From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-3.8 required=3.0 tests=BAYES_00, HEADER_FROM_DIFFERENT_DOMAINS,MAILING_LIST_MULTI,NICE_REPLY_A,SPF_HELO_NONE, SPF_PASS,URIBL_BLOCKED autolearn=no autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id B6224C48BDF for ; Thu, 10 Jun 2021 17:50:36 +0000 (UTC) Received: from gabe.freedesktop.org (gabe.freedesktop.org [131.252.210.177]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPS id 128D6613CA for ; Thu, 10 Jun 2021 17:50:36 +0000 (UTC) DMARC-Filter: OpenDMARC Filter v1.3.2 mail.kernel.org 128D6613CA Authentication-Results: mail.kernel.org; dmarc=none (p=none dis=none) header.from=zary.sk Authentication-Results: mail.kernel.org; spf=none smtp.mailfrom=nouveau-bounces@lists.freedesktop.org Received: from gabe.freedesktop.org (localhost [127.0.0.1]) by gabe.freedesktop.org (Postfix) with ESMTP id A3A416E4D7; Thu, 10 Jun 2021 17:50:35 +0000 (UTC) Received: from hosting.gsystem.sk (hosting.gsystem.sk [212.5.213.30]) by gabe.freedesktop.org (Postfix) with ESMTP id 2D4896E4D7; Thu, 10 Jun 2021 17:50:34 +0000 (UTC) Received: from [192.168.0.2] (188-167-68-178.dynamic.chello.sk [188.167.68.178]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by hosting.gsystem.sk (Postfix) with ESMTPSA id D668C7A024A; Thu, 10 Jun 2021 19:50:32 +0200 (CEST) From: Ondrej Zary To: Christian =?utf-8?q?K=C3=B6nig?= Date: Thu, 10 Jun 2021 19:50:28 +0200 User-Agent: KMail/1.9.10 References: <202106052143.52488.linux@zary.sk> <202106092200.08088.linux@zary.sk> <081b7908-9a1c-fef1-2b82-4b794f612c9b@amd.com> In-Reply-To: <081b7908-9a1c-fef1-2b82-4b794f612c9b@amd.com> X-KMail-QuotePrefix: > MIME-Version: 1.0 Content-Disposition: inline Message-Id: <202106101950.28723.linux@zary.sk> Subject: Re: [Nouveau] nouveau broken on Riva TNT2 in 5.13.0-rc4: NULL pointer dereference in nouveau_bo_sync_for_device X-BeenThere: nouveau@lists.freedesktop.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Nouveau development list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Cc: nouveau@lists.freedesktop.org, Ben Skeggs , dri-devel@lists.freedesktop.org, linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 Errors-To: nouveau-bounces@lists.freedesktop.org Sender: "Nouveau" T24gVGh1cnNkYXkgMTAgSnVuZSAyMDIxIDA4OjQzOjA2IENocmlzdGlhbiBLw7ZuaWcgd3JvdGU6 Cj4gCj4gQW0gMDkuMDYuMjEgdW0gMjI6MDAgc2NocmllYiBPbmRyZWogWmFyeToKPiA+IE9uIFdl ZG5lc2RheSAwOSBKdW5lIDIwMjEgMTE6MjE6MDUgQ2hyaXN0aWFuIEvDtm5pZyB3cm90ZToKPiA+ PiBBbSAwOS4wNi4yMSB1bSAwOToxMCBzY2hyaWViIE9uZHJlaiBaYXJ5Ogo+ID4+PiBPbiBXZWRu ZXNkYXkgMDkgSnVuZSAyMDIxLCBDaHJpc3RpYW4gS8O2bmlnIHdyb3RlOgo+ID4+Pj4gQW0gMDku MDYuMjEgdW0gMDg6NTcgc2NocmllYiBPbmRyZWogWmFyeToKPiA+Pj4+PiBbU05JUF0KPiA+Pj4+ Pj4gVGhhbmtzIGZvciB0aGUgaGVhZHMgdXAuIFNvIHRoZSBwcm9ibGVtIHdpdGggbXkgcGF0Y2gg aXMgYWxyZWFkeSBmaXhlZCwKPiA+Pj4+Pj4gaXNuJ3QgaXQ/Cj4gPj4+Pj4gVGhlIE5VTEwgcG9p bnRlciBkZXJlZmVyZW5jZSBpbiBub3V2ZWF1X2JvX3dyMTYgaW50cm9kdWNlZCBpbgo+ID4+Pj4+ IDE0MWIxNWU1OTE3NWFhMTc0Y2ExZjc1OTYxODhiZDE1YTdjYTE3YmEgd2FzIGZpeGVkIGJ5Cj4g Pj4+Pj4gYWVhNjU2YjBkMDVlYzViOGVkNWJlYjJmOTRjNGRkNDJlYTgzNGU5ZC4KPiA+Pj4+Pgo+ ID4+Pj4+IFRoYXQncyB0aGUgYnVnIEkgaGl0IHdoZW4gYmlzZWN0aW5nIHRoZSBvcmlnaW5hbCBw cm9ibGVtOgo+ID4+Pj4+IE5VTEwgcG9pbnRlciBkZXJlZmVyZW5jZSBpbiBub3V2ZWF1X2JvX3N5 bmNfZm9yX2RldmljZQo+ID4+Pj4+IEl0J3MgY2F1c2VkIGJ5Ogo+ID4+Pj4+ICMgZmlyc3QgYmFk IGNvbW1pdDogW2UzNGI4ZmVlYWE0YjY1NzI1YjI1ZjQ5YzliMDhhMGY4NzA3ZThlODZdIGRybS90 dG06IG1lcmdlIHR0bV9kbWFfdHQgYmFjayBpbnRvIHR0bV90dAo+ID4+Pj4gR29vZCB0aGF0IEkn dmUgYXNrZWQgOikKPiA+Pj4+Cj4gPj4+PiBPayB0aGF0J3MgYSBiaXQgc3RyYW5nZS4gZTM0Yjhm ZWVhYTRiNjU3MjViMjVmNDljOWIwOGEwZjg3MDdlOGU4NiB3YXMKPiA+Pj4+IGNyZWF0ZWQgbW9z dGx5IGF1dG9tYXRlZC4KPiA+Pj4+Cj4gPj4+PiBEbyB5b3UgaGF2ZSB0aGUgb3JpZ2luYWwgYmFj a3RyYWNlIG9mIHRoYXQgTlVMTCBwb2ludGVyIGRlcmVmIG9uY2UgbW9yZT8KPiA+Pj4gVGhlIG9y aWdpbmFsIGJhY2t0cmFjZSBpcyBoZXJlOiBodHRwczovL25hbTExLnNhZmVsaW5rcy5wcm90ZWN0 aW9uLm91dGxvb2suY29tLz91cmw9aHR0cHMlM0ElMkYlMkZsa21sLm9yZyUyRmxrbWwlMkYyMDIx JTJGNiUyRjUlMkYzNTAmYW1wO2RhdGE9MDQlN0MwMSU3Q2NocmlzdGlhbi5rb2VuaWclNDBhbWQu Y29tJTdDNDMwOWZmMDIxZDVlNGNiZTk0OGIwOGQ5MmI4MTMxMDYlN0MzZGQ4OTYxZmU0ODg0ZTYw OGUxMWE4MmQ5OTRlMTgzZCU3QzAlN0MwJTdDNjM3NTg4NjU3MDQ1MzgzMDU2JTdDVW5rbm93biU3 Q1RXRnBiR1pzYjNkOGV5SldJam9pTUM0d0xqQXdNREFpTENKUUlqb2lWMmx1TXpJaUxDSkJUaUk2 SWsxaGFXd2lMQ0pYVkNJNk1uMCUzRCU3QzMwMDAmYW1wO3NkYXRhPXQ3MGM5a3R6UEp6RGFFQWNP NHdwUU12M1RVbzViNTNjVXk2NkFrTGVWd0UlM0QmYW1wO3Jlc2VydmVkPTAKPiA+PiBBbmQgdGhl IHByb2JsZW0gaXMgdGhhdCB0dG1fZG1hLT5kbWFfYWRkcmVzcyBpcyBOVUxMLCByaWdodD8gTWht LCBJCj4gPj4gZG9uJ3Qgc2VlIGhvdyB0aGF0IGNhbiBoYXBwZW4gc2luY2Ugbm91dmVhdSBpcyB1 c2luZyB0dG1fc2dfdHRfaW5pdCgpLgo+ID4+Cj4gPj4gQXBhcnQgZnJvbSB0aGF0IHdoYXQgbm91 dmVhdSBkb2VzIGhlcmUgaXMgcmF0aGVyIHF1ZXN0aW9uYWJsZSBzaW5jZSB5b3UKPiA+PiBuZWVk IGEgY29oZXJlbnQgYXJjaGl0ZWN0dXJlIGZvciBtb3N0IHRoaW5ncyBhbnl3YXksIGJ1dCB0aGF0 J3Mgbm90IHdoYXQKPiA+PiB3ZSBhcmUgdHJ5aW5nIHRvIGZpeCBoZXJlLgo+ID4+Cj4gPj4gQ2Fu IHlvdSB0cnkgdG8gbmFycm93IGRvd24gaWYgdHRtX3NnX3R0X2luaXQgaXMgY2FsbGVkIGJlZm9y ZSBjYWxsaW5nCj4gPj4gdGhpcyBmdW5jdGlvbiBmb3IgdGhlIHR0IG9iamVjdCBpbiBxdWVzdGlv bj8KPiA+IHR0bV9zZ190dF9pbml0IGlzIG5vdCBjYWxsZWQ6Cj4gPiBbICAgMTIuMTUwMTI0XSBu b3V2ZWF1IDAwMDA6MDE6MDAuMDogRFJNOiBWUkFNOiAzMSBNaUIKPiA+IFsgICAxMi4xNTAxMzNd IG5vdXZlYXUgMDAwMDowMTowMC4wOiBEUk06IEdBUlQ6IDEyOCBNaUIKPiA+IFsgICAxMi4xNTAx NDNdIG5vdXZlYXUgMDAwMDowMTowMC4wOiBEUk06IEJNUCB2ZXJzaW9uIDUuNgo+ID4gWyAgIDEy LjE1MDE1MV0gbm91dmVhdSAwMDAwOjAxOjAwLjA6IERSTTogTm8gRENCIGRhdGEgZm91bmQgaW4g VkJJT1MKPiA+IFsgICAxMi4xNTEzNjJdIHR0bV90dF9pbml0Cj4gPiBbICAgMTIuMTUxMzcwXSB0 dG1fdHRfaW5pdF9maWVsZHMKPiA+IFsgICAxMi4xNTEzNzRdIHR0bV90dF9hbGxvY19wYWdlX2Rp cmVjdG9yeQo+ID4gWyAgIDEyLjE1MTYxNV0gQlVHOiBrZXJuZWwgTlVMTCBwb2ludGVyIGRlcmVm ZXJlbmNlLCBhZGRyZXNzOiAwMDAwMDAwMAo+IAo+IFBsZWFzZSBhZGQgZHVtcF9zdGFjaygpOyB0 byB0dG1fdHRfaW5pdCgpIGFuZCByZXBvcnQgYmFjayB3aXRoIHRoZSAKPiBiYWNrdHJhY2UuCj4g Cj4gSSBjYW4ndCBzZWUgaG93IHRoaXMgaXMgY2FsbGVkIGZyb20gdGhlIG5vdXZlYXUgY29kZSwg b25seSBwb3NzaWJpbGl0eSBJIAo+IHNlZSBpcyB0aGF0IGl0IGlzIG1heWJlIGNhbGxlZCB0aHJv dWdoIHRoZSBBR1AgY29kZSBzb21laG93LgoKWWVzLCB5b3UncmUgcmlnaHQ6ClsgICAxMy4xOTI2 NjNdIENhbGwgVHJhY2U6ClsgICAxMy4xOTI2NzhdICBkdW1wX3N0YWNrKzB4NTQvMHg2OApbICAg MTMuMTkyNjkwXSAgdHRtX3R0X2luaXQrMHgxMS8weDhhIFt0dG1dClsgICAxMy4xOTI2OTldICB0 dG1fYWdwX3R0X2NyZWF0ZSsweDM5LzB4NTEgW3R0bV0KWyAgIDEzLjE5Mjg0MF0gIG5vdXZlYXVf dHRtX3R0X2NyZWF0ZSsweDE3LzB4MjIgW25vdXZlYXVdClsgICAxMy4xOTI4NTZdICB0dG1fdHRf Y3JlYXRlKzB4NzgvMHg4YyBbdHRtXQpbICAgMTMuMTkyODY0XSAgdHRtX2JvX2hhbmRsZV9tb3Zl X21lbSsweDdkLzB4Y2EgW3R0bV0KWyAgIDEzLjE5Mjg3M10gIHR0bV9ib192YWxpZGF0ZSsweDky LzB4YzggW3R0bV0KWyAgIDEzLjE5Mjg4M10gIHR0bV9ib19pbml0X3Jlc2VydmVkKzB4MjE2LzB4 MjQzIFt0dG1dClsgICAxMy4xOTI4OTJdICB0dG1fYm9faW5pdCsweDQ1LzB4NjUgW3R0bV0KWyAg IDEzLjE5MzAxOF0gID8gbm91dmVhdV9ib19kZWxfaW9fcmVzZXJ2ZV9scnUrMHg0OC8weDQ4IFtu b3V2ZWF1XQpbICAgMTMuMTkzMTUwXSAgbm91dmVhdV9ib19pbml0KzB4OGMvMHg5NCBbbm91dmVh dV0KWyAgIDEzLjE5MzI3M10gID8gbm91dmVhdV9ib19kZWxfaW9fcmVzZXJ2ZV9scnUrMHg0OC8w eDQ4IFtub3V2ZWF1XQpbICAgMTMuMTkzNDA3XSAgbm91dmVhdV9ib19uZXcrMHg0NC8weDU3IFtu b3V2ZWF1XQpbICAgMTMuMTkzNTM3XSAgbm91dmVhdV9jaGFubmVsX3ByZXArMHhhMy8weDI2OSBb bm91dmVhdV0KWyAgIDEzLjE5MzY2NV0gIG5vdXZlYXVfY2hhbm5lbF9uZXcrMHgzYy8weDVmNyBb bm91dmVhdV0KWyAgIDEzLjE5MzY3OV0gID8gc2xhYl9mcmVlX2ZyZWVsaXN0X2hvb2srMHgzYi8w eGE3ClsgICAxMy4xOTM2ODZdICA/IGtmcmVlKzB4OWUvMHgxMWEKWyAgIDEzLjE5Mzc4MV0gID8g bnZpZl9vYmplY3Rfc2NsYXNzX3B1dCsweGQvMHgxNiBbbm91dmVhdV0KWyAgIDEzLjE5MzkwOF0g IG5vdXZlYXVfZHJtX2RldmljZV9pbml0KzB4MmUyLzB4NjQ2IFtub3V2ZWF1XQpbICAgMTMuMTkz OTI0XSAgPyBwY2lfZW5hYmxlX2RldmljZV9mbGFncysweDFlLzB4YWMKWyAgIDEzLjE5NDA1Ml0g IG5vdXZlYXVfZHJtX3Byb2JlKzB4ZWIvMHgxODggW25vdXZlYXVdClsgICAxMy4xOTQxODJdICA/ IG5vdXZlYXVfZHJtX2RldmljZV9pbml0KzB4NjQ2LzB4NjQ2IFtub3V2ZWF1XQpbICAgMTMuMTk0 MTk1XSAgcGNpX2RldmljZV9wcm9iZSsweDg5LzB4ZTkKWyAgIDEzLjE5NDIwNV0gIHJlYWxseV9w cm9iZSsweDEyNy8weDJhNwpbICAgMTMuMTk0MjEyXSAgZHJpdmVyX3Byb2JlX2RldmljZSsweDVi LzB4ODcKWyAgIDEzLjE5NDIxOV0gIGRldmljZV9kcml2ZXJfYXR0YWNoKzB4MmUvMHg0MQpbICAg MTMuMTk0MjI2XSAgX19kcml2ZXJfYXR0YWNoKzB4N2MvMHg4MwpbICAgMTMuMTk0MjMyXSAgYnVz X2Zvcl9lYWNoX2RldisweDRjLzB4NjYKWyAgIDEzLjE5NDIzOF0gIGRyaXZlcl9hdHRhY2grMHgx NC8weDE2ClsgICAxMy4xOTQyNDRdICA/IGRldmljZV9kcml2ZXJfYXR0YWNoKzB4NDEvMHg0MQpb ICAgMTMuMTk0MjUxXSAgYnVzX2FkZF9kcml2ZXIrMHhjNS8weDE2YwpbICAgMTMuMTk0MjU4XSAg ZHJpdmVyX3JlZ2lzdGVyKzB4ODcvMHhiOQpbICAgMTMuMTk0MjY1XSAgX19wY2lfcmVnaXN0ZXJf ZHJpdmVyKzB4MzgvMHgzYgpbICAgMTMuMTk0MjcxXSAgPyAweGYwYzBkMDAwClsgICAxMy4xOTQz NjJdICBub3V2ZWF1X2RybV9pbml0KzB4MTRjLzB4MTAwMCBbbm91dmVhdV0KCkhvdyBpcyB0dG1f ZG1hX3R0LT5kbWFfYWRkcmVzcyBhbGxvY2F0ZWQ/IEkgY2Fubm90IGZpbmQgYW55IGFzc2lnbm1l bnQKZXhlY3V0ZWQgKGluIHRoZSB3b3JraW5nIGNvZGUpOgoKJCBnaXQgZ3JlcCBkbWFfYWRkcmVz c1wgPSBkcml2ZXJzL2dwdS8KZHJpdmVycy9ncHUvZHJtL2FtZC9hbWRncHUvYW1kZ3B1X2FtZGtm ZF9ncHV2bS5jOiAgICAgICBzZy0+c2dsLT5kbWFfYWRkcmVzcyA9IGFkZHI7CmRyaXZlcnMvZ3B1 L2RybS9hbWQvYW1kZ3B1L2FtZGdwdV90dG0uYzogICAgICAgICAgICAgICAgZG1hX2FkZHJlc3Mg PSAmZG1hLT5kbWFfYWRkcmVzc1tvZmZzZXQgPj4gUEFHRV9TSElGVF07CmRyaXZlcnMvZ3B1L2Ry bS9hbWQvYW1kZ3B1L2FtZGdwdV90dG0uYzogICAgICAgICAgICAgICAgZG1hX2FkZHJlc3MgPSAo bW1fbm9kZS0+c3RhcnQgPDwgUEFHRV9TSElGVCkgKyBvZmZzZXQ7CmRyaXZlcnMvZ3B1L2RybS9p OTE1L2d2dC9zY2hlZHVsZXIuYzogICBzZy0+ZG1hX2FkZHJlc3MgPSBhZGRyOwpkcml2ZXJzL2dw dS9kcm0vaTkxNS9pOTE1X2dwdV9lcnJvci5jOiAgc2ctPmRtYV9hZGRyZXNzID0gaXQ7CmRyaXZl cnMvZ3B1L2RybS90dG0vdHRtX3R0LmM6ICAgdHRtLT5kbWFfYWRkcmVzcyA9ICh2b2lkICopICh0 dG0tPnR0bS5wYWdlcyArIHR0bS0+dHRtLm51bV9wYWdlcyk7CmRyaXZlcnMvZ3B1L2RybS90dG0v dHRtX3R0LmM6ICAgdHRtLT5kbWFfYWRkcmVzcyA9IGt2bWFsbG9jX2FycmF5KHR0bS0+dHRtLm51 bV9wYWdlcywKZHJpdmVycy9ncHUvZHJtL3R0bS90dG1fdHQuYzogICB0dG1fZG1hLT5kbWFfYWRk cmVzcyA9IE5VTEw7CmRyaXZlcnMvZ3B1L2RybS92bXdnZngvdm13Z2Z4X3R0bV9idWZmZXIuYzog ICAgICAgICAgICAgdml0ZXItPmRtYV9hZGRyZXNzID0gJl9fdm13X3BpdGVyX3BoeXNfYWRkcjsK ZHJpdmVycy9ncHUvZHJtL3Ztd2dmeC92bXdnZnhfdHRtX2J1ZmZlci5jOiAgICAgICAgICAgICB2 aXRlci0+ZG1hX2FkZHJlc3MgPSAmX192bXdfcGl0ZXJfZG1hX2FkZHI7CmRyaXZlcnMvZ3B1L2Ry bS92bXdnZngvdm13Z2Z4X3R0bV9idWZmZXIuYzogICAgICAgICAgICAgdml0ZXItPmRtYV9hZGRy ZXNzID0gJl9fdm13X3BpdGVyX3NnX2FkZHI7CgpUaGUgMiBjYXNlcyBpbiB0dG1fdHQuYyBhcmUg aW4gdHRtX2RtYV90dF9hbGxvY19wYWdlX2RpcmVjdG9yeSgpIGFuZAp0dG1fc2dfdHRfYWxsb2Nf cGFnZV9kaXJlY3RvcnkoKS4KQ29uZmlybWVkIGJ5IGFkZGluZyBwcmludGsoKXMgdGhhdCB0aGV5 J3JlIE5PVCBjYWxsZWQuCgoKLS0gCk9uZHJlaiBaYXJ5Cl9fX19fX19fX19fX19fX19fX19fX19f X19fX19fX19fX19fX19fX19fX19fX19fCk5vdXZlYXUgbWFpbGluZyBsaXN0Ck5vdXZlYXVAbGlz dHMuZnJlZWRlc2t0b3Aub3JnCmh0dHBzOi8vbGlzdHMuZnJlZWRlc2t0b3Aub3JnL21haWxtYW4v bGlzdGluZm8vbm91dmVhdQo= From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-3.8 required=3.0 tests=BAYES_00, HEADER_FROM_DIFFERENT_DOMAINS,MAILING_LIST_MULTI,NICE_REPLY_A,SPF_HELO_NONE, SPF_PASS autolearn=no autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 6D707C48BE5 for ; Thu, 10 Jun 2021 17:50:37 +0000 (UTC) Received: from gabe.freedesktop.org (gabe.freedesktop.org [131.252.210.177]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPS id 07A24613BD for ; Thu, 10 Jun 2021 17:50:37 +0000 (UTC) DMARC-Filter: OpenDMARC Filter v1.3.2 mail.kernel.org 07A24613BD Authentication-Results: mail.kernel.org; dmarc=none (p=none dis=none) header.from=zary.sk Authentication-Results: mail.kernel.org; spf=none smtp.mailfrom=dri-devel-bounces@lists.freedesktop.org Received: from gabe.freedesktop.org (localhost [127.0.0.1]) by gabe.freedesktop.org (Postfix) with ESMTP id 3DC6B6E4DE; Thu, 10 Jun 2021 17:50:36 +0000 (UTC) Received: from hosting.gsystem.sk (hosting.gsystem.sk [212.5.213.30]) by gabe.freedesktop.org (Postfix) with ESMTP id 2D4896E4D7; Thu, 10 Jun 2021 17:50:34 +0000 (UTC) Received: from [192.168.0.2] (188-167-68-178.dynamic.chello.sk [188.167.68.178]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by hosting.gsystem.sk (Postfix) with ESMTPSA id D668C7A024A; Thu, 10 Jun 2021 19:50:32 +0200 (CEST) From: Ondrej Zary To: Christian =?utf-8?q?K=C3=B6nig?= Subject: Re: nouveau broken on Riva TNT2 in 5.13.0-rc4: NULL pointer dereference in nouveau_bo_sync_for_device Date: Thu, 10 Jun 2021 19:50:28 +0200 User-Agent: KMail/1.9.10 References: <202106052143.52488.linux@zary.sk> <202106092200.08088.linux@zary.sk> <081b7908-9a1c-fef1-2b82-4b794f612c9b@amd.com> In-Reply-To: <081b7908-9a1c-fef1-2b82-4b794f612c9b@amd.com> X-KMail-QuotePrefix: > MIME-Version: 1.0 Content-Type: Text/Plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Content-Disposition: inline Message-Id: <202106101950.28723.linux@zary.sk> X-BeenThere: dri-devel@lists.freedesktop.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Direct Rendering Infrastructure - Development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Cc: nouveau@lists.freedesktop.org, Ben Skeggs , dri-devel@lists.freedesktop.org, linux-kernel@vger.kernel.org Errors-To: dri-devel-bounces@lists.freedesktop.org Sender: "dri-devel" On Thursday 10 June 2021 08:43:06 Christian K=C3=B6nig wrote: >=20 > Am 09.06.21 um 22:00 schrieb Ondrej Zary: > > On Wednesday 09 June 2021 11:21:05 Christian K=C3=B6nig wrote: > >> Am 09.06.21 um 09:10 schrieb Ondrej Zary: > >>> On Wednesday 09 June 2021, Christian K=C3=B6nig wrote: > >>>> Am 09.06.21 um 08:57 schrieb Ondrej Zary: > >>>>> [SNIP] > >>>>>> Thanks for the heads up. So the problem with my patch is already f= ixed, > >>>>>> isn't it? > >>>>> The NULL pointer dereference in nouveau_bo_wr16 introduced in > >>>>> 141b15e59175aa174ca1f7596188bd15a7ca17ba was fixed by > >>>>> aea656b0d05ec5b8ed5beb2f94c4dd42ea834e9d. > >>>>> > >>>>> That's the bug I hit when bisecting the original problem: > >>>>> NULL pointer dereference in nouveau_bo_sync_for_device > >>>>> It's caused by: > >>>>> # first bad commit: [e34b8feeaa4b65725b25f49c9b08a0f8707e8e86] drm/= ttm: merge ttm_dma_tt back into ttm_tt > >>>> Good that I've asked :) > >>>> > >>>> Ok that's a bit strange. e34b8feeaa4b65725b25f49c9b08a0f8707e8e86 was > >>>> created mostly automated. > >>>> > >>>> Do you have the original backtrace of that NULL pointer deref once m= ore? > >>> The original backtrace is here: https://nam11.safelinks.protection.ou= tlook.com/?url=3Dhttps%3A%2F%2Flkml.org%2Flkml%2F2021%2F6%2F5%2F350&dat= a=3D04%7C01%7Cchristian.koenig%40amd.com%7C4309ff021d5e4cbe948b08d92b813106= %7C3dd8961fe4884e608e11a82d994e183d%7C0%7C0%7C637588657045383056%7CUnknown%= 7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6M= n0%3D%7C3000&sdata=3Dt70c9ktzPJzDaEAcO4wpQMv3TUo5b53cUy66AkLeVwE%3D&= ;reserved=3D0 > >> And the problem is that ttm_dma->dma_address is NULL, right? Mhm, I > >> don't see how that can happen since nouveau is using ttm_sg_tt_init(). > >> > >> Apart from that what nouveau does here is rather questionable since you > >> need a coherent architecture for most things anyway, but that's not wh= at > >> we are trying to fix here. > >> > >> Can you try to narrow down if ttm_sg_tt_init is called before calling > >> this function for the tt object in question? > > ttm_sg_tt_init is not called: > > [ 12.150124] nouveau 0000:01:00.0: DRM: VRAM: 31 MiB > > [ 12.150133] nouveau 0000:01:00.0: DRM: GART: 128 MiB > > [ 12.150143] nouveau 0000:01:00.0: DRM: BMP version 5.6 > > [ 12.150151] nouveau 0000:01:00.0: DRM: No DCB data found in VBIOS > > [ 12.151362] ttm_tt_init > > [ 12.151370] ttm_tt_init_fields > > [ 12.151374] ttm_tt_alloc_page_directory > > [ 12.151615] BUG: kernel NULL pointer dereference, address: 00000000 >=20 > Please add dump_stack(); to ttm_tt_init() and report back with the=20 > backtrace. >=20 > I can't see how this is called from the nouveau code, only possibility I= =20 > see is that it is maybe called through the AGP code somehow. Yes, you're right: [ 13.192663] Call Trace: [ 13.192678] dump_stack+0x54/0x68 [ 13.192690] ttm_tt_init+0x11/0x8a [ttm] [ 13.192699] ttm_agp_tt_create+0x39/0x51 [ttm] [ 13.192840] nouveau_ttm_tt_create+0x17/0x22 [nouveau] [ 13.192856] ttm_tt_create+0x78/0x8c [ttm] [ 13.192864] ttm_bo_handle_move_mem+0x7d/0xca [ttm] [ 13.192873] ttm_bo_validate+0x92/0xc8 [ttm] [ 13.192883] ttm_bo_init_reserved+0x216/0x243 [ttm] [ 13.192892] ttm_bo_init+0x45/0x65 [ttm] [ 13.193018] ? nouveau_bo_del_io_reserve_lru+0x48/0x48 [nouveau] [ 13.193150] nouveau_bo_init+0x8c/0x94 [nouveau] [ 13.193273] ? nouveau_bo_del_io_reserve_lru+0x48/0x48 [nouveau] [ 13.193407] nouveau_bo_new+0x44/0x57 [nouveau] [ 13.193537] nouveau_channel_prep+0xa3/0x269 [nouveau] [ 13.193665] nouveau_channel_new+0x3c/0x5f7 [nouveau] [ 13.193679] ? slab_free_freelist_hook+0x3b/0xa7 [ 13.193686] ? kfree+0x9e/0x11a [ 13.193781] ? nvif_object_sclass_put+0xd/0x16 [nouveau] [ 13.193908] nouveau_drm_device_init+0x2e2/0x646 [nouveau] [ 13.193924] ? pci_enable_device_flags+0x1e/0xac [ 13.194052] nouveau_drm_probe+0xeb/0x188 [nouveau] [ 13.194182] ? nouveau_drm_device_init+0x646/0x646 [nouveau] [ 13.194195] pci_device_probe+0x89/0xe9 [ 13.194205] really_probe+0x127/0x2a7 [ 13.194212] driver_probe_device+0x5b/0x87 [ 13.194219] device_driver_attach+0x2e/0x41 [ 13.194226] __driver_attach+0x7c/0x83 [ 13.194232] bus_for_each_dev+0x4c/0x66 [ 13.194238] driver_attach+0x14/0x16 [ 13.194244] ? device_driver_attach+0x41/0x41 [ 13.194251] bus_add_driver+0xc5/0x16c [ 13.194258] driver_register+0x87/0xb9 [ 13.194265] __pci_register_driver+0x38/0x3b [ 13.194271] ? 0xf0c0d000 [ 13.194362] nouveau_drm_init+0x14c/0x1000 [nouveau] How is ttm_dma_tt->dma_address allocated? I cannot find any assignment executed (in the working code): $ git grep dma_address\ =3D drivers/gpu/ drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd_gpuvm.c: sg->sgl->dma_addres= s =3D addr; drivers/gpu/drm/amd/amdgpu/amdgpu_ttm.c: dma_address =3D &dm= a->dma_address[offset >> PAGE_SHIFT]; drivers/gpu/drm/amd/amdgpu/amdgpu_ttm.c: dma_address =3D (mm= _node->start << PAGE_SHIFT) + offset; drivers/gpu/drm/i915/gvt/scheduler.c: sg->dma_address =3D addr; drivers/gpu/drm/i915/i915_gpu_error.c: sg->dma_address =3D it; drivers/gpu/drm/ttm/ttm_tt.c: ttm->dma_address =3D (void *) (ttm->ttm.pag= es + ttm->ttm.num_pages); drivers/gpu/drm/ttm/ttm_tt.c: ttm->dma_address =3D kvmalloc_array(ttm->tt= m.num_pages, drivers/gpu/drm/ttm/ttm_tt.c: ttm_dma->dma_address =3D NULL; drivers/gpu/drm/vmwgfx/vmwgfx_ttm_buffer.c: viter->dma_address = =3D &__vmw_piter_phys_addr; drivers/gpu/drm/vmwgfx/vmwgfx_ttm_buffer.c: viter->dma_address = =3D &__vmw_piter_dma_addr; drivers/gpu/drm/vmwgfx/vmwgfx_ttm_buffer.c: viter->dma_address = =3D &__vmw_piter_sg_addr; The 2 cases in ttm_tt.c are in ttm_dma_tt_alloc_page_directory() and ttm_sg_tt_alloc_page_directory(). Confirmed by adding printk()s that they're NOT called. =2D-=20 Ondrej Zary From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-3.8 required=3.0 tests=BAYES_00, HEADER_FROM_DIFFERENT_DOMAINS,MAILING_LIST_MULTI,NICE_REPLY_A,SPF_HELO_NONE, SPF_PASS autolearn=no autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 533A6C48BD1 for ; Thu, 10 Jun 2021 17:50:36 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by mail.kernel.org (Postfix) with ESMTP id 21329613F1 for ; Thu, 10 Jun 2021 17:50:36 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S230205AbhFJRwb convert rfc822-to-8bit (ORCPT ); Thu, 10 Jun 2021 13:52:31 -0400 Received: from hosting.gsystem.sk ([212.5.213.30]:59516 "EHLO hosting.gsystem.sk" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S229802AbhFJRwa (ORCPT ); Thu, 10 Jun 2021 13:52:30 -0400 Received: from [192.168.0.2] (188-167-68-178.dynamic.chello.sk [188.167.68.178]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by hosting.gsystem.sk (Postfix) with ESMTPSA id D668C7A024A; Thu, 10 Jun 2021 19:50:32 +0200 (CEST) From: Ondrej Zary To: Christian =?utf-8?q?K=C3=B6nig?= Subject: Re: nouveau broken on Riva TNT2 in 5.13.0-rc4: NULL pointer dereference in nouveau_bo_sync_for_device Date: Thu, 10 Jun 2021 19:50:28 +0200 User-Agent: KMail/1.9.10 Cc: Ben Skeggs , dri-devel@lists.freedesktop.org, nouveau@lists.freedesktop.org, linux-kernel@vger.kernel.org References: <202106052143.52488.linux@zary.sk> <202106092200.08088.linux@zary.sk> <081b7908-9a1c-fef1-2b82-4b794f612c9b@amd.com> In-Reply-To: <081b7908-9a1c-fef1-2b82-4b794f612c9b@amd.com> X-KMail-QuotePrefix: > MIME-Version: 1.0 Content-Type: Text/Plain; charset="utf-8" Content-Transfer-Encoding: 8BIT Content-Disposition: inline Message-Id: <202106101950.28723.linux@zary.sk> Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org On Thursday 10 June 2021 08:43:06 Christian König wrote: > > Am 09.06.21 um 22:00 schrieb Ondrej Zary: > > On Wednesday 09 June 2021 11:21:05 Christian König wrote: > >> Am 09.06.21 um 09:10 schrieb Ondrej Zary: > >>> On Wednesday 09 June 2021, Christian König wrote: > >>>> Am 09.06.21 um 08:57 schrieb Ondrej Zary: > >>>>> [SNIP] > >>>>>> Thanks for the heads up. So the problem with my patch is already fixed, > >>>>>> isn't it? > >>>>> The NULL pointer dereference in nouveau_bo_wr16 introduced in > >>>>> 141b15e59175aa174ca1f7596188bd15a7ca17ba was fixed by > >>>>> aea656b0d05ec5b8ed5beb2f94c4dd42ea834e9d. > >>>>> > >>>>> That's the bug I hit when bisecting the original problem: > >>>>> NULL pointer dereference in nouveau_bo_sync_for_device > >>>>> It's caused by: > >>>>> # first bad commit: [e34b8feeaa4b65725b25f49c9b08a0f8707e8e86] drm/ttm: merge ttm_dma_tt back into ttm_tt > >>>> Good that I've asked :) > >>>> > >>>> Ok that's a bit strange. e34b8feeaa4b65725b25f49c9b08a0f8707e8e86 was > >>>> created mostly automated. > >>>> > >>>> Do you have the original backtrace of that NULL pointer deref once more? > >>> The original backtrace is here: https://nam11.safelinks.protection.outlook.com/?url=https%3A%2F%2Flkml.org%2Flkml%2F2021%2F6%2F5%2F350&data=04%7C01%7Cchristian.koenig%40amd.com%7C4309ff021d5e4cbe948b08d92b813106%7C3dd8961fe4884e608e11a82d994e183d%7C0%7C0%7C637588657045383056%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C3000&sdata=t70c9ktzPJzDaEAcO4wpQMv3TUo5b53cUy66AkLeVwE%3D&reserved=0 > >> And the problem is that ttm_dma->dma_address is NULL, right? Mhm, I > >> don't see how that can happen since nouveau is using ttm_sg_tt_init(). > >> > >> Apart from that what nouveau does here is rather questionable since you > >> need a coherent architecture for most things anyway, but that's not what > >> we are trying to fix here. > >> > >> Can you try to narrow down if ttm_sg_tt_init is called before calling > >> this function for the tt object in question? > > ttm_sg_tt_init is not called: > > [ 12.150124] nouveau 0000:01:00.0: DRM: VRAM: 31 MiB > > [ 12.150133] nouveau 0000:01:00.0: DRM: GART: 128 MiB > > [ 12.150143] nouveau 0000:01:00.0: DRM: BMP version 5.6 > > [ 12.150151] nouveau 0000:01:00.0: DRM: No DCB data found in VBIOS > > [ 12.151362] ttm_tt_init > > [ 12.151370] ttm_tt_init_fields > > [ 12.151374] ttm_tt_alloc_page_directory > > [ 12.151615] BUG: kernel NULL pointer dereference, address: 00000000 > > Please add dump_stack(); to ttm_tt_init() and report back with the > backtrace. > > I can't see how this is called from the nouveau code, only possibility I > see is that it is maybe called through the AGP code somehow. Yes, you're right: [ 13.192663] Call Trace: [ 13.192678] dump_stack+0x54/0x68 [ 13.192690] ttm_tt_init+0x11/0x8a [ttm] [ 13.192699] ttm_agp_tt_create+0x39/0x51 [ttm] [ 13.192840] nouveau_ttm_tt_create+0x17/0x22 [nouveau] [ 13.192856] ttm_tt_create+0x78/0x8c [ttm] [ 13.192864] ttm_bo_handle_move_mem+0x7d/0xca [ttm] [ 13.192873] ttm_bo_validate+0x92/0xc8 [ttm] [ 13.192883] ttm_bo_init_reserved+0x216/0x243 [ttm] [ 13.192892] ttm_bo_init+0x45/0x65 [ttm] [ 13.193018] ? nouveau_bo_del_io_reserve_lru+0x48/0x48 [nouveau] [ 13.193150] nouveau_bo_init+0x8c/0x94 [nouveau] [ 13.193273] ? nouveau_bo_del_io_reserve_lru+0x48/0x48 [nouveau] [ 13.193407] nouveau_bo_new+0x44/0x57 [nouveau] [ 13.193537] nouveau_channel_prep+0xa3/0x269 [nouveau] [ 13.193665] nouveau_channel_new+0x3c/0x5f7 [nouveau] [ 13.193679] ? slab_free_freelist_hook+0x3b/0xa7 [ 13.193686] ? kfree+0x9e/0x11a [ 13.193781] ? nvif_object_sclass_put+0xd/0x16 [nouveau] [ 13.193908] nouveau_drm_device_init+0x2e2/0x646 [nouveau] [ 13.193924] ? pci_enable_device_flags+0x1e/0xac [ 13.194052] nouveau_drm_probe+0xeb/0x188 [nouveau] [ 13.194182] ? nouveau_drm_device_init+0x646/0x646 [nouveau] [ 13.194195] pci_device_probe+0x89/0xe9 [ 13.194205] really_probe+0x127/0x2a7 [ 13.194212] driver_probe_device+0x5b/0x87 [ 13.194219] device_driver_attach+0x2e/0x41 [ 13.194226] __driver_attach+0x7c/0x83 [ 13.194232] bus_for_each_dev+0x4c/0x66 [ 13.194238] driver_attach+0x14/0x16 [ 13.194244] ? device_driver_attach+0x41/0x41 [ 13.194251] bus_add_driver+0xc5/0x16c [ 13.194258] driver_register+0x87/0xb9 [ 13.194265] __pci_register_driver+0x38/0x3b [ 13.194271] ? 0xf0c0d000 [ 13.194362] nouveau_drm_init+0x14c/0x1000 [nouveau] How is ttm_dma_tt->dma_address allocated? I cannot find any assignment executed (in the working code): $ git grep dma_address\ = drivers/gpu/ drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd_gpuvm.c: sg->sgl->dma_address = addr; drivers/gpu/drm/amd/amdgpu/amdgpu_ttm.c: dma_address = &dma->dma_address[offset >> PAGE_SHIFT]; drivers/gpu/drm/amd/amdgpu/amdgpu_ttm.c: dma_address = (mm_node->start << PAGE_SHIFT) + offset; drivers/gpu/drm/i915/gvt/scheduler.c: sg->dma_address = addr; drivers/gpu/drm/i915/i915_gpu_error.c: sg->dma_address = it; drivers/gpu/drm/ttm/ttm_tt.c: ttm->dma_address = (void *) (ttm->ttm.pages + ttm->ttm.num_pages); drivers/gpu/drm/ttm/ttm_tt.c: ttm->dma_address = kvmalloc_array(ttm->ttm.num_pages, drivers/gpu/drm/ttm/ttm_tt.c: ttm_dma->dma_address = NULL; drivers/gpu/drm/vmwgfx/vmwgfx_ttm_buffer.c: viter->dma_address = &__vmw_piter_phys_addr; drivers/gpu/drm/vmwgfx/vmwgfx_ttm_buffer.c: viter->dma_address = &__vmw_piter_dma_addr; drivers/gpu/drm/vmwgfx/vmwgfx_ttm_buffer.c: viter->dma_address = &__vmw_piter_sg_addr; The 2 cases in ttm_tt.c are in ttm_dma_tt_alloc_page_directory() and ttm_sg_tt_alloc_page_directory(). Confirmed by adding printk()s that they're NOT called. -- Ondrej Zary