From nobody Sat Jan 1 20:00:52 2022 X-Original-To: x11@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 13448192B860 for ; Sat, 1 Jan 2022 20:00:53 +0000 (UTC) (envelope-from bugzilla-noreply@freebsd.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "R3" (verified OK)) by mx1.freebsd.org (Postfix) with ESMTPS id 4JRCYc6R7kz4jKd for ; Sat, 1 Jan 2022 20:00:52 +0000 (UTC) (envelope-from bugzilla-noreply@freebsd.org) Received: from kenobi.freebsd.org (kenobi.freebsd.org [IPv6:2610:1c1:1:606c::50:1d]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256) (Client did not present a certificate) by mxrelay.nyi.freebsd.org (Postfix) with ESMTPS id B06D424C2F for ; Sat, 1 Jan 2022 20:00:52 +0000 (UTC) (envelope-from bugzilla-noreply@freebsd.org) Received: from kenobi.freebsd.org ([127.0.1.5]) by kenobi.freebsd.org (8.15.2/8.15.2) with ESMTP id 201K0qX2066729 for ; Sat, 1 Jan 2022 20:00:52 GMT (envelope-from bugzilla-noreply@freebsd.org) Received: (from www@localhost) by kenobi.freebsd.org (8.15.2/8.15.2/Submit) id 201K0qro066728 for x11@FreeBSD.org; Sat, 1 Jan 2022 20:00:52 GMT (envelope-from bugzilla-noreply@freebsd.org) X-Authentication-Warning: kenobi.freebsd.org: www set sender to bugzilla-noreply@freebsd.org using -f From: bugzilla-noreply@freebsd.org To: x11@FreeBSD.org Subject: [Bug 237544] graphics/drm-fbsd12.0-kmod: panic on 12-STABLE with Radeon HD 7450 (but not with drm-fbsd11.2-kmod) Date: Sat, 01 Jan 2022 20:00:52 +0000 X-Bugzilla-Reason: AssignedTo X-Bugzilla-Type: changed X-Bugzilla-Watch-Reason: None X-Bugzilla-Product: Base System X-Bugzilla-Component: kern X-Bugzilla-Version: 12.0-STABLE X-Bugzilla-Keywords: crash, needs-qa X-Bugzilla-Severity: Affects Only Me X-Bugzilla-Who: noisetube@gmail.com X-Bugzilla-Status: Closed X-Bugzilla-Resolution: Overcome By Events X-Bugzilla-Priority: --- X-Bugzilla-Assigned-To: x11@FreeBSD.org X-Bugzilla-Flags: X-Bugzilla-Changed-Fields: Message-ID: In-Reply-To: References: Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable X-Bugzilla-URL: https://bugs.freebsd.org/bugzilla/ Auto-Submitted: auto-generated List-Id: X11 List-Archive: https://lists.freebsd.org/archives/freebsd-x11 List-Help: List-Post: List-Subscribe: List-Unsubscribe: Sender: owner-freebsd-x11@freebsd.org X-BeenThere: freebsd-x11@freebsd.org MIME-Version: 1.0 ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1641067252; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=zWPSAP8pREr/SdlomowLyNS/hh73KI2hRht2AjEv6mo=; b=PF1Eg5xilW1k4IN8nv069s/KU3lBq7GpXWcNFPDZNrW3twQ1/uorek6XZq06XTHEpC8EO3 OY3cxRf1qlhqBYJkXXoR0XC89xpRlj7TNudfcnisYGOUmfUS4fLHS8XaZTuGj37v+dSmVd WTr7h/ltFGv1JFJ7J9KvJ09SWgUGu3S6Y9O4S35NBoA7hMrJ4UyVbMtspF+Yq9RtYqoCUo 9rMb52iLx1otPHYD9jqN/ydDU+Gmz779HZemjZihX2pwlosHJmqgi+UlGNsIphRy9Dv6hU /GM8d8z2uNWNdkV16+0WVnfU+FJ9gqEYZ3FwxV77T8lmf8M937wftSqVcfbKXA== ARC-Seal: i=1; s=dkim; d=freebsd.org; t=1641067252; a=rsa-sha256; cv=none; b=rDT0+ezlR4itsDvGAM5KJD0MFc/IjLGD02TOpP5cQddz7d2VdARW6OU5HQo/2X9IVUOFC3 f+wRoHMOyE44r1crkdBmymEbaZDE1Tr7cXfYSu+xbAmX11EHJgy9TRWKW4YtwgfAf3Y1hs +qhi8IC29RD7mpMVzAXtx3Qc1SIjVg64GkOKsa9/wxr3tQPy7s2is017aZ9GOf83cWyqTt O/dYn08tRcJEHSDprGTmj+I4Qz7kYghm9vCO1ZWLgkxozm1NT5U1J6XRgY75PnTC2PVfiW UcrLzKrl6aoYDLLs2rVTVGJUc7IXelM8AQb4GanZzRV97o+irqHut4VlKmBppw== ARC-Authentication-Results: i=1; mx1.freebsd.org; none X-ThisMailContainsUnwantedMimeParts: N https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=3D237544 --- Comment #14 from Bill Paul --- I think I figured it out. The problem seems to be in dma_fence_signal_locked_sub(): static inline void dma_fence_signal_locked_sub(struct dma_fence *fence) { struct dma_fence_cb *cur; while ((cur =3D list_first_entry_or_null(&fence->cb_list, struct dma_fence_cb, node)) !=3D NULL) { list_del_init(&cur->node); spin_unlock(fence->lock); cur->func(fence, cur); spin_lock(fence->lock); } } This function is shared by dma_fence_signal() and dma_fence_signal_unlocked= (). It looks like the problem is the spin_unlock()/spin_lock() calls used to dr= op the fence lock while calling the signal callbacks. The drm-fbsd11.2-kmod co= de did not do this, and for that matter it looks like the most recent Linux co= de doesn't do it either. As far as I can tell, dropping this lock here is what causes the race condition: the rest of the code is not expecting this to ha= ppen when dma_fence_signal() is called: it's only dma_fence_signal_locked() that should work this way. If I patch the drm-fbsd12.0-kmod code to remove the spin_unlock()/spin_lock= () calls, I also don't get any crashes. I created a new tarball with a single patch that has just this fix: http://people.freebsd.org/~wpaul/radeon/drm-fbsd12.0-kmod.tar.gz I've been running with this patch for the last day or so and haven't had any panics. I would appreciate it if anyone else who has been experiencing this same crash (i.e. similar to the panics in this PR) could test this patch and see if it fixes for you. It would also be nice if someone could also review the code and confirm if = my findings make sense. Oh, one last thing: from a cursory inspection of the FreeBSD 13 code, I don= 't see this same problem, so if you claim that you're experiencing "the same crash" with FreeBSD 13 or later, please back up your claim by showing me the panic stack trace. If it doesn't match the examples in this PR, they your problem may be something entirely different. I'm sorry if your system is al= so unstable, but it's important to be sure, because I don't want to waste a lo= t of time on something that turns out to be unrelated. --=20 You are receiving this mail because: You are the assignee for the bug.=