reported by smatch:
drivers/gpu/drm/amd/amdgpu/amdgpu_gfx.c:136 amdgpu_gfx_parse_disable_cu() warn: 
potential spectre issue 'mask' [w]

Fixes: 6f8941a23088 ("drm/amdgpu: add disable_cu parameter")
Cc: Nicolai Hähnle 
Cc: Christian König 
Cc: Alex Deucher 
Signed-off-by: Srinivasan Shanmugam 
---
 drivers/gpu/drm/amd/amdgpu/amdgpu_gfx.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_gfx.c 
b/drivers/gpu/drm/amd/amdgpu/amdgpu_gfx.c
index 4835d6d899e7..2ef31dbdbc3d 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_gfx.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_gfx.c
@@ -24,6 +24,7 @@
  */
 
 #include 
+#include 
 #include "amdgpu.h"
 #include "amdgpu_gfx.h"
 #include "amdgpu_rlc.h"
@@ -132,8 +133,9 @@ void amdgpu_gfx_parse_disable_cu(unsigned int *mask, 
unsigned int max_se, unsign
}
 
if (se < max_se && sh < max_sh && cu < 16) {
+   unsigned int index = array_index_nospec(se * max_sh + 
sh, max_se * max_sh);
DRM_INFO("amdgpu: disabling CU %u.%u.%u\n", se, sh, cu);
-   mask[se * max_sh + sh] |= 1u << cu;
+   mask[index] |= 1u << cu;
} else {
DRM_ERROR("amdgpu: disable_cu %u.%u.%u is out of 
range\n",
  se, sh, cu);
-- 
2.34.1

[PATCH] drm/amd/display: Fix potential index out of bounds in color transformation function

[Srinivasan Shanmugam]

Fixes index out of bounds issue in the color transformation function.
The issue could occur when the index 'i' exceeds the number of transfer
function points (TRANSFER_FUNC_POINTS).

The fix adds a check to ensure 'i' is within bounds before accessing the
transfer function points. If 'i' is out of bounds, an error message is
logged and the function returns false to indicate an error.

Reported by smatch:
drivers/gpu/drm/amd/amdgpu/../display/dc/dcn10/dcn10_cm_common.c:405 
cm_helper_translate_curve_to_hw_format() error: buffer overflow 
'output_tf->tf_pts.red' 1025 <= s32max
drivers/gpu/drm/amd/amdgpu/../display/dc/dcn10/dcn10_cm_common.c:406 
cm_helper_translate_curve_to_hw_format() error: buffer overflow 
'output_tf->tf_pts.green' 1025 <= s32max
drivers/gpu/drm/amd/amdgpu/../display/dc/dcn10/dcn10_cm_common.c:407 
cm_helper_translate_curve_to_hw_format() error: buffer overflow 
'output_tf->tf_pts.blue' 1025 <= s32max

Fixes: b629596072e5 ("drm/amd/display: Build unity lut for shaper")
Cc: Vitaly Prosyak 
Cc: Charlene Liu 
Cc: Harry Wentland 
Cc: Rodrigo Siqueira 
Cc: Roman Li 
Cc: Aurabindo Pillai 
Cc: Tom Chung 
Signed-off-by: Srinivasan Shanmugam 
---
 drivers/gpu/drm/amd/display/dc/dcn10/dcn10_cm_common.c | 5 +
 1 file changed, 5 insertions(+)

diff --git a/drivers/gpu/drm/amd/display/dc/dcn10/dcn10_cm_common.c 
b/drivers/gpu/drm/amd/display/dc/dcn10/dcn10_cm_common.c
index b7e57aa27361..b0d192c6e63e 100644
--- a/drivers/gpu/drm/amd/display/dc/dcn10/dcn10_cm_common.c
+++ b/drivers/gpu/drm/amd/display/dc/dcn10/dcn10_cm_common.c
@@ -402,6 +402,11 @@ bool cm_helper_translate_curve_to_hw_format(struct 
dc_context *ctx,
i += increment) {
if (j == hw_points - 1)
break;
+   if (i >= TRANSFER_FUNC_POINTS) {
+   DC_LOG_ERROR("Index out of bounds: i=%d, 
TRANSFER_FUNC_POINTS=%d\n",
+i, TRANSFER_FUNC_POINTS);
+   return false;
+   }
rgb_resulted[j].red = output_tf->tf_pts.red[i];
rgb_resulted[j].green = output_tf->tf_pts.green[i];
rgb_resulted[j].blue = output_tf->tf_pts.blue[i];
-- 
2.34.1

[PATCH] drm/amdgpu: Fix multiple truncation issues in multiple driver files

[Srinivasan Shanmugam]

Fixes snprintf function by writing more bytes into various buffers than
they can hold.

In several files - smu_v13_0.c, gfx_v11_0.c, gfx_v10_0.c, gfx_v9_0.c,
and amdgpu_mes.c. They were related to different directives, such as
'%s', '_pfp.bin', '_me.bin', '_rlc.bin', '_mec.bin', '_mec2', and
'_mes.bin'.

The buffers sizes have been adjusted to accommodate the maximum possible
string size.

Fixes the below with gcc W=1:
drivers/gpu/drm/amd/amdgpu/../pm/swsmu/smu13/smu_v13_0.c:108:52: warning: ‘%s’ 
directive output may be truncated writing up to 29 bytes into a region of size 
23 [-Wformat-truncation=]
drivers/gpu/drm/amd/amdgpu/gfx_v11_0.c:523:54: warning: ‘_pfp.bin’ directive 
output may be truncated writing 8 bytes into a region of size between 4 and 33 
[-Wformat-truncation=]
drivers/gpu/drm/amd/amdgpu/gfx_v11_0.c:540:54: warning: ‘_me.bin’ directive 
output may be truncated writing 7 bytes into a region of size between 4 and 33 
[-Wformat-truncation=]
drivers/gpu/drm/amd/amdgpu/gfx_v11_0.c:557:70: warning: ‘_rlc.bin’ directive 
output may be truncated writing 8 bytes into a region of size between 4 and 33 
[-Wformat-truncation=]
drivers/gpu/drm/amd/amdgpu/gfx_v11_0.c:569:54: warning: ‘_mec.bin’ directive 
output may be truncated writing 8 bytes into a region of size between 4 and 33 
[-Wformat-truncation=]
drivers/gpu/drm/amd/amdgpu/gfx_v10_0.c:3979:58: warning: ‘%s’ directive output 
may be truncated writing up to 4 bytes into a region of size between 0 and 29 
[-Wformat-truncation=]
drivers/gpu/drm/amd/amdgpu/gfx_v10_0.c:3985:57: warning: ‘%s’ directive output 
may be truncated writing up to 4 bytes into a region of size between 1 and 30 
[-Wformat-truncation=]
drivers/gpu/drm/amd/amdgpu/gfx_v10_0.c:3991:57: warning: ‘%s’ directive output 
may be truncated writing up to 4 bytes into a region of size between 1 and 30 
[-Wformat-truncation=]
drivers/gpu/drm/amd/amdgpu/gfx_v10_0.c:3998:62: warning: ‘_rlc.bin’ directive 
output may be truncated writing 8 bytes into a region of size between 4 and 33 
[-Wformat-truncation=]
drivers/gpu/drm/amd/amdgpu/gfx_v10_0.c:4014:58: warning: ‘%s’ directive output 
may be truncated writing up to 4 bytes into a region of size between 0 and 29 
[-Wformat-truncation=]
drivers/gpu/drm/amd/amdgpu/gfx_v10_0.c:4021:54: warning: ‘_mec2’ directive 
output may be truncated writing 5 bytes into a region of size between 4 and 33 
[-Wformat-truncation=]
drivers/gpu/drm/amd/amdgpu/gfx_v9_0.c:1255:52: warning: ‘%s’ directive output 
may be truncated writing up to 29 bytes into a region of size 23 
[-Wformat-truncation=]
drivers/gpu/drm/amd/amdgpu/gfx_v9_0.c:1261:52: warning: ‘%s’ directive output 
may be truncated writing up to 29 bytes into a region of size 23 
[-Wformat-truncation=]
drivers/gpu/drm/amd/amdgpu/gfx_v9_0.c:1267:52: warning: ‘%s’ directive output 
may be truncated writing up to 29 bytes into a region of size 23 
[-Wformat-truncation=]
drivers/gpu/drm/amd/amdgpu/gfx_v9_0.c:1303:60: warning: ‘%s’ directive output 
may be truncated writing up to 29 bytes into a region of size 23 
[-Wformat-truncation=]
drivers/gpu/drm/amd/amdgpu/gfx_v9_0.c:1309:60: warning: ‘%s’ directive output 
may be truncated writing up to 29 bytes into a region of size 23 
[-Wformat-truncation=]
drivers/gpu/drm/amd/amdgpu/gfx_v9_0.c:1311:60: warning: ‘%s’ directive output 
may be truncated writing up to 29 bytes into a region of size 23 
[-Wformat-truncation=]
drivers/gpu/drm/amd/amdgpu/gfx_v9_0.c:1344:60: warning: ‘%s’ directive output 
may be truncated writing up to 29 bytes into a region of size 23 
[-Wformat-truncation=]
drivers/gpu/drm/amd/amdgpu/gfx_v9_0.c:1346:60: warning: ‘%s’ directive output 
may be truncated writing up to 29 bytes into a region of size 23 
[-Wformat-truncation=]
drivers/gpu/drm/amd/amdgpu/gfx_v9_0.c:1356:68: warning: ‘%s’ directive output 
may be truncated writing up to 29 bytes into a region of size 23 
[-Wformat-truncation=]
drivers/gpu/drm/amd/amdgpu/gfx_v9_0.c:1358:68: warning: ‘%s’ directive output 
may be truncated writing up to 29 bytes into a region of size 23 
[-Wformat-truncation=]
drivers/gpu/drm/amd/amdgpu/amdgpu_mes.c:1486:66: warning: ‘%s’ directive output 
may be truncated writing up to 1 bytes into a region of size between 0 and 29 
[-Wformat-truncation=]
drivers/gpu/drm/amd/amdgpu/amdgpu_mes.c:1481:66: warning: ‘%s’ directive output 
may be truncated writing 1 byte into a region of size between 0 and 29 
[-Wformat-truncation=]
drivers/gpu/drm/amd/amdgpu/amdgpu_mes.c:1481:66: warning: ‘%s’ directive output 
may be truncated writing 2 bytes into a region of size between 0 and 29 
[-Wformat-truncation=]
drivers/gpu/drm/amd/amdgpu/amdgpu_mes.c:1493:62: warning: ‘_mes.bin’ directive 
output may be truncated writing 8 bytes into a region of size between 4 and 33 
[-Wformat-truncation=]

Cc: Christian König 
Cc: Alex Deucher 
Signed-off-by: Srinivasan Shanmugam 
---
 drivers/gpu/drm/amd/amdgpu/amdgpu_mes.c| 2 +-
 drivers/gpu/drm/amd/amdgpu/amdgpu_vcn.c

[PATCH] drm/amdgpu: Fix potential truncation by increasing SMU_FW_NAME_LEN

[Srinivasan Shanmugam]

Increases the size of SMU_FW_NAME_LEN from 0x24 (36 in decimal) to 0x2A
(42 in decimal). This change prevents truncation when the snprintf
function writes into the fw_name buffer in the smu_v11_0_init_microcode
function.

Previously, snprintf could write between 12 and 41 bytes into fw_name,
which can only hold 36 bytes. This could lead to truncation if the size
of the string is larger than 36 bytes. By increasing the size of
SMU_FW_NAME_LEN to 42, we ensure that fw_name can accommodate the
maximum possible string size.

Fixes the below with gcc W=1
drivers/gpu/drm/amd/amdgpu/../pm/swsmu/smu11/smu_v11_0.c: In function 
‘smu_v11_0_init_microcode’:
drivers/gpu/drm/amd/amdgpu/../pm/swsmu/smu11/smu_v11_0.c:110:54: warning: 
‘.bin’ directive output may be truncated writing 4 bytes into a region of size 
between 0 and 29 [-Wformat-truncation=]
  110 | snprintf(fw_name, sizeof(fw_name), "amdgpu/%s.bin", 
ucode_prefix);
  |  ^~~~
drivers/gpu/drm/amd/amdgpu/../pm/swsmu/smu11/smu_v11_0.c:110:9: note: 
‘snprintf’ output between 12 and 41 bytes into a destination of size 36
  110 | snprintf(fw_name, sizeof(fw_name), "amdgpu/%s.bin", 
ucode_prefix);
  | 
^

Fixes: 6b54496238cc ("drm/amd: Convert SMUv11 microcode to use 
`amdgpu_ucode_ip_version_decode`")
Cc: Mario Limonciello 
Cc: Christian König 
Cc: Alex Deucher 
Cc: Lijo Lazar 
Signed-off-by: Srinivasan Shanmugam 
---
 drivers/gpu/drm/amd/pm/swsmu/inc/amdgpu_smu.h | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/gpu/drm/amd/pm/swsmu/inc/amdgpu_smu.h 
b/drivers/gpu/drm/amd/pm/swsmu/inc/amdgpu_smu.h
index a870bdd49a4e..3d98b0e0eec2 100644
--- a/drivers/gpu/drm/amd/pm/swsmu/inc/amdgpu_smu.h
+++ b/drivers/gpu/drm/amd/pm/swsmu/inc/amdgpu_smu.h
@@ -35,7 +35,7 @@
 #define SMU_THERMAL_MINIMUM_ALERT_TEMP 0
 #define SMU_THERMAL_MAXIMUM_ALERT_TEMP 255
 #define SMU_TEMPERATURE_UNITS_PER_CENTIGRADES  1000
-#define SMU_FW_NAME_LEN0x24
+#define SMU_FW_NAME_LEN0x2A
 
 #define SMU_DPM_USER_PROFILE_RESTORE (1 << 0)
 #define SMU_CUSTOM_FAN_SPEED_RPM (1 << 1)
-- 
2.34.1

[PATCH v2] drm/amd/amdgpu: Fix potential ioremap() memory leaks in amdgpu_device_init()

[Srinivasan Shanmugam]

This ensures that the memory mapped by ioremap for adev->rmmio, is
properly handled in amdgpu_device_init(). If the function exits early
due to an error, the memory is unmapped. If the function completes
successfully, the memory remains mapped.

Reported by smatch:
drivers/gpu/drm/amd/amdgpu/amdgpu_device.c:4337 amdgpu_device_init() warn: 
'adev->rmmio' from ioremap() not released on lines: 
4035,4045,4051,4058,4068,4337

Cc: Christian König 
Cc: Alex Deucher 
Signed-off-by: Srinivasan Shanmugam 
---
v2: 
 - updated commit message
 - use a goto label and error handling instead (Christian)

 drivers/gpu/drm/amd/amdgpu/amdgpu_device.c | 16 ++--
 1 file changed, 10 insertions(+), 6 deletions(-)

diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c 
b/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c
index 1ef892bea488..d0e77bbee60e 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c
@@ -4031,8 +4031,10 @@ int amdgpu_device_init(struct amdgpu_device *adev,
 * early on during init and before calling to RREG32.
 */
adev->reset_domain = amdgpu_reset_create_reset_domain(SINGLE_DEVICE, 
"amdgpu-reset-dev");
-   if (!adev->reset_domain)
-   return -ENOMEM;
+   if (!adev->reset_domain) {
+   r = -ENOMEM;
+   goto unmap_memory;
+   }
 
/* detect hw virtualization here */
amdgpu_detect_virtualization(adev);
@@ -4042,20 +4044,20 @@ int amdgpu_device_init(struct amdgpu_device *adev,
r = amdgpu_device_get_job_timeout_settings(adev);
if (r) {
dev_err(adev->dev, "invalid lockup_timeout parameter syntax\n");
-   return r;
+   goto unmap_memory;
}
 
/* early init functions */
r = amdgpu_device_ip_early_init(adev);
if (r)
-   return r;
+   goto unmap_memory;
 
amdgpu_device_set_mcbp(adev);
 
/* Get rid of things like offb */
r = drm_aperture_remove_conflicting_pci_framebuffers(adev->pdev, 
_kms_driver);
if (r)
-   return r;
+   goto unmap_memory;
 
/* Enable TMZ based on IP_VERSION */
amdgpu_gmc_tmz_set(adev);
@@ -4065,7 +4067,7 @@ int amdgpu_device_init(struct amdgpu_device *adev,
if (adev->gmc.xgmi.supported) {
r = adev->gfxhub.funcs->get_xgmi_info(adev);
if (r)
-   return r;
+   goto unmap_memory;
}
 
/* enable PCIE atomic ops */
@@ -4334,6 +4336,8 @@ int amdgpu_device_init(struct amdgpu_device *adev,
 failed:
amdgpu_vf_error_trans_all(adev);
 
+unmap_memory:
+   iounmap(adev->rmmio);
return r;
 }
 
-- 
2.34.1

Re: [PATCH] drm/amd/amdgpu: Fix potential ioremap() memory leaks in amdgpu_device_init()

[SRINIVASAN SHANMUGAM]

Hi Christian,

On 2/26/2024 1:46 PM, Christian König wrote:

Am 24.02.24 um 07:38 schrieb Srinivasan Shanmugam:

This ensures that the memory mapped by ioremap for adev->rmmio, is
properly handled in amdgpu_device_init(). If the function exits early
due to an error, the memory is unmapped. If the function completes
successfully, the memory remains mapped.

Fixes the below:
drivers/gpu/drm/amd/amdgpu/amdgpu_device.c:4337 amdgpu_device_init() 
warn: 'adev->rmmio' from ioremap() not released on lines: 
4035,4045,4051,4058,4068,4337


Hui? How do you got that warning?


It was caught by smatch & will update the same in the commit message.


Cc: Christian König 
Cc: Alex Deucher 
Signed-off-by: Srinivasan Shanmugam 
---
  drivers/gpu/drm/amd/amdgpu/amdgpu_device.c | 18 ++
  1 file changed, 14 insertions(+), 4 deletions(-)

diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c 
b/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c

index 1ef892bea488..68bf5e910cb8 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c
@@ -4031,8 +4031,10 @@ int amdgpu_device_init(struct amdgpu_device 
*adev,

   * early on during init and before calling to RREG32.
   */
  adev->reset_domain = 
amdgpu_reset_create_reset_domain(SINGLE_DEVICE, "amdgpu-reset-dev");

-    if (!adev->reset_domain)
+    if (!adev->reset_domain) {
+    iounmap(adev->rmmio);
  return -ENOMEM;
+    }


Please use a goto label and error handling instead. Apart from that 
looks good to me.


Thanks a lot for all your reviews, highly appreciate it, will send v2 
for this.


Best Wishes,

Srini



Regards,
Christian.


    /* detect hw virtualization here */
  amdgpu_detect_virtualization(adev);
@@ -4042,20 +4044,25 @@ int amdgpu_device_init(struct amdgpu_device 
*adev,

  r = amdgpu_device_get_job_timeout_settings(adev);
  if (r) {
  dev_err(adev->dev, "invalid lockup_timeout parameter 
syntax\n");

+    iounmap(adev->rmmio);
  return r;
  }
    /* early init functions */
  r = amdgpu_device_ip_early_init(adev);
-    if (r)
+    if (r) {
+    iounmap(adev->rmmio);
  return r;
+    }
    amdgpu_device_set_mcbp(adev);
    /* Get rid of things like offb */
  r = 
drm_aperture_remove_conflicting_pci_framebuffers(adev->pdev, 
_kms_driver);

-    if (r)
+    if (r) {
+    iounmap(adev->rmmio);
  return r;
+    }
    /* Enable TMZ based on IP_VERSION */
  amdgpu_gmc_tmz_set(adev);
@@ -4064,8 +4071,10 @@ int amdgpu_device_init(struct amdgpu_device 
*adev,

  /* Need to get xgmi info early to decide the reset behavior*/
  if (adev->gmc.xgmi.supported) {
  r = adev->gfxhub.funcs->get_xgmi_info(adev);
-    if (r)
+    if (r) {
+    iounmap(adev->rmmio);
  return r;
+    }
  }
    /* enable PCIE atomic ops */
@@ -4334,6 +4343,7 @@ int amdgpu_device_init(struct amdgpu_device *adev,
  failed:
  amdgpu_vf_error_trans_all(adev);
  +    iounmap(adev->rmmio);
  return r;
  }

[PATCH] drm/amd/display: Remove redundant condition in dcn35_calc_blocks_to_gate()

[Srinivasan Shanmugam]

pipe_ctx->plane_res.mpcc_inst is of a type that can only hold values
between 0 and 255, so it's always greater than or equal to 0.

Thus the condition 'pipe_ctx->plane_res.mpcc_inst >= 0' was always true
and has been removed.

Fixes the below:
drivers/gpu/drm/amd/amdgpu/../display/dc/hwss/dcn35/dcn35_hwseq.c:1023 
dcn35_calc_blocks_to_gate() warn: always true condition 
'(pipe_ctx->plane_res.mpcc_inst >= 0) => (0-255 >= 0)'

Fixes: 6f8b7565cca4 ("drm/amd/display: Add DCN35 HWSEQ")
Cc: Qingqing Zhuo 
Cc: Harry Wentland 
Cc: Rodrigo Siqueira 
Cc: Roman Li 
Cc: Aurabindo Pillai 
Cc: Tom Chung 
Signed-off-by: Srinivasan Shanmugam 
---
 drivers/gpu/drm/amd/display/dc/hwss/dcn35/dcn35_hwseq.c | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/drivers/gpu/drm/amd/display/dc/hwss/dcn35/dcn35_hwseq.c 
b/drivers/gpu/drm/amd/display/dc/hwss/dcn35/dcn35_hwseq.c
index 4b92df23ff0d..3dbbf6ea2603 100644
--- a/drivers/gpu/drm/amd/display/dc/hwss/dcn35/dcn35_hwseq.c
+++ b/drivers/gpu/drm/amd/display/dc/hwss/dcn35/dcn35_hwseq.c
@@ -1019,8 +1019,7 @@ void dcn35_calc_blocks_to_gate(struct dc *dc, struct 
dc_state *context,
if (pipe_ctx->plane_res.dpp)

update_state->pg_pipe_res_update[PG_DPP][pipe_ctx->plane_res.hubp->inst] = 
false;
 
-   if ((pipe_ctx->plane_res.dpp || pipe_ctx->stream_res.opp) &&
-   pipe_ctx->plane_res.mpcc_inst >= 0)
+   if (pipe_ctx->plane_res.dpp || pipe_ctx->stream_res.opp)

update_state->pg_pipe_res_update[PG_MPCC][pipe_ctx->plane_res.mpcc_inst] = 
false;
 
if (pipe_ctx->stream_res.dsc)
-- 
2.34.1

[PATCH] drm/amd/display: Fix logical operator in get_meta_and_pte_attr()

[Srinivasan Shanmugam]

logical operator in a condition check in the get_meta_and_pte_attr
function bitwise AND operator '&' was used in an 'if' statement, but the
logical AND operator '&&' was likely intended.

The condition check was changed from:
if (!surf_linear & (log2_dpte_req_height_ptes == 0) & surf_vert)
to the below:
if (!surf_linear && (log2_dpte_req_height_ptes == 0) && surf_vert)

This ensures that the 'if' statement will be true only if all three
conditions are met, which is the typical use case in an 'if' statement.

Fixes the below:
drivers/gpu/drm/amd/amdgpu/../display/dc/dml/dcn20/display_rq_dlg_calc_20.c:656 
get_meta_and_pte_attr() warn: maybe use && instead of &
drivers/gpu/drm/amd/amdgpu/../display/dc/dml/dcn20/display_rq_dlg_calc_20v2.c:656
 get_meta_and_pte_attr() warn: maybe use && instead of &
drivers/gpu/drm/amd/amdgpu/../display/dc/dml/dcn21/display_rq_dlg_calc_21.c:662 
get_meta_and_pte_attr() warn: maybe use && instead of &
drivers/gpu/drm/amd/amdgpu/../display/dc/dml/dcn30/display_rq_dlg_calc_30.c:627 
get_meta_and_pte_attr() warn: maybe use && instead of &
drivers/gpu/drm/amd/amdgpu/../display/dc/dml/dcn31/display_rq_dlg_calc_31.c:622 
get_meta_and_pte_attr() warn: maybe use && instead of &
drivers/gpu/drm/amd/amdgpu/../display/dc/dml/dcn314/display_rq_dlg_calc_314.c:710
 get_meta_and_pte_attr() warn: maybe use && instead of &

Cc: Rodrigo Siqueira 
Cc: Roman Li 
Cc: Aurabindo Pillai 
Cc: Tom Chung 
Signed-off-by: Srinivasan Shanmugam 
---
 .../gpu/drm/amd/display/dc/dml/dcn20/display_rq_dlg_calc_20.c  | 3 ++-
 .../drm/amd/display/dc/dml/dcn20/display_rq_dlg_calc_20v2.c| 3 ++-
 .../gpu/drm/amd/display/dc/dml/dcn21/display_rq_dlg_calc_21.c  | 3 ++-
 .../gpu/drm/amd/display/dc/dml/dcn30/display_rq_dlg_calc_30.c  | 3 ++-
 .../gpu/drm/amd/display/dc/dml/dcn31/display_rq_dlg_calc_31.c  | 3 ++-
 .../drm/amd/display/dc/dml/dcn314/display_rq_dlg_calc_314.c| 3 ++-
 6 files changed, 12 insertions(+), 6 deletions(-)

diff --git a/drivers/gpu/drm/amd/display/dc/dml/dcn20/display_rq_dlg_calc_20.c 
b/drivers/gpu/drm/amd/display/dc/dml/dcn20/display_rq_dlg_calc_20.c
index 548cdef8a8ad..e689afdf9e7b 100644
--- a/drivers/gpu/drm/amd/display/dc/dml/dcn20/display_rq_dlg_calc_20.c
+++ b/drivers/gpu/drm/amd/display/dc/dml/dcn20/display_rq_dlg_calc_20.c
@@ -653,7 +653,8 @@ static void get_meta_and_pte_attr(struct display_mode_lib 
*mode_lib,
 
// the dpte_group_bytes is reduced for the specific case of vertical
// access of a tile surface that has dpte request of 8x1 ptes.
-   if (!surf_linear & (log2_dpte_req_height_ptes == 0) & surf_vert) 
//reduced, in this case, will have page fault within a group
+   if (!surf_linear && log2_dpte_req_height_ptes == 0 &&
+   surf_vert) //reduced, in this case, will have page fault within a 
group
rq_sizing_param->dpte_group_bytes = 512;
else
//full size
diff --git 
a/drivers/gpu/drm/amd/display/dc/dml/dcn20/display_rq_dlg_calc_20v2.c 
b/drivers/gpu/drm/amd/display/dc/dml/dcn20/display_rq_dlg_calc_20v2.c
index 0fc9f3e3ffae..6d105a8bd4c7 100644
--- a/drivers/gpu/drm/amd/display/dc/dml/dcn20/display_rq_dlg_calc_20v2.c
+++ b/drivers/gpu/drm/amd/display/dc/dml/dcn20/display_rq_dlg_calc_20v2.c
@@ -653,7 +653,8 @@ static void get_meta_and_pte_attr(struct display_mode_lib 
*mode_lib,
 
// the dpte_group_bytes is reduced for the specific case of vertical
// access of a tile surface that has dpte request of 8x1 ptes.
-   if (!surf_linear & (log2_dpte_req_height_ptes == 0) & surf_vert) 
//reduced, in this case, will have page fault within a group
+   if (!surf_linear && log2_dpte_req_height_ptes == 0 &&
+   surf_vert) //reduced, in this case, will have page fault within a 
group
rq_sizing_param->dpte_group_bytes = 512;
else
//full size
diff --git a/drivers/gpu/drm/amd/display/dc/dml/dcn21/display_rq_dlg_calc_21.c 
b/drivers/gpu/drm/amd/display/dc/dml/dcn21/display_rq_dlg_calc_21.c
index 618f4b682ab1..5d604f52a948 100644
--- a/drivers/gpu/drm/amd/display/dc/dml/dcn21/display_rq_dlg_calc_21.c
+++ b/drivers/gpu/drm/amd/display/dc/dml/dcn21/display_rq_dlg_calc_21.c
@@ -659,7 +659,8 @@ static void get_meta_and_pte_attr(
if (hostvm_enable)
rq_sizing_param->dpte_group_bytes = 512;
else {
-   if (!surf_linear & (log2_dpte_req_height_ptes == 0) & 
surf_vert) //reduced, in this case, will have page fault within a group
+   if (!surf_linear && log2_dpte_req_height_ptes == 0 &&
+   surf_vert) //reduced, in this case, will have page fault 
within a group
rq_sizing_param->dpte_group_bytes = 512;
else
//full size
diff --git a/

[PATCH] drm/amd/display: Improve 'dml32_TruncToValidBPP()' function

[Srinivasan Shanmugam]

Refactors the dml32_TruncToValidBPP function by removing a
redundant return statement.

The function previously had a return statement at the end that was
never executed because all execution paths in the function ended with
a return statement before this line.

Fixes the below:
drivers/gpu/drm/amd/amdgpu/../display/dc/dml/dcn32/display_mode_vba_util_32.c:1680
 dml32_TruncToValidBPP() warn: ignoring unreachable code.

Fixes: dda4fb85e433 ("drm/amd/display: DML changes for DCN32/321")
Cc: Rodrigo Siqueira 
Cc: Roman Li 
Cc: Aurabindo Pillai 
Cc: Tom Chung 
Signed-off-by: Srinivasan Shanmugam 
---
 .../gpu/drm/amd/display/dc/dml/dcn32/display_mode_vba_util_32.c | 2 --
 1 file changed, 2 deletions(-)

diff --git 
a/drivers/gpu/drm/amd/display/dc/dml/dcn32/display_mode_vba_util_32.c 
b/drivers/gpu/drm/amd/display/dc/dml/dcn32/display_mode_vba_util_32.c
index 80fccd4999a5..54ac8242f7b0 100644
--- a/drivers/gpu/drm/amd/display/dc/dml/dcn32/display_mode_vba_util_32.c
+++ b/drivers/gpu/drm/amd/display/dc/dml/dcn32/display_mode_vba_util_32.c
@@ -1678,8 +1678,6 @@ double dml32_TruncToValidBPP(
}
 
*RequiredSlots = dml_ceil(DesiredBPP / MaxLinkBPP * 64, 1);
-
-   return BPP_INVALID;
 } // TruncToValidBPP
 
 double dml32_RequiredDTBCLK(
-- 
2.34.1

[PATCH] drm/amdgpu: Fix missing break in ATOM_ARG_IMM Case of atom_get_src_int()

[Srinivasan Shanmugam]

Missing break statement in the ATOM_ARG_IMM case of a switch statement,
adds the missing break statement, ensuring that the program's control
flow is as intended.

Fixes the below:
drivers/gpu/drm/amd/amdgpu/atom.c:323 atom_get_src_int() warn: ignoring 
unreachable code.

Fixes: d38ceaf99ed0 ("drm/amdgpu: add core driver (v4)")
Cc: Jammy Zhou 
Cc: Christian König 
Cc: Alex Deucher 
Signed-off-by: Srinivasan Shanmugam 
---
 drivers/gpu/drm/amd/amdgpu/atom.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/gpu/drm/amd/amdgpu/atom.c 
b/drivers/gpu/drm/amd/amdgpu/atom.c
index b888613f653f..72362df352f6 100644
--- a/drivers/gpu/drm/amd/amdgpu/atom.c
+++ b/drivers/gpu/drm/amd/amdgpu/atom.c
@@ -320,7 +320,7 @@ static uint32_t atom_get_src_int(atom_exec_context *ctx, 
uint8_t attr,
DEBUG("IMM 0x%02X\n", val);
return val;
}
-   return 0;
+   break;
case ATOM_ARG_PLL:
idx = U8(*ptr);
(*ptr)++;
-- 
2.34.1

[PATCH] drm/amd/amdgpu: Fix potential ioremap() memory leaks in amdgpu_device_init()

[Srinivasan Shanmugam]

This ensures that the memory mapped by ioremap for adev->rmmio, is
properly handled in amdgpu_device_init(). If the function exits early
due to an error, the memory is unmapped. If the function completes
successfully, the memory remains mapped.

Fixes the below:
drivers/gpu/drm/amd/amdgpu/amdgpu_device.c:4337 amdgpu_device_init() warn: 
'adev->rmmio' from ioremap() not released on lines: 
4035,4045,4051,4058,4068,4337

Cc: Christian König 
Cc: Alex Deucher 
Signed-off-by: Srinivasan Shanmugam 
---
 drivers/gpu/drm/amd/amdgpu/amdgpu_device.c | 18 ++
 1 file changed, 14 insertions(+), 4 deletions(-)

diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c 
b/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c
index 1ef892bea488..68bf5e910cb8 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c
@@ -4031,8 +4031,10 @@ int amdgpu_device_init(struct amdgpu_device *adev,
 * early on during init and before calling to RREG32.
 */
adev->reset_domain = amdgpu_reset_create_reset_domain(SINGLE_DEVICE, 
"amdgpu-reset-dev");
-   if (!adev->reset_domain)
+   if (!adev->reset_domain) {
+   iounmap(adev->rmmio);
return -ENOMEM;
+   }
 
/* detect hw virtualization here */
amdgpu_detect_virtualization(adev);
@@ -4042,20 +4044,25 @@ int amdgpu_device_init(struct amdgpu_device *adev,
r = amdgpu_device_get_job_timeout_settings(adev);
if (r) {
dev_err(adev->dev, "invalid lockup_timeout parameter syntax\n");
+   iounmap(adev->rmmio);
return r;
}
 
/* early init functions */
r = amdgpu_device_ip_early_init(adev);
-   if (r)
+   if (r) {
+   iounmap(adev->rmmio);
return r;
+   }
 
amdgpu_device_set_mcbp(adev);
 
/* Get rid of things like offb */
r = drm_aperture_remove_conflicting_pci_framebuffers(adev->pdev, 
_kms_driver);
-   if (r)
+   if (r) {
+   iounmap(adev->rmmio);
return r;
+   }
 
/* Enable TMZ based on IP_VERSION */
amdgpu_gmc_tmz_set(adev);
@@ -4064,8 +4071,10 @@ int amdgpu_device_init(struct amdgpu_device *adev,
/* Need to get xgmi info early to decide the reset behavior*/
if (adev->gmc.xgmi.supported) {
r = adev->gfxhub.funcs->get_xgmi_info(adev);
-   if (r)
+   if (r) {
+   iounmap(adev->rmmio);
return r;
+   }
}
 
/* enable PCIE atomic ops */
@@ -4334,6 +4343,7 @@ int amdgpu_device_init(struct amdgpu_device *adev,
 failed:
amdgpu_vf_error_trans_all(adev);
 
+   iounmap(adev->rmmio);
return r;
 }
 
-- 
2.34.1

[PATCH v3] drm/amd/display: Prevent potential buffer overflow in map_hw_resources

[Srinivasan Shanmugam]

Adds a check in the map_hw_resources function to prevent a potential
buffer overflow. The function was accessing arrays using an index that
could potentially be greater than the size of the arrays, leading to a
buffer overflow.

Adds a check to ensure that the index is within the bounds of the
arrays. If the index is out of bounds, an error message is printed and
break it will continue execution with just ignoring extra data early to
prevent the buffer overflow.

Reported by smatch:
drivers/gpu/drm/amd/amdgpu/../display/dc/dml2/dml2_wrapper.c:79 
map_hw_resources() error: buffer overflow 
'dml2->v20.scratch.dml_to_dc_pipe_mapping.disp_cfg_to_stream_id' 6 <= 7
drivers/gpu/drm/amd/amdgpu/../display/dc/dml2/dml2_wrapper.c:81 
map_hw_resources() error: buffer overflow 
'dml2->v20.scratch.dml_to_dc_pipe_mapping.disp_cfg_to_plane_id' 6 <= 7

Fixes: 482ce89eec1b ("drm/amd/display: Introduce DML2")
Cc: Rodrigo Siqueira 
Cc: Roman Li 
Cc: Qingqing Zhuo 
Cc: Aurabindo Pillai 
Cc: Tom Chung 
Signed-off-by: Srinivasan Shanmugam 
---
v3:
 - s/return/break as return may leave the system in a bad state

 drivers/gpu/drm/amd/display/dc/dml2/dml2_wrapper.c | 5 +
 1 file changed, 5 insertions(+)

diff --git a/drivers/gpu/drm/amd/display/dc/dml2/dml2_wrapper.c 
b/drivers/gpu/drm/amd/display/dc/dml2/dml2_wrapper.c
index 26307e599614..2a58a7687bdb 100644
--- a/drivers/gpu/drm/amd/display/dc/dml2/dml2_wrapper.c
+++ b/drivers/gpu/drm/amd/display/dc/dml2/dml2_wrapper.c
@@ -76,6 +76,11 @@ static void map_hw_resources(struct dml2_context *dml2,
in_out_display_cfg->hw.DLGRefClkFreqMHz = 50;
}
for (j = 0; j < mode_support_info->DPPPerSurface[i]; j++) {
+   if (i >= __DML2_WRAPPER_MAX_STREAMS_PLANES__) {
+   dml_print("DML::%s: Index out of bounds: i=%d, 
__DML2_WRAPPER_MAX_STREAMS_PLANES__=%d\n",
+ __func__, i, 
__DML2_WRAPPER_MAX_STREAMS_PLANES__);
+   break;
+   }

dml2->v20.scratch.dml_to_dc_pipe_mapping.dml_pipe_idx_to_stream_id[num_pipes] = 
dml2->v20.scratch.dml_to_dc_pipe_mapping.disp_cfg_to_stream_id[i];

dml2->v20.scratch.dml_to_dc_pipe_mapping.dml_pipe_idx_to_stream_id_valid[num_pipes]
 = true;

dml2->v20.scratch.dml_to_dc_pipe_mapping.dml_pipe_idx_to_plane_id[num_pipes] = 
dml2->v20.scratch.dml_to_dc_pipe_mapping.disp_cfg_to_plane_id[i];
-- 
2.34.1

[PATCH v2] drm/amd/display: Prevent potential buffer overflow in map_hw_resources

[Srinivasan Shanmugam]

Adds a check in the map_hw_resources function to prevent a
potential buffer overflow. The function was accessing arrays using an
index that could potentially be greater than the size of the arrays,
leading to a buffer overflow.

Adds a check to ensure that the index is within the bounds of
the arrays. If the index is out of bounds, an error message is printed
and the function returns early to prevent the buffer overflow.

Reported by smatch:
drivers/gpu/drm/amd/amdgpu/../display/dc/dml2/dml2_wrapper.c:79 
map_hw_resources() error: buffer overflow 
'dml2->v20.scratch.dml_to_dc_pipe_mapping.disp_cfg_to_stream_id' 6 <= 7
drivers/gpu/drm/amd/amdgpu/../display/dc/dml2/dml2_wrapper.c:81 
map_hw_resources() error: buffer overflow 
'dml2->v20.scratch.dml_to_dc_pipe_mapping.disp_cfg_to_plane_id' 6 <= 7

Fixes: 482ce89eec1b ("drm/amd/display: Introduce DML2")
Cc: Rodrigo Siqueira 
Cc: Roman Li 
Cc: Qingqing Zhuo 
Cc: Aurabindo Pillai 
Cc: Tom Chung 
Signed-off-by: Srinivasan Shanmugam 
---
v2:
  - fixes the below warnings due to incorrect line continuation string split 
across two lines

/linux/drivers/gpu/drm/amd/amdgpu/../display/dc/dml2/dml2_wrapper.c: In 
function ‘map_hw_resources’:
/linux/drivers/gpu/drm/amd/amdgpu/../display/dc/dml2/dml2_wrapper.c:80:15: 
error: missing terminating " character [-Werror]
   80 | dml_print("DML::%s: Index out of bounds: i=%d,
  |   ^
/linux/drivers/gpu/drm/amd/amdgpu/../display/dc/dml2/dml2_wrapper.c:81:48: 
error: missing terminating " character [-Werror]
   81 |__DML2_WRAPPER_MAX_STREAMS_PLANES__=%d\n",
  |^
cc1: all warnings being treated as errors
 

 drivers/gpu/drm/amd/display/dc/dml2/dml2_wrapper.c | 5 +
 1 file changed, 5 insertions(+)

diff --git a/drivers/gpu/drm/amd/display/dc/dml2/dml2_wrapper.c 
b/drivers/gpu/drm/amd/display/dc/dml2/dml2_wrapper.c
index 26307e599614..2ebeb2b384cf 100644
--- a/drivers/gpu/drm/amd/display/dc/dml2/dml2_wrapper.c
+++ b/drivers/gpu/drm/amd/display/dc/dml2/dml2_wrapper.c
@@ -76,6 +76,11 @@ static void map_hw_resources(struct dml2_context *dml2,
in_out_display_cfg->hw.DLGRefClkFreqMHz = 50;
}
for (j = 0; j < mode_support_info->DPPPerSurface[i]; j++) {
+   if (i >= __DML2_WRAPPER_MAX_STREAMS_PLANES__) {
+   dml_print("DML::%s: Index out of bounds: i=%d, 
__DML2_WRAPPER_MAX_STREAMS_PLANES__=%d\n",
+ __func__, i, 
__DML2_WRAPPER_MAX_STREAMS_PLANES__);
+   return;
+   }

dml2->v20.scratch.dml_to_dc_pipe_mapping.dml_pipe_idx_to_stream_id[num_pipes] = 
dml2->v20.scratch.dml_to_dc_pipe_mapping.disp_cfg_to_stream_id[i];

dml2->v20.scratch.dml_to_dc_pipe_mapping.dml_pipe_idx_to_stream_id_valid[num_pipes]
 = true;

dml2->v20.scratch.dml_to_dc_pipe_mapping.dml_pipe_idx_to_plane_id[num_pipes] = 
dml2->v20.scratch.dml_to_dc_pipe_mapping.disp_cfg_to_plane_id[i];
-- 
2.34.1

[PATCH] drm/amd/display: Prevent potential buffer overflow in map_hw_resources

[Srinivasan Shanmugam]

Adds a check in the map_hw_resources function to prevent a
potential buffer overflow. The function was accessing arrays using an
index that could potentially be greater than the size of the arrays,
leading to a buffer overflow.

Adds a check to ensure that the index is within the bounds of
the arrays. If the index is out of bounds, an error message is printed
and the function returns early to prevent the buffer overflow.

Reported by smatch:
drivers/gpu/drm/amd/amdgpu/../display/dc/dml2/dml2_wrapper.c:79 
map_hw_resources() error: buffer overflow 
'dml2->v20.scratch.dml_to_dc_pipe_mapping.disp_cfg_to_stream_id' 6 <= 7
drivers/gpu/drm/amd/amdgpu/../display/dc/dml2/dml2_wrapper.c:81 
map_hw_resources() error: buffer overflow 
'dml2->v20.scratch.dml_to_dc_pipe_mapping.disp_cfg_to_plane_id' 6 <= 7

Fixes: 482ce89eec1b ("drm/amd/display: Introduce DML2")
Cc: Rodrigo Siqueira 
Cc: Roman Li 
Cc: Qingqing Zhuo 
Cc: Aurabindo Pillai 
Cc: Tom Chung 
Signed-off-by: Srinivasan Shanmugam 
---
 drivers/gpu/drm/amd/display/dc/dml2/dml2_wrapper.c | 6 ++
 1 file changed, 6 insertions(+)

diff --git a/drivers/gpu/drm/amd/display/dc/dml2/dml2_wrapper.c 
b/drivers/gpu/drm/amd/display/dc/dml2/dml2_wrapper.c
index 26307e599614..0531d54b3d68 100644
--- a/drivers/gpu/drm/amd/display/dc/dml2/dml2_wrapper.c
+++ b/drivers/gpu/drm/amd/display/dc/dml2/dml2_wrapper.c
@@ -76,6 +76,12 @@ static void map_hw_resources(struct dml2_context *dml2,
in_out_display_cfg->hw.DLGRefClkFreqMHz = 50;
}
for (j = 0; j < mode_support_info->DPPPerSurface[i]; j++) {
+   if (i >= __DML2_WRAPPER_MAX_STREAMS_PLANES__) {
+   dml_print("DML::%s: Index out of bounds: i=%d,
+ 
__DML2_WRAPPER_MAX_STREAMS_PLANES__=%d\n",
+ __func__, i, 
__DML2_WRAPPER_MAX_STREAMS_PLANES__);
+   return;
+   }

dml2->v20.scratch.dml_to_dc_pipe_mapping.dml_pipe_idx_to_stream_id[num_pipes] = 
dml2->v20.scratch.dml_to_dc_pipe_mapping.disp_cfg_to_stream_id[i];

dml2->v20.scratch.dml_to_dc_pipe_mapping.dml_pipe_idx_to_stream_id_valid[num_pipes]
 = true;

dml2->v20.scratch.dml_to_dc_pipe_mapping.dml_pipe_idx_to_plane_id[num_pipes] = 
dml2->v20.scratch.dml_to_dc_pipe_mapping.disp_cfg_to_plane_id[i];
-- 
2.34.1

[PATCH v2] drm/amd/display: Fix potential null pointer dereference in dc_dmub_srv

[Srinivasan Shanmugam]

Fixes potential null pointer dereference warnings in the
dc_dmub_srv_cmd_list_queue_execute() and dc_dmub_srv_is_hw_pwr_up()
functions.

In both functions, the 'dc_dmub_srv' variable was being dereferenced
before it was checked for null. This could lead to a null pointer
dereference if 'dc_dmub_srv' is null. The fix is to check if
'dc_dmub_srv' is null before dereferencing it.

Thus moving the null checks for 'dc_dmub_srv' to the beginning of the
functions to ensure that 'dc_dmub_srv' is not null when it is
dereferenced.

Found by smatch & thus fixing the below:
drivers/gpu/drm/amd/amdgpu/../display/dc/dc_dmub_srv.c:133 
dc_dmub_srv_cmd_list_queue_execute() warn: variable dereferenced before check 
'dc_dmub_srv' (see line 128)
drivers/gpu/drm/amd/amdgpu/../display/dc/dc_dmub_srv.c:1167 
dc_dmub_srv_is_hw_pwr_up() warn: variable dereferenced before check 
'dc_dmub_srv' (see line 1164)

Fixes: 01fbdc34c687 ("drm/amd/display: decouple dmcub execution to reduce lock 
granularity")
Fixes: 65138eb72e1f ("drm/amd/display: Add DCN35 DMUB")
Cc: JinZe.Xu 
Cc: Hersen Wu 
Cc: Josip Pavic 
Cc: Roman Li 
Cc: Qingqing Zhuo 
Cc: Harry Wentland 
Cc: Rodrigo Siqueira 
Cc: Aurabindo Pillai 
Cc: Tom Chung 
Signed-off-by: Srinivasan Shanmugam 
---
v2:
 - For dc_dmub_srv_is_hw_pwr_up() move 'dc_ctx = dc_dmub_srv->ctx;'
   below 'if (dc_dmub_srv->ctx->dc->debug.dmcub_emulation)' (Tom) 

 drivers/gpu/drm/amd/display/dc/dc_dmub_srv.c | 7 +--
 1 file changed, 5 insertions(+), 2 deletions(-)

diff --git a/drivers/gpu/drm/amd/display/dc/dc_dmub_srv.c 
b/drivers/gpu/drm/amd/display/dc/dc_dmub_srv.c
index 0bc32537e2eb..a115e1170ef5 100644
--- a/drivers/gpu/drm/amd/display/dc/dc_dmub_srv.c
+++ b/drivers/gpu/drm/amd/display/dc/dc_dmub_srv.c
@@ -128,7 +128,7 @@ bool dc_dmub_srv_cmd_list_queue_execute(struct dc_dmub_srv 
*dc_dmub_srv,
unsigned int count,
union dmub_rb_cmd *cmd_list)
 {
-   struct dc_context *dc_ctx = dc_dmub_srv->ctx;
+   struct dc_context *dc_ctx;
struct dmub_srv *dmub;
enum dmub_status status;
int i;
@@ -136,6 +136,7 @@ bool dc_dmub_srv_cmd_list_queue_execute(struct dc_dmub_srv 
*dc_dmub_srv,
if (!dc_dmub_srv || !dc_dmub_srv->dmub)
return false;
 
+   dc_ctx = dc_dmub_srv->ctx;
dmub = dc_dmub_srv->dmub;
 
for (i = 0 ; i < count; i++) {
@@ -1169,7 +1170,7 @@ void dc_dmub_srv_subvp_save_surf_addr(const struct 
dc_dmub_srv *dc_dmub_srv, con
 
 bool dc_dmub_srv_is_hw_pwr_up(struct dc_dmub_srv *dc_dmub_srv, bool wait)
 {
-   struct dc_context *dc_ctx = dc_dmub_srv->ctx;
+   struct dc_context *dc_ctx;
enum dmub_status status;
 
if (!dc_dmub_srv || !dc_dmub_srv->dmub)
@@ -1177,6 +1178,8 @@ bool dc_dmub_srv_is_hw_pwr_up(struct dc_dmub_srv 
*dc_dmub_srv, bool wait)
 
if (dc_dmub_srv->ctx->dc->debug.dmcub_emulation)
return true;
+
+   dc_ctx = dc_dmub_srv->ctx;
 
if (wait) {
if (dc_dmub_srv->ctx->dc->debug.disable_timeout) {
-- 
2.34.1

[PATCH] drm/amd/display: Fix potential null pointer dereference in dc_dmub_srv

[Srinivasan Shanmugam]

Fixes potential null pointer dereference warnings in the
dc_dmub_srv_cmd_list_queue_execute() and dc_dmub_srv_is_hw_pwr_up()
functions.

In both functions, the 'dc_dmub_srv' variable was being dereferenced
before it was checked for null. This could lead to a null pointer
dereference if 'dc_dmub_srv' is null. The fix is to check if
'dc_dmub_srv' is null before dereferencing it.

Thus moving the null checks for 'dc_dmub_srv' to the beginning of the
functions to ensure that 'dc_dmub_srv' is not null when it is
dereferenced.

Found by smatch & thus fixing the below:
drivers/gpu/drm/amd/amdgpu/../display/dc/dc_dmub_srv.c:133 
dc_dmub_srv_cmd_list_queue_execute() warn: variable dereferenced before check 
'dc_dmub_srv' (see line 128)
drivers/gpu/drm/amd/amdgpu/../display/dc/dc_dmub_srv.c:1167 
dc_dmub_srv_is_hw_pwr_up() warn: variable dereferenced before check 
'dc_dmub_srv' (see line 1164)

Fixes: 01fbdc34c687 ("drm/amd/display: decouple dmcub execution to reduce lock 
granularity")
Fixes: 65138eb72e1f ("drm/amd/display: Add DCN35 DMUB")
Cc: JinZe.Xu 
Cc: Hersen Wu 
Cc: Josip Pavic 
Cc: Roman Li 
Cc: Qingqing Zhuo 
Cc: Harry Wentland 
Cc: Rodrigo Siqueira 
Cc: Aurabindo Pillai 
Cc: Tom Chung 
Signed-off-by: Srinivasan Shanmugam 
---
 drivers/gpu/drm/amd/display/dc/dc_dmub_srv.c | 7 +--
 1 file changed, 5 insertions(+), 2 deletions(-)

diff --git a/drivers/gpu/drm/amd/display/dc/dc_dmub_srv.c 
b/drivers/gpu/drm/amd/display/dc/dc_dmub_srv.c
index 0bc32537e2eb..8bc361e0f404 100644
--- a/drivers/gpu/drm/amd/display/dc/dc_dmub_srv.c
+++ b/drivers/gpu/drm/amd/display/dc/dc_dmub_srv.c
@@ -128,7 +128,7 @@ bool dc_dmub_srv_cmd_list_queue_execute(struct dc_dmub_srv 
*dc_dmub_srv,
unsigned int count,
union dmub_rb_cmd *cmd_list)
 {
-   struct dc_context *dc_ctx = dc_dmub_srv->ctx;
+   struct dc_context *dc_ctx;
struct dmub_srv *dmub;
enum dmub_status status;
int i;
@@ -136,6 +136,7 @@ bool dc_dmub_srv_cmd_list_queue_execute(struct dc_dmub_srv 
*dc_dmub_srv,
if (!dc_dmub_srv || !dc_dmub_srv->dmub)
return false;
 
+   dc_ctx = dc_dmub_srv->ctx;
dmub = dc_dmub_srv->dmub;
 
for (i = 0 ; i < count; i++) {
@@ -1169,12 +1170,14 @@ void dc_dmub_srv_subvp_save_surf_addr(const struct 
dc_dmub_srv *dc_dmub_srv, con
 
 bool dc_dmub_srv_is_hw_pwr_up(struct dc_dmub_srv *dc_dmub_srv, bool wait)
 {
-   struct dc_context *dc_ctx = dc_dmub_srv->ctx;
+   struct dc_context *dc_ctx;
enum dmub_status status;
 
if (!dc_dmub_srv || !dc_dmub_srv->dmub)
return true;
 
+   dc_ctx = dc_dmub_srv->ctx;
+
if (dc_dmub_srv->ctx->dc->debug.dmcub_emulation)
return true;
 
-- 
2.34.1

[PATCH] drm/amd/display: Add 'replay' NULL check in 'edp_set_replay_allow_active()'

[Srinivasan Shanmugam]

In the first if statement, we're checking if 'replay' is NULL. But in
the second if statement, we're not checking if 'replay' is NULL again
before calling replay->funcs->replay_set_power_opt().

if (replay == NULL && force_static)
return false;

...

if (link->replay_settings.replay_feature_enabled &&
replay->funcs->replay_set_power_opt) {
replay->funcs->replay_set_power_opt(replay, *power_opts, panel_inst);
link->replay_settings.replay_power_opt_active = *power_opts;
}

If 'replay' is NULL, this will cause a null pointer dereference.

Fixes the below found by smatch:
drivers/gpu/drm/amd/amdgpu/../display/dc/link/protocols/link_edp_panel_control.c:895
 edp_set_replay_allow_active() error: we previously assumed 'replay' could be 
null (see line 887)

Fixes: c7ddc0a800bc ("drm/amd/display: Add Functions to enable Freesync Panel 
Replay")
Cc: Bhawanpreet Lakha 
Cc: Roman Li 
Cc: Rodrigo Siqueira 
Cc: Aurabindo Pillai 
Cc: Tom Chung 
Suggested-by: Tom Chung 
Signed-off-by: Srinivasan Shanmugam 
---
 .../drm/amd/display/dc/link/protocols/link_edp_panel_control.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git 
a/drivers/gpu/drm/amd/display/dc/link/protocols/link_edp_panel_control.c 
b/drivers/gpu/drm/amd/display/dc/link/protocols/link_edp_panel_control.c
index 443215b96308..acfbbc638cc6 100644
--- a/drivers/gpu/drm/amd/display/dc/link/protocols/link_edp_panel_control.c
+++ b/drivers/gpu/drm/amd/display/dc/link/protocols/link_edp_panel_control.c
@@ -892,7 +892,8 @@ bool edp_set_replay_allow_active(struct dc_link *link, 
const bool *allow_active,
 
/* Set power optimization flag */
if (power_opts && link->replay_settings.replay_power_opt_active != 
*power_opts) {
-   if (link->replay_settings.replay_feature_enabled && 
replay->funcs->replay_set_power_opt) {
+   if (replay != NULL && 
link->replay_settings.replay_feature_enabled &&
+   replay->funcs->replay_set_power_opt) {
replay->funcs->replay_set_power_opt(replay, 
*power_opts, panel_inst);
link->replay_settings.replay_power_opt_active = 
*power_opts;
}
-- 
2.34.1

[PATCH] drm/amdgpu/display: Address kdoc for 'is_psr_su' in 'fill_dc_dirty_rects'

[Srinivasan Shanmugam]

The is_psr_su parameter is a boolean flag indicating whether the Panel
Self Refresh Selective Update (PSR SU) feature is enabled which is a
power-saving feature that allows only the updated regions of the screen
to be refreshed, reducing the amount of data that needs to be sent to
the display.

Fixes the below with gcc W=1:
drivers/gpu/drm/amd/amdgpu/../display/amdgpu_dm/amdgpu_dm.c:5257: warning: 
Function parameter or member 'is_psr_su' not described in 'fill_dc_dirty_rects'

Fixes: 13d6b0812e58 ("drm/amdgpu: make damage clips support configurable")
Cc: sta...@vger.kernel.org
Cc: Hamza Mahfooz 
Cc: Mario Limonciello 
Cc: Rodrigo Siqueira 
Cc: Aurabindo Pillai 
Signed-off-by: Srinivasan Shanmugam 
---
 drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c | 4 
 1 file changed, 4 insertions(+)

diff --git a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c 
b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
index b9ac3d2f8029..1b51f7fb48ea 100644
--- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
+++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
@@ -5234,6 +5234,10 @@ static inline void fill_dc_dirty_rect(struct drm_plane 
*plane,
  * @new_plane_state: New state of @plane
  * @crtc_state: New state of CRTC connected to the @plane
  * @flip_addrs: DC flip tracking struct, which also tracts dirty rects
+ * @is_psr_su: Flag indicating whether Panel Self Refresh Selective Update 
(PSR SU) is enabled.
+ * If PSR SU is enabled and damage clips are available, only the 
regions of the screen
+ * that have changed will be updated. If PSR SU is not enabled,
+ * or if damage clips are not available, the entire screen will be 
updated.
  * @dirty_regions_changed: dirty regions changed
  *
  * For PSR SU, DC informs the DMUB uController of dirty rectangle regions
-- 
2.34.1

[PATCH] drm/amdgpu: Fix missing parameter descriptions in ih_v7_0.c

[Srinivasan Shanmugam]

Rectifies kdoc warnings related to the 'ih' parameter in the
'ih_v7_0_get_wptr', 'ih_v7_0_irq_rearm', and 'ih_v7_0_set_rptr'
functions within the 'ih_v7_0.c' file.

Fixes the below with gcc W=1:
drivers/gpu/drm/amd/amdgpu/ih_v7_0.c:392: warning: Function parameter or member 
'ih' not described in 'ih_v7_0_get_wptr'
drivers/gpu/drm/amd/amdgpu/ih_v7_0.c:432: warning: Function parameter or member 
'ih' not described in 'ih_v7_0_irq_rearm'
drivers/gpu/drm/amd/amdgpu/ih_v7_0.c:458: warning: Function parameter or member 
'ih' not described in 'ih_v7_0_set_rptr'

Fixes: b6ba7a165b13 ("drm/amdgpu: Add ih v7_0 ip block support")
Cc: Likun Gao 
Cc: Hawking Zhang 
Cc: Christian König 
Cc: Alex Deucher 
Signed-off-by: Srinivasan Shanmugam 
---
 drivers/gpu/drm/amd/amdgpu/ih_v7_0.c | 7 ---
 1 file changed, 4 insertions(+), 3 deletions(-)

diff --git a/drivers/gpu/drm/amd/amdgpu/ih_v7_0.c 
b/drivers/gpu/drm/amd/amdgpu/ih_v7_0.c
index 236806797b23..16fe428c0722 100644
--- a/drivers/gpu/drm/amd/amdgpu/ih_v7_0.c
+++ b/drivers/gpu/drm/amd/amdgpu/ih_v7_0.c
@@ -378,9 +378,10 @@ static void ih_v7_0_irq_disable(struct amdgpu_device *adev)
 }
 
 /**
- * ih_v7_0_get_wptr - get the IH ring buffer wptr
+ * ih_v7_0_get_wptr() - get the IH ring buffer wptr
  *
  * @adev: amdgpu_device pointer
+ * @ih: IH ring buffer to fetch wptr
  *
  * Get the IH ring buffer wptr from either the register
  * or the writeback memory buffer.  Also check for
@@ -425,6 +426,7 @@ static u32 ih_v7_0_get_wptr(struct amdgpu_device *adev,
  * ih_v7_0_irq_rearm - rearm IRQ if lost
  *
  * @adev: amdgpu_device pointer
+ * @ih: IH ring to match
  *
  */
 static void ih_v7_0_irq_rearm(struct amdgpu_device *adev,
@@ -450,8 +452,7 @@ static void ih_v7_0_irq_rearm(struct amdgpu_device *adev,
  * ih_v7_0_set_rptr - set the IH ring buffer rptr
  *
  * @adev: amdgpu_device pointer
- *
- * Set the IH ring buffer rptr.
+ * @ih: IH ring buffer to set rptr
  */
 static void ih_v7_0_set_rptr(struct amdgpu_device *adev,
   struct amdgpu_ih_ring *ih)
-- 
2.34.1

[PATCH] drm/amdgpu: Drop unused function 'static void amdgpu_choose_low_power_state()' in amdgpu/amdgpu.h

[Srinivasan Shanmugam]

'static void amdgpu_choose_low_power_state() {
}' is nowhere used, thus drop it.

Fixing the below:
In file included from
drivers/gpu/drm/amd/amdgpu/amdgpu.h:1559:13: error:
‘amdgpu_choose_low_power_state’ defined but not used
[-Werror=unused-function] 1559 | static void
amdgpu_choose_low_power_state(struct amdgpu_device *adev) { } |
^ cc1: all warnings being treated as errors

Fixes: c1251e31ec25 ("drm/amd: Stop evicting resources on APUs in suspend")
Cc: Mario Limonciello 
Cc: Christian König 
Cc: Alex Deucher 
Signed-off-by: Srinivasan Shanmugam 
---
 drivers/gpu/drm/amd/amdgpu/amdgpu.h | 1 -
 1 file changed, 1 deletion(-)

diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu.h 
b/drivers/gpu/drm/amd/amdgpu/amdgpu.h
index 2a3f12bae823..32ad5c49ab74 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu.h
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu.h
@@ -1556,7 +1556,6 @@ void amdgpu_choose_low_power_state(struct amdgpu_device 
*adev);
 #else
 static inline bool amdgpu_acpi_is_s0ix_active(struct amdgpu_device *adev) { 
return false; }
 static inline bool amdgpu_acpi_is_s3_active(struct amdgpu_device *adev) { 
return false; }
-static void amdgpu_choose_low_power_state(struct amdgpu_device *adev) { }
 #endif
 
 #if defined(CONFIG_DRM_AMD_DC)
-- 
2.34.1

Re: [PATCH v2] drm/amd/display: Add NULL test for 'timing generator' in 'dcn21_set_pipe()'

[SRINIVASAN SHANMUGAM]

On 2/13/2024 12:07 AM, Kees Cook wrote:

On Thu, Feb 01, 2024 at 03:28:45PM +0530, Srinivasan Shanmugam wrote:

In "u32 otg_inst = pipe_ctx->stream_res.tg->inst;"
pipe_ctx->stream_res.tg could be NULL, it is relying on the caller to
ensure the tg is not NULL.

Fixes: 474ac4a875ca ("drm/amd/display: Implement some asic specific abm call 
backs.")
Cc: Yongqiang Sun 
Cc: Anthony Koo 
Cc: Rodrigo Siqueira 
Cc: Aurabindo Pillai 
Signed-off-by: Srinivasan Shanmugam 
---
v2:
   - s/u32/uint32_t for consistency (Anthony)

  .../amd/display/dc/hwss/dcn21/dcn21_hwseq.c   | 24 +++
  1 file changed, 14 insertions(+), 10 deletions(-)

diff --git a/drivers/gpu/drm/amd/display/dc/hwss/dcn21/dcn21_hwseq.c 
b/drivers/gpu/drm/amd/display/dc/hwss/dcn21/dcn21_hwseq.c
index 8e88dcaf88f5..8323077bba15 100644
--- a/drivers/gpu/drm/amd/display/dc/hwss/dcn21/dcn21_hwseq.c
+++ b/drivers/gpu/drm/amd/display/dc/hwss/dcn21/dcn21_hwseq.c
@@ -206,28 +206,32 @@ void dcn21_set_abm_immediate_disable(struct pipe_ctx 
*pipe_ctx)
  void dcn21_set_pipe(struct pipe_ctx *pipe_ctx)
  {
struct abm *abm = pipe_ctx->stream_res.abm;
-   uint32_t otg_inst = pipe_ctx->stream_res.tg->inst;
+   struct timing_generator *tg = pipe_ctx->stream_res.tg;
struct panel_cntl *panel_cntl = pipe_ctx->stream->link->panel_cntl;
struct dmcu *dmcu = pipe_ctx->stream->ctx->dc->res_pool->dmcu;
+   uint32_t otg_inst;
+
+   if (!abm && !tg && !panel_cntl)
+   return;
+
+   otg_inst = tg->inst;

Is the "if" supposed to be using "||"s instead of "&&"s? I noticed
Coverity complained "tg may be NULL" for the "tg->inst" dereference...

-Kees


Thanks Kees!

It is fixed in the below commit:

commit ccc1e78470efb6572a71ba88d70995e8eee2f6e5
Author: Dan Carpenter 
Date:   Fri Feb 9 16:02:42 2024 +0300

    drm/amd/display: Fix && vs || typos

    These ANDs should be ORs or it will lead to a NULL dereference.

    Fixes: fb5a3d037082 ("drm/amd/display: Add NULL test for 'timing 
generator' in 'dcn21_set_pipe()'")
    Fixes: 886571d217d7 ("drm/amd/display: Fix 'panel_cntl' could be 
null in 'dcn21_set_backlight_level()'")

    Reviewed-by: Anthony Koo 
    Signed-off-by: Dan Carpenter 
    Signed-off-by: Hamza Mahfooz 

-Srini

[PATCH v2] drm/amdgpu/display: Initialize gamma correction mode variable in dcn30_get_gamcor_current()

[Srinivasan Shanmugam]

The dcn30_get_gamcor_current() function is responsible for determining
the current gamma correction mode used by the display controller.
However, the 'mode' variable, which stores the gamma correction mode,
was not initialized before its first usage, leading to an uninitialized
symbol error.

Thus initializes the 'mode' variable with a default value of LUT_BYPASS
before the conditional statements in the function, improves code clarity
and stability, ensuring correct behavior of the
dcn30_get_gamcor_current() function in determining the gamma correction
mode.

Fixes the below:
drivers/gpu/drm/amd/amdgpu/../display/dc/dcn30/dcn30_dpp_cm.c:77 
dpp30_get_gamcor_current() error: uninitialized symbol 'mode'.

Fixes: 03f54d7d3448 ("drm/amd/display: Add DCN3 DPP")
Cc: Bhawanpreet Lakha 
Cc: Rodrigo Siqueira 
Cc: Aurabindo Pillai 
Cc: Tom Chung 
Signed-off-by: Srinivasan Shanmugam 
Suggested-by: Roman Li 
---
v2:
 - removed the below redundant code (Roman)
if (state_mode == 0)
mode = LUT_BYPASS; 

 drivers/gpu/drm/amd/display/dc/dcn30/dcn30_dpp_cm.c | 5 +
 1 file changed, 1 insertion(+), 4 deletions(-)

diff --git a/drivers/gpu/drm/amd/display/dc/dcn30/dcn30_dpp_cm.c 
b/drivers/gpu/drm/amd/display/dc/dcn30/dcn30_dpp_cm.c
index 54ec144f7b81..2f5b3fbd3507 100644
--- a/drivers/gpu/drm/amd/display/dc/dcn30/dcn30_dpp_cm.c
+++ b/drivers/gpu/drm/amd/display/dc/dcn30/dcn30_dpp_cm.c
@@ -56,16 +56,13 @@ static void dpp3_enable_cm_block(
 
 static enum dc_lut_mode dpp30_get_gamcor_current(struct dpp *dpp_base)
 {
-   enum dc_lut_mode mode;
+   enum dc_lut_mode mode = LUT_BYPASS;
uint32_t state_mode;
uint32_t lut_mode;
struct dcn3_dpp *dpp = TO_DCN30_DPP(dpp_base);
 
REG_GET(CM_GAMCOR_CONTROL, CM_GAMCOR_MODE_CURRENT, _mode);
 
-   if (state_mode == 0)
-   mode = LUT_BYPASS;
-
if (state_mode == 2) {//Programmable RAM LUT
REG_GET(CM_GAMCOR_CONTROL, CM_GAMCOR_SELECT_CURRENT, _mode);
if (lut_mode == 0)
-- 
2.34.1

[PATCH] drm/amdgpu/display: Initialize gamma correction mode variable in dcn30_get_gamcor_current()

[Srinivasan Shanmugam]

The dcn30_get_gamcor_current() function is responsible for determining
the current gamma correction mode used by the display controller.
However, the 'mode' variable, which stores the gamma correction mode,
was not initialized before its first usage, leading to an uninitialized
symbol error.

Thus initializes the 'mode' variable with a default value of LUT_BYPASS
before the conditional statements in the function, improves code clarity
and stability, ensuring correct behavior of the
dcn30_get_gamcor_current() function in determining the gamma correction
mode.

Fixes the below:
drivers/gpu/drm/amd/amdgpu/../display/dc/dcn30/dcn30_dpp_cm.c:77 
dpp30_get_gamcor_current() error: uninitialized symbol 'mode'.

Fixes: 03f54d7d3448 ("drm/amd/display: Add DCN3 DPP")
Cc: Bhawanpreet Lakha 
Cc: Rodrigo Siqueira 
Cc: Aurabindo Pillai 
Cc: Tom Chung 
Signed-off-by: Srinivasan Shanmugam 
---
 drivers/gpu/drm/amd/display/dc/dcn30/dcn30_dpp_cm.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/gpu/drm/amd/display/dc/dcn30/dcn30_dpp_cm.c 
b/drivers/gpu/drm/amd/display/dc/dcn30/dcn30_dpp_cm.c
index 54ec144f7b81..5276b50cf901 100644
--- a/drivers/gpu/drm/amd/display/dc/dcn30/dcn30_dpp_cm.c
+++ b/drivers/gpu/drm/amd/display/dc/dcn30/dcn30_dpp_cm.c
@@ -56,7 +56,7 @@ static void dpp3_enable_cm_block(
 
 static enum dc_lut_mode dpp30_get_gamcor_current(struct dpp *dpp_base)
 {
-   enum dc_lut_mode mode;
+   enum dc_lut_mode mode = LUT_BYPASS;
uint32_t state_mode;
uint32_t lut_mode;
struct dcn3_dpp *dpp = TO_DCN30_DPP(dpp_base);
-- 
2.34.1

[PATCH] drm/amd/display: Fix && vs || in 'edp_set_replay_allow_active()'

[Srinivasan Shanmugam]

AND should be OR or it will lead to a NULL dereference.

Fixes the below:
drivers/gpu/drm/amd/amdgpu/../display/dc/link/protocols/link_edp_panel_control.c:895
 edp_set_replay_allow_active() error: we previously assumed 'replay' could be 
null (see line 887)

Fixes: c7ddc0a800bc ("drm/amd/display: Add Functions to enable Freesync Panel 
Replay")
Cc: Bhawanpreet Lakha 
Cc: Harry Wentland 
Cc: Rodrigo Siqueira 
Cc: Aurabindo Pillai 
Signed-off-by: Srinivasan Shanmugam 
---
 .../drm/amd/display/dc/link/protocols/link_edp_panel_control.c  | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git 
a/drivers/gpu/drm/amd/display/dc/link/protocols/link_edp_panel_control.c 
b/drivers/gpu/drm/amd/display/dc/link/protocols/link_edp_panel_control.c
index 443215b96308..77648228ec60 100644
--- a/drivers/gpu/drm/amd/display/dc/link/protocols/link_edp_panel_control.c
+++ b/drivers/gpu/drm/amd/display/dc/link/protocols/link_edp_panel_control.c
@@ -884,7 +884,7 @@ bool edp_set_replay_allow_active(struct dc_link *link, 
const bool *allow_active,
struct dmub_replay *replay = dc->res_pool->replay;
unsigned int panel_inst;
 
-   if (replay == NULL && force_static)
+   if (!replay || force_static)
return false;
 
if (!dc_get_edp_link_panel_inst(dc, link, _inst))
-- 
2.34.1

[PATCH] drm/amd/display: Fix possible use of uninitialized 'max_chunks_fbc_mode' in 'calculate_bandwidth()'

[Srinivasan Shanmugam]

'max_chunks_fbc_mode' is only declared and assigned a value under a
specific condition in the following lines:

if (data->fbc_en[i] == 1) {
max_chunks_fbc_mode = 128 - dmif_chunk_buff_margin;
}

If 'data->fbc_en[i]' is not equal to 1 for any i, max_chunks_fbc_mode
will not be initialized if it's used outside of this for loop.

Ensure that 'max_chunks_fbc_mode' is properly initialized before it's
used. Initialize it to a default value right after its declaration to
ensure that it gets a value assigned under all possible control flow
paths.

Thus fixing the below:
drivers/gpu/drm/amd/amdgpu/../display/dc/basics/dce_calcs.c:914 
calculate_bandwidth() error: uninitialized symbol 'max_chunks_fbc_mode'.
drivers/gpu/drm/amd/amdgpu/../display/dc/basics/dce_calcs.c:917 
calculate_bandwidth() error: uninitialized symbol 'max_chunks_fbc_mode'.

Fixes: 4562236b3bc0 ("drm/amd/dc: Add dc display driver (v2)")
Cc: Harry Wentland 
Cc: Alex Deucher 
Cc: Rodrigo Siqueira 
Cc: Aurabindo Pillai 
Signed-off-by: Srinivasan Shanmugam 
---
 drivers/gpu/drm/amd/display/dc/basics/dce_calcs.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/gpu/drm/amd/display/dc/basics/dce_calcs.c 
b/drivers/gpu/drm/amd/display/dc/basics/dce_calcs.c
index f2dfa96f9ef5..39530b2ea495 100644
--- a/drivers/gpu/drm/amd/display/dc/basics/dce_calcs.c
+++ b/drivers/gpu/drm/amd/display/dc/basics/dce_calcs.c
@@ -94,7 +94,7 @@ static void calculate_bandwidth(
const uint32_t s_high = 7;
const uint32_t dmif_chunk_buff_margin = 1;
 
-   uint32_t max_chunks_fbc_mode;
+   uint32_t max_chunks_fbc_mode = 0;
int32_t num_cursor_lines;
 
int32_t i, j, k;
-- 
2.34.1

[PATCH] drm/amd/display: Fix possible buffer overflow in 'find_dcfclk_for_voltage()'

[Srinivasan Shanmugam]

when 'find_dcfclk_for_voltage()' function is looping over
VG_NUM_SOC_VOLTAGE_LEVELS (which is 8), but the size of the DcfClocks
array is VG_NUM_DCFCLK_DPM_LEVELS (which is 7).

When the loop variable i reaches 7, the function tries to access
clock_table->DcfClocks[7]. However, since the size of the DcfClocks
array is 7, the valid indices are 0 to 6. Index 7 is beyond the size of
the array, leading to a buffer overflow.

Fixes the below:
drivers/gpu/drm/amd/amdgpu/../display/dc/clk_mgr/dcn301/vg_clk_mgr.c:550 
find_dcfclk_for_voltage() error: buffer overflow 'clock_table->DcfClocks' 7 <= 7

Fixes: 3a83e4e64bb1 ("drm/amd/display: Add dcn3.01 support to DC (v2)")
Cc: Roman Li 
Cc: Rodrigo Siqueira 
Cc: Aurabindo Pillai 
Signed-off-by: Srinivasan Shanmugam 
---
 drivers/gpu/drm/amd/display/dc/clk_mgr/dcn301/vg_clk_mgr.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/drivers/gpu/drm/amd/display/dc/clk_mgr/dcn301/vg_clk_mgr.c 
b/drivers/gpu/drm/amd/display/dc/clk_mgr/dcn301/vg_clk_mgr.c
index a5489fe6875f..aa9fd1dc550a 100644
--- a/drivers/gpu/drm/amd/display/dc/clk_mgr/dcn301/vg_clk_mgr.c
+++ b/drivers/gpu/drm/amd/display/dc/clk_mgr/dcn301/vg_clk_mgr.c
@@ -546,6 +546,8 @@ static unsigned int find_dcfclk_for_voltage(const struct 
vg_dpm_clocks *clock_ta
int i;
 
for (i = 0; i < VG_NUM_SOC_VOLTAGE_LEVELS; i++) {
+   if (i >= VG_NUM_DCFCLK_DPM_LEVELS)
+   break;
if (clock_table->SocVoltage[i] == voltage)
return clock_table->DcfClocks[i];
}
-- 
2.34.1

[PATCH] drm/amd/display: Fix possible NULL dereference on device remove/driver unload

[Srinivasan Shanmugam]

As part of a cleanup amdgpu_dm_fini() function, which is typically
called when a device is being shut down or a driver is being unloaded

The below error message suggests that there is a potential null pointer
dereference issue with adev->dm.dc.

In the below, line of code where adev->dm.dc is used without a preceding
null check:

for (i = 0; i < adev->dm.dc->caps.max_links; i++) {

To fix this issue, add a null check for adev->dm.dc before this line.

Reported by smatch:
drivers/gpu/drm/amd/amdgpu/../display/amdgpu_dm/amdgpu_dm.c:1959 
amdgpu_dm_fini() error: we previously assumed 'adev->dm.dc' could be null (see 
line 1943)

Fixes: 006c26a0f1c8 ("drm/amd/display: Fix crash on device remove/driver 
unload")
Cc: Andrey Grodzovsky 
Cc: Harry Wentland 
Cc: Rodrigo Siqueira 
Cc: Aurabindo Pillai 
Signed-off-by: Srinivasan Shanmugam 
---
 drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c 
b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
index b3a5e730be24..d4c1415f4562 100644
--- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
+++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
@@ -1956,7 +1956,7 @@ static void amdgpu_dm_fini(struct amdgpu_device *adev)
  >dm.dmub_bo_gpu_addr,
  >dm.dmub_bo_cpu_addr);
 
-   if (adev->dm.hpd_rx_offload_wq) {
+   if (adev->dm.hpd_rx_offload_wq && adev->dm.dc) {
for (i = 0; i < adev->dm.dc->caps.max_links; i++) {
if (adev->dm.hpd_rx_offload_wq[i].wq) {

destroy_workqueue(adev->dm.hpd_rx_offload_wq[i].wq);
-- 
2.34.1

[PATCH] drm/amd/display: Initialize 'wait_time_microsec' variable in link_dp_training_dpia.c

[Srinivasan Shanmugam]

wait_time_microsec = max(wait_time_microsec, (uint32_t)
DPIA_CLK_SYNC_DELAY);

Above line is trying to assign the maximum value between
'wait_time_microsec' and 'DPIA_CLK_SYNC_DELAY' to wait_time_microsec.
However, 'wait_time_microsec' has not been assigned a value before this
line, initialize 'wait_time_microsec' at the point of declaration.

Fixes the below:
drivers/gpu/drm/amd/amdgpu/../display/dc/link/protocols/link_dp_training_dpia.c:697
 dpia_training_eq_non_transparent() error: uninitialized symbol 
'wait_time_microsec'.

Fixes: 630168a97314 ("drm/amd/display: move dp link training logic to 
link_dp_training")
Cc: Wenjing Liu 
Cc: Rodrigo Siqueira 
Cc: Aurabindo Pillai 
Signed-off-by: Srinivasan Shanmugam 
---
 .../drm/amd/display/dc/link/protocols/link_dp_training_dpia.c   | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git 
a/drivers/gpu/drm/amd/display/dc/link/protocols/link_dp_training_dpia.c 
b/drivers/gpu/drm/amd/display/dc/link/protocols/link_dp_training_dpia.c
index e8dda44b23cb..5d36bab0029c 100644
--- a/drivers/gpu/drm/amd/display/dc/link/protocols/link_dp_training_dpia.c
+++ b/drivers/gpu/drm/amd/display/dc/link/protocols/link_dp_training_dpia.c
@@ -619,7 +619,7 @@ static enum link_training_result 
dpia_training_eq_non_transparent(
uint32_t retries_eq = 0;
enum dc_status status;
enum dc_dp_training_pattern tr_pattern;
-   uint32_t wait_time_microsec;
+   uint32_t wait_time_microsec = 0;
enum dc_lane_count lane_count = lt_settings->link_settings.lane_count;
union lane_align_status_updated dpcd_lane_status_updated = {0};
union lane_status dpcd_lane_status[LANE_COUNT_DP_MAX] = {0};
-- 
2.34.1

[PATCH v2] drm/amd/display: Implement bounds check for stream encoder creation in DCN301

[Srinivasan Shanmugam]

'stream_enc_regs' array is an array of dcn10_stream_enc_registers
structures. The array is initialized with four elements, corresponding
to the four calls to stream_enc_regs() in the array initializer. This
means that valid indices for this array are 0, 1, 2, and 3.

The error message 'stream_enc_regs' 4 <= 5 below, is indicating that
there is an attempt to access this array with an index of 5, which is
out of bounds. This could lead to undefined behavior

Here, eng_id is used as an index to access the stream_enc_regs array. If
eng_id is 5, this would result in an out-of-bounds access on the
stream_enc_regs array.

Thus fixing Buffer overflow error in dcn301_stream_encoder_create
reported by Smatch:
drivers/gpu/drm/amd/amdgpu/../display/dc/resource/dcn301/dcn301_resource.c:1011 
dcn301_stream_encoder_create() error: buffer overflow 'stream_enc_regs' 4 <= 5

Fixes: 3a83e4e64bb1 ("drm/amd/display: Add dcn3.01 support to DC (v2)")
Cc: Roman Li 
Cc: Rodrigo Siqueira 
Cc: Aurabindo Pillai 
Signed-off-by: Srinivasan Shanmugam 
---
 .../drm/amd/display/dc/resource/dcn301/dcn301_resource.c | 9 -
 1 file changed, 4 insertions(+), 5 deletions(-)

diff --git a/drivers/gpu/drm/amd/display/dc/resource/dcn301/dcn301_resource.c 
b/drivers/gpu/drm/amd/display/dc/resource/dcn301/dcn301_resource.c
index 511ff6b5b985..4a475a723191 100644
--- a/drivers/gpu/drm/amd/display/dc/resource/dcn301/dcn301_resource.c
+++ b/drivers/gpu/drm/amd/display/dc/resource/dcn301/dcn301_resource.c
@@ -999,7 +999,7 @@ static struct stream_encoder 
*dcn301_stream_encoder_create(enum engine_id eng_id
vpg = dcn301_vpg_create(ctx, vpg_inst);
afmt = dcn301_afmt_create(ctx, afmt_inst);
 
-   if (!enc1 || !vpg || !afmt) {
+   if (!enc1 || !vpg || !afmt || eng_id >= ARRAY_SIZE(stream_enc_regs)) {
kfree(enc1);
kfree(vpg);
kfree(afmt);
@@ -1007,10 +1007,9 @@ static struct stream_encoder 
*dcn301_stream_encoder_create(enum engine_id eng_id
}
 
dcn30_dio_stream_encoder_construct(enc1, ctx, ctx->dc_bios,
-   eng_id, vpg, afmt,
-   _enc_regs[eng_id],
-   _shift, _mask);
-
+  eng_id, vpg, afmt,
+  _enc_regs[eng_id],
+  _shift, _mask);
return >base;
 }
 
-- 
2.34.1

[PATCH] drm/amd/display: Implement bounds check for stream encoder creation in DCN301

[Srinivasan Shanmugam]

'stream_enc_regs' array is an array of dcn10_stream_enc_registers
structures. The array is initialized with four elements, corresponding
to the four calls to stream_enc_regs() in the array initializer. This
means that valid indices for this array are 0, 1, 2, and 3.

The error message 'stream_enc_regs' 4 <= 5 below, is indicating that
there is an attempt to access this array with an index of 5, which is
out of bounds. This could lead to undefined behavior

Here, eng_id is used as an index to access the stream_enc_regs array. If
eng_id is 5, this would result in an out-of-bounds access.

Fixes the below:
drivers/gpu/drm/amd/amdgpu/../display/dc/resource/dcn301/dcn301_resource.c:1011 
dcn301_stream_encoder_create() error: buffer overflow 'stream_enc_regs' 4 <= 5

Fixes: 3a83e4e64bb1 ("drm/amd/display: Add dcn3.01 support to DC (v2)")
Cc: Roman Li 
Cc: Rodrigo Siqueira 
Cc: Aurabindo Pillai 
Signed-off-by: Srinivasan Shanmugam 
---
 .../display/dc/resource/dcn301/dcn301_resource.c | 16 
 1 file changed, 12 insertions(+), 4 deletions(-)

diff --git a/drivers/gpu/drm/amd/display/dc/resource/dcn301/dcn301_resource.c 
b/drivers/gpu/drm/amd/display/dc/resource/dcn301/dcn301_resource.c
index 511ff6b5b985..f915d7c3980e 100644
--- a/drivers/gpu/drm/amd/display/dc/resource/dcn301/dcn301_resource.c
+++ b/drivers/gpu/drm/amd/display/dc/resource/dcn301/dcn301_resource.c
@@ -1006,10 +1006,18 @@ static struct stream_encoder 
*dcn301_stream_encoder_create(enum engine_id eng_id
return NULL;
}
 
-   dcn30_dio_stream_encoder_construct(enc1, ctx, ctx->dc_bios,
-   eng_id, vpg, afmt,
-   _enc_regs[eng_id],
-   _shift, _mask);
+   if (eng_id < ARRAY_SIZE(stream_enc_regs)) {
+   dcn30_dio_stream_encoder_construct(enc1, ctx, ctx->dc_bios,
+  eng_id, vpg, afmt,
+  _enc_regs[eng_id],
+  _shift, _mask);
+   } else {
+   DRM_ERROR("Invalid engine id: %d\n", eng_id);
+   kfree(enc1);
+   kfree(vpg);
+   kfree(afmt);
+   return NULL;
+   }
 
return >base;
 }
-- 
2.34.1

[PATCH v3] drm/amdgpu: Fix potential out-of-bounds access in 'amdgpu_discovery_reg_base_init()'

[Srinivasan Shanmugam]

The issue arises when the array 'adev->vcn.vcn_config' is accessed
before checking if the index 'adev->vcn.num_vcn_inst' is within the
bounds of the array.

The fix involves moving the bounds check before the array access. This
ensures that 'adev->vcn.num_vcn_inst' is within the bounds of the array
before it is used as an index.

Fixes the below:
drivers/gpu/drm/amd/amdgpu/amdgpu_discovery.c:1289 
amdgpu_discovery_reg_base_init() error: testing array offset 
'adev->vcn.num_vcn_inst' after use.

Fixes: aaf1090a6cb6 ("drm/amdgpu: Add instance mask for VCN and JPEG")
Cc: Christian König 
Cc: Alex Deucher 
Signed-off-by: Srinivasan Shanmugam 
---
v3:
 - Added fixes tag. 

 drivers/gpu/drm/amd/amdgpu/amdgpu_discovery.c | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_discovery.c 
b/drivers/gpu/drm/amd/amdgpu/amdgpu_discovery.c
index ef800590c1ab..93c84a1c1d3e 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_discovery.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_discovery.c
@@ -1282,11 +1282,10 @@ static int amdgpu_discovery_reg_base_init(struct 
amdgpu_device *adev)
 * 0b10 : encode is disabled
 * 0b01 : decode is disabled
 */
-   adev->vcn.vcn_config[adev->vcn.num_vcn_inst] =
-   ip->revision & 0xc0;
-   ip->revision &= ~0xc0;
if (adev->vcn.num_vcn_inst <
AMDGPU_MAX_VCN_INSTANCES) {
+   
adev->vcn.vcn_config[adev->vcn.num_vcn_inst] =
+   ip->revision & 0xc0;
adev->vcn.num_vcn_inst++;
adev->vcn.inst_mask |=
(1U << ip->instance_number);
@@ -1297,6 +1296,7 @@ static int amdgpu_discovery_reg_base_init(struct 
amdgpu_device *adev)
adev->vcn.num_vcn_inst + 1,
AMDGPU_MAX_VCN_INSTANCES);
}
+   ip->revision &= ~0xc0;
}
if (le16_to_cpu(ip->hw_id) == SDMA0_HWID ||
le16_to_cpu(ip->hw_id) == SDMA1_HWID ||
-- 
2.34.1

[PATCH v2] drm/amdgpu: Fix potential out-of-bounds access in 'amdgpu_discovery_reg_base_init()'

[Srinivasan Shanmugam]

The issue arises when the array 'adev->vcn.vcn_config' is accessed
before checking if the index 'adev->vcn.num_vcn_inst' is within the
bounds of the array.

The fix involves moving the bounds check before the array access. This
ensures that 'adev->vcn.num_vcn_inst' is within the bounds of the array
before it is used as an index.

Fixes the below:
drivers/gpu/drm/amd/amdgpu/amdgpu_discovery.c:1289 
amdgpu_discovery_reg_base_init() error: testing array offset 
'adev->vcn.num_vcn_inst' after use.

Cc: Christian König 
Cc: Alex Deucher 
Signed-off-by: Srinivasan Shanmugam 
---
v2:
 - `ip->revision &= ~0xc0;` should always be executed, not just if the number 
of instances < MAX_VCN_INSTANCES. (Alex)

 drivers/gpu/drm/amd/amdgpu/amdgpu_discovery.c | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_discovery.c 
b/drivers/gpu/drm/amd/amdgpu/amdgpu_discovery.c
index ef800590c1ab..93c84a1c1d3e 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_discovery.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_discovery.c
@@ -1282,11 +1282,10 @@ static int amdgpu_discovery_reg_base_init(struct 
amdgpu_device *adev)
 * 0b10 : encode is disabled
 * 0b01 : decode is disabled
 */
-   adev->vcn.vcn_config[adev->vcn.num_vcn_inst] =
-   ip->revision & 0xc0;
-   ip->revision &= ~0xc0;
if (adev->vcn.num_vcn_inst <
AMDGPU_MAX_VCN_INSTANCES) {
+   
adev->vcn.vcn_config[adev->vcn.num_vcn_inst] =
+   ip->revision & 0xc0;
adev->vcn.num_vcn_inst++;
adev->vcn.inst_mask |=
(1U << ip->instance_number);
@@ -1297,6 +1296,7 @@ static int amdgpu_discovery_reg_base_init(struct 
amdgpu_device *adev)
adev->vcn.num_vcn_inst + 1,
AMDGPU_MAX_VCN_INSTANCES);
}
+   ip->revision &= ~0xc0;
}
if (le16_to_cpu(ip->hw_id) == SDMA0_HWID ||
le16_to_cpu(ip->hw_id) == SDMA1_HWID ||
-- 
2.34.1

[PATCH] drm/amdgpu: Fix potential out-of-bounds access in 'amdgpu_discovery_reg_base_init()'

[Srinivasan Shanmugam]

The issue arises when the array 'adev->vcn.vcn_config' is accessed
before checking if the index 'adev->vcn.num_vcn_inst' is within the
bounds of the array.

The fix involves moving the bounds check before the array access. This
ensures that 'adev->vcn.num_vcn_inst' is within the bounds of the array
before it is used as an index.

Fixes the below:
drivers/gpu/drm/amd/amdgpu/amdgpu_discovery.c:1289 
amdgpu_discovery_reg_base_init() error: testing array offset 
'adev->vcn.num_vcn_inst' after use.

Cc: Christian König 
Cc: Alex Deucher 
Signed-off-by: Srinivasan Shanmugam 
---
 drivers/gpu/drm/amd/amdgpu/amdgpu_discovery.c | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_discovery.c 
b/drivers/gpu/drm/amd/amdgpu/amdgpu_discovery.c
index ef800590c1ab..83da46d73f70 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_discovery.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_discovery.c
@@ -1282,11 +1282,11 @@ static int amdgpu_discovery_reg_base_init(struct 
amdgpu_device *adev)
 * 0b10 : encode is disabled
 * 0b01 : decode is disabled
 */
-   adev->vcn.vcn_config[adev->vcn.num_vcn_inst] =
-   ip->revision & 0xc0;
-   ip->revision &= ~0xc0;
if (adev->vcn.num_vcn_inst <
AMDGPU_MAX_VCN_INSTANCES) {
+   
adev->vcn.vcn_config[adev->vcn.num_vcn_inst] =
+   ip->revision & 0xc0;
+   ip->revision &= ~0xc0;
adev->vcn.num_vcn_inst++;
adev->vcn.inst_mask |=
(1U << ip->instance_number);
-- 
2.34.1

[PATCH v2] drm/amd/display: Add NULL test for 'timing generator' in 'dcn21_set_pipe()'

[Srinivasan Shanmugam]

In "u32 otg_inst = pipe_ctx->stream_res.tg->inst;"
pipe_ctx->stream_res.tg could be NULL, it is relying on the caller to
ensure the tg is not NULL.

Fixes: 474ac4a875ca ("drm/amd/display: Implement some asic specific abm call 
backs.")
Cc: Yongqiang Sun 
Cc: Anthony Koo 
Cc: Rodrigo Siqueira 
Cc: Aurabindo Pillai 
Signed-off-by: Srinivasan Shanmugam 
---
v2:
  - s/u32/uint32_t for consistency (Anthony)

 .../amd/display/dc/hwss/dcn21/dcn21_hwseq.c   | 24 +++
 1 file changed, 14 insertions(+), 10 deletions(-)

diff --git a/drivers/gpu/drm/amd/display/dc/hwss/dcn21/dcn21_hwseq.c 
b/drivers/gpu/drm/amd/display/dc/hwss/dcn21/dcn21_hwseq.c
index 8e88dcaf88f5..8323077bba15 100644
--- a/drivers/gpu/drm/amd/display/dc/hwss/dcn21/dcn21_hwseq.c
+++ b/drivers/gpu/drm/amd/display/dc/hwss/dcn21/dcn21_hwseq.c
@@ -206,28 +206,32 @@ void dcn21_set_abm_immediate_disable(struct pipe_ctx 
*pipe_ctx)
 void dcn21_set_pipe(struct pipe_ctx *pipe_ctx)
 {
struct abm *abm = pipe_ctx->stream_res.abm;
-   uint32_t otg_inst = pipe_ctx->stream_res.tg->inst;
+   struct timing_generator *tg = pipe_ctx->stream_res.tg;
struct panel_cntl *panel_cntl = pipe_ctx->stream->link->panel_cntl;
struct dmcu *dmcu = pipe_ctx->stream->ctx->dc->res_pool->dmcu;
+   uint32_t otg_inst;
+
+   if (!abm && !tg && !panel_cntl)
+   return;
+
+   otg_inst = tg->inst;
 
if (dmcu) {
dce110_set_pipe(pipe_ctx);
return;
}
 
-   if (abm && panel_cntl) {
-   if (abm->funcs && abm->funcs->set_pipe_ex) {
-   abm->funcs->set_pipe_ex(abm,
+   if (abm->funcs && abm->funcs->set_pipe_ex) {
+   abm->funcs->set_pipe_ex(abm,
otg_inst,
SET_ABM_PIPE_NORMAL,
panel_cntl->inst,
panel_cntl->pwrseq_inst);
-   } else {
-   dmub_abm_set_pipe(abm, otg_inst,
-   SET_ABM_PIPE_NORMAL,
-   panel_cntl->inst,
-   panel_cntl->pwrseq_inst);
-   }
+   } else {
+   dmub_abm_set_pipe(abm, otg_inst,
+ SET_ABM_PIPE_NORMAL,
+ panel_cntl->inst,
+ panel_cntl->pwrseq_inst);
}
 }
 
-- 
2.34.1

[PATCH v3] drm/amd/display: Fix 'panel_cntl' could be null in 'dcn21_set_backlight_level()'

[Srinivasan Shanmugam]

'panel_cntl' structure used to control the display panel could be null,
dereferencing it could lead to a null pointer access.

Fixes the below:
drivers/gpu/drm/amd/amdgpu/../display/dc/hwss/dcn21/dcn21_hwseq.c:269 
dcn21_set_backlight_level() error: we previously assumed 'panel_cntl' could be 
null (see line 250)

Fixes: 474ac4a875ca ("drm/amd/display: Implement some asic specific abm call 
backs.")
Cc: Yongqiang Sun 
Cc: Anthony Koo 
Cc: Rodrigo Siqueira 
Cc: Aurabindo Pillai 
Signed-off-by: Srinivasan Shanmugam 
---
v3:
 - s/u32/uint32_t for consistency (Anthony)

 .../amd/display/dc/hwss/dcn21/dcn21_hwseq.c   | 39 ++-
 1 file changed, 20 insertions(+), 19 deletions(-)

diff --git a/drivers/gpu/drm/amd/display/dc/hwss/dcn21/dcn21_hwseq.c 
b/drivers/gpu/drm/amd/display/dc/hwss/dcn21/dcn21_hwseq.c
index 8323077bba15..5c7f380a84f9 100644
--- a/drivers/gpu/drm/amd/display/dc/hwss/dcn21/dcn21_hwseq.c
+++ b/drivers/gpu/drm/amd/display/dc/hwss/dcn21/dcn21_hwseq.c
@@ -241,34 +241,35 @@ bool dcn21_set_backlight_level(struct pipe_ctx *pipe_ctx,
 {
struct dc_context *dc = pipe_ctx->stream->ctx;
struct abm *abm = pipe_ctx->stream_res.abm;
+   struct timing_generator *tg = pipe_ctx->stream_res.tg;
struct panel_cntl *panel_cntl = pipe_ctx->stream->link->panel_cntl;
+   uint32_t otg_inst;
+
+   if (!abm && !tg && !panel_cntl)
+   return false;
+
+   otg_inst = tg->inst;
 
if (dc->dc->res_pool->dmcu) {
dce110_set_backlight_level(pipe_ctx, backlight_pwm_u16_16, 
frame_ramp);
return true;
}
 
-   if (abm != NULL) {
-   uint32_t otg_inst = pipe_ctx->stream_res.tg->inst;
-
-   if (abm && panel_cntl) {
-   if (abm->funcs && abm->funcs->set_pipe_ex) {
-   abm->funcs->set_pipe_ex(abm,
-   otg_inst,
-   SET_ABM_PIPE_NORMAL,
-   panel_cntl->inst,
-   panel_cntl->pwrseq_inst);
-   } else {
-   dmub_abm_set_pipe(abm,
-   otg_inst,
-   SET_ABM_PIPE_NORMAL,
-   panel_cntl->inst,
-   
panel_cntl->pwrseq_inst);
-   }
-   }
+   if (abm->funcs && abm->funcs->set_pipe_ex) {
+   abm->funcs->set_pipe_ex(abm,
+   otg_inst,
+   SET_ABM_PIPE_NORMAL,
+   panel_cntl->inst,
+   panel_cntl->pwrseq_inst);
+   } else {
+   dmub_abm_set_pipe(abm,
+ otg_inst,
+ SET_ABM_PIPE_NORMAL,
+ panel_cntl->inst,
+ panel_cntl->pwrseq_inst);
}
 
-   if (abm && abm->funcs && abm->funcs->set_backlight_level_pwm)
+   if (abm->funcs && abm->funcs->set_backlight_level_pwm)
abm->funcs->set_backlight_level_pwm(abm, backlight_pwm_u16_16,
frame_ramp, 0, panel_cntl->inst);
else
-- 
2.34.1

[PATCH] drm/amd/display: Add NULL test for 'timing generator' in 'dcn21_set_pipe()'

[Srinivasan Shanmugam]

In "u32 otg_inst = pipe_ctx->stream_res.tg->inst;"
pipe_ctx->stream_res.tg could be NULL, it is relying on the caller to
ensure the tg is not NULL.

Fixes: 474ac4a875ca ("drm/amd/display: Implement some asic specific abm call 
backs.")
Cc: Yongqiang Sun 
Cc: Anthony Koo 
Cc: Rodrigo Siqueira 
Cc: Aurabindo Pillai 
Signed-off-by: Srinivasan Shanmugam 
---
 .../amd/display/dc/hwss/dcn21/dcn21_hwseq.c   | 24 +++
 1 file changed, 14 insertions(+), 10 deletions(-)

diff --git a/drivers/gpu/drm/amd/display/dc/hwss/dcn21/dcn21_hwseq.c 
b/drivers/gpu/drm/amd/display/dc/hwss/dcn21/dcn21_hwseq.c
index 5d2d8fd64d98..4e21af0942ea 100644
--- a/drivers/gpu/drm/amd/display/dc/hwss/dcn21/dcn21_hwseq.c
+++ b/drivers/gpu/drm/amd/display/dc/hwss/dcn21/dcn21_hwseq.c
@@ -206,28 +206,32 @@ void dcn21_set_abm_immediate_disable(struct pipe_ctx 
*pipe_ctx)
 void dcn21_set_pipe(struct pipe_ctx *pipe_ctx)
 {
struct abm *abm = pipe_ctx->stream_res.abm;
-   uint32_t otg_inst = pipe_ctx->stream_res.tg->inst;
+   struct timing_generator *tg = pipe_ctx->stream_res.tg;
struct panel_cntl *panel_cntl = pipe_ctx->stream->link->panel_cntl;
struct dmcu *dmcu = pipe_ctx->stream->ctx->dc->res_pool->dmcu;
+   u32 otg_inst;
+
+   if (!abm && !tg && !panel_cntl)
+   return;
+
+   otg_inst = tg->inst;
 
if (dmcu) {
dce110_set_pipe(pipe_ctx);
return;
}
 
-   if (abm && panel_cntl) {
-   if (abm->funcs && abm->funcs->set_pipe_ex) {
-   abm->funcs->set_pipe_ex(abm,
+   if (abm->funcs && abm->funcs->set_pipe_ex) {
+   abm->funcs->set_pipe_ex(abm,
otg_inst,
SET_ABM_PIPE_NORMAL,
panel_cntl->inst,
panel_cntl->pwrseq_inst);
-   } else {
-   dmub_abm_set_pipe(abm, otg_inst,
-   SET_ABM_PIPE_NORMAL,
-   panel_cntl->inst,
-   panel_cntl->pwrseq_inst);
-   }
+   } else {
+   dmub_abm_set_pipe(abm, otg_inst,
+ SET_ABM_PIPE_NORMAL,
+ panel_cntl->inst,
+ panel_cntl->pwrseq_inst);
}
 }
 
-- 
2.34.1

[PATCH v2] drm/amd/display: Fix 'panel_cntl' could be null in 'dcn21_set_backlight_level()'

[Srinivasan Shanmugam]

'panel_cntl' structure used to control the display panel could be null,
dereferencing it could lead to a null pointer access.

Fixes the below:
drivers/gpu/drm/amd/amdgpu/../display/dc/hwss/dcn21/dcn21_hwseq.c:269 
dcn21_set_backlight_level() error: we previously assumed 'panel_cntl' could be 
null (see line 250)

Fixes: 474ac4a875ca ("drm/amd/display: Implement some asic specific abm call 
backs.")
Cc: Yongqiang Sun 
Cc: Anthony Koo 
Cc: Rodrigo Siqueira 
Cc: Aurabindo Pillai 
Signed-off-by: Srinivasan Shanmugam 
---
v2:
 - Add NULL check for timing generator also which controls CRTC (Anthony)

 .../amd/display/dc/hwss/dcn21/dcn21_hwseq.c   | 39 ++-
 1 file changed, 20 insertions(+), 19 deletions(-)

diff --git a/drivers/gpu/drm/amd/display/dc/hwss/dcn21/dcn21_hwseq.c 
b/drivers/gpu/drm/amd/display/dc/hwss/dcn21/dcn21_hwseq.c
index 8e88dcaf88f5..5d2d8fd64d98 100644
--- a/drivers/gpu/drm/amd/display/dc/hwss/dcn21/dcn21_hwseq.c
+++ b/drivers/gpu/drm/amd/display/dc/hwss/dcn21/dcn21_hwseq.c
@@ -237,34 +237,35 @@ bool dcn21_set_backlight_level(struct pipe_ctx *pipe_ctx,
 {
struct dc_context *dc = pipe_ctx->stream->ctx;
struct abm *abm = pipe_ctx->stream_res.abm;
+   struct timing_generator *tg = pipe_ctx->stream_res.tg;
struct panel_cntl *panel_cntl = pipe_ctx->stream->link->panel_cntl;
+   u32 otg_inst;
+
+   if (!abm && !tg && !panel_cntl)
+   return false;
+
+   otg_inst = tg->inst;
 
if (dc->dc->res_pool->dmcu) {
dce110_set_backlight_level(pipe_ctx, backlight_pwm_u16_16, 
frame_ramp);
return true;
}
 
-   if (abm != NULL) {
-   uint32_t otg_inst = pipe_ctx->stream_res.tg->inst;
-
-   if (abm && panel_cntl) {
-   if (abm->funcs && abm->funcs->set_pipe_ex) {
-   abm->funcs->set_pipe_ex(abm,
-   otg_inst,
-   SET_ABM_PIPE_NORMAL,
-   panel_cntl->inst,
-   panel_cntl->pwrseq_inst);
-   } else {
-   dmub_abm_set_pipe(abm,
-   otg_inst,
-   SET_ABM_PIPE_NORMAL,
-   panel_cntl->inst,
-   
panel_cntl->pwrseq_inst);
-   }
-   }
+   if (abm->funcs && abm->funcs->set_pipe_ex) {
+   abm->funcs->set_pipe_ex(abm,
+   otg_inst,
+   SET_ABM_PIPE_NORMAL,
+   panel_cntl->inst,
+   panel_cntl->pwrseq_inst);
+   } else {
+   dmub_abm_set_pipe(abm,
+ otg_inst,
+ SET_ABM_PIPE_NORMAL,
+ panel_cntl->inst,
+ panel_cntl->pwrseq_inst);
}
 
-   if (abm && abm->funcs && abm->funcs->set_backlight_level_pwm)
+   if (abm->funcs && abm->funcs->set_backlight_level_pwm)
abm->funcs->set_backlight_level_pwm(abm, backlight_pwm_u16_16,
frame_ramp, 0, panel_cntl->inst);
else
-- 
2.34.1

[PATCH v3] drm/amdgpu: Fix missing error code in 'gmc_v6/7/8/9_0_hw_init()'

[Srinivasan Shanmugam]

Return 0 for success scenairos in 'gmc_v6/7/8/9_0_hw_init()'

Fixes the below:
drivers/gpu/drm/amd/amdgpu/gmc_v6_0.c:920 gmc_v6_0_hw_init() warn: missing 
error code? 'r'
drivers/gpu/drm/amd/amdgpu/gmc_v7_0.c:1104 gmc_v7_0_hw_init() warn: missing 
error code? 'r'
drivers/gpu/drm/amd/amdgpu/gmc_v8_0.c:1224 gmc_v8_0_hw_init() warn: missing 
error code? 'r'
drivers/gpu/drm/amd/amdgpu/gmc_v9_0.c:2347 gmc_v9_0_hw_init() warn: missing 
error code? 'r'

Fixes: 8301de8fcadc ("drm/amdgpu: Fix with right return code '-EIO' in 
'amdgpu_gmc_vram_checking()'")
Cc: Christian König 
Cc: Alex Deucher 
Signed-off-by: Srinivasan Shanmugam 
---
v3: 
  - Changed from 'return r;' to 'return 0' (Christian)

 drivers/gpu/drm/amd/amdgpu/gmc_v6_0.c | 4 ++--
 drivers/gpu/drm/amd/amdgpu/gmc_v7_0.c | 4 ++--
 drivers/gpu/drm/amd/amdgpu/gmc_v8_0.c | 4 ++--
 drivers/gpu/drm/amd/amdgpu/gmc_v9_0.c | 4 ++--
 4 files changed, 8 insertions(+), 8 deletions(-)

diff --git a/drivers/gpu/drm/amd/amdgpu/gmc_v6_0.c 
b/drivers/gpu/drm/amd/amdgpu/gmc_v6_0.c
index 229263e407e0..23b478639921 100644
--- a/drivers/gpu/drm/amd/amdgpu/gmc_v6_0.c
+++ b/drivers/gpu/drm/amd/amdgpu/gmc_v6_0.c
@@ -916,8 +916,8 @@ static int gmc_v6_0_hw_init(void *handle)
 
if (amdgpu_emu_mode == 1)
return amdgpu_gmc_vram_checking(adev);
-   else
-   return r;
+
+   return 0;
 }
 
 static int gmc_v6_0_hw_fini(void *handle)
diff --git a/drivers/gpu/drm/amd/amdgpu/gmc_v7_0.c 
b/drivers/gpu/drm/amd/amdgpu/gmc_v7_0.c
index d95f719eec55..3da7b6a2b00d 100644
--- a/drivers/gpu/drm/amd/amdgpu/gmc_v7_0.c
+++ b/drivers/gpu/drm/amd/amdgpu/gmc_v7_0.c
@@ -1100,8 +1100,8 @@ static int gmc_v7_0_hw_init(void *handle)
 
if (amdgpu_emu_mode == 1)
return amdgpu_gmc_vram_checking(adev);
-   else
-   return r;
+
+   return 0;
 }
 
 static int gmc_v7_0_hw_fini(void *handle)
diff --git a/drivers/gpu/drm/amd/amdgpu/gmc_v8_0.c 
b/drivers/gpu/drm/amd/amdgpu/gmc_v8_0.c
index 4eb0cccdb413..969a9e867170 100644
--- a/drivers/gpu/drm/amd/amdgpu/gmc_v8_0.c
+++ b/drivers/gpu/drm/amd/amdgpu/gmc_v8_0.c
@@ -1220,8 +1220,8 @@ static int gmc_v8_0_hw_init(void *handle)
 
if (amdgpu_emu_mode == 1)
return amdgpu_gmc_vram_checking(adev);
-   else
-   return r;
+
+   return 0;
 }
 
 static int gmc_v8_0_hw_fini(void *handle)
diff --git a/drivers/gpu/drm/amd/amdgpu/gmc_v9_0.c 
b/drivers/gpu/drm/amd/amdgpu/gmc_v9_0.c
index a3a11538207b..4a50537252ac 100644
--- a/drivers/gpu/drm/amd/amdgpu/gmc_v9_0.c
+++ b/drivers/gpu/drm/amd/amdgpu/gmc_v9_0.c
@@ -2343,8 +2343,8 @@ static int gmc_v9_0_hw_init(void *handle)
 
if (amdgpu_emu_mode == 1)
return amdgpu_gmc_vram_checking(adev);
-   else
-   return r;
+
+   return 0;
 }
 
 /**
-- 
2.34.1

Re: [PATCH] drm/amd/display: Fix buffer overflow in 'get_host_router_total_dp_tunnel_bw()'

[SRINIVASAN SHANMUGAM]

+ Cc: Tom Chung 

On 1/29/2024 9:19 PM, Srinivasan Shanmugam wrote:

The error message buffer overflow 'dc->links' 12 <= 12 suggests that the
code is trying to access an element of the dc->links array that is
beyond its bounds. In C, arrays are zero-indexed, so an array with 12
elements has valid indices from 0 to 11. Trying to access dc->links[12]
would be an attempt to access the 13th element of a 12-element array,
which is a buffer overflow.

To fix this, ensure that the loop does not go beyond the last valid
index when accessing dc->links[i + 1] by subtracting 1 from the loop
condition.

This would ensure that i + 1 is always a valid index in the array.

Fixes the below:
drivers/gpu/drm/amd/amdgpu/../display/dc/link/protocols/link_dp_dpia_bw.c:208 
get_host_router_total_dp_tunnel_bw() error: buffer overflow 'dc->links' 12 <= 12

Fixes: 9ed0893b7c58 ("drm/amd/display: Add dpia display mode validation logic")
Cc: PeiChen Huang
Cc: Aric Cyr
Cc: Rodrigo Siqueira
Cc: Aurabindo Pillai
Cc: Meenakshikumar Somasundaram
Signed-off-by: Srinivasan Shanmugam
---
  drivers/gpu/drm/amd/display/dc/link/protocols/link_dp_dpia_bw.c | 2 +-
  1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/gpu/drm/amd/display/dc/link/protocols/link_dp_dpia_bw.c 
b/drivers/gpu/drm/amd/display/dc/link/protocols/link_dp_dpia_bw.c
index dd0d2b206462..5491b707cec8 100644
--- a/drivers/gpu/drm/amd/display/dc/link/protocols/link_dp_dpia_bw.c
+++ b/drivers/gpu/drm/amd/display/dc/link/protocols/link_dp_dpia_bw.c
@@ -196,7 +196,7 @@ static int get_host_router_total_dp_tunnel_bw(const struct 
dc *dc, uint8_t hr_in
struct dc_link *link_dpia_primary, *link_dpia_secondary;
int total_bw = 0;
  
-	for (uint8_t i = 0; i < MAX_PIPES * 2; ++i) {

+   for (uint8_t i = 0; i < (MAX_PIPES * 2) - 1; ++i) {
  
  		if (!dc->links[i] || dc->links[i]->ep_type != DISPLAY_ENDPOINT_USB4_DPIA)

continue;

Re: [PATCH] drm/amd/display: Add NULL check for kzalloc in 'amdgpu_dm_atomic_commit_tail()'

[SRINIVASAN SHANMUGAM]

+ Cc: Tom Chung 

On 1/30/2024 2:11 PM, SHANMUGAM, SRINIVASAN wrote:

Add a NULL check for the kzalloc call that allocates memory for
dummy_updates in the amdgpu_dm_atomic_commit_tail function. Previously,
if kzalloc failed to allocate memory and returned NULL, the code would
attempt to use the NULL pointer.

The fix is to check if kzalloc returns NULL, and if so, log an error
message and skip the rest of the current loop iteration with the
continue statement.  This prevents the code from attempting to use the
NULL pointer.

Cc: Julia Lawall 
Cc: Aurabindo Pillai 
Cc: Rodrigo Siqueira 
Cc: Alex Hung 
Cc: Alex Deucher 
Signed-off-by: Srinivasan Shanmugam 
---
  drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c | 4 
  1 file changed, 4 insertions(+)

diff --git a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c 
b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
index 0bf1bc7ced7d..8590c9f1dda6 100644
--- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
+++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
@@ -9236,6 +9236,10 @@ static void amdgpu_dm_atomic_commit_tail(struct 
drm_atomic_state *state)
 * To fix this, DC should permit updating only stream 
properties.
 */
dummy_updates = kzalloc(sizeof(struct dc_surface_update) * 
MAX_SURFACES, GFP_ATOMIC);
+   if (!dummy_updates) {
+   DRM_ERROR("Failed to allocate memory for 
dummy_updates.\n");
+   continue;
+   }
for (j = 0; j < status->plane_count; j++)
dummy_updates[j].surface = status->plane_states[0];
  

[PATCH] drm/amd/display: Add NULL check for kzalloc in 'amdgpu_dm_atomic_commit_tail()'

[Srinivasan Shanmugam]

Add a NULL check for the kzalloc call that allocates memory for
dummy_updates in the amdgpu_dm_atomic_commit_tail function. Previously,
if kzalloc failed to allocate memory and returned NULL, the code would
attempt to use the NULL pointer.

The fix is to check if kzalloc returns NULL, and if so, log an error
message and skip the rest of the current loop iteration with the
continue statement.  This prevents the code from attempting to use the
NULL pointer.

Cc: Julia Lawall 
Cc: Aurabindo Pillai 
Cc: Rodrigo Siqueira 
Cc: Alex Hung 
Cc: Alex Deucher 
Signed-off-by: Srinivasan Shanmugam 
---
 drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c | 4 
 1 file changed, 4 insertions(+)

diff --git a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c 
b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
index 0bf1bc7ced7d..8590c9f1dda6 100644
--- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
+++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
@@ -9236,6 +9236,10 @@ static void amdgpu_dm_atomic_commit_tail(struct 
drm_atomic_state *state)
 * To fix this, DC should permit updating only stream 
properties.
 */
dummy_updates = kzalloc(sizeof(struct dc_surface_update) * 
MAX_SURFACES, GFP_ATOMIC);
+   if (!dummy_updates) {
+   DRM_ERROR("Failed to allocate memory for 
dummy_updates.\n");
+   continue;
+   }
for (j = 0; j < status->plane_count; j++)
dummy_updates[j].surface = status->plane_states[0];
 
-- 
2.34.1

[PATCH v2] drm/amdgpu: Fix missing error code in 'gmc_v6/7/8/9_0_hw_init()'

[Srinivasan Shanmugam]

Return r for success scenairos in 'gmc_v6/7/8/9_0_hw_init()'

Fixes the below:
drivers/gpu/drm/amd/amdgpu/gmc_v6_0.c:920 gmc_v6_0_hw_init() warn: missing 
error code? 'r'
drivers/gpu/drm/amd/amdgpu/gmc_v7_0.c:1104 gmc_v7_0_hw_init() warn: missing 
error code? 'r'
drivers/gpu/drm/amd/amdgpu/gmc_v8_0.c:1224 gmc_v8_0_hw_init() warn: missing 
error code? 'r'
drivers/gpu/drm/amd/amdgpu/gmc_v9_0.c:2347 gmc_v9_0_hw_init() warn: missing 
error code? 'r'

Fixes: 8301de8fcadc ("drm/amdgpu: Fix with right return code '-EIO' in 
'amdgpu_gmc_vram_checking()'")
Cc: Christian König 
Cc: Alex Deucher 
Signed-off-by: Srinivasan Shanmugam 
---
v2: 
   Changed 'return 0;' to 'return r;' in 'gmc_v9_0_hw_init' in v1.

 drivers/gpu/drm/amd/amdgpu/gmc_v6_0.c | 4 ++--
 drivers/gpu/drm/amd/amdgpu/gmc_v7_0.c | 4 ++--
 drivers/gpu/drm/amd/amdgpu/gmc_v8_0.c | 4 ++--
 drivers/gpu/drm/amd/amdgpu/gmc_v9_0.c | 4 ++--
 4 files changed, 8 insertions(+), 8 deletions(-)

diff --git a/drivers/gpu/drm/amd/amdgpu/gmc_v6_0.c 
b/drivers/gpu/drm/amd/amdgpu/gmc_v6_0.c
index 229263e407e0..7e53b7b043a8 100644
--- a/drivers/gpu/drm/amd/amdgpu/gmc_v6_0.c
+++ b/drivers/gpu/drm/amd/amdgpu/gmc_v6_0.c
@@ -916,8 +916,8 @@ static int gmc_v6_0_hw_init(void *handle)
 
if (amdgpu_emu_mode == 1)
return amdgpu_gmc_vram_checking(adev);
-   else
-   return r;
+
+   return r;
 }
 
 static int gmc_v6_0_hw_fini(void *handle)
diff --git a/drivers/gpu/drm/amd/amdgpu/gmc_v7_0.c 
b/drivers/gpu/drm/amd/amdgpu/gmc_v7_0.c
index d95f719eec55..d30b57820c9c 100644
--- a/drivers/gpu/drm/amd/amdgpu/gmc_v7_0.c
+++ b/drivers/gpu/drm/amd/amdgpu/gmc_v7_0.c
@@ -1100,8 +1100,8 @@ static int gmc_v7_0_hw_init(void *handle)
 
if (amdgpu_emu_mode == 1)
return amdgpu_gmc_vram_checking(adev);
-   else
-   return r;
+
+   return r;
 }
 
 static int gmc_v7_0_hw_fini(void *handle)
diff --git a/drivers/gpu/drm/amd/amdgpu/gmc_v8_0.c 
b/drivers/gpu/drm/amd/amdgpu/gmc_v8_0.c
index 4eb0cccdb413..5d55e2313345 100644
--- a/drivers/gpu/drm/amd/amdgpu/gmc_v8_0.c
+++ b/drivers/gpu/drm/amd/amdgpu/gmc_v8_0.c
@@ -1220,8 +1220,8 @@ static int gmc_v8_0_hw_init(void *handle)
 
if (amdgpu_emu_mode == 1)
return amdgpu_gmc_vram_checking(adev);
-   else
-   return r;
+
+   return r;
 }
 
 static int gmc_v8_0_hw_fini(void *handle)
diff --git a/drivers/gpu/drm/amd/amdgpu/gmc_v9_0.c 
b/drivers/gpu/drm/amd/amdgpu/gmc_v9_0.c
index a3a11538207b..b5651e0426f1 100644
--- a/drivers/gpu/drm/amd/amdgpu/gmc_v9_0.c
+++ b/drivers/gpu/drm/amd/amdgpu/gmc_v9_0.c
@@ -2343,8 +2343,8 @@ static int gmc_v9_0_hw_init(void *handle)
 
if (amdgpu_emu_mode == 1)
return amdgpu_gmc_vram_checking(adev);
-   else
-   return r;
+
+   return r;
 }
 
 /**
-- 
2.34.1

[PATCH] drm/amdgpu: Fix missing error code in 'gmc_v6/7/8/9_0_hw_init()'

[Srinivasan Shanmugam]

Return r for success scenairos in 'gmc_v6/7/8/9_0_hw_init()'

Fixes the below:
drivers/gpu/drm/amd/amdgpu/gmc_v6_0.c:920 gmc_v6_0_hw_init() warn: missing 
error code? 'r'
drivers/gpu/drm/amd/amdgpu/gmc_v7_0.c:1104 gmc_v7_0_hw_init() warn: missing 
error code? 'r'
drivers/gpu/drm/amd/amdgpu/gmc_v8_0.c:1224 gmc_v8_0_hw_init() warn: missing 
error code? 'r'
drivers/gpu/drm/amd/amdgpu/gmc_v9_0.c:2347 gmc_v9_0_hw_init() warn: missing 
error code? 'r'

Fixes: 8301de8fcadc ("drm/amdgpu: Fix with right return code '-EIO' in 
'amdgpu_gmc_vram_checking()'")
Cc: Christian König 
Cc: Alex Deucher 
Signed-off-by: Srinivasan Shanmugam 
---
 drivers/gpu/drm/amd/amdgpu/gmc_v6_0.c | 4 ++--
 drivers/gpu/drm/amd/amdgpu/gmc_v7_0.c | 4 ++--
 drivers/gpu/drm/amd/amdgpu/gmc_v8_0.c | 4 ++--
 drivers/gpu/drm/amd/amdgpu/gmc_v9_0.c | 4 ++--
 4 files changed, 8 insertions(+), 8 deletions(-)

diff --git a/drivers/gpu/drm/amd/amdgpu/gmc_v6_0.c 
b/drivers/gpu/drm/amd/amdgpu/gmc_v6_0.c
index 229263e407e0..7e53b7b043a8 100644
--- a/drivers/gpu/drm/amd/amdgpu/gmc_v6_0.c
+++ b/drivers/gpu/drm/amd/amdgpu/gmc_v6_0.c
@@ -916,8 +916,8 @@ static int gmc_v6_0_hw_init(void *handle)
 
if (amdgpu_emu_mode == 1)
return amdgpu_gmc_vram_checking(adev);
-   else
-   return r;
+
+   return r;
 }
 
 static int gmc_v6_0_hw_fini(void *handle)
diff --git a/drivers/gpu/drm/amd/amdgpu/gmc_v7_0.c 
b/drivers/gpu/drm/amd/amdgpu/gmc_v7_0.c
index d95f719eec55..d30b57820c9c 100644
--- a/drivers/gpu/drm/amd/amdgpu/gmc_v7_0.c
+++ b/drivers/gpu/drm/amd/amdgpu/gmc_v7_0.c
@@ -1100,8 +1100,8 @@ static int gmc_v7_0_hw_init(void *handle)
 
if (amdgpu_emu_mode == 1)
return amdgpu_gmc_vram_checking(adev);
-   else
-   return r;
+
+   return r;
 }
 
 static int gmc_v7_0_hw_fini(void *handle)
diff --git a/drivers/gpu/drm/amd/amdgpu/gmc_v8_0.c 
b/drivers/gpu/drm/amd/amdgpu/gmc_v8_0.c
index 4eb0cccdb413..5d55e2313345 100644
--- a/drivers/gpu/drm/amd/amdgpu/gmc_v8_0.c
+++ b/drivers/gpu/drm/amd/amdgpu/gmc_v8_0.c
@@ -1220,8 +1220,8 @@ static int gmc_v8_0_hw_init(void *handle)
 
if (amdgpu_emu_mode == 1)
return amdgpu_gmc_vram_checking(adev);
-   else
-   return r;
+
+   return r;
 }
 
 static int gmc_v8_0_hw_fini(void *handle)
diff --git a/drivers/gpu/drm/amd/amdgpu/gmc_v9_0.c 
b/drivers/gpu/drm/amd/amdgpu/gmc_v9_0.c
index a3a11538207b..4a50537252ac 100644
--- a/drivers/gpu/drm/amd/amdgpu/gmc_v9_0.c
+++ b/drivers/gpu/drm/amd/amdgpu/gmc_v9_0.c
@@ -2343,8 +2343,8 @@ static int gmc_v9_0_hw_init(void *handle)
 
if (amdgpu_emu_mode == 1)
return amdgpu_gmc_vram_checking(adev);
-   else
-   return r;
+
+   return 0;
 }
 
 /**
-- 
2.34.1

[PATCH] drm/amd/display: Fix buffer overflow in 'get_host_router_total_dp_tunnel_bw()'

[Srinivasan Shanmugam]

The error message buffer overflow 'dc->links' 12 <= 12 suggests that the
code is trying to access an element of the dc->links array that is
beyond its bounds. In C, arrays are zero-indexed, so an array with 12
elements has valid indices from 0 to 11. Trying to access dc->links[12]
would be an attempt to access the 13th element of a 12-element array,
which is a buffer overflow.

To fix this, ensure that the loop does not go beyond the last valid
index when accessing dc->links[i + 1] by subtracting 1 from the loop
condition.

This would ensure that i + 1 is always a valid index in the array.

Fixes the below:
drivers/gpu/drm/amd/amdgpu/../display/dc/link/protocols/link_dp_dpia_bw.c:208 
get_host_router_total_dp_tunnel_bw() error: buffer overflow 'dc->links' 12 <= 12

Fixes: 9ed0893b7c58 ("drm/amd/display: Add dpia display mode validation logic")
Cc: PeiChen Huang 
Cc: Aric Cyr 
Cc: Rodrigo Siqueira 
Cc: Aurabindo Pillai 
Cc: Meenakshikumar Somasundaram 
Signed-off-by: Srinivasan Shanmugam 
---
 drivers/gpu/drm/amd/display/dc/link/protocols/link_dp_dpia_bw.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/gpu/drm/amd/display/dc/link/protocols/link_dp_dpia_bw.c 
b/drivers/gpu/drm/amd/display/dc/link/protocols/link_dp_dpia_bw.c
index dd0d2b206462..5491b707cec8 100644
--- a/drivers/gpu/drm/amd/display/dc/link/protocols/link_dp_dpia_bw.c
+++ b/drivers/gpu/drm/amd/display/dc/link/protocols/link_dp_dpia_bw.c
@@ -196,7 +196,7 @@ static int get_host_router_total_dp_tunnel_bw(const struct 
dc *dc, uint8_t hr_in
struct dc_link *link_dpia_primary, *link_dpia_secondary;
int total_bw = 0;
 
-   for (uint8_t i = 0; i < MAX_PIPES * 2; ++i) {
+   for (uint8_t i = 0; i < (MAX_PIPES * 2) - 1; ++i) {
 
if (!dc->links[i] || dc->links[i]->ep_type != 
DISPLAY_ENDPOINT_USB4_DPIA)
continue;
-- 
2.34.1

[PATCH] drm/amd/display: Fix 'panel_cntl' could be null in 'dcn21_set_backlight_level()'

[Srinivasan Shanmugam]

'panel_cntl' structure used control the display panel could be null,
dereferencing it could lead to a null pointer access.

Fixes the below:
drivers/gpu/drm/amd/amdgpu/../display/dc/hwss/dcn21/dcn21_hwseq.c:269 
dcn21_set_backlight_level() error: we previously assumed 'panel_cntl' could be 
null (see line 250)

Fixes: 474ac4a875ca ("drm/amd/display: Implement some asic specific abm call 
backs.")
Cc: Yongqiang Sun 
Cc: Anthony Koo 
Cc: Rodrigo Siqueira 
Cc: Aurabindo Pillai 
Signed-off-by: Srinivasan Shanmugam 
---
 .../amd/display/dc/hwss/dcn21/dcn21_hwseq.c   | 39 ++-
 1 file changed, 20 insertions(+), 19 deletions(-)

diff --git a/drivers/gpu/drm/amd/display/dc/hwss/dcn21/dcn21_hwseq.c 
b/drivers/gpu/drm/amd/display/dc/hwss/dcn21/dcn21_hwseq.c
index 8e88dcaf88f5..86b9265f670f 100644
--- a/drivers/gpu/drm/amd/display/dc/hwss/dcn21/dcn21_hwseq.c
+++ b/drivers/gpu/drm/amd/display/dc/hwss/dcn21/dcn21_hwseq.c
@@ -237,34 +237,35 @@ bool dcn21_set_backlight_level(struct pipe_ctx *pipe_ctx,
 {
struct dc_context *dc = pipe_ctx->stream->ctx;
struct abm *abm = pipe_ctx->stream_res.abm;
+   u32 otg_inst = pipe_ctx->stream_res.tg->inst;
struct panel_cntl *panel_cntl = pipe_ctx->stream->link->panel_cntl;
 
+   if (!abm)
+   return false;
+
+   if (!panel_cntl)
+   return false;
+
if (dc->dc->res_pool->dmcu) {
dce110_set_backlight_level(pipe_ctx, backlight_pwm_u16_16, 
frame_ramp);
return true;
}
 
-   if (abm != NULL) {
-   uint32_t otg_inst = pipe_ctx->stream_res.tg->inst;
-
-   if (abm && panel_cntl) {
-   if (abm->funcs && abm->funcs->set_pipe_ex) {
-   abm->funcs->set_pipe_ex(abm,
-   otg_inst,
-   SET_ABM_PIPE_NORMAL,
-   panel_cntl->inst,
-   panel_cntl->pwrseq_inst);
-   } else {
-   dmub_abm_set_pipe(abm,
-   otg_inst,
-   SET_ABM_PIPE_NORMAL,
-   panel_cntl->inst,
-   
panel_cntl->pwrseq_inst);
-   }
-   }
+   if (abm->funcs && abm->funcs->set_pipe_ex) {
+   abm->funcs->set_pipe_ex(abm,
+   otg_inst,
+   SET_ABM_PIPE_NORMAL,
+   panel_cntl->inst,
+   panel_cntl->pwrseq_inst);
+   } else {
+   dmub_abm_set_pipe(abm,
+ otg_inst,
+ SET_ABM_PIPE_NORMAL,
+ panel_cntl->inst,
+ panel_cntl->pwrseq_inst);
}
 
-   if (abm && abm->funcs && abm->funcs->set_backlight_level_pwm)
+   if (abm->funcs && abm->funcs->set_backlight_level_pwm)
abm->funcs->set_backlight_level_pwm(abm, backlight_pwm_u16_16,
frame_ramp, 0, panel_cntl->inst);
else
-- 
2.34.1

[PATCH] drm/amd/display: Fix potential NULL pointer dereferences in 'dcn10_set_output_transfer_func()'

[Srinivasan Shanmugam]

The 'stream' pointer is used in dcn10_set_output_transfer_func() before
the check if 'stream' is NULL.

Fixes the below:
drivers/gpu/drm/amd/amdgpu/../display/dc/hwss/dcn10/dcn10_hwseq.c:1892 
dcn10_set_output_transfer_func() warn: variable dereferenced before check 
'stream' (see line 1875)

Fixes: ddef02de0d71 ("drm/amd/display: add null checks before logging")
Cc: Wyatt Wood 
Cc: Anthony Koo 
Cc: Rodrigo Siqueira 
Cc: Aurabindo Pillai 
Signed-off-by: Srinivasan Shanmugam 
---
 drivers/gpu/drm/amd/display/dc/hwss/dcn10/dcn10_hwseq.c | 7 +--
 1 file changed, 5 insertions(+), 2 deletions(-)

diff --git a/drivers/gpu/drm/amd/display/dc/hwss/dcn10/dcn10_hwseq.c 
b/drivers/gpu/drm/amd/display/dc/hwss/dcn10/dcn10_hwseq.c
index d923d8d915f9..22cce2b58f95 100644
--- a/drivers/gpu/drm/amd/display/dc/hwss/dcn10/dcn10_hwseq.c
+++ b/drivers/gpu/drm/amd/display/dc/hwss/dcn10/dcn10_hwseq.c
@@ -1890,6 +1890,9 @@ bool dcn10_set_output_transfer_func(struct dc *dc, struct 
pipe_ctx *pipe_ctx,
 {
struct dpp *dpp = pipe_ctx->plane_res.dpp;
 
+   if (!stream)
+   return false;
+
if (dpp == NULL)
return false;
 
@@ -1912,8 +1915,8 @@ bool dcn10_set_output_transfer_func(struct dc *dc, struct 
pipe_ctx *pipe_ctx,
} else
dpp->funcs->dpp_program_regamma_pwl(dpp, NULL, 
OPP_REGAMMA_BYPASS);
 
-   if (stream != NULL && stream->ctx != NULL &&
-   stream->out_transfer_func != NULL) {
+   if (stream->ctx &&
+   stream->out_transfer_func) {
log_tf(stream->ctx,
stream->out_transfer_func,
dpp->regamma_params.hw_points_num);
-- 
2.34.1

[PATCH] drm/amd/display: Fix a potential buffer overflow in 'dp_dsc_clock_en_read()'

[Srinivasan Shanmugam]

Tell snprintf() to store at most 10 bytes in the output buffer
instead of 30.

Fixes the below:
drivers/gpu/drm/amd/amdgpu/../display/amdgpu_dm/amdgpu_dm_debugfs.c:1508 
dp_dsc_clock_en_read() error: snprintf() is printing too much 30 vs 10

Fixes: c06e09b76639 ("drm/amd/display: Add DSC parameters logging to debugfs")
Cc: Alex Hung 
Cc: Qingqing Zhuo 
Cc: Rodrigo Siqueira 
Cc: Aurabindo Pillai 
Cc: Alex Deucher 
Signed-off-by: Srinivasan Shanmugam 
---
 drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_debugfs.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_debugfs.c 
b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_debugfs.c
index 68a846323912..85fc6181303b 100644
--- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_debugfs.c
+++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_debugfs.c
@@ -1483,7 +1483,7 @@ static ssize_t dp_dsc_clock_en_read(struct file *f, char 
__user *buf,
const uint32_t rd_buf_size = 10;
struct pipe_ctx *pipe_ctx;
ssize_t result = 0;
-   int i, r, str_len = 30;
+   int i, r, str_len = 10;
 
rd_buf = kcalloc(rd_buf_size, sizeof(char), GFP_KERNEL);
 
-- 
2.34.1

[PATCH] drm/amdgpu: Fix 'adev->gfx.rlc_fw' from request_firmware() not released in 'gfx_v10_0_init_microcode()'

[Srinivasan Shanmugam]

'adev->gfx.rlc_fw' may not be released before end of
gfx_v10_0_init_microcode() function.

Using the function release_firmware() to release adev->gfx.rlc_fw.

Fixes the below:
drivers/gpu/drm/amd/amdgpu/gfx_v10_0.c:4046 gfx_v10_0_init_microcode() warn: 
'adev->gfx.rlc_fw' from request_firmware() not released on lines: 4046.

Fixes: 1797ec7ffd1b ("drm/amdgpu: skip rlc ucode loading for SRIOV gfx10")
Cc: Monk Liu 
Cc: Lijo Lazar 
Cc: Hawking Zhang 
Cc: Christian König 
Cc: Alex Deucher 
Signed-off-by: Srinivasan Shanmugam 
---
 drivers/gpu/drm/amd/amdgpu/gfx_v10_0.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/gpu/drm/amd/amdgpu/gfx_v10_0.c 
b/drivers/gpu/drm/amd/amdgpu/gfx_v10_0.c
index 420c82b54650..ce76fbcc2602 100644
--- a/drivers/gpu/drm/amd/amdgpu/gfx_v10_0.c
+++ b/drivers/gpu/drm/amd/amdgpu/gfx_v10_0.c
@@ -4006,6 +4006,7 @@ static int gfx_v10_0_init_microcode(struct amdgpu_device 
*adev)
rlc_hdr = (const struct rlc_firmware_header_v2_0 
*)adev->gfx.rlc_fw->data;
version_major = 
le16_to_cpu(rlc_hdr->header.header_version_major);
version_minor = 
le16_to_cpu(rlc_hdr->header.header_version_minor);
+   release_firmware(adev->gfx.rlc_fw);
err = amdgpu_gfx_rlc_init_microcode(adev, version_major, 
version_minor);
if (err)
goto out;
-- 
2.34.1

[PATCH] drm/amdgpu: Fix return type in 'aca_bank_hwip_is_matched()'

[Srinivasan Shanmugam]

Change the return type of "if (!bank || type == ACA_HWIP_TYPE_UNKNOW)"
to be bool instead of int.

Fixes the below:
drivers/gpu/drm/amd/amdgpu/amdgpu_aca.c:185 aca_bank_hwip_is_matched() warn: 
signedness bug returning '(-22)'

Cc: Yang Wang 
Cc: Hawking Zhang 
Cc: Christian König 
Cc: Alex Deucher 
Signed-off-by: Srinivasan Shanmugam 
---
 drivers/gpu/drm/amd/amdgpu/amdgpu_aca.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_aca.c 
b/drivers/gpu/drm/amd/amdgpu/amdgpu_aca.c
index 8a3c3a49415d..d2662f4d3d75 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_aca.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_aca.c
@@ -182,7 +182,7 @@ static bool aca_bank_hwip_is_matched(struct aca_bank *bank, 
enum aca_hwip_type t
u64 ipid;
 
if (!bank || type == ACA_HWIP_TYPE_UNKNOW)
-   return -EINVAL;
+   return false;
 
hwip = _hwid_mcatypes[type];
if (!hwip->hwid)
-- 
2.34.1

[PATCH] drm/amd/display: Address kdoc for eDP Panel Replay feature in 'amdgpu_dm_crtc_set_panel_sr_feature()'

[Srinivasan Shanmugam]

Fixes the below:
drivers/gpu/drm/amd/amdgpu/../display/amdgpu_dm/amdgpu_dm_crtc.c:100: warning: 
This comment starts with '/**', but isn't a kernel-doc comment. Refer 
Documentation/doc-guide/kernel-doc.rst
 * The DRM vblank counter enable/disable action is used as the trigger
   to enable

Cc: Sun peng Li 
Cc: Alex Hung 
Cc: Tom Chung 
Cc: Rodrigo Siqueira 
Cc: Aurabindo Pillai 
Signed-off-by: Srinivasan Shanmugam 
---
 .../gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_crtc.c| 11 +--
 1 file changed, 9 insertions(+), 2 deletions(-)

diff --git a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_crtc.c 
b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_crtc.c
index f64c5ffed234..690b007805f6 100644
--- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_crtc.c
+++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_crtc.c
@@ -97,8 +97,9 @@ bool amdgpu_dm_crtc_vrr_active(struct dm_crtc_state *dm_state)
 }
 
 /**
- * The DRM vblank counter enable/disable action is used as the trigger to 
enable
- * or disable various panel self-refresh features:
+ * amdgpu_dm_crtc_set_panel_sr_feature() - The DRM vblank counter
+ * enable/disable action is used as the trigger to enable or disable various
+ * panel self-refresh features:
  *
  * Panel Replay and PSR SU
  * - Enable when:
@@ -111,6 +112,12 @@ bool amdgpu_dm_crtc_vrr_active(struct dm_crtc_state 
*dm_state)
  * PSR1
  * - Enable condition same as above
  * - Disable when vblank counter is enabled
+ *
+ * @vblank_work: is a pointer to a struct vblank_control_work object.
+ * @vblank_enabled: indicates whether the DRM vblank counter is currently
+ *  enabled (true) or disabled (false).
+ * @allow_sr_entry: represents whether entry into the self-refresh mode is
+ *  allowed (true) or not allowed (false).
  */
 static void amdgpu_dm_crtc_set_panel_sr_feature(
struct vblank_control_work *vblank_work,
-- 
2.34.1

[PATCH] drm/amd/display: Drop kdoc markers for some Panel Replay functions

[Srinivasan Shanmugam]

Fixes the below gcc with W=1:
drivers/gpu/drm/amd/amdgpu/../display/dc/dce/dmub_replay.c:262: warning: This 
comment starts with '/**', but isn't a kernel-doc comment. Refer 
Documentation/doc-guide/kernel-doc.rst
 * Set REPLAY power optimization flags and coasting vtotal.
drivers/gpu/drm/amd/amdgpu/../display/dc/dce/dmub_replay.c:284: warning: This 
comment starts with '/**', but isn't a kernel-doc comment. Refer 
Documentation/doc-guide/kernel-doc.rst
 * send Replay general cmd to DMUB.

Fixes: 340b072e38d3 ("drm/amd/display: Add some functions for Panel Replay")
Cc: Aurabindo Pillai 
Cc: Rodrigo Siqueira 
Cc: Leo Li 
Cc: Tom Chung 
Signed-off-by: Srinivasan Shanmugam 
---
 drivers/gpu/drm/amd/display/dc/dce/dmub_replay.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/drivers/gpu/drm/amd/display/dc/dce/dmub_replay.c 
b/drivers/gpu/drm/amd/display/dc/dce/dmub_replay.c
index 38e4797e9476..b010814706fe 100644
--- a/drivers/gpu/drm/amd/display/dc/dce/dmub_replay.c
+++ b/drivers/gpu/drm/amd/display/dc/dce/dmub_replay.c
@@ -258,7 +258,7 @@ static void dmub_replay_residency(struct dmub_replay *dmub, 
uint8_t panel_inst,
*residency = 0;
 }
 
-/**
+/*
  * Set REPLAY power optimization flags and coasting vtotal.
  */
 static void dmub_replay_set_power_opt_and_coasting_vtotal(struct dmub_replay 
*dmub,
@@ -280,7 +280,7 @@ static void 
dmub_replay_set_power_opt_and_coasting_vtotal(struct dmub_replay *dm
dc_wake_and_execute_dmub_cmd(dc, , DM_DMUB_WAIT_TYPE_WAIT);
 }
 
-/**
+/*
  * send Replay general cmd to DMUB.
  */
 static void dmub_replay_send_cmd(struct dmub_replay *dmub,
-- 
2.34.1

[PATCH] drm/amdgpu: Cleanup inconsistent indenting in 'amdgpu_gfx_enable_kcq()'

[Srinivasan Shanmugam]

Fixes the below:
drivers/gpu/drm/amd/amdgpu/amdgpu_gfx.c:645 amdgpu_gfx_enable_kcq() warn: 
inconsistent indenting

Cc: Le Ma 
Cc: Hawking Zhang 
Cc: Christian König 
Cc: Alex Deucher 
Signed-off-by: Srinivasan Shanmugam 
---
 drivers/gpu/drm/amd/amdgpu/amdgpu_gfx.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_gfx.c 
b/drivers/gpu/drm/amd/amdgpu/amdgpu_gfx.c
index b9674c57c436..eb03f2d7b607 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_gfx.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_gfx.c
@@ -642,8 +642,8 @@ int amdgpu_gfx_enable_kcq(struct amdgpu_device *adev, int 
xcc_id)
kiq->pmf->kiq_set_resources(kiq_ring, queue_mask);
for (i = 0; i < adev->gfx.num_compute_rings; i++) {
j = i + xcc_id * adev->gfx.num_compute_rings;
-   kiq->pmf->kiq_map_queues(kiq_ring,
->gfx.compute_ring[j]);
+   kiq->pmf->kiq_map_queues(kiq_ring,
+>gfx.compute_ring[j]);
}
 
r = amdgpu_ring_test_helper(kiq_ring);
-- 
2.34.1

[PATCH v2] drm/amd/display: Fix uninitialized variable usage in core_link_ 'read_dpcd() & write_dpcd()' functions

[Srinivasan Shanmugam]

The 'status' variable in 'core_link_read_dpcd()' &
'core_link_write_dpcd()' was uninitialized.

Thus, initializing 'status' variable to 'DC_ERROR_UNEXPECTED' by default.

Fixes the below:
drivers/gpu/drm/amd/amdgpu/../display/dc/link/protocols/link_dpcd.c:226 
core_link_read_dpcd() error: uninitialized symbol 'status'.
drivers/gpu/drm/amd/amdgpu/../display/dc/link/protocols/link_dpcd.c:248 
core_link_write_dpcd() error: uninitialized symbol 'status'.

Cc: sta...@vger.kernel.org
Cc: Jerry Zuo 
Cc: Jun Lei 
Cc: Wayne Lin 
Cc: Aurabindo Pillai 
Cc: Rodrigo Siqueira 
Cc: Hamza Mahfooz 
Signed-off-by: Srinivasan Shanmugam 
---
v2:
  - Initialized status variable to 'DC_ERROR_UNEXPECTED' default.
  - Added Jerry to Cc

 drivers/gpu/drm/amd/display/dc/link/protocols/link_dpcd.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/drivers/gpu/drm/amd/display/dc/link/protocols/link_dpcd.c 
b/drivers/gpu/drm/amd/display/dc/link/protocols/link_dpcd.c
index 5c9a30211c10..fc50931c2aec 100644
--- a/drivers/gpu/drm/amd/display/dc/link/protocols/link_dpcd.c
+++ b/drivers/gpu/drm/amd/display/dc/link/protocols/link_dpcd.c
@@ -205,7 +205,7 @@ enum dc_status core_link_read_dpcd(
uint32_t extended_size;
/* size of the remaining partitioned address space */
uint32_t size_left_to_read;
-   enum dc_status status;
+   enum dc_status status = DC_ERROR_UNEXPECTED;
/* size of the next partition to be read from */
uint32_t partition_size;
uint32_t data_index = 0;
@@ -234,7 +234,7 @@ enum dc_status core_link_write_dpcd(
 {
uint32_t partition_size;
uint32_t data_index = 0;
-   enum dc_status status;
+   enum dc_status status = DC_ERROR_UNEXPECTED;
 
while (size) {
partition_size = dpcd_get_next_partition_size(address, size);
-- 
2.34.1

[PATCH v2] drm/amd/display: Fix uninitialized variable usage in core_link_ 'read_dpcd() & write_dpcd()' functions

[Srinivasan Shanmugam]

The 'status' variable in 'core_link_read_dpcd()' &
'core_link_write_dpcd()' was uninitialized.

Thus, initializing 'status' variable to 'DC_ERROR_UNEXPECTED' by default.

Fixes the below:
drivers/gpu/drm/amd/amdgpu/../display/dc/link/protocols/link_dpcd.c:226 
core_link_read_dpcd() error: uninitialized symbol 'status'.
drivers/gpu/drm/amd/amdgpu/../display/dc/link/protocols/link_dpcd.c:248 
core_link_write_dpcd() error: uninitialized symbol 'status'.

Cc: sta...@vger.kernel.org
Cc: Jun Lei 
Cc: Wayne Lin 
Cc: Aurabindo Pillai 
Cc: Rodrigo Siqueira 
Cc: Hamza Mahfooz 
Signed-off-by: Srinivasan Shanmugam 
---
v2:
 - Initialized status variable to 'DC_ERROR_UNEXPECTED' default.

 drivers/gpu/drm/amd/display/dc/link/protocols/link_dpcd.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/drivers/gpu/drm/amd/display/dc/link/protocols/link_dpcd.c 
b/drivers/gpu/drm/amd/display/dc/link/protocols/link_dpcd.c
index 5c9a30211c10..fc50931c2aec 100644
--- a/drivers/gpu/drm/amd/display/dc/link/protocols/link_dpcd.c
+++ b/drivers/gpu/drm/amd/display/dc/link/protocols/link_dpcd.c
@@ -205,7 +205,7 @@ enum dc_status core_link_read_dpcd(
uint32_t extended_size;
/* size of the remaining partitioned address space */
uint32_t size_left_to_read;
-   enum dc_status status;
+   enum dc_status status = DC_ERROR_UNEXPECTED;
/* size of the next partition to be read from */
uint32_t partition_size;
uint32_t data_index = 0;
@@ -234,7 +234,7 @@ enum dc_status core_link_write_dpcd(
 {
uint32_t partition_size;
uint32_t data_index = 0;
-   enum dc_status status;
+   enum dc_status status = DC_ERROR_UNEXPECTED;
 
while (size) {
partition_size = dpcd_get_next_partition_size(address, size);
-- 
2.34.1

[PATCH] drm/amd/display: Fix uninitialized variable usage in core_link_ 'read_dpcd() & write_dpcd()' functions

[Srinivasan Shanmugam]

The 'status' variable in 'core_link_read_dpcd()' &
'core_link_write_dpcd()' was uninitialized for success scenarios.

Thus, initializing 'status' variable with appropriate enum value.

Fixes the below:
drivers/gpu/drm/amd/amdgpu/../display/dc/link/protocols/link_dpcd.c:226 
core_link_read_dpcd() error: uninitialized symbol 'status'.
drivers/gpu/drm/amd/amdgpu/../display/dc/link/protocols/link_dpcd.c:248 
core_link_write_dpcd() error: uninitialized symbol 'status'.

Cc: sta...@vger.kernel.org
Cc: Wesley Chalmers 
Cc: Jun Lei 
Cc: Wayne Lin 
Cc: Aurabindo Pillai 
Cc: Rodrigo Siqueira 
Cc: Hamza Mahfooz 
Signed-off-by: Srinivasan Shanmugam 
---
 drivers/gpu/drm/amd/display/dc/link/protocols/link_dpcd.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/drivers/gpu/drm/amd/display/dc/link/protocols/link_dpcd.c 
b/drivers/gpu/drm/amd/display/dc/link/protocols/link_dpcd.c
index 5c9a30211c10..2b2073dce389 100644
--- a/drivers/gpu/drm/amd/display/dc/link/protocols/link_dpcd.c
+++ b/drivers/gpu/drm/amd/display/dc/link/protocols/link_dpcd.c
@@ -205,7 +205,7 @@ enum dc_status core_link_read_dpcd(
uint32_t extended_size;
/* size of the remaining partitioned address space */
uint32_t size_left_to_read;
-   enum dc_status status;
+   enum dc_status status = DC_OK;
/* size of the next partition to be read from */
uint32_t partition_size;
uint32_t data_index = 0;
@@ -234,7 +234,7 @@ enum dc_status core_link_write_dpcd(
 {
uint32_t partition_size;
uint32_t data_index = 0;
-   enum dc_status status;
+   enum dc_status status = DC_OK;
 
while (size) {
partition_size = dpcd_get_next_partition_size(address, size);
-- 
2.34.1

[PATCH] drm/amd/display: Drop 'acrtc' and add 'new_crtc_state' NULL check for writeback requests.

[Srinivasan Shanmugam]

Return value of 'to_amdgpu_crtc' which is container_of(...) can't be
null, so it's null check 'acrtc' is dropped.

Fixing the below:
drivers/gpu/drm/amd/amdgpu/../display/amdgpu_dm/amdgpu_dm.c:9302 
amdgpu_dm_atomic_commit_tail() error: we previously assumed 'acrtc' could be 
null (see line 9299)

Add 'new_crtc_state'NULL check for function
'drm_atomic_get_new_crtc_state' that retrieves the new state for a CRTC,
while enabling writeback requests.

Cc: sta...@vger.kernel.org
Cc: Alex Hung 
Cc: Aurabindo Pillai 
Cc: Rodrigo Siqueira 
Cc: Hamza Mahfooz 
Signed-off-by: Srinivasan Shanmugam 
---
 drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c 
b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
index 95ff3800fc87..8eb381d5f6b8 100644
--- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
+++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
@@ -9294,10 +9294,10 @@ static void amdgpu_dm_atomic_commit_tail(struct 
drm_atomic_state *state)
if (!new_con_state->writeback_job)
continue;
 
-   new_crtc_state = NULL;
+   new_crtc_state = drm_atomic_get_new_crtc_state(state, 
>base);
 
-   if (acrtc)
-   new_crtc_state = drm_atomic_get_new_crtc_state(state, 
>base);
+   if (!new_crtc_state)
+   continue;
 
if (acrtc->wb_enabled)
continue;
-- 
2.34.1

[PATCH v2] drm/amd/display: Fix late derefrence 'dsc' check in 'link_set_dsc_pps_packet()'

[Srinivasan Shanmugam]

In link_set_dsc_pps_packet(), 'struct display_stream_compressor *dsc'
was dereferenced in a DC_LOGGER_INIT(dsc->ctx->logger); before the 'dsc'
NULL pointer check.

Fixes the below:
drivers/gpu/drm/amd/amdgpu/../display/dc/link/link_dpms.c:905 
link_set_dsc_pps_packet() warn: variable dereferenced before check 'dsc' (see 
line 903)

Cc: sta...@vger.kernel.org
Cc: Aurabindo Pillai 
Cc: Rodrigo Siqueira 
Cc: Hamza Mahfooz 
Cc: Wenjing Liu 
Cc: Qingqing Zhuo 
Signed-off-by: Srinivasan Shanmugam 
---
v2:
 - Corrected the logic when !pipe_ctx->stream->timing.flags.DSC is true,
   still skipping the !dsc NULL check

 drivers/gpu/drm/amd/display/dc/link/link_dpms.c | 8 ++--
 1 file changed, 6 insertions(+), 2 deletions(-)

diff --git a/drivers/gpu/drm/amd/display/dc/link/link_dpms.c 
b/drivers/gpu/drm/amd/display/dc/link/link_dpms.c
index 3de148004c06..d084ac0d30b2 100644
--- a/drivers/gpu/drm/amd/display/dc/link/link_dpms.c
+++ b/drivers/gpu/drm/amd/display/dc/link/link_dpms.c
@@ -900,11 +900,15 @@ bool link_set_dsc_pps_packet(struct pipe_ctx *pipe_ctx, 
bool enable, bool immedi
 {
struct display_stream_compressor *dsc = pipe_ctx->stream_res.dsc;
struct dc_stream_state *stream = pipe_ctx->stream;
-   DC_LOGGER_INIT(dsc->ctx->logger);
 
-   if (!pipe_ctx->stream->timing.flags.DSC || !dsc)
+   if (!pipe_ctx->stream->timing.flags.DSC)
+   return false;
+
+   if(!dsc)
return false;
 
+   DC_LOGGER_INIT(dsc->ctx->logger);
+
if (enable) {
struct dsc_config dsc_cfg;
uint8_t dsc_packed_pps[128];
-- 
2.34.1

[PATCH v2] drm/amdkfd: Fix variable dereferenced before NULL check in 'kfd_dbg_trap_device_snapshot()'

[Srinivasan Shanmugam]

Fixes the below:
drivers/gpu/drm/amd/amdgpu/../amdkfd/kfd_debug.c:1024 
kfd_dbg_trap_device_snapshot() warn: variable dereferenced before check 
'entry_size' (see line 1021)

Cc: Felix Kuehling 
Cc: Christian König 
Cc: Alex Deucher 
Signed-off-by: Srinivasan Shanmugam 
---
v2:
 - Changed from u32 to unit32_t for consistency (Felix) 

 drivers/gpu/drm/amd/amdkfd/kfd_debug.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/drivers/gpu/drm/amd/amdkfd/kfd_debug.c 
b/drivers/gpu/drm/amd/amdkfd/kfd_debug.c
index 9ec750666382..d889e3545120 100644
--- a/drivers/gpu/drm/amd/amdkfd/kfd_debug.c
+++ b/drivers/gpu/drm/amd/amdkfd/kfd_debug.c
@@ -1018,12 +1018,14 @@ int kfd_dbg_trap_device_snapshot(struct kfd_process 
*target,
uint32_t *entry_size)
 {
struct kfd_dbg_device_info_entry device_info;
-   uint32_t tmp_entry_size = *entry_size, tmp_num_devices;
+   uint32_t tmp_entry_size, tmp_num_devices;
int i, r = 0;
 
if (!(target && user_info && number_of_device_infos && entry_size))
return -EINVAL;
 
+   tmp_entry_size = *entry_size;
+
tmp_num_devices = min_t(size_t, *number_of_device_infos, 
target->n_pdds);
*number_of_device_infos = target->n_pdds;
*entry_size = min_t(size_t, *entry_size, sizeof(device_info));
-- 
2.34.1

[PATCH] drm/amd/display: Fix late derefrence 'dsc' check in 'link_set_dsc_pps_packet()'

[Srinivasan Shanmugam]

In link_set_dsc_pps_packet(), 'struct display_stream_compressor *dsc'
was dereferenced in a DC_LOGGER_INIT(dsc->ctx->logger); before the 'dsc'
NULL pointer check.

Fixes the below:
drivers/gpu/drm/amd/amdgpu/../display/dc/link/link_dpms.c:905 
link_set_dsc_pps_packet() warn: variable dereferenced before check 'dsc' (see 
line 903)

Cc: sta...@vger.kernel.org
Cc: Aurabindo Pillai 
Cc: Rodrigo Siqueira 
Cc: Hamza Mahfooz 
Cc: Wenjing Liu 
Cc: Qingqing Zhuo 
Signed-off-by: Srinivasan Shanmugam 
---
 drivers/gpu/drm/amd/display/dc/link/link_dpms.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/drivers/gpu/drm/amd/display/dc/link/link_dpms.c 
b/drivers/gpu/drm/amd/display/dc/link/link_dpms.c
index 3de148004c06..562eb79bfbc8 100644
--- a/drivers/gpu/drm/amd/display/dc/link/link_dpms.c
+++ b/drivers/gpu/drm/amd/display/dc/link/link_dpms.c
@@ -900,11 +900,12 @@ bool link_set_dsc_pps_packet(struct pipe_ctx *pipe_ctx, 
bool enable, bool immedi
 {
struct display_stream_compressor *dsc = pipe_ctx->stream_res.dsc;
struct dc_stream_state *stream = pipe_ctx->stream;
-   DC_LOGGER_INIT(dsc->ctx->logger);
 
if (!pipe_ctx->stream->timing.flags.DSC || !dsc)
return false;
 
+   DC_LOGGER_INIT(dsc->ctx->logger);
+
if (enable) {
struct dsc_config dsc_cfg;
uint8_t dsc_packed_pps[128];
-- 
2.34.1

[PATCH] drm/amdkfd: Fix 'node' NULL check in 'svm_range_get_range_boundaries()'

[Srinivasan Shanmugam]

Range interval [start, last] is ordered by rb_tree, rb_prev, rb_next
return value still needs NULL check, thus modified from "node" to "rb_node".

Fixes the below:
drivers/gpu/drm/amd/amdgpu/../amdkfd/kfd_svm.c:2691 
svm_range_get_range_boundaries() warn: can 'node' even be NULL?

Suggested-by: Philip Yang 
Cc: Felix Kuehling 
Cc: Christian König 
Cc: Alex Deucher 
Signed-off-by: Srinivasan Shanmugam 
---
 drivers/gpu/drm/amd/amdkfd/kfd_svm.c | 10 +-
 1 file changed, 5 insertions(+), 5 deletions(-)

diff --git a/drivers/gpu/drm/amd/amdkfd/kfd_svm.c 
b/drivers/gpu/drm/amd/amdkfd/kfd_svm.c
index 3b78e48832e9..6aa032731ddc 100644
--- a/drivers/gpu/drm/amd/amdkfd/kfd_svm.c
+++ b/drivers/gpu/drm/amd/amdkfd/kfd_svm.c
@@ -2656,6 +2656,7 @@ svm_range_get_range_boundaries(struct kfd_process *p, 
int64_t addr,
 {
struct vm_area_struct *vma;
struct interval_tree_node *node;
+   struct rb_node *rb_node;
unsigned long start_limit, end_limit;
 
vma = vma_lookup(p->mm, addr << PAGE_SHIFT);
@@ -2678,16 +2679,15 @@ svm_range_get_range_boundaries(struct kfd_process *p, 
int64_t addr,
if (node) {
end_limit = min(end_limit, node->start);
/* Last range that ends before the fault address */
-   node = container_of(rb_prev(>rb),
-   struct interval_tree_node, rb);
+   rb_node = rb_prev(>rb);
} else {
/* Last range must end before addr because
 * there was no range after addr
 */
-   node = container_of(rb_last(>svms.objects.rb_root),
-   struct interval_tree_node, rb);
+   rb_node = rb_last(>svms.objects.rb_root);
}
-   if (node) {
+   if (rb_node) {
+   node = container_of(rb_node, struct interval_tree_node, rb);
if (node->last >= addr) {
WARN(1, "Overlap with prev node and page fault addr\n");
return -EFAULT;
-- 
2.34.1

Re: [PATCH] drm/amd/display: Fix variable deferencing before NULL check in edp_setup_replay()

[SRINIVASAN SHANMUGAM]

On 1/8/2024 9:58 PM, Aurabindo Pillai wrote:



On 2024-01-08 11:19, Srinivasan Shanmugam wrote:

In edp_setup_replay(), 'struct dc *dc' & 'struct dmub_replay *replay'
was dereferenced before the pointer 'link' & 'replay' NULL check.

Fixes the below:
drivers/gpu/drm/amd/amdgpu/../display/dc/link/protocols/link_edp_panel_control.c:947 
edp_setup_replay() warn: variable dereferenced before check 'link' 
(see line 933)


Cc: Bhawanpreet Lakha 
Cc: Harry Wentland 
Cc: Rodrigo Siqueira 
Cc: Aurabindo Pillai 
Cc: Alex Deucher 
Signed-off-by: Srinivasan Shanmugam 
---
  .../dc/link/protocols/link_edp_panel_control.c    | 11 +++
  1 file changed, 7 insertions(+), 4 deletions(-)

diff --git 
a/drivers/gpu/drm/amd/display/dc/link/protocols/link_edp_panel_control.c 
b/drivers/gpu/drm/amd/display/dc/link/protocols/link_edp_panel_control.c

index 7f1196528218..046d3e205415 100644
--- 
a/drivers/gpu/drm/amd/display/dc/link/protocols/link_edp_panel_control.c
+++ 
b/drivers/gpu/drm/amd/display/dc/link/protocols/link_edp_panel_control.c
@@ -930,8 +930,8 @@ bool edp_get_replay_state(const struct dc_link 
*link, uint64_t *state)
  bool edp_setup_replay(struct dc_link *link, const struct 
dc_stream_state *stream)

  {
  /* To-do: Setup Replay */
-    struct dc *dc = link->ctx->dc;
-    struct dmub_replay *replay = dc->res_pool->replay;
+    struct dc *dc;
+    struct dmub_replay *replay;
  int i;
  unsigned int panel_inst;
  struct replay_context replay_context = { 0 };
@@ -947,6 +947,10 @@ bool edp_setup_replay(struct dc_link *link, 
const struct dc_stream_state *stream

  if (!link)
  return false;
  +    dc = link->ctx->dc;
+
+    replay = dc->res_pool->replay;
+
  if (!replay)
  return false;
  @@ -975,8 +979,7 @@ bool edp_setup_replay(struct dc_link *link, 
const struct dc_stream_state *stream

    replay_context.line_time_in_ns = lineTimeInNs;
  -    if (replay)
-    link->replay_settings.replay_feature_enabled =
+    link->replay_settings.replay_feature_enabled =
  replay->funcs->replay_copy_settings(replay, link, 
_context, panel_inst);

  if (link->replay_settings.replay_feature_enabled) {


Please add Cc: sta...@vger.kernel.org in description.


Sure Jay!, thanks for reviews! will add this in description.

Best regards,

Srini



Reviewed-by: Aurabindo Pillai