From mboxrd@z Thu Jan 1 00:00:00 1970 From: bugzilla-daemon@freedesktop.org Subject: [Bug 105760] [4.17-rc1] RIP: smu7_populate_single_firmware_entry.isra.6+0x57/0xc0 [amdgpu] RSP: ffffa17901efb930 Date: Thu, 12 Jul 2018 13:17:49 +0000 Message-ID: References: Mime-Version: 1.0 Content-Type: multipart/mixed; boundary="===============1554815326==" Return-path: Received: from culpepper.freedesktop.org (culpepper.freedesktop.org [IPv6:2610:10:20:722:a800:ff:fe98:4b55]) by gabe.freedesktop.org (Postfix) with ESMTP id 36FB76EF32 for ; Thu, 12 Jul 2018 13:17:49 +0000 (UTC) In-Reply-To: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: dri-devel-bounces@lists.freedesktop.org Sender: "dri-devel" To: dri-devel@lists.freedesktop.org List-Id: dri-devel@lists.freedesktop.org --===============1554815326== Content-Type: multipart/alternative; boundary="15314014690.10E37213E.9401" Content-Transfer-Encoding: 7bit --15314014690.10E37213E.9401 Date: Thu, 12 Jul 2018 13:17:49 +0000 MIME-Version: 1.0 Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable X-Bugzilla-URL: http://bugs.freedesktop.org/ Auto-Submitted: auto-generated https://bugs.freedesktop.org/show_bug.cgi?id=3D105760 Thomas Martitz changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #140560|0 |1 is obsolete| | --- Comment #36 from Thomas Martitz --- Created attachment 140591 --> https://bugs.freedesktop.org/attachment.cgi?id=3D140591&action=3Dedit workaround without memcpy I made the following patch as an alternative workaround. The printks I added indicate what's going wrong. The smu_data->header pointer does not become busted. Instead, the toc->num_entries member somehow gets set to -1 (perhap= s by accident), and since toc->num_entries is used as an index for the toc->entry array, the smu7_populate_single_firmware_entry() function gets passed an invalid pointer. The workaround uses a temp. variable as the index (which seems to make resu= me work), but it's still to be found out why toc->num_entries changes to -1. A= lso, I still get lots of powerplay error messages with this patch. I'll attach d= mesg next, below is just the output of the printks I added. kugel@thomas-nb:linux.git$ dmesg | grep smu7 [ 0.908377] amdgpu: [powerplay] smu7_request_smu_load_fw: 10 ffffa8a060081000 0 1 [ 0.908422] amdgpu: [powerplay] smu7_request_smu_load_fw: 20 ffffa8a060081000 0 1 [ 30.042293] amdgpu: [powerplay] smu7_request_smu_load_fw: 10 ffffa8a060081000 0 1 [ 30.042309] amdgpu: [powerplay] smu7_request_smu_load_fw: 20 ffffa8a060081000 -1 -1 --=20 You are receiving this mail because: You are the assignee for the bug.= --15314014690.10E37213E.9401 Date: Thu, 12 Jul 2018 13:17:49 +0000 MIME-Version: 1.0 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable X-Bugzilla-URL: http://bugs.freedesktop.org/ Auto-Submitted: auto-generated Thomas Martitz changed bug 10576= 0
What Removed Added
Attachment #140560 is obsolete   1

Comme= nt # 36 on bug 10576= 0 from Thomas Martitz 
Created attachment 140=
591 [details] [review]
workaround without memcpy

I made the following patch as an alternative workaround. The printks I added
indicate what's going wrong. The smu_data->header pointer does not become
busted. Instead, the toc->num_entries member somehow gets set to -1 (per=
haps by
accident), and since toc->num_entries is used as an index for the toc-&g=
t;entry
array, the smu7_populate_single_firmware_entry() function gets passed an
invalid pointer.

The workaround uses a temp. variable as the index (which seems to make resu=
me
work), but it's still to be found out why toc->num_entries changes to -1=
. Also,
I still get lots of powerplay error messages with this patch. I'll attach d=
mesg
next, below is just the output of the printks I added.

kugel@thomas-nb:linux.git$ dmesg  | grep smu7
[    0.908377] amdgpu: [powerplay] smu7_request_smu_load_fw: 10
ffffa8a060081000 0 1
[    0.908422] amdgpu: [powerplay] smu7_request_smu_load_fw: 20
ffffa8a060081000 0 1
[   30.042293] amdgpu: [powerplay] smu7_request_smu_load_fw: 10
ffffa8a060081000 0 1
[   30.042309] amdgpu: [powerplay] smu7_request_smu_load_fw: 20
ffffa8a060081000 -1 -1

You are receiving this mail because:
  • You are the assignee for the bug.
= --15314014690.10E37213E.9401-- --===============1554815326== Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: base64 Content-Disposition: inline X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX18KZHJpLWRldmVs IG1haWxpbmcgbGlzdApkcmktZGV2ZWxAbGlzdHMuZnJlZWRlc2t0b3Aub3JnCmh0dHBzOi8vbGlz dHMuZnJlZWRlc2t0b3Aub3JnL21haWxtYW4vbGlzdGluZm8vZHJpLWRldmVsCg== --===============1554815326==--