diff options
author | Terje Bergstrom <tbergstrom@nvidia.com> | 2014-09-04 09:08:29 -0400 |
---|---|---|
committer | Dan Willemsen <dwillemsen@nvidia.com> | 2015-03-18 15:11:11 -0400 |
commit | 1bc3b3436f25a8a1de3dd336984dfaa014737a16 (patch) | |
tree | d8e54f4a3f531098e5c09713d4be5f0b396453d4 | |
parent | f69682cda8ae3d6fd1825258b6664d580fecbf4d (diff) |
gpu: nvgpu: Use pgsz_idx instead of page_size
Alloc space writes the page size to a field that requires pgsz_idx.
That can cause corruption in internal kernel structures.
Clear_sparse treated a parameter as page size instead of index.
Bug 1549451
Change-Id: I73ce17b99aae6865056facce72d2ab9ca8b3f81d
Signed-off-by: Terje Bergstrom <tbergstrom@nvidia.com>
Reviewed-on: http://git-master/r/495692
-rw-r--r-- | drivers/gpu/nvgpu/gk20a/mm_gk20a.c | 2 | ||||
-rw-r--r-- | drivers/gpu/nvgpu/gm20b/mm_gm20b.c | 14 |
2 files changed, 4 insertions, 12 deletions
diff --git a/drivers/gpu/nvgpu/gk20a/mm_gk20a.c b/drivers/gpu/nvgpu/gk20a/mm_gk20a.c index 173776ff..9ab3ae88 100644 --- a/drivers/gpu/nvgpu/gk20a/mm_gk20a.c +++ b/drivers/gpu/nvgpu/gk20a/mm_gk20a.c | |||
@@ -2379,7 +2379,7 @@ int gk20a_vm_alloc_space(struct gk20a_as_share *as_share, | |||
2379 | 2379 | ||
2380 | va_node->vaddr_start = vaddr_start; | 2380 | va_node->vaddr_start = vaddr_start; |
2381 | va_node->size = (u64)args->page_size * (u64)args->pages; | 2381 | va_node->size = (u64)args->page_size * (u64)args->pages; |
2382 | va_node->pgsz_idx = args->page_size; | 2382 | va_node->pgsz_idx = pgsz_idx; |
2383 | INIT_LIST_HEAD(&va_node->va_buffers_list); | 2383 | INIT_LIST_HEAD(&va_node->va_buffers_list); |
2384 | INIT_LIST_HEAD(&va_node->reserved_va_list); | 2384 | INIT_LIST_HEAD(&va_node->reserved_va_list); |
2385 | 2385 | ||
diff --git a/drivers/gpu/nvgpu/gm20b/mm_gm20b.c b/drivers/gpu/nvgpu/gm20b/mm_gm20b.c index 0f9749f7..afb04cae 100644 --- a/drivers/gpu/nvgpu/gm20b/mm_gm20b.c +++ b/drivers/gpu/nvgpu/gm20b/mm_gm20b.c | |||
@@ -272,19 +272,11 @@ fail: | |||
272 | } | 272 | } |
273 | 273 | ||
274 | void gm20b_vm_clear_sparse(struct vm_gk20a *vm, u64 vaddr, | 274 | void gm20b_vm_clear_sparse(struct vm_gk20a *vm, u64 vaddr, |
275 | u64 size, u32 pgsz) { | 275 | u64 size, u32 pgsz_idx) { |
276 | int pgsz_idx; | ||
277 | u64 vaddr_hi; | 276 | u64 vaddr_hi; |
278 | u32 pde_lo, pde_hi, pde_i; | 277 | u32 pde_lo, pde_hi, pde_i; |
279 | 278 | ||
280 | gk20a_dbg_fn(""); | 279 | gk20a_dbg_fn(""); |
281 | /* determine pagesz idx */ | ||
282 | for (pgsz_idx = gmmu_page_size_small; | ||
283 | pgsz_idx < gmmu_nr_page_sizes; | ||
284 | pgsz_idx++) { | ||
285 | if (gmmu_page_sizes[pgsz_idx] == pgsz) | ||
286 | break; | ||
287 | } | ||
288 | vaddr_hi = vaddr + size - 1; | 280 | vaddr_hi = vaddr + size - 1; |
289 | pde_range_from_vaddr_range(vm, | 281 | pde_range_from_vaddr_range(vm, |
290 | vaddr, | 282 | vaddr, |
@@ -292,8 +284,8 @@ void gm20b_vm_clear_sparse(struct vm_gk20a *vm, u64 vaddr, | |||
292 | &pde_lo, &pde_hi); | 284 | &pde_lo, &pde_hi); |
293 | 285 | ||
294 | gk20a_dbg_info("vaddr: 0x%llx, vaddr_hi: 0x%llx, pde_lo: 0x%x, " | 286 | gk20a_dbg_info("vaddr: 0x%llx, vaddr_hi: 0x%llx, pde_lo: 0x%x, " |
295 | "pde_hi: 0x%x, pgsz: %d, pde_stride_shift: %d", | 287 | "pde_hi: 0x%x, pgsz_idx: %d, pde_stride_shift: %d", |
296 | vaddr, vaddr_hi, pde_lo, pde_hi, pgsz, | 288 | vaddr, vaddr_hi, pde_lo, pde_hi, pgsz_idx, |
297 | vm->mm->pde_stride_shift); | 289 | vm->mm->pde_stride_shift); |
298 | 290 | ||
299 | for (pde_i = pde_lo; pde_i <= pde_hi; pde_i++) { | 291 | for (pde_i = pde_lo; pde_i <= pde_hi; pde_i++) { |