1. 11 Dec, 2018 1 commit
  2. 10 Oct, 2018 2 commits
    • Lyude Paul's avatar
      drm/nouveau/drm/nouveau: s/nouveau_backlight_exit/nouveau_backlight_fini/ · a4e05f41
      Lyude Paul authored
      
      More consistent with the rest of the codebase, no functional changes
      here.
      Signed-off-by: default avatarLyude Paul <lyude@redhat.com>
      Reviewed-by: default avatarKarol Herbst <kherbst@redhat.com>
      Signed-off-by: default avatarBen Skeggs <bskeggs@redhat.com>
      a4e05f41
    • Lyude Paul's avatar
      drm/nouveau: Move backlight device into nouveau_connector · 6d757753
      Lyude Paul authored
      
      Currently module unloading is broken in nouveau due to a rather annoying
      race condition resulting from nouveau_backlight.c having gone a bit
      stale over time:
      
      [ 1960.791143] ==================================================================
      [ 1960.791394] BUG: KASAN: use-after-free in nouveau_backlight_exit+0x112/0x150 [nouveau]
      [ 1960.791460] Read of size 4 at addr ffff88075accf350 by task zsh/11185
      [ 1960.791521]
      [ 1960.791545] CPU: 7 PID: 11185 Comm: zsh Kdump: loaded Tainted: G           O      4.18.0Lyude-Test+ #4
      [ 1960.791580] Hardware name: LENOVO 20EQS64N0B/20EQS64N0B, BIOS N1EET79W (1.52 ) 07/13/2018
      [ 1960.791628] Call Trace:
      [ 1960.791680]  dump_stack+0xa4/0xfd
      [ 1960.791721]  print_address_description+0x71/0x239
      [ 1960.791833]  ? nouveau_backlight_exit+0x112/0x150 [nouveau]
      [ 1960.791877]  kasan_report.cold.6+0x242/0x2fe
      [ 1960.791919]  __asan_report_load4_noabort+0x19/0x20
      [ 1960.792012]  nouveau_backlight_exit+0x112/0x150 [nouveau]
      [ 1960.792081]  nouveau_display_destroy+0x76/0x150 [nouveau]
      [ 1960.792150]  nouveau_drm_device_fini+0xb7/0x190 [nouveau]
      [ 1960.792265]  nouveau_drm_device_remove+0x14b/0x1d0 [nouveau]
      [ 1960.792347]  ? nouveau_cli_work_queue+0x2e0/0x2e0 [nouveau]
      [ 1960.792378]  ? trace_hardirqs_on_caller+0x38b/0x570
      [ 1960.792406]  ? trace_hardirqs_on+0xd/0x10
      [ 1960.792472]  nouveau_drm_remove+0x37/0x50 [nouveau]
      [ 1960.792502]  pci_device_remove+0x112/0x2d0
      [ 1960.792530]  ? pcibios_free_irq+0x10/0x10
      [ 1960.792558]  ? kasan_check_write+0x14/0x20
      [ 1960.792587]  device_release_driver_internal+0x35c/0x650
      [ 1960.792617]  device_release_driver+0x12/0x20
      [ 1960.792643]  pci_stop_bus_device+0x172/0x1e0
      [ 1960.792671]  pci_stop_and_remove_bus_device_locked+0x1a/0x30
      [ 1960.792715]  remove_store+0xcb/0xe0
      [ 1960.792753]  ? sriov_numvfs_store+0x2e0/0x2e0
      [ 1960.792779]  ? __lock_is_held+0xb5/0x140
      [ 1960.792808]  ? component_add+0x530/0x530
      [ 1960.792834]  dev_attr_store+0x3f/0x70
      [ 1960.792859]  ? sysfs_file_ops+0x11d/0x170
      [ 1960.792885]  sysfs_kf_write+0x104/0x150
      [ 1960.792915]  ? sysfs_file_ops+0x170/0x170
      [ 1960.792940]  kernfs_fop_write+0x24f/0x400
      [ 1960.792978]  ? __lock_acquire+0x6ea/0x47f0
      [ 1960.793021]  __vfs_write+0xeb/0x760
      [ 1960.793048]  ? kernel_read+0x130/0x130
      [ 1960.793076]  ? __lock_is_held+0xb5/0x140
      [ 1960.793107]  ? rcu_read_lock_sched_held+0xdd/0x110
      [ 1960.793135]  ? rcu_sync_lockdep_assert+0x78/0xb0
      [ 1960.793162]  ? __sb_start_write+0x183/0x220
      [ 1960.793189]  vfs_write+0x14d/0x4a0
      [ 1960.793229]  ksys_write+0xd2/0x1b0
      [ 1960.793255]  ? __ia32_sys_read+0xb0/0xb0
      [ 1960.793298]  ? fput+0x1d/0x120
      [ 1960.793324]  ? filp_close+0xf3/0x130
      [ 1960.793349]  ? entry_SYSCALL_64_after_hwframe+0x59/0xbe
      [ 1960.793380]  __x64_sys_write+0x73/0xb0
      [ 1960.793407]  do_syscall_64+0xaa/0x400
      [ 1960.793433]  entry_SYSCALL_64_after_hwframe+0x49/0xbe
      [ 1960.793460] RIP: 0033:0x7f59df433164
      [ 1960.793486] Code: 89 02 48 c7 c0 ff ff ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 8d 05 81 38 2d 00 8b 00 85 c0 75 13 b8 01 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 54 c3 0f 1f 00 41 54 49 89 d4 55 48 89 f5 53
      [ 1960.793541] RSP: 002b:00007ffd70ee2fb8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001
      [ 1960.793576] RAX: ffffffffffffffda RBX: 0000000000000002 RCX: 00007f59df433164
      [ 1960.793620] RDX: 0000000000000002 RSI: 00005578088640c0 RDI: 0000000000000001
      [ 1960.793665] RBP: 00005578088640c0 R08: 00007f59df7038c0 R09: 00007f59e0995b80
      [ 1960.793696] R10: 000000000000000a R11: 0000000000000246 R12: 00007f59df702760
      [ 1960.793730] R13: 0000000000000002 R14: 00007f59df6fd760 R15: 0000000000000002
      [ 1960.793768]
      [ 1960.793790] Allocated by task 11167:
      [ 1960.793816]  save_stack+0x43/0xd0
      [ 1960.793841]  kasan_kmalloc+0xc4/0xe0
      [ 1960.793880]  kasan_slab_alloc+0x11/0x20
      [ 1960.793905]  kmem_cache_alloc+0xd7/0x270
      [ 1960.793944]  getname_flags+0xbd/0x520
      [ 1960.793969]  user_path_at_empty+0x23/0x50
      [ 1960.793994]  do_faccessat+0x1fc/0x5d0
      [ 1960.794018]  __x64_sys_access+0x59/0x80
      [ 1960.794043]  do_syscall_64+0xaa/0x400
      [ 1960.794067]  entry_SYSCALL_64_after_hwframe+0x49/0xbe
      [ 1960.794093]
      [ 1960.794127] Freed by task 11167:
      [ 1960.794152]  save_stack+0x43/0xd0
      [ 1960.794190]  __kasan_slab_free+0x139/0x190
      [ 1960.794215]  kasan_slab_free+0xe/0x10
      [ 1960.794239]  kmem_cache_free+0xcb/0x2c0
      [ 1960.794264]  putname+0xad/0xe0
      [ 1960.794287]  filename_lookup.part.59+0x1f1/0x360
      [ 1960.794313]  user_path_at_empty+0x3e/0x50
      [ 1960.794338]  do_faccessat+0x1fc/0x5d0
      [ 1960.794362]  __x64_sys_access+0x59/0x80
      [ 1960.794393]  do_syscall_64+0xaa/0x400
      [ 1960.794421]  entry_SYSCALL_64_after_hwframe+0x49/0xbe
      [ 1960.794461]
      [ 1960.794483] The buggy address belongs to the object at ffff88075acceac0
      [ 1960.794483]  which belongs to the cache names_cache of size 4096
      [ 1960.794540] The buggy address is located 2192 bytes inside of
      [ 1960.794540]  4096-byte region [ffff88075acceac0, ffff88075accfac0)
      [ 1960.794581] The buggy address belongs to the page:
      [ 1960.794609] page:ffffea001d6b3200 count:1 mapcount:0 mapping:ffff880778e4b1c0 index:0x0 compound_mapcount: 0
      [ 1960.794651] flags: 0x8000000000008100(slab|head)
      [ 1960.794679] raw: 8000000000008100 ffffea001d39e808 ffffea001d39ea08 ffff880778e4b1c0
      [ 1960.794739] raw: 0000000000000000 0000000000070007 00000001ffffffff 0000000000000000
      [ 1960.794785] page dumped because: kasan: bad access detected
      [ 1960.794813]
      [ 1960.794834] Memory state around the buggy address:
      [ 1960.794861]  ffff88075accf200: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
      [ 1960.794894]  ffff88075accf280: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
      [ 1960.794925] >ffff88075accf300: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
      [ 1960.794956]                                                  ^
      [ 1960.794985]  ffff88075accf380: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
      [ 1960.795017]  ffff88075accf400: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
      [ 1960.795061] ==================================================================
      [ 1960.795106] Disabling lock debugging due to kernel taint
      [ 1960.795131] ------------[ cut here ]------------
      [ 1960.795148] ida_remove called for id=1802201963 which is not allocated.
      [ 1960.795193] WARNING: CPU: 7 PID: 11185 at lib/idr.c:521 ida_remove+0x184/0x210
      [ 1960.795213] Modules linked in: nouveau(O) mxm_wmi ttm i2c_algo_bit drm_kms_helper syscopyarea sysfillrect sysimgblt fb_sys_fops drm joydev vfat fat intel_rapl x86_pkg_temp_thermal coretemp crc32_pclmul iTCO_wdt psmouse wmi_bmof mei_me tpm_tis mei tpm_tis_core tpm i2c_i801 thinkpad_acpi pcc_cpufreq crc32c_intel serio_raw xhci_pci xhci_hcd wmi video i2c_dev i2c_core
      [ 1960.795305] CPU: 7 PID: 11185 Comm: zsh Kdump: loaded Tainted: G    B      O      4.18.0Lyude-Test+ #4
      [ 1960.795330] Hardware name: LENOVO 20EQS64N0B/20EQS64N0B, BIOS N1EET79W (1.52 ) 07/13/2018
      [ 1960.795352] RIP: 0010:ida_remove+0x184/0x210
      [ 1960.795370] Code: 4c 89 f7 e8 ae c8 00 00 eb 22 41 83 c4 02 4c 89 e8 41 83 fc 3f 0f 86 64 ff ff ff 44 89 fe 48 c7 c7 20 94 1e 83 e8 54 ed 81 fe <0f> 0b 48 b8 00 00 00 00 00 fc ff df 48 01 c3 c7 03 00 00 00 00 c7
      [ 1960.795402] RSP: 0018:ffff88074d4df7b8 EFLAGS: 00010082
      [ 1960.795421] RAX: 0000000000000000 RBX: 1ffff100e9a9befa RCX: ffffffff81479975
      [ 1960.795440] RDX: 0000000000000000 RSI: 0000000000000008 RDI: ffff88077c1de690
      [ 1960.795460] RBP: ffff88074d4df878 R08: ffffed00ef83bcd3 R09: ffffed00ef83bcd2
      [ 1960.795479] R10: ffffed00ef83bcd2 R11: ffff88077c1de697 R12: 000000000000036b
      [ 1960.795498] R13: 0000000000000202 R14: ffffffffa0aa7fa0 R15: 000000006b6b6b6b
      [ 1960.795518] FS:  00007f59e0995b80(0000) GS:ffff88077c1c0000(0000) knlGS:0000000000000000
      [ 1960.795553] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
      [ 1960.795571] CR2: 00007f59e09a2010 CR3: 00000004a1a70005 CR4: 00000000003606e0
      [ 1960.795596] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
      [ 1960.795629] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
      [ 1960.795649] Call Trace:
      [ 1960.795667]  ? ida_destroy+0x1d0/0x1d0
      [ 1960.795686]  ? kasan_check_write+0x14/0x20
      [ 1960.795704]  ? do_raw_spin_lock+0xc2/0x1c0
      [ 1960.795724]  ida_simple_remove+0x26/0x40
      [ 1960.795794]  nouveau_backlight_exit+0x9d/0x150 [nouveau]
      [ 1960.795867]  nouveau_display_destroy+0x76/0x150 [nouveau]
      [ 1960.795930]  nouveau_drm_device_fini+0xb7/0x190 [nouveau]
      [ 1960.795989]  nouveau_drm_device_remove+0x14b/0x1d0 [nouveau]
      [ 1960.796047]  ? nouveau_cli_work_queue+0x2e0/0x2e0 [nouveau]
      [ 1960.796067]  ? trace_hardirqs_on_caller+0x38b/0x570
      [ 1960.796089]  ? trace_hardirqs_on+0xd/0x10
      [ 1960.796146]  nouveau_drm_remove+0x37/0x50 [nouveau]
      [ 1960.796167]  pci_device_remove+0x112/0x2d0
      [ 1960.796186]  ? pcibios_free_irq+0x10/0x10
      [ 1960.796218]  ? kasan_check_write+0x14/0x20
      [ 1960.796237]  device_release_driver_internal+0x35c/0x650
      [ 1960.796257]  device_release_driver+0x12/0x20
      [ 1960.796289]  pci_stop_bus_device+0x172/0x1e0
      [ 1960.796308]  pci_stop_and_remove_bus_device_locked+0x1a/0x30
      [ 1960.796328]  remove_store+0xcb/0xe0
      [ 1960.796345]  ? sriov_numvfs_store+0x2e0/0x2e0
      [ 1960.796364]  ? __lock_is_held+0xb5/0x140
      [ 1960.796383]  ? component_add+0x530/0x530
      [ 1960.796401]  dev_attr_store+0x3f/0x70
      [ 1960.796419]  ? sysfs_file_ops+0x11d/0x170
      [ 1960.796436]  sysfs_kf_write+0x104/0x150
      [ 1960.796454]  ? sysfs_file_ops+0x170/0x170
      [ 1960.796471]  kernfs_fop_write+0x24f/0x400
      [ 1960.796488]  ? __lock_acquire+0x6ea/0x47f0
      [ 1960.796520]  __vfs_write+0xeb/0x760
      [ 1960.796538]  ? kernel_read+0x130/0x130
      [ 1960.796556]  ? __lock_is_held+0xb5/0x140
      [ 1960.796590]  ? rcu_read_lock_sched_held+0xdd/0x110
      [ 1960.796608]  ? rcu_sync_lockdep_assert+0x78/0xb0
      [ 1960.796626]  ? __sb_start_write+0x183/0x220
      [ 1960.796648]  vfs_write+0x14d/0x4a0
      [ 1960.796666]  ksys_write+0xd2/0x1b0
      [ 1960.796684]  ? __ia32_sys_read+0xb0/0xb0
      [ 1960.796701]  ? fput+0x1d/0x120
      [ 1960.796732]  ? filp_close+0xf3/0x130
      [ 1960.796749]  ? entry_SYSCALL_64_after_hwframe+0x59/0xbe
      [ 1960.796768]  __x64_sys_write+0x73/0xb0
      [ 1960.796800]  do_syscall_64+0xaa/0x400
      [ 1960.796818]  entry_SYSCALL_64_after_hwframe+0x49/0xbe
      [ 1960.796836] RIP: 0033:0x7f59df433164
      [ 1960.796854] Code: 89 02 48 c7 c0 ff ff ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 8d 05 81 38 2d 00 8b 00 85 c0 75 13 b8 01 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 54 c3 0f 1f 00 41 54 49 89 d4 55 48 89 f5 53
      [ 1960.796884] RSP: 002b:00007ffd70ee2fb8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001
      [ 1960.796906] RAX: ffffffffffffffda RBX: 0000000000000002 RCX: 00007f59df433164
      [ 1960.796926] RDX: 0000000000000002 RSI: 00005578088640c0 RDI: 0000000000000001
      [ 1960.796946] RBP: 00005578088640c0 R08: 00007f59df7038c0 R09: 00007f59e0995b80
      [ 1960.796966] R10: 000000000000000a R11: 0000000000000246 R12: 00007f59df702760
      [ 1960.796985] R13: 0000000000000002 R14: 00007f59df6fd760 R15: 0000000000000002
      [ 1960.797008] irq event stamp: 509990
      [ 1960.797026] hardirqs last  enabled at (509989): [<ffffffff8119ff78>] flush_work+0x4b8/0x6d0
      [ 1960.797063] hardirqs last disabled at (509990): [<ffffffff8297c395>] _raw_spin_lock_irqsave+0x25/0x60
      [ 1960.797085] softirqs last  enabled at (509744): [<ffffffff82c005ad>] __do_softirq+0x5ad/0x8c0
      [ 1960.797121] softirqs last disabled at (509735): [<ffffffff8115aa15>] irq_exit+0x1a5/0x1e0
      [ 1960.797142] ---[ end trace fb1342325f1846b8 ]---
      
      While I haven't actually gone into the details of what's causing this to
      happen (maybe the kernel removes the backlight device in the device core
      before we get to it?), it doesn't really matter anyway because the way
      nouveau handles backlights has long since been deprecated.
      
      According to the documentation on the drm_connector->late_register()
      hook, the ->late_register() hook should be used for adding extra
      connector-related devices. Vice versa, the ->early_unregister() hook is
      meant to be used for removing those devices.
      
      So: gut nouveau_drm->bl_list and nouveau_drm->backlight, and replace
      them with per-connector backlight structures. Additionally, move
      backlight registration/teardown into the ->late_register() and
      ->early_unregister() hooks so that DRM can give us a chance to remove
      the backlight before the connector is even removed. This appears to fix
      the problem once and for all.
      
      Changes since v2:
      - Use NV_INFO_ONCE for printing GMUX information, since otherwise this
        will end up printing that message for as many times as we have
        connectors
      Signed-off-by: default avatarLyude Paul <lyude@redhat.com>
      Reviewed-by: default avatarKarol Herbst <kherbst@redhat.com>
      Signed-off-by: default avatarBen Skeggs <bskeggs@redhat.com>
      6d757753
  3. 09 Sep, 2018 1 commit
  4. 16 Jul, 2018 2 commits
    • Lyude Paul's avatar
      drm/nouveau: Avoid looping through fake MST connectors · 37afe55b
      Lyude Paul authored
      
      When MST and atomic were introduced to nouveau, another structure that
      could contain a drm_connector embedded within it was introduced; struct
      nv50_mstc. This meant that we no longer would be able to simply loop
      through our connector list and assume that nouveau_connector() would
      return a proper pointer for each connector, since the assertion that
      all connectors coming from nouveau have a full nouveau_connector struct
      became invalid.
      
      Unfortunately, none of the actual code that looped through connectors
      ever got updated, which means that we've been causing invalid memory
      accesses for quite a while now.
      
      An example that was caught by KASAN:
      
      [  201.038698] ==================================================================
      [  201.038792] BUG: KASAN: slab-out-of-bounds in nvif_notify_get+0x190/0x1a0 [nouveau]
      [  201.038797] Read of size 4 at addr ffff88076738c650 by task kworker/0:3/718
      [  201.038800]
      [  201.038822] CPU: 0 PID: 718 Comm: kworker/0:3 Tainted: G           O      4.18.0-rc4Lyude-Test+ #1
      [  201.038825] Hardware name: LENOVO 20EQS64N0B/20EQS64N0B, BIOS N1EET78W (1.51 ) 05/18/2018
      [  201.038882] Workqueue: events nouveau_display_hpd_work [nouveau]
      [  201.038887] Call Trace:
      [  201.038894]  dump_stack+0xa4/0xfd
      [  201.038900]  print_address_description+0x71/0x239
      [  201.038929]  ? nvif_notify_get+0x190/0x1a0 [nouveau]
      [  201.038935]  kasan_report.cold.6+0x242/0x2fe
      [  201.038942]  __asan_report_load4_noabort+0x19/0x20
      [  201.038970]  nvif_notify_get+0x190/0x1a0 [nouveau]
      [  201.038998]  ? nvif_notify_put+0x1f0/0x1f0 [nouveau]
      [  201.039003]  ? kmsg_dump_rewind_nolock+0xe4/0xe4
      [  201.039049]  nouveau_display_init.cold.12+0x34/0x39 [nouveau]
      [  201.039089]  ? nouveau_user_framebuffer_create+0x120/0x120 [nouveau]
      [  201.039133]  nouveau_display_resume+0x5c0/0x810 [nouveau]
      [  201.039173]  ? nvkm_client_ioctl+0x20/0x20 [nouveau]
      [  201.039215]  nouveau_do_resume+0x19f/0x570 [nouveau]
      [  201.039256]  nouveau_pmops_runtime_resume+0xd8/0x2a0 [nouveau]
      [  201.039264]  pci_pm_runtime_resume+0x130/0x250
      [  201.039269]  ? pci_restore_standard_config+0x70/0x70
      [  201.039275]  __rpm_callback+0x1f2/0x5d0
      [  201.039279]  ? rpm_resume+0x560/0x18a0
      [  201.039283]  ? pci_restore_standard_config+0x70/0x70
      [  201.039287]  ? pci_restore_standard_config+0x70/0x70
      [  201.039291]  ? pci_restore_standard_config+0x70/0x70
      [  201.039296]  rpm_callback+0x175/0x210
      [  201.039300]  ? pci_restore_standard_config+0x70/0x70
      [  201.039305]  rpm_resume+0xcc3/0x18a0
      [  201.039312]  ? rpm_callback+0x210/0x210
      [  201.039317]  ? __pm_runtime_resume+0x9e/0x100
      [  201.039322]  ? kasan_check_write+0x14/0x20
      [  201.039326]  ? do_raw_spin_lock+0xc2/0x1c0
      [  201.039333]  __pm_runtime_resume+0xac/0x100
      [  201.039374]  nouveau_display_hpd_work+0x67/0x1f0 [nouveau]
      [  201.039380]  process_one_work+0x7a0/0x14d0
      [  201.039388]  ? cancel_delayed_work_sync+0x20/0x20
      [  201.039392]  ? lock_acquire+0x113/0x310
      [  201.039398]  ? kasan_check_write+0x14/0x20
      [  201.039402]  ? do_raw_spin_lock+0xc2/0x1c0
      [  201.039409]  worker_thread+0x86/0xb50
      [  201.039418]  kthread+0x2e9/0x3a0
      [  201.039422]  ? process_one_work+0x14d0/0x14d0
      [  201.039426]  ? kthread_create_worker_on_cpu+0xc0/0xc0
      [  201.039431]  ret_from_fork+0x3a/0x50
      [  201.039441]
      [  201.039444] Allocated by task 79:
      [  201.039449]  save_stack+0x43/0xd0
      [  201.039452]  kasan_kmalloc+0xc4/0xe0
      [  201.039456]  kmem_cache_alloc_trace+0x10a/0x260
      [  201.039494]  nv50_mstm_add_connector+0x9a/0x340 [nouveau]
      [  201.039504]  drm_dp_add_port+0xff5/0x1fc0 [drm_kms_helper]
      [  201.039511]  drm_dp_send_link_address+0x4a7/0x740 [drm_kms_helper]
      [  201.039518]  drm_dp_check_and_send_link_address+0x1a7/0x210 [drm_kms_helper]
      [  201.039525]  drm_dp_mst_link_probe_work+0x71/0xb0 [drm_kms_helper]
      [  201.039529]  process_one_work+0x7a0/0x14d0
      [  201.039533]  worker_thread+0x86/0xb50
      [  201.039537]  kthread+0x2e9/0x3a0
      [  201.039541]  ret_from_fork+0x3a/0x50
      [  201.039543]
      [  201.039546] Freed by task 0:
      [  201.039549] (stack is not available)
      [  201.039551]
      [  201.039555] The buggy address belongs to the object at ffff88076738c1a8
                                       which belongs to the cache kmalloc-2048 of size 2048
      [  201.039559] The buggy address is located 1192 bytes inside of
                                       2048-byte region [ffff88076738c1a8, ffff88076738c9a8)
      [  201.039563] The buggy address belongs to the page:
      [  201.039567] page:ffffea001d9ce200 count:1 mapcount:0 mapping:ffff88084000d0c0 index:0x0 compound_mapcount: 0
      [  201.039573] flags: 0x8000000000008100(slab|head)
      [  201.039578] raw: 8000000000008100 ffffea001da3be08 ffffea001da25a08 ffff88084000d0c0
      [  201.039582] raw: 0000000000000000 00000000000d000d 00000001ffffffff 0000000000000000
      [  201.039585] page dumped because: kasan: bad access detected
      [  201.039588]
      [  201.039591] Memory state around the buggy address:
      [  201.039594]  ffff88076738c500: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
      [  201.039598]  ffff88076738c580: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
      [  201.039601] >ffff88076738c600: 00 00 00 00 00 00 00 00 00 00 fc fc fc fc fc fc
      [  201.039604]                                                  ^
      [  201.039607]  ffff88076738c680: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
      [  201.039611]  ffff88076738c700: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
      [  201.039613] ==================================================================
      Signed-off-by: default avatarLyude Paul <lyude@redhat.com>
      Cc: stable@vger.kernel.org
      Cc: Karol Herbst <karolherbst@gmail.com>
      Signed-off-by: default avatarBen Skeggs <bskeggs@redhat.com>
      37afe55b
    • Lyude Paul's avatar
      drm/nouveau: Use drm_connector_list_iter_* for iterating connectors · 22b76bbe
      Lyude Paul authored
      
      Every codepath in nouveau that loops through the connector list
      currently does so using the old method, which is prone to race
      conditions from MST connectors being created and destroyed. This has
      been causing a multitude of problems, including memory corruption from
      trying to access connectors that have already been freed!
      Signed-off-by: default avatarLyude Paul <lyude@redhat.com>
      Cc: stable@vger.kernel.org
      Cc: Karol Herbst <karolherbst@gmail.com>
      Signed-off-by: default avatarBen Skeggs <bskeggs@redhat.com>
      22b76bbe
  5. 18 Dec, 2016 1 commit
    • Laurent Pinchart's avatar
      drm: Don't include <drm/drm_encoder.h> in <drm/drm_crtc.h> · 9338203c
      Laurent Pinchart authored
      
      <drm/drm_crtc.h> used to define most of the in-kernel KMS API. It has
      now been split into separate files for each object type, but still
      includes most other KMS headers to avoid breaking driver compilation.
      
      As a step towards fixing that problem, remove the inclusion of
      <drm/drm_encoder.h> from <drm/drm_crtc.h> and include it instead where
      appropriate. Also remove the forward declarations of the drm_encoder and
      drm_encoder_helper_funcs structures from <drm/drm_crtc.h> as they're not
      needed in the header.
      
      <drm/drm_encoder.h> now has to include <drm/drm_mode.h> and contain a
      forward declaration of struct drm_encoder in order to allow including it
      as the first header in a compilation unit.
      Signed-off-by: default avatarLaurent Pinchart <laurent.pinchart+renesas@ideasonboard.com>
      Reviewed-by: default avatarDaniel Vetter <daniel.vetter@ffwll.ch>
      Reviewed-by: Sinclair Yeh <syeh@vmware.com> # For vmwgfx
      Reviewed-by: default avatarAlex Deucher <alexander.deucher@amd.com>
      Signed-off-by: Archit Ta...
      9338203c
  6. 07 Nov, 2016 5 commits
  7. 22 Jan, 2015 2 commits
    • Ben Skeggs's avatar
      drm/nouveau: finalise nvkm namespace switch (no binary change) · be83cd4e
      Ben Skeggs authored
      
      The namespace of NVKM is being changed to nvkm_ instead of nouveau_,
      which will be used for the DRM part of the driver.  This is being
      done in order to make it very clear as to what part of the driver a
      given symbol belongs to, and as a minor step towards splitting the
      DRM driver out to be able to stand on its own (for virt).
      
      Because there's already a large amount of churn here anyway, this is
      as good a time as any to also switch to NVIDIA's device and chipset
      naming to ease collaboration with them.
      
      A comparison of objdump disassemblies proves no code changes.
      Signed-off-by: default avatarBen Skeggs <bskeggs@redhat.com>
      be83cd4e
    • Ben Skeggs's avatar
      drm/nv50-/kms: allow disabling of gpu scaling on fixed panels · 576f7911
      Ben Skeggs authored
      
      The hilarious part is that, under X, this won't work anyway because the
      server decides to construct its own modes for some reason.
      
      Tested with modetest, which isn't quite as insane.  I'd hope that
      wayland is more sensible.
      Signed-off-by: default avatarBen Skeggs <bskeggs@redhat.com>
      576f7911
  8. 15 Sep, 2014 1 commit
  9. 09 Aug, 2014 3 commits
  10. 11 Jun, 2014 2 commits
  11. 08 Nov, 2013 2 commits
  12. 20 Feb, 2013 2 commits
  13. 28 Nov, 2012 1 commit
  14. 03 Oct, 2012 2 commits
    • Ben Skeggs's avatar
      drm/nouveau/i2c: port to subdev interfaces · 4196faa8
      Ben Skeggs authored
      
      v2/v3: Ben Skeggs <bskeggs@redhat.com>
      - fix typo in default bus selection
      - fix accidental loss of destructor
      
      v4: Dmitry Eremin-Solenikov <dmitry_eremin@mentor.com>
      - fix typo causing incorrect default i2c port settings when no BMP data
      Signed-off-by: default avatarBen Skeggs <bskeggs@redhat.com>
      4196faa8
    • Ben Skeggs's avatar
      drm/nouveau: restructure source tree, split core from drm implementation · 02a841d4
      Ben Skeggs authored
      
      Future work will be headed in the way of separating the policy supplied by
      the nouveau drm module from the mechanisms provided by the driver core.
      
      There will be a couple of major classes (subdev, engine) of driver modules
      that have clearly defined tasks, and the further directory structure change
      is to reflect this.
      
      No code changes here whatsoever, aside from fixing up a couple of include
      file pathnames.
      Signed-off-by: default avatarBen Skeggs <bskeggs@redhat.com>
      02a841d4
  15. 02 Oct, 2012 1 commit
  16. 21 Dec, 2011 3 commits
  17. 18 Nov, 2010 1 commit
  18. 04 Oct, 2010 1 commit
  19. 13 Jul, 2010 2 commits
  20. 25 Feb, 2010 1 commit
  21. 11 Dec, 2009 1 commit
    • Ben Skeggs's avatar
      drm/nouveau: Add DRM driver for NVIDIA GPUs · 6ee73861
      Ben Skeggs authored
      
      This adds a drm/kms staging non-API stable driver for GPUs from NVIDIA.
      
      This driver is a KMS-based driver and requires a compatible nouveau
      userspace libdrm and nouveau X.org driver.
      
      This driver requires firmware files not available in this kernel tree,
      interested parties can find them via the nouveau project git archive.
      
      This driver is reverse engineered, and is in no way supported by nVidia.
      
      Support for nearly the complete range of nvidia hw from nv04->g80 (nv50)
      is available, and the kms driver should support driving nearly all
      output types (displayport is under development still) along with supporting
      suspend/resume.
      
      This work is all from the upstream nouveau project found at
      nouveau.freedesktop.org.
      
      The original authors list from nouveau git tree is:
      Anssi Hannula <anssi.hannula@iki.fi>
      Ben Skeggs <bskeggs@redhat.com>
      Francisco Jerez <currojerez@riseup.net>
      Maarten Maathuis <madman2003@gmail.com>
      Marcin Kościelnicki <koriakin@0x04.net>
      Matthew Garrett <mjg@redhat.com>
      Matt Parnell <mparnell@gmail.com>
      Patrice Mandin <patmandin@gmail.com>
      Pekka Paalanen <pq@iki.fi>
      Xavier Chantry <shiningxc@gmail.com>
      along with project founder Stephane Marchesin <marchesin@icps.u-strasbg.fr>
      Signed-off-by: default avatarBen Skeggs <bskeggs@redhat.com>
      Signed-off-by: default avatarDave Airlie <airlied@redhat.com>
      6ee73861