[PATCH] drm/amdkfd: Fix UBSAN shift-out-of-bounds warning

[Sider, Graham]

[AMD Official Use Only - General]

> -----Original Message-----
> From: amd-gfx <amd-gfx-bounces at lists.freedesktop.org> On Behalf Of Felix
> Kuehling
> Sent: Wednesday, September 21, 2022 6:30 PM
> To: amd-gfx at lists.freedesktop.org
> Cc: Ellis Michael <ellis at ellismichael.com>
> Subject: [PATCH] drm/amdkfd: Fix UBSAN shift-out-of-bounds warning
> 
> Caution: This message originated from an External Source. Use proper
> caution when opening attachments, clicking links, or responding.
> 
> 
> This was fixed in initialize_cpsch before, but not in initialize_nocpsch.
> Factor sdma bitmap initialization into a helper function to apply the correct
> implementation in both cases without duplicating it.
> 
> Reported-by: Ellis Michael <ellis at ellismichael.com>
> Signed-off-by: Felix Kuehling <Felix.Kuehling at amd.com>
> ---
>  .../drm/amd/amdkfd/kfd_device_queue_manager.c | 41 ++++++++----------
> -
>  1 file changed, 17 insertions(+), 24 deletions(-)
> 
> diff --git a/drivers/gpu/drm/amd/amdkfd/kfd_device_queue_manager.c
> b/drivers/gpu/drm/amd/amdkfd/kfd_device_queue_manager.c
> index e83725a28106..f88ec6a11ad2 100644
> --- a/drivers/gpu/drm/amd/amdkfd/kfd_device_queue_manager.c
> +++ b/drivers/gpu/drm/amd/amdkfd/kfd_device_queue_manager.c
> @@ -1240,6 +1240,20 @@ static void init_interrupts(struct
> device_queue_manager *dqm)
>                         dqm->dev->kfd2kgd->init_interrupts(dqm->dev->adev, i);  }
> 
> +static void init_sdma_bitmaps(struct device_queue_manager *dqm) {
> +       uint64_t num_sdma_queues = get_num_sdma_queues(dqm);
> +       uint64_t num_xgmi_sdma_queues =
> get_num_xgmi_sdma_queues(dqm);
> +
> +       if (num_sdma_queues)
> +               dqm->sdma_bitmap = GENMASK_ULL(num_sdma_queues-1, 0);
> +       if (num_xgmi_sdma_queues)
> +               dqm->xgmi_sdma_bitmap =
> + GENMASK_ULL(num_xgmi_sdma_queues-1, 0);

I think we still want a safeguard here in case we ever get into a situation where num_sdma_queues is > 64. Otherwise we could hit an unsigned wraparound (in __GENMASK_ULL: (~ULL(0) >> (BITS_PER_LONG_LONG - 1 - (h)))) --> would cause a wrap plus shift > width of type warning if h > 63).

Something along the lines of

dqm->sdma_bitmap = GENMASK_ULL(min(num_sdma_queues, BITS_PER_LONG_LONG) - 1, 0);

Could work as a safeguard. Same for xgmi_sdma_bitmap.

Best,
Graham

> +
> +       dqm->sdma_bitmap &= ~get_reserved_sdma_queues_bitmap(dqm);
> +       pr_info("sdma_bitmap: %llx\n", dqm->sdma_bitmap); }
> +
>  static int initialize_nocpsch(struct device_queue_manager *dqm)  {
>         int pipe, queue;
> @@ -1268,11 +1282,7 @@ static int initialize_nocpsch(struct
> device_queue_manager *dqm)
> 
>         memset(dqm->vmid_pasid, 0, sizeof(dqm->vmid_pasid));
> 
> -       dqm->sdma_bitmap = ~0ULL >> (64 - get_num_sdma_queues(dqm));
> -       dqm->sdma_bitmap &= ~(get_reserved_sdma_queues_bitmap(dqm));
> -       pr_info("sdma_bitmap: %llx\n", dqm->sdma_bitmap);
> -
> -       dqm->xgmi_sdma_bitmap = ~0ULL >> (64 -
> get_num_xgmi_sdma_queues(dqm));
> +       init_sdma_bitmaps(dqm);
> 
>         return 0;
>  }
> @@ -1450,9 +1460,6 @@ static int set_sched_resources(struct
> device_queue_manager *dqm)
> 
>  static int initialize_cpsch(struct device_queue_manager *dqm)  {
> -       uint64_t num_sdma_queues;
> -       uint64_t num_xgmi_sdma_queues;
> -
>         pr_debug("num of pipes: %d\n", get_pipes_per_mec(dqm));
> 
>         mutex_init(&dqm->lock_hidden);
> @@ -1461,24 +1468,10 @@ static int initialize_cpsch(struct
> device_queue_manager *dqm)
>         dqm->active_cp_queue_count = 0;
>         dqm->gws_queue_count = 0;
>         dqm->active_runlist = false;
> -
> -       num_sdma_queues = get_num_sdma_queues(dqm);
> -       if (num_sdma_queues >= BITS_PER_TYPE(dqm->sdma_bitmap))
> -               dqm->sdma_bitmap = ULLONG_MAX;
> -       else
> -               dqm->sdma_bitmap = (BIT_ULL(num_sdma_queues) - 1);
> -
> -       dqm->sdma_bitmap &= ~(get_reserved_sdma_queues_bitmap(dqm));
> -       pr_info("sdma_bitmap: %llx\n", dqm->sdma_bitmap);
> -
> -       num_xgmi_sdma_queues = get_num_xgmi_sdma_queues(dqm);
> -       if (num_xgmi_sdma_queues >= BITS_PER_TYPE(dqm-
> >xgmi_sdma_bitmap))
> -               dqm->xgmi_sdma_bitmap = ULLONG_MAX;
> -       else
> -               dqm->xgmi_sdma_bitmap = (BIT_ULL(num_xgmi_sdma_queues) -
> 1);
> -
>         INIT_WORK(&dqm->hw_exception_work, kfd_process_hw_exception);
> 
> +       init_sdma_bitmaps(dqm);
> +
>         return 0;
>  }
> 
> --
> 2.32.0