| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Date: Mon, 18 May 2015 13:57:20 +0300
From: Jani Nikula <jani.nikula@...el.com>
To: Luis Henriques <luis.henriques@...onical.com>,
Jiri Slaby <jslaby@...e.cz>
Cc: stable@...r.kernel.org, linux-kernel@...r.kernel.org,
Dmitry Torokhov <dmitry.torokhov@...il.com>,
Ben Hutchings <ben@...adent.org.uk>
Subject: Re: [PATCH 3.12 071/142] drm/i915: cope with large i2c transfers
On Mon, 18 May 2015, Luis Henriques <luis.henriques@...onical.com> wrote:
> On Sat, May 16, 2015 at 09:37:11AM +0200, Jiri Slaby wrote:
>> From: Dmitry Torokhov <dmitry.torokhov@...il.com>
>>
>> 3.12-stable review patch. If anyone has any objections, please let me know.
>>
>
> Ben Hutchings (on CC) just asked about this patch being included on
> the 3.16 kernel [1]. Is this patch really useful for kernels < 3.17?
> Should it be reverted from all the other stable kernels (3.10, 3.14
> and 3.16), or do you think it's harmless?
The bug fixed by Dmitry's patch has been there since the introduction of
the gmbus code in v2.6.37 by
commit f899fc64cda8569d0529452aafc0da31c042df2e
Author: Chris Wilson <chris@...is-wilson.co.uk>
Date: Tue Jul 20 15:44:45 2010 -0700
drm/i915: use GMBUS to manage i2c links
It's just that nobody noticed before
commit 9d8dc3e529a19e427fd379118acd132520935c5d
Author: Nick Dyer <nick.dyer@...ev.co.uk>
Date: Wed Jul 23 12:49:04 2014 -0700
Input: atmel_mxt_ts - implement T44 message handling
BR,
Jani.
>
> [1] http://thread.gmane.org/gmane.linux.kernel.stable/136673
>
> Cheers,
> --
> Luís
>
>> ===============
>>
>> commit 9535c4757b881e06fae72a857485ad57c422b8d2 upstream.
>>
>> The hardware, according to the specs, is limited to 256 byte transfers,
>> and current driver has no protections in case users attempt to do larger
>> transfers. The code will just stomp over status register and mayhem
>> ensues.
>>
>> Let's split larger transfers into digestable chunks. Doing this allows
>> Atmel MXT driver on Pixel 1 function properly (it hasn't since commit
>> 9d8dc3e529a19e427fd379118acd132520935c5d "Input: atmel_mxt_ts -
>> implement T44 message handling" which tries to consume multiple
>> touchscreen/touchpad reports in a single transaction).
>>
>> Reviewed-by: Chris Wilson <chris@...is-wilson.co.uk>
>> Signed-off-by: Dmitry Torokhov <dmitry.torokhov@...il.com>
>> Signed-off-by: Jani Nikula <jani.nikula@...el.com>
>> Signed-off-by: Jiri Slaby <jslaby@...e.cz>
>> ---
>> drivers/gpu/drm/i915/i915_reg.h | 1 +
>> drivers/gpu/drm/i915/intel_i2c.c | 66 ++++++++++++++++++++++++++++++++++------
>> 2 files changed, 57 insertions(+), 10 deletions(-)
>>
>> diff --git a/drivers/gpu/drm/i915/i915_reg.h b/drivers/gpu/drm/i915/i915_reg.h
>> index 9d344da55056..4e0053e64f14 100644
>> --- a/drivers/gpu/drm/i915/i915_reg.h
>> +++ b/drivers/gpu/drm/i915/i915_reg.h
>> @@ -1105,6 +1105,7 @@
>> #define GMBUS_CYCLE_INDEX (2<<25)
>> #define GMBUS_CYCLE_STOP (4<<25)
>> #define GMBUS_BYTE_COUNT_SHIFT 16
>> +#define GMBUS_BYTE_COUNT_MAX 256U
>> #define GMBUS_SLAVE_INDEX_SHIFT 8
>> #define GMBUS_SLAVE_ADDR_SHIFT 1
>> #define GMBUS_SLAVE_READ (1<<0)
>> diff --git a/drivers/gpu/drm/i915/intel_i2c.c b/drivers/gpu/drm/i915/intel_i2c.c
>> index d1c1e0f7f262..36b720475dc0 100644
>> --- a/drivers/gpu/drm/i915/intel_i2c.c
>> +++ b/drivers/gpu/drm/i915/intel_i2c.c
>> @@ -276,18 +276,17 @@ gmbus_wait_idle(struct drm_i915_private *dev_priv)
>> }
>>
>> static int
>> -gmbus_xfer_read(struct drm_i915_private *dev_priv, struct i2c_msg *msg,
>> - u32 gmbus1_index)
>> +gmbus_xfer_read_chunk(struct drm_i915_private *dev_priv,
>> + unsigned short addr, u8 *buf, unsigned int len,
>> + u32 gmbus1_index)
>> {
>> int reg_offset = dev_priv->gpio_mmio_base;
>> - u16 len = msg->len;
>> - u8 *buf = msg->buf;
>>
>> I915_WRITE(GMBUS1 + reg_offset,
>> gmbus1_index |
>> GMBUS_CYCLE_WAIT |
>> (len << GMBUS_BYTE_COUNT_SHIFT) |
>> - (msg->addr << GMBUS_SLAVE_ADDR_SHIFT) |
>> + (addr << GMBUS_SLAVE_ADDR_SHIFT) |
>> GMBUS_SLAVE_READ | GMBUS_SW_RDY);
>> while (len) {
>> int ret;
>> @@ -309,11 +308,35 @@ gmbus_xfer_read(struct drm_i915_private *dev_priv, struct i2c_msg *msg,
>> }
>>
>> static int
>> -gmbus_xfer_write(struct drm_i915_private *dev_priv, struct i2c_msg *msg)
>> +gmbus_xfer_read(struct drm_i915_private *dev_priv, struct i2c_msg *msg,
>> + u32 gmbus1_index)
>> {
>> - int reg_offset = dev_priv->gpio_mmio_base;
>> - u16 len = msg->len;
>> u8 *buf = msg->buf;
>> + unsigned int rx_size = msg->len;
>> + unsigned int len;
>> + int ret;
>> +
>> + do {
>> + len = min(rx_size, GMBUS_BYTE_COUNT_MAX);
>> +
>> + ret = gmbus_xfer_read_chunk(dev_priv, msg->addr,
>> + buf, len, gmbus1_index);
>> + if (ret)
>> + return ret;
>> +
>> + rx_size -= len;
>> + buf += len;
>> + } while (rx_size != 0);
>> +
>> + return 0;
>> +}
>> +
>> +static int
>> +gmbus_xfer_write_chunk(struct drm_i915_private *dev_priv,
>> + unsigned short addr, u8 *buf, unsigned int len)
>> +{
>> + int reg_offset = dev_priv->gpio_mmio_base;
>> + unsigned int chunk_size = len;
>> u32 val, loop;
>>
>> val = loop = 0;
>> @@ -325,8 +348,8 @@ gmbus_xfer_write(struct drm_i915_private *dev_priv, struct i2c_msg *msg)
>> I915_WRITE(GMBUS3 + reg_offset, val);
>> I915_WRITE(GMBUS1 + reg_offset,
>> GMBUS_CYCLE_WAIT |
>> - (msg->len << GMBUS_BYTE_COUNT_SHIFT) |
>> - (msg->addr << GMBUS_SLAVE_ADDR_SHIFT) |
>> + (chunk_size << GMBUS_BYTE_COUNT_SHIFT) |
>> + (addr << GMBUS_SLAVE_ADDR_SHIFT) |
>> GMBUS_SLAVE_WRITE | GMBUS_SW_RDY);
>> while (len) {
>> int ret;
>> @@ -343,6 +366,29 @@ gmbus_xfer_write(struct drm_i915_private *dev_priv, struct i2c_msg *msg)
>> if (ret)
>> return ret;
>> }
>> +
>> + return 0;
>> +}
>> +
>> +static int
>> +gmbus_xfer_write(struct drm_i915_private *dev_priv, struct i2c_msg *msg)
>> +{
>> + u8 *buf = msg->buf;
>> + unsigned int tx_size = msg->len;
>> + unsigned int len;
>> + int ret;
>> +
>> + do {
>> + len = min(tx_size, GMBUS_BYTE_COUNT_MAX);
>> +
>> + ret = gmbus_xfer_write_chunk(dev_priv, msg->addr, buf, len);
>> + if (ret)
>> + return ret;
>> +
>> + buf += len;
>> + tx_size -= len;
>> + } while (tx_size != 0);
>> +
>> return 0;
>> }
>>
>> --
>> 2.3.7
>>
>> --
>> To unsubscribe from this list: send the line "unsubscribe stable" in
>> the body of a message to majordomo@...r.kernel.org
>> More majordomo info at http://vger.kernel.org/majordomo-info.html
--
Jani Nikula, Intel Open Source Technology Center
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
Please read the FAQ at http://www.tux.org/lkml/
Powered by blists - more mailing lists