* [PATCH] drm/radeon: avoid kernel segfault in vce when gpu fails to resume
@ 2017-02-06 20:13 j.glisse
2017-02-07 10:51 ` Christian König
0 siblings, 1 reply; 3+ messages in thread
From: j.glisse @ 2017-02-06 20:13 UTC (permalink / raw)
To: dri-devel; +Cc: Jérôme Glisse
From: Jérôme Glisse <jglisse@redhat.com>
When GPU fails to resume we can not trust that value we write to GPU
memory will post and we might get garbage (more like 0xffffffff on
x86) when reading them back. This trigger out of range memory access
in the kernel inside the vce resume code path.
This patch use canonical value to compute offset instead of reading
back value from GPU memory.
Signed-off-by: Jérôme Glisse <jglisse@redhat.com>
---
drivers/gpu/drm/radeon/vce_v1_0.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/gpu/drm/radeon/vce_v1_0.c b/drivers/gpu/drm/radeon/vce_v1_0.c
index a01efe3..f541a4b 100644
--- a/drivers/gpu/drm/radeon/vce_v1_0.c
+++ b/drivers/gpu/drm/radeon/vce_v1_0.c
@@ -196,7 +196,7 @@ int vce_v1_0_load_fw(struct radeon_device *rdev, uint32_t *data)
memset(&data[5], 0, 44);
memcpy(&data[16], &sign[1], rdev->vce_fw->size - sizeof(*sign));
- data += le32_to_cpu(data[4]) / 4;
+ data += (le32_to_cpu(sign->len) + 64) / 4;
data[0] = sign->val[i].sigval[0];
data[1] = sign->val[i].sigval[1];
data[2] = sign->val[i].sigval[2];
--
2.9.3
_______________________________________________
dri-devel mailing list
dri-devel@lists.freedesktop.org
https://lists.freedesktop.org/mailman/listinfo/dri-devel
^ permalink raw reply related [flat|nested] 3+ messages in thread
* Re: [PATCH] drm/radeon: avoid kernel segfault in vce when gpu fails to resume
2017-02-06 20:13 [PATCH] drm/radeon: avoid kernel segfault in vce when gpu fails to resume j.glisse
@ 2017-02-07 10:51 ` Christian König
2017-02-09 2:17 ` Alex Deucher
0 siblings, 1 reply; 3+ messages in thread
From: Christian König @ 2017-02-07 10:51 UTC (permalink / raw)
To: j.glisse, dri-devel; +Cc: Jérôme Glisse
Am 06.02.2017 um 21:13 schrieb j.glisse@gmail.com:
> From: Jérôme Glisse <jglisse@redhat.com>
>
> When GPU fails to resume we can not trust that value we write to GPU
> memory will post and we might get garbage (more like 0xffffffff on
> x86) when reading them back. This trigger out of range memory access
> in the kernel inside the vce resume code path.
>
> This patch use canonical value to compute offset instead of reading
> back value from GPU memory.
>
> Signed-off-by: Jérôme Glisse <jglisse@redhat.com>
Good point, path is Reviewed-by: Christian König <christian.koenig@amd.com>.
Regards,
Christian.
> ---
> drivers/gpu/drm/radeon/vce_v1_0.c | 2 +-
> 1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/drivers/gpu/drm/radeon/vce_v1_0.c b/drivers/gpu/drm/radeon/vce_v1_0.c
> index a01efe3..f541a4b 100644
> --- a/drivers/gpu/drm/radeon/vce_v1_0.c
> +++ b/drivers/gpu/drm/radeon/vce_v1_0.c
> @@ -196,7 +196,7 @@ int vce_v1_0_load_fw(struct radeon_device *rdev, uint32_t *data)
> memset(&data[5], 0, 44);
> memcpy(&data[16], &sign[1], rdev->vce_fw->size - sizeof(*sign));
>
> - data += le32_to_cpu(data[4]) / 4;
> + data += (le32_to_cpu(sign->len) + 64) / 4;
> data[0] = sign->val[i].sigval[0];
> data[1] = sign->val[i].sigval[1];
> data[2] = sign->val[i].sigval[2];
_______________________________________________
dri-devel mailing list
dri-devel@lists.freedesktop.org
https://lists.freedesktop.org/mailman/listinfo/dri-devel
^ permalink raw reply [flat|nested] 3+ messages in thread
* Re: [PATCH] drm/radeon: avoid kernel segfault in vce when gpu fails to resume
2017-02-07 10:51 ` Christian König
@ 2017-02-09 2:17 ` Alex Deucher
0 siblings, 0 replies; 3+ messages in thread
From: Alex Deucher @ 2017-02-09 2:17 UTC (permalink / raw)
To: Christian König
Cc: Jérôme Glisse, Maling list - DRI developers
On Tue, Feb 7, 2017 at 5:51 AM, Christian König <deathsimple@vodafone.de> wrote:
> Am 06.02.2017 um 21:13 schrieb j.glisse@gmail.com:
>>
>> From: Jérôme Glisse <jglisse@redhat.com>
>>
>> When GPU fails to resume we can not trust that value we write to GPU
>> memory will post and we might get garbage (more like 0xffffffff on
>> x86) when reading them back. This trigger out of range memory access
>> in the kernel inside the vce resume code path.
>>
>> This patch use canonical value to compute offset instead of reading
>> back value from GPU memory.
>>
>> Signed-off-by: Jérôme Glisse <jglisse@redhat.com>
Applied. Thanks!
Alex
>
>
> Good point, path is Reviewed-by: Christian König <christian.koenig@amd.com>.
>
> Regards,
> Christian.
>
>> ---
>> drivers/gpu/drm/radeon/vce_v1_0.c | 2 +-
>> 1 file changed, 1 insertion(+), 1 deletion(-)
>>
>> diff --git a/drivers/gpu/drm/radeon/vce_v1_0.c
>> b/drivers/gpu/drm/radeon/vce_v1_0.c
>> index a01efe3..f541a4b 100644
>> --- a/drivers/gpu/drm/radeon/vce_v1_0.c
>> +++ b/drivers/gpu/drm/radeon/vce_v1_0.c
>> @@ -196,7 +196,7 @@ int vce_v1_0_load_fw(struct radeon_device *rdev,
>> uint32_t *data)
>> memset(&data[5], 0, 44);
>> memcpy(&data[16], &sign[1], rdev->vce_fw->size - sizeof(*sign));
>> - data += le32_to_cpu(data[4]) / 4;
>> + data += (le32_to_cpu(sign->len) + 64) / 4;
>> data[0] = sign->val[i].sigval[0];
>> data[1] = sign->val[i].sigval[1];
>> data[2] = sign->val[i].sigval[2];
>
>
>
> _______________________________________________
> dri-devel mailing list
> dri-devel@lists.freedesktop.org
> https://lists.freedesktop.org/mailman/listinfo/dri-devel
_______________________________________________
dri-devel mailing list
dri-devel@lists.freedesktop.org
https://lists.freedesktop.org/mailman/listinfo/dri-devel
^ permalink raw reply [flat|nested] 3+ messages in thread
end of thread, other threads:[~2017-02-09 2:17 UTC | newest]
Thread overview: 3+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2017-02-06 20:13 [PATCH] drm/radeon: avoid kernel segfault in vce when gpu fails to resume j.glisse
2017-02-07 10:51 ` Christian König
2017-02-09 2:17 ` Alex Deucher
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.