Adreno driver crashing on Lenovo Tab P11 (SM6115)

konradybcio commented 1 year ago

Current Behavior:

Adreno driver dies after some binder calls get denied. Changing selinux to permissive doesn't resolve the problem. My best guess would be that the A11 blobs disagree about something with A12.1.

To Reproduce

flash stock firmware
flash gsi
boot

Expected behavior

The driver should not crash.

Smartphone (please complete the following information):

Device: Lenovo Tab P11 / XiaoXin Pad (non-Pro)
Build Flavor: system-squeak-arm64-ab-gogapps.img (non-Go Gapps behaves the same way, VNDKLite doesn't boot)
Version v416

Additional context

Relevant log fragment:

[   47.584163] [drm:sde_sync_wait:51] [sde error]fence driver name:kgsl-timeline timeline name:kgsl-3d0_9-ndroid.systemui(2445)-RenderThread(2659) seqno:0x31e00 timeline:178752 queued:229824 retired:178752 signaled:0x0
[   47.584176] [drm:sde_plane_wait_input_fence:629] [sde error]plane62 9999ms timeout on 6B67736C fd 42
[   47.584184] [drm:sde_fence_timeline_status:428] [sde error]drm obj:crtc id:72 type:0xcccccccc done_count:19 commit_count:20
[   47.584193] [drm:sde_fence_timeline_status:428] [sde error]drm obj:connector id:29 type:0xc0c0c0c0 done_count:19 commit_count:20
[   47.584586] kgsl kgsl-3d0: Preemption Fault: cur=3 R/W=0x81/0x11f, next=2 R/W=0x24/0x6c9
[   47.584687] kgsl kgsl-3d0: ndroid.systemui[2445]: gpu timeout ctx 6 ts 25536
[   47.584748] kgsl kgsl-3d0: ndroid.systemui[2445]: gpu fault ctx 6 ctx_type GL ts 25536 status 00E59005 rb 00ae/00d0 ib1 00000005001BA000/0000 ib2 00000005016A01B8/0000
[   47.584757] kgsl kgsl-3d0: ndroid.systemui[2445]: gpu fault rb 3 rb sw r/w 00ae/011f
[   47.593030] kgsl kgsl-3d0: ndroid.systemui[2445]: gpu failed ctx 6 ts 25536
[   47.593584] kgsl_iommu_fault_handler: 4 callbacks suppressed
[   47.593598] kgsl kgsl-3d0: GPU PAGE FAULT: addr = C0100 pid= 2800 name=droid.launcher3
[   47.593614] kgsl kgsl-3d0: context=gfx3d_user TTBR0=0x10000df3f5000 CIDR=0xaf0 (read translation fault)
[   47.593628] kgsl kgsl-3d0: FAULTING BLOCK: UCHE: TP | VFD
[   47.593635] kgsl kgsl-3d0: ---- nearby memory ----
[   47.593661] kgsl kgsl-3d0: *EMPTY*
[   47.593667] kgsl kgsl-3d0:  <- fault @ 000C0100
[   47.593676] kgsl kgsl-3d0: [0000000500000000 - 0000000500030000]   (pid = 2800) (any(0))
[   48.651870] audit: audit_lost=3098 audit_rate_limit=5 audit_backlog_limit=64
[   48.651874] audit: rate limit exceeded
[   49.600779] kgsl kgsl-3d0: droid.launcher3[2800]: gpu timeout ctx 13 ts 25536
[   49.600874] kgsl kgsl-3d0: droid.launcher3[2800]: gpu fault ctx 13 ctx_type GL ts 25536 status 00E59005 rb 00ae/00d1 ib1 00000005000B9000/0000 ib2 00000005000BD000/0000
[   49.600892] kgsl kgsl-3d0: droid.launcher3[2800]: gpu fault rb 1 rb sw r/w 00ae/00d1
[   49.610320] kgsl kgsl-3d0: droid.launcher3[2800]: gpu failed ctx 13 ts 25536
[   49.611620] kgsl kgsl-3d0: GPU PAGE FAULT: addr = 2B90100 pid= 2445 name=ndroid.systemui
[   49.611643] kgsl kgsl-3d0: context=gfx3d_user TTBR0=0x10000ede24000 CIDR=0x98d (read translation fault)
[   49.611661] kgsl kgsl-3d0: FAULTING BLOCK: UCHE
[   49.611678] kgsl kgsl-3d0: ---- nearby memory ----
[   49.611741] kgsl kgsl-3d0: *EMPTY*
[   49.611753] kgsl kgsl-3d0:  <- fault @ 02B90100
[   49.611769] kgsl kgsl-3d0: [0000000500000000 - 0000000500030000]   (pid = 2445) (any(0))
[   49.669621] type=1400 audit(1668006548.879:7541): avc: denied { getattr } for comm="Binder:2092_4" scontext=u:r:system_server:s0 tcontext=u:r:audioserver:s0 tclass=process permissive=0
[   49.684176] type=1400 audit(1668006548.891:7542): avc: denied { getattr } for comm="Binder:2054_1" scontext=u:r:surfaceflinger:s0 tcontext=u:r:system_server:s0 tclass=process permissive=0

konradybcio commented 1 year ago

Same story with A12.0 GSI, though there are no binder calls nearby in the log.

konradybcio commented 1 year ago

Same on A11 GSI.

phhusson commented 1 year ago

You're not saying what happens exactly, so I'll presume it tries to launch launcher in loop. Please try this:

adb root
adb shell setprop ro.surface_flinger.running_without_sync_framework true
adb shell setprop ctl.restart surfaceflinger

Does it boot?

If not, then reboot with adb reboot, and try this:

adb root
adb shell setprop debug.sf.latch_unsignaled 1
adb shell setprop ctl.restart surfaceflinger

Does it boot?

Le lun. 5 déc. 2022 à 22:36, Konrad Dybcio @.***> a écrit :

Current Behavior:

Adreno driver dies after some binder calls get denied. Changing selinux to permissive doesn't resolve the problem. My best guess would be that the A11 blobs disagree about something with A12.1. To Reproduce

flash stock firmware

flash gsi

boot

Expected behavior

The driver should not crash. Smartphone (please complete the following information):

Device: Lenovo Tab P11 / XiaoXin Pad (non-Pro)

Build Flavor: system-squeak-arm64-ab-gogapps.img (non-Go Gapps behaves the same way, VNDKLite doesn't boot)

Version v416

Additional context

Relevant log fragment:

[ 47.584163] [drm:sde_sync_wait:51] [sde error]fence driver name:kgsl-timeline timeline name:kgsl-3d0_9-ndroid.systemui(2445)-RenderThread(2659) seqno:0x31e00 timeline:178752 queued:229824 retired:178752 signaled:0x0 [ 47.584176] [drm:sde_plane_wait_input_fence:629] [sde error]plane62 9999ms timeout on 6B67736C fd 42 [ 47.584184] [drm:sde_fence_timeline_status:428] [sde error]drm obj:crtc id:72 type:0xcccccccc done_count:19 commit_count:20 [ 47.584193] [drm:sde_fence_timeline_status:428] [sde error]drm obj:connector id:29 type:0xc0c0c0c0 done_count:19 commit_count:20 [ 47.584586] kgsl kgsl-3d0: Preemption Fault: cur=3 R/W=0x81/0x11f, next=2 R/W=0x24/0x6c9 [ 47.584687] kgsl kgsl-3d0: ndroid.systemui[2445]: gpu timeout ctx 6 ts 25536 [ 47.584748] kgsl kgsl-3d0: ndroid.systemui[2445]: gpu fault ctx 6 ctx_type GL ts 25536 status 00E59005 rb 00ae/00d0 ib1 00000005001BA000/0000 ib2 00000005016A01B8/0000 [ 47.584757] kgsl kgsl-3d0: ndroid.systemui[2445]: gpu fault rb 3 rb sw r/w 00ae/011f [ 47.593030] kgsl kgsl-3d0: ndroid.systemui[2445]: gpu failed ctx 6 ts 25536 [ 47.593584] kgsl_iommu_fault_handler: 4 callbacks suppressed [ 47.593598] kgsl kgsl-3d0: GPU PAGE FAULT: addr = C0100 pid= 2800 name=droid.launcher3 [ 47.593614] kgsl kgsl-3d0: context=gfx3d_user TTBR0=0x10000df3f5000 CIDR=0xaf0 (read translation fault) [ 47.593628] kgsl kgsl-3d0: FAULTING BLOCK: UCHE: TP | VFD [ 47.593635] kgsl kgsl-3d0: ---- nearby memory ---- [ 47.593661] kgsl kgsl-3d0: EMPTY [ 47.593667] kgsl kgsl-3d0: <- fault @ 000C0100 [ 47.593676] kgsl kgsl-3d0: [0000000500000000 - 0000000500030000] (pid = 2800) (any(0)) [ 48.651870] audit: audit_lost=3098 audit_rate_limit=5 audit_backlog_limit=64 [ 48.651874] audit: rate limit exceeded [ 49.600779] kgsl kgsl-3d0: droid.launcher3[2800]: gpu timeout ctx 13 ts 25536 [ 49.600874] kgsl kgsl-3d0: droid.launcher3[2800]: gpu fault ctx 13 ctx_type GL ts 25536 status 00E59005 rb 00ae/00d1 ib1 00000005000B9000/0000 ib2 00000005000BD000/0000 [ 49.600892] kgsl kgsl-3d0: droid.launcher3[2800]: gpu fault rb 1 rb sw r/w 00ae/00d1 [ 49.610320] kgsl kgsl-3d0: droid.launcher3[2800]: gpu failed ctx 13 ts 25536 [ 49.611620] kgsl kgsl-3d0: GPU PAGE FAULT: addr = 2B90100 pid= 2445 name=ndroid.systemui [ 49.611643] kgsl kgsl-3d0: context=gfx3d_user TTBR0=0x10000ede24000 CIDR=0x98d (read translation fault) [ 49.611661] kgsl kgsl-3d0: FAULTING BLOCK: UCHE [ 49.611678] kgsl kgsl-3d0: ---- nearby memory ---- [ 49.611741] kgsl kgsl-3d0: EMPTY [ 49.611753] kgsl kgsl-3d0: <- fault @ 02B90100 [ 49.611769] kgsl kgsl-3d0: [0000000500000000 - 0000000500030000] (pid = 2445) (any(0)) [ 49.669621] type=1400 audit(1668006548.879:7541): avc: denied { getattr } for comm="Binder:2092_4" scontext=u:r:system_server:s0 tcontext=u:r:audioserver:s0 tclass=process permissive=0 [ 49.684176] type=1400 audit(1668006548.891:7542): avc: denied { getattr } for comm="Binder:2054_1" scontext=u:r:surfaceflinger:s0 tcontext=u:r:system_server:s0 tclass=process permissive=0

— Reply to this email directly, view it on GitHub https://github.com/phhusson/treble_experimentations/issues/2482, or unsubscribe https://github.com/notifications/unsubscribe-auth/AAAA4OTO6KS3HZGSR5BWKATWLZN5LANCNFSM6AAAAAASUYA6OQ . You are receiving this because you are subscribed to this thread.Message ID: @.***>

konradybcio commented 1 year ago

You're not saying what happens exactly, so I'll presume it tries to launch launcher in loop.

Right, sorry. The adreno driver starts crashing as soon as the device enters Android-proper (sometimes at bootanim, sometimes after rendering a portion or the entire first frame of the setup screen.

Neither of your suggested fixes helps, but I noticed that it can render things correctly for 2-5s after restarting surfaceflinger, and then it goes back to Adreno constantly crashing.

phhusson commented 1 year ago

Try installing a totally different Launcher, like this one: https://f-droid.org/en/packages/de.markusfisch.android.pielauncher/

phhusson / treble_experimentations