search for: nouveau_ttm_io_mem_reserv

...evice.ttm.type_vram can become -1 for unknown types of memory (see nouveau_ttm_init()). This leads to an out-of-bounds error when accessing struct nvif_mmu.type[]: [ 18.304116] ================================================================== [ 18.311649] BUG: KASAN: slab-out-of-bounds in nouveau_ttm_io_mem_reserve+0x17a/0x7e0 [nouveau] [ 18.320415] Read of size 1 at addr ffff88810ffac1fe by task systemd-udevd/342 [ 18.327681] [ 18.329208] CPU: 1 PID: 342 Comm: systemd-udevd Tainted: G E 5.10.0-rc2-1-default+ #581 [ 18.338681] Hardware name: Dell Inc. OptiPlex 9020/0N4YC8, BIOS...

...se, but resolving that would apparently require more than a bugfix. Best regards Thomas > > Mike > >> >> [ 18.304116] >> =========================================================== >> ======= >> [ 18.311649] BUG: KASAN: slab-out-of-bounds in >> nouveau_ttm_io_mem_reserve+0x17a/0x7e0 [nouveau] >> [ 18.320415] Read of size 1 at addr ffff88810ffac1fe by task systemd- >> udevd/342 >> [ 18.327681] >> [ 18.329208] CPU: 1 PID: 342 Comm: systemd-udevd Tainted: G E >> 5.10.0-rc2-1-default+ #581 >> [ 18.338681] Hard...

...of-bounds >error when accessing struct nvif_mmu.type[]: Would this make more sense to just set the type_vram = 0 instead of -1? Mike > > [ 18.304116] >=========================================================== >======= > [ 18.311649] BUG: KASAN: slab-out-of-bounds in >nouveau_ttm_io_mem_reserve+0x17a/0x7e0 [nouveau] > [ 18.320415] Read of size 1 at addr ffff88810ffac1fe by task systemd- >udevd/342 > [ 18.327681] > [ 18.329208] CPU: 1 PID: 342 Comm: systemd-udevd Tainted: G E >5.10.0-rc2-1-default+ #581 > [ 18.338681] Hardware name: Dell Inc. OptiP...

...> In general we should remove driver specific handling from the memory > management, so this patch moves the io_reserve_lru handling into Nouveau > instead. > > The patch should be functional correct, but is only compile tested! > > v2: don't call ttm_bo_unmap_virtual in nouveau_ttm_io_mem_reserve > > Signed-off-by: Christian K?nig <christian.koenig at amd.com> > Acked-by: Daniel Vetter <daniel.vetter at ffwll.ch> > --- > drivers/gpu/drm/nouveau/nouveau_bo.c | 107 ++++++++++++++++++++------ > drivers/gpu/drm/nouveau/nouveau_bo.h | 3 + > drivers/gp...

...Thanks -- Gustavo On 2/11/19 12:58 PM, Gustavo A. R. Silva wrote: > In preparation to enabling -Wimplicit-fallthrough, mark switch > cases where we are expecting to fall through. > > This patch fixes the following warning: > > drivers/gpu/drm/nouveau/nouveau_bo.c: In function ‘nouveau_ttm_io_mem_reserve’: > drivers/gpu/drm/nouveau/nouveau_bo.c:1434:53: warning: this statement may fall through [-Wimplicit-fallthrough=] > if (drm->client.mem->oclass < NVIF_CLASS_MEM_NV50 || !mem->kind) > ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~^~~~~~~~~~~~~ > drivers/gpu/drm/...

...U as an eviction candidate. We *do* require the LRU, so it's not something that can just be dropped completely. There's a user report where they're getting a SIGBUS due to the bug you noticed causing it to not work right now. Ben. > > v2: don't call ttm_bo_unmap_virtual in nouveau_ttm_io_mem_reserve > > Signed-off-by: Christian K?nig <christian.koenig at amd.com> > Acked-by: Daniel Vetter <daniel.vetter at ffwll.ch> > --- > drivers/gpu/drm/nouveau/nouveau_bo.c | 107 ++++++++++++++++++++------ > drivers/gpu/drm/nouveau/nouveau_bo.h | 3 + > drivers/gpu/dr...

...gt; Thanks, Mike >Best regards >Thomas > >> >> Mike >> >>> >>> [ 18.304116] >>> >=========================================================== >>> ======= >>> [ 18.311649] BUG: KASAN: slab-out-of-bounds in >>> nouveau_ttm_io_mem_reserve+0x17a/0x7e0 [nouveau] >>> [ 18.320415] Read of size 1 at addr ffff88810ffac1fe by task systemd- >>> udevd/342 >>> [ 18.327681] >>> [ 18.329208] CPU: 1 PID: 342 Comm: systemd-udevd Tainted: G E >>> 5.10.0-rc2-1-default+ #581 >>&...

Hi guys, I've already send this out in September last year, but only got a response from Daniel. Could you guys please test this and tell me what you think about it? Basically I'm trying to remove all driver specific features from TTM which don't need to be inside the framework. Thanks, Christian.

...au is actually not working at all. In general we should remove driver specific handling from the memory management, so this patch moves the io_reserve_lru handling into Nouveau instead. The patch should be functional correct, but is only compile tested! v2: don't call ttm_bo_unmap_virtual in nouveau_ttm_io_mem_reserve Signed-off-by: Christian K?nig <christian.koenig at amd.com> Acked-by: Daniel Vetter <daniel.vetter at ffwll.ch> --- drivers/gpu/drm/nouveau/nouveau_bo.c | 107 ++++++++++++++++++++------ drivers/gpu/drm/nouveau/nouveau_bo.h | 3 + drivers/gpu/drm/nouveau/nouveau_drv.h | 2 + d...

...on TTM cleanups I've found that the io_reserve_lru used by Nouveau is actually not working at all. In general we should remove driver specific handling from the memory management, so this patch moves the io_reserve_lru handling into Nouveau instead. v2: don't call ttm_bo_unmap_virtual in nouveau_ttm_io_mem_reserve v3: rebased and use both base and offset in the check v4: fix small typos and test the patch Signed-off-by: Christian K?nig <christian.koenig at amd.com> Acked-by: Daniel Vetter <daniel.vetter at ffwll.ch> --- drivers/gpu/drm/nouveau/nouveau_bo.c | 111 ++++++++++++++++++++------ dr...

...; > >> > >> Mike > >> > >>> > >>> [ 18.304116] > >>> > >=========================================================== > >>> ======= > >>> [ 18.311649] BUG: KASAN: slab-out-of-bounds in > >>> nouveau_ttm_io_mem_reserve+0x17a/0x7e0 [nouveau] > >>> [ 18.320415] Read of size 1 at addr ffff88810ffac1fe by task systemd- > >>> udevd/342 > >>> [ 18.327681] > >>> [ 18.329208] CPU: 1 PID: 342 Comm: systemd-udevd Tainted: G E > >>> 5.10.0-rc2-...

Hi guys, I already tried this a few month ago, but since I don't have NVidia hardware its rather hard to test for me (need to get some ordered). Dave brought up the topic that we should probably try to move the handling into Nouveau once more, so I tried to fix the problem Ben reported and rebased on top of current drm-misc-next. Dave can you test this? At least in theory the approach

...t; >> >> >>> >> >>> [ 18.304116] >> >>> >> >>========================================================== >= >> >>> ======= >> >>> [ 18.311649] BUG: KASAN: slab-out-of-bounds in >> >>> nouveau_ttm_io_mem_reserve+0x17a/0x7e0 [nouveau] >> >>> [ 18.320415] Read of size 1 at addr ffff88810ffac1fe by task systemd- >> >>> udevd/342 >> >>> [ 18.327681] >> >>> [ 18.329208] CPU: 1 PID: 342 Comm: systemd-udevd Tainted: G E >> >...

...au_bo.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/gpu/drm/nouveau/nouveau_bo.c b/drivers/gpu/drm/nouveau/nouveau_bo.c index 73eff52036d2..a72be71c45b4 100644 --- a/drivers/gpu/drm/nouveau/nouveau_bo.c +++ b/drivers/gpu/drm/nouveau/nouveau_bo.c @@ -1434,7 +1434,7 @@ nouveau_ttm_io_mem_reserve(struct ttm_bo_device *bdev, struct ttm_mem_reg *reg) if (drm->client.mem->oclass < NVIF_CLASS_MEM_NV50 || !mem->kind) /* untiled */ break; - /* fallthrough, tiled memory */ + /* fall through - tiled memory */ case TTM_PL_VRAM: reg->bus.offset = reg->start <&l...

Hi guys, so I got some hardware and tested this and after hammering out tons of typos it now seems to work fine. Could you give it more testing? Thanks in advance, Christian

...) > + nvif_object_unmap_handle(&mem->mem.object); > + break; > + case TTM_PL_VRAM: > + nvif_object_unmap_handle(&mem->mem.object); > + break; > + default: > + break; > + } > + } > + reg->bus.base = 0; > +} > + > static int > nouveau_ttm_io_mem_reserve(struct ttm_bo_device *bdev, struct ttm_mem_reg *reg) > { > @@ -1433,18 +1479,26 @@ nouveau_ttm_io_mem_reserve(struct ttm_bo_device *bdev, struct ttm_mem_reg *reg) > struct nouveau_drm *drm = nouveau_bdev(bdev); > struct nvkm_device *device = nvxx_device(&drm->client.device)...

...veau/nouveau_bo.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/gpu/drm/nouveau/nouveau_bo.c b/drivers/gpu/drm/nouveau/nouveau_bo.c index 488686d..4aed171 100644 --- a/drivers/gpu/drm/nouveau/nouveau_bo.c +++ b/drivers/gpu/drm/nouveau/nouveau_bo.c @@ -1249,7 +1249,7 @@ nouveau_ttm_io_mem_reserve(struct ttm_bo_device *bdev, struct ttm_mem_reg *mem) mem->bus.is_iomem = !dev->agp->cant_use_aperture; } #endif - if (!node->memtype) + if (nv_device(drm->device)->card_type < NV_50 || !node->memtype) /* untiled */ break; /* fallthrough, tiled memory */...

...+ switch (reg->mem_type) { + case TTM_PL_TT: + if (mem->kind) + nvif_object_unmap_handle(&mem->mem.object); + break; + case TTM_PL_VRAM: + nvif_object_unmap_handle(&mem->mem.object); + break; + default: + break; + } + } + reg->bus.base = 0; +} + static int nouveau_ttm_io_mem_reserve(struct ttm_bo_device *bdev, struct ttm_mem_reg *reg) { @@ -1433,18 +1479,26 @@ nouveau_ttm_io_mem_reserve(struct ttm_bo_device *bdev, struct ttm_mem_reg *reg) struct nouveau_drm *drm = nouveau_bdev(bdev); struct nvkm_device *device = nvxx_device(&drm->client.device); struct nouveau_m...

....c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/drivers/gpu/drm/nouveau/nouveau_bo.c b/drivers/gpu/drm/nouveau/nouveau_bo.c index a8a957207f3a..8334b3f4e60b 100644 --- a/drivers/gpu/drm/nouveau/nouveau_bo.c +++ b/drivers/gpu/drm/nouveau/nouveau_bo.c @@ -1494,11 +1494,13 @@ nouveau_ttm_io_mem_reserve(struct ttm_bo_device *bdev, struct ttm_mem_reg *reg) args.nv50.ro = 0; args.nv50.kind = mem->kind; args.nv50.comp = mem->comp; + argc = sizeof(args.nv50); break; case NVIF_CLASS_MEM_GF100: args.gf100.version = 0; args.gf100.ro = 0; args.gf100.kind =...

...<< 12, mem); + else + nouveau_vm_map(vma, mem); return 0; } diff --git a/drivers/gpu/drm/nouveau/nouveau_bo.c b/drivers/gpu/drm/nouveau/nouveau_bo.c index 639d7cd..9ecb874 100644 --- a/drivers/gpu/drm/nouveau/nouveau_bo.c +++ b/drivers/gpu/drm/nouveau/nouveau_bo.c @@ -1259,6 +1259,7 @@ nouveau_ttm_io_mem_reserve(struct ttm_bo_device *bdev, struct ttm_mem_reg *mem) { struct ttm_mem_type_manager *man = &bdev->man[mem->mem_type]; struct nouveau_drm *drm = nouveau_bdev(bdev); + struct nouveau_mem *node = mem->mm_node; struct drm_device *dev = drm->dev; int ret; @@ -1281,14 +1282,16...