search for: nouveau_bo_move

...> + } > + Definitely the right idea, we can't handle this case right now. However, we may someday want/need to be able to scan out of system memory, so this is the wrong place. I suspect the correct thing to do (which'll also handle the "defensive" part) is to bail in nouveau_bo_move() on attempts to move a DMA-BUF backed object into VRAM. Sound OK? Ben. > nouveau_fb = kzalloc(sizeof(struct nouveau_framebuffer), GFP_KERNEL); > if (!nouveau_fb) > goto err_unref; > > - ret = nouveau_framebuffer_init(dev, nouveau_fb, mode_cmd...

...============================================ [ INFO: possible circular locking dependency detected ] 3.10.0-rc7+ #101 Not tainted ------------------------------------------------------- mplayer/4979 is trying to acquire lock: (&drm_client_lock_class_key){+.+.+.}, at: [<ffffffffa0346b66>] nouveau_bo_move_m2mf.isra.13+0x4d/0x130 [nouveau] but task is already holding lock: (reservation_ww_class_mutex){+.+.+.}, at: [<ffffffffa019ab8b>] ttm_bo_vm_fault+0x47/0x394 [ttm] which lock already depends on the new lock. the existing dependency chain (in reverse order) is: -> #1 (reservation_ww_c...

...we can't handle this case right now. > > However, we may someday want/need to be able to scan out of system > > memory, so this is the wrong place. > > > > I suspect the correct thing to do (which'll also handle the > > "defensive" part) is to bail in nouveau_bo_move() on attempts to move > > a DMA-BUF backed object into VRAM. > > > > Sound OK? > > > If it has a WARN_ON or something that would be ok, I didn't find any other places that attempt to move buffers to VRAM though, so it's probably harmless. > Ben/Maarten: Are yo...

..._first+0x12f/0x4a0 [ttm] Jun 11 15:08:00 myhost kernel: [ 8670.323460] [<f840ba19>] ? ttm_bo_man_get_node+0xb9/0xc0 [ttm] Jun 11 15:08:00 myhost kernel: [ 8670.323468] [<f840ce5d>] ? ttm_bo_mem_space+0x36d/0x430 [ttm] Jun 11 15:08:00 myhost kernel: [ 8670.323486] [<f84bd183>] ? nouveau_bo_move+0x193/0x410 [nouveau] Jun 11 15:08:00 myhost kernel: [ 8670.323498] [<c106c805>] ? generic_smp_call_function_single_interrupt+0x95/0xd0 Jun 11 15:08:00 myhost kernel: [ 8670.323511] [<f84bcff0>] ? nouveau_bo_move+0x0/0x410 [nouveau] Jun 11 15:08:00 myhost kernel: [ 8670.323519] [<...

...[nouveau] [ 1730.734272] nvkm_vm_unmap+0x1b/0x20 [nouveau] [ 1730.734288] nouveau_vram_manager_del+0x60/0x80 [nouveau] [ 1730.734291] ttm_bo_mem_put+0x2a/0x30 [ttm] [ 1730.734293] ttm_bo_move_accel_cleanup+0x10c/0x200 [ttm] [ 1730.734308] ? nouveau_fence_new+0x58/0x90 [nouveau] [ 1730.734324] nouveau_bo_move_m2mf.constprop.14+0x170/0x1a0 [nouveau] [ 1730.734340] nouveau_bo_move+0xac/0x430 [nouveau] [ 1730.734342] ttm_bo_handle_move_mem+0x280/0x5b0 [ttm] [ 1730.734344] ttm_bo_evict+0x116/0x2b0 [ttm] [ 1730.734346] ? find_busiest_group+0x122/0x980 [ 1730.734354] ? drm_rect_debug_print+0x31/0xc0 [drm...

...; + if (nvbo->pin_refcnt) + goto ref_inc; nouveau_bo_placement_set(nvbo, memtype, 0); @@ -341,6 +341,10 @@ nouveau_bo_pin(struct nouveau_bo *nvbo, uint32_t memtype) break; } } + +ref_inc: + nvbo->pin_refcnt++; + out: ttm_bo_unreserve(bo); return ret; @@ -1184,6 +1188,9 @@ nouveau_bo_move(struct ttm_buffer_object *bo, bool evict, bool intr, struct nouveau_drm_tile *new_tile = NULL; int ret = 0; + if (nvbo->pin_refcnt) + NV_WARN(drm, "Moving pinned object %p!\n", nvbo); + if (drm->device.info.family < NV_DEVICE_INFO_V0_TESLA) { ret = nouveau_bo_vm_bind(...

http://bugs.freedesktop.org/show_bug.cgi?id=26521 Summary: Bug in kernel module - ttm_bo_pci_offset Product: xorg Version: 7.4 Platform: x86-64 (AMD64) OS/Version: Linux (All) Status: NEW Severity: normal Priority: medium Component: Driver/nouveau AssignedTo: nouveau at lists.freedesktop.org

...this case right now. >> > However, we may someday want/need to be able to scan out of system >> > memory, so this is the wrong place. >> > >> > I suspect the correct thing to do (which'll also handle the >> > "defensive" part) is to bail in nouveau_bo_move() on attempts to move >> > a DMA-BUF backed object into VRAM. >> > >> > Sound OK? >> > >> If it has a WARN_ON or something that would be ok, I didn't find any other places that attempt to move buffers to VRAM though, so it's probably harmless. >&...

...finitely the right idea, we can't handle this case right now. > However, we may someday want/need to be able to scan out of system > memory, so this is the wrong place. > > I suspect the correct thing to do (which'll also handle the > "defensive" part) is to bail in nouveau_bo_move() on attempts to move > a DMA-BUF backed object into VRAM. > > Sound OK? > If it has a WARN_ON or something that would be ok, I didn't find any other places that attempt to move buffers to VRAM though, so it's probably harmless. When looking into this bug I noticed that nouveau...

...5ae300 R12: ffff88e02677d400 R13: 0000000000000000 R14: ffffa985e2b9bbe0 R15: ffff88e01a7805a8 FS: 00007fca33a51740(0000) GS:ffff88e075c00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000000000000048 CR3: 000000042e65a004 CR4: 00000000003606f0 Call Trace: nouveau_bo_move_m2mf.constprop.24+0x121/0x1e0 [nouveau] nouveau_bo_move+0xaa/0x450 [nouveau] ? nvif_vmm_unmap+0x38/0x60 [nouveau] ? nouveau_vma_unmap+0x20/0x30 [nouveau] ttm_bo_handle_move_mem+0x28a/0x5a0 [ttm] ttm_bo_evict+0x171/0x350 [ttm] ? drm_mm_remove_node+0xbe/0x360 [drm] ttm_mem_evict_first+0x18d/0x210 [tt...

...e-of.patch Type: application/octet-stream Size: 1387 bytes Desc: not available Url : http://lists.freedesktop.org/archives/nouveau/attachments/20090103/481ab5a3/attachment-0009.obj -------------- next part -------------- A non-text attachment was scrubbed... Name: 0004-nv50-Also-reset-old-pages-in-nouveau_bo_move.patch Type: application/octet-stream Size: 1725 bytes Desc: not available Url : http://lists.freedesktop.org/archives/nouveau/attachments/20090103/481ab5a3/attachment-0010.obj -------------- next part -------------- A non-text attachment was scrubbed... Name: WIP.patch Type: application/octet-stre...

...180 [nouveau] [ 469.931903] ? nvkm_uvmm_mthd+0x17f/0x780 [nouveau] [ 469.931912] nvif_object_mthd+0x104/0x130 [nouveau] [ 469.931921] ? nvif_object_mthd+0x117/0x130 [nouveau] [ 469.931929] nvif_vmm_map+0x115/0x130 [nouveau] [ 469.931949] nouveau_mem_map+0x8d/0xf0 [nouveau] [ 469.931969] nouveau_bo_move_m2mf.constprop.0+0x113/0x200 [nouveau] [ 469.931989] nouveau_bo_move+0xa5/0x430 [nouveau] [ 469.932008] ? nouveau_vma_map+0x44/0x70 [nouveau] [ 469.932011] ttm_bo_handle_move_mem+0x10b/0x4f0 [ttm] [ 469.932013] ttm_bo_validate+0x11b/0x130 [ttm] [ 469.932032] nouveau_bo_validate+0x59/0x90...

...349H2G/2349H2G RIP: 0010:[<ffffffffa01abb7e>] [<ffffffffa01abb7e>] nvc0_vm_map_sg+0x8e/0x110 [nouveau] RSP: 0018:ffff8803298357c8 EFLAGS: 00010206 .. Process Xorg (pid: 1208,..) .. Call Trace: .. nouveau_vm_map_sg+0xc2/0x130 [nouveau] .. nouveau_vma_getmap.isra.11+0x68/0xa0 [nouveau] .. nouveau_bo_move_m2mf.isra.12+0x85/0x140 [nouveau] .. ? nouveau_vm_map_at+0x153/0x1c0 [nouveau] .. nouveau_bo_move+0xa5/0x400 [nouveau] .. ttm_bo_handle_move_mem+0x245/0x610 [ttm] More info from the screenshots above (also attached).. Kernel dmesg from before the crash attached. I also tried with Linux kernel 3.9...

...o nouveau_vm.o nouveau_mxm.o nouveau_gpio.o \ nv04_timer.o \ diff --git a/drivers/gpu/drm/nouveau/nouveau_bo.c b/drivers/gpu/drm/nouveau/nouveau_bo.c index 5b0dc50..7de6cad 100644 --- a/drivers/gpu/drm/nouveau/nouveau_bo.c +++ b/drivers/gpu/drm/nouveau/nouveau_bo.c @@ -936,7 +936,7 @@ nouveau_bo_move(struct ttm_buffer_object *bo, bool evict, bool intr, } /* Software copy if the card isn't up and running yet. */ - if (!dev_priv->channel) { + if (!dev_priv->channel || nouveau_gpu_reset_in_progress(dev_priv->dev)) { ret = ttm_bo_move_memcpy(bo, evict, no_wait_reserve, no_wait...

...o nouveau_vm.o nouveau_mxm.o nouveau_gpio.o \ nv04_timer.o \ diff --git a/drivers/gpu/drm/nouveau/nouveau_bo.c b/drivers/gpu/drm/nouveau/nouveau_bo.c index 5b0dc50..7de6cad 100644 --- a/drivers/gpu/drm/nouveau/nouveau_bo.c +++ b/drivers/gpu/drm/nouveau/nouveau_bo.c @@ -936,7 +936,7 @@ nouveau_bo_move(struct ttm_buffer_object *bo, bool evict, bool intr, } /* Software copy if the card isn't up and running yet. */ - if (!dev_priv->channel) { + if (!dev_priv->channel || nouveau_gpu_reset_in_progress(dev_priv->dev)) { ret = ttm_bo_move_memcpy(bo, evict, no_wait_reserve, no_wait...

...3 - 17 files changed, 36 insertions(+), 139 deletions(-) diff --git a/drivers/gpu/drm/nouveau/nouveau_bo.c b/drivers/gpu/drm/nouveau/nouveau_bo.c index 33eb7164525a..e98af2e9a1cb 100644 --- a/drivers/gpu/drm/nouveau/nouveau_bo.c +++ b/drivers/gpu/drm/nouveau/nouveau_bo.c @@ -1196,9 +1196,7 @@ nouveau_bo_move(struct ttm_buffer_object *bo, bool evict, bool intr, } /* Fallback to software copy. */ - spin_lock(&bo->bdev->fence_lock); ret = ttm_bo_wait(bo, true, intr, no_wait_gpu); - spin_unlock(&bo->bdev->fence_lock); if (ret == 0) ret = ttm_bo_move_memcpy(bo, evict, no_wai...

The code expects non-VRAM mem nodes to have a pages list. If that's not set, it will do a null deref down the line. Warn on that condition and return an error. See https://bugs.freedesktop.org/show_bug.cgi?id=64774 Reported-by: Pasi K?rkk?inen <pasik at iki.fi> Tested-by: Pasi K?rkk?inen <pasik at iki.fi> Signed-off-by: Ilia Mirkin <imirkin at alum.mit.edu> Cc: <stable

So far the DRM GPUVA manager offers common infrastructure to track GPU VA allocations and mappings, generically connect GPU VA mappings to their backing buffers and perform more complex mapping operations on the GPU VA space. However, there are more design patterns commonly used by drivers, which can potentially be generalized in order to make the DRM GPUVA manager represent a basic GPU-VM

Signed-off-by: Francisco Jerez <currojerez at riseup.net> --- drivers/gpu/drm/nouveau/nouveau_drv.h | 23 +++++ drivers/gpu/drm/nouveau/nouveau_reg.h | 16 ++-- drivers/gpu/drm/nouveau/nouveau_state.c | 8 ++ drivers/gpu/drm/nouveau/nv10_fb.c | 32 ++++++-- drivers/gpu/drm/nouveau/nv10_graph.c | 47 ++++++++--- drivers/gpu/drm/nouveau/nv20_graph.c | 80

...ct nouveau_drm *drm = nouveau_drm(dev); if (tile) { spin_lock(&drm->tile.lock); - tile->fence = nouveau_fence_ref(fence); + tile->fence = nouveau_fence_ref((struct nouveau_fence *)fence); tile->used = false; spin_unlock(&drm->tile.lock); } @@ -965,7 +965,8 @@ nouveau_bo_move_m2mf(struct ttm_buffer_object *bo, int evict, bool intr, if (ret == 0) { ret = nouveau_fence_new(chan, false, &fence); if (ret == 0) { - ret = ttm_bo_move_accel_cleanup(bo, fence, + ret = ttm_bo_move_accel_cleanup(bo, + &fence->base, evict, no_wa...