On Tue, Jan 14, 2014 at 3:07 PM, Ben Skeggs <skeggsb@xxxxxxxxx> wrote:
> On Tue, Jan 14, 2014 at 1:22 PM, Bob Gleitsmann <rjgleits@xxxxxxxxxxxxx> wrote:
>> I should have mentioned that this applies to Linus' 3.13.0-rc7 and rc8
>> git. Maybe it's obvious.
> Hey Bob,
>
> Thanks for reporting this. Can you try the attached patch instead and
> report if it helps you?
Thinko in first attempt, new one attached.
>
> Ben.
>
>>
>> Sorry about that.
>>
>> Bob
>> -------- Forwarded Message --------
>> From: Bob Gleitsmann <rjgleits@xxxxxxxxxxxxx>
>> To: bskeggs@xxxxxxxxxx
>> Cc: nouveau@xxxxxxxxxxxxxxxxxxxxx, dri-devel@xxxxxxxxxxxxxxxxxxxxx
>> Subject: [PATCH] Fix null dereference oopses for nv40 cards
>> Date: Mon, 13 Jan 2014 01:45:36 -0500
>>
>> The problem affects nv40 cards during booting. It comes from there being
>> two places where subdev arrays are maintained. A commit was recently
>> added to make the two equal. However, the struct nouveau_device version
>> ends up being referenced before it is initialized. The problem arises
>> during the creation of the INSTMEM and THERM subdevs. '
>>
>> Signed off by: Bob Gleitsmann rjgleits@xxxxxxxxxxxxx
>>
>> diff --git a/drivers/gpu/drm/nouveau/core/subdev/instmem/nv40.c b/drivers/gpu/drm/nouveau/core/subdev/instmem/nv40.c
>> index b10a143..0f494ca 100644
>> --- a/drivers/gpu/drm/nouveau/core/subdev/instmem/nv40.c
>> +++ b/drivers/gpu/drm/nouveau/core/subdev/instmem/nv40.c
>> @@ -23,6 +23,7 @@
>> */
>>
>> #include <engine/graph/nv40.h>
>> +#include <core/device.h>
>>
>> #include "nv04.h"
>>
>> @@ -38,6 +39,7 @@ nv40_instmem_ctor(struct nouveau_object *parent, struct nouveau_object *engine,
>>
>> ret = nouveau_instmem_create(parent, engine, oclass, &priv);
>> *pobject = nv_object(priv);
>> + device->subdev[NVDEV_SUBDEV_INSTMEM] = *pobject;
>> if (ret)
>> return ret;
>>
>> diff --git a/drivers/gpu/drm/nouveau/core/subdev/therm/nv40.c b/drivers/gpu/drm/nouveau/core/subdev/therm/nv40.c
>> index 002e51b..59b25be 100644
>> --- a/drivers/gpu/drm/nouveau/core/subdev/therm/nv40.c
>> +++ b/drivers/gpu/drm/nouveau/core/subdev/therm/nv40.c
>> @@ -187,9 +187,11 @@ nv40_therm_ctor(struct nouveau_object *parent,
>> {
>> struct nv40_therm_priv *priv;
>> int ret;
>> + struct nouveau_device *device = nv_device(parent);
>>
>> ret = nouveau_therm_create(parent, engine, oclass, &priv);
>> *pobject = nv_object(priv);
>> + device->subdev[NVDEV_SUBDEV_THERM] = *pobject;
>> if (ret)
>> return ret;
>>
>>
>>
>>
>> _______________________________________________
>> Nouveau mailing list
>> Nouveau@xxxxxxxxxxxxxxxxxxxxx
>> http://lists.freedesktop.org/mailman/listinfo/nouveau
From 2f40bcd890aa9d861c7e26b4867580f58836d8ec Mon Sep 17 00:00:00 2001
From: Ben Skeggs <bskeggs@xxxxxxxxxx>
Date: Tue, 14 Jan 2014 14:56:22 +1000
Subject: [PATCH] fix null ptr dereferences on some boards
Regression from "device: populate master subdev pointer only when fully
constructed"
Reported-by: Bob Gleitsmann <rjgleits@xxxxxxxxxxxxx>
Signed-off-by: Ben Skeggs <bskeggs@xxxxxxxxxx>
---
drm/dispnv04/dfp.c | 2 +-
drm/dispnv04/tvnv04.c | 2 +-
nvkm/include/subdev/i2c.h | 2 +-
nvkm/include/subdev/instmem.h | 7 +++++++
nvkm/subdev/i2c/base.c | 4 ++--
nvkm/subdev/therm/ic.c | 10 +++++-----
6 files changed, 17 insertions(+), 10 deletions(-)
diff --git a/drm/dispnv04/dfp.c b/drm/dispnv04/dfp.c
index 936a71c..7fdc51e 100644
--- a/drm/dispnv04/dfp.c
+++ b/drm/dispnv04/dfp.c
@@ -643,7 +643,7 @@ static void nv04_tmds_slave_init(struct drm_encoder *encoder)
get_tmds_slave(encoder))
return;
- type = i2c->identify(i2c, 2, "TMDS transmitter", info, NULL);
+ type = i2c->identify(i2c, 2, "TMDS transmitter", info, NULL, NULL);
if (type < 0)
return;
diff --git a/drm/dispnv04/tvnv04.c b/drm/dispnv04/tvnv04.c
index cc4b208..244822d 100644
--- a/drm/dispnv04/tvnv04.c
+++ b/drm/dispnv04/tvnv04.c
@@ -59,7 +59,7 @@ int nv04_tv_identify(struct drm_device *dev, int i2c_index)
struct nouveau_i2c *i2c = nouveau_i2c(drm->device);
return i2c->identify(i2c, i2c_index, "TV encoder",
- nv04_tv_encoder_info, NULL);
+ nv04_tv_encoder_info, NULL, NULL);
}
diff --git a/nvkm/include/subdev/i2c.h b/nvkm/include/subdev/i2c.h
index 9fa5da7..7f50a85 100644
--- a/nvkm/include/subdev/i2c.h
+++ b/nvkm/include/subdev/i2c.h
@@ -73,7 +73,7 @@ struct nouveau_i2c {
int (*identify)(struct nouveau_i2c *, int index,
const char *what, struct nouveau_i2c_board_info *,
bool (*match)(struct nouveau_i2c_port *,
- struct i2c_board_info *));
+ struct i2c_board_info *, void *), void *);
struct list_head ports;
};
diff --git a/nvkm/include/subdev/instmem.h b/nvkm/include/subdev/instmem.h
index e40b26c..c1df26f 100644
--- a/nvkm/include/subdev/instmem.h
+++ b/nvkm/include/subdev/instmem.h
@@ -35,6 +35,13 @@ struct nouveau_instmem {
static inline struct nouveau_instmem *
nouveau_instmem(void *obj)
{
+ /* nv04/nv40 impls need to create objects in their constructor,
+ * which is before the subdev pointer is valid
+ */
+ if (nv_iclass(obj, NV_SUBDEV_CLASS) &&
+ nv_subidx(obj) == NVDEV_SUBDEV_INSTMEM)
+ return obj;
+
return (void *)nv_device(obj)->subdev[NVDEV_SUBDEV_INSTMEM];
}
diff --git a/nvkm/subdev/i2c/base.c b/nvkm/subdev/i2c/base.c
index 041fd5e..c33c03d 100644
--- a/nvkm/subdev/i2c/base.c
+++ b/nvkm/subdev/i2c/base.c
@@ -197,7 +197,7 @@ static int
nouveau_i2c_identify(struct nouveau_i2c *i2c, int index, const char *what,
struct nouveau_i2c_board_info *info,
bool (*match)(struct nouveau_i2c_port *,
- struct i2c_board_info *))
+ struct i2c_board_info *, void *), void *data)
{
struct nouveau_i2c_port *port = nouveau_i2c_find(i2c, index);
int i;
@@ -221,7 +221,7 @@ nouveau_i2c_identify(struct nouveau_i2c *i2c, int index, const char *what,
}
if (nv_probe_i2c(port, info[i].dev.addr) &&
- (!match || match(port, &info[i].dev))) {
+ (!match || match(port, &info[i].dev, data))) {
nv_info(i2c, "detected %s: %s\n", what,
info[i].dev.type);
return i;
diff --git a/nvkm/subdev/therm/ic.c b/nvkm/subdev/therm/ic.c
index e44ed7b..7610fc5 100644
--- a/nvkm/subdev/therm/ic.c
+++ b/nvkm/subdev/therm/ic.c
@@ -29,9 +29,9 @@
static bool
probe_monitoring_device(struct nouveau_i2c_port *i2c,
- struct i2c_board_info *info)
+ struct i2c_board_info *info, void *data)
{
- struct nouveau_therm_priv *priv = (void *)nouveau_therm(i2c);
+ struct nouveau_therm_priv *priv = data;
struct nvbios_therm_sensor *sensor = &priv->bios_sensor;
struct i2c_client *client;
@@ -96,7 +96,7 @@ nouveau_therm_ic_ctor(struct nouveau_therm *therm)
};
i2c->identify(i2c, NV_I2C_DEFAULT(0), "monitoring device",
- board, probe_monitoring_device);
+ board, probe_monitoring_device, therm);
if (priv->ic)
return;
}
@@ -108,7 +108,7 @@ nouveau_therm_ic_ctor(struct nouveau_therm *therm)
};
i2c->identify(i2c, NV_I2C_DEFAULT(0), "monitoring device",
- board, probe_monitoring_device);
+ board, probe_monitoring_device, therm);
if (priv->ic)
return;
}
@@ -117,5 +117,5 @@ nouveau_therm_ic_ctor(struct nouveau_therm *therm)
device. Let's try our static list.
*/
i2c->identify(i2c, NV_I2C_DEFAULT(0), "monitoring device",
- nv_board_infos, probe_monitoring_device);
+ nv_board_infos, probe_monitoring_device, therm);
}
--
1.8.5.2
_______________________________________________
dri-devel mailing list
dri-devel@xxxxxxxxxxxxxxxxxxxxx
http://lists.freedesktop.org/mailman/listinfo/dri-devel
