From: Christian König <christian.koenig@amd.com>
Date: Wed, 10 Jun 2015 15:20:11 +0000 (+0200)
Subject: drm/amdgpu: fix UVD/VCE VM emulation
X-Git-Tag: Ubuntu-5.4-5.4.0-11.14~12009^2~23^2~2
X-Git-Url: https://git.proxmox.com/?a=commitdiff_plain;h=4802ce11778664a69b308c5aa9b95350b76793be;p=mirror_ubuntu-focal-kernel.git

drm/amdgpu: fix UVD/VCE VM emulation

Signed-off-by: Christian König <christian.koenig@amd.com>
Reviewed-by: Alex Deucher <alexander.deucher@amd.com>
---

diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c
index f6b224a69b3a..f09b2cba40ca 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c
@@ -564,21 +564,33 @@ static int amdgpu_cs_ib_fill(struct amdgpu_device *adev,
 			return r;
 
 		if (ring->funcs->parse_cs) {
+			struct amdgpu_bo_va_mapping *m;
 			struct amdgpu_bo *aobj = NULL;
-			void *kptr;
+			uint64_t offset;
+			uint8_t *kptr;
 
-			amdgpu_cs_find_mapping(parser, chunk_ib->va_start, &aobj);
+			m = amdgpu_cs_find_mapping(parser, chunk_ib->va_start,
+						   &aobj);
 			if (!aobj) {
 				DRM_ERROR("IB va_start is invalid\n");
 				return -EINVAL;
 			}
 
+			if ((chunk_ib->va_start + chunk_ib->ib_bytes) >
+			    (m->it.last + 1) * AMDGPU_GPU_PAGE_SIZE) {
+				DRM_ERROR("IB va_start+ib_bytes is invalid\n");
+				return -EINVAL;
+			}
+
 			/* the IB should be reserved at this point */
-			r = amdgpu_bo_kmap(aobj, &kptr);
+			r = amdgpu_bo_kmap(aobj, (void **)&kptr);
 			if (r) {
 				return r;
 			}
 
+			offset = ((uint64_t)m->it.start) * AMDGPU_GPU_PAGE_SIZE;
+			kptr += chunk_ib->va_start - offset;
+
 			r =  amdgpu_ib_get(ring, NULL, chunk_ib->ib_bytes, ib);
 			if (r) {
 				DRM_ERROR("Failed to get ib !\n");