Op 24-07-13 17:55, Dan Carpenter schreef:
> Hello Maarten Lankhorst,
>
> This is a semi-automatic email about new static checker warnings.
>
> The patch 0108bc80: "drm/nouveau: do not allow negative sizes for
> now" from Jul 7, 2013, leads to the following Smatch complaint:
>
> drivers/gpu/drm/nouveau/nouveau_bo.c:222 nouveau_bo_new()
> 	 warn: variable dereferenced before check 'drm->client.base.vm' (see line 201)
>
> drivers/gpu/drm/nouveau/nouveau_bo.c
>    200		int type = ttm_bo_type_device;
>    201		int max_size = INT_MAX & ~((1 << drm->client.base.vm->vmm->lpg_shift) - 1);
>                                                  ^^^^^^^^^^^^^^^^^^^
> New dereference.
>
>    202
>    203		if (size <= 0 || size > max_size) {
>    204			nv_warn(drm, "skipped size %x\n", (u32)size);
>    205			return -EINVAL;
>    206		}
>    207
>    208		if (sg)
>    209			type = ttm_bo_type_sg;
>    210
>    211		nvbo = kzalloc(sizeof(struct nouveau_bo), GFP_KERNEL);
>    212		if (!nvbo)
>    213			return -ENOMEM;
>    214		INIT_LIST_HEAD(&nvbo->head);
>    215		INIT_LIST_HEAD(&nvbo->entry);
>    216		INIT_LIST_HEAD(&nvbo->vma_list);
>    217		nvbo->tile_mode = tile_mode;
>    218		nvbo->tile_flags = tile_flags;
>    219		nvbo->bo.bdev = &drm->ttm.bdev;
>    220
>    221		nvbo->page_shift = 12;
>    222		if (drm->client.base.vm) {
>                     ^^^^^^^^^^^^^^^^^^^
> Old check.
>
>    223			if (!(flags & TTM_PL_FLAG_TT) && size > 256 * 1024)
>    224				nvbo->page_shift = drm->client.base.vm->vmm->lpg_shift;
>
> regards,
> dan carpenter

8<-----
Commit 0108bc80: "drm/nouveau: do not allow negative sizes for now" broke
older nvidia gpu's that lack a vm. Add an explicit check to handle this.
Reported-by: NDan Carpenter <dan.carpenter@oracle.com>
Reported-by: Nkonrad wilk <konrad.wilk@oracle.com>
Signed-off-by: NMaarten Lankhorst <maarten.lankhorst@canonical.com>
Signed-off-by: NBen Skeggs <bskeggs@redhat.com>

Unused and irrelavant since the code move of DP training/linkcontrol interrupt
Signed-off-by: NEmil Velikov <emil.l.velikov@gmail.com>
Signed-off-by: NBen Skeggs <bskeggs@redhat.com>

Commits 0a9e2b95 (drm/nvd0/disp: move HDA codec setup to core) and
a4feaf4e (drm/nva3/disp: move hda codec handling to core) moved code
around but neglected to fill data up to 0x60 as before. This caused
/proc/asound/cardN/eld#3.0 to show eld_valid as 0. With this patch, that
file is again populated with the correct data.

See https://bugs.freedesktop.org/show_bug.cgi?id=67051Reported-and-tested-by: NAlex <alupu01@gmail.com>
Signed-off-by: NIlia Mirkin <imirkin@alum.mit.edu>
Signed-off-by: NBen Skeggs <bskeggs@redhat.com>

object->engine is null, which leads to a null deref down the line
Signed-off-by: NIlia Mirkin <imirkin@alum.mit.edu>
Signed-off-by: NBen Skeggs <bskeggs@redhat.com>

Signed-off-by: NIlia Mirkin <imirkin@alum.mit.edu>
Signed-off-by: NBen Skeggs <bskeggs@redhat.com>

Fixes vgaswitcheroo on a card without display.
Signed-off-by: NMaarten Lankhorst <maarten.lankhorst@canonical.com>
Signed-off-by: NBen Skeggs <bskeggs@redhat.com>

Since the original merge of nouveau to upstream kernel, we were assuming
that nv90 (and later) cards have 32 lines.

Based on mmio traces of the binary driver, as well as PBUS error messages
during read/write of the e070/e074 registers, we can conclude that nv92
has only 16 lines whereas nv94 (and later) cards have 32.
Reported-and-tested-by: NDavid M. Lloyd <david.lloyd@redhat.com>
Signed-off-by: NEmil Velikov <emil.l.velikov@gmail.com>
Cc: dri-devel@lists.freedesktop.org
Cc: Ben Skeggs <bskeggs@redhat.com>
Signed-off-by: NBen Skeggs <bskeggs@redhat.com>

Kernel panic caused by list corruption in ltcg seems to indicate a
concurrency issue.

Take mutex of pfb like nv50_ram_put() to eliminate concurrency.

V2: Separate critical section into separate function, avoid taking the
    lock twice on NVC0
Signed-off-by: NRoy Spliet <r.spliet@student.tudelft.nl>
Signed-off-by: NBen Skeggs <bskeggs@redhat.com>

The current logic is wrong since we send fw->size >> 8 to the
card. Rounding the size up by 0x100 and 0x1000 didn't seem to help,
the card still hung, so go back to what the blob does -- 0x40000.
Signed-off-by: NIlia Mirkin <imirkin@alum.mit.edu>
Signed-off-by: NBen Skeggs <bskeggs@redhat.com>

The API allows up to 64-bits allocations, but size is handled as int
inside nouveau almost everywhere. Until this is fixed it's better to
prevent negative sizes.

The 256 kB before INT_MAX is paranoia, because of the large page
aligning below that could flip it above INT_MAX.
Signed-off-by: NMaarten Lankhorst <maarten.lankhorst@canonical.com>
Signed-off-by: NBen Skeggs <bskeggs@redhat.com>

This prevents 100% cpu usage on fermi cards when the exit interrupt
from the secret scrubber is not acked.
Signed-off-by: NMaarten Lankhorst <maarten.lankhorst@canonical.com>
Signed-off-by: NBen Skeggs <bskeggs@redhat.com>

The moves themselves were generally async to graphics previously, with
the exception that if the "main" channel is used to synchronise a
page flip at the same time, it can end up blocked for a noticable amount
of time for large buffer moves.

Not really critical, and there's better ways of handling this, but they
are all rather invasive, so this is fine for now.

Based on a patch by Maarten Lankhorst addressing the same issue.
Reported-by: NMaarten Lankhorst <maarten.lankhorst@canonical.com>
Signed-off-by: NBen Skeggs <bskeggs@redhat.com>
Acked-by: NMaarten Lankhorst <maarten.lankhorst@canonical.com>

calim didn't like 150 seconds timeout, so lower the timeout for him.
15 seconds should still be plenty.
Signed-off-by: NMaarten Lankhorst <maarten.lankhorst@canonical.com>
Signed-off-by: NBen Skeggs <bskeggs@redhat.com>

This should no longer be required, and is harmful for framebuffer pinning.
Also add a warning if unpin causes the pin count to drop below 0.
Signed-off-by: NMaarten Lankhorst <maarten.lankhorst@canonical.com>
Signed-off-by: NBen Skeggs <bskeggs@redhat.com>

Weren't critical previously, the buffers would go away anyway.  But with
recent changes to core drm/ttm lockdep will get pissed off now, so let's
fix it.
Reported-by: NMaarten Lankhorst <maarten.lankhorst@canonical.com>
Signed-off-by: NBen Skeggs <bskeggs@redhat.com>
Acked-by: NMaarten Lankhorst <maarten.lankhorst@canonical.com>

Signed-off-by: NMaarten Lankhorst <maarten.lankhorst@canonical.com>
Signed-off-by: NBen Skeggs <bskeggs@redhat.com>

b580c9e2 introduced additional problems
while trying to solve issues that became apparent while porting to the
new reservation stuff.

The major problem was that the the previously mentioned patch took the
client mutex earlier than previously, but the pinning of new_bo can
can potentially cause a buffer move, which would result in attempting to
acquire the same mutex again.

This commit attempts to fix that "fix".

Thanks to Maarten for the tips on keeping lockdep happy and cooking :)
Reported-by: NMaarten Lankhorst <maarten.lankhorst@canonical.com>
Signed-off-by: NBen Skeggs <bskeggs@redhat.com>
Acked-by: NMaarten Lankhorst <maarten.lankhorst@canonical.com>

"drm/nve0-/gr: some new gpc registers can have multiple copies"
5ee86c41 caused a regression for nvc0, because the bit indicating last
transfer has occured was no longer set, resulting in random system lockups.
Reported-by: NRonald Uitermark <ronald645@gmail.com>
Tested-by: NRonald Uitermark <ronald645@gmail.com>
Signed-off-by: NMaarten Lankhorst <maarten.lankhorst@canonical.com>
Signed-off-by: NBen Skeggs <bskeggs@redhat.com>

Reported-by: NMaarten Lankhorst <maarten.lankhorst@canonical.com>
Signed-off-by: NBen Skeggs <bskeggs@redhat.com>

This is the nva3 counterpart to commit beba44b1 (drm/nv84/disp: Fix
HDMI audio regression). The regression happened as a result of
refactoring in commit 8e9e3d2d (drm/nv84/disp: move hdmi control into
core).
Reported-and-tested-by: NMax Baldwin <archerseven@gmail.com>
Signed-off-by: NIlia Mirkin <imirkin@alum.mit.edu>
Signed-off-by: NBen Skeggs <bskeggs@redhat.com>
Cc: stable@vger.kernel.org

The commit

   commit 476e84e1
   Author: Ben Skeggs <bskeggs@redhat.com>
   Date:   Mon Feb 11 09:24:23 2013 +1000

       drm/nv50-/disp: initial supervisor support for off-chip encoders

changed the write mask in one of the interrupt functions for on-chip encoders,
causing a regression in certain VGA dual-head setups. This commit reintroduces
the mask thus resolving the regression

Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=66129Reported-and-Tested-by: NYves-Alexis <corsac@debian.org>
Cc: stable@vger.kernel.org [3.9+]
CC: Ben Skeggs <bskeggs@redhat.com>
Signed-off-by: NEmil Velikov <emil.l.velikov@gmail.com>
Signed-off-by: NBen Skeggs <bskeggs@redhat.com>

Page tables on nv50 take 48kB, which can be hard to allocate in one piece.
Let's use vmalloc.
Signed-off-by: NMarcin Slusarz <marcin.slusarz@gmail.com>
Cc: stable@vger.kernel.org [3.7+]
Signed-off-by: NBen Skeggs <bskeggs@redhat.com>

Signed-off-by: NBen Skeggs <bskeggs@redhat.com>

NVC1/NVD9 are the only chipsets that should have anything different
happen on them after this.  We previously weren't doing these
register modifications, and NVIDIA do.
Signed-off-by: NBen Skeggs <bskeggs@redhat.com>

Signed-off-by: NBen Skeggs <bskeggs@redhat.com>

Signed-off-by: NBen Skeggs <bskeggs@redhat.com>

Signed-off-by: NBen Skeggs <bskeggs@redhat.com>

Signed-off-by: NBen Skeggs <bskeggs@redhat.com>

Signed-off-by: NBen Skeggs <bskeggs@redhat.com>

This can be generalised and used on GK104 (probably even GF117), but lets
just make it work for now.
Signed-off-by: NBen Skeggs <bskeggs@redhat.com>

Signed-off-by: NBen Skeggs <bskeggs@redhat.com>

Signed-off-by: NBen Skeggs <bskeggs@redhat.com>

Signed-off-by: NBen Skeggs <bskeggs@redhat.com>

Signed-off-by: NBen Skeggs <bskeggs@redhat.com>

Signed-off-by: NBen Skeggs <bskeggs@redhat.com>

Signed-off-by: NMaarten Lankhorst <maarten.lankhorst@canonical.com>
Signed-off-by: NBen Skeggs <bskeggs@redhat.com>

Signed-off-by: NBen Skeggs <bskeggs@redhat.com>

Signed-off-by: NBen Skeggs <bskeggs@redhat.com>

GK110 exposes more than one, and needs to be dealt with in the ctxsw
ucode just like the TPC sets are.

Broadcast is at +0xe00.
Signed-off-by: NBen Skeggs <bskeggs@redhat.com>