6.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Xiaoyong Lu xiaoyong.lu@mediatek.com
[ Upstream commit 89a4f369b20810a8365f87badf7862c67d344bbe ]
Fix av1 decode fail when iova is 36bit.
Decoder hardware will access incorrect iova address when tile buffer is 36bit, it will lead to iommu fault when hardware access dram data.
Fixes: 2f5d0aef37c6 ("media: mediatek: vcodec: support stateless AV1 decoder") Signed-off-by: Xiaoyong Luxiaoyong.lu@mediatek.com Signed-off-by: Hans Verkuil hverkuil-cisco@xs4all.nl Signed-off-by: Sasha Levin sashal@kernel.org --- .../mediatek/vcodec/vdec/vdec_av1_req_lat_if.c | 12 ++++++++---- 1 file changed, 8 insertions(+), 4 deletions(-)
diff --git a/drivers/media/platform/mediatek/vcodec/vdec/vdec_av1_req_lat_if.c b/drivers/media/platform/mediatek/vcodec/vdec/vdec_av1_req_lat_if.c index 404a1a23fd402..b00b423274b3b 100644 --- a/drivers/media/platform/mediatek/vcodec/vdec/vdec_av1_req_lat_if.c +++ b/drivers/media/platform/mediatek/vcodec/vdec/vdec_av1_req_lat_if.c @@ -1658,9 +1658,9 @@ static void vdec_av1_slice_setup_tile_buffer(struct vdec_av1_slice_instance *ins u32 allow_update_cdf = 0; u32 sb_boundary_x_m1 = 0, sb_boundary_y_m1 = 0; int tile_info_base; - u32 tile_buf_pa; + u64 tile_buf_pa; u32 *tile_info_buf = instance->tile.va; - u32 pa = (u32)bs->dma_addr; + u64 pa = (u64)bs->dma_addr;
if (uh->disable_cdf_update == 0) allow_update_cdf = 1; @@ -1673,8 +1673,12 @@ static void vdec_av1_slice_setup_tile_buffer(struct vdec_av1_slice_instance *ins tile_info_buf[tile_info_base + 0] = (tile_group->tile_size[tile_num] << 3); tile_buf_pa = pa + tile_group->tile_start_offset[tile_num];
- tile_info_buf[tile_info_base + 1] = (tile_buf_pa >> 4) << 4; - tile_info_buf[tile_info_base + 2] = (tile_buf_pa % 16) << 3; + /* save av1 tile high 4bits(bit 32-35) address in lower 4 bits position + * and clear original for hw requirement. + */ + tile_info_buf[tile_info_base + 1] = (tile_buf_pa & 0xFFFFFFF0ull) | + ((tile_buf_pa & 0xF00000000ull) >> 32); + tile_info_buf[tile_info_base + 2] = (tile_buf_pa & 0xFull) << 3;
sb_boundary_x_m1 = (tile->mi_col_starts[tile_col + 1] - tile->mi_col_starts[tile_col] - 1) &