From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from kanga.kvack.org (kanga.kvack.org [205.233.56.17]) by smtp.lore.kernel.org (Postfix) with ESMTP id 3F3B5C001DE for ; Tue, 25 Jul 2023 10:53:40 +0000 (UTC) Received: by kanga.kvack.org (Postfix) id D0E018D0001; Tue, 25 Jul 2023 06:53:39 -0400 (EDT) Received: by kanga.kvack.org (Postfix, from userid 40) id CBE186B0074; Tue, 25 Jul 2023 06:53:39 -0400 (EDT) X-Delivered-To: int-list-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix, from userid 63042) id B86428D0001; Tue, 25 Jul 2023 06:53:39 -0400 (EDT) X-Delivered-To: linux-mm@kvack.org Received: from relay.hostedemail.com (smtprelay0017.hostedemail.com [216.40.44.17]) by kanga.kvack.org (Postfix) with ESMTP id ABF266B0071 for ; Tue, 25 Jul 2023 06:53:39 -0400 (EDT) Received: from smtpin25.hostedemail.com (a10.router.float.18 [10.200.18.1]) by unirelay09.hostedemail.com (Postfix) with ESMTP id 71DEB80D36 for ; Tue, 25 Jul 2023 10:53:39 +0000 (UTC) X-FDA: 81049823358.25.0C9EE4E Received: from mga18.intel.com (mga18.intel.com [134.134.136.126]) by imf07.hostedemail.com (Postfix) with ESMTP id 4655340006 for ; Tue, 25 Jul 2023 10:53:36 +0000 (UTC) Authentication-Results: imf07.hostedemail.com; dkim=pass header.d=intel.com header.s=Intel header.b=QLuKqIpQ; spf=none (imf07.hostedemail.com: domain of tvrtko.ursulin@linux.intel.com has no SPF policy when checking 134.134.136.126) smtp.mailfrom=tvrtko.ursulin@linux.intel.com; dmarc=pass (policy=none) header.from=intel.com ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=hostedemail.com; s=arc-20220608; t=1690282416; h=from:from:sender:reply-to:subject:subject:date:date: message-id:message-id:to:to:cc:cc:mime-version:mime-version: content-type:content-type: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references:dkim-signature; bh=802eGo9jtFx3Sm+17hZJFPC6z06T0wCCJRk9xWVJHKU=; b=Q6NL6jxacxX5HTBjph+j5n7PS6JPUJzDeDuzyxW3/LRRayhKTGVNTTuvuTsLMJrl8MEbbj BXtX/97z8tVi/y6+lUSFKRsIzGKnY41qOPtl/38E19gZR0OWX7zrE6F7r4krH9q9BXdOuL v5asOjqcKPoO4VUzxiuyhOaPygiclSE= ARC-Seal: i=1; s=arc-20220608; d=hostedemail.com; t=1690282416; a=rsa-sha256; cv=none; b=VA+mWIjGsAdAbH8PeZupR6ROfNlNoNSWXi9UtM9DJ6guI7QUW5y0EKRkxKQuf/s7pqajM+ f6e3DFTqboKtpNHYy0GFtST6K7nWQDy+WjSnYMI7YBVr6equQ+FLvffGc8/LjfRMdwFoJB S9qklVfhy1FyeoAFTaHVEQtKXmidqZo= ARC-Authentication-Results: i=1; imf07.hostedemail.com; dkim=pass header.d=intel.com header.s=Intel header.b=QLuKqIpQ; spf=none (imf07.hostedemail.com: domain of tvrtko.ursulin@linux.intel.com has no SPF policy when checking 134.134.136.126) smtp.mailfrom=tvrtko.ursulin@linux.intel.com; dmarc=pass (policy=none) header.from=intel.com DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=intel.com; i=@intel.com; q=dns/txt; s=Intel; t=1690282416; x=1721818416; h=message-id:date:mime-version:subject:to:cc:references: from:in-reply-to:content-transfer-encoding; bh=/H0O+FjMd/lC8BGzzURnOxli8yTXPYTsmbjFZggdkZ8=; b=QLuKqIpQcctdj1KCNq0QsrYfb1MZH6qpX3e5h/06OFFT+n6ToNuoYTu6 jHmb8mPlUTGlt7C35v6vYoXg4VP+AgJ8QpMKrLtcSD1Ih5CrHrNF78vDb FkaWFkijp4fB3dMjTNpwLhK30eiPJr1fVsjPRToSzDj8RhB6zv7hkYUBW pr/C2kO2i8xkDpQHb5xBdANsYJYOwEASJU7p/cnpq8e/+MAV5GrauH4PF KvlkmnIixS5RS5Z7QE6ZEefdIxrk6ThAqHCz5mcz9veao0yRiCqm5FTkv CODeZ9QGkcKdSdEZ2w415xkwOBCiaW7N+SFhCw/nlO8bXY+oGqgi+Eu7a g==; X-IronPort-AV: E=McAfee;i="6600,9927,10781"; a="352585077" X-IronPort-AV: E=Sophos;i="6.01,230,1684825200"; d="scan'208";a="352585077" Received: from fmsmga006.fm.intel.com ([10.253.24.20]) by orsmga106.jf.intel.com with ESMTP/TLS/ECDHE-RSA-AES256-GCM-SHA384; 25 Jul 2023 03:53:34 -0700 X-ExtLoop1: 1 X-IronPort-AV: E=McAfee;i="6600,9927,10781"; a="972625202" X-IronPort-AV: E=Sophos;i="6.01,230,1684825200"; d="scan'208";a="972625202" Received: from grdarcy-mobl1.ger.corp.intel.com (HELO [10.213.228.4]) ([10.213.228.4]) by fmsmga006-auth.fm.intel.com with ESMTP/TLS/ECDHE-RSA-AES256-GCM-SHA384; 25 Jul 2023 03:53:32 -0700 Message-ID: Date: Tue, 25 Jul 2023 11:53:30 +0100 MIME-Version: 1.0 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:102.0) Gecko/20100101 Thunderbird/102.11.0 Subject: Re: [Intel-gfx] Regression in linux-next Content-Language: en-US To: "Borah, Chaitanya Kumar" , "apopple@nvidia.com" Cc: "Nikula, Jani" , "intel-gfx@lists.freedesktop.org" , "linux-kernel@vger.kernel.org" , "linux-mm@kvack.org" , "Kurmi, Suresh Kumar" , "Yedireswarapu, SaiX Nandan" References: From: Tvrtko Ursulin Organization: Intel Corporation UK Plc In-Reply-To: Content-Type: text/plain; charset=UTF-8; format=flowed Content-Transfer-Encoding: 7bit X-Stat-Signature: 6ekhffjz5c99mwu7n68hmnwmx39c4tnk X-Rspamd-Server: rspam10 X-Rspamd-Queue-Id: 4655340006 X-Rspam-User: X-HE-Tag: 1690282416-507412 X-HE-Meta: U2FsdGVkX18u3ivO1RuwvbxbnP0JGBNpbL5JljvBHHSCxAKJi9FkDKFQev0SObkHC71IFPhtohXtp5RG2MSf9PxNNjTH4JDZU4eKa9MCqgSIX4zHRVkYCQRVTJOGB3iTZxh2YfFBN/mSmjLN/wN6I33jO7G0RXuqajPAcuATtEzNulZfk1z0Su+Jm3LNBBXeJf419ZBnp5osq2GkHsYtLoSnsHwOFgscWK2MPFr4cmy4qGvrEvjUYGHja8C/5vLbPzZHK7+dNGPA1ThSXQ3KJBRPVvaBR4M+Ec0JpPbq/eBOtOrU9U5KAsV+x66Do9qN1BC7K6o2KunJ+Bf6ulbWFEut4fh1kal/6wM4zIfcqtwBY8ex1Qnaatgp+3l6UZKpCNGVK2IobNmQvuwx/g4yjdpvF6wdA6inuBNhDcnjUy5hwuXIE9x54J74j2pNny55QYiv2fU5Rq0/50OPsQCFeVG2yv6G0Oqs+6LA6fI97hdz2xyCtU70xMkGtiBRp/RPc48C3OPyKHG+RhwK7yWaaU7IwOs8/K9HbhyA5cmiX9gXBwBuiGUF8cWRZUcInk51CtLwGCkIf0TJxEWziXa+lSR6n+/7d1BPMJSnVKb3W28WMnceYHcCNjSRBHrBJWgTNTlvL4Hepni0xvrm4JtZeEVQfSZKB91Qr3YiUSHePGJgQYGLk3D2QvIlfOeMpU+IYCsDlrVQZR3lQEZnRaBYS7v9fWnFruJmgaq6I5nylV8ojYHWl+FwGx2lsu3nr1Y0F8Akm98Xi5q9B4rftiRq2j16eSyE0yogvtJhk53tZolHsUsZq7UP1ghyRJvFZEQVcLPv9xJtij/kVSB+uVfmnpI6mr/O6174sSpTIxVjkOtHhR6BTP7rfmP9lzilJKw8jVS+pCAk7KS8DnRdJu5KSo0RqnbONfdaK9RgpNFqtCo5ISzjgPOPkowWvoUPraWMxsNW5jzN0Pk13n5C3Vp uwigxEjo 56GtoaeLFxD4ddCbMl8Mv58yvOqbH0TbWT7lTeGeorljEM9TQ3fBTG9c33OCb4RL8goP5Kdan1T7A8+l9dApohFYWag/WPdG/qUKIPOONt1L+Bbldfxuk8317z0K13f7ItS6WT/92kgfmwMfq2bVmoc+Ji/OpbOmPS07CTVx8ncaAAf2ZmTpeEkuZdsGM/KSyR+WQIAR77rSsT/ICTsoQTa47iolI1NOHQIinekyGDvkrx0+4uOpNSkvutW3yNc1dun+iRGYKk7/gYaOjNz9aZXmEaOMQh/KFAUftsyBMYsW0AQjZRMpPxwalUmsp0xcFIVIR621np92/iEj+v5RzOFbCA9Fr0qHrRdybX7Kms9PInU4o0zezO2P6Fw== X-Bogosity: Ham, tests=bogofilter, spamicity=0.000000, version=1.2.4 Sender: owner-linux-mm@kvack.org Precedence: bulk X-Loop: owner-majordomo@kvack.org List-ID: On 25/07/2023 07:42, Borah, Chaitanya Kumar wrote: > Hello Alistair, > > Hope you are doing well. I am Chaitanya from the linux graphics team in Intel. > > This mail is regarding a regression we are seeing in our CI runs[1] on linux-next > repository. > > On next-20230720 [2], we are seeing the following error > > <4>[ 76.189375] Hardware name: Intel Corporation Meteor Lake Client Platform/MTL-P DDR5 SODIMM SBS RVP, BIOS MTLPFWI1.R00.3271.D81.2307101805 07/10/2023 > <4>[ 76.202534] RIP: 0010:__mmu_notifier_register+0x40/0x210 > <4>[ 76.207804] Code: 1a 71 5a 01 85 c0 0f 85 ec 00 00 00 48 8b 85 30 01 00 00 48 85 c0 0f 84 04 01 00 00 8b 85 cc 00 00 00 85 c0 0f 8e bb 01 00 00 <49> 8b 44 24 10 48 83 78 38 00 74 1a 48 83 78 28 00 74 0c 0f 0b b8 > <4>[ 76.226368] RSP: 0018:ffffc900019d7ca8 EFLAGS: 00010202 > <4>[ 76.231549] RAX: 0000000000000001 RBX: 0000000000001000 RCX: 0000000000000001 > <4>[ 76.238613] RDX: 0000000000000000 RSI: ffffffff823ceb7b RDI: ffffffff823ee12d > <4>[ 76.245680] RBP: ffff888102ec9b40 R08: 00000000ffffffff R09: 0000000000000001 > <4>[ 76.252747] R10: 0000000000000001 R11: ffff8881157cd2c0 R12: 0000000000000000 > <4>[ 76.259811] R13: ffff888102ec9c70 R14: ffffffffa07de500 R15: ffff888102ec9ce0 > <4>[ 76.266875] FS: 00007fbcabe11c00(0000) GS:ffff88846ec00000(0000) knlGS:0000000000000000 > <4>[ 76.274884] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 > <4>[ 76.280578] CR2: 0000000000000010 CR3: 000000010d4c2005 CR4: 0000000000f70ee0 > <4>[ 76.287643] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 > <4>[ 76.294711] DR3: 0000000000000000 DR6: 00000000ffff07f0 DR7: 0000000000000400 > <4>[ 76.301775] PKRU: 55555554 > <4>[ 76.304463] Call Trace: > <4>[ 76.306893] > <4>[ 76.308983] ? __die_body+0x1a/0x60 > <4>[ 76.312444] ? page_fault_oops+0x156/0x450 > <4>[ 76.316510] ? do_user_addr_fault+0x65/0x980 > <4>[ 76.320747] ? exc_page_fault+0x68/0x1a0 > <4>[ 76.324643] ? asm_exc_page_fault+0x26/0x30 > <4>[ 76.328796] ? __mmu_notifier_register+0x40/0x210 > <4>[ 76.333460] ? __mmu_notifier_register+0x11c/0x210 > <4>[ 76.338206] ? preempt_count_add+0x4c/0xa0 > <4>[ 76.342273] mmu_notifier_register+0x30/0xe0 > <4>[ 76.346509] mmu_interval_notifier_insert+0x74/0xb0 > <4>[ 76.351344] i915_gem_userptr_ioctl+0x21a/0x320 [i915] > <4>[ 76.356565] ? __pfx_i915_gem_userptr_ioctl+0x10/0x10 [i915] > <4>[ 76.362271] drm_ioctl_kernel+0xb4/0x150 > <4>[ 76.366159] drm_ioctl+0x21d/0x420 > <4>[ 76.369537] ? __pfx_i915_gem_userptr_ioctl+0x10/0x10 [i915] > <4>[ 76.375242] ? find_held_lock+0x2b/0x80 > <4>[ 76.379046] __x64_sys_ioctl+0x79/0xb0 > <4>[ 76.382766] do_syscall_64+0x3c/0x90 > <4>[ 76.386312] entry_SYSCALL_64_after_hwframe+0x6e/0xd8 > <4>[ 76.391317] RIP: 0033:0x7fbcae63f3ab > > Details log can be found in [3]. > > After bisecting the tree, the following patch seems to be causing the > regression. > > commit 828fe4085cae77acb3abf7dd3d25b3ed6c560edf > Author: Alistair Popple apopple@nvidia.com > Date: Wed Jul 19 22:18:46 2023 +1000 > > mmu_notifiers: rename invalidate_range notifier > > There are two main use cases for mmu notifiers. One is by KVM which uses > mmu_notifier_invalidate_range_start()/end() to manage a software TLB. > > The other is to manage hardware TLBs which need to use the > invalidate_range() callback because HW can establish new TLB entries at > any time. Hence using start/end() can lead to memory corruption as these > callbacks happen too soon/late during page unmap. > > mmu notifier users should therefore either use the start()/end() callbacks > or the invalidate_range() callbacks. To make this usage clearer rename > the invalidate_range() callback to arch_invalidate_secondary_tlbs() and > update documention. > > Link: https://lkml.kernel.org/r/9a02dde2f8ddaad2db31e54706a80c12d1817aaf.1689768831.git-series.apopple@nvidia.com > > > We also verified by reverting the patch in the tree. > > Could you please check why this patch causes the regression and if we can find > a solution for it soon? Without checking out the whole tree but only looking at this patch in isolation, it could be that it is not considering NULL subscription can be passed to mmu_notifier_register. For instance from mmu_interval_notifier_insert, which i915 is calling. So the check patch added to __mmu_notifier_register causes a null pointer dereference: @@ -616,6 +617,15 @@ int __mmu_notifier_register(struct mmu_notifier *subscription, mmap_assert_write_locked(mm); BUG_ON(atomic_read(&mm->mm_users) <= 0); + /* + * Subsystems should only register for invalidate_secondary_tlbs() or + * invalidate_range_start()/end() callbacks, not both. + */ + if (WARN_ON_ONCE(subscription->ops->arch_invalidate_secondary_tlbs && ---> subscription is NULL here <--- + (subscription->ops->invalidate_range_start || + subscription->ops->invalidate_range_end))) + return -EINVAL; + Regards, Tvrtko > > [1] https://intel-gfx-ci.01.org/tree/linux-next/combined-alt.html? > [2] https://git.kernel.org/pub/scm/linux/kernel/git/next/linux-next.git/commit/?h=next-20230720 > [3] https://intel-gfx-ci.01.org/tree/linux-next/next-20230720/bat-mtlp-6/dmesg0.txt