Kernels since 2.5.60 upto 2.5.67 freeze when X server terminates

Hello

Since 2.5.60, I have been experiencing problems with a complete system freeze or random oopses when the X-server terminates. It is happening on both machines I am using whose hardware configuration differs slightly, however both of them are equipped with ATI video cards (ATI Rage 128 and ATI Radeon 8500), and both of them run the same version of X-server. That's about all they have in common.

The version of X-server I am using is:
XFree86 Version 4.3.0
Release Date: 27 February 2003

Since the crash either results in an oops obviously not having to do with the core problem, or the system freezes dead (no ping, no reaction to SysRq key), I don't know how to get some debug information to describe the fault more precisely.

Has anyone notyiced similar problems and is there some documentation how to trace such deadly bugs ?

Petr

Me too! But only about 50% of the time.
(On an Athlon MP with ATI Radeon, Debian/sid, 2.5.66 at the moment).

Dave

freeze or random oopses when the X-server terminates. It is happening on both machines I am using whose hardware configuration differs slightly, however both of them are equipped with ATI video cards (ATI Rage 128 and ATI Radeon 8500), and both of them run the same version of X-server. That's about all they have in common.

seen it to (~60% of the time)
my X is quite old:
XFree86 Version 4.2.0 / X Window System (protocol Version 11, revision 0, vendor release 6600) Release Date: 18 January 2002

thought that it was a problem of X and didn't have time to update it (although I played with a lot of -mm kernels since 2.5.64).

Rudmer

I got the same problem here:
AMD Duron 1.2
SIS 735 chipset
ATI Radeon 8500

On 2.5.67 I get freezes with XFree86 4.3.0 . It works fine with 4.2.1 .

Exactly the same symptoms: the box is dead, no message on the serial console.

florin

"NT is to UNIX what a doughnut is to a particle accelerator."

According to http://bugme.osdl.org/show_bug.cgi?id=543 , a variant
of the problem happens by just exiting from Gnome and running startx again.

I surely hit bug 543 in 2.5.65 IIRC, and guess what...
ATI Radeon 7500 Mobile - XFree 4.2.1

According to other emails on lkml, it appears that DRM and/or AGP
new kernel code might be at fault. I don't actually remember seeing non-Radeon cards being hit by such problems though...

When the ex-PC from my brother is supplied a new USB keyboard and
a hard disk I'll try reproducing on its Voodoo5 :)

--alessandro

"Se e' vero che ad ogni rinuncia corrisponde una contropartita considerevole
privarsi dell'anima comporterebbe una lauta ricompensa"
(Carmen Consoli, "L'eccezione")

On Tue, Apr 15, 2003 at 03:06:37PM +0200, Alessandro Suardi wrote:
<snip>

I've seen this problem too many times, but haven't tried to track
it down. The video is ATI Rage 128 Pro.

A common bit seems to be ATI cards, judging from this thread. I'm
also using the aty128fb framebuffer driver. My motherboard is Aladdin V based and so uses the ali-agp module.

I wonder if all of us who are seeing this problem have any of
these other things in common?

Joseph Fannin
[email protected]

"I think I said something eloquent, like 'Fuck.'" -- Rusty Russell.

I think it has to do with the interaction between XFree86 4.3.0 and the AGP code.

I have wdm as my display manager. I am able to login, but when logging out the system dies. These are the last two messages printed on the serial console:
agpgart: Putting AGP V2 device at 00:00.0 into 4x mode
agpgart: Putting AGP V2 device at 01:00.0 into 4x mode
and then, hard freeze.

These lines do not appear when using XFree86 4.2.1 .

I have a Radeon 8500 and AGP 4x is enabled in BIOS. The motherboard is ECS K7S5A (SIS 735 chipset).

Dave, if you have any patch to test send it over!

florin

"NT is to UNIX what a doughnut is to a particle accelerator."

Has anyone tried disabling kernel AGP support and retesting?

Now that you suggested it, I disabled kernel AGP support and 4.3.0 (Daniel Stone Debian packages) works fine so far.

Thanks,
florin

"NT is to UNIX what a doughnut is to a particle accelerator."

Thing is, if this runs rock solid now, it's not necessarily indicative of a bug in agpgart, it could equally be a bug in the DRM. This disables a whole bunch of code, it's practically a completely different application wrt 3d now.

Of course, if this _is_ a bug in agpgart, I'll be the first to put my hands up.

Dave

Would disabling DRM, and enabling AGP be interesting?

Not really. Nothing else uses it afaik.. Other than testgart, which only really does minimal read-through-aperture-with-cpu testing.

Dave.

Disablign AGP turned off 3D. There is a problem in a lot of the current DRI drivers where shared IRQs break as sometimes do restarts because the IRQ is not masked properly in the DRI module on close down. Its certainly true in the -ac tree (Radeon patch pending, someone apparently has other patches I need to chase).

Alan

I did a lspci -v and the Radeon has IRQ 5 all to itself. There is no sharing.

I do suspect the
agpgart: Putting AGP V2 device at 00:00.0 into 4x mode
agpgart: Putting AGP V2 device at 01:00.0 into 4x mode might give us a clue, since lspci says
00:00.0 Host bridge: Silicon Integrated Systems [SiS] 735 Host (rev
01)
01:00.0 VGA compatible controller: ATI Technologies Inc Radeon R200 QL [Radeon 8500 LE]

Maybe the AGP code is trying to push some bits in the wrong port/address?

Thanks,
florin

"NT is to UNIX what a doughnut is to a particle accelerator."

SiS driver internals haven't changed (at least not under my hands), so it should be poking the same bits in the same registers as the 2.4 driver does. The only 'bits in wrong address' type bug outstanding in agpgart is that the gatt_table address is potentially allocated as a 64bit address and truncated to fit into 32bits, but that will only bite you on a 64bit host that uses the generic gatt allocation routines. (Namely x86-64).

Dave

Should I try 2.4.20? I can not try -ac kernels because all my filesystems are xfs.

florin

"NT is to UNIX what a doughnut is to a particle accelerator."

With 2.5.67-bk8, agpgart and sis-agp compiled as modules and loaded:
- X starts (I am using wdm as display manager)
- direct rendering is enabled, according to /var/log/XFree86.0.log
- start glxgears
- framerate 130!!! It should be around 1900-2000 on my hardware (moons ago on XFree 4.2.1 + DRI snapshot)
- after 15-20 seconds, the X session is restarted - back to wdm screen
- I login, I logout and the machine freeze
- the last words on serial console:

      [drm] Loading R200 Microcode
      double fault, gdt at c039df00 [255 bytes]
      double fault, tss at c0418800
      eip = c0143a00, esp = ececbf0c
      eax = ee37dc60, ebx = ee37dc40, ecx = 0000007b, edx = 00000000
      esi = ee37dc60, edi = edc0e0c0

With 2.5.67-bk8, agpgart and sis-agp built in:
- no lockups
- direct rendering is disabled
- X crashes sometimes with the following traces:

eth0: Media Link On 100mbps full-duplex
Please use the 'usbfs' filetype instead, the 'usbdevfs' name is deprecated.
agpgart: Found an AGP 2.0 compliant device.
agpgart: Putting AGP V2 device at 00:00.0 into 4x mode
agpgart: Putting AGP V2 device at 01:00.0 into 4x mode
[drm] Loading R200 Microcode
agpgart: Found an AGP 2.0 compliant device.
agpgart: Putting AGP V2 device at 00:00.0 into 4x mode
agpgart: Putting AGP V2 device at 01:00.0 into 4x mode
[drm] Loading R200 Microcode

Unable to handle kernel paging request at virtual address fffffff0
 printing eip:
c0146147
*pde = 00001067
*pte = 00000000
Oops: 0000 [#1]
CPU:    0
EIP:    0060:[<c0146147>]    Not tainted
EFLAGS: 00013286

EIP is at page_remove_rmap+0xb7/0x130
eax: ffffffff ebx: c14acc48 ecx: 0000000f edx: fffffff0
esi: dcd5ffc0 edi: ffffffff ebp: fffffff0 esp: da333b60
ds: 007b es: 007b ss: 0068
Process XFree86 (pid: 657, threadinfo=da332000 task=de0ced00)

Stack: dcb72cc0 dcd5ffc0 da403a18 da403a18 0006e000 00100000 c14acc48 c0140495 
       c14acc48 da332000 da332000 00000000 1deb5045 dc8b5084 08618000 08318000 
       c0465758 c014053b c0465758 dc8b5080 08218000 00100000 08218000 dc8b5084 
Call Trace:
 [<c0140495>] zap_pte_range+0x155/0x1b0
 [<c014053b>] zap_pmd_range+0x4b/0x70
 [<c01405a3>] unmap_page_range+0x43/0x70
 [<c0140694>] unmap_vmas+0xc4/0x220
 [<c01444cb>] exit_mmap+0x7b/0x190
 [<c011bc44>] mmput+0x54/0xb0
 [<c0159203>] exec_mmap+0xb3/0x130
 [<c0159309>] flush_old_exec+0x19/0x850
 [<c0159140>] kernel_read+0x50/0x60
 [<c0175525>] load_elf_binary+0x2d5/0xb50
 [<c01651e2>] dput+0x22/0x1e0
 [<c021a187>] linvfs_readv+0x47/0x50
 [<c0175250>] load_elf_binary+0x0/0xb50
 [<c0159e7a>] search_binary_handler+0x8a/0x1d0
 [<c015a1d1>] do_execve+0x211/0x260
 [<c01093e0>] sys_execve+0x50/0x80
 [<c010ab77>] syscall_call+0x7/0xb

Code: 8b 02 89 c5 83 e5 f0 74 04 0f 0d 45 00 89 c1 83 e1 0f 83 f9 
 <6>note: XFree86[657] exited with preempt_count 2
Unable to handle kernel paging request at virtual address 081e5788
 printing eip:
c0164857
*pde = 00000000
Oops: 0000 [#2]
CPU:    0
EIP:    0060:[<c0164857>]    Not tainted
EFLAGS: 00013206

EIP is at locks_remove_posix+0x97/0x110
eax: de0ced00 ebx: dd6dfd20 ecx: 00000000 edx: 081e5760
esi: de84b040 edi: de84b040 ebp: 00000000 esp: da333988
ds: 007b es: 007b ss: 0068
Process XFree86 (pid: 657, threadinfo=da332000 task=de0ced00)

Stack: 000003e8 00000005 0000000d 00000032 00000000 00000000 da3339c0 c0119948 
       de84b040 00000291 00003092 00000000 de3064c0 00000201 00000000 00000000 
       ffffffff 7fffffff 00000000 da332000 00003296 00000000 00100000 de826ac0 
Call Trace:
 [<c0119948>] try_to_wake_up+0x128/0x1d0
 [<c014ea5c>] filp_close+0x8c/0xd0
 [<c011ecb7>] put_files_struct+0x57/0xc0
 [<c011f816>] do_exit+0x146/0x370
 [<c010bbb1>] die+0xe1/0xf0
 [<c0118a2a>] do_page_fault+0x14a/0x457
 [<c01355b0>] do_generic_mapping_read+0x1a0/0x3b0
 [<c0168409>] update_atime+0xd9/0xe0
 [<c0135a89>] __generic_file_aio_read+0x1b9/0x200
 [<c01357c0>] file_read_actor+0x0/0x110
 [<c01188e0>] do_page_fault+0x0/0x457
 [<c010b581>] error_code+0x2d/0x38
 [<c0146147>] page_remove_rmap+0xb7/0x130
 [<c0140495>] zap_pte_range+0x155/0x1b0
 [<c014053b>] zap_pmd_range+0x4b/0x70
 [<c01405a3>] unmap_page_range+0x43/0x70
 [<c0140694>] unmap_vmas+0xc4/0x220
 [<c01444cb>] exit_mmap+0x7b/0x190
 [<c011bc44>] mmput+0x54/0xb0
 [<c0159203>] exec_mmap+0xb3/0x130
 [<c0159309>] flush_old_exec+0x19/0x850
 [<c0159140>] kernel_read+0x50/0x60
 [<c0175525>] load_elf_binary+0x2d5/0xb50
 [<c01651e2>] dput+0x22/0x1e0
 [<c021a187>] linvfs_readv+0x47/0x50
 [<c0175250>] load_elf_binary+0x0/0xb50
 [<c0159e7a>] search_binary_handler+0x8a/0x1d0
 [<c015a1d1>] do_execve+0x211/0x260
 [<c01093e0>] sys_execve+0x50/0x80
 [<c010ab77>] syscall_call+0x7/0xb

Code: 0f b6 42 28 24 01 84 c0 74 05 39 72 14 74 44 89 d3 8b 03 85 
 <6>note: XFree86[657] exited with preempt_count 3
Unable to handle kernel paging request at virtual address 09373844
 printing eip:
c0143a33
*pde = 00000000
Oops: 0000 [#3]
CPU:    0
EIP:    0060:[<c0143a33>]    Not tainted
EFLAGS: 00013202

EIP is at find_vma+0x33/0x60
eax: 0937383c ebx: bfffe76c ecx: 00000000 edx: 09373854
esi: de826ac0 edi: de0ced00 ebp: bfffe76c esp: da257f04
ds: 007b es: 007b ss: 0068
Process XFree86 (pid: 658, threadinfo=da256000 task=de0ced00)

Stack: de826ac0 de826ae0 c0118a68 de826ac0 bfffe76c 081c959c 00000001 00000001 
       dc4b8c00 00000000 00000000 00030001 00000000 00000000 40000000 40000000 
       00000000 00000000 00000000 00000000 08754c28 08768ed4 00000000 00000000 
Call Trace:
 [<c0118a68>] do_page_fault+0x188/0x457
 [<c014ea63>] filp_close+0x93/0xd0
 [<c014ea63>] filp_close+0x93/0xd0
 [<c01188e0>] do_page_fault+0x0/0x457
 [<c010b581>] error_code+0x2d/0x38

Code: 39 58 08 76 1a 39 58 04 89 c1 76 07 8b 52 0c 85 d2 75 ea 85 
 unmap_vmas: VMA list is not sorted correctly!
------------[ cut here ]------------
kernel BUG at mm/mmap.c:1417!
invalid operand: 0000 [#4]
CPU:    0
EIP:    0060:[<c01445d2>]    Not tainted
EFLAGS: 00013202

EIP is at exit_mmap+0x182/0x190
eax: fffff8f1 ebx: 00000002 ecx: 00000000 edx: 00000000
esi: de826ac0 edi: da256000 ebp: de0ced00 esp: da257d9c
ds: 007b es: 007b ss: 0068
Process XFree86 (pid: 658, threadinfo=da256000 task=de0ced00)

Stack: da257db4 de826ac0 dc4b8e80 00000000 ffffffff da257db8 c0465758 0000070f 
       de826ac0 00000000 00000000 c011bc44 de826ac0 c03b4fdc de826ac0 c011f7dd 
       de826ac0 de826ac0 00000001 0000007b da256000 da257ed0 de0ced00 09373844 
Call Trace:
 [<c011bc44>] mmput+0x54/0xb0
 [<c011f7dd>] do_exit+0x10d/0x370
 [<c010bbb1>] die+0xe1/0xf0
 [<c0118a2a>] do_page_fault+0x14a/0x457
 [<c0138941>] buffered_rmqueue+0xb1/0x150
 [<c0138a72>] __alloc_pages+0x92/0x2c0
 [<c013d945>] invalidate_vcache+0x35/0xf0
 [<c014110d>] do_wp_page+0x1cd/0x370
 [<c01188e0>] do_page_fault+0x0/0x457
 [<c010b581>] error_code+0x2d/0x38
 [<c0143a33>] find_vma+0x33/0x60
 [<c0118a68>] do_page_fault+0x188/0x457
 [<c014ea63>] filp_close+0x93/0xd0
 [<c014ea63>] filp_close+0x93/0xd0
 [<c01188e0>] do_page_fault+0x0/0x457
 [<c010b581>] error_code+0x2d/0x38

Code: 0f 0b 89 05 a6 50 37 c0 e9 06 ff ff ff 90 83 ec 28 89 5c 24 
 <6>note: XFree86[658] exited with preempt_count 1
Unable to handle kernel paging request at virtual address 081e5788
 printing eip:
c0164857
*pde = 1c19e067
*pte = 00000000
Oops: 0000 [#5]
CPU:    0
EIP:    0060:[<c0164857>]    Not tainted
EFLAGS: 00013206

EIP is at locks_remove_posix+0x97/0x110
eax: de0ced00 ebx: dd6dfd20 ecx: 00000000 edx: 081e5760
esi: df2f8e40 edi: df2f8e40 ebp: 00000000 esp: da257bd8
ds: 007b es: 007b ss: 0068
Process XFree86 (pid: 658, threadinfo=da256000 task=de0ced00)

Stack: 000003e8 00000005 0000000d 00000032 00000000 00000000 da257c10 c0119948 
       df2f8e40 00000292 00003092 00000000 de3064c0 00000201 00000000 00000000 
       ffffffff 7fffffff 00000000 da256000 00003292 00000032 da257c50 00003292 
Call Trace:
 [<c0119948>] try_to_wake_up+0x128/0x1d0
 [<c014ea5c>] filp_close+0x8c/0xd0
 [<c011ecb7>] put_files_struct+0x57/0xc0
 [<c010bf30>] do_invalid_op+0x0/0xd0
 [<c011f816>] do_exit+0x146/0x370
 [<c010bf30>] do_invalid_op+0x0/0xd0
 [<c010bbb1>] die+0xe1/0xf0
 [<c010bff9>] do_invalid_op+0xc9/0xd0
 [<c01445d2>] exit_mmap+0x182/0x190
 [<c011a3f1>] __wake_up_common+0x31/0x50
 [<c011df1d>] printk+0x11d/0x180
 [<c010b581>] error_code+0x2d/0x38
 [<c01445d2>] exit_mmap+0x182/0x190
 [<c011bc44>] mmput+0x54/0xb0
 [<c011f7dd>] do_exit+0x10d/0x370
 [<c010bbb1>] die+0xe1/0xf0
 [<c0118a2a>] do_page_fault+0x14a/0x457
 [<c0138941>] buffered_rmqueue+0xb1/0x150
 [<c0138a72>] __alloc_pages+0x92/0x2c0
 [<c013d945>] invalidate_vcache+0x35/0xf0
 [<c014110d>] do_wp_page+0x1cd/0x370
 [<c01188e0>] do_page_fault+0x0/0x457
 [<c010b581>] error_code+0x2d/0x38
 [<c0143a33>] find_vma+0x33/0x60
 [<c0118a68>] do_page_fault+0x188/0x457
 [<c014ea63>] filp_close+0x93/0xd0
 [<c014ea63>] filp_close+0x93/0xd0
 [<c01188e0>] do_page_fault+0x0/0x457
 [<c010b581>] error_code+0x2d/0x38

Code: 0f b6 42 28 24 01 84 c0 74 05 39 72 14 74 44 89 d3 8b 03 85 
 <6>note: XFree86[658] exited with preempt_count 2

mtrr: MTRR 1 not used
mtrr: MTRR 1 not used
serio: kseriod exiting
Shutting down devices
Power down.
acpi_power_off called

With the same .config but with 67-ac2 the machine hungs with similar traces on the serial console.

florin

"NT is to UNIX what a doughnut is to a particle accelerator."

Very strange. Does glxinfo output look sane too? Especially the OpenGL renderer string. It sounds like it isn't doing hw rendering even if your X log says it is..

Not good at all. 'bad shit happened'.

It's essentially the same code though, which doesn't make a lot of sense.

Again, puzzling. What reason is given for this in your XFree86.log ?

The fact that this lot appears twice is odd, or did you restart the X server ?

So X tried to load a module (likely the DRI part), and in doing so something went awry.
Could be that something else caused memory corruption beforehand, but that's speculation. If this always happens the second time the server starts, it could be a problem with reentrancy of the r200 dri module maybe. *shrug*.

Frankly, from this backtrace, I've no idea.
There are a bunch of radeon fixes pending in the DRI tree,
so things could suddenly 'start working' again, so this could be one to keep an eye on in bugzilla for now so we don't forget about it.

Dave

Dave

I tried 2.5.67-ac1 with AGP and no CONFIG_DRM, with Intel 82810E DC-133 CGC [Chipset Graphics Controller]. With that configuration, I saw the freeze once (not easily repeatable) on _starting_ the X server (init 5) after a successful termination of the X server with /sbin/init 3. The freeze is 100% repeatable when selecting "Log Out" from KDE or Gnome after X was started with /sbin/init 5. If X is started with "startx", "Log Out" always successfully terminates the X server with no freeze.

This is with RedHat 9.

Steven

Except that I'm seeing the very same sort of freeze on with a
Rage128 card with XFree86 4.2.1.

Are we all Debian sid users, perhaps?

Or maybe the Rage128 needs a similar patch to the Radeon one you
posted.

Joseph Fannin
[email protected]

"Bull in pure form is rare; there is usually some contamination by data."
    -- William Graves Perry Jr.

I am, indeed.

Try with AGP disabled. It worked for me, but glxgears suck :(

florin

"NT is to UNIX what a doughnut is to a particle accelerator."

Nice try, but I'm seeing it on a RedHat 9-ish laptop with this card:

01:00.0 VGA compatible controller: nVidia Corporation NV17 [GeForce4 440 Go] (rev a3)

using XFree86 4.3.0 and the binary NVidia 4191 driver. I hadn't posted because I figured it was an NVidia problem and tainted quite thoroughly.

Another data point: I *dont* see this sort of freeze if I start it with 'NvAGP=1' (use internal agp), but I *do* see it with 'NvAGP=2' or '3' (which tell it to use the kernel 'agpgart' code).

Sorry Dave, looks like a bug in AGP....

Yet another data point. I've seen this with RedHat 9 and i810 and 2.5.67+. I've haven't had time to test without AGP yet

I could avoid the freeze by starting X with "startx". Then, when going back to runlevel 3, the freeze did _not_ occur.

I saw the freeze when selecting "Log Out" from either KDE or Gnome, but only if I started X with /sbin/init 5.

Occasionally and with 2.5.67-mm1 only, instead of a freeze, I saw a spontaneous reboot.

I'm many miles from that test box now but if I get the chance I'll test without AGP.

Steven