GPU pointer to the structure is shifted right by 10 bits, so we need to
align to 1024 bytes, not 256.
Reported-by: Maarten Maathuis <madman2003@gmail.com>
Signed-off-by: Ben Skeggs <bskeggs@redhat.com>
Currently, we take down the sgdma engine without evicting all buffers
from VRAM.
The TTM device release will try to evict anything in VRAM to GART
memory, but this will fail since sgdma has already been taken down.
This causes an infinite loop in kernel mode on module unload.
It usually doesn't happen because there aren't any buffer on close.
However, if the GPU is locked up, this condition is easily triggered.
This patch fixes it in the simplest way possible by cleaning VRAM
right before cleaning SGDMA memory.
Signed-off-by: Luca Barbieri <luca@luca-barbieri.com>
Signed-off-by: Francisco Jerez <currojerez@riseup.net>
Signed-off-by: Ben Skeggs <bskeggs@redhat.com>
Currently Nouveau is unable to dismiss DMA_VTX_PROTECTION errors,
which results in an infinite loop in the interrupt handler.
These errors are caused both by bugs in the Gallium driver and by
user-specified index buffers with out of bounds indices.
By mmio-tracing the nVidia drivers, I found out how this is done.
On DMA_VTX_PROTECTION, The nVidia driver reads the register 0x402000,
always getting the value 4, and then writes 4 back to 0x402000.
This patch adds that logic by reading 0x402000 and writing the same
value back.
It's unclear what should happen if the value read is not 4, and
the current approach might not be the correct one.
To test this, modify mesa/progs/trivial/vbo-drawrange.c, defining
ELTOBJ to 1 and replacing indices with huge out of bounds integers.
Without this patch, the GPU and/or kernel should lock up.
With this patch, it should misrender as expected but not lock up.
The errors are still logged since they are useful for development.
This has been tested on NV49 and may not work on other cards.
To find out how things work on other cards, run the aforementioned
test using the blob with mmiotrace and grep for a read of the PGRAPH
source register.
Signed-off-by: Luca Barbieri <luca@luca-barbieri.com>
Signed-off-by: Francisco Jerez <currojerez@riseup.net>
Signed-off-by: Ben Skeggs <bskeggs@redhat.com>
Can be triggered easily on certain cards (NV46 and NV50 of mine) by
running "dmesg", the DRM's channel will lockup.
Signed-off-by: Ben Skeggs <bskeggs@redhat.com>
X is accepting such video mode, do the same. Pointed out by Joshua Roys
on IRC. Fix https://bugzilla.redhat.com/show_bug.cgi?id=540024
[fix printf to use composite not integrated :- airlied]
Signed-off-by: Jerome Glisse <jglisse@redhat.com>
Signed-off-by: Dave Airlie <airlied@redhat.com>
* 'nouveau/for-airlied' of ../drm-nouveau-next: (44 commits)
drm/nouveau: check pushbuffer bounds in ioctl
drm/nouveau: reserve VGA area for the moment
drm/nouveau: Unset the EDID connector property when the EDID block goes away.
drm/nouveau: Fallback to analog load detection when the EDID block is invalid.
drm/nouveau: fix edid memleak in nouveau_connector
drm/nouveau: Break some long lines.
drm/nouveau: add NV18 device id to call_lvds_manufacturer_script
drm/nv50: Fix typo in PGRAPH initialisation.
drm/nouveau: less magic DCB 1.5 parsing
drm/nouveau: assume no nv04 board has a DCB table
drm/nouveau: remove PRIV0 check in nouveau_mem_close()
drm/nouveau: wait on fence after bo move if validating for another channel
drm/nouveau: trust init table registers are safe
drm/nv50: wait for pgraph to idle before unloading the context
Currently there is no check that the pushbuffer request bounds are inside
the TTM BO.
This allows to instruct the kernel to do relocations on user-selected
addresses, since the relocation bounds checking relies on the request
bounds.
This can oops the kernel accidentally and is easily exploitable.
This patch adds bound checking and alignment checking for ->offset and
->nr_dwords.
It also makes some variables unsigned, which should have no effect,
but prevents possible bounds checking problems.
Signed-off-by: Luca Barbieri <luca@luca-barbieri.com>
Signed-off-by: Ben Skeggs <bskeggs@redhat.com>
This is to prevent things such as GART tables and other important GPU
structures being allocated there before we take over fbcon ourselves.
This is more of a workaround for the moment, a better solution will
require some more invasive changes, but it'll be done at some point.
Signed-off-by: Ben Skeggs <bskeggs@redhat.com>
This was spotted by kmemleak.
Signed-off-by: Xavier Chantry <shiningxc@gmail.com>
Signed-off-by: Francisco Jerez <currojerez@riseup.net>
Signed-off-by: Ben Skeggs <bskeggs@redhat.com>
This fixes imac black screen (NV18 card)
Signed-off-by: Andrea Tacconi <tacconet@libero.it>
Signed-off-by: Francisco Jerez <currojerez@riseup.net>
Signed-off-by: Ben Skeggs <bskeggs@redhat.com>
This in the very least matches the parsing of all the previously known
entries, and hopefully (at least closer to) correct for any we haven't
seen yet.
Signed-off-by: Ben Skeggs <bskeggs@redhat.com>
There's a report of a TNT2 where the DCB table pointer is *not* NULL
(it contains a part of a VBIOS data string), and we assume this means
a DCB table is present, causing all kinds of hilarity.
Signed-off-by: Ben Skeggs <bskeggs@redhat.com>
Not an ideal solution, but it'll do for the moment for correctness. We
need to come up with a nicer way to manage inter-channel sync, the hw
is unfortunately a little lacking in this area.
Should fix some resume corruption, as well as corruption that may be seen
while under memory pressure.
Signed-off-by: Ben Skeggs <bskeggs@redhat.com>
Apparently the original reason for checking this was there were known
register accesses that caused hangs on some chipsets. This was more
than likely because of incorrect parsing of previous opcodes, and I
hardly think aborting a script half way through is going to be any
better (in fact, we have had bug reports where this has been the cause
of s/r failures among other things).
This patch (which has been in Fedora 12 for a long time now) removes
all checking for known register ranges, and just leaves the check to
ensure the access is within the mapped aperture to avoid an oops.
Signed-off-by: Ben Skeggs <bskeggs@redhat.com>
This should fix the problem with gpu hangs people have had when closing
channels.
Signed-off-by: Maarten Maathuis <madman2003@gmail.com>
Signed-off-by: Ben Skeggs <bskeggs@redhat.com>
This is a convention that the vmwgfx driver has come to rely on.
Signed-off-by: Thomas Hellstrom <thellstrom@vmware.com>
Signed-off-by: Dave Airlie <airlied@redhat.com>
Currently we really only support S3, since the device doesn't support
saving of the 3D state.
On S3/S4, move all buffer objects to swappable memory and take down
GMR bindings. We need to do that from a PM notifier since we can't
do persistant memory allocations from the standard PM callbacks.
Signed-off-by: Thomas Hellstrom <thellstrom@vmware.com>
Signed-off-by: Dave Airlie <airlied@redhat.com>
Unbind GMR bindings on the buffer about to be swapped out.
Signed-off-by: Thomas Hellstrom <thellstrom@vmware.com>
Signed-off-by: Dave Airlie <airlied@redhat.com>
This is needed for a bugfix in the vmwgfx driver.
Drivers may have GPU bindings on buffers that core TTM is not aware of,
and TTM may view those buffers as ordinary system memory buffers.
Add a notifier to such drivers when TTM is about to move the buffer
contents out to swappable memory. The driver must then release any
private GPU bindings on those buffers.
Signed-off-by: Thomas Hellstrom <thellstrom@vmware.com>
Signed-off-by: Dave Airlie <airlied@redhat.com>
This was previously done explicitly for overlay- and fb buffers.
Now it's done for any buffer leaving the SYSTEM memory region.
Signed-off-by: Thomas Hellstrom <thellstrom@vmware.com>
Signed-off-by: Dave Airlie <airlied@redhat.com>
A vt switch in stealth mode would take down the FIFO, and re-
initialize fence sequence numbers. This patch
saves the current state of the fence sequence when the FIFO is
disabled.
Signed-off-by: Thomas Hellstrom <thellstrom@vmware.com>
Signed-off-by: Dave Airlie <airlied@redhat.com>
An error happening before the snooper.image member had been set up
would cause a kfree of an arbitrary pointer. Set up the snooper.image
member early.
Signed-off-by: Thomas Hellstrom <thellstrom@vmware.com>
Signed-off-by: Dave Airlie <airlied@redhat.com>
That's unnecessary since partial screen updates from GMRs are fast.
Also fix cliprect pointer dereferencing
Signed-off-by: Thomas Hellstrom <thellstrom@vmware.com>
Signed-off-by: Dave Airlie <airlied@redhat.com>
Use same common function to disable agp so we replace the GART
callback by the proper one when we do so. This fix oops if
radeon_agp_init report failure.
This patch also move radeon_agp_init out of *_mc_init for r600
& rv770 so that we can have a similar behavior than for previous
hw, ie if agp_init fails it will fallback to GPU GART and disable
AGP.
Signed-off-by: Jerome Glisse <jglisse@redhat.com>
Signed-off-by: Dave Airlie <airlied@redhat.com>
radeon KMS need a GART of at least 32M to properly work. This patch
check the AGP aperture size and disable if it's less than 32M. Note
than unlike non KMS path we don't staticaly allocate AGP memory so
we are not wasting memory not used by graphic processing.
Signed-off-by: Jerome Glisse <jglisse@redhat.com>
Signed-off-by: Dave Airlie <airlied@redhat.com>
r600 blit cleanup path need to check if a bo was allocated before
trying to free or unpin it. This patch add this check and avoid
oops when the initialization on r6xx or r7xx hw fails.
Signed-off-by: Jerome Glisse <jglisse@redhat.com>
Signed-off-by: Dave Airlie <airlied@redhat.com>
It's not necessary to unpin buffer in fb destruction. pin/unpin
need to be balanced and we don't pin in fb creation. We pin when
an fb is associated to a crtc and unpin when the fb is disassociated
from the crtc.
Note:
Maybe we should take reference on fb in set_base callback so fb
doesn't disappear until it's unbind from ctrc.
Signed-off-by: Jerome Glisse <jglisse@redhat.com>
Signed-off-by: Dave Airlie <airlied@redhat.com>
It appears that attempting AUXCH DDC breaks the subsequent attempt
to do DDC over the i2c lines, so use the sink type to determine
if we should be doing AUXCH or i2c DDC.
This fixes my DVI monitor plugged into DP->DVI convertor.
Signed-off-by: Dave Airlie <airlied@redhat.com>
* korg/drm-radeon-next
drm/radeon/kms: only evict to GTT if CP is ready
drm/radeon/kms: Fix crash getting TV info with no BIOS.
drm/radeon/kms/rv100: reject modes > 135 Mhz on DVI (v2)
drm/radeon/kms/r6xx+: make irq handler less verbose
drm/radeon/kms: fix up LVDS handling on macs (v2)
Following drm info repeat 207 times during one hour, it's quite annoying
[ 1266.286747] [drm] TV-19: set mode NTSC 480i 0
Change from DRM_INFO to DRM_DEBUG
Signed-off-by: Dave Young <hidave.darkstar@gmail.com>
Signed-off-by: Dave Airlie <airlied@redhat.com>
Testing GTT ready might be more correct but cp.ready
works fine and has been tested on irc by 2-3 ppl.
fixes bug k.org 15035 and fd.o 25733
Signed-off-by: Dave Airlie <airlied@redhat.com>
Due to heat issues. Fixes fdo bug 25992
v2: fix typo noticed by Maarten Maathuis
Signed-off-by: Alex Deucher <alexdeucher@gmail.com>
Signed-off-by: Dave Airlie <airlied@redhat.com>
Unhandled vectors can be safely ignored, no need
to spam the kernel log by default.
Signed-off-by: Alex Deucher <alexdeucher@gmail.com>
Signed-off-by: Dave Airlie <airlied@redhat.com>
Based on radeonfb code and recent ddx fix.
v2: minor formatting fix from Michel Dänzer
Signed-off-by: Alex Deucher <alexdeucher@gmail.com>
Reviewed-by: Michel Dänzer <michel@daenzer.net>
Tested-by: Michel Dänzer <michel@daenzer.net>
Signed-off-by: Dave Airlie <airlied@redhat.com>
* 'for-airlied' of /ssd/git/drm-nouveau-next: (28 commits)
drm/nv04: Fix set_operation software method.
drm/nouveau: initialise DMA tracking parameters earlier
drm/nouveau: use dma.max rather than pushbuf size for checking GET validity
drm/nv04: differentiate between nv04/nv05
drm/nouveau: Fix null deref in nouveau_fence_emit due to deleted fence
drm/nv50: prevent a possible ctxprog hang
drm/nouveau: have ttm's fault handler called directly
drm/nv50: restore correct cache1 get/put address on fifoctx load
drm/nouveau: create function for "dealing" with gpu lockup
drm/nouveau: remove unused nouveau_channel_idle() function
drm/nouveau: fix handling of fbcon colours in 8bpp
drm/nv04: Context switching fixes.
drm/nouveau: Use the software object for fencing.
drm/nouveau: Allocate a per-channel instance of NV_SW.
drm/nv50: make the blocksize depend on vram size
drm/nouveau: better alignment of bo sizes and use roundup instead of ALIGN
drm/nouveau: Don't skip card take down on nv0x.
drm/nouveau: Implement nv42-nv43 TV load detection.
drm/nouveau: Clean up the nv17-nv4x load detection code a bit.
drm/nv50: fix fillrect color
...
* korg/drm-radeon-next:
drm/radeon/kms: add additional safe regs for r4xx/rs6xx and r5xx
drm/radeon/kms: Don't try to enable IRQ if we have no handler installed
drm: Avoid calling vblank function is vblank wasn't initialized
drm/radeon: mkregtable.c: close a file before exit
drm/radeon/kms: Make sure we release AGP device if we acquired it
drm/radeon/kms: Schedule host path read cache flush through the ring V2
drm/radeon/kms: Workaround RV410/R420 CP errata (V3)
drm/radeon/kms: detect sideport memory on IGP chips
drm/radeon: fix a couple of array index errors
drm/radeon/kms: add support for eDP (embedded DisplayPort)
drm: Add eDP connector type
drm/radeon/kms: pull in the latest upstream ObjectID.h changes
drm/radeon/kms: whitespace changes to ObjectID.h
drm/radeon/kms: fix typo in atom connector type handling
Some upcoming G80 DMA changes will depend on this, but it's split out for
bisectibility just in case it causes some unexpected issues.
Signed-off-by: Ben Skeggs <bskeggs@redhat.com>
Ben Skeggs
Luca Barbieri
Dave Airlie
Jerome Glisse
Francisco Jerez
Xavier Chantry
Andrea Tacconi
Marcin Kościelnicki
Maarten Maathuis
Thomas Hellstrom
Dave Young
Michel Dänzer
Alex Deucher