Re: kern/56103: i915 crashes kernel

[Stefan Schaeckeler <schaecsn%gmx.net@localhost>]

The following reply was made to PR kern/56103; it has been noted by GNATS.

From: Stefan Schaeckeler <schaecsn%gmx.net@localhost>
To: gnats-bugs%netbsd.org@localhost
Cc: 
Subject: Re: kern/56103: i915 crashes kernel
Date: Mon, 18 Oct 2021 22:27:35 -0700 (PDT)

 > From: gnats-admin%netbsd.org@localhost
 >
 > Thank you very much for your problem report.
 > It has the internal identification `kern/56103'.
 > The individual assigned to look at your
 > report is: kern-bug-people.
 >
 > >Category:       kern
 > >Responsible:    kern-bug-people
 > >Synopsis:       i915 crashes kernel
 > >Arrival-Date:   Mon Apr 12 04:55:00 +0000 2021
 >
 
 =46rom a Google search, I learned that this is a common problem on NetBSD.=
  The
 recommended workaround is switching to uxa acceleration. Uxa acceleration =
 works
 for a few hours, days or weeks. Eventually, the uxa driver fails for me in
 
 ./external/mit/xf86-video-intel/dist/src/uxa/intel_batchbuffer.c with
 
 [ 26933.347] (EE) intel(0): Failed to submit batch buffer, expect renderin=
 g corruption: Cannot allocate memory.
 
 
 I don't see a rendering corruption; this results in multimedia application=
 s
 segfaulting in /usr/X11R7/lib/modules/dri/i965_dri.so. Only a restart of t=
 he X
 server makes multimedia applications work, again. Here is a segfault of ff=
 play:
 
 $ gdb ffplay -c ffplay.core
 GNU gdb (GDB) 8.3
 ...
 Reading symbols from ffplay...
 [New process 1]
 [New process 16]
 [New process 15]
 [New process 14]
 [New process 13]
 [New process 12]
 [New process 11]
 [New process 10]
 [New process 9]
 [New process 8]
 [New process 7]
 [New process 4]
 [New process 3]
 [New process 2]
 Core was generated by `ffplay'.
 Program terminated with signal SIGSEGV, Segmentation fault.
 #0  0x000071b08a541007 in gen6_update_renderbuffer_surface (surf_index=3D0=
 , unit=3D0, rb=3D0x71b0a3ba5b00, brw=3D0x71b0a20a6f30)
     at /usr/xsrc/external/mit/MesaLib/dist/src/mesa/drivers/dri/i965/brw_w=
 m_surface_state.c:253
 253           .base_level =3D irb->mt_level - irb->mt->first_level,
 [Current thread is 1 (process 1)]
 
 (gdb) bt
 #0  0x000071b08a541007 in gen6_update_renderbuffer_surface (surf_index=3D0=
 , unit=3D0, rb=3D0x71b0a3ba5b00, brw=3D0x71b0a20a6f30)
     at /usr/xsrc/external/mit/MesaLib/dist/src/mesa/drivers/dri/i965/brw_w=
 m_surface_state.c:253
 #1  update_renderbuffer_surfaces (brw=3D0x71b0a20a6f30) at /usr/xsrc/exter=
 nal/mit/MesaLib/dist/src/mesa/drivers/dri/i965/brw_wm_surface_state.c:1013
 #2  0x000071b08a7e2e04 in check_and_emit_atom (atom=3D0x71b0a20bde18, stat=
 e=3D<synthetic pointer>, brw=3D0x71b0a20a6f30)
     at /usr/xsrc/external/mit/MesaLib/dist/src/mesa/drivers/dri/i965/brw_s=
 tate_upload.c:496
 #3  brw_upload_pipeline_state (pipeline=3DBRW_RENDER_PIPELINE, brw=3D0x71b=
 0a20a6f30)
     at /usr/xsrc/external/mit/MesaLib/dist/src/mesa/drivers/dri/i965/brw_s=
 tate_upload.c:615
 #4  brw_upload_render_state (brw=3D0x71b0a20a6f30) at /usr/xsrc/external/m=
 it/MesaLib/dist/src/mesa/drivers/dri/i965/brw_state_upload.c:637
 #5  0x000071b08a625f13 in brw_draw_single_prim (indirect=3D0x0, stream=3D0=
 , xfb_obj=3D0x0, prim_id=3D0, prim=3D<optimized out>, ctx=3D0x71b0a20a6f30=
 )
     at /usr/xsrc/external/mit/MesaLib/dist/src/mesa/drivers/dri/i965/brw_d=
 raw.c:987
 #6  brw_draw_prims (ctx=3D0x71b0a20a6f30, prims=3D<optimized out>, nr_prim=
 s=3D1, ib=3D<optimized out>, index_bounds_valid=3D<optimized out>, min_ind=
 ex=3D<optimized out>,
     max_index=3D<optimized out>, gl_xfb_obj=3D0x0, stream=3D0, indirect=3D=
 0x0) at /usr/xsrc/external/mit/MesaLib/dist/src/mesa/drivers/dri/i965/brw_=
 draw.c:1107
 #7  0x000071b08a3d0bd5 in vbo_exec_vtx_flush (exec=3Dexec@entry=3D0x71b0a3=
 b48a70, keepUnmapped=3D<optimized out>)
     at /usr/xsrc/external/mit/MesaLib/dist/src/mesa/vbo/vbo_exec_draw.c:39=
 3
 #8  0x000071b08a3d1b72 in vbo_exec_FlushVertices_internal (exec=3D0x71b0a3=
 b48a70, unmap=3D<optimized out>)
     at /usr/xsrc/external/mit/MesaLib/dist/src/mesa/vbo/vbo_exec_api.c:643
 #9  0x000071b08a3e387c in vbo_exec_FlushVertices (ctx=3Dctx@entry=3D0x71b0=
 a20a6f30, flags=3Dflags@entry=3D1)
     at /usr/xsrc/external/mit/MesaLib/dist/src/mesa/vbo/vbo_exec_api.c:125=
 5
 #10 0x000071b08a494835 in clear (no_error=3Dfalse, mask=3D16384, ctx=3D0x7=
 1b0a20a6f30) at /usr/xsrc/external/mit/MesaLib/dist/src/mesa/main/clear.c:=
 146
 #11 _mesa_Clear (mask=3D16384) at /usr/xsrc/external/mit/MesaLib/dist/src/=
 mesa/main/clear.c:242
 #12 0x000071b0a085377a in GL_RunCommandQueue (renderer=3D0x71b0a3baaa00, c=
 md=3D0x71b0a3b63750, vertices=3D0x71b0a41b1800, vertsize=3D<optimized out>=
 )
     at /var/tmp/pkgsrc/devel/SDL2/work/SDL2-2.0.14/src/render/opengl/SDL_r=
 ender_gl.c:1235
 #13 0x000071b0a0847635 in FlushRenderCommands (renderer=3Drenderer@entry=
 =3D0x71b0a3baaa00) at /var/tmp/pkgsrc/devel/SDL2/work/SDL2-2.0.14/src/rend=
 er/SDL_render.c:221
 #14 0x000071b0a084cb79 in SDL_RenderPresent_REAL (renderer=3D0x71b0a3baaa0=
 0) at /var/tmp/pkgsrc/devel/SDL2/work/SDL2-2.0.14/src/render/SDL_render.c:=
 3174
 #15 0x000000000041224c in video_display (is=3Dis@entry=3D0x71b0a18bf600) a=
 t fftools/ffplay.c:1372
 #16 0x0000000000413d20 in video_refresh (opaque=3Dopaque@entry=3D0x71b0a18=
 bf600, remaining_time=3Dremaining_time@entry=3D0x7f7fffe43868) at fftools/=
 ffplay.c:1689
 #17 0x0000000000414bd8 in refresh_loop_wait_event (event=3D0x7f7fffe43870,=
  is=3D0x71b0a18bf600) at fftools/ffplay.c:3245
 #18 event_loop (cur_stream=3D<optimized out>) at fftools/ffplay.c:3285
 #19 main (argc=3D<optimized out>, argv=3D<optimized out>) at fftools/ffpla=
 y.c:3776
 
 
 debugging optimized code: this cast is actually irb:
 
 (gdb) p/x  *((struct intel_renderbuffer *)rb)
 $18 =3D {Base =3D {Base =3D {Mutex =3D {ptm_magic =3D 0x33330003, ptm_erro=
 rcheck =3D 0x0,
         ptm_pad1 =3D {0x0, 0x0, 0x0}, {ptm_ceiling =3D 0x0, ptm_unused =3D=
  0x0}, ptm_pad2 =3D {
           0x0, 0x0, 0x0}, ptm_owner =3D 0x0, ptm_waiters =3D 0x0, ptm_recu=
 rsed =3D 0x0,
         ptm_spare2 =3D 0x0}, ClassID =3D 0x12345678, Name =3D 0x0, Label =
 =3D 0x0,
       RefCount =3D 0x1, Width =3D 0x0, Height =3D 0x0, Depth =3D 0x0, Purg=
 eable =3D 0x0,
       AttachedAnytime =3D 0x0, NeedsFinishRenderTexture =3D 0x0, NumSample=
 s =3D 0x0,
       NumStorageSamples =3D 0x0, InternalFormat =3D 0x1907, _BaseFormat =
 =3D 0x1907,
       Format =3D 0x6, TexImage =3D 0x0, Delete =3D 0x71b08a4fbb71,
       AllocStorage =3D 0x71b08a4fbb60}, Buffer =3D 0x0, Map =3D 0x0, RowSt=
 ride =3D 0x0,
     ColorType =3D 0x0}, mt =3D 0x0, singlesample_mt =3D 0x0, align_wa_mt =
 =3D 0x0,
   mt_level =3D 0x0, mt_layer =3D 0x0, layer_count =3D 0x1, draw_x =3D 0x0,=
  draw_y =3D 0x0,
   need_downsample =3D 0x1, need_map_upsample =3D 0x0, singlesample_mt_is_t=
 mp =3D 0x0,
   need_srgb =3D 0x0}
 
 
 unfortunately, irb->mt is 0x0 and so irb->mt->first_level seg-faults in li=
 ne 253:
 
       .base_level =3D irb->mt_level - irb->mt->first_level,
 
 Here I gave up. The actual problem is probably anway in
 
 ./external/mit/xf86-video-intel/dist/src/uxa/intel_batchbuffer.c
 
 [ 26933.347] (EE) intel(0): Failed to submit batch buffer, expect renderin=
 g corruption: Cannot allocate memory.
 
 for which I don't have any debugging info - that is very outlandish code.
 
 
 A little bit about my hardware
 
 # lspci -s  00:02.0
 00:02.0 VGA compatible controller: Intel Corporation HD Graphics 510 (rev =
 06) (prog-if 00 [VGA controller])
 
 
 $ dmesg | egrep "drm|915|intelfb"
 [     1.053248] i915drmkms0 at pci0 dev 2 function 0: vendor 8086 product =
 1902 (rev. 0x06)
 [     5.098524] kern info: [drm] Memory usable by graphics device =3D 4096=
 M
 [     5.107554] kern info: [drm] Supports vblank timestamp caching Rev 2 (=
 21.10.2013).
 [     5.107554] kern info: [drm] Driver supports precise vblank timestamp =
 query.
 [     5.107554] kern info: [drm] failed to find VBIOS tables
 [     5.108524] i915drmkms0: interrupting at ioapic0 pin 16 (i915drmkms0)
 [     5.138522] kern info: [drm] failed to retrieve link info, disabling e=
 DP
 [     5.258522] intelfb0 at i915drmkms0
 [     5.258522] intelfb0: framebuffer at 0xffffd08066abc000, size 1920x108=
 0, depth 32, stride 7680
 [     5.308522] wsdisplay0 at intelfb0 kbdmux 1: console (default, vt100 e=
 mulation), using wskbd0
 [     6.188524] kern info: [drm] RC6 on
 
  Stefan