pvops: i915 kms crashs with corrupt page table

pvops: i915 kms crashs with corrupt page table

[Bastian Blank]

Hi

I run a 2.6.32 dom0 kernel (the Debian distribution config). If I enable
KMS in the intel driver, Xorg crashs with corrupt page table.

| Xorg: Corrupted page table at address 7fd9e2f86000
| PGD 745d0067 PUD 74d1f067 PMD 72cae067 PTE fffffffffffff22f
| Bad pagetable: 000f [#1] SMP 
| last sysfs file: /sys/devices/virtual/backlight/acpi_video0/brightness
| CPU 0 
| Modules linked in: i915 drm_kms_helper xen_evtchn xenfs bridge stp firewire_sbp2 loop dm_snapshot snd_hda_codec_analog ide_cs arc4 snd_hda_intel snd_hda_codec snd_hwdep ecb snd_pcm snd_timer joydev snd hp_accel lis3lv02d parport_pc pcmcia irda soundcore parport tpm_infineon iwlagn yenta_socket tpm rsrc_nonstatic container evdev input_polldev crc_ccitt iwlcore ac snd_page_alloc pcspkr tpm_bios pcmcia_core wmi battery mac80211 processor cfg80211 rfkill serio_raw psmouse ext3 jbd mbcache dm_mod sd_mod crc_t10dif ide_cd_mod cdrom ata_generic uhci_hcd ide_pci_generic ahci sdhci_pci sdhci ricoh_mmc firewire_ohci firewire_core crc_itu_t mmc_core led_class intel_agp drm i2c_algo_bit button i2c_core video output e1000e libata scsi_mod ehci_hcd piix ide_core usbcore nls_base thermal fan thermal_sys [last unloaded: drm_kms_helper]
| Pid: 1955, comm: Xorg Not tainted 2.6.32-3-xen-amd64 #1 HP Compaq 6910p
| RIP: e033:[<00007fd9e34dc0a0>]  [<00007fd9e34dc0a0>] 0x7fd9e34dc0a0
| RSP: e02b:00007fff0525abf8  EFLAGS: 00010246
| RAX: 0000000000000010 RBX: 00007fd9e2f86000 RCX: 0000000000000000
| RDX: 00000000ffff0000 RSI: 00000000ffffffff RDI: 000000000000ffff
| RBP: 0000000000000000 R08: 00007fd9e2f86000 R09: 0000000000000000
| R10: 0000000000000000 R11: 0000000000000002 R12: 0000000000000000
| R13: 0000000000000040 R14: 0000000400000000 R15: 0000000400000000
| FS:  00007fd9e786a790(0000) GS:ffff88000342f000(0000) knlGS:0000000000000000
| CS:  e033 DS: 0000 ES: 0000 CR0: 000000008005003b
| CR2: 00007fd9e2f86000 CR3: 0000000002b52000 CR4: 0000000000002660
| DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
| DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000400
| Process Xorg (pid: 1955, threadinfo ffff880001f2a000, task ffff880001e28e20)
| 
| RIP  [<00007fd9e34dc0a0>] 0x7fd9e34dc0a0
|  RSP <00007fff0525abf8>
| ---[ end trace 8b2c5cb2c5b589cc ]---

Bastian

-- 
There are always alternatives.
		-- Spock, "The Galileo Seven", stardate 2822.3

Re: pvops: i915 kms crashs with corrupt page table

[Jeremy Fitzhardinge]

On 02/24/2010 09:55 AM, Bastian Blank wrote:
> Hi
>
> I run a 2.6.32 dom0 kernel (the Debian distribution config). If I enable
> KMS in the intel driver, Xorg crashs with corrupt page table.
>    

Does this help?

 From d36d7863f86b2d7a786abf60ea37c75438b448d5 Mon Sep 17 00:00:00 2001
From: Jeremy Fitzhardinge<jeremy.fitzhardinge@citrix.com>
Date: Wed, 24 Feb 2010 11:10:45 -0800
Subject: [PATCH] agp: use DMA API when compiled for Xen as well

Xen guests need translation between pseudo-physical and real machine
physical addresses when accessing graphics devices, so use the DMA API
in that case too.

Signed-off-by: Jeremy Fitzhardinge<jeremy.fitzhardinge@citrix.com>

diff --git a/drivers/char/agp/intel-agp.c b/drivers/char/agp/intel-agp.c
index 3cb56a0..efa7213 100644
--- a/drivers/char/agp/intel-agp.c
+++ b/drivers/char/agp/intel-agp.c
@@ -15,8 +15,12 @@
   * an Intel IOMMU. So make the correct use of the PCI DMA API contingent
   * on the Intel IOMMU support (CONFIG_DMAR).
   * Only newer chipsets need to bother with this, of course.
+ *
+ * Xen guests accessing graphics hardware also need proper translation
+ * between pseudo-physical addresses and real machine addresses, which
+ * is also achieved by using the DMA API.
   */
-#ifdef CONFIG_DMAR
+#if defined(CONFIG_DMAR) || defined(CONFIG_XEN)
  #define USE_PCI_DMA_API 1
  #endif

Re: Re: pvops: i915 kms crashs with corrupt page table

[Bastian Blank]

On Wed, Feb 24, 2010 at 11:23:37AM -0800, Jeremy Fitzhardinge wrote:
> On 02/24/2010 09:55 AM, Bastian Blank wrote:
>> I run a 2.6.32 dom0 kernel (the Debian distribution config). If I enable
>> KMS in the intel driver, Xorg crashs with corrupt page table.
> Does this help?

No.

[ 4398.310454] [drm] TV-16: set mode NTSC 480i 0
[ 4398.310454] [drm] TV-16: set mode NTSC 480i 0
[ 4398.310454] [drm] TV-16: set mode NTSC 480i 0
[ 4398.310454] [drm] TV-16: set mode NTSC 480i 0
[ 4398.310454] Xorg: Corrupted page table at address 7ffff3706000
[ 4398.310454] PGD 74e22067 PUD 739e9067 PMD 1dc7067 PTE fffffffffffff22f
[ 4398.310454] Bad pagetable: 000f [#1] SMP 
[ 4398.310454] last sysfs file: /sys/devices/virtual/backlight/acpi_video0/brightness
[ 4398.310454] CPU 0 
[ 4398.310454] Modules linked in: xen_evtchn xenfs bridge stp firewire_sbp2 loop dm_snapshot ide_cs snd_hda_codec_analog snd_hda_intel snd_hda_codec arc4 snd_hwdep ecb pcmcia joydev snd_pcm iwlagn iwlcore parport_pc tpm_infineon snd_timer mac80211 hp_accel yenta_socket lis3lv02d rsrc_nonstatic input_polldev parport pcmcia_core ac snd tpm container battery soundcore irda serio_raw cfg80211 wmi evdev rfkill crc_ccitt snd_page_alloc tpm_bios pcspkr processor psmouse ext3 jbd mbcache dm_mod ide_cd_mod cdrom ata_generic sd_mod crc_t10dif ide_pci_generic uhci_hcd e1000e i915 drm_kms_helper drm i2c_algo_bit intel_agp button i2c_core video output ahci sdhci_pci sdhci piix ide_core ricoh_mmc firewire_ohci firewire_core crc_itu_t mmc_core led_class ehci_hcd libata scsi_mod usbcore nls_base thermal f
 an thermal_sys [last unloaded: scsi_wait_scan]
[ 4398.310454] Pid: 1756, comm: Xorg Not tainted 2.6.32-3-xen-amd64 #1 HP Compaq 6910p
[ 4398.310454] RIP: e033:[<00007ffff3c5d0a0>]  [<00007ffff3c5d0a0>] 0x7ffff3c5d0a0
[ 4398.310454] RSP: e02b:00007fffffffe818  EFLAGS: 00010246
[ 4398.310454] RAX: 0000000000000010 RBX: 00007ffff3706000 RCX: 0000000000000000
[ 4398.310454] RDX: 00000000ffff0000 RSI: 00000000ffffffff RDI: 000000000000ffff
[ 4398.310454] RBP: 0000000000000000 R08: 00007ffff3706000 R09: 0000000000000000
[ 4398.310454] R10: 0000000000000000 R11: 0000000000000002 R12: 0000000000000000
[ 4398.310454] R13: 0000000000000040 R14: 0000000400000000 R15: 0000000400000000
[ 4398.310454] FS:  00007ffff7fea790(0000) GS:ffff88000342f000(0000) knlGS:0000000000000000
[ 4398.310454] CS:  e033 DS: 0000 ES: 0000 CR0: 000000008005003b
[ 4398.310454] CR2: 00007ffff3706000 CR3: 000000007534f000 CR4: 0000000000002660
[ 4398.310454] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
[ 4398.310454] DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000400
[ 4398.310454] Process Xorg (pid: 1756, threadinfo ffff880074aa0000, task ffff88000258cdb0)
[ 4398.310454] 
[ 4398.310454] RIP  [<00007ffff3c5d0a0>] 0x7ffff3c5d0a0
[ 4398.310454]  RSP <00007fffffffe818>
[ 4398.310454] ---[ end trace 9903f83d8074225b ]---
[ 4398.310454] [drm] LVDS-8: set mode 1440x900 1f

If I disable the va randomization, I can correlate the addresses and see:
| 7ffff3701000-7ffff3705000 rw-s 00000000 00:04 16461                      /drm mm object (deleted)
| 7ffff3705000-7ffff3706000 rw-s 100001000 00:0e 2043                      /dev/dri/card0
| 7ffff3706000-7ffff3707000 rw-s 100000000 00:0e 2043                      /dev/dri/card0
| 7ffff3707000-7ffff39c8000 r-xp 00000000 08:02 106995                     /usr/lib/dri/i965_dri.so
| 7ffff39c8000-7ffff3bc8000 ---p 002c1000 08:02 106995                     /usr/lib/dri/i965_dri.so
| 7ffff3bc8000-7ffff3bd7000 rw-p 002c1000 08:02 106995                     /usr/lib/dri/i965_dri.so
| 7ffff3bd7000-7ffff3be6000 rw-p 00000000 00:00 0 

strace output:
| write(0, "(II) intel(0): Setting screen ph"..., 57) = 57
| ioctl(11, 0xc010645b, 0x7fffffffea20)   = 0
| ioctl(11, 0xc0106464, 0x7fffffffe940)   = 0
| mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_SHARED, 11, 0x100000000) = 0x7ffff3706000
| ioctl(11, 0x400c645f, 0x7fffffffe950)   = 0
| +++ killed by SIGKILL +++

Bastian

-- 
Captain's Log, star date 21:34.5...

Re: Re: pvops: i915 kms crashs with corrupt page table

[Bastian Blank]

On Thu, Feb 25, 2010 at 11:06:20AM +0100, Bastian Blank wrote:
> On Wed, Feb 24, 2010 at 11:23:37AM -0800, Jeremy Fitzhardinge wrote:
> > On 02/24/2010 09:55 AM, Bastian Blank wrote:
> >> I run a 2.6.32 dom0 kernel (the Debian distribution config). If I enable
> >> KMS in the intel driver, Xorg crashs with corrupt page table.
> > Does this help?
> 
> No.

But it is something like that:

intel_i810_configure:
        pci_read_config_dword(intel_private.pcidev, I810_GMADDR, &temp);
        agp_bridge->gart_bus_addr = (temp & PCI_BASE_ADDRESS_MEM_MASK);

agp_copy_info:
	info->aper_base = bridge->gart_bus_addr;

drm_agp_init:
	head->base = head->agp_info.aper_base;

	dev->agp = head

i915_gem_init_ringbuffer:
	ring->map.offset = dev->agp->base + obj_priv->gtt_offset;

This address is directly used to create a userspace mapping.

Bastian

-- 
Without freedom of choice there is no creativity.
		-- Kirk, "The return of the Archons", stardate 3157.4

Re: Re: pvops: i915 kms crashs with corrupt page table

[Jeremy Fitzhardinge]

On 02/25/2010 02:32 AM, Bastian Blank wrote:
> On Thu, Feb 25, 2010 at 11:06:20AM +0100, Bastian Blank wrote:
>    
>> On Wed, Feb 24, 2010 at 11:23:37AM -0800, Jeremy Fitzhardinge wrote:
>>      
>>> On 02/24/2010 09:55 AM, Bastian Blank wrote:
>>>        
>>>> I run a 2.6.32 dom0 kernel (the Debian distribution config). If I enable
>>>> KMS in the intel driver, Xorg crashs with corrupt page table.
>>>>          
>>> Does this help?
>>>        
>> No.
>>      
> But it is something like that:
>
> intel_i810_configure:
>          pci_read_config_dword(intel_private.pcidev, I810_GMADDR,&temp);
>          agp_bridge->gart_bus_addr = (temp&  PCI_BASE_ADDRESS_MEM_MASK);
>
> agp_copy_info:
> 	info->aper_base = bridge->gart_bus_addr;
>
> drm_agp_init:
> 	head->base = head->agp_info.aper_base;
>
> 	dev->agp = head
>
> i915_gem_init_ringbuffer:
> 	ring->map.offset = dev->agp->base + obj_priv->gtt_offset;
>
> This address is directly used to create a userspace mapping.
>    

Does this help?

diff --git a/arch/x86/include/asm/pgtable_64.h b/arch/x86/include/asm/pgtable_64.h
index c57a301..4e46931 100644
--- a/arch/x86/include/asm/pgtable_64.h
+++ b/arch/x86/include/asm/pgtable_64.h
@@ -160,7 +160,7 @@ extern void cleanup_highmap(void);
  #define pgtable_cache_init()   do { } while (0)
  #define check_pgt_cache()      do { } while (0)

-#define PAGE_AGP    PAGE_KERNEL_NOCACHE
+#define PAGE_AGP    PAGE_KERNEL_IO_NOCACHE
  #define HAVE_PAGE_AGP 1

  /* fs/proc/kcore.c */

	J

Re: Re: pvops: i915 kms crashs with corrupt page table

[Bastian Blank]

On Thu, Feb 25, 2010 at 04:37:43PM -0800, Jeremy Fitzhardinge wrote:
> Does this help?

No.

Bastian

-- 
Respect is a rational process
		-- McCoy, "The Galileo Seven", stardate 2822.3

Re: Re: pvops: i915 kms crashs with corrupt page table

[Jeremy Fitzhardinge]

On 02/26/2010 04:44 AM, Bastian Blank wrote:
> On Thu, Feb 25, 2010 at 04:37:43PM -0800, Jeremy Fitzhardinge wrote:
>    
>> Does this help?
>>      
> No.
>    

Exactly the same result?  It should have changed something.

     J

Re: Re: pvops: i915 kms crashs with corrupt page table

[Bastian Blank]

On Fri, Feb 26, 2010 at 10:11:12AM -0800, Jeremy Fitzhardinge wrote:
> Yes.  Why is there no debug info?  Have you disabled frame pointers and  
> symbols?  What does 00007ffff3c5d0a0  correspond to?  Are there any  
> messages on the Xen console?

Please take a look at the memory layout of x86-64 linux, the lower half
of the memory is userspace.

The trap happened while userspace code was running, Xorg in this case.

Bastian

-- 
Respect is a rational process
		-- McCoy, "The Galileo Seven", stardate 2822.3

Re: Re: pvops: i915 kms crashs with corrupt page table

[Jeremy Fitzhardinge]

On 02/26/2010 04:45 PM, Bastian Blank wrote:
> The trap happened while userspace code was running, Xorg in this case.
>    

The changes in xen/next should help with this.

     J

Re: Re: pvops: i915 kms crashs with corrupt page table

[Bastian Blank]

On Fri, Feb 26, 2010 at 05:17:36PM -0800, Jeremy Fitzhardinge wrote:
> On 02/26/2010 04:45 PM, Bastian Blank wrote:
>> The trap happened while userspace code was running, Xorg in this case.
> The changes in xen/next should help with this.

Yep, looks much better.

Bastian

-- 
Every living thing wants to survive.
		-- Spock, "The Ultimate Computer", stardate 4731.3

Re: Re: pvops: i915 kms crashs with corrupt page table

[Ian Campbell]

On Sun, 2010-02-28 at 12:27 +0000, Bastian Blank wrote: 
> On Fri, Feb 26, 2010 at 05:17:36PM -0800, Jeremy Fitzhardinge wrote:
> > On 02/26/2010 04:45 PM, Bastian Blank wrote:
> >> The trap happened while userspace code was running, Xorg in this case.
> > The changes in xen/next should help with this.
> 
> Yep, looks much better.

I was having some problems with my radeon which seem to have gone away
with these fixes too.

Thanks,
Ian.