* imxdrm issue on SABRE Lite @ 2017-02-11 21:09 Dan MacDonald 2017-02-12 0:15 ` Russell King - ARM Linux 2017-02-20 15:42 ` Philipp Zabel 0 siblings, 2 replies; 9+ messages in thread From: Dan MacDonald @ 2017-02-11 21:09 UTC (permalink / raw) To: p.zabel; +Cc: linux, dri-devel Hi Phillipp I'm having trouble getting xf86-video-armada working properly on a Element 14 / Embest SABRE Lite board running Arch Linux with kernel 4.9.8. I have been in touch with RMK and he's confident the crash below is caused by a kernel issue relating to imxdrm and a null pointer dereference. The first indiction of X/armada not being happy it that it only starts in 720x480 when connected to a 4K HDMI display, and when I try running: xrandr --output HDMI1 --mode 1920x1080 X crashes. Here's the serial console output for X loading and then crashing after I try running that xrandr command: Arch Linux 4.9.8-1-ARCH (ttymxc1) alarm login: [ 19.197477] fec 2188000.ethernet eth0: Link is Up - 1Gbps/Full - flow control rx/tx [ 19.205165] IPv6: ADDRCONF(NETDEV_CHANGE): eth0: link becomes ready [ 33.080000] vgaarb: this pci device is not a vga device [ 33.203520] vgaarb: this pci device is not a vga device [ 33.447051] imx-ipuv3 2400000.ipu: DC stop timeout after 50 ms [ 33.707042] ------------[ cut here ]------------ [ 33.711682] WARNING: CPU: 1 PID: 316 at drivers/gpu/drm/drm_atomic_helper.c:1140 drm_atomic_helper_wait_for_vblanks+0x274/0x278 [ 33.723187] [CRTC:24] vblank wait timed out [ 33.727395] Modules linked in: snd_soc_sgtl5000 snd_soc_fsl_ssi snd_soc_imx_sgtl5000 imx_pcm_fiq imx_pcm_dma snd_soc_fsl_asrc snd_soc_fsl_asoc_card snd_soc_core dw_hdmi_ahb_audio snd_pcm_dmaengine caam_jr imx_ipuv3_crtc snd_ac97_codec coda v4l2_mem2mem videobuf2_dma_contig ac97_bus imx_ipu_v3 snd_soc_imx_audmux snd_pcm videobuf2_vmalloc videobuf2_memops videobuf2_v4l2 videobuf2_core dw_hdmi_imx caam imx2_wdt ofpart spi_imx evdev dw_hdmi etnaviv imx_ldb pwm_imx snd_timer parallel_display uio_pdrv_genirq uio imxdrm sch_fq_codel ip_tables x_tables [ 33.776237] CPU: 1 PID: 316 Comm: Xorg Not tainted 4.9.8-1-ARCH #1 [ 33.782419] Hardware name: Freescale i.MX6 Quad/DualLite (Device Tree) [ 33.788965] [<c0110ba4>] (unwind_backtrace) from [<c010bf10>] (show_stack+0x10/0x14) [ 33.796719] [<c010bf10>] (show_stack) from [<c053f2c0>] (dump_stack+0x88/0x9c) [ 33.803951] [<c053f2c0>] (dump_stack) from [<c01442a0>] (__warn+0xe8/0x100) [ 33.810919] [<c01442a0>] (__warn) from [<c0144300>] (warn_slowpath_fmt+0x48/0x6c) [ 33.818410] [<c0144300>] (warn_slowpath_fmt) from [<c06c1850>] (drm_atomic_helper_wait_for_vblanks+0x274/0x278) [ 33.828516] [<c06c1850>] (drm_atomic_helper_wait_for_vblanks) from [<bf0182ec>] (imx_drm_atomic_commit_tail+0x48/0x58 [imxdrm]) [ 33.840004] [<bf0182ec>] (imx_drm_atomic_commit_tail [imxdrm]) from [<c06c40f4>] (commit_tail+0x40/0x5c) [ 33.849489] [<c06c40f4>] (commit_tail) from [<c06c41ac>] (drm_atomic_helper_commit+0x94/0xd8) [ 33.858019] [<c06c41ac>] (drm_atomic_helper_commit) from [<c06c46dc>] (drm_atomic_helper_set_config+0x78/0x9c) [ 33.868028] [<c06c46dc>] (drm_atomic_helper_set_config) from [<c06d5f8c>] (drm_mode_set_config_internal+0x58/0xdc) [ 33.878382] [<c06d5f8c>] (drm_mode_set_config_internal) from [<c06d74c4>] (drm_mode_setcrtc+0x4a4/0x550) [ 33.887867] [<c06d74c4>] (drm_mode_setcrtc) from [<c06ce704>] (drm_ioctl+0x214/0x44c) [ 33.895704] [<c06ce704>] (drm_ioctl) from [<c0288638>] (do_vfs_ioctl+0xac/0x980) [ 33.903104] [<c0288638>] (do_vfs_ioctl) from [<c0288f78>] (SyS_ioctl+0x6c/0x7c) [ 33.910422] [<c0288f78>] (SyS_ioctl) from [<c0107c60>] (ret_fast_syscall+0x0/0x3c) [ 33.918023] ---[ end trace e8a77aa320be7e55 ]--- [ 43.997066] [drm:drm_atomic_helper_commit_cleanup_done] *ERROR* [CRTC:24:crtc-0] flip_done timed out [ 55.517063] [drm:drm_atomic_helper_commit_cleanup_done] *ERROR* [CRTC:24:crtc-0] flip_done timed out [ 56.958264] alloc_contig_range: [4d0b7, 4d0b8) PFNs busy [ 90.896615] usb 1-1.2.3: new low-speed USB device number 6 using ci_hdrc [ 91.050796] usb 1-1.2.3: New USB device found, idVendor=0458, idProduct=003a [ 91.057888] usb 1-1.2.3: New USB device strings: Mfr=1, Product=2, SerialNumber=0 [ 91.065382] usb 1-1.2.3: Product: Optical Mouse [ 91.069944] usb 1-1.2.3: Manufacturer: Genius [ 91.082071] input: Genius Optical Mouse as /devices/soc0/soc/2100000.aips-bus/2184200.usb/ci_hdrc.1/usb1/1-1/1-1.2/1-1.2.3/1-1.2.3:1.0/0003:0458:003A.0003/input/input3 [ 91.098116] hid-generic 0003:0458:003A.0003: input,hidraw2: USB HID v1.11 Mouse [Genius Optical Mouse] on usb-ci_hdrc.1-1.2.3/input0 [ 91.162048] mousedev: PS/2 mouse device common for all mice [ 214.765689] imx-ipuv3 2400000.ipu: DC stop timeout after 50 ms [ 214.825688] Unable to handle kernel NULL pointer dereference at virtual address 00000000 [ 214.833783] pgd = ed1b8000 [ 214.836491] [00000000] *pgd=4c974831 [ 214.840084] Internal error: Oops: 17 [#1] SMP ARM [ 214.844789] Modules linked in: mousedev snd_soc_sgtl5000 snd_soc_fsl_ssi snd_soc_imx_sgtl5000 imx_pcm_fiq imx_pcm_dma snd_soc_fsl_asrc snd_soc_fsl_asoc_card snd_soc_core dw_hdmi_ahb_audio snd_pcm_dmaengine caam_jr imx_ipuv3_crtc snd_ac97_codec coda v4l2_mem2mem videobuf2_dma_contig ac97_bus imx_ipu_v3 snd_soc_imx_audmux snd_pcm videobuf2_vmalloc videobuf2_memops videobuf2_v4l2 videobuf2_core dw_hdmi_imx caam imx2_wdt ofpart spi_imx evdev dw_hdmi etnaviv imx_ldb pwm_imx snd_timer parallel_display uio_pdrv_genirq uio imxdrm sch_fq_codel ip_tables x_tables [ 214.894338] CPU: 2 PID: 316 Comm: Xorg Tainted: G W 4.9.8-1-ARCH #1 [ 214.901735] Hardware name: Freescale i.MX6 Quad/DualLite (Device Tree) [ 214.908264] task: ed2c4d00 task.stack: ed2a6000 [ 214.912803] PC is at __wake_up_common+0x1c/0x80 [ 214.917337] LR is at __wake_up_locked+0x14/0x1c [ 214.921871] pc : [<c0186568>] lr : [<c018662c>] psr: a0070093 [ 214.921871] sp : ed2a7c68 ip : 00000000 fp : c0fa2a70 [ 214.933348] r10: c0f37384 r9 : 00000003 r8 : 00000000 [ 214.938574] r7 : 00000000 r6 : edbf3410 r5 : edbf3408 r4 : edbf340c [ 214.945101] r3 : 00000000 r2 : 00000000 r1 : 00000000 r0 : edbf340c [ 214.951630] Flags: NzCv IRQs off FIQs on Mode SVC_32 ISA ARM Segment none [ 214.958854] Control: 10c5387d Table: 3d1b804a DAC: 00000051 [ 214.964600] Process Xorg (pid: 316, stack limit = 0xed2a6220) [ 214.970347] Stack: (0xed2a7c68 to 0xed2a8000) [ 214.974708] 7c60: 00000000 edbf340c edbf3408 a0070093 edb46114 edb46000 [ 214.982889] 7c80: 0000039f c0f37384 c0fa2a70 c018662c 00000000 c0fa1144 bf21c4fc c018704c [ 214.991069] 7ca0: edbf3380 edbf3380 00000000 c06ccac0 edfa1400 edbf3380 00000000 c06d023c [ 214.999250] 7cc0: 0000039f 00000000 edab2a00 80070013 edb4611c c12040cc 00000000 00000000 [ 215.007430] 7ce0: 00000000 00040908 edb3f410 ed412c40 00000000 00000000 ed26a800 edb47c18 [ 215.015610] 7d00: c0f37384 c0fa1144 bf21c4fc c06c3e3c edc67780 c06c1c24 edb46000 edb46000 [ 215.023791] 7d20: bf01862c ed412c40 edb46000 00000000 edb46000 ed410100 ed412240 ed412240 [ 215.031971] 7d40: c0c0c0c0 bf0182bc ed412c40 bf018ca4 00000000 c06c40f4 ed412c40 00000000 [ 215.040152] 7d60: 00000000 c06c41ac ed412c40 00000000 ed2a7dd0 edb47c18 ed410100 c06c46dc [ 215.048332] 7d80: eda36180 edb47c18 00000001 c12040cc ed410100 c06d5f8c ed2a7e4c edb46000 [ 215.056513] 7da0: 00000001 c12040cc ed410100 c06d74c4 edaa5980 edb46248 edb47c18 eda3618c [ 215.064694] 7dc0: eda36180 ed412240 ed410100 c12040cc eda36180 edb47c18 ed410100 00000000 [ 215.072874] 7de0: 00000000 ed412240 00000001 00040908 ed2a7e70 00000051 00000068 c12040cc [ 215.081055] 7e00: c0cbf0a0 00000068 edf66800 ed2a7e4c c06864a2 c06ce704 0000e201 00000001 [ 215.089236] 7e20: c0fa22f0 00040908 f50417fa ed2a7e4c be9d1910 000000a2 edb46000 00000068 [ 215.097415] 7e40: 00000062 c06d7020 c1208504 008a1210 00000000 00000001 00000018 00000047 [ 215.105596] 7e60: 00000000 00000000 00000000 00000001 00007530 03480320 03a00378 01e00000 [ 215.113775] 7e80: 01f001ed 0000020d 00000000 00000000 00000000 00000000 00000000 00000000 [ 215.121955] 7ea0: 00000000 00000000 00000000 00000000 00000000 c0b0a268 00000000 00040908 [ 215.130137] 7ec0: ed2a7edc ed2a7fb0 00000008 00040908 00000000 c12040cc be9d1910 edd8cbc8 [ 215.138317] 7ee0: edcc9b40 be9d1910 0000000b 00000000 00000000 c0288638 004f10a0 c0101308 [ 215.146497] 7f00: 00000000 eff6fe48 eff6fe24 eff6fe00 000112da c02bb9bc 00000008 c01b4a08 [ 215.154677] 7f20: 00040908 c12040cc 00000000 ed29b1b8 00000003 be9d1910 be9d1808 ffffe000 [ 215.162857] 7f40: 00000051 ed2a6100 00000100 00000000 ed2a6000 c0102fa4 be9d1678 00040908 [ 215.171038] 7f60: c12040cc 00000000 edcc9b41 edcc9b40 c06864a2 be9d1910 0000000b 00000000 [ 215.179218] 7f80: 00000000 c0288f78 b6fc3c90 be9d1910 c06864a2 00000036 c0107e24 ed2a6000 [ 215.187398] 7fa0: 00000000 c0107c60 b6fc3c90 be9d1910 0000000b c06864a2 be9d1910 00000001 [ 215.195579] 7fc0: b6fc3c90 be9d1910 c06864a2 00000036 008a1210 00000047 00000018 00000000 [ 215.203759] 7fe0: b6ddf088 be9d18f4 b6dc7ad4 b6b11adc 40070010 0000000b 3fffd861 3fffdc61 [ 215.211946] [<c0186568>] (__wake_up_common) from [<c018662c>] (__wake_up_locked+0x14/0x1c) [ 215.220216] [<c018662c>] (__wake_up_locked) from [<c018704c>] (complete_all+0x34/0x44) [ 215.228141] [<c018704c>] (complete_all) from [<c06ccac0>] (drm_send_event_locked+0x28/0x11c) [ 215.236588] [<c06ccac0>] (drm_send_event_locked) from [<c06d023c>] (drm_vblank_off+0x1b0/0x21c) [ 215.245296] [<c06d023c>] (drm_vblank_off) from [<c06c3e3c>] (drm_atomic_helper_commit_modeset_disables+0x1dc/0x3fc) [ 215.255750] [<c06c3e3c>] (drm_atomic_helper_commit_modeset_disables) from [<bf0182bc>] (imx_drm_atomic_commit_tail+0x18/0x58 [imxdrm]) [ 215.267843] [<bf0182bc>] (imx_drm_atomic_commit_tail [imxdrm]) from [<c06c40f4>] (commit_tail+0x40/0x5c) [ 215.277327] [<c06c40f4>] (commit_tail) from [<c06c41ac>] (drm_atomic_helper_commit+0x94/0xd8) [ 215.285858] [<c06c41ac>] (drm_atomic_helper_commit) from [<c06c46dc>] (drm_atomic_helper_set_config+0x78/0x9c) [ 215.295865] [<c06c46dc>] (drm_atomic_helper_set_config) from [<c06d5f8c>] (drm_mode_set_config_internal+0x58/0xdc) [ 215.306219] [<c06d5f8c>] (drm_mode_set_config_internal) from [<c06d74c4>] (drm_mode_setcrtc+0x4a4/0x550) [ 215.315703] [<c06d74c4>] (drm_mode_setcrtc) from [<c06ce704>] (drm_ioctl+0x214/0x44c) [ 215.323540] [<c06ce704>] (drm_ioctl) from [<c0288638>] (do_vfs_ioctl+0xac/0x980) [ 215.330940] [<c0288638>] (do_vfs_ioctl) from [<c0288f78>] (SyS_ioctl+0x6c/0x7c) [ 215.338258] [<c0288f78>] (SyS_ioctl) from [<c0107c60>] (ret_fast_syscall+0x0/0x3c) [ 215.345832] Code: e5b61004 e1a08003 e59d7028 e1560001 (e5913000) [ 215.351929] ---[ end trace e8a77aa320be7e56 ]--- Thanks _______________________________________________ dri-devel mailing list dri-devel@lists.freedesktop.org https://lists.freedesktop.org/mailman/listinfo/dri-devel ^ permalink raw reply [flat|nested] 9+ messages in thread
* Re: imxdrm issue on SABRE Lite 2017-02-11 21:09 imxdrm issue on SABRE Lite Dan MacDonald @ 2017-02-12 0:15 ` Russell King - ARM Linux 2017-02-13 8:05 ` Thierry Reding 2017-02-20 15:42 ` Philipp Zabel 1 sibling, 1 reply; 9+ messages in thread From: Russell King - ARM Linux @ 2017-02-12 0:15 UTC (permalink / raw) To: p.zabel, dri-devel; +Cc: Dan MacDonald On Sat, Feb 11, 2017 at 09:09:34PM +0000, Dan MacDonald wrote: > [ 43.997066] [drm:drm_atomic_helper_commit_cleanup_done] *ERROR* > [CRTC:24:crtc-0] flip_done timed out > [ 55.517063] [drm:drm_atomic_helper_commit_cleanup_done] *ERROR* > [CRTC:24:crtc-0] flip_done timed out This seems to lay the foundation for the kernel to Oops itself later. The problem seems to be this: drm_atomic_helper_commit(state->dev, state, false) - drm_atomic_helper_setup_commit(state, false) - foreach crtc in state - commit->event = kzalloc() - crtc_state->event = commit->event - crtc_state->event->base.completion = &commit->flip_done ... - commit_tail(state) - funcs->atomic_commit_tail(state) ... - drm_atomic_helper_commit_planes(dev, state, DRM_PLANE_COMMIT_ACTIVE_ONLY | DRM_PLANE_COMMIT_NO_DISABLE_AFTER_MODES$ - foreach active crtc in state - funcs->atomic_begin(crtc, old_crtc_state) - ipu_crtc_atomic_begin() - drm_crtc_vblank_on() - if crtc->state->event - drm_crtc_arm_vblank_event(crtc, crtc->state->event) - crtc->state->event = NULL At this point, the "commit->flip_done" completion is queued with the event onto the vblank list. ... - drm_atomic_helper_commit_cleanup_done(state) - foreach crtc in state - try_wait_for_completion(&commit->hw_done) - wait_for_completion_timeout(&commit->flip_done, 10sec) This is where we get the timeout message. - drm_atomic_state_free(state) This "clears" the commit state (calling drm_crtc_commit_put() on it) which has the effect of kfree()'ing the structure containing the flip_done, but which is still on the vblank list. The next time we try to set a mode, the result is that a call to drm_crtc_vblank_off() causes all queued events to be sent, including the now kfree()'d flip_done completion, resulting in the reported kernel oops. It seems others are also suffering similar issues when the flip_done completion times out with other drivers: https://lkml.org/lkml/2016/12/1/171 https://bugs.freedesktop.org/show_bug.cgi?id=96781 https://lists.opensuse.org/opensuse-bugs/2016-10/msg03011.html https://patchwork.kernel.org/patch/9280223/ (which is me...) This is likely the same, although the timeout line was not captured: https://bugzilla.redhat.com/show_bug.cgi?id=1415180 https://bodhi.fedoraproject.org/updates/kernel-4.8.7-200.fc24 So, can we please avoid killing the kernel when the hardware doesn't quite behave as we want it to? Right now, when we oops the kernel, we're leaking all the memory associated with the atomic modeset, so if we stop oopsing the kernel but still leak the memory, surely that would be an improvement? Maybe something like the untested patch at the bottom of this mail? It would give the opportunity to poke about on a failed system to work out what happened and maybe why the hardware misbehaved. The real answer is for the hardware to behave, but we can't always have our cake. Note - I can't reproduce Dan's problem here on 4.10-rc7 as I suspect it needs multiple CRTCs/outputs running in the IPU to trigger it, which Sabre lite has. I'll try enabling the (disconnected) LVDS output tomorrow (I have Fabio's LVDS patch knocking about), but I suspect those with a deeper knowledge of the IPU need to investigate what's going on. > [ 214.765689] imx-ipuv3 2400000.ipu: DC stop timeout after 50 ms > [ 214.825688] Unable to handle kernel NULL pointer dereference at > virtual address 00000000 > [ 214.833783] pgd = ed1b8000 > [ 214.836491] [00000000] *pgd=4c974831 > [ 214.840084] Internal error: Oops: 17 [#1] SMP ARM > [ 214.844789] Modules linked in: mousedev snd_soc_sgtl5000 > snd_soc_fsl_ssi snd_soc_imx_sgtl5000 imx_pcm_fiq imx_pcm_dma > snd_soc_fsl_asrc snd_soc_fsl_asoc_card snd_soc_core dw_hdmi_ahb_audio > snd_pcm_dmaengine caam_jr imx_ipuv3_crtc snd_ac97_codec coda > v4l2_mem2mem videobuf2_dma_contig ac97_bus imx_ipu_v3 > snd_soc_imx_audmux snd_pcm videobuf2_vmalloc videobuf2_memops > videobuf2_v4l2 videobuf2_core dw_hdmi_imx caam imx2_wdt ofpart spi_imx > evdev dw_hdmi etnaviv imx_ldb pwm_imx snd_timer parallel_display > uio_pdrv_genirq uio imxdrm sch_fq_codel ip_tables x_tables > [ 214.894338] CPU: 2 PID: 316 Comm: Xorg Tainted: G W > 4.9.8-1-ARCH #1 > [ 214.901735] Hardware name: Freescale i.MX6 Quad/DualLite (Device Tree) > [ 214.908264] task: ed2c4d00 task.stack: ed2a6000 > [ 214.912803] PC is at __wake_up_common+0x1c/0x80 > [ 214.917337] LR is at __wake_up_locked+0x14/0x1c > [ 214.921871] pc : [<c0186568>] lr : [<c018662c>] psr: a0070093 > [ 214.921871] sp : ed2a7c68 ip : 00000000 fp : c0fa2a70 > [ 214.933348] r10: c0f37384 r9 : 00000003 r8 : 00000000 > [ 214.938574] r7 : 00000000 r6 : edbf3410 r5 : edbf3408 r4 : edbf340c > [ 214.945101] r3 : 00000000 r2 : 00000000 r1 : 00000000 r0 : edbf340c > [ 214.951630] Flags: NzCv IRQs off FIQs on Mode SVC_32 ISA ARM > Segment none > [ 214.958854] Control: 10c5387d Table: 3d1b804a DAC: 00000051 > [ 214.964600] Process Xorg (pid: 316, stack limit = 0xed2a6220) > [ 214.970347] Stack: (0xed2a7c68 to 0xed2a8000) > [ 214.974708] 7c60: 00000000 edbf340c edbf3408 > a0070093 edb46114 edb46000 > [ 214.982889] 7c80: 0000039f c0f37384 c0fa2a70 c018662c 00000000 > c0fa1144 bf21c4fc c018704c > [ 214.991069] 7ca0: edbf3380 edbf3380 00000000 c06ccac0 edfa1400 > edbf3380 00000000 c06d023c > [ 214.999250] 7cc0: 0000039f 00000000 edab2a00 80070013 edb4611c > c12040cc 00000000 00000000 > [ 215.007430] 7ce0: 00000000 00040908 edb3f410 ed412c40 00000000 > 00000000 ed26a800 edb47c18 > [ 215.015610] 7d00: c0f37384 c0fa1144 bf21c4fc c06c3e3c edc67780 > c06c1c24 edb46000 edb46000 > [ 215.023791] 7d20: bf01862c ed412c40 edb46000 00000000 edb46000 > ed410100 ed412240 ed412240 > [ 215.031971] 7d40: c0c0c0c0 bf0182bc ed412c40 bf018ca4 00000000 > c06c40f4 ed412c40 00000000 > [ 215.040152] 7d60: 00000000 c06c41ac ed412c40 00000000 ed2a7dd0 > edb47c18 ed410100 c06c46dc > [ 215.048332] 7d80: eda36180 edb47c18 00000001 c12040cc ed410100 > c06d5f8c ed2a7e4c edb46000 > [ 215.056513] 7da0: 00000001 c12040cc ed410100 c06d74c4 edaa5980 > edb46248 edb47c18 eda3618c > [ 215.064694] 7dc0: eda36180 ed412240 ed410100 c12040cc eda36180 > edb47c18 ed410100 00000000 > [ 215.072874] 7de0: 00000000 ed412240 00000001 00040908 ed2a7e70 > 00000051 00000068 c12040cc > [ 215.081055] 7e00: c0cbf0a0 00000068 edf66800 ed2a7e4c c06864a2 > c06ce704 0000e201 00000001 > [ 215.089236] 7e20: c0fa22f0 00040908 f50417fa ed2a7e4c be9d1910 > 000000a2 edb46000 00000068 > [ 215.097415] 7e40: 00000062 c06d7020 c1208504 008a1210 00000000 > 00000001 00000018 00000047 > [ 215.105596] 7e60: 00000000 00000000 00000000 00000001 00007530 > 03480320 03a00378 01e00000 > [ 215.113775] 7e80: 01f001ed 0000020d 00000000 00000000 00000000 > 00000000 00000000 00000000 > [ 215.121955] 7ea0: 00000000 00000000 00000000 00000000 00000000 > c0b0a268 00000000 00040908 > [ 215.130137] 7ec0: ed2a7edc ed2a7fb0 00000008 00040908 00000000 > c12040cc be9d1910 edd8cbc8 > [ 215.138317] 7ee0: edcc9b40 be9d1910 0000000b 00000000 00000000 > c0288638 004f10a0 c0101308 > [ 215.146497] 7f00: 00000000 eff6fe48 eff6fe24 eff6fe00 000112da > c02bb9bc 00000008 c01b4a08 > [ 215.154677] 7f20: 00040908 c12040cc 00000000 ed29b1b8 00000003 > be9d1910 be9d1808 ffffe000 > [ 215.162857] 7f40: 00000051 ed2a6100 00000100 00000000 ed2a6000 > c0102fa4 be9d1678 00040908 > [ 215.171038] 7f60: c12040cc 00000000 edcc9b41 edcc9b40 c06864a2 > be9d1910 0000000b 00000000 > [ 215.179218] 7f80: 00000000 c0288f78 b6fc3c90 be9d1910 c06864a2 > 00000036 c0107e24 ed2a6000 > [ 215.187398] 7fa0: 00000000 c0107c60 b6fc3c90 be9d1910 0000000b > c06864a2 be9d1910 00000001 > [ 215.195579] 7fc0: b6fc3c90 be9d1910 c06864a2 00000036 008a1210 > 00000047 00000018 00000000 > [ 215.203759] 7fe0: b6ddf088 be9d18f4 b6dc7ad4 b6b11adc 40070010 > 0000000b 3fffd861 3fffdc61 > [ 215.211946] [<c0186568>] (__wake_up_common) from [<c018662c>] > (__wake_up_locked+0x14/0x1c) > [ 215.220216] [<c018662c>] (__wake_up_locked) from [<c018704c>] > (complete_all+0x34/0x44) > [ 215.228141] [<c018704c>] (complete_all) from [<c06ccac0>] > (drm_send_event_locked+0x28/0x11c) > [ 215.236588] [<c06ccac0>] (drm_send_event_locked) from [<c06d023c>] > (drm_vblank_off+0x1b0/0x21c) > [ 215.245296] [<c06d023c>] (drm_vblank_off) from [<c06c3e3c>] > (drm_atomic_helper_commit_modeset_disables+0x1dc/0x3fc) > [ 215.255750] [<c06c3e3c>] > (drm_atomic_helper_commit_modeset_disables) from [<bf0182bc>] > (imx_drm_atomic_commit_tail+0x18/0x58 [imxdrm]) > [ 215.267843] [<bf0182bc>] (imx_drm_atomic_commit_tail [imxdrm]) from > [<c06c40f4>] (commit_tail+0x40/0x5c) > [ 215.277327] [<c06c40f4>] (commit_tail) from [<c06c41ac>] > (drm_atomic_helper_commit+0x94/0xd8) > [ 215.285858] [<c06c41ac>] (drm_atomic_helper_commit) from > [<c06c46dc>] (drm_atomic_helper_set_config+0x78/0x9c) > [ 215.295865] [<c06c46dc>] (drm_atomic_helper_set_config) from > [<c06d5f8c>] (drm_mode_set_config_internal+0x58/0xdc) > [ 215.306219] [<c06d5f8c>] (drm_mode_set_config_internal) from > [<c06d74c4>] (drm_mode_setcrtc+0x4a4/0x550) > [ 215.315703] [<c06d74c4>] (drm_mode_setcrtc) from [<c06ce704>] > (drm_ioctl+0x214/0x44c) > [ 215.323540] [<c06ce704>] (drm_ioctl) from [<c0288638>] > (do_vfs_ioctl+0xac/0x980) > [ 215.330940] [<c0288638>] (do_vfs_ioctl) from [<c0288f78>] > (SyS_ioctl+0x6c/0x7c) > [ 215.338258] [<c0288f78>] (SyS_ioctl) from [<c0107c60>] > (ret_fast_syscall+0x0/0x3c) > [ 215.345832] Code: e5b61004 e1a08003 e59d7028 e1560001 (e5913000) > [ 215.351929] ---[ end trace e8a77aa320be7e56 ]--- drivers/gpu/drm/drm_atomic_helper.c | 15 +++++++++------ include/drm/drm_atomic_helper.h | 2 +- 2 files changed, 10 insertions(+), 7 deletions(-) diff --git a/drivers/gpu/drm/drm_atomic_helper.c b/drivers/gpu/drm/drm_atomic_helper.c index 21f992605541..46668d071d6a 100644 --- a/drivers/gpu/drm/drm_atomic_helper.c +++ b/drivers/gpu/drm/drm_atomic_helper.c @@ -1201,9 +1201,8 @@ static void commit_tail(struct drm_atomic_state *state) else drm_atomic_helper_commit_tail(state); - drm_atomic_helper_commit_cleanup_done(state); - - drm_atomic_state_free(state); + if (drm_atomic_helper_commit_cleanup_done(state) == 0) + drm_atomic_state_free(state); } static void commit_work(struct work_struct *work) @@ -1591,12 +1590,12 @@ EXPORT_SYMBOL(drm_atomic_helper_commit_hw_done); * This is part of the atomic helper support for nonblocking commits, see * drm_atomic_helper_setup_commit() for an overview. */ -void drm_atomic_helper_commit_cleanup_done(struct drm_atomic_state *state) +int drm_atomic_helper_commit_cleanup_done(struct drm_atomic_state *state) { struct drm_crtc *crtc; struct drm_crtc_state *crtc_state; struct drm_crtc_commit *commit; - int i; + int i, failed = 0; long ret; for_each_crtc_in_state(state, crtc, crtc_state, i) { @@ -1621,15 +1620,19 @@ void drm_atomic_helper_commit_cleanup_done(struct drm_atomic_state *state) * not hold a reference of its own. */ ret = wait_for_completion_timeout(&commit->flip_done, 10*HZ); - if (ret == 0) - DRM_ERROR("[CRTC:%d:%s] flip_done timed out\n", + if (ret == 0) { + DRM_ERROR("[CRTC:%d:%s] flip_done timed out, memory leaked\n", crtc->base.id, crtc->name); + failed = -ETIMEDOUT; + } spin_lock(&crtc->commit_lock); del_commit: list_del(&commit->commit_entry); spin_unlock(&crtc->commit_lock); } + + return failed; } EXPORT_SYMBOL(drm_atomic_helper_commit_cleanup_done); diff --git a/include/drm/drm_atomic_helper.h b/include/drm/drm_atomic_helper.h index 7ff92b09fd9c..ee3d642c1feb 100644 --- a/include/drm/drm_atomic_helper.h +++ b/include/drm/drm_atomic_helper.h @@ -88,7 +88,7 @@ int drm_atomic_helper_setup_commit(struct drm_atomic_state *state, bool nonblock); void drm_atomic_helper_wait_for_dependencies(struct drm_atomic_state *state); void drm_atomic_helper_commit_hw_done(struct drm_atomic_state *state); -void drm_atomic_helper_commit_cleanup_done(struct drm_atomic_state *state); +int drm_atomic_helper_commit_cleanup_done(struct drm_atomic_state *state); /* implementations for legacy interfaces */ int drm_atomic_helper_update_plane(struct drm_plane *plane, -- RMK's Patch system: http://www.armlinux.org.uk/developer/patches/ FTTC broadband for 0.8mile line: currently at 9.6Mbps down 400kbps up according to speedtest.net. _______________________________________________ dri-devel mailing list dri-devel@lists.freedesktop.org https://lists.freedesktop.org/mailman/listinfo/dri-devel ^ permalink raw reply related [flat|nested] 9+ messages in thread
* Re: imxdrm issue on SABRE Lite 2017-02-12 0:15 ` Russell King - ARM Linux @ 2017-02-13 8:05 ` Thierry Reding 2017-02-13 8:55 ` Chris Wilson 2017-02-13 9:20 ` Russell King - ARM Linux 0 siblings, 2 replies; 9+ messages in thread From: Thierry Reding @ 2017-02-13 8:05 UTC (permalink / raw) To: Russell King - ARM Linux; +Cc: dri-devel, Dan MacDonald [-- Attachment #1.1: Type: text/plain, Size: 13767 bytes --] On Sun, Feb 12, 2017 at 12:15:46AM +0000, Russell King - ARM Linux wrote: > On Sat, Feb 11, 2017 at 09:09:34PM +0000, Dan MacDonald wrote: > > [ 43.997066] [drm:drm_atomic_helper_commit_cleanup_done] *ERROR* > > [CRTC:24:crtc-0] flip_done timed out > > [ 55.517063] [drm:drm_atomic_helper_commit_cleanup_done] *ERROR* > > [CRTC:24:crtc-0] flip_done timed out > > This seems to lay the foundation for the kernel to Oops itself later. > The problem seems to be this: > > drm_atomic_helper_commit(state->dev, state, false) > - drm_atomic_helper_setup_commit(state, false) > - foreach crtc in state > - commit->event = kzalloc() > - crtc_state->event = commit->event > - crtc_state->event->base.completion = &commit->flip_done > ... > - commit_tail(state) > - funcs->atomic_commit_tail(state) > ... > - drm_atomic_helper_commit_planes(dev, state, > DRM_PLANE_COMMIT_ACTIVE_ONLY | > DRM_PLANE_COMMIT_NO_DISABLE_AFTER_MODES$ - foreach active crtc in state > - funcs->atomic_begin(crtc, old_crtc_state) > - ipu_crtc_atomic_begin() > - drm_crtc_vblank_on() > - if crtc->state->event > - drm_crtc_arm_vblank_event(crtc, crtc->state->event) > - crtc->state->event = NULL > > At this point, the "commit->flip_done" completion is queued with the > event onto the vblank list. > ... > - drm_atomic_helper_commit_cleanup_done(state) > - foreach crtc in state > - try_wait_for_completion(&commit->hw_done) > - wait_for_completion_timeout(&commit->flip_done, 10sec) > > This is where we get the timeout message. > > - drm_atomic_state_free(state) > > This "clears" the commit state (calling drm_crtc_commit_put() on it) > which has the effect of kfree()'ing the structure containing the > flip_done, but which is still on the vblank list. > > The next time we try to set a mode, the result is that a call to > drm_crtc_vblank_off() causes all queued events to be sent, including > the now kfree()'d flip_done completion, resulting in the reported > kernel oops. > > It seems others are also suffering similar issues when the flip_done > completion times out with other drivers: > > https://lkml.org/lkml/2016/12/1/171 > https://bugs.freedesktop.org/show_bug.cgi?id=96781 > https://lists.opensuse.org/opensuse-bugs/2016-10/msg03011.html > https://patchwork.kernel.org/patch/9280223/ (which is me...) > > This is likely the same, although the timeout line was not captured: > https://bugzilla.redhat.com/show_bug.cgi?id=1415180 > https://bodhi.fedoraproject.org/updates/kernel-4.8.7-200.fc24 > > So, can we please avoid killing the kernel when the hardware doesn't > quite behave as we want it to? > > Right now, when we oops the kernel, we're leaking all the memory > associated with the atomic modeset, so if we stop oopsing the kernel > but still leak the memory, surely that would be an improvement? > Maybe something like the untested patch at the bottom of this mail? > > It would give the opportunity to poke about on a failed system to > work out what happened and maybe why the hardware misbehaved. > > The real answer is for the hardware to behave, but we can't always > have our cake. > > Note - I can't reproduce Dan's problem here on 4.10-rc7 as I suspect > it needs multiple CRTCs/outputs running in the IPU to trigger it, > which Sabre lite has. I'll try enabling the (disconnected) LVDS > output tomorrow (I have Fabio's LVDS patch knocking about), but I > suspect those with a deeper knowledge of the IPU need to investigate > what's going on. > > > [ 214.765689] imx-ipuv3 2400000.ipu: DC stop timeout after 50 ms > > [ 214.825688] Unable to handle kernel NULL pointer dereference at > > virtual address 00000000 > > [ 214.833783] pgd = ed1b8000 > > [ 214.836491] [00000000] *pgd=4c974831 > > [ 214.840084] Internal error: Oops: 17 [#1] SMP ARM > > [ 214.844789] Modules linked in: mousedev snd_soc_sgtl5000 > > snd_soc_fsl_ssi snd_soc_imx_sgtl5000 imx_pcm_fiq imx_pcm_dma > > snd_soc_fsl_asrc snd_soc_fsl_asoc_card snd_soc_core dw_hdmi_ahb_audio > > snd_pcm_dmaengine caam_jr imx_ipuv3_crtc snd_ac97_codec coda > > v4l2_mem2mem videobuf2_dma_contig ac97_bus imx_ipu_v3 > > snd_soc_imx_audmux snd_pcm videobuf2_vmalloc videobuf2_memops > > videobuf2_v4l2 videobuf2_core dw_hdmi_imx caam imx2_wdt ofpart spi_imx > > evdev dw_hdmi etnaviv imx_ldb pwm_imx snd_timer parallel_display > > uio_pdrv_genirq uio imxdrm sch_fq_codel ip_tables x_tables > > [ 214.894338] CPU: 2 PID: 316 Comm: Xorg Tainted: G W > > 4.9.8-1-ARCH #1 > > [ 214.901735] Hardware name: Freescale i.MX6 Quad/DualLite (Device Tree) > > [ 214.908264] task: ed2c4d00 task.stack: ed2a6000 > > [ 214.912803] PC is at __wake_up_common+0x1c/0x80 > > [ 214.917337] LR is at __wake_up_locked+0x14/0x1c > > [ 214.921871] pc : [<c0186568>] lr : [<c018662c>] psr: a0070093 > > [ 214.921871] sp : ed2a7c68 ip : 00000000 fp : c0fa2a70 > > [ 214.933348] r10: c0f37384 r9 : 00000003 r8 : 00000000 > > [ 214.938574] r7 : 00000000 r6 : edbf3410 r5 : edbf3408 r4 : edbf340c > > [ 214.945101] r3 : 00000000 r2 : 00000000 r1 : 00000000 r0 : edbf340c > > [ 214.951630] Flags: NzCv IRQs off FIQs on Mode SVC_32 ISA ARM > > Segment none > > [ 214.958854] Control: 10c5387d Table: 3d1b804a DAC: 00000051 > > [ 214.964600] Process Xorg (pid: 316, stack limit = 0xed2a6220) > > [ 214.970347] Stack: (0xed2a7c68 to 0xed2a8000) > > [ 214.974708] 7c60: 00000000 edbf340c edbf3408 > > a0070093 edb46114 edb46000 > > [ 214.982889] 7c80: 0000039f c0f37384 c0fa2a70 c018662c 00000000 > > c0fa1144 bf21c4fc c018704c > > [ 214.991069] 7ca0: edbf3380 edbf3380 00000000 c06ccac0 edfa1400 > > edbf3380 00000000 c06d023c > > [ 214.999250] 7cc0: 0000039f 00000000 edab2a00 80070013 edb4611c > > c12040cc 00000000 00000000 > > [ 215.007430] 7ce0: 00000000 00040908 edb3f410 ed412c40 00000000 > > 00000000 ed26a800 edb47c18 > > [ 215.015610] 7d00: c0f37384 c0fa1144 bf21c4fc c06c3e3c edc67780 > > c06c1c24 edb46000 edb46000 > > [ 215.023791] 7d20: bf01862c ed412c40 edb46000 00000000 edb46000 > > ed410100 ed412240 ed412240 > > [ 215.031971] 7d40: c0c0c0c0 bf0182bc ed412c40 bf018ca4 00000000 > > c06c40f4 ed412c40 00000000 > > [ 215.040152] 7d60: 00000000 c06c41ac ed412c40 00000000 ed2a7dd0 > > edb47c18 ed410100 c06c46dc > > [ 215.048332] 7d80: eda36180 edb47c18 00000001 c12040cc ed410100 > > c06d5f8c ed2a7e4c edb46000 > > [ 215.056513] 7da0: 00000001 c12040cc ed410100 c06d74c4 edaa5980 > > edb46248 edb47c18 eda3618c > > [ 215.064694] 7dc0: eda36180 ed412240 ed410100 c12040cc eda36180 > > edb47c18 ed410100 00000000 > > [ 215.072874] 7de0: 00000000 ed412240 00000001 00040908 ed2a7e70 > > 00000051 00000068 c12040cc > > [ 215.081055] 7e00: c0cbf0a0 00000068 edf66800 ed2a7e4c c06864a2 > > c06ce704 0000e201 00000001 > > [ 215.089236] 7e20: c0fa22f0 00040908 f50417fa ed2a7e4c be9d1910 > > 000000a2 edb46000 00000068 > > [ 215.097415] 7e40: 00000062 c06d7020 c1208504 008a1210 00000000 > > 00000001 00000018 00000047 > > [ 215.105596] 7e60: 00000000 00000000 00000000 00000001 00007530 > > 03480320 03a00378 01e00000 > > [ 215.113775] 7e80: 01f001ed 0000020d 00000000 00000000 00000000 > > 00000000 00000000 00000000 > > [ 215.121955] 7ea0: 00000000 00000000 00000000 00000000 00000000 > > c0b0a268 00000000 00040908 > > [ 215.130137] 7ec0: ed2a7edc ed2a7fb0 00000008 00040908 00000000 > > c12040cc be9d1910 edd8cbc8 > > [ 215.138317] 7ee0: edcc9b40 be9d1910 0000000b 00000000 00000000 > > c0288638 004f10a0 c0101308 > > [ 215.146497] 7f00: 00000000 eff6fe48 eff6fe24 eff6fe00 000112da > > c02bb9bc 00000008 c01b4a08 > > [ 215.154677] 7f20: 00040908 c12040cc 00000000 ed29b1b8 00000003 > > be9d1910 be9d1808 ffffe000 > > [ 215.162857] 7f40: 00000051 ed2a6100 00000100 00000000 ed2a6000 > > c0102fa4 be9d1678 00040908 > > [ 215.171038] 7f60: c12040cc 00000000 edcc9b41 edcc9b40 c06864a2 > > be9d1910 0000000b 00000000 > > [ 215.179218] 7f80: 00000000 c0288f78 b6fc3c90 be9d1910 c06864a2 > > 00000036 c0107e24 ed2a6000 > > [ 215.187398] 7fa0: 00000000 c0107c60 b6fc3c90 be9d1910 0000000b > > c06864a2 be9d1910 00000001 > > [ 215.195579] 7fc0: b6fc3c90 be9d1910 c06864a2 00000036 008a1210 > > 00000047 00000018 00000000 > > [ 215.203759] 7fe0: b6ddf088 be9d18f4 b6dc7ad4 b6b11adc 40070010 > > 0000000b 3fffd861 3fffdc61 > > [ 215.211946] [<c0186568>] (__wake_up_common) from [<c018662c>] > > (__wake_up_locked+0x14/0x1c) > > [ 215.220216] [<c018662c>] (__wake_up_locked) from [<c018704c>] > > (complete_all+0x34/0x44) > > [ 215.228141] [<c018704c>] (complete_all) from [<c06ccac0>] > > (drm_send_event_locked+0x28/0x11c) > > [ 215.236588] [<c06ccac0>] (drm_send_event_locked) from [<c06d023c>] > > (drm_vblank_off+0x1b0/0x21c) > > [ 215.245296] [<c06d023c>] (drm_vblank_off) from [<c06c3e3c>] > > (drm_atomic_helper_commit_modeset_disables+0x1dc/0x3fc) > > [ 215.255750] [<c06c3e3c>] > > (drm_atomic_helper_commit_modeset_disables) from [<bf0182bc>] > > (imx_drm_atomic_commit_tail+0x18/0x58 [imxdrm]) > > [ 215.267843] [<bf0182bc>] (imx_drm_atomic_commit_tail [imxdrm]) from > > [<c06c40f4>] (commit_tail+0x40/0x5c) > > [ 215.277327] [<c06c40f4>] (commit_tail) from [<c06c41ac>] > > (drm_atomic_helper_commit+0x94/0xd8) > > [ 215.285858] [<c06c41ac>] (drm_atomic_helper_commit) from > > [<c06c46dc>] (drm_atomic_helper_set_config+0x78/0x9c) > > [ 215.295865] [<c06c46dc>] (drm_atomic_helper_set_config) from > > [<c06d5f8c>] (drm_mode_set_config_internal+0x58/0xdc) > > [ 215.306219] [<c06d5f8c>] (drm_mode_set_config_internal) from > > [<c06d74c4>] (drm_mode_setcrtc+0x4a4/0x550) > > [ 215.315703] [<c06d74c4>] (drm_mode_setcrtc) from [<c06ce704>] > > (drm_ioctl+0x214/0x44c) > > [ 215.323540] [<c06ce704>] (drm_ioctl) from [<c0288638>] > > (do_vfs_ioctl+0xac/0x980) > > [ 215.330940] [<c0288638>] (do_vfs_ioctl) from [<c0288f78>] > > (SyS_ioctl+0x6c/0x7c) > > [ 215.338258] [<c0288f78>] (SyS_ioctl) from [<c0107c60>] > > (ret_fast_syscall+0x0/0x3c) > > [ 215.345832] Code: e5b61004 e1a08003 e59d7028 e1560001 (e5913000) > > [ 215.351929] ---[ end trace e8a77aa320be7e56 ]--- > > drivers/gpu/drm/drm_atomic_helper.c | 15 +++++++++------ > include/drm/drm_atomic_helper.h | 2 +- > 2 files changed, 10 insertions(+), 7 deletions(-) > > diff --git a/drivers/gpu/drm/drm_atomic_helper.c b/drivers/gpu/drm/drm_atomic_helper.c > index 21f992605541..46668d071d6a 100644 > --- a/drivers/gpu/drm/drm_atomic_helper.c > +++ b/drivers/gpu/drm/drm_atomic_helper.c > @@ -1201,9 +1201,8 @@ static void commit_tail(struct drm_atomic_state *state) > else > drm_atomic_helper_commit_tail(state); > > - drm_atomic_helper_commit_cleanup_done(state); > - > - drm_atomic_state_free(state); > + if (drm_atomic_helper_commit_cleanup_done(state) == 0) > + drm_atomic_state_free(state); Chris (Cc'ed) added reference counting to atomic state for v4.10, maybe that already fixes the issue? Thierry > } > > static void commit_work(struct work_struct *work) > @@ -1591,12 +1590,12 @@ EXPORT_SYMBOL(drm_atomic_helper_commit_hw_done); > * This is part of the atomic helper support for nonblocking commits, see > * drm_atomic_helper_setup_commit() for an overview. > */ > -void drm_atomic_helper_commit_cleanup_done(struct drm_atomic_state *state) > +int drm_atomic_helper_commit_cleanup_done(struct drm_atomic_state *state) > { > struct drm_crtc *crtc; > struct drm_crtc_state *crtc_state; > struct drm_crtc_commit *commit; > - int i; > + int i, failed = 0; > long ret; > > for_each_crtc_in_state(state, crtc, crtc_state, i) { > @@ -1621,15 +1620,19 @@ void drm_atomic_helper_commit_cleanup_done(struct drm_atomic_state *state) > * not hold a reference of its own. */ > ret = wait_for_completion_timeout(&commit->flip_done, > 10*HZ); > - if (ret == 0) > - DRM_ERROR("[CRTC:%d:%s] flip_done timed out\n", > + if (ret == 0) { > + DRM_ERROR("[CRTC:%d:%s] flip_done timed out, memory leaked\n", > crtc->base.id, crtc->name); > + failed = -ETIMEDOUT; > + } > > spin_lock(&crtc->commit_lock); > del_commit: > list_del(&commit->commit_entry); > spin_unlock(&crtc->commit_lock); > } > + > + return failed; > } > EXPORT_SYMBOL(drm_atomic_helper_commit_cleanup_done); > > diff --git a/include/drm/drm_atomic_helper.h b/include/drm/drm_atomic_helper.h > index 7ff92b09fd9c..ee3d642c1feb 100644 > --- a/include/drm/drm_atomic_helper.h > +++ b/include/drm/drm_atomic_helper.h > @@ -88,7 +88,7 @@ int drm_atomic_helper_setup_commit(struct drm_atomic_state *state, > bool nonblock); > void drm_atomic_helper_wait_for_dependencies(struct drm_atomic_state *state); > void drm_atomic_helper_commit_hw_done(struct drm_atomic_state *state); > -void drm_atomic_helper_commit_cleanup_done(struct drm_atomic_state *state); > +int drm_atomic_helper_commit_cleanup_done(struct drm_atomic_state *state); > > /* implementations for legacy interfaces */ > int drm_atomic_helper_update_plane(struct drm_plane *plane, > > > -- > RMK's Patch system: http://www.armlinux.org.uk/developer/patches/ > FTTC broadband for 0.8mile line: currently at 9.6Mbps down 400kbps up > according to speedtest.net. > _______________________________________________ > dri-devel mailing list > dri-devel@lists.freedesktop.org > https://lists.freedesktop.org/mailman/listinfo/dri-devel [-- Attachment #1.2: signature.asc --] [-- Type: application/pgp-signature, Size: 833 bytes --] [-- Attachment #2: Type: text/plain, Size: 160 bytes --] _______________________________________________ dri-devel mailing list dri-devel@lists.freedesktop.org https://lists.freedesktop.org/mailman/listinfo/dri-devel ^ permalink raw reply [flat|nested] 9+ messages in thread
* Re: imxdrm issue on SABRE Lite 2017-02-13 8:05 ` Thierry Reding @ 2017-02-13 8:55 ` Chris Wilson 2017-02-13 9:38 ` Russell King - ARM Linux 2017-02-13 9:20 ` Russell King - ARM Linux 1 sibling, 1 reply; 9+ messages in thread From: Chris Wilson @ 2017-02-13 8:55 UTC (permalink / raw) To: Thierry Reding; +Cc: dri-devel, Russell King - ARM Linux, Dan MacDonald On Mon, Feb 13, 2017 at 09:05:33AM +0100, Thierry Reding wrote: > On Sun, Feb 12, 2017 at 12:15:46AM +0000, Russell King - ARM Linux wrote: > > On Sat, Feb 11, 2017 at 09:09:34PM +0000, Dan MacDonald wrote: > > diff --git a/drivers/gpu/drm/drm_atomic_helper.c b/drivers/gpu/drm/drm_atomic_helper.c > > index 21f992605541..46668d071d6a 100644 > > --- a/drivers/gpu/drm/drm_atomic_helper.c > > +++ b/drivers/gpu/drm/drm_atomic_helper.c > > @@ -1201,9 +1201,8 @@ static void commit_tail(struct drm_atomic_state *state) > > else > > drm_atomic_helper_commit_tail(state); > > > > - drm_atomic_helper_commit_cleanup_done(state); > > - > > - drm_atomic_state_free(state); > > + if (drm_atomic_helper_commit_cleanup_done(state) == 0) > > + drm_atomic_state_free(state); > > Chris (Cc'ed) added reference counting to atomic state for v4.10, maybe > that already fixes the issue? I'm not confident it will, as there is not an independent ref on the state for the phases, and so a forced timeout still leaves a dangling pointer. The above chunk goes the opposite way and leaks the state to avoid the invalid deref, what we need is a ref around its existence on the dependency queue if that is outside the lifetime of the commit. -Chris -- Chris Wilson, Intel Open Source Technology Centre _______________________________________________ dri-devel mailing list dri-devel@lists.freedesktop.org https://lists.freedesktop.org/mailman/listinfo/dri-devel ^ permalink raw reply [flat|nested] 9+ messages in thread
* Re: imxdrm issue on SABRE Lite 2017-02-13 8:55 ` Chris Wilson @ 2017-02-13 9:38 ` Russell King - ARM Linux 2017-02-18 8:14 ` Dan MacDonald 0 siblings, 1 reply; 9+ messages in thread From: Russell King - ARM Linux @ 2017-02-13 9:38 UTC (permalink / raw) To: Chris Wilson; +Cc: dri-devel, Dan MacDonald On Mon, Feb 13, 2017 at 08:55:53AM +0000, Chris Wilson wrote: > On Mon, Feb 13, 2017 at 09:05:33AM +0100, Thierry Reding wrote: > > On Sun, Feb 12, 2017 at 12:15:46AM +0000, Russell King - ARM Linux wrote: > > > On Sat, Feb 11, 2017 at 09:09:34PM +0000, Dan MacDonald wrote: > > > diff --git a/drivers/gpu/drm/drm_atomic_helper.c b/drivers/gpu/drm/drm_atomic_helper.c > > > index 21f992605541..46668d071d6a 100644 > > > --- a/drivers/gpu/drm/drm_atomic_helper.c > > > +++ b/drivers/gpu/drm/drm_atomic_helper.c > > > @@ -1201,9 +1201,8 @@ static void commit_tail(struct drm_atomic_state *state) > > > else > > > drm_atomic_helper_commit_tail(state); > > > > > > - drm_atomic_helper_commit_cleanup_done(state); > > > - > > > - drm_atomic_state_free(state); > > > + if (drm_atomic_helper_commit_cleanup_done(state) == 0) > > > + drm_atomic_state_free(state); > > > > Chris (Cc'ed) added reference counting to atomic state for v4.10, maybe > > that already fixes the issue? > > I'm not confident it will, as there is not an independent ref on the > state for the phases, and so a forced timeout still leaves a dangling > pointer. The above chunk goes the opposite way and leaks the state to > avoid the invalid deref, what we need is a ref around its existence on > the dependency queue if that is outside the lifetime of the commit. I said as much in my email - unfortunately, Thierry cut all that context. Right now, we oops the kernel, which causes: (a) the death of the calling process (b) leaking of all memory associated with the modeset What I'm proposing for the -stable kernels is to _improve_ the situation by eliminating part of the problem, so it's possible to get a better idea of which bit went wrong and which outputs have failed. Fixing it properly is likely to be very invasive, since you'll need to add reference counting to the drm_crtc_commit structure, a pointer to that in the drm_pending_event structure, and ensure that the reference count gets incremented at the appropriate time. Incrementing the reference count in drm_atomic_helper_setup_commit() certainly isn't the right place, that would be at the sites which queue the event, but they are scattered amongst all the atomic modeset drivers. For reference, here's my complete patch I posted yesterday: drivers/gpu/drm/drm_atomic_helper.c | 15 +++++++++------ include/drm/drm_atomic_helper.h | 2 +- 2 files changed, 10 insertions(+), 7 deletions(-) diff --git a/drivers/gpu/drm/drm_atomic_helper.c b/drivers/gpu/drm/drm_atomic_helper.c index 21f992605541..46668d071d6a 100644 --- a/drivers/gpu/drm/drm_atomic_helper.c +++ b/drivers/gpu/drm/drm_atomic_helper.c @@ -1201,9 +1201,8 @@ static void commit_tail(struct drm_atomic_state *state) else drm_atomic_helper_commit_tail(state); - drm_atomic_helper_commit_cleanup_done(state); - - drm_atomic_state_free(state); + if (drm_atomic_helper_commit_cleanup_done(state) == 0) + drm_atomic_state_free(state); } static void commit_work(struct work_struct *work) @@ -1591,12 +1590,12 @@ EXPORT_SYMBOL(drm_atomic_helper_commit_hw_done); * This is part of the atomic helper support for nonblocking commits, see * drm_atomic_helper_setup_commit() for an overview. */ -void drm_atomic_helper_commit_cleanup_done(struct drm_atomic_state *state) +int drm_atomic_helper_commit_cleanup_done(struct drm_atomic_state *state) { struct drm_crtc *crtc; struct drm_crtc_state *crtc_state; struct drm_crtc_commit *commit; - int i; + int i, failed = 0; long ret; for_each_crtc_in_state(state, crtc, crtc_state, i) { @@ -1621,15 +1620,19 @@ void drm_atomic_helper_commit_cleanup_done(struct drm_atomic_state *state) * not hold a reference of its own. */ ret = wait_for_completion_timeout(&commit->flip_done, 10*HZ); - if (ret == 0) - DRM_ERROR("[CRTC:%d:%s] flip_done timed out\n", + if (ret == 0) { + DRM_ERROR("[CRTC:%d:%s] flip_done timed out, memory leaked\n", crtc->base.id, crtc->name); + failed = -ETIMEDOUT; + } spin_lock(&crtc->commit_lock); del_commit: list_del(&commit->commit_entry); spin_unlock(&crtc->commit_lock); } + + return failed; } EXPORT_SYMBOL(drm_atomic_helper_commit_cleanup_done); diff --git a/include/drm/drm_atomic_helper.h b/include/drm/drm_atomic_helper.h index 7ff92b09fd9c..ee3d642c1feb 100644 --- a/include/drm/drm_atomic_helper.h +++ b/include/drm/drm_atomic_helper.h @@ -88,7 +88,7 @@ int drm_atomic_helper_setup_commit(struct drm_atomic_state *state, bool nonblock); void drm_atomic_helper_wait_for_dependencies(struct drm_atomic_state *state); void drm_atomic_helper_commit_hw_done(struct drm_atomic_state *state); -void drm_atomic_helper_commit_cleanup_done(struct drm_atomic_state *state); +int drm_atomic_helper_commit_cleanup_done(struct drm_atomic_state *state); /* implementations for legacy interfaces */ int drm_atomic_helper_update_plane(struct drm_plane *plane, -- RMK's Patch system: http://www.armlinux.org.uk/developer/patches/ FTTC broadband for 0.8mile line: currently at 9.6Mbps down 400kbps up according to speedtest.net. _______________________________________________ dri-devel mailing list dri-devel@lists.freedesktop.org https://lists.freedesktop.org/mailman/listinfo/dri-devel ^ permalink raw reply related [flat|nested] 9+ messages in thread
* Re: imxdrm issue on SABRE Lite 2017-02-13 9:38 ` Russell King - ARM Linux @ 2017-02-18 8:14 ` Dan MacDonald 0 siblings, 0 replies; 9+ messages in thread From: Dan MacDonald @ 2017-02-18 8:14 UTC (permalink / raw) To: Russell King - ARM Linux; +Cc: dri-devel Hi all Has there been any progress toward getting imxdrm working with the SABRE Lite and similar? I'm presuming that non of you own such a board and that this won't be fixed in time for 4.10, right? Thanks On Mon, Feb 13, 2017 at 9:38 AM, Russell King - ARM Linux <linux@armlinux.org.uk> wrote: > On Mon, Feb 13, 2017 at 08:55:53AM +0000, Chris Wilson wrote: >> On Mon, Feb 13, 2017 at 09:05:33AM +0100, Thierry Reding wrote: >> > On Sun, Feb 12, 2017 at 12:15:46AM +0000, Russell King - ARM Linux wrote: >> > > On Sat, Feb 11, 2017 at 09:09:34PM +0000, Dan MacDonald wrote: >> > > diff --git a/drivers/gpu/drm/drm_atomic_helper.c b/drivers/gpu/drm/drm_atomic_helper.c >> > > index 21f992605541..46668d071d6a 100644 >> > > --- a/drivers/gpu/drm/drm_atomic_helper.c >> > > +++ b/drivers/gpu/drm/drm_atomic_helper.c >> > > @@ -1201,9 +1201,8 @@ static void commit_tail(struct drm_atomic_state *state) >> > > else >> > > drm_atomic_helper_commit_tail(state); >> > > >> > > - drm_atomic_helper_commit_cleanup_done(state); >> > > - >> > > - drm_atomic_state_free(state); >> > > + if (drm_atomic_helper_commit_cleanup_done(state) == 0) >> > > + drm_atomic_state_free(state); >> > >> > Chris (Cc'ed) added reference counting to atomic state for v4.10, maybe >> > that already fixes the issue? >> >> I'm not confident it will, as there is not an independent ref on the >> state for the phases, and so a forced timeout still leaves a dangling >> pointer. The above chunk goes the opposite way and leaks the state to >> avoid the invalid deref, what we need is a ref around its existence on >> the dependency queue if that is outside the lifetime of the commit. > > I said as much in my email - unfortunately, Thierry cut all that context. > > Right now, we oops the kernel, which causes: > > (a) the death of the calling process > (b) leaking of all memory associated with the modeset > > What I'm proposing for the -stable kernels is to _improve_ the situation > by eliminating part of the problem, so it's possible to get a better > idea of which bit went wrong and which outputs have failed. > > Fixing it properly is likely to be very invasive, since you'll need to > add reference counting to the drm_crtc_commit structure, a pointer > to that in the drm_pending_event structure, and ensure that the > reference count gets incremented at the appropriate time. Incrementing > the reference count in drm_atomic_helper_setup_commit() certainly isn't > the right place, that would be at the sites which queue the event, but > they are scattered amongst all the atomic modeset drivers. > > For reference, here's my complete patch I posted yesterday: > > drivers/gpu/drm/drm_atomic_helper.c | 15 +++++++++------ > include/drm/drm_atomic_helper.h | 2 +- > 2 files changed, 10 insertions(+), 7 deletions(-) > > diff --git a/drivers/gpu/drm/drm_atomic_helper.c b/drivers/gpu/drm/drm_atomic_helper.c > index 21f992605541..46668d071d6a 100644 > --- a/drivers/gpu/drm/drm_atomic_helper.c > +++ b/drivers/gpu/drm/drm_atomic_helper.c > @@ -1201,9 +1201,8 @@ static void commit_tail(struct drm_atomic_state *state) > else > drm_atomic_helper_commit_tail(state); > > - drm_atomic_helper_commit_cleanup_done(state); > - > - drm_atomic_state_free(state); > + if (drm_atomic_helper_commit_cleanup_done(state) == 0) > + drm_atomic_state_free(state); > } > > static void commit_work(struct work_struct *work) > @@ -1591,12 +1590,12 @@ EXPORT_SYMBOL(drm_atomic_helper_commit_hw_done); > * This is part of the atomic helper support for nonblocking commits, see > * drm_atomic_helper_setup_commit() for an overview. > */ > -void drm_atomic_helper_commit_cleanup_done(struct drm_atomic_state *state) > +int drm_atomic_helper_commit_cleanup_done(struct drm_atomic_state *state) > { > struct drm_crtc *crtc; > struct drm_crtc_state *crtc_state; > struct drm_crtc_commit *commit; > - int i; > + int i, failed = 0; > long ret; > > for_each_crtc_in_state(state, crtc, crtc_state, i) { > @@ -1621,15 +1620,19 @@ void drm_atomic_helper_commit_cleanup_done(struct drm_atomic_state *state) > * not hold a reference of its own. */ > ret = wait_for_completion_timeout(&commit->flip_done, > 10*HZ); > - if (ret == 0) > - DRM_ERROR("[CRTC:%d:%s] flip_done timed out\n", > + if (ret == 0) { > + DRM_ERROR("[CRTC:%d:%s] flip_done timed out, memory leaked\n", > crtc->base.id, crtc->name); > + failed = -ETIMEDOUT; > + } > > spin_lock(&crtc->commit_lock); > del_commit: > list_del(&commit->commit_entry); > spin_unlock(&crtc->commit_lock); > } > + > + return failed; > } > EXPORT_SYMBOL(drm_atomic_helper_commit_cleanup_done); > > diff --git a/include/drm/drm_atomic_helper.h b/include/drm/drm_atomic_helper.h > index 7ff92b09fd9c..ee3d642c1feb 100644 > --- a/include/drm/drm_atomic_helper.h > +++ b/include/drm/drm_atomic_helper.h > @@ -88,7 +88,7 @@ int drm_atomic_helper_setup_commit(struct drm_atomic_state *state, > bool nonblock); > void drm_atomic_helper_wait_for_dependencies(struct drm_atomic_state *state); > void drm_atomic_helper_commit_hw_done(struct drm_atomic_state *state); > -void drm_atomic_helper_commit_cleanup_done(struct drm_atomic_state *state); > +int drm_atomic_helper_commit_cleanup_done(struct drm_atomic_state *state); > > /* implementations for legacy interfaces */ > int drm_atomic_helper_update_plane(struct drm_plane *plane, > > > -- > RMK's Patch system: http://www.armlinux.org.uk/developer/patches/ > FTTC broadband for 0.8mile line: currently at 9.6Mbps down 400kbps up > according to speedtest.net. _______________________________________________ dri-devel mailing list dri-devel@lists.freedesktop.org https://lists.freedesktop.org/mailman/listinfo/dri-devel ^ permalink raw reply [flat|nested] 9+ messages in thread
* Re: imxdrm issue on SABRE Lite 2017-02-13 8:05 ` Thierry Reding 2017-02-13 8:55 ` Chris Wilson @ 2017-02-13 9:20 ` Russell King - ARM Linux 1 sibling, 0 replies; 9+ messages in thread From: Russell King - ARM Linux @ 2017-02-13 9:20 UTC (permalink / raw) To: Thierry Reding; +Cc: dri-devel, Dan MacDonald On Mon, Feb 13, 2017 at 09:05:33AM +0100, Thierry Reding wrote: > On Sun, Feb 12, 2017 at 12:15:46AM +0000, Russell King - ARM Linux wrote: > > diff --git a/drivers/gpu/drm/drm_atomic_helper.c b/drivers/gpu/drm/drm_atomic_helper.c > > index 21f992605541..46668d071d6a 100644 > > --- a/drivers/gpu/drm/drm_atomic_helper.c > > +++ b/drivers/gpu/drm/drm_atomic_helper.c > > @@ -1201,9 +1201,8 @@ static void commit_tail(struct drm_atomic_state *state) > > else > > drm_atomic_helper_commit_tail(state); > > > > - drm_atomic_helper_commit_cleanup_done(state); > > - > > - drm_atomic_state_free(state); > > + if (drm_atomic_helper_commit_cleanup_done(state) == 0) > > + drm_atomic_state_free(state); > > Chris (Cc'ed) added reference counting to atomic state for v4.10, maybe > that already fixes the issue? No. It's not the atomic state that's referenced, it's only a completion within the drm_crtc_commit structure, which is completely separate from the atomic state. Moreover, the event code has no knowledge of commits, so it can't "put" a reference count on it. See: void drm_send_event_locked(struct drm_device *dev, struct drm_pending_event *e) { assert_spin_locked(&dev->event_lock); if (e->completion) { /* ->completion might disappear as soon as it signalled. */ complete_all(e->completion); e->completion = NULL; } vs the setup of the event done in drm_atomic_helper_setup_commit(): if (!crtc_state->event) { commit->event = kzalloc(sizeof(*commit->event), GFP_KERNEL); if (!commit->event) return -ENOMEM; crtc_state->event = commit->event; } crtc_state->event->base.completion = &commit->flip_done; "commit" gets freed before drm_send_event_locked() is called (hence the timeout message) and when drm_send_event_locked() is eventually called via drm_vblank_off(), this causes a use-after-free bug. -- RMK's Patch system: http://www.armlinux.org.uk/developer/patches/ FTTC broadband for 0.8mile line: currently at 9.6Mbps down 400kbps up according to speedtest.net. _______________________________________________ dri-devel mailing list dri-devel@lists.freedesktop.org https://lists.freedesktop.org/mailman/listinfo/dri-devel ^ permalink raw reply [flat|nested] 9+ messages in thread
* Re: imxdrm issue on SABRE Lite 2017-02-11 21:09 imxdrm issue on SABRE Lite Dan MacDonald 2017-02-12 0:15 ` Russell King - ARM Linux @ 2017-02-20 15:42 ` Philipp Zabel 2017-02-20 16:25 ` Dan MacDonald 1 sibling, 1 reply; 9+ messages in thread From: Philipp Zabel @ 2017-02-20 15:42 UTC (permalink / raw) To: Dan MacDonald; +Cc: linux, dri-devel Hi Dan, On Sat, 2017-02-11 at 21:09 +0000, Dan MacDonald wrote: > Hi Phillipp > > I'm having trouble getting xf86-video-armada working properly on a > Element 14 / Embest SABRE Lite board running Arch Linux with kernel > 4.9.8. I have been in touch with RMK and he's confident the crash > below is caused by a kernel issue relating to imxdrm and a null > pointer dereference. I can't reproduce this on v4.9.8 with a Nitrogen6X with 1280x800 LDVS panel and 1920x1080 HDMI monitor using modetest from libdrm. Does this only happen with X? Do you have framebuffer console emulation enabled? Does this still happen if you disable the LVDS panel in the device tree? > The first indiction of X/armada not being happy it that it only starts > in 720x480 when connected to a 4K HDMI display, and when I try > running: > > xrandr --output HDMI1 --mode 1920x1080 > > X crashes. > > Here's the serial console output for X loading and then crashing after > I try running that xrandr command: > > Arch Linux 4.9.8-1-ARCH (ttymxc1) > > alarm login: [ 19.197477] fec 2188000.ethernet eth0: Link is Up - > 1Gbps/Full - flow control rx/tx > [ 19.205165] IPv6: ADDRCONF(NETDEV_CHANGE): eth0: link becomes ready > [ 33.080000] vgaarb: this pci device is not a vga device > [ 33.203520] vgaarb: this pci device is not a vga device > [ 33.447051] imx-ipuv3 2400000.ipu: DC stop timeout after 50 ms Does the "gpu: ipu-v3: remove IRQ dance on DC channel disable" patch (https://patchwork.kernel.org/patch/9417683) do anything to improve the situation, besides removing the above warning? > [ 33.707042] ------------[ cut here ]------------ > [ 33.711682] WARNING: CPU: 1 PID: 316 at > drivers/gpu/drm/drm_atomic_helper.c:1140 > drm_atomic_helper_wait_for_vblanks+0x274/0x278 > [ 33.723187] [CRTC:24] vblank wait timed out > [ 33.727395] Modules linked in: snd_soc_sgtl5000 snd_soc_fsl_ssi > snd_soc_imx_sgtl5000 imx_pcm_fiq imx_pcm_dma snd_soc_fsl_asrc > snd_soc_fsl_asoc_card snd_soc_core dw_hdmi_ahb_audio snd_pcm_dmaengine > caam_jr imx_ipuv3_crtc snd_ac97_codec coda v4l2_mem2mem > videobuf2_dma_contig ac97_bus imx_ipu_v3 snd_soc_imx_audmux snd_pcm > videobuf2_vmalloc videobuf2_memops videobuf2_v4l2 videobuf2_core > dw_hdmi_imx caam imx2_wdt ofpart spi_imx evdev dw_hdmi etnaviv imx_ldb > pwm_imx snd_timer parallel_display uio_pdrv_genirq uio imxdrm > sch_fq_codel ip_tables x_tables > [ 33.776237] CPU: 1 PID: 316 Comm: Xorg Not tainted 4.9.8-1-ARCH #1 > [ 33.782419] Hardware name: Freescale i.MX6 Quad/DualLite (Device Tree) > [ 33.788965] [<c0110ba4>] (unwind_backtrace) from [<c010bf10>] > (show_stack+0x10/0x14) > [ 33.796719] [<c010bf10>] (show_stack) from [<c053f2c0>] > (dump_stack+0x88/0x9c) > [ 33.803951] [<c053f2c0>] (dump_stack) from [<c01442a0>] (__warn+0xe8/0x100) > [ 33.810919] [<c01442a0>] (__warn) from [<c0144300>] > (warn_slowpath_fmt+0x48/0x6c) > [ 33.818410] [<c0144300>] (warn_slowpath_fmt) from [<c06c1850>] > (drm_atomic_helper_wait_for_vblanks+0x274/0x278) > [ 33.828516] [<c06c1850>] (drm_atomic_helper_wait_for_vblanks) from > [<bf0182ec>] (imx_drm_atomic_commit_tail+0x48/0x58 [imxdrm]) > [ 33.840004] [<bf0182ec>] (imx_drm_atomic_commit_tail [imxdrm]) from > [<c06c40f4>] (commit_tail+0x40/0x5c) > [ 33.849489] [<c06c40f4>] (commit_tail) from [<c06c41ac>] > (drm_atomic_helper_commit+0x94/0xd8) > [ 33.858019] [<c06c41ac>] (drm_atomic_helper_commit) from > [<c06c46dc>] (drm_atomic_helper_set_config+0x78/0x9c) > [ 33.868028] [<c06c46dc>] (drm_atomic_helper_set_config) from > [<c06d5f8c>] (drm_mode_set_config_internal+0x58/0xdc) > [ 33.878382] [<c06d5f8c>] (drm_mode_set_config_internal) from > [<c06d74c4>] (drm_mode_setcrtc+0x4a4/0x550) > [ 33.887867] [<c06d74c4>] (drm_mode_setcrtc) from [<c06ce704>] > (drm_ioctl+0x214/0x44c) > [ 33.895704] [<c06ce704>] (drm_ioctl) from [<c0288638>] > (do_vfs_ioctl+0xac/0x980) > [ 33.903104] [<c0288638>] (do_vfs_ioctl) from [<c0288f78>] > (SyS_ioctl+0x6c/0x7c) > [ 33.910422] [<c0288f78>] (SyS_ioctl) from [<c0107c60>] > (ret_fast_syscall+0x0/0x3c) > [ 33.918023] ---[ end trace e8a77aa320be7e55 ]--- > [ 43.997066] [drm:drm_atomic_helper_commit_cleanup_done] *ERROR* > [CRTC:24:crtc-0] flip_done timed out > [ 55.517063] [drm:drm_atomic_helper_commit_cleanup_done] *ERROR* > [CRTC:24:crtc-0] flip_done timed out > [ 56.958264] alloc_contig_range: [4d0b7, 4d0b8) PFNs busy > [ 90.896615] usb 1-1.2.3: new low-speed USB device number 6 using ci_hdrc > [ 91.050796] usb 1-1.2.3: New USB device found, idVendor=0458, idProduct=003a > [ 91.057888] usb 1-1.2.3: New USB device strings: Mfr=1, Product=2, > SerialNumber=0 > [ 91.065382] usb 1-1.2.3: Product: Optical Mouse > [ 91.069944] usb 1-1.2.3: Manufacturer: Genius > [ 91.082071] input: Genius Optical Mouse as > /devices/soc0/soc/2100000.aips-bus/2184200.usb/ci_hdrc.1/usb1/1-1/1-1.2/1-1.2.3/1-1.2.3:1.0/0003:0458:003A.0003/input/input3 > [ 91.098116] hid-generic 0003:0458:003A.0003: input,hidraw2: USB HID > v1.11 Mouse [Genius Optical Mouse] on usb-ci_hdrc.1-1.2.3/input0 > [ 91.162048] mousedev: PS/2 mouse device common for all mice > [ 214.765689] imx-ipuv3 2400000.ipu: DC stop timeout after 50 ms > [ 214.825688] Unable to handle kernel NULL pointer dereference at > virtual address 00000000 > [ 214.833783] pgd = ed1b8000 > [ 214.836491] [00000000] *pgd=4c974831 > [ 214.840084] Internal error: Oops: 17 [#1] SMP ARM > [ 214.844789] Modules linked in: mousedev snd_soc_sgtl5000 > snd_soc_fsl_ssi snd_soc_imx_sgtl5000 imx_pcm_fiq imx_pcm_dma > snd_soc_fsl_asrc snd_soc_fsl_asoc_card snd_soc_core dw_hdmi_ahb_audio > snd_pcm_dmaengine caam_jr imx_ipuv3_crtc snd_ac97_codec coda > v4l2_mem2mem videobuf2_dma_contig ac97_bus imx_ipu_v3 > snd_soc_imx_audmux snd_pcm videobuf2_vmalloc videobuf2_memops > videobuf2_v4l2 videobuf2_core dw_hdmi_imx caam imx2_wdt ofpart spi_imx > evdev dw_hdmi etnaviv imx_ldb pwm_imx snd_timer parallel_display > uio_pdrv_genirq uio imxdrm sch_fq_codel ip_tables x_tables > [ 214.894338] CPU: 2 PID: 316 Comm: Xorg Tainted: G W > 4.9.8-1-ARCH #1 > [ 214.901735] Hardware name: Freescale i.MX6 Quad/DualLite (Device Tree) > [ 214.908264] task: ed2c4d00 task.stack: ed2a6000 > [ 214.912803] PC is at __wake_up_common+0x1c/0x80 > [ 214.917337] LR is at __wake_up_locked+0x14/0x1c > [ 214.921871] pc : [<c0186568>] lr : [<c018662c>] psr: a0070093 > [ 214.921871] sp : ed2a7c68 ip : 00000000 fp : c0fa2a70 > [ 214.933348] r10: c0f37384 r9 : 00000003 r8 : 00000000 > [ 214.938574] r7 : 00000000 r6 : edbf3410 r5 : edbf3408 r4 : edbf340c > [ 214.945101] r3 : 00000000 r2 : 00000000 r1 : 00000000 r0 : edbf340c > [ 214.951630] Flags: NzCv IRQs off FIQs on Mode SVC_32 ISA ARM > Segment none > [ 214.958854] Control: 10c5387d Table: 3d1b804a DAC: 00000051 > [ 214.964600] Process Xorg (pid: 316, stack limit = 0xed2a6220) > [ 214.970347] Stack: (0xed2a7c68 to 0xed2a8000) > [ 214.974708] 7c60: 00000000 edbf340c edbf3408 > a0070093 edb46114 edb46000 > [ 214.982889] 7c80: 0000039f c0f37384 c0fa2a70 c018662c 00000000 > c0fa1144 bf21c4fc c018704c > [ 214.991069] 7ca0: edbf3380 edbf3380 00000000 c06ccac0 edfa1400 > edbf3380 00000000 c06d023c > [ 214.999250] 7cc0: 0000039f 00000000 edab2a00 80070013 edb4611c > c12040cc 00000000 00000000 > [ 215.007430] 7ce0: 00000000 00040908 edb3f410 ed412c40 00000000 > 00000000 ed26a800 edb47c18 > [ 215.015610] 7d00: c0f37384 c0fa1144 bf21c4fc c06c3e3c edc67780 > c06c1c24 edb46000 edb46000 > [ 215.023791] 7d20: bf01862c ed412c40 edb46000 00000000 edb46000 > ed410100 ed412240 ed412240 > [ 215.031971] 7d40: c0c0c0c0 bf0182bc ed412c40 bf018ca4 00000000 > c06c40f4 ed412c40 00000000 > [ 215.040152] 7d60: 00000000 c06c41ac ed412c40 00000000 ed2a7dd0 > edb47c18 ed410100 c06c46dc > [ 215.048332] 7d80: eda36180 edb47c18 00000001 c12040cc ed410100 > c06d5f8c ed2a7e4c edb46000 > [ 215.056513] 7da0: 00000001 c12040cc ed410100 c06d74c4 edaa5980 > edb46248 edb47c18 eda3618c > [ 215.064694] 7dc0: eda36180 ed412240 ed410100 c12040cc eda36180 > edb47c18 ed410100 00000000 > [ 215.072874] 7de0: 00000000 ed412240 00000001 00040908 ed2a7e70 > 00000051 00000068 c12040cc > [ 215.081055] 7e00: c0cbf0a0 00000068 edf66800 ed2a7e4c c06864a2 > c06ce704 0000e201 00000001 > [ 215.089236] 7e20: c0fa22f0 00040908 f50417fa ed2a7e4c be9d1910 > 000000a2 edb46000 00000068 > [ 215.097415] 7e40: 00000062 c06d7020 c1208504 008a1210 00000000 > 00000001 00000018 00000047 > [ 215.105596] 7e60: 00000000 00000000 00000000 00000001 00007530 > 03480320 03a00378 01e00000 > [ 215.113775] 7e80: 01f001ed 0000020d 00000000 00000000 00000000 > 00000000 00000000 00000000 > [ 215.121955] 7ea0: 00000000 00000000 00000000 00000000 00000000 > c0b0a268 00000000 00040908 > [ 215.130137] 7ec0: ed2a7edc ed2a7fb0 00000008 00040908 00000000 > c12040cc be9d1910 edd8cbc8 > [ 215.138317] 7ee0: edcc9b40 be9d1910 0000000b 00000000 00000000 > c0288638 004f10a0 c0101308 > [ 215.146497] 7f00: 00000000 eff6fe48 eff6fe24 eff6fe00 000112da > c02bb9bc 00000008 c01b4a08 > [ 215.154677] 7f20: 00040908 c12040cc 00000000 ed29b1b8 00000003 > be9d1910 be9d1808 ffffe000 > [ 215.162857] 7f40: 00000051 ed2a6100 00000100 00000000 ed2a6000 > c0102fa4 be9d1678 00040908 > [ 215.171038] 7f60: c12040cc 00000000 edcc9b41 edcc9b40 c06864a2 > be9d1910 0000000b 00000000 > [ 215.179218] 7f80: 00000000 c0288f78 b6fc3c90 be9d1910 c06864a2 > 00000036 c0107e24 ed2a6000 > [ 215.187398] 7fa0: 00000000 c0107c60 b6fc3c90 be9d1910 0000000b > c06864a2 be9d1910 00000001 > [ 215.195579] 7fc0: b6fc3c90 be9d1910 c06864a2 00000036 008a1210 > 00000047 00000018 00000000 > [ 215.203759] 7fe0: b6ddf088 be9d18f4 b6dc7ad4 b6b11adc 40070010 > 0000000b 3fffd861 3fffdc61 > [ 215.211946] [<c0186568>] (__wake_up_common) from [<c018662c>] > (__wake_up_locked+0x14/0x1c) > [ 215.220216] [<c018662c>] (__wake_up_locked) from [<c018704c>] > (complete_all+0x34/0x44) > [ 215.228141] [<c018704c>] (complete_all) from [<c06ccac0>] > (drm_send_event_locked+0x28/0x11c) > [ 215.236588] [<c06ccac0>] (drm_send_event_locked) from [<c06d023c>] > (drm_vblank_off+0x1b0/0x21c) > [ 215.245296] [<c06d023c>] (drm_vblank_off) from [<c06c3e3c>] > (drm_atomic_helper_commit_modeset_disables+0x1dc/0x3fc) > [ 215.255750] [<c06c3e3c>] > (drm_atomic_helper_commit_modeset_disables) from [<bf0182bc>] > (imx_drm_atomic_commit_tail+0x18/0x58 [imxdrm]) > [ 215.267843] [<bf0182bc>] (imx_drm_atomic_commit_tail [imxdrm]) from > [<c06c40f4>] (commit_tail+0x40/0x5c) > [ 215.277327] [<c06c40f4>] (commit_tail) from [<c06c41ac>] > (drm_atomic_helper_commit+0x94/0xd8) > [ 215.285858] [<c06c41ac>] (drm_atomic_helper_commit) from > [<c06c46dc>] (drm_atomic_helper_set_config+0x78/0x9c) > [ 215.295865] [<c06c46dc>] (drm_atomic_helper_set_config) from > [<c06d5f8c>] (drm_mode_set_config_internal+0x58/0xdc) > [ 215.306219] [<c06d5f8c>] (drm_mode_set_config_internal) from > [<c06d74c4>] (drm_mode_setcrtc+0x4a4/0x550) > [ 215.315703] [<c06d74c4>] (drm_mode_setcrtc) from [<c06ce704>] > (drm_ioctl+0x214/0x44c) > [ 215.323540] [<c06ce704>] (drm_ioctl) from [<c0288638>] > (do_vfs_ioctl+0xac/0x980) > [ 215.330940] [<c0288638>] (do_vfs_ioctl) from [<c0288f78>] > (SyS_ioctl+0x6c/0x7c) > [ 215.338258] [<c0288f78>] (SyS_ioctl) from [<c0107c60>] > (ret_fast_syscall+0x0/0x3c) > [ 215.345832] Code: e5b61004 e1a08003 e59d7028 e1560001 (e5913000) > [ 215.351929] ---[ end trace e8a77aa320be7e56 ]--- > > > Thanks regards Philipp _______________________________________________ dri-devel mailing list dri-devel@lists.freedesktop.org https://lists.freedesktop.org/mailman/listinfo/dri-devel ^ permalink raw reply [flat|nested] 9+ messages in thread
* Re: imxdrm issue on SABRE Lite 2017-02-20 15:42 ` Philipp Zabel @ 2017-02-20 16:25 ` Dan MacDonald 0 siblings, 0 replies; 9+ messages in thread From: Dan MacDonald @ 2017-02-20 16:25 UTC (permalink / raw) To: Philipp Zabel; +Cc: Russell King - ARM Linux, dri-devel Hi Phillipp On Mon, Feb 20, 2017 at 3:42 PM, Philipp Zabel <p.zabel@pengutronix.de> wrote: > Hi Dan, > > On Sat, 2017-02-11 at 21:09 +0000, Dan MacDonald wrote: >> Hi Phillipp >> >> I'm having trouble getting xf86-video-armada working properly on a >> Element 14 / Embest SABRE Lite board running Arch Linux with kernel >> 4.9.8. I have been in touch with RMK and he's confident the crash >> below is caused by a kernel issue relating to imxdrm and a null >> pointer dereference. > > I can't reproduce this on v4.9.8 with a Nitrogen6X with 1280x800 LDVS > panel and 1920x1080 HDMI monitor using modetest from libdrm. Does this > only happen with X? I have read that there are supposedly differences between the Element 14 SL and the Boundary Devices board of the same name but I have yet to find out exactly what they are as the specs are the same on paper. Saying that, all of the uboot and OS images for the BD SL that I've tried have worked without issue, including the GLES demos on the BD Ubuntu 16.04 image. I've never used wayland. The console works fine with my 4K display and I have been able to get X running at 720x480 under Arch with armada but no other resolution. > Do you have framebuffer console emulation enabled? Not sure - will need to check if thats enable by default under ALARM? I've not manually enabled it. > Does this still happen if you disable the LVDS panel in the device tree? Russell sent me a different dtb file which seemed to fix some of my kernel probs. Russell will be able to explain that better than me. > >> The first indiction of X/armada not being happy it that it only starts >> in 720x480 when connected to a 4K HDMI display, and when I try >> running: >> >> xrandr --output HDMI1 --mode 1920x1080 >> >> X crashes. >> >> Here's the serial console output for X loading and then crashing after >> I try running that xrandr command: >> >> Arch Linux 4.9.8-1-ARCH (ttymxc1) >> >> alarm login: [ 19.197477] fec 2188000.ethernet eth0: Link is Up - >> 1Gbps/Full - flow control rx/tx >> [ 19.205165] IPv6: ADDRCONF(NETDEV_CHANGE): eth0: link becomes ready >> [ 33.080000] vgaarb: this pci device is not a vga device >> [ 33.203520] vgaarb: this pci device is not a vga device >> [ 33.447051] imx-ipuv3 2400000.ipu: DC stop timeout after 50 ms > > Does the "gpu: ipu-v3: remove IRQ dance on DC channel disable" patch > (https://patchwork.kernel.org/patch/9417683) do anything to improve the > situation, besides removing the above warning? After trying Russells dtb, he asked me to try booting with: setenv bootargs cma=256M Then X failed to start with the error: [ 57.705889] imx-drm display-subsystem: failed to allocate buffer with size 33177600 Do you think that patch could fix such an issue? Thanks _______________________________________________ dri-devel mailing list dri-devel@lists.freedesktop.org https://lists.freedesktop.org/mailman/listinfo/dri-devel ^ permalink raw reply [flat|nested] 9+ messages in thread
end of thread, other threads:[~2017-02-20 16:25 UTC | newest] Thread overview: 9+ messages (download: mbox.gz follow: Atom feed -- links below jump to the message on this page -- 2017-02-11 21:09 imxdrm issue on SABRE Lite Dan MacDonald 2017-02-12 0:15 ` Russell King - ARM Linux 2017-02-13 8:05 ` Thierry Reding 2017-02-13 8:55 ` Chris Wilson 2017-02-13 9:38 ` Russell King - ARM Linux 2017-02-18 8:14 ` Dan MacDonald 2017-02-13 9:20 ` Russell King - ARM Linux 2017-02-20 15:42 ` Philipp Zabel 2017-02-20 16:25 ` Dan MacDonald
This is an external index of several public inboxes, see mirroring instructions on how to clone and mirror all data and code used by this external index.