Can be triggered easily on certain cards (NV46 and NV50 of mine) by
running "dmesg", the DRM's channel will lockup.
Signed-off-by: Ben Skeggs <bskeggs@redhat.com>
Currently there is no check that the pushbuffer request bounds are inside
the TTM BO.
This allows to instruct the kernel to do relocations on user-selected
addresses, since the relocation bounds checking relies on the request
bounds.
This can oops the kernel accidentally and is easily exploitable.
This patch adds bound checking and alignment checking for ->offset and
->nr_dwords.
It also makes some variables unsigned, which should have no effect,
but prevents possible bounds checking problems.
Signed-off-by: Luca Barbieri <luca@luca-barbieri.com>
Signed-off-by: Ben Skeggs <bskeggs@redhat.com>
This is to prevent things such as GART tables and other important GPU
structures being allocated there before we take over fbcon ourselves.
This is more of a workaround for the moment, a better solution will
require some more invasive changes, but it'll be done at some point.
Signed-off-by: Ben Skeggs <bskeggs@redhat.com>
This was spotted by kmemleak.
Signed-off-by: Xavier Chantry <shiningxc@gmail.com>
Signed-off-by: Francisco Jerez <currojerez@riseup.net>
Signed-off-by: Ben Skeggs <bskeggs@redhat.com>
This fixes imac black screen (NV18 card)
Signed-off-by: Andrea Tacconi <tacconet@libero.it>
Signed-off-by: Francisco Jerez <currojerez@riseup.net>
Signed-off-by: Ben Skeggs <bskeggs@redhat.com>
This in the very least matches the parsing of all the previously known
entries, and hopefully (at least closer to) correct for any we haven't
seen yet.
Signed-off-by: Ben Skeggs <bskeggs@redhat.com>
There's a report of a TNT2 where the DCB table pointer is *not* NULL
(it contains a part of a VBIOS data string), and we assume this means
a DCB table is present, causing all kinds of hilarity.
Signed-off-by: Ben Skeggs <bskeggs@redhat.com>
Not an ideal solution, but it'll do for the moment for correctness. We
need to come up with a nicer way to manage inter-channel sync, the hw
is unfortunately a little lacking in this area.
Should fix some resume corruption, as well as corruption that may be seen
while under memory pressure.
Signed-off-by: Ben Skeggs <bskeggs@redhat.com>
Apparently the original reason for checking this was there were known
register accesses that caused hangs on some chipsets. This was more
than likely because of incorrect parsing of previous opcodes, and I
hardly think aborting a script half way through is going to be any
better (in fact, we have had bug reports where this has been the cause
of s/r failures among other things).
This patch (which has been in Fedora 12 for a long time now) removes
all checking for known register ranges, and just leaves the check to
ensure the access is within the mapped aperture to avoid an oops.
Signed-off-by: Ben Skeggs <bskeggs@redhat.com>
This should fix the problem with gpu hangs people have had when closing
channels.
Signed-off-by: Maarten Maathuis <madman2003@gmail.com>
Signed-off-by: Ben Skeggs <bskeggs@redhat.com>
Some upcoming G80 DMA changes will depend on this, but it's split out for
bisectibility just in case it causes some unexpected issues.
Signed-off-by: Ben Skeggs <bskeggs@redhat.com>
Currently Nouveau will unvalidate all buffers if it is forced to wait on
one, and then start revalidating from the beginning. While doing so, it
destroys the operation fence, causing nouveau_fence_emit to crash.
This patch fixes this bug by taking the fence object out of validate_op
and creating it just before emit. The fence pointer is initialized to 0
and unref'ed unconditionally.
In addition to fixing the bug, this prevents its reintroduction and
simplifies the code.
Signed-off-by: Luca Barbieri <luca@luca-barbieri.com>
Signed-off-by: Ben Skeggs <bskeggs@redhat.com>
The below is mainly an educated guess at what's going on, docs would
sure be handy... NVIDIA? :P
It appears it's possible for a ctxprog to run even while a GPU exception
is pending. The GF8 and up ctxprogs appear to have a small snippet of
code which detects this, and stalls the ctxprog until it's been handled,
which essentially looks like:
if (r2 & 0x00008000) {
r0 |= 0x80000000;
while (r0 & 0x80000000) {}
}
I don't know of any way that flag would get cleared unless the driver
intervenes (and indeed, in the cases I've seen the hang, nothing steps
in to automagically clear it for us). This patch causes the driver to
clear the flag during the PGRAPH IRQ handler.
Signed-off-by: Ben Skeggs <bskeggs@redhat.com>
There's no good reason for us to have our own anymore, this is left over
from an early port to these TTM interfaces.
Signed-off-by: Ben Skeggs <bskeggs@redhat.com>
It's mostly a cleanup, but in nv50_fbcon_accel_init gpu lockup
message was printed, but HWACCEL_DISBALED flag was not set.
Signed-off-by: Marcin Slusarz <marcin.slusarz@gmail.com>
Signed-off-by: Ben Skeggs <bskeggs@redhat.com>
Depending on the visual, the colours handed to us in fillrect() can either be
an actual colour, or an index into the pseudo-palette.
Signed-off-by: Ben Skeggs <bskeggs@redhat.com>
This should avoid a race condition on nv0x, if we're doing it with
actual PGRAPH objects and a there's a fence within the FIFO DMA fetch
area when a context switch kicks in.
In that case we get an ILLEGAL_MTHD interrupt as expected, but the
values in PGRAPH_TRAPPED_ADDR aren't calculated correctly and they're
almost useless (e.g. you can see ILLEGAL_MTHDs for the now inactive
channel, with a wrong offset/data pair).
Signed-off-by: Francisco Jerez <currojerez@riseup.net>
It will be useful for various synchronization purposes, mostly stolen
from "[PATCH] drm/nv50: synchronize user channel after buffer object
move on kernel channel" by Maarten Maathuis.
Signed-off-by: Francisco Jerez <currojerez@riseup.net>
- Aligning to block size should ensure that the extra size is enough.
- Using roundup, because not all sizes are powers of two.
Signed-off-by: Maarten Maathuis <madman2003@gmail.com>
struct fb_fillrect->color is not a color, but index into pseudo_palette
array
Signed-off-by: Marcin Slusarz <marcin.slusarz@gmail.com>
Signed-off-by: Ben Skeggs <bskeggs@redhat.com>
This partially reverts e4b41066, as this driver is intended to be
useful with any KMS driver for suitable hardware. The missing build
dependency that commit workarounded was DRM_KMS_HELPER.
Signed-off-by: Francisco Jerez <currojerez@riseup.net>
This commit has also the following 3 bugfix commits squashed into it from
the nouveau git tree:
drm/nouveau: Fix up the tiling alignment restrictions for nv1x.
drm/nouveau: Fix up the nv2x tiling alignment restrictions.
drm/nv50: fix align typo for g9x
Signed-off-by: Francisco Jerez <currojerez@riseup.net>
* nouveau/for-airlied:
drm/nouveau: fix bug causing pinned buffers to lose their NO_EVICT flag
drm/nv50: fix suspend/resume delays without firmware present
drm/nouveau: prevent all channel creation if accel not available
drm/nv50: fix two potential suspend/resume oopses
drm/nv40: implement ctxprog/state generation
drm/nv10: Add the initial graph context and soft methods needed for LMA.
drm/nouveau: Fix up buffer eviction, and evict them to GART, if possible.
drm/nouveau: Add proper error handling to nouveau_card_init
drm/nv04: Fix NV04 set_operation software method.
drm/nouveau: Kill global state in BIOS script interpreter
drm/nouveau: Kill global state in NvShadowBIOS
drm/nouveau: use drm debug levels
drm/i2c/ch7006: Fix load detection false positives right after system init.
drm/nv04-nv40: Fix "conflicting memory types" when saving/restoring VGA fonts.
drm_ioctl is called with the Big Kernel Lock held,
which shows up very high in statistics on vfs_ioctl.
Moving the lock into the drm_ioctl function itself
makes sure we blame the right subsystem and it gets
us one step closer to eliminating the locked version
of fops->ioctl.
Since drm_ioctl does not require the lock itself,
we only need to hold it while calling the specific
handler. The 32 bit conversion handlers do not
interact with any other code, so they don't need
the BKL here either and can just call drm_ioctl.
As a bonus, this cleans up all the other users
of drm_ioctl which now no longer have to find
the inode or call lock_kernel.
[airlied: squashed the non-driver bits
of the second patch in here, this provides
the flag for drivers to use to select unlocked
ioctls - but doesn't modify any drivers].
Signed-off-by: Arnd Bergmann <arnd@arndb.de>
Cc: David Airlie <airlied@linux.ie>
Cc: dri-devel@lists.sourceforge.net
Cc: Frederic Weisbecker <fweisbec@gmail.com>
Cc: Thomas Gleixner <tglx@linutronix.de>
Signed-off-by: Dave Airlie <airlied@redhat.com>
Previously, if there was no firmware available, the DRM would just
disable channel creation from userspace, but still use a single
channel for its own purposes.
With a bit of care it should actually be possible to do this, due
to the DRM's very limited use of the engine. It currently doesn't
work correctly however, resulting in corrupted fbcon and hangs on
a number of cards.
Signed-off-by: Ben Skeggs <bskeggs@redhat.com>
The context programs are *very* simple compared to the ones used by
the binary driver. There's notes in nv40_grctx.c explaining most of
the things we don't implement. If we discover if/why any of it is
required further down the track, we'll handle it then.
The PGRAPH state generated for each chipset should match what NVIDIA
do almost exactly (there's a couple of exceptions). If someone has
a lot of time on their hands, they could figure out the mapping of
object/method to PGRAPH register and demagic the initial state a little,
it's not terribly important however.
At time of commit, confirmed to be working at least well enough for
accelerated X (and where tested, for 3D apps) on NV40, NV43, NV44, NV46,
NV49, NV4A, NV4B and NV4E.
A module option has been added to force the use of external firmware
blobs if it becomes required.
Signed-off-by: Ben Skeggs <bskeggs@redhat.com>
- Use driver level (0x2) for NV_DEBUG instead of all levels
- Create a NV_DEBUG_KMS for KMS level (0x4) and use them in modesetting code
- Remove a few odd NV_TRACE calls and replace some of them with NV_DEBUG_KMS or
NV_INFO
Signed-off-by: Maarten Maathuis <madman2003@gmail.com>
Signed-off-by: Ben Skeggs <bskeggs@redhat.com>
When switching to request_firmware() to load the context programs,
some endian fixes need to be applied. This makes it work again on
my quad g5 nvidia 6600.
Signed-off-by: Benjamin Herrenschmidt <benh@kernel.crashing.org>
Signed-off-by: Ben Skeggs <bskeggs@redhat.com>
The ch7006 driver could be built even when nouveau was not enabled,
but the build fails in that case, so make it depend on DRM_NOUVEUA.
Also make the I2c encoder/helper chips menu depend on I2C (no build
error, just visual inspection).
ERROR: "drm_helper_probe_single_connector_modes" [drivers/gpu/drm/i2c/ch7006.ko] undefined!
Signed-off-by: Randy Dunlap <randy.dunlap@oracle.com>
Signed-off-by: Ben Skeggs <bskeggs@redhat.com>
This adds a drm/kms staging non-API stable driver for GPUs from NVIDIA.
This driver is a KMS-based driver and requires a compatible nouveau
userspace libdrm and nouveau X.org driver.
This driver requires firmware files not available in this kernel tree,
interested parties can find them via the nouveau project git archive.
This driver is reverse engineered, and is in no way supported by nVidia.
Support for nearly the complete range of nvidia hw from nv04->g80 (nv50)
is available, and the kms driver should support driving nearly all
output types (displayport is under development still) along with supporting
suspend/resume.
This work is all from the upstream nouveau project found at
nouveau.freedesktop.org.
The original authors list from nouveau git tree is:
Anssi Hannula <anssi.hannula@iki.fi>
Ben Skeggs <bskeggs@redhat.com>
Francisco Jerez <currojerez@riseup.net>
Maarten Maathuis <madman2003@gmail.com>
Marcin Kościelnicki <koriakin@0x04.net>
Matthew Garrett <mjg@redhat.com>
Matt Parnell <mparnell@gmail.com>
Patrice Mandin <patmandin@gmail.com>
Pekka Paalanen <pq@iki.fi>
Xavier Chantry <shiningxc@gmail.com>
along with project founder Stephane Marchesin <marchesin@icps.u-strasbg.fr>
Signed-off-by: Ben Skeggs <bskeggs@redhat.com>
Signed-off-by: Dave Airlie <airlied@redhat.com>
