dri-devel July 2019

dri-devel@lists.freedesktop.org

323 participants
2301 discussions

[PATCH] drm: avoid spurious EBUSY due to nonblocking atomic modesets
by Daniel Vetter 23 Sep '20

23 Sep '20

When doing an atomic modeset with ALLOW_MODESET drivers are allowed to pull in arbitrary other resources, including CRTCs (e.g. when reconfiguring global resources). But in nonblocking mode userspace has then no idea this happened, which can lead to spurious EBUSY calls, both: - when that other CRTC is currently busy doing a page_flip the ALLOW_MODESET commit can fail with an EBUSY - on the other CRTC a normal atomic flip can fail with EBUSY because of the additional commit inserted by the kernel without userspace's knowledge For blocking commits this isn't a problem, because everyone else will just block until all the CRTC are reconfigured. Only thing userspace can notice is the dropped frames without any reason for why frames got dropped. Consensus is that we need new uapi to handle this properly, but no one has any idea what exactly the new uapi should look like. As a stop-gap plug this problem by demoting nonblocking commits which might cause issues by including CRTCs not in the original request to blocking commits. v2: Add comments and a WARN_ON to enforce this only when allowed - we don't want to silently convert page flips into blocking plane updates just because the driver is buggy. References: https://lists.freedesktop.org/archives/dri-devel/2018-July/182281.html Bugzilla: https://gitlab.freedesktop.org/wayland/weston/issues/24#note_9568 Cc: Daniel Stone <daniel(a)fooishbar.org> Cc: Pekka Paalanen <pekka.paalanen(a)collabora.co.uk> Cc: stable(a)vger.kernel.org Signed-off-by: Daniel Vetter <daniel.vetter(a)intel.com> --- drivers/gpu/drm/drm_atomic.c | 34 +++++++++++++++++++++++++++++++--- 1 file changed, 31 insertions(+), 3 deletions(-) diff --git a/drivers/gpu/drm/drm_atomic.c b/drivers/gpu/drm/drm_atomic.c index d5cefb1cb2a2..058512f14772 100644 --- a/drivers/gpu/drm/drm_atomic.c +++ b/drivers/gpu/drm/drm_atomic.c @@ -2018,15 +2018,43 @@ EXPORT_SYMBOL(drm_atomic_commit); int drm_atomic_nonblocking_commit(struct drm_atomic_state *state) { struct drm_mode_config *config = &state->dev->mode_config; - int ret; + unsigned requested_crtc = 0; + unsigned affected_crtc = 0; + struct drm_crtc *crtc; + struct drm_crtc_state *crtc_state; + bool nonblocking = true; + int ret, i; + + /* + * For commits that allow modesets drivers can add other CRTCs to the + * atomic commit, e.g. when they need to reallocate global resources. + * + * But when userspace also requests a nonblocking commit then userspace + * cannot know that the commit affects other CRTCs, which can result in + * spurious EBUSY failures. Until we have better uapi plug this by + * demoting such commits to blocking mode. + */ + for_each_new_crtc_in_state(state, crtc, crtc_state, i) + requested_crtc |= drm_crtc_mask(crtc); ret = drm_atomic_check_only(state); if (ret) return ret; - DRM_DEBUG_ATOMIC("committing %p nonblocking\n", state); + for_each_new_crtc_in_state(state, crtc, crtc_state, i) + affected_crtc |= drm_crtc_mask(crtc); + + if (affected_crtc != requested_crtc) { + /* adding other CRTC is only allowed for modeset commits */ + WARN_ON(state->allow_modeset); + + DRM_DEBUG_ATOMIC("demoting %p to blocking mode to avoid EBUSY\n", state); + nonblocking = false; + } else { + DRM_DEBUG_ATOMIC("committing %p nonblocking\n", state); + } - return config->funcs->atomic_commit(state->dev, state, true); + return config->funcs->atomic_commit(state->dev, state, nonblocking); } EXPORT_SYMBOL(drm_atomic_nonblocking_commit); -- 2.18.0

3 11

[Bug 203033] New: nouveau hung task
by bugzilla-daemon＠bugzilla.kernel.org 28 Aug '20

28 Aug '20

https://bugzilla.kernel.org/show_bug.cgi?id=203033 Bug ID: 203033 Summary: nouveau hung task Product: Drivers Version: 2.5 Kernel Version: 5.0.0 Hardware: x86-64 OS: Linux Tree: Mainline Status: NEW Severity: normal Priority: P1 Component: Video(DRI - non Intel) Assignee: drivers_video-dri(a)kernel-bugs.osdl.org Reporter: mcroce(a)redhat.com Regression: No The GUI freezes randomly with nouveau with this error in the syslog: INFO: task kworker/u16:4:14755 blocked for more than 120 seconds. Not tainted 5.0.0-matteo #28 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. kworker/u16:4 D 0 14755 2 0x80000000 Workqueue: events_unbound nv50_disp_atomic_commit_work [nouveau] Call Trace: ? __schedule+0x1a6/0x6c0 schedule+0x2c/0x70 schedule_timeout+0x268/0x380 ? nvif_notify_get+0x94/0xa0 [nouveau] dma_fence_default_wait+0x204/0x270 ? dma_fence_release+0x90/0x90 dma_fence_wait_timeout+0xdd/0x100 drm_atomic_helper_wait_for_fences+0x3a/0xc0 [drm_kms_helper] nv50_disp_atomic_commit_tail+0x7c/0x850 [nouveau] ? __switch_to_asm+0x34/0x70 ? __switch_to_asm+0x40/0x70 ? __switch_to_asm+0x40/0x70 ? __switch_to_asm+0x40/0x70 process_one_work+0x1fa/0x400 worker_thread+0x2d/0x3d0 ? process_one_work+0x400/0x400 kthread+0x113/0x130 ? kthread_create_on_node+0x60/0x60 ret_from_fork+0x35/0x40 -- You are receiving this mail because: You are watching the assignee of the bug.

1 5

[RFC v2 00/11] DVFS in the OPP core
by Rajendra Nayak 12 Aug '20

12 Aug '20

This is a v2 of the RFC posted earlier by Stephen Boyd [1] As part of v2 I still follow the same approach of dev_pm_opp_set_rate() API using clk framework to round the frequency passed and making it accept 0 as a valid frequency indicating the frequency isn't required anymore. It just has a few more drivers converted to use this approach like dsi/dpu and ufs. ufs demonstrates the case of having to handle multiple power domains, one of which is scalable. The patches are based on 5.1-rc1 and depend on some ufs fixes I posted earlier [2] and a DT patch to include the rpmpd header [3] [1] https://lkml.org/lkml/2019/1/28/2086 [2] https://lkml.org/lkml/2019/3/8/70 [3] https://lkml.org/lkml/2019/3/20/120 Rajendra Nayak (10): OPP: Make dev_pm_opp_set_rate() with freq=0 as valid tty: serial: qcom_geni_serial: Use OPP API to set clk/perf state spi: spi-geni-qcom: Use OPP API to set clk/perf state arm64: dts: sdm845: Add OPP table for all qup devices scsi: ufs: Add support to manage multiple power domains in ufshcd-pltfrm scsi: ufs: Add support for specifying OPP tables in DT arm64: dts: sdm845: Add ufs opps and power-domains drm/msm/dpu: Use OPP API to set clk/perf state drm/msm: dsi: Use OPP API to set clk/perf state arm64: dts: sdm845: Add DSI and MDP OPP tables and power-domains Stephen Boyd (1): OPP: Don't overwrite rounded clk rate arch/arm64/boot/dts/qcom/sdm845.dtsi | 194 +++++++++++++++++- drivers/gpu/drm/msm/disp/dpu1/dpu_core_perf.c | 7 +- drivers/gpu/drm/msm/disp/dpu1/dpu_kms.c | 9 + drivers/gpu/drm/msm/dsi/dsi.h | 2 + drivers/gpu/drm/msm/dsi/dsi_cfg.c | 4 +- drivers/gpu/drm/msm/dsi/dsi_host.c | 88 +++++++- drivers/opp/core.c | 26 ++- drivers/scsi/ufs/ufshcd-pltfrm.c | 52 ++++- drivers/scsi/ufs/ufshcd.c | 21 +- drivers/scsi/ufs/ufshcd.h | 3 + drivers/spi/spi-geni-qcom.c | 14 +- drivers/tty/serial/qcom_geni_serial.c | 15 +- 12 files changed, 406 insertions(+), 29 deletions(-) -- QUALCOMM INDIA, on behalf of Qualcomm Innovation Center, Inc. is a member of Code Aurora Forum, hosted by The Linux Foundation

5 35

[drm/ttm] Memory corruption problem when ttm_tt_init() fails.
by Tetsuo Handa 29 Jul '20

29 Jul '20

I'm doing memory allocation failure injection test using 3.19-rc5 and it seems to me that there is a memory corruption bug in ttm or vmwgfx code. ---------- Crash pattern 1 start ---------- [ 80.751971] [TTM] Failed allocating page table [ 83.000393] BUG: unable to handle kernel NULL pointer dereference at (null) [ 83.004392] IP: [<ffffffff811b65a9>] __fput+0x39/0x1e0 [ 83.006944] PGD 7acd2067 PUD 7b0c7067 PMD 0 [ 83.009240] Oops: 0000 [#1] SMP [ 83.010940] Modules linked in: stap_fault_injection(OE) ip6t_rpfilter ip6t_REJECT nf_reject_ipv6 nf_conntrack_ipv6 nf_defrag_ipv6 ipt_REJECT nf_reject_ipv4 nf_conntrack_ipv4 nf_defrag_ipv4 xt_conntrack nf_conntrack ebtable_nat ebtable_broute bridge stp llc ebtable_filter ebtables ip6table_mangle ip6table_raw ip6table_filter ip6_tables iptable_mangle iptable_raw iptable_filter ip_tables coretemp crct10dif_pclmul crc32_pclmul crc32c_intel dm_mirror ghash_clmulni_intel dm_region_hash aesni_intel dm_log glue_helper dm_mod lrw gf128mul ablk_helper cryptd ppdev vmw_balloon microcode serio_raw pcspkr parport_pc shpchp parport vmw_vmci i2c_piix4 nfsd auth_rpcgss nfs_acl lockd grace sunrpc uinput sd_mod ata_generic pata_acpi mptspi scsi_transport_spi mptscsih ata_piix e1000 mptbase libata floppy [ 83.038033] CPU: 2 PID: 8795 Comm: sh Tainted: G W OE 3.19.0-rc5+ #28 [ 83.039666] Hardware name: VMware, Inc. VMware Virtual Platform/440BX Desktop Reference Platform, BIOS 6.00 07/31/2013 [ 83.042110] task: ffff88007a220000 ti: ffff880052048000 task.ti: ffff880052048000 [ 83.043865] RIP: 0010:[<ffffffff811b65a9>] [<ffffffff811b65a9>] __fput+0x39/0x1e0 [ 83.045665] RSP: 0018:ffff88005204bea8 EFLAGS: 00010297 [ 83.046895] RAX: 0000000000000000 RBX: ffff88007aff3500 RCX: 0000000000000a0a [ 83.048595] RDX: 000000000002801d RSI: 000000000000000a RDI: ffff88007aff3500 [ 83.050254] RBP: ffff88005204bee8 R08: ffff88007cbfd000 R09: 0000000180080006 [ 83.051848] R10: 0000000000000000 R11: ffffea0001f2fe00 R12: ffffffff81e6c040 [ 83.053515] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 83.055156] FS: 0000000000000000(0000) GS:ffff88007fc80000(0000) knlGS:0000000000000000 [ 83.057000] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 83.058328] CR2: 0000000000000000 CR3: 000000007b0bc000 CR4: 00000000000407e0 [ 83.060004] Stack: [ 83.060482] ffff88007af0de48 ffff88007af0dc00 ffff88007af0de48 0000000000000000 [ 83.062285] ffffffff81e6c040 ffff88007a220610 ffff88007a220000 0000000000000000 [ 83.064115] ffff88005204bef8 ffffffff811b679e ffff88005204bf28 ffffffff81088f6f [ 83.065956] Call Trace: [ 83.066544] [<ffffffff811b679e>] ____fput+0xe/0x10 [ 83.067738] [<ffffffff81088f6f>] task_work_run+0xaf/0xf0 [ 83.068971] [<ffffffff81013c5a>] do_notify_resume+0x7a/0x90 [ 83.070307] [<ffffffff816a6d87>] int_signal+0x12/0x17 [ 83.071464] Code: 55 41 54 53 48 89 fb 48 83 ec 18 4c 8b 7f 18 4c 8b 77 10 4c 8b 6f 20 e8 06 c7 4e 00 8b 53 44 4c 8b 53 20 89 d0 83 e0 02 83 f8 01 <41> 0f b7 02 45 19 e4 41 83 e4 08 41 83 c4 08 44 89 e1 66 25 00 [ 83.077450] RIP [<ffffffff811b65a9>] __fput+0x39/0x1e0 [ 83.078729] RSP <ffff88005204bea8> [ 83.079522] CR2: 0000000000000000 crash> bt -l PID: 8795 TASK: ffff88007a220000 CPU: 2 COMMAND: "sh" #0 [ffff88005204ba70] machine_kexec at ffffffff8104ef62 /usr/src/linux/arch/x86/kernel/machine_kexec_64.c: 320 #1 [ffff88005204bac0] crash_kexec at ffffffff810ed983 /usr/src/linux/kernel/kexec.c: 1482 #2 [ffff88005204bb90] oops_end at ffffffff810176e8 /usr/src/linux/arch/x86/kernel/dumpstack.c: 231 #3 [ffff88005204bbc0] no_context at ffffffff8169af1f /usr/src/linux/arch/x86/mm/fault.c: 724 #4 [ffff88005204bc20] __bad_area_nosemaphore at ffffffff8169aff6 /usr/src/linux/arch/x86/mm/fault.c: 804 #5 [ffff88005204bc70] bad_area at ffffffff8169b31f /usr/src/linux/arch/x86/mm/fault.c: 833 #6 [ffff88005204bca0] __do_page_fault at ffffffff81059b37 /usr/src/linux/arch/x86/mm/fault.c: 1213 #7 [ffff88005204bdc0] do_page_fault at ffffffff81059c11 /usr/src/linux/arch/x86/mm/fault.c: 1295 #8 [ffff88005204bdf0] page_fault at ffffffff816a8a28 /usr/src/linux/arch/x86/kernel/entry_64.S: 1283 [exception RIP: __fput+57] RIP: ffffffff811b65a9 RSP: ffff88005204bea8 RFLAGS: 00010297 RAX: 0000000000000000 RBX: ffff88007aff3500 RCX: 0000000000000a0a RDX: 000000000002801d RSI: 000000000000000a RDI: ffff88007aff3500 RBP: ffff88005204bee8 R8: ffff88007cbfd000 R9: 0000000180080006 R10: 0000000000000000 R11: ffffea0001f2fe00 R12: ffffffff81e6c040 R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 ORIG_RAX: ffffffffffffffff CS: 0010 SS: 0018 #9 [ffff88005204bef0] ____fput at ffffffff811b679e /usr/src/linux/fs/file_table.c: 245 #10 [ffff88005204bf00] task_work_run at ffffffff81088f6f /usr/src/linux/kernel/task_work.c: 125 #11 [ffff88005204bf30] do_notify_resume at ffffffff81013c5a /usr/src/linux/include/linux/tracehook.h: 190 #12 [ffff88005204bf50] int_signal at ffffffff816a6d87 /usr/src/linux/arch/x86/kernel/entry_64.S: 587 RIP: 00007f1361d5f420 RSP: 00007fff77be5740 RFLAGS: 00000200 RAX: 0000000000000000 RBX: 0000000000000000 RCX: 0000000000000000 RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 RBP: 0000000000000000 R8: 0000000000000000 R9: 0000000000000000 R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000000 R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 ORIG_RAX: 000000000000003b CS: 0033 SS: 002b WARNING: possibly bogus exception frame ---------- Crash pattern 1 end ---------- ---------- Crash pattern 2 start ---------- [ 227.647021] [TTM] Failed allocating page table [ 227.875795] BUG: unable to handle kernel NULL pointer dereference at (null) [ 227.877714] IP: [<ffffffff81594c57>] skb_queue_tail+0x37/0x60 [ 227.879107] PGD 78adc067 PUD 78ada067 PMD 0 [ 227.880186] Oops: 0002 [#1] SMP [ 227.881017] Modules linked in: stap_fault_injection(OE) ip6t_rpfilter ip6t_REJECT nf_reject_ipv6 nf_conntrack_ipv6 nf_defrag_ipv6 ipt_REJECT nf_reject_ipv4 nf_conntrack_ipv4 nf_defrag_ipv4 xt_conntrack nf_conntrack ebtable_nat ebtable_broute bridge stp llc ebtable_filter ebtables ip6table_mangle ip6table_raw ip6table_filter ip6_tables iptable_mangle iptable_raw iptable_filter ip_tables coretemp crct10dif_pclmul crc32_pclmul crc32c_intel ghash_clmulni_intel dm_mirror aesni_intel dm_region_hash dm_log glue_helper dm_mod lrw gf128mul ablk_helper cryptd ppdev vmw_balloon microcode parport_pc serio_raw pcspkr parport vmw_vmci shpchp i2c_piix4 nfsd auth_rpcgss nfs_acl lockd grace sunrpc uinput ata_generic pata_acpi sd_mod ata_piix libata mptspi scsi_transport_spi e1000 mptscsih mptbase floppy [ 227.898988] CPU: 2 PID: 610 Comm: Xorg Tainted: G W OE 3.19.0-rc5+ #28 [ 227.900691] Hardware name: VMware, Inc. VMware Virtual Platform/440BX Desktop Reference Platform, BIOS 6.00 07/31/2013 [ 227.903162] task: ffff8800788c6040 ti: ffff8800792d8000 task.ti: ffff8800792d8000 [ 227.904884] RIP: 0010:[<ffffffff81594c57>] [<ffffffff81594c57>] skb_queue_tail+0x37/0x60 [ 227.906816] RSP: 0018:ffff8800792dbbc8 EFLAGS: 00010046 [ 227.908056] RAX: 0000000000000292 RBX: ffff88007cbc6d10 RCX: 0000000000000000 [ 227.909718] RDX: 0000000000000000 RSI: 0000000000000292 RDI: ffff88007cbc6d24 [ 227.911376] RBP: ffff8800792dbbe8 R08: 0000000000000292 R09: 0180000002800000 [ 227.913027] R10: 0000000700020008 R11: 0000000000000000 R12: ffff88007b65aa00 [ 227.914690] R13: ffff88007cbc6d24 R14: 0000000000000000 R15: ffff88007cbc6c80 [ 227.916356] FS: 00007f3d07740980(0000) GS:ffff88007fc80000(0000) knlGS:0000000000000000 [ 227.918232] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 227.919559] CR2: 0000000000000000 CR3: 0000000078add000 CR4: 00000000000407e0 [ 227.921261] Stack: [ 227.921744] 0000000000000078 ffff88007b65aa00 0000000000000078 0000000000000000 [ 227.923618] ffff8800792dbca8 ffffffff816491bd ffff88007cbc6d10 ffff8800792dbd10 [ 227.925427] 0000007800000000 ffff8800792dbcc8 0000000000000078 ffff88007cbc6f78 [ 227.927271] Call Trace: [ 227.927872] [<ffffffff816491bd>] unix_stream_sendmsg+0x1dd/0x430 [ 227.929301] [<ffffffff8158c0c3>] sock_aio_write+0x103/0x140 [ 227.930638] [<ffffffff811b42ec>] do_sync_readv_writev+0x4c/0x80 [ 227.932047] [<ffffffff811b5c95>] do_readv_writev+0x1e5/0x280 [ 227.933406] [<ffffffff8101fe4b>] ? __restore_xstate_sig+0x8b/0x680 [ 227.934865] [<ffffffff81104424>] ? __audit_syscall_entry+0xb4/0x110 [ 227.936371] [<ffffffff811b5db9>] vfs_writev+0x39/0x50 [ 227.937565] [<ffffffff811b5eea>] SyS_writev+0x4a/0xd0 [ 227.938777] [<ffffffff816a6d6c>] ? int_check_syscall_exit_work+0x34/0x3d [ 227.940364] [<ffffffff816a6ae9>] system_call_fastpath+0x12/0x17 [ 227.941775] Code: 8d 6f 14 41 54 49 89 f4 53 48 89 fb 4c 89 ef 48 83 ec 08 e8 dc 1a 11 00 48 8b 53 08 49 89 1c 24 4c 89 ef 48 89 c6 49 89 54 24 08 <4c> 89 22 83 43 10 01 4c 89 63 08 e8 09 17 11 00 48 83 c4 08 5b [ 227.947880] RIP [<ffffffff81594c57>] skb_queue_tail+0x37/0x60 [ 227.949297] RSP <ffff8800792dbbc8> [ 227.950112] CR2: 0000000000000000 crash> bt -l PID: 610 TASK: ffff8800788c6040 CPU: 2 COMMAND: "Xorg" #0 [ffff8800792db790] machine_kexec at ffffffff8104ef62 /usr/src/linux/arch/x86/kernel/machine_kexec_64.c: 320 #1 [ffff8800792db7e0] crash_kexec at ffffffff810ed983 /usr/src/linux/kernel/kexec.c: 1482 #2 [ffff8800792db8b0] oops_end at ffffffff810176e8 /usr/src/linux/arch/x86/kernel/dumpstack.c: 231 #3 [ffff8800792db8e0] no_context at ffffffff8169af1f /usr/src/linux/arch/x86/mm/fault.c: 724 #4 [ffff8800792db940] __bad_area_nosemaphore at ffffffff8169aff6 /usr/src/linux/arch/x86/mm/fault.c: 804 #5 [ffff8800792db990] bad_area at ffffffff8169b31f /usr/src/linux/arch/x86/mm/fault.c: 833 #6 [ffff8800792db9c0] __do_page_fault at ffffffff81059b37 /usr/src/linux/arch/x86/mm/fault.c: 1213 #7 [ffff8800792dbae0] do_page_fault at ffffffff81059c11 /usr/src/linux/arch/x86/mm/fault.c: 1295 #8 [ffff8800792dbb10] page_fault at ffffffff816a8a28 /usr/src/linux/arch/x86/kernel/entry_64.S: 1283 [exception RIP: skb_queue_tail+55] RIP: ffffffff81594c57 RSP: ffff8800792dbbc8 RFLAGS: 00010046 RAX: 0000000000000292 RBX: ffff88007cbc6d10 RCX: 0000000000000000 RDX: 0000000000000000 RSI: 0000000000000292 RDI: ffff88007cbc6d24 RBP: ffff8800792dbbe8 R8: 0000000000000292 R9: 0180000002800000 R10: 0000000700020008 R11: 0000000000000000 R12: ffff88007b65aa00 R13: ffff88007cbc6d24 R14: 0000000000000000 R15: ffff88007cbc6c80 ORIG_RAX: ffffffffffffffff CS: 0010 SS: 0018 #9 [ffff8800792dbbf0] unix_stream_sendmsg at ffffffff816491bd /usr/src/linux/net/unix/af_unix.c: 1711 #10 [ffff8800792dbcb0] sock_aio_write at ffffffff8158c0c3 /usr/src/linux/net/socket.c: 955 #11 [ffff8800792dbd90] do_sync_readv_writev at ffffffff811b42ec /usr/src/linux/fs/read_write.c: 697 #12 [ffff8800792dbe20] do_readv_writev at ffffffff811b5c95 /usr/src/linux/fs/read_write.c: 851 #13 [ffff8800792dbf20] vfs_writev at ffffffff811b5db9 /usr/src/linux/fs/read_write.c: 893 #14 [ffff8800792dbf30] sys_writev at ffffffff811b5eea /usr/src/linux/fs/read_write.c: 926 #15 [ffff8800792dbf80] system_call_fastpath at ffffffff816a6ae9 /usr/src/linux/arch/x86/kernel/entry_64.S: 423 RIP: 00007f3d056223c0 RSP: 00007ffff316be40 RFLAGS: 00003293 RAX: ffffffffffffffda RBX: ffffffff816a6ae9 RCX: ffffffffffffffff RDX: 0000000000000001 RSI: 00007ffff316af90 RDI: 0000000000000014 RBP: 0000000001d59be0 R8: 0000000000000000 R9: 0000000000000004 R10: 00000000ffffffff R11: 0000000000003293 R12: 00007f3d077406a0 R13: 0000000000000001 R14: 00007ffff316af90 R15: 0000000000000000 ORIG_RAX: 0000000000000014 CS: 0033 SS: 002b ---------- Crash pattern 2 end ---------- ---------- Crash pattern 3 start ---------- [ 88.675004] [TTM] Failed allocating page table [ 88.678152] BUG: unable to handle kernel paging request at ffff8801531d77c0 [ 88.679845] IP: [<ffffffff815964b5>] __alloc_skb+0x165/0x2b0 [ 88.681221] PGD 1f2b067 PUD 0 [ 88.682000] Oops: 0002 [#1] SMP [ 88.682838] Modules linked in: stap_fault_injection(OE) ip6t_rpfilter ip6t_REJECT nf_reject_ipv6 nf_conntrack_ipv6 nf_defrag_ipv6 ipt_REJECT nf_reject_ipv4 nf_conntrack_ipv4 nf_defrag_ipv4 xt_conntrack nf_conntrack ebtable_nat ebtable_broute bridge stp llc ebtable_filter ebtables ip6table_mangle ip6table_raw ip6table_filter ip6_tables iptable_mangle iptable_raw iptable_filter ip_tables coretemp crct10dif_pclmul crc32_pclmul crc32c_intel ghash_clmulni_intel dm_mirror dm_region_hash aesni_intel dm_log glue_helper dm_mod lrw gf128mul ablk_helper cryptd ppdev vmw_balloon microcode serio_raw pcspkr parport_pc shpchp vmw_vmci parport i2c_piix4 nfsd auth_rpcgss nfs_acl lockd grace sunrpc uinput sd_mod ata_generic pata_acpi e1000 ata_piix libata mptspi scsi_transport_spi mptscsih mptbase floppy [ 88.701377] CPU: 0 PID: 3904 Comm: gnome-shell Tainted: G W OE 3.19.0-rc5+ #31 [ 88.703292] Hardware name: VMware, Inc. VMware Virtual Platform/440BX Desktop Reference Platform, BIOS 6.00 07/31/2013 [ 88.705840] task: ffff880079e05780 ti: ffff88007918c000 task.ti: ffff88007918c000 [ 88.707575] RIP: 0010:[<ffffffff815964b5>] [<ffffffff815964b5>] __alloc_skb+0x165/0x2b0 [ 88.709601] RSP: 0018:ffff88007918faa8 EFLAGS: 00010246 [ 88.710884] RAX: 00000000ffffffff RBX: ffff8800531d7700 RCX: 00000000ffffffff [ 88.712584] RDX: ffff8801531d77c0 RSI: 0000000000000000 RDI: ffff8800531d77c8 [ 88.714260] RBP: ffff88007918faf8 R08: 00000000ffffffc0 R09: 0000000000000200 [ 88.715927] R10: ffffffff8159639e R11: ffff88007f803700 R12: ffff8800531d7800 [ 88.717648] R13: 00000000ffffffff R14: ffff88007f803700 R15: 0000000000000100 [ 88.719327] FS: 00007fcafd8aaa00(0000) GS:ffff88007fc00000(0000) knlGS:0000000000000000 [ 88.721216] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 88.722548] CR2: ffff8801531d77c0 CR3: 00000000790ae000 CR4: 00000000000407f0 [ 88.724257] Stack: [ 88.724761] ffff88007a2cdf00 000000007a01b800 0000000000000246 00ff88007918fcd8 [ 88.726741] ffff88007918fae8 0000000000000003 0000000000000000 ffff88007918fba8 [ 88.728578] ffff88007a01b800 0000000000000000 ffff88007918fb58 ffffffff81596d5c [ 88.730582] Call Trace: [ 88.731243] [<ffffffff81596d5c>] alloc_skb_with_frags+0x5c/0x1e0 [ 88.732725] [<ffffffff811c99bc>] ? do_sys_poll+0x12c/0x5b0 [ 88.734208] [<ffffffff815910b6>] sock_alloc_send_pskb+0x196/0x250 [ 88.735710] [<ffffffff8159b887>] ? skb_copy_datagram_from_iter+0xe7/0x200 [ 88.737361] [<ffffffff8164ba07>] ? wait_for_unix_gc+0x27/0xa0 [ 88.738784] [<ffffffff8164928a>] unix_stream_sendmsg+0x2aa/0x430 [ 88.740213] [<ffffffff8158c0c3>] sock_aio_write+0x103/0x140 [ 88.741610] [<ffffffff811c8860>] ? poll_select_copy_remaining+0x130/0x130 [ 88.743278] [<ffffffff811b42ec>] do_sync_readv_writev+0x4c/0x80 [ 88.744721] [<ffffffff811b5c95>] do_readv_writev+0x1e5/0x280 [ 88.746109] [<ffffffff8158bf9d>] ? SYSC_recvfrom+0x13d/0x160 [ 88.747452] [<ffffffff81104424>] ? __audit_syscall_entry+0xb4/0x110 [ 88.748992] [<ffffffff811b5db9>] vfs_writev+0x39/0x50 [ 88.750192] [<ffffffff811b5eea>] SyS_writev+0x4a/0xd0 [ 88.751423] [<ffffffff811046b6>] ? __audit_syscall_exit+0x236/0x2e0 [ 88.753121] [<ffffffff816a6ae9>] system_call_fastpath+0x12/0x17 [ 88.754650] Code: b6 83 90 00 00 00 83 e0 f7 09 c8 b9 ff ff ff ff 85 f6 88 83 90 00 00 00 b8 ff ff ff ff 66 89 8b c2 00 00 00 66 89 83 c6 00 00 00 <48> c7 02 00 00 00 00 48 c7 42 08 00 00 00 00 48 c7 42 10 00 00 [ 88.761554] RIP [<ffffffff815964b5>] __alloc_skb+0x165/0x2b0 [ 88.763077] RSP <ffff88007918faa8> [ 88.763978] CR2: ffff8801531d77c0 crash> bt -l PID: 3904 TASK: ffff880079e05780 CPU: 0 COMMAND: "gnome-shell" #0 [ffff88007918f690] machine_kexec at ffffffff8104ef62 /usr/src/linux/arch/x86/kernel/machine_kexec_64.c: 320 #1 [ffff88007918f6e0] crash_kexec at ffffffff810ed983 /usr/src/linux/kernel/kexec.c: 1482 #2 [ffff88007918f7b0] oops_end at ffffffff810176e8 /usr/src/linux/arch/x86/kernel/dumpstack.c: 231 #3 [ffff88007918f7e0] no_context at ffffffff8169af1f /usr/src/linux/arch/x86/mm/fault.c: 724 #4 [ffff88007918f840] __bad_area_nosemaphore at ffffffff8169aff6 /usr/src/linux/arch/x86/mm/fault.c: 804 #5 [ffff88007918f890] bad_area_nosemaphore at ffffffff8169b162 /usr/src/linux/arch/x86/mm/fault.c: 812 #6 [ffff88007918f8a0] __do_page_fault at ffffffff810596f8 /usr/src/linux/arch/x86/mm/fault.c: 1277 #7 [ffff88007918f9c0] do_page_fault at ffffffff81059c11 /usr/src/linux/arch/x86/mm/fault.c: 1295 #8 [ffff88007918f9f0] page_fault at ffffffff816a8a28 /usr/src/linux/arch/x86/kernel/entry_64.S: 1283 [exception RIP: __alloc_skb+357] RIP: ffffffff815964b5 RSP: ffff88007918faa8 RFLAGS: 00010246 RAX: 00000000ffffffff RBX: ffff8800531d7700 RCX: 00000000ffffffff RDX: ffff8801531d77c0 RSI: 0000000000000000 RDI: ffff8800531d77c8 RBP: ffff88007918faf8 R8: 00000000ffffffc0 R9: 0000000000000200 R10: ffffffff8159639e R11: ffff88007f803700 R12: ffff8800531d7800 R13: 00000000ffffffff R14: ffff88007f803700 R15: 0000000000000100 ORIG_RAX: ffffffffffffffff CS: 0010 SS: 0018 #9 [ffff88007918fb00] alloc_skb_with_frags at ffffffff81596d5c /usr/src/linux/net/core/skbuff.c: 4386 #10 [ffff88007918fb60] sock_alloc_send_pskb at ffffffff815910b6 /usr/src/linux/net/core/sock.c: 1826 #11 [ffff88007918fbf0] unix_stream_sendmsg at ffffffff8164928a /usr/src/linux/net/unix/af_unix.c: 1682 #12 [ffff88007918fcb0] sock_aio_write at ffffffff8158c0c3 /usr/src/linux/net/socket.c: 955 #13 [ffff88007918fd90] do_sync_readv_writev at ffffffff811b42ec /usr/src/linux/fs/read_write.c: 697 #14 [ffff88007918fe20] do_readv_writev at ffffffff811b5c95 /usr/src/linux/fs/read_write.c: 851 #15 [ffff88007918ff20] vfs_writev at ffffffff811b5db9 /usr/src/linux/fs/read_write.c: 893 #16 [ffff88007918ff30] sys_writev at ffffffff811b5eea /usr/src/linux/fs/read_write.c: 926 #17 [ffff88007918ff80] system_call_fastpath at ffffffff816a6ae9 /usr/src/linux/arch/x86/kernel/entry_64.S: 423 RIP: 00007fcaf3c273c0 RSP: 00007fffadd91330 RFLAGS: 00000246 RAX: ffffffffffffffda RBX: ffffffff816a6ae9 RCX: 00007fffadd91360 RDX: 0000000000000002 RSI: 00007fffadd914b0 RDI: 0000000000000006 RBP: 0000000000b5c230 R8: 0000000000000000 R9: 0000000000000000 R10: 0000000000000000 R11: 0000000000000293 R12: 00007fffadd91428 R13: 00007fffadd91424 R14: 0000000000b5c248 R15: 0000000000000001 ORIG_RAX: 0000000000000014 CS: 0033 SS: 002b ---------- Crash pattern 3 end ---------- ---------- Failed memory allocation start ---------- 0xffffffff81199850 : __kmalloc+0x0/0x280 [kernel] /usr/src/linux/mm/slub.c:3247 0xffffffff814676fa : ttm_tt_init+0x8a/0xb0 [kernel] /usr/src/linux/include/linux/slab.h:524 /usr/src/linux/include/linux/slab.h:535 /usr/src/linux/include/drm/drm_mem_util.h:38 /usr/src/linux/drivers/gpu/drm/ttm/ttm_tt.c:53 /usr/src/linux/drivers/gpu/drm/ttm/ttm_tt.c:200 0xffffffff8147caa6 : vmw_ttm_tt_create+0x76/0xb0 [kernel] /usr/src/linux/drivers/gpu/drm/vmwgfx/vmwgfx_buffer.c:700 0xffffffff81467b8d : ttm_bo_add_ttm+0x9d/0xe0 [kernel] /usr/src/linux/drivers/gpu/drm/ttm/ttm_bo.c:238 0xffffffff8146a2ff : ttm_bo_validate+0x14f/0x1f0 [kernel] /usr/src/linux/drivers/gpu/drm/ttm/ttm_bo.c:1067 0xffffffff8146a5d4 : ttm_bo_init+0x234/0x470 [kernel] /usr/src/linux/drivers/gpu/drm/ttm/ttm_bo.c:1167 0xffffffff8147ae9e : vmw_dmabuf_init+0x13e/0x240 [kernel] /usr/src/linux/drivers/gpu/drm/vmwgfx/vmwgfx_resource.c:435 0xffffffff8147b0cb : vmw_user_dmabuf_alloc+0x8b/0x120 [kernel] /usr/src/linux/drivers/gpu/drm/vmwgfx/vmwgfx_resource.c:503 0xffffffff8147b202 : vmw_dmabuf_alloc_ioctl+0x52/0xb0 [kernel] /usr/src/linux/drivers/gpu/drm/vmwgfx/vmwgfx_resource.c:698 0xffffffff814497a4 : drm_ioctl+0x1a4/0x630 [kernel] /usr/src/linux/drivers/gpu/drm/drm_ioctl.c:727 0xffffffff814773c9 : vmw_generic_ioctl+0x169/0x260 [kernel] /usr/src/linux/drivers/gpu/drm/vmwgfx/vmwgfx_drv.c:1073 0xffffffff814774f5 : vmw_unlocked_ioctl+0x15/0x20 [kernel] /usr/src/linux/drivers/gpu/drm/vmwgfx/vmwgfx_drv.c:1084 0xffffffff811c7c18 : do_vfs_ioctl+0x2f8/0x510 [kernel] /usr/src/linux/fs/ioctl.c:44 /usr/src/linux/fs/ioctl.c:602 0xffffffff811c7e71 : sys_ioctl+0x41/0x80 [kernel] /usr/src/linux/include/linux/file.h:38 /usr/src/linux/fs/ioctl.c:618 /usr/src/linux/fs/ioctl.c:608 0xffffffff816a6ae9 : system_call_fastpath+0x12/0x17 [kernel] /usr/src/linux/arch/x86/kernel/entry_64.S:423 ---------- Failed memory allocation end ---------- If I skip ttm_tt_destroy() call, this bug no longer occurs. Therefore, I guess that this memory corruption is caused by the destroy function being called with partially initialized ttm object. --- a/drivers/gpu/drm/ttm/ttm_tt.c +++ b/drivers/gpu/drm/ttm/ttm_tt.c @@ -199,8 +199,8 @@ int ttm_tt_init(struct ttm_tt *ttm, struct ttm_bo_device *bdev, ttm_tt_alloc_page_directory(ttm); if (!ttm->pages) { - ttm_tt_destroy(ttm); - pr_err("Failed allocating page table\n"); + //ttm_tt_destroy(ttm); + pr_err("Failed allocating page table, but skip ttm_tt_destroy()\n"); return -ENOMEM; } return 0; I can reproduce this problem at least since 3.13.0. I don't know whether this problem is specific to vmwgfx code or not, for I tested only CentOS 7 with GUI environment on VMware Player 6. I think you can reproduce this problem by starting a SystemTap script shown below and then flipping windows using from Ctrl-Alt-F1 to Ctrl-Alt-F7 . ---------- Reproducer start ---------- # stap -g -e 'global is_target%; probe begin { printf("Probe start!\n"); } probe module("ttm").function("ttm_tt_init") { is_target[tid()] = 1; } probe module("ttm").function("ttm_tt_init").return { is_target[tid()] = 0; } probe kernel.function("__kmalloc") { if (($flags & %{ __GFP_NOFAIL | __GFP_WAIT %} ) == %{ __GFP_WAIT %} && is_target[tid()]) { print_backtrace(); $size = 1 << 30; exit(); } } probe end { delete is_target; }' ---------- Reproducer end ---------- I can also reproduce below problem using 3.10.0-123.9.3.el7.x86_64 , though below problem might be different from above problem. ---------- Crash pattern 4 start ---------- [TTM] Failed allocating page table ------------[ cut here ]------------ WARNING: at lib/list_debug.c:33 __list_add+0xac/0xc0() list_add corruption. prev->next should be next (ffff88007af4cd98), but was (null). (prev=ffff88007ac881f0). Modules linked in: fuse btrfs zlib_deflate raid6_pq xor vfat msdos fat ext4 mbcache jbd2 netconsole ip6t_rpfilter ip6t_REJECT ipt_REJECT xt_conntrack ebtable_nat ebtable_broute bridge stp llc ebtable_filter ebtables ip6table_nat nf_conntrack_ipv6 nf_defrag_ipv6 nf_nat_ipv6 ip6table_mangle ip6table_security ip6table_raw ip6table_filter ip6_tables iptable_nat nf_conntrack_ipv4 nf_defrag_ipv4 nf_nat_ipv4 nf_nat nf_conntrack iptable_mangle iptable_security iptable_raw iptable_filter ip_tables sg coretemp crct10dif_pclmul crc32_pclmul ghash_clmulni_intel aesni_intel lrw gf128mul ppdev glue_helper vmw_balloon ablk_helper cryptd serio_raw parport_pc i2c_piix4 parport vmw_vmci pcspkr dm_mirror shpchp dm_region_hash dm_log mperf dm_mod nfsd auth_rpcgss nfs_acl lockd sunrpc uinput xfs libcrc32c sr_mod cdrom sd_mod crc_t10dif crct10dif_common ata_generic pata_acpi crc32c_intel vmwgfx mptspi ttm scsi_transport_spi mptscsih ahci ata_piix libahci drm mptbase libata e1000 i2c_core floppy [last unloaded: stap_bad36894e80d53e8ee72ce3ee48a27ac_3394] CPU: 0 PID: 849 Comm: Xorg Tainted: GF W O-------------- 3.10.0-123.9.3.el7.x86_64 #1 Hardware name: VMware, Inc. VMware Virtual Platform/440BX Desktop Reference Platform, BIOS 6.00 07/31/2013 ffff88007984da10 00000000da42f7a4 ffff88007984d9c8 ffffffff815e239b ffff88007984da00 ffffffff8105dee1 ffff88007ac881f0 ffff88007af4cd98 ffff88007ac881f0 0000000000000282 ffff88007984db98 ffff88007984da68 Call Trace: [<ffffffff815e239b>] dump_stack+0x19/0x1b [<ffffffff8105dee1>] warn_slowpath_common+0x61/0x80 [<ffffffff8105df5c>] warn_slowpath_fmt+0x5c/0x80 [<ffffffff812cfeec>] __list_add+0xac/0xc0 [<ffffffffa01a56e9>] vmw_fence_create+0xd9/0x130 [vmwgfx] [<ffffffffa0197ef8>] vmw_execbuf_fence_commands+0xc8/0x120 [vmwgfx] [<ffffffffa01987b8>] vmw_execbuf_process+0x4f8/0xbe0 [vmwgfx] [<ffffffff81194585>] ? __kmalloc+0x55/0x230 [<ffffffffa0199af8>] do_dmabuf_dirty_sou.isra.9+0x328/0x3c0 [vmwgfx] [<ffffffffa00da00c>] ? ttm_read_lock+0x2c/0xd0 [ttm] [<ffffffffa00d50a1>] ? ttm_bo_add_to_lru+0x51/0xc0 [ttm] [<ffffffffa0199d50>] vmw_framebuffer_dmabuf_dirty+0x1c0/0x1f0 [vmwgfx] [<ffffffff81194723>] ? __kmalloc+0x1f3/0x230 [<ffffffffa012d3f0>] drm_mode_dirtyfb_ioctl+0xe0/0x190 [drm] [<ffffffffa011cdb2>] drm_ioctl+0x502/0x630 [drm] [<ffffffff815edbb4>] ? __do_page_fault+0x204/0x540 [<ffffffff812c0e64>] ? timerqueue_del+0x24/0x70 [<ffffffff81089486>] ? __remove_hrtimer+0x46/0xa0 [<ffffffffa019ca71>] vmw_unlocked_ioctl+0x51/0x80 [vmwgfx] [<ffffffff811c2b25>] do_vfs_ioctl+0x2e5/0x4c0 [<ffffffff810650d6>] ? do_setitimer+0xe6/0x2a0 [<ffffffff811c2da1>] SyS_ioctl+0xa1/0xc0 [<ffffffff815f2a99>] system_call_fastpath+0x16/0x1b ---[ end trace a993c155f4775b96 ]--- ------------[ cut here ]------------ WARNING: at lib/list_debug.c:36 __list_add+0x8a/0xc0() list_add double add: new=ffff88007ac881f0, prev=ffff88007ac881f0, next=ffff88007af4cd98. Modules linked in: fuse btrfs zlib_deflate raid6_pq xor vfat msdos fat ext4 mbcache jbd2 netconsole ip6t_rpfilter ip6t_REJECT ipt_REJECT xt_conntrack ebtable_nat ebtable_broute bridge stp llc ebtable_filter ebtables ip6table_nat nf_conntrack_ipv6 nf_defrag_ipv6 nf_nat_ipv6 ip6table_mangle ip6table_security ip6table_raw ip6table_filter ip6_tables iptable_nat nf_conntrack_ipv4 nf_defrag_ipv4 nf_nat_ipv4 nf_nat nf_conntrack iptable_mangle iptable_security iptable_raw iptable_filter ip_tables sg coretemp crct10dif_pclmul crc32_pclmul ghash_clmulni_intel aesni_intel lrw gf128mul ppdev glue_helper vmw_balloon ablk_helper cryptd serio_raw parport_pc i2c_piix4 parport vmw_vmci pcspkr dm_mirror shpchp dm_region_hash dm_log mperf dm_mod nfsd auth_rpcgss nfs_acl lockd sunrpc uinput xfs libcrc32c sr_mod cdrom sd_mod crc_t10dif crct10dif_common ata_generic pata_acpi crc32c_intel vmwgfx mptspi ttm scsi_transport_spi mptscsih ahci ata_piix libahci drm mptbase libata e1000 i2c_core floppy [last unloaded: stap_bad36894e80d53e8ee72ce3ee48a27ac_3394] CPU: 0 PID: 849 Comm: Xorg Tainted: GF W O-------------- 3.10.0-123.9.3.el7.x86_64 #1 Hardware name: VMware, Inc. VMware Virtual Platform/440BX Desktop Reference Platform, BIOS 6.00 07/31/2013 ffff88007984da10 00000000da42f7a4 ffff88007984d9c8 ffffffff815e239b ffff88007984da00 ffffffff8105dee1 ffff88007ac881f0 ffff88007af4cd98 ffff88007ac881f0 0000000000000282 ffff88007984db98 ffff88007984da68 Call Trace: [<ffffffff815e239b>] dump_stack+0x19/0x1b [<ffffffff8105dee1>] warn_slowpath_common+0x61/0x80 [<ffffffff8105df5c>] warn_slowpath_fmt+0x5c/0x80 [<ffffffff812cfeca>] __list_add+0x8a/0xc0 [<ffffffffa01a56e9>] vmw_fence_create+0xd9/0x130 [vmwgfx] [<ffffffffa0197ef8>] vmw_execbuf_fence_commands+0xc8/0x120 [vmwgfx] [<ffffffffa01987b8>] vmw_execbuf_process+0x4f8/0xbe0 [vmwgfx] [<ffffffff81194585>] ? __kmalloc+0x55/0x230 [<ffffffffa0199af8>] do_dmabuf_dirty_sou.isra.9+0x328/0x3c0 [vmwgfx] [<ffffffffa00da00c>] ? ttm_read_lock+0x2c/0xd0 [ttm] [<ffffffffa00d50a1>] ? ttm_bo_add_to_lru+0x51/0xc0 [ttm] [<ffffffffa0199d50>] vmw_framebuffer_dmabuf_dirty+0x1c0/0x1f0 [vmwgfx] [<ffffffff81194723>] ? __kmalloc+0x1f3/0x230 [<ffffffffa012d3f0>] drm_mode_dirtyfb_ioctl+0xe0/0x190 [drm] [<ffffffffa011cdb2>] drm_ioctl+0x502/0x630 [drm] [<ffffffff815edbb4>] ? __do_page_fault+0x204/0x540 [<ffffffff812c0e64>] ? timerqueue_del+0x24/0x70 [<ffffffff81089486>] ? __remove_hrtimer+0x46/0xa0 [<ffffffffa019ca71>] vmw_unlocked_ioctl+0x51/0x80 [vmwgfx] [<ffffffff811c2b25>] do_vfs_ioctl+0x2e5/0x4c0 [<ffffffff810650d6>] ? do_setitimer+0xe6/0x2a0 [<ffffffff811c2da1>] SyS_ioctl+0xa1/0xc0 [<ffffffff815f2a99>] system_call_fastpath+0x16/0x1b ---[ end trace a993c155f4775b97 ]--- INFO: rcu_sched detected stalls on CPUs/tasks: { 0} (detected by 1, t=60019 jiffies, g=6722, c=6721, q=0) sending NMI to all CPUs: NMI backtrace for cpu 0 CPU: 0 PID: 849 Comm: Xorg Tainted: GF W O-------------- 3.10.0-123.9.3.el7.x86_64 #1 Hardware name: VMware, Inc. VMware Virtual Platform/440BX Desktop Reference Platform, BIOS 6.00 07/31/2013 task: ffff880077655b00 ti: ffff88007984c000 task.ti: ffff88007984c000 RIP: 0010:[<ffffffff8108ece5>] [<ffffffff8108ece5>] __wake_up_common+0x5/0x90 RSP: 0018:ffff88007984d9d0 EFLAGS: 00000046 RAX: 0000000000000046 RBX: ffff88007ac88220 RCX: 0000000000000000 RDX: 0000000000000000 RSI: 0000000000000003 RDI: ffff88007ac88220 RBP: ffff88007984da00 R08: 0000000000000000 R09: ffff88007f617320 R10: ffffea000173f700 R11: ffffffffa01a462d R12: 0000000000000046 R13: 0000000000000003 R14: 0000000000000000 R15: 0000000000000000 FS: 00007faaaca78980(0000) GS:ffff88007f600000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007faaa4b3c000 CR3: 000000007baaf000 CR4: 00000000000407f0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000400 Stack: ffffffff81090af9 ffff88007af4cd80 ffff88007ac881e0 ffff88007ac881f0 ffff88007984da48 ffff88007ac881e0 ffff88007984da88 ffffffffa01a524b ffffc90008680018 ffff88007af4cda8 ffff88007af4cdd8 0000000000000292 Call Trace: [<ffffffff81090af9>] ? __wake_up+0x39/0x50 [<ffffffffa01a524b>] vmw_fences_update+0x11b/0x220 [vmwgfx] [<ffffffffa01a2568>] vmw_update_seqno+0x48/0x50 [vmwgfx] [<ffffffffa01a2073>] vmw_fifo_send_fence+0x93/0xe0 [vmwgfx] [<ffffffffa0197e85>] vmw_execbuf_fence_commands+0x55/0x120 [vmwgfx] [<ffffffffa01987b8>] vmw_execbuf_process+0x4f8/0xbe0 [vmwgfx] [<ffffffffa01998d0>] do_dmabuf_dirty_sou.isra.9+0x100/0x3c0 [vmwgfx] [<ffffffffa00da00c>] ? ttm_read_lock+0x2c/0xd0 [ttm] [<ffffffffa00d50a1>] ? ttm_bo_add_to_lru+0x51/0xc0 [ttm] [<ffffffffa0199d50>] vmw_framebuffer_dmabuf_dirty+0x1c0/0x1f0 [vmwgfx] [<ffffffff81194723>] ? __kmalloc+0x1f3/0x230 [<ffffffffa012d3f0>] drm_mode_dirtyfb_ioctl+0xe0/0x190 [drm] [<ffffffffa011cdb2>] drm_ioctl+0x502/0x630 [drm] [<ffffffff815edbb4>] ? __do_page_fault+0x204/0x540 [<ffffffff812c0e64>] ? timerqueue_del+0x24/0x70 [<ffffffff81089486>] ? __remove_hrtimer+0x46/0xa0 [<ffffffffa019ca71>] vmw_unlocked_ioctl+0x51/0x80 [vmwgfx] [<ffffffff811c2b25>] do_vfs_ioctl+0x2e5/0x4c0 [<ffffffff810650d6>] ? do_setitimer+0xe6/0x2a0 [<ffffffff811c2da1>] SyS_ioctl+0xa1/0xc0 [<ffffffff815f2a99>] system_call_fastpath+0x16/0x1b Code: 49 0f af c0 e9 64 ff ff ff 0f 1f 44 00 00 44 8d 4a ff 31 c0 45 31 c0 4d 63 c9 e9 4e ff ff ff 0f 1f 80 00 00 00 00 66 66 66 66 90 <55> 48 89 e5 41 57 41 89 f7 41 56 41 89 ce 41 55 41 54 4c 8d 67 ---------- Crash pattern 4 end ----------

4 3

[Bug 204181] New: NULL pointer dereference regression in amdgpu
by bugzilla-daemon＠bugzilla.kernel.org 26 Jul '20

26 Jul '20

https://bugzilla.kernel.org/show_bug.cgi?id=204181 Bug ID: 204181 Summary: NULL pointer dereference regression in amdgpu Product: Drivers Version: 2.5 Kernel Version: 5.2.1 Hardware: x86-64 OS: Linux Tree: Mainline Status: NEW Severity: high Priority: P1 Component: Video(DRI - non Intel) Assignee: drivers_video-dri(a)kernel-bugs.osdl.org Reporter: virtuousfox(a)gmail.com Regression: No Created attachment 283693 --> https://bugzilla.kernel.org/attachment.cgi?id=283693&action=edit dmesg After updating from 5.1 to 5.2.1 in about 5-10 minutes of watching a Youtube video in Firefox I now get complete lock-up of video output and inability to shutdown using power button. Using "magic keys" allows me to reboot and get kernel log via `journalctl -b -1 -k`, here is relevant part: BUG: kernel NULL pointer dereference, address: 00000000000002b4 #PF: supervisor read access in kernel mode #PF: error_code(0x0000) - not-present page PGD 0 P4D 0 Oops: 0000 [#1] PREEMPT SMP NOPTI CPU: 2 PID: 8200 Comm: kworker/u16:1 Tainted: G IO 5.2.1-1383.gd5bbc26-HSF #1 openSUSE Tumbleweed (unreleased) Hardware name: Gigabyte Technology Co., Ltd. GA-990XA-UD3/GA-990XA-UD3, BIOS F14e 09/09/2014 Workqueue: events_unbound commit_work RIP: 0010:dc_stream_log+0x6/0xb0 [amdgpu] Code: 04 00 00 49 8b bc 02 80 02 00 00 48 8b 07 48 8b 40 50 e8 ed 88 a8 d6 b8 01 00 00 00 c3 0f 1f 80 00 00 00 00 0f 1f 44 00 00 53 <8b> 86 b4 02 00 00 48 89 f3 48 89 f2 8b 8e 10 01 00 00 bf 04 00 00 RSP: 0018:ffffa5568b1b7c00 EFLAGS: 00010202 RAX: 0000000000000000 RBX: 0000000000000001 RCX: 0000000000000002 RDX: ffffffffc07fbd50 RSI: 0000000000000000 RDI: ffff8e9ee9500000 RBP: ffff8e9d90618000 R08: 0000000000000001 R09: 0000000000000000 R10: ffffa5568b1b7c30 R11: 0000000000000000 R12: ffff8e9ee9500000 R13: ffff8e9ededb4448 R14: ffff8e9e47e10c00 R15: ffff8e9ededa0000 FS: 0000000000000000(0000) GS:ffff8e9eee000000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00000000000002b4 CR3: 00000003bcf46000 CR4: 00000000000406e0 Call Trace: dc_commit_state+0x79/0xb0 [amdgpu] amdgpu_dm_atomic_commit_tail+0x3c0/0xdb0 [amdgpu] ? finish_task_switch+0x74/0x300 ? __switch_to+0x152/0x4e0 ? __switch_to_asm+0x34/0x70 ? __lock_acquire+0x3c8/0x7a0 ? find_held_lock+0x32/0x90 ? find_held_lock+0x32/0x90 ? sched_clock+0x5/0x10 ? mark_held_locks+0x2d/0x80 ? preempt_count_sub+0x98/0xe0 ? _raw_spin_unlock_irq+0x3a/0x50 ? wait_for_completion_timeout+0xe9/0x110 ? commit_tail+0x3c/0x70 commit_tail+0x3c/0x70 process_one_work+0x271/0x5f0 worker_thread+0x4a/0x3d0 ? process_one_work+0x5f0/0x5f0 kthread+0x118/0x140 ? kthread_create_worker_on_cpu+0x70/0x70 ret_from_fork+0x27/0x50 Modules linked in: af_packet ts_bm xt_pkttype xt_string nf_nat_ftp nf_conntrack_ftp xt_tcpudp ip6t_rpfilter ip6t_REJECT ipt_REJECT xt_conntrack ebtable_nat ip6table_nat ip6table_mangle ip6table_raw ip6table_security iptable_nat nf_nat iptable_mangle iptable_raw iptable_security nf_conntrack nf_defrag_ipv6 nf_defrag_ipv4 ip_set nfnetlink ebtable_filter ebtables scsi_transport_iscsi ip6table_filter ip6_tables iptable_filter ip_tables x_tables bpfilter snd_seq_dummy snd_seq_oss snd_seq_midi_event snd_seq zram snd_pcm_oss rfcomm snd_mixer_oss it87 hwmon_vid bnep msr rc_avermedia tuner_simple tuner_types amd64_edac_mod tuner tda7432 edac_mce_amd btusb tvaudio kvm_amd ath9k btrtl btbcm msp3400 ath9k_common btintel bluetooth ath9k_hw kvm irqbypass ath bttv tea575x joydev tveeprom videobuf_dma_sg snd_usb_audio videobuf_core snd_usbmidi_lib rc_core snd_rawmidi snd_hda_codec_realtek mac80211 snd_hda_codec_generic ledtrig_audio snd_hda_codec_hdmi v4l2_common snd_seq_device snd_hda_intel videodev sp5100_tco pcspkr snd_hda_codec wmi_bmof mxm_wmi amdgpu fam15h_power k10temp media i2c_piix4 cfg80211 r8169 snd_hda_core gpu_sched realtek snd_hwdep libphy ttm rfkill snd_pcm mac_hid hid_generic usbhid uas usb_storage ohci_pci serio_raw sd_mod ehci_pci ohci_hcd xhci_pci ehci_hcd xhci_hcd wmi exfat(O) l2tp_ppp l2tp_netlink l2tp_core ip6_udp_tunnel udp_tunnel pppox ppp_generic slhc vhba(O) uinput sg nbd dm_multipath scsi_dh_rdac scsi_dh_emc scsi_dh_alua ecryptfs CR2: 00000000000002b4 ---[ end trace 0633d97cb3f2d2d6 ]--- RIP: 0010:dc_stream_log+0x6/0xb0 [amdgpu] Code: 04 00 00 49 8b bc 02 80 02 00 00 48 8b 07 48 8b 40 50 e8 ed 88 a8 d6 b8 01 00 00 00 c3 0f 1f 80 00 00 00 00 0f 1f 44 00 00 53 <8b> 86 b4 02 00 00 48 89 f3 48 89 f2 8b 8e 10 01 00 00 bf 04 00 00 RSP: 0018:ffffa5568b1b7c00 EFLAGS: 00010202 RAX: 0000000000000000 RBX: 0000000000000001 RCX: 0000000000000002 RDX: ffffffffc07fbd50 RSI: 0000000000000000 RDI: ffff8e9ee9500000 RBP: ffff8e9d90618000 R08: 0000000000000001 R09: 0000000000000000 R10: ffffa5568b1b7c30 R11: 0000000000000000 R12: ffff8e9ee9500000 R13: ffff8e9ededb4448 R14: ffff8e9e47e10c00 R15: ffff8e9ededa0000 FS: 0000000000000000(0000) GS:ffff8e9eee000000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00000000000002b4 CR3: 00000003bcf46000 CR4: 00000000000406e0 -- You are receiving this mail because: You are watching the assignee of the bug.

1 67

[Bug 199475] New: AMDGPU Failed to blank
by bugzilla-daemon＠bugzilla.kernel.org 20 Jun '20

20 Jun '20

https://bugzilla.kernel.org/show_bug.cgi?id=199475 Bug ID: 199475 Summary: AMDGPU Failed to blank Product: Drivers Version: 2.5 Kernel Version: 4.15.18 Hardware: Other OS: Linux Tree: Mainline Status: NEW Severity: low Priority: P1 Component: Video(DRI - non Intel) Assignee: drivers_video-dri(a)kernel-bugs.osdl.org Reporter: andreassx0(a)gmail.com Regression: No Im getting this error on starup: drm:hwss_wait_for_blank_complete [amdgpu] *ERROR* DC: failed to blank crtc! -- You are receiving this mail because: You are watching the assignee of the bug.

1 9

[Bug 71891] New: 3.13 fails to boot with the radeon module
by bugzilla-daemon＠bugzilla.kernel.org 08 Jun '20

08 Jun '20

https://bugzilla.kernel.org/show_bug.cgi?id=71891 Bug ID: 71891 Summary: 3.13 fails to boot with the radeon module Product: Drivers Version: 2.5 Kernel Version: 3.13.6-1-ARCH Hardware: x86-64 OS: Linux Tree: Mainline Status: NEW Severity: high Priority: P1 Component: Video(DRI - non Intel) Assignee: drivers_video-dri(a)kernel-bugs.osdl.org Reporter: sh.siddhartha(a)gmail.com Regression: No $ lspci -k | grep -A3 VGA 01:00.0 VGA compatible controller: Advanced Micro Devices, Inc. [AMD/ATI] RV730/M96 [Mobility Radeon HD 4650/5165] Subsystem: Dell Device 0447 Kernel driver in use: fglrx_pci Kernel modules: radeon, fglrx Dell Inspiron N5010 (BIOS) Legacy catalyst works properly. Using the open source radeon driver either boots to tty login with above errors, or boots to a locked up black screen. drm syslog: [drm] Initialized drm 1.1.0 20060810 [drm] radeon kernel modesetting enabled. fb: conflicting fb hw usage radeondrmfb vs VESA VGA - removing generic driver [drm] initializing kernel modesetting (RV730 0x1002:0x9480 0x1028:0x0447). [drm] register mmio base: 0xFBE20000 [drm] register mmio size: 65536 [drm] Detected VRAM RAM=1024M, BAR=256M [drm] RAM width 128bits DDR [drm] radeon: 1024M of VRAM memory ready [drm] radeon: 1024M of GTT memory ready. [drm] GART: num cpu pages 262144, num gpu pages 262144 [drm] Loading RV730 Microcode [drm] PCIE GART of 1024M enabled (table at 0x000000000025D000). [drm] Supports vblank timestamp caching Rev 2 (21.10.2013). [drm] Driver supports precise vblank timestamp query. [drm] radeon: irq initialized. [drm] ring test on 0 succeeded in 1 usecs [drm] ring test on 3 succeeded in 1 usecs [drm:uvd_v1_0_start] *ERROR* UVD not responding, trying to reset the VCPU!!! [drm:uvd_v1_0_start] *ERROR* UVD not responding, trying to reset the VCPU!!! [drm:uvd_v1_0_start] *ERROR* UVD not responding, trying to reset the VCPU!!! [drm:uvd_v1_0_start] *ERROR* UVD not responding, trying to reset the VCPU!!! [drm:uvd_v1_0_start] *ERROR* UVD not responding, trying to reset the VCPU!!! [drm:uvd_v1_0_start] *ERROR* UVD not responding, trying to reset the VCPU!!! [drm:uvd_v1_0_start] *ERROR* UVD not responding, trying to reset the VCPU!!! [drm:uvd_v1_0_start] *ERROR* UVD not responding, trying to reset the VCPU!!! [drm:uvd_v1_0_start] *ERROR* UVD not responding, trying to reset the VCPU!!! [drm:uvd_v1_0_start] *ERROR* UVD not responding, trying to reset the VCPU!!! [drm:uvd_v1_0_start] *ERROR* UVD not responding, giving up!!! [drm:rv770_startup] *ERROR* radeon: failed initializing UVD (-1). [drm] Enabling audio 0 support [drm] ib test on ring 0 succeeded in 0 usecs [drm] ib test on ring 3 succeeded in 0 usecs [drm] radeon atom DIG backlight initialized [drm] Radeon Display Connectors [drm] Connector 0: [drm] VGA-1 [drm] DDC: 0x7e40 0x7e40 0x7e44 0x7e44 0x7e48 0x7e48 0x7e4c 0x7e4c [drm] Encoders: [drm] CRT1: INTERNAL_KLDSCP_DAC1 [drm] Connector 1: [drm] HDMI-A-1 [drm] HPD1 [drm] DDC: 0x7e50 0x7e50 0x7e54 0x7e54 0x7e58 0x7e58 0x7e5c 0x7e5c [drm] Encoders: [drm] DFP1: INTERNAL_UNIPHY [drm] Connector 2: [drm] LVDS-1 [drm] DDC: 0x7f68 0x7f68 0x7f6c 0x7f6c 0x7f70 0x7f70 0x7f74 0x7f74 [drm] Encoders: [drm] LCD1: INTERNAL_UNIPHY2 [drm] Internal thermal controller with fan control [drm] radeon: dpm initialized [drm] fb mappable at 0xC045E000 [drm] vram apper at 0xC0000000 [drm] size 4325376 [drm] fb depth is 24 [drm] pitch is 5632 fbcon: radeondrmfb (fb0) is primary device [drm:rv770_dpm_set_power_state] *ERROR* rv770_restrict_performance_levels_before_switch failed radeon 0000:01:00.0: fb0: radeondrmfb frame buffer device [drm] Initialized radeon 2.36.0 20080528 for 0000:01:00.0 on minor 0 -- You are receiving this mail because: You are watching the assignee of the bug.

1 51

KMS documentation for userspace
by Simon Ser 03 Jun '20

03 Jun '20

Hi all, With Wayland compositors and DRM leases, the number of DRM userspace programs has increased (and will probably continue to increase). However it's been pretty hard to find good DRM docs for userspace. The resources currently available are: - The kernel docs, although only the high level overview is useful to userspace. - User-contributed tutorials, like [1] and [2]. - To help userspace understand hardware capabilities and limitations, I've recently started a DRM database dump project [3]. (Anything else I've missed?) We still lack docs that describe how to properly use the KMS API and the KMS properties. There is a deprecated list at [4], and another list mixed with kernel structs at [5]. This is not great for userspace developers. So I wanted to know if there's interest from the kernel community to maintain documentation for userspace? Or should userspace maintain its own docs of the kernel API? I don't know what would be the best place for these docs. If they live in kernel doc comments, then references to kernel functions and guidelines for kernel devs will appear (just like in the current docs). If they live outside of the kernel source code or outside of the kernel tree, they might get outdated. Thoughts? Thanks, [1]: https://github.com/ascent12/drm_doc [2]: https://gitlab.freedesktop.org/daniels/kms-quads [3]: https://drmdb.emersion.fr/ [4]: https://01.org/linuxgraphics/gfx-docs/drm/gpu/drm-kms.html#standard-connect… [5]: https://01.org/linuxgraphics/gfx-docs/drm/gpu/drm-kms.html#existing-kms-pro… -- Simon Ser https://emersion.fr

3 7

[PATCH v1 0/4] make hdmi work on bananapi-r2
by Frank Wunderlich 21 May '20

21 May '20

This Patch-Series adds missing Patches/Bugfixes to get hdmi working on BPI-R2 first 2 Patches were already posted, but not yet merged into mainline i found no hint why - config component output by device node port https://patchwork.kernel.org/patch/10609007/ - add display subsystem related device nodes (resend) https://patchwork.kernel.org/patch/10588951/ Bibby Hsieh (1): drm/mediatek: config component output by device node port Ryder Lee (2): arm: dts: mt7623: add display subsystem related device nodes drm/mediatek: fix possible_crtcs chunhui dai (1): drm/mediatek: fix boot up for 720 and 480 but 1080 arch/arm/boot/dts/mt7623.dtsi | 177 ++++++++++++++++++ arch/arm/boot/dts/mt7623n-bananapi-bpi-r2.dts | 85 +++++++++ arch/arm/boot/dts/mt7623n-rfb-emmc.dts | 85 +++++++++ drivers/gpu/drm/mediatek/mtk_dpi.c | 2 +- drivers/gpu/drm/mediatek/mtk_drm_drv.c | 41 +++- drivers/gpu/drm/mediatek/mtk_drm_drv.h | 4 +- drivers/gpu/drm/mediatek/mtk_hdmi_phy.c | 3 + drivers/gpu/drm/mediatek/mtk_hdmi_phy.h | 1 + .../gpu/drm/mediatek/mtk_mt2701_hdmi_phy.c | 1 + 9 files changed, 390 insertions(+), 9 deletions(-) -- 2.17.1

4 10

[PATCH] drm/debugfs: accept trailing whitespace in "force" attribute
by Michael Tretter 18 May '20

18 May '20

Using plain echo to set the "force" connector attribute fails with -EINVAL, because echo appends a newline to the output. Strip trailing whitespace in the input before checking the value to accept "off\n" or "off ". Signed-off-by: Michael Tretter <m.tretter(a)pengutronix.de> --- drivers/gpu/drm/drm_debugfs.c | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/drivers/gpu/drm/drm_debugfs.c b/drivers/gpu/drm/drm_debugfs.c index c1807d5754b2..10dd89d3f28e 100644 --- a/drivers/gpu/drm/drm_debugfs.c +++ b/drivers/gpu/drm/drm_debugfs.c @@ -241,6 +241,7 @@ static ssize_t connector_write(struct file *file, const char __user *ubuf, struct seq_file *m = file->private_data; struct drm_connector *connector = m->private; char buf[12]; + int i; if (len > sizeof(buf) - 1) return -EINVAL; @@ -250,6 +251,10 @@ static ssize_t connector_write(struct file *file, const char __user *ubuf, buf[len] = '\0'; + /* strip trailing whitespace */ + for (i = len - 1; i > 0 && isspace(buf[i]); i--) + buf[i] = '\0'; + if (!strcmp(buf, "on")) connector->force = DRM_FORCE_ON; else if (!strcmp(buf, "digital")) -- 2.11.0

3 6

← Newer
1
2
3
4
5
6
7
...
231
Older →

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

dri-devel July 2019