gpu: host1x: Use correct semantics for HOST1X_CHANNEL_DMAEND

The HOST1X_CHANNEL_DMAEND is an offset relative to the value written to
the HOST1X_CHANNEL_DMASTART register, but it is currently treated as an
absolute address. This can cause SMMU faults if the CDMA fetches past a
pushbuffer's IOMMU mapping.

Properly setting the DMAEND prevents the CDMA from fetching beyond that
address and avoid such issues. This is currently not observed because a
whole (almost) page of essentially scratch space absorbs any excessive
prefetching by CDMA. However, changing the number of slots in the push
buffer can trigger these SMMU faults.

Signed-off-by: Thierry Reding <treding@nvidia.com>

diff --git a/drivers/gpu/host1x/hw/cdma_hw.c b/drivers/gpu/host1x/hw/cdma_hw.c
index 485aef5..a24c090 100644 (file)
--- a/drivers/gpu/host1x/hw/cdma_hw.c
+++ b/drivers/gpu/host1x/hw/cdma_hw.c
@@ -75,7 +75,7 @@ static void cdma_start(struct host1x_cdma *cdma)
 
        cdma->last_pos = cdma->push_buffer.pos;
        start = cdma->push_buffer.dma;
-       end = start + cdma->push_buffer.size + 4;
+       end = cdma->push_buffer.size + 4;
 
        host1x_ch_writel(ch, HOST1X_CHANNEL_DMACTRL_DMASTOP,
                         HOST1X_CHANNEL_DMACTRL);
@@ -126,7 +126,7 @@ static void cdma_timeout_restart(struct host1x_cdma *cdma, u32 getptr)
                         HOST1X_CHANNEL_DMACTRL);
 
        start = cdma->push_buffer.dma;
-       end = start + cdma->push_buffer.size + 4;
+       end = cdma->push_buffer.size + 4;
 
        /* set base, end pointer (all of memory) */
        host1x_ch_writel(ch, lower_32_bits(start), HOST1X_CHANNEL_DMASTART);