Re: Panic on drm-devel v5.5.19.g20210909

On 14.09.2021 17:42, Pete Wright via x11 wrote:
> 
> 
> On 9/13/21 6:23 PM, Pete Wright via x11 wrote:
>>
>>
>> On 9/12/21 1:10 PM, Vladimir Kondratyev wrote:
>>>
>>> Could you obtain a crashdump from drm-kmod compiled with -O0 option
>>> added to CFLAGS? Following command will apply -O0 to build:
>>>
>>> $ make clean
>>> $ CFLAGS='-g -O0' make
>>>
>>
>> hopefully this backtrace has the missing info:
>> (kgdb) bt
>> #0  __curthread () at
>> /usr/home/pete/git/freebsd/sys/amd64/include/pcpu_aux.h:55
>> #1  doadump (textdump=textdump@entry=0) at
>> /usr/home/pete/git/freebsd/sys/kern/kern_shutdown.c:399
>> #2  0xffffffff804cf8fa in db_dump (dummy=<optimized out>,
>> dummy2=<unavailable>, dummy3=<unavailable>, dummy4=<unavailable>)
>>     at /usr/home/pete/git/freebsd/sys/ddb/db_command.c:575
>> #3  0xffffffff804cf7b2 in db_command (last_cmdp=<optimized out>,
>> cmd_table=<optimized out>, dopager=dopager@entry=1) at
>> /usr/home/pete/git/freebsd/sys/ddb/db_command.c:482
>> #4  0xffffffff804cf42d in db_command_loop () at
>> /usr/home/pete/git/freebsd/sys/ddb/db_command.c:535
>> #5  0xffffffff804d2ba6 in db_trap (type=<optimized out>,
>> code=<optimized out>) at /usr/home/pete/git/freebsd/sys/ddb/db_main.c:270
>> #6  0xffffffff80c73547 in kdb_trap (type=type@entry=3,
>> code=code@entry=0, tf=tf@entry=0xfffffe011ced0d00) at
>> /usr/home/pete/git/freebsd/sys/kern/subr_kdb.c:733
>> #7  0xffffffff810ebe83 in trap (frame=0xfffffe011ced0d00) at
>> /usr/home/pete/git/freebsd/sys/amd64/amd64/trap.c:609
>> #8  <signal handler called>
>> #9  kdb_enter (why=0xffffffff812e8d97 "panic", msg=<optimized out>) at
>> /usr/home/pete/git/freebsd/sys/kern/subr_kdb.c:506
>> #10 0xffffffff80c259e8 in vpanic (fmt=0xffffffff8121692d "acquiring
>> blockable sleep lock with spinlock or critical section held (%s) %s @
>> %s:%d", ap=<optimized out>,
>>     ap@entry=0xfffffe011ced0e70) at
>> /usr/home/pete/git/freebsd/sys/kern/kern_shutdown.c:907
>> #11 0xffffffff80c25773 in panic (fmt=0xffffffff81e9d9c0 <cnputs_mtx>
>> "KN*\201\377\377\377\377") at
>> /usr/home/pete/git/freebsd/sys/kern/kern_shutdown.c:843
>> #12 0xffffffff80c963b8 in witness_checkorder (lock=0xfffff80004818f88,
>> flags=9, file=<optimized out>,
>>     file@entry=0xffffffff812479c6
>> "/usr/home/pete/git/freebsd/sys/compat/linuxkpi/common/src/linux_work.c",
>> line=line@entry=105, interlock=interlock@entry=0x0)
>>     at /usr/home/pete/git/freebsd/sys/kern/subr_witness.c:1135
>> #13 0xffffffff80c01c44 in __mtx_lock_flags (c=0xfffff80004818fa0,
>> opts=0, file=0xffffffff812479c6
>> "/usr/home/pete/git/freebsd/sys/compat/linuxkpi/common/src/linux_work.c",
>>     line=105) at /usr/home/pete/git/freebsd/sys/kern/kern_mutex.c:278
>> #14 0xffffffff80e9adea in linux_work_exec_unblock
>> (work=0xfffff801be7f1998) at
>> /usr/home/pete/git/freebsd/sys/compat/linuxkpi/common/src/linux_work.c:105
>>
>> #15 linux_queue_work_on (cpu=<optimized out>, wq=0xfffff80004818f80,
>> work=0xfffff801be7f1998) at
>> /usr/home/pete/git/freebsd/sys/compat/linuxkpi/common/src/linux_work.c:150
>>
>> #16 0xffffffff84200e5c in active_retire () from /boot/modules/i915kms.ko
>> #17 0xffffffff842019de in node_retire () from /boot/modules/i915kms.ko
>> #18 0xffffffff84148965 in dma_fence_signal_locked () from
>> /boot/modules/linuxkpi_gplv2.ko
>> #19 0xffffffff84148ca3 in dma_fence_signal () from
>> /boot/modules/linuxkpi_gplv2.ko
>> #20 0xffffffff8414a9de in dma_fence_is_signaled () from
>> /boot/modules/linuxkpi_gplv2.ko
>> #21 0xffffffff8414aadc in dma_resv_add_shared_fence () from
>> /boot/modules/linuxkpi_gplv2.ko
>> #22 0xffffffff84246a02 in i915_vma_move_to_active () from
>> /boot/modules/i915kms.ko
>> #23 0xffffffff843cfbe1 in eb_move_to_gpu () from /boot/modules/i915kms.ko
>> #24 0xffffffff843c93c5 in eb_submit () from /boot/modules/i915kms.ko
>> #25 0xffffffff843c7f5a in i915_gem_do_execbuffer () from
>> /boot/modules/i915kms.ko
>> #26 0xffffffff843c83ab in i915_gem_execbuffer2_ioctl () from
>> /boot/modules/i915kms.ko
>> #27 0xffffffff8448c6d4 in drm_ioctl_kernel () from /boot/modules/drm.ko
>> #28 0xffffffff8448ce92 in drm_ioctl () from /boot/modules/drm.ko
>> #29 0xffffffff80e8ab07 in linux_file_ioctl_sub (fp=<optimized out>,
>> filp=0xfffff8019ecb9300, fop=<optimized out>, cmd=<optimized out>,
>> data=<optimized out>,
>>     td=<optimized out>) at
>> /usr/home/pete/git/freebsd/sys/compat/linuxkpi/common/src/linux_compat.c:985
>>
>> #30 linux_file_ioctl (fp=<optimized out>, cmd=<optimized out>,
>> data=<optimized out>, cred=<optimized out>, td=0xfffffe011d7d0740)
>>     at
>> /usr/home/pete/git/freebsd/sys/compat/linuxkpi/common/src/linux_compat.c:1601
>>
>> #31 0xffffffff80c9bd82 in fo_ioctl (fp=<optimized out>,
>> com=2151703657, data=0x1c200001, active_cred=0x1, td=0xfffffe011d7d0740)
>>     at /usr/home/pete/git/freebsd/sys/sys/file.h:360
>> #32 kern_ioctl (td=<optimized out>, td@entry=0xfffffe011d7d0740,
>> fd=<optimized out>, com=<optimized out>, com@entry=2151703657,
>>     data=0x1c200001 <error: Cannot access memory at address
>> 0x1c200001>, data@entry=0xfffffe011ced1910 "") at
>> /usr/home/pete/git/freebsd/sys/kern/sys_generic.c:803
>> #33 0xffffffff80c9bad4 in sys_ioctl (td=0xfffffe011d7d0740,
>> uap=0xfffffe011d7d0b30) at
>> /usr/home/pete/git/freebsd/sys/kern/sys_generic.c:711
>> #34 0xffffffff810ecc5e in syscallenter (td=<optimized out>) at
>> /usr/home/pete/git/freebsd/sys/amd64/amd64/../../kern/subr_syscall.c:189
>> --Type <RET> for more, q to quit, c to continue without paging--
>> #35 amd64_syscall (td=0xfffffe011d7d0740, traced=0) at
>> /usr/home/pete/git/freebsd/sys/amd64/amd64/trap.c:1191
>> #36 <signal handler called>
>> #37 0x000000080f1ae3ca in ?? ()
>>
> 
> 
> i think i've figured out how to reproduce this issue.  it seems to be
> triggered by chrome, using firefox and other apps and i am not seeing
> any issues.  but once i launch chrome it seems to trigger the panic
> above pretty reliably.  i've even moved my ~/.config/chrome/ directory
> out of the way to ensure i don't have any bad settings and it still
> triggers the panic.
> 
> -pete
> 

Test attached patch. With and without commit 787ffa8c48ec reverted.

-- 
WBR
Vladimir Kondratyev

diff --git a/drivers/gpu/drm/i915/i915_active.c b/drivers/gpu/drm/i915/i915_active.c
index 2cec8cb34..f3aad9016 100644
--- a/drivers/gpu/drm/i915/i915_active.c
+++ b/drivers/gpu/drm/i915/i915_active.c
@@ -166,7 +166,11 @@ __active_retire(struct i915_active *ref)
 }
 
 static void
+#ifdef __linux__
 active_work(struct work_struct *wrk)
+#elif defined(__FreeBSD__)
+active_work(struct irq_work *wrk)
+#endif
 {
 	struct i915_active *ref = container_of(wrk, typeof(*ref), work);
 
@@ -185,7 +189,11 @@ active_retire(struct i915_active *ref)
 		return;
 
 	if (ref->flags & I915_ACTIVE_RETIRE_SLEEPS) {
+#ifdef __linux__
 		queue_work(system_unbound_wq, &ref->work);
+#elif defined(__FreeBSD__)
+		irq_work_queue(&ref->work);
+#endif
 		return;
 	}
 
@@ -288,7 +296,11 @@ void __i915_active_init(struct i915_active *ref,
 	atomic_set(&ref->count, 0);
 	__mutex_init(&ref->mutex, "i915_active", key);
 	__i915_active_fence_init(&ref->excl, &ref->mutex, NULL, excl_retire);
+#ifdef __linux__
 	INIT_WORK(&ref->work, active_work);
+#elif defined(__FreeBSD__)
+	init_irq_work(&ref->work, active_work);
+#endif
 }
 
 static bool ____active_del_barrier(struct i915_active *ref,
@@ -496,7 +508,11 @@ void i915_active_fini(struct i915_active *ref)
 {
 	debug_active_fini(ref);
 	GEM_BUG_ON(atomic_read(&ref->count));
+#ifdef __linux__
 	GEM_BUG_ON(work_pending(&ref->work));
+#elif defined(__FreeBSD__)
+	irq_work_sync(&ref->work);
+#endif
 	GEM_BUG_ON(!RB_EMPTY_ROOT(&ref->tree));
 	mutex_destroy(&ref->mutex);
 }
diff --git a/drivers/gpu/drm/i915/i915_active_types.h b/drivers/gpu/drm/i915/i915_active_types.h
index 96aed0ee7..ce7e2d94f 100644
--- a/drivers/gpu/drm/i915/i915_active_types.h
+++ b/drivers/gpu/drm/i915/i915_active_types.h
@@ -14,6 +14,9 @@
 #include <linux/rbtree.h>
 #include <linux/rcupdate.h>
 #include <linux/workqueue.h>
+#ifdef __FreeBSD__
+#include <linux/irq_work.h>
+#endif
 
 #include "i915_utils.h"
 
@@ -61,7 +64,13 @@ struct i915_active {
 	int (*active)(struct i915_active *ref);
 	void (*retire)(struct i915_active *ref);
 
+#ifdef __linux__
 	struct work_struct work;
+#elif defined(__FreeBSD__)
+	/* On FreeBSD this work is sporadically scheduled
+	 * within a critical section. */
+	struct irq_work work;
+#endif
 
 	struct llist_head preallocated_barriers;
 };