From: Linus T. <tor...@tr...> - 2003-04-24 22:25:07
|
[ New people and the dri-devel list cc'd, so some background: I've been trying to figure out why I can hang my i845G boxes with current DRI, apparently with major memory corruption. It's almost completely repeatable for me, although getting oopses is hit-and-miss and most often the box just crashes completely instead of oopsing ] On Thu, 24 Apr 2003, Linus Torvalds wrote: > > I'll try to see if I can get more oopses and see if we see a pattern. Here's another one: (meminfo_read_proc -> get_vmalloc_info), what a strange place to get an oops.. This definitely looks like it's the result of random memory corruption. HOWEVER, I think I have a frigging clue this time. I had DRM debugging enabled with both kernels, and while the oopses looked totally unrelated, they were at the _exact_ same place in the logs.. The oopses were preceded by (some numbers differed, like "pid" etc, but otherwise its clearly the same sequence and same point in the sequence (Longish sequence, this is the whole thing for the X startup, I think..) 14:53:36 [drm:i810_open_helper] pid = 1579, minor = 0 14:53:36 [drm:i810_setup] 14:53:36 [drm:i810_ioctl] pid=1579, cmd=0xc0246400, nr=0x00, dev 0xe200, auth=1 14:53:36 [drm:i810_ioctl] pid=1579, cmd=0xc0246400, nr=0x00, dev 0xe200, auth=1 14:53:36 [drm:i810_flush] pid = 1579, device = 0xe200, open_count = 1 14:53:36 [drm:i810_release] open_count = 1 14:53:36 [drm:i810_release] pid = 1579, device = 0xe200, open_count = 1 14:53:36 [drm:i810_fasync] fd = -1, device = 0xe200 14:53:36 [drm:i810_takedown] 14:53:36 [drm:i810_open_helper] pid = 1579, minor = 0 14:53:36 [drm:i810_setup] 14:53:36 [drm:i810_ioctl] pid=1579, cmd=0xc0246400, nr=0x00, dev 0xe200, auth=1 14:53:36 [drm:i810_ioctl] pid=1579, cmd=0xc0246400, nr=0x00, dev 0xe200, auth=1 14:53:36 [drm:i810_flush] pid = 1579, device = 0xe200, open_count = 1 14:53:36 [drm:i810_release] open_count = 1 14:53:36 [drm:i810_release] pid = 1579, device = 0xe200, open_count = 1 14:53:36 [drm:i810_fasync] fd = -1, device = 0xe200 14:53:36 [drm:i810_takedown] 14:53:36 [drm:i810_open_helper] pid = 1579, minor = 0 14:53:36 [drm:i810_setup] 14:53:36 [drm:i810_ioctl] pid=1579, cmd=0xc0246400, nr=0x00, dev 0xe200, auth=1 14:53:36 [drm:i810_ioctl] pid=1579, cmd=0xc0246400, nr=0x00, dev 0xe200, auth=1 14:53:36 [drm:i810_flush] pid = 1579, device = 0xe200, open_count = 1 14:53:36 [drm:i810_release] open_count = 1 14:53:36 [drm:i810_release] pid = 1579, device = 0xe200, open_count = 1 14:53:36 [drm:i810_fasync] fd = -1, device = 0xe200 14:53:36 [drm:i810_takedown] 14:53:36 [drm:i830_open_helper] pid = 1579, minor = 1 14:53:36 [drm:i830_setup] 14:53:36 [drm:i830_ioctl] pid=1579, cmd=0xc0246400, nr=0x00, dev 0xe201, auth=1 14:53:36 [drm:i830_ioctl] pid=1579, cmd=0xc0246400, nr=0x00, dev 0xe201, auth=1 14:53:36 [drm:i830_ioctl] pid=1579, cmd=0xc0086401, nr=0x01, dev 0xe201, auth=1 14:53:36 [drm:i830_ioctl] pid=1579, cmd=0xc0086401, nr=0x01, dev 0xe201, auth=1 14:53:36 [drm:i830_ioctl] pid=1579, cmd=0x40086410, nr=0x10, dev 0xe201, auth=1 14:53:36 [drm:i830_ioctl] pid=1579, cmd=0xc0186415, nr=0x15, dev 0xe201, auth=1 14:53:36 [drm:i830_addmap] offset = 0x00000000, size = 0x00002000, type = 2 14:53:36 [drm:i830_addmap] 8192 13 e0124000 14:53:36 [drm:i830_mmap] start = 0x40017000, end = 0x40019000, offset = 0xe0124000 14:53:36 [drm:i830_vm_open] 0x40017000,0x00002000 14:53:36 [drm:i830_vm_shm_nopage] shm_nopage 0x40017000 14:53:36 [drm:i830_vm_shm_nopage] shm_nopage 0x40018000 14:53:36 [drm:i830_ioctl] pid=1579, cmd=0xc0186415, nr=0x15, dev 0xe201, auth=1 14:53:36 [drm:i830_addmap] offset = 0xd8020000, size = 0x00300000, type = 0 14:53:36 [drm:i830_ioctl] pid=1579, cmd=0xc0086426, nr=0x26, dev 0xe201, auth=1 14:53:36 [drm:i830_ioctl] pid=1579, cmd=0xc0086426, nr=0x26, dev 0xe201, auth=1 14:53:36 [drm:i830_ioctl] pid=1579, cmd=0xc0246400, nr=0x00, dev 0xe201, auth=1 14:53:36 [drm:i830_ioctl] pid=1579, cmd=0xc0246400, nr=0x00, dev 0xe201, auth=1 14:53:36 agp_allocate_memory: ddf92ac0 14:53:36 agp_allocate_memory: ddf92740 14:53:36 agp_allocate_memory: ddf92a40 14:53:36 agp_allocate_memory: ddf92a00 14:53:36 agp_allocate_memory: ddf92700 14:53:36 [drm:i830_ioctl] pid=1579, cmd=0xc0186415, nr=0x15, dev 0xe201, auth=1 14:53:36 [drm:i830_addmap] offset = 0xe0100000, size = 0x00080000, type = 1 14:53:36 [drm:i830_ioctl] pid=1579, cmd=0xc0186415, nr=0x15, dev 0xe201, auth=1 14:53:36 [drm:i830_addmap] offset = 0xdf800000, size = 0x00300000, type = 3 14:53:36 [drm:i830_ioctl] pid=1579, cmd=0xc0186415, nr=0x15, dev 0xe201, auth=1 14:53:36 [drm:i830_addmap] offset = 0xdf400000, size = 0x00300000, type = 3 14:53:36 [drm:i830_ioctl] pid=1579, cmd=0xc0186415, nr=0x15, dev 0xe201, auth=1 14:53:36 [drm:i830_addmap] offset = 0xdf2f8000, size = 0x00100000, type = 3 14:53:36 [drm:i830_ioctl] pid=1579, cmd=0xc0186415, nr=0x15, dev 0xe201, auth=1 14:53:36 [drm:i830_addmap] offset = 0xd8000000, size = 0x00020000, type = 3 14:53:36 [drm:i830_ioctl] pid=1579, cmd=0xc0186415, nr=0x15, dev 0xe201, auth=1 14:53:36 [drm:i830_addmap] offset = 0xd8566000, size = 0x01380000, type = 3 14:53:36 [drm:i830_ioctl] pid=1579, cmd=0xc0186416, nr=0x16, dev 0xe201, auth=1 14:53:36 [drm:i830_addbufs_agp] count: 256 14:53:36 [drm:i830_addbufs_agp] order: 12 14:53:36 [drm:i830_addbufs_agp] size: 4096 14:53:36 [drm:i830_addbufs_agp] agp_offset: -550535168 14:53:36 [drm:i830_addbufs_agp] alignment: 4096 14:53:36 [drm:i830_addbufs_agp] page_order: 0 14:53:36 [drm:i830_addbufs_agp] total: 4096 14:53:36 [drm:i830_addbufs_agp] buffer 0 @ df2f8000 14:53:36 [drm:i830_addbufs_agp] buffer 1 @ df2f9000 14:53:36 [drm:i830_addbufs_agp] buffer 2 @ df2fa000 ...... 14:53:36: [drm:i830_addbufs_agp] buffer 253 @ df3f5000 14:53:36: [drm:i830_addbufs_agp] buffer 254 @ df3f6000 14:53:36: [drm:i830_addbufs_agp] buffer 255 @ df3f7000 14:53:36: [drm:i830_addbufs_agp] byte_count: 1048576 14:53:36: [drm:i830_addbufs_agp] dma->buf_count : 256 14:53:36: [drm:i830_addbufs_agp] entry->buf_count : 256 14:53:36: [drm:i830_ioctl] pid=1579, cmd=0x40446440, nr=0x40, dev 0xe201, auth=1 14:53:36: [drm:i830_dma_initialize] front_di1 20000 14:53:36: [drm:i830_dma_initialize] back_offset 7800000 14:53:36: [drm:i830_dma_initialize] back_di1 7800000 14:53:36: [drm:i830_dma_initialize] pitch_bits 0 14:53:36: [drm:i830_dma_initialize] hw status page @ d98d9000 14:53:36: [drm:i830_dma_initialize] Enabled hardware status page 14:53:36: [drm:i830_ioctl] pid=1579, cmd=0xc0106403, nr=0x03, dev 0xe201, auth=1 14:53:36: [drm:i830_irq_busid] 0:2:0 => IRQ 16 14:53:36: [drm:i830_ioctl] pid=1579, cmd=0x40086414, nr=0x14, dev 0xe201, auth=1 14:53:36: [drm:i830_ioctl] pid=1579, cmd=0xc0086420, nr=0x20, dev 0xe201, auth=1 14:53:36: [drm:i830_ctxbitmap_next] drm_ctxbitmap_next bit : 1 14:53:36: [drm:i830_addctx] 1 14:53:36: [drm:i830_ioctl] pid=1579, cmd=0x40086422, nr=0x22, dev 0xe201, auth=1 14:53:36: [drm:i830_ioctl] pid=1579, cmd=0x4008642a, nr=0x2a, dev 0xe201, auth=1 14:53:36: [drm:i830_lock] 1 (pid 1579) requests lock (0x00000000), flags = 0x00000000 14:53:36: [drm:i830_lock] 1 has lock 14:53:36: [drm:i830_fasync] fd = 6, device = 0xe201 14:53:36: [drm:i830_vm_open] 0x40017000,0x00002000 14:53:36: [drm:i830_vm_shm_close] 0x40017000,0x00002000 14:53:36: [drm:i830_flush] pid = 1582, device = 0xe201, open_count = 1 14:53:38: [drm:i830_vm_open] 0x40017000,0x00002000 14:53:38: [drm:i830_vm_shm_close] 0x40017000,0x00002000 14:53:38: [drm:i830_flush] pid = 1583, device = 0xe201, open_count = 1 14:53:38: [drm:i830_ioctl] pid=1579, cmd=0x4008642a, nr=0x2a, dev 0xe201, auth=1 14:53:38: [drm:i830_lock] 1 (pid 1579) requests lock (0x00000001), flags = 0x0000000a 14:53:38: [drm:i830_lock] 1 has lock *** OOPS HERE, MEMORY CORRUPTION HAS HAPPENED! *** The oops itself is attached, but I don't think it's interesting. It's just crazy enough that it's almost certainly memory corruption. My guess would be either on that i830_vm_open/i830_vm_shm_close pair at the end. The last ioctl is just a plain DRM_IOCTL_LOCK(), which shouldn't be doing a whole lot. Similarly, the preceding flush doesn't actually _do_ anything. But hey, maybe it's the dma_initialize or something that happened much earlier, so I put the whole log there in case somebody sees something obviously bad. Linus --- 14:53:38: Unable to handle kernel paging request at virtual address d98db980 14:53:38: printing eip: 14:53:38: c01809a6 14:53:38: *pde = 197fe163 14:53:38: *pte = 00000000 14:53:38: Oops: 0000 [#1] 14:53:38: CPU: 1 14:53:38: EIP: 0060:[<c01809a6>] Not tainted 14:53:38: EFLAGS: 00010282 14:53:38: EIP is at get_vmalloc_info+0x5d/0xba 14:53:38: eax: e0436000 ebx: d98db980 ecx: e04b7000 edx: 00000000 14:53:38: esi: 004b7000 edi: 00000000 ebp: d85cddd4 esp: d85cddc8 14:53:38: ds: 007b es: 007b ss: 0068 14:53:38: Process egrep (pid: 1603, threadinfo=d85cc000 task=dc56c080) 14:53:38: Stack: 0007ffb8 000080a4 d85f0000 d85cdf1c c0180baa d85cde48 d85cde40 d85cde44 14:53:38: 00001002 df7df390 df7e7500 df7e8600 d85cde10 c017bc79 d85cde10 c016934c 14:53:38: df7df390 df7df390 d85cde30 c017bf91 df7df390 00001002 dbd9a480 00000007 14:53:38: Call Trace: 14:53:38: [<c0180baa>] meminfo_read_proc+0x7f/0x1c7 14:53:38: [<c017bc79>] proc_read_inode+0x17/0x39 14:53:38: [<c016934c>] wake_up_inode+0x14/0x3f 14:53:38: [<c017bf91>] proc_get_inode+0x11f/0x143 14:53:38: [<c017ec31>] proc_lookup+0xda/0x14f 14:53:38: [<c0136d86>] __alloc_pages+0x8a/0x306 14:53:38: [<c0180b2b>] meminfo_read_proc+0x0/0x1c7 14:53:38: [<c017e6a0>] proc_file_read+0xbf/0x245 14:53:38: [<c014ee16>] vfs_read+0xaf/0x119 14:53:38: [<c014f089>] sys_read+0x3c/0x51 14:53:38: [<c0109405>] sysenter_past_esp+0x52/0x71 14:53:38: |
From: Linus T. <tor...@tr...> - 2003-04-25 19:45:51
|
On Thu, 24 Apr 2003, Linus Torvalds wrote: > 14:53:36: [drm:i830_ctxbitmap_next] drm_ctxbitmap_next bit : 1 > 14:53:36: [drm:i830_addctx] 1 > 14:53:36: [drm:i830_ioctl] pid=1579, cmd=0x40086422, nr=0x22, dev 0xe201, auth=1 > 14:53:36: [drm:i830_ioctl] pid=1579, cmd=0x4008642a, nr=0x2a, dev 0xe201, auth=1 > 14:53:36: [drm:i830_lock] 1 (pid 1579) requests lock (0x00000000), flags = 0x00000000 > 14:53:36: [drm:i830_lock] 1 has lock > 14:53:36: [drm:i830_fasync] fd = 6, device = 0xe201 > 14:53:36: [drm:i830_vm_open] 0x40017000,0x00002000 > 14:53:36: [drm:i830_vm_shm_close] 0x40017000,0x00002000 > 14:53:36: [drm:i830_flush] pid = 1582, device = 0xe201, open_count = 1 > 14:53:38: [drm:i830_vm_open] 0x40017000,0x00002000 > 14:53:38: [drm:i830_vm_shm_close] 0x40017000,0x00002000 > 14:53:38: [drm:i830_flush] pid = 1583, device = 0xe201, open_count = 1 > 14:53:38: [drm:i830_ioctl] pid=1579, cmd=0x4008642a, nr=0x2a, dev 0xe201, auth=1 > 14:53:38: [drm:i830_lock] 1 (pid 1579) requests lock (0x00000001), flags = 0x0000000a > 14:53:38: [drm:i830_lock] 1 has lock > > *** OOPS HERE, MEMORY CORRUPTION HAS HAPPENED! *** > > The oops itself is attached, but I don't think it's interesting. It's just > crazy enough that it's almost certainly memory corruption. More memory corruption and "impossible" oopses, this time earlier in the sequence, immediately after the first "i830_vm_open". Again, this never happens on the _first_ start of X, so it's something that doesn't get reset properly across an X session. Further info: I don't actually have to start a 3D program to trigger this. In fact, as can be seen from the DRM logs, I only need to start the X server with a simple "xterm" client, shut it down, and re-start it again. It's the act of initializing AGP and/or DRI that corrupts stuff. I wonder what I do differently that I can see this, and apparently Keith and others cannot. Linus |
From: Dave J. <da...@co...> - 2003-04-25 20:21:23
|
On Fri, Apr 25, 2003 at 12:46:23PM -0700, Linus Torvalds wrote: > More memory corruption and "impossible" oopses, this time earlier in the > sequence, immediately after the first "i830_vm_open". > > Again, this never happens on the _first_ start of X, so it's something > that doesn't get reset properly across an X session. > > Further info: I don't actually have to start a 3D program to trigger this. > In fact, as can be seen from the DRM logs, I only need to start the X > server with a simple "xterm" client, shut it down, and re-start it again. > > It's the act of initializing AGP and/or DRI that corrupts stuff. > > I wonder what I do differently that I can see this, and apparently Keith > and others cannot. What version of DRI are you using? cvs HEAD ? Dave |
From: Linus T. <tor...@tr...> - 2003-04-25 20:38:42
|
On Fri, 25 Apr 2003, Dave Jones wrote: > > I wonder what I do differently that I can see this, and apparently Keith > > and others cannot. > > What version of DRI are you using? cvs HEAD ? Current 2.5.x DRI, which is pretty close to CVS head. But this has been on-going at least for a few weeks, definitely over the last DRI->kernel merge. Linus |
From: Dave J. <da...@co...> - 2003-04-25 20:44:48
|
On Fri, Apr 25, 2003 at 01:39:20PM -0700, Linus Torvalds wrote: > > On Fri, 25 Apr 2003, Dave Jones wrote: > > > I wonder what I do differently that I can see this, and apparently Keith > > > and others cannot. > > > > What version of DRI are you using? cvs HEAD ? > > Current 2.5.x DRI, which is pretty close to CVS head. But this has been > on-going at least for a few weeks, definitely over the last DRI->kernel > merge. Sorry, I meant which X version... Dave |
From: Linus T. <tor...@tr...> - 2003-04-25 21:16:55
|
On Fri, 25 Apr 2003, Dave Jones wrote: > > Sorry, I meant which X version... Oh, dri head. But again, this thing has locked up for me with the head for at least a few weeks now, so it's not just one random snapshot. Linus |
From: Keith W. <ke...@tu...> - 2003-04-25 20:46:54
|
Linus Torvalds wrote: > On Fri, 25 Apr 2003, Dave Jones wrote: > >> > I wonder what I do differently that I can see this, and apparently Keith >> > and others cannot. >> >>What version of DRI are you using? cvs HEAD ? > > > Current 2.5.x DRI, which is pretty close to CVS head. But this has been > on-going at least for a few weeks, definitely over the last DRI->kernel > merge. I've tried again & still can't reproduce it. I'm using basically rh7.3 and dri head. My agpgart module isn't standard, being left over from our internal development for the i830 -- maybe that's a source of the differences? Keith |
From: Leif D. <lde...@re...> - 2003-04-25 22:03:17
|
On Fri, 25 Apr 2003, Keith Whitwell wrote: > Linus Torvalds wrote: > > On Fri, 25 Apr 2003, Dave Jones wrote: > > > >> > I wonder what I do differently that I can see this, and apparently Keith > >> > and others cannot. > >> > >>What version of DRI are you using? cvs HEAD ? > > > > > > Current 2.5.x DRI, which is pretty close to CVS head. But this has been > > on-going at least for a few weeks, definitely over the last DRI->kernel > > merge. > > I've tried again & still can't reproduce it. I'm using basically rh7.3 and > dri head. My agpgart module isn't standard, being left over from our internal > development for the i830 -- maybe that's a source of the differences? > > Keith One thing that looks odd to me is that both the i810 and i830 DDX call the DRM dma init before DRIFinishScreenInit, which means the lock isn't held during the dma init. Actually, I'm wondering why none of the drivers seem to have the lock test macro in the dma,cp,cce, etc. init/cleanup ioctl. Other DDX drivers have comments about DRIFinishScreenInit needing to be called before the kernel init so that the lock is held. The bug in 4.3.0 with the i810/i830 DDX not removing the IRQ handler (only affecting 'older' kernel modules that used IRQs), is a good example of why we should try not to make assumptions that userspace will call ioctls in a certain order, or call the cleanup ioctls at all. We shouldn't oops because userspace didn't do what we expected. This is a bit offtopic, but I think all the drivers that can use IRQs should probably call DRM(uninstall_irq) in the cleanup function if it hasn't been done already (i.e. dev->irq != 0), and should make sure it's cleanup function has been called on takedown -- the radeon driver does this in DRIVER_PRETAKEDOWN(). -- Leif Delgass http://www.retinalburn.net |
From: Keith W. <ke...@tu...> - 2003-04-25 22:07:48
|
Leif Delgass wrote: > On Fri, 25 Apr 2003, Keith Whitwell wrote: > > >>Linus Torvalds wrote: >> >>>On Fri, 25 Apr 2003, Dave Jones wrote: >>> >>> >>>>>I wonder what I do differently that I can see this, and apparently Keith >>>>>and others cannot. >>>> >>>>What version of DRI are you using? cvs HEAD ? >>> >>> >>>Current 2.5.x DRI, which is pretty close to CVS head. But this has been >>>on-going at least for a few weeks, definitely over the last DRI->kernel >>>merge. >> >>I've tried again & still can't reproduce it. I'm using basically rh7.3 and >>dri head. My agpgart module isn't standard, being left over from our internal >>development for the i830 -- maybe that's a source of the differences? >> >>Keith > > > One thing that looks odd to me is that both the i810 and i830 DDX call the > DRM dma init before DRIFinishScreenInit, which means the lock isn't held > during the dma init. Actually, I'm wondering why none of the drivers seem > to have the lock test macro in the dma,cp,cce, etc. init/cleanup ioctl. > Other DDX drivers have comments about DRIFinishScreenInit needing to be > called before the kernel init so that the lock is held. > > The bug in 4.3.0 with the i810/i830 DDX not removing the IRQ handler (only > affecting 'older' kernel modules that used IRQs), is a good example of why > we should try not to make assumptions that userspace will call ioctls in a > certain order, or call the cleanup ioctls at all. We shouldn't oops > because userspace didn't do what we expected. Obviously -- I don't think there's a deliberate policy of doing this - at worst a selective blindness to the workings of code on the other sides of various lines in the sand. I know I don't pay a lot of attention to the code in the DDX once it appears to be working. > This is a bit offtopic, but I think all the drivers that can use IRQs > should probably call DRM(uninstall_irq) in the cleanup function if it > hasn't been done already (i.e. dev->irq != 0), and should make sure it's > cleanup function has been called on takedown -- the radeon driver does > this in DRIVER_PRETAKEDOWN(). That sounds reasonable - feel free to make these sort of cleanups as you feel motivated to do so... Keith |
From: Linus T. <tor...@tr...> - 2003-04-25 22:52:20
|
On Fri, 25 Apr 2003, Keith Whitwell wrote: > > I've tried again & still can't reproduce it. I'm using basically rh7.3 and > dri head. My agpgart module isn't standard, being left over from our internal > development for the i830 -- maybe that's a source of the differences? That would definitely be interesting to hear. One of the things that has changed in the kernel is AGP infrastructure support for AGP-3 etc.. Linus |
From: Linus T. <tor...@tr...> - 2003-04-26 03:35:01
|
Btw, this is my current diff of cleanups from the kernel. Some of it is removal of the "wrapper" functions (deprecated), and most of it is cleanups of "hw_status_page" in the i8x0 drivers: it should be a pointer, since every _single_ use of it is as a pointer. So instead of having it as an unsigned long and casting it, just make it a "void *" in the first place, avoiding all the need for casting. Linus ---- diff -u --recursive dri-kernel/drm_memory.h v2.5/linux/drivers/char/drm/drm_memory.h --- dri-kernel/drm_memory.h 2003-04-25 14:38:37.000000000 -0700 +++ v2.5/linux/drivers/char/drm/drm_memory.h 2003-04-25 16:01:30.000000000 -0700 @@ -29,10 +29,9 @@ * Gareth Hughes <ga...@va...> */ #define __NO_VERSION__ #include <linux/config.h> #include "drmP.h" -#include <linux/wrapper.h> /* Cut down version of drm_memory_debug.h, which used to be called * drm_memory.h. If you want the debug functionality, change 0 to 1 @@ -95,7 +93,7 @@ for (addr = address, sz = bytes; sz > 0; addr += PAGE_SIZE, sz -= PAGE_SIZE) { - mem_map_reserve(virt_to_page(addr)); + SetPageReserved(virt_to_page(addr)); } return address; @@ -114,7 +112,7 @@ for (addr = address, sz = bytes; sz > 0; addr += PAGE_SIZE, sz -= PAGE_SIZE) { - mem_map_unreserve(virt_to_page(addr)); + ClearPageReserved(virt_to_page(addr)); } free_pages(address, order); diff -u --recursive dri-kernel/drm_memory_debug.h v2.5/linux/drivers/char/drm/drm_memory_debug.h --- dri-kernel/drm_memory_debug.h 2003-04-24 03:02:18.000000000 -0700 +++ v2.5/linux/drivers/char/drm/drm_memory_debug.h 2003-04-25 16:01:30.000000000 -0700 @@ -29,10 +29,9 @@ * Gareth Hughes <ga...@va...> */ #define __NO_VERSION__ #include <linux/config.h> #include "drmP.h" -#include <linux/wrapper.h> typedef struct drm_mem_stats { const char *name; @@ -232,7 +230,7 @@ for (addr = address, sz = bytes; sz > 0; addr += PAGE_SIZE, sz -= PAGE_SIZE) { - mem_map_reserve(virt_to_page(addr)); + SetPageReserved(virt_to_page(addr)); } return address; @@ -253,7 +251,7 @@ for (addr = address, sz = bytes; sz > 0; addr += PAGE_SIZE, sz -= PAGE_SIZE) { - mem_map_unreserve(virt_to_page(addr)); + ClearPageReserved(virt_to_page(addr)); } free_pages(address, order); } diff -u --recursive dri-kernel/drm_os_linux.h v2.5/linux/drivers/char/drm/drm_os_linux.h --- dri-kernel/drm_os_linux.h 2003-04-09 19:51:41.000000000 -0700 +++ v2.5/linux/drivers/char/drm/drm_os_linux.h 2003-04-25 15:51:14.000000000 -0700 @@ -70,7 +69,7 @@ current->state = TASK_INTERRUPTIBLE; \ if (condition) \ break; \ - if((signed)(end - jiffies) <= 0) { \ + if (time_after_eq(jiffies, end)) { \ ret = -EBUSY; \ break; \ } \ diff -u --recursive dri-kernel/i810_dma.c v2.5/linux/drivers/char/drm/i810_dma.c --- dri-kernel/i810_dma.c 2003-04-25 14:38:38.000000000 -0700 +++ v2.5/linux/drivers/char/drm/i810_dma.c 2003-04-25 17:35:00.000000000 -0700 @@ -62,7 +55,7 @@ { drm_device_dma_t *dma = dev->dma; drm_i810_private_t *dev_priv = dev->dev_private; - u32 *temp = (u32 *)dev_priv->hw_status_page; + u32 *temp = dev_priv->hw_status_page; int i; DRM_DEBUG( "hw_status: Interrupt Status : %x\n", temp[0]); @@ -247,9 +240,9 @@ DRM(ioremapfree)((void *) dev_priv->ring.virtual_start, dev_priv->ring.Size); } - if(dev_priv->hw_status_page != 0UL) { + if (dev_priv->hw_status_page) { pci_free_consistent(dev->pdev, PAGE_SIZE, - (void *)dev_priv->hw_status_page, + dev_priv->hw_status_page, dev_priv->dma_status_page); /* Need to rewrite hardware status page */ I810_WRITE(0x02080, 0x1ffff000); @@ -412,16 +405,16 @@ /* Program Hardware Status Page */ dev_priv->hw_status_page = - (unsigned long) pci_alloc_consistent(dev->pdev, PAGE_SIZE, + pci_alloc_consistent(dev->pdev, PAGE_SIZE, &dev_priv->dma_status_page); - if(dev_priv->hw_status_page == 0UL) { + if (!dev_priv->hw_status_page) { dev->dev_private = (void *)dev_priv; i810_dma_cleanup(dev); DRM_ERROR("Can not allocate hardware status page\n"); return -ENOMEM; } - memset((void *) dev_priv->hw_status_page, 0, PAGE_SIZE); - DRM_DEBUG("hw status page @ %lx\n", dev_priv->hw_status_page); + memset(dev_priv->hw_status_page, 0, PAGE_SIZE); + DRM_DEBUG("hw status page @ %p\n", dev_priv->hw_status_page); I810_WRITE(0x02080, dev_priv->dma_status_page); DRM_DEBUG("Enabled hardware status page\n"); @@ -906,7 +899,7 @@ drm_device_t *dev = priv->dev; drm_device_dma_t *dma = dev->dma; drm_i810_private_t *dev_priv = (drm_i810_private_t *)dev->dev_private; - u32 *hw_status = (u32 *)dev_priv->hw_status_page; + u32 *hw_status = dev_priv->hw_status_page; drm_i810_sarea_t *sarea_priv = (drm_i810_sarea_t *) dev_priv->sarea_priv; drm_i810_vertex_t vertex; @@ -982,7 +975,7 @@ drm_file_t *priv = filp->private_data; drm_device_t *dev = priv->dev; drm_i810_private_t *dev_priv = (drm_i810_private_t *)dev->dev_private; - u32 *hw_status = (u32 *)dev_priv->hw_status_page; + u32 *hw_status = dev_priv->hw_status_page; drm_i810_sarea_t *sarea_priv = (drm_i810_sarea_t *) dev_priv->sarea_priv; @@ -998,7 +991,7 @@ int retcode = 0; drm_i810_dma_t d; drm_i810_private_t *dev_priv = (drm_i810_private_t *)dev->dev_private; - u32 *hw_status = (u32 *)dev_priv->hw_status_page; + u32 *hw_status = dev_priv->hw_status_page; drm_i810_sarea_t *sarea_priv = (drm_i810_sarea_t *) dev_priv->sarea_priv; @@ -1107,7 +1100,7 @@ drm_device_t *dev = priv->dev; drm_device_dma_t *dma = dev->dma; drm_i810_private_t *dev_priv = (drm_i810_private_t *)dev->dev_private; - u32 *hw_status = (u32 *)dev_priv->hw_status_page; + u32 *hw_status = dev_priv->hw_status_page; drm_i810_sarea_t *sarea_priv = (drm_i810_sarea_t *) dev_priv->sarea_priv; drm_i810_mc_t mc; diff -u --recursive dri-kernel/i810_drv.h v2.5/linux/drivers/char/drm/i810_drv.h --- dri-kernel/i810_drv.h 2003-04-09 19:51:41.000000000 -0700 +++ v2.5/linux/drivers/char/drm/i810_drv.h 2003-04-25 16:10:49.000000000 -0700 @@ -61,7 +61,7 @@ drm_i810_sarea_t *sarea_priv; drm_i810_ring_buffer_t ring; - unsigned long hw_status_page; + void *hw_status_page; unsigned long counter; dma_addr_t dma_status_page; diff -u --recursive dri-kernel/i830_dma.c v2.5/linux/drivers/char/drm/i830_dma.c --- dri-kernel/i830_dma.c 2003-04-25 14:38:38.000000000 -0700 +++ v2.5/linux/drivers/char/drm/i830_dma.c 2003-04-25 18:21:49.000000000 -0700 @@ -59,19 +52,11 @@ #define up_write up #endif -#ifndef LockPage -#define LockPage(page) set_bit(PG_locked, &(page)->flags) -#endif -#ifndef UnlockPage -#define UnlockPage(page) unlock_page(page) -#endif - - static inline void i830_print_status_page(drm_device_t *dev) { drm_device_dma_t *dma = dev->dma; drm_i830_private_t *dev_priv = dev->dev_private; - u32 *temp = (u32 *)dev_priv->hw_status_page; + u32 *temp = dev_priv->hw_status_page; int i; DRM_DEBUG( "hw_status: Interrupt Status : %x\n", temp[0]); @@ -181,10 +166,10 @@ buf->bus_address); dev_priv->mmap_buffer = NULL; filp->f_op = old_fops; - if ((unsigned long)buf_priv->virtual > -1024UL) { + if (IS_ERR(buf_priv->virtual)) { /* Real error */ DRM_ERROR("mmap error\n"); - retcode = (signed int)buf_priv->virtual; + retcode = PTR_ERR(buf_priv->virtual); buf_priv->virtual = 0; } up_write( ¤t->mm->mmap_sem ); @@ -255,9 +240,9 @@ DRM(ioremapfree)((void *) dev_priv->ring.virtual_start, dev_priv->ring.Size); } - if(dev_priv->hw_status_page != 0UL) { + if (dev_priv->hw_status_page) { pci_free_consistent(dev->pdev, PAGE_SIZE, - (void *)dev_priv->hw_status_page, + dev_priv->hw_status_page, dev_priv->dma_status_page); /* Need to rewrite hardware status page */ I830_WRITE(0x02080, 0x1ffff000); @@ -449,16 +434,16 @@ /* Program Hardware Status Page */ dev_priv->hw_status_page = - (unsigned long) pci_alloc_consistent(dev->pdev, PAGE_SIZE, + pci_alloc_consistent(dev->pdev, PAGE_SIZE, &dev_priv->dma_status_page); - if(dev_priv->hw_status_page == 0UL) { + if (!dev_priv->hw_status_page) { dev->dev_private = (void *)dev_priv; i830_dma_cleanup(dev); DRM_ERROR("Can not allocate hardware status page\n"); return -ENOMEM; } - memset((void *) dev_priv->hw_status_page, 0, PAGE_SIZE); - DRM_DEBUG("hw status page @ %lx\n", dev_priv->hw_status_page); + memset(dev_priv->hw_status_page, 0, PAGE_SIZE); + DRM_DEBUG("hw status page @ %p\n", dev_priv->hw_status_page); I830_WRITE(0x02080, dev_priv->dma_status_page); DRM_DEBUG("Enabled hardware status page\n"); @@ -1350,7 +1335,7 @@ drm_device_t *dev = priv->dev; drm_device_dma_t *dma = dev->dma; drm_i830_private_t *dev_priv = (drm_i830_private_t *)dev->dev_private; - u32 *hw_status = (u32 *)dev_priv->hw_status_page; + u32 *hw_status = dev_priv->hw_status_page; drm_i830_sarea_t *sarea_priv = (drm_i830_sarea_t *) dev_priv->sarea_priv; drm_i830_vertex_t vertex; @@ -1475,7 +1460,7 @@ drm_file_t *priv = filp->private_data; drm_device_t *dev = priv->dev; drm_i830_private_t *dev_priv = (drm_i830_private_t *)dev->dev_private; - u32 *hw_status = (u32 *)dev_priv->hw_status_page; + u32 *hw_status = dev_priv->hw_status_page; drm_i830_sarea_t *sarea_priv = (drm_i830_sarea_t *) dev_priv->sarea_priv; @@ -1491,7 +1476,7 @@ int retcode = 0; drm_i830_dma_t d; drm_i830_private_t *dev_priv = (drm_i830_private_t *)dev->dev_private; - u32 *hw_status = (u32 *)dev_priv->hw_status_page; + u32 *hw_status = dev_priv->hw_status_page; drm_i830_sarea_t *sarea_priv = (drm_i830_sarea_t *) dev_priv->sarea_priv; diff -u --recursive dri-kernel/i830_drv.h v2.5/linux/drivers/char/drm/i830_drv.h --- dri-kernel/i830_drv.h 2003-04-09 19:51:42.000000000 -0700 +++ v2.5/linux/drivers/char/drm/i830_drv.h 2003-04-25 16:10:49.000000000 -0700 @@ -61,7 +61,7 @@ drm_i830_sarea_t *sarea_priv; drm_i830_ring_buffer_t ring; - unsigned long hw_status_page; + void * hw_status_page; unsigned long counter; dma_addr_t dma_status_page; |
From: Keith W. <ke...@tu...> - 2003-04-26 21:34:05
|
Linus Torvalds wrote: > Btw, this is my current diff of cleanups from the kernel. Some of it is > removal of the "wrapper" functions (deprecated), and most of it is > cleanups of "hw_status_page" in the i8x0 drivers: it should be a pointer, > since every _single_ use of it is as a pointer. So instead of having it as > an unsigned long and casting it, just make it a "void *" in the first > place, avoiding all the need for casting. > OK, committed. Keith |
From: Linus T. <tor...@tr...> - 2003-04-26 01:04:39
|
On Fri, 25 Apr 2003, Keith Whitwell wrote: > > I've tried again & still can't reproduce it. Keith, how much memory do you have? In particular, look at i8?0_dma_cleanup(), and notice this line: I830_WRITE(0x02080, 0x1ffff000); I don't know about you - but on the hardware _I_ have, that's a perfectly valid page, just under the 512MB mark. In particular, it's a page that DRM has _not_ allocated. If the graphics card starts writing to it (or reading from it), crap is going to happen. I don't know what the format of register 0x02080 is, but judging by the code that writes the normal data in there, it's just a physical page address. Which makes me think that the above is wrong when there _is_ such a physical page. Or is "0x1ffff000" some documented "shut me off" value? What happens if that happens to be the page that is allocated for the _real_ status page? Unlikely, but still.. Maybe a comment would be in order, or suggestions for something to try. Linus |