From mboxrd@z Thu Jan 1 00:00:00 1970 From: bugzilla-daemon@freedesktop.org Subject: [Bug 107319] [amdgpu] [4.14+] [patch] amdgpu uses raw rlc_hdr values, causing kernel OOPS on big endian architectures Date: Sat, 21 Jul 2018 05:24:34 +0000 Message-ID: Mime-Version: 1.0 Content-Type: multipart/mixed; boundary="===============1890563173==" Return-path: Received: from culpepper.freedesktop.org (culpepper.freedesktop.org [IPv6:2610:10:20:722:a800:ff:fe98:4b55]) by gabe.freedesktop.org (Postfix) with ESMTP id 75D016E0D2 for ; Sat, 21 Jul 2018 05:24:34 +0000 (UTC) List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: dri-devel-bounces@lists.freedesktop.org Sender: "dri-devel" To: dri-devel@lists.freedesktop.org List-Id: dri-devel@lists.freedesktop.org --===============1890563173== Content-Type: multipart/alternative; boundary="15321506740.Ce75a5Fc8.13582" Content-Transfer-Encoding: 7bit --15321506740.Ce75a5Fc8.13582 Date: Sat, 21 Jul 2018 05:24:34 +0000 MIME-Version: 1.0 Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable X-Bugzilla-URL: http://bugs.freedesktop.org/ Auto-Submitted: auto-generated https://bugs.freedesktop.org/show_bug.cgi?id=3D107319 Bug ID: 107319 Summary: [amdgpu] [4.14+] [patch] amdgpu uses raw rlc_hdr values, causing kernel OOPS on big endian architectures Product: DRI Version: XOrg git Hardware: PowerPC OS: Linux (All) Status: NEW Severity: major Priority: medium Component: DRM/AMDgpu Assignee: dri-devel@lists.freedesktop.org Reporter: awilfox@adelielinux.org Created attachment 140751 --> https://bugs.freedesktop.org/attachment.cgi?id=3D140751&action=3Dedit drm/amdgpu: use processed values for counting [ 8.143396] Unable to handle kernel paging request for data at address 0xc00800000615b000 [ 8.143396] Faulting instruction address: 0xc008000005f063c8 [ 8.143399] Oops: Kernel access of bad area, sig: 11 [#1] [ 8.143429] BE SMP NR_CPUS=3D256 NUMA PowerNV [ 8.143461] Modules linked in: binfmt_misc amdgpu(+) ast ttm drm_kms_hel= per sysimgblt syscopyarea sysfillrect fb_sys_fops drm joydev mac_hid tg3 ipmi_powernv ipmi_msghandler agpgart i2c_algo_bit shpchp [ 8.143615] CPU: 0 PID: 2402 Comm: kworker/0:3 Not tainted 4.14.48-mc8-e= asy #1 [ 8.143679] Workqueue: events .work_for_cpu_fn [ 8.143728] task: c0000003e7fd8000 task.stack: c0000003e7fe0000 [ 8.143783] NIP: c008000005f063c8 LR: c008000005f06388 CTR: c00000000027efd0 [ 8.143869] REGS: c0000003e7fe3430 TRAP: 0300 Not tainted=20 (4.14.48-mc8-easy) [ 8.143950] MSR: 9000000000009032 CR: 28002444= =20 XER: 20040000 [ 8.144040] CFAR: c008000005f063d0 DAR: c00800000615b000 DSISR: 40000000 SOFTE: 1 [ 8.144787] NIP [c008000005f063c8] .gfx_v8_0_sw_init+0x5a8/0x15b0 [amdgp= u] [ 8.144911] LR [c008000005f06388] .gfx_v8_0_sw_init+0x568/0x15b0 [amdgpu] [ 8.144976] Call Trace: [ 8.145049] [c0000003e7fe36b0] [c008000005f06388] .gfx_v8_0_sw_init+0x568/0x15b0 [amdgpu] (unreliable) [ 8.145194] [c0000003e7fe37c0] [c008000005e484c4] .amdgpu_device_init+0xf34/0x1750 [amdgpu] [ 8.145302] [c0000003e7fe38f0] [c008000005e4a94c] .amdgpu_driver_load_kms+0x9c/0x2a0 [amdgpu] [ 8.145420] [c0000003e7fe3980] [c008000004f4d200] .drm_dev_register+0x1c0/0x250 [drm] [ 8.145548] [c0000003e7fe3a30] [c008000005e416c4] .amdgpu_pci_probe+0x164/0x1a0 [amdgpu] [ 8.145601] [c0000003e7fe3ac0] [c000000000618ed0] .local_pci_probe+0x60/0x130 [ 8.145683] [c0000003e7fe3b60] [c0000000000e8780] .work_for_cpu_fn+0x30/= 0x50 [ 8.145774] [c0000003e7fe3be0] [c0000000000ecea8] .process_one_work+0x2a8/0x550 [ 8.145854] [c0000003e7fe3c80] [c0000000000ed430] .worker_thread+0x2e0/0= x600 [ 8.145924] [c0000003e7fe3d70] [c0000000000f5338] .kthread+0x158/0x1a0 [ 8.145973] [c0000003e7fe3e30] [c00000000000bd4c] .ret_from_kernel_thread+0x58/0x8c [ 8.146054] Instruction dump: [ 8.146089] 38db004c 39200000 7d00342c 7d08da14 815b0048 554af0be 7f8a48= 40 409d004c 792a1764 e8ff46f0 39290001 79290020 <7cc8542c> 7cc7512e 4bffffd8 60000000 [ 8.146252] ---[ end trace 8b0ede048bbb20ae ]--- adev->gfx.rlc in gfx_v8_0_init_microcode has the values from rlc_hdr already processed by le32_to_cpu. Using the rlc_hdr values on big-endian machines causes a kernel Oops due to writing well outside of the array (0x24000000 instead of 0x24). gfx_v9_0 had the same issue and was fixed in the same ma= nner (but was not tested locally; I do not have a v9 card). --=20 You are receiving this mail because: You are the assignee for the bug.= --15321506740.Ce75a5Fc8.13582 Date: Sat, 21 Jul 2018 05:24:34 +0000 MIME-Version: 1.0 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable X-Bugzilla-URL: http://bugs.freedesktop.org/ Auto-Submitted: auto-generated
Bug ID 107319
Summary [amdgpu] [4.14+] [patch] amdgpu uses raw rlc_hdr values, caus= ing kernel OOPS on big endian architectures
Product DRI
Version XOrg git
Hardware PowerPC
OS Linux (All)
Status NEW
Severity major
Priority medium
Component DRM/AMDgpu
Assignee dri-devel@lists.freedesktop.org
Reporter awilfox@adelielinux.org 

Created attachment 140751 [details]=

drm/amdgpu: use processed values for counting

[    8.143396] Unable to handle kernel paging request for data at address
0xc00800000615b000
[    8.143396] Faulting instruction address: 0xc008000005f063c8
[    8.143399] Oops: Kernel access of bad area, sig: 11 [#1]
[    8.143429] BE SMP NR_CPUS=3D256 NUMA PowerNV
[    8.143461] Modules linked in: binfmt_misc amdgpu(+) ast ttm drm_kms_hel=
per
sysimgblt syscopyarea sysfillrect fb_sys_fops drm joydev mac_hid tg3
ipmi_powernv ipmi_msghandler agpgart i2c_algo_bit shpchp
[    8.143615] CPU: 0 PID: 2402 Comm: kworker/0:3 Not tainted 4.14.48-mc8-e=
asy
#1
[    8.143679] Workqueue: events .work_for_cpu_fn
[    8.143728] task: c0000003e7fd8000 task.stack: c0000003e7fe0000
[    8.143783] NIP:  c008000005f063c8 LR: c008000005f06388 CTR:
c00000000027efd0
[    8.143869] REGS: c0000003e7fe3430 TRAP: 0300   Not tainted=20
(4.14.48-mc8-easy)
[    8.143950] MSR:  9000000000009032 <SF,HV,EE,ME,IR,DR,RI>  CR: 280=
02444=20
XER: 20040000
[    8.144040] CFAR: c008000005f063d0 DAR: c00800000615b000 DSISR: 40000000
SOFTE: 1
[    8.144787] NIP [c008000005f063c8] .gfx_v8_0_sw_init+0x5a8/0x15b0 [amdgp=
u]
[    8.144911] LR [c008000005f06388] .gfx_v8_0_sw_init+0x568/0x15b0 [amdgpu]
[    8.144976] Call Trace:
[    8.145049] [c0000003e7fe36b0] [c008000005f06388]
.gfx_v8_0_sw_init+0x568/0x15b0 [amdgpu] (unreliable)
[    8.145194] [c0000003e7fe37c0] [c008000005e484c4]
.amdgpu_device_init+0xf34/0x1750 [amdgpu]
[    8.145302] [c0000003e7fe38f0] [c008000005e4a94c]
.amdgpu_driver_load_kms+0x9c/0x2a0 [amdgpu]
[    8.145420] [c0000003e7fe3980] [c008000004f4d200]
.drm_dev_register+0x1c0/0x250 [drm]
[    8.145548] [c0000003e7fe3a30] [c008000005e416c4]
.amdgpu_pci_probe+0x164/0x1a0 [amdgpu]
[    8.145601] [c0000003e7fe3ac0] [c000000000618ed0]
.local_pci_probe+0x60/0x130
[    8.145683] [c0000003e7fe3b60] [c0000000000e8780] .work_for_cpu_fn+0x30/=
0x50
[    8.145774] [c0000003e7fe3be0] [c0000000000ecea8]
.process_one_work+0x2a8/0x550
[    8.145854] [c0000003e7fe3c80] [c0000000000ed430] .worker_thread+0x2e0/0=
x600
[    8.145924] [c0000003e7fe3d70] [c0000000000f5338] .kthread+0x158/0x1a0
[    8.145973] [c0000003e7fe3e30] [c00000000000bd4c]
.ret_from_kernel_thread+0x58/0x8c
[    8.146054] Instruction dump:
[    8.146089] 38db004c 39200000 7d00342c 7d08da14 815b0048 554af0be 7f8a48=
40
409d004c 792a1764 e8ff46f0 39290001 79290020 <7cc8542c> 7cc7512e 4bff=
ffd8
60000000
[    8.146252] ---[ end trace 8b0ede048bbb20ae ]---

adev->gfx.rlc in gfx_v8_0_init_microcode has the values from rlc_hdr alr=
eady
processed by le32_to_cpu.  Using the rlc_hdr values on big-endian machines
causes a kernel Oops due to writing well outside of the array (0x24000000
instead of 0x24).  gfx_v9_0 had the same issue and was fixed in the same ma=
nner
(but was not tested locally; I do not have a v9 card).

You are receiving this mail because:
  • You are the assignee for the bug.
= --15321506740.Ce75a5Fc8.13582-- --===============1890563173== Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: base64 Content-Disposition: inline X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX18KZHJpLWRldmVs IG1haWxpbmcgbGlzdApkcmktZGV2ZWxAbGlzdHMuZnJlZWRlc2t0b3Aub3JnCmh0dHBzOi8vbGlz dHMuZnJlZWRlc2t0b3Aub3JnL21haWxtYW4vbGlzdGluZm8vZHJpLWRldmVsCg== --===============1890563173==--