Re: [git pull] drm fixes

From: Daniel Vetter <daniel@ffwll.ch>
To: Dave Jones <davej@codemonkey.org.uk>,
	Josh Boyer <jwboyer@fedoraproject.org>,
	Dave Airlie <airlied@linux.ie>,
	Damien Lespiau <damien.lespiau@intel.com>,
	Xi Ruoyao <xry111@outlook.com>,
	Linus Torvalds <torvalds@linux-foundation.org>,
	DRI mailing list <dri-devel@lists.freedesktop.org>,
	"Linux-Kernel@Vger. Kernel. Org" <linux-kernel@vger.kernel.org>,
	Intel Graphics Development <intel-gfx@lists.freedesktop.org>
Subject: Re: [git pull] drm fixes
Date: Wed, 25 Mar 2015 09:56:28 +0100	[thread overview]
Message-ID: <20150325085628.GR1349@phenom.ffwll.local> (raw)
In-Reply-To: <20150324014119.GA14736@codemonkey.org.uk>

On Mon, Mar 23, 2015 at 09:41:20PM -0400, Dave Jones wrote:
> On Mon, Mar 23, 2015 at 11:33:42AM -0400, Josh Boyer wrote:
>  
>  > I have a machine that no longer boots in a headless manner with -rc5.
>  > It's an Celeron based NUC device.  I blacklisted the i915 driver and
>  > it boots fine, then I ran insmod manually and got the backtrace below.
>  > This machine only has HDMI output on it.  If I have it connected (even
>  > if the monitor is set to display some other input) it will boot fine,
>  > but the backtrace is still present.  I'm going to guess the machine
>  > "hangs" in headless because X causes some further issues in the
>  > headless case.
>  > 
>  > Linux v4.0-rc4-199-gb314acaccd7e gets this splat in the headless state:
>  > 
>  > [  +0.000039] WARNING: CPU: 0 PID: 63 at
>  > drivers/gpu/drm/i915/i915_gem.c:4525 i915_gem_free_object+0x2e5/0x320
>  > [i915]()
>  > [  +0.000002] WARN_ON(obj->frontbuffer_bits)
>  > 
>  > which is what I thought one of these commits was supposed to fix.  I
>  > don't see that in -rc5, but then we have these other issues.
>  
> 
>  > [  +0.000037] WARNING: CPU: 1 PID: 1486 at include/linux/kref.h:47
>  > drm_framebuffer_reference+0x7a/0x90 [drm]()
>  ..
>  > [  +0.000037] WARNING: CPU: 0 PID: 563 at
>  > drivers/gpu/drm/drm_atomic.c:482 drm_atomic_check_only+0x33d/0x500
>  > [drm]()
> 
> I've started seeing this one too as of rc5.
> Along with..

Yeah we're freeing memory too early with these bugs. To get up to the
current debug state can you please cherry-pick

commit f55548b5af87ebfc586ca75748947f1c1b1a4a52
Author: Damien Lespiau <damien.lespiau@intel.com>
Date:   Thu Feb 5 18:30:20 2015 +0000

    drm/i915: Don't try to reference the fb in get_initial_plane_config()

and

commit fb9981aa675eb7b398849915364916fd98833cfa
Author: Damien Lespiau <damien.lespiau@intel.com>
Date:   Thu Feb 5 19:24:25 2015 +0000

    drm/i915: Fix atomic state when reusing the firmware fb

from linux-next and then check what's left?

Thanks, Daniel

> 
>  
> =============================================================================
> BUG kmalloc-192 (Tainted: G        W      ): Poison overwritten
> -----------------------------------------------------------------------------
> Disabling lock debugging due to kernel taint
> INFO: 0xffff8804277e5c78-0xffff8804277e5c78. First byte 0x6a instead of 0x6b
> INFO: Allocated in ironlake_get_initial_plane_config+0x86/0x390 [i915] age=175 cpu=5 pid=313
> 	__slab_alloc.constprop.79+0x5a9/0x670
> 	kmem_cache_alloc_trace+0x21f/0x300
> 	ironlake_get_initial_plane_config+0x86/0x390 [i915]
> 	intel_modeset_init+0x9d9/0x1a50 [i915]
> 	i915_driver_load+0xebf/0x1150 [i915]
> 	drm_dev_register+0xb5/0x110 [drm]
> 	drm_get_pci_dev+0x8d/0x200 [drm]
> 	i915_pci_probe+0x3b/0x60 [i915]
> 	pci_device_probe+0x8c/0xf0
> 	driver_probe_device+0x90/0x3e0
> 	__driver_attach+0xa3/0xb0
> 	bus_for_each_dev+0x73/0xc0
> 	driver_attach+0x1e/0x20
> 	bus_add_driver+0x188/0x260
> 	driver_register+0x64/0xf0
> 	__pci_register_driver+0x64/0x70
> INFO: Freed in intel_user_framebuffer_destroy+0x65/0xa0 [i915] age=40 cpu=0 pid=128
> 	__slab_free+0x19e/0x2c0
> 	kfree+0x2c1/0x310
> 	intel_user_framebuffer_destroy+0x65/0xa0 [i915]
> 	drm_framebuffer_free+0x50/0x60 [drm]
> 	drm_framebuffer_unreference+0x35/0x70 [drm]
> 	drm_atomic_helper_plane_destroy_state+0x1f/0x30 [drm_kms_helper]
> 	intel_plane_destroy_state+0xe/0x10 [i915]
> 	drm_plane_helper_commit+0xb2/0x2e0 [drm_kms_helper]
> 	drm_plane_helper_update+0x9a/0xf0 [drm_kms_helper]
> 	__intel_set_mode+0x8b5/0xb70 [i915]
> 	intel_crtc_set_config+0xc4b/0x1030 [i915]
> 	drm_mode_set_config_internal+0x69/0x120 [drm]
> 	restore_fbdev_mode+0xc8/0xf0 [drm_kms_helper]
> 	drm_fb_helper_restore_fbdev_mode_unlocked+0x29/0x80 [drm_kms_helper]
> 	drm_fb_helper_set_par+0x22/0x50 [drm_kms_helper]
> 	intel_fbdev_set_par+0x1a/0x60 [i915]
> INFO: Slab 0xffffea00109df900 objects=31 used=31 fp=0x          (null) flags=0x8000000000004080
> INFO: Object 0xffff8804277e5c70 @offset=7280 fp=0xffff8804277e6288
> Bytes b4 ffff8804277e5c60: 54 7a fb ff 00 00 00 00 5a 5a 5a 5a 5a 5a 5a 5a  Tz......ZZZZZZZZ
> Object ffff8804277e5c70: 6b 6b 6b 6b 6b 6b 6b 6b 6a 6b 6b 6b 6b 6b 6b 6b  kkkkkkkkjkkkkkkk
> Object ffff8804277e5c80: 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b  kkkkkkkkkkkkkkkk
> Object ffff8804277e5c90: 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b  kkkkkkkkkkkkkkkk
> Object ffff8804277e5ca0: 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b  kkkkkkkkkkkkkkkk
> Object ffff8804277e5cb0: 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b  kkkkkkkkkkkkkkkk
> Object ffff8804277e5cc0: 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b  kkkkkkkkkkkkkkkk
> Object ffff8804277e5cd0: 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b  kkkkkkkkkkkkkkkk
> Object ffff8804277e5ce0: 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b  kkkkkkkkkkkkkkkk
> Object ffff8804277e5cf0: 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b  kkkkkkkkkkkkkkkk
> Object ffff8804277e5d00: 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b  kkkkkkkkkkkkkkkk
> Object ffff8804277e5d10: 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b  kkkkkkkkkkkkkkkk
> Object ffff8804277e5d20: 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b a5  kkkkkkkkkkkkkkk.
> Redzone ffff8804277e5d30: bb bb bb bb bb bb bb bb                          ........
> Padding ffff8804277e5e70: 5a 5a 5a 5a 5a 5a 5a 5a                          ZZZZZZZZ
> CPU: 4 PID: 128 Comm: kworker/u16:4 Tainted: G    B   W       4.0.0-rc5-backupdebug+ #1
> Workqueue: events_unbound async_run_entry_fn
>  ffff8804277e5c70 000000002ebc2945 ffff8800b780f578 ffffffff90780cc3
>  0000000000000000 ffff88042b804900 ffff8800b780f5b8 ffffffff901e76cc
>  0000000000000008 ffff880400000001 ffff8804277e5c79 ffff88042b804900
> Call Trace:
>  [<ffffffff90780cc3>] dump_stack+0x4c/0x65
>  [<ffffffff901e76cc>] print_trailer+0x14c/0x200
>  [<ffffffff901e784f>] check_bytes_and_report+0xcf/0x110
>  [<ffffffff901e8717>] check_object+0x1d7/0x250
>  [<ffffffffc0335cac>] ? intel_plane_duplicate_state+0x2c/0xa0 [i915]
>  [<ffffffff901e8c14>] alloc_debug_processing+0xa4/0x1a0
>  [<ffffffff901eb5c9>] __slab_alloc.constprop.79+0x5a9/0x670
>  [<ffffffffc0335cac>] ? intel_plane_duplicate_state+0x2c/0xa0 [i915]
>  [<ffffffffc0335cac>] ? intel_plane_duplicate_state+0x2c/0xa0 [i915]
>  [<ffffffff901edc0e>] __kmalloc_track_caller+0x2ee/0x380
>  [<ffffffff901b2e40>] kmemdup+0x20/0x50
>  [<ffffffffc0335cac>] intel_plane_duplicate_state+0x2c/0xa0 [i915]
>  [<ffffffffc0239be8>] drm_atomic_get_plane_state+0x78/0xf0 [drm]
>  [<ffffffffc028d428>] drm_atomic_helper_plane_set_property+0x68/0xd0 [drm_kms_helper]
>  [<ffffffffc022824d>] drm_mode_plane_set_obj_prop+0x2d/0x90 [drm]
>  [<ffffffffc028ee4b>] restore_fbdev_mode+0x6b/0xf0 [drm_kms_helper]
>  [<ffffffffc0290f09>] drm_fb_helper_restore_fbdev_mode_unlocked+0x29/0x80 [drm_kms_helper]
>  [<ffffffffc0290f82>] drm_fb_helper_set_par+0x22/0x50 [drm_kms_helper]
>  [<ffffffffc0290e91>] drm_fb_helper_hotplug_event+0x91/0xe0 [drm_kms_helper]
>  [<ffffffffc0290f2c>] drm_fb_helper_restore_fbdev_mode_unlocked+0x4c/0x80 [drm_kms_helper]
>  [<ffffffffc0290f82>] drm_fb_helper_set_par+0x22/0x50 [drm_kms_helper]
>  [<ffffffffc03313ba>] intel_fbdev_set_par+0x1a/0x60 [i915]
>  [<ffffffff9047e488>] fbcon_init+0x588/0x610
>  [<ffffffff90500f4c>] visual_init+0xbc/0x120
>  [<ffffffff9050376e>] do_bind_con_driver+0x17e/0x3b0
>  [<ffffffff90503ef4>] do_take_over_console+0xb4/0x1e0
>  [<ffffffff90479283>] do_fbcon_takeover+0x63/0xd0
>  [<ffffffff9047efbd>] fbcon_event_notify+0x6cd/0x7d0
>  [<ffffffff9009d0e2>] notifier_call_chain+0x62/0x100
>  [<ffffffff9009d391>] __blocking_notifier_call_chain+0x51/0x70
>  [<ffffffff9009d3c6>] blocking_notifier_call_chain+0x16/0x20
>  [<ffffffff90484f1b>] fb_notifier_call_chain+0x1b/0x20
>  [<ffffffff90487267>] register_framebuffer+0x207/0x340
>  [<ffffffffc0291214>] drm_fb_helper_initial_config+0x264/0x3c0 [drm_kms_helper]
>  [<ffffffffc03326db>] intel_fbdev_initial_config+0x1b/0x20 [i915]
>  [<ffffffff9009f69a>] async_run_entry_fn+0x4a/0x150
>  [<ffffffff90095819>] process_one_work+0x209/0x810
>  [<ffffffff90095780>] ? process_one_work+0x170/0x810
>  [<ffffffff90095e8b>] worker_thread+0x6b/0x490
>  [<ffffffff90095e20>] ? process_one_work+0x810/0x810
>  [<ffffffff9009ba79>] kthread+0x119/0x130
>  [<ffffffff9009b960>] ? kthread_create_on_node+0x240/0x240
>  [<ffffffff90789888>] ret_from_fork+0x58/0x90
>  [<ffffffff9009b960>] ? kthread_create_on_node+0x240/0x240
> FIX kmalloc-192: Restoring 0xffff8804277e5c78-0xffff8804277e5c78=0x6b
> FIX kmalloc-192: Marking all objects used
> 
> _______________________________________________
> dri-devel mailing list
> dri-devel@lists.freedesktop.org
> http://lists.freedesktop.org/mailman/listinfo/dri-devel

-- 
Daniel Vetter
Software Engineer, Intel Corporation
http://blog.ffwll.ch