[g33] Ring buffer not flushed - X server crashes and switches to low-res mode

[Amit Kucheria]

Binary package hint: xorg

What I was doing:

I was using firefox with several tabs open (15-20). I just opened up maps.google.com and the X-server crashed.

After the screen flickering several times as X (gdm) tried to restart, it left in a low-res mode offering to reconfigure X. Choosing to reconfigure the card was unsuccessful since it seemed that the hardware was left in an inconsistent state.

Attached Xorg.log show error messages related to the crash.

ProblemType: Bug
Architecture: amd64
DistroRelease: Ubuntu 8.10
Package: xorg 1:7.4~5ubuntu3
ProcEnviron:
 PATH=/home/username/bin:/bin:/usr/bin:/usr/local/bin:/usr/X11R6/bin:/sbin:/usr/sbin
 LANG=en_US.UTF-8
 SHELL=/bin/bash
 LC_PAPER=a4
ProcVersion: Linux version 2.6.27-14-generic (buildd@yellow) (gcc version 4.3.2 (Ubuntu 4.3.2-1ubuntu12) ) #1 SMP Fri Mar 13 19:54:51 UTC 2009

SourcePackage: xorg
Uname: Linux 2.6.27-14-generic x86_64
xkbcomp:

(II) intel(0): xf86BindGARTMemory: bind key 0 at 0x01000000 (pgoffset 4096)
(II) intel(0): xf86BindGARTMemory: bind key 1 at 0x02000000 (pgoffset 8192)
(II) intel(0): Fixed memory allocation layout:
(II) intel(0): 0x00000000-0x0001ffff: ring buffer (128 kB)
(II) intel(0): 0x00020000-0x00029fff: HW cursors (40 kB)
(II) intel(0): 0x0002a000-0x00031fff: logical 3D context (32 kB)
(II) intel(0): 0x00032000-0x00032fff: overlay registers (4 kB)
(II) intel(0): 0x006ff000: end of stolen memory
(II) intel(0): 0x01000000-0x01ffffff: front buffer (13440 kB) X tiled
(II) intel(0): 0x02000000-0x0475ffff: exa offscreen (40320 kB)
(II) intel(0): 0x10000000: end of aperture
(WW) intel(0): PRB0_CTL (0x0001f001) indicates ring buffer enabled
(WW) intel(0): PRB0_HEAD (0x7341d4dc) and PRB0_TAIL (0x0001d638) indicate ring buffer not flushed
(WW) intel(0): Existing errors found in hardware state.
Error in I830WaitLpRing(), timeout for 2 seconds
pgetbl_ctl: 0x00000001 getbl_err: 0x00000000
ipeir: 0x00000000 iphdr: 0x54f00006
LP ring tail: 0x0001d640 head: 0x0001d4dc len: 0x0001f001 start 0x00000000
eir: 0x0000 esr: 0x0000 emr: 0xffff
instdone: 0xfa41 instpm: 0x0000
memmode: 0x00000306 instps: 0x80007806
hwstam: 0xffff ier: 0x0000 imr: 0xffff iir: 0x0000
Ring at virtual 0x7fde137fb000 head 0x1d4dc tail 0x1d640 count 89
Ring at virtual 0x7fde137fb000 head 0x1d4dc tail 0x1d640 count 89
Ring at virtual 0x7fde137fb000 head 0x1d4dc tail 0x1d640 count 89
Ring at virtual 0x7fde137fb000 head 0x1d4dc tail 0x1d640 count 89
Ring at virtual 0x7fde137fb000 head 0x1d4dc tail 0x1d640 count 89
Ring at virtual 0x7fde137fb000 head 0x1d4dc tail 0x1d640 count 89
Ring at virtual 0x7fde137fb000 head 0x1d4dc tail 0x1d640 count 89
Ring at virtual 0x7fde137fb000 head 0x1d4dc tail 0x1d640 count 89
Ring at virtual 0x7fde137fb000 head 0x1d4dc tail 0x1d640 count 89

[lspci]
00:00.0 Host bridge [0600]: Intel Corporation 82G33/G31/P35/P31 Express DRAM Controller [8086:29c0] (rev 02)
     Subsystem: Intel Corporation 82G33/G31/P35/P31 Express DRAM Controller [8086:29c0]
00:02.0 VGA compatible controller [0300]: Intel Corporation 82G33/G31 Express Integrated Graphics Controller [8086:29c2] (rev 02)
     Subsystem: Intel Corporation 82G33/G31 Express Integrated Graphics Controller [8086:29c2]

[Bryce Harrington (bryce)]

Amit, we'll focus this bug on the ring lockup error, but I've also filed
a separate bug, #351215, for the usability issue you ran into in the
failsafe mode. As far as I know, there is no solution for this class of
issue aside from rebooting, and if instead it's bumping you into
failsafe mode, then that needs to account for that situation. Would you
mind adding your thoughts on that bug about how this kind of error
situation can be handled in a more user friendly manner?

Meanwhile, regarding the ring error, I don't know of troubleshooting
techniques for this class of issue, other than forwarding it upstream.
What I think they will require is to have the specific steps to
reproduce the issue. Can you try repeating the steps you described and
see if you can reproduce the failure a couple times?

[Amit Kucheria (amitk)]

On Sun, Mar 29, 2009 at 11:55 PM, Bryce Harrington
<email address hidden> wrote:

> Meanwhile, regarding the ring error, I don't know of troubleshooting
> techniques for this class of issue, other than forwarding it upstream.
> What I think they will require is to have the specific steps to
> reproduce the issue.  Can you try repeating the steps you described and
> see if you can reproduce the failure a couple times?

What is the ring buffer and how is it used by the driver?

If we know what it is, I could try to concentrate on reproducing my
actions to stress that part of the HW.

I am not able to reproduce the bug just by having many Firefox tabs
and going to graphics intensive websites. So that might be a red
herring.

[Bryce Harrington (bryce)]

On Mon, Mar 30, 2009 at 06:52:50AM -0000, Amit Kucheria wrote:
> On Sun, Mar 29, 2009 at 11:55 PM, Bryce Harrington
> <email address hidden> wrote:
>
> > Meanwhile, regarding the ring error, I don't know of troubleshooting
> > techniques for this class of issue, other than forwarding it upstream.
> > What I think they will require is to have the specific steps to
> > reproduce the issue.  Can you try repeating the steps you described and
> > see if you can reproduce the failure a couple times?
>
> What is the ring buffer and how is it used by the driver?

I don't know if there is documentation explaining what it is. I've just
sort of pieced guesses together and am probably wrong, but I've assumed
it is a circular link list data structure containing memory buffer
objects that the video driver uses for some purpose. From what I've
gathered, this data structure isn't the *cause* of the bug, just that
when certain kinds of bugs occur, part of the error dump includes
dumping the state in the ring buffer. Unfortunately, not much beyond
this dump is provided with this class of error, so they're hard to
troubleshoot. I don't know how to make heads or tails out of the ring
dump (pun, sorry) and in talking with upstream they've suggested not
bothering to try to do so, as it isn't sufficient for figuring out the
issue.

> If we know what it is, I could try to concentrate on reproducing my
> actions to stress that part of the HW.
>
> I am not able to reproduce the bug just by having many Firefox tabs
> and going to graphics intensive websites. So that might be a red
> herring.

The bugs associated with web pages often are hard to reproduce and seem
to depend on seemingly random conditions. Sometimes I wonder if they're
dependent on filling up certain buffers in certain ways before
triggering them. I.e., if you do ABC after a fresh boot you can't
reproduce it, but if you then do ABC after the system's been up and in
use for a couple days, then *pow* it always does it.

On -psb with somewhat similar issues, we found that reducing some of the
memory parameters for the driver would make bugs more easily
reproduced. Browsing through 'man intel' there's a few parameters for
controlling video memory, however from the descriptions they don't
appear to be quite what we need. ulimit -m and booting with reduced
overall memory via mem= could be other options.

Bryce

[Paul (balaur)]

Hi,

The same problem on Thinkpad T60 (VGA compatible controller: Intel Corporation Mobile 945GM/GMS version).

The Xorg says

Ring at virtual 0xa776c000 head 0xd32c tail 0x1b8 count 19363
Ring at virtual 0xa776c000 head 0xd32c tail 0x1b8 count 19363
Ring at virtual 0xa776c000 head 0xd32c tail 0x1b8 count 19363
Ring at virtual 0xa776c000 head 0xd32c tail 0x1b8 count 19363
Ring at virtual 0xa776c000 head 0xd32c tail 0x1b8 count 19363
Ring at virtual 0xa776c000 head 0xd32c tail 0x1b8 count 19363
Ring at virtual 0xa776c000 head 0xd32c tail 0x1b8 count 19363
Ring at virtual 0xa776c000 head 0xd32c tail 0x1b8 count 19363
Ring at virtual 0xa776c000 head 0xd32c tail 0x1b8 count 19363
Ring at virtual 0xa776c000 head 0xd32c tail 0x1b8 count 19363
Ring at virtual 0xa776c000 head 0xd32c tail 0x1b8 count 19363
Ring at virtual 0xa776c000 head 0xd32c tail 0x1b8 count 19363
Ring end

and crashes

If you need any other logs, please tell me and I'm going to provide.

Maybe it's not Firefox dependent, I had my Firefox opened but I was working on other workspace.

[tomaskCZ (tomaskcz1)]

I experienced the same problem today

[44665.665517] Xorg[26512]: segfault at 38 ip b7a4f35c sp bfa70960 error 4 in libdri.so[b7a4a000+8000]
[44679.314507] Xorg[26554]: segfault at 38 ip b7bcf35c sp bfbf06e0 error 4 in libdri.so[b7bca000+8000]
[44693.118558] Xorg[26584]: segfault at 38 ip b79df35c sp bfc026f0 error 4 in libdri.so[b79da000+8000]
Apr 17 21:45:04 TKbuntu syslogd 1.5.0#2ubuntu6: restart.

Ring at virtual 0xa771e000 head 0xec3c tail 0x1d0 count 17765
Ring at virtual 0xa771e000 head 0xec3c tail 0x1d0 count 17765

on Mobile 945GM/GMS/GME, 943/940GML Express Integrated Graphics Controller
             vendor: Intel Corporation physical id: 2.1 bus info: pci@0000:00:02.1 version: 03 width: 32 bits
             clock: 33MHz capabilities: pm bus_master cap_list configuration: latency=0

also with firefox running with multiple tabs opened for few hours

Intrepid Ibex
2.6.27-11-generic

[Bryce Harrington (bryce)]

Amit,
Can you let us know if this issue still occurs with the Jaunty release? If so, please also see if the 2.7.0 driver resolves it:
  https://edge.launchpad.net/~ubuntu-x-swat/+archive/x-updates/

[Amit Kucheria (amitk)]

Haven't seen this yet on Jaunty. And was never able to reliably reproduce it on Intrepid.

[Bryce Harrington (bryce)]

Thanks for letting us know the issue is resolved.