Nouveau - Jan 2016 - [Bug 93778] New: Noveau GeForce GT 640M vbios error

https://bugs.freedesktop.org/show_bug.cgi?id=93778

            Bug ID: 93778
           Summary: Noveau GeForce GT 640M vbios error
           Product: xorg
           Version: unspecified
          Hardware: x86-64 (AMD64)
                OS: Linux (All)
            Status: NEW
          Severity: normal
          Priority: medium
         Component: Driver/nouveau
          Assignee: nouveau at lists.freedesktop.org
          Reporter: lahs8353 at yahoo.com
        QA Contact: xorg-team at lists.x.org

Created attachment 121140
  --> https://bugs.freedesktop.org/attachment.cgi?id=121140&action=edit
acpidump

Noveau fails to load, yielding error messages in dmesg suggesting problems with
vbios:
nouveau: probe of 0000:01:00.0 failed with error -22
[   17.520208] nouveau 0000:01:00.0: devinit: 0x9b29[0]: unknown opcode 0x00

-- 
You are receiving this mail because:
You are the assignee for the bug.
-------------- next part --------------
An HTML attachment was scrubbed...
URL:
<http://lists.freedesktop.org/archives/nouveau/attachments/20160119/fcd772a3/attachment.html>

https://bugs.freedesktop.org/show_bug.cgi?id=93778

Ilia Mirkin <imirkin at alum.mit.edu> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
            Summary|Noveau GeForce GT 640M      |[NVE7] Noveau GeForce GT
                   |vbios error                 |640M vbios error

--- Comment #1 from Ilia Mirkin <imirkin at alum.mit.edu> ---
I think the issue is a buggy _ROM method. Instead of Add (Arg0, Arg1, Local2)
it should be Add(Local0, Local1, Local2) :(

It clamps the read length to 0x1000, which is common. But then it goes ahead
and sets the length to the total length - offset if the offset + original
length (not the clamped length) is too big. No idea how negatives are handled
in ACPI either.

Our first request is offset = 0, length = 0x1000, so that should be good.
However our second request is offset = 0x1000 length = round_up(remainder,
0x1000). I think this will hit the issue outlined above. Instead of the length
being clamped to 0x1000, it will determine that we're overflowing and reset
the
length to total - offset, which will be way bigger than 0x1000. Since it has
the vbios data in multiple 32K regions, this won't return the correct data.

Ben, thoughts on how to detect this?

    Scope (\_SB.PCI0.PEG0.PEGP)
    {
        OperationRegion (VBOR, SystemMemory, 0x9AF9C018, 0x00016004)
        Field (VBOR, DWordAcc, Lock, Preserve)
        {
            RVBS,   32, 
            VBS1,   262144, 
            VBS2,   262144, 
            VBS3,   196608, 
            VBS4,   0
        }
    }


        Method (_ROM, 2, NotSerialized)  // _ROM: Read-Only Memory
        {
            Store (Arg0, Local0)
            Store (Arg1, Local1)
            Name (VROM, Buffer (Local1)
            {
                 0x00                                             /* . */
            })
            If (LGreater (Local1, 0x1000))
            {
                Store (0x1000, Local1)
            }

            If (LGreater (Arg0, RVBS))
            {
                Return (VROM) /* \_SB_.PCI0.PEG0.PEGP._ROM.VROM */
            }

            Add (Arg0, Arg1, Local2)
            If (LGreater (Local2, RVBS))
            {
                Subtract (RVBS, Local0, Local1)
            }

            If (LLess (Local0, 0x8000))
            {
                Mid (VBS1, Local0, Local1, VROM) /*
\_SB_.PCI0.PEG0.PEGP._ROM.VROM */
            }
            Else
            {
                Subtract (Local0, 0x8000, Local0)
                If (LLess (Local0, 0x8000))
                {
                    Mid (VBS2, Local0, Local1, VROM) /*
\_SB_.PCI0.PEG0.PEGP._ROM.VROM */
                }
                Else
                {
                    Subtract (Local0, 0x8000, Local0)
                    If (LLess (Local0, 0x8000))
                    {
                        Mid (VBS3, Local0, Local1, VROM) /*
\_SB_.PCI0.PEG0.PEGP._ROM.VROM */
                    }
                    Else
                    {
                        Subtract (Local0, 0x8000, Local0)
                        If (LLess (Local0, 0x8000))
                        {
                            Mid (VBS4, Local0, Local1, VROM) /*
\_SB_.PCI0.PEG0.PEGP._ROM.VROM */
                        }
                    }
                }
            }

            Return (VROM) /* \_SB_.PCI0.PEG0.PEGP._ROM.VROM */
        }

-- 
You are receiving this mail because:
You are the assignee for the bug.
-------------- next part --------------
An HTML attachment was scrubbed...
URL:
<http://lists.freedesktop.org/archives/nouveau/attachments/20160119/3acaa6a5/attachment.html>

https://bugs.freedesktop.org/show_bug.cgi?id=93778

--- Comment #2 from Ilia Mirkin <imirkin at alum.mit.edu> ---
Over IRC, the OP reported that commenting out the fast acpi method does indeed
make nouveau load properly.

-- 
You are receiving this mail because:
You are the assignee for the bug.
-------------- next part --------------
An HTML attachment was scrubbed...
URL:
<http://lists.freedesktop.org/archives/nouveau/attachments/20160120/4a4fef1c/attachment.html>

https://bugs.freedesktop.org/show_bug.cgi?id=93778

--- Comment #3 from Marcel S. <me at marcel-sander.eu> ---
Created attachment 128903
  --> https://bugs.freedesktop.org/attachment.cgi?id=128903&action=edit
Extracted using kernel 3.16

Nouveau works successfully on kernel 3.16.
I copied the bios from /sys/kernel/debug/dri/1/vbios.rom.

-- 
You are receiving this mail because:
You are the assignee for the bug.
-------------- next part --------------
An HTML attachment was scrubbed...
URL:
<https://lists.freedesktop.org/archives/nouveau/attachments/20170111/b8fa3a13/attachment.html>

https://bugs.freedesktop.org/show_bug.cgi?id=93778

Ilia Mirkin <imirkin at alum.mit.edu> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
         Resolution|---                         |FIXED
             Status|NEW                         |RESOLVED

--- Comment #4 from Ilia Mirkin <imirkin at alum.mit.edu> ---
This bug was fixed by 5dc7f4aa9d84ea94b54a9bfcef095f0289f1ebda, part of kernel
4.10-rc1 (and potentially some earlier commits also addressed this). Should
backport pretty cleanly.

Pawel, if you still have issues, please reopen. If ANYONE OTHER THAN Pawel has
issues that look like this, open a fresh issue.

-- 
You are receiving this mail because:
You are the assignee for the bug.
-------------- next part --------------
An HTML attachment was scrubbed...
URL:
<https://lists.freedesktop.org/archives/nouveau/attachments/20170111/91175b68/attachment-0001.html>