Bug 463494

Summary:	Kernel panic running 'system-config-display' with r500 driver enabled
Product:	Red Hat Enterprise Linux 5	Reporter:	Jay Turner <jturner>
Component:	kernel	Assignee:	Mauro Carvalho Chehab <mchehab>
Status:	CLOSED CURRENTRELEASE	QA Contact:	Martin Jenner <mjenner>
Severity:	high	Docs Contact:
Priority:	medium
Version:	5.3	CC:	airlied, ajax, dzickus, jrb, kem, ltroan, lwang, srevivo
Target Milestone:	rc
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:	2.6.18-118.el5	Doc Type:	Bug Fix
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2008-10-09 14:36:24 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:
Bug Blocks:	432382

Description Jay Turner 2008-09-23 18:18:36 UTC

Description of problem:
I've got a Lenovo T400 with a ATI Technologies Inc Mobilitiy Radeon HD 3400 Series graphics chip.  Installing the 5.3 beta candidate (20080919.2) on the machine the r500 driver gets picked.  Post installation X doesn't work, so I ran 'system-config-display' from the commandline . . . oops!

Version-Release number of selected component (if applicable):
xorg-x11-drv-ati-6.6.3-3.17.el5
kernel-2.6.18-116.el5

How reproducible:
Always

Steps to Reproduce:
1. Run 'system-config-display' from commandline on a T400 with the xorg driver set up r500
2.
3.
  
Actual results:
Kernel panic . . . http://slingshot.devel.redhat.com/vmcore/T400-vmcore-2

(Note, if the above link doesn't work, try http://cobalt.devel.redhat.com/vmcore/T400-vmcore-2 . . . GIT is screwing around with DNS and my box!)

Additional info:
X doesn't work during the install either.  In addition, running 'system-config-display --reconfig' will cause a panic as well, no matter what driver is setup in xorg.conf

Comment 2 Mauro Carvalho Chehab 2008-10-08 18:13:17 UTC

We've discovered a patch on RHEL5.3 beta that caused some regressions on video graphics devices, on x86_64. Could you please try to use 2.6.18-118.el5?

Comment 3 Mauro Carvalho Chehab 2008-10-08 18:27:26 UTC

The OOPS happened at DRM code, just like bug 463853. I suspect that both have the same root cause: some corruption at VM.

This is the dmesg enclosed inside the crash:

[drm] Initialized drm 1.0.1 20051102                                                                               
----------- [cut here ] --------- [please bite here ] ---------                                                    
Kernel BUG at mm/memory.c:423                                                                                      
invalid opcode: 0000 [1] SMP                                                                                       
last sysfs file: /devices/pci0000:00/0000:00:00.0/resource                                                         
CPU 1                                                                                                              
Modules linked in: i915 drm autofs4 hidp rfcomm l2cap sunrpc ip_conntrack_netbios_ns ipt_REJECT xt_state ip_conntra
ck nfnetlink iptable_filter ip_tables ip6t_REJECT xt_tcpudp ip6table_filter ip6_tables x_tables ipv6 xfrm_nalgo cpu
freq_ondemand dm_multipath scsi_dh video backlight sbs i2c_ec button battery asus_acpi acpi_memhotplug ac parport_p
c lp parport joydev snd_hda_intel snd_seq_dummy snd_seq_oss snd_seq_midi_event testmgr_cipher testmgr aead snd_seq
crypto_blkcipher snd_seq_device crypto_algapi crypto_api snd_pcm_oss arc4 sr_mod snd_mixer_oss iwlagn cdrom iwlcore
 snd_pcm snd_timer snd_page_alloc mac80211 sg snd_hwdep hci_usb uvcvideo compat_ioctl32 videodev v4l1_compat sdhci
e1000e mmc_core v4l2_common serio_raw shpchp snd cfg80211 i2c_i801 bluetooth soundcore pcspkr i2c_core dm_snapshot
dm_zero dm_mirror dm_log dm_mod ahci libata sd_mod scsi_mod ext3 jbd uhci_hcd ohci_hcd ehci_hcd
Pid: 4095, comm: Xorg Not tainted 2.6.18-116.el5 #1
RIP: 0010:[<ffffffff8000c4b6>]  [<ffffffff8000c4b6>] vm_normal_page+0x54/0xa5
RSP: 0018:ffff810054325d40  EFLAGS: 00010246
RAX: ffff8100090000d0 RBX: 80000000d1f7f007 RCX: 000000000000001a
RDX: ffff810009000000 RSI: 00000000000d1f7f RDI: ffff81005419ec38
RBP: 80000000d1f7f007 R08: ffff810050c1f9a8 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000000 R12: ffff810050b2f040
R13: 00002b26135d4000 R14: ffff81005282aea0 R15: 0000000000084408
FS:  00002b260e4a2ad0(0000) GS:ffff81007c851840(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 000000008005003b
CR2: 000000000053eaa0 CR3: 0000000053ef9000 CR4: 00000000000006e0
Process Xorg (pid: 4095, threadinfo ffff810054324000, task ffff810076c84080)
Stack:  ffffffff800084da ffff81007c863660 ffff81005419ec38 ffff810077dfc840
 ffff81006dedab40 ffff810053ef92b0 ffff810050df32b0 00002b2613865000
 00002b2613865000 00002b2613865000 ffff810053ddf4c0 ffff810050c7a4c0
Call Trace:
 [<ffffffff800084da>] copy_page_range+0x5b3/0x73e
 [<ffffffff8001f921>] copy_process+0xce6/0x1550
 [<ffffffff80030e4a>] do_fork+0x69/0x1be
 [<ffffffff8005d28d>] tracesys+0xd5/0xe0
 [<ffffffff8005d427>] ptregscall_common+0x67/0xac


Code: 0f 0b 68 84 16 2a 80 c2 a7 01 48 89 c8 31 d2 48 c1 e8 09 48
RIP  [<ffffffff8000c4b6>] vm_normal_page+0x54/0xa5
 RSP <ffff810054325d40>

Comment 4 Jay Turner 2008-10-08 19:47:07 UTC

Linville has the machine now and says he'll bring it into the office tomorrow (10/9) and let me attempt to verify this defect.

Comment 5 Jay Turner 2008-10-09 14:36:24 UTC

Things are much happier with the -118.el5 kernel.  Closing out.