Paging Error in vc4 when switching resolution

Start by reproducing the failure on the Raspberry Pi 4 with the two supplied xrandr resolutions, then inspect the vc4_plane_atomic_async_update call path and the linked dmesg trace. Done means repeated resolution switches no longer produce a black display or the reported kernel Oops.

Describe the bug

When I switch to another resolution using the xrandr binary, sometimes the display goes to black and never recovers. The Raspberry Pi is still functioning and I can connect via SSH, but something in the graphics stack seems to have crashed. In such a situation, a need to do a reboot to get my display back.

Steps to reproduce the behaviour

• Toggle the resolution via xrandr (I switch between xrandr -s 1280x720 and xrandr -s 1920x1080)
• If the resolution changed successfully, try again.

Device (s)

Raspberry Pi 4 Mod. B

System

Full raspinfo output: https://pastebin.com/sfUMjcgW

#$ cat /etc/rpi-issue
Raspberry Pi reference 2023-12-11
Generated using pi-gen, https://github.com/RPi-Distro/pi-gen, 2acf7afcba7d11500313a7b93bb55a2aae20b2d6, stage2

#$ vcgencmd version
Oct 17 2023 15:39:16
Copyright (c) 2012 Broadcom
version 30f0c5e4d076da3ab4f341d88e7d505760b93ad7 (clean) (release) (start)

#$ uname -a
Linux beatrice 6.1.0-rpi8-rpi-v8 #1 SMP PREEMPT Debian 1:6.1.73-1+rpt1 (2024-01-25) aarch64 GNU/Linux

Logs

Full dmesg: https://pastebin.com/daZD2GhR
Relevant part:

[16636.545605] Unable to handle kernel NULL pointer dereference at virtual address 0000000000000014
[16636.545624] Mem abort info:
[16636.545627] ESR = 0x0000000096000005
[16636.545631] EC = 0x25: DABT (current EL), IL = 32 bits
[16636.545635] SET = 0, FnV = 0
[16636.545638] EA = 0, S1PTW = 0
[16636.545641] FSC = 0x05: level 1 translation fault
[16636.545644] Data abort info:
[16636.545647] ISV = 0, ISS = 0x00000005
[16636.545649] CM = 0, WnR = 0
[16636.545653] user pgtable: 4k pages, 39-bit VAs, pgdp=00000001031b7000
[16636.545658] [0000000000000014] pgd=0000000000000000, p4d=0000000000000000, pud=0000000000000000
[16636.545670] Internal error: Oops: 0000000096000005 [#1] PREEMPT SMP
[16636.545676] Modules linked in: rpcsec_gss_krb5 cmac algif_hash aes_arm64 aes_generic algif_skcipher af_alg bnep hid_logitech_hidpp brcmfmac brcmutil cfg80211 hci_uart btbcm bluetooth binfmt_misc joydev bcm2835_v4l2(C) ecdh_generic ecc rpivid_hevc(C) bcm2835_isp(C) bcm2835_codec(C) bcm2835_mmal_vchiq(C) v4l2_mem2mem videobuf2_dma_contig videobuf2_vmalloc rfkill videobuf2_memops videobuf2_v4l2 libaes videobuf2_common raspberrypi_hwmon videodev snd_bcm2835(C) vc_sm_cma(C) mc raspberrypi_gpiomem nvmem_rmem sg hid_logitech_dj uio_pdrv_genirq uio fuse dm_mod ip_tables x_tables ipv6 vc4 snd_soc_hdmi_codec drm_display_helper cec drm_dma_helper drm_kms_helper syscopyarea sysfillrect sysimgblt fb_sys_fops v3d gpu_sched drm_shmem_helper snd_soc_core drm drm_panel_orientation_quirks snd_compress i2c_brcmstb snd_pcm_dmaengine snd_pcm snd_timer snd backlight
[16636.545795] CPU: 3 PID: 1529 Comm: InputThread Tainted: G C 6.1.0-rpi8-rpi-v8 #1 Debian 1:6.1.73-1+rpt1
[16636.545802] Hardware name: Raspberry Pi 4 Model B Rev 1.5 (DT)
[16636.545806] pstate: 00000005 (nzcv daif -PAN -UAO -TCO -DIT -SSBS BTYPE=--)
[16636.545811] pc : vc4_plane_atomic_async_update+0x1bc/0x27c [vc4]
[16636.545854] lr : vc4_plane_atomic_async_update+0x50/0x27c [vc4]
[16636.545882] sp : ffffffc008ffb8b0
[16636.545884] x29: ffffffc008ffb8b0 x28: ffffff812f88b400 x27: ffffff812f9e3c00
[16636.545893] x26: 000000000000015c x25: 000000000000025a x24: ffffff812f9e3c00
[16636.545900] x23: ffffff812f9e3c00 x22: ffffff81340b8180 x21: 0000000000000019
[16636.545907] x20: ffffff8104fc4080 x19: ffffff812f88b400 x18: 0000000000000000
[16636.545915] x17: 0000000000000000 x16: ffffffe5dc117380 x15: 0000000000000000
[16636.545922] x14: 0000000000000000 x13: 000000000007bc00 x12: 0000000000007bc0
[16636.545929] x11: 0000000000000040 x10: 0000000000000040 x9 : ffffffe5a1030ec4
[16636.545936] x8 : ffffffe5a1086000 x7 : ffffff81340b8980 x6 : ffffff81340b8180
[16636.545943] x5 : 00000000012a2cd4 x4 : 0000000000000000 x3 : 0000000000000010
[16636.545950] x2 : 0000000000000010 x1 : 0000000000000001 x0 : ffffff812f88a400
[16636.545958] Call trace:
[16636.545961] vc4_plane_atomic_async_update+0x1bc/0x27c [vc4]
[16636.545989] drm_atomic_helper_async_commit+0x70/0x150 [drm_kms_helper]
[16636.546047] drm_atomic_helper_commit+0x114/0x180 [drm_kms_helper]
[16636.546088] drm_atomic_commit+0xb0/0xf0 [drm]
[16636.546217] drm_atomic_helper_update_plane+0x140/0x180 [drm_kms_helper]
[16636.546257] __setplane_atomic+0xfc/0x140 [drm]
[16636.546344] drm_mode_cursor_universal+0x11c/0x24c [drm]
[16636.546429] drm_mode_cursor_common+0x11c/0x230 [drm]
[16636.546514] drm_mode_cursor_ioctl+0x50/0x7c [drm]
[16636.546599] drm_ioctl_kernel+0xd0/0x180 [drm]
[16636.546684] drm_ioctl+0x214/0x430 [drm]
[16636.546769] __arm64_sys_ioctl+0xb4/0xfc
[16636.546782] invoke_syscall+0x50/0x120
[16636.546789] el0_svc_common.constprop.0+0x4c/0xf4
[16636.546796] do_el0_svc+0x34/0xd0
[16636.546802] el0_svc+0x2c/0x84
[16636.546808] el0t_64_sync_handler+0xf4/0x120
[16636.546814] el0t_64_sync+0x18c/0x190
[16636.546821] Code: 39044403 394f3263 390f3003 f9405263 (b8617863)
[16636.546826] ---[ end trace 0000000000000000 ]---
[16636.574080] Unable to handle kernel paging request at virtual address ffffffc008ffbbe0
[16636.574102] Mem abort info:
[16636.574105] ESR = 0x0000000096000007
[16636.574108] EC = 0x25: DABT (current EL), IL = 32 bits
[16636.574113] SET = 0, FnV = 0
[16636.574116] EA = 0, S1PTW = 0
[16636.574119] FSC = 0x07: level 3 translation fault
[16636.574122] Data abort info:
[16636.574125] ISV = 0, ISS = 0x00000007
[16636.574128] CM = 0, WnR = 0
[16636.574131] swapper pgtable: 4k pages, 39-bit VAs, pgdp=0000000001226000
[16636.574135] [ffffffc008ffbbe0] pgd=1000000100159003, p4d=1000000100159003, pud=1000000100159003, pmd=10000001013aa003, pte=0000000000000000
[16636.574150] Internal error: Oops: 0000000096000007 [#2] PREEMPT SMP
[16636.574157] Modules linked in: rpcsec_gss_krb5 cmac algif_hash aes_arm64 aes_generic algif_skcipher af_alg bnep hid_logitech_hidpp brcmfmac brcmutil cfg80211 hci_uart btbcm bluetooth binfmt_misc joydev bcm2835_v4l2(C) ecdh_generic ecc rpivid_hevc(C) bcm2835_isp(C) bcm2835_codec(C) bcm2835_mmal_vchiq(C) v4l2_mem2mem videobuf2_dma_contig videobuf2_vmalloc rfkill videobuf2_memops videobuf2_v4l2 libaes videobuf2_common raspberrypi_hwmon videodev snd_bcm2835(C) vc_sm_cma(C) mc raspberrypi_gpiomem nvmem_rmem sg hid_logitech_dj uio_pdrv_genirq uio fuse dm_mod ip_tables x_tables ipv6 vc4 snd_soc_hdmi_codec drm_display_helper cec drm_dma_helper drm_kms_helper syscopyarea sysfillrect sysimgblt fb_sys_fops v3d gpu_sched drm_shmem_helper snd_soc_core drm drm_panel_orientation_quirks snd_compress i2c_brcmstb snd_pcm_dmaengine snd_pcm snd_timer snd backlight
[16636.574277] CPU: 1 PID: 1524 Comm: Xorg Tainted: G D C 6.1.0-rpi8-rpi-v8 #1 Debian 1:6.1.73-1+rpt1
[16636.574284] Hardware name: Raspberry Pi 4 Model B Rev 1.5 (DT)
[16636.574288] pstate: a0000005 (NzCv daif -PAN -UAO -TCO -DIT -SSBS BTYPE=--)
[16636.574293] pc : __ww_mutex_lock.constprop.0+0x54c/0x8b0
[16636.574310] lr : __ww_mutex_lock.constprop.0+0x824/0x8b0
[16636.574316] sp : ffffffc0090bba50
[16636.574319] x29: ffffffc0090bba50 x28: 00000000ffffffa1 x27: 0000000000000068
[16636.574327] x26: 0000000000000000 x25: ffffff810016e0b0 x24: ffffff810016e0b8
[16636.574335] x23: 0000000000000001 x22: ffffffc0090bbaa8 x21: ffffff810016e0b8
[16636.574342] x20: ffffffc0090bbc18 x19: ffffff810016e0a8 x18: 0000000000000000
[16636.574349] x17: 0000000000000000 x16: ffffffe5dcbfc350 x15: 0000007fe3787eb0
[16636.574356] x14: 0000000000000465 x13: 0441043c04380000 x12: 0898080407d80780
[16636.574363] x11: 0000000000000040 x10: ffffff8104e781f0 x9 : ffffffe5dcbfc294
[16636.574370] x8 : ffffffc0090bbc58 x7 : 0000000000000000 x6 : 0000000000000000
[16636.574377] x5 : ffffff8106566238 x4 : ffffff8102ff9ec0 x3 : ffffff8101880000
[16636.574384] x2 : 0000000000000004 x1 : ffffffc008ffbbd8 x0 : ffffff8101880001
[16636.574391] Call trace:
[16636.574395] __ww_mutex_lock.constprop.0+0x54c/0x8b0
[16636.574403] __ww_mutex_lock_interruptible_slowpath+0x20/0x30
[16636.574409] ww_mutex_lock_interruptible+0x9c/0xe0
[16636.574416] drm_modeset_lock_all_ctx+0x244/0x3d4 [drm]
[16636.574563] drm_mode_setcrtc+0x158/0x6bc [drm]
[16636.574650] drm_ioctl_kernel+0xd0/0x180 [drm]
[16636.574737] drm_ioctl+0x214/0x430 [drm]
[16636.574824] __arm64_sys_ioctl+0xb4/0xfc
[16636.574835] invoke_syscall+0x50/0x120
[16636.574843] el0_svc_common.constprop.0+0x4c/0xf4
[16636.574850] do_el0_svc+0x34/0xd0
[16636.574855] el0_svc+0x2c/0x84
[16636.574861] el0t_64_sync_handler+0xf4/0x120
[16636.574866] el0t_64_sync+0x18c/0x190
[16636.574874] Code: f1001c1f 54ffe289 b9401282 34ffe242 (f9400422)
[16636.574879] ---[ end trace 0000000000000000 ]---
[16636.574883] note: Xorg[1524] exited with preempt_count 2
[16636.665475] detected fb_set_par error, error code: -16

Additional context

The bug happened multiple times with different kernel versions.