The backtrace looks similar to bug#20863. Does VT switch can reproduce your problem too?

No. I can switch between VT fine without a crash. Also nothing bad is logged in dmesg when VT switch happens.

(Note that I have KMS enabled and running on this setup)

Created attachment 24259 [details]
xorg log

Created attachment 24260 [details]
dmesg

More logs.

Tried this combination, too:

xserver 1.6
kernel 2.6.29
intel master from today
libdrm master from today
drm from drm-intel-next

Also ended with crash:

(II) UnloadModule: "evdev"
(II) Open ACPI successful (/var/run/acpid.socket)
(II) APM registered successfully
(II) intel(0): [DRI2] Setup complete
(**) intel(0): Kernel mode setting active, disabling FBC.
(**) intel(0): Framebuffer compression disabled
(**) intel(0): Tiling enabled
(==) intel(0): VideoRam: -1 KB
(II) intel(0): Attempting memory allocation with tiled buffers.

Backtrace:
0: /usr/bin/X(xorg_backtrace+0x26) [0x4e9ed6]
1: /usr/bin/X(xf86SigHandler+0x39) [0x48ca49]
2: /lib64/libc.so.6 [0x7f311cfc7570]
3: /usr/lib64/libdrm_intel.so.1(drm_intel_bo_alloc+0x3) [0x7f311b181683]
4: /usr/lib64/xorg/modules/drivers//intel_drv.so(i830_allocate_memory+0x316) [0x7f311b3be3f6]
5: /usr/lib64/xorg/modules/drivers//intel_drv.so(i830_allocate_2d_memory+0xc0) [0x7f311b3bf1d0]
6: /usr/lib64/xorg/modules/drivers//intel_drv.so [0x7f311b3b3603]
7: /usr/lib64/xorg/modules/drivers//intel_drv.so [0x7f311b3b87a0]
8: /usr/bin/X(AddScreen+0x1c6) [0x42cde6]
9: /usr/bin/X(InitOutput+0x242) [0x467f52]
10: /usr/bin/X(main+0x20e) [0x42d4ee]
11: /lib64/libc.so.6(__libc_start_main+0xe6) [0x7f311cfb35d6]
12: /usr/bin/X [0x42cb39]

Fatal server error:
Caught signal 11.  Server aborting

*** Bug 20757 has been marked as a duplicate of this bug. ***

Program received signal SIGSEGV, Segmentation fault.
drm_intel_bo_alloc (bufmgr=0x0, name=0x7f9939908bda "HW cursors", size=40960, alignment=4096) at intel_bufmgr.c:51
51         return bufmgr->bo_alloc(bufmgr, name, size, alignment);                                                
(gdb) bt                                                                                                          
#0  drm_intel_bo_alloc (bufmgr=0x0, name=0x7f9939908bda "HW cursors", size=40960, alignment=4096) at intel_bufmgr.c:51
#1  0x00007f99398c93f6 in i830_allocate_memory_bo (tile_format=<value optimized out>, flags=<value optimized out>, align=4096, pitch=<value optimized out>, size=40960,
    name=<value optimized out>, pScrn=<value optimized out>) at i830_memory.c:828
#2  i830_allocate_memory (tile_format=<value optimized out>, flags=<value optimized out>, align=4096, pitch=<value optimized out>, size=40960, name=<value optimized out>,
    pScrn=<value optimized out>) at i830_memory.c:942
#3  0x00007f99398ca1d0 in i830_allocate_cursor_buffers (pScrn=<value optimized out>) at i830_memory.c:1306
#4  i830_allocate_2d_memory (pScrn=<value optimized out>) at i830_memory.c:1437
#5  0x00007f99398be603 in i830_try_memory_allocation (pScrn=0xecd6d0) at i830_driver.c:2706
#6  0x00007f99398c37a0 in i830_memory_init (pScrn=<value optimized out>) at i830_driver.c:2764
#7  I830ScreenInit (pScrn=<value optimized out>) at i830_driver.c:3068
#8  0x000000000042cde6 in AddScreen (pfnInit=0x7f99398c2e20 <I830ScreenInit>, argc=7, argv=0x7fff4551e268) at main.c:702
#9  0x0000000000467f52 in InitOutput (pScreenInfo=0x7d1ae0, argc=7, argv=0x7fff4551e268) at xf86Init.c:1245
#10 0x000000000042d4ee in main (argc=7, argv=0x7fff4551e268, envp=0x7d1260) at main.c:315
(gdb) frame 1
#1  0x00007f99398c93f6 in i830_allocate_memory_bo (tile_format=<value optimized out>, flags=<value optimized out>, align=4096, pitch=<value optimized out>, size=40960,
    name=<value optimized out>, pScrn=<value optimized out>) at i830_memory.c:828
828         mem->bo = dri_bo_alloc (pI830->bufmgr, name, size, align);
(gdb) frame 2
#2  i830_allocate_memory (tile_format=<value optimized out>, flags=<value optimized out>, align=4096, pitch=<value optimized out>, size=40960, name=<value optimized out>,
    pScrn=<value optimized out>) at i830_memory.c:942
942             return i830_allocate_memory_bo(pScrn, name, size, pitch, alignment, flags, tile_format);

More info.

In I830ScreenInit():

(gdb) print pScreen->myNum
$20 = 0
(gdb) print ((I830Ptr)xf86Screens[0]->driverPrivate)->bufmgr
$21 = (drm_intel_bufmgr *) 0x0


I830CloseScreen() is called, it calls dri_bufmgr_destroy(pI830->bufmgr); and pI830->bufmgr = NULL;

but later I830ScreenInit() is called but without I830PreInit
and the call path is:

#0  I830CloseScreen (scrnIndex=0, pScreen=0x1d38030) at i830_driver.c:3703
#1  0x00000000004fea99 in CursorCloseScreen (index=0, pScreen=0x1d38030) at cursor.c:186
#2  0x000000000052d423 in AnimCurCloseScreen (index=0, pScreen=0x1d38030) at animcur.c:136
#3  0x000000000042d72c in main (argc=7, argv=0x7fffe070c458, envp=<value optimized out>) at main.c:429

thus bufmgr is NULL since no I830PreInit was called.

Now InitOutput() calls I830PreInit but only once, when if (serverGeneration == 1) .

So at second generation CloseScreen is called, bufmgr is freed, I830PreInit not called anymore and segfault on bufmgr (being NULL) access.

ScreenInit actually initializes bufmgr BUT after i830_memory_init() where X segfaults in i830_memory_init.


diff --git a/src/i830_memory.c b/src/i830_memory.c
index 052d906..1eaf896 100644
--- a/src/i830_memory.c
+++ b/src/i830_memory.c
@@ -553,8 +553,8 @@ i830_allocator_init(ScrnInfoPtr pScrn, unsigned long offset, unsigned long size)
                    i830_free_memory(pScrn, pI830->memory_manager);
                    pI830->memory_manager = NULL;
                }
-               i830_init_bufmgr(pScrn);
            }
+           i830_init_bufmgr(pScrn);
        } else {
            xf86DrvMsg(pScrn->scrnIndex, X_ERROR,
                       "Failed to allocate space for kernel memory manager\n");

help - X no longers segfaults at trying to access bufmgr but it segfaults in other place:
Program received signal SIGSEGV, Segmentation fault.
0x00007fd268e3e000 in ?? ()
(gdb) bt
#0  0x00007fd268e3e000 in ?? ()
#1  0x00007fd26529da47 in i965_prepare_composite (op=3, pSrcPicture=0x37ac160, pMaskPicture=0x0, pDstPicture=0x37b7430, pSrc=0x37acac0, pMask=0x0, pDst=0x3760cf0)
    at i965_render.c:1350
#2  0x00007fd2652b3a7f in uxa_try_driver_composite (op=3 '\3', pSrc=0x37ac160, pMask=0x0, pDst=0x37b7430, xSrc=0, ySrc=0, xMask=0, yMask=0, xDst=0, yDst=0,
    width=1440, height=900) at uxa-render.c:489
#3  0x00007fd2652b47a8 in uxa_composite (op=3 '\3', pSrc=0x37ac160, pMask=0x0, pDst=0x37b7430, xSrc=0, ySrc=0, xMask=0, yMask=0, xDst=0, yDst=0, width=1440,
    height=900) at uxa-render.c:747
#4  0x0000000000530638 in damageComposite (op=32 ' ', pSrc=0x37ac160, pMask=0x0, pDst=0x37b7430, xSrc=0, ySrc=0, xMask=30304, yMask=<value optimized out>,
    xDst=<value optimized out>, yDst=<value optimized out>, width=<value optimized out>, height=<value optimized out>) at damage.c:643
#5  0x0000000000528c5a in ProcRenderComposite (client=0x37ba8c0) at render.c:720
#6  0x000000000044781c in Dispatch () at dispatch.c:437
#7  0x000000000042d69d in main (argc=7, argv=0x7fff70ed6c18, envp=<value optimized out>) at main.c:397

I wonder if you were bitten by the videoRAM warning fix bug... Does this still happen with the latest git bits?

Adjusting severity: crashes & hangs should be marked critical.

This happens for me as well with xorg-edgers drivers, current being git20090617.b5cd2130 (today's date). I get it with and without KMS, on my self-compiled 2.6.30 kernel.


...
(II) intel(0): [DRI2] Setup complete
(**) intel(0): Kernel mode setting active, disabling FBC.
(**) intel(0): Framebuffer compression disabled
(**) intel(0): Tiling enabled
(==) intel(0): VideoRam: 262144 KB
(II) intel(0): Attempting memory allocation with tiled buffers.

Backtrace:
0: /usr/bin/X(xorg_backtrace+0x3b) [0x81353ab]
1: /usr/bin/X(xf86SigHandler+0x55) [0x80c74e5]
2: [0xb7f9c400]
3: /usr/lib/xorg/modules/drivers//intel_drv.so(i830_allocate_memory+0x2f6) [0xb7971816]
4: /usr/lib/xorg/modules/drivers//intel_drv.so(i830_allocate_2d_memory+0xbf) [0xb797230f]
5: /usr/lib/xorg/modules/drivers//intel_drv.so [0xb7966764]
6: /usr/lib/xorg/modules/drivers//intel_drv.so [0xb796b6c0]
7: /usr/bin/X(AddScreen+0x19d) [0x8071b0d]
8: /usr/bin/X(InitOutput+0x206) [0x80afc86]
9: /usr/bin/X(main+0x1e1) [0x8072201]
10: /lib/tls/i686/cmov/libc.so.6(__libc_start_main+0xe5) [0xb7c90775]
11: /usr/bin/X [0x8071891]
Saw signal 11.  Server aborting.
 ddxSigGiveUp: Closing log


Full paste at http://pastebin.ubuntu.com/197847. No special options defined in xorg.conf, except for ModeDebug to make the log more verbose.

The crash is 100% reproducible; just log into KDE and log out. Noteworthy is that if you enable zapping and restart via ctrl+alt+backspace, it restarts properly. Merely logging out doesn't.

*** Bug 22335 has been marked as a duplicate of this bug. ***

This is not kdm related, afaict, something in the regen path in the driver is broken, so adjusting summary

I can say that I noticed this issue right from 2.7.1 drivers but some where around 2.7.99 it got fixed and then with some updates a few days back it broke again.

What information is needed ? (Saw in keywords) 

None (sorry removing the needinfo tag), this is a known breakage.  We don't recommend that people run with regeneration though...

#16: I'm sorry, I'm not very familiar with the terminology, and it's apparently something too technical for google to be of help. Is this something I can disable via xorg.conf options, or at compile-time of the intel driver itself?

It's usually a display manager (gdm or kdm) option.  On gdm it's AlwaysRestartServer, on kdm it might be AllowClose=true (not sure about that).

Basically what you want to do is start a new X server everytime, rather than trying to reuse the server you just logged out from.

(In reply to comment #18)
> It's usually a display manager (gdm or kdm) option.  On gdm it's
> AlwaysRestartServer, on kdm it might be AllowClose=true (not sure about that).
> 
> Basically what you want to do is start a new X server everytime, rather than
> trying to reuse the server you just logged out from.
> 

This is not correct for kdm AllowClose=true is already set in my case. I read that this setting is for enabling X to restart from kdm login place.

I found the settings

add TerminateServer=true
to  /etc/kde4/kdm/kdmrc under [X-*-Core]

Now log off works.

*** Bug 22151 has been marked as a duplicate of this bug. ***

*** Bug 22462 has been marked as a duplicate of this bug. ***

The original comment in this bug was about suspend/resume, but all later comments appear to be about regen, so marking it as a dupe of the first regen bug in the list (with the same backtrace and cause).


*** This bug has been marked as a duplicate of bug 20516 ***