[Nouveau] [PATCH] drm/nv50: initialize ramht_refs list for faked 0 channel

[Marcin Slusarz]

On Thu, Sep 02, 2010 at 10:31:55PM +1000, Ben Skeggs wrote:
> On Thu, 2010-09-02 at 12:45 +0200, Marcin Slusarz wrote:
> > On Wed, Sep 01, 2010 at 07:52:58AM +1000, Ben Skeggs wrote:
> > > On Tue, 2010-08-31 at 23:22 +0200, Marcin Slusarz wrote:
> > > > On Sun, Aug 22, 2010 at 08:54:08PM +0200, Marcin Slusarz wrote:
> > > > > We need it for PFIFO_INTR_CACHE_ERROR interrupt handling,
> > > > > because nouveau_fifo_swmthd looks for matching gpuobj in
> > > > > ramht_refs list.
> > > > > It fixes kernel panic in nouveau_gpuobj_ref_find.
> > > > > 
> > > > > Signed-off-by: Marcin Slusarz <marcin.slusarz at gmail.com>
> > > > > ---
> > > > >  drivers/gpu/drm/nouveau/nv50_instmem.c |    2 ++
> > > > >  1 files changed, 2 insertions(+), 0 deletions(-)
> > > > > 
> > > > > diff --git a/drivers/gpu/drm/nouveau/nv50_instmem.c b/drivers/gpu/drm/nouveau/nv50_instmem.c
> > > > > index b57cc4a..6e57426 100644
> > > > > --- a/drivers/gpu/drm/nouveau/nv50_instmem.c
> > > > > +++ b/drivers/gpu/drm/nouveau/nv50_instmem.c
> > > > > @@ -139,6 +139,8 @@ nv50_instmem_init(struct drm_device *dev)
> > > > >  	chan->file_priv = (struct drm_file *)-2;
> > > > >  	dev_priv->fifos[0] = dev_priv->fifos[127] = chan;
> > > > >  
> > > > > +	INIT_LIST_HEAD(&chan->ramht_refs);
> > > > > +
> > > > >  	/* Channel's PRAMIN object + heap */
> > > > >  	ret = nouveau_gpuobj_new_fake(dev, 0, c_offset, c_size, 0,
> > > > >  							NULL, &chan->ramin);
> > > > > -- 
> > > > 
> > > > ping
> > > Pong!  Thank you for the patch.
> > > 
> > > I meant to reply to this earlier but it slipped my mind.  I have a
> > > number of pending cleanups to all this stuff that should make this patch
> > > unnecessary.
> > 
> > Oh, come on. It's a simple one-line bugfix for easily triggerable kernel panic.
> > Patch like this should not wait a week for any response - it should be applied
> > ASAP and go to Linus possibly with -stable tag.
> Oh please, it's hardly easily triggerable.  I've *never* seen it
> personally, and triggering errors on those channels isn't something that
> generally happens. 

Are you sure you have *never* seen it? Do you have netconsole enabled all the time?
I'm asking because once you hit this bug, machine is dead and you won't find anything
in the logs.

I'm attaching the testcase. Yes, it's that simple.

--
#include <stdio.h>

#include <libdrm/nouveau_drmif.h>
#include <nouveau/nouveau_channel.h>

int main()
{
	struct nouveau_device *dev = NULL;
	struct nouveau_channel *chan = NULL;

	if (nouveau_device_open(&dev, "")) {
		perror("nouveau_device_open");
		return 1;
	}

	if (nouveau_channel_alloc(dev, 0, 0, &chan)) {
		perror("nouveau_channel_alloc");
		return 2;
	}

	return 0;
}