Re: [Xen-devel] Re: pvops: i915 kms crashs with corrupt page table

[Bastian Blank <waldi@xxxxxxxxxx>]

On Wed, Feb 24, 2010 at 11:23:37AM -0800, Jeremy Fitzhardinge wrote:
> On 02/24/2010 09:55 AM, Bastian Blank wrote:
>> I run a 2.6.32 dom0 kernel (the Debian distribution config). If I enable
>> KMS in the intel driver, Xorg crashs with corrupt page table.
> Does this help?

No.

[ 4398.310454] [drm] TV-16: set mode NTSC 480i 0
[ 4398.310454] [drm] TV-16: set mode NTSC 480i 0
[ 4398.310454] [drm] TV-16: set mode NTSC 480i 0
[ 4398.310454] [drm] TV-16: set mode NTSC 480i 0
[ 4398.310454] Xorg: Corrupted page table at address 7ffff3706000
[ 4398.310454] PGD 74e22067 PUD 739e9067 PMD 1dc7067 PTE fffffffffffff22f
[ 4398.310454] Bad pagetable: 000f [#1] SMP 
[ 4398.310454] last sysfs file: 
/sys/devices/virtual/backlight/acpi_video0/brightness
[ 4398.310454] CPU 0 
[ 4398.310454] Modules linked in: xen_evtchn xenfs bridge stp firewire_sbp2 
loop dm_snapshot ide_cs snd_hda_codec_analog snd_hda_intel snd_hda_codec arc4 
snd_hwdep ecb pcmcia joydev snd_pcm iwlagn iwlcore parport_pc tpm_infineon 
snd_timer mac80211 hp_accel yenta_socket lis3lv02d rsrc_nonstatic input_polldev 
parport pcmcia_core ac snd tpm container battery soundcore irda serio_raw 
cfg80211 wmi evdev rfkill crc_ccitt snd_page_alloc tpm_bios pcspkr processor 
psmouse ext3 jbd mbcache dm_mod ide_cd_mod cdrom ata_generic sd_mod crc_t10dif 
ide_pci_generic uhci_hcd e1000e i915 drm_kms_helper drm i2c_algo_bit intel_agp 
button i2c_core video output ahci sdhci_pci sdhci piix ide_core ricoh_mmc 
firewire_ohci firewire_core crc_itu_t mmc_core led_class ehci_hcd libata 
scsi_mod usbcore nls_base thermal fan thermal_sys [last unloaded: 
scsi_wait_scan]
[ 4398.310454] Pid: 1756, comm: Xorg Not tainted 2.6.32-3-xen-amd64 #1 HP 
Compaq 6910p
[ 4398.310454] RIP: e033:[<00007ffff3c5d0a0>]  [<00007ffff3c5d0a0>] 
0x7ffff3c5d0a0
[ 4398.310454] RSP: e02b:00007fffffffe818  EFLAGS: 00010246
[ 4398.310454] RAX: 0000000000000010 RBX: 00007ffff3706000 RCX: 0000000000000000
[ 4398.310454] RDX: 00000000ffff0000 RSI: 00000000ffffffff RDI: 000000000000ffff
[ 4398.310454] RBP: 0000000000000000 R08: 00007ffff3706000 R09: 0000000000000000
[ 4398.310454] R10: 0000000000000000 R11: 0000000000000002 R12: 0000000000000000
[ 4398.310454] R13: 0000000000000040 R14: 0000000400000000 R15: 0000000400000000
[ 4398.310454] FS:  00007ffff7fea790(0000) GS:ffff88000342f000(0000) 
knlGS:0000000000000000
[ 4398.310454] CS:  e033 DS: 0000 ES: 0000 CR0: 000000008005003b
[ 4398.310454] CR2: 00007ffff3706000 CR3: 000000007534f000 CR4: 0000000000002660
[ 4398.310454] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
[ 4398.310454] DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000400
[ 4398.310454] Process Xorg (pid: 1756, threadinfo ffff880074aa0000, task 
ffff88000258cdb0)
[ 4398.310454] 
[ 4398.310454] RIP  [<00007ffff3c5d0a0>] 0x7ffff3c5d0a0
[ 4398.310454]  RSP <00007fffffffe818>
[ 4398.310454] ---[ end trace 9903f83d8074225b ]---
[ 4398.310454] [drm] LVDS-8: set mode 1440x900 1f

If I disable the va randomization, I can correlate the addresses and see:
| 7ffff3701000-7ffff3705000 rw-s 00000000 00:04 16461                      /drm 
mm object (deleted)
| 7ffff3705000-7ffff3706000 rw-s 100001000 00:0e 2043                      
/dev/dri/card0
| 7ffff3706000-7ffff3707000 rw-s 100000000 00:0e 2043                      
/dev/dri/card0
| 7ffff3707000-7ffff39c8000 r-xp 00000000 08:02 106995                     
/usr/lib/dri/i965_dri.so
| 7ffff39c8000-7ffff3bc8000 ---p 002c1000 08:02 106995                     
/usr/lib/dri/i965_dri.so
| 7ffff3bc8000-7ffff3bd7000 rw-p 002c1000 08:02 106995                     
/usr/lib/dri/i965_dri.so
| 7ffff3bd7000-7ffff3be6000 rw-p 00000000 00:00 0 

strace output:
| write(0, "(II) intel(0): Setting screen ph"..., 57) = 57
| ioctl(11, 0xc010645b, 0x7fffffffea20)   = 0
| ioctl(11, 0xc0106464, 0x7fffffffe940)   = 0
| mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_SHARED, 11, 0x100000000) = 
0x7ffff3706000
| ioctl(11, 0x400c645f, 0x7fffffffe950)   = 0
| +++ killed by SIGKILL +++

Bastian

-- 
Captain's Log, star date 21:34.5...

_______________________________________________
Xen-devel mailing list
Xen-devel@xxxxxxxxxxxxxxxxxxx
http://lists.xensource.com/xen-devel