Opening many windows on Compiz-GLES makes the kernel crash with SGX

[Marcin Juszkiewicz]

I booted Linaro LEB Ubuntu desktop image on EA1 pandaboard. After opening several terminal windows X11 died and kernel generated oops:

[ 624.715759] Unable to handle kernel NULL pointer dereference at virtual address 000000e8
[ 624.724609] pgd = c0004000
[ 624.727508] [000000e8] *pgd=00000000
[ 624.731445] Internal error: Oops: 5 [#1] PREEMPT SMP
[ 624.736724] last sysfs file: /sys/devices/virtual/sound/timer/uevent
[ 624.743530] Modules linked in: hid binfmt_misc fat vfat usbhid nls_cp437 nls_iso8859_1 omap2_mcspi leds_gpio rfkill omap_wdt ohci_hcd bluetooth usbnet btsdio smsc95xx parport l2cap lp bnep ppdev sco pvrsrvkm
[ 624.763519] CPU: 0 Not tainted (2.6.38-1003-linaro-omap #4~ppa5-Ubuntu)
[ 624.780364] PC is at HASH_Remove_Extended+0x67/0x76 [pvrsrvkm]
[ 624.795837] LR is at HASH_Remove_Extended+0x18/0x76 [pvrsrvkm]
[ 624.811157] pc : [<bf908064>] lr : [<bf908015>] psr: 600f0033
[ 624.811157] sp : e851bca8 ip : 00000000 fp : ebed94f4
[ 624.841644] r10: 00000000 r9 : 00000000 r8 : 00000000
[ 624.856292] r7 : e851bcc4 r6 : 000000e8 r5 : 00000000 r4 : ebabf300
[ 624.872222] r3 : b15e7f80 r2 : 00000040 r1 : 0000003a r0 : 02c579fe
[ 624.888092] Flags: nZCv IRQs on FIQs on Mode SVC_32 ISA Thumb Segment user
[ 624.904785] Control: 50c53c7d Table: ac01c04a DAC: 00000015
[ 624.919799] Process compiz (pid: 750, stack limit = 0xe851a2f8)
[ 624.934967] Stack: (0xe851bca8 to 0xe851c000)
[ 624.948394] bca0: e851bcc4 eb9abe00 00000000 02110a03 00000000 bf908081
[ 624.965911] bcc0: ebabf300 0a516000 00000000 bf90a63f cb679380 cb680420 cb679380 bf904b49
[ 624.983428] bce0: 00000000 d6306720 00000000 00000000 e6e1230c bf905931 00000000 bf905e61
[ 625.000976] bd00: d6306720 00000000 00000024 d8758f80 00000000 00000000 e6e1230c bf905f17
[ 625.018463] bd20: bf905ecf 00000001 d8758d40 bf90a9f1 00000000 0000000e 00000001 bf90aa5d
[ 625.035949] bd40: 00000000 00000000 0000000e 00000000 e6e1230c e6e12300 bf917f08 ebed94e8
[ 625.053436] bd60: e6d9dbe8 bf90ac51 00000000 00000000 e6d50300 bf9183ec ebed9400 bf90ced3
[ 625.070983] bd80: eb928340 bf90897b 000002ee bf903959 bf91123d c07079f0 ecba1580 bf911247
[ 625.088470] bda0: bf91123d c02e60bd ebed9400 ecba1580 00000000 ecba1580 ebed9400 00000000
[ 625.106018] bdc0: ebed94c0 c02da491 000002ee 0000e200 00000001 00000000 00000001 e6d9dbe0
[ 625.123535] bde0: ebed5220 ec593f68 eb95b280 00000008 e6d9dbe8 00000000 0000b25a c0111435
[ 625.141052] be00: 00000000 00000000 e6d9dbe0 ec82f7e0 00000000 ec82f7e0 0000004c 00000000
[ 625.158782] be20: 0000d442 c010ecc3 00000000 000019ff da345f40 c0085de3 ebadaa00 e851a000
[ 625.176483] be40: 00000006 00000001 eb978fc0 eb40fa40 0000d442 c008781d ebadaa00 eb40fa40
[ 625.194091] be60: 00000006 e851a000 e851a000 00000014 e851bef4 c071ea38 ebe6c520 c0087aef
[ 625.211791] be80: 00000003 00000006 020c0027 eb40fa40 e851a000 c0092713 00000000 ebe6ca24
[ 625.229461] bea0: 418004fc c06bb044 e851bfb0 e851bf74 00040100 e851a000 e851bec0 c007de65
[ 625.247131] bec0: ebadaa00 e851bfb0 c0052104 e851a000 00000000 406f48c6 406f48c4 00000000
[ 625.264801] bee0: 00000032 c0054493 ebadaa00 e851bf10 00000000 00000006 00000000 fffffffa
[ 625.282592] bf00: 000002ee 000003e8 c0473f09 e73a6f40 c0086feb e851a000 0000040a 00000000
[ 625.300384] bf20: c011042d 00000001 e851a000 e851bf50 c007de65 e851a000 00000000 e851bf80
[ 625.318176] bf40: c0473ecf e851a000 c0091059 00000020 00000000 00000001 e851a000 e851bf88
[ 625.335937] bf60: c00929f3 00000020 00000000 00000000 00000000 e851a000 e851bf88 c00929f3
[ 625.353698] bf80: 00000020 00000000 00000000 00000001 408874c0 00000001 0000010c 00000000
[ 625.371520] bfa0: e851a000 c00549d1 00000006 c0051faf 00000000 000002ee 00000006 000002ee
[ 625.389343] bfc0: 00000006 408874c0 00000001 0000010c 005cc9e8 beed19ac 00000000 00000032
[ 625.407104] bfe0: 0000010c beed1764 40702a8f 406f48c6 200f0030 000002ee 00000000 00000000
[ 625.425048] [<bf908064>] (HASH_Remove_Extended+0x67/0x76 [pvrsrvkm]) from [<bf908081>] (HASH_Remove+0xe/0x10 [pvrsrvkm])
[ 625.445922] [<bf908081>] (HASH_Remove+0xe/0x10 [pvrsrvkm]) from [<bf90a63f>] (RA_Free+0x10/0x28 [pvrsrvkm])
[ 625.465606] [<bf90a63f>] (RA_Free+0x10/0x28 [pvrsrvkm]) from [<bf904b49>] (BM_CreateHeap_AnyVaCb+0x92/0x104 [pvrsrvkm])
[ 625.486450] [<bf904b49>] (BM_CreateHeap_AnyVaCb+0x92/0x104 [pvrsrvkm]) from [<bf905931>] (BM_FreeExport+0xe/0x10 [pvrsrvkm])
[ 625.507781] [<bf905931>] (BM_FreeExport+0xe/0x10 [pvrsrvkm]) from [<bf905e61>] (PVRSRVFreeSyncInfoKM+0xd0/0x108 [pvrsrvkm])
[ 625.529174] [<bf905e61>] (PVRSRVFreeSyncInfoKM+0xd0/0x108 [pvrsrvkm]) from [<bf905f17>] (UnmapDeviceMemoryCallBack+0x48/0x5a [pvrsrvkm])
[ 625.551940] [<bf905f17>] (UnmapDeviceMemoryCallBack+0x48/0x5a [pvrsrvkm]) from [<bf90a9f1>] (FreeResourceByCriteria_AnyVaCb+0xbc/0x14c [pvrsrvkm])
[ 625.575744] [<bf90a9f1>] (FreeResourceByCriteria_AnyVaCb+0xbc/0x14c [pvrsrvkm]) from [<bf90aa5d>] (FreeResourceByCriteria_AnyVaCb+0x128/0x14c [pvrsrvkm])
[ 625.600311] [<bf90aa5d>] (FreeResourceByCriteria_AnyVaCb+0x128/0x14c [pvrsrvkm]) from [<bf90ac51>] (PVRSRVResManDisconnect+0x108/0x19c [pvrsrvkm])
[ 625.624267] [<bf90ac51>] (PVRSRVResManDisconnect+0x108/0x19c [pvrsrvkm]) from [<bf90ced3>] (PVRSRVPerProcessDataDisconnect+0x1e/0x38 [pvrsrvkm])
[ 625.647979] [<bf90ced3>] (PVRSRVPerProcessDataDisconnect+0x1e/0x38 [pvrsrvkm]) from [<bf90897b>] (PVRSRVProcessDisconnect+0x6/0x8 [pvrsrvkm])
[ 625.671417] [<bf90897b>] (PVRSRVProcessDisconnect+0x6/0x8 [pvrsrvkm]) from [<bf903959>] (PVRSRVRelease+0x28/0x50 [pvrsrvkm])
[ 625.693267] [<bf903959>] (PVRSRVRelease+0x28/0x50 [pvrsrvkm]) from [<bf911247>] (PVRSRVDrmRelease+0xa/0xe [pvrsrvkm])
[ 625.714447] [<bf911247>] (PVRSRVDrmRelease+0xa/0xe [pvrsrvkm]) from [<c02e60bd>] (dev_postclose+0x39/0x50)
[ 625.734680] [<c02e60bd>] (dev_postclose+0x39/0x50) from [<c02da491>] (drm_release+0x205/0x2a4)
[ 625.753845] [<c02da491>] (drm_release+0x205/0x2a4) from [<c0111435>] (__fput+0x5d/0x12c)
[ 625.772338] [<c0111435>] (__fput+0x5d/0x12c) from [<c010ecc3>] (filp_close+0x2f/0x40)
[ 625.790435] [<c010ecc3>] (filp_close+0x2f/0x40) from [<c0085de3>] (put_files_struct+0xaf/0xc0)
[ 625.809295] [<c0085de3>] (put_files_struct+0xaf/0xc0) from [<c008781d>] (do_exit+0x101/0x2a8)
[ 625.828094] [<c008781d>] (do_exit+0x101/0x2a8) from [<c0087aef>] (do_group_exit+0x2b/0x80)
[ 625.846618] [<c0087aef>] (do_group_exit+0x2b/0x80) from [<c0092713>] (get_signal_to_deliver+0x167/0x2ac)
[ 625.866546] [<c0092713>] (get_signal_to_deliver+0x167/0x2ac) from [<c0054493>] (do_signal+0x67/0x14c)
[ 625.886138] [<c0054493>] (do_signal+0x67/0x14c) from [<c00549d1>] (do_notify_resume+0x3d/0x40)
[ 625.905090] [<c00549d1>] (do_notify_resume+0x3d/0x40) from [<c0051faf>] (work_pending+0x1f/0x20)
[ 625.924285] Code: f7ff ff02 e005 4616 (6835)
[ 625.941467] ---[ end trace f19fdb1329df8698 ]---
[ 625.956695] Fixing recursive fault but reboot is needed!

[Ricardo Salveti (rsalveti)]

I believe this is related with the out of (SGX virtual) memory condition, as AFAIK it can only address up-to 256MB (and you can check with TOP that it explodes at the time compiz is consuming almost 256MB of ram).

Maybe a limitation could exist on the X11 driver to avoid creating the pixmap in such conditions, but still it's not trivial to solve the problem (maybe TI can say if it's now in a better status).

[Nicolas Dechesne (ndec)]

the bug report does not mention if it's using compiz or metacity. if it's compiz yes, that's kind of expected as ricardo explained. there is no solution that will be available in the short term. the h/w can only map 256Mb, out of this pool you get about 160Mb of texture. the more you have windows open the more texture... even though you could implement *something* in s/w to workaround the issue, it would be slow and TI will not do that. the real fix is to wait for the OMAP4470 chip (already announced) that comes with a new graphics core which does not have this limitation (well the limit will be 4Gb which gives us a bit more time until we reach the limit)

[Ricardo Salveti (rsalveti)]

Setting to Won't Fix per Nicolas's comment.