From: Mika Kuoppala <mika.kuoppala@linux.intel.com>
To: Chris Wilson <chris@chris-wilson.co.uk>, intel-gfx@lists.freedesktop.org
Subject: Re: [PATCH] drm/i915/execlists: Backtrack along timeline
Date: Fri, 09 Aug 2019 11:48:30 +0300 [thread overview]
Message-ID: <87ftma9129.fsf@gaia.fi.intel.com> (raw)
In-Reply-To: <20190809073723.6593-1-chris@chris-wilson.co.uk>
Chris Wilson <chris@chris-wilson.co.uk> writes:
> After a preempt-to-busy, we may find an active request that is caught
> between execution states. Walk back along the timeline instead of the
> execution list to be safe.
>
> [ 106.417541] i915 0000:00:02.0: Resetting rcs0 for preemption time out
> [ 106.417659] ==================================================================
> [ 106.418041] BUG: KASAN: slab-out-of-bounds in __execlists_reset+0x2f2/0x440 [i915]
> [ 106.418123] Read of size 8 at addr ffff888703506b30 by task swapper/1/0
> [ 106.418194]
> [ 106.418267] CPU: 1 PID: 0 Comm: swapper/1 Tainted: G U 5.3.0-rc3+ #5
> [ 106.418344] Hardware name: Intel Corporation NUC7i5BNK/NUC7i5BNB, BIOS BNKBL357.86A.0052.2017.0918.1346 09/18/2017
> [ 106.418434] Call Trace:
> [ 106.418508] <IRQ>
> [ 106.418585] dump_stack+0x5b/0x90
> [ 106.418941] ? __execlists_reset+0x2f2/0x440 [i915]
> [ 106.419022] print_address_description+0x67/0x32d
> [ 106.419376] ? __execlists_reset+0x2f2/0x440 [i915]
> [ 106.419731] ? __execlists_reset+0x2f2/0x440 [i915]
> [ 106.419810] __kasan_report.cold.6+0x1a/0x3c
> [ 106.419888] ? __trace_bprintk+0xc0/0xd0
> [ 106.420239] ? __execlists_reset+0x2f2/0x440 [i915]
> [ 106.420318] check_memory_region+0x144/0x1c0
> [ 106.420671] __execlists_reset+0x2f2/0x440 [i915]
> [ 106.421029] execlists_reset+0x3d/0x50 [i915]
> [ 106.421387] intel_engine_reset+0x203/0x3a0 [i915]
> [ 106.421744] ? igt_reset_nop+0x2b0/0x2b0 [i915]
> [ 106.421825] ? _raw_spin_trylock_bh+0xe0/0xe0
> [ 106.421901] ? rcu_core+0x1b9/0x6a0
> [ 106.422251] preempt_reset+0x9a/0xf0 [i915]
> [ 106.422333] tasklet_action_common.isra.15+0xc0/0x1e0
> [ 106.422685] ? execlists_submit_request+0x200/0x200 [i915]
> [ 106.422764] __do_softirq+0x106/0x3cf
> [ 106.422840] irq_exit+0xdc/0xf0
> [ 106.422914] smp_apic_timer_interrupt+0x81/0x1c0
> [ 106.422988] apic_timer_interrupt+0xf/0x20
> [ 106.423059] </IRQ>
> [ 106.423144] RIP: 0010:cpuidle_enter_state+0xc3/0x620
> [ 106.423222] Code: 24 0f 1f 44 00 00 31 ff e8 da 87 9c ff 80 7c 24 10 00 74 12 9c 58 f6 c4 02 0f 85 33 05 00 00 31 ff e8 c1 77 a3 ff fb 45 85 e4 <0f> 89 bf 02 00 00 48 8d 7d 10 e8 4e 45 b9 ff c7 45 10 00 00 00 00
> [ 106.423311] RSP: 0018:ffff88881c30fda8 EFLAGS: 00000202 ORIG_RAX: ffffffffffffff13
> [ 106.423390] RAX: 0000000000000000 RBX: ffffffff825b4c80 RCX: ffffffff810c8a00
> [ 106.423465] RDX: dffffc0000000000 RSI: 0000000039f89620 RDI: ffff88881f6b00a8
> [ 106.423540] RBP: ffff88881f6b5bf8 R08: 0000000000000002 R09: 000000000002ed80
> [ 106.423616] R10: 0000003fdd956146 R11: ffff88881c2d1e47 R12: 0000000000000008
> [ 106.423691] R13: 0000000000000008 R14: ffffffff825b4f80 R15: ffffffff825b4fc0
> [ 106.423772] ? sched_idle_set_state+0x20/0x30
> [ 106.423851] ? cpuidle_enter_state+0xa6/0x620
> [ 106.423874] ? tick_nohz_idle_stop_tick+0x1d1/0x3f0
> [ 106.423896] cpuidle_enter+0x37/0x60
> [ 106.423919] do_idle+0x246/0x280
> [ 106.423941] ? arch_cpu_idle_exit+0x30/0x30
> [ 106.423964] ? __wake_up_common+0x46/0x240
> [ 106.423986] cpu_startup_entry+0x14/0x20
> [ 106.424009] start_secondary+0x1b0/0x200
> [ 106.424031] ? set_cpu_sibling_map+0x990/0x990
> [ 106.424054] secondary_startup_64+0xa4/0xb0
> [ 106.424075]
> [ 106.424096] Allocated by task 626:
> [ 106.424119] save_stack+0x19/0x80
> [ 106.424143] __kasan_kmalloc.constprop.7+0xc1/0xd0
> [ 106.424165] kmem_cache_alloc+0xb2/0x1d0
> [ 106.424277] i915_sched_lookup_priolist+0x1ab/0x320 [i915]
> [ 106.424385] execlists_submit_request+0x73/0x200 [i915]
> [ 106.424498] submit_notify+0x59/0x60 [i915]
> [ 106.424600] __i915_sw_fence_complete+0x9b/0x330 [i915]
> [ 106.424713] __i915_request_commit+0x4bf/0x570 [i915]
> [ 106.424818] intel_engine_pulse+0x213/0x310 [i915]
> [ 106.424925] context_close+0x22f/0x470 [i915]
> [ 106.425033] i915_gem_context_destroy_ioctl+0x7b/0xa0 [i915]
> [ 106.425058] drm_ioctl_kernel+0x131/0x170
> [ 106.425081] drm_ioctl+0x2d9/0x4f1
> [ 106.425104] do_vfs_ioctl+0x115/0x890
> [ 106.425126] ksys_ioctl+0x35/0x70
> [ 106.425147] __x64_sys_ioctl+0x38/0x40
> [ 106.425169] do_syscall_64+0x66/0x220
> [ 106.425191] entry_SYSCALL_64_after_hwframe+0x44/0xa9
> [ 106.425213]
> [ 106.425234] Freed by task 0:
> [ 106.425255] (stack is not available)
> [ 106.425276]
> [ 106.425297] The buggy address belongs to the object at ffff888703506a40
> [ 106.425297] which belongs to the cache i915_priolist of size 104
> [ 106.425321] The buggy address is located 136 bytes to the right of
> [ 106.425321] 104-byte region [ffff888703506a40, ffff888703506aa8)
> [ 106.425345] The buggy address belongs to the page:
> [ 106.425367] page:ffffea001c0d4180 refcount:1 mapcount:0 mapping:ffff88873e1cf740 index:0xffff888703506e40 compound_mapcount: 0
> [ 106.425391] flags: 0x8000000000010200(slab|head)
> [ 106.425415] raw: 8000000000010200 ffffea0020192b88 ffff8888174b5450 ffff88873e1cf740
> [ 106.425439] raw: ffff888703506e40 000000000010000e 00000001ffffffff 0000000000000000
> [ 106.425464] page dumped because: kasan: bad access detected
> [ 106.425486]
> [ 106.425506] Memory state around the buggy address:
> [ 106.425528] ffff888703506a00: fc fc fc fc fc fc fc fc 00 00 00 00 00 00 00 00
> [ 106.425551] ffff888703506a80: 00 00 00 00 00 fc fc fc fc fc fc fc fc fc fc fc
> [ 106.425573] >ffff888703506b00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
> [ 106.425597] ^
> [ 106.425619] ffff888703506b80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
> [ 106.425642] ffff888703506c00: fc fc fc fc fc fc fc fc 00 00 00 00 00 00 00 00
> [ 106.425664] ==================================================================
>
> Fixes: 22b7a426bbe1 ("drm/i915/execlists: Preempt-to-busy")
> Signed-off-by: Chris Wilson <chris@chris-wilson.co.uk>
On agreement that the timeline is safer,
Reviewed-by: Mika Kuoppala <mika.kuoppala@linux.intel.com>
> ---
> drivers/gpu/drm/i915/gt/intel_lrc.c | 8 ++++----
> 1 file changed, 4 insertions(+), 4 deletions(-)
>
> diff --git a/drivers/gpu/drm/i915/gt/intel_lrc.c b/drivers/gpu/drm/i915/gt/intel_lrc.c
> index 191892f7b3a9..645f6b21d8c6 100644
> --- a/drivers/gpu/drm/i915/gt/intel_lrc.c
> +++ b/drivers/gpu/drm/i915/gt/intel_lrc.c
> @@ -2246,15 +2246,15 @@ static void reset_csb_pointers(struct intel_engine_cs *engine)
>
> static struct i915_request *active_request(struct i915_request *rq)
> {
> - const struct list_head * const list = &rq->engine->active.requests;
> - const struct intel_context * const context = rq->hw_context;
> + const struct list_head * const list = &rq->timeline->requests;
> + const struct intel_context * const ce = rq->hw_context;
> struct i915_request *active = NULL;
>
> - list_for_each_entry_from_reverse(rq, list, sched.link) {
> + list_for_each_entry_from_reverse(rq, list, link) {
> if (i915_request_completed(rq))
> break;
>
> - if (rq->hw_context != context)
> + if (rq->hw_context != ce)
> break;
>
> active = rq;
> --
> 2.23.0.rc1
>
> _______________________________________________
> Intel-gfx mailing list
> Intel-gfx@lists.freedesktop.org
> https://lists.freedesktop.org/mailman/listinfo/intel-gfx
_______________________________________________
Intel-gfx mailing list
Intel-gfx@lists.freedesktop.org
https://lists.freedesktop.org/mailman/listinfo/intel-gfx
next prev parent reply other threads:[~2019-08-09 8:49 UTC|newest]
Thread overview: 4+ messages / expand[flat|nested] mbox.gz Atom feed top
2019-08-09 7:37 [PATCH] drm/i915/execlists: Backtrack along timeline Chris Wilson
2019-08-09 8:48 ` Mika Kuoppala [this message]
2019-08-09 9:09 ` ✓ Fi.CI.BAT: success for " Patchwork
2019-08-09 22:20 ` ✓ Fi.CI.IGT: " Patchwork
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=87ftma9129.fsf@gaia.fi.intel.com \
--to=mika.kuoppala@linux.intel.com \
--cc=chris@chris-wilson.co.uk \
--cc=intel-gfx@lists.freedesktop.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.