[Intel-gfx] i915_chipset_val()

[Konstantin Belousov]

i915_chipset_val saves the jiffies count of the invocation in last_time1.
Then, on the next call, the diff between current jiffies value and
last_time1 is used as divisor.

I have a suspicious that two rapid calls to i915_chipset_val() may result
in division by zero. This looks as user-controllable action, since
debugfs, if configured, would export i915_chipset_val() as emon status.

I did not tested the Linux, but in the (ported) code I am able to get
into the described situation. As a workaround, I cached the previous
return value from i915_chipset_val() and return it instead of doing
the calculation if consequtive calls are close enough.

What do you think ? (patch is not directly applicable to Linux).

diff --git a/sys/dev/drm/i915_dma.c b/sys/dev/drm/i915_dma.c
index a22643f..773a171 100644
--- a/sys/dev/drm/i915_dma.c
+++ b/sys/dev/drm/i915_dma.c
@@ -1588,9 +1588,14 @@ unsigned long i915_chipset_val(struct drm_i915_private *dev_priv)
 	int i;
 
 	diff1 = now - dev_priv->last_time1;
+	/*
+	 * sysctl(8) reads the value of sysctl twice in rapid
+	 * succession.  There is high chance that it happens in the
+	 * same timer tick.  Use the cached value to not divide by
+	 * zero.
+	 */
+	if (diff1 == 0)
+		return (dev_priv->last_chipset_val);
 
 	count1 = I915_READ(DMIEC);
 	count2 = I915_READ(DDREC);
@@ -1622,7 +1627,8 @@ unsigned long i915_chipset_val(struct drm_i915_private *dev_priv)
 	dev_priv->last_count1 = total_count;
 	dev_priv->last_time1 = now;
 
-	return ret;
+	dev_priv->last_chipset_val = ret;
+	return (ret);
 }
 
 unsigned long i915_mch_val(struct drm_i915_private *dev_priv)
diff --git a/sys/dev/drm/i915_drv.h b/sys/dev/drm/i915_drv.h
index 5e6340b..36d066a 100644
--- a/sys/dev/drm/i915_drv.h
+++ b/sys/dev/drm/i915_drv.h
@@ -579,6 +579,7 @@ typedef struct drm_i915_private {
 
 	u64 last_count1;
 	unsigned long last_time1;
+	unsigned long last_chipset_val;
 	u64 last_count2;
 	struct timespec last_time2;
 	unsigned long gfx_power;
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 196 bytes
Desc: not available
URL: <http://lists.freedesktop.org/archives/intel-gfx/attachments/20110708/fb618704/attachment.sig>