13:28 <liquidAcid> [ 88.569822] PAGE FAULT occurred at 0xdfb80 by 10a40000.sysmmu(Page table base: 0x6d860000)

13:28 <liquidAcid> prahal___, oops i did it again :)

13:55 <prahal___> liquidAcid: gasp , ! thanks for the feedback

13:55 <prahal___> gtg

15:58 <liquidAcid> prahal__, seems to be an out-of-array-bounds access, more details later

16:38 <liquidAcid> prahal__, userspace buffer allocated via posix_memalign to system pagesize: userptr (0xb189d000), size = 458752

16:38 <liquidAcid> g2d_map_cmdlist_gem creates this dma_addr out of it: 0x20080000

16:39 <liquidAcid> PAGE FAULT occurred at 0x200f0380 by 10a40000.sysmmu(Page table base: 0x6d9d4000)

16:39 <liquidAcid> 0x200f0380 - 0x20080000 = 0x70380 = 459648

16:39 <liquidAcid> and 459648 > 458752, so it reads beyond the buffer

16:39 <liquidAcid> the only thing i wonder: WHY?

16:51 <prahal__> I had not noticed before that g2d iommu space was different than the main exynos_drm iommu space

16:53 <prahal__> I remind of http://lwn.net/Articles/607626/ namely "FIMD, HDMI-mixer and others form together Exynos DRM subsystem; it is highly welcome to let them to operate in the same, shared DMA address space to simplify buffer sharing"

16:53 <liquidAcid> i think it's sysmmu_g2d, and not sysmmu_tv as the rest

16:54 <prahal__> that is one point I find hard about exynos drm the above also tell "DMA-mapping subsystem assumes that there is only one DMA (IO) address space associated with the given struct device entity."

16:55 <prahal__> then "To let driver to access other DMA (IO) address spaces a sub-device has been introduced. This approach has been already used by s5p-mfc driver "

16:55 <prahal__> by hard I mean hackish and confusing

16:56 <prahal__> will be afk

16:56 <liquidAcid> shouldn't make a difference for this issue though, at least i don't think so

16:56 <liquidAcid> maybe i should overallocate the buffer and see what happens then

18:16 <liquidAcid> not completly sure, but i get the impression that this is totally broken. https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/tree/drivers/gpu/drm/exynos/exynos_drm_g2d.c#n651

18:17 <liquidAcid> i only checks if the "area" size of the buffer is smaller than the buffer size

18:18 <liquidAcid> but nothing about whether the area is actually inside the buffer

18:19 <liquidAcid> it doesn't consider stride at all

19:32 <liquidAcid> ok, it's not just my imagination, the check is broken and doesn't actually check anything

19:33 <liquidAcid> after rechecking everything in userspace i get an image now, but it suffers from various "stripey" artifacts

19:34 <liquidAcid> downclocking the engine doesn't help, the artifacts stay

19:34 <liquidAcid> i've also tried to put memory fences around the g2d call, but to no avail

22:55 <liquidAcid> prahal__, you there?

22:55 <prahal__> yes

22:56 <prahal__> liquidAcid: pong

22:57 <liquidAcid> prahal__, can you try this? https://github.com/tobiasjakobi/libdrm/commit/db8bf6844436598251f67a71fc334b929bfb2b71

22:57 <liquidAcid> fails almost immediately for me

22:58 <prahal__> in two days I could . I only have ssh access to the droid

22:59 <liquidAcid> prahal__, k, however it doesn't crash the system

22:59 <liquidAcid> well, you never know for sure

23:05 <liquidAcid> what's funny is that the corruption go away when i increase the buffer size

23:06 <liquidAcid> ./exynos_fimg2d_userptr -w 4096 -h 4096 -i 2 -n 8

23:06 <liquidAcid> exynos/fimg2d: G2D version (4.1).

23:06 <liquidAcid> starting G2D userptr test

23:06 <liquidAcid> buffer width = 4096, buffer height = 4096, iterations = 2

23:06 <liquidAcid> exits properly

23:09 <prahal__> well what about a non PAGE_SIZE multiple ?

23:10 <liquidAcid> prahal__, you mean buffer size a non-multiple?

23:13 <prahal__> yes , as -w 5120 -h 5120

23:14 <liquidAcid> 104857600 % 4096 == 0

23:15 <liquidAcid> so your example is a multiple

23:16 <prahal__> gee :/

23:16 <liquidAcid> interesting

23:16 <liquidAcid> exynos/fimg2d: G2D version (4.1).

23:16 <liquidAcid> starting G2D userptr test

23:16 <liquidAcid> buffer width = 3784, buffer height = 3991, iterations = 2

23:16 <liquidAcid> pagesize = 4096

23:16 <liquidAcid> exynos/fimg2d: failed to set cmdlist.

23:16 <liquidAcid> error: buffer copy 0 failed in iteration 0

23:17 <liquidAcid> oh, i know

23:17 <liquidAcid> prahal__, it's your fault ;)

23:17 <liquidAcid> prahal__, https://github.com/tobiasjakobi/linux-odroid/commit/1daf4d4be04acd76e4c5e374d8c52185c68f4a88

23:28 <prahal__> looks like it was "based" on https://github.com/tobiasjakobi/linux-odroid/commit/d81e870d5afa1b0a95ea94c4052d3c7e973fae8c from when I was after a fix for the g2d unstability :/

23:29 <liquidAcid> yep, i won't bother with unaligned accesses for now -- when the aligned ones still are this shaky

23:33 <liquidAcid> i guess there is some flushing here missing here, maybe something to do with mixer being in tv iommu domain and g2d in its own