seems stable without radeon.dynpm=1.

(In reply to comment #1)
> seems stable without radeon.dynpm=1.

I've just had one of these crashes - same trace, current drt, RV670 AGP 32 bit system after about 15 minutes of openarena with dynpm on.

Will see if I can get one with it disabled.

I'm seeing a slightly different problem in d-r-t without dynpm:

BUG: sleeping function called from invalid context at arch/x86/mm/fault.c:1072
in_atomic(): 0, irqs_disabled(): 1, pid: 2504, name: Xorg
3 locks held by Xorg/2504:
 #0:  (&dev->struct_mutex){+.+.+.}, at: [<f7d19a4b>] drm_gem_object_free_unlocked+0x3b/0x55 [drm]
 #1:  (&rdev->vram_mutex){+.+.+.}, at: [<f7f42246>] radeon_bo_unref+0x2c/0x56 [radeon]
 #2:  (&mm->mmap_sem){++++++}, at: [<c07af871>] do_page_fault+0x18c/0x302
irq event stamp: 378986
hardirqs last  enabled at (378985): [<c04d036f>] kfree+0x10a/0x11b
hardirqs last disabled at (378986): [<c07ab263>] __mutex_unlock_slowpath+0x5a/0x104
softirqs last  enabled at (378634): [<c043de93>] __do_softirq+0x164/0x173
softirqs last disabled at (378611): [<c043dedd>] do_softirq+0x3b/0x5f
Pid: 2504, comm: Xorg Not tainted 2.6.34-rc5 #2
Call Trace:
 [<c04305ef>] __might_sleep+0xdd/0xe4
 [<c07af8b3>] do_page_fault+0x1ce/0x302
 [<c07af6e5>] ? do_page_fault+0x0/0x302
 [<c07ad4fc>] error_code+0x78/0x80
 [<c07ab268>] ? __mutex_unlock_slowpath+0x5f/0x104
 [<c07ab31a>] mutex_unlock+0xd/0xf
 [<f7f42260>] radeon_bo_unref+0x46/0x56 [radeon]
 [<f7f50c55>] radeon_gem_object_free+0x27/0x39 [radeon]
 [<f7d19a59>] drm_gem_object_free_unlocked+0x49/0x55 [drm]
 [<f7d19a10>] ? drm_gem_object_free_unlocked+0x0/0x55 [drm]
 [<c05b4b1d>] kref_put+0x39/0x42
 [<f7d19bbd>] drm_gem_object_handle_unreference_unlocked+0x28/0x2b [drm]
 [<f7d19d37>] drm_gem_close_ioctl+0x6b/0x73 [drm]
 [<f7d18b92>] drm_ioctl+0x245/0x32b [drm]
 [<f7d19ccc>] ? drm_gem_close_ioctl+0x0/0x73 [drm]
 [<c0407a11>] ? sched_clock+0x9/0xd
 [<c0453cc3>] ? sched_clock_local+0x17/0x11e
 [<c0585b0c>] ? file_has_perm+0x8f/0xa9
 [<c04e4de1>] vfs_ioctl+0x2c/0x96
 [<f7d1894d>] ? drm_ioctl+0x0/0x32b [drm]
 [<c04e5394>] do_vfs_ioctl+0x49b/0x4d9
 [<c0585db0>] ? selinux_file_ioctl+0x43/0x46
 [<c04e5418>] sys_ioctl+0x46/0x66
 [<c04032df>] sysenter_do_call+0x12/0x38
BUG: unable to handle kernel paging request at 6b6b861f
IP: [<c07ab268>] __mutex_unlock_slowpath+0x5f/0x104
*pde = 00000000 
Oops: 0002 [#1] SMP 
last sysfs file: /sys/devices/virtual/vtconsole/vtcon0/uevent
Modules linked in: radeon ttm drm_kms_helper drm i2c_algo_bit fuse rfcomm sco bridge stp llc bnep l2cap sunrpc ipv6 cpufreq_ondemand acpi_cpufreq uinput arc4 ecb iwl3945 iwlcore mac80211 snd_hda_codec_analog snd_hda_intel snd_hda_codec snd_hwdep snd_seq irda snd_seq_device thinkpad_acpi snd_pcm cfg80211 e1000e hwmon snd_timer iTCO_wdt snd btusb bluetooth iTCO_vendor_support video i2c_i801 microcode snd_page_alloc soundcore output crc_ccitt joydev rfkill pcspkr ums_cypress yenta_socket rsrc_nonstatic i2c_core [last unloaded: i2c_algo_bit]

Pid: 2504, comm: Xorg Not tainted 2.6.34-rc5 #2 2007WUK/2007WUK
EIP: 0060:[<c07ab268>] EFLAGS: 00013006 CPU: 0
EIP is at __mutex_unlock_slowpath+0x5f/0x104
EAX: 00000100 EBX: 6b6b861b ECX: e99b9590 EDX: c28040e4
ESI: e9a151e0 EDI: 00003246 EBP: eef8ddf0 ESP: eef8dde4
 DS: 007b ES: 007b FS: 00d8 GS: 00e0 SS: 0068
Process Xorg (pid: 2504, ti=eef8c000 task=e99b9590 task.ti=eef8c000)
Stack:
 eef8de10 e9a151e0 e9a15214 eef8ddf8 c07ab31a eef8de08 f7f42260 00000000
<0> eefebb40 eef8de18 f7f50c55 e99ec230 eefebb40 eef8de2c f7d19a59 eefebb40
<0> f7d19a10 00000005 eef8de3c c05b4b1d eefebb40 eefebb40 eef8de48 f7d19bbd
Call Trace:
 [<c07ab31a>] ? mutex_unlock+0xd/0xf
 [<f7f42260>] ? radeon_bo_unref+0x46/0x56 [radeon]
 [<f7f50c55>] ? radeon_gem_object_free+0x27/0x39 [radeon]
 [<f7d19a59>] ? drm_gem_object_free_unlocked+0x49/0x55 [drm]
 [<f7d19a10>] ? drm_gem_object_free_unlocked+0x0/0x55 [drm]
 [<c05b4b1d>] ? kref_put+0x39/0x42
 [<f7d19bbd>] ? drm_gem_object_handle_unreference_unlocked+0x28/0x2b [drm]
 [<f7d19d37>] ? drm_gem_close_ioctl+0x6b/0x73 [drm]
 [<f7d18b92>] ? drm_ioctl+0x245/0x32b [drm]
 [<f7d19ccc>] ? drm_gem_close_ioctl+0x0/0x73 [drm]
 [<c0407a11>] ? sched_clock+0x9/0xd
 [<c0453cc3>] ? sched_clock_local+0x17/0x11e
 [<c0585b0c>] ? file_has_perm+0x8f/0xa9
 [<c04e4de1>] ? vfs_ioctl+0x2c/0x96
 [<f7d1894d>] ? drm_ioctl+0x0/0x32b [drm]
 [<c04e5394>] ? do_vfs_ioctl+0x49b/0x4d9
 [<c0585db0>] ? selinux_file_ioctl+0x43/0x46
 [<c04e5418>] ? sys_ioctl+0x46/0x66
 [<c04032df>] ? sysenter_do_call+0x12/0x38
Code: c1 00 75 0f ba 3a 01 00 00 b8 ac 69 8d c0 e8 5d d5 c8 ff 9c 58 8d 74 26 00 89 c7 fa 90 8d 74 26 00 e8 ef 2e cb ff b8 00 01 00 00 <f0> 66 0f c1 43 04 38 e0 74 07 f3 90 8a 43 04 eb f5 83 3d 18 2c 
EIP: [<c07ab268>] __mutex_unlock_slowpath+0x5f/0x104 SS:ESP 0068:eef8dde4
CR2: 000000006b6b861f
---[ end trace ea1f7ab8efd48567 ]---

(In reply to comment #2)
> (In reply to comment #1)
> > seems stable without radeon.dynpm=1.
> 
> I've just had one of these crashes - same trace, current drt, RV670 AGP 32 bit
> system after about 15 minutes of openarena with dynpm on.
> 
> Will see if I can get one with it disabled.

I just got one without dynpm -

Apr 29 00:36:24 nf7 kernel: BUG: unable to handle kernel paging request at 00001630
Apr 29 00:36:24 nf7 kernel: IP: [<c138b678>] mutex_unlock+0x8/0x20
Apr 29 00:36:24 nf7 kernel: *pde = 00000000 
Apr 29 00:36:24 nf7 kernel: Oops: 0002 [#1] PREEMPT 
Apr 29 00:36:24 nf7 kernel: last sysfs file: /sys/devices/pci0000:00/0000:00:1e.0/0000:02:00.0/boot_vga
Apr 29 00:36:24 nf7 kernel: Modules linked in: radeon ttm drm_kms_helper drm i2c_algo_bit cfbcopyarea cfbimgblt cfbfillrect fbcon font bitblit softcursor fb saa7134_alsa mt352 saa7134_dvb videobuf_dvb dvb_core mt20xx tea5767 tda9887 tda8290 tuner saa7134 v4l2_common videodev videobuf_dma_sg videobuf_core tveeprom i2c_core nvidia_agp ehci_hcd agpgart ohci_hcd usbhid usbcore snd_intel8x0 snd_ac97_codec ac97_bus forcedeth
Apr 29 00:36:24 nf7 kernel: 
Apr 29 00:36:24 nf7 kernel: Pid: 2553, comm: openarena.i386 Not tainted 2.6.34-rc5-59866-g65cab33 #5 NF7-S/NF7 (nVidia-nForce2)/ 
Apr 29 00:36:24 nf7 kernel: EIP: 0060:[<c138b678>] EFLAGS: 00210246 CPU: 0
Apr 29 00:36:24 nf7 kernel: EIP is at mutex_unlock+0x8/0x20
Apr 29 00:36:24 nf7 kernel: EAX: 00001630 EBX: f3963df4 ECX: 00000000 EDX: 00000001
Apr 29 00:36:24 nf7 kernel: ESI: f62dfc00 EDI: e30e80e0 EBP: f3963ddc ESP: f3963ddc
Apr 29 00:36:24 nf7 kernel:  DS: 007b ES: 007b FS: 0000 GS: 0033 SS: 0068
Apr 29 00:36:24 nf7 kernel: Process openarena.i386 (pid: 2553, ti=f3962000 task=f7ba4960 task.ti=f3962000)
Apr 29 00:36:24 nf7 kernel: Stack:
Apr 29 00:36:24 nf7 kernel:  f3963dec fa0ebad4 00000000 e30e80e0 f3963dfc fa0ff097 e30af800 f62dfc10
Apr 29 00:36:24 nf7 kernel: <0> f3963e10 f952edf2 e30e80e0 f952ed90 00000038 f3963e20 c12041bc e30e80e0
Apr 29 00:36:24 nf7 kernel: <0> e30f2dc4 f3963e34 f952f157 f3963e78 f62dfc00 e30f2da0 f3963f04 f952d719
Apr 29 00:36:24 nf7 kernel: Call Trace:
Apr 29 00:36:24 nf7 kernel:  [<fa0ebad4>] ? radeon_bo_unref+0x44/0x60 [radeon]
Apr 29 00:36:24 nf7 kernel:  [<fa0ff097>] ? radeon_gem_object_free+0x27/0x40 [radeon]
Apr 29 00:36:24 nf7 kernel:  [<f952edf2>] ? drm_gem_object_free_unlocked+0x62/0x80 [drm]
Apr 29 00:36:24 nf7 kernel:  [<f952ed90>] ? drm_gem_object_free_unlocked+0x0/0x80 [drm]
Apr 29 00:36:24 nf7 kernel:  [<c12041bc>] ? kref_put+0x2c/0x60
Apr 29 00:36:24 nf7 kernel:  [<f952f157>] ? drm_gem_close_ioctl+0x97/0xf0 [drm]
Apr 29 00:36:24 nf7 kernel:  [<f952d719>] ? drm_ioctl+0x259/0x3e0 [drm]
Apr 29 00:36:24 nf7 kernel:  [<f952f0c0>] ? drm_gem_close_ioctl+0x0/0xf0 [drm]
Apr 29 00:36:24 nf7 kernel:  [<c12045df>] ? prio_tree_remove+0x5f/0xb0
Apr 29 00:36:24 nf7 kernel:  [<c10a3cec>] ? vma_prio_tree_remove+0x9c/0xf0
Apr 29 00:36:24 nf7 kernel:  [<c10abc3e>] ? free_pgd_range+0xe/0x160
Apr 29 00:36:24 nf7 kernel:  [<c10ae05d>] ? __remove_shared_vm_struct+0x3d/0x60
Apr 29 00:36:24 nf7 kernel:  [<f952d4c0>] ? drm_ioctl+0x0/0x3e0 [drm]
Apr 29 00:36:24 nf7 kernel:  [<c10ccdad>] ? vfs_ioctl+0x2d/0xa0
Apr 29 00:36:24 nf7 kernel:  [<c10ac01b>] ? free_pgtables+0x8b/0xc0
Apr 29 00:36:24 nf7 kernel:  [<c10ccf6a>] ? do_vfs_ioctl+0x6a/0x560
Apr 29 00:36:24 nf7 kernel:  [<c138f3a8>] ? sub_preempt_count+0x8/0x90
Apr 29 00:36:24 nf7 kernel:  [<c10ad5b0>] ? arch_unmap_area_topdown+0x0/0x30
Apr 29 00:36:24 nf7 kernel:  [<c10adc8f>] ? remove_vma+0x3f/0x50
Apr 29 00:36:24 nf7 kernel:  [<c10ae836>] ? do_munmap+0x1e6/0x260
Apr 29 00:36:24 nf7 kernel:  [<c138f3a8>] ? sub_preempt_count+0x8/0x90
Apr 29 00:36:24 nf7 kernel:  [<c10c07a2>] ? fget_light+0xb2/0xe0
Apr 29 00:36:24 nf7 kernel:  [<c10cd49e>] ? sys_ioctl+0x3e/0x60
Apr 29 00:36:24 nf7 kernel:  [<c1002b8c>] ? sysenter_do_call+0x12/0x22
Apr 29 00:36:24 nf7 kernel: Code: fc c9 c3 55 89 e5 e8 a8 7a c7 ff ff 08 79 05 e8 cf 02 00 00 c9 c3 8d b6 00 00 00 00 8d bc 27 00 00 00 00 55 89 e5 e8 88 7a c7 ff <ff> 00 7f 05 e8 4f 00 00 00 c9 c3 8d b6 00 00 00 00 8d bc 27 00 
Apr 29 00:36:24 nf7 kernel: EIP: [<c138b678>] mutex_unlock+0x8/0x20 SS:ESP 0068:f3963ddc
Apr 29 00:36:24 nf7 kernel: CR2: 0000000000001630
Apr 29 00:36:24 nf7 kernel: ---[ end trace 62d63a5a8e78952c ]---

(In reply to comment #4)
I can't (so far) crash with today's d-r-t.

Could just be luck I suppose, but it only took 20 mins of openarena to get two yesterday and I've just gone 50 mins OK.

should be fixed with this commit:
http://git.kernel.org/?p=linux/kernel/git/airlied/drm-2.6.git;a=commitdiff;h=7a1ffce50373c177d3f6eecce52badc40c90e1dd

yes the crash appears gone thank you, however I am seeing a new issue after the pull.  every now and again there is screen flicker.  it is extremely fast, if you blink you will miss it.  one time i noticed momentary display of garbage.

(In reply to comment #7)
> yes the crash appears gone thank you, however I am seeing a new issue after the
> pull.  every now and again there is screen flicker.  it is extremely fast, if
> you blink you will miss it.  one time i noticed momentary display of garbage.

This happens when the reclocking misses the vblank period.  work is ongoing to avoid that.

It seems i have same issue (with d-r-t up to commit 7a1ffce50373c177d3f6eecce52badc40c90e1dd
Author: Dave Airlie <airlied@redhat.com>
Date:   Thu Apr 29 18:37:59 2010 +1000
    drm/radeon/kms: take vram mutex pointer before derefing object. )


May  1 03:47:11 (none) kernel: 41112 pages non-shared
May  1 03:47:11 (none) kernel: [ttm] unable to allocate page.
May  1 03:47:11 (none) kernel: radeon 0000:01:00.0: object_init failed for (847872, 0x00000002)
May  1 03:47:11 (none) kernel: [drm:radeon_gem_object_create] *ERROR* Failed to allocate GEM object (847872, 2, 4096, -12)
May  1 05:20:47 (none) kernel: BUG: unable to handle kernel paging request at 00001688
May  1 05:20:47 (none) kernel: IP: [<c1263de0>] mutex_unlock+0x8/0x1b
May  1 05:20:47 (none) kernel: *pde = 00000000
May  1 05:20:47 (none) kernel: Oops: 0002 [#1] SMP
May  1 05:20:47 (none) kernel: last sysfs file: /sys/devices/platform/w83627hf.656/in8_input
May  1 05:20:47 (none) kernel: Modules linked in: ramzswap(C) lzo_compress radeon ttm drm_kms_helper drm i2c_algo_bit cfbcopyarea cfbimgblt cfb
fillrect snd_seq_dummy snd_seq_oss snd_seq_midi_event snd_seq snd_pcm_oss snd_mixer_oss nfsd lockd nfs_acl auth_rpcgss sunrpc ipv6 tuner_simple
 tuner_types tda9887 usbmouse snd_wavefront usbhid tda8290 snd_cs4236 snd_wss_lib ppdev snd_opl3_lib snd_hwdep snd_via82xx snd_ac97_codec ac97_
bus snd_pcm snd_mpu401 snd_timer saa7134 rtc_cmos snd_page_alloc snd_mpu401_uart uhci_hcd snd_rawmidi rtc_core ir_common ehci_hcd parport_pc ns
558 shpchp videobuf_dma_sg rtc_lib snd_seq_device snd floppy soundcore parport videobuf_core gameport 8139too mii pci_hotplug ir_core usbcore t
veeprom via_agp ufs xfs exportfs agpgart tuner v4l2_common videodev v4l1_compat w83627hf hwmon_vid hwmon i2c_viapro i2c_dev i2c_core fbcon tile
blit font bitblit softcursor fb
May  1 05:20:47 (none) kernel:
May  1 05:20:47 (none) kernel: Pid: 6445, comm: X Tainted: G         C 2.6.34-rc5-i486 #34 MS-6380E/MS-6380E
May  1 05:20:47 (none) kernel: EIP: 0060:[<c1263de0>] EFLAGS: 00013206 CPU: 0
May  1 05:20:47 (none) kernel: EIP is at mutex_unlock+0x8/0x1b
May  1 05:20:47 (none) kernel: EAX: 00001678 EBX: cb238e10 ECX: c1807150 EDX: c31c3e00
May  1 05:20:47 (none) kernel: ESI: c84e3400 EDI: c84e3414 EBP: cb238df8 ESP: cb238df8
May  1 05:20:47 (none) kernel:  DS: 007b ES: 007b FS: 00d8 GS: 0033 SS: 0068
May  1 05:20:47 (none) kernel: Process X (pid: 6445, ti=cb238000 task=c6930000 task.ti=cb238000)
May  1 05:20:47 (none) kernel: Stack:
May  1 05:20:47 (none) kernel:  cb238e08 cd29a0c7 00000000 c881ec60 cb238e18 cd2a8b6e c31c3200 c881ec60
May  1 05:20:47 (none) kernel: <0> cb238e2c cd15a9c3 c881ec60 cd15a97c c9762924 cb238e3c c113a101 c881ec60
May  1 05:20:47 (none) kernel: <0> c881ec60 cb238e44 cd15ab04 cb238e50 cd15ab3b c9762900 cb238e68 cd15acf3
May  1 05:20:47 (none) kernel: Call Trace:
May  1 05:20:47 (none) kernel:  [<cd29a0c7>] ? radeon_bo_unref+0x44/0x54 [radeon]
May  1 05:20:47 (none) kernel:  [<cd2a8b6e>] ? radeon_gem_object_free+0x27/0x39 [radeon]
May  1 05:20:47 (none) kernel:  [<cd15a9c3>] ? drm_gem_object_free_unlocked+0x47/0x53 [drm]
May  1 05:20:47 (none) kernel:  [<cd15a97c>] ? drm_gem_object_free_unlocked+0x0/0x53 [drm]
May  1 05:20:47 (none) kernel:  [<c113a101>] ? kref_put+0x39/0x42
May  1 05:20:47 (none) kernel:  [<cd15ab04>] ? drm_gem_object_unreference_unlocked+0x16/0x18 [drm]
May  1 05:20:47 (none) kernel:  [<cd15ab3b>] ? drm_gem_object_handle_unreference_unlocked+0x23/0x26 [drm]
May  1 05:20:47 (none) kernel:  [<cd15acf3>] ? drm_gem_close_ioctl+0x62/0x6a [drm]
May  1 05:20:47 (none) kernel:  [<cd159b79>] ? drm_ioctl+0x22c/0x2fb [drm]
May  1 05:20:47 (none) kernel:  [<cd15ac91>] ? drm_gem_close_ioctl+0x0/0x6a [drm]
May  1 05:20:47 (none) kernel:  [<c104c6bb>] ? sched_clock_local+0x17/0x11f
May  1 05:20:47 (none) kernel:  [<c10c34cd>] ? vfs_ioctl+0x2c/0x94
May  1 05:20:47 (none) kernel:  [<cd15994d>] ? drm_ioctl+0x0/0x2fb [drm]
May  1 05:20:47 (none) kernel:  [<c10c3a2f>] ? do_vfs_ioctl+0x456/0x494
May  1 05:20:47 (none) kernel:  [<c102d4ad>] ? finish_task_switch+0x38/0x7f
May  1 05:20:47 (none) kernel:  [<c126394e>] ? schedule+0x564/0x5b8
May  1 05:20:47 (none) kernel:  [<c10c3aa0>] ? sys_ioctl+0x33/0x4d
May  1 05:20:47 (none) kernel:  [<c1264ea5>] ? syscall_call+0x7/0xb
May  1 05:20:47 (none) kernel: Code: 53 83 ec 04 0f 1f 44 00 00 89 c3 3e ff 08 79 05 e8 f3 01 00 00 89 e0 25 00 f0 ff ff 89 43 10 58 5b 5d c3 5
5 89 e5 0f 1f 44 00 00 <c7> 40 10 00 00 00 00 3e ff 00 7f 05 e8 02 00 00 00 5d c3 55 89
May  1 05:20:47 (none) kernel: EIP: [<c1263de0>] mutex_unlock+0x8/0x1b SS:ESP 0068:cb238df8
May  1 05:20:47 (none) kernel: CR2: 0000000000001688
May  1 05:20:47 (none) kernel: ---[ end trace 7081f22cd73eb330 ]---

Created attachment 35365 [details]
my /var/log/syslog

Has some unrelated/old oopses, but anything with 2.6.34-rc5 #34 should be  new enough ...

Created attachment 35386 [details]
my .config

May be this bug is config-dependent, i was unable to run into  any crash  with  attached .config (note various  debug options enabled). Currently i turn them off one after another ....

May be  we should edit bug description, if crash was not only with dynpm=1?
Or should i open new bug, because my issue has nothing in common with dynpm bugs (apart from being oops)?

Closing this bug as it seems original issue is now fixed. Andrew Randrianasulu please open a new bug with a stripped log for your oops and attach there your config and hw information, thanks.