From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-3.8 required=3.0 tests=BAYES_00, HEADER_FROM_DIFFERENT_DOMAINS,MAILING_LIST_MULTI,NICE_REPLY_A,SPF_HELO_NONE, SPF_PASS autolearn=no autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 48E69C48BE0 for ; Fri, 11 Jun 2021 18:23:19 +0000 (UTC) Received: from gabe.freedesktop.org (gabe.freedesktop.org [131.252.210.177]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPS id AA47A613AE for ; Fri, 11 Jun 2021 18:23:18 +0000 (UTC) DMARC-Filter: OpenDMARC Filter v1.3.2 mail.kernel.org AA47A613AE Authentication-Results: mail.kernel.org; dmarc=none (p=none dis=none) header.from=zary.sk Authentication-Results: mail.kernel.org; spf=none smtp.mailfrom=nouveau-bounces@lists.freedesktop.org Received: from gabe.freedesktop.org (localhost [127.0.0.1]) by gabe.freedesktop.org (Postfix) with ESMTP id 4DE376F3B3; Fri, 11 Jun 2021 18:23:18 +0000 (UTC) Received: from hosting.gsystem.sk (hosting.gsystem.sk [212.5.213.30]) by gabe.freedesktop.org (Postfix) with ESMTP id 5B3A66F3B3; Fri, 11 Jun 2021 18:23:17 +0000 (UTC) Received: from [192.168.0.2] (unknown [188.167.68.178]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by hosting.gsystem.sk (Postfix) with ESMTPSA id F2EDD7A024A; Fri, 11 Jun 2021 20:23:13 +0200 (CEST) From: Ondrej Zary To: Christian =?utf-8?q?K=C3=B6nig?= Date: Fri, 11 Jun 2021 20:23:10 +0200 User-Agent: KMail/1.9.10 References: <202106052143.52488.linux@zary.sk> <4b4248d8-b708-3832-7fe3-2a9fd2c2311e@amd.com> In-Reply-To: <4b4248d8-b708-3832-7fe3-2a9fd2c2311e@amd.com> X-KMail-QuotePrefix: > MIME-Version: 1.0 Content-Disposition: inline Message-Id: <202106112023.11270.linux@zary.sk> Subject: Re: [Nouveau] nouveau broken on Riva TNT2 in 5.13.0-rc4: NULL pointer dereference in nouveau_bo_sync_for_device X-BeenThere: nouveau@lists.freedesktop.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Nouveau development list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Cc: nouveau@lists.freedesktop.org, Ben Skeggs , dri-devel@lists.freedesktop.org, linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 Errors-To: nouveau-bounces@lists.freedesktop.org Sender: "Nouveau" T24gRnJpZGF5IDExIEp1bmUgMjAyMSAxNDozODoxOCBDaHJpc3RpYW4gS8O2bmlnIHdyb3RlOgo+ IAo+IEFtIDEwLjA2LjIxIHVtIDE5OjU5IHNjaHJpZWIgQ2hyaXN0aWFuIEvDtm5pZzoKPiA+IEFt IDEwLjA2LjIxIHVtIDE5OjUwIHNjaHJpZWIgT25kcmVqIFphcnk6Cj4gPj4gW1NOSVBdCj4gPj4+ IEkgY2FuJ3Qgc2VlIGhvdyB0aGlzIGlzIGNhbGxlZCBmcm9tIHRoZSBub3V2ZWF1IGNvZGUsIG9u bHkgCj4gPj4+IHBvc3NpYmlsaXR5IEkKPiA+Pj4gc2VlIGlzIHRoYXQgaXQgaXMgbWF5YmUgY2Fs bGVkIHRocm91Z2ggdGhlIEFHUCBjb2RlIHNvbWVob3cuCj4gPj4gWWVzLCB5b3UncmUgcmlnaHQ6 Cj4gPj4gW8KgwqAgMTMuMTkyNjYzXSBDYWxsIFRyYWNlOgo+ID4+IFvCoMKgIDEzLjE5MjY3OF3C oCBkdW1wX3N0YWNrKzB4NTQvMHg2OAo+ID4+IFvCoMKgIDEzLjE5MjY5MF3CoCB0dG1fdHRfaW5p dCsweDExLzB4OGEgW3R0bV0KPiA+PiBbwqDCoCAxMy4xOTI2OTldwqAgdHRtX2FncF90dF9jcmVh dGUrMHgzOS8weDUxIFt0dG1dCj4gPj4gW8KgwqAgMTMuMTkyODQwXcKgIG5vdXZlYXVfdHRtX3R0 X2NyZWF0ZSsweDE3LzB4MjIgW25vdXZlYXVdCj4gPj4gW8KgwqAgMTMuMTkyODU2XcKgIHR0bV90 dF9jcmVhdGUrMHg3OC8weDhjIFt0dG1dCj4gPj4gW8KgwqAgMTMuMTkyODY0XcKgIHR0bV9ib19o YW5kbGVfbW92ZV9tZW0rMHg3ZC8weGNhIFt0dG1dCj4gPj4gW8KgwqAgMTMuMTkyODczXcKgIHR0 bV9ib192YWxpZGF0ZSsweDkyLzB4YzggW3R0bV0KPiA+PiBbwqDCoCAxMy4xOTI4ODNdwqAgdHRt X2JvX2luaXRfcmVzZXJ2ZWQrMHgyMTYvMHgyNDMgW3R0bV0KPiA+PiBbwqDCoCAxMy4xOTI4OTJd wqAgdHRtX2JvX2luaXQrMHg0NS8weDY1IFt0dG1dCj4gPj4gW8KgwqAgMTMuMTkzMDE4XcKgID8g bm91dmVhdV9ib19kZWxfaW9fcmVzZXJ2ZV9scnUrMHg0OC8weDQ4IFtub3V2ZWF1XQo+ID4+IFvC oMKgIDEzLjE5MzE1MF3CoCBub3V2ZWF1X2JvX2luaXQrMHg4Yy8weDk0IFtub3V2ZWF1XQo+ID4+ IFvCoMKgIDEzLjE5MzI3M13CoCA/IG5vdXZlYXVfYm9fZGVsX2lvX3Jlc2VydmVfbHJ1KzB4NDgv MHg0OCBbbm91dmVhdV0KPiA+PiBbwqDCoCAxMy4xOTM0MDddwqAgbm91dmVhdV9ib19uZXcrMHg0 NC8weDU3IFtub3V2ZWF1XQo+ID4+IFvCoMKgIDEzLjE5MzUzN13CoCBub3V2ZWF1X2NoYW5uZWxf cHJlcCsweGEzLzB4MjY5IFtub3V2ZWF1XQo+ID4+IFvCoMKgIDEzLjE5MzY2NV3CoCBub3V2ZWF1 X2NoYW5uZWxfbmV3KzB4M2MvMHg1ZjcgW25vdXZlYXVdCj4gPj4gW8KgwqAgMTMuMTkzNjc5XcKg ID8gc2xhYl9mcmVlX2ZyZWVsaXN0X2hvb2srMHgzYi8weGE3Cj4gPj4gW8KgwqAgMTMuMTkzNjg2 XcKgID8ga2ZyZWUrMHg5ZS8weDExYQo+ID4+IFvCoMKgIDEzLjE5Mzc4MV3CoCA/IG52aWZfb2Jq ZWN0X3NjbGFzc19wdXQrMHhkLzB4MTYgW25vdXZlYXVdCj4gPj4gW8KgwqAgMTMuMTkzOTA4XcKg IG5vdXZlYXVfZHJtX2RldmljZV9pbml0KzB4MmUyLzB4NjQ2IFtub3V2ZWF1XQo+ID4+IFvCoMKg IDEzLjE5MzkyNF3CoCA/IHBjaV9lbmFibGVfZGV2aWNlX2ZsYWdzKzB4MWUvMHhhYwo+ID4+IFvC oMKgIDEzLjE5NDA1Ml3CoCBub3V2ZWF1X2RybV9wcm9iZSsweGViLzB4MTg4IFtub3V2ZWF1XQo+ ID4+IFvCoMKgIDEzLjE5NDE4Ml3CoCA/IG5vdXZlYXVfZHJtX2RldmljZV9pbml0KzB4NjQ2LzB4 NjQ2IFtub3V2ZWF1XQo+ID4+IFvCoMKgIDEzLjE5NDE5NV3CoCBwY2lfZGV2aWNlX3Byb2JlKzB4 ODkvMHhlOQo+ID4+IFvCoMKgIDEzLjE5NDIwNV3CoCByZWFsbHlfcHJvYmUrMHgxMjcvMHgyYTcK PiA+PiBbwqDCoCAxMy4xOTQyMTJdwqAgZHJpdmVyX3Byb2JlX2RldmljZSsweDViLzB4ODcKPiA+ PiBbwqDCoCAxMy4xOTQyMTldwqAgZGV2aWNlX2RyaXZlcl9hdHRhY2grMHgyZS8weDQxCj4gPj4g W8KgwqAgMTMuMTk0MjI2XcKgIF9fZHJpdmVyX2F0dGFjaCsweDdjLzB4ODMKPiA+PiBbwqDCoCAx My4xOTQyMzJdwqAgYnVzX2Zvcl9lYWNoX2RldisweDRjLzB4NjYKPiA+PiBbwqDCoCAxMy4xOTQy MzhdwqAgZHJpdmVyX2F0dGFjaCsweDE0LzB4MTYKPiA+PiBbwqDCoCAxMy4xOTQyNDRdwqAgPyBk ZXZpY2VfZHJpdmVyX2F0dGFjaCsweDQxLzB4NDEKPiA+PiBbwqDCoCAxMy4xOTQyNTFdwqAgYnVz X2FkZF9kcml2ZXIrMHhjNS8weDE2Ywo+ID4+IFvCoMKgIDEzLjE5NDI1OF3CoCBkcml2ZXJfcmVn aXN0ZXIrMHg4Ny8weGI5Cj4gPj4gW8KgwqAgMTMuMTk0MjY1XcKgIF9fcGNpX3JlZ2lzdGVyX2Ry aXZlcisweDM4LzB4M2IKPiA+PiBbwqDCoCAxMy4xOTQyNzFdwqAgPyAweGYwYzBkMDAwCj4gPj4g W8KgwqAgMTMuMTk0MzYyXcKgIG5vdXZlYXVfZHJtX2luaXQrMHgxNGMvMHgxMDAwIFtub3V2ZWF1 XQo+ID4+Cj4gPj4gSG93IGlzIHR0bV9kbWFfdHQtPmRtYV9hZGRyZXNzIGFsbG9jYXRlZD8KPiA+ Cj4gPiBNaG0sIEkgbmVlZCB0byBkb3VibGUgY2hlY2sgaG93IEFHUCBpcyBzdXBwb3NlZCB0byB3 b3JrLgo+ID4KPiA+IFNpbmNlIGJhcmVseSBhbnlib2R5IGlzIHVzaW5nIGl0IHRoZXNlIGRheXMg aXQgaXMgc29tZXRoaW5nIHdoaWNoIAo+ID4gYnJlYWtzIGZyb20gdGltZSB0byB0aW1lLgo+IAo+ IEkgaGF2ZSBubyBpZGVhIGhvdyB0aGF0IGV2ZXIgd29ya2VkIGluIHRoZSBmaXJzdCBwbGFjZSBz aW5jZSBBR1AgaXNuJ3QgCj4gc3VwcG9zZWQgdG8gc3luYyBiZXR3ZWVuIENQVS9HUFUuIEV2ZXJ5 dGhpbmcgaXMgY29oZXJlbnQgZm9yIHRoYXQgY2FzZS4KPiAKPiBBbnl3YXkgaGVyZSBpcyBhIHBh dGNoIHdoaWNoIGFkZHMgYSBjaGVjayB0byB0aG9zZSBmdW5jdGlvbnMgaWYgdGhlIAo+IGRtYV9h ZGRyZXNzIGFycmF5IGlzIGFsbG9jYXRlZCBpbiB0aGUgZmlyc3QgcGxhY2UuIFBsZWFzZSB0ZXN0 IGl0LgoKVGhhbmtzLCB0aGUgcGF0Y2ggZml4ZXMgdGhlIHByb2JsZW0gYW5kIG5vdXZlYXUgbm93 IHdvcmtzIQpTaG91bGQgYmUgYXBwbGllZCB0byA1LjEyLXN0YWJsZSB0b28gKDUuMTEgaXMgYWZm ZWN0ZWQgdG9vIGJ1dCBFT0wpLgoKSXQncyB3ZWlyZCB0aGF0IGl0IHdvcmtlZCBiZWZvcmUuCkxv b2tzIGxpa2UgZG1hX2FkZHJlc3Mgd2FzIHVzZWQgdW5pbml0aWFsaXplZCAtIGl0IGNvbnRhaW5l ZCBzb21lIHJhbmRvbQpjcmFwOgpbICAgMTIuMjkzMzA0XSBub3V2ZWF1X2JvX3N5bmNfZm9yX2Rl dmljZTogdHRtX2RtYS0+ZG1hX2FkZHJlc3M9M2UwNTU5NzEgdHRtX2RtYS0+dHRtLm51bV9wYWdl cz0xOApbICAgMTIuMjkzMzIxXSB0dG1fZG1hLT5kbWFfYWRkcmVzc1swXT0weDAKWyAgIDEyLjI5 MzM0MV0gdHRtX2RtYS0+ZG1hX2FkZHJlc3NbMV09MHgwClsgICAxMi4yOTMzNjBdIHR0bV9kbWEt PmRtYV9hZGRyZXNzWzJdPTB4ZWU3Mjg5ODAKWyAgIDEyLjI5MzM3OV0gdHRtX2RtYS0+ZG1hX2Fk ZHJlc3NbM109MHhlZDFjYjEyMApbICAgMTIuMjkzMzk3XSB0dG1fZG1hLT5kbWFfYWRkcmVzc1s0 XT0weDEyClsgICAxMi4yOTM0MTZdIHR0bV9kbWEtPmRtYV9hZGRyZXNzWzVdPTB4MApbICAgMTIu MjkzNDM0XSB0dG1fZG1hLT5kbWFfYWRkcmVzc1s2XT0weDEKWyAgIDEyLjI5MzQ1M10gdHRtX2Rt YS0+ZG1hX2FkZHJlc3NbN109MHgwClsgICAxMi4yOTM0NzFdIHR0bV9kbWEtPmRtYV9hZGRyZXNz WzhdPTB4MTAwMDAKWyAgIDEyLjI5MzQ5MF0gdHRtX2RtYS0+ZG1hX2FkZHJlc3NbOV09MHgwClsg ICAxMi4yOTM1MTBdIHR0bV9kbWEtPmRtYV9hZGRyZXNzWzEwXT0weDEwMQpbICAgMTIuMjkzNTI4 XSB0dG1fZG1hLT5kbWFfYWRkcmVzc1sxMV09MHhlZTcyODllYwpbICAgMTIuMjkzNTQ2XSB0dG1f ZG1hLT5kbWFfYWRkcmVzc1sxMl09MHhlZTcyODllYwpbICAgMTIuMjkzNTY0XSB0dG1fZG1hLT5k bWFfYWRkcmVzc1sxM109MHgwClsgICAxMi4yOTM1ODFdIHR0bV9kbWEtPmRtYV9hZGRyZXNzWzE0 XT0weDAKWyAgIDEyLjI5MzU5OV0gdHRtX2RtYS0+ZG1hX2FkZHJlc3NbMTVdPTB4MApbICAgMTIu MjkzNjE2XSB0dG1fZG1hLT5kbWFfYWRkcmVzc1sxNl09MHgwClsgICAxMi4yOTM2MzRdIHR0bV9k bWEtPmRtYV9hZGRyZXNzWzE3XT0weDAKQnV0IGl0IGRpZCBub3QgbWF0dGVyIGFzIGRtYV9zeW5j X3NpbmdsZV9mb3JfZGV2aWNlIGlzIGEgbm8tb3AgaGVyZS4KV2hlbiBkbWFfYWRkcmVzcyBpcyBw cm9wZXJseSBpbml0aWFsaXplZCB0byBOVUxMLCBpdCBjcmFzaGVzLi4uCgo+IFRoYW5rcywKPiBD aHJpc3RpYW4uCj4gCj4gPgo+ID4gVGhhbmtzIGZvciB0aGUgYmFja3RyYWNlLAo+ID4gQ2hyaXN0 aWFuLgo+ID4KPiA+PiDCoCBJIGNhbm5vdCBmaW5kIGFueSBhc3NpZ25tZW50Cj4gPj4gZXhlY3V0 ZWQgKGluIHRoZSB3b3JraW5nIGNvZGUpOgo+ID4+Cj4gPj4gJCBnaXQgZ3JlcCBkbWFfYWRkcmVz c1wgPSBkcml2ZXJzL2dwdS8KPiA+PiBkcml2ZXJzL2dwdS9kcm0vYW1kL2FtZGdwdS9hbWRncHVf YW1ka2ZkX2dwdXZtLmM6IAo+ID4+IHNnLT5zZ2wtPmRtYV9hZGRyZXNzID0gYWRkcjsKPiA+PiBk cml2ZXJzL2dwdS9kcm0vYW1kL2FtZGdwdS9hbWRncHVfdHRtLmM6IGRtYV9hZGRyZXNzID0gCj4g Pj4gJmRtYS0+ZG1hX2FkZHJlc3Nbb2Zmc2V0ID4+IFBBR0VfU0hJRlRdOwo+ID4+IGRyaXZlcnMv Z3B1L2RybS9hbWQvYW1kZ3B1L2FtZGdwdV90dG0uYzogZG1hX2FkZHJlc3MgPSAKPiA+PiAobW1f bm9kZS0+c3RhcnQgPDwgUEFHRV9TSElGVCkgKyBvZmZzZXQ7Cj4gPj4gZHJpdmVycy9ncHUvZHJt L2k5MTUvZ3Z0L3NjaGVkdWxlci5jOsKgwqAgc2ctPmRtYV9hZGRyZXNzID0gYWRkcjsKPiA+PiBk cml2ZXJzL2dwdS9kcm0vaTkxNS9pOTE1X2dwdV9lcnJvci5jOsKgIHNnLT5kbWFfYWRkcmVzcyA9 IGl0Owo+ID4+IGRyaXZlcnMvZ3B1L2RybS90dG0vdHRtX3R0LmM6wqDCoCB0dG0tPmRtYV9hZGRy ZXNzID0gKHZvaWQgKikgCj4gPj4gKHR0bS0+dHRtLnBhZ2VzICsgdHRtLT50dG0ubnVtX3BhZ2Vz KTsKPiA+PiBkcml2ZXJzL2dwdS9kcm0vdHRtL3R0bV90dC5jOsKgwqAgdHRtLT5kbWFfYWRkcmVz cyA9IAo+ID4+IGt2bWFsbG9jX2FycmF5KHR0bS0+dHRtLm51bV9wYWdlcywKPiA+PiBkcml2ZXJz L2dwdS9kcm0vdHRtL3R0bV90dC5jOsKgwqAgdHRtX2RtYS0+ZG1hX2FkZHJlc3MgPSBOVUxMOwo+ ID4+IGRyaXZlcnMvZ3B1L2RybS92bXdnZngvdm13Z2Z4X3R0bV9idWZmZXIuYzogdml0ZXItPmRt YV9hZGRyZXNzID0gCj4gPj4gJl9fdm13X3BpdGVyX3BoeXNfYWRkcjsKPiA+PiBkcml2ZXJzL2dw dS9kcm0vdm13Z2Z4L3Ztd2dmeF90dG1fYnVmZmVyLmM6IHZpdGVyLT5kbWFfYWRkcmVzcyA9IAo+ ID4+ICZfX3Ztd19waXRlcl9kbWFfYWRkcjsKPiA+PiBkcml2ZXJzL2dwdS9kcm0vdm13Z2Z4L3Zt d2dmeF90dG1fYnVmZmVyLmM6IHZpdGVyLT5kbWFfYWRkcmVzcyA9IAo+ID4+ICZfX3Ztd19waXRl cl9zZ19hZGRyOwo+ID4+Cj4gPj4gVGhlIDIgY2FzZXMgaW4gdHRtX3R0LmMgYXJlIGluIHR0bV9k bWFfdHRfYWxsb2NfcGFnZV9kaXJlY3RvcnkoKSBhbmQKPiA+PiB0dG1fc2dfdHRfYWxsb2NfcGFn ZV9kaXJlY3RvcnkoKS4KPiA+PiBDb25maXJtZWQgYnkgYWRkaW5nIHByaW50aygpcyB0aGF0IHRo ZXkncmUgTk9UIGNhbGxlZC4KPiA+Pgo+ID4+Cj4gPgo+IAo+IAoKCi0tIApPbmRyZWogWmFyeQpf X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fXwpOb3V2ZWF1IG1h aWxpbmcgbGlzdApOb3V2ZWF1QGxpc3RzLmZyZWVkZXNrdG9wLm9yZwpodHRwczovL2xpc3RzLmZy ZWVkZXNrdG9wLm9yZy9tYWlsbWFuL2xpc3RpbmZvL25vdXZlYXUK From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-3.8 required=3.0 tests=BAYES_00, HEADER_FROM_DIFFERENT_DOMAINS,MAILING_LIST_MULTI,NICE_REPLY_A,SPF_HELO_NONE, SPF_PASS autolearn=no autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 48395C48BD1 for ; Fri, 11 Jun 2021 18:23:22 +0000 (UTC) Received: from gabe.freedesktop.org (gabe.freedesktop.org [131.252.210.177]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPS id E93B9613AE for ; Fri, 11 Jun 2021 18:23:21 +0000 (UTC) DMARC-Filter: OpenDMARC Filter v1.3.2 mail.kernel.org E93B9613AE Authentication-Results: mail.kernel.org; dmarc=none (p=none dis=none) header.from=zary.sk Authentication-Results: mail.kernel.org; spf=none smtp.mailfrom=dri-devel-bounces@lists.freedesktop.org Received: from gabe.freedesktop.org (localhost [127.0.0.1]) by gabe.freedesktop.org (Postfix) with ESMTP id B8A086F3BE; Fri, 11 Jun 2021 18:23:18 +0000 (UTC) Received: from hosting.gsystem.sk (hosting.gsystem.sk [212.5.213.30]) by gabe.freedesktop.org (Postfix) with ESMTP id 5B3A66F3B3; Fri, 11 Jun 2021 18:23:17 +0000 (UTC) Received: from [192.168.0.2] (unknown [188.167.68.178]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by hosting.gsystem.sk (Postfix) with ESMTPSA id F2EDD7A024A; Fri, 11 Jun 2021 20:23:13 +0200 (CEST) From: Ondrej Zary To: Christian =?utf-8?q?K=C3=B6nig?= Subject: Re: nouveau broken on Riva TNT2 in 5.13.0-rc4: NULL pointer dereference in nouveau_bo_sync_for_device Date: Fri, 11 Jun 2021 20:23:10 +0200 User-Agent: KMail/1.9.10 References: <202106052143.52488.linux@zary.sk> <4b4248d8-b708-3832-7fe3-2a9fd2c2311e@amd.com> In-Reply-To: <4b4248d8-b708-3832-7fe3-2a9fd2c2311e@amd.com> X-KMail-QuotePrefix: > MIME-Version: 1.0 Content-Type: Text/Plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Content-Disposition: inline Message-Id: <202106112023.11270.linux@zary.sk> X-BeenThere: dri-devel@lists.freedesktop.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Direct Rendering Infrastructure - Development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Cc: nouveau@lists.freedesktop.org, Ben Skeggs , dri-devel@lists.freedesktop.org, linux-kernel@vger.kernel.org Errors-To: dri-devel-bounces@lists.freedesktop.org Sender: "dri-devel" On Friday 11 June 2021 14:38:18 Christian K=C3=B6nig wrote: >=20 > Am 10.06.21 um 19:59 schrieb Christian K=C3=B6nig: > > Am 10.06.21 um 19:50 schrieb Ondrej Zary: > >> [SNIP] > >>> I can't see how this is called from the nouveau code, only=20 > >>> possibility I > >>> see is that it is maybe called through the AGP code somehow. > >> Yes, you're right: > >> [=C2=A0=C2=A0 13.192663] Call Trace: > >> [=C2=A0=C2=A0 13.192678]=C2=A0 dump_stack+0x54/0x68 > >> [=C2=A0=C2=A0 13.192690]=C2=A0 ttm_tt_init+0x11/0x8a [ttm] > >> [=C2=A0=C2=A0 13.192699]=C2=A0 ttm_agp_tt_create+0x39/0x51 [ttm] > >> [=C2=A0=C2=A0 13.192840]=C2=A0 nouveau_ttm_tt_create+0x17/0x22 [nouvea= u] > >> [=C2=A0=C2=A0 13.192856]=C2=A0 ttm_tt_create+0x78/0x8c [ttm] > >> [=C2=A0=C2=A0 13.192864]=C2=A0 ttm_bo_handle_move_mem+0x7d/0xca [ttm] > >> [=C2=A0=C2=A0 13.192873]=C2=A0 ttm_bo_validate+0x92/0xc8 [ttm] > >> [=C2=A0=C2=A0 13.192883]=C2=A0 ttm_bo_init_reserved+0x216/0x243 [ttm] > >> [=C2=A0=C2=A0 13.192892]=C2=A0 ttm_bo_init+0x45/0x65 [ttm] > >> [=C2=A0=C2=A0 13.193018]=C2=A0 ? nouveau_bo_del_io_reserve_lru+0x48/0x= 48 [nouveau] > >> [=C2=A0=C2=A0 13.193150]=C2=A0 nouveau_bo_init+0x8c/0x94 [nouveau] > >> [=C2=A0=C2=A0 13.193273]=C2=A0 ? nouveau_bo_del_io_reserve_lru+0x48/0x= 48 [nouveau] > >> [=C2=A0=C2=A0 13.193407]=C2=A0 nouveau_bo_new+0x44/0x57 [nouveau] > >> [=C2=A0=C2=A0 13.193537]=C2=A0 nouveau_channel_prep+0xa3/0x269 [nouvea= u] > >> [=C2=A0=C2=A0 13.193665]=C2=A0 nouveau_channel_new+0x3c/0x5f7 [nouveau] > >> [=C2=A0=C2=A0 13.193679]=C2=A0 ? slab_free_freelist_hook+0x3b/0xa7 > >> [=C2=A0=C2=A0 13.193686]=C2=A0 ? kfree+0x9e/0x11a > >> [=C2=A0=C2=A0 13.193781]=C2=A0 ? nvif_object_sclass_put+0xd/0x16 [nouv= eau] > >> [=C2=A0=C2=A0 13.193908]=C2=A0 nouveau_drm_device_init+0x2e2/0x646 [no= uveau] > >> [=C2=A0=C2=A0 13.193924]=C2=A0 ? pci_enable_device_flags+0x1e/0xac > >> [=C2=A0=C2=A0 13.194052]=C2=A0 nouveau_drm_probe+0xeb/0x188 [nouveau] > >> [=C2=A0=C2=A0 13.194182]=C2=A0 ? nouveau_drm_device_init+0x646/0x646 [= nouveau] > >> [=C2=A0=C2=A0 13.194195]=C2=A0 pci_device_probe+0x89/0xe9 > >> [=C2=A0=C2=A0 13.194205]=C2=A0 really_probe+0x127/0x2a7 > >> [=C2=A0=C2=A0 13.194212]=C2=A0 driver_probe_device+0x5b/0x87 > >> [=C2=A0=C2=A0 13.194219]=C2=A0 device_driver_attach+0x2e/0x41 > >> [=C2=A0=C2=A0 13.194226]=C2=A0 __driver_attach+0x7c/0x83 > >> [=C2=A0=C2=A0 13.194232]=C2=A0 bus_for_each_dev+0x4c/0x66 > >> [=C2=A0=C2=A0 13.194238]=C2=A0 driver_attach+0x14/0x16 > >> [=C2=A0=C2=A0 13.194244]=C2=A0 ? device_driver_attach+0x41/0x41 > >> [=C2=A0=C2=A0 13.194251]=C2=A0 bus_add_driver+0xc5/0x16c > >> [=C2=A0=C2=A0 13.194258]=C2=A0 driver_register+0x87/0xb9 > >> [=C2=A0=C2=A0 13.194265]=C2=A0 __pci_register_driver+0x38/0x3b > >> [=C2=A0=C2=A0 13.194271]=C2=A0 ? 0xf0c0d000 > >> [=C2=A0=C2=A0 13.194362]=C2=A0 nouveau_drm_init+0x14c/0x1000 [nouveau] > >> > >> How is ttm_dma_tt->dma_address allocated? > > > > Mhm, I need to double check how AGP is supposed to work. > > > > Since barely anybody is using it these days it is something which=20 > > breaks from time to time. >=20 > I have no idea how that ever worked in the first place since AGP isn't=20 > supposed to sync between CPU/GPU. Everything is coherent for that case. >=20 > Anyway here is a patch which adds a check to those functions if the=20 > dma_address array is allocated in the first place. Please test it. Thanks, the patch fixes the problem and nouveau now works! Should be applied to 5.12-stable too (5.11 is affected too but EOL). It's weird that it worked before. Looks like dma_address was used uninitialized - it contained some random crap: [ 12.293304] nouveau_bo_sync_for_device: ttm_dma->dma_address=3D3e055971 = ttm_dma->ttm.num_pages=3D18 [ 12.293321] ttm_dma->dma_address[0]=3D0x0 [ 12.293341] ttm_dma->dma_address[1]=3D0x0 [ 12.293360] ttm_dma->dma_address[2]=3D0xee728980 [ 12.293379] ttm_dma->dma_address[3]=3D0xed1cb120 [ 12.293397] ttm_dma->dma_address[4]=3D0x12 [ 12.293416] ttm_dma->dma_address[5]=3D0x0 [ 12.293434] ttm_dma->dma_address[6]=3D0x1 [ 12.293453] ttm_dma->dma_address[7]=3D0x0 [ 12.293471] ttm_dma->dma_address[8]=3D0x10000 [ 12.293490] ttm_dma->dma_address[9]=3D0x0 [ 12.293510] ttm_dma->dma_address[10]=3D0x101 [ 12.293528] ttm_dma->dma_address[11]=3D0xee7289ec [ 12.293546] ttm_dma->dma_address[12]=3D0xee7289ec [ 12.293564] ttm_dma->dma_address[13]=3D0x0 [ 12.293581] ttm_dma->dma_address[14]=3D0x0 [ 12.293599] ttm_dma->dma_address[15]=3D0x0 [ 12.293616] ttm_dma->dma_address[16]=3D0x0 [ 12.293634] ttm_dma->dma_address[17]=3D0x0 But it did not matter as dma_sync_single_for_device is a no-op here. When dma_address is properly initialized to NULL, it crashes... > Thanks, > Christian. >=20 > > > > Thanks for the backtrace, > > Christian. > > > >> =C2=A0 I cannot find any assignment > >> executed (in the working code): > >> > >> $ git grep dma_address\ =3D drivers/gpu/ > >> drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd_gpuvm.c:=20 > >> sg->sgl->dma_address =3D addr; > >> drivers/gpu/drm/amd/amdgpu/amdgpu_ttm.c: dma_address =3D=20 > >> &dma->dma_address[offset >> PAGE_SHIFT]; > >> drivers/gpu/drm/amd/amdgpu/amdgpu_ttm.c: dma_address =3D=20 > >> (mm_node->start << PAGE_SHIFT) + offset; > >> drivers/gpu/drm/i915/gvt/scheduler.c:=C2=A0=C2=A0 sg->dma_address =3D = addr; > >> drivers/gpu/drm/i915/i915_gpu_error.c:=C2=A0 sg->dma_address =3D it; > >> drivers/gpu/drm/ttm/ttm_tt.c:=C2=A0=C2=A0 ttm->dma_address =3D (void *= )=20 > >> (ttm->ttm.pages + ttm->ttm.num_pages); > >> drivers/gpu/drm/ttm/ttm_tt.c:=C2=A0=C2=A0 ttm->dma_address =3D=20 > >> kvmalloc_array(ttm->ttm.num_pages, > >> drivers/gpu/drm/ttm/ttm_tt.c:=C2=A0=C2=A0 ttm_dma->dma_address =3D NUL= L; > >> drivers/gpu/drm/vmwgfx/vmwgfx_ttm_buffer.c: viter->dma_address =3D=20 > >> &__vmw_piter_phys_addr; > >> drivers/gpu/drm/vmwgfx/vmwgfx_ttm_buffer.c: viter->dma_address =3D=20 > >> &__vmw_piter_dma_addr; > >> drivers/gpu/drm/vmwgfx/vmwgfx_ttm_buffer.c: viter->dma_address =3D=20 > >> &__vmw_piter_sg_addr; > >> > >> The 2 cases in ttm_tt.c are in ttm_dma_tt_alloc_page_directory() and > >> ttm_sg_tt_alloc_page_directory(). > >> Confirmed by adding printk()s that they're NOT called. > >> > >> > > >=20 >=20 =2D-=20 Ondrej Zary From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-3.8 required=3.0 tests=BAYES_00, HEADER_FROM_DIFFERENT_DOMAINS,MAILING_LIST_MULTI,NICE_REPLY_A,SPF_HELO_NONE, SPF_PASS autolearn=no autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id F3B88C48BD1 for ; Fri, 11 Jun 2021 18:23:17 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by mail.kernel.org (Postfix) with ESMTP id D28A7613D9 for ; Fri, 11 Jun 2021 18:23:17 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S231264AbhFKSZO convert rfc822-to-8bit (ORCPT ); Fri, 11 Jun 2021 14:25:14 -0400 Received: from hosting.gsystem.sk ([212.5.213.30]:51094 "EHLO hosting.gsystem.sk" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S231209AbhFKSZN (ORCPT ); Fri, 11 Jun 2021 14:25:13 -0400 Received: from [192.168.0.2] (unknown [188.167.68.178]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by hosting.gsystem.sk (Postfix) with ESMTPSA id F2EDD7A024A; Fri, 11 Jun 2021 20:23:13 +0200 (CEST) From: Ondrej Zary To: Christian =?utf-8?q?K=C3=B6nig?= Subject: Re: nouveau broken on Riva TNT2 in 5.13.0-rc4: NULL pointer dereference in nouveau_bo_sync_for_device Date: Fri, 11 Jun 2021 20:23:10 +0200 User-Agent: KMail/1.9.10 Cc: Ben Skeggs , dri-devel@lists.freedesktop.org, nouveau@lists.freedesktop.org, linux-kernel@vger.kernel.org References: <202106052143.52488.linux@zary.sk> <4b4248d8-b708-3832-7fe3-2a9fd2c2311e@amd.com> In-Reply-To: <4b4248d8-b708-3832-7fe3-2a9fd2c2311e@amd.com> X-KMail-QuotePrefix: > MIME-Version: 1.0 Content-Type: Text/Plain; charset="utf-8" Content-Transfer-Encoding: 8BIT Content-Disposition: inline Message-Id: <202106112023.11270.linux@zary.sk> Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org On Friday 11 June 2021 14:38:18 Christian König wrote: > > Am 10.06.21 um 19:59 schrieb Christian König: > > Am 10.06.21 um 19:50 schrieb Ondrej Zary: > >> [SNIP] > >>> I can't see how this is called from the nouveau code, only > >>> possibility I > >>> see is that it is maybe called through the AGP code somehow. > >> Yes, you're right: > >> [   13.192663] Call Trace: > >> [   13.192678]  dump_stack+0x54/0x68 > >> [   13.192690]  ttm_tt_init+0x11/0x8a [ttm] > >> [   13.192699]  ttm_agp_tt_create+0x39/0x51 [ttm] > >> [   13.192840]  nouveau_ttm_tt_create+0x17/0x22 [nouveau] > >> [   13.192856]  ttm_tt_create+0x78/0x8c [ttm] > >> [   13.192864]  ttm_bo_handle_move_mem+0x7d/0xca [ttm] > >> [   13.192873]  ttm_bo_validate+0x92/0xc8 [ttm] > >> [   13.192883]  ttm_bo_init_reserved+0x216/0x243 [ttm] > >> [   13.192892]  ttm_bo_init+0x45/0x65 [ttm] > >> [   13.193018]  ? nouveau_bo_del_io_reserve_lru+0x48/0x48 [nouveau] > >> [   13.193150]  nouveau_bo_init+0x8c/0x94 [nouveau] > >> [   13.193273]  ? nouveau_bo_del_io_reserve_lru+0x48/0x48 [nouveau] > >> [   13.193407]  nouveau_bo_new+0x44/0x57 [nouveau] > >> [   13.193537]  nouveau_channel_prep+0xa3/0x269 [nouveau] > >> [   13.193665]  nouveau_channel_new+0x3c/0x5f7 [nouveau] > >> [   13.193679]  ? slab_free_freelist_hook+0x3b/0xa7 > >> [   13.193686]  ? kfree+0x9e/0x11a > >> [   13.193781]  ? nvif_object_sclass_put+0xd/0x16 [nouveau] > >> [   13.193908]  nouveau_drm_device_init+0x2e2/0x646 [nouveau] > >> [   13.193924]  ? pci_enable_device_flags+0x1e/0xac > >> [   13.194052]  nouveau_drm_probe+0xeb/0x188 [nouveau] > >> [   13.194182]  ? nouveau_drm_device_init+0x646/0x646 [nouveau] > >> [   13.194195]  pci_device_probe+0x89/0xe9 > >> [   13.194205]  really_probe+0x127/0x2a7 > >> [   13.194212]  driver_probe_device+0x5b/0x87 > >> [   13.194219]  device_driver_attach+0x2e/0x41 > >> [   13.194226]  __driver_attach+0x7c/0x83 > >> [   13.194232]  bus_for_each_dev+0x4c/0x66 > >> [   13.194238]  driver_attach+0x14/0x16 > >> [   13.194244]  ? device_driver_attach+0x41/0x41 > >> [   13.194251]  bus_add_driver+0xc5/0x16c > >> [   13.194258]  driver_register+0x87/0xb9 > >> [   13.194265]  __pci_register_driver+0x38/0x3b > >> [   13.194271]  ? 0xf0c0d000 > >> [   13.194362]  nouveau_drm_init+0x14c/0x1000 [nouveau] > >> > >> How is ttm_dma_tt->dma_address allocated? > > > > Mhm, I need to double check how AGP is supposed to work. > > > > Since barely anybody is using it these days it is something which > > breaks from time to time. > > I have no idea how that ever worked in the first place since AGP isn't > supposed to sync between CPU/GPU. Everything is coherent for that case. > > Anyway here is a patch which adds a check to those functions if the > dma_address array is allocated in the first place. Please test it. Thanks, the patch fixes the problem and nouveau now works! Should be applied to 5.12-stable too (5.11 is affected too but EOL). It's weird that it worked before. Looks like dma_address was used uninitialized - it contained some random crap: [ 12.293304] nouveau_bo_sync_for_device: ttm_dma->dma_address=3e055971 ttm_dma->ttm.num_pages=18 [ 12.293321] ttm_dma->dma_address[0]=0x0 [ 12.293341] ttm_dma->dma_address[1]=0x0 [ 12.293360] ttm_dma->dma_address[2]=0xee728980 [ 12.293379] ttm_dma->dma_address[3]=0xed1cb120 [ 12.293397] ttm_dma->dma_address[4]=0x12 [ 12.293416] ttm_dma->dma_address[5]=0x0 [ 12.293434] ttm_dma->dma_address[6]=0x1 [ 12.293453] ttm_dma->dma_address[7]=0x0 [ 12.293471] ttm_dma->dma_address[8]=0x10000 [ 12.293490] ttm_dma->dma_address[9]=0x0 [ 12.293510] ttm_dma->dma_address[10]=0x101 [ 12.293528] ttm_dma->dma_address[11]=0xee7289ec [ 12.293546] ttm_dma->dma_address[12]=0xee7289ec [ 12.293564] ttm_dma->dma_address[13]=0x0 [ 12.293581] ttm_dma->dma_address[14]=0x0 [ 12.293599] ttm_dma->dma_address[15]=0x0 [ 12.293616] ttm_dma->dma_address[16]=0x0 [ 12.293634] ttm_dma->dma_address[17]=0x0 But it did not matter as dma_sync_single_for_device is a no-op here. When dma_address is properly initialized to NULL, it crashes... > Thanks, > Christian. > > > > > Thanks for the backtrace, > > Christian. > > > >>   I cannot find any assignment > >> executed (in the working code): > >> > >> $ git grep dma_address\ = drivers/gpu/ > >> drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd_gpuvm.c: > >> sg->sgl->dma_address = addr; > >> drivers/gpu/drm/amd/amdgpu/amdgpu_ttm.c: dma_address = > >> &dma->dma_address[offset >> PAGE_SHIFT]; > >> drivers/gpu/drm/amd/amdgpu/amdgpu_ttm.c: dma_address = > >> (mm_node->start << PAGE_SHIFT) + offset; > >> drivers/gpu/drm/i915/gvt/scheduler.c:   sg->dma_address = addr; > >> drivers/gpu/drm/i915/i915_gpu_error.c:  sg->dma_address = it; > >> drivers/gpu/drm/ttm/ttm_tt.c:   ttm->dma_address = (void *) > >> (ttm->ttm.pages + ttm->ttm.num_pages); > >> drivers/gpu/drm/ttm/ttm_tt.c:   ttm->dma_address = > >> kvmalloc_array(ttm->ttm.num_pages, > >> drivers/gpu/drm/ttm/ttm_tt.c:   ttm_dma->dma_address = NULL; > >> drivers/gpu/drm/vmwgfx/vmwgfx_ttm_buffer.c: viter->dma_address = > >> &__vmw_piter_phys_addr; > >> drivers/gpu/drm/vmwgfx/vmwgfx_ttm_buffer.c: viter->dma_address = > >> &__vmw_piter_dma_addr; > >> drivers/gpu/drm/vmwgfx/vmwgfx_ttm_buffer.c: viter->dma_address = > >> &__vmw_piter_sg_addr; > >> > >> The 2 cases in ttm_tt.c are in ttm_dma_tt_alloc_page_directory() and > >> ttm_sg_tt_alloc_page_directory(). > >> Confirmed by adding printk()s that they're NOT called. > >> > >> > > > > -- Ondrej Zary