Commit Graph

1406 Commits

Author SHA1 Message Date
Marcin Slusarz
761c5a6975 drm/nouveau: fix i2ctable bounds checking
i2c_entries seems to be the number of i2c entries,
so with index equal to this number, we could read
invalid data from i2ctable. Fix it.

Signed-off-by: Marcin Slusarz <marcin.slusarz@gmail.com>
Signed-off-by: Francisco Jerez <currojerez@riseup.net>
Signed-off-by: Ben Skeggs <bskeggs@redhat.com>
2010-02-25 15:09:11 +10:00
Marcin Slusarz
b762b8ce53 drm/nouveau: fix nouveau_i2c_find bounds checking
Reported-by: Dan Carpenter <error27@gmail.com>
Signed-off-by: Marcin Slusarz <marcin.slusarz@gmail.com>
Signed-off-by: Francisco Jerez <currojerez@riseup.net>
Signed-off-by: Ben Skeggs <bskeggs@redhat.com>
2010-02-25 15:09:09 +10:00
Marcin Slusarz
df31ef4dbd drm/nouveau: fix pramdac_table range checking
get_tmds_index_reg reads some value from stack when mlv happens
to be equal to size of pramdac_table array. Fix it.

Reported-by: Dan Carpenter <error27@gmail.com>
Signed-off-by: Marcin Slusarz <marcin.slusarz@gmail.com>
Signed-off-by: Francisco Jerez <currojerez@riseup.net>
Signed-off-by: Ben Skeggs <bskeggs@redhat.com>
2010-02-25 15:09:07 +10:00
Ben Skeggs
a1606a9596 drm/nouveau: new gem pushbuf interface, bump to 0.0.16
This commit breaks the userspace interface, and requires a new libdrm for
nouveau to operate again.

The multiple GEM_PUSHBUF ioctls that were present in 0.0.15 for
compatibility purposes are now gone, and replaced with the new ioctl which
allows for multiple push buffers to be submitted (necessary for hw index
buffers in the nv50 3d driver) and relocations to be applied on any buffer.

A number of other ioctls (CARD_INIT, GEM_PIN, GEM_UNPIN) that were needed
for userspace modesetting have also been removed.

Signed-off-by: Ben Skeggs <bskeggs@redhat.com>
Signed-off-by: Francisco Jerez <currojerez@riseup.net>
2010-02-25 15:08:44 +10:00
Ben Skeggs
d87897d4c8 drm/nv50: make pushbuf dma object cover entire vm
This allows us to submit push buffers from any memtype to the hardware.
We'll need this ability for VRAM index buffers at some point.

Signed-off-by: Ben Skeggs <bskeggs@redhat.com>
2010-02-25 15:08:33 +10:00
Ben Skeggs
2ccb04ecc7 drm/nouveau: remove PUSHBUF_CAL macro
Signed-off-by: Ben Skeggs <bskeggs@redhat.com>
2010-02-25 15:08:31 +10:00
Ben Skeggs
9a391ad8a2 drm/nv50: switch to indirect push buffer controls
PFIFO on G80 and up has a new mode where the main ring buffer is simply a
ring of pointers to indirect buffers containing the actual command/data
packets.  In order to be able to implement index buffers in the 3D driver
we need to be able to submit data-only push buffers right after the cmd
packet header, which is only possible using the new command submission
method.

This commit doesn't make it possible to implement index buffers yet, some
userspace interface changes will be required, but it does allow for
testing/debugging of the hardware-side support in the meantime.

Signed-off-by: Ben Skeggs <bskeggs@redhat.com>
2010-02-25 15:08:29 +10:00
Maarten Maathuis
ff9e5279b1 drm/nouveau: protect channel create/destroy and irq handler with a spinlock
The nv50 pgraph handler (for example) could reenable pgraph fifo access
and that would be bad when pgraph context is being unloaded (we need the
guarantee a ctxprog isn't running).

Signed-off-by: Maarten Maathuis <madman2003@gmail.com>
Signed-off-by: Ben Skeggs <bskeggs@redhat.com>
2010-02-25 15:07:53 +10:00
Ben Skeggs
6c42966768 drm/nv50: fix vram ptes on IGPs to point at stolen system memory
Signed-off-by: Ben Skeggs <bskeggs@redhat.com>
2010-02-23 13:50:24 +10:00
Ben Skeggs
76befb8c30 drm/nv50: fix instmem binding on IGPs to point at stolen system memory
This also modifies the unused PRAMIN PT entries to be all zeroes, can't
really recall why I used 9/0 initially, just that it didn't work for
some reason.  It was likely masking a bug elsewhere that's since been
fixed.

Signed-off-by: Ben Skeggs <bskeggs@redhat.com>
2010-02-23 13:50:21 +10:00
Ben Skeggs
531e77139f drm/nv50: improve vram page table construction
This commit changes nouveau to construct PTEs which look very much like
the ones the binary driver creates.

I presume that filling multiple PTEs identically with length flags and
the physical address of the start of a block of VRAM is a hint to the
memory controller that it need not perform additional page table lookups
for that range of addresses.

Signed-off-by: Ben Skeggs <bskeggs@redhat.com>
2010-02-23 13:50:03 +10:00
Ben Skeggs
4c27bd339d drm/nv50: more efficient clearing of gpu page table entries
Signed-off-by: Ben Skeggs <bskeggs@redhat.com>
2010-02-23 13:49:58 +10:00
Ben Skeggs
66b6ebaccb drm/nv50: make nv50_mem_vm_{bind,unbind} operate only on vram
GART is handled elsewhere, no reason to have the code for it here too.

Signed-off-by: Ben Skeggs <bskeggs@redhat.com>
2010-02-23 13:41:16 +10:00
Francisco Jerez
e7e65caefd drm/nouveau: Fix up pre-nv17 analog load detection.
Signed-off-by: Francisco Jerez <currojerez@riseup.net>
Signed-off-by: Ben Skeggs <bskeggs@redhat.com>
2010-02-23 13:41:05 +10:00
Francisco Jerez
bf929efa56 drm/nouveau: Force TV encoder DPMS reinit after resume.
Signed-off-by: Francisco Jerez <currojerez@riseup.net>
Signed-off-by: Ben Skeggs <bskeggs@redhat.com>
2010-02-16 11:15:07 +10:00
Ben Skeggs
d9184fa97b drm/nouveau: use mutex for vbios lock
Signed-off-by: Ben Skeggs <bskeggs@redhat.com>
2010-02-16 11:14:33 +10:00
Matthew Garrett
13876c6e5f nouveau: fix state detection with switchable graphics
Signed-off-by: Matthew Garrett <mjg@redhat.com>
Signed-off-by: Ben Skeggs <bskeggs@redhat.com>
2010-02-11 09:52:02 +10:00
Marcin Slusarz
dd19e44b28 drm/nouveau: move dereferences after null checks
Reported-by: Dan Carpenter <error27@gmail.com>
Signed-off-by: Marcin Slusarz <marcin.slusarz@gmail.com>
Signed-off-by: Maarten Maathuis <madman2003@gmail.com>
Signed-off-by: Ben Skeggs <bskeggs@redhat.com>
2010-02-11 09:52:00 +10:00
Maarten Maathuis
b1d37aa0aa drm/nv50: make the pgraph irq handler loop like the pre-nv50 version
Unset the bit that indicates that a ctxprog can continue at the end.

Signed-off-by: Maarten Maathuis <madman2003@gmail.com>
Signed-off-by: Ben Skeggs <bskeggs@redhat.com>
2010-02-10 08:19:39 +10:00
Maarten Maathuis
a87ff62a80 drm/nv50: delete ramfc object after disabling fifo, not before
ramfc is zero'ed upon destruction, so it's safer to do things in the right
order.

Signed-off-by: Maarten Maathuis <madman2003@gmail.com>
Signed-off-by: Ben Skeggs <bskeggs@redhat.com>
2010-02-10 08:19:38 +10:00
Maarten Maathuis
a51a3bf50d drm/nv50: avoid unloading pgraph context when ctxprog is running
- We need to disable pgraph fifo access before checking the current channel,
  otherwise we could still hit a running ctxprog.
- The writes to 0x400500 are already handled by pgraph->fifo_access and are
  therefore redundant, moreover pgraph fifo access should not be reenabled
  before current context is set as invalid. So remove them altogether.

Signed-off-by: Maarten Maathuis <madman2003@gmail.com>
Signed-off-by: Ben Skeggs <bskeggs@redhat.com>
2010-02-10 08:19:36 +10:00
Maarten Maathuis
eb1dba0eba drm/nv50: align size of buffer object to the right boundaries.
- In the current situation the padding that is added is dangerous to write
  to, userspace could potentially overwrite parts of another bo.
- Depth and stencil buffers are supposed to be large enough in general so
  the waste of memory should be acceptable.
- Alternatives are hiding the padding from users or splitting vram into 2
  zones.

Signed-off-by: Maarten Maathuis <madman2003@gmail.com>
Signed-off-by: Ben Skeggs <bskeggs@redhat.com>
2010-02-10 08:19:34 +10:00
Ben Skeggs
5025b43120 drm/nv50: disregard dac outputs in nv50_sor_dpms()
Fixes DVI+VGA on my 9400, and likely a lot of other configurations that
got broken by the previos DVI-over-DP fix.

Signed-off-by: Ben Skeggs <bskeggs@redhat.com>
2010-02-10 08:19:33 +10:00
Ben Skeggs
39c9bfb453 drm/nv50: prevent multiple init tables being parsed at the same time
With DVI and DP plugged, the DVI clock change interrupts being run can
cause DP link training to fail.  This adds a spinlock around init table
parsing to prevent this.

Signed-off-by: Ben Skeggs <bskeggs@redhat.com>
2010-02-10 08:19:18 +10:00
Ben Skeggs
1ee7698fc3 drm/nouveau: make dp auxch xfer len check for reads only
Writes don't return a count, and adding the check broke native DP.

Signed-off-by: Ben Skeggs <bskeggs@redhat.com>
2010-02-09 12:50:43 +10:00
Ben Skeggs
e235c1f3e1 drm/nv40: make INIT_COMPUTE_MEM a NOP, just like nv50
It appears we aren't required to do memory sizing ourselves on nv40
either.  NV40 init tables read a strap from PEXTDEV_BOOT_0 into a
CRTC register, and then later use that value to select a memory
configuration (written to PFB_CFG0, just like INIT_COMPUTE_MEM on
earlier cards) with INIT_IO_RESTRICT_PROG.

Signed-off-by: Ben Skeggs <bskeggs@redhat.com>
2010-02-09 12:50:35 +10:00
Marcin Kościelnicki
9967b9481d drm/nouveau: Add proper vgaarb support.
Signed-off-by: Marcin Kościelnicki <koriakin@0x04.net>
Signed-off-by: Ben Skeggs <bskeggs@redhat.com>
2010-02-09 12:50:27 +10:00
Marcin Kościelnicki
126b544056 drm/nouveau: Fix fbcon on mixed pre-NV50 + NV50 multicard.
We used single shared fbops struct and patched it at fb init time with
pointers to the right variant. On mixed multicard, this meant that
it was either sending NV50-style commands to all cards, or NV04-style
commands to all cards.

Signed-off-by: Marcin Kościelnicki <koriakin@0x04.net>
Signed-off-by: Ben Skeggs <bskeggs@redhat.com>
2010-02-09 12:50:14 +10:00
Julia Lawall
7dad9ef6d9 drivers/gpu/drm/nouveau/nouveau_grctx.c: correct NULL test
Test the just-allocated value for NULL rather than some other value.

The semantic patch that makes this change is as follows:
(http://coccinelle.lip6.fr/)

// <smpl>
@@
expression x,y;
statement S;
@@

x = \(kmalloc\|kcalloc\|kzalloc\)(...);
(
if ((x) == NULL) S
|
if (
-   y
+   x
       == NULL)
 S
)
// </smpl>

Signed-off-by: Julia Lawall <julia@diku.dk>
Cc: David Airlie <airlied@linux.ie>
Cc: Ben Skeggs <bskeggs@redhat.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Ben Skeggs <bskeggs@redhat.com>
2010-02-09 12:49:55 +10:00
Luca Barbieri
f0fbe3eb5f drm/nouveau: call ttm_bo_wait with the bo lock held to prevent hang
nouveau_gem_ioctl_cpu_prep calls ttm_bo_wait without the bo lock held.
ttm_bo_wait unlocks that lock, and so must be called with it held.

Currently this bug causes libdrm nouveau_bo_busy() to hang the machine.

Signed-off-by: Luca Barbieri <luca at luca-barbieri.com>
Acked-by: Maarten Maathuis <madman2003@gmail.com>
Signed-off-by: Francisco Jerez <currojerez@riseup.net>
Signed-off-by: Ben Skeggs <bskeggs@redhat.com>
2010-02-09 12:49:09 +10:00
Francisco Jerez
139295b671 drm/nouveau: Fixup semaphores on pre-nv50 cards.
Apparently, they generate a PFIFO interrupt each time one of the
semaphore methods is executed if its ctxdma wasn't manually marked as
valid. This patch makes it flip the valid bit in response to the
DMA_SEMAPHORE method (which triggers the IRQ even for a valid ctxdma).

Signed-off-by: Francisco Jerez <currojerez@riseup.net>
Signed-off-by: Ben Skeggs <bskeggs@redhat.com>
2010-02-09 12:48:56 +10:00
Marcin Kościelnicki
69c9700b54 drm/nouveau: Add getparam to get available PGRAPH units.
On nv50, this will be needed by applications using CUDA to know
how much stack/local memory to allocate.

Signed-off-by: Marcin Kościelnicki <koriakin@0x04.net>
Signed-off-by: Ben Skeggs <bskeggs@redhat.com>
2010-02-09 12:48:08 +10:00
Marcin Kościelnicki
a32ed69d7b drm/nouveau: Add module options to disable acceleration.
noaccel=1 disables all acceleration and doesn't even attempt
initialising PGRAPH+PFIFO, nofbaccel=1 only makes fbcon unaccelerated.

Signed-off-by: Marcin Kościelnicki <koriakin@0x04.net>
Signed-off-by: Ben Skeggs <bskeggs@redhat.com>
2010-02-09 12:47:59 +10:00
Ben Skeggs
f927b8907c drm/nouveau: fix non-vram notifier blocks
Due to a thinko, these were previously forced to VRAM even if we allocated
them in GART.

This commit fixes that bug, but keeps the previous behaviour of using VRAM
by default until it's been tested properly across more chipsets.

Signed-off-by: Ben Skeggs <bskeggs@redhat.com>
2010-02-09 12:47:52 +10:00
Ben Skeggs
162265367a drm/nv50: prevent switching off SOR when in use for DVI-over-DP
Another hack because of us exposing each encoder block's function as
an encoder rather than exposing a single encoder that deals with them
all.

A proper fix will come, it's just rather invasive so this hack will
do until then.

Signed-off-by: Ben Skeggs <bskeggs@redhat.com>
2010-01-25 10:35:33 +10:00
Ben Skeggs
0107bae01a drm/nv50: fail auxch transaction if reply count not what we expect
Signed-off-by: Ben Skeggs <bskeggs@redhat.com>
2010-01-25 10:35:25 +10:00
Ben Skeggs
0208843dd5 drm/nouveau: fix failure path if userspace specifies no valid memtypes
We need to add the buffer to the list even if we fail, otherwise the
validate_fini() call won't unreserve + unreference the GEM object,
making TTM very unhappy.

Signed-off-by: Ben Skeggs <bskeggs@redhat.com>
2010-01-25 10:35:19 +10:00
Ben Skeggs
a1470890f2 drm/nouveau: report LVDS as disconnected if lid closed
Also adds a module option to ignore the status reported via ACPI, in case
we hit systems with broken ACPI.

Signed-off-by: Ben Skeggs <bskeggs@redhat.com>
2010-01-25 10:35:13 +10:00
Ben Skeggs
58d65b84de drm/nv50: prevent accidently turning off encoders we're actually using
On most cards the DisplayPort connector is created with 2 encoders sharing
a single SOR (for native DP, and for DVI-over-DP).  The previous logic
for turning off unused encoders didn't take into account that we could
have multiple drm_encoders on a single hw encoder and ended up turning off
encoders that were actually being used still.

This patch fixes that issue.  We probably want to look at something a bit
better later on, and only expose one drm_encoder per hw encoder block.

Signed-off-by: Ben Skeggs <bskeggs@redhat.com>
2010-01-18 09:56:27 +10:00
Ben Skeggs
134f248bea drm/nv50: fix alignment of per-channel fifo cache
GPU pointer to the structure is shifted right by 10 bits, so we need to
align to 1024 bytes, not 256.

Reported-by: Maarten Maathuis <madman2003@gmail.com>
Signed-off-by: Ben Skeggs <bskeggs@redhat.com>
2010-01-18 09:56:19 +10:00
Luca Barbieri
7166647501 drm/nouveau: Evict buffers in VRAM before freeing sgdma
Currently, we take down the sgdma engine without evicting all buffers
from VRAM.

The TTM device release will try to evict anything in VRAM to GART
memory, but this will fail since sgdma has already been taken down.

This causes an infinite loop in kernel mode on module unload.
It usually doesn't happen because there aren't any buffer on close.
However, if the GPU is locked up, this condition is easily triggered.

This patch fixes it in the simplest way possible by cleaning VRAM
right before cleaning SGDMA memory.

Signed-off-by: Luca Barbieri <luca@luca-barbieri.com>
Signed-off-by: Francisco Jerez <currojerez@riseup.net>
Signed-off-by: Ben Skeggs <bskeggs@redhat.com>
2010-01-18 09:56:13 +10:00
Luca Barbieri
d051bbb22e drm/nouveau: Acknowledge DMA_VTX_PROTECTION PGRAPH interrupts
Currently Nouveau is unable to dismiss DMA_VTX_PROTECTION errors,
which results in an infinite loop in the interrupt handler.

These errors are caused both by bugs in the Gallium driver and by
user-specified index buffers with out of bounds indices.

By mmio-tracing the nVidia drivers, I found out how this is done.
On DMA_VTX_PROTECTION, The nVidia driver reads the register 0x402000,
always getting the value 4, and then writes 4 back to 0x402000.

This patch adds that logic by reading 0x402000 and writing the same
value back.
It's unclear what should happen if the value read is not 4, and
the current approach might not be the correct one.

To test this, modify mesa/progs/trivial/vbo-drawrange.c, defining
ELTOBJ to 1 and replacing indices with huge out of bounds integers.

Without this patch, the GPU and/or kernel should lock up.
With this patch, it should misrender as expected but not lock up.

The errors are still logged since they are useful for development.

This has been tested on NV49 and may not work on other cards.

To find out how things work on other cards, run the aforementioned
test using the blob with mmiotrace and grep for a read of the PGRAPH
source register.

Signed-off-by: Luca Barbieri <luca@luca-barbieri.com>
Signed-off-by: Francisco Jerez <currojerez@riseup.net>
Signed-off-by: Ben Skeggs <bskeggs@redhat.com>
2010-01-18 09:56:03 +10:00
Ben Skeggs
0d92971dd6 drm/nouveau: fix thinko in nv04_instmem.c
Signed-off-by: Ben Skeggs <bskeggs@redhat.com>
2010-01-18 09:55:54 +10:00
Ben Skeggs
ba59953d28 drm/nouveau: fix a race condition in nouveau_dma_wait()
Can be triggered easily on certain cards (NV46 and NV50 of mine) by
running "dmesg", the DRM's channel will lockup.

Signed-off-by: Ben Skeggs <bskeggs@redhat.com>
2010-01-18 09:55:48 +10:00
Luca Barbieri
12f735b79f drm/nouveau: check pushbuffer bounds in ioctl
Currently there is no check that the pushbuffer request bounds are inside
the TTM BO.

This allows to instruct the kernel to do relocations on user-selected
addresses, since the relocation bounds checking relies on the request
bounds.

This can oops the kernel accidentally and is easily exploitable.

This patch adds bound checking and alignment checking for ->offset and
->nr_dwords.

It also makes some variables unsigned, which should have no effect,
but prevents possible bounds checking problems.

Signed-off-by: Luca Barbieri <luca@luca-barbieri.com>
Signed-off-by: Ben Skeggs <bskeggs@redhat.com>
2010-01-15 09:56:50 +10:00
Ben Skeggs
ac8fb975e8 drm/nouveau: reserve VGA area for the moment
This is to prevent things such as GART tables and other important GPU
structures being allocated there before we take over fbcon ourselves.

This is more of a workaround for the moment, a better solution will
require some more invasive changes, but it'll be done at some point.

Signed-off-by: Ben Skeggs <bskeggs@redhat.com>
2010-01-15 09:29:38 +10:00
Francisco Jerez
b8780e2ad2 drm/nouveau: Unset the EDID connector property when the EDID block goes away.
Signed-off-by: Francisco Jerez <currojerez@riseup.net>
Signed-off-by: Ben Skeggs <bskeggs@redhat.com>
2010-01-15 09:29:35 +10:00
Francisco Jerez
0ed3165e55 drm/nouveau: Fallback to analog load detection when the EDID block is invalid.
Signed-off-by: Francisco Jerez <currojerez@riseup.net>
Signed-off-by: Ben Skeggs <bskeggs@redhat.com>
2010-01-15 09:28:59 +10:00
Xavier Chantry
c8ebe27579 drm/nouveau: fix edid memleak in nouveau_connector
This was spotted by kmemleak.

Signed-off-by: Xavier Chantry <shiningxc@gmail.com>
Signed-off-by: Francisco Jerez <currojerez@riseup.net>
Signed-off-by: Ben Skeggs <bskeggs@redhat.com>
2010-01-15 09:28:48 +10:00
Francisco Jerez
3d9aefb8bd drm/nouveau: Break some long lines.
Signed-off-by: Francisco Jerez <currojerez@riseup.net>
Signed-off-by: Ben Skeggs <bskeggs@redhat.com>
2010-01-15 09:28:10 +10:00