From: Peter Delevoryas <p...@fb.com>
Hey everyone,
I think there might be a bug in aspeed_gpio_update, where it's selecting
a GPIO IRQ to update. The indexing that maps from GPIO pin to IRQ leads
to an out-of-bounds array access and a segfault after that.
tl;dr
There's 8 rows of 32 pins (8 * 32 == 256 total) on the AST2500, but some
of the pins are not actually active: there's only 228 pins actually
active in the AST2500.
The GPIO IRQ array has length 228, but we index it using a matrix
indexing scheme like [row][column], and end up out-of-bounds for
high-numbered pins.
I fixed this by converting the IRQ array to a matrix, where some
of the entries are uninitialized (zero). This retains the matrix
indexing scheme, which I think is easy to understand.
Notes on reproducing:
I was testing booting Facebook's OpenBMC platform "YosemiteV2" (fby2)
and hit a segfault:
qemu-system-arm -machine ast2500-evb \
-drive file=fby2.mtd,format=raw,if=mtd \
-serial stdio -display none
...
Setup Caching for Bridge IC info..done.
Setup Front Panel Daemon..done.
Setup fan speed...
FAN CONFIG : Single Rotor FAN
Unexpected 4 Servers config! Run FSC 4 TLs Config as default config
Setting Zone 0 speed to 70%
Setting Zone 1 speed to 70%
ok: run: fscd: (pid 1726) 0s
done.
Powering fru 1 to ON state...
Segmentation fault (core dumped)
In gdb:
Thread 3 "qemu-system-arm" received signal SIGSEGV, Segmentation fault.
[Switching to Thread 0x7ffff20ee700 (LWP 1840353)]
qemu_set_irq (irq=0xffffffff00000000, level=1) at ../hw/core/irq.c:45
45 irq->handler(irq->opaque, irq->n, level);
(gdb) p irq
$1 = (qemu_irq) 0xffffffff00000000
(gdb) up
#1 0x00005555558e36f5 in aspeed_gpio_update (s=0x7ffff7ecffb0,
regs=0x7ffff7ed0c94, value=128) at ../hw/gpio/aspeed_gpio.c:287
287 qemu_set_irq(s->gpios[offset], !!(new & mask));
(gdb) p s->gpios
$2 = {0x0 <repeats 228 times>}
(gdb) p offset
$3 = 231
(gdb) p set
$5 = 7
(gdb) p gpio
$4 = 7
With my fix, I can boot the fby2 platform. The image I was using is here:
https://github.com/peterdelevoryas/openbmc/releases/tag/fby2.debug.mtd
Peter Delevoryas (1):
hw: aspeed_gpio: Fix GPIO array indexing
hw/gpio/aspeed_gpio.c | 72 ++++++++++++++---------------------
include/hw/gpio/aspeed_gpio.h | 5 +--
2 files changed, 31 insertions(+), 46 deletions(-)
--
2.30.2
