[Intel-gfx] Kernel Oops on 3.14.66

[Andreas Lampersperger]

Hello,

has anyone here a hint for me, what can cause this error.
The error occures highly sporadic on different machines with intel hd
graphics (ivb_gt1).
I did also some kernel coredumps and found out, that the failed
paging request came from drm_i915_gem_request->list.prev or ->list.next.

Thank you
Andreas

dmesg:

[13328.412403] BUG: unable to handle kernel paging request at 00c6d1fc
[13328.412439] IP: [<f8224eed>] i915_gem_free_request+0x10/0x81 [i915]
[13328.412440] *pde = 00000000
[13328.412443] Oops: 0002 [#1] PREEMPT SMP
[13328.412485] Modules linked in: snd_dummy snd_pcm snd_timer snd
soundcore ftdi_sio usbserial 8250 serial_core jhhw(O) fex(O) fe1(O)
jhint(O) heros(O) arc4 ecb md4 md5 nls_utf8 cifs hid_multitouch
kvm_intel kvm evdev cdc_acm nls_cp437 des_generic af_packet hik(O)
hsci(O) jhnc(O) sr_mod cdrom hldx(O) msr input_polldev i2c_dev w83781d
hwmon_vid i2c_i801 i2c_ali1535 rtc_cmos fuse nbd psmouse igb pch_gbe
ptp_pch e1000 e1000e ptp pps_core e100 mii tun pata_sch usb_storage
sd_mod sg pata_ali ide_gd_mod ide_core ahci libahci ata_piix libata
scsi_mod hid_generic usbmon usbkbd usbhid hid uhci_hcd ohci_pci
ohci_hcd xhci_hcd ehci_pci ehci_hcd usbcore i915 drm_kms_helper drm
firmware_class i2c_algo_bit button video thermal_sys hwmon
[13328.412554] CPU: 1 PID: 5341 Comm: Xorg Tainted: G           O
3.14.66-rt68-heros5 #2
[13328.412555] Hardware name: MC64XX/MC64XX, BIOS MC64XX_2.2.0.377 X64
04/22/2014
[13328.412557] task: efa84970 ti: e640a000 task.ti: e640a000
[13328.412559] EIP: 0060:[<f8224eed>] EFLAGS: 00213246 CPU: 1
[13328.412586] EIP is at i915_gem_free_request+0x10/0x81 [i915]
[13328.412588] EAX: 00c6d1fc EBX: cc303140 ECX: 00000000 EDX: cc3030dc
[13328.412589] ESI: 00000000 EDI: cc30315c EBP: e640bdd8 ESP: e640bdd0
[13328.412591]  DS: 007b ES: 007b FS: 00d8 GS: 0033 SS: 0068
[13328.412592] CR0: 80050033 CR2: 00c6d1fc CR3: 2644b000 CR4: 001407d0
[13328.412593] Stack:
[13328.412597]  f4dd4b24 00000000 e640be00 f8226740 00423d74 cc303140
f4dd4bcc e640a000
[13328.412601]  00423d76 f4d36d00 00000000 f4dd4b24 e640be14 f8226bc4
00000300 082f177c
[13328.412604]  f4d36d00 e640be88 f822a9d6 e640be6c 00000000 00005ea9
00000000 00000000
[13328.412605] Call Trace:
[13328.412638]  [<f8226740>] i915_gem_retire_requests_ring+0xac/0x106 [i915]
[13328.412667]  [<f8226bc4>] i915_gem_object_wait_rendering+0x3c/0x51 [i915]
[13328.412698]  [<f822a9d6>] i915_gem_pwrite_ioctl+0x36d/0x710 [i915]
[13328.412705]  [<c0545ea9>] ? preempt_count_add+0x69/0x9b
[13328.412709]  [<c0151317>] ? migrate_enable+0x11a/0x16b
[13328.412714]  [<c03b4724>] ? _copy_from_user+0x27/0x3a
[13328.412743]  [<f822a669>] ?
i915_gem_object_set_to_gtt_domain+0x15f/0x15f [i915]
[13328.412766]  [<f80f4962>] drm_ioctl+0x2aa/0x3a4 [drm]
[13328.412793]  [<f822a669>] ?
i915_gem_object_set_to_gtt_domain+0x15f/0x15f [i915]
[13328.412802]  [<c0375ef5>] ? avc_has_perm+0x83/0xd6
[13328.412820]  [<f80f46b8>] ? drm_core_reclaim_buffers+0x5b/0x5b [drm]
[13328.412825]  [<c020cc62>] do_vfs_ioctl+0x387/0x436
[13328.412828]  [<c037a1db>] ? file_has_perm+0x4d/0x6e
[13328.412832]  [<c037a5d0>] ? selinux_file_ioctl+0x9b/0x9e
[13328.412836]  [<c020cd4f>] SyS_ioctl+0x3e/0x63
[13328.412841]  [<c0548a00>] sysenter_do_call+0x12/0x12
[13328.412865] Code: fb c7 8a 93 a9 00 00 00 83 e2 fc 83 ca 02 88 93
a9 00 00 00 58 5a 8b 5d fc c9 c3 55 89 e5 56 53 89 c3 8b 50 1c 8b 40
20 89 42 04 <89> 10 8b 73 24 c7 43 1c 00 01 10 00 c7 43 20 00 02 20 00
85 f6
[13328.412891] EIP: [<f8224eed>] i915_gem_free_request+0x10/0x81
[i915] SS:ESP 0068:e640bdd0
[13328.412892] CR2: 0000000000c6d1fc


gdb log of kernel coredump:

i915_gem_free_request (request=0xcc303140) at
drivers/gpu/drm/i915/i915_gem.c:2367
(gdb) p request
$2 = (struct drm_i915_gem_request *) 0xcc303140
(gdb) p *request
$3 = {ring = 0xf4dd4b24, seqno = 4341108, head = 26224, tail = 26240,
ctx = 0xf4d58600, batch_obj = 0xf4d36d00, emitted_jiffies = 13029884,
list = {next = 0xcc3030dc, prev = 0x
c6d1fc}, file_priv = 0xefae4780, client_list = {next = 0xcc3030e8,
prev = 0xefae479c}}
(gdb) bt
#0  __list_del (next=<optimized out>, prev=<optimized out>) at
include/linux/list.h:89
#1  list_del (entry=<optimized out>) at include/linux/list.h:106
#2  i915_gem_free_request (request=0xcc303140) at
drivers/gpu/drm/i915/i915_gem.c:2367
#3  0xf8226740 in i915_gem_retire_requests_ring (ring=0xf4dd4b24) at
drivers/gpu/drm/i915/i915_gem.c:2498
#4  0xf8226bc4 in i915_gem_object_wait_rendering__tail
(ring=<optimized out>, obj=<optimized out>) at
drivers/gpu/drm/i915/i915_gem.c:1144
#5  i915_gem_object_wait_rendering (obj=0xf4d36d00,
readonly=<optimized out>) at drivers/gpu/drm/i915/i915_gem.c:1179
#6  0xf822a9d6 in i915_gem_shmem_pwrite (file=<optimized out>,
args=<optimized out>, obj=<optimized out>, dev=<optimized out>) at
drivers/gpu/drm/i915/i915_gem.c:752
#7  i915_gem_pwrite_ioctl (dev=<optimized out>, data=<optimized out>,
file=<optimized out>) at drivers/gpu/drm/i915/i915_gem.c:927
#8  0xf80f4962 in drm_ioctl (filp=<optimized out>, cmd=<optimized
out>, arg=<optimized out>) at drivers/gpu/drm/drm_drv.c:387
#9  0xc020cc62 in vfs_ioctl (arg=<optimized out>, cmd=<optimized out>,
filp=<optimized out>) at fs/ioctl.c:43
#10 do_vfs_ioctl (filp=0xf01af100, fd=12, cmd=<optimized out>,
arg=3215145920) at fs/ioctl.c:598
#11 0xc020cd4f in SYSC_ioctl (arg=<optimized out>, cmd=<optimized
out>, fd=<optimized out>) at fs/ioctl.c:613
#12 SyS_ioctl (fd=12, cmd=1075864669, arg=-1079821376) at fs/ioctl.c:604
#13 <signal handler called>
#14 0xffffe440 in ?? ()
Backtrace stopped: Cannot access memory at address 0xbfa33b58
(gdb)