[Bug 2935] [New] Matrox MGA driver causes Kernel Pagefault

[Herbert Poetzl]

https://bugs.mageia.org/show_bug.cgi?id=2935

Summary: Matrox MGA driver causes Kernel Pagefault
Product: Mageia
Version: 1
Platform: i586
OS/Version: Linux
Status: NEW
Severity: critical
Priority: Normal
Component: RPM Packages
AssignedTo: bugsquad-odJJhXpcy38dnm+***@public.gmane.org
ReportedBy: herbert-dBHVzrDq9nF4Lj/***@public.gmane.org
RPM Package: kernel-2.6.38.8-5.mga1.src.rpm


Description of problem:
Trying to start Xorg on Matrox MGA G400/G450 (sometimes, race?) causes the
kernel to panic when the driver is unloaded (Xorg exits)

Version-Release number of selected component (if applicable):
x11-server-xorg-1.10.1-1.mga1
kernel-desktop-2.6.38.8-5.mga-1-1.mga1

How reproducible:
relatively good

Steps to Reproduce:
1. start Xorg with Xinerama configuration
2. wait for the (EE) MGA(1): Unable to map BAR 0. Invalid argument (22)
3. on unload, the kernel sometimes crashes with:


[drm] Initialized drm 1.1.0 20060810
matrox_w1 0000:01:00.0: PCI INT A -> GSI 16 (level, low) -> IRQ 16
[drm] Supports vblank timestamp caching Rev 1 (10.10.2010).
[drm] No driver support for vblank timestamp query.
[drm] Initialized mga 3.2.1 20051102 for 0000:01:00.0 on minor 0
mtrr: base(0xf0000000) is not aligned on a size(0x1800000) boundary
agpgart-intel 0000:00:00.0: AGP 3.0 bridge
agpgart-intel 0000:00:00.0: bridge is in legacy mode, falling back to 2.x
agpgart-intel 0000:00:00.0: putting AGP V2 device into 1x mode
matrox_w1 0000:01:00.0: putting AGP V2 device into 1x mode
[drm] Initialized card for AGP DMA.
BUG: unable to handle kernel paging request at f4179e1c
IP: [<f416f87d>] mga_driver_irq_uninstall+0x1d/0x30 [mga]
*pde = 310c8067 *pte = 00000000
Oops: 0002 [#1] SMP
last sysfs file: /sys/devices/virtual/sound/timer/uevent
Modules linked in: mga drm sit tunnel4 ipt_IFWLOG xt_state ipt_LOG xt_time
xt_connlimit xt_helper xt_realm xt_NFQUEUE xt_tcpmss xt_tcpudp ipt_addrtype
xt_pkttype xt_set ip_set_hash_ip ip_set nfnetlink iptable_raw xt_TPROXY
nf_tproxy_core ip6_tables nf_defrag_ipv6 xt_CLASSIFY xt_mark xt_hashlimit
xt_comment ipt_REJECT xt_length xt_connmark xt_owner xt_recent xt_iprange
xt_physdev xt_policy xt_multiport iptable_mangle iptable_nat nf_nat
nf_conntrack_ipv4 nf_defrag_ipv4 xt_conntrack nf_conntrack iptable_filter
ip_tables x_tables af_packet ipv6 binfmt_misc loop dm_mirror dm_region_hash
dm_log dm_mod cpufreq_ondemand cpufreq_conservative cpufreq_powersave
p4_clockmod freq_table speedstep_lib snd_intel8x0 snd_ac97_codec ac97_bus
snd_seq_dummy snd_seq_oss snd_seq_midi_event snd_seq snd_seq_device snd_pcm_oss
snd_pcm snd_timer snd_mixer_oss matrox_w1 wire cn usbhid ppdev e1000 snd sg
skge parport_pc ns558 hid sr_mod floppy thermal gameport i2c_i801 shpchp
processor parport evdev i2c_core rng_core soundcore fan iTCO_wdt pci_hotplug
button snd_page_alloc iTCO_vendor_support ahci libahci ata_piix libata uas
usb_storage uhci_hcd ohci_hcd ehci_hcd usbcore sd_mod scsi_mod crc_t10dif ext3
jbd [last unloaded: scsi_wait_scan]

Pid: 10959, comm: Xorg Not tainted 2.6.38.8-desktop-5.mga #1 /8I848P-G
EIP: 0060:[<f416f87d>] EFLAGS: 00213246 CPU: 0
EIP is at mga_driver_irq_uninstall+0x1d/0x30 [mga]
EAX: f0529c00 EBX: f0529c00 ECX: f4178000 EDX: 00000000
ESI: 00000001 EDI: f11f2c38 EBP: f0ae3dd8 ESP: f0ae3dd8
DS: 007b ES: 007b FS: 00d8 GS: 00e0 SS: 0068
Process Xorg (pid: 10959, ti=f0ae2000 task=f0ad0c90 task.ti=f0ae2000)
Stack:
f0ae3e10 f41af5b1 00000000 f41bf203 f41be440 f41bf207 00000010 00203202
00000001 f0529d7c 00000001 00000001 f0529c00 00000001 f0ae3e50 f416b1f7
00000001 f4170383 f4170040 f4170381 f0ae3e44 00203282 f41b115b 00203282
Call Trace:
[<f41af5b1>] drm_irq_uninstall+0x151/0x1c0 [drm]
[<f416b1f7>] mga_do_cleanup_dma+0x1b7/0x220 [mga]
[<f41b115b>] ? drm_master_destroy+0x10b/0x130 [drm]
[<f416cdd2>] mga_driver_lastclose+0x12/0x20 [mga]
[<f41abff5>] drm_lastclose+0x45/0x2b0 [drm]
[<f41ac812>] drm_release+0x402/0x5e0 [drm]
[<f41ac9f0>] ? drm_fasync+0x0/0x90 [drm]
[<c02171d5>] fput+0xb5/0x1e0
[<c02140ae>] filp_close+0x4e/0x70
[<c014e23f>] put_files_struct+0x6f/0xc0
[<c014e331>] exit_files+0x41/0x50
[<c014e745>] do_exit+0x135/0x740
[<c014ef7e>] do_group_exit+0x3e/0xb0
[<c014f008>] sys_exit_group+0x18/0x20
[<c0103b1f>] sysenter_do_call+0x12/0x28
Code: 00 30 c0 5b 5d c3 90 8d b4 26 00 00 00 00 55 89 e5 3e 8d 74 26 00 8b 90
24 02 00 00 85 d2 74 1b 8b 92 e0 00 00 00 8b 4a 10 31 d2 <89> 91 1c 1e 00 00 c7
80 30 01 00 00 00 00 00 00 5d c3 00 55 89
EIP: [<f416f87d>] mga_driver_irq_uninstall+0x1d/0x30 [mga] SS:ESP 0068:f0ae3dd8
CR2: 00000000f4179e1c
---[ end trace 5179deb9d86197aa ]---

[Manuel Hiebel]

https://bugs.mageia.org/show_bug.cgi?id=2935

Manuel Hiebel <manuel-XA19kHydqdCHXe+***@public.gmane.org> changed:

What |Removed |Added
----------------------------------------------------------------------------
CC| |thierry.vignaud-***@public.gmane.org,
| |tmb-***@public.gmane.org

--- Comment #1 from Manuel Hiebel <manuel-XA19kHydqdCHXe+***@public.gmane.org> 2011-10-29 18:08:04 CEST ---
I don't know how to determinate for when it is :)

Can you try that: https://bugs.mageia.org/show_bug.cgi?id=3183#c3 ?

[Herbert Poetzl]

https://bugs.mageia.org/show_bug.cgi?id=2935

--- Comment #2 from Herbert Poetzl <herbert-dBHVzrDq9nF4Lj/***@public.gmane.org> 2011-11-04 00:12:56 CET ---
hmm, what exactly?

a) recompiling the 'sisimedia' driver?
I can do that, but as that driver is not involed, I don't think it will help

b) run "sh ./Xgdb2.sh"
I can do that as well, but it won't help when the kernel panics.

c) something I missed
please clarify

[Marja van Waes]

https://bugs.mageia.org/show_bug.cgi?id=2935

Marja van Waes <marja11-qWit8jRvyhVmR6Xm/***@public.gmane.org> changed:

What |Removed |Added
----------------------------------------------------------------------------
Keywords| |NEEDINFO
CC| |marja11-qWit8jRvyhVmR6Xm/***@public.gmane.org
RPM Package|kernel-2.6.38.8-5.mga1.src. |kernel-2.6.38.8-5.mga1.src.
|rpm |rpm,
| |x11-server-1.10.1-1.mga1.sr
| |c.rpm

--- Comment #3 from Marja van Waes <marja11-qWit8jRvyhVmR6Xm/***@public.gmane.org> 2011-12-29 14:04:47 CET ---
(In reply to comment #1)

Post by Manuel Hiebel
I don't know how to determinate for when it is :)
Can you try that: https://bugs.mageia.org/show_bug.cgi?id=3183#c3 ?

(In reply to comment #2)

Post by Manuel Hiebel
hmm, what exactly?
a) recompiling the 'sisimedia' driver?
I can do that, but as that driver is not involed, I don't think it will help
b) run "sh ./Xgdb2.sh"
I can do that as well, but it won't help when the kernel panics.
c) something I missed
please clarify

He referred to comment 3 of bug 3183, so this is about getting a backtrace,
just use the x11-driver-video-mga-debug instead of
x11-driver-video-sisimedia-debug. And please add the debug package for the
kernel you use, too.

Feel free to add more debug packages if you think they are useful. You probably
know better what to choose than I do. And for the rest, don't forget to install
gdb, do as Thierry described and make your system crash.

If this bug is still valid, and the version numbers of involved packages
changed since you filed it, please change the version numbers to the correct
ones.

[Marja van Waes]

https://bugs.mageia.org/show_bug.cgi?id=2935

--- Comment #4 from Marja van Waes <marja11-qWit8jRvyhVmR6Xm/***@public.gmane.org> 2011-12-29 14:08:41 CET ---
and of course, a kernel panic will make it impossible to get anything, I agree
with that, but what other options are there... what is the use of having a
kernel debug package, if you can't ever use it?

[Herbert Poetzl]

https://bugs.mageia.org/show_bug.cgi?id=2935

--- Comment #5 from Herbert Poetzl <herbert-dBHVzrDq9nF4Lj/***@public.gmane.org> 2011-12-29 15:26:16 CET ---
there is a kernel debug package?
I'm curious what it contains, but I couldn't find one with:
urpmf --filename kernel | grep debug

regarding the test script/gdb, I guess I can do that, as the kernel trace is
not critical (i.e. not a panic)
(will do as soon as I get around)

[Marja van Waes]

https://bugs.mageia.org/show_bug.cgi?id=2935

--- Comment #6 from Marja van Waes <marja11-qWit8jRvyhVmR6Xm/***@public.gmane.org> 2011-12-29 16:03:55 CET ---
(In reply to comment #5)

Post by Herbert Poetzl
there is a kernel debug package?

For the kernel I currently have in "1", there is:
kernel-desktop-2.6.38.8-6.mga-debug

[Marja van Waes]

https://bugs.mageia.org/show_bug.cgi?id=2935

Post by Herbert Poetzl
urpmf --filename kernel | grep debug

For me, that command works.

Did you add the debug repositories?

[Thierry Vignaud]

https://bugs.mageia.org/show_bug.cgi?id=2935

Thierry Vignaud <thierry.vignaud-***@public.gmane.org> changed:

What |Removed |Added
----------------------------------------------------------------------------
AssignedTo|bugsquad-odJJhXpcy38dnm+***@public.gmane.org |tmb-***@public.gmane.org

[Marja van Waes]

https://bugs.mageia.org/show_bug.cgi?id=2935

--- Comment #8 from Marja van Waes <marja11-qWit8jRvyhVmR6Xm/***@public.gmane.org> 2012-01-27 09:21:20 CET ---
(In reply to comment #5)

Post by Herbert Poetzl
there is a kernel debug package?
urpmf --filename kernel | grep debug
regarding the test script/gdb, I guess I can do that, as the kernel trace is
not critical (i.e. not a panic)
(will do as soon as I get around)

@ Herbert

Did you get around to doing it?

[Herbert Poetzl]

https://bugs.mageia.org/show_bug.cgi?id=2935

--- Comment #9 from Herbert Poetzl <herbert-dBHVzrDq9nF4Lj/***@public.gmane.org> 2012-01-28 04:02:27 CET ---
not yet, I forgot to do that last time I was near that machine :(
next chance will be in roughly two weeks AFAICT

[Thierry Vignaud]

https://bugs.mageia.org/show_bug.cgi?id=2935

--- Comment #10 from Thierry Vignaud <thierry.vignaud-***@public.gmane.org> 2012-01-28 09:15:21 CET ---
Could you also check Mageia 2 alpha3 in order to see if it works better with a
newer kernel?