Bug 24159

Summary: [KMS] radeon module oops with stex3d and rv280
Product: DRI Reporter: Andrew Randrianasulu <randrik>
Component: DRM/RadeonAssignee: Default DRI bug account <dri-devel>
Status: RESOLVED FIXED QA Contact:
Severity: normal    
Priority: medium    
Version: XOrg git   
Hardware: x86 (IA32)   
OS: Linux (All)   
Whiteboard:
i915 platform: i915 features:
Attachments:
Description Flags
patch for upstream none

Description Andrew Randrianasulu 2009-09-25 15:42:55 UTC 
Using kernel from http://git.kernel.org/?p=linux/kernel/git/airlied/drm-2.6.git;a=shortlog;h=drm-next

up to adea4796cfb9b74d340f9e32ba523fb61305d0b7 ( drm/r600: get values from the passed in IB not the copy.)

i got this oops:

Sep 26 02:28:43 (none) kernel: BUG: unable to handle kernel NULL pointer dereference at 00000014
Sep 26 02:28:43 (none) kernel: IP: [<d120c48a>] radeon_object_size+0x8/0x10 [radeon]
Sep 26 02:28:43 (none) kernel: *pde = 00000000
Sep 26 02:28:43 (none) kernel: Oops: 0000 [#1] SMP
Sep 26 02:28:43 (none) kernel: last sysfs file: /sys/devices/platform/w83627hf.656/in8_input
Sep 26 02:28:43 (none) kernel: Modules linked in: radeon ttm drm_kms_helper drm i2c_algo_bit cfbcopyarea cfbimgblt cfbfillrect
 sg sd_mod snd_seq_dummy snd_seq_oss snd_seq_midi_event snd_seq snd_pcm_oss snd_mixer_oss nfsd lockd nfs_acl auth_rpcgss sunrp
c ipv6 usb_storage usblp scsi_mod usb_libusual tuner_simple tuner_types tda9887 tda8290 snd_emu10k1 snd_cs4236 snd_via82xx ppd
ev snd_mpu401 snd_ac97_codec snd_wavefront snd_wss_lib ac97_bus snd_pcm saa7134 snd_opl3_lib snd_util_mem snd_page_alloc snd_t
imer snd_mpu401_uart ir_common snd_hwdep snd_rawmidi snd_seq_device parport_pc snd uhci_hcd videobuf_dma_sg ehci_hcd parport v
ideobuf_core floppy usbcore ns558 shpchp rtc_cmos tveeprom rtc_core emu10k1_gp 8139too soundcore rtc_lib gameport pci_hotplug
mii via_agp xfs exportfs ufs agpgart tuner v4l2_common videodev v4l1_compat w83627hf hwmon_vid hwmon i2c_viapro i2c_dev i2c_co
re fbcon tileblit font bitblit softcursor fb
Sep 26 02:28:43 (none) kernel:
Sep 26 02:28:43 (none) kernel: Pid: 3982, comm: stex3d Not tainted (2.6.31-rc9-i486 #12) MS-6380E
Sep 26 02:28:43 (none) kernel: EIP: 0060:[<d120c48a>] EFLAGS: 00210202 CPU: 0
Sep 26 02:28:43 (none) kernel: EIP is at radeon_object_size+0x8/0x10 [radeon]
Sep 26 02:28:43 (none) kernel: EAX: 00000000 EBX: c90720d0 ECX: c9072000 EDX: cc17c000
Sep 26 02:28:43 (none) kernel: ESI: 00000004 EDI: c9072120 EBP: c915dd78 ESP: c915dd78
Sep 26 02:28:43 (none) kernel:  DS: 007b ES: 007b FS: 00d8 GS: 0033 SS: 0068
Sep 26 02:28:43 (none) kernel: Process stex3d (pid: 3982, ti=c915d000 task=cf878000 task.ti=c915d000)
Sep 26 02:28:43 (none) kernel: Stack:
Sep 26 02:28:43 (none) kernel:  c915ddb0 d121a07d 00000040 00002d00 c9072000 cc17c000 00000000 00000000
Sep 26 02:28:43 (none) kernel: <0> c9136c00 00000000 00004000 00000000 c915de28 c9072000 c915de18 d121bebd
Sep 26 02:28:43 (none) kernel: <0> 00000003 00000000 00001000 00000004 00000004 00000003 000000f7 d16a0000
Sep 26 02:28:43 (none) kernel: Call Trace:
Sep 26 02:28:43 (none) kernel:  [<d121a07d>] ? r100_cs_track_check+0x422/0x4ed [radeon]
Sep 26 02:28:43 (none) kernel:  [<d121bebd>] ? r100_cs_parse+0x41a/0x46a [radeon]
Sep 26 02:28:43 (none) kernel:  [<d1217d32>] ? radeon_cs_ioctl+0xe1/0x15f [radeon]
Sep 26 02:28:43 (none) kernel:  [<d1120716>] ? drm_ioctl+0x20b/0x28b [drm]
Sep 26 02:28:43 (none) kernel:  [<d1217c51>] ? radeon_cs_ioctl+0x0/0x15f [radeon]
Sep 26 02:28:43 (none) kernel:  [<c1083e04>] ? filemap_fault+0x6e/0x2ed
Sep 26 02:28:43 (none) kernel:  [<c10a88f9>] ? mem_cgroup_update_mapped_file_stat+0x60/0x6b
Sep 26 02:28:43 (none) kernel:  [<c108394b>] ? unlock_page+0x43/0x46
Sep 26 02:28:43 (none) kernel:  [<c1094efd>] ? __do_fault+0x33c/0x36c
Sep 26 02:28:43 (none) kernel:  [<c10b53a4>] ? vfs_ioctl+0x53/0x6c
Sep 26 02:28:43 (none) kernel:  [<c10b58d6>] ? do_vfs_ioctl+0x470/0x4aa
Sep 26 02:28:43 (none) kernel:  [<c1045fae>] ? hrtimer_interrupt+0x13b/0x14b
Sep 26 02:28:43 (none) kernel:  [<c10b5941>] ? sys_ioctl+0x31/0x4a
Sep 26 02:28:43 (none) kernel:  [<c1002b25>] ? syscall_call+0x7/0xb
Sep 26 02:28:43 (none) kernel: Code: 18 00 89 c1 74 0e 8b 02 89 48 04 89 01 89 51 04 89 0a eb 0d 8b 42 04 89 11 89 4a 04 89 08
 89 41 04 5d c3 55 89 e5 0f 1f 44 00 00 <8b> 40 14 5d c1 e0 0c c3 55 89 e5 57 56 53 0f 1f 44 00 00 8b 98
Sep 26 02:28:43 (none) kernel: EIP: [<d120c48a>] radeon_object_size+0x8/0x10 [radeon] SS:ESP 0068:c915dd78
Sep 26 02:28:43 (none) kernel: CR2: 0000000000000014
Sep 26 02:28:43 (none) kernel: ---[ end trace cc0588276d1b182e ]---


My hw is AGP rv280, mesa from git master up to commit c19482b16f164ce1b6625d18950a4644e5834373 ( st/xorg: Re-enable accelerated fills and copies.)
Comment 1 Andrew Randrianasulu 2009-12-21 13:58:28 UTC 
bug still here with upstream kernel (2.6.33-rc1, up to commit dd59f6c76b265ed2ff18b497d6105a9511b1feb1) and mesa git master (up to ad7f9d71e22fb7667c90dbbc0558939b89a45154)

----from syslog-----

Dec 21 22:55:12 (none) kernel: BUG: unable to handle kernel NULL pointer dereference at 00000040
Dec 21 22:55:12 (none) kernel: IP: [<d11dd08a>] r100_cs_track_check+0x4a9/0x56a [radeon]
Dec 21 22:55:12 (none) kernel: *pde = 00000000 
Dec 21 22:55:12 (none) kernel: Oops: 0000 [#1] SMP 
Dec 21 22:55:12 (none) kernel: last sysfs file: /sys/devices/platform/w83627hf.656/in8_input
Dec 21 22:55:12 (none) kernel: Modules linked in: radeon ttm drm_kms_helper drm i2c_algo_bit cfbcopyarea cfbimgblt cfbfillrect snd_seq_dummy snd_seq_oss snd_seq_midi_event snd_seq snd_pcm_oss snd_mixer_oss nfsd lockd nfs_acl auth_rpcgss sunrpc ipv6 uhci_hcd tuner_simple tuner_types tda9887 snd_cs4236 snd_mpu401 tda8290 snd_wavefront snd_via82xx snd_ac97_codec snd_wss_lib ac97_bus snd_pcm snd_opl3_lib ppdev snd_timer snd_hwdep snd_page_alloc ehci_hcd snd_mpu401_uart saa7134 snd_rawmidi snd_seq_device rtc_cmos parport_pc rtc_core shpchp rtc_lib ir_common ns558 videobuf_dma_sg snd parport pci_hotplug floppy processor gameport usbcore 8139too mii soundcore videobuf_core button ir_core tveeprom thermal via_agp mousedev evdev ufs xfs exportfs agpgart psmouse tuner v4l2_common videodev v4l1_compat w83627hf hwmon_vid hwmon i2c_viapro i2c_dev i2c_core fbcon tileblit font bitblit softcursor fb via82cxxx ide_gd_mod ide_core
Dec 21 22:55:12 (none) kernel: 
Dec 21 22:55:12 (none) kernel: EIP: 0060:[<d11dd08a>] EFLAGS: 00010202 CPU: 0
Dec 21 22:55:12 (none) kernel: EIP is at r100_cs_track_check+0x4a9/0x56a [radeon]
Dec 21 22:55:12 (none) kernel: EAX: 00000000 EBX: 00000000 ECX: c71080d0 EDX: 00000004
Dec 21 22:55:12 (none) kernel: ESI: 00004000 EDI: 00000004 EBP: c71b7da8 ESP: c71b7d60
Dec 21 22:55:12 (none) kernel:  DS: 007b ES: 007b FS: 00d8 GS: 0033 SS: 0068
Dec 21 22:55:12 (none) kernel: Process stex3d (pid: 3826, ti=c71b7000 task=c7120ce0 task.ti=c71b7000)
Dec 21 22:55:12 (none) kernel: Stack:
Dec 21 22:55:12 (none) kernel:  00000040 c7054d50 00002d00 c71b7de4 c7108000 c8ea9000 00000000 c7105600
Dec 21 22:55:12 (none) kernel: <0> 00000006 00000000 c7108000 00000066 00000004 00000024 00001000 00000000
Dec 21 22:55:12 (none) kernel: <0> c71b7e28 c7108000 c71b7e10 d11ded69 00000003 00000000 00001000 00000004
Dec 21 22:55:12 (none) kernel: Call Trace:
Dec 21 22:55:12 (none) kernel:  [<d11ded69>] ? r100_cs_parse+0x41a/0x46a [radeon]
Dec 21 22:55:12 (none) kernel:  [<d11da709>] ? radeon_cs_ioctl+0xe3/0x162 [radeon]
Dec 21 22:55:12 (none) kernel:  [<d10bc63f>] ? drm_ioctl+0x20b/0x28b [drm]
Dec 21 22:55:12 (none) kernel:  [<d11da626>] ? radeon_cs_ioctl+0x0/0x162 [radeon]
Dec 21 22:55:12 (none) kernel:  [<c10918dd>] ? filemap_fault+0x6e/0x2e5
Dec 21 22:55:12 (none) kernel:  [<c10b8ba1>] ? mem_cgroup_update_file_mapped+0x12/0x5c
Dec 21 22:55:12 (none) kernel:  [<c109140b>] ? unlock_page+0x43/0x46
Dec 21 22:55:12 (none) kernel:  [<c10a3565>] ? __do_fault+0x33c/0x36c
Dec 21 22:55:12 (none) kernel:  [<c10c59f3>] ? vfs_ioctl+0x62/0x8a
Dec 21 22:55:12 (none) kernel:  [<c10c5f34>] ? do_vfs_ioctl+0x470/0x4aa
Dec 21 22:55:12 (none) kernel:  [<c10a9558>] ? do_mmap_pgoff+0x22a/0x27a
Dec 21 22:55:12 (none) kernel:  [<c101c9cc>] ? do_page_fault+0x26c/0x2aa
Dec 21 22:55:12 (none) kernel:  [<c10c5f9f>] ? sys_ioctl+0x31/0x4a
Dec 21 22:55:12 (none) kernel:  [<c1240175>] ? syscall_call+0x7/0xb
Dec 21 22:55:12 (none) kernel: Code: c8 80 b8 cd 08 00 00 00 74 62 8b 45 d0 31 db 8b 55 c8 c1 e0 07 8d 8c 02 d0 00 00 00 8b 01 89 fa 0f af 51 08 0f af 51 0c 03 51 04 <8b> 40 40 c1 e0 0c 39 c2 76 2c 50 52 68 98 bb 1f d1 68 0b 5e 20 
Dec 21 22:55:12 (none) kernel: EIP: [<d11dd08a>] r100_cs_track_check+0x4a9/0x56a [radeon] SS:ESP 0068:c71b7d60
Dec 21 22:55:12 (none) kernel: CR2: 0000000000000040
Dec 21 22:55:12 (none) kernel: ---[ end trace 2cbdd1b091cfad6d ]---
Comment 2 Andrew Randrianasulu 2010-01-16 17:44:46 UTC 
issue still here, on 33-rc4+:

after minor modification in drivers/gpu/drm/radeon/r100.c

----debug patch

diff --git a/drivers/gpu/drm/radeon/r100.c b/drivers/gpu/drm/radeon/r100.c
index 8760d66..09e5acb 100644
--- a/drivers/gpu/drm/radeon/r100.c
+++ b/drivers/gpu/drm/radeon/r100.c
@@ -2846,6 +2846,8 @@ static int r100_cs_track_texture_check(struct radeon_device *rdev,
                }
                size *= track->textures[u].cpp;
 
+               // r100_cs_track_texture_print(&track->textures[u]); // tmp debug
+
                switch (track->textures[u].tex_coord_type) {
                case 0:
                        break;
@@ -2975,6 +2977,7 @@ int r100_cs_track_check(struct radeon_device *rdev, struct r100_cs_track *track)
                          prim_walk);
                return -EINVAL;
        }
+       DRM_INFO("[drm] want to call r100_cs_track_texture_check! \n");
        return r100_cs_track_texture_check(rdev, track);
 }
---debug patch end

i get this

Jan 17 03:42:20 (none) kernel: Console: switching to colour frame buffer device 160x64
Jan 17 03:43:16 (none) kernel: [drm:r100_cs_track_texture_print] *ERROR* pitch                      256
Jan 17 03:43:16 (none) kernel: [drm:r100_cs_track_texture_print] *ERROR* use_pitch                  0
Jan 17 03:43:16 (none) kernel: [drm:r100_cs_track_texture_print] *ERROR* width                      64
Jan 17 03:43:16 (none) kernel: [drm:r100_cs_track_texture_print] *ERROR* width_11                   2048
Jan 17 03:43:16 (none) kernel: [drm:r100_cs_track_texture_print] *ERROR* height                     64
Jan 17 03:43:16 (none) kernel: [drm:r100_cs_track_texture_print] *ERROR* height_11                  2048
Jan 17 03:43:16 (none) kernel: [drm:r100_cs_track_texture_print] *ERROR* num levels                 0
Jan 17 03:43:16 (none) kernel: [drm:r100_cs_track_texture_print] *ERROR* depth                      6
Jan 17 03:43:16 (none) kernel: [drm:r100_cs_track_texture_print] *ERROR* bpp                        4
Jan 17 03:43:16 (none) kernel: [drm:r100_cs_track_texture_print] *ERROR* coordinate type            2
Jan 17 03:43:16 (none) kernel: [drm:r100_cs_track_texture_print] *ERROR* width round to power of 2  1
Jan 17 03:43:16 (none) kernel: [drm:r100_cs_track_texture_print] *ERROR* height round to power of 2 1
Jan 17 03:43:16 (none) kernel: [drm:r100_cs_track_texture_print] *ERROR* compress format            0
Jan 17 03:43:16 (none) kernel: BUG: unable to handle kernel NULL pointer dereference at 00000040
Jan 17 03:43:16 (none) kernel: IP: [<d11906d7>] r100_cs_track_check+0x4e2/0x58b [radeon]
Jan 17 03:43:16 (none) kernel: *pde = 00000000 
Jan 17 03:43:16 (none) kernel: Oops: 0000 [#1] SMP 
Jan 17 03:43:16 (none) kernel: last sysfs file: /sys/class/vc/vcs7/dev
Jan 17 03:43:16 (none) kernel: Modules linked in: radeon ttm drm_kms_helper drm i2c_algo_bit cfbcopyarea cfbimgblt cfbfillrect snd_seq_dummy snd_seq_oss snd_seq_midi_event snd_seq snd_pcm_oss snd_mixer_oss nfsd lockd nfs_acl auth_rpcgss sunrpc ipv6 mousedev usbhid usbmouse snd_via82xx snd_cs4236 snd_mpu401 tuner_simple tuner_types snd_ac97_codec snd_wavefront tda9887 snd_wss_lib ac97_bus tda8290 snd_pcm snd_opl3_lib uhci_hcd snd_timer snd_page_alloc snd_hwdep saa7134 snd_mpu401_uart ehci_hcd snd_rawmidi snd_seq_device ppdev ir_common rtc_cmos videobuf_dma_sg snd parport_pc rtc_core rtc_lib shpchp videobuf_core 8139too mii ns558 parport usbcore pci_hotplug floppy processor via_agp soundcore gameport ir_core thermal button tveeprom evdev ufs xfs exportfs agpgart psmouse tuner v4l2_common videodev v4l1_compat w83627hf hwmon_vid hwmon i2c_viapro i2c_dev i2c_core fbcon tileblit font bitblit softcursor fb via82cxxx ide_gd_mod ide_core
Jan 17 03:43:16 (none) kernel: 
Jan 17 03:43:16 (none) kernel: Pid: 3804, comm: stex3d Not tainted 2.6.33-rc4-i486 #61 MS-6380E/MS-6380E
Jan 17 03:43:16 (none) kernel: EIP: 0060:[<d11906d7>] EFLAGS: 00210246 CPU: 0
Jan 17 03:43:16 (none) kernel: EIP is at r100_cs_track_check+0x4e2/0x58b [radeon]
Jan 17 03:43:16 (none) kernel: EAX: 00000000 EBX: 00000000 ECX: cd59b0d4 EDX: 00000004
Jan 17 03:43:16 (none) kernel: ESI: 00004000 EDI: cd59b0d0 EBP: cac32da4 ESP: cac32d5c
Jan 17 03:43:16 (none) kernel:  DS: 007b ES: 007b FS: 00d8 GS: 0033 SS: 0068
Jan 17 03:43:16 (none) kernel: Process stex3d (pid: 3804, ti=cac32000 task=cbb88000 task.ti=cac32000)
Jan 17 03:43:16 (none) kernel: Stack:
Jan 17 03:43:16 (none) kernel:  00000040 cbb66210 00002d00 cac32de0 cd59b000 cd591000 00000004 00000000
Jan 17 03:43:16 (none) kernel: <0> cac33400 00000000 cd59b000 00000066 00000004 00000024 00001000 00000000
Jan 17 03:43:16 (none) kernel: <0> cac32e24 cd59b000 cac32e0c d119239e 00000003 00000000 00001000 00000004
Jan 17 03:43:16 (none) kernel: Call Trace:
Jan 17 03:43:16 (none) kernel:  [<d119239e>] ? r100_cs_parse+0x41a/0x46a [radeon]
Jan 17 03:43:16 (none) kernel:  [<d118de21>] ? radeon_cs_ioctl+0xe3/0x162 [radeon]
Jan 17 03:43:16 (none) kernel:  [<d106e698>] ? drm_ioctl+0x268/0x310 [drm]
Jan 17 03:43:16 (none) kernel:  [<d118dd3e>] ? radeon_cs_ioctl+0x0/0x162 [radeon]
Jan 17 03:43:16 (none) kernel:  [<c10b8ff5>] ? mem_cgroup_update_file_mapped+0x12/0x5c
Jan 17 03:43:16 (none) kernel:  [<c1091833>] ? unlock_page+0x43/0x46
Jan 17 03:43:16 (none) kernel:  [<c10a3895>] ? __do_fault+0x33c/0x36c
Jan 17 03:43:16 (none) kernel:  [<d106e430>] ? drm_ioctl+0x0/0x310 [drm]
Jan 17 03:43:16 (none) kernel:  [<c10c5e48>] ? vfs_ioctl+0x27/0x8a
Jan 17 03:43:16 (none) kernel:  [<c10c63c4>] ? do_vfs_ioctl+0x470/0x4aa
Jan 17 03:43:16 (none) kernel:  [<c10a9888>] ? do_mmap_pgoff+0x22a/0x27a
Jan 17 03:43:16 (none) kernel:  [<c101c7ac>] ? do_page_fault+0x26c/0x2aa
Jan 17 03:43:16 (none) kernel:  [<c10c642f>] ? sys_ioctl+0x31/0x4a
Jan 17 03:43:16 (none) kernel:  [<c1240cb5>] ? syscall_call+0x7/0xb
Jan 17 03:43:16 (none) kernel: Code: 00 8b 45 c8 80 b8 d1 08 00 00 00 74 53 8b 55 e0 8d 4f 04 31 db 8b 92 34 01 00 00 89 55 d0 8b 01 8b 51 0c 0f af 51 08 0f af 55 d0 <8b> 40 40 03 51 04 c1 e0 0c 39 c2 76 1d 50 52 68 60 f0 1a d1 68 
Jan 17 03:43:16 (none) kernel: EIP: [<d11906d7>] r100_cs_track_check+0x4e2/0x58b [radeon] SS:ESP 0068:cac32d5c
Jan 17 03:43:16 (none) kernel: CR2: 0000000000000040
Jan 17 03:43:16 (none) kernel: ---[ end trace 92b6cc214ec9a14f ]---
Comment 3 Andrew Randrianasulu 2010-01-18 00:25:49 UTC 
after some digging in sources .... this patch fixes oops:

diff --git a/drivers/gpu/drm/radeon/r200.c b/drivers/gpu/drm/radeon/r200.c
index 2094212..ace59ca 100644
--- a/drivers/gpu/drm/radeon/r200.c
+++ b/drivers/gpu/drm/radeon/r200.c
@@ -373,10 +373,10 @@ int r200_packet0_check(struct radeon_cs_parser *p,
                case 7:
                        track->textures[i].tex_coord_type = 0;
                        break;
-               case 1:
+               case 2:
                        track->textures[i].tex_coord_type = 1;
                        break;
-               case 2:
+               case 1:
                        track->textures[i].tex_coord_type = 2;
                        break;
                }


-------

progs/demos/cubemap still work.
Comment 4 Alex Deucher 2010-01-20 08:41:58 UTC 
Created attachment 32742 [details] [review]
patch for upstream

good catch.  I'm sending this upstream.
Comment 5 Fabio Pedretti 2010-02-01 04:50:26 UTC 
Patch merged in 2.6.33-rc6.

Use of freedesktop.org services, including Bugzilla, is subject to our Code of Conduct. How we collect and use information is described in our Privacy Policy.