Created attachment 88124 [details]
oops output from dmesg
Ever since switching to drm-intel-nightly to test some patches a while back, my IVB MBA has been oopsing on a regular basis when running piglit quick.tests in a gnome-shell session.
Oops will be attached, but an excerpt:
[111184.767285] RIP: 0010:[<ffffffffa0014c30>] [<ffffffffa0014c30>] i915_gem_free_request+0x50/0xc0 [i915]
[111184.767616] Call Trace:
[111184.767639] [<ffffffffa0015e75>] i915_gem_retire_requests_ring+0x65/0x130 [i915]
[111184.767681] [<ffffffffa001c5b7>] i915_gem_set_domain_ioctl+0x197/0x250 [i915]
[111184.767718] [<ffffffff8151da82>] drm_ioctl+0x502/0x630
[111184.767746] [<ffffffff811c67a1>] ? fsnotify+0x231/0x310
[111184.767774] [<ffffffff8119b8fd>] do_vfs_ioctl+0x2cd/0x4a0
[111184.767801] [<ffffffff8119bb51>] SyS_ioctl+0x81/0xa0
[111184.767829] [<ffffffff81c36ea2>] system_call_fastpath+0x16/0x1b
Apparently at some point my kernel config rotted and lost debugging symbols; I've found the knob to reenable and built a new one so next time I'll be able to get line info.
Author: Kenneth Graunke <firstname.lastname@example.org>
Date: Mon Oct 14 11:38:40 2013 -0700
use per-context OACONTROL stuff again.
branchpoint from danvet:
Merge: e4e0241 14c8d11
Author: Daniel Vetter <email@example.com>
Date: Tue Oct 22 00:28:42 2013 +0200
Merge remote-tracking branch 'drm-upstream/drm-next' into drm-intel-nightly
Note that I was also experiencing this problem without kwg's stuff -- it started when I was trying to get a patch tested for Ben.
Created attachment 88125 [details]
copy of i915.ko in case someone wants to go digging before I reproduce again.
Created attachment 88130 [details] [review]
Serialise i915_gem_release() and i915_gem_free_request()
Chris, can I intrigue you for an i-g-t testcase to exercise this race?
But nice catch, definite case of bonghits locking here ;-)
Created attachment 88276 [details]
gdb log of line numbers for latest oops, for what it's worth.
Attached gdb log of trying to list line numbers on my latest oops. Doesn't look terribly useful.
Author: Chris Wilson <firstname.lastname@example.org>
Date: Wed Dec 4 14:52:06 2013 +0000
drm/i915: Hold mutex across i915_gem_release
Inorder to serialise the closing of the file descriptor and its
subsequent release of client requests with i915_gem_free_request(), we
need to hold the struct_mutex in i915_gem_release(). Failing to do so
has the potential to trigger an OOPS, later with a use-after-free.