Date: Sat, 15 Jun 2013 08:17:46 +0300 From: Konstantin Belousov <kostikbel@gmail.com> To: Artyom Mirgorodskiy <artyom.mirgorodsky@gmail.com> Cc: Oleg Sidorkin <osidorkin@gmail.com>, freebsd-x11@freebsd.org, freebsd-current@freebsd.org Subject: Re: [drm2][panic] Running XOrg with SNA enabled causes system panic after few hours on G33 Message-ID: <20130615051746.GH91021@kib.kiev.ua> In-Reply-To: <4987465.p9MvIyND5v@notebook.alkar.net> References: <CAGw%2Bup%2BoCnRPe6XPY5PJ12vO9qVFx6bN5CjgiGJF66J2hj1R1w@mail.gmail.com> <4987465.p9MvIyND5v@notebook.alkar.net>
next in thread | previous in thread | raw e-mail | index | archive | help
--Rn7IEEq3VEzCw+ji Content-Type: text/plain; charset=us-ascii Content-Disposition: inline Content-Transfer-Encoding: quoted-printable On Fri, Jun 14, 2013 at 10:16:15AM +0300, Artyom Mirgorodskiy wrote: > Thank you! This patch also solve my issue (unable shutdown): > http://lists.freebsd.org/pipermail/freebsd-current/2013-May/042011.html >=20 > On Tuesday 11 June 2013 12:34:16 Oleg Sidorkin wrote: > > Hello. > >=20 > > I'm running recent 9.1/stable with the recent XOrg on the system with > > G33 chipset. > > My pciconf -lvb output is here: http://pastebin.com/LDzKzf1i > >=20 > > If I add > > Option "AccelMethod" "sna" > > to my xorg.conf system panics after few hours: > >=20 > > (kgdb) bt > > #0 doadump (textdump=3D<value optimized out>) > > at /usr/src/sys/kern/kern_ > > shutdown.c:272 > > #1 0xffffffff8050a19f in kern_reboot (howto=3D260) > > at /usr/src/sys/kern/kern_shutdown.c:449 > > #2 0xffffffff8050a6a3 in panic (fmt=3D0x104 <Address 0x104 out of boun= ds>) > > at /usr/src/sys/kern/kern_shutdown.c:637 > > #3 0xffffffff80765f77 in vm_page_insert (m=3D0xfffffe0226126b50, > > object=3D0xfffffe0208de8488, pindex=3D3) at /usr/src/sys/vm/vm_page= =2Ec:914 > > #4 0xffffffff814a889d in i915_gem_pager_fault (vm_obj=3D0xfffffe0208de= 8488, > > offset=3D3, prot=3D<value optimized out>, mres=3D0xffffff824705b680) > > at /usr/src/sys/modules/drm2/i915kms/../../../dev/drm2/i915/i915_ge= m.c:1429 > > #5 0xffffffff80747fe3 in dev_pager_getpages (object=3D0xfffffe0208de84= 88, > > ma=3D0xffffff824705b680, count=3D1, reqpage=3D<value optimized out>) > > at /usr/src/sys/vm/device_pager.c:260 > > #6 0xffffffff80754bb6 in vm_fault_hold (map=3D0xfffffe000c247188, > > vaddr=3D34458505216, fault_type=3D2 '\002', fault_flags=3D0, m_hold= =3D0x0) > > at vm_pager.h:128 > > #7 0xffffffff80756ca3 in vm_fault (map=3D0xfffffe000c247188, vaddr=3D3= 4458505216, > > fault_type=3D<value optimized out>, fault_flags=3D0) > > at /usr/src/sys/vm/vm_fault.c:229 > > #8 0xffffffff8078e01f in trap_pfault (frame=3D0xffffff824705bc40, user= mode=3D1) > > at /usr/src/sys/amd64/amd64/trap.c:762 > > #9 0xffffffff8078e864 in trap (frame=3D0xffffff824705bc40) > >=20 > > (kgdb) bt full > > #0 doadump (textdump=3D<value optimized out>) > > at /usr/src/sys/kern/kern_shutdown.c:272 > > No locals. > > #1 0xffffffff8050a19f in kern_reboot (howto=3D260) > > at /usr/src/sys/kern/kern_shutdown.c:449 > > _ep =3D (struct eventhandler_entry *) 0x0 > > _el =3D (struct eventhandler_list *) 0xfffffe0009c7f700 > > first_buf_printf =3D 1 > > #2 0xffffffff8050a6a3 in panic (fmt=3D0x104 <Address 0x104 out of boun= ds>) > > at /usr/src/sys/kern/kern_shutdown.c:637 > > td =3D (struct thread *) 0x0 > > bootopt =3D <value optimized out> > > newpanic =3D <value optimized out> > > ap =3D {{gp_offset =3D 8, fp_offset =3D 48, > > overflow_arg_area =3D 0xffffff824705b570, > > reg_save_area =3D 0xffffff824705b490}} > > panic_cpu =3D 3 > > buf =3D "vm_page_insert: page already inserted", '\0' <repeats = 218 times> > > #3 0xffffffff80765f77 in vm_page_insert (m=3D0xfffffe0226126b50, > > object=3D0xfffffe0208de8488, pindex=3D3) at /usr/src/sys/vm/vm_page= =2Ec:914 > > root =3D 0x0 > > #4 0xffffffff814a889d in i915_gem_pager_fault (vm_obj=3D0xfffffe0208de= 8488, > > offset=3D3, prot=3D<value optimized out>, mres=3D0xffffff824705b680) > >=20 > > (kgdb) up 4 > > #4 0xffffffff814a889d in i915_gem_pager_fault (vm_obj=3D0xfffffe0208de= 8488, > > offset=3D3, prot=3D<value optimized out>, mres=3D0xffffff824705b680) > > at /usr/src/sys/modules/drm2/i915kms/../../../dev/drm2/i915/i915_ge= m.c:1429 > > 1429 vm_page_insert(m, vm_obj, OFF_TO_IDX(offset)); > > (kgdb) p vm_obj > > $1 =3D 0xfffffe0208de8488 > > (kgdb) p m->object > > $2 =3D 0xfffffe0208de8488 > >=20 > > It works fine for weeks without Option "AccelMethod" "sna". > >=20 > > I replaced > > vm_page_insert(m, vm_obj, OFF_TO_IDX(offset)); > > with the code > > if (m->object=3D=3DNULL){ > > vm_page_insert(m, vm_obj, OFF_TO_IDX(offset)); > > } > > else{ > > if(m->object!=3Dvm_obj) > > panic("i915_gem_pager_fault: tried to assign already > > assigned page to the different object"); > > } > > and it worked with SNA enabled for about a week with no problems. But > > I'm not sure that is a good solution. > >=20 > > I can provide additional info if required. > >=20 > > Thanks > > -- > > Oleg Sidorkin > > _______________________________________________ > > freebsd-x11@freebsd.org mailing list > > http://lists.freebsd.org/mailman/listinfo/freebsd-x11 > > To unsubscribe, send any mail to "freebsd-x11-unsubscribe@freebsd.org" > --=20 > Artyom Mirgorodskiy > _______________________________________________ > freebsd-current@freebsd.org mailing list > http://lists.freebsd.org/mailman/listinfo/freebsd-current > To unsubscribe, send any mail to "freebsd-current-unsubscribe@freebsd.org" I did not see the original mail with the backtrace. FWIW, it seems that the issue is that other thread might have faulted on the same GTT offset and bound the page before the paniced thread. If this is indeed the situation, then the proper fix is to check for the race, and not to just avoid the insertion. Re-instantiating the fences is particularly wrong IMO. Try this patch (untested, I only compiled it). diff --git a/sys/dev/drm2/i915/i915_gem.c b/sys/dev/drm2/i915/i915_gem.c index 8ce8bec..c505cdb 100644 --- a/sys/dev/drm2/i915/i915_gem.c +++ b/sys/dev/drm2/i915/i915_gem.c @@ -1362,7 +1362,6 @@ unlocked_vmobj: cause =3D ret =3D 0; m =3D NULL; =20 - if (i915_intr_pf) { ret =3D i915_mutex_lock_interruptible(dev); if (ret !=3D 0) { @@ -1372,6 +1371,23 @@ unlocked_vmobj: } else DRM_LOCK(dev); =20 + /* + * Since the object lock was dropped, other thread might have + * faulted on the same GTT address and instantiated the + * mapping for the page. Recheck. + */ + VM_OBJECT_WLOCK(vm_obj); + m =3D vm_page_lookup(vm_obj, OFF_TO_IDX(offset)); + if (m !=3D NULL) { + if ((m->flags & VPO_BUSY) !=3D 0) { + DRM_UNLOCK(dev); + vm_page_sleep(m, "915pee"); + goto retry; + } + goto have_page; + } else + VM_OBJECT_WUNLOCK(vm_obj); + /* Now bind it into the GTT if needed */ if (!obj->map_and_fenceable) { ret =3D i915_gem_object_unbind(obj); @@ -1425,8 +1441,9 @@ unlocked_vmobj: goto retry; } m->valid =3D VM_PAGE_BITS_ALL; - *mres =3D m; vm_page_insert(m, vm_obj, OFF_TO_IDX(offset)); +have_page: + *mres =3D m; vm_page_busy(m); =20 CTR4(KTR_DRM, "fault %p %jx %x phys %x", gem_obj, offset, prot, --Rn7IEEq3VEzCw+ji Content-Type: application/pgp-signature -----BEGIN PGP SIGNATURE----- Version: GnuPG v2.0.20 (FreeBSD) iQIcBAEBAgAGBQJRu/j5AAoJEJDCuSvBvK1BhjcP/ie/EktJ/y90D6HQ+KsCccPr lr1d0l/ulJyOXD6mnpMPQPVjOL1Ko5b+edXFIuymS4VL/1ZZbYVzMbtef21iDBzY Ytjhrk/N6qJFSo3qO7E00wGx491YXbpxxE/QyfiLTfRUmSHiIb9lpONKuApnqf63 M8fa6VjMMLf9+Uc1wyNkYtxGApFimbJxFYvrBIY3a1C/Ra7B1WfiA2CPLGZp9YGN atjlJv6NDjLtOkMet4GdDmzbivdDo38D/DG1tFHhzF1ewG17wLKDIy1830pX/PgZ 6+bhQyf7G0mBLymuy0amdBY42tRt4E7RRAF9W/JjvrfdEZH/PlvzkKF+sXE0oN4Q VeKHrPhNLXkLsrMII53tZLxIcsunDe/tAuTWuMgJdlJEzuc3q58cKhvTTcsKyv+p 1ETE+W32Qh18IFgfQz7RoHal8MKD4i4V90keluFdvIM/ODb5Z5OeigLh+NgsHXMa V/PcXxmkBipdPPdlN/8+ICUnXLcU+1hp6NvyH1cqGr4OT7oMyHKTxQ8D/HusorkI yyoVaH/9d/8ZJbCxrICdqWFyR8tAqj8LhANRCrKiH2OstZ3vQ9TH8QKysz7DmPG4 xMST6G+mjIkDnG6G8Mfwyl5D57lygzspSVUuHrrm6YKGW2sw9LqubM2Rq33AMfNa 6dUVCapMk+MONqW12Tk/ =kpqA -----END PGP SIGNATURE----- --Rn7IEEq3VEzCw+ji--
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?20130615051746.GH91021>