From: Sasha Levin <sashal@kernel.org>
To: linux-kernel@vger.kernel.org, stable@vger.kernel.org
Cc: Sasha Levin <sashal@kernel.org>,
nouveau@lists.freedesktop.org, linux-pci@vger.kernel.org,
dri-devel@lists.freedesktop.org,
Alex Deucher <alexander.deucher@amd.com>,
amd-gfx@lists.freedesktop.org, Mikel Rychliski <mikel@mikelr.com>,
Bjorn Helgaas <bhelgaas@google.com>
Subject: [PATCH AUTOSEL 5.6 149/149] PCI: Use ioremap(), not phys_to_virt() for platform ROM
Date: Sat, 11 Apr 2020 19:03:46 -0400 [thread overview]
Message-ID: <20200411230347.22371-149-sashal@kernel.org> (raw)
In-Reply-To: <20200411230347.22371-1-sashal@kernel.org>
From: Mikel Rychliski <mikel@mikelr.com>
[ Upstream commit 72e0ef0e5f067fd991f702f0b2635d911d0cf208 ]
On some EFI systems, the video BIOS is provided by the EFI firmware. The
boot stub code stores the physical address of the ROM image in pdev->rom.
Currently we attempt to access this pointer using phys_to_virt(), which
doesn't work with CONFIG_HIGHMEM.
On these systems, attempting to load the radeon module on a x86_32 kernel
can result in the following:
BUG: unable to handle page fault for address: 3e8ed03c
#PF: supervisor read access in kernel mode
#PF: error_code(0x0000) - not-present page
*pde = 00000000
Oops: 0000 [#1] PREEMPT SMP
CPU: 0 PID: 317 Comm: systemd-udevd Not tainted 5.6.0-rc3-next-20200228 #2
Hardware name: Apple Computer, Inc. MacPro1,1/Mac-F4208DC8, BIOS MP11.88Z.005C.B08.0707021221 07/02/07
EIP: radeon_get_bios+0x5ed/0xe50 [radeon]
Code: 00 00 84 c0 0f 85 12 fd ff ff c7 87 64 01 00 00 00 00 00 00 8b 47 08 8b 55 b0 e8 1e 83 e1 d6 85 c0 74 1a 8b 55 c0 85 d2 74 13 <80> 38 55 75 0e 80 78 01 aa 0f 84 a4 03 00 00 8d 74 26 00 68 dc 06
EAX: 3e8ed03c EBX: 00000000 ECX: 3e8ed03c EDX: 00010000
ESI: 00040000 EDI: eec04000 EBP: eef3fc60 ESP: eef3fbe0
DS: 007b ES: 007b FS: 00d8 GS: 00e0 SS: 0068 EFLAGS: 00010206
CR0: 80050033 CR2: 3e8ed03c CR3: 2ec77000 CR4: 000006d0
Call Trace:
r520_init+0x26/0x240 [radeon]
radeon_device_init+0x533/0xa50 [radeon]
radeon_driver_load_kms+0x80/0x220 [radeon]
drm_dev_register+0xa7/0x180 [drm]
radeon_pci_probe+0x10f/0x1a0 [radeon]
pci_device_probe+0xd4/0x140
Fix the issue by updating all drivers which can access a platform provided
ROM. Instead of calling the helper function pci_platform_rom() which uses
phys_to_virt(), call ioremap() directly on the pdev->rom.
radeon_read_platform_bios() previously directly accessed an __iomem
pointer. Avoid this by calling memcpy_fromio() instead of kmemdup().
pci_platform_rom() now has no remaining callers, so remove it.
Link: https://lore.kernel.org/r/20200319021623.5426-1-mikel@mikelr.com
Signed-off-by: Mikel Rychliski <mikel@mikelr.com>
Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
Acked-by: Alex Deucher <alexander.deucher@amd.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/gpu/drm/amd/amdgpu/amdgpu_bios.c | 31 +++++++++++--------
.../drm/nouveau/nvkm/subdev/bios/shadowpci.c | 17 ++++++++--
drivers/gpu/drm/radeon/radeon_bios.c | 30 +++++++++++-------
drivers/pci/rom.c | 17 ----------
include/linux/pci.h | 1 -
5 files changed, 52 insertions(+), 44 deletions(-)
diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_bios.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_bios.c
index 50dff69a0f6e3..b1172d93c99c3 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_bios.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_bios.c
@@ -192,30 +192,35 @@ static bool amdgpu_read_bios_from_rom(struct amdgpu_device *adev)
static bool amdgpu_read_platform_bios(struct amdgpu_device *adev)
{
- uint8_t __iomem *bios;
- size_t size;
+ phys_addr_t rom = adev->pdev->rom;
+ size_t romlen = adev->pdev->romlen;
+ void __iomem *bios;
adev->bios = NULL;
- bios = pci_platform_rom(adev->pdev, &size);
- if (!bios) {
+ if (!rom || romlen == 0)
return false;
- }
- adev->bios = kzalloc(size, GFP_KERNEL);
- if (adev->bios == NULL)
+ adev->bios = kzalloc(romlen, GFP_KERNEL);
+ if (!adev->bios)
return false;
- memcpy_fromio(adev->bios, bios, size);
+ bios = ioremap(rom, romlen);
+ if (!bios)
+ goto free_bios;
- if (!check_atom_bios(adev->bios, size)) {
- kfree(adev->bios);
- return false;
- }
+ memcpy_fromio(adev->bios, bios, romlen);
+ iounmap(bios);
- adev->bios_size = size;
+ if (!check_atom_bios(adev->bios, romlen))
+ goto free_bios;
+
+ adev->bios_size = romlen;
return true;
+free_bios:
+ kfree(adev->bios);
+ return false;
}
#ifdef CONFIG_ACPI
diff --git a/drivers/gpu/drm/nouveau/nvkm/subdev/bios/shadowpci.c b/drivers/gpu/drm/nouveau/nvkm/subdev/bios/shadowpci.c
index 9b91da09dc5f8..8d9812a51ef63 100644
--- a/drivers/gpu/drm/nouveau/nvkm/subdev/bios/shadowpci.c
+++ b/drivers/gpu/drm/nouveau/nvkm/subdev/bios/shadowpci.c
@@ -101,9 +101,13 @@ platform_init(struct nvkm_bios *bios, const char *name)
else
return ERR_PTR(-ENODEV);
+ if (!pdev->rom || pdev->romlen == 0)
+ return ERR_PTR(-ENODEV);
+
if ((priv = kmalloc(sizeof(*priv), GFP_KERNEL))) {
+ priv->size = pdev->romlen;
if (ret = -ENODEV,
- (priv->rom = pci_platform_rom(pdev, &priv->size)))
+ (priv->rom = ioremap(pdev->rom, pdev->romlen)))
return priv;
kfree(priv);
}
@@ -111,11 +115,20 @@ platform_init(struct nvkm_bios *bios, const char *name)
return ERR_PTR(ret);
}
+static void
+platform_fini(void *data)
+{
+ struct priv *priv = data;
+
+ iounmap(priv->rom);
+ kfree(priv);
+}
+
const struct nvbios_source
nvbios_platform = {
.name = "PLATFORM",
.init = platform_init,
- .fini = (void(*)(void *))kfree,
+ .fini = platform_fini,
.read = pcirom_read,
.rw = true,
};
diff --git a/drivers/gpu/drm/radeon/radeon_bios.c b/drivers/gpu/drm/radeon/radeon_bios.c
index c42f73fad3e31..bb29cf02974d1 100644
--- a/drivers/gpu/drm/radeon/radeon_bios.c
+++ b/drivers/gpu/drm/radeon/radeon_bios.c
@@ -108,25 +108,33 @@ static bool radeon_read_bios(struct radeon_device *rdev)
static bool radeon_read_platform_bios(struct radeon_device *rdev)
{
- uint8_t __iomem *bios;
- size_t size;
+ phys_addr_t rom = rdev->pdev->rom;
+ size_t romlen = rdev->pdev->romlen;
+ void __iomem *bios;
rdev->bios = NULL;
- bios = pci_platform_rom(rdev->pdev, &size);
- if (!bios) {
+ if (!rom || romlen == 0)
return false;
- }
- if (size == 0 || bios[0] != 0x55 || bios[1] != 0xaa) {
+ rdev->bios = kzalloc(romlen, GFP_KERNEL);
+ if (!rdev->bios)
return false;
- }
- rdev->bios = kmemdup(bios, size, GFP_KERNEL);
- if (rdev->bios == NULL) {
- return false;
- }
+
+ bios = ioremap(rom, romlen);
+ if (!bios)
+ goto free_bios;
+
+ memcpy_fromio(rdev->bios, bios, romlen);
+ iounmap(bios);
+
+ if (rdev->bios[0] != 0x55 || rdev->bios[1] != 0xaa)
+ goto free_bios;
return true;
+free_bios:
+ kfree(rdev->bios);
+ return false;
}
#ifdef CONFIG_ACPI
diff --git a/drivers/pci/rom.c b/drivers/pci/rom.c
index 137bf0cee897c..8fc9a4e911e3a 100644
--- a/drivers/pci/rom.c
+++ b/drivers/pci/rom.c
@@ -195,20 +195,3 @@ void pci_unmap_rom(struct pci_dev *pdev, void __iomem *rom)
pci_disable_rom(pdev);
}
EXPORT_SYMBOL(pci_unmap_rom);
-
-/**
- * pci_platform_rom - provides a pointer to any ROM image provided by the
- * platform
- * @pdev: pointer to pci device struct
- * @size: pointer to receive size of pci window over ROM
- */
-void __iomem *pci_platform_rom(struct pci_dev *pdev, size_t *size)
-{
- if (pdev->rom && pdev->romlen) {
- *size = pdev->romlen;
- return phys_to_virt((phys_addr_t)pdev->rom);
- }
-
- return NULL;
-}
-EXPORT_SYMBOL(pci_platform_rom);
diff --git a/include/linux/pci.h b/include/linux/pci.h
index 3840a541a9de5..7268dcf1f23e9 100644
--- a/include/linux/pci.h
+++ b/include/linux/pci.h
@@ -1214,7 +1214,6 @@ int pci_enable_rom(struct pci_dev *pdev);
void pci_disable_rom(struct pci_dev *pdev);
void __iomem __must_check *pci_map_rom(struct pci_dev *pdev, size_t *size);
void pci_unmap_rom(struct pci_dev *pdev, void __iomem *rom);
-void __iomem __must_check *pci_platform_rom(struct pci_dev *pdev, size_t *size);
/* Power management related routines */
int pci_save_state(struct pci_dev *dev);
--
2.20.1
_______________________________________________
dri-devel mailing list
dri-devel@lists.freedesktop.org
https://lists.freedesktop.org/mailman/listinfo/dri-devel
prev parent reply other threads:[~2020-04-11 23:06 UTC|newest]
Thread overview: 28+ messages / expand[flat|nested] mbox.gz Atom feed top
[not found] <20200411230347.22371-1-sashal@kernel.org>
2020-04-11 23:01 ` [PATCH AUTOSEL 5.6 010/149] drm/amd/display: differentiate vsc sdp colorimetry use criteria between MST and SST Sasha Levin
2020-04-11 23:01 ` [PATCH AUTOSEL 5.6 015/149] drm/amd/display: Explicitly disable triplebuffer flips Sasha Levin
2020-04-11 23:01 ` [PATCH AUTOSEL 5.6 016/149] drm/amd/display: Fix test pattern color space inconsistency for Linux Sasha Levin
2020-04-11 23:01 ` [PATCH AUTOSEL 5.6 023/149] drm/amdgpu: check GFX RAS capability before reset counters Sasha Levin
2020-04-11 23:01 ` [PATCH AUTOSEL 5.6 031/149] drm/tegra: dc: Release PM and RGB output when client's registration fails Sasha Levin
2020-04-11 23:01 ` [PATCH AUTOSEL 5.6 033/149] drm/amd/display: Stop if retimer is not available Sasha Levin
2020-04-11 23:01 ` [PATCH AUTOSEL 5.6 036/149] drm/amd/display: writing stereo polarity register if swapped Sasha Levin
2020-04-11 23:01 ` [PATCH AUTOSEL 5.6 039/149] drm/amd/display: Fix default logger mask definition Sasha Levin
2020-04-11 23:02 ` [PATCH AUTOSEL 5.6 046/149] drm/amd/display: Only round InfoFrame refresh rates Sasha Levin
2020-04-11 23:02 ` [PATCH AUTOSEL 5.6 047/149] drm/amd/display: Fix HDMI repeater authentication Sasha Levin
2020-04-11 23:02 ` [PATCH AUTOSEL 5.6 049/149] drm/panel: simple: fix osd070t1718_19ts sync drive edge Sasha Levin
2020-04-11 23:02 ` [PATCH AUTOSEL 5.6 059/149] drm/sun4i: dsi: Use NULL to signify "no panel" Sasha Levin
2020-04-11 23:02 ` [PATCH AUTOSEL 5.6 065/149] drm/amdgpu: Fix missing error check in suspend Sasha Levin
2020-04-11 23:02 ` [PATCH AUTOSEL 5.6 068/149] drm/amd/display: always apply T7/T9 delay logic Sasha Levin
2020-04-11 23:02 ` [PATCH AUTOSEL 5.6 069/149] drm/omap: fix possible object reference leak Sasha Levin
2020-04-11 23:02 ` [PATCH AUTOSEL 5.6 072/149] drm/stm: ltdc: check crtc state before enabling LIE Sasha Levin
2020-04-11 23:02 ` [PATCH AUTOSEL 5.6 073/149] fbdev: potential information leak in do_fb_ioctl() Sasha Levin
2020-04-11 23:02 ` [PATCH AUTOSEL 5.6 074/149] drm/crc: Actually allow to change the crc source Sasha Levin
2020-04-11 23:02 ` [PATCH AUTOSEL 5.6 075/149] drm/amdgpu: fix parentheses in amdgpu_vm_update_ptes Sasha Levin
2020-04-11 23:02 ` [PATCH AUTOSEL 5.6 076/149] drm/amd/display: dc_get_vmid_use_vector() crashes when get called Sasha Levin
2020-04-11 23:02 ` [PATCH AUTOSEL 5.6 087/149] drm/amd/display: dal_ddc_i2c_payloads_create can fail causing panic Sasha Levin
2020-04-11 23:02 ` [PATCH AUTOSEL 5.6 088/149] drm/amd/display: System crashes when add_ptb_to_table() gets called Sasha Levin
2020-04-11 23:02 ` [PATCH AUTOSEL 5.6 089/149] drm/omap: dss: Cleanup DSS ports on initialisation failure Sasha Levin
2020-04-11 23:02 ` [PATCH AUTOSEL 5.6 090/149] drm/amdkfd: Fix a memory leak in queue creation error handling Sasha Levin
2020-04-11 23:02 ` [PATCH AUTOSEL 5.6 095/149] drm/amd/display: Fix dmub_psr_destroy() Sasha Levin
2020-04-11 23:03 ` [PATCH AUTOSEL 5.6 105/149] drm/msm: fix leaks if initialization fails Sasha Levin
2020-04-11 23:03 ` [PATCH AUTOSEL 5.6 106/149] drm/msm/a5xx: Always set an OPP supported hardware value Sasha Levin
2020-04-11 23:03 ` Sasha Levin [this message]
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20200411230347.22371-149-sashal@kernel.org \
--to=sashal@kernel.org \
--cc=alexander.deucher@amd.com \
--cc=amd-gfx@lists.freedesktop.org \
--cc=bhelgaas@google.com \
--cc=dri-devel@lists.freedesktop.org \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-pci@vger.kernel.org \
--cc=mikel@mikelr.com \
--cc=nouveau@lists.freedesktop.org \
--cc=stable@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).