github-mirror/linux
1
0
Fork 0
mirror of https://github.com/torvalds/linux.git synced 2026-05-25 23:52:08 +02:00
Code Issues Actions Packages Projects Releases Wiki Activity Graph

gpu: nova-core: gsp: fix improper handling of empty slot in cmdq

Browse Source 
The current code hands out buffers that go all the way up to and
including `rx - 1`, but we need to maintain an empty slot to prevent the
ring buffer from wrapping around into having 'tx == rx', which means
empty.

Also add more rigorous no-panic proofs.

Fixes: 75f6b1de81 ("gpu: nova-core: gsp: Add GSP command queue bindings and handling")
Signed-off-by: Eliot Courtney <ecourtney@nvidia.com>
Reviewed-by: Gary Guo <gary@garyguo.net>
Link: https://patch.msgid.link/20260129-nova-core-cmdq1-v3-4-2ede85493a27@nvidia.com
Signed-off-by: Alexandre Courbot <acourbot@nvidia.com>
This commit is contained in:
Eliot Courtney 2026-01-29 16:45:02 +09:00 committed by Alexandre Courbot
parent f6f072d8ef
commit f64caf673c
1 changed files with 20 additions and 14 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

34
drivers/gpu/nova-core/gsp/cmdq.rs
View File

@ -227,21 +227,27 @@ fn new(dev: &device::Device<device::Bound>) -> Result<Self> {
// PANIC: per the invariant of `cpu_write_ptr`, `tx` is `< MSGQ_NUM_PAGES`.
let (before_tx, after_tx) = gsp_mem.cpuq.msgq.data.split_at_mut(tx);
if rx <= tx {
// The area from `tx` up to the end of the ring, and from the beginning of the ring up
// to `rx`, minus one unit, belongs to the driver.
if rx == 0 {
let last = after_tx.len() - 1;
(&mut after_tx[..last], &mut [])
} else {
(after_tx, &mut before_tx[..rx])
}
// The area starting at `tx` and ending at `rx - 2` modulo MSGQ_NUM_PAGES, inclusive,
// belongs to the driver for writing.
if rx == 0 {
// Since `rx` is zero, leave an empty slot at end of the buffer.
let last = after_tx.len() - 1;
(&mut after_tx[..last], &mut [])
} else if rx <= tx {
// The area is discontiguous and we leave an empty slot before `rx`.
// PANIC:
// - The index `rx - 1` is non-negative because `rx != 0` in this branch.
// - The index does not exceed `before_tx.len()` (which equals `tx`) because
// `rx <= tx` in this branch.
(after_tx, &mut before_tx[..(rx - 1)])
} else {
// The area from `tx` to `rx`, minus one unit, belongs to the driver.
//
// PANIC: per the invariants of `cpu_write_ptr` and `gsp_read_ptr`, `rx` and `tx` are
// `<= MSGQ_NUM_PAGES`, and the test above ensured that `rx > tx`.
(after_tx.split_at_mut(rx - tx).0, &mut [])
// The area is contiguous and we leave an empty slot before `rx`.
// PANIC:
// - The index `rx - tx - 1` is non-negative because `rx > tx` in this branch.
// - The index does not exceed `after_tx.len()` (which is `MSGQ_NUM_PAGES - tx`)
// because `rx < MSGQ_NUM_PAGES` by the `gsp_read_ptr` invariant.
(&mut after_tx[..(rx - tx - 1)], &mut [])
}
}