i915 driver fails on i686 userspace + x86_64 kernel

[Pavel Roskin]

On Tue, 15 Oct 2013 21:59:08 +0100
Chris Wilson <chris at chris-wilson.co.uk> wrote:

> Yikes, that implies we have a size mismatch with the kernel - ideally
> we construct the struct to have the same size when compiled with 32
> or 64 bits.
> 
> Please try:
> 
> commit a63b4d5a0766a7e98efeff8dd520c58e9a1bea88
> Author: Chris Wilson <chris at chris-wilson.co.uk>
> Date:   Tue Oct 15 21:53:16 2013 +0100
> 
>     sna: Expand packed KMS structs for 64-bit alignment

It helps.  Xorg starts.

However, I feel uneasy about that patch.  I tried to debug the problem,
and it looked not as a data corruption, but as something opposite.  The
kernel writes correct data to the userspace, but the userspace gets the
old value.

My theory is that the compat code incorrectly restores some data on the
stack that should not be restored.  It would happen to the value that
is the closest to the stack pointer.  gcc orders variables on the stack
on its own, so additional arrays would only protect the enc structure
only if gcc would place them below enc.

The attached patch makes ioctl calls with enc and the 4 members of the
encoderid array.  encoderid[0] keeps the original value of 0x12345678.
Other calls return the right value.  The kernel can be changed to show
the pointer address and read back the value with get_user.  The value
and the pointer address are correct.

I tried Linux 3.8.12 and it made no difference.  I also recompiled the
kernel and xf86-video-intel with gcc 4.4.7 (the Ubuntu default is
4.6.3), and it also made no difference.

It's hard to believe that there is a bug in the stack saving code that
went unnoticed for so long, but I cannot think of anything else that
would explain the results I'm observing.

If the compiler gets the size of a certain structure wrong, why would
the compat call restore any data on stack on return?

I have an impression that your patch complicates things too much
without addressing the actual problem.

-- 
Regards,
Pavel Roskin
-------------- next part --------------
A non-text attachment was scrubbed...
Name: 01-protect-array.patch
Type: text/x-patch
Size: 2056 bytes
Desc: not available
URL: <http://lists.freedesktop.org/archives/dri-devel/attachments/20131015/6f7d6a3b/attachment.bin>