I can crash the i915 driver on a gateway 550GR running fedora 15 kernel after a minute or so running the xscreensaver "fliptext".
lspci -vv: 00:02.0 VGA compatible controller: Intel Corporation 82915G/GV/910GL Integrated Graphics Controller (rev 04) (prog-if 00 [VGA controller]) Subsystem: Gateway 2000 Device 4037 Control: I/O+ Mem+ BusMaster+ SpecCycle- MemWINV- VGASnoop- ParErr- Stepping- SERR- FastB2B- DisINTx- Status: Cap+ 66MHz- UDF- FastB2B+ ParErr- DEVSEL=fast >TAbort- <TAbort- <MAbort- >SERR- <PERR- INTx- Latency: 0 Interrupt: pin A routed to IRQ 16 Region 0: Memory at feb80000 (32-bit, non-prefetchable) [size=512K] Region 1: I/O ports at ec00 [size=8] Region 2: Memory at d0000000 (32-bit, prefetchable) [size=256M] Region 3: Memory at feb40000 (32-bit, non-prefetchable) [size=256K] Expansion ROM at <unassigned> [disabled] Capabilities: [d0] Power Management version 2 Flags: PMEClk- DSI+ D1- D2- AuxCurrent=0mA PME(D0-,D1-,D2-,D3hot-,D3cold-) Status: D0 NoSoftRst- PME-Enable- DSel=0 DScale=0 PME- Kernel driver in use: i915 Kernel modules: i915
[ 1791.466962] ------------[ cut here ]------------ [ 1791.467505] kernel BUG at drivers/gpu/drm/i915/i915_gem.c:3292! [ 1791.467505] invalid opcode: 0000 [#1] SMP [ 1791.467505] Modules linked in: fuse vboxnetadp vboxnetflt vboxdrv p4_clockmod capi kernelcapi bnep bluetooth rfkill nf_conntrack_netbios_ns nf_conntrack_broadcast ip6t_REJECT nf_conntrack_ipv6 nf_defrag_ipv6 nf_conntrack_ipv4 nf_defrag_ipv4 xt_state nf_conntrack ip6table_filter ip6_tables cx88_blackbird cx2341x tuner_simple tuner_types tda9887 tda8290 ir_lirc_codec lirc_dev tea5767 ir_sony_decoder tuner ir_jvc_decoder ir_rc6_decoder cx88_alsa ir_rc5_decoder cx8800 cx8802 cx88xx ir_nec_decoder rc_core snd_hda_codec_realtek tveeprom v4l2_common snd_hda_intel snd_hda_codec snd_hwdep snd_seq snd_seq_device snd_pcm videodev media videobuf_dma_sg btcx_risc videobuf_core snd_timer snd iTCO_wdt iTCO_vendor_support e100 i2c_i801 mii soundcore snd_page_alloc ppdev parport_pc parport microcode ipv6 firewire_ohci firewire_core crc_itu_t uas usb_storage i915 drm_kms_helper drm i2c_algo_bit i2c_core video [last unloaded: mperf] [ 1791.497283] [ 1791.497283] Pid: 2738, comm: fliptext Not tainted 2.6.40.3-0.fc15.i686 #1 Gateway /D915GAG [ 1791.497283] EIP: 0060:[<f7a3822e>] EFLAGS: 00210246 CPU: 1 [ 1791.497283] EIP is at i915_gem_object_pin+0x32/0x12b [i915] [ 1791.497283] EAX: 0001e000 EBX: ee80bf00 ECX: 00000000 EDX: 00000000 [ 1791.497283] ESI: 00000000 EDI: 00000000 EBP: eea4fd54 ESP: eea4fd28 [ 1791.497283] DS: 007b ES: 007b FS: 00d8 GS: 00e0 SS: 0068 [ 1791.537018] Process fliptext (pid: 2738, ti=eea4e000 task=ee9571a0 task.ti=eea4e000) [ 1791.537018] Stack: [ 1791.537018] eea4fd4c c042916b f7a3a54f f0080240 f4002380 f00804c0 eea4fd78 f40bc000 [ 1791.537018] ee80bf00 00000000 00000000 eea4fd80 f7a3a0c4 f40bc01c 01000024 00000000 [ 1791.537018] eea4fe00 ee827578 ee9a9278 eea4fe00 f40bc01c ee9c6bc0 eea4fe18 f7a3a932 [ 1791.537018] Call Trace: [ 1791.537018] [<c042916b>] ? __wake_up_common+0x3b/0x62 [ 1791.537018] [<f7a3a54f>] ? kzalloc.constprop.2+0x12/0x14 [i915] [ 1791.537018] [<f7a3a0c4>] i915_gem_execbuffer_reserve+0x116/0x275 [i915] [ 1791.537018] [<f7a3a932>] i915_gem_do_execbuffer+0x3e1/0xce3 [i915] [ 1791.537018] [<f7a351f0>] ? list_move_tail+0x1f/0x23 [i915] [ 1791.537018] [<f7a382ff>] ? i915_gem_object_pin+0x103/0x12b [i915] [ 1791.537018] [<c04297af>] ? should_resched+0xd/0x27 [ 1791.537018] [<c05e159e>] ? _copy_from_user+0x3c/0x50 [ 1791.537018] [<f7a3b54f>] i915_gem_execbuffer2+0xde/0x12f [i915] [ 1791.537018] [<c05e159e>] ? _copy_from_user+0x3c/0x50 [ 1791.537018] [<f793634b>] drm_ioctl+0x2a4/0x38a [drm] [ 1791.537018] [<f7a3b471>] ? i915_gem_execbuffer+0x23d/0x23d [i915] [ 1791.537018] [<c059ff05>] ? file_has_perm+0xa2/0xbb [ 1791.537018] [<f79360a7>] ? drm_copy_field+0x54/0x54 [drm] [ 1791.537018] [<c04f77e2>] do_vfs_ioctl+0x457/0x488 [ 1791.537018] [<c05a17df>] ? selinux_file_ioctl+0xac/0xb0 [ 1791.537018] [<c04f785b>] sys_ioctl+0x48/0x69 [ 1791.537018] [<c07e9d3c>] syscall_call+0x7/0xb [ 1791.537018] [<c07e0000>] ? cpufreq_cpu_callback+0x9/0x63 [ 1791.537018] Code: ec 20 3e 8d 74 26 00 89 c3 8b 40 08 89 d6 89 cf 8b 80 1c 02 00 00 89 45 f0 8b 83 80 00 00 00 25 00 e0 01 00 3d 00 e0 01 00 75 02 <0f> 0b 83 7b 54 00 74 6f 85 d2 74 0b 8d 52 ff 85 93 a0 00 00 00 [ 1791.537018] EIP: [<f7a3822e>] i915_gem_object_pin+0x32/0x12b [i915] SS:ESP 0068:eea4fd28
[root@math16-16 mejh]# uname -a Linux math16-16 2.6.40.3-0.fc15.i686 #1 SMP Tue Aug 16 04:24:09 UTC 2011 i686 i686 i386 GNU/Linux
I tried 2.6.38.8 and was able to crash the driver as well.
2.6.38 is positively stone-age in graphics land. Can you please retest with 3.3?
I have 3.2 on F15, and it's still an issue: [ 4588.254315] ------------[ cut here ]------------ [ 4588.254395] kernel BUG at drivers/gpu/drm/i915/i915_gem.c:3330! [ 4588.254481] invalid opcode: 0000 [#1] SMP [ 4588.254548] Modules linked in: fuse vboxpci(O) vboxnetadp(O) vboxnetflt(O) vboxdrv(O) p4_clockmod capi kernelcapi bnep bluetooth rfkill nf_conntrack_netbios_ns nf_conntrack_broadcast ip6t_REJECT nf_conntrack_ipv6 nf_conntrack_ipv4 nf_defrag_ipv6 nf_defrag_ipv4 xt_state nf_conntrack ip6table_filter ip6_tables cx88_blackbird cx2341x tuner_simple tuner_types tda9887 tda8290 tea5767 ir_lirc_codec lirc_dev snd_hda_codec_realtek tuner snd_hda_intel snd_hda_codec ir_mce_kbd_decoder ir_sony_decoder cx88_alsa ir_jvc_decoder snd_hwdep cx8800 cx8802 snd_seq ir_rc6_decoder ir_rc5_decoder snd_seq_device ir_nec_decoder snd_pcm cx88xx snd_timer snd e100 iTCO_wdt rc_core iTCO_vendor_support ppdev mii videobuf_dma_sg tveeprom videobuf_core soundcore parport_pc parport v4l2_common videodev media btcx_risc snd_page_alloc microcode i2c_i801 usb_storage firewire_ohci firewire_core crc_itu_t i915 drm_kms_helper drm i2c_algo_bit i2c_core video [last unloaded: mperf] [ 4588.255004] [ 4588.255004] Pid: 4345, comm: fliptext Tainted: G C O 2.6.42.9-2.fc15.i686 #1 Gateway /D915GAG [ 4588.255004] EIP: 0060:[<f7e50a36>] EFLAGS: 00210246 CPU: 1 [ 4588.255004] EIP is at i915_gem_object_pin+0x136/0x190 [i915] [ 4588.255004] EAX: 000be40a EBX: f2854d00 ECX: 0001e000 EDX: 00000000 [ 4588.255004] ESI: 00000000 EDI: 00000000 EBP: e268fd50 ESP: e268fd1c [ 4588.255004] DS: 007b ES: 007b FS: 00d8 GS: 00e0 SS: 0068 [ 4588.255004] Process fliptext (pid: 4345, ti=e268e000 task=ee5c6480 task.ti=e268e000) [ 4588.255004] Stack: [ 4588.255004] e1013c44 e1013c40 00000001 00200282 e268fd4c c0435c7c e1013900 0001e000 [ 4588.255004] e268fd7c f38b6000 f2854d00 00000000 00000000 e268fd7c f7e5316e 00000000 [ 4588.255004] f38b6028 e268fdf8 01b7dd00 f2854b78 ee4fe878 e268fe88 f2854b78 0000000a [ 4588.255004] Call Trace: [ 4588.255004] [<c0435c7c>] ? __wake_up_sync_key+0x4c/0x60 [ 4588.255004] [<f7e5316e>] i915_gem_execbuffer_reserve+0x14e/0x320 [i915] [ 4588.255004] [<f7e53c3a>] i915_gem_do_execbuffer+0x52a/0x1020 [i915] [ 4588.255004] [<f7e4fcef>] ? i915_gem_object_set_to_gtt_domain+0xaf/0x1d0 [i915] [ 4588.255004] [<f7e50ca5>] ? i915_gem_object_unpin+0x95/0xa0 [i915] [ 4588.255004] [<f7e50d98>] ? i915_gem_pwrite_ioctl+0xe8/0xa70 [i915] [ 4588.255004] [<c066ed34>] ? idr_get_new_above_int+0x14/0x70 [ 4588.255004] [<c066f18b>] ? idr_pre_get+0x4b/0x80 [ 4588.255004] [<f7e54c31>] i915_gem_execbuffer2+0x61/0x210 [i915] [ 4588.255004] [<f7d3ccd8>] drm_ioctl+0x378/0x480 [drm] [ 4588.255004] [<f7e54bd0>] ? i915_gem_execbuffer+0x4a0/0x4a0 [i915] [ 4588.255004] [<c06292db>] ? file_has_perm+0xcb/0xe0 [ 4588.255004] [<f7d3c960>] ? drm_copy_field+0x80/0x80 [drm] [ 4588.255004] [<c05404f6>] do_vfs_ioctl+0x86/0x5a0 [ 4588.255004] [<c0629754>] ? selinux_file_ioctl+0x54/0x110 [ 4588.255004] [<c0540a7f>] sys_ioctl+0x6f/0x80 [ 4588.255004] [<c041f309>] ? smp_apic_timer_interrupt+0x59/0x90 [ 4588.255004] [<c0944694>] syscall_call+0x7/0xb [ 4588.255004] [<c0940000>] ? add_new_disk+0x28/0x486 [ 4588.255004] Code: 50 12 00 00 89 f8 81 c1 4c 12 00 00 e8 14 ee 82 c8 eb 8a 66 90 89 f0 0f b6 c8 89 d8 e8 94 cc ff ff 85 c0 0f 84 4c ff ff ff eb 93 <0f> 0b 0f b6 83 82 00 00 00 89 f1 89 54 24 10 c7 44 24 08 ec 75 [ 4588.255004] EIP: [<f7e50a36>] i915_gem_object_pin+0x136/0x190 [i915] SS:ESP 0068:e268fd1c MATH16-16 >> uname -a Linux math16-16 2.6.42.9-2.fc15.i686 #1 SMP Mon Mar 5 21:10:27 UTC 2012 i686 i686 i386 GNU/Linux
Ok, can you "cat /sys/kernel/debug/dri/0/i915_gem_pinned" in the moments prior to the hang?
I did a few of those before running the fliptext: MATH16-16 >> cat I915 Pinned: f321cf00: p 131072 0001 0001 0 0 uncached (gtt offset: 00000000, size: 00020000) (p mappable) f32a0c00: p 5763072 0041 0000 0 0 uncached (gtt offset: 00020000, size: 0057f000) (p mappable) Total 2 objects, 5894144 bytes, 5894144 GTT size Pinned: f321cf00: p 131072 0001 0001 0 0 uncached (gtt offset: 00000000, size: 00020000) (p mappable) f32a0c00: p 5763072 0041 0000 0 0 uncached (gtt offset: 00020000, size: 0057f000) (p mappable) Total 2 objects, 5894144 bytes, 5894144 GTT size Pinned: f321cf00: p 131072 0001 0001 0 0 uncached (gtt offset: 00000000, size: 00020000) (p mappable) f32a0c00: p 5763072 0041 0000 0 0 uncached (gtt offset: 00020000, size: 0057f000) (p mappable) Total 2 objects, 5894144 bytes, 5894144 GTT size Pinned: f321cf00: p 131072 0001 0001 0 0 uncached (gtt offset: 00000000, size: 00020000) (p mappable) f32a0c00: p 5763072 0041 0000 0 0 uncached (gtt offset: 00020000, size: 0057f000) (p mappable) Total 2 objects, 5894144 bytes, 5894144 GTT size Pinned: f321cf00: p 131072 0001 0001 0 0 uncached (gtt offset: 00000000, size: 00020000) (p mappable) f32a0c00: p 5763072 0041 0000 0 0 uncached (gtt offset: 00020000, size: 0057f000) (p mappable) Total 2 objects, 5894144 bytes, 5894144 GTT size MATH16-16 >> Kernel has been upgraded, but we still crash: MATH16-16 >> uname -a Linux math16-16 2.6.42.12-1.fc15.i686 #1 SMP Tue Mar 20 16:26:27 UTC 2012 i686 i686 i386 GNU/Linux [ 423.220834] ------------[ cut here ]------------ [ 423.221003] kernel BUG at drivers/gpu/drm/i915/i915_gem.c:3330! [ 423.221003] invalid opcode: 0000 [#1] SMP [ 423.221003] Modules linked in: fuse vboxpci(O) vboxnetadp(O) vboxnetflt(O) vboxdrv(O) p4_clockmod capi kernelcapi bnep bluetooth rfkill nf_conntrack_netbios_ns nf_conntrack_broadcast nf_conntrack_ipv4 ip6t_REJECT nf_defrag_ipv4 nf_conntrack_ipv6 nf_defrag_ipv6 xt_state nf_conntrack ip6table_filter ip6_tables cx88_blackbird cx2341x tuner_simple tuner_types tda9887 ir_lirc_codec lirc_dev tda8290 ir_mce_kbd_decoder tea5767 ir_sony_decoder tuner ir_jvc_decoder ir_rc6_decoder ir_rc5_decoder snd_hda_codec_realtek snd_hda_intel snd_hda_codec cx8800 snd_hwdep cx88_alsa snd_seq snd_seq_device ppdev ir_nec_decoder cx8802 cx88xx rc_core videobuf_dma_sg videobuf_core parport_pc snd_pcm tveeprom v4l2_common videodev e100 parport media btcx_risc snd_timer snd soundcore snd_page_alloc i2c_i801 mii iTCO_wdt iTCO_vendor_support microcode usb_storage firewire_ohci firewire_core crc_itu_t i915 drm_kms_helper drm i2c_algo_bit i2c_core video [last unloaded: mperf] [ 423.240581] [ 423.240581] Pid: 2718, comm: fliptext Tainted: G C O 2.6.42.12-1.fc15.i686 #1 Gateway /D915GAG [ 423.240581] EIP: 0060:[<f7e50a36>] EFLAGS: 00210246 CPU: 1 [ 423.240581] EIP is at i915_gem_object_pin+0x136/0x190 [i915] [ 423.240581] EAX: 000be41a EBX: eeefb600 ECX: 0001e000 EDX: 00000000 [ 423.240581] ESI: 00000000 EDI: 00000000 EBP: eeebbd50 ESP: eeebbd1c [ 423.240581] DS: 007b ES: 007b FS: 00d8 GS: 00e0 SS: 0068 [ 423.240581] Process fliptext (pid: 2718, ti=eeeba000 task=f3178000 task.ti=eeeba000) [ 423.240581] Stack: [ 423.240581] eeb86b04 eeb86b00 00000001 00200286 eeebbd4c c0435e4c eef75c80 0001e000 [ 423.240581] eeebbd7c f38b6000 eeefb600 00000000 00000000 eeebbd7c f7e5316e 00000000 [ 423.240581] f38b6028 eeebbdf8 0184bc00 eeafa278 eec62078 eeebbe88 eeafa278 00000009 [ 423.240581] Call Trace: [ 423.240581] [<c0435e4c>] ? __wake_up_sync_key+0x4c/0x60 [ 423.240581] [<f7e5316e>] i915_gem_execbuffer_reserve+0x14e/0x320 [i915] [ 423.240581] [<f7e53c3a>] i915_gem_do_execbuffer+0x52a/0x1020 [i915] [ 423.240581] [<f7e4fcef>] ? i915_gem_object_set_to_gtt_domain+0xaf/0x1d0 [i915] [ 423.240581] [<f7e50ca5>] ? i915_gem_object_unpin+0x95/0xa0 [i915] [ 423.240581] [<f7e50d98>] ? i915_gem_pwrite_ioctl+0xe8/0xa70 [i915] [ 423.240581] [<c066f3a4>] ? idr_get_new_above_int+0x14/0x70 [ 423.240581] [<c066f7fb>] ? idr_pre_get+0x4b/0x80 [ 423.240581] [<f7e54c31>] i915_gem_execbuffer2+0x61/0x210 [i915] [ 423.240581] [<f7d3ccd8>] drm_ioctl+0x378/0x480 [drm] [ 423.240581] [<f7e54bd0>] ? i915_gem_execbuffer+0x4a0/0x4a0 [i915] [ 423.240581] [<c062993b>] ? file_has_perm+0xcb/0xe0 [ 423.240581] [<f7d3c960>] ? drm_copy_field+0x80/0x80 [drm] [ 423.240581] [<c0540a46>] do_vfs_ioctl+0x86/0x5a0 [ 423.240581] [<c0629db4>] ? selinux_file_ioctl+0x54/0x110 [ 423.240581] [<c0540fcf>] sys_ioctl+0x6f/0x80 [ 423.240581] [<c0404494>] ? math_state_restore+0x44/0x60 [ 423.240581] [<c0944e54>] syscall_call+0x7/0xb [ 423.240581] [<c0940000>] ? check_for_audio_disc+0x12c/0x188 [ 423.240581] Code: 50 12 00 00 89 f8 81 c1 4c 12 00 00 e8 84 f4 82 c8 eb 8a 66 90 89 f0 0f b6 c8 89 d8 e8 94 cc ff ff 85 c0 0f 84 4c ff ff ff eb 93 <0f> 0b 0f b6 83 82 00 00 00 89 f1 89 54 24 10 c7 44 24 08 ec 75 [ 423.240581] EIP: [<f7e50a36>] i915_gem_object_pin+0x136/0x190 [i915] SS:ESP 0068:eeebbd1c
915g has a similar funny PendingFlip status bit and so I'm thinking that we queue many pageflips rather than just one.
Can you try: diff --git a/drivers/gpu/drm/i915/i915_debugfs.c b/drivers/gpu/drm/i915/i915_deb index 73982a5..1ff6ec7 100644 --- a/drivers/gpu/drm/i915/i915_debugfs.c +++ b/drivers/gpu/drm/i915/i915_debugfs.c @@ -135,6 +135,8 @@ describe_obj(struct seq_file *m, struct drm_i915_gem_object obj->madv == I915_MADV_DONTNEED ? " purgeable" : ""); if (obj->base.name) seq_printf(m, " (name: %d)", obj->base.name); + if (obj->pin_count) + seq_printf(m, " (pinned x %d)", obj->pin_count); if (obj->fence_reg != I915_FENCE_REG_NONE) seq_printf(m, " (fence: %d)", obj->fence_reg); if (obj->gtt_space != NULL) and then catting /sys/kernel/debug/dri/0/i915_gem_gtt prior to death (as close to death as possible).
My suspicion is that this is due to queueing too many flips at once, I've attacked the i915 irq handler to hopefully make it more robustly handle pageflips. Can you please try this branch: http://cgit.freedesktop.org/~ickle/linux-2.6/log/?h=gen3-pageflip
I am running a Fedora built kernel. I'll have to grab a source and build it before I can apply the patch. It might take me a couple days to get the time to do that.
I guess I have the corresponding source for the kernel.. Maybe I can try tomorrow night.
Should be fixed with this series in intel/drm-intel-next-queued [http://cgit.freedesktop.org/~danvet/drm-intel/]: commit 01b471ffbce7c9e5f694af4c94b8412e2d0baccd Author: Chris Wilson <chris@chris-wilson.co.uk> Date: Tue Apr 24 22:59:50 2012 +0100 drm/i915: Handle PendingFlip on gen3 robustly We appear to allow too many pending pageflips as evidenced by an apparent pin-leak. So borrow the pageflip completion logic from i8xx for handling PendingFlip in a robust manner. v2: Address Jesse's reminders about the nuances of gen3 IRQ handling. References: https://bugzilla.kernel.org/show_bug.cgi?id=41882 Signed-off-by: Chris Wilson <chris@chris-wilson.co.uk> Reviewed-by: Jesse Barnes <jbarnes@virtuousgeek.org> Signed-off-by: Daniel Vetter <daniel.vetter@ffwll.ch>
What kernel version are you calling it resolved in? I am finally trying to build a kernel from source. I have 3.3.6 source. My fedora 15 is running 3.3.2 so that seems close. I will try the patch on that, if I can get the hang in the compiled 3.3.6
You need drm-intel-next-queued git branch from git://people.freedesktop.org/~danvet/drm-intel See http://blog.ffwll.ch/2012/05/git-for-bug-reporters.html for a quick git howto for bug reporters.
A patch referencing this bug report has been merged in Linux v3.5-rc1: commit 38bde18045afe854f389961846d64c4b3f86105f Author: Chris Wilson <chris@chris-wilson.co.uk> Date: Tue Apr 24 22:59:50 2012 +0100 drm/i915: Handle PendingFlip on gen3 robustly