Nouveau - Apr 2016 - [Bug 94803] New: nouveau bug crashes kernel 4.4.6 on warm boot

https://bugs.freedesktop.org/show_bug.cgi?id=94803

            Bug ID: 94803
           Summary: nouveau bug crashes kernel 4.4.6 on warm boot
           Product: xorg
           Version: unspecified
          Hardware: Other
                OS: All
            Status: NEW
          Severity: normal
          Priority: medium
         Component: Driver/nouveau
          Assignee: nouveau at lists.freedesktop.org
          Reporter: mic.daum at gmx.de
        QA Contact: xorg-team at lists.x.org

Created attachment 122684
  --> https://bugs.freedesktop.org/attachment.cgi?id=122684&action=edit
picture from stack trace taken with camera

Whenever doing a warm boot (reboot), kernel 4.4.6 crashes showing the stack
trace in the attached picture. The kernel boots fine when doing a cold start or
after pressing the reset button.

The GPU in question is a "PNY Quadro FX 580" (Tesla / G96) with two
attached
monitors, both connected on display port.

The crash happens quite early when the kernel sets mode on the framebuffer.
Resolution is set to 1920x1200 px, 240x75 cols/lines.

attached:

picture of the screen showing the stack trace
dump of "nv50_disp_intr_supervisor" function from the 4.4.6 vmlinux

-- 
You are receiving this mail because:
You are the assignee for the bug.
-------------- next part --------------
An HTML attachment was scrubbed...
URL:
<https://lists.freedesktop.org/archives/nouveau/attachments/20160402/d314d66f/attachment.html>

https://bugs.freedesktop.org/show_bug.cgi?id=94803

--- Comment #1 from Michael Daum <mic.daum at gmx.de> ---
Created attachment 122685
  --> https://bugs.freedesktop.org/attachment.cgi?id=122685&action=edit
dump of the nv50_disp_intr_supervisor function

-- 
You are receiving this mail because:
You are the assignee for the bug.
-------------- next part --------------
An HTML attachment was scrubbed...
URL:
<https://lists.freedesktop.org/archives/nouveau/attachments/20160402/65f1a618/attachment.html>

https://bugs.freedesktop.org/show_bug.cgi?id=94803

Ilia Mirkin <imirkin at alum.mit.edu> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
 Attachment #122684|text/plain                  |image/jpeg
          mime type|                            |

-- 
You are receiving this mail because:
You are the assignee for the bug.
-------------- next part --------------
An HTML attachment was scrubbed...
URL:
<https://lists.freedesktop.org/archives/nouveau/attachments/20160402/508f80a9/attachment.html>

https://bugs.freedesktop.org/show_bug.cgi?id=94803

--- Comment #2 from Ilia Mirkin <imirkin at alum.mit.edu> ---
0x80c (2060) looks like this:

   0xffffffff814daf32 <+2050>:    xor    %edx,%edx
   0xffffffff814daf34 <+2052>:    mov    %rax,%rdi
   0xffffffff814daf37 <+2055>:    mov    $0xc,%eax
   0xffffffff814daf3c <+2060>:    divl   -0x88(%rbp)

which has gotta come from

nv50_disp_intr_unk20_2_dp(...) {

    u32 dpctrl = nvkm_rd32(device, 0x61c10c + loff);
    link_nr = hweight32(dpctrl & 0x000f0000);

...

     value = value - (3 * !!(dpctrl & 0x00004000)) - (12 / link_nr);

Which means that on boot link_nr is 0. Michael, if you're up for some kernel
patching, can you just add a

if (!link_nr) {
  nvkm_error(subdev, "link_nr = 0; dpctrl: %08x\n", dpctrl);
  return;
}

right after the link_nr assignment in that function?

-- 
You are receiving this mail because:
You are the assignee for the bug.
-------------- next part --------------
An HTML attachment was scrubbed...
URL:
<https://lists.freedesktop.org/archives/nouveau/attachments/20160402/f8baa111/attachment.html>

https://bugs.freedesktop.org/show_bug.cgi?id=94803

--- Comment #3 from Michael Daum <mic.daum at gmx.de> ---
The patch from Ilia prevents the kernel from crashing. Reboot does not fail any
longer. Additionally _most_ of the time both monitors come up at reboot.

But on some reboots one of the monitors stays black and the kernel logs
following error (from dmesg):

[    0.955154] nouveau 0000:01:00.0: disp: outp 04:0006:0384: link training
failed
[    0.973972] nouveau 0000:01:00.0: disp: outp 04:0006:0384: link training
failed
[    0.974279] nouveau 0000:01:00.0: disp: link_nr = 0; dpctrl: 00401101


The value of dpctrl is always the same (00401101) then.

-- 
You are receiving this mail because:
You are the assignee for the bug.
-------------- next part --------------
An HTML attachment was scrubbed...
URL:
<https://lists.freedesktop.org/archives/nouveau/attachments/20160403/96ee41f6/attachment.html>

https://bugs.freedesktop.org/show_bug.cgi?id=94803

Martin Peres <martin.peres at free.fr> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
         Resolution|---                         |MOVED
             Status|NEW                         |RESOLVED

--- Comment #4 from Martin Peres <martin.peres at free.fr> ---
-- GitLab Migration Automatic Message --

This bug has been migrated to freedesktop.org's GitLab instance and has been
closed from further activity.

You can subscribe and participate further through the new bug through this link
to our GitLab instance:
https://gitlab.freedesktop.org/xorg/driver/xf86-video-nouveau/issues/259.

-- 
You are receiving this mail because:
You are the assignee for the bug.
-------------- next part --------------
An HTML attachment was scrubbed...
URL:
<https://lists.freedesktop.org/archives/nouveau/attachments/20191204/77d99ac6/attachment.html>