| Summary: | [arrandale] GPU lockup render.IPEHR: 0xff4c4c4c on GNOME Shell [garbage in batch] | ||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| Product: | DRI | Reporter: | Bryce Harrington <bryce> | ||||||||||
| Component: | DRM/Intel | Assignee: | Chris Wilson <chris> | ||||||||||
| Status: | CLOSED DUPLICATE | QA Contact: | |||||||||||
| Severity: | major | ||||||||||||
| Priority: | high | CC: | ben, chris, daniel, eugeni, jbarnes | ||||||||||
| Version: | unspecified | Keywords: | regression | ||||||||||
| Hardware: | x86 (IA32) | ||||||||||||
| OS: | Linux (All) | ||||||||||||
| Whiteboard: | |||||||||||||
| i915 platform: | i915 features: | ||||||||||||
| Attachments: |
|
||||||||||||
|
Description
Bryce Harrington
2011-09-21 17:48:21 UTC
Created attachment 51483 [details]
XorgLog.txt
Created attachment 51484 [details]
i915_error_state.txt
Created attachment 51485 [details]
CurrentDmesg.txt
Created attachment 51486 [details]
BootDmesg.txt
Well, that's no batchbuffer the gpu tries to execute, that's just a pile of rgba pixels. Hence the strange IPEHR code. No idea where these pixels are coming from. We've only seen this on snb and blamed it on semaphores not correctly syncing the batches. Well, it was a batchbuffer. It has the cache domain to prove that the last time the CPU saw it was inactive and ready to execute... With the split rings on SNB, it is much easier to trick the GPU into overwriting memory queued for execution on another ring. On ILK it requires the GPU to overwrite a bo that has already been flushed. One way is userspace could have used an absolute relocation, very unlikely. I have seen such corrupt batches with very short-lived ddx bugs (e.g. marking cache domains incorrectly or not clipping drawing commands correctly) or tiling issues with pipelined fencing and map_and_fenceable. All of which do not seem to apply here. There's something pretty odd with this error_state. The batchbuffer containing the rbgba values has read_domains = GTT | INSTRUCTION | COMMAND | SAMPLER, write_domains = 0. The first 3 read domains are ok (and should be like that), sampler makes just no sense. We probably don't want to sample a batchbuffer, and the write to turn that bo into something worth sampling (or executing, depending upon ordering) should have invalidated the other domains. This is fishy. SAMPLER is used for surface binding table in Mesa (or was). And the surface binding table is embedded at the tail of the batchbuffer, so yes it could legitimately be moved to the SAMPLER domain following the batchbuffer pwrite. My current favourite hypothesis is a wild write from one of the intervening batches, and we have a mix of ddx/dri suspects. Bug 41102 is similar. That looks like a batch buffer clobbered by BLT? I believe this is related to: commit c501ae7f332cdaf42e31af30b72b4b66cbbb1604 Author: Chris Wilson <chris@chris-wilson.co.uk> Date: Wed Dec 14 13:57:23 2011 +0100 drm/i915: Only clear the GPU domains upon a successful finish By clearing the GPU read domains before waiting upon the buffer, we run the risk of the wait being interrupted and the domains prematurely cleared. The next time we attempt to wait upon the buffer (after userspace handles the signal), we believe that the buffer is idle and so skip the wait. There are a number of bugs across all generations which show signs of an overly haste reuse of active buffers. Such as: https://bugs.freedesktop.org/show_bug.cgi?id=29046 https://bugs.freedesktop.org/show_bug.cgi?id=35863 https://bugs.freedesktop.org/show_bug.cgi?id=38952 https://bugs.freedesktop.org/show_bug.cgi?id=40282 https://bugs.freedesktop.org/show_bug.cgi?id=41098 https://bugs.freedesktop.org/show_bug.cgi?id=41102 https://bugs.freedesktop.org/show_bug.cgi?id=41284 https://bugs.freedesktop.org/show_bug.cgi?id=42141 A couple of those pre-date i915_gem_object_finish_gpu(), so may be unrelated (such as a wild write from a userspace command buffer), but this does look like a convincing cause for most of those bugs. Signed-off-by: Chris Wilson <chris@chris-wilson.co.uk> Cc: stable@kernel.org Reviewed-by: Daniel Vetter <daniel.vetter@ffwll.ch> Reviewed-by: Eugeni Dodonov <eugeni.dodonov@intel.com> Signed-off-by: Daniel Vetter <daniel.vetter@ffwll.ch> to mark dup to show relationship *** This bug has been marked as a duplicate of bug 29046 *** Closing resolved+duplicate as duplicate of closed+fixed. |
Use of freedesktop.org services, including Bugzilla, is subject to our Code of Conduct. How we collect and use information is described in our Privacy Policy.