drm/amd/display: Pass command instead of header into DMUB service

[Why]
We read memory that we shouldn't be touching if the struct isn't
a full union dmub_rb_cmd.

[How]
Fix up all the callers and functions that take in the dmub_cmd_header
to use the dmub_rb_cmd instead.

Signed-off-by: Nicholas Kazlauskas <nicholas.kazlauskas@amd.com>
Reviewed-by: Tony Cheng <Tony.Cheng@amd.com>
Acked-by: Aurabindo Pillai <aurabindo.pillai@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>

diff --git a/drivers/gpu/drm/amd/display/dc/bios/command_table2.c b/drivers/gpu/drm/amd/display/dc/bios/command_table2.c
index 8edc250..bed9157 100644 (file)
--- a/drivers/gpu/drm/amd/display/dc/bios/command_table2.c
+++ b/drivers/gpu/drm/amd/display/dc/bios/command_table2.c
@@ -113,13 +113,19 @@ static void encoder_control_dmcub(
                struct dc_dmub_srv *dmcub,
                struct dig_encoder_stream_setup_parameters_v1_5 *dig)
 {
-       struct dmub_rb_cmd_digx_encoder_control encoder_control = { 0 };
+       union dmub_rb_cmd cmd;
 
-       encoder_control.header.type = DMUB_CMD__VBIOS;
-       encoder_control.header.sub_type = DMUB_CMD__VBIOS_DIGX_ENCODER_CONTROL;
-       encoder_control.encoder_control.dig.stream_param = *dig;
+       memset(&cmd, 0, sizeof(cmd));
 
-       dc_dmub_srv_cmd_queue(dmcub, &encoder_control.header);
+       cmd.digx_encoder_control.header.type = DMUB_CMD__VBIOS;
+       cmd.digx_encoder_control.header.sub_type =
+               DMUB_CMD__VBIOS_DIGX_ENCODER_CONTROL;
+       cmd.digx_encoder_control.header.payload_bytes =
+               sizeof(cmd.digx_encoder_control) -
+               sizeof(cmd.digx_encoder_control.header);
+       cmd.digx_encoder_control.encoder_control.dig.stream_param = *dig;
+
+       dc_dmub_srv_cmd_queue(dmcub, &cmd);
        dc_dmub_srv_cmd_execute(dmcub);
        dc_dmub_srv_wait_idle(dmcub);
 }
@@ -238,14 +244,19 @@ static void transmitter_control_dmcub(
                struct dc_dmub_srv *dmcub,
                struct dig_transmitter_control_parameters_v1_6 *dig)
 {
-       struct dmub_rb_cmd_dig1_transmitter_control transmitter_control;
+       union dmub_rb_cmd cmd;
+
+       memset(&cmd, 0, sizeof(cmd));
 
-       transmitter_control.header.type = DMUB_CMD__VBIOS;
-       transmitter_control.header.sub_type =
+       cmd.dig1_transmitter_control.header.type = DMUB_CMD__VBIOS;
+       cmd.dig1_transmitter_control.header.sub_type =
                DMUB_CMD__VBIOS_DIG1_TRANSMITTER_CONTROL;
-       transmitter_control.transmitter_control.dig = *dig;
+       cmd.dig1_transmitter_control.header.payload_bytes =
+               sizeof(cmd.dig1_transmitter_control) -
+               sizeof(cmd.dig1_transmitter_control.header);
+       cmd.dig1_transmitter_control.transmitter_control.dig = *dig;
 
-       dc_dmub_srv_cmd_queue(dmcub, &transmitter_control.header);
+       dc_dmub_srv_cmd_queue(dmcub, &cmd);
        dc_dmub_srv_cmd_execute(dmcub);
        dc_dmub_srv_wait_idle(dmcub);
 }
@@ -339,13 +350,18 @@ static void set_pixel_clock_dmcub(
                struct dc_dmub_srv *dmcub,
                struct set_pixel_clock_parameter_v1_7 *clk)
 {
-       struct dmub_rb_cmd_set_pixel_clock pixel_clock = { 0 };
+       union dmub_rb_cmd cmd;
 
-       pixel_clock.header.type = DMUB_CMD__VBIOS;
-       pixel_clock.header.sub_type = DMUB_CMD__VBIOS_SET_PIXEL_CLOCK;
-       pixel_clock.pixel_clock.clk = *clk;
+       memset(&cmd, 0, sizeof(cmd));
 
-       dc_dmub_srv_cmd_queue(dmcub, &pixel_clock.header);
+       cmd.set_pixel_clock.header.type = DMUB_CMD__VBIOS;
+       cmd.set_pixel_clock.header.sub_type = DMUB_CMD__VBIOS_SET_PIXEL_CLOCK;
+       cmd.set_pixel_clock.header.payload_bytes =
+               sizeof(cmd.set_pixel_clock) -
+               sizeof(cmd.set_pixel_clock.header);
+       cmd.set_pixel_clock.pixel_clock.clk = *clk;
+
+       dc_dmub_srv_cmd_queue(dmcub, &cmd);
        dc_dmub_srv_cmd_execute(dmcub);
        dc_dmub_srv_wait_idle(dmcub);
 }
@@ -705,13 +721,19 @@ static void enable_disp_power_gating_dmcub(
        struct dc_dmub_srv *dmcub,
        struct enable_disp_power_gating_parameters_v2_1 *pwr)
 {
-       struct dmub_rb_cmd_enable_disp_power_gating power_gating;
+       union dmub_rb_cmd cmd;
+
+       memset(&cmd, 0, sizeof(cmd));
 
-       power_gating.header.type = DMUB_CMD__VBIOS;
-       power_gating.header.sub_type = DMUB_CMD__VBIOS_ENABLE_DISP_POWER_GATING;
-       power_gating.power_gating.pwr = *pwr;
+       cmd.enable_disp_power_gating.header.type = DMUB_CMD__VBIOS;
+       cmd.enable_disp_power_gating.header.sub_type =
+               DMUB_CMD__VBIOS_ENABLE_DISP_POWER_GATING;
+       cmd.enable_disp_power_gating.header.payload_bytes =
+               sizeof(cmd.enable_disp_power_gating) -
+               sizeof(cmd.enable_disp_power_gating.header);
+       cmd.enable_disp_power_gating.power_gating.pwr = *pwr;
 
-       dc_dmub_srv_cmd_queue(dmcub, &power_gating.header);
+       dc_dmub_srv_cmd_queue(dmcub, &cmd);
        dc_dmub_srv_cmd_execute(dmcub);
        dc_dmub_srv_wait_idle(dmcub);
 }

diff --git a/drivers/gpu/drm/amd/display/dc/dc_dmub_srv.c b/drivers/gpu/drm/amd/display/dc/dc_dmub_srv.c
index 59c298a..907e0c5 100644 (file)
--- a/drivers/gpu/drm/amd/display/dc/dc_dmub_srv.c
+++ b/drivers/gpu/drm/amd/display/dc/dc_dmub_srv.c
@@ -58,7 +58,7 @@ void dc_dmub_srv_destroy(struct dc_dmub_srv **dmub_srv)
 }
 
 void dc_dmub_srv_cmd_queue(struct dc_dmub_srv *dc_dmub_srv,
-                          struct dmub_cmd_header *cmd)
+                          union dmub_rb_cmd *cmd)
 {
        struct dmub_srv *dmub = dc_dmub_srv->dmub;
        struct dc_context *dc_ctx = dc_dmub_srv->ctx;

diff --git a/drivers/gpu/drm/amd/display/dc/dc_dmub_srv.h b/drivers/gpu/drm/amd/display/dc/dc_dmub_srv.h
index 8554314..6689ae3 100644 (file)
--- a/drivers/gpu/drm/amd/display/dc/dc_dmub_srv.h
+++ b/drivers/gpu/drm/amd/display/dc/dc_dmub_srv.h
@@ -30,7 +30,6 @@
 #include "dmub/inc/dmub_cmd.h"
 
 struct dmub_srv;
-struct dmub_cmd_header;
 
 struct dc_reg_helper_state {
        bool gather_in_progress;
@@ -49,7 +48,7 @@ struct dc_dmub_srv {
 };
 
 void dc_dmub_srv_cmd_queue(struct dc_dmub_srv *dc_dmub_srv,
-                          struct dmub_cmd_header *cmd);
+                          union dmub_rb_cmd *cmd);
 
 void dc_dmub_srv_cmd_execute(struct dc_dmub_srv *dc_dmub_srv);
 

diff --git a/drivers/gpu/drm/amd/display/dc/dc_helper.c b/drivers/gpu/drm/amd/display/dc/dc_helper.c
index 737048d..85a0170 100644 (file)
--- a/drivers/gpu/drm/amd/display/dc/dc_helper.c
+++ b/drivers/gpu/drm/amd/display/dc/dc_helper.c
@@ -50,7 +50,7 @@ static inline void submit_dmub_read_modify_write(
        gather = ctx->dmub_srv->reg_helper_offload.gather_in_progress;
        ctx->dmub_srv->reg_helper_offload.gather_in_progress = false;
 
-       dc_dmub_srv_cmd_queue(ctx->dmub_srv, &cmd_buf->header);
+       dc_dmub_srv_cmd_queue(ctx->dmub_srv, &offload->cmd_data);
 
        ctx->dmub_srv->reg_helper_offload.gather_in_progress = gather;
 
@@ -73,7 +73,7 @@ static inline void submit_dmub_burst_write(
        gather = ctx->dmub_srv->reg_helper_offload.gather_in_progress;
        ctx->dmub_srv->reg_helper_offload.gather_in_progress = false;
 
-       dc_dmub_srv_cmd_queue(ctx->dmub_srv, &cmd_buf->header);
+       dc_dmub_srv_cmd_queue(ctx->dmub_srv, &offload->cmd_data);
 
        ctx->dmub_srv->reg_helper_offload.gather_in_progress = gather;
 
@@ -92,7 +92,7 @@ static inline void submit_dmub_reg_wait(
        gather = ctx->dmub_srv->reg_helper_offload.gather_in_progress;
        ctx->dmub_srv->reg_helper_offload.gather_in_progress = false;
 
-       dc_dmub_srv_cmd_queue(ctx->dmub_srv, &cmd_buf->header);
+       dc_dmub_srv_cmd_queue(ctx->dmub_srv, &offload->cmd_data);
 
        memset(cmd_buf, 0, sizeof(*cmd_buf));
        offload->reg_seq_count = 0;

diff --git a/drivers/gpu/drm/amd/display/dc/dce/dmub_abm.c b/drivers/gpu/drm/amd/display/dc/dce/dmub_abm.c
index 992d869..09e19e3 100644 (file)
--- a/drivers/gpu/drm/amd/display/dc/dce/dmub_abm.c
+++ b/drivers/gpu/drm/amd/display/dc/dce/dmub_abm.c
@@ -62,7 +62,7 @@ static bool dmub_abm_set_pipe(struct abm *abm, uint32_t otg_inst)
        cmd.abm_set_pipe.abm_set_pipe_data.ramping_boundary = ramping_boundary;
        cmd.abm_set_pipe.header.payload_bytes = sizeof(struct dmub_cmd_abm_set_pipe_data);
 
-       dc_dmub_srv_cmd_queue(dc->dmub_srv, &cmd.abm_set_pipe.header);
+       dc_dmub_srv_cmd_queue(dc->dmub_srv, &cmd);
        dc_dmub_srv_cmd_execute(dc->dmub_srv);
        dc_dmub_srv_wait_idle(dc->dmub_srv);
 
@@ -146,7 +146,7 @@ static void dmcub_set_backlight_level(
        cmd.abm_set_backlight.abm_set_backlight_data.frame_ramp = frame_ramp;
        cmd.abm_set_backlight.header.payload_bytes = sizeof(struct dmub_cmd_abm_set_backlight_data);
 
-       dc_dmub_srv_cmd_queue(dc->dmub_srv, &cmd.abm_set_backlight.header);
+       dc_dmub_srv_cmd_queue(dc->dmub_srv, &cmd);
        dc_dmub_srv_cmd_execute(dc->dmub_srv);
        dc_dmub_srv_wait_idle(dc->dmub_srv);
 
@@ -171,7 +171,7 @@ static void dmub_abm_enable_fractional_pwm(struct dc_context *dc)
        cmd.abm_set_pwm_frac.abm_set_pwm_frac_data.fractional_pwm = fractional_pwm;
        cmd.abm_set_pwm_frac.header.payload_bytes = sizeof(struct dmub_cmd_abm_set_pwm_frac_data);
 
-       dc_dmub_srv_cmd_queue(dc->dmub_srv, &cmd.abm_set_pwm_frac.header);
+       dc_dmub_srv_cmd_queue(dc->dmub_srv, &cmd);
        dc_dmub_srv_cmd_execute(dc->dmub_srv);
        dc_dmub_srv_wait_idle(dc->dmub_srv);
 }
@@ -250,7 +250,7 @@ static bool dmub_abm_set_level(struct abm *abm, uint32_t level)
        cmd.abm_set_level.abm_set_level_data.level = level;
        cmd.abm_set_level.header.payload_bytes = sizeof(struct dmub_cmd_abm_set_level_data);
 
-       dc_dmub_srv_cmd_queue(dc->dmub_srv, &cmd.abm_set_level.header);
+       dc_dmub_srv_cmd_queue(dc->dmub_srv, &cmd);
        dc_dmub_srv_cmd_execute(dc->dmub_srv);
        dc_dmub_srv_wait_idle(dc->dmub_srv);
 
@@ -370,7 +370,7 @@ static bool dmub_abm_init_config(struct abm *abm,
        cmd.abm_init_config.abm_init_config_data.bytes = bytes;
        cmd.abm_init_config.header.payload_bytes = sizeof(struct dmub_cmd_abm_init_config_data);
 
-       dc_dmub_srv_cmd_queue(dc->dmub_srv, &cmd.abm_init_config.header);
+       dc_dmub_srv_cmd_queue(dc->dmub_srv, &cmd);
        dc_dmub_srv_cmd_execute(dc->dmub_srv);
        dc_dmub_srv_wait_idle(dc->dmub_srv);
 

diff --git a/drivers/gpu/drm/amd/display/dc/dce/dmub_psr.c b/drivers/gpu/drm/amd/display/dc/dce/dmub_psr.c
index 7b32e5d..9f12c76 100644 (file)
--- a/drivers/gpu/drm/amd/display/dc/dce/dmub_psr.c
+++ b/drivers/gpu/drm/amd/display/dc/dce/dmub_psr.c
@@ -102,7 +102,7 @@ static bool dmub_psr_set_version(struct dmub_psr *dmub, struct dc_stream_state *
        cmd.psr_set_version.psr_set_version_data.version = stream->link->psr_settings.psr_version;
        cmd.psr_set_version.header.payload_bytes = sizeof(struct dmub_cmd_psr_set_version_data);
 
-       dc_dmub_srv_cmd_queue(dc->dmub_srv, &cmd.psr_set_version.header);
+       dc_dmub_srv_cmd_queue(dc->dmub_srv, &cmd);
        dc_dmub_srv_cmd_execute(dc->dmub_srv);
        dc_dmub_srv_wait_idle(dc->dmub_srv);
 
@@ -126,7 +126,7 @@ static void dmub_psr_enable(struct dmub_psr *dmub, bool enable)
 
        cmd.psr_enable.header.payload_bytes = 0; // Send header only
 
-       dc_dmub_srv_cmd_queue(dc->dmub_srv, &cmd.psr_enable.header);
+       dc_dmub_srv_cmd_queue(dc->dmub_srv, &cmd);
        dc_dmub_srv_cmd_execute(dc->dmub_srv);
        dc_dmub_srv_wait_idle(dc->dmub_srv);
 }
@@ -150,7 +150,7 @@ static void dmub_psr_set_level(struct dmub_psr *dmub, uint16_t psr_level)
        cmd.psr_set_level.header.payload_bytes = sizeof(struct dmub_cmd_psr_set_level_data);
        cmd.psr_set_level.psr_set_level_data.psr_level = psr_level;
 
-       dc_dmub_srv_cmd_queue(dc->dmub_srv, &cmd.psr_set_level.header);
+       dc_dmub_srv_cmd_queue(dc->dmub_srv, &cmd);
        dc_dmub_srv_cmd_execute(dc->dmub_srv);
        dc_dmub_srv_wait_idle(dc->dmub_srv);
 }
@@ -227,7 +227,7 @@ static bool dmub_psr_copy_settings(struct dmub_psr *dmub,
        copy_settings_data->debug.visual_confirm                = dc->dc->debug.visual_confirm == VISUAL_CONFIRM_PSR ?
                                                                        true : false;
 
-       dc_dmub_srv_cmd_queue(dc->dmub_srv, &cmd.psr_copy_settings.header);
+       dc_dmub_srv_cmd_queue(dc->dmub_srv, &cmd);
        dc_dmub_srv_cmd_execute(dc->dmub_srv);
        dc_dmub_srv_wait_idle(dc->dmub_srv);
 

diff --git a/drivers/gpu/drm/amd/display/dc/dcn21/dcn21_hubp.c b/drivers/gpu/drm/amd/display/dc/dcn21/dcn21_hubp.c
index d285ba6..960a071 100644 (file)
--- a/drivers/gpu/drm/amd/display/dc/dcn21/dcn21_hubp.c
+++ b/drivers/gpu/drm/amd/display/dc/dcn21/dcn21_hubp.c
@@ -778,21 +778,28 @@ void dmcub_PLAT_54186_wa(struct hubp *hubp, struct surface_flip_registers *flip_
 {
        struct dc_dmub_srv *dmcub = hubp->ctx->dmub_srv;
        struct dcn21_hubp *hubp21 = TO_DCN21_HUBP(hubp);
-       struct dmub_rb_cmd_PLAT_54186_wa PLAT_54186_wa = { 0 };
-
-       PLAT_54186_wa.header.type = DMUB_CMD__PLAT_54186_WA;
-       PLAT_54186_wa.flip.DCSURF_PRIMARY_SURFACE_ADDRESS = flip_regs->DCSURF_PRIMARY_SURFACE_ADDRESS;
-       PLAT_54186_wa.flip.DCSURF_PRIMARY_SURFACE_ADDRESS_C = flip_regs->DCSURF_PRIMARY_SURFACE_ADDRESS_C;
-       PLAT_54186_wa.flip.DCSURF_PRIMARY_SURFACE_ADDRESS_HIGH = flip_regs->DCSURF_PRIMARY_SURFACE_ADDRESS_HIGH;
-       PLAT_54186_wa.flip.DCSURF_PRIMARY_SURFACE_ADDRESS_HIGH_C = flip_regs->DCSURF_PRIMARY_SURFACE_ADDRESS_HIGH_C;
-       PLAT_54186_wa.flip.flip_params.grph_stereo = flip_regs->grph_stereo;
-       PLAT_54186_wa.flip.flip_params.hubp_inst = hubp->inst;
-       PLAT_54186_wa.flip.flip_params.immediate = flip_regs->immediate;
-       PLAT_54186_wa.flip.flip_params.tmz_surface = flip_regs->tmz_surface;
-       PLAT_54186_wa.flip.flip_params.vmid = flip_regs->vmid;
+       union dmub_rb_cmd cmd;
+
+       memset(&cmd, 0, sizeof(cmd));
+
+       cmd.PLAT_54186_wa.header.type = DMUB_CMD__PLAT_54186_WA;
+       cmd.PLAT_54186_wa.header.payload_bytes = sizeof(cmd.PLAT_54186_wa.flip);
+       cmd.PLAT_54186_wa.flip.DCSURF_PRIMARY_SURFACE_ADDRESS =
+               flip_regs->DCSURF_PRIMARY_SURFACE_ADDRESS;
+       cmd.PLAT_54186_wa.flip.DCSURF_PRIMARY_SURFACE_ADDRESS_C =
+               flip_regs->DCSURF_PRIMARY_SURFACE_ADDRESS_C;
+       cmd.PLAT_54186_wa.flip.DCSURF_PRIMARY_SURFACE_ADDRESS_HIGH =
+               flip_regs->DCSURF_PRIMARY_SURFACE_ADDRESS_HIGH;
+       cmd.PLAT_54186_wa.flip.DCSURF_PRIMARY_SURFACE_ADDRESS_HIGH_C =
+               flip_regs->DCSURF_PRIMARY_SURFACE_ADDRESS_HIGH_C;
+       cmd.PLAT_54186_wa.flip.flip_params.grph_stereo = flip_regs->grph_stereo;
+       cmd.PLAT_54186_wa.flip.flip_params.hubp_inst = hubp->inst;
+       cmd.PLAT_54186_wa.flip.flip_params.immediate = flip_regs->immediate;
+       cmd.PLAT_54186_wa.flip.flip_params.tmz_surface = flip_regs->tmz_surface;
+       cmd.PLAT_54186_wa.flip.flip_params.vmid = flip_regs->vmid;
 
        PERF_TRACE();  // TODO: remove after performance is stable.
-       dc_dmub_srv_cmd_queue(dmcub, &PLAT_54186_wa.header);
+       dc_dmub_srv_cmd_queue(dmcub, &cmd);
        PERF_TRACE();  // TODO: remove after performance is stable.
        dc_dmub_srv_cmd_execute(dmcub);
        PERF_TRACE();  // TODO: remove after performance is stable.

diff --git a/drivers/gpu/drm/amd/display/dmub/inc/dmub_rb.h b/drivers/gpu/drm/amd/display/dmub/inc/dmub_rb.h
index df875fd..2ae48c1 100644 (file)
--- a/drivers/gpu/drm/amd/display/dmub/inc/dmub_rb.h
+++ b/drivers/gpu/drm/amd/display/dmub/inc/dmub_rb.h
@@ -33,8 +33,6 @@
 extern "C" {
 #endif
 
-struct dmub_cmd_header;
-
 struct dmub_rb_init_params {
        void *ctx;
        void *base_address;
@@ -71,7 +69,7 @@ static inline bool dmub_rb_full(struct dmub_rb *rb)
 }
 
 static inline bool dmub_rb_push_front(struct dmub_rb *rb,
-                                     const struct dmub_cmd_header *cmd)
+                                     const union dmub_rb_cmd *cmd)
 {
        uint64_t volatile *dst = (uint64_t volatile *)(rb->base_address) + rb->wrpt / sizeof(uint64_t);
        const uint64_t *src = (const uint64_t *)cmd;
@@ -93,7 +91,7 @@ static inline bool dmub_rb_push_front(struct dmub_rb *rb,
 }
 
 static inline bool dmub_rb_front(struct dmub_rb *rb,
-                                struct dmub_cmd_header *cmd)
+                                union dmub_rb_cmd  *cmd)
 {
        uint8_t *rd_ptr = (uint8_t *)rb->base_address + rb->rptr;
 

diff --git a/drivers/gpu/drm/amd/display/dmub/inc/dmub_srv.h b/drivers/gpu/drm/amd/display/dmub/inc/dmub_srv.h
index e40d1cd..9f10bfe 100644 (file)
--- a/drivers/gpu/drm/amd/display/dmub/inc/dmub_srv.h
+++ b/drivers/gpu/drm/amd/display/dmub/inc/dmub_srv.h
@@ -75,7 +75,6 @@ extern "C" {
 
 /* Forward declarations */
 struct dmub_srv;
-struct dmub_cmd_header;
 struct dmub_srv_common_regs;
 
 /* enum dmub_status - return code for dmcub functions */
@@ -458,7 +457,7 @@ enum dmub_status dmub_srv_hw_reset(struct dmub_srv *dmub);
  *   DMUB_STATUS_INVALID - unspecified error
  */
 enum dmub_status dmub_srv_cmd_queue(struct dmub_srv *dmub,
-                                   const struct dmub_cmd_header *cmd);
+                                   const union dmub_rb_cmd *cmd);
 
 /**
  * dmub_srv_cmd_execute() - Executes a queued sequence to the dmub

diff --git a/drivers/gpu/drm/amd/display/dmub/src/dmub_srv.c b/drivers/gpu/drm/amd/display/dmub/src/dmub_srv.c
index a6e4032..66ba0b2 100644 (file)
--- a/drivers/gpu/drm/amd/display/dmub/src/dmub_srv.c
+++ b/drivers/gpu/drm/amd/display/dmub/src/dmub_srv.c
@@ -462,7 +462,7 @@ enum dmub_status dmub_srv_hw_reset(struct dmub_srv *dmub)
 }
 
 enum dmub_status dmub_srv_cmd_queue(struct dmub_srv *dmub,
-                                   const struct dmub_cmd_header *cmd)
+                                   const union dmub_rb_cmd *cmd)
 {
        if (!dmub->hw_init)
                return DMUB_STATUS_INVALID;