--- /dev/null
+From a54f7e866cc73a4cb71b8b24bb568ba35c8969df Mon Sep 17 00:00:00 2001
+From: Hersen Wu <hersenxs.wu@amd.com>
+Date: Fri, 26 Apr 2024 16:39:37 -0400
+Subject: drm/amd/display: Skip inactive planes within ModeSupportAndSystemConfiguration
+
+From: Hersen Wu <hersenxs.wu@amd.com>
+
+commit a54f7e866cc73a4cb71b8b24bb568ba35c8969df upstream.
+
+[Why]
+Coverity reports Memory - illegal accesses.
+
+[How]
+Skip inactive planes.
+
+Reviewed-by: Alex Hung <alex.hung@amd.com>
+Acked-by: Tom Chung <chiahsuan.chung@amd.com>
+Signed-off-by: Hersen Wu <hersenxs.wu@amd.com>
+Tested-by: Daniel Wheeler <daniel.wheeler@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+[get_pipe_idx() was introduced as a helper by
+dda4fb85e433 ("drm/amd/display: DML changes for DCN32/321") in v6.0.
+This patch backports it to make code clearer. And minor conflict is
+resolved due to code context change.]
+Signed-off-by: Jianqi Ren <jianqi.ren.cn@windriver.com>
+Signed-off-by: He Zhe <zhe.he@windriver.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/amd/display/dc/dml/display_mode_vba.c | 24 ++++++++++++++++++
+ 1 file changed, 24 insertions(+)
+
+--- a/drivers/gpu/drm/amd/display/dc/dml/display_mode_vba.c
++++ b/drivers/gpu/drm/amd/display/dc/dml/display_mode_vba.c
+@@ -867,11 +867,30 @@ static unsigned int CursorBppEnumToBits(
+ }
+ }
+
++static unsigned int get_pipe_idx(struct display_mode_lib *mode_lib, unsigned int plane_idx)
++{
++ int pipe_idx = -1;
++ int i;
++
++ ASSERT(plane_idx < DC__NUM_DPP__MAX);
++
++ for (i = 0; i < DC__NUM_DPP__MAX ; i++) {
++ if (plane_idx == mode_lib->vba.pipe_plane[i]) {
++ pipe_idx = i;
++ break;
++ }
++ }
++ ASSERT(pipe_idx >= 0);
++
++ return pipe_idx;
++}
++
+ void ModeSupportAndSystemConfiguration(struct display_mode_lib *mode_lib)
+ {
+ soc_bounding_box_st *soc = &mode_lib->vba.soc;
+ unsigned int k;
+ unsigned int total_pipes = 0;
++ unsigned int pipe_idx = 0;
+
+ mode_lib->vba.VoltageLevel = mode_lib->vba.cache_pipes[0].clks_cfg.voltage;
+ mode_lib->vba.ReturnBW = mode_lib->vba.ReturnBWPerState[mode_lib->vba.VoltageLevel][mode_lib->vba.maxMpcComb];
+@@ -892,6 +911,11 @@ void ModeSupportAndSystemConfiguration(s
+
+ // Total Available Pipes Support Check
+ for (k = 0; k < mode_lib->vba.NumberOfActivePlanes; ++k) {
++ pipe_idx = get_pipe_idx(mode_lib, k);
++ if (pipe_idx == -1) {
++ ASSERT(0);
++ continue; // skip inactive planes
++ }
+ total_pipes += mode_lib->vba.DPPPerPlane[k];
+ }
+ ASSERT(total_pipes <= DC__NUM_DPP__MAX);
--- /dev/null
+From c8c19ebf7c0b202a6a2d37a52ca112432723db5f Mon Sep 17 00:00:00 2001
+From: Jesse Zhang <jesse.zhang@amd.com>
+Date: Tue, 30 Apr 2024 10:23:48 +0800
+Subject: drm/amd/pm: Fix negative array index read
+
+From: Jesse Zhang <jesse.zhang@amd.com>
+
+commit c8c19ebf7c0b202a6a2d37a52ca112432723db5f upstream.
+
+Avoid using the negative values
+for clk_idex as an index into an array pptable->DpmDescriptor.
+
+V2: fix clk_index return check (Tim Huang)
+
+Signed-off-by: Jesse Zhang <Jesse.Zhang@amd.com>
+Reviewed-by: Tim Huang <Tim.Huang@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+[Minor conflict resolved due to code context change.]
+Signed-off-by: Jianqi Ren <jianqi.ren.cn@windriver.com>
+Signed-off-by: He Zhe <zhe.he@windriver.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/amd/pm/swsmu/smu11/navi10_ppt.c | 21 ++++++++++++++++-----
+ 1 file changed, 16 insertions(+), 5 deletions(-)
+
+--- a/drivers/gpu/drm/amd/pm/swsmu/smu11/navi10_ppt.c
++++ b/drivers/gpu/drm/amd/pm/swsmu/smu11/navi10_ppt.c
+@@ -1231,19 +1231,22 @@ static int navi10_get_current_clk_freq_b
+ value);
+ }
+
+-static bool navi10_is_support_fine_grained_dpm(struct smu_context *smu, enum smu_clk_type clk_type)
++static int navi10_is_support_fine_grained_dpm(struct smu_context *smu, enum smu_clk_type clk_type)
+ {
+ PPTable_t *pptable = smu->smu_table.driver_pptable;
+ DpmDescriptor_t *dpm_desc = NULL;
+- uint32_t clk_index = 0;
++ int clk_index = 0;
+
+ clk_index = smu_cmn_to_asic_specific_index(smu,
+ CMN2ASIC_MAPPING_CLK,
+ clk_type);
++ if (clk_index < 0)
++ return clk_index;
++
+ dpm_desc = &pptable->DpmDescriptor[clk_index];
+
+ /* 0 - Fine grained DPM, 1 - Discrete DPM */
+- return dpm_desc->SnapToDiscrete == 0;
++ return dpm_desc->SnapToDiscrete == 0 ? 1 : 0;
+ }
+
+ static inline bool navi10_od_feature_is_supported(struct smu_11_0_overdrive_table *od_table, enum SMU_11_0_ODFEATURE_CAP cap)
+@@ -1299,7 +1302,11 @@ static int navi10_print_clk_levels(struc
+ if (ret)
+ return size;
+
+- if (!navi10_is_support_fine_grained_dpm(smu, clk_type)) {
++ ret = navi10_is_support_fine_grained_dpm(smu, clk_type);
++ if (ret < 0)
++ return ret;
++
++ if (!ret) {
+ for (i = 0; i < count; i++) {
+ ret = smu_v11_0_get_dpm_freq_by_index(smu, clk_type, i, &value);
+ if (ret)
+@@ -1468,7 +1475,11 @@ static int navi10_force_clk_levels(struc
+ case SMU_UCLK:
+ case SMU_FCLK:
+ /* There is only 2 levels for fine grained DPM */
+- if (navi10_is_support_fine_grained_dpm(smu, clk_type)) {
++ ret = navi10_is_support_fine_grained_dpm(smu, clk_type);
++ if (ret < 0)
++ return ret;
++
++ if (ret) {
+ soft_max_level = (soft_max_level >= 1 ? 1 : 0);
+ soft_min_level = (soft_min_level >= 1 ? 1 : 0);
+ }
projects / thirdparty / kernel / stable-queue.git / commitdiff
