Nouveau dumb buffer bug

[Rian Quinn]

I wrote a unit test that basically exercises the dumb buffer IOCTL to
verify that I can create and destroy dumb buffers without any problems. All
of my tests pass except for one test, on the nouveau driver.

Right now I am testing on an nVidia K2000, which can support two monitors.
If I allocate three buffers at 4096, 4096, attempts to access the third
buffer causes a "Bus error" to occur. All of the IOCTLs, mmaps, and DRM API
calls pass without error. You don't see a problem until you attempt to
access the buffer itself. I have included a simple test case that
demonstrates this.

Up front, I am aware that the test case doesn't clean up as this is part of
the test (allocating more than one buffer). I am also aware that I am
allocating more buffers than I need (as only two monitors are supported).
My reason for bringing this up is that you would expect that if the nVidia
card ran out of memory to map in, it would error out on one of the IOCTLs.

#define _FILE_OFFSET_BITS 64

// Generic Includes
#include <sys/ioctl.h>
#include <sys/types.h>
#include <sys/stat.h>
#include <sys/mman.h>
#include <stdbool.h>
#include <stdint.h>
#include <stdlib.h>
#include <unistd.h>
#include <getopt.h>
#include <string.h>
#include <fcntl.h>
#include <stdio.h>
#include <error.h>
#include <errno.h>

// LibDRM
#include <xf86drm.h>
#include <xf86drmMode.h>

int fd;

void allocate_buffer(int width, int height)
{
    unsigned int *mVaddr;
    int mSize, mStride, mHandle, mFb;
    struct drm_mode_create_dumb create_arg;
    struct drm_mode_map_dumb map_arg;

    // Clear the arg buffers.
    memset(&create_arg, 0, sizeof(create_arg));
    memset(&map_arg, 0, sizeof(map_arg));

    //
------------------------------------------------------------------------
    // Allocate

    // Fill in the arguments for the IOCTL. Note that we only support 32bpp
    // dumb buffers so that is hard coded here.
    create_arg.width = width;
    create_arg.height = height;
    create_arg.bpp = 32;

    // Allocate the dumb buffer
    if (drmIoctl(fd, DRM_IOCTL_MODE_CREATE_DUMB, &create_arg))
    {
        printf("Failed: DRM_IOCTL_MODE_CREATE_DUMB\r\n");
        return;
    }

    // Store the dumb buffer properties.
    mSize = create_arg.size;
    mStride = create_arg.pitch;
    mHandle = create_arg.handle;

    //
------------------------------------------------------------------------
    // Map

    // Fill in the arguments for the IOCTL.
    map_arg.handle = mHandle;

    // Allocate the dumb buffer
    if (drmIoctl(fd, DRM_IOCTL_MODE_MAP_DUMB, &map_arg))
    {
        printf("Failed: DRM_IOCTL_MODE_MAP_DUMB\r\n");
        return;
    }

    // Store the mapped memory
    if ((mVaddr = (unsigned int *)mmap(0, mSize, PROT_READ | PROT_WRITE,
MAP_SHARED, fd, map_arg.offset)) == MAP_FAILED)
    {
        // Need to clear out the address so that we don't try to use it.
        mVaddr = NULL;

        // Error out.
        printf("Failed: mmap\r\n");
        return;
    }

    //
------------------------------------------------------------------------
    // Add to DRM

    if(drmModeAddFB(fd, width, height, 24, 32, mStride, mHandle, &mFb))
    {
        printf("Failed: drmModeAddFB\r\n");
        return;
    }

    printf("allocated buffer: (%p) width=%d height=%d\r\n", mVaddr, width,
height);
    mVaddr[0] = 0x10101010;
    printf("  - touched buffer: (%p)\r\n", mVaddr);

}

main()
{
if ((fd = open("/dev/dri/card1", O_RDWR)) == -1)
{
printf("open failed\r\n");
exit(1);
}

    allocate_buffer(4096, 4096);
    allocate_buffer(4096, 4096);
    allocate_buffer(4096, 4096);
    allocate_buffer(4096, 4096);
    allocate_buffer(4096, 4096);
    allocate_buffer(4096, 4096);
    allocate_buffer(4096, 4096);
    allocate_buffer(4096, 4096);

close(fd);
}
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.freedesktop.org/archives/dri-devel/attachments/20141111/e14bd5b1/attachment-0001.html>