On Mon, Apr 24, 2023 at 11:53:25PM +1000, Jonathan Gray wrote:
> On Mon, Apr 24, 2023 at 01:49:32PM +0100, Stuart Henderson wrote:
> > Running picom (with no special config or command line flags) on intel
> > T14 gen 3 fairly easily triggers a crash in drm. If it doesn't fail the
> > first time, exiting and restarting a few times pretty much always
> > triggers it.
> >
> > Full proc listing below after dmesg, Xorg is the only active process
> > at the time.
> >
> > xcompmgr hasn't yet triggered it.
> >
> >
> > uvm_fault(0xffffffff824b4570, 0xffff800001e73014, 0, 1) -> e
> > kernel: page fault trap, code=0
> > Stopped at dpt_insert_entries+0xbc: movl 0x34(%r8),%r10d
> > TID PID UID PRFLAGS PFLAGS CPU COMMAND
> >
> > *459624 48440 35 0x12 0 4K Xorg
> >
> > dpt_insert_entries(ffff800001a1cc00,fffffd83b9afd178,0,0) at
> > dpt_insert_entries+0xbc
>
> this is line 34 of /sys/dev/pci/drm/i915/i915_scatterlist.h
>
> 23 static __always_inline struct sgt_iter {
> 24 struct scatterlist *sgp;
> 25 union {
> 26 unsigned long pfn;
> 27 dma_addr_t dma;
> 28 };
> 29 unsigned int curr;
> 30 unsigned int max;
> 31 } __sgt_iter(struct scatterlist *sgl, bool dma) {
> 32 struct sgt_iter s = { .sgp = sgl };
> 33
> 34 if (dma && s.sgp && sg_dma_len(s.sgp) == 0) {
> 35 s.sgp = NULL;
> 36 } else if (s.sgp) {
>
> sgl is pointing to something that isn't there?
>
> I have an intel t14 gen 3 but can't reproduce this.
> Running fvwm from xenocara and starting picom from xterm 20 times or so,
> ^C after each.
Tested with snapshot
OpenBSD 7.3-current (GENERIC.MP) #1176: Wed May 10 17:30:02 MDT 2023
I cannot reproduce with picom in the default xenodm session for root,
neither with fwvm nor cwm restarted into via fvwm's menu.
But bonzomatic reliably triggers an uvm_fault(), sadly that's the only
blue line I see at the bottom overlapping ttyC0 console output before
the machine locks up and only hard reset helps.
fvwm just opens a window for bonzomatic in which nothing happens, i.e.
cwm is needed (I kept restarting into the menu to keep the reproducing
process the same).
bonzomatic needs no config or flags, it spawns a fullscreen editor with
a preset shader running live as background...
>
> Looking over the local changes to i915_scatterlist.h the segment size
> could be larger, I'm not sure if that would help.
>
> Index: dev/pci/drm/i915/i915_scatterlist.h
> ===================================================================
> RCS file: /cvs/src/sys/dev/pci/drm/i915/i915_scatterlist.h,v
> retrieving revision 1.3
> diff -u -p -r1.3 i915_scatterlist.h
> --- dev/pci/drm/i915/i915_scatterlist.h 1 Jan 2023 01:34:54 -0000
> 1.3
> +++ dev/pci/drm/i915/i915_scatterlist.h 24 Apr 2023 13:15:46 -0000
> @@ -153,7 +153,7 @@ static inline unsigned int i915_sg_segme
> #else
> static inline unsigned int i915_sg_segment_size(struct device *dev)
> {
> - return PAGE_SIZE;
> + return round_down(UINT_MAX, PAGE_SIZE);
> }
> #endif
>
>
> > dpt_bind_vma(ffff800001a1cc00,0,fffffd83b9afd178,0,400) at dpt_bind_vma+0x64
> > i915_vma_bind(ffff800001ce4ec0,0,400,0,fffffd83b9afd178) at
> > i915_vma_bind+0x319
> > i915_vma_pin_ww(ffff800001ce4ec0,ffff800033b78db0,0,200000,400) at
> > i915_vma_pin_ww+0x454
> > intel_plane_pin_fb(ffff800001cc9000) at intel_plane_pin_fb+0x25c
> > intel_prepare_plane_fb(ffff8000014c7400,ffff800001cc9000) at
> > intel_prepare_plane_fb+0x127
> > drm_atomic_helper_prepare_planes(ffff80000044c078,ffff800001cda000) at
> > drm_atomic_helper_prepare_planes+0x5b
> > intel_atomic_commit(ffff80000044c078,ffff800001cda000,1) at
> > intel_atomic_commit+0xda
> > drm_atomic_helper_page_flip(ffff8000014c2800,ffff800001e41200,ffff800001d55300,1,ffff800033b79048)
> > at drm_atomic_helper_page_flip+0x77
> > drm_mode_page_flip_ioctl(ffff80000044c078,ffff800033b793e0,ffff80000195bc00)
> > at drm_mode_page_flip_ioctl+0x466
> > drm_do_ioctl(ffff80000044c078,100,c01864b0,ffff800033b793e0) at
> > drm_do_ioctl+0x29e
> > drmioctl(15700,c01864b0,ffff800033b793e0,3,ffff800033bba5c8) at
> > drmioctl+0xdc
> > VOP_IOCTL(fffffd845bb870f0,c01864b0,ffff800033b793e0,3,fffffd845efad750,ffff800033bba5c8)
> > at VOP_IOCTL+0x60
> > vn_ioctl(fffffd845bd084c0,c01864b0,ffff800033b793e0,ffff800033bba5c8) at
> > vn_ioctl+0x79
>
