search for: nouveau_channel_new

...84ca977adea56b8aa06cc3e, as it was initialising some structures only when acceleration was on, even if it was later used in both cases. These structures changed in commit ebb945a94bba2ce8dff7b0942ff2b3f2a52a0a69, solving the initial issue but the problem still remains. After a few tests, it seems nouveau_channel_new is key to get a correct screen, though it is only called when acceleration is on; I didn't find which structures initialised by nouveau_channel_new are needed to get a clean screen, nor did I find any clues in debug messages. Does anyone have some clues about how it (should) works, or could g...

...1 file changed, 1 insertion(+) > > diff --git a/drivers/gpu/drm/nouveau/nouveau_chan.c b/drivers/gpu/drm/nouveau/nouveau_chan.c > index b80e4ebf1..a7a47b325 100644 > --- a/drivers/gpu/drm/nouveau/nouveau_chan.c > +++ b/drivers/gpu/drm/nouveau/nouveau_chan.c > @@ -533,6 +533,7 @@ nouveau_channel_new(struct nouveau_drm *drm, struct nvif_device *device, > if (ret) { > NV_PRINTK(err, cli, "channel failed to initialise, %d\n", ret); > nouveau_channel_del(pchan); > + goto done; > } > > ret = nouveau_svmm_join((*pchan)->vmm->svmm, (*pchan)->inst...

...ised only when acceleration is on (it was always initialised before), though it would be used inside functions called even when acceleration is off. You can see it in comments 18 [2] and 20 [3]. > Can you go into some detail on what these tests were that yielded a > successful outcome? IIRC nouveau_channel_new is called to create a > new... channel, which is used by drm clients. If you don't have > acceleration, that whole api is disabled, so it shouldn't come up. I > guess accel_init also initializes drm->channel which is the kernel > channel for doing stuff. [Although TBH I'm...

...+) > > > > diff --git a/drivers/gpu/drm/nouveau/nouveau_chan.c b/drivers/gpu/drm/nouveau/nouveau_chan.c > > index b80e4ebf1..a7a47b325 100644 > > --- a/drivers/gpu/drm/nouveau/nouveau_chan.c > > +++ b/drivers/gpu/drm/nouveau/nouveau_chan.c > > @@ -533,6 +533,7 @@ nouveau_channel_new(struct nouveau_drm *drm, struct nvif_device *device, > > if (ret) { > > NV_PRINTK(err, cli, "channel failed to initialise, %d\n", ret); > > nouveau_channel_del(pchan); > > + goto done; > > } > > > &...

...a/drivers/gpu/drm/nouveau/nouveau_drm.c b/drivers/gpu/drm/nouveau/nouveau_drm.c index a58c31089613..0a75ce4c5021 100644 --- a/drivers/gpu/drm/nouveau/nouveau_drm.c +++ b/drivers/gpu/drm/nouveau/nouveau_drm.c @@ -356,7 +356,7 @@ nouveau_accel_ce_init(struct nouveau_drm *drm) return; } - ret = nouveau_channel_new(drm, device, false, runm, NvDmaFB, NvDmaTT, &drm->cechan); + ret = nouveau_channel_new(drm, device, true, runm, NvDmaFB, NvDmaTT, &drm->cechan); if (ret) NV_ERROR(drm, "failed to create ce channel, %d\n", ret); } -- 2.34.1

...a/drivers/gpu/drm/nouveau/nouveau_drm.c b/drivers/gpu/drm/nouveau/nouveau_drm.c index a58c31089613..0a75ce4c5021 100644 --- a/drivers/gpu/drm/nouveau/nouveau_drm.c +++ b/drivers/gpu/drm/nouveau/nouveau_drm.c @@ -356,7 +356,7 @@ nouveau_accel_ce_init(struct nouveau_drm *drm) return; } - ret = nouveau_channel_new(drm, device, false, runm, NvDmaFB, NvDmaTT, &drm->cechan); + ret = nouveau_channel_new(drm, device, true, runm, NvDmaFB, NvDmaTT, &drm->cechan); if (ret) NV_ERROR(drm, "failed to create ce channel, %d\n", ret); } -- 2.34.1

.../nouveau/nouveau_chan.c | 1 + 1 file changed, 1 insertion(+) diff --git a/drivers/gpu/drm/nouveau/nouveau_chan.c b/drivers/gpu/drm/nouveau/nouveau_chan.c index b80e4ebf1..a7a47b325 100644 --- a/drivers/gpu/drm/nouveau/nouveau_chan.c +++ b/drivers/gpu/drm/nouveau/nouveau_chan.c @@ -533,6 +533,7 @@ nouveau_channel_new(struct nouveau_drm *drm, struct nvif_device *device, if (ret) { NV_PRINTK(err, cli, "channel failed to initialise, %d\n", ret); nouveau_channel_del(pchan); + goto done; } ret = nouveau_svmm_join((*pchan)->vmm->svmm, (*pchan)->inst); -- Frantisek Hrbata

...er used in both cases. These structures changed in commit > ebb945a94bba2ce8dff7b0942ff2b3f2a52a0a69, solving the initial issue but the > problem still remains. As you probably saw, this is a MASSIVE commit. What exactly was the problem with 20abd1634a? > > After a few tests, it seems nouveau_channel_new is key to get a correct > screen, though it is only called when acceleration is on; I didn't find > which structures initialised by nouveau_channel_new are needed to get a > clean screen, nor did I find any clues in debug messages. Can you go into some detail on what these tests were...

...is on (it was always initialised before), > though it would be used inside functions called even when acceleration is > off. You can see it in comments 18 [2] and 20 [3]. > > > > Can you go into some detail on what these tests were that yielded a > > successful outcome? IIRC nouveau_channel_new is called to create a > > new... channel, which is used by drm clients. If you don't have > > acceleration, that whole api is disabled, so it shouldn't come up. I > > guess accel_init also initializes drm->channel which is the kernel > > channel for doing stuff. [...

...tialised before), >> though it would be used inside functions called even when acceleration is >> off. You can see it in comments 18 [2] and 20 [3]. >> >> >>> Can you go into some detail on what these tests were that yielded a >>> successful outcome? IIRC nouveau_channel_new is called to create a >>> new... channel, which is used by drm clients. If you don't have >>> acceleration, that whole api is disabled, so it shouldn't come up. I >>> guess accel_init also initializes drm->channel which is the kernel >>> channel for do...

This patch series addresses two critical issues in the Nouveau driver related to device channels, error handling and memory leaking. - Memory Leak in migrate_to_ram - the migrate_to_ram function was identified as leaking memory when a copy push command fails. This results in the function returning a dirty HIGH_USER page, which can expose sensitive information and pose a security risk. To mitigate

...kasan_kmalloc+0x5e/0x70 [<ffffffff81306803>] ? kmem_cache_alloc_trace+0x123/0x290 [<ffffffff8201a263>] ? nv84_fence_context_new+0x73/0x2d0 [<ffffffff8201a28d>] nv84_fence_context_new+0x9d/0x2d0 [<ffffffff8201b351>] nvc0_fence_context_new+0x11/0x70 [<ffffffff820155f1>] nouveau_channel_new+0x7e1/0xca0 [<ffffffff8130fc6c>] ? create_object+0x28c/0x4d0 [<ffffffff82014e10>] ? nouveau_channel_prep+0x4b0/0x4b0 [<ffffffff8130fde6>] ? create_object+0x406/0x4d0 [<ffffffff8130f9e0>] ? kmemleak_disable+0x70/0x70 [<ffffffff82012d57>] ? nouveau_abi16_get+0x37/0x80 [&...

From: Yonatan Maman <Ymaman at Nvidia.com> This patch series addresses two critical issues in the Nouveau driver related to device channels, error handling, and sensitive data leaks. - Vulnerability in migrate_to_ram: The migrate_to_ram function might return a dirty HIGH_USER page when a copy push command (FW channel) fails, potentially exposing sensitive data and posing a security

...eau] [252778.064611] [<ffffffffa08f5a52>] nouveau_bo_vma_add+0x32/0xa0 [nouveau] [252778.065124] [<ffffffffa08f3c2a>] ? nouveau_bo_map+0x7a/0xa0 [nouveau] [252778.065627] [<ffffffffa0906f52>] nouveau_channel_prep+0x1d2/0x290 [nouveau] [252778.066136] [<ffffffffa0907067>] nouveau_channel_new+0x57/0x6d0 [nouveau] [252778.066642] [<ffffffffa0844a2d>] ? nvif_device_init+0x2d/0x30 [nouveau] [252778.067144] [<ffffffff811eb0cc>] ? kmem_cache_alloc_trace+0x19c/0x1b0 [252778.067672] [<ffffffffa0906174>] nouveau_abi16_ioctl_channel_alloc+0xe4/0x330 [nouveau] [252778.068185]...

From: Yonatan Maman <Ymaman at Nvidia.com> This patch series addresses two critical issues in the Nouveau driver related to device channels, error handling, and sensitive data leaks. - Vulnerability in migrate_to_ram: The migrate_to_ram function might return a dirty HIGH_USER page when a copy push command (FW channel) fails, potentially exposing sensitive data and posing a security

...u_bo_validate+0x34/0x40 [nouveau] [ 37.497310] [<f85ba608>] nouveau_bo_pin+0x188/0x290 [nouveau] [ 37.497391] [<f85b8b60>] ? nv10_bo_put_tile_region+0x80/0x80 [nouveau] [ 37.497413] [<f85cd830>] nouveau_channel_prep+0x140/0x330 [nouveau] [ 37.497413] [<f85cda92>] nouveau_channel_new+0x72/0x770 [nouveau] [ 37.497413] [<f85baa27>] ? nouveau_bo_wr32+0x37/0x60 [nouveau] [ 37.497413] [<f85b56e7>] nouveau_accel_init+0x157/0x4e0 [nouveau] [ 37.497413] [<c05dda14>] ? kmem_cache_alloc_trace+0x364/0x3e0 [ 37.497413] [<f85b7431>] ? nouveau_hwmon_init+0...

...> [<ffffffff81306803>] ? kmem_cache_alloc_trace+0x123/0x290 > [<ffffffff8201a263>] ? nv84_fence_context_new+0x73/0x2d0 > [<ffffffff8201a28d>] nv84_fence_context_new+0x9d/0x2d0 > [<ffffffff8201b351>] nvc0_fence_context_new+0x11/0x70 > [<ffffffff820155f1>] nouveau_channel_new+0x7e1/0xca0 > [<ffffffff8130fc6c>] ? create_object+0x28c/0x4d0 > [<ffffffff82014e10>] ? nouveau_channel_prep+0x4b0/0x4b0 > [<ffffffff8130fde6>] ? create_object+0x406/0x4d0 > [<ffffffff8130f9e0>] ? kmemleak_disable+0x70/0x70 > [<ffffffff82012d57>] ? nouve...

...lt;ffffffff8143bad0>] ? nvkm_udevice_map+0x40/0x40 [<ffffffff813e6602>] nvkm_ioctl+0x102/0x250 [<ffffffff8147d90d>] nvkm_client_ioctl+0xd/0x10 [<ffffffff813e38cc>] nvif_object_ioctl+0x3c/0x50 [<ffffffff813e3e7d>] nvif_object_init+0xbd/0x130 [<ffffffff81492866>] nouveau_channel_new+0xa6/0x630 [<ffffffff813e4198>] ? nvif_device_init+0x28/0x30 [<ffffffff81491a2a>] nouveau_abi16_ioctl_channel_alloc+0xda/0x2d0 [<ffffffff813be0ad>] ? drm_copy_field+0x3d/0x60 [<ffffffff813bdc9e>] drm_ioctl+0x13e/0x510 [<ffffffff81491950>] ? nouveau_abi16_ioctl_set...

https://bugs.freedesktop.org/show_bug.cgi?id=58556 Priority: medium Bug ID: 58556 Assignee: nouveau at lists.freedesktop.org Summary: MacBook Pro 5,1 with nVidia 9400m and 9600m, scrambled screen QA Contact: xorg-team at lists.x.org Severity: major Classification: Unclassified OS: other

...ers/gpu/drm/nouveau/nouveau_drm.c @@ -171,6 +171,11 @@ nouveau_accel_init(struct nouveau_drm *drm) return; } + if (device->chipset == 0xea) { + /* gk20a does not have CE0/CE1 */ + arg0 = NVE0_CHANNEL_IND_ENGINE_GR; + arg1 = 1; + } else if (device->card_type >= NV_E0) { ret = nouveau_channel_new(drm, &drm->client, NVDRM_DEVICE, NVDRM_CHAN + 1, @@ -207,6 +212,10 @@ nouveau_accel_init(struct nouveau_drm *drm) return; } + /* Need to figure out how to handle sw for gk20a */ + if (device->chipset == 0xea) + goto skip_sw_init; + ret = nouveau_object_new(nv_object(drm)...