[RV280 9200] Xorg hang [drm:radeon_cp_idle] *ERROR* radeon_cp_idle called without lock held [1002:5961]

[Terry]

Binary package hint: xserver-xorg-video-radeon

When attempting to run a 3d game such as Enemy Territory or a game via wine X crashes and locks up. I am still able to ssh into the system but unable to kill X in any way. Exactly the same thing happens using the kernel from Hardy so I'm inclined to believe this not a kernel issue.

dmesg is entirely filled with:
Dec 5 11:23:39 smithers kernel: [ 126.311404] [drm:radeon_cp_idle] *ERROR* radeon_cp_idle called without lock held, held 0 owner ed9589c0 ee2e0880
Dec 5 11:23:39 smithers kernel: [ 126.313311] [drm:radeon_cp_reset] *ERROR* radeon_cp_reset called without lock held, held 0 owner ed9589c0 ee2e0880
Dec 5 11:23:39 smithers kernel: [ 126.316425] [drm:radeon_cp_start] *ERROR* radeon_cp_start called without lock held, held 0 owner ed9589c0 ee2e0880

01:05.0 VGA compatible controller: ATI Technologies Inc RV280 [Radeon 9200] (rev 01)
        Subsystem: C.P. Technology Co. Ltd Device 2063

$ lsb_release -rd
Description: Ubuntu 8.10
Release: 8.10

$ apt-cache policy linux-image-generic
linux-image-generic:
  Installed: 2.6.27.9.13
  Candidate: 2.6.27.9.13
  Version table:
 *** 2.6.27.9.13 0
        500 http://ubuntu.virginmedia.com intrepid-updates/main Packages
        500 http://ubuntu.virginmedia.com intrepid-security/main Packages
        100 /var/lib/dpkg/status
     2.6.27.7.11 0
        500 http://ubuntu.virginmedia.com intrepid/main Packages

[Workaround]
Disable desktop effects.

[Wowbagger (wowbagger)]

Created an attachment (id=5826)
Configuration for server

Configuration for the X server.

[Wowbagger (wowbagger)]

Crap - I thought I had a reproducable lockup, but now all I get is a

xine: r300_state.c:1148: r300_setup_textures: Assertion `tmu_mappings[unit] >=
0' failed.

error when trying to start the second Xine session.

[Michel-tungstengraphics (michel-tungstengraphics)]

That actually makes sense; only one client can use the single Xv adaptor port at
a time. So either there's some kind of race condition that sometimes allows
multiple clients to use it, or the problem is actually with the interaction
between Xv and the OpenGL driver, as xine seems to fall back to using OpenGL
when it can't use Xv.

[Daniel Holbach (dholbach)]

I had a hangup some minutes ago:

Jan 15 11:29:38 localhost kernel: [ 7907.609190] [drm:radeon_cp_idle] *ERROR*
radeon_cp_idle called without lock held
Jan 15 11:29:38 localhost kernel: [ 7907.621161] [drm:radeon_cp_reset] *ERROR*
radeon_cp_reset called without lock held
Jan 15 11:29:38 localhost kernel: [ 7907.621175] [drm:radeon_cp_start] *ERROR*
radeon_cp_start called without lock held
Jan 15 11:29:38 localhost kernel: [ 7907.621187] [drm:radeon_cp_idle] *ERROR*
radeon_cp_idle called without lock held
Jan 15 11:29:38 localhost kernel: [ 7907.633176] [drm:radeon_cp_reset] *ERROR*
radeon_cp_reset called without lock held
Jan 15 11:29:38 localhost kernel: [ 7907.633191] [drm:radeon_cp_start] *ERROR*
radeon_cp_start called without lock held

I reckon it was gnash trying to display something.

If I can supply you with more information, let me know.

[Michel-tungstengraphics (michel-tungstengraphics)]

Can you try to get a backtrace from the X server when this happens?

[Michel-tungstengraphics (michel-tungstengraphics)]

Aapo Tahkola brought up a good point on IRC: Does the lockup also happen with

    Option "DMAForXv" "off"

?

[Daniel Holbach (dholbach)]

X backtrace:

Thread 1 (Thread 47563531181504 (LWP 6713)):
#0 0x00002b423f1e1190 in nanosleep () from /lib/libc.so.6
No symbol table info available.
#1 0x00002b423f2140f4 in usleep () from /lib/libc.so.6
No symbol table info available.
#2 0x00002b4241505a7b in RADEONPllErrataAfterData (info=0x7fd520) at ../../src/radeon_driver.c:759
 RADEONMMIO = (unsigned char *) 0x2b424173b000 <Address 0x2b424173b000 out of bounds>
#3 0x00002b42414fcea9 in RADEONWaitForIdleCP (pScrn=0x7fbf60) at ../../src/radeon_commonfuncs.c:148
 ret = -22
 info = (RADEONInfoPtr) 0x7fd520
 RADEONMMIO = <value optimized out>
 i = 0
 __FUNCTION__ = "RADEONWaitForIdleCP"
#4 0x00002b424220b149 in XAALeaveVT (index=0, flags=0) at ../../../../hw/xfree86/xaa/xaaInit.c:716
 pScreenPriv = (XAAScreenPtr) 0x8f6cd0
 infoRec = (XAAInfoRecPtr) 0x8f72f0
#5 0x000000000046574d in AbortDDX () at ../../../../hw/xfree86/common/xf86Init.c:1304
 i = 1
#6 0x000000000055ebe3 in AbortServer () at ../../os/log.c:408
No locals.
#7 0x000000000055f1b5 in FatalError (f=0x56ec80 "Caught signal %d. Server aborting\n") at ../../os/log.c:554
 args = {{gp_offset = 16, fp_offset = 48, overflow_arg_area = 0x7fff6caad330, reg_save_area = 0x7fff6caad270}}
 beenhere = 1
#8 0x000000000048757c in xf86SigHandler (signo=11) at ../../../../hw/xfree86/common/xf86Events.c:1484
No locals.
#9 <signal handler called>
No symbol table info available.
#10 0x00002b423f1c3070 in memcpy () from /lib/libc.so.6
No symbol table info available.
#11 0x00002b4240749ce9 in getDrawableInfo (dpy=<value optimized out>, screen=0, drawable=<value optimized out>, index=0xb564d4, stamp=0xb564e0, x=0xb564e4,
    y=0xb564e8, width=0xb564ec, height=0xb564f0, numClipRects=0xb564f4, ppClipRects=0xb564f8, backX=0xb56500, backY=0xb56504, numBackClipRects=0xb5650c,
    ppBackClipRects=0xb56510) at ../../../GL/glx/glxdri.c:746
 pClipRects = (drm_clip_rect_t *) 0x1
 pBackClipRects = <value optimized out>
 size = 8
#12 0x00002b4247082e22 in __driUtilUpdateDrawableInfo () from /usr/lib/dri/radeon_dri.so
No symbol table info available.
#13 0x00002b4247089b8d in radeonGetLock () from /usr/lib/dri/radeon_dri.so
No symbol table info available.
#14 0x00002b4247087a9a in radeonFlushCmdBuf () from /usr/lib/dri/radeon_dri.so
No symbol table info available.
#15 0x00002b4240727e3f in DoMakeCurrent (cl=0xeb4a50, drawId=<value optimized out>, readId=44040226, contextId=<value optimized out>, tag=1)
    at ../../../GL/glx/glxcmds.c:631
 client = (ClientPtr) 0xeb96a0
 pDraw = (DrawablePtr) 0xf35230
 pRead = (DrawablePtr) 0xf35230
 reply = {type = 0 '\0', unused = 0 '\0', sequenceNumber = 0, length = 0, contextTag = 0, pad2 = 0, pad3 = 0, pad4 = 0, pad5 = 0, pad6 = 0}
 drawPixmap = (__GLXpixmap *) 0x0
 readPixmap = (__GLXpixmap *) 0x0
 glxc = (__GLXcontext *) 0xbd2ed0
 prevglxc = dwarf2_read_address: Corrupted DWARF expression.
#0 0x00002b423f1e1190 in nanosleep () from /lib/libc.so.6
quit
The program is running. Quit anyway (and detach it)? (y or n) Detaching from program: /usr/bin/Xorg, process 6713

I'll try Option "DMAForXv" "off" now.

[Daniel Holbach (dholbach)]

Another backtrace, this time with Option "DMAForXv" "off" enabled. It still locks up hard.

Thread 1 (Thread 47563531181504 (LWP 6713)):
#0 0x00002b423f1e1190 in nanosleep () from /lib/libc.so.6
No symbol table info available.
#1 0x00002b423f2140f4 in usleep () from /lib/libc.so.6
No symbol table info available.
#2 0x00002b4241505a7b in RADEONPllErrataAfterData (info=0x7fd520) at ../../src/radeon_driver.c:759
 RADEONMMIO = (unsigned char *) 0x2b424173b000 <Address 0x2b424173b000 out of bounds>
#3 0x00002b42414fcea9 in RADEONWaitForIdleCP (pScrn=0x7fbf60) at ../../src/radeon_commonfuncs.c:148
 ret = -22
 info = (RADEONInfoPtr) 0x7fd520
 RADEONMMIO = <value optimized out>
 i = 0
 __FUNCTION__ = "RADEONWaitForIdleCP"
#4 0x00002b424220b149 in XAALeaveVT (index=0, flags=0) at ../../../../hw/xfree86/xaa/xaaInit.c:716
 pScreenPriv = (XAAScreenPtr) 0x8f6cd0
 infoRec = (XAAInfoRecPtr) 0x8f72f0
#5 0x000000000046574d in AbortDDX () at ../../../../hw/xfree86/common/xf86Init.c:1304
 i = 1
#6 0x000000000055ebe3 in AbortServer () at ../../os/log.c:408
No locals.
#7 0x000000000055f1b5 in FatalError (f=0x56ec80 "Caught signal %d. Server aborting\n") at ../../os/log.c:554
 args = {{gp_offset = 16, fp_offset = 48, overflow_arg_area = 0x7fff6caad330, reg_save_area = 0x7fff6caad270}}
 beenhere = 1
#8 0x000000000048757c in xf86SigHandler (signo=11) at ../../../../hw/xfree86/common/xf86Events.c:1484
No locals.
#9 <signal handler called>
No symbol table info available.
#10 0x00002b423f1c3070 in memcpy () from /lib/libc.so.6
No symbol table info available.
#11 0x00002b4240749ce9 in getDrawableInfo (dpy=<value optimized out>, screen=0, drawable=<value optimized out>, index=0xb564d4, stamp=0xb564e0, x=0xb564e4,
    y=0xb564e8, width=0xb564ec, height=0xb564f0, numClipRects=0xb564f4, ppClipRects=0xb564f8, backX=0xb56500, backY=0xb56504, numBackClipRects=0xb5650c,
    ppBackClipRects=0xb56510) at ../../../GL/glx/glxdri.c:746
 pClipRects = (drm_clip_rect_t *) 0x1
 pBackClipRects = <value optimized out>
 size = 8
#12 0x00002b4247082e22 in __driUtilUpdateDrawableInfo () from /usr/lib/dri/radeon_dri.so
No symbol table info available.
#13 0x00002b4247089b8d in radeonGetLock () from /usr/lib/dri/radeon_dri.so
No symbol table info available.
#14 0x00002b4247087a9a in radeonFlushCmdBuf () from /usr/lib/dri/radeon_dri.so
No symbol table info available.
#15 0x00002b4240727e3f in DoMakeCurrent (cl=0xeb4a50, drawId=<value optimized out>, readId=44040226, contextId=<value optimized out>, tag=1)
    at ../../../GL/glx/glxcmds.c:631
 client = (ClientPtr) 0xeb96a0
 pDraw = (DrawablePtr) 0xf35230
 pRead = (DrawablePtr) 0xf35230
 reply = {type = 0 '\0', unused = 0 '\0', sequenceNumber = 0, length = 0, contextTag = 0, pad2 = 0, pad3 = 0, pad4 = 0, pad5 = 0, pad6 = 0}
 drawPixmap = (__GLXpixmap *) 0x0
 readPixmap = (__GLXpixmap *) 0x0
 glxc = (__GLXcontext *) 0xbd2ed0
 prevglxc = dwarf2_read_address: Corrupted DWARF expression.
#0 0x00002b423f1e1190 in nanosleep () from /lib/libc.so.6
quit
The program is running. Quit anyway (and detach it)? (y or n) Detaching from program: /usr/bin/Xorg, process 6713

Thread 1 (Thread 47049118789056 (LWP 9242)):
#0 0x00002aca79bfe190 in n...

[Papadakos Panagiotis (papadako)]

I get the same assertion while using Bump Map effect from osgFX in an OpenSceneGraph application.

r300_state.c:1310: r300_setup_textures: Assertion `tmu_mappings[unit] >= 0' failed.

[Benjamin-close (benjamin-close)]

Bugzilla Upgrade Mass Bug Change

NEEDSINFO state was removed in Bugzilla 3.x, reopening any bugs previously listed as NEEDSINFO.

  - benjsc
    fd.o Wrangler

[Michel-tungstengraphics (michel-tungstengraphics)]

Created an attachment (id=17681)
Try to be more robust about DRIGetDrawableInfo() failures

Oh my, looks like we have once again at least two or three separate issues mixed together here...

Anyway, here's a patch that might help for the crashes shown in comment #7 and comment #8. Let me know if it helps, Daniel.

[Struberg (struberg)]

It seems that I have the same issue with xf86-video-ati git 98fdd78a122958 (and previous)

I tried to compare 3d performance of radeonhd vs radeon and while radeon provides higher fps, it sometimes crashes the whole system.

My system e.g. freezes reproducably after exiting the game freedroidrpg (last version from Fedora9 yum repos; start the game, load or create new tux, then exit the game) when running with radeon, but works fine with radeonhd. After exiting the game I can see X again, but cannot even move the mouse anymore, nor can switch to console or login via ssh from my notebook.

Oct 25 14:56:01 localhost kernel: [drm] Num pipes: 1
Oct 25 14:56:02 localhost kernel: [drm:radeon_cp_idle] *ERROR* radeon_cp_idle called without lock held, held 0 owner ffff81006499bb40 ffff81006499b240
Oct 25 14:56:02 localhost kernel: [drm:radeon_cp_reset] *ERROR* radeon_cp_reset called without lock held, held 0 owner ffff81006499bb40 ffff81006499b240
Oct 25 14:56:02 localhost kernel: [drm:radeon_cp_start] *ERROR* radeon_cp_start called without lock held, held 0 owner ffff81006499bb40 ffff81006499b240
Oct 25 14:56:02 localhost kernel: [drm:radeon_cp_idle] *ERROR* radeon_cp_idle called without lock held, held 0 owner ffff81006499bb40 ffff81006499b240
Oct 25 14:56:02 localhost kernel: [drm:radeon_cp_reset] *ERROR* radeon_cp_reset called without lock held, held 0 owner ffff81006499bb40 ffff81006499b240
Oct 25 14:56:02 localhost kernel: [drm:radeon_cp_start] *ERROR* radeon_cp_start called without lock held, held 0 owner ffff81006499bb40 ffff81006499b240
Oct 25 14:56:02 localhost kernel: [drm:radeon_cp_idle] *ERROR* radeon_cp_idle called without lock held, held 0 owner ffff81006499bb40 ffff81006499b240
Oct 25 14:56:02 localhost kernel: [drm:radeon_cp_reset] *ERROR* radeon_cp_reset called without lock held, held 0 owner ffff81006499bb40 ffff81006499b240
Oct 25 14:56:02 localhost kernel: [drm:radeon_cp_start] *ERROR* radeon_cp_start called without lock held, held 0 owner ffff81006499bb40 ffff81006499b240
Oct 25 14:56:02 localhost kernel: [drm:radeon_cp_idle] *ERROR* radeon_cp_idle called without lock held, held 0 owner ffff81006499bb40 ffff81006499b240

...

Oct 25 14:56:03 localhost kernel: [drm:radeon_cp_idle] *ERROR* radeon_cp_idle called without lock held, held 0 owner ffff81006499bb40 ffff81006499b240
Oct 25 14:56:03 localhost kernel: [deld, held 0 owner ffff81006499bb40 ffff81006499b240
Oct 25 14:56:03 localhost kernel: [drm:radeon_cp_idle] *ERROR* radeon_cp_idle called without lock held, held 0 owner ffff81006499bb40 ffff81006499b240
...

Oct 25 14:56:04 localhost kernel: [drm:radeon_cp_reset] *ERROR* radeon_cp_reset called without lock held, held 0 owner ffff81006499bb40 ffff81006499b240
Oct 25 14:56:04 localhost kernel: [deld, held 0 owner ffff81006499bb40 ffff81006499b240
Oct 25 14:56:04 localhost kernel: [drm:radeon_cp_reset] *ERROR* radeon_cp_reset called without lock held, held 0 owner ffff81006499bb40 ffff81006499b240O
...

from my Xorg log:

X.Org X Server 1.5.0
Release Date:
X Protocol Version 11, Revision 0
Build Operating System: Linux 2.6.18-107.el5xen x86_64
Current Operating System: Linux fixwienix 2.6.26.6-79.fc9.x86_64 #...

[Terry (terry-kryogenic)]

Binary package hint: xserver-xorg-video-radeon

When attempting to run a 3d game such as Enemy Territory or a game via wine X crashes and locks up. I am still able to ssh into the system but unable to kill X in anyway. Exactly the same thing happens using the kernel from Hardy so I'm inclined to believe this not a kernel issue.

dmesg is entirely filled with:
Dec 5 11:23:39 smithers kernel: [ 126.311404] [drm:radeon_cp_idle] *ERROR* radeon_cp_idle called without lock held, held 0 owner ed9589c0 ee2e0880
Dec 5 11:23:39 smithers kernel: [ 126.313311] [drm:radeon_cp_reset] *ERROR* radeon_cp_reset called without lock held, held 0 owner ed9589c0 ee2e0880
Dec 5 11:23:39 smithers kernel: [ 126.316425] [drm:radeon_cp_start] *ERROR* radeon_cp_start called without lock held, held 0 owner ed9589c0 ee2e0880

01:05.0 VGA compatible controller: ATI Technologies Inc RV280 [Radeon 9200] (rev 01)
        Subsystem: C.P. Technology Co. Ltd Device 2063

$ lsb_release -rd
Description: Ubuntu 8.10
Release: 8.10

$ apt-cache policy linux-image-generic
linux-image-generic:
  Installed: 2.6.27.9.13
  Candidate: 2.6.27.9.13
  Version table:
 *** 2.6.27.9.13 0
        500 http://ubuntu.virginmedia.com intrepid-updates/main Packages
        500 http://ubuntu.virginmedia.com intrepid-security/main Packages
        100 /var/lib/dpkg/status
     2.6.27.7.11 0
        500 http://ubuntu.virginmedia.com intrepid/main Packages

[Terry (terry-kryogenic)]

gzipped because this file is fairly big.

[Terry (terry-kryogenic)]

Having desktop effects enabled causes the problem, games work after disabling it. Running kde 4.1.3 from backports. Any more info you need please ask.

[Bryce Harrington (bryce)]

I've forwarded your issue upstream to http://bugs.freedesktop.org/show_bug.cgi?id=19140. Please subscribe to this bug report in case upstream needs further information or wishes you to test something.

[Bryce Harrington (bryce)]

Upstream suspects this may be a case of http://bugs.freedesktop.org/show_bug.cgi?id=7128, due to the
AIGLX code dereferncing a stale DrawablePtr.

[Michel Dänzer (michel-daenzer)]

This may be fixed in xserver 1.6.1. Can someone confirm?

[Michel Dänzer (michel-daenzer)]

Should be fixed.

[David R. Hedges (p14nd4)]

I'm using xserver 1.6.4-2ubuntu1 (ubuntu 9.10/karmic) on r100, and am seeing a hard lock even when launching a nautilus window. Like I said, my system is hard-locked when this occurs. If I'm already ssh'd in, I can see the syslog output below for a second, then the connection gets closed. I can't ctrl-alt-f1 on the system, and there's no disk activity. I have to hold down the power button to turn off the system.

Should I log a separate bug, or reopen this bug? What other information can I provide?

---

Kernel is linux-image-2.6.31-13-generic (version 2.6.31-13.45, but I've seen this since karmic alpha5)
xserver-xorg-video-radeon is version 1:6.12.99+git20090825.fc74e119-0ubuntu3

syslog excerpt:
---

Oct 13 15:59:32 dixon kernel: [ 610.810666] [drm:radeon_cp_idle] *ERROR* radeon_cp_idle called without lock held, held -2147483648 owner eeb6ff60 eeaff360
Oct 13 15:59:32 dixon kernel: [ 610.810722] [drm:radeon_cp_reset] *ERROR* radeon_cp_reset called without lock held, held -2147483648 owner eeb6ff60 eeaff360
Oct 13 15:59:32 dixon kernel: [ 610.810738] [drm:radeon_cp_start] *ERROR* radeon_cp_start called without lock held, held -2147483648 owner eeb6ff60 eeaff360
Oct 13 15:59:32 dixon kernel: [ 610.810753] [drm:radeon_cp_idle] *ERROR* radeon_cp_idle called without lock held, held -2147483648 owner eeb6ff60 eeaff360
Oct 13 15:59:32 dixon kernel: [ 610.810793] [drm:radeon_cp_reset] *ERROR* radeon_cp_reset called without lock held, held -2147483648 owner eeb6ff60 eeaff360
Oct 13 15:59:32 dixon kernel: [ 610.810807] [drm:radeon_cp_start] *ERROR* radeon_cp_start called without lock held, held -2147483648 owner eeb6ff60 eeaff360

---

lspci -vv excerpt:
---

01:00.0 VGA compatible controller: ATI Technologies Inc Radeon Mobility M7 LW [Radeon Mobility 7500]
        Subsystem: IBM Device 0530
        Control: I/O+ Mem+ BusMaster+ SpecCycle- MemWINV- VGASnoop- ParErr- Stepping+ SERR+ FastB2B+ DisINTx-
        Status: Cap+ 66MHz+ UDF- FastB2B+ ParErr- DEVSEL=medium >TAbort- <TAbort- <MAbort- >SERR- <PERR- INTx-
        Latency: 66 (2000ns min), Cache Line Size: 32 bytes
        Interrupt: pin A routed to IRQ 11
        Region 0: Memory at e0000000 (32-bit, prefetchable) [size=128M]
        Region 1: I/O ports at 3000 [size=256]
        Region 2: Memory at c0100000 (32-bit, non-prefetchable) [size=64K]
        [virtual] Expansion ROM at c0120000 [disabled] [size=128K]
        Capabilities: [58] AGP version 2.0
                Status: RQ=48 Iso- ArqSz=0 Cal=0 SBA+ ITACoh- GART64- HTrans- 64bit- FW- AGP3- Rate=x1,x2,x4
                Command: RQ=32 ArqSz=0 Cal=0 SBA+ AGP+ GART64- 64bit- FW- Rate=x4
        Capabilities: [50] Power Management version 2
                Flags: PMEClk- DSI- D1+ D2+ AuxCurrent=0mA PME(D0-,D1-,D2-,D3hot-,D3cold-)
                Status: D0 PME-Enable- DSel=0 DScale=0 PME-
        Kernel modules: radeon, radeonfb

---

[Corbin Simpson (mostawesomedude)]

*** Bug 19140 has been marked as a duplicate of this bug. ***

[Corbin Simpson (mostawesomedude)]

I've gone ahead and closed the upstream bug as a duplicate of a much earlier bug. If this is still a problem with KMS, let us know.

[Timo Aaltonen (tjaalton)]

Yep, please try on 10.04 beta1 or newer.

[Bryce Harrington (bryce)]

[This is an automatic notification.]

Hi Terry,

This bug was reported against an earlier version of Ubuntu, can you
test if it still occurs on Lucid?

Please note we also provide technical support for older versions of
Ubuntu, but not in the bug tracker. Instead, to raise the issue through
normal support channels, please see:

    http://www.ubuntu.com/support

If you are the original reporter and can still reproduce the issue on
Lucid, please run the following command to refresh the report:

  apport-collect 305458

If you are not the original reporter, please file a new bug report, so
we can work with you as the original reporter instead (you can reference
bug 305458 in your report if you think it may be related):

  ubuntu-bug xorg

If by chance you can no longer reproduce the issue on Lucid or if you
feel it is no longer relevant, please mark the bug report 'Fix Released'
or 'Invalid' as appropriate, at the following URL:

  https://bugs.launchpad.net/ubuntu/+bug/305458

[Terry (terry-kryogenic)]

Unfortunately I no longer have the PC the graphics card was in as some of the components on the motherboard started failing causing instabilities. I'm positive that was not related to the issue here though.

Annoyed as I wanted to help resolve this issue. Sorry :(

[Timo Aaltonen (tjaalton)]

closing, since there is no way to verify it for the original submitter.