linux-kernel - Re: [PATCH RFC 1/4] drm/msm/adreno: Add speedbin support for X1-85

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <837602a7-bbd5-4436-ab9f-2b101bdcaac2@quicinc.com>
Date: Thu, 16 Jan 2025 01:07:17 +0530
From: Akhil P Oommen <quic_akhilpo@...cinc.com>
To: Konrad Dybcio <konrad.dybcio@....qualcomm.com>,
        Rob Clark
	<robdclark@...il.com>, Sean Paul <sean@...rly.run>,
        Konrad Dybcio
	<konradybcio@...nel.org>,
        Abhinav Kumar <quic_abhinavk@...cinc.com>,
        "Dmitry
 Baryshkov" <dmitry.baryshkov@...aro.org>,
        Marijn Suijten
	<marijn.suijten@...ainline.org>,
        David Airlie <airlied@...il.com>, "Simona
 Vetter" <simona@...ll.ch>,
        Rob Herring <robh@...nel.org>,
        Krzysztof Kozlowski
	<krzk+dt@...nel.org>,
        Conor Dooley <conor+dt@...nel.org>,
        Bjorn Andersson
	<andersson@...nel.org>,
        Srinivas Kandagatla <srinivas.kandagatla@...aro.org>
CC: <linux-arm-msm@...r.kernel.org>, <dri-devel@...ts.freedesktop.org>,
        <freedreno@...ts.freedesktop.org>, <linux-kernel@...r.kernel.org>,
        <devicetree@...r.kernel.org>
Subject: Re: [PATCH RFC 1/4] drm/msm/adreno: Add speedbin support for X1-85

On 1/9/2025 7:27 PM, Konrad Dybcio wrote:
> On 8.01.2025 11:42 PM, Akhil P Oommen wrote:
>> Adreno X1-85 has an additional bit which is at a non-contiguous
>> location in qfprom. Add support for this new "hi" bit along with
>> the speedbin mappings.
>> ---
>>  drivers/gpu/drm/msm/adreno/a6xx_catalog.c |  5 +++++
>>  drivers/gpu/drm/msm/adreno/adreno_gpu.c   | 15 ++++++++++++++-
>>  2 files changed, 19 insertions(+), 1 deletion(-)
>>
>> diff --git a/drivers/gpu/drm/msm/adreno/a6xx_catalog.c b/drivers/gpu/drm/msm/adreno/a6xx_catalog.c
>> index 0c560e84ad5a53bb4e8a49ba4e153ce9cf33f7ae..e2261f50aabc6a2f931d810f3637dfdba5695f43 100644
>> --- a/drivers/gpu/drm/msm/adreno/a6xx_catalog.c
>> +++ b/drivers/gpu/drm/msm/adreno/a6xx_catalog.c
>> @@ -1412,6 +1412,11 @@ static const struct adreno_info a7xx_gpus[] = {
>>  			.gmu_cgc_mode = 0x00020202,
>>  		},
>>  		.address_space_size = SZ_256G,
>> +		.speedbins = ADRENO_SPEEDBINS(
>> +			{ 0,   0 },
>> +			{ 263, 1 },
>> +			{ 315, 0 },
>> +		),
>>  		.preempt_record_size = 4192 * SZ_1K,
>>  	}, {
>>  		.chip_ids = ADRENO_CHIP_IDS(0x43051401), /* "C520v2" */
>> diff --git a/drivers/gpu/drm/msm/adreno/adreno_gpu.c b/drivers/gpu/drm/msm/adreno/adreno_gpu.c
>> index 75f5367e73caace4648491b041f80b7c4d26bf89..7b31379eff444cf3f8ed0dcfd23c14920c13ee9d 100644
>> --- a/drivers/gpu/drm/msm/adreno/adreno_gpu.c
>> +++ b/drivers/gpu/drm/msm/adreno/adreno_gpu.c
>> @@ -1078,7 +1078,20 @@ void adreno_gpu_ocmem_cleanup(struct adreno_ocmem *adreno_ocmem)
>>  
>>  int adreno_read_speedbin(struct device *dev, u32 *speedbin)
>>  {
>> -	return nvmem_cell_read_variable_le_u32(dev, "speed_bin", speedbin);
>> +	u32 hi_bits = 0;
>> +	int ret;
>> +
>> +	ret = nvmem_cell_read_variable_le_u32(dev, "speed_bin", speedbin);
>> +	if (ret)
>> +		return ret;
>> +
>> +	/* Some chipsets have MSB bits (BIT(8) and above) at a non-contiguous location */
>> +	ret = nvmem_cell_read_variable_le_u32(dev, "speed_bin_hi", &hi_bits);
>> +	if (ret != -ENOENT)
>> +		return ret;
>> +
>> +	*speedbin |= (hi_bits << 8);
> 
> Now that we're overwriting speedbin, we should probably have some checks in
> order to make sure somebody passing a too-wide cell to one of these won't
> result in cripplingly-untraceable value corruption
> 
> I guess we could just introduce nvmem_cell_read_variable_le_u8() and call it
> a day?

X1E is an outlier here, because this was fixed from the next chipset
onward. For newer chipsets, we can use just the "speed_bin" node, which
represents a contiguous 9 bits. So, just do a "WARN_ON(fls(speedbin) >
8)" here?

-Akhil.

> 
> Konrad