linux-kernel - Re: unable to access BIOS of Radeon X1650Pro cards (kernel bug?)

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-Id: <200805191726.03515.linux@rainbow-software.org>
Date:	Mon, 19 May 2008 17:26:02 +0200
From:	Ondrej Zary <linux@...nbow-software.org>
To:	linux-kernel@...r.kernel.org
Subject: Re: unable to access BIOS of Radeon X1650Pro cards (kernel bug?)

On Monday 19 May 2008 16:30:53 Ondrej Zary wrote:
> Hello,
> I'm debugging a weird problem - it started as inability to use xorg radeon
> driver on X1650Pro cards. The machine (Asus P5K-V board with latest BIOS
> and 64-bit, kernel 2.6.25) has 3 VGA cards - one Radeon 7000 PCI card
> (primary) and two Radeon X1650Pro PCI-E cards. The radeon driver is unable
> to initialize X1650Pro cards because it's unable to access the BIOS:
>
> (II) RADEON(0): initializing int10
> (II) Attempted to read BIOS 128KB from
> /sys/bus/pci/devices/0000:01:00.0/rom: got 0KB Requesting insufficient
> memory window!: start: 0xfe700000 end: 0xfe7fffff size 0x10000000 (EE)
> Cannot find empty range to map base to
> (EE) RADEON(0): Cannot read V_BIOS (3)
>
> I tried to read the BIOS using sysfs and it really does not work:
> # cd /sys/bus/pci/devices/0000:04:00.0
> # cat rom
> #
>
> The card seems to be setup correctly:
> # lspci -vv -s 04:00.0
> 04:00.0 VGA compatible controller: ATI Technologies Inc Radeon X1650 Pro
> (rev 9e) Subsystem: PC Partner Limited Device c880
>         Control: I/O- Mem- BusMaster- SpecCycle- MemWINV- VGASnoop- ParErr-
> Stepping- SERR- FastB2B- DisINTx- Status: Cap+ 66MHz- UDF- FastB2B- ParErr-
> DEVSEL=fast >TAbort- <TAbort- <MAbort- >SERR- <PERR- INTx- Interrupt: pin A
> routed to IRQ 11
>         Region 0: Memory at d0000000 (64-bit, prefetchable) [disabled]
> [size=256M] Region 2: Memory at feae0000 (64-bit, non-prefetchable)
> [disabled] [size=64K] Region 4: I/O ports at d000 [disabled] [size=256]
>         Expansion ROM at feac0000 [disabled] [size=128K]
>         Capabilities: [50] Power Management version 2
>                 Flags: PMEClk- DSI- D1+ D2+ AuxCurrent=0mA
> PME(D0-,D1-,D2-,D3hot-,D3cold-) Status: D0 PME-Enable- DSel=0 DScale=0 PME-
>         Capabilities: [58] Express (v1) Endpoint, MSI 00
>                 DevCap: MaxPayload 128 bytes, PhantFunc 0, Latency L0s
> <4us, L1 unlimited ExtTag+ AttnBtn- AttnInd- PwrInd- RBE- FLReset- DevCtl:
> Report errors: Correctable- Non-Fatal- Fatal- Unsupported- RlxdOrd+ ExtTag-
> PhantFunc- AuxPwr- NoSnoop+ MaxPayload 128 bytes, MaxReadReq 128 bytes
> DevSta: CorrErr- UncorrErr- FatalErr- UnsuppReq- AuxPwr- TransPend- LnkCap:
> Port #0, Speed 2.5GT/s, Width x16, ASPM L0s L1, Latency L0 <64ns, L1 <1us
> ClockPM- Suprise- LLActRep- BwNot-
>                 LnkCtl: ASPM Disabled; RCB 64 bytes Disabled- Retrain-
> CommClk+ ExtSynch- ClockPM- AutWidDis- BWInt- AutBWInt- LnkSta: Speed
> 2.5GT/s, Width x4, TrErr- Train- SlotClk+ DLActive- BWMgmt- ABWMgmt-
> Capabilities: [80] Message Signalled Interrupts: Mask- 64bit+ Queue=0/0
> Enable- Address: 0000000000000000  Data: 0000
>
>
> Then I tried it manually and it does work:
> # cat rom_enable.sh
> #! /bin/sh
> setpci -s 04:00.0 ROM_ADDRESS=feac0001
> setpci -s 04:00.0 COMMAND=3
>
> # ./rom_enable.sh
>
> # cat biosdump.c
> #include <stdio.h>
> #include <stdlib.h>
> #include <unistd.h>
> #include <sys/types.h>
> #include <sys/stat.h>
> #include <fcntl.h>
> #include <sys/mman.h>
> int main(void) {
>     int mem_fd;
>     char *mem;
>     FILE *f;
>         /* open /dev/mem */
>     if ((mem_fd = open("/dev/mem", O_RDWR) ) < 0) {
>         printf("can't open /dev/mem \n");
>         exit (-1);
>     }
>
>     /* mmap memory */
>     mem = mmap(NULL, 131072, PROT_READ|PROT_WRITE, MAP_SHARED|MAP_FIXED,
> mem_fd, 0xfeac0000); if ((long)mem < 0) {
>         printf("mmap error \n");
>         exit (-1);
>     }
>     f = fopen("dump.bin","w");
>     fwrite(mem, 1, 131072, f);
>     fclose(f);
>     close(mem_fd);
> }
>
> # cc biosdump.c -o biosdump
>
> # ./biosdump
>
> # hexdump dump.bin
> 0000000 aa55 e97e 0277 0000 0000 0000 0000 0000
> [...]
>
>
> And now, sysfs magically works!
> # cd /sys/bus/pci/devices/0000:04:00.0
> # hexdump rom
> 0000000 aa55 e97e 0277 0000 0000 0000 0000 0000
>
>
> Does anyone know what's going on here?

Replying to my own mail: the problem is caused by memory access bit of the PCI 
Command register which is disabled by default (as the card was not 
initialized because it's not primary). Issuing this command:
# setpci -s 04:00.0 COMMAND=2:2
causes reads from sysfs rom file to work.

Is it a bug or a feature? Would it be correct to enable memory access of the 
PCI device automatically during PCI ROM access?

-- 
Ondrej Zary
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/