Bug 524312

Summary: Xorg busy loops in RADEONDownloadFromScreenCP
Product: [Fedora] Fedora Reporter: Stefan Becker <chemobejk>
Component: xorg-x11-drv-atiAssignee: Dave Airlie <airlied>
Status: CLOSED RAWHIDE QA Contact: Fedora Extras Quality Assurance <extras-qa>
Severity: high Docs Contact:
Priority: low    
Version: rawhideCC: xgl-maint
Target Milestone: ---Keywords: Reopened
Target Release: ---   
Hardware: All   
OS: Linux   
URL: http://www.smolts.org/client/show/pub_2f56c9e2-bad1-462e-b877-6491a917db79
Whiteboard:
Fixed In Version: Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2009-10-06 11:58:50 EDT Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:

Description Stefan Becker 2009-09-18 15:39:50 EDT
Description of problem:

X hangs regularly on my Lenovo T60 with Mobility Radeon X1300 [1002:7149] since I pre-upgraded from F11 to F12-rawhide. As far as I can see there is no specific action to trigger it. When it happens the mouse pointer movement becomes jerky and there are no X display updates anymore.

The system itself is not frozen, i.e. you can still initiate a ACPI powerdown with the power off key or login with ssh and initiate a shutdown command.

Version-Release number of selected component (if applicable):
xorg-x11-drv-ati-6.13.0-0.4.20090908git651fe5a47.fc12.i686
libdrm-2.4.12-0.10.fc12.i686
mesa-libGL-7.6-0.11.fc12.i686
kernel-2.6.31-23.fc12.i686
xorg-x11-server-Xorg-1.6.99.901-2.fc12.i686

How reproducible:
always

Steps to Reproduce:
1. Login as normal user into X session
2. work normally, e.g. browse web pages

Additional info:

Smolt URL attached

1. I'm using kernel parameter "nomodeset" as KMS breaks suspend
2. I have experienced the freeze after a fresh boot and after resume from
hibernate
3. I have experienced the freeze with WLAN active or not active
4. I have experienced the freeze with cable Ethernet active or not active
5. Log in after the fact shows the X process uses up 100%, i.e. one CPU core
6. X process can only be killed with -9
7. Killing X does NOT restore the display, chvt hangs
8. uname -a: Linux XXX 2.6.31-23.fc12.i686 #1 SMP Wed Sep 16 16:09:25 EDT 2009
i686 i686 i386 GNU/Linux
9. There are no messages in /var/log/Xorg.0.log from the point in time when the
freeze occurs

10. Don't know if this is related, but after a fresh boot I get these dmesg
when X starts:

=======================================================
[ INFO: possible circular locking dependency detected ]
2.6.31-23.fc12.i686 #1
-------------------------------------------------------
Xorg/1143 is trying to acquire lock:
 (&dev->struct_mutex){+.+.+.}, at: [<f7ca4232>] drm_mmap+0x38/0x66 [drm]

but task is already holding lock:
 (&mm->mmap_sem){++++++}, at: [<c0407abd>] sys_mmap2+0x72/0xb9

which lock already depends on the new lock.


the existing dependency chain (in reverse order) is:

-> #4 (&mm->mmap_sem){++++++}:
       [<c04711a3>] __lock_acquire+0x9b3/0xb25
       [<c04713cc>] lock_acquire+0xb7/0xeb
       [<c04d7959>] might_fault+0x73/0xa4
       [<c06019fc>] copy_to_user+0x41/0x12b
       [<c05069bc>] filldir64+0xc8/0x10d
       [<c054986c>] sysfs_readdir+0x11a/0x161
       [<c0506c42>] vfs_readdir+0x7b/0xb8
       [<c0506cfa>] sys_getdents64+0x7b/0xcb
       [<c0403a50>] syscall_call+0x7/0xb
       [<ffffffff>] 0xffffffff

-> #3 (sysfs_mutex){+.+.+.}:
       [<c04711a3>] __lock_acquire+0x9b3/0xb25
       [<c04713cc>] lock_acquire+0xb7/0xeb
       [<c0825354>] __mutex_lock_common+0x43/0x32b
       [<c082572f>] mutex_lock_nested+0x41/0x5a
       [<c0549c36>] sysfs_addrm_start+0x34/0xb2
       [<c0548529>] sysfs_hash_and_remove+0x2d/0x71
       [<c054aab0>] sysfs_remove_link+0x29/0x3c
       [<c04f1911>] sysfs_slab_add+0x57/0x189
       [<c04f1a83>] sysfs_add_func+0x40/0x74
       [<c045831e>] worker_thread+0x194/0x275
       [<c045cef1>] kthread+0x7b/0x80
       [<c040463f>] kernel_thread_helper+0x7/0x10
       [<ffffffff>] 0xffffffff

-> #2 (slub_lock){+++++.}:
       [<c04711a3>] __lock_acquire+0x9b3/0xb25
       [<c04713cc>] lock_acquire+0xb7/0xeb
       [<c0825a6a>] down_read+0x45/0x93
       [<c0822fe0>] slab_cpuup_callback+0x50/0x13e
       [<c082920b>] notifier_call_chain+0x5d/0x95
       [<c0462192>] __raw_notifier_call_chain+0x23/0x39
       [<c0821f54>] _cpu_up+0x6d/0x121
       [<c082205f>] cpu_up+0x57/0x78
       [<c0a7b419>] kernel_init+0xba/0x211
       [<c040463f>] kernel_thread_helper+0x7/0x10
       [<ffffffff>] 0xffffffff

-> #1 (cpu_hotplug.lock){+.+.+.}:
       [<c04711a3>] __lock_acquire+0x9b3/0xb25
       [<c04713cc>] lock_acquire+0xb7/0xeb
       [<c0825354>] __mutex_lock_common+0x43/0x32b
       [<c082572f>] mutex_lock_nested+0x41/0x5a
       [<c0446425>] get_online_cpus+0x44/0x67
       [<c04134e1>] mtrr_del_page+0x40/0x131
       [<c0413616>] mtrr_del+0x44/0x5b
       [<f7c9bbc6>] drm_rmmap_locked+0xc4/0x17d [drm]
       [<f7ca2c56>] drm_master_destroy+0x61/0xe1 [drm]
       [<c05fbbb7>] kref_put+0x47/0x62
       [<f7ca2b61>] drm_master_put+0x25/0x40 [drm]
       [<f7c9f647>] drm_release+0x3f7/0x4d7 [drm]
       [<c04fa4e2>] __fput+0x101/0x1a9
       [<c04fa5b1>] fput+0x27/0x3a
       [<c04f6c9a>] filp_close+0x64/0x7f
       [<c04f6d31>] sys_close+0x7c/0xc2
       [<c0403a50>] syscall_call+0x7/0xb
       [<ffffffff>] 0xffffffff

-> #0 (&dev->struct_mutex){+.+.+.}:
       [<c04710aa>] __lock_acquire+0x8ba/0xb25
       [<c04713cc>] lock_acquire+0xb7/0xeb
       [<c0825354>] __mutex_lock_common+0x43/0x32b
       [<c082572f>] mutex_lock_nested+0x41/0x5a
       [<f7ca4232>] drm_mmap+0x38/0x66 [drm]
       [<c04df171>] mmap_region+0x264/0x3f9
       [<c04df58f>] do_mmap_pgoff+0x289/0x2ec
       [<c0407ad1>] sys_mmap2+0x86/0xb9
       [<c0403a50>] syscall_call+0x7/0xb
       [<ffffffff>] 0xffffffff

other info that might help us debug this:

1 lock held by Xorg/1143:
 #0:  (&mm->mmap_sem){++++++}, at: [<c0407abd>] sys_mmap2+0x72/0xb9

stack backtrace:
Pid: 1143, comm: Xorg Tainted: G        W  2.6.31-23.fc12.i686 #1
Call Trace:
 [<c0823ee6>] ? printk+0x22/0x3c
 [<c04704d8>] print_circular_bug_tail+0x68/0x84
 [<c04710aa>] __lock_acquire+0x8ba/0xb25
 [<c04713cc>] lock_acquire+0xb7/0xeb
 [<f7ca4232>] ? drm_mmap+0x38/0x66 [drm]
 [<f7ca4232>] ? drm_mmap+0x38/0x66 [drm]
 [<c0825354>] __mutex_lock_common+0x43/0x32b
 [<f7ca4232>] ? drm_mmap+0x38/0x66 [drm]
 [<f7ca4232>] ? drm_mmap+0x38/0x66 [drm]
 [<c04f091b>] ? kmem_cache_alloc+0xcb/0x159
 [<c046fe05>] ? trace_hardirqs_on_caller+0x122/0x155
 [<c082572f>] mutex_lock_nested+0x41/0x5a
 [<f7ca4232>] ? drm_mmap+0x38/0x66 [drm]
 [<f7ca4232>] drm_mmap+0x38/0x66 [drm]
 [<c04df171>] mmap_region+0x264/0x3f9
 [<c04df58f>] do_mmap_pgoff+0x289/0x2ec
 [<c0407ad1>] sys_mmap2+0x86/0xb9
 [<c0403a50>] syscall_call+0x7/0xb
[drm] Setting GART location based on new memory map
[drm] Loading R500 Microcode
platform radeon_cp.0: firmware: requesting radeon/R520_cp.bin
[drm] Num pipes: 1
[drm] writeback test succeeded in 1 usecs

Backtrace from gdb:

(gdb) bt
#0  0x00e6e416 in __kernel_vsyscall ()
#1  0x0059fd79 in ioctl () from /lib/libc.so.6
#2  0x0047188e in drmIoctl () from /usr/lib/libdrm.so.2
#3  0x00471cd3 in drmCommandNone () from /usr/lib/libdrm.so.2
#4  0x00bc71f4 in RADEONDownloadFromScreenCP (pSrc=<value optimized out>,
    x=<value optimized out>, y=<value optimized out>, w=<value optimized out>,
    h=<value optimized out>, dst=<value optimized out>,
    dst_pitch=<value optimized out>) at radeon_exa_funcs.c:669
#5  0x007cf6c3 in exaCopyDirty (migrate=<value optimized out>,
    pValidDst=<value optimized out>, pValidSrc=<value optimized out>,
    transfer=<value optimized out>, fallback_src=<value optimized out>,
    fallback_dst=<value optimized out>,
    fallback_srcpitch=<value optimized out>,
    fallback_dstpitch=<value optimized out>,
    fallback_index=<value optimized out>, sync=<value optimized out>)
    at exa_migration_classic.c:218
#6  0x007cfb12 in exaCopyDirtyToSys (migrate=0xbff7cb40)
    at exa_migration_classic.c:273
#7  0x007cfb88 in exaDoMoveOutPixmap (migrate=<value optimized out>)
    at exa_migration_classic.c:391
#8  0x007d054a in exaDoMigration_classic (pixmaps=<value optimized out>,
    npixmaps=<value optimized out>, can_accel=<value optimized out>)
    at exa_migration_classic.c:699
#9  0x007cd25b in exaDoMigration (pixmaps=<value optimized out>,
    npixmaps=<value optimized out>, can_accel=<value optimized out>)
    at exa.c:1205
#10 0x007ce7bd in exaPrepareAccessReg (pDrawable=<value optimized out>,
    index=<value optimized out>, pReg=<value optimized out>) at exa.c:392
#11 0x007ce811 in exaPrepareAccess (pDrawable=<value optimized out>,
    index=<value optimized out>) at exa.c:407
#12 0x007da726 in ExaCheckComposite (op=<value optimized out>,
    pSrc=<value optimized out>, pMask=<value optimized out>,
    pDst=<value optimized out>, xSrc=<value optimized out>,
    ySrc=<value optimized out>, xMask=<value optimized out>,
    yMask=<value optimized out>, xDst=<value optimized out>,
    yDst=<value optimized out>, width=<value optimized out>,
    height=<value optimized out>) at exa_unaccel.c:432
#13 0x007d805a in exaComposite (op=<value optimized out>,
    pSrc=<value optimized out>, pMask=<value optimized out>,
    pDst=<value optimized out>, xSrc=<value optimized out>,
    ySrc=<value optimized out>, xMask=<value optimized out>,
    yMask=<value optimized out>, xDst=<value optimized out>,
    yDst=<value optimized out>, width=<value optimized out>,
    height=<value optimized out>) at exa_render.c:1050
#14 0x0811b7d7 in damageComposite (op=<value optimized out>,
    pSrc=<value optimized out>, pMask=<value optimized out>,
    pDst=<value optimized out>, xSrc=<value optimized out>,
    ySrc=<value optimized out>, xMask=<value optimized out>,
    yMask=<value optimized out>, xDst=<value optimized out>,
    yDst=<value optimized out>, width=<value optimized out>,
    height=<value optimized out>) at damage.c:643
#15 0x0810ed60 in CompositePicture (op=<value optimized out>,
    pSrc=<value optimized out>, pMask=<value optimized out>,
    pDst=<value optimized out>, xSrc=<value optimized out>,
    ySrc=<value optimized out>, xMask=<value optimized out>,
    yMask=<value optimized out>, xDst=<value optimized out>,
    yDst=<value optimized out>, width=<value optimized out>,
    height=<value optimized out>) at picture.c:1721
#16 0x081b63a0 in miCompositeRects (op=<value optimized out>,
    pDst=<value optimized out>, color=<value optimized out>,
    nRect=<value optimized out>, rects=0xa181a98) at mirect.c:168
#17 0x0810eab4 in CompositeRects (op=<value optimized out>,
    pDst=<value optimized out>, color=<value optimized out>,
    nRect=<value optimized out>, rects=<value optimized out>) at picture.c:1745
#18 0x08115a1d in ProcRenderFillRectangles (client=<value optimized out>)
    at render.c:1456
#19 0x08111b44 in ProcRenderDispatch (client=<value optimized out>)
    at render.c:2041
#20 0x0806e137 in Dispatch () at dispatch.c:445
#21 0x08062885 in main (argc=<value optimized out>,
    argv=<value optimized out>, envp=<value optimized out>) at main.c:285

(gdb) bt full
#0  0x00e6e416 in __kernel_vsyscall ()
No symbol table info available.
#1  0x0059fd79 in ioctl () from /lib/libc.so.6
No symbol table info available.
#2  0x0047188e in drmIoctl () from /usr/lib/libdrm.so.2
No symbol table info available.
#3  0x00471cd3 in drmCommandNone () from /usr/lib/libdrm.so.2
No symbol table info available.
#4  0x00bc71f4 in RADEONDownloadFromScreenCP (pSrc=<value optimized out>,
    x=<value optimized out>, y=<value optimized out>, w=<value optimized out>,
    h=<value optimized out>, dst=<value optimized out>,
    dst_pitch=<value optimized out>) at radeon_exa_funcs.c:669
        i = 1168
        hpass = 1
        indirect = {idx = 136393216, start = 160913408, end = -1074279616,
          discard = -1074280168}
        __head = <value optimized out>
        __expected = <value optimized out>
        __count = <value optimized out>
        swap = Cannot access memory at address 0x0

Output from strace:

...
sigreturn()                             = ? (mask now [])
ioctl(11, 0x6444, 0)                    = -1 EBUSY (Device or resource busy)
--- SIGALRM (Alarm clock) @ 0 (0) ---
sigreturn()                             = ? (mask now [])
ioctl(11, 0x6444, 0)                    = -1 EBUSY (Device or resource busy)
--- SIGALRM (Alarm clock) @ 0 (0) ---
sigreturn()                             = ? (mask now [])
ioctl(11, 0x6444, 0)                    = -1 EBUSY (Device or resource busy)
--- SIGALRM (Alarm clock) @ 0 (0) ---
sigreturn()                             = ? (mask now [])
ioctl(11, 0x6444^C <unfinished ...>
Process 1143 detached


I have now setup the machine with an xorg.conf and selected XAA as AccelMethod. Up to now the machine hasn't frozen up once.

This is a different problem than bug #517744. I don't know if it is the same problem as bug #517625 (user didn't mention his graphics card).
Comment 1 Matěj Cepl 2009-09-23 12:14:38 EDT

*** This bug has been marked as a duplicate of bug 517625 ***
Comment 2 Stefan Becker 2009-09-23 14:54:33 EDT
Sorry, not a duplicate of bug #517625. That user has 

NV: Found NVIDIA GeForce FX Go5650 at 01@00:00:0

with

(II) Loading sub module "xaa"

His is a totally different problem.
Comment 3 Stefan Becker 2009-10-06 11:58:50 EDT
Retested with:

kernel-2.6.31.1-58.fc12.i686
xorg-x11-server-common-1.7.0-1.fc12.i686
xorg-x11-drv-ati-6.13.0-0.7.20091006git457646d73.fc12.i686
libdrm-2.4.14-1.fc12.i686
mesa-libGL-7.6-0.13.fc12.i686

As far as I can tell the problem has disappeared. I've now been using the machine for several hours and still no lockup.