[Nouveau] [PATCH] drm/nouveau: release vga_ram allocation before tearing down mm's

[Daniel Vetter]

Otherwise we have a use-after free.

Tested-and-Reported-by: Bruno Prémont 
Signed-off-by: Daniel Vetter 
---
 drivers/gpu/drm/nouveau/nouveau_mem.c   |2 --
 drivers/gpu/drm/nouveau/nouveau_state.c |2 ++
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/drivers/gpu/drm/nouveau/nouveau_mem.c 
b/drivers/gpu/drm/nouveau/nouveau_mem.c
index 5045f8b..c3e953b 100644
--- a/drivers/gpu/drm/nouveau/nouveau_mem.c
+++ b/drivers/gpu/drm/nouveau/nouveau_mem.c
@@ -152,8 +152,6 @@ nouveau_mem_vram_fini(struct drm_device *dev)
 {
struct drm_nouveau_private *dev_priv = dev->dev_private;
 
-   nouveau_bo_ref(NULL, &dev_priv->vga_ram);
-
ttm_bo_device_release(&dev_priv->ttm.bdev);
 
nouveau_ttm_global_release(dev_priv);
diff --git a/drivers/gpu/drm/nouveau/nouveau_state.c 
b/drivers/gpu/drm/nouveau/nouveau_state.c
index a30adec..1fe6503 100644
--- a/drivers/gpu/drm/nouveau/nouveau_state.c
+++ b/drivers/gpu/drm/nouveau/nouveau_state.c
@@ -768,6 +768,8 @@ static void nouveau_card_takedown(struct drm_device *dev)
engine->mc.takedown(dev);
engine->display.late_takedown(dev);
 
+   nouveau_bo_ref(NULL, &dev_priv->vga_ram);
+
mutex_lock(&dev->struct_mutex);
ttm_bo_clean_mm(&dev_priv->ttm.bdev, TTM_PL_VRAM);
ttm_bo_clean_mm(&dev_priv->ttm.bdev, TTM_PL_TT);
-- 
1.7.5.1

___
Nouveau mailing list
Nouveau@lists.freedesktop.org
http://lists.freedesktop.org/mailman/listinfo/nouveau

[Nouveau] [Bug 35876] Hard GPU hang on nvidia

[bugzilla-daemon]

https://bugs.freedesktop.org/show_bug.cgi?id=35876

--- Comment #2 from Alexander Potashev  2011-05-07 
06:51:44 PDT ---
What version of Linux kernel do you use? I'm having the same problem with
vanilla kernel v2.6.39-rc6. But there were no problems with v2.6.37 (may be I
haven't tested it enough).

I think, this should be fixed in the kernel (more exactly, in the "nouveau"
kernel driver).

-- 
Configure bugmail: https://bugs.freedesktop.org/userprefs.cgi?tab=email
--- You are receiving this mail because: ---
You are the assignee for the bug.
___
Nouveau mailing list
Nouveau@lists.freedesktop.org
http://lists.freedesktop.org/mailman/listinfo/nouveau

Re: [Nouveau] 2.6.39-rc6, nouveau: unload trips on freed memory (SLUB poison)

[Bruno Prémont]

On Thu, 05 May 2011 Bruno Prémont  wrote:
> With 2.6.39-rc6 I'm hitting the following (relevant part from objdump of
> drm_mm.o at bottom).
> Some part of node passed to drm_mm_remove_node() is being use after free
> and hits SLUB poison.
> 
> Bruno
> 
> 
> [  328.447498] drm: unregistered panic notifier
> [  328.447648] [drm] nouveau :02:00.0: 0xAFD8: Parsing digital output 
> script table
> [  328.448642] [drm] nouveau :02:00.0: Restoring VGA fonts
> [  328.450949] [drm:drm_mm_takedown] *ERROR* Memory manager not clean. 
> Delaying takedown

Here is the trace to the erroring drm_mm_takedown() call:

[   95.486464] [drm:drm_mm_takedown] *ERROR* Memory manager not clean. Delaying 
takedown
[   95.486585] [ cut here ]
[   95.486640] kernel BUG at /usr/src/linux-2.6/drivers/gpu/drm/drm_mm.c:628!
[   95.486697] invalid opcode:  [#1] 
[   95.486805] last sysfs file: /sys/devices/platform/w83627hf.656/temp3_input
[   95.486862] Modules linked in: nouveau(-) fbcon tileblit font ttm bitblit 
softcursor drm_kms_helper drm fb fbdev i2c_algo_bit cfbcopyarea video cfbimgblt 
cfbfillrect nfs lockd nfs_acl sunrpc snd_intel8x0 snd_ac97_codec ac97_bus 
snd_pcm snd_timer snd snd_page_alloc pcspkr
[   95.488061] 
[   95.488121] Pid: 1714, comm: rmmod Tainted: GW   
2.6.39-rc6-jupiter-1-g443badf-dirty #13 NVIDIA Corporation. 
nFORCE-MCP/MS-6373
[   95.488306] EIP: 0060:[] EFLAGS: 00010292 CPU: 0
[   95.488397] EIP is at drm_mm_takedown+0x7c/0x80 [drm]
[   95.488451] EAX: 005f EBX: da148620 ECX: fed5 EDX: 
[   95.488508] ESI: da148620 EDI: 0090 EBP: dbc47e18 ESP: dbc47e04
[   95.488563]  DS: 007b ES: 007b FS:  GS: 00e0 SS: 0068
[   95.488631] Process rmmod (pid: 1714, ti=dbc46000 task=dd446470 
task.ti=dbc46000)
[   95.488693] Stack:
[   95.488740]  deb62a24 deb5c8ab da148620 da0001e8 0090 dbc47e28 dec5934b 
da000148
[   95.489099]  da0001d8 dbc47e44 dec550eb dbc47e44 def998cb da204820 da00 
da00
[   95.489469]  dbc47e64 def6dc51 deb5c280 da000148 da204830 da204820 dd5270c0 
dd5271d8
[   95.489839] Call Trace:
[   95.489907]  [] ttm_bo_man_takedown+0x2b/0x50 [ttm]
[   95.489968]  [] ttm_bo_clean_mm+0x5b/0xa0 [ttm]
[   95.490063]  [] ? nv10_fb_takedown+0x2b/0x50 [nouveau]
[   95.490130]  [] nouveau_unload+0xa1/0x150 [nouveau]
[   95.490198]  [] drm_put_dev+0xb3/0x1c0 [drm]
[   95.490263]  [] nouveau_pci_remove+0x10/0x20 [nouveau]
[   95.490325]  [] pci_device_remove+0x3f/0xf0
[   95.490384]  [] __device_release_driver+0x4b/0xa0
[   95.490424]  [] driver_detach+0x77/0x80
[   95.490424]  [] bus_remove_driver+0x5b/0xa0
[   95.490424]  [] driver_unregister+0x46/0x80
[   95.490424]  [] ? sysfs_remove_file+0xf/0x20
[   95.490424]  [] pci_unregister_driver+0x2a/0x70
[   95.490424]  [] drm_pci_exit+0x7f/0x90 [drm]
[   95.490424]  [] nouveau_exit+0x1b/0x22 [nouveau]
[   95.490424]  [] sys_delete_module+0x19b/0x1f0
[   95.490424]  [] ? do_munmap+0x212/0x2f0
[   95.490424]  [] sysenter_do_call+0x12/0x26
[   95.490424] Code: 75 d5 85 c9 75 0d 83 c4 08 5b 5e 5f c9 c3 8b 4e 30 eb ef 
0f 0b eb fe c7 44 24 04 ab c8 b5 de c7 04 24 24 2a b6 de e8 75 bc 81 e2 <0f> 0b 
eb fe 55 89 e5 56 53 8b 58 1c ff 4b 48 0f b6 50 10 f6 c2 
[   95.490424] EIP: [] drm_mm_takedown+0x7c/0x80 [drm] SS:ESP 
0068:dbc47e04
[   95.494410] ---[ end trace ea6b63472f535569 ]---



___
Nouveau mailing list
Nouveau@lists.freedesktop.org
http://lists.freedesktop.org/mailman/listinfo/nouveau

[Nouveau] Added the missing licence to nouveau_dri2.c. This time I've also used the correct author's name.

[Albert Pool]

Added the missing licence to nouveau_dri2.c (again). This time I've looked up 
the author in the git log.
---
 src/nouveau_dri2.c |   25 +
 1 files changed, 25 insertions(+), 0 deletions(-)

diff --git a/src/nouveau_dri2.c b/src/nouveau_dri2.c
index 1a68ed3..4178dbc 100644
--- a/src/nouveau_dri2.c
+++ b/src/nouveau_dri2.c
@@ -1,3 +1,28 @@
+/*
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining a
+ * copy of this software and associated documentation files (the "Software"),
+ * to deal in the Software without restriction, including without limitation
+ * the rights to use, copy, modify, merge, publish, distribute, sublicense,
+ * and/or sell copies of the Software, and to permit persons to whom the
+ * Software is furnished to do so, subject to the following conditions:
+ *
+ * The above copyright notice and this permission notice (including the next
+ * paragraph) shall be included in all copies or substantial portions of the
+ * Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+ * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.  IN NO EVENT SHALL
+ * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+ * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING 
FROM,
+ * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN 
THE
+ * SOFTWARE.
+ *
+ * Author:
+ *Ben Skeggs
+ *
+ */
 #include 
 #include 
 #include 
-- 
1.7.5


___
Nouveau mailing list
Nouveau@lists.freedesktop.org
http://lists.freedesktop.org/mailman/listinfo/nouveau

Re: [Nouveau] [PATCH 2/2] drm/nouveau/nv50: reclock memory using PMS on nv50

[Maxim Levitsky]

Just my 0.2 cent, here are PMS scripts executed by the blob (270.41.06)
with slightly better formatting (script attached)
This is trace from bare Xorg start on my NV86.


-- 
Best regards,
Maxim Levitsky

Visit my blog: http://maximlevitsky.wordpress.com
Warning: Above blog contains rants.
script1:

: e2 17 01 10 00 data 0x100117
0005: e0 0c a8 61 00 addr 0x61a80c
000a: 00 ???
000b: 40 0c a8   addr 0x61a80c
000e: 05 ??? [unknown: 05]
000f: e2 00 00 00 00 data 0
0014: 40 0c a8   addr 0x61a80c
0017: 7f exit


script2:

: e2 a7 00 10 00 data 0x1000a7
0005: e0 0c a0 61 00 addr 0x61a00c
000a: 00 ???
000b: 40 0c a0   addr 0x61a00c
000e: 05 ??? [unknown: 05]
000f: e2 00 00 00 00 data 0
0014: 40 0c a0   addr 0x61a00c
0017: 7f exit


script3:

: e2 00 33 00 00 data 0x3300
0005: e0 00 12 61 00 addr 0x611200
000a: 42 01 00   data 0x1
000d: e0 04 25 00 00 addr 0x2504
0012: 07 ??? [unknown: 07]
0013: b0 ??? [unknown: b0]
0014: 5f 00 01   unk5f [unknown: 00 00 01]
0017: e0 d4 02 10 00 addr 0x1002d4
001c: 40 d0 02   addr 0x1002d0
001f: 40 d0 02   addr 0x1002d0
0022: 42 00 00   data 0
0025: 40 10 02   addr 0x100210
0028: 42 01 00   data 0x1
002b: 40 dc 02   addr 0x1002dc
002e: 42 05 25   data 0x2505
0031: e0 0c 40 00 00 addr 0x400c
0036: e2 00 e4 59 80 data 0x8059e400
003b: 40 08 40   addr 0x4008
003e: 0d ??? [unknown: 0d]
003f: 0a ??? [unknown: 0a]
0040: 40 08 40   addr 0x4008
0043: e2 00 00 00 00 data 0
0048: e0 dc 02 10 00 addr 0x1002dc
004d: e2 00 00 00 80 data 0x8000
0052: 40 10 02   addr 0x100210
0055: 07 ??? [unknown: 07]
0056: e2 62 0a 00 00 data 0xa62
005b: 40 c0 02   addr 0x1002c0
005e: e2 04 09 01 0c data 0xc010904
0063: 40 24 02   addr 0x100224
0066: e2 18 2a 12 06 data 0x6122a18
006b: 40 20 02   addr 0x100220
006e: e2 62 0b 00 00 data 0xb62
0073: 40 c0 02   addr 0x1002c0
0076: 42 62 0a   data 0xa62
0079: 40 c0 02   addr 0x1002c0
007c: 0b ??? [unknown: 0b]
007d: d0 ??? [unknown: d0]
007e: 5f 00 00   unk5f
0081: 42 30 33   data 0x3330
0084: e0 00 12 61 00 addr 0x611200
0089: 7f exit
008a: 7f exit
008b: 7f exit


script4:
little bug here--

: 0a ??? [unknown: 0a]
0001: 7f exit
0002: e2 00 33 00 00 data 0x3300
0007: e0 00 12 61 00 addr 0x611200
000c: 42 01 00   data 0x1
000f: e0 04 25 00 00 addr 0x2504
0014: 07 ??? [unknown: 07]
0015: b0 ??? [unknown: b0]
0016: 5f 00 01   unk5f [unknown: 00 00 01]
0019: e0 d4 02 10 00 addr 0x1002d4
001e: 40 d0 02   addr 0x1002d0
0021: 40 d0 02   addr 0x1002d0
0024: 42 00 00   data 0
0027: 40 10 02   addr 0x100210
002a: 42 01 00   data 0x1
002d: 40 dc 02   addr 0x1002dc
0030: 42 05 25   data 0x2505
0033: e0 0c 40 00 00 addr 0x400c
0038: e2 00 e4 59 80 data 0x8059e400
003d: 40 08 40   addr 0x4008
0040: 0d ??? [unknown: 0d]
0041: 0a ??? [unknown: 0a]
0042: 40 08 40   addr 0x4008
0045: e2 00 00 00 00 data 0
004a: e0 dc 02 10 00 addr 0x1002dc
004f: e2 00 00 00 80 data 0x8000
0054: 40 10 02   addr 0x100210
0057: 07 ??? [unknown: 07]
0058: e2 62 0a 00 00 data 0xa62
005d: 40 c0 02   addr 0x1002c0
0060: e2 04 09 01 0c data 0xc010904
0065: 40 24 02   addr 0x100224
0068: e2 18 2a 12 06 data 0x6122a18
006d: 40 20 02   addr 0x100220
0070: e2 62 0b 00 00 data 0xb62
0075: 40 c0 02   addr 0x1002c0
0078: 42 62 0a   data 0xa62
007b: 40 c0 02   addr 0x1002c0
007e: 0b ??? [unknown: 0b]
007f: d0 ??? [unknown: d0]
0080: 5f 00 00   unk5f
0083: 42 30 33   data 0x3330
0086: e0 00 12 61 00 addr 0x611200
008b: 7f exit



script5:

: 0a ??? [unknown: 0a]
0001: 00 ???
0002: e2 00 ?? ?? ?? data 0 [incomplete]


script6:

: e2 00 33 00 00 data 0x3300
0005: e0 00 12 61 00 addr 0x611200
000a: 07