From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1755141Ab0KIKlN (ORCPT ); Tue, 9 Nov 2010 05:41:13 -0500 Received: from darkcity.gna.ch ([195.226.6.51]:40098 "EHLO mail.gna.ch" rhost-flags-OK-OK-OK-FAIL) by vger.kernel.org with ESMTP id S1754789Ab0KIKlK convert rfc822-to-8bit (ORCPT ); Tue, 9 Nov 2010 05:41:10 -0500 X-Greylist: delayed 467 seconds by postgrey-1.27 at vger.kernel.org; Tue, 09 Nov 2010 05:41:09 EST X-Amavis-Alert: BAD HEADER SECTION, Improper folded header field made up entirely of whitespace (char 09 hex): Face: ...MWASAkVVViQjzP\n jycPrvgA\n\t\n R1goSzOnkp14Y[...] Subject: Re: Radeon RS780 - BUG: unable to handle kernel NULL pointer dereference From: Michel =?ISO-8859-1?Q?D=E4nzer?= To: Thomas Hellstrom Cc: "dri-devel@lists.freedesktop.org" , "linux-kernel@vger.kernel.org" , Markus Trippelsdorf In-Reply-To: <4CD91D58.7080508@vmware.com> References: <20101108170221.GA1602@arch.trippelsdorf.de> <20101108170737.GA1617@arch.trippelsdorf.de> <20101108184301.GA1614@arch.trippelsdorf.de> <20101108190258.GA1623@arch.trippelsdorf.de> <4CD879BC.5060008@vmware.com> <20101109092920.GA1542@arch.trippelsdorf.de> <4CD91A07.1060308@vmware.com> <4CD91D58.7080508@vmware.com> Face: iVBORw0KGgoAAAANSUhEUgAAADAAAAAwBAMAAAClLOS0AAAAAXNSR0IArs4c6QAAADBQTFRFDg4OHh4eLCwsOzs7S0tLWlpaa2treXl5hISEjY2NmJiYqKiotLS0xsbG1dXV/Pz81CO0SQAAArtJREFUOMtd1M9P01AcAHCI/4AtGq/QDfDHRfraEX8eaNeJFw1rO/DCYet7mxc1ZG0x3sStHQkmZpqtHDwAi+tMiFEzbZdwNWEJR48cjPG4g5HhELUbrHvjpYe2n7zvt++977cD/7rjsCry8uNG93Gge9OKUyAAgLB1AlpTZICmAzR15QTEiQAPAKADYLMPfhNnEJR4HvD0tT5YI2KGUcyqihQN7mDwZ3hMN4q2N4ol+gEGTSLWhorrjYXrGPwc0jTDOoKP4xi8G0W6adl2Gz6zGDwag5p5PMON7vZgJuSB976+3U6y2QdeKNet1+uum9/qwVQHvEjtKesY0EIb7CNYe+7DIRXCID/vQ4tksVAY7JFBD7yvqrWTL93xoUmOQsPIddbnuk8v+bBPsigB2KRlFxS4nL/owwEpKBSg2MU3UcDf+nATyyHEQwrHzJZFNpXeuOHDC0qW4sMhEHESFGOUrvgQpWUYFVNQdjQxca8abnSB55CmehdcLSxa1ifoQ4JBpmGYWbhsly3X0fxQ7xmkW3Y5CztLcXI+fAu2oWho3nbV6s5rH35xSC/aBR2tOpVa/Utv25tcTDPL6aT21kG17WrvaFtMBJmFhJCsVF4uu9VG76DWBaRnEiNs7pU659pYlfwtQSRy9GCYlwR7C6/dPQgBw3MsTPNWA4d9SeMDDC9JYdnqq/amdF+diGnVhXFztQ/2lJSWjulOxjRX+uC7EkOqhLRk2ejrqHVBEqCqJLO5cmEXgx8TrBiWVQh1u2DhzQlPsyIveU2YLGorGBxODoR5notlpcUieoLB1/NEmGc4AalGJpLe8WF/8txMWASAkVVViQjzP jycPrvgA R1goSzOnkp14YCYHsp7QJHAS5QcXDqG1jBxdSITVgBNkBTFloj88Q/gMkFcuItYiQPUCBGc2xh5drsD/wGZrgsgDOE4ZAAAAABJRU5ErkJggg== Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: 8BIT Date: Tue, 09 Nov 2010 11:32:57 +0100 Message-ID: <1289298777.10682.63.camel@thor.local> Mime-Version: 1.0 X-Mailer: Evolution 2.30.3 Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org On Die, 2010-11-09 at 11:07 +0100, Thomas Hellstrom wrote: > On 11/09/2010 10:53 AM, Thomas Hellstrom wrote: > > On 11/09/2010 10:29 AM, Markus Trippelsdorf wrote: > >> OK I've found the buggy commit by bisection: > >> > >> e376573f7267390f4e1bdc552564b6fb913bce76 is the first bad commit > >> commit e376573f7267390f4e1bdc552564b6fb913bce76 > >> Author: Michel Dänzer > >> Date: Thu Jul 8 12:43:28 2010 +1000 > >> > >> drm/radeon: fall back to GTT if bo creation/validation in VRAM > >> fails. > >> > >> This fixes a problem where on low VRAM cards we'd run out of > >> space for validation. > >> > >> [airlied: Tested on my M7, Thinkpad T42, compiz works with no > >> problems.] > >> > >> Signed-off-by: Michel Dänzer > >> Cc: stable@kernel.org > >> Signed-off-by: Dave Airlie > >> > >> Please note that this is an old commit from 2.6.36-rc. When I revert > >> it the > >> kernel no longer crashes. Instead I see the following in my dmesg: > >> > > > > Hmm, so this sounds like something in the Radeon eviction error path > > is causing corruption. > > I had a similar problem with vmwgfx, when I tried to unref a BO > > _after_ ttm_bo_init() failed. > > ttm_bo_init() is really supposed to call unref itself for various > > reasons, so calling unref() or kfree() after a failed ttm_bo_init() > > will cause corruption. > > > > In any case, the error below also suggests something is a bit fragile > > in the Radeon driver: > > > > First, an accelerated eviction may fail, like in the message below, > > but then there must always be a backup plan, like unaccelerated > > eviction to system. On BO creation, there are a number of placement > > strategies, but if all else fails, it should be possible to initially > > place the BO in system memory. > > > > Second, If bo validation fails during a command submission, due to > > insufficient VRAM / TT, then the driver should retry the complete > > validation cycle after first blocking all other validators and then > > evicting everything not pinned, to avoid failures due to fragmentation. > > > > /Thomas > > > > Indeed, it seems like the commit you mention just retries ttm_bo_init() > after it previously failed. At that point the bo has been destroyed, so > that is probably what's causing the BUG you are seeing. > > Admittedly, ttm_bo_init() calling unref on failure is not properly > documented in the function description. The reason for doing so is to > have a single path for freeing all BO resources already allocated on the > point of failure. Does the patch below fix the problem? commit e224472eedbda391ddb6d8b88f26e82e1c3b036b Author: Michel Dänzer Date: Tue Nov 9 11:30:41 2010 +0100 drm/radeon/kms: Fix retrying ttm_bo_init() after it failed once. If ttm_bo_init() returns failure, it already destroyed the BO, so we need to retry from scratch. Signed-off-by: Michel Dänzer Cc: stable@kernel.org diff --git a/drivers/gpu/drm/radeon/radeon_object.c b/drivers/gpu/drm/radeon/radeon_object.c index 1b9004e..bbe92d5 100644 --- a/drivers/gpu/drm/radeon/radeon_object.c +++ b/drivers/gpu/drm/radeon/radeon_object.c @@ -102,6 +102,8 @@ int radeon_bo_create(struct radeon_device *rdev, struct drm_gem_object *gobj, type = ttm_bo_type_device; } *bo_ptr = NULL; + +retry: bo = kzalloc(sizeof(struct radeon_bo), GFP_KERNEL); if (bo == NULL) return -ENOMEM; @@ -109,8 +111,6 @@ int radeon_bo_create(struct radeon_device *rdev, struct drm_gem_object *gobj, bo->gobj = gobj; bo->surface_reg = -1; INIT_LIST_HEAD(&bo->list); - -retry: radeon_ttm_placement_from_domain(bo, domain); /* Kernel allocation are uninterruptible */ mutex_lock(&rdev->vram_mutex); -- Earthling Michel Dänzer | http://www.vmware.com Libre software enthusiast | Debian, X and DRI developer From mboxrd@z Thu Jan 1 00:00:00 1970 From: Michel =?ISO-8859-1?Q?D=E4nzer?= Subject: Re: Radeon RS780 - BUG: unable to handle kernel NULL pointer dereference Date: Tue, 09 Nov 2010 11:32:57 +0100 Message-ID: <1289298777.10682.63.camel@thor.local> References: <20101108170221.GA1602@arch.trippelsdorf.de> <20101108170737.GA1617@arch.trippelsdorf.de> <20101108184301.GA1614@arch.trippelsdorf.de> <20101108190258.GA1623@arch.trippelsdorf.de> <4CD879BC.5060008@vmware.com> <20101109092920.GA1542@arch.trippelsdorf.de> <4CD91A07.1060308@vmware.com> <4CD91D58.7080508@vmware.com> Mime-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 Return-path: Received: from mail.gna.ch (darkcity.gna.ch [195.226.6.51]) by gabe.freedesktop.org (Postfix) with ESMTP id DC80D9E86C for ; Tue, 9 Nov 2010 02:33:19 -0800 (PST) In-Reply-To: <4CD91D58.7080508@vmware.com> List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: dri-devel-bounces+sf-dri-devel=m.gmane.org@lists.freedesktop.org Errors-To: dri-devel-bounces+sf-dri-devel=m.gmane.org@lists.freedesktop.org To: Thomas Hellstrom Cc: Markus@freedesktop.org, "linux-kernel@vger.kernel.org" , "dri-devel@lists.freedesktop.org" , Trippelsdorf List-Id: dri-devel@lists.freedesktop.org T24gRGllLCAyMDEwLTExLTA5IGF0IDExOjA3ICswMTAwLCBUaG9tYXMgSGVsbHN0cm9tIHdyb3Rl OiAKPiBPbiAxMS8wOS8yMDEwIDEwOjUzIEFNLCBUaG9tYXMgSGVsbHN0cm9tIHdyb3RlOgo+ID4g T24gMTEvMDkvMjAxMCAxMDoyOSBBTSwgTWFya3VzIFRyaXBwZWxzZG9yZiB3cm90ZToKPiA+PiBP SyBJJ3ZlIGZvdW5kIHRoZSBidWdneSBjb21taXQgYnkgYmlzZWN0aW9uOgo+ID4+Cj4gPj4gZTM3 NjU3M2Y3MjY3MzkwZjRlMWJkYzU1MjU2NGI2ZmI5MTNiY2U3NiBpcyB0aGUgZmlyc3QgYmFkIGNv bW1pdAo+ID4+IGNvbW1pdCBlMzc2NTczZjcyNjczOTBmNGUxYmRjNTUyNTY0YjZmYjkxM2JjZTc2 Cj4gPj4gQXV0aG9yOiBNaWNoZWwgRMOkbnplcjxkYWVuemVyQHZtd2FyZS5jb20+Cj4gPj4gRGF0 ZTogICBUaHUgSnVsIDggMTI6NDM6MjggMjAxMCArMTAwMAo+ID4+Cj4gPj4gICAgICBkcm0vcmFk ZW9uOiBmYWxsIGJhY2sgdG8gR1RUIGlmIGJvIGNyZWF0aW9uL3ZhbGlkYXRpb24gaW4gVlJBTSAK PiA+PiBmYWlscy4KPiA+Pgo+ID4+ICAgICAgVGhpcyBmaXhlcyBhIHByb2JsZW0gd2hlcmUgb24g bG93IFZSQU0gY2FyZHMgd2UnZCBydW4gb3V0IG9mIAo+ID4+IHNwYWNlIGZvciB2YWxpZGF0aW9u Lgo+ID4+Cj4gPj4gICAgICBbYWlybGllZDogVGVzdGVkIG9uIG15IE03LCBUaGlua3BhZCBUNDIs IGNvbXBpeiB3b3JrcyB3aXRoIG5vIAo+ID4+IHByb2JsZW1zLl0KPiA+Pgo+ID4+ICAgICAgU2ln bmVkLW9mZi1ieTogTWljaGVsIETDpG56ZXI8ZGFlbnplckB2bXdhcmUuY29tPgo+ID4+ICAgICAg Q2M6IHN0YWJsZUBrZXJuZWwub3JnCj4gPj4gICAgICBTaWduZWQtb2ZmLWJ5OiBEYXZlIEFpcmxp ZTxhaXJsaWVkQHJlZGhhdC5jb20+Cj4gPj4KPiA+PiBQbGVhc2Ugbm90ZSB0aGF0IHRoaXMgaXMg YW4gb2xkIGNvbW1pdCBmcm9tIDIuNi4zNi1yYy4gV2hlbiBJIHJldmVydCAKPiA+PiBpdCB0aGUK PiA+PiBrZXJuZWwgbm8gbG9uZ2VyIGNyYXNoZXMuIEluc3RlYWQgSSBzZWUgdGhlIGZvbGxvd2lu ZyBpbiBteSBkbWVzZzoKPiA+Pgo+ID4KPiA+IEhtbSwgc28gdGhpcyBzb3VuZHMgbGlrZSBzb21l dGhpbmcgaW4gdGhlIFJhZGVvbiBldmljdGlvbiBlcnJvciBwYXRoIAo+ID4gaXMgY2F1c2luZyBj b3JydXB0aW9uLgo+ID4gSSBoYWQgYSBzaW1pbGFyIHByb2JsZW0gd2l0aCB2bXdnZngsIHdoZW4g SSB0cmllZCB0byB1bnJlZiBhIEJPIAo+ID4gX2FmdGVyXyB0dG1fYm9faW5pdCgpIGZhaWxlZC4K PiA+IHR0bV9ib19pbml0KCkgaXMgcmVhbGx5IHN1cHBvc2VkIHRvIGNhbGwgdW5yZWYgaXRzZWxm IGZvciB2YXJpb3VzIAo+ID4gcmVhc29ucywgIHNvIGNhbGxpbmcgdW5yZWYoKSBvciBrZnJlZSgp IGFmdGVyIGEgZmFpbGVkIHR0bV9ib19pbml0KCkgCj4gPiB3aWxsIGNhdXNlIGNvcnJ1cHRpb24u Cj4gPgo+ID4gSW4gYW55IGNhc2UsIHRoZSBlcnJvciBiZWxvdyBhbHNvIHN1Z2dlc3RzIHNvbWV0 aGluZyBpcyBhIGJpdCBmcmFnaWxlIAo+ID4gaW4gdGhlIFJhZGVvbiBkcml2ZXI6Cj4gPgo+ID4g Rmlyc3QsIGFuIGFjY2VsZXJhdGVkIGV2aWN0aW9uIG1heSBmYWlsLCBsaWtlIGluIHRoZSBtZXNz YWdlIGJlbG93LCAKPiA+IGJ1dCB0aGVuIHRoZXJlIG11c3QgYWx3YXlzIGJlIGEgYmFja3VwIHBs YW4sIGxpa2UgdW5hY2NlbGVyYXRlZCAKPiA+IGV2aWN0aW9uIHRvIHN5c3RlbS4gT24gQk8gY3Jl YXRpb24sIHRoZXJlIGFyZSBhIG51bWJlciBvZiBwbGFjZW1lbnQgCj4gPiBzdHJhdGVnaWVzLCBi dXQgaWYgYWxsIGVsc2UgZmFpbHMsIGl0IHNob3VsZCBiZSBwb3NzaWJsZSB0byBpbml0aWFsbHkg Cj4gPiBwbGFjZSB0aGUgQk8gaW4gc3lzdGVtIG1lbW9yeS4KPiA+Cj4gPiBTZWNvbmQsIElmIGJv IHZhbGlkYXRpb24gZmFpbHMgZHVyaW5nIGEgY29tbWFuZCBzdWJtaXNzaW9uLCBkdWUgdG8gCj4g PiBpbnN1ZmZpY2llbnQgVlJBTSAvIFRULCB0aGVuIHRoZSBkcml2ZXIgc2hvdWxkIHJldHJ5IHRo ZSBjb21wbGV0ZSAKPiA+IHZhbGlkYXRpb24gY3ljbGUgYWZ0ZXIgZmlyc3QgYmxvY2tpbmcgYWxs IG90aGVyIHZhbGlkYXRvcnMgYW5kIHRoZW4gCj4gPiBldmljdGluZyBldmVyeXRoaW5nIG5vdCBw aW5uZWQsIHRvIGF2b2lkIGZhaWx1cmVzIGR1ZSB0byBmcmFnbWVudGF0aW9uLgo+ID4KPiA+IC9U aG9tYXMKPiA+Cj4gCj4gSW5kZWVkLCBpdCBzZWVtcyBsaWtlIHRoZSBjb21taXQgeW91IG1lbnRp b24ganVzdCByZXRyaWVzIHR0bV9ib19pbml0KCkgCj4gYWZ0ZXIgaXQgcHJldmlvdXNseSBmYWls ZWQuIEF0IHRoYXQgcG9pbnQgdGhlIGJvIGhhcyBiZWVuIGRlc3Ryb3llZCwgc28gCj4gdGhhdCBp cyBwcm9iYWJseSB3aGF0J3MgY2F1c2luZyB0aGUgQlVHIHlvdSBhcmUgc2VlaW5nLgo+IAo+IEFk bWl0dGVkbHksIHR0bV9ib19pbml0KCkgY2FsbGluZyB1bnJlZiBvbiBmYWlsdXJlIGlzIG5vdCBw cm9wZXJseSAKPiBkb2N1bWVudGVkIGluIHRoZSBmdW5jdGlvbiBkZXNjcmlwdGlvbi4gIFRoZSBy ZWFzb24gZm9yIGRvaW5nIHNvIGlzIHRvIAo+IGhhdmUgYSBzaW5nbGUgcGF0aCBmb3IgZnJlZWlu ZyBhbGwgQk8gcmVzb3VyY2VzIGFscmVhZHkgYWxsb2NhdGVkIG9uIHRoZSAKPiBwb2ludCBvZiBm YWlsdXJlLgoKRG9lcyB0aGUgcGF0Y2ggYmVsb3cgZml4IHRoZSBwcm9ibGVtPwoKCmNvbW1pdCBl MjI0NDcyZWVkYmRhMzkxZGRiNmQ4Yjg4ZjI2ZTgyZTFjM2IwMzZiCkF1dGhvcjogTWljaGVsIETD pG56ZXIgPGRhZW56ZXJAdm13YXJlLmNvbT4KRGF0ZTogICBUdWUgTm92IDkgMTE6MzA6NDEgMjAx MCArMDEwMAoKICAgIGRybS9yYWRlb24va21zOiBGaXggcmV0cnlpbmcgdHRtX2JvX2luaXQoKSBh ZnRlciBpdCBmYWlsZWQgb25jZS4KICAgIAogICAgSWYgdHRtX2JvX2luaXQoKSByZXR1cm5zIGZh aWx1cmUsIGl0IGFscmVhZHkgZGVzdHJveWVkIHRoZSBCTywgc28gd2UgbmVlZCB0bwogICAgcmV0 cnkgZnJvbSBzY3JhdGNoLgogICAgCiAgICBTaWduZWQtb2ZmLWJ5OiBNaWNoZWwgRMOkbnplciA8 ZGFlbnplckB2bXdhcmUuY29tPgogICAgQ2M6IHN0YWJsZUBrZXJuZWwub3JnCgpkaWZmIC0tZ2l0 IGEvZHJpdmVycy9ncHUvZHJtL3JhZGVvbi9yYWRlb25fb2JqZWN0LmMgYi9kcml2ZXJzL2dwdS9k cm0vcmFkZW9uL3JhZGVvbl9vYmplY3QuYwppbmRleCAxYjkwMDRlLi5iYmU5MmQ1IDEwMDY0NAot LS0gYS9kcml2ZXJzL2dwdS9kcm0vcmFkZW9uL3JhZGVvbl9vYmplY3QuYworKysgYi9kcml2ZXJz L2dwdS9kcm0vcmFkZW9uL3JhZGVvbl9vYmplY3QuYwpAQCAtMTAyLDYgKzEwMiw4IEBAIGludCBy YWRlb25fYm9fY3JlYXRlKHN0cnVjdCByYWRlb25fZGV2aWNlICpyZGV2LCBzdHJ1Y3QgZHJtX2dl bV9vYmplY3QgKmdvYmosCiAJCXR5cGUgPSB0dG1fYm9fdHlwZV9kZXZpY2U7CiAJfQogCSpib19w dHIgPSBOVUxMOworCityZXRyeToKIAlibyA9IGt6YWxsb2Moc2l6ZW9mKHN0cnVjdCByYWRlb25f Ym8pLCBHRlBfS0VSTkVMKTsKIAlpZiAoYm8gPT0gTlVMTCkKIAkJcmV0dXJuIC1FTk9NRU07CkBA IC0xMDksOCArMTExLDYgQEAgaW50IHJhZGVvbl9ib19jcmVhdGUoc3RydWN0IHJhZGVvbl9kZXZp Y2UgKnJkZXYsIHN0cnVjdCBkcm1fZ2VtX29iamVjdCAqZ29iaiwKIAliby0+Z29iaiA9IGdvYmo7 CiAJYm8tPnN1cmZhY2VfcmVnID0gLTE7CiAJSU5JVF9MSVNUX0hFQUQoJmJvLT5saXN0KTsKLQot cmV0cnk6CiAJcmFkZW9uX3R0bV9wbGFjZW1lbnRfZnJvbV9kb21haW4oYm8sIGRvbWFpbik7CiAJ LyogS2VybmVsIGFsbG9jYXRpb24gYXJlIHVuaW50ZXJydXB0aWJsZSAqLwogCW11dGV4X2xvY2so JnJkZXYtPnZyYW1fbXV0ZXgpOwoKCi0tIApFYXJ0aGxpbmcgTWljaGVsIETDpG56ZXIgICAgICAg ICAgIHwgICAgICAgICAgICAgICAgaHR0cDovL3d3dy52bXdhcmUuY29tCkxpYnJlIHNvZnR3YXJl IGVudGh1c2lhc3QgICAgICAgICB8ICAgICAgICAgIERlYmlhbiwgWCBhbmQgRFJJIGRldmVsb3Bl cgpfX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fXwpkcmktZGV2 ZWwgbWFpbGluZyBsaXN0CmRyaS1kZXZlbEBsaXN0cy5mcmVlZGVza3RvcC5vcmcKaHR0cDovL2xp c3RzLmZyZWVkZXNrdG9wLm9yZy9tYWlsbWFuL2xpc3RpbmZvL2RyaS1kZXZlbAo=