diff options
| author | Qu Huang <jinsdb@126.com> | 2021-01-28 20:14:25 +0800 |
|---|---|---|
| committer | Alex Deucher <alexander.deucher@amd.com> | 2021-04-09 16:47:06 -0400 |
| commit | b010affea45d812d8d386cc49c3b2bafd74b4154 (patch) | |
| tree | 2d933d8e8411e93eedf740ebcb2c761cf08cf520 /drivers/gpu/drm/amd/amdkfd/kfd_packet_manager.c | |
| parent | 84e070f58ad22879787602bb18df656c326f6492 (diff) | |
| download | linux-b010affea45d812d8d386cc49c3b2bafd74b4154.tar.gz linux-b010affea45d812d8d386cc49c3b2bafd74b4154.tar.bz2 linux-b010affea45d812d8d386cc49c3b2bafd74b4154.zip | |
drm/amdkfd: dqm fence memory corruption
Amdgpu driver uses 4-byte data type as DQM fence memory,
and transmits GPU address of fence memory to microcode
through query status PM4 message. However, query status
PM4 message definition and microcode processing are all
processed according to 8 bytes. Fence memory only allocates
4 bytes of memory, but microcode does write 8 bytes of memory,
so there is a memory corruption.
Changes since v1:
* Change dqm->fence_addr as a u64 pointer to fix this issue,
also fix up query_status and amdkfd_fence_wait_timeout function
uses 64 bit fence value to make them consistent.
Signed-off-by: Qu Huang <jinsdb@126.com>
Reviewed-by: Felix Kuehling <Felix.Kuehling@amd.com>
Signed-off-by: Felix Kuehling <Felix.Kuehling@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Diffstat (limited to 'drivers/gpu/drm/amd/amdkfd/kfd_packet_manager.c')
| -rw-r--r-- | drivers/gpu/drm/amd/amdkfd/kfd_packet_manager.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/drivers/gpu/drm/amd/amdkfd/kfd_packet_manager.c b/drivers/gpu/drm/amd/amdkfd/kfd_packet_manager.c index d903f694acba..e840dd581719 100644 --- a/drivers/gpu/drm/amd/amdkfd/kfd_packet_manager.c +++ b/drivers/gpu/drm/amd/amdkfd/kfd_packet_manager.c @@ -348,7 +348,7 @@ fail_create_runlist_ib: } int pm_send_query_status(struct packet_manager *pm, uint64_t fence_address, - uint32_t fence_value) + uint64_t fence_value) { uint32_t *buffer, size; int retval = 0; |
