| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Date: Mon, 18 May 2015 14:00:04 +0300
From: Jani Nikula <jani.nikula@...el.com>
To: Luis Henriques <luis.henriques@...onical.com>,
Jiri Slaby <jslaby@...e.cz>
Cc: stable@...r.kernel.org, linux-kernel@...r.kernel.org,
Dmitry Torokhov <dmitry.torokhov@...il.com>,
Ben Hutchings <ben@...adent.org.uk>
Subject: Re: [PATCH 3.12 071/142] drm/i915: cope with large i2c transfers
On Mon, 18 May 2015, Jani Nikula <jani.nikula@...el.com> wrote:
> On Mon, 18 May 2015, Luis Henriques <luis.henriques@...onical.com> wrote:
>> On Sat, May 16, 2015 at 09:37:11AM +0200, Jiri Slaby wrote:
>>> From: Dmitry Torokhov <dmitry.torokhov@...il.com>
>>>
>>> 3.12-stable review patch. If anyone has any objections, please let me know.
>>>
>>
>> Ben Hutchings (on CC) just asked about this patch being included on
>> the 3.16 kernel [1]. Is this patch really useful for kernels < 3.17?
>> Should it be reverted from all the other stable kernels (3.10, 3.14
>> and 3.16), or do you think it's harmless?
>
> The bug fixed by Dmitry's patch has been there since the introduction of
> the gmbus code in v2.6.37 by
>
> commit f899fc64cda8569d0529452aafc0da31c042df2e
> Author: Chris Wilson <chris@...is-wilson.co.uk>
> Date: Tue Jul 20 15:44:45 2010 -0700
>
> drm/i915: use GMBUS to manage i2c links
>
> It's just that nobody noticed before
>
> commit 9d8dc3e529a19e427fd379118acd132520935c5d
> Author: Nick Dyer <nick.dyer@...ev.co.uk>
> Date: Wed Jul 23 12:49:04 2014 -0700
>
> Input: atmel_mxt_ts - implement T44 message handling
So to be clear, I think the fix is worth backporting anywhere you can
easily backport. I did not check, but I think it may be possible to
trigger this from userspace with the i2c interface.
>
>
> BR,
> Jani.
>
>
>>
>> [1] http://thread.gmane.org/gmane.linux.kernel.stable/136673
>>
>> Cheers,
>> --
>> Luís
>>
>>> ===============
>>>
>>> commit 9535c4757b881e06fae72a857485ad57c422b8d2 upstream.
>>>
>>> The hardware, according to the specs, is limited to 256 byte transfers,
>>> and current driver has no protections in case users attempt to do larger
>>> transfers. The code will just stomp over status register and mayhem
>>> ensues.
>>>
>>> Let's split larger transfers into digestable chunks. Doing this allows
>>> Atmel MXT driver on Pixel 1 function properly (it hasn't since commit
>>> 9d8dc3e529a19e427fd379118acd132520935c5d "Input: atmel_mxt_ts -
>>> implement T44 message handling" which tries to consume multiple
>>> touchscreen/touchpad reports in a single transaction).
>>>
>>> Reviewed-by: Chris Wilson <chris@...is-wilson.co.uk>
>>> Signed-off-by: Dmitry Torokhov <dmitry.torokhov@...il.com>
>>> Signed-off-by: Jani Nikula <jani.nikula@...el.com>
>>> Signed-off-by: Jiri Slaby <jslaby@...e.cz>
>>> ---
>>> drivers/gpu/drm/i915/i915_reg.h | 1 +
>>> drivers/gpu/drm/i915/intel_i2c.c | 66 ++++++++++++++++++++++++++++++++++------
>>> 2 files changed, 57 insertions(+), 10 deletions(-)
>>>
>>> diff --git a/drivers/gpu/drm/i915/i915_reg.h b/drivers/gpu/drm/i915/i915_reg.h
>>> index 9d344da55056..4e0053e64f14 100644
>>> --- a/drivers/gpu/drm/i915/i915_reg.h
>>> +++ b/drivers/gpu/drm/i915/i915_reg.h
>>> @@ -1105,6 +1105,7 @@
>>> #define GMBUS_CYCLE_INDEX (2<<25)
>>> #define GMBUS_CYCLE_STOP (4<<25)
>>> #define GMBUS_BYTE_COUNT_SHIFT 16
>>> +#define GMBUS_BYTE_COUNT_MAX 256U
>>> #define GMBUS_SLAVE_INDEX_SHIFT 8
>>> #define GMBUS_SLAVE_ADDR_SHIFT 1
>>> #define GMBUS_SLAVE_READ (1<<0)
>>> diff --git a/drivers/gpu/drm/i915/intel_i2c.c b/drivers/gpu/drm/i915/intel_i2c.c
>>> index d1c1e0f7f262..36b720475dc0 100644
>>> --- a/drivers/gpu/drm/i915/intel_i2c.c
>>> +++ b/drivers/gpu/drm/i915/intel_i2c.c
>>> @@ -276,18 +276,17 @@ gmbus_wait_idle(struct drm_i915_private *dev_priv)
>>> }
>>>
>>> static int
>>> -gmbus_xfer_read(struct drm_i915_private *dev_priv, struct i2c_msg *msg,
>>> - u32 gmbus1_index)
>>> +gmbus_xfer_read_chunk(struct drm_i915_private *dev_priv,
>>> + unsigned short addr, u8 *buf, unsigned int len,
>>> + u32 gmbus1_index)
>>> {
>>> int reg_offset = dev_priv->gpio_mmio_base;
>>> - u16 len = msg->len;
>>> - u8 *buf = msg->buf;
>>>
>>> I915_WRITE(GMBUS1 + reg_offset,
>>> gmbus1_index |
>>> GMBUS_CYCLE_WAIT |
>>> (len << GMBUS_BYTE_COUNT_SHIFT) |
>>> - (msg->addr << GMBUS_SLAVE_ADDR_SHIFT) |
>>> + (addr << GMBUS_SLAVE_ADDR_SHIFT) |
>>> GMBUS_SLAVE_READ | GMBUS_SW_RDY);
>>> while (len) {
>>> int ret;
>>> @@ -309,11 +308,35 @@ gmbus_xfer_read(struct drm_i915_private *dev_priv, struct i2c_msg *msg,
>>> }
>>>
>>> static int
>>> -gmbus_xfer_write(struct drm_i915_private *dev_priv, struct i2c_msg *msg)
>>> +gmbus_xfer_read(struct drm_i915_private *dev_priv, struct i2c_msg *msg,
>>> + u32 gmbus1_index)
>>> {
>>> - int reg_offset = dev_priv->gpio_mmio_base;
>>> - u16 len = msg->len;
>>> u8 *buf = msg->buf;
>>> + unsigned int rx_size = msg->len;
>>> + unsigned int len;
>>> + int ret;
>>> +
>>> + do {
>>> + len = min(rx_size, GMBUS_BYTE_COUNT_MAX);
>>> +
>>> + ret = gmbus_xfer_read_chunk(dev_priv, msg->addr,
>>> + buf, len, gmbus1_index);
>>> + if (ret)
>>> + return ret;
>>> +
>>> + rx_size -= len;
>>> + buf += len;
>>> + } while (rx_size != 0);
>>> +
>>> + return 0;
>>> +}
>>> +
>>> +static int
>>> +gmbus_xfer_write_chunk(struct drm_i915_private *dev_priv,
>>> + unsigned short addr, u8 *buf, unsigned int len)
>>> +{
>>> + int reg_offset = dev_priv->gpio_mmio_base;
>>> + unsigned int chunk_size = len;
>>> u32 val, loop;
>>>
>>> val = loop = 0;
>>> @@ -325,8 +348,8 @@ gmbus_xfer_write(struct drm_i915_private *dev_priv, struct i2c_msg *msg)
>>> I915_WRITE(GMBUS3 + reg_offset, val);
>>> I915_WRITE(GMBUS1 + reg_offset,
>>> GMBUS_CYCLE_WAIT |
>>> - (msg->len << GMBUS_BYTE_COUNT_SHIFT) |
>>> - (msg->addr << GMBUS_SLAVE_ADDR_SHIFT) |
>>> + (chunk_size << GMBUS_BYTE_COUNT_SHIFT) |
>>> + (addr << GMBUS_SLAVE_ADDR_SHIFT) |
>>> GMBUS_SLAVE_WRITE | GMBUS_SW_RDY);
>>> while (len) {
>>> int ret;
>>> @@ -343,6 +366,29 @@ gmbus_xfer_write(struct drm_i915_private *dev_priv, struct i2c_msg *msg)
>>> if (ret)
>>> return ret;
>>> }
>>> +
>>> + return 0;
>>> +}
>>> +
>>> +static int
>>> +gmbus_xfer_write(struct drm_i915_private *dev_priv, struct i2c_msg *msg)
>>> +{
>>> + u8 *buf = msg->buf;
>>> + unsigned int tx_size = msg->len;
>>> + unsigned int len;
>>> + int ret;
>>> +
>>> + do {
>>> + len = min(tx_size, GMBUS_BYTE_COUNT_MAX);
>>> +
>>> + ret = gmbus_xfer_write_chunk(dev_priv, msg->addr, buf, len);
>>> + if (ret)
>>> + return ret;
>>> +
>>> + buf += len;
>>> + tx_size -= len;
>>> + } while (tx_size != 0);
>>> +
>>> return 0;
>>> }
>>>
>>> --
>>> 2.3.7
>>>
>>> --
>>> To unsubscribe from this list: send the line "unsubscribe stable" in
>>> the body of a message to majordomo@...r.kernel.org
>>> More majordomo info at http://vger.kernel.org/majordomo-info.html
>
> --
> Jani Nikula, Intel Open Source Technology Center
--
Jani Nikula, Intel Open Source Technology Center
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
Please read the FAQ at http://www.tux.org/lkml/
Powered by blists - more mailing lists