From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from gabe.freedesktop.org (gabe.freedesktop.org [131.252.210.177]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.lore.kernel.org (Postfix) with ESMTPS id 7C1D6CE79A9 for ; Tue, 19 Sep 2023 15:44:01 +0000 (UTC) Received: from gabe.freedesktop.org (localhost [127.0.0.1]) by gabe.freedesktop.org (Postfix) with ESMTP id 44A4910E24F; Tue, 19 Sep 2023 15:43:57 +0000 (UTC) Received: from casper.infradead.org (casper.infradead.org [IPv6:2001:8b0:10b:1236::1]) by gabe.freedesktop.org (Postfix) with ESMTPS id AA8AF10E27A; Tue, 19 Sep 2023 15:43:54 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=infradead.org; s=casper.20170209; h=In-Reply-To:Content-Type:MIME-Version: References:Message-ID:Subject:Cc:To:From:Date:Sender:Reply-To: Content-Transfer-Encoding:Content-ID:Content-Description; bh=K4XOxDjoQc0tDKul2sAFg8dPE5RBNC5v+ER7EvKWlro=; b=NUUqRKI9eBera0KC3gXkeqZtkM /GFKMZSxhT/N4WSHKiJ/LnKARML8J4fVRmJAK6vS+sngTB3qVVyL5CZ7+aYjPzEBzodj/t51kyRLt +lC5J68P8dYuCckGOdMcFiLmJTQjK6XnyMKf+KwyMI7oVjFXRLoLzSfMEgkQla6fltpCc33xk0tTD jkWzrEOofVLacRE1OsH9DD0Y3UrJuKKDfV9dv6ARDpn1HVgbpIj1e8+kk7CJygrv6/VjTWV4BPRkl RwV6MSNc1q6jXJklBhtoCEN0yr3A6DbNe1h+LuJ/9Kx0mqQ2fnY4HswW1WJ8xjBYMRuhM1tY0rMmS FoqlIc6w==; Received: from willy by casper.infradead.org with local (Exim 4.94.2 #2 (Red Hat Linux)) id 1qict2-000Qnd-Tt; Tue, 19 Sep 2023 15:43:40 +0000 Date: Tue, 19 Sep 2023 16:43:40 +0100 From: Matthew Wilcox To: Oleksandr Natalenko Message-ID: References: <4857570.31r3eYUQgx@natalenko.name> <6287208.lOV4Wx5bFT@natalenko.name> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <6287208.lOV4Wx5bFT@natalenko.name> Subject: Re: [Intel-gfx] [REGRESSION] [BISECTED] Panic in gen8_ggtt_insert_entries() with v6.5 X-BeenThere: intel-gfx@lists.freedesktop.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Intel graphics driver community testing & development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Cc: Thomas =?iso-8859-1?Q?Hellstr=F6m?= , Matt Roper , intel-gfx@lists.freedesktop.org, linux-kernel@vger.kernel.org, Chris Wilson , Nathan Chancellor , linux-mm@kvack.org, Andrzej Hajda , dri-devel@lists.freedesktop.org, Daniel Vetter , Rodrigo Vivi , Andrew Morton , David Airlie , Matthew Auld Errors-To: intel-gfx-bounces@lists.freedesktop.org Sender: "Intel-gfx" On Tue, Sep 19, 2023 at 10:26:42AM +0200, Oleksandr Natalenko wrote: > Andrzej asked me to try to revert commits 0b62af28f249, e0b72c14d8dc and 1e0877d58b1e, and reverting those fixed the i915 crash for me. The e0b72c14d8dc and 1e0877d58b1e commits look like just prerequisites, so I assume 0b62af28f249 ("i915: convert shmem_sg_free_table() to use a folio_batch") is the culprit here. > > Could you please check this? > > Our conversation with Andrzej is available at drm-intel GitLab [1]. > > Thanks. > > [1] https://gitlab.freedesktop.org/drm/intel/-/issues/9256 Wow, that is some great debugging. Thanks for all the time & effort you and others have invested. Sorry for breaking your system. You're almost right about the "prerequisites", but it's in the other direction; 0b62af28f249 is a prerequisite for the later two cleanups, so reverting all three is necessary to test 0b62af28f249. It seems to me that you've isolated the problem to constructing overly long sg lists. I didn't realise that was going to be a problem, so that's my fault. Could I ask you to try this patch? I'll follow up with another patch later because I think I made another assumption that may not be valid. diff --git a/drivers/gpu/drm/i915/gem/i915_gem_shmem.c b/drivers/gpu/drm/i915/gem/i915_gem_shmem.c index 8f1633c3fb93..73a4a4eb29e0 100644 --- a/drivers/gpu/drm/i915/gem/i915_gem_shmem.c +++ b/drivers/gpu/drm/i915/gem/i915_gem_shmem.c @@ -100,6 +100,7 @@ int shmem_sg_alloc_table(struct drm_i915_private *i915, struct sg_table *st, st->nents = 0; for (i = 0; i < page_count; i++) { struct folio *folio; + unsigned long nr_pages; const unsigned int shrink[] = { I915_SHRINK_BOUND | I915_SHRINK_UNBOUND, 0, @@ -150,6 +151,8 @@ int shmem_sg_alloc_table(struct drm_i915_private *i915, struct sg_table *st, } } while (1); + nr_pages = min_t(unsigned long, + folio_nr_pages(folio), page_count - i); if (!i || sg->length >= max_segment || folio_pfn(folio) != next_pfn) { @@ -157,13 +160,13 @@ int shmem_sg_alloc_table(struct drm_i915_private *i915, struct sg_table *st, sg = sg_next(sg); st->nents++; - sg_set_folio(sg, folio, folio_size(folio), 0); + sg_set_folio(sg, folio, nr_pages * PAGE_SIZE, 0); } else { /* XXX: could overflow? */ - sg->length += folio_size(folio); + sg->length += nr_pages * PAGE_SIZE; } - next_pfn = folio_pfn(folio) + folio_nr_pages(folio); - i += folio_nr_pages(folio) - 1; + next_pfn = folio_pfn(folio) + nr_pages; + i += nr_pages - 1; /* Check that the i965g/gm workaround works. */ GEM_BUG_ON(gfp & __GFP_DMA32 && next_pfn >= 0x00100000UL);