Message-ID: <2136072.1591491984@warthog.procyon.org.uk>
Date:   Sun, 07 Jun 2020 02:06:24 +0100
From:   David Howells <dhowells@...hat.com>
To:     Jani Nikula <jani.nikula@...ux.intel.com>,
        Joonas Lahtinen <joonas.lahtinen@...ux.intel.com>,
        Rodrigo Vivi <rodrigo.vivi@...el.com>
cc:     dhowells@...hat.com, airlied@...hat.com,
        intel-gfx@...ts.freedesktop.org, dri-devel@...ts.freedesktop.org,
        linux-kernel@...r.kernel.org
Subject: A panic and a hang in the i915 drm driver


Hi,

I'm seeing the attached oops and panic from the i915 drm driver.  I've tried
bisecting it, but there's a problem in that one of the merged branches causes
the machine to hang without output.

The oops for commit c41219fda6e04255c44d37fd2c0d898c1c46abf1 looks like:

BUG: kernel NULL pointer dereference, address: 0000000000000000
#PF: supervisor read access in kernel mode
#PF: error_code(0x0000) - not-present page
PGD 0 P4D 0 
Oops: 0000 [#1] SMP PTI
CPU: 2 PID: 1 Comm: swapper/0 Not tainted 5.7.0-rc2-fscache+ #883
Hardware name: ASUS All Series/H97-PLUS, BIOS 2306 10/09/2014
RIP: 0010:intel_psr_enabled+0xb/0x6e
Code: 8b 44 24 08 65 48 33 04 25 28 00 00 00 74 05 e8 7e ff 97 ff 48 83 c4 10 5b 5d 41 5c 41 5d c3 0f 1f 44 00 00 41 55 41 54 55 53 <48> 8b 9f d8 fe ff ff f6 83 5e 08 00 00 20 75 05 45 31 e4 eb 44 80
RSP: 0000:ffff88840dedfa18 EFLAGS: 00010246
RAX: 0000000000000000 RBX: ffff8884086f9000 RCX: 0000000000000000
RDX: 0000000000000001 RSI: ffff8884086f9000 RDI: 0000000000000128
RBP: ffff8884086fb000 R08: 0000000000000000 R09: 0000000000000001
R10: 0000000000000001 R11: 00000000000000ff R12: ffff888408680000
R13: 0000000000000000 R14: 0000000000000000 R15: ffff8884086fb200
FS:  0000000000000000(0000) GS:ffff88840fb00000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000000000000000 CR3: 000000000440c001 CR4: 00000000001606e0
Call Trace:
 intel_read_dp_sdp+0x71/0x2c5
 hsw_crt_get_config+0x18/0x41
 intel_modeset_readout_hw_state+0x24d/0x662
 ? do_raw_spin_lock+0x8b/0xcd
 ? _raw_spin_lock_irqsave+0x10/0x16
 intel_modeset_setup_hw_state+0xa8/0xb59
 ? __next_node_in+0x39/0x42
 ? ww_mutex_lock+0x3d/0x1da
 ? modeset_lock+0xd4/0x114
 ? drm_modeset_lock_all_ctx+0x86/0xcc
 intel_modeset_init+0x285/0x5bf
 ? intel_irq_postinstall+0x485/0x4d1
 i915_driver_probe+0x1b4/0x49c
 ? __kernfs_new_node+0x161/0x1b2
 ? rpm_resume+0x45e/0x485
 i915_pci_probe+0xfd/0x11d
 ? __pm_runtime_resume+0x51/0x5e
 local_pci_probe+0x39/0x7a
 pci_device_probe+0xf5/0x14f
 ? sysfs_do_create_link_sd.isra.0+0x77/0xa3
 really_probe+0x140/0x2a9
 driver_probe_device+0x9c/0xd1
 device_driver_attach+0x3c/0x55
 __driver_attach+0x97/0x9f
 ? device_driver_attach+0x55/0x55
 bus_for_each_dev+0x72/0xa8
 bus_add_driver+0x108/0x1b9
 driver_register+0x9e/0xd7
 ? mipi_dsi_bus_init+0x11/0x11
 i915_init+0x58/0x6b
 do_one_initcall+0x83/0x18a
 kernel_init_freeable+0x19b/0x1fd
 ? rest_init+0x9f/0x9f
 kernel_init+0xa/0xfa
 ret_from_fork+0x1f/0x30
Modules linked in:
CR2: 0000000000000000
---[ end trace d0c4f561618aeb37 ]---
RIP: 0010:intel_psr_enabled+0xb/0x6e
Code: 8b 44 24 08 65 48 33 04 25 28 00 00 00 74 05 e8 7e ff 97 ff 48 83 c4 10 5b 5d 41 5c 41 5d c3 0f 1f 44 00 00 41 55 41 54 55 53 <48> 8b 9f d8 fe ff ff f6 83 5e 08 00 00 20 75 05 45 31 e4 eb 44 80
RSP: 0000:ffff88840dedfa18 EFLAGS: 00010246
RAX: 0000000000000000 RBX: ffff8884086f9000 RCX: 0000000000000000
RDX: 0000000000000001 RSI: ffff8884086f9000 RDI: 0000000000000128
RBP: ffff8884086fb000 R08: 0000000000000000 R09: 0000000000000001
R10: 0000000000000001 R11: 00000000000000ff R12: ffff888408680000
R13: 0000000000000000 R14: 0000000000000000 R15: ffff8884086fb200
FS:  0000000000000000(0000) GS:ffff88840fb00000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000000000000000 CR3: 000000000440c001 CR4: 00000000001606e0
Kernel panic - not syncing: Attempted to kill init! exitcode=0x00000009
Kernel Offset: disabled
---[ end Kernel panic - not syncing: Attempted to kill init! exitcode=0x00000009 ]---


Decoding the RIP gives:

RIP: 0010:intel_psr_enabled (/data/fs/linux-fs/build3/../drivers/gpu/drm/i915/display/intel_display_types.h:1595 /data/fs/linux-fs/build3/../drivers/gpu/drm/i915/display/intel_psr.c:1598) 



Commit c41219fda6e04255c44d37fd2c0d898c1c46abf1 ("Merge tag
'drm-intel-next-fixes-2020-05-20' of
git://anongit.freedesktop.org/drm/drm-intel into drm-next") is definitely bad
and logs an oops to the console and panics, but it's a merge.

On one side is e20bb857dea2f620ff37ae541ed8aee70e3c89f1 ("Merge tag
'exynos-drm-next-for-v5.8' of
git://git.kernel.org/pub/scm/linux/kernel/git/daeinki/drm-exynos into
drm-next"), which hangs.  This is also a merge.

One side of e20bb is f84e1ba336a4f47ae251e4d2d8a694902571b0df
("drm/exynos-vidi: convert platform driver to use dev_groups") which is good.

The other side of c4121 and e20bb derive from the same line of commits, with
three patches between.  All of these, down to at least
230982d8d8df7f9d9aa216840ea2db1df6ad5d37 ("drm/i915: Update DRIVER_DATE to
20200430") cause the machine to hang without any sort of console output.

Commit bfbe1744e4417986419236719922a9a7fda224d1 ("Merge tag
'amd-drm-next-5.8-2020-05-19' of git://people.freedesktop.org/~agd5f/linux
into drm-next") is good.

Commit 47e51832ae93534d872511ba557115722582d94c
("drm/i915/gvt: use context lrc_reg_state for shadow ppgtt override") is good.

I've attached the git log and the config file.

David


View attachment "bisect.log" of type "text/plain" (10205 bytes)

View attachment ".config" of type "text/plain" (104787 bytes)

Powered by blists - more mailing lists