* [PATCH] drivers/gpu/drm/ast: Fix infinite loop if read fails
@ 2016-12-15 5:12 Russell Currey
2016-12-16 1:08 ` Joel Stanley
0 siblings, 1 reply; 5+ messages in thread
From: Russell Currey @ 2016-12-15 5:12 UTC (permalink / raw)
To: airlied; +Cc: dri-devel, Russell Currey
ast_get_dram_info() configures a window in order to access BMC memory.
A BMC register can be configured to disallow this, and if so, causes
an infinite loop in the ast driver which renders the system unusable.
Fix this by erroring out if an error is detected. On powerpc systems with
EEH, this leads to the device being fenced and the system continuing to
operate.
Cc: <stable@vger.kernel.org> # 3.10+
Signed-off-by: Russell Currey <ruscur@russell.cc>
---
drivers/gpu/drm/ast/ast_main.c | 7 +++++--
1 file changed, 5 insertions(+), 2 deletions(-)
diff --git a/drivers/gpu/drm/ast/ast_main.c b/drivers/gpu/drm/ast/ast_main.c
index 904beaa..f75c642 100644
--- a/drivers/gpu/drm/ast/ast_main.c
+++ b/drivers/gpu/drm/ast/ast_main.c
@@ -223,7 +223,8 @@ static int ast_get_dram_info(struct drm_device *dev)
ast_write32(ast, 0x10000, 0xfc600309);
do {
- ;
+ if (pci_channel_offline(dev->pdev))
+ return -EIO;
} while (ast_read32(ast, 0x10000) != 0x01);
data = ast_read32(ast, 0x10004);
@@ -428,7 +429,9 @@ int ast_driver_load(struct drm_device *dev, unsigned long flags)
ast_detect_chip(dev, &need_post);
if (ast->chip != AST1180) {
- ast_get_dram_info(dev);
+ ret = ast_get_dram_info(dev);
+ if (ret)
+ goto out_free;
ast->vram_size = ast_get_vram_info(dev);
DRM_INFO("dram %d %d %d %08x\n", ast->mclk, ast->dram_type, ast->dram_bus_width, ast->vram_size);
}
--
2.10.2
_______________________________________________
dri-devel mailing list
dri-devel@lists.freedesktop.org
https://lists.freedesktop.org/mailman/listinfo/dri-devel
^ permalink raw reply related [flat|nested] 5+ messages in thread
* Re: drivers/gpu/drm/ast: Fix infinite loop if read fails
2016-12-15 5:12 [PATCH] drivers/gpu/drm/ast: Fix infinite loop if read fails Russell Currey
@ 2016-12-16 1:08 ` Joel Stanley
2016-12-18 13:39 ` Daniel Vetter
0 siblings, 1 reply; 5+ messages in thread
From: Joel Stanley @ 2016-12-16 1:08 UTC (permalink / raw)
To: Russell Currey; +Cc: airlied, dri-devel
On Thu, Dec 15, 2016 at 3:42 PM, Russell Currey <ruscur@russell.cc> wrote:
> ast_get_dram_info() configures a window in order to access BMC memory.
> A BMC register can be configured to disallow this, and if so, causes
> an infinite loop in the ast driver which renders the system unusable.
>
> Fix this by erroring out if an error is detected. On powerpc systems with
> EEH, this leads to the device being fenced and the system continuing to
> operate.
>
> Cc: <stable@vger.kernel.org> # 3.10+
> Signed-off-by: Russell Currey <ruscur@russell.cc>
Reviewed-by: Joel Stanley <joel@jms.id.au>
Thanks Russel.
Cheers,
Joel
> ---
> drivers/gpu/drm/ast/ast_main.c | 7 +++++--
> 1 file changed, 5 insertions(+), 2 deletions(-)
>
> diff --git a/drivers/gpu/drm/ast/ast_main.c b/drivers/gpu/drm/ast/ast_main.c
> index 904beaa..f75c642 100644
> --- a/drivers/gpu/drm/ast/ast_main.c
> +++ b/drivers/gpu/drm/ast/ast_main.c
> @@ -223,7 +223,8 @@ static int ast_get_dram_info(struct drm_device *dev)
> ast_write32(ast, 0x10000, 0xfc600309);
>
> do {
> - ;
> + if (pci_channel_offline(dev->pdev))
> + return -EIO;
> } while (ast_read32(ast, 0x10000) != 0x01);
> data = ast_read32(ast, 0x10004);
>
> @@ -428,7 +429,9 @@ int ast_driver_load(struct drm_device *dev, unsigned long flags)
> ast_detect_chip(dev, &need_post);
>
> if (ast->chip != AST1180) {
> - ast_get_dram_info(dev);
> + ret = ast_get_dram_info(dev);
> + if (ret)
> + goto out_free;
> ast->vram_size = ast_get_vram_info(dev);
> DRM_INFO("dram %d %d %d %08x\n", ast->mclk, ast->dram_type, ast->dram_bus_width, ast->vram_size);
> }
_______________________________________________
dri-devel mailing list
dri-devel@lists.freedesktop.org
https://lists.freedesktop.org/mailman/listinfo/dri-devel
^ permalink raw reply [flat|nested] 5+ messages in thread
* Re: drivers/gpu/drm/ast: Fix infinite loop if read fails
2016-12-16 1:08 ` Joel Stanley
@ 2016-12-18 13:39 ` Daniel Vetter
0 siblings, 0 replies; 5+ messages in thread
From: Daniel Vetter @ 2016-12-18 13:39 UTC (permalink / raw)
To: Joel Stanley; +Cc: airlied, dri-devel, Russell Currey
On Fri, Dec 16, 2016 at 11:38:57AM +1030, Joel Stanley wrote:
> On Thu, Dec 15, 2016 at 3:42 PM, Russell Currey <ruscur@russell.cc> wrote:
> > ast_get_dram_info() configures a window in order to access BMC memory.
> > A BMC register can be configured to disallow this, and if so, causes
> > an infinite loop in the ast driver which renders the system unusable.
> >
> > Fix this by erroring out if an error is detected. On powerpc systems with
> > EEH, this leads to the device being fenced and the system continuing to
> > operate.
> >
> > Cc: <stable@vger.kernel.org> # 3.10+
> > Signed-off-by: Russell Currey <ruscur@russell.cc>
>
> Reviewed-by: Joel Stanley <joel@jms.id.au>
Applied to drm-misc-fixes.
-Daniel
>
> Thanks Russel.
>
> Cheers,
>
> Joel
>
>
> > ---
> > drivers/gpu/drm/ast/ast_main.c | 7 +++++--
> > 1 file changed, 5 insertions(+), 2 deletions(-)
> >
> > diff --git a/drivers/gpu/drm/ast/ast_main.c b/drivers/gpu/drm/ast/ast_main.c
> > index 904beaa..f75c642 100644
> > --- a/drivers/gpu/drm/ast/ast_main.c
> > +++ b/drivers/gpu/drm/ast/ast_main.c
> > @@ -223,7 +223,8 @@ static int ast_get_dram_info(struct drm_device *dev)
> > ast_write32(ast, 0x10000, 0xfc600309);
> >
> > do {
> > - ;
> > + if (pci_channel_offline(dev->pdev))
> > + return -EIO;
> > } while (ast_read32(ast, 0x10000) != 0x01);
> > data = ast_read32(ast, 0x10004);
> >
> > @@ -428,7 +429,9 @@ int ast_driver_load(struct drm_device *dev, unsigned long flags)
> > ast_detect_chip(dev, &need_post);
> >
> > if (ast->chip != AST1180) {
> > - ast_get_dram_info(dev);
> > + ret = ast_get_dram_info(dev);
> > + if (ret)
> > + goto out_free;
> > ast->vram_size = ast_get_vram_info(dev);
> > DRM_INFO("dram %d %d %d %08x\n", ast->mclk, ast->dram_type, ast->dram_bus_width, ast->vram_size);
> > }
> _______________________________________________
> dri-devel mailing list
> dri-devel@lists.freedesktop.org
> https://lists.freedesktop.org/mailman/listinfo/dri-devel
--
Daniel Vetter
Software Engineer, Intel Corporation
http://blog.ffwll.ch
_______________________________________________
dri-devel mailing list
dri-devel@lists.freedesktop.org
https://lists.freedesktop.org/mailman/listinfo/dri-devel
^ permalink raw reply [flat|nested] 5+ messages in thread
* [PATCH] drivers/gpu/drm/ast: Fix infinite loop if read fails
@ 2020-12-28 2:27 ` Defang Bo
0 siblings, 0 replies; 5+ messages in thread
From: Defang Bo @ 2020-12-28 2:27 UTC (permalink / raw)
To: airlied, tzimmermann, airlied, daniel; +Cc: dri-devel, linux-kernel, Defang Bo
[Why]
Similar to commit <298360af3>("drivers/gpu/drm/ast: Fix infinite loop if read fails"),
ast_init_dram_reg() configures a window in order to access BMC memory.
A BMC register can be configured to disallow this, and if so, causes
an infinite loop in the ast driver which renders the system unusable.
[How]
Fix this by erroring out if an error is detected.
Signed-off-by: Defang Bo <bodefang@126.com>
---
drivers/gpu/drm/ast/ast_post.c | 9 ++++++---
1 file changed, 6 insertions(+), 3 deletions(-)
diff --git a/drivers/gpu/drm/ast/ast_post.c b/drivers/gpu/drm/ast/ast_post.c
index 8902c2f..8bcd1e6 100644
--- a/drivers/gpu/drm/ast/ast_post.c
+++ b/drivers/gpu/drm/ast/ast_post.c
@@ -287,7 +287,8 @@ static void ast_init_dram_reg(struct drm_device *dev)
ast_write32(ast, 0x10100, 0xa8);
do {
- ;
+ if (pci_channel_offline(dev->pdev))
+ return;
} while (ast_read32(ast, 0x10100) != 0xa8);
} else {/* AST2100/1100 */
if (ast->chip == AST2100 || ast->chip == 2200)
@@ -299,12 +300,14 @@ static void ast_init_dram_reg(struct drm_device *dev)
ast_write32(ast, 0xf000, 0x1);
ast_write32(ast, 0x12000, 0x1688A8A8);
do {
- ;
+ if (pci_channel_offline(dev->pdev))
+ return;
} while (ast_read32(ast, 0x12000) != 0x01);
ast_write32(ast, 0x10000, 0xfc600309);
do {
- ;
+ if (pci_channel_offline(dev->pdev))
+ return;
} while (ast_read32(ast, 0x10000) != 0x01);
}
--
2.7.4
^ permalink raw reply related [flat|nested] 5+ messages in thread
* [PATCH] drivers/gpu/drm/ast: Fix infinite loop if read fails
@ 2020-12-28 2:27 ` Defang Bo
0 siblings, 0 replies; 5+ messages in thread
From: Defang Bo @ 2020-12-28 2:27 UTC (permalink / raw)
To: airlied, tzimmermann, airlied, daniel; +Cc: Defang Bo, linux-kernel, dri-devel
[Why]
Similar to commit <298360af3>("drivers/gpu/drm/ast: Fix infinite loop if read fails"),
ast_init_dram_reg() configures a window in order to access BMC memory.
A BMC register can be configured to disallow this, and if so, causes
an infinite loop in the ast driver which renders the system unusable.
[How]
Fix this by erroring out if an error is detected.
Signed-off-by: Defang Bo <bodefang@126.com>
---
drivers/gpu/drm/ast/ast_post.c | 9 ++++++---
1 file changed, 6 insertions(+), 3 deletions(-)
diff --git a/drivers/gpu/drm/ast/ast_post.c b/drivers/gpu/drm/ast/ast_post.c
index 8902c2f..8bcd1e6 100644
--- a/drivers/gpu/drm/ast/ast_post.c
+++ b/drivers/gpu/drm/ast/ast_post.c
@@ -287,7 +287,8 @@ static void ast_init_dram_reg(struct drm_device *dev)
ast_write32(ast, 0x10100, 0xa8);
do {
- ;
+ if (pci_channel_offline(dev->pdev))
+ return;
} while (ast_read32(ast, 0x10100) != 0xa8);
} else {/* AST2100/1100 */
if (ast->chip == AST2100 || ast->chip == 2200)
@@ -299,12 +300,14 @@ static void ast_init_dram_reg(struct drm_device *dev)
ast_write32(ast, 0xf000, 0x1);
ast_write32(ast, 0x12000, 0x1688A8A8);
do {
- ;
+ if (pci_channel_offline(dev->pdev))
+ return;
} while (ast_read32(ast, 0x12000) != 0x01);
ast_write32(ast, 0x10000, 0xfc600309);
do {
- ;
+ if (pci_channel_offline(dev->pdev))
+ return;
} while (ast_read32(ast, 0x10000) != 0x01);
}
--
2.7.4
_______________________________________________
dri-devel mailing list
dri-devel@lists.freedesktop.org
https://lists.freedesktop.org/mailman/listinfo/dri-devel
^ permalink raw reply related [flat|nested] 5+ messages in thread
end of thread, other threads:[~2020-12-28 11:06 UTC | newest]
Thread overview: 5+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2016-12-15 5:12 [PATCH] drivers/gpu/drm/ast: Fix infinite loop if read fails Russell Currey
2016-12-16 1:08 ` Joel Stanley
2016-12-18 13:39 ` Daniel Vetter
2020-12-28 2:27 [PATCH] " Defang Bo
2020-12-28 2:27 ` Defang Bo
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.