[lucid][xorg-edgers][radeon] Kernel OOPS in radeon_object_clear_surface_reg

[Bernhard Schmidt]

Since a couple of weeks my Lucid system (Compiz effects enabled, ATI 780G = R600 series, xorg-edgers PPA for 3D support in radeon) crashes several times a day. I've managed to pull the following oops using netconsole:

[ 22.588056] ata1: EH complete
[ 25.668606] cscotun0: Disabled Privacy Extensions
[ 762.966160] Slow work thread pool: Starting up
[ 762.966231] Slow work thread pool: Ready
[ 2384.725510] IPv6: sending pkt_too_big to self
[ 2384.725547] IPv6: sending pkt_too_big to self
[ 2800.509142] ------------[ cut here ]------------
[ 2800.509163] WARNING: at /build/buildd/linux-2.6.32/lib/kref.c:43 kref_get+0x21/0x30()
[ 2800.509172] Hardware name: To Be Filled By O.E.M.
[ 2800.509178] Modules linked in: nls_cp437 cifs netconsole configfs binfmt_misc ppdev kvm_amd kvm fbcon tileblit font bitblit softcursor vga16fb vgastate snd_hda_codec_realtek snd_hda_intel snd_hda_codec snd_hwdep snd_pcm_oss snd_mixer_oss snd_pcm snd_seq_dummy snd_seq_oss snd_seq_midi snd_rawmidi snd_seq_midi_event snd_seq radeon snd_timer snd_seq_device ttm drm_kms_helper drm pl2303 usbserial agpgart i2c_algo_bit snd i2c_piix4 shpchp soundcore snd_page_alloc lp parport usbhid usb_storage r8169 mii
[ 2800.509364] Pid: 9, comm: events/0 Not tainted 2.6.32-14-generic #20-Ubuntu
[ 2800.509368] Call Trace:
[ 2800.509380] [<c014a9d2>] warn_slowpath_common+0x72/0xa0
[ 2800.509385] [<c03487e1>] ? kref_get+0x21/0x30
[ 2800.509393] [<c03487e1>] ? kref_get+0x21/0x30
[ 2800.509401] [<c014aa1a>] warn_slowpath_null+0x1a/0x20
[ 2800.509408] [<c03487e1>] kref_get+0x21/0x30
[ 2800.509425] [<f80f4e5c>] ttm_bo_delayed_delete+0x7c/0x140 [ttm]
[ 2800.509431] [<c013d5b3>] ? finish_task_switch+0x43/0xc0
[ 2800.509446] [<f80f4f38>] ttm_bo_delayed_workqueue+0x18/0x30 [ttm]
[ 2800.509453] [<c0161c6e>] run_workqueue+0x8e/0x150
[ 2800.509467] [<f80f4f20>] ? ttm_bo_delayed_workqueue+0x0/0x30 [ttm]
[ 2800.509473] [<c0161db4>] worker_thread+0x84/0xe0
[ 2800.509481] [<c0165d30>] ? autoremove_wake_function+0x0/0x50
[ 2800.509489] [<c0161d30>] ? worker_thread+0x0/0xe0
[ 2800.509496] [<c0165aa4>] kthread+0x74/0x80
[ 2800.509503] [<c0165a30>] ? kthread+0x0/0x80
[ 2800.509512] [<c0104087>] kernel_thread_helper+0x7/0x10
[ 2800.509519] ---[ end trace cefe16882073e65d ]---
[ 2800.509534] BUG: unable to handle kernel NULL pointer dereference at 0000004c
[ 2800.509540] IP: [<c012a268>] __ticket_spin_lock+0x8/0x20
[ 2800.509548] *pde = 6e661067
[ 2800.509554] Oops: 0002 [#1] SMP
[ 2800.509561] last sysfs file: /sys/devices/pci0000:00/0000:00:0a.0/0000:04:00.0/local_cpus
[ 2800.509566] Modules linked in: nls_cp437 cifs netconsole configfs binfmt_misc ppdev kvm_amd kvm fbcon tileblit font bitblit softcursor vga16fb vgastate snd_hda_codec_realtek snd_hda_intel snd_hda_codec snd_hwdep snd_pcm_oss snd_mixer_oss snd_pcm snd_seq_dummy snd_seq_oss snd_seq_midi snd_rawmidi snd_seq_midi_event snd_seq radeon snd_timer snd_seq_device ttm drm_kms_helper drm pl2303 usbserial agpgart i2c_algo_bit snd i2c_piix4 shpchp soundcore snd_page_alloc lp parport usbhid usb_storage r8169 mii
[ 2800.509722]
[ 2800.509727] Pid: 9, comm: events/0 Tainted: G W (2.6.32-14-generic #20-Ubuntu) To Be Filled By O.E.M.
[ 2800.509732] EIP: 0060:[<c012a268>] EFLAGS: 00010202 CPU: 0
[ 2800.509737] EIP is at __ticket_spin_lock+0x8/0x20
[ 2800.509741] EAX: 0000004c EBX: eff1c400 ECX: 00000000 EDX: 00000100
[ 2800.509745] ESI: 0000004c EDI: eff1c438 EBP: f70a5ed8 ESP: f70a5ed8
[ 2800.509749] DS: 007b ES: 007b FS: 00d8 GS: 00e0 SS: 0068
[ 2800.509753] Process events/0 (pid: 9, ti=f70a4000 task=f70a8000 task.ti=f70a4000)
[ 2800.509756] Stack:
[ 2800.509759] f70a5ee0 c05a523d f70a5f10 f80f4c7d 00000001 eff1c428 eff1c400 f12797f0
[ 2800.509772] <0> f70a5f04 f8243600 0000004c eff1c470 eff1c400 eff1c428 f70a5f40 f80f4e79
[ 2800.509848] <0> c013d5b3 00000000 f3157324 00000000 f31575dc eff1c400 f312154c f31575ec
[ 2800.509863] Call Trace:
[ 2800.509868] [<c05a523d>] ? _spin_lock+0xd/0x10
[ 2800.509878] [<f80f4c7d>] ? ttm_bo_cleanup_refs+0x9d/0x200 [ttm]
[ 2800.509887] [<f80f4e79>] ? ttm_bo_delayed_delete+0x99/0x140 [ttm]
[ 2800.509892] [<c013d5b3>] ? finish_task_switch+0x43/0xc0
[ 2800.509900] [<f80f4f38>] ? ttm_bo_delayed_workqueue+0x18/0x30 [ttm]
[ 2800.509906] [<c0161c6e>] ? run_workqueue+0x8e/0x150
[ 2800.509914] [<f80f4f20>] ? ttm_bo_delayed_workqueue+0x0/0x30 [ttm]
[ 2800.509919] [<c0161db4>] ? worker_thread+0x84/0xe0
[ 2800.509924] [<c0165d30>] ? autoremove_wake_function+0x0/0x50
[ 2800.509929] [<c0161d30>] ? worker_thread+0x0/0xe0
[ 2800.509933] [<c0165aa4>] ? kthread+0x74/0x80
[ 2800.509938] [<c0165a30>] ? kthread+0x0/0x80
[ 2800.509943] [<c0104087>] ? kernel_thread_helper+0x7/0x10
[ 2800.509946] Code: b8 0d a1 12 c0 e9 59 ff ff ff 90 b9 10 a1 12 c0 b8 13 a1 12 c0 e9 49 ff ff ff 90 90 90 90 90 90 90 90 90 55 ba 00 01 00 00 89 e5 <f0> 66 0f c1 10 38 f2 74 06 f3 90 8a 10 eb f6 5d c3 8d b4 26 00
[ 2800.510146] EIP: [<c012a268>] __ticket_spin_lock+0x8/0x20 SS:ESP 0068:f70a5ed8
[ 2800.510154] CR2: 000000000000004c
[ 2800.510169] ---[ end trace cefe16882073e65e ]---
[ 2883.714424] BUG: unable to handle kernel NULL pointer dereference at 000008dc
[ 2883.714437] IP: [<f81f5869>] radeon_object_clear_surface_reg+0x29/0x60 [radeon]
[ 2883.714457] *pde = 6ee95067
[ 2883.714461] Oops: 0000 [#2] SMP
[ 2883.714466] last sysfs file: /sys/devices/pci0000:00/0000:00:0a.0/0000:04:00.0/local_cpus
[ 2883.714469] Modules linked in: nls_cp437 cifs netconsole configfs binfmt_misc ppdev kvm_amd kvm fbcon tileblit font bitblit softcursor vga16fb vgastate snd_hda_codec_realtek snd_hda_intel snd_hda_codec snd_hwdep snd_pcm_oss snd_mixer_oss snd_pcm snd_seq_dummy snd_seq_oss snd_seq_midi snd_rawmidi snd_seq_midi_event snd_seq radeon snd_timer snd_seq_device ttm drm_kms_helper drm pl2303 usbserial agpgart i2c_algo_bit snd i2c_piix4 shpchp soundcore snd_page_alloc lp parport usbhid usb_storage r8169 mii
[ 2883.714589]
[ 2883.714593] Pid: 793, comm: ttm_swap Tainted: G D W (2.6.32-14-generic #20-Ubuntu) To Be Filled By O.E.M.
[ 2883.714596] EIP: 0060:[<f81f5869>] EFLAGS: 00010213 CPU: 0
[ 2883.714608] EIP is at radeon_object_clear_surface_reg+0x29/0x60 [radeon]
[ 2883.714611] EAX: f1396a80 EBX: f1396a80 ECX: 00000001 EDX: 00000000
[ 2883.714613] ESI: 00000000 EDI: 00000007 EBP: f31dfe90 ESP: f31dfe84
[ 2883.714615] DS: 007b ES: 007b FS: 00d8 GS: 00e0 SS: 0068
[ 2883.714618] Process ttm_swap (pid: 793, ti=f31de000 task=f315b340 task.ti=f31de000)
[ 2883.714620] Stack:
[ 2883.714621] f1396a80 f3157324 00000000 f31dfe98 f81f5a41 f31dfea0 f81f5aa4 f31dfed0
[ 2883.714687] <0> f80f463a 00000067 00000000 00000000 00000001 010000b8 f31dfeec f81f5a90
[ 2883.714695] <0> 00000000 f1396a80 f1396aa8 f31dff10 f80f4a0f 00000000 00000000 f312154c
[ 2883.714704] Call Trace:
[ 2883.714719] [<f81f5a41>] ? radeon_object_check_tiling+0x31/0x60 [radeon]
[ 2883.714730] [<f81f5aa4>] ? radeon_bo_move_notify+0x14/0x20 [radeon]
[ 2883.714737] [<f80f463a>] ? ttm_bo_handle_move_mem+0xba/0x330 [ttm]
[ 2883.714748] [<f81f5a90>] ? radeon_bo_move_notify+0x0/0x20 [radeon]
[ 2883.714754] [<f80f4a0f>] ? ttm_bo_swapout+0x15f/0x1f0 [ttm]
[ 2883.714759] [<f80f2430>] ? ttm_shrink+0xa0/0x130 [ttm]
[ 2883.714764] [<c013d5b3>] ? finish_task_switch+0x43/0xc0
[ 2883.714768] [<f80f24e7>] ? ttm_shrink_work+0x27/0x30 [ttm]
[ 2883.714773] [<c0161c6e>] ? run_workqueue+0x8e/0x150
[ 2883.714778] [<f80f24c0>] ? ttm_shrink_work+0x0/0x30 [ttm]
[ 2883.714782] [<c0161db4>] ? worker_thread+0x84/0xe0
[ 2883.714785] [<c0165d30>] ? autoremove_wake_function+0x0/0x50
[ 2883.714788] [<c0161d30>] ? worker_thread+0x0/0xe0
[ 2883.714790] [<c0165aa4>] ? kthread+0x74/0x80
[ 2883.714792] [<c0165a30>] ? kthread+0x0/0x80
[ 2883.714855] [<c0104087>] ? kernel_thread_helper+0x7/0x10
[ 2883.714857] Code: 0c c3 55 89 e5 83 ec 0c 89 1c 24 89 74 24 04 89 7c 24 08 0f 1f 44 00 00 8b b8 e8 00 00 00 8b b0 b8 00 00 00 89 c3 83 ff ff 74 22 <8b> 8e dc 08 00 00 89 fa 89 f0 ff 51 78 c7 84 be 68 09 00 00 00
[ 2883.715011] EIP: [<f81f5869>] radeon_object_clear_surface_reg+0x29/0x60 [radeon] SS:ESP 0068:f31dfe84
[ 2883.715026] CR2: 00000000000008dc
[ 2883.715039] ---[ end trace cefe16882073e65f ]---
[ 2897.927659] SysRq : Emergency Remount R/O
[ 2897.978732] SysRq : Emergency Sync
[ 2898.227798] SysRq : Resetting

I will try the drmbackports from http://people.canonical.com/~apw/drm-backport-lucid/ now

ProblemType: Bug
AlsaVersion: Advanced Linux Sound Architecture Driver Version 1.0.21.
Architecture: i386
AudioDevicesInUse:
 USER PID ACCESS COMMAND
 /dev/snd/controlC0: berni 2367 F.... pulseaudio
CRDA: Error: [Errno 2] No such file or directory
Card0.Amixer.info:
 Card hw:0 'SB'/'HDA ATI SB at 0xfddf0000 irq 16'
   Mixer name : 'Realtek ALC662 rev1'
   Components : 'HDA:10ec0662,18493662,00100101'
   Controls : 36
   Simple ctrls : 19
Date: Mon Mar 1 21:04:01 2010
DistroRelease: Ubuntu 10.04
Frequency: This has only happened once.
IwConfig:
 lo no wireless extensions.

 eth1 no wireless extensions.

 lrz no wireless extensions.
MachineType: To Be Filled By O.E.M. To Be Filled By O.E.M.
Package: linux-image-2.6.32-14-generic 2.6.32-14.20
ProcCmdLine: BOOT_IMAGE=/vmlinuz-2.6.32-14-generic root=/dev/mapper/wdc-karmic ro quiet splash
ProcEnviron:
 LANG=de_DE.UTF-8
 SHELL=/bin/bash
ProcVersionSignature: Ubuntu 2.6.32-14.20-generic
Regression: No
RelatedPackageVersions: linux-firmware 1.31
Reproducible: No
RfKill:

SourcePackage: linux
TestedUpstream: No
Uname: Linux 2.6.32-14-generic i686
WpaSupplicantLog:

dmi.bios.date: 04/09/2009
dmi.bios.vendor: American Megatrends Inc.
dmi.bios.version: P1.50
dmi.board.name: A780FullHD
dmi.board.vendor: ASRock
dmi.chassis.asset.tag: To Be Filled By O.E.M.
dmi.chassis.type: 3
dmi.chassis.vendor: To Be Filled By O.E.M.
dmi.chassis.version: To Be Filled By O.E.M.
dmi.modalias: dmi:bvnAmericanMegatrendsInc.:bvrP1.50:bd04/09/2009:svnToBeFilledByO.E.M.:pnToBeFilledByO.E.M.:pvrToBeFilledByO.E.M.:rvnASRock:rnA780FullHD:rvr:cvnToBeFilledByO.E.M.:ct3:cvrToBeFilledByO.E.M.:
dmi.product.name: To Be Filled By O.E.M.
dmi.product.version: To Be Filled By O.E.M.
dmi.sys.vendor: To Be Filled By O.E.M.

[Bernhard Schmidt (berni)]

Did not crash again using drm-backports

[Bernhard Schmidt (berni)]

no more crashes with linux-image-2.6.32-16-generic 2.6.32-16.25 which according to the changelog contains a backport of the 2.6.33 drm.