linux-kernel - [PATCH 3/3] drm/gma500: Fix the failure to map the stolen memory

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-Id: <20230830154546.499987-4-suijingfeng@loongson.cn>
Date:   Wed, 30 Aug 2023 23:45:46 +0800
From:   Sui Jingfeng <suijingfeng@...ngson.cn>
To:     Patrik Jakobsson <patrik.r.jakobsson@...il.com>,
        David Airlie <airlied@...il.com>,
        Daniel Vetter <daniel@...ll.ch>
Cc:     dri-devel@...ts.freedesktop.org, linux-kernel@...r.kernel.org
Subject: [PATCH 3/3] drm/gma500: Fix the failure to map the stolen memory

When another discrete video card(SM750 or AST1400) is mounted into the mini
PCIe slot of my ASRock AD2550B-ITX board, the gma500 drivers fails to work.
It probably because the UEFI firmware of that board forget to initialize
the PSB_PGETBL_CTL reg, therefore the value of dev_priv->pge_ctl is 0, then
the value of gtt_phys_start is also 0.

On normal case, the value of the dev_priv->stolen_base is 0xbf800000 for
this board, so the value of the vram_stolen_size will be negative in this
case, the calculation of the stolen vram size of drm/gma500 is pasted at
below:

vram_stolen_size = pg->gtt_phys_start - dev_priv->stolen_base - PAGE_SIZE;
                 = 0 - 0xbf800000 - 4096 = 1056764 KiB

Which is so large, so this cause the ioremap_wc() fail, see below dmesg for
more information.

 gma500 0000:00:02.0: enabling device (0000 -> 0003)
 gma500 0000:00:02.0: GPU: power management timed out.
 gma500 0000:00:02.0: [drm] Phys start of GTT: 0x0
 gma500 0000:00:02.0: [drm] Stolen memory base 0xbf800000, size 1056764KiB
 x86/PAT: systemd-udevd:386 conflicting memory types bf800000-fffff000 write-combining<->uncached-minus
 x86/PAT: memtype_reserve failed [mem 0xbf800000-0xffffefff], track write-combining, req write-combining
 ioremap memtype_reserve failed -16
 gma500 0000:00:02.0: Failure to map stolen base.
 gma500: probe of 0000:00:02.0 failed with error -12

Regardless, we want this driver works even there have another video card
mounted. This patch solve this problem by given 8M stolen memory if the
value of pg->gtt_phys_start is zero. And after apply this patch, it works
fine.

$ dmesg | grep drm

 gma500 0000:00:02.0: [drm] Phys start of GTT: 0x0
 gma500 0000:00:02.0: [drm] Stolen memory base 0xbf800000, size 8192KiB
 [drm] Initialized gma500 1.0.0 20140314 for 0000:00:02.0 on minor 0
 gma500 0000:00:02.0: [drm] fb1: gma500drmfb frame buffer device

Signed-off-by: Sui Jingfeng <suijingfeng@...ngson.cn>
---
 drivers/gpu/drm/gma500/gem.c | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/drivers/gpu/drm/gma500/gem.c b/drivers/gpu/drm/gma500/gem.c
index 6fe78f61e127..0e9971bb24fa 100644
--- a/drivers/gpu/drm/gma500/gem.c
+++ b/drivers/gpu/drm/gma500/gem.c
@@ -340,7 +340,11 @@ int psb_gem_mm_init(struct drm_device *dev)
 	pg = &dev_priv->gtt;
 
 	pci_read_config_dword(pdev, PSB_BSM, &dev_priv->stolen_base);
-	vram_stolen_size = pg->gtt_phys_start - dev_priv->stolen_base - PAGE_SIZE;
+
+	if (pg->gtt_phys_start)
+		vram_stolen_size = pg->gtt_phys_start - dev_priv->stolen_base - PAGE_SIZE;
+	else
+		vram_stolen_size = 8 * 1024 * 1024;
 
 	stolen_size = vram_stolen_size;
 
-- 
2.34.1