[Bug 43835] System crashes when radeon firmware blob (R520_cp.bin) is installed
https://bugs.freedesktop.org/show_bug.cgi?id=43835
--- Comment #24 from Jonathan Nieder 2012-01-22
14:24:16 PST ---
bugzilla-daemon at freedesktop.org wrote:
> The user still reports crashes with kernel 3.2.0-rc7-686-pae. I'm attaching
> the
> involved files ("syslog" contains the kernel oops).
Summary of log: tests were performed on 22 January.
| 20:37:04 linux dbus[1320]: [system] Activating service
name='org.freedesktop.Accounts' (using servicehelper)
| 20:37:04 linux kernel: [ 724.400329] dbus-daemon-lau: Corrupted page table
at address b817800c
| 20:37:04 linux kernel: [ 724.400434] *pdpt = 33666001 *pde =
fb274e7ffb274e81
| 20:37:04 linux kernel: [ 724.400530] Bad pagetable: 0009 [#1] SMP
[... snipping list of modules linked in, because of line wrapping ...]
| 20:37:04 linux kernel: [ 724.401727] Pid: 1815, comm: dbus-daemon-lau Not
tainted 3.2.0-rc7-686-pae #1 Apple Computer, Inc. iMac5,1/Mac-F4228EC8
The boot was at 20:36. Maybe those 10 minutes came from NTP or
something. Next boot:
| 20:41:33 linux dbus[1353]: [system] Activating service
name='org.freedesktop.Accounts' (using servicehelper)
| 20:41:33 linux dbus[1353]: [system] Successfully activated service
'org.freedesktop.Accounts'
| 20:41:33 linux accounts-daemon[2275]: started daemon version 0.6.15
| 20:41:34 linux kernel: [ 41.669373] ssh: Corrupted page table at address
998f31c
| 20:41:34 linux kernel: [ 41.669433] *pdpt = 2c80d001 *pde =
2f980067 *pte = ff192f4fff192f4f
| 20:41:34 linux kernel: [ 41.669502] Bad pagetable: 0009 [#1] SMP
[...]
| 20:41:34 linux kernel: [ 41.670989] Pid: 2279, comm: ssh Not tainted
3.2.0-rc7-686-pae #1 Apple Computer, Inc. iMac5,1/Mac-F4228EC8
Anyway, the page table seems to get corrupted when X starts.
Could you send a log from booting and starting X with drm.debug=6 on
the kernel command line?
Thanks,
Jonathan
--
Configure bugmail: https://bugs.freedesktop.org/userprefs.cgi?tab=email
--- You are receiving this mail because: ---
You are the assignee for the bug.
[Bug 43835] System crashes when radeon firmware blob (R520_cp.bin) is installed
https://bugs.freedesktop.org/show_bug.cgi?id=43835 --- Comment #23 from Camale?n 2012-01-22 13:49:36 PST --- Created attachment 56001 --> https://bugs.freedesktop.org/attachment.cgi?id=56001 xorg.0.log -- Configure bugmail: https://bugs.freedesktop.org/userprefs.cgi?tab=email --- You are receiving this mail because: --- You are the assignee for the bug.
[Bug 43835] System crashes when radeon firmware blob (R520_cp.bin) is installed
https://bugs.freedesktop.org/show_bug.cgi?id=43835 --- Comment #22 from Camale?n 2012-01-22 13:49:03 PST --- Created attachment 56000 --> https://bugs.freedesktop.org/attachment.cgi?id=56000 syslog -- Configure bugmail: https://bugs.freedesktop.org/userprefs.cgi?tab=email --- You are receiving this mail because: --- You are the assignee for the bug.
[Bug 43835] System crashes when radeon firmware blob (R520_cp.bin) is installed
https://bugs.freedesktop.org/show_bug.cgi?id=43835 --- Comment #21 from Camale?n 2012-01-22 13:48:12 PST --- Created attachment 55999 --> https://bugs.freedesktop.org/attachment.cgi?id=55999 dmesg -- Configure bugmail: https://bugs.freedesktop.org/userprefs.cgi?tab=email --- You are receiving this mail because: --- You are the assignee for the bug.
[Bug 43835] System crashes when radeon firmware blob (R520_cp.bin) is installed
https://bugs.freedesktop.org/show_bug.cgi?id=43835 --- Comment #20 from Camale?n 2012-01-22 13:47:45 PST --- Created attachment 55998 --> https://bugs.freedesktop.org/attachment.cgi?id=55998 glxinfo -- Configure bugmail: https://bugs.freedesktop.org/userprefs.cgi?tab=email --- You are receiving this mail because: --- You are the assignee for the bug.
[Bug 43835] System crashes when radeon firmware blob (R520_cp.bin) is installed
https://bugs.freedesktop.org/show_bug.cgi?id=43835
--- Comment #19 from Camale?n 2012-01-22 13:46:46 PST
---
The user still reports crashes with kernel 3.2.0-rc7-686-pae. I'm attaching the
involved files ("syslog" contains the kernel oops).
I can tell the user to run whatever tests you estimate convenient, he is very
interested in solving this because he can't use GNOME3 and gnome-shell at all
and has to work with no 3D acceleration.
--
Configure bugmail: https://bugs.freedesktop.org/userprefs.cgi?tab=email
--- You are receiving this mail because: ---
You are the assignee for the bug.
[PATCH 2/2] drm/radeon: finish getting bios earlier
Return a number of bytes read in radeon_atrm_get_bios_chunk() and properly check this value in radeon_atrm_get_bios(). If radeon_atrm_get_bios_chunk() read less bytes then were requested, it means that it finished reading bios data. Prior to this patch, condition in radeon_atrm_get_bios() was always equivalent to "if (ATRM_BIOS_PAGE <= 0)", so it was always false, thus radeon_atrm_get_bios() was trying to read past the bios data wasting boot time. On my lenovo ideapad u455 laptop this patch drops bios reading time from ~5.5s to ~1.5s. Signed-off-by: Igor Murzov --- drivers/gpu/drm/radeon/radeon_atpx_handler.c |2 +- drivers/gpu/drm/radeon/radeon_bios.c |2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/drivers/gpu/drm/radeon/radeon_atpx_handler.c b/drivers/gpu/drm/radeon/radeon_atpx_handler.c index c666a5b..13ac63b 100644 --- a/drivers/gpu/drm/radeon/radeon_atpx_handler.c +++ b/drivers/gpu/drm/radeon/radeon_atpx_handler.c @@ -60,7 +60,7 @@ static int radeon_atrm_call(acpi_handle atrm_handle, uint8_t *bios, obj = (union acpi_object *)buffer.pointer; memcpy(bios+offset, obj->buffer.pointer, obj->buffer.length); kfree(buffer.pointer); - return len; + return obj->buffer.length; } bool radeon_atrm_supported(struct pci_dev *pdev) diff --git a/drivers/gpu/drm/radeon/radeon_bios.c b/drivers/gpu/drm/radeon/radeon_bios.c index 229a20f..501f488 100644 --- a/drivers/gpu/drm/radeon/radeon_bios.c +++ b/drivers/gpu/drm/radeon/radeon_bios.c @@ -120,7 +120,7 @@ static bool radeon_atrm_get_bios(struct radeon_device *rdev) ret = radeon_atrm_get_bios_chunk(rdev->bios, (i * ATRM_BIOS_PAGE), ATRM_BIOS_PAGE); - if (ret <= 0) + if (ret < ATRM_BIOS_PAGE) break; } -- 1.7.5.1
[PATCH 1/2] drm/radeon: fix invalid memory access in radeon_atrm_get_bios()
At a boot time I observed following bug: BUG: unable to handle kernel paging request at 8800a4244000 IP: [] memcpy+0xb/0x120 PGD 1816063 PUD 1fe7d067 PMD 1ff9f067 PTE 8000a4244160 Oops: [#1] SMP DEBUG_PAGEALLOC CPU 0 Modules linked in: btusb bluetooth brcmsmac brcmutil crc8 cordic b43 radeon(+) mac80211 cfg80211 ttm ohci_hcd drm_kms_helper rfkill drm ssb agpgart mmc_core sp5100_tco video battery ac thermal processor rtc_cmos thermal_sys snd_hda_codec_hdmi joydev snd_hda_codec_conexant button bcma pcmcia snd_hda_intel snd_hda_codec snd_hwdep snd_pcm shpchp pcmcia_core k8temp snd_timer atl1c snd psmouse hwmon i2c_piix4 i2c_algo_bit soundcore evdev i2c_core ehci_hcd sg serio_raw snd_page_alloc loop btrfs Pid: 1008, comm: modprobe Not tainted 3.3.0-rc1 #21 LENOVO 20046 /AMD CRB RIP: 0010:[] [] memcpy+0xb/0x120 RSP: 0018:8800aa72db00 EFLAGS: 00010246 RAX: 8800a415 RBX: 1000 RCX: 0087 RDX: RSI: 8800a4244000 RDI: 8800a4150bc8 RBP: 8800aa72db78 R08: 0010 R09: 8174bbec R10: 812ee010 R11: 0001 R12: 1000 R13: 0001 R14: 8800a414 R15: 8800aaba1800 FS: 7ff9a3bd4720() GS:8800afa0() knlGS: CS: 0010 DS: ES: CR0: 8005003b CR2: 8800a4244000 CR3: a9c18000 CR4: 06f0 DR0: DR1: DR2: DR3: DR6: 0ff0 DR7: 0400 Process modprobe (pid: 1008, threadinfo 8800aa72c000, task 8800aa0e4000) Stack: a04e7c7b 0001 0001 8800aa72db28 0001 1000 8113cbef 0020 8800a4243420 8802 8800aa72db08 8800a9d42000 Call Trace: [] ? radeon_atrm_get_bios_chunk+0x8b/0xd0 [radeon] [] ? kmalloc_order_trace+0x3f/0xb0 [] radeon_get_bios+0x68/0x2f0 [radeon] [] rv770_init+0x40/0x280 [radeon] [] radeon_device_init+0x560/0x600 [radeon] [] radeon_driver_load_kms+0xaf/0x170 [radeon] [] drm_get_pci_dev+0x18e/0x2c0 [drm] [] radeon_pci_probe+0xad/0xb5 [radeon] [] local_pci_probe+0x5f/0xd0 [] pci_device_probe+0x88/0xb0 [] ? driver_sysfs_add+0x7a/0xb0 [] really_probe+0x68/0x180 [] driver_probe_device+0x45/0x70 [] __driver_attach+0xa3/0xb0 [] ? driver_probe_device+0x70/0x70 [] bus_for_each_dev+0x5e/0x90 [] driver_attach+0x1e/0x20 [] bus_add_driver+0xc8/0x280 [] driver_register+0x76/0x140 [] __pci_register_driver+0x66/0xe0 [] drm_pci_init+0x111/0x120 [drm] [] ? vga_switcheroo_register_handler+0x3a/0x60 [] ? 0xa0228fff [] radeon_init+0xec/0xee [radeon] [] do_one_initcall+0x42/0x180 [] sys_init_module+0x92/0x1e0 [] system_call_fastpath+0x16/0x1b Code: 58 2a 43 50 88 43 4e 48 83 c4 08 5b c9 c3 66 90 e8 cb fd ff ff eb e6 90 90 90 90 90 90 90 90 90 48 89 f8 89 d1 c1 e9 03 83 e2 07 48 a5 89 d1 f3 a4 c3 20 48 83 ea 20 4c 8b 06 4c 8b 4e 08 4c RIP [] memcpy+0xb/0x120 RSP CR2: 8800a4244000 ---[ end trace fcffa1599cf56382 ]--- Call to acpi_evaluate_object() not always returns 4096 bytes chunks, on my system it can return 2048 bytes chunk, so pass the length of retrieved chunk to memcpy(), not the length of the recieving buffer. Signed-off-by: Igor Murzov --- drivers/gpu/drm/radeon/radeon_atpx_handler.c |2 +- 1 files changed, 1 insertions(+), 1 deletions(-) diff --git a/drivers/gpu/drm/radeon/radeon_atpx_handler.c b/drivers/gpu/drm/radeon/radeon_atpx_handler.c index 9d95792..c666a5b 100644 --- a/drivers/gpu/drm/radeon/radeon_atpx_handler.c +++ b/drivers/gpu/drm/radeon/radeon_atpx_handler.c @@ -58,7 +58,7 @@ static int radeon_atrm_call(acpi_handle atrm_handle, uint8_t *bios, } obj = (union acpi_object *)buffer.pointer; - memcpy(bios+offset, obj->buffer.pointer, len); + memcpy(bios+offset, obj->buffer.pointer, obj->buffer.length); kfree(buffer.pointer); return len; } -- 1.7.5.1
[PATCH 2/2] drm/radeon: finish getting bios earlier
[PATCH 1/2] drm/radeon: fix invalid memory access in radeon_atrm_get_bios()
[next] Null pointer dereference in nouveau_vm_map_sg
On Tue, Jan 17, 2012 at 12:57:50AM +0100, Martin Nyhus wrote: > On Monday 16. January 2012 21:30:59 Jerome Glisse wrote: > > On Sun, Jan 15, 2012 at 10:31:08PM +0100, Martin Nyhus wrote: > > > In some cases mem will be null in nouveau_vm_map_sg, resulting in a crash > > > at drivers/gpu/drm/nouveau/nouveau_vm.c:84. It seems to be easy enough to > > > reproduce, so I can test patches if needed. > > How do you trigger this ? > > Opening 10-15 high-res pictures in Firefox triggers it every time. Doing the > same using Gimp does not, and neither does Firefox and lots of small images > (eg. Google image search). I seem to be able to trigger this by using both Chrome and Firefox and seeing a YouTube video. I did at that time have a dual-head display, while in the past to reproduce this I had only one monitor and it took a bit of time before I hit it.
[Bug 44919] Wayland clients segfault
https://bugs.freedesktop.org/show_bug.cgi?id=44919 --- Comment #7 from Scott Moreau 2012-01-22 05:24:04 PST --- Another report from irc: hi, whenever I try to run any wayland client I get a segfault here is the bt http://dpaste.com/691450/ this happens for all clients using cairo (simple-egl works for example) bt paste contents: #0 st_framebuffer_validate (stfb=0x70acbce0, st=) at state_tracker/st_manager.c:186 #1 0x7fffefc40e68 in st_api_make_current (stapi=, stctxi=0x7a36e0, stdrawi=, streadi=) at state_tracker/st_manager.c:731 #2 0x7fffefc0238f in driBindContext (pcp=, pdp=, prp=) at ../../../../src/mesa/drivers/dri/common/dri_util.c:330 #3 0x755ac670 in dri2_make_current (drv=0x623120, disp=0x6223a0, dsurf=0x0, rsurf=0x0, ctx=0x62b3c0) at egl_dri2.c:818 #4 0x755a5829 in eglMakeCurrent (dpy=0x6223a0, draw=0x0, read=0x0, ctx=0x62b3c0) at eglapi.c:502 #5 0x761effcd in _egl_make_current_surfaceless (ctx=) at cairo-egl-context.c:127 #6 cairo_egl_device_create (dpy=0x6223a0, egl=0x62b3c0) at cairo-egl-context.c:160 #7 0x004093f7 in init_egl (d=0x61d200) at window.c:2822 #8 display_create (argc=0x7fffdb1c, argv=0x7fffdb10, option_entries=) at window.c:2926 #9 0x00404767 in main (argc=1, argv=0x7fffdc38) at gears.c:373 -- Configure bugmail: https://bugs.freedesktop.org/userprefs.cgi?tab=email --- You are receiving this mail because: --- You are the assignee for the bug.
[BUG] Intel HD Graphic QM57 chipset: Dell U3011 monitor turns to power saving mode
Hi Keith, * Keith Packard (keithp at keithp.com) wrote: > On Sat, 21 Jan 2012 13:56:21 -0500, Mathieu Desnoyers efficios.com> wrote: > > > Dell U3011 monitor turns to power saving mode when resolution set to 2560 x > > 1600 > > (intermittent) > > > > Reproduced with: > > Linux 2.6.38-1-amd64 (Debian kernel) > > Linux 3.1.0-1-amd64 (Debian kernel) > > Linux 3.2.0-1-amd64 (Debian kernel) > > > > The computer is a Lenovo X201 Tablet (Intel QM57 chipset), on a X200 > > docking station. The docking station uses a DisplayPort cable to connect > > to the monitor. I tried upgrading my Bios from 1.34/1.13 to 1.38/1.14 > > (latest), which did not fix the problem. I cannot use anything else > > than DisplayPort in this case to connect the monitor at 2560 x 1600, > > because this resolution requires either the bandwidth provided by a > > dual-link DVI (which I cannot connect in my docking station), or > > DisplayPort. > > I use this same monitor, and have run it with an X200 in the past. > > Can you capture a dmesg output with the kernel parameter drm.debug=0xe > set? That will let us see the DP link training adventure and see what's > broken. If you can, separate traces of working and non-working tries > would be nice. > > And, of course, trying 3.3-rc1 would be helpful as that's what any > test patches would be developed on top of. I've compiled and launched a 3.3-rc1 kernel for the following tests. The dmesg log follows. FWIW, when I get the screen to run, if I launch this 1080p video with either mplayer or vlc (http://www.bigbuckbunny.org/index.php/download/, 1920x1080, mp4 format) in full screen, I get an horizontal line of blur at about 7/8 of the screen (from the top) when there is a lot of movement in the movie. This looks like a vertical refresh sync issue and/or too small buffers for double(/triple)-buffering. I'm aware that this is a separate issue, but it might help the current investigation. The xrandr -q --verbose gives "+HSync -VSync" for the monitor, even though its EDID (taken with get-edid/parse-edid) specifies "Flags "-HSync" "+VSync"". So hsync and vsync +/- seems to be mixed up. * 3.3-rc1 up until Xorg is running, screen does not work ] [drm:drm_helper_probe_single_connector_modes], [CONNECTOR:12:VGA-1] [ 14.440212] [drm:intel_ironlake_crt_detect_hotplug], ironlake hotplug adpa=0xf4, result 0 [ 14.440216] [drm:intel_crt_detect], CRT not detected via hotplug [ 14.440220] [drm:drm_helper_probe_single_connector_modes], [CONNECTOR:12:VGA-1] disconnected [ 14.440229] [drm:drm_mode_getconnector], [CONNECTOR:15:?] [ 14.440234] [drm:drm_helper_probe_single_connector_modes], [CONNECTOR:15:HDMI-A-1] [ 14.451677] [drm:drm_helper_probe_single_connector_modes], [CONNECTOR:15:HDMI-A-1] disconnected [ 14.451686] [drm:drm_mode_getconnector], [CONNECTOR:15:?] [ 14.451691] [drm:drm_helper_probe_single_connector_modes], [CONNECTOR:15:HDMI-A-1] [ 14.463035] [drm:drm_helper_probe_single_connector_modes], [CONNECTOR:15:HDMI-A-1] disconnected [ 14.463048] [drm:drm_mode_getconnector], [CONNECTOR:18:?] [ 14.463050] [drm:drm_helper_probe_single_connector_modes], [CONNECTOR:18:DP-1] [ 14.463365] [drm:intel_dp_detect], DPCD: 110a840101000100 [ 14.464389] [drm:i2c_algo_dp_aux_xfer], dp_aux_xfer return 2 [ 14.491348] [drm:i2c_algo_dp_aux_xfer], dp_aux_xfer return 2 [ 14.518291] [drm:i2c_algo_dp_aux_xfer], dp_aux_xfer return 2 [ 14.518294] [drm:drm_detect_monitor_audio], Monitor has basic audio support [ 14.519321] [drm:i2c_algo_dp_aux_xfer], dp_aux_xfer return 2 [ 14.546261] [drm:i2c_algo_dp_aux_xfer], dp_aux_xfer return 2 [ 14.573232] [drm:i2c_algo_dp_aux_xfer], dp_aux_xfer return 2 [ 14.573265] [drm:drm_edid_to_eld], ELD monitor DELL U3011 [ 14.573266] [drm:drm_edid_to_eld], ELD size 9, SAD count 1 [ 14.573287] [drm:drm_helper_probe_single_connector_modes], [CONNECTOR:18:DP-1] probed modes : [ 14.573289] [drm:drm_mode_debug_printmodeline], Modeline 9:"2560x1600" 60 268500 2560 2608 2640 2720 1600 1603 1609 1646 0x48 0x9 [ 14.573292] [drm:drm_mode_debug_printmodeline], Modeline 30:"1920x1440" 60 234000 1920 2048 2256 2600 1440 1441 1444 1500 0x40 0x6 [ 14.573296] [drm:drm_mode_debug_printmodeline], Modeline 29:"1920x1200" 60 193250 1920 2056 2256 2592 1200 1203 1209 1245 0x40 0x6 [ 14.573299] [drm:drm_mode_debug_printmodeline], Modeline 53:"1920x1080" 50 148500 1920 2448 2492 2640 1080 1084 1089 1125 0x40 0x5 [ 14.573302] [drm:drm_mode_debug_printmodeline], Modeline 39:"1920x1080" 60 148500 1920 2008 2052 2200 1080 1084 1089 1125 0x40 0x5 [ 14.573305] [drm:drm_mode_debug_printmodeline], Modeline 54:"1920x1080" 24 74250 1920 2558 2602 2750 1080 1084 1089 1125 0x40 0x5 [ 14.573308] [drm:drm_mode_debug_printmodeline], Modeline 52:"1920x1080" 50 74250 1920 2448 2492 2640 1080 1084 1094 1125 0x40 0x15 [ 14.573312] [drm:drm_mode_debug_printmodeline], Modeline 40:"1920x1080" 60 74250 1920 2008 2052 2200 1080 1084 1094 1125 0x40 0x15 [
[Bug 44919] Wayland clients segfault
https://bugs.freedesktop.org/show_bug.cgi?id=44919 --- Comment #6 from Scott Moreau 2012-01-22 02:20:56 PST --- It might be useful if you post the backtrace, what program you're running and give more details about your system etc. -- Configure bugmail: https://bugs.freedesktop.org/userprefs.cgi?tab=email --- You are receiving this mail because: --- You are the assignee for the bug.
[Bug 44919] Wayland clients segfault
https://bugs.freedesktop.org/show_bug.cgi?id=44919 --- Comment #5 from Ran Benita 2012-01-22 01:46:17 PST --- I can also confirm the bad commit, with a different codebase than Wayland (but exactly the same mesa backtrace). I use nouveau. -- Configure bugmail: https://bugs.freedesktop.org/userprefs.cgi?tab=email --- You are receiving this mail because: --- You are the assignee for the bug.
[Bug 44919] Wayland clients segfault
https://bugs.freedesktop.org/show_bug.cgi?id=44919 --- Comment #5 from Ran Benita ran...@gmail.com 2012-01-22 01:46:17 PST --- I can also confirm the bad commit, with a different codebase than Wayland (but exactly the same mesa backtrace). I use nouveau. -- Configure bugmail: https://bugs.freedesktop.org/userprefs.cgi?tab=email --- You are receiving this mail because: --- You are the assignee for the bug. ___ dri-devel mailing list dri-devel@lists.freedesktop.org http://lists.freedesktop.org/mailman/listinfo/dri-devel
[Bug 44919] Wayland clients segfault
https://bugs.freedesktop.org/show_bug.cgi?id=44919 --- Comment #7 from Scott Moreau ore...@gmail.com 2012-01-22 05:24:04 PST --- Another report from irc: stfacc hi, whenever I try to run any wayland client I get a segfault stfacc here is the bt http://dpaste.com/691450/ stfacc this happens for all clients using cairo (simple-egl works for example) bt paste contents: #0 st_framebuffer_validate (stfb=0x70acbce0, st=optimized out) at state_tracker/st_manager.c:186 #1 0x7fffefc40e68 in st_api_make_current (stapi=optimized out, stctxi=0x7a36e0, stdrawi=optimized out, streadi=optimized out) at state_tracker/st_manager.c:731 #2 0x7fffefc0238f in driBindContext (pcp=optimized out, pdp=optimized out, prp=optimized out) at ../../../../src/mesa/drivers/dri/common/dri_util.c:330 #3 0x755ac670 in dri2_make_current (drv=0x623120, disp=0x6223a0, dsurf=0x0, rsurf=0x0, ctx=0x62b3c0) at egl_dri2.c:818 #4 0x755a5829 in eglMakeCurrent (dpy=0x6223a0, draw=0x0, read=0x0, ctx=0x62b3c0) at eglapi.c:502 #5 0x761effcd in _egl_make_current_surfaceless (ctx=optimized out) at cairo-egl-context.c:127 #6 cairo_egl_device_create (dpy=0x6223a0, egl=0x62b3c0) at cairo-egl-context.c:160 #7 0x004093f7 in init_egl (d=0x61d200) at window.c:2822 #8 display_create (argc=0x7fffdb1c, argv=0x7fffdb10, option_entries=optimized out) at window.c:2926 #9 0x00404767 in main (argc=1, argv=0x7fffdc38) at gears.c:373 -- Configure bugmail: https://bugs.freedesktop.org/userprefs.cgi?tab=email --- You are receiving this mail because: --- You are the assignee for the bug. ___ dri-devel mailing list dri-devel@lists.freedesktop.org http://lists.freedesktop.org/mailman/listinfo/dri-devel
[PATCH 1/2] drm/radeon: fix invalid memory access in radeon_atrm_get_bios()
From 77c912ea1eca50a93a34d5be69f9dc96a8bef0d8 Mon Sep 17 00:00:00 2001 From: Igor Murzov e-m...@date.by Date: Sun, 22 Jan 2012 19:02:27 +0400 Subject: [PATCH 1/2] drm/radeon: fix invalid memory access in radeon_atrm_get_bios() At a boot time I observed following bug: BUG: unable to handle kernel paging request at 8800a4244000 IP: [81275b5b] memcpy+0xb/0x120 PGD 1816063 PUD 1fe7d067 PMD 1ff9f067 PTE 8000a4244160 Oops: [#1] SMP DEBUG_PAGEALLOC CPU 0 Modules linked in: btusb bluetooth brcmsmac brcmutil crc8 cordic b43 radeon(+) mac80211 cfg80211 ttm ohci_hcd drm_kms_helper rfkill drm ssb agpgart mmc_core sp5100_tco video battery ac thermal processor rtc_cmos thermal_sys snd_hda_codec_hdmi joydev snd_hda_codec_conexant button bcma pcmcia snd_hda_intel snd_hda_codec snd_hwdep snd_pcm shpchp pcmcia_core k8temp snd_timer atl1c snd psmouse hwmon i2c_piix4 i2c_algo_bit soundcore evdev i2c_core ehci_hcd sg serio_raw snd_page_alloc loop btrfs Pid: 1008, comm: modprobe Not tainted 3.3.0-rc1 #21 LENOVO 20046 /AMD CRB RIP: 0010:[81275b5b] [81275b5b] memcpy+0xb/0x120 RSP: 0018:8800aa72db00 EFLAGS: 00010246 RAX: 8800a415 RBX: 1000 RCX: 0087 RDX: RSI: 8800a4244000 RDI: 8800a4150bc8 RBP: 8800aa72db78 R08: 0010 R09: 8174bbec R10: 812ee010 R11: 0001 R12: 1000 R13: 0001 R14: 8800a414 R15: 8800aaba1800 FS: 7ff9a3bd4720() GS:8800afa0() knlGS: CS: 0010 DS: ES: CR0: 8005003b CR2: 8800a4244000 CR3: a9c18000 CR4: 06f0 DR0: DR1: DR2: DR3: DR6: 0ff0 DR7: 0400 Process modprobe (pid: 1008, threadinfo 8800aa72c000, task 8800aa0e4000) Stack: a04e7c7b 0001 0001 8800aa72db28 0001 1000 8113cbef 0020 8800a4243420 8802 8800aa72db08 8800a9d42000 Call Trace: [a04e7c7b] ? radeon_atrm_get_bios_chunk+0x8b/0xd0 [radeon] [8113cbef] ? kmalloc_order_trace+0x3f/0xb0 [a04a9298] radeon_get_bios+0x68/0x2f0 [radeon] [a04c7a30] rv770_init+0x40/0x280 [radeon] [a047d740] radeon_device_init+0x560/0x600 [radeon] [a047ef4f] radeon_driver_load_kms+0xaf/0x170 [radeon] [a043cdde] drm_get_pci_dev+0x18e/0x2c0 [drm] [a04e7e95] radeon_pci_probe+0xad/0xb5 [radeon] [81296c5f] local_pci_probe+0x5f/0xd0 [81297418] pci_device_probe+0x88/0xb0 [813417aa] ? driver_sysfs_add+0x7a/0xb0 [813418d8] really_probe+0x68/0x180 [81341be5] driver_probe_device+0x45/0x70 [81341cb3] __driver_attach+0xa3/0xb0 [81341c10] ? driver_probe_device+0x70/0x70 [813400ce] bus_for_each_dev+0x5e/0x90 [8134172e] driver_attach+0x1e/0x20 [81341298] bus_add_driver+0xc8/0x280 [813422c6] driver_register+0x76/0x140 [812976d6] __pci_register_driver+0x66/0xe0 [a043d021] drm_pci_init+0x111/0x120 [drm] [8133c67a] ? vga_switcheroo_register_handler+0x3a/0x60 [a0229000] ? 0xa0228fff [a02290ec] radeon_init+0xec/0xee [radeon] [810002f2] do_one_initcall+0x42/0x180 [8109d8d2] sys_init_module+0x92/0x1e0 [815407a9] system_call_fastpath+0x16/0x1b Code: 58 2a 43 50 88 43 4e 48 83 c4 08 5b c9 c3 66 90 e8 cb fd ff ff eb e6 90 90 90 90 90 90 90 90 90 48 89 f8 89 d1 c1 e9 03 83 e2 07 f3 48 a5 89 d1 f3 a4 c3 20 48 83 ea 20 4c 8b 06 4c 8b 4e 08 4c RIP [81275b5b] memcpy+0xb/0x120 RSP 8800aa72db00 CR2: 8800a4244000 ---[ end trace fcffa1599cf56382 ]--- Call to acpi_evaluate_object() not always returns 4096 bytes chunks, on my system it can return 2048 bytes chunk, so pass the length of retrieved chunk to memcpy(), not the length of the recieving buffer. Signed-off-by: Igor Murzov e-m...@date.by --- drivers/gpu/drm/radeon/radeon_atpx_handler.c |2 +- 1 files changed, 1 insertions(+), 1 deletions(-) diff --git a/drivers/gpu/drm/radeon/radeon_atpx_handler.c b/drivers/gpu/drm/radeon/radeon_atpx_handler.c index 9d95792..c666a5b 100644 --- a/drivers/gpu/drm/radeon/radeon_atpx_handler.c +++ b/drivers/gpu/drm/radeon/radeon_atpx_handler.c @@ -58,7 +58,7 @@ static int radeon_atrm_call(acpi_handle atrm_handle, uint8_t *bios, } obj = (union acpi_object *)buffer.pointer; - memcpy(bios+offset, obj-buffer.pointer, len); + memcpy(bios+offset, obj-buffer.pointer, obj-buffer.length); kfree(buffer.pointer); return len; } -- 1.7.5.1 ___ dri-devel mailing list dri-devel@lists.freedesktop.org
[PATCH 2/2] drm/radeon: finish getting bios earlier
From 4a57f34f6ebc3adac143a329327f69cb0469c2e2 Mon Sep 17 00:00:00 2001 From: Igor Murzov e-m...@date.by Date: Sun, 22 Jan 2012 19:05:13 +0400 Subject: [PATCH 2/2] drm/radeon: finish getting bios earlier Return a number of bytes read in radeon_atrm_get_bios_chunk() and properly check this value in radeon_atrm_get_bios(). If radeon_atrm_get_bios_chunk() read less bytes then were requested, it means that it finished reading bios data. Prior to this patch, condition in radeon_atrm_get_bios() was always equivalent to if (ATRM_BIOS_PAGE = 0), so it was always false, thus radeon_atrm_get_bios() was trying to read past the bios data wasting boot time. On my lenovo ideapad u455 laptop this patch drops bios reading time from ~5.5s to ~1.5s. Signed-off-by: Igor Murzov e-m...@date.by --- drivers/gpu/drm/radeon/radeon_atpx_handler.c |2 +- drivers/gpu/drm/radeon/radeon_bios.c |2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/drivers/gpu/drm/radeon/radeon_atpx_handler.c b/drivers/gpu/drm/radeon/radeon_atpx_handler.c index c666a5b..13ac63b 100644 --- a/drivers/gpu/drm/radeon/radeon_atpx_handler.c +++ b/drivers/gpu/drm/radeon/radeon_atpx_handler.c @@ -60,7 +60,7 @@ static int radeon_atrm_call(acpi_handle atrm_handle, uint8_t *bios, obj = (union acpi_object *)buffer.pointer; memcpy(bios+offset, obj-buffer.pointer, obj-buffer.length); kfree(buffer.pointer); - return len; + return obj-buffer.length; } bool radeon_atrm_supported(struct pci_dev *pdev) diff --git a/drivers/gpu/drm/radeon/radeon_bios.c b/drivers/gpu/drm/radeon/radeon_bios.c index 229a20f..501f488 100644 --- a/drivers/gpu/drm/radeon/radeon_bios.c +++ b/drivers/gpu/drm/radeon/radeon_bios.c @@ -120,7 +120,7 @@ static bool radeon_atrm_get_bios(struct radeon_device *rdev) ret = radeon_atrm_get_bios_chunk(rdev-bios, (i * ATRM_BIOS_PAGE), ATRM_BIOS_PAGE); - if (ret = 0) + if (ret ATRM_BIOS_PAGE) break; } -- 1.7.5.1 ___ dri-devel mailing list dri-devel@lists.freedesktop.org http://lists.freedesktop.org/mailman/listinfo/dri-devel
Re: [next] Null pointer dereference in nouveau_vm_map_sg
On Tue, Jan 17, 2012 at 12:57:50AM +0100, Martin Nyhus wrote: On Monday 16. January 2012 21:30:59 Jerome Glisse wrote: On Sun, Jan 15, 2012 at 10:31:08PM +0100, Martin Nyhus wrote: In some cases mem will be null in nouveau_vm_map_sg, resulting in a crash at drivers/gpu/drm/nouveau/nouveau_vm.c:84. It seems to be easy enough to reproduce, so I can test patches if needed. How do you trigger this ? Opening 10-15 high-res pictures in Firefox triggers it every time. Doing the same using Gimp does not, and neither does Firefox and lots of small images (eg. Google image search). I seem to be able to trigger this by using both Chrome and Firefox and seeing a YouTube video. I did at that time have a dual-head display, while in the past to reproduce this I had only one monitor and it took a bit of time before I hit it. ___ dri-devel mailing list dri-devel@lists.freedesktop.org http://lists.freedesktop.org/mailman/listinfo/dri-devel
[Bug 43835] System crashes when radeon firmware blob (R520_cp.bin) is installed
https://bugs.freedesktop.org/show_bug.cgi?id=43835 --- Comment #20 from Camaleón noela...@gmail.com 2012-01-22 13:47:45 PST --- Created attachment 55998 -- https://bugs.freedesktop.org/attachment.cgi?id=55998 glxinfo -- Configure bugmail: https://bugs.freedesktop.org/userprefs.cgi?tab=email --- You are receiving this mail because: --- You are the assignee for the bug. ___ dri-devel mailing list dri-devel@lists.freedesktop.org http://lists.freedesktop.org/mailman/listinfo/dri-devel
[Bug 43835] System crashes when radeon firmware blob (R520_cp.bin) is installed
https://bugs.freedesktop.org/show_bug.cgi?id=43835 --- Comment #22 from Camaleón noela...@gmail.com 2012-01-22 13:49:03 PST --- Created attachment 56000 -- https://bugs.freedesktop.org/attachment.cgi?id=56000 syslog -- Configure bugmail: https://bugs.freedesktop.org/userprefs.cgi?tab=email --- You are receiving this mail because: --- You are the assignee for the bug. ___ dri-devel mailing list dri-devel@lists.freedesktop.org http://lists.freedesktop.org/mailman/listinfo/dri-devel
[Bug 43835] System crashes when radeon firmware blob (R520_cp.bin) is installed
https://bugs.freedesktop.org/show_bug.cgi?id=43835 --- Comment #23 from Camaleón noela...@gmail.com 2012-01-22 13:49:36 PST --- Created attachment 56001 -- https://bugs.freedesktop.org/attachment.cgi?id=56001 xorg.0.log -- Configure bugmail: https://bugs.freedesktop.org/userprefs.cgi?tab=email --- You are receiving this mail because: --- You are the assignee for the bug. ___ dri-devel mailing list dri-devel@lists.freedesktop.org http://lists.freedesktop.org/mailman/listinfo/dri-devel
[Bug 43835] System crashes when radeon firmware blob (R520_cp.bin) is installed
https://bugs.freedesktop.org/show_bug.cgi?id=43835 --- Comment #24 from Jonathan Nieder jrnie...@gmail.com 2012-01-22 14:24:16 PST --- bugzilla-dae...@freedesktop.org wrote: The user still reports crashes with kernel 3.2.0-rc7-686-pae. I'm attaching the involved files (syslog contains the kernel oops). Summary of log: tests were performed on 22 January. | 20:37:04 linux dbus[1320]: [system] Activating service name='org.freedesktop.Accounts' (using servicehelper) | 20:37:04 linux kernel: [ 724.400329] dbus-daemon-lau: Corrupted page table at address b817800c | 20:37:04 linux kernel: [ 724.400434] *pdpt = 33666001 *pde = fb274e7ffb274e81 | 20:37:04 linux kernel: [ 724.400530] Bad pagetable: 0009 [#1] SMP [... snipping list of modules linked in, because of line wrapping ...] | 20:37:04 linux kernel: [ 724.401727] Pid: 1815, comm: dbus-daemon-lau Not tainted 3.2.0-rc7-686-pae #1 Apple Computer, Inc. iMac5,1/Mac-F4228EC8 The boot was at 20:36. Maybe those 10 minutes came from NTP or something. Next boot: | 20:41:33 linux dbus[1353]: [system] Activating service name='org.freedesktop.Accounts' (using servicehelper) | 20:41:33 linux dbus[1353]: [system] Successfully activated service 'org.freedesktop.Accounts' | 20:41:33 linux accounts-daemon[2275]: started daemon version 0.6.15 | 20:41:34 linux kernel: [ 41.669373] ssh: Corrupted page table at address 998f31c | 20:41:34 linux kernel: [ 41.669433] *pdpt = 2c80d001 *pde = 2f980067 *pte = ff192f4fff192f4f | 20:41:34 linux kernel: [ 41.669502] Bad pagetable: 0009 [#1] SMP [...] | 20:41:34 linux kernel: [ 41.670989] Pid: 2279, comm: ssh Not tainted 3.2.0-rc7-686-pae #1 Apple Computer, Inc. iMac5,1/Mac-F4228EC8 Anyway, the page table seems to get corrupted when X starts. Could you send a log from booting and starting X with drm.debug=6 on the kernel command line? Thanks, Jonathan -- Configure bugmail: https://bugs.freedesktop.org/userprefs.cgi?tab=email --- You are receiving this mail because: --- You are the assignee for the bug. ___ dri-devel mailing list dri-devel@lists.freedesktop.org http://lists.freedesktop.org/mailman/listinfo/dri-devel
