Bug 45503

Summary: [drm:radeon_get_bios] *ERROR* Unable to locate a BIOS ROM
Product: DRI Reporter: mlambda
Component: DRM/RadeonAssignee: Default DRI bug account <dri-devel>
Status: RESOLVED FIXED QA Contact:
Severity: major    
Priority: medium CC: mathieu.malaterre
Version: unspecified   
Hardware: x86-64 (AMD64)   
OS: Linux (All)   
Whiteboard:
i915 platform: i915 features:
Attachments:
Description Flags
dmesg with kernel 3.2.2
none
dmesg with kernel 3.3-rc2
none
dmesg with commit 211fa4f...
none
dmesg with commit a3f83ab...
none
debugging patch
none
dmesg with debug patch
none
dmesg with my patch none

Description mlambda 2012-02-01 07:55:43 UTC
Created attachment 56455 [details]
dmesg with kernel 3.2.2

On my HP Pavilion dv7 6104eg notebook with kernel 3.3-rc2 I get the following error:
----------------------------------------
[   10.341795] [drm] radeon defaulting to kernel modesetting.
[   10.341797] [drm] radeon kernel modesetting enabled.
[   10.341809] VGA switcheroo: detected switching method \_SB_.PCI0.GFX0.ATPX handle
[   10.341851] radeon 0000:01:00.0: enabling device (0000 -> 0003)
[   10.342036] [drm] initializing kernel modesetting (TURKS 0x1002:0x6740 0x103C:0x3389).
[   10.342074] [drm] register mmio base: 0xC6500000
[   10.342075] [drm] register mmio size: 131072
[   10.342077] vga_switcheroo: enabled
[   10.342166] radeon atpx: version is 1
[   10.365217] radeon 0000:01:00.0: Invalid ROM contents
[   10.365319] radeon 0000:01:00.0: Invalid ROM contents
[   10.365368] [drm:radeon_get_bios] *ERROR* Unable to locate a BIOS ROM
[   10.365408] radeon 0000:01:00.0: Fatal error during GPU init
[   10.365444] [drm] radeon: finishing device.
[   10.365447] [TTM] Memory type 2 has not been initialized.
[   10.366516] radeon 0000:01:00.0: no bo for sa manager
[   10.366540] vga_switcheroo: disabled
[   10.366663] radeon: probe of 0000:01:00.0 failed with error -22
----------------------------------------

I want to switch off the discrete Radeon GPU with vga_switcheroo when using Linux as it gets quite hot and causes the fan to run permanently. This used to work with kernel 3.2.2 without any problems.

Please tell me which additional information you need to resolve the issue!
Comment 1 mlambda 2012-02-01 07:57:27 UTC
Created attachment 56456 [details]
dmesg with kernel 3.3-rc2
Comment 2 Alex Deucher 2012-02-01 08:14:14 UTC
Please make sure pci quirks are enabled in your kernel config.  If it still doesn't work with that enabled, can you bisect?
Comment 3 mlambda 2012-02-01 08:35:41 UTC
Do you mean this option: CONFIG_PCI_QUIRKS=y ? It is enabled in my kernel config.

I'm sorry, but I have never bisected a kernel bug before and I don't know the kernel source very well. Are there many changes to radeon_get_bios from 3.2.2 to 3.3-rc2? Maybe you can guess two commits and I can try them...
Comment 4 Dave Airlie 2012-02-01 09:02:31 UTC
Its most likely one of

211fa4fc4e13492151e698d92b0dff56b29928ec

a3f83ab1a717c0e6c2f59a4cfdaa10707cc35c55
Comment 5 mlambda 2012-02-01 10:25:18 UTC
Commit a3f83ab1a717c0e6c2f59a4cfdaa10707cc35c55 works, commit 211fa4fc4e13492151e698d92b0dff56b29928ec doesn't.
Comment 6 mlambda 2012-02-01 10:26:12 UTC
Created attachment 56461 [details]
dmesg with commit 211fa4f...
Comment 7 mlambda 2012-02-01 10:26:45 UTC
Created attachment 56462 [details]
dmesg with commit a3f83ab...
Comment 8 Dave Airlie 2012-02-01 12:49:24 UTC
Created attachment 56468 [details] [review]
debugging patch

this is a debugging patch to apply on top of 3.3-rc2

can you get the dmesg with it applied?

thanks.
Comment 9 mlambda 2012-02-01 13:40:08 UTC
Created attachment 56474 [details]
dmesg with debug patch

Here's the dmesg output with your debugging patch applied.
Comment 10 mlambda 2012-02-02 06:20:36 UTC
I just found the solution:

diff -ur a/drivers/gpu/drm/radeon/radeon_atpx_handler.c b/drivers/gpu/drm/radeon/radeon_atpx_handler.c
--- a/drivers/gpu/drm/radeon/radeon_atpx_handler.c	2012-01-31 22:31:54.000000000 +0100
+++ b/drivers/gpu/drm/radeon/radeon_atpx_handler.c	2012-02-02 15:03:32.408629788 +0100
@@ -58,9 +58,12 @@
 	}
 
 	obj = (union acpi_object *)buffer.pointer;
+	printk("obj->buffer.length: %i\n", obj->buffer.length);
+	printk("len: %i\n", len);
 	memcpy(bios+offset, obj->buffer.pointer, obj->buffer.length);
+	len = obj->buffer.length;
 	kfree(buffer.pointer);
-	return obj->buffer.length;
+	return len;
 }
 
 bool radeon_atrm_supported(struct pci_dev *pdev)
Comment 11 mlambda 2012-02-02 06:22:03 UTC
Created attachment 56517 [details]
dmesg with my patch
Comment 12 Dave Airlie 2012-02-02 06:59:30 UTC
arrgh good catch, I'll send a patch with that fix now,

thanks for tracking that down.
Comment 13 Florian Mickler 2012-02-11 07:52:31 UTC
A patch referencing this bug report has been merged in Linux v3.3-rc3:

commit de47a9cd62771e3e78954d855d2304fbad4c5a44
Author: Dave Airlie <airlied@redhat.com>
Date:   Thu Feb 2 15:25:16 2012 +0000

    drm/radeon: fix use after free in ATRM bios reading code.

Use of freedesktop.org services, including Bugzilla, is subject to our Code of Conduct. How we collect and use information is described in our Privacy Policy.