Bug 2935

Summary: Matrox MGA driver causes Kernel Pagefault
Product: Mageia Reporter: Herbert Poetzl <herbert>
Component: RPM PackagesAssignee: Thomas Backlund <tmb>
Status: RESOLVED OLD QA Contact:
Severity: critical    
Priority: Normal CC: marja11, thierry.vignaud, tmb
Version: 1Keywords: NEEDINFO
Target Milestone: ---   
Hardware: i586   
OS: Linux   
Whiteboard:
Source RPM: kernel-2.6.38.8-5.mga1.src.rpm, x11-server-1.10.1-1.mga1.src.rpm CVE:
Status comment:

Description Herbert Poetzl 2011-10-04 21:03:34 CEST
Description of problem:
Trying to start Xorg on Matrox MGA G400/G450 (sometimes, race?) causes the kernel to panic when the driver is unloaded (Xorg exits) 

Version-Release number of selected component (if applicable):
x11-server-xorg-1.10.1-1.mga1
kernel-desktop-2.6.38.8-5.mga-1-1.mga1

How reproducible:
relatively good

Steps to Reproduce:
1. start Xorg with Xinerama configuration
2. wait for the (EE) MGA(1): Unable to map BAR 0.  Invalid argument (22)
3. on unload, the kernel sometimes crashes with:


[drm] Initialized drm 1.1.0 20060810
matrox_w1 0000:01:00.0: PCI INT A -> GSI 16 (level, low) -> IRQ 16
[drm] Supports vblank timestamp caching Rev 1 (10.10.2010).
[drm] No driver support for vblank timestamp query.
[drm] Initialized mga 3.2.1 20051102 for 0000:01:00.0 on minor 0
mtrr: base(0xf0000000) is not aligned on a size(0x1800000) boundary
agpgart-intel 0000:00:00.0: AGP 3.0 bridge
agpgart-intel 0000:00:00.0: bridge is in legacy mode, falling back to 2.x
agpgart-intel 0000:00:00.0: putting AGP V2 device into 1x mode
matrox_w1 0000:01:00.0: putting AGP V2 device into 1x mode
[drm] Initialized card for AGP DMA.
BUG: unable to handle kernel paging request at f4179e1c
IP: [<f416f87d>] mga_driver_irq_uninstall+0x1d/0x30 [mga]
*pde = 310c8067 *pte = 00000000 
Oops: 0002 [#1] SMP 
last sysfs file: /sys/devices/virtual/sound/timer/uevent
Modules linked in: mga drm sit tunnel4 ipt_IFWLOG xt_state ipt_LOG xt_time xt_connlimit xt_helper xt_realm xt_NFQUEUE xt_tcpmss xt_tcpudp ipt_addrtype xt_pkttype xt_set ip_set_hash_ip ip_set nfnetlink iptable_raw xt_TPROXY nf_tproxy_core ip6_tables nf_defrag_ipv6 xt_CLASSIFY xt_mark xt_hashlimit xt_comment ipt_REJECT xt_length xt_connmark xt_owner xt_recent xt_iprange xt_physdev xt_policy xt_multiport iptable_mangle iptable_nat nf_nat nf_conntrack_ipv4 nf_defrag_ipv4 xt_conntrack nf_conntrack iptable_filter ip_tables x_tables af_packet ipv6 binfmt_misc loop dm_mirror dm_region_hash dm_log dm_mod cpufreq_ondemand cpufreq_conservative cpufreq_powersave p4_clockmod freq_table speedstep_lib snd_intel8x0 snd_ac97_codec ac97_bus snd_seq_dummy snd_seq_oss snd_seq_midi_event snd_seq snd_seq_device snd_pcm_oss snd_pcm snd_timer snd_mixer_oss matrox_w1 wire cn usbhid ppdev e1000 snd sg skge parport_pc ns558 hid sr_mod floppy thermal gameport i2c_i801 shpchp processor parport evdev i2c_core rng_core soundcore fan iTCO_wdt pci_hotplug button snd_page_alloc iTCO_vendor_support ahci libahci ata_piix libata uas usb_storage uhci_hcd ohci_hcd ehci_hcd usbcore sd_mod scsi_mod crc_t10dif ext3 jbd [last unloaded: scsi_wait_scan]

Pid: 10959, comm: Xorg Not tainted 2.6.38.8-desktop-5.mga #1    /8I848P-G
EIP: 0060:[<f416f87d>] EFLAGS: 00213246 CPU: 0
EIP is at mga_driver_irq_uninstall+0x1d/0x30 [mga]
EAX: f0529c00 EBX: f0529c00 ECX: f4178000 EDX: 00000000
ESI: 00000001 EDI: f11f2c38 EBP: f0ae3dd8 ESP: f0ae3dd8
 DS: 007b ES: 007b FS: 00d8 GS: 00e0 SS: 0068
Process Xorg (pid: 10959, ti=f0ae2000 task=f0ad0c90 task.ti=f0ae2000)
Stack:
 f0ae3e10 f41af5b1 00000000 f41bf203 f41be440 f41bf207 00000010 00203202
 00000001 f0529d7c 00000001 00000001 f0529c00 00000001 f0ae3e50 f416b1f7
 00000001 f4170383 f4170040 f4170381 f0ae3e44 00203282 f41b115b 00203282
Call Trace:
 [<f41af5b1>] drm_irq_uninstall+0x151/0x1c0 [drm]
 [<f416b1f7>] mga_do_cleanup_dma+0x1b7/0x220 [mga]
 [<f41b115b>] ? drm_master_destroy+0x10b/0x130 [drm]
 [<f416cdd2>] mga_driver_lastclose+0x12/0x20 [mga]
 [<f41abff5>] drm_lastclose+0x45/0x2b0 [drm]
 [<f41ac812>] drm_release+0x402/0x5e0 [drm]
 [<f41ac9f0>] ? drm_fasync+0x0/0x90 [drm]
 [<c02171d5>] fput+0xb5/0x1e0
 [<c02140ae>] filp_close+0x4e/0x70
 [<c014e23f>] put_files_struct+0x6f/0xc0
 [<c014e331>] exit_files+0x41/0x50
 [<c014e745>] do_exit+0x135/0x740
 [<c014ef7e>] do_group_exit+0x3e/0xb0
 [<c014f008>] sys_exit_group+0x18/0x20
 [<c0103b1f>] sysenter_do_call+0x12/0x28
Code: 00 30 c0 5b 5d c3 90 8d b4 26 00 00 00 00 55 89 e5 3e 8d 74 26 00 8b 90 24 02 00 00 85 d2 74 1b 8b 92 e0 00 00 00 8b 4a 10 31 d2 <89> 91 1c 1e 00 00 c7 80 30 01 00 00 00 00 00 00 5d c3 00 55 89 
EIP: [<f416f87d>] mga_driver_irq_uninstall+0x1d/0x30 [mga] SS:ESP 0068:f0ae3dd8
CR2: 00000000f4179e1c
---[ end trace 5179deb9d86197aa ]---
Comment 1 Manuel Hiebel 2011-10-29 16:08:04 CEST
I don't know how to determinate for when it is :)

Can you try that: https://bugs.mageia.org/show_bug.cgi?id=3183#c3 ?

CC: (none) => thierry.vignaud, tmb

Comment 2 Herbert Poetzl 2011-11-03 23:12:56 CET
hmm, what exactly?

a) recompiling the 'sisimedia' driver?
  I can do that, but as that driver is not involed, I don't think it will help

b) run "sh ./Xgdb2.sh"
  I can do that as well, but it won't help when the kernel panics.

c) something I missed
  please clarify
Comment 3 Marja Van Waes 2011-12-29 14:04:47 CET
(In reply to comment #1)
> I don't know how to determinate for when it is :)
> 
> Can you try that: https://bugs.mageia.org/show_bug.cgi?id=3183#c3 ?

(In reply to comment #2)
> hmm, what exactly?
> 
> a) recompiling the 'sisimedia' driver?
>   I can do that, but as that driver is not involed, I don't think it will help
> 
> b) run "sh ./Xgdb2.sh"
>   I can do that as well, but it won't help when the kernel panics.
> 
> c) something I missed
>   please clarify

He referred to comment 3 of bug 3183, so this is about getting a backtrace, just use the x11-driver-video-mga-debug instead of x11-driver-video-sisimedia-debug. And please add the debug package for the kernel you use, too.

Feel free to add more debug packages if you think they are useful. You probably know better what to choose than I do. And for the rest, don't forget to install gdb, do as Thierry described and make your system crash.

If this bug is still valid, and the version numbers of involved packages changed since you filed it, please change the version numbers to the correct ones.

Keywords: (none) => NEEDINFO
CC: (none) => marja11
Source RPM: kernel-2.6.38.8-5.mga1.src.rpm => kernel-2.6.38.8-5.mga1.src.rpm, x11-server-1.10.1-1.mga1.src.rpm

Comment 4 Marja Van Waes 2011-12-29 14:08:41 CET
and of course, a kernel panic will make it impossible to get anything, I agree with that, but what other options are there... what is the use of having a kernel debug package, if you can't ever use it?
Comment 5 Herbert Poetzl 2011-12-29 15:26:16 CET
there is a kernel debug package?
I'm curious what it contains, but I couldn't find one with:
urpmf --filename kernel | grep debug

regarding the test script/gdb, I guess I can do that, as the kernel trace is not critical (i.e. not a panic)
(will do as soon as I get around)
Comment 6 Marja Van Waes 2011-12-29 16:03:55 CET
(In reply to comment #5)
> there is a kernel debug package?

For the kernel I currently have in "1", there is:
kernel-desktop-2.6.38.8-6.mga-debug
Comment 7 Marja Van Waes 2011-12-29 17:06:24 CET

> I'm curious what it contains, but I couldn't find one with:
> urpmf --filename kernel | grep debug
> 
For me, that command works.

Did you add the debug repositories?
Thierry Vignaud 2011-12-29 19:42:47 CET

Assignee: bugsquad => tmb

Comment 8 Marja Van Waes 2012-01-27 08:21:20 CET
(In reply to comment #5)
> there is a kernel debug package?
> I'm curious what it contains, but I couldn't find one with:
> urpmf --filename kernel | grep debug
> 
> regarding the test script/gdb, I guess I can do that, as the kernel trace is
> not critical (i.e. not a panic)
> (will do as soon as I get around)

@ Herbert

Did you get around to doing it?
Comment 9 Herbert Poetzl 2012-01-28 04:02:27 CET
not yet, I forgot to do that last time I was near that machine :(
next chance will be in roughly two weeks AFAICT
Comment 10 Thierry Vignaud 2012-01-28 09:15:21 CET
Could you also check Mageia 2 alpha3 in order to see if it works better with a newer kernel?
Comment 11 Marja Van Waes 2012-02-15 18:40:46 CET
(In reply to comment #9)

> next chance will be in roughly two weeks AFAICT

Did you have that chance? (for gdb trace and check Mga2a3?)
Comment 12 Herbert Poetzl 2012-02-15 21:11:37 CET
unfortunately no, otherwise I would have come back to you with the requested data.
Comment 13 Marja Van Waes 2012-03-03 07:16:44 CET
(In reply to comment #11)
> (In reply to comment #9)
> 
> > next chance will be in roughly two weeks AFAICT
> 
> Did you have that chance? (for gdb trace and check Mga2a3?)

(In reply to comment #12)
> unfortunately no, otherwise I would have come back to you with the requested
> data.

make that Mga2b1

closing as old for now, please reopen when you have the requested information
Comment 14 Marja Van Waes 2012-03-03 07:17:24 CET
again:
closing as old for now, please reopen when you have the requested information

Status: NEW => RESOLVED
Resolution: (none) => OLD