Ok, this is more infos about what I reported earlier (it was DRM crash
on VT switch & suspend).

Actually, the problem happens when closing the DRM files, which I had
happening with VT switch & suspend because I was use DRIReInit patch.
Without this (now that DRM suspend is merged), I only see this problem
on server exit. Kernel is 2.6.0-test2 with some additional powermac
stuffs that shouldn't be related.

The oops log is:
Aug  4 17:10:49 gaston kernel: Oops: kernel access of bad area, sig: 11 [#1]
Aug  4 17:10:49 gaston kernel: NIP: F5075164 LR: F5072890 SP: EEB9FEB0 REGS: eeb9fe00 
TRAP: 0301    Not tainted
Aug  4 17:10:49 gaston kernel: MSR: 00009032 EE: 1 PR: 0 FP: 0 ME: 1 IR/DR: 11
Aug  4 17:10:49 gaston kernel: DAR: 6B6B6B6B, DSISR: 40000000
Aug  4 17:10:49 gaston kernel: TASK = eec8c7a0[2284] 'XFree86' Last syscall: 6
Aug  4 17:10:49 gaston kernel: GPR00: EEA68578 EEB9FEB0 EEC8C7A0 F5090000 B0080000 
E4B4CC50 B0000000 00000410
Aug  4 17:10:49 gaston kernel: GPR08: 00000000 6B6B6B6B 6B6B6B6B 6B6B6B6B EEA68578
Aug  4 17:10:49 gaston kernel: Call trace:
Aug  4 17:10:49 gaston kernel:  [f5072890] radeon_takedown+0x1e0/0x344 [radeon]
Aug  4 17:10:49 gaston kernel:  [c0078160] __fput+0x148/0x154
Aug  4 17:10:49 gaston kernel:  [c0078014] fput+0x3c/0x40
Aug  4 17:10:49 gaston kernel:  [c0076410] filp_close+0x60/0x9c
Aug  4 17:10:49 gaston kernel:  [c0007a5c] ret_from_syscall+0x0/0x44

It's actually dying in drm_ioremapfree() called by radeon_takedown(),
This is a uninorth based PowerMac, so it's using the vmap mecanism
(cant_use_aperture is 1).  It's accessing a freed object (apparently,
a pointer set to 6b6b6b6b, so a pointer retreived within a freed
object). This is obviously triggered by slab poisoning.

One strange thing though is that only maps of type _DRM_REGISTERS and
_DRM_FRAME_BUFFER are freed via this codepath. Also, the above address
shows, in the disassembly, that we did enter the "AGP" case of
drm_ioremapfree(), we didn't just do iounmap(). It seems the actual
crash location is within drm_lookup_map(). Like if a freed map was
still in there...

Anything more I can do to help track this down ?
 
-- 
Benjamin Herrenschmidt <[EMAIL PROTECTED]>


-------------------------------------------------------
This SF.Net email sponsored by: Free pre-built ASP.NET sites including
Data Reports, E-commerce, Portals, and Forums are available now.
Download today and enter to win an XBOX or Visual Studio .NET.
http://aspnet.click-url.com/go/psa00100003ave/direct;at.aspnet_072303_01/01
_______________________________________________
Dri-devel mailing list
[EMAIL PROTECTED]
https://lists.sourceforge.net/lists/listinfo/dri-devel

Reply via email to