Dan Carpenter
2017-Mar-14  07:50 UTC
[Nouveau] [bug report] drm/nouveau/fb/gf100-: rework ram detection
Hello Ben Skeggs,
The patch 97e5268d57bb: "drm/nouveau/fb/gf100-: rework ram detection"
from Mar 2, 2017, leads to the following static checker warning:
	drivers/gpu/drm/nouveau/nvkm/subdev/fb/ramgf100.c:592 gf100_ram_ctor()
	warn: should 'size << 20' be a 64 bit type?
drivers/gpu/drm/nouveau/nvkm/subdev/fb/ramgf100.c
   572  gf100_ram_ctor(const struct nvkm_ram_func *func, struct nvkm_fb *fb,
   573                 struct nvkm_ram *ram)
   574  {
   575          struct nvkm_subdev *subdev = &fb->subdev;
   576          struct nvkm_device *device = subdev->device;
   577          struct nvkm_bios *bios = device->bios;
   578          const u32 rsvd_head = ( 256 * 1024); /* vga memory */
   579          const u32 rsvd_tail = (1024 * 1024); /* vbios etc */
   580          enum nvkm_ram_type type = nvkm_fb_bios_memtype(bios);
   581          u32 fbps = nvkm_rd32(device, 0x022438);
   582          u64 total = 0, lcomm = ~0, lower, ubase, usize;
                ^^^^^^^^^^^^^
It's a u64.
   583          int ret, fbp, ltcs, ltcn = 0;
   584  
   585          nvkm_debug(subdev, "%d FBP(s)\n", fbps);
   586          for (fbp = 0; fbp < fbps; fbp++) {
   587                  u32 size = func->probe_fbp(func, device, fbp,
<cs);
                        ^^^^^^^^
This is a u32.
   588                  if (size) {
   589                          nvkm_debug(subdev, "FBP %d: %4d MiB, %d
LTC(s)\n",
   590                                     fbp, size, ltcs);
   591                          lcomm  = min(lcomm, (u64)(size / ltcs) <<
20);
   592                          total += size << 20;
                                         ^^^^^^^^^^
I don't know if this shift can overflow or not?
   593                          ltcn  += ltcs;
   594                  } else {
   595                          nvkm_debug(subdev, "FBP %d:
disabled\n", fbp);
   596                  }
   597          }
   598  
   599          lower = lcomm * ltcn;
   600          ubase = lcomm + func->upper;
   601          usize = total - lower;
   602  
   603          nvkm_debug(subdev, "Lower: %4lld MiB @ %010llx\n",
lower >> 20, 0ULL);
   604          nvkm_debug(subdev, "Upper: %4lld MiB @ %010llx\n",
usize >> 20, ubase);
   605          nvkm_debug(subdev, "Total: %4lld MiB\n", total
>> 20);
   606  
   607          ret = nvkm_ram_ctor(func, fb, type, total, 0, ram);
   608          if (ret)
   609                  return ret;
   610  
   611          nvkm_mm_fini(&ram->vram);
   612  
regards,
dan carpenter
Reasonably Related Threads
- [PATCH] drm/nouveau/fb/gf100-: Fix 32 bit wraparound in new ram detection
 - Kerberized Telnet Badly Broken (Patch enclosed)
 - [LLVMdev] MC ARM ELF local common variable alignment.
 - [LLVMdev] MC ARM ELF local common variable alignment.
 - [LLVMdev] Patch - SPU bss alignment
 
