linux-kernel - Re: [REGRESSION] QXL display malfunction

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date: Wed, 12 Jun 2024 16:26:04 +0200
From: Thomas Zimmermann <tzimmermann@...e.de>
To: Linux regressions mailing list <regressions@...ts.linux.dev>
Cc: "Petkov, Borislav" <Borislav.Petkov@....com>,
 "zack.rusin@...adcom.com" <zack.rusin@...adcom.com>,
 "dmitry.osipenko@...labora.com" <dmitry.osipenko@...labora.com>,
 "Kaplan, David" <David.Kaplan@....com>,
 "Koenig, Christian" <Christian.Koenig@....com>,
 Dave Airlie <airlied@...hat.com>,
 Maarten Lankhorst <maarten.lankhorst@...ux.intel.com>,
 Maxime Ripard <mripard@...nel.org>, LKML <linux-kernel@...r.kernel.org>,
 ML dri-devel <dri-devel@...ts.freedesktop.org>,
 spice-devel@...ts.freedesktop.org, virtualization@...ts.linux.dev
Subject: Re: [REGRESSION] QXL display malfunction

Hi

Am 12.06.24 um 14:41 schrieb Linux regression tracking (Thorsten Leemhuis):
> [CCing a few more people and lists that get_maintainers pointed out for qxl]
>
> Hi, Thorsten here, the Linux kernel's regression tracker. Top-posting
> for once, to make this easily accessible to everyone.
>
> Thomas, from here it looks like this report that apparently is caused by
> a change of yours that went into 6.10-rc1 (b33651a5c98dbd ("drm/qxl: Do
> not pin buffer objects for vmap")) fell through the cracks. Or was
> progress made to resolve this and I just missed this?
>
> Ciao, Thorsten (wearing his 'the Linux kernel's regression tracker' hat)
> --
> Everything you wanna know about Linux kernel regression tracking:
> https://linux-regtracking.leemhuis.info/about/#tldr
> If I did something stupid, please tell me, as explained on that page.
>
> #regzbot poke
>
>
> On 03.06.24 04:29, Kaplan, David wrote:
>>> -----Original Message-----
>>> From: Kaplan, David
>>> Sent: Sunday, June 2, 2024 9:25 PM
>>> To: tzimmermann@...e.de; dmitry.osipenko@...labora.com; Koenig,
>>> Christian <Christian.Koenig@....com>; zach.rusin@...adcom.com
>>> Cc: Petkov, Borislav <Borislav.Petkov@....com>; regressions@...t.linux.dev
>>> Subject: [REGRESSION] QXL display malfunction
>>>
>>> Hi,
>>>
>>> I am running an Ubuntu 19.10 VM with a tip kernel using QXL video and I've
>>> observed the VM graphics often malfunction after boot, sometimes failing to
>>> load the Ubuntu desktop or even immediately shutting the guest down.
>>> When it does load, the guest dmesg log often contains errors like
>>>
>>> [    4.303586] [drm:drm_atomic_helper_commit_planes] *ERROR* head 1
>>> wrong: 65376256x16777216+0+0
>>> [    4.586883] [drm:drm_atomic_helper_commit_planes] *ERROR* head 1
>>> wrong: 65376256x16777216+0+0
>>> [    4.904036] [drm:drm_atomic_helper_commit_planes] *ERROR* head 1
>>> wrong: 65335296x16777216+0+0

I don't see how these messages are related. Did they already appear 
before the broken commit was there?

>>> [    5.374347] [drm:qxl_release_from_id_locked] *ERROR* failed to find id in
>>> release_idr

Is there only one such message in the log? Or multiple/frequent ones.

Could you provide a stack trace of what happens before?

We sometimes draw into the buffer object from the CPU. For accessing the 
buffer object's pages from the CPU, only a vmap operation should be 
necessary. It appears as if qxl also requires a pin. My guess is that 
the pin inserts the buffer-object's host-side pages and the code around 
qxl_release_from_id_locked() appears to be garbage-collecting them. 
Hence without the pin, the GC complains about inconsistent state.
>>>
>>> I bisected the issue down to "drm/qxl: Do not pin buffer objects for vmap"
>>> (b33651a5c98dbd5a919219d8c129d0674ef74299).

Thanks for bisecting. Does it work if you revert that commit?

Best regards
Thomas


>>>
>>> The full guest .config and guest XML can be provided if desired.  The guest
>>> kernel has QXL support compiled in and the VM has
>>>
>>> <video>
>>>    <model type="qxl" ram="65536" vram="65536" vgamem="16384"
>>> heads="1" primary="yes"/>
>>>    <address type="pci" domain="0x0000" bus="0x00" slot="0x01"
>>> function="0x0"/> </video>
>>>
>>> The host is Ubuntu 24.04 (stock) running QEMU version 8.2.2.  The VM is run
>>> under virt-manager 4.1.0.  If other information would be helpful, just let me
>>> know.
>>>
>>> Thanks --David Kaplan
>> Fixing emails...sorry
>>
>> --David Kaplan
>>
>>

-- 
--
Thomas Zimmermann
Graphics Driver Developer
SUSE Software Solutions Germany GmbH
Frankenstrasse 146, 90461 Nuernberg, Germany
GF: Ivo Totev, Andrew Myers, Andrew McDonald, Boudien Moerman
HRB 36809 (AG Nuernberg)