search for: map_sg_tabl

.../drivers/gpu/drm/nouveau/core/subdev/vm/base.c b/drivers/gpu/drm/nouveau/core/subdev/vm/base.c > > index ef3133e..5833851 100644 > > --- a/drivers/gpu/drm/nouveau/core/subdev/vm/base.c > > +++ b/drivers/gpu/drm/nouveau/core/subdev/vm/base.c > > @@ -84,10 +84,11 @@ nouveau_vm_map_sg_table(struct nouveau_vma *vma, u64 delta, u64 length, > > { > > struct nouveau_vm *vm = vma->vm; > > struct nouveau_vmmgr *vmm = vm->vmm; > > - int big = vma->node->type != vmm->spg_shift; > > + u32 shift = vma->node->type; > > + int big = sh...

.../nouveau/core/subdev/vm/base.c b/drivers/gpu/drm/nouveau/core/subdev/vm/base.c >> > index ef3133e..5833851 100644 >> > --- a/drivers/gpu/drm/nouveau/core/subdev/vm/base.c >> > +++ b/drivers/gpu/drm/nouveau/core/subdev/vm/base.c >> > @@ -84,10 +84,11 @@ nouveau_vm_map_sg_table(struct nouveau_vma *vma, u64 delta, u64 length, >> > { >> > struct nouveau_vm *vm = vma->vm; >> > struct nouveau_vmmgr *vmm = vm->vmm; >> > - int big = vma->node->type != vmm->spg_shift; >> > + u32 shift = vma->node->ty...

...<< NVDEV_ENGINE_GR) | diff --git a/drivers/gpu/drm/nouveau/core/subdev/vm/base.c b/drivers/gpu/drm/nouveau/core/subdev/vm/base.c index ef3133e..5833851 100644 --- a/drivers/gpu/drm/nouveau/core/subdev/vm/base.c +++ b/drivers/gpu/drm/nouveau/core/subdev/vm/base.c @@ -84,10 +84,11 @@ nouveau_vm_map_sg_table(struct nouveau_vma *vma, u64 delta, u64 length, { struct nouveau_vm *vm = vma->vm; struct nouveau_vmmgr *vmm = vm->vmm; - int big = vma->node->type != vmm->spg_shift; + u32 shift = vma->node->type; + int big = shift != vmm->spg_shift; u32 offset = vma->node->of...

...Skeggs wrote: > > Additionally the current code is broken in that the upper layer in > > vm/base.c doesn't increment "pte" by the right amount. > > > > Now, if those two assertions can be made always true: > > > > - Those two functions (map_sg and map_sg_table) never deal with the > > "big" case. > > > > - An object is always mapped at a card address that is a multiple > > of PAGE_SIZE (ie, invividual PAGE_SIZE pages don't cross pde boundaries > > when mapped) > I think these two restrictions are reasonab...

...? > diff --git a/drivers/gpu/drm/nouveau/core/subdev/vm/base.c b/drivers/gpu/drm/nouveau/core/subdev/vm/base.c > index ef3133e..5833851 100644 > --- a/drivers/gpu/drm/nouveau/core/subdev/vm/base.c > +++ b/drivers/gpu/drm/nouveau/core/subdev/vm/base.c > @@ -84,10 +84,11 @@ nouveau_vm_map_sg_table(struct nouveau_vma *vma, u64 delta, u64 length, > { > struct nouveau_vm *vm = vma->vm; > struct nouveau_vmmgr *vmm = vm->vmm; > - int big = vma->node->type != vmm->spg_shift; > + u32 shift = vma->node->type; > + int big = shift != vmm->spg_shift; >...

...> Additionally the current code is broken in that the upper layer in >> > vm/base.c doesn't increment "pte" by the right amount. >> > >> > Now, if those two assertions can be made always true: >> > >> > - Those two functions (map_sg and map_sg_table) never deal with the >> > "big" case. >> > >> > - An object is always mapped at a card address that is a multiple >> > of PAGE_SIZE (ie, invividual PAGE_SIZE pages don't cross pde boundaries >> > when mapped) > >> I think these t...

...sn't > + * have pages, we will end up doing a null deref in > + * nouveau_vm_map_sg. */ > + if (WARN_ON(mem->mem_type != TTM_PL_VRAM && !node->pages)) > + return -EINVAL; My guess here is that this is a mapping that requires the use of map_sg_table() (see nouveau_bo_move_ntfy() for the condition). I'm not entirely sure this should even be happening to be honest. I guess TTM is trying to move a shared buffer from GART to VRAM for some reason (userspace probably asked for it?).. And well, this really shouldn't be allowed.. The other...

The code expects non-VRAM mem nodes to have a pages list. If that's not set, it will do a null deref down the line. Warn on that condition and return an error. See https://bugs.freedesktop.org/show_bug.cgi?id=64774 Reported-by: Pasi K?rkk?inen <pasik at iki.fi> Tested-by: Pasi K?rkk?inen <pasik at iki.fi> Signed-off-by: Ilia Mirkin <imirkin at alum.mit.edu> Cc: <stable