intel T14 gen 3, picom triggers page fault trap in dpt_insert_entries
Running picom (with no special config or command line flags) on intel T14 gen 3 fairly easily triggers a crash in drm. If it doesn't fail the first time, exiting and restarting a few times pretty much always triggers it. Full proc listing below after dmesg, Xorg is the only active process at the time. xcompmgr hasn't yet triggered it. uvm_fault(0x824b4570, 0x81e73014, 0, 1) -> e kernel: page fault trap, code=0 Stopped at dpt_insert_entries+0xbc:movl0x34(%r8),%r10d TIDPIDUID PRFLAGS PFLAGS CPU COMMAND *459624 48440 350x12 04K Xorg dpt_insert_entries(81a1cc00,fd83b9afd178,0,0) at dpt_insert_entries+0xbc dpt_bind_vma(81a1cc00,0,fd83b9afd178,0,400) at dpt_bind_vma+0x64 i915_vma_bind(81ce4ec0,0,400,0,fd83b9afd178) at i915_vma_bind+0x319 i915_vma_pin_ww(81ce4ec0,800033b78db0,0,20,400) at i915_vma_pin_ww+0x454 intel_plane_pin_fb(81cc9000) at intel_plane_pin_fb+0x25c intel_prepare_plane_fb(814c7400,81cc9000) at intel_prepare_plane_fb+0x127 drm_atomic_helper_prepare_planes(8044c078,81cda000) at drm_atomic_helper_prepare_planes+0x5b intel_atomic_commit(8044c078,81cda000,1) at intel_atomic_commit+0xda drm_atomic_helper_page_flip(814c2800,81e41200,81d55300,1,800033b79048) at drm_atomic_helper_page_flip+0x77 drm_mode_page_flip_ioctl(8044c078,800033b793e0,8195bc00) at drm_mode_page_flip_ioctl+0x466 drm_do_ioctl(8044c078,100,c01864b0,800033b793e0) at drm_do_ioctl+0x29e drmioctl(15700,c01864b0,800033b793e0,3,800033bba5c8) at drmioctl+0xdc VOP_IOCTL(fd845bb870f0,c01864b0,800033b793e0,3,fd845efad750,800033bba5c8) at VOP_IOCTL+0x60 vn_ioctl(fd845bd084c0,c01864b0,800033b793e0,800033bba5c8) at vn_ioctl+0x79 OpenBSD 7.3-current (GENERIC.MP) #2: Mon Apr 24 08:24:39 BST 2023 st...@lundy.spacehopper.org:/sys/arch/amd64/compile/GENERIC.MP real mem = 16814370816 (16035MB) avail mem = 16285147136 (15530MB) random: good seed from bootblocks mpath0 at root scsibus0 at mpath0: 256 targets mainbus0 at root bios0 at mainbus0: SMBIOS rev. 3.4 @ 0x8d8a3000 (81 entries) bios0: vendor LENOVO version "N3MET12W (1.11 )" date 02/09/2023 bios0: LENOVO 21AJS4GY00 efi0 at bios0: UEFI 2.7 efi0: Lenovo rev 0x1110 acpi0 at bios0: ACPI 6.3 acpi0: sleep states S0 S4 S5 acpi0: tables DSDT FACP SSDT SSDT SSDT SSDT SSDT TPM2 HPET APIC MCFG ECDT SSDT SSDT SSDT SSDT SSDT SSDT LPIT WSMT SSDT DBGP DBG2 NHLT MSDM SSDT BATB DMAR SSDT SSDT SSDT PHAT UEFI FPDT ASF! BGRT acpi0: wakeup devices PEG0(S4) PEGP(S4) PEGP(S4) PEG2(S4) PEGP(S4) GLAN(S4) XHCI(S3) XDCI(S4) HDAS(S4) CNVW(S4) RP01(S4) PXSX(S4) RP02(S4) PXSX(S4) RP03(S4) PXSX(S4) [...] acpitimer0 at acpi0: 3579545 Hz, 24 bits acpihpet0 at acpi0: 1920 Hz acpimadt0 at acpi0 addr 0xfee0: PC-AT compat cpu0 at mainbus0: apid 0 (boot processor) cpu0: 12th Gen Intel(R) Core(TM) i5-1245U, 1720.17 MHz, 06-9a-04 cpu0: FPU,VME,DE,PSE,TSC,MSR,PAE,MCE,CX8,APIC,SEP,MTRR,PGE,MCA,CMOV,PAT,PSE36,CFLUSH,DS,ACPI,MMX,FXSR,SSE,SSE2,SS,HTT,TM,PBE,SSE3,PCLMUL,DTES64,MWAIT,DS-CPL,VMX,SMX,EST,TM2,SSSE3,SDBG,FMA3,CX16,xTPR,PDCM,PCID,SSE4.1,SSE4.2,x2APIC,MOVBE,POPCNT,DEADLINE,AES,XSAVE,AVX,F16C,RDRAND,NXE,PAGE1GB,RDTSCP,LONG,LAHF,ABM,3DNOWP,PERF,ITSC,FSGSBASE,TSC_ADJUST,BMI1,AVX2,SMEP,BMI2,ERMS,INVPCID,RDSEED,ADX,SMAP,CLFLUSHOPT,CLWB,PT,SHA,UMIP,PKU,WAITPKG,PKS,MD_CLEAR,IBT,IBRS,IBPB,STIBP,L1DF,SSBD,SENSOR,ARAT,XSAVEOPT,XSAVEC,XGETBV1,XSAVES cpu0: 48KB 64b/line 12-way D-cache, 32KB 64b/line 8-way I-cache, 1MB 64b/line 10-way L2 cache, 12MB 64b/line 12-way L3 cache cpu0: smt 0, core 0, package 0 mtrr: Pentium Pro MTRR support, 10 var ranges, 88 fixed ranges cpu0: apic clock running at 38MHz cpu0: mwait min=64, max=64, C-substates=0.2.0.2.0.1.0.1, IBE cpu1 at mainbus0: apid 1 (application processor) cpu1: 12th Gen Intel(R) Core(TM) i5-1245U, 1893.04 MHz, 06-9a-04 cpu1: FPU,VME,DE,PSE,TSC,MSR,PAE,MCE,CX8,APIC,SEP,MTRR,PGE,MCA,CMOV,PAT,PSE36,CFLUSH,DS,ACPI,MMX,FXSR,SSE,SSE2,SS,HTT,TM,PBE,SSE3,PCLMUL,DTES64,MWAIT,DS-CPL,VMX,SMX,EST,TM2,SSSE3,SDBG,FMA3,CX16,xTPR,PDCM,PCID,SSE4.1,SSE4.2,x2APIC,MOVBE,POPCNT,DEADLINE,AES,XSAVE,AVX,F16C,RDRAND,NXE,PAGE1GB,RDTSCP,LONG,LAHF,ABM,3DNOWP,PERF,ITSC,FSGSBASE,TSC_ADJUST,BMI1,AVX2,SMEP,BMI2,ERMS,INVPCID,RDSEED,ADX,SMAP,CLFLUSHOPT,CLWB,PT,SHA,UMIP,PKU,PKS,MD_CLEAR,IBT,IBRS,IBPB,STIBP,L1DF,SSBD,SENSOR,ARAT,XSAVEOPT,XSAVEC,XGETBV1,XSAVES cpu1: 48KB 64b/line 12-way D-cache, 32KB 64b/line 8-way I-cache, 1MB 64b/line 10-way L2 cache, 12MB 64b/line 12-way L3 cache cpu1: smt 1, core 0, package 0 cpu2 at mainbus0: apid 8 (application processor) cpu2: 12th Gen Intel(R) Core(TM) i5-1245U, 1561.10 MHz, 06-9a-04 cpu2: FPU,VME,DE,PSE,TSC,MSR,PAE,MCE,CX8,APIC,SEP,MTRR,PGE,MCA,CMOV,PAT,PSE36,CFLUSH,DS,ACPI,MMX,FXSR,SSE,SSE2,SS,HTT,TM,PBE,SSE3,PCLMUL,DTES6
Re: intel T14 gen 3, picom triggers page fault trap in dpt_insert_entries
On Mon, Apr 24, 2023 at 01:49:32PM +0100, Stuart Henderson wrote: > Running picom (with no special config or command line flags) on intel > T14 gen 3 fairly easily triggers a crash in drm. If it doesn't fail the > first time, exiting and restarting a few times pretty much always > triggers it. > > Full proc listing below after dmesg, Xorg is the only active process > at the time. > > xcompmgr hasn't yet triggered it. > > > uvm_fault(0x824b4570, 0x81e73014, 0, 1) -> e > kernel: page fault trap, code=0 > Stopped atdpt_insert_entries+0xbc:movl0x34(%r8),%r10d > TIDPIDUID PRFLAGS PFLAGS CPU COMMAND > > *459624 48440 350x12 04K Xorg > > dpt_insert_entries(81a1cc00,fd83b9afd178,0,0) at > dpt_insert_entries+0xbc this is line 34 of /sys/dev/pci/drm/i915/i915_scatterlist.h 23 static __always_inline struct sgt_iter { 24 struct scatterlist *sgp; 25 union { 26 unsigned long pfn; 27 dma_addr_t dma; 28 }; 29 unsigned int curr; 30 unsigned int max; 31 } __sgt_iter(struct scatterlist *sgl, bool dma) { 32 struct sgt_iter s = { .sgp = sgl }; 33 34 if (dma && s.sgp && sg_dma_len(s.sgp) == 0) { 35 s.sgp = NULL; 36 } else if (s.sgp) { sgl is pointing to something that isn't there? I have an intel t14 gen 3 but can't reproduce this. Running fvwm from xenocara and starting picom from xterm 20 times or so, ^C after each. Looking over the local changes to i915_scatterlist.h the segment size could be larger, I'm not sure if that would help. Index: dev/pci/drm/i915/i915_scatterlist.h === RCS file: /cvs/src/sys/dev/pci/drm/i915/i915_scatterlist.h,v retrieving revision 1.3 diff -u -p -r1.3 i915_scatterlist.h --- dev/pci/drm/i915/i915_scatterlist.h 1 Jan 2023 01:34:54 - 1.3 +++ dev/pci/drm/i915/i915_scatterlist.h 24 Apr 2023 13:15:46 - @@ -153,7 +153,7 @@ static inline unsigned int i915_sg_segme #else static inline unsigned int i915_sg_segment_size(struct device *dev) { - return PAGE_SIZE; + return round_down(UINT_MAX, PAGE_SIZE); } #endif > dpt_bind_vma(81a1cc00,0,fd83b9afd178,0,400) at dpt_bind_vma+0x64 > i915_vma_bind(81ce4ec0,0,400,0,fd83b9afd178) at > i915_vma_bind+0x319 > i915_vma_pin_ww(81ce4ec0,800033b78db0,0,20,400) at > i915_vma_pin_ww+0x454 > intel_plane_pin_fb(81cc9000) at intel_plane_pin_fb+0x25c > intel_prepare_plane_fb(814c7400,81cc9000) at > intel_prepare_plane_fb+0x127 > drm_atomic_helper_prepare_planes(8044c078,81cda000) at > drm_atomic_helper_prepare_planes+0x5b > intel_atomic_commit(8044c078,81cda000,1) at > intel_atomic_commit+0xda > drm_atomic_helper_page_flip(814c2800,81e41200,81d55300,1,800033b79048) > at drm_atomic_helper_page_flip+0x77 > drm_mode_page_flip_ioctl(8044c078,800033b793e0,8195bc00) > at drm_mode_page_flip_ioctl+0x466 > drm_do_ioctl(8044c078,100,c01864b0,800033b793e0) at > drm_do_ioctl+0x29e > drmioctl(15700,c01864b0,800033b793e0,3,800033bba5c8) at drmioctl+0xdc > VOP_IOCTL(fd845bb870f0,c01864b0,800033b793e0,3,fd845efad750,800033bba5c8) > at VOP_IOCTL+0x60 > vn_ioctl(fd845bd084c0,c01864b0,800033b793e0,800033bba5c8) at > vn_ioctl+0x79
Re: intel T14 gen 3, picom triggers page fault trap in dpt_insert_entries
On 2023/04/24 23:53, Jonathan Gray wrote: > On Mon, Apr 24, 2023 at 01:49:32PM +0100, Stuart Henderson wrote: > > Running picom (with no special config or command line flags) on intel > > T14 gen 3 fairly easily triggers a crash in drm. If it doesn't fail the > > first time, exiting and restarting a few times pretty much always > > triggers it. > > > > Full proc listing below after dmesg, Xorg is the only active process > > at the time. > > > > xcompmgr hasn't yet triggered it. > > > > > > uvm_fault(0x824b4570, 0x81e73014, 0, 1) -> e > > kernel: page fault trap, code=0 > > Stopped at dpt_insert_entries+0xbc:movl0x34(%r8),%r10d > > TIDPIDUID PRFLAGS PFLAGS CPU COMMAND > > > > *459624 48440 350x12 04K Xorg > > > > dpt_insert_entries(81a1cc00,fd83b9afd178,0,0) at > > dpt_insert_entries+0xbc > > this is line 34 of /sys/dev/pci/drm/i915/i915_scatterlist.h > > 23 static __always_inline struct sgt_iter { > 24 struct scatterlist *sgp; > 25 union { > 26 unsigned long pfn; > 27 dma_addr_t dma; > 28 }; > 29 unsigned int curr; > 30 unsigned int max; > 31 } __sgt_iter(struct scatterlist *sgl, bool dma) { > 32 struct sgt_iter s = { .sgp = sgl }; > 33 > 34 if (dma && s.sgp && sg_dma_len(s.sgp) == 0) { > 35 s.sgp = NULL; > 36 } else if (s.sgp) { > > sgl is pointing to something that isn't there? > > I have an intel t14 gen 3 but can't reproduce this. > Running fvwm from xenocara and starting picom from xterm 20 times or so, > ^C after each. I'm using i3, though I used to have picom in .xsession which was started very early - certainly before the wm loaded - and that was crashing too. Currently this is twin display (internal + an HDMI display connected to a USB-C dock, attached via DP-3) though I first ran into with just the internal display. (Took me a little while to get to a state where I could type into ddb). > Looking over the local changes to i915_scatterlist.h the segment size > could be larger, I'm not sure if that would help. I will try that and report back after lunch. > Index: dev/pci/drm/i915/i915_scatterlist.h > === > RCS file: /cvs/src/sys/dev/pci/drm/i915/i915_scatterlist.h,v > retrieving revision 1.3 > diff -u -p -r1.3 i915_scatterlist.h > --- dev/pci/drm/i915/i915_scatterlist.h 1 Jan 2023 01:34:54 - > 1.3 > +++ dev/pci/drm/i915/i915_scatterlist.h 24 Apr 2023 13:15:46 - > @@ -153,7 +153,7 @@ static inline unsigned int i915_sg_segme > #else > static inline unsigned int i915_sg_segment_size(struct device *dev) > { > - return PAGE_SIZE; > + return round_down(UINT_MAX, PAGE_SIZE); > } > #endif > > > > dpt_bind_vma(81a1cc00,0,fd83b9afd178,0,400) at dpt_bind_vma+0x64 > > i915_vma_bind(81ce4ec0,0,400,0,fd83b9afd178) at > > i915_vma_bind+0x319 > > i915_vma_pin_ww(81ce4ec0,800033b78db0,0,20,400) at > > i915_vma_pin_ww+0x454 > > intel_plane_pin_fb(81cc9000) at intel_plane_pin_fb+0x25c > > intel_prepare_plane_fb(814c7400,81cc9000) at > > intel_prepare_plane_fb+0x127 > > drm_atomic_helper_prepare_planes(8044c078,81cda000) at > > drm_atomic_helper_prepare_planes+0x5b > > intel_atomic_commit(8044c078,81cda000,1) at > > intel_atomic_commit+0xda > > drm_atomic_helper_page_flip(814c2800,81e41200,81d55300,1,800033b79048) > > at drm_atomic_helper_page_flip+0x77 > > drm_mode_page_flip_ioctl(8044c078,800033b793e0,8195bc00) > > at drm_mode_page_flip_ioctl+0x466 > > drm_do_ioctl(8044c078,100,c01864b0,800033b793e0) at > > drm_do_ioctl+0x29e > > drmioctl(15700,c01864b0,800033b793e0,3,800033bba5c8) at > > drmioctl+0xdc > > VOP_IOCTL(fd845bb870f0,c01864b0,800033b793e0,3,fd845efad750,800033bba5c8) > > at VOP_IOCTL+0x60 > > vn_ioctl(fd845bd084c0,c01864b0,800033b793e0,800033bba5c8) at > > vn_ioctl+0x79 >
Re: intel T14 gen 3, picom triggers page fault trap in dpt_insert_entries
On 2023/04/24 15:00, Stuart Henderson wrote: > > Looking over the local changes to i915_scatterlist.h the segment size > > could be larger, I'm not sure if that would help. > > I will try that and report back after lunch. Doesn't help. > > > Index: dev/pci/drm/i915/i915_scatterlist.h > > === > > RCS file: /cvs/src/sys/dev/pci/drm/i915/i915_scatterlist.h,v > > retrieving revision 1.3 > > diff -u -p -r1.3 i915_scatterlist.h > > --- dev/pci/drm/i915/i915_scatterlist.h 1 Jan 2023 01:34:54 - > > 1.3 > > +++ dev/pci/drm/i915/i915_scatterlist.h 24 Apr 2023 13:15:46 - > > @@ -153,7 +153,7 @@ static inline unsigned int i915_sg_segme > > #else > > static inline unsigned int i915_sg_segment_size(struct device *dev) > > { > > - return PAGE_SIZE; > > + return round_down(UINT_MAX, PAGE_SIZE); > > } > > #endif > > > > > > > dpt_bind_vma(81a1cc00,0,fd83b9afd178,0,400) at > > > dpt_bind_vma+0x64 > > > i915_vma_bind(81ce4ec0,0,400,0,fd83b9afd178) at > > > i915_vma_bind+0x319 > > > i915_vma_pin_ww(81ce4ec0,800033b78db0,0,20,400) at > > > i915_vma_pin_ww+0x454 > > > intel_plane_pin_fb(81cc9000) at intel_plane_pin_fb+0x25c > > > intel_prepare_plane_fb(814c7400,81cc9000) at > > > intel_prepare_plane_fb+0x127 > > > drm_atomic_helper_prepare_planes(8044c078,81cda000) at > > > drm_atomic_helper_prepare_planes+0x5b > > > intel_atomic_commit(8044c078,81cda000,1) at > > > intel_atomic_commit+0xda > > > drm_atomic_helper_page_flip(814c2800,81e41200,81d55300,1,800033b79048) > > > at drm_atomic_helper_page_flip+0x77 > > > drm_mode_page_flip_ioctl(8044c078,800033b793e0,8195bc00) > > > at drm_mode_page_flip_ioctl+0x466 > > > drm_do_ioctl(8044c078,100,c01864b0,800033b793e0) at > > > drm_do_ioctl+0x29e > > > drmioctl(15700,c01864b0,800033b793e0,3,800033bba5c8) at > > > drmioctl+0xdc > > > VOP_IOCTL(fd845bb870f0,c01864b0,800033b793e0,3,fd845efad750,800033bba5c8) > > > at VOP_IOCTL+0x60 > > > vn_ioctl(fd845bd084c0,c01864b0,800033b793e0,800033bba5c8) at > > > vn_ioctl+0x79 > > >
Re: intel T14 gen 3, picom triggers page fault trap in dpt_insert_entries
On Mon, Apr 24, 2023 at 11:53:25PM +1000, Jonathan Gray wrote: > On Mon, Apr 24, 2023 at 01:49:32PM +0100, Stuart Henderson wrote: > > Running picom (with no special config or command line flags) on intel > > T14 gen 3 fairly easily triggers a crash in drm. If it doesn't fail the > > first time, exiting and restarting a few times pretty much always > > triggers it. > > > > Full proc listing below after dmesg, Xorg is the only active process > > at the time. > > > > xcompmgr hasn't yet triggered it. > > > > > > uvm_fault(0x824b4570, 0x81e73014, 0, 1) -> e > > kernel: page fault trap, code=0 > > Stopped at dpt_insert_entries+0xbc:movl0x34(%r8),%r10d > > TIDPIDUID PRFLAGS PFLAGS CPU COMMAND > > > > *459624 48440 350x12 04K Xorg > > > > dpt_insert_entries(81a1cc00,fd83b9afd178,0,0) at > > dpt_insert_entries+0xbc > > this is line 34 of /sys/dev/pci/drm/i915/i915_scatterlist.h > > 23 static __always_inline struct sgt_iter { > 24 struct scatterlist *sgp; > 25 union { > 26 unsigned long pfn; > 27 dma_addr_t dma; > 28 }; > 29 unsigned int curr; > 30 unsigned int max; > 31 } __sgt_iter(struct scatterlist *sgl, bool dma) { > 32 struct sgt_iter s = { .sgp = sgl }; > 33 > 34 if (dma && s.sgp && sg_dma_len(s.sgp) == 0) { > 35 s.sgp = NULL; > 36 } else if (s.sgp) { > > sgl is pointing to something that isn't there? > > I have an intel t14 gen 3 but can't reproduce this. > Running fvwm from xenocara and starting picom from xterm 20 times or so, > ^C after each. Tested with snapshot OpenBSD 7.3-current (GENERIC.MP) #1176: Wed May 10 17:30:02 MDT 2023 I cannot reproduce with picom in the default xenodm session for root, neither with fwvm nor cwm restarted into via fvwm's menu. But bonzomatic reliably triggers an uvm_fault(), sadly that's the only blue line I see at the bottom overlapping ttyC0 console output before the machine locks up and only hard reset helps. fvwm just opens a window for bonzomatic in which nothing happens, i.e. cwm is needed (I kept restarting into the menu to keep the reproducing process the same). bonzomatic needs no config or flags, it spawns a fullscreen editor with a preset shader running live as background... > > Looking over the local changes to i915_scatterlist.h the segment size > could be larger, I'm not sure if that would help. > > Index: dev/pci/drm/i915/i915_scatterlist.h > === > RCS file: /cvs/src/sys/dev/pci/drm/i915/i915_scatterlist.h,v > retrieving revision 1.3 > diff -u -p -r1.3 i915_scatterlist.h > --- dev/pci/drm/i915/i915_scatterlist.h 1 Jan 2023 01:34:54 - > 1.3 > +++ dev/pci/drm/i915/i915_scatterlist.h 24 Apr 2023 13:15:46 - > @@ -153,7 +153,7 @@ static inline unsigned int i915_sg_segme > #else > static inline unsigned int i915_sg_segment_size(struct device *dev) > { > - return PAGE_SIZE; > + return round_down(UINT_MAX, PAGE_SIZE); > } > #endif > > > > dpt_bind_vma(81a1cc00,0,fd83b9afd178,0,400) at dpt_bind_vma+0x64 > > i915_vma_bind(81ce4ec0,0,400,0,fd83b9afd178) at > > i915_vma_bind+0x319 > > i915_vma_pin_ww(81ce4ec0,800033b78db0,0,20,400) at > > i915_vma_pin_ww+0x454 > > intel_plane_pin_fb(81cc9000) at intel_plane_pin_fb+0x25c > > intel_prepare_plane_fb(814c7400,81cc9000) at > > intel_prepare_plane_fb+0x127 > > drm_atomic_helper_prepare_planes(8044c078,81cda000) at > > drm_atomic_helper_prepare_planes+0x5b > > intel_atomic_commit(8044c078,81cda000,1) at > > intel_atomic_commit+0xda > > drm_atomic_helper_page_flip(814c2800,81e41200,81d55300,1,800033b79048) > > at drm_atomic_helper_page_flip+0x77 > > drm_mode_page_flip_ioctl(8044c078,800033b793e0,8195bc00) > > at drm_mode_page_flip_ioctl+0x466 > > drm_do_ioctl(8044c078,100,c01864b0,800033b793e0) at > > drm_do_ioctl+0x29e > > drmioctl(15700,c01864b0,800033b793e0,3,800033bba5c8) at > > drmioctl+0xdc > > VOP_IOCTL(fd845bb870f0,c01864b0,800033b793e0,3,fd845efad750,800033bba5c8) > > at VOP_IOCTL+0x60 > > vn_ioctl(fd845bd084c0,c01864b0,800033b793e0,800033bba5c8) at > > vn_ioctl+0x79 >