From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1752870AbcKIICB convert rfc822-to-8bit (ORCPT ); Wed, 9 Nov 2016 03:02:01 -0500 Received: from mx1.redhat.com ([209.132.183.28]:35826 "EHLO mx1.redhat.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1752126AbcKIIB7 (ORCPT ); Wed, 9 Nov 2016 03:01:59 -0500 Message-ID: <1478678517.2078.12.camel@redhat.com> Subject: Re: BUG: 'list_empty(&vgdev->free_vbufs)' is true! From: Gerd Hoffmann To: "Michael S. Tsirkin" Cc: Jiri Slaby , virtualization@lists.linux-foundation.org, Linux kernel mailing list , David Airlie , dri-devel@lists.freedesktop.org Date: Wed, 09 Nov 2016 09:01:57 +0100 In-Reply-To: <20161108223153-mutt-send-email-mst@kernel.org> References: <20161108223153-mutt-send-email-mst@kernel.org> Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: 8BIT Mime-Version: 1.0 X-Greylist: Sender IP whitelisted, not delayed by milter-greylist-4.5.16 (mx1.redhat.com [10.5.110.31]); Wed, 09 Nov 2016 08:01:59 +0000 (UTC) Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org On Di, 2016-11-08 at 22:37 +0200, Michael S. Tsirkin wrote: > On Mon, Nov 07, 2016 at 09:43:24AM +0100, Jiri Slaby wrote: > > Hi, > > > > I can relatively easily reproduce this bug: How? > > BUG: 'list_empty(&vgdev->free_vbufs)' is true! > The following might be helpful for debugging - if kernel still will > not stop panicing, we are looking at some kind > of memory corruption. Looking carefully through the code I think it isn't impossible to trigger this, but you need for that: (1) command queue full (quite possible), (2) cursor queue full too (unlikely), and (3) multiple threads trying to submit commands and waiting for free space in the command queue (possible with virgl enabled). Do things improve if you allocate some extra bufs? int virtio_gpu_alloc_vbufs(struct virtio_gpu_device *vgdev) { struct virtio_gpu_vbuffer *vbuf; - int i, size, count = 0; + int i, size, count = 16; void *ptr; INIT_LIST_HEAD(&vgdev->free_vbufs); Memory corruption sounds plausible too. Redirect console to ttyS0 for trouble-shooting, trying to dump the oops to the display device which triggered the oops in the first place isn't going to work very well ... cheers, Gerd From mboxrd@z Thu Jan 1 00:00:00 1970 From: Gerd Hoffmann Subject: Re: BUG: 'list_empty(&vgdev->free_vbufs)' is true! Date: Wed, 09 Nov 2016 09:01:57 +0100 Message-ID: <1478678517.2078.12.camel@redhat.com> References: <20161108223153-mutt-send-email-mst@kernel.org> Mime-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Return-path: In-Reply-To: <20161108223153-mutt-send-email-mst@kernel.org> List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: virtualization-bounces@lists.linux-foundation.org Errors-To: virtualization-bounces@lists.linux-foundation.org To: "Michael S. Tsirkin" Cc: David Airlie , Jiri Slaby , Linux kernel mailing list , dri-devel@lists.freedesktop.org, virtualization@lists.linux-foundation.org List-Id: virtualization@lists.linuxfoundation.org On Di, 2016-11-08 at 22:37 +0200, Michael S. Tsirkin wrote: > On Mon, Nov 07, 2016 at 09:43:24AM +0100, Jiri Slaby wrote: > > Hi, > > > > I can relatively easily reproduce this bug: How? > > BUG: 'list_empty(&vgdev->free_vbufs)' is true! > The following might be helpful for debugging - if kernel still will > not stop panicing, we are looking at some kind > of memory corruption. Looking carefully through the code I think it isn't impossible to trigger this, but you need for that: (1) command queue full (quite possible), (2) cursor queue full too (unlikely), and (3) multiple threads trying to submit commands and waiting for free space in the command queue (possible with virgl enabled). Do things improve if you allocate some extra bufs? int virtio_gpu_alloc_vbufs(struct virtio_gpu_device *vgdev) { struct virtio_gpu_vbuffer *vbuf; - int i, size, count = 0; + int i, size, count = 16; void *ptr; INIT_LIST_HEAD(&vgdev->free_vbufs); Memory corruption sounds plausible too. Redirect console to ttyS0 for trouble-shooting, trying to dump the oops to the display device which triggered the oops in the first place isn't going to work very well ... cheers, Gerd