diff mbox series

[3/5] drm/i915: Fix potential overflows in ilk ips calculations

Message ID 20201021131443.25616-3-ville.syrjala@linux.intel.com (mailing list archive)
State New, archived
Headers show
Series [1/5] drm/i915: Restore ILK-M RPS support | expand

Commit Message

Ville Syrjälä Oct. 21, 2020, 1:14 p.m. UTC
From: Ville Syrjälä <ville.syrjala@linux.intel.com>

A bunch of the ips calculations require 64bit math. In particular
'corr' and 'corr2' look like they can overflow on 32bit systems.
Switch to explicit u64 for those.

Signed-off-by: Ville Syrjälä <ville.syrjala@linux.intel.com>
---
 drivers/gpu/drm/i915/gt/intel_rps.c | 10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

Comments

Chris Wilson Oct. 21, 2020, 5:40 p.m. UTC | #1
Quoting Ville Syrjala (2020-10-21 14:14:41)
> From: Ville Syrjälä <ville.syrjala@linux.intel.com>
> 
> A bunch of the ips calculations require 64bit math. In particular
> 'corr' and 'corr2' look like they can overflow on 32bit systems.
> Switch to explicit u64 for those.
> 
> Signed-off-by: Ville Syrjälä <ville.syrjala@linux.intel.com>
> ---
>  drivers/gpu/drm/i915/gt/intel_rps.c | 10 +++++-----
>  1 file changed, 5 insertions(+), 5 deletions(-)
> 
> diff --git a/drivers/gpu/drm/i915/gt/intel_rps.c b/drivers/gpu/drm/i915/gt/intel_rps.c
> index e0db7541dbfa..1cf48c51a93e 100644
> --- a/drivers/gpu/drm/i915/gt/intel_rps.c
> +++ b/drivers/gpu/drm/i915/gt/intel_rps.c
> @@ -1281,8 +1281,9 @@ static unsigned long __ips_gfx_val(struct intel_ips *ips)
>  {
>         struct intel_rps *rps = container_of(ips, typeof(*rps), ips);
>         struct intel_uncore *uncore = rps_to_uncore(rps);
> -       unsigned long t, corr, state1, corr2, state2;
> +       unsigned int t, state1, state2;
>         u32 pxvid, ext_v;
> +       u64 corr, corr2;
>  
>         lockdep_assert_held(&mchdev_lock);
>  
> @@ -1303,11 +1304,10 @@ static unsigned long __ips_gfx_val(struct intel_ips *ips)
>         else /* < 50 */
>                 corr = t * 301 + 1004;
>  
> -       corr = corr * 150142 * state1 / 10000 - 78642;
> -       corr /= 100000;
> -       corr2 = corr * ips->corr;
> +       corr = div_u64(corr * 150142 * state1, 10000) - 78642;
u64 = (u64 * int * uint) / u32 - int

> +       corr2 = div_u64(corr, 100000) * ips->corr;
u64 = u64 / u32 * u8
>  
> -       state2 = corr2 * state1 / 10000;
> +       state2 = div_u64(corr2 * state1, 10000);
uint = (u64 * uint) / u32
>         state2 /= 100; /* convert to mW */

I stared at this and wondered if they could be too big. The unsigned
long is a bit of a give away.

div_u64 == u64/u32, check.

Reviewed-by: Chris Wilson <chris@chris-wilson.co.uk>
-Chris
diff mbox series

Patch

diff --git a/drivers/gpu/drm/i915/gt/intel_rps.c b/drivers/gpu/drm/i915/gt/intel_rps.c
index e0db7541dbfa..1cf48c51a93e 100644
--- a/drivers/gpu/drm/i915/gt/intel_rps.c
+++ b/drivers/gpu/drm/i915/gt/intel_rps.c
@@ -1281,8 +1281,9 @@  static unsigned long __ips_gfx_val(struct intel_ips *ips)
 {
 	struct intel_rps *rps = container_of(ips, typeof(*rps), ips);
 	struct intel_uncore *uncore = rps_to_uncore(rps);
-	unsigned long t, corr, state1, corr2, state2;
+	unsigned int t, state1, state2;
 	u32 pxvid, ext_v;
+	u64 corr, corr2;
 
 	lockdep_assert_held(&mchdev_lock);
 
@@ -1303,11 +1304,10 @@  static unsigned long __ips_gfx_val(struct intel_ips *ips)
 	else /* < 50 */
 		corr = t * 301 + 1004;
 
-	corr = corr * 150142 * state1 / 10000 - 78642;
-	corr /= 100000;
-	corr2 = corr * ips->corr;
+	corr = div_u64(corr * 150142 * state1, 10000) - 78642;
+	corr2 = div_u64(corr, 100000) * ips->corr;
 
-	state2 = corr2 * state1 / 10000;
+	state2 = div_u64(corr2 * state1, 10000);
 	state2 /= 100; /* convert to mW */
 
 	__gen5_ips_update(ips);