[One (M7) Original Android Development] dyndragon:
Disclaimer: I am not a kernel wizard. I just have some hardware design, assembly and C++/Java coding background, and exercise my Google-fu liberally. If [MENTION=3332811]faux123[/MENTION] or someone else that knows better says I am wrong, just say so and I'll shut up. Just trying to help.

Ok, here goes. I think something is wrong with either the GPU adreno area or the ioctl area of the kernel, or perhaps the fsync routines of the kernel.

Reading up on kernel stuff--

BUG: scheduling while atomic

This means that while doing an atomic operation (ex. something that should not be interrupted, like a write to emmc, flushing to disk, etc), some process or routine either in userspace or kernel driver changed the state from atomic (again, should not be interrupted) to scheduled (allows interruptions for higher priority tasks).

My theory is that this has something to do with memory writes. In my first log, the backtrace looks like:

[28774.477075] c0 369 BUG: scheduling while atomic: SurfaceFlinger/369/0x00000004
[28774.477075] c0 369 Modules linked in: bcmdhd dm_crypt
[28774.477136] c0 369 [<c0013d24>] (unwind_backtrace+0x0/0x11c) from [<c07eee38>] (__schedule+0x7c/0x5d8)
[28774.477166] c0 369 [<c07eee38>] (__schedule+0x7c/0x5d8) from [<c07edb00>] (schedule_timeout+0x2b0/0x2ec)
[28774.477197] c0 369 [<c07edb00>] (schedule_timeout+0x2b0/0x2ec) from [<c03a6638>] (adreno_waittimestamp+0x370/0x488)
[28774.477227] c0 369 [<c03a6638>] (adreno_waittimestamp+0x370/0x488) from [<c0384f9c>] (_device_waittimestamp+0x108/0x1fc)
[28774.477227] c0 369 [<c0384f9c>] (_device_waittimestamp+0x108/0x1fc) from [<c03864b8>] (kgsl_ioctl_device_waittimestamp_ctxtid+0x88/0xe4)
[28774.477258] c0 369 [<c03864b8>] (kgsl_ioctl_device_waittimestamp_ctxtid+0x88/0xe4) from [<c0386fac>] (kgsl_ioctl+0x200/0x2fc)
[28774.477288] c0 369 [<c0386fac>] (kgsl_ioctl+0x200/0x2fc) from [<c015273c>] (do_vfs_ioctl+0x4d8/0x54c)
[28774.477319] c0 369 [<c015273c>] (do_vfs_ioctl+0x4d8/0x54c) from [<c01527e4>] (sys_ioctl+0x34/0x54)
[28774.477319] c0 369 [<c01527e4>] (sys_ioctl+0x34/0x54) from [<c000e480>] (ret_fast_syscall+0x0/0x30)

The routine that called schedule originated at ioctl, which was writing to something adreno.

In the instance that chrome crashed from [MENTION=4376475]FangorX[/MENTION]:

[52507.305113] c0 9556 BUG: scheduling while atomic: android.browser/9556/0x40000002
[52507.305113] c0 9556 Modules linked in: cpufreq_limit bcmdhd dm_crypt
[52507.305174] c0 9556 [<c0013d24>] (unwind_backtrace+0x0/0x11c) from [<c07eee38>] (__schedule+0x7c/0x5d8)
[52507.305174] c0 9556 [<c07eee38>] (__schedule+0x7c/0x5d8) from [<c00b8730>] (__cond_resched+0x24/0x34)
[52507.305204] c0 9556 [<c00b8730>] (__cond_resched+0x24/0x34) from [<c07ef420>] (_cond_resched+0x34/0x44)
[52507.305235] c0 9556 [<c07ef420>] (_cond_resched+0x34/0x44) from [<c011b3fc>] (shrink_page_list+0x60/0x890)
[52507.305235] c0 9556 [<c011b3fc>] (shrink_page_list+0x60/0x890) from [<c011bffc>] (shrink_inactive_list+0x1f8/0x494)
[52507.305265] c0 9556 [<c011bffc>] (shrink_inactive_list+0x1f8/0x494) from [<c011c5ec>] (shrink_mem_cgroup_zone+0x354/0x4c4)
[52507.305265] c0 9556 [<c011c5ec>] (shrink_mem_cgroup_zone+0x354/0x4c4) from [<c011d48c>] (try_to_free_pages+0x29c/0x56c)
[52507.305296] c0 9556 [<c011d48c>] (try_to_free_pages+0x29c/0x56c) from [<c0112390>] (__alloc_pages_nodemask+0x424/0x758)
[52507.305296] c0 9556 [<c0112390>] (__alloc_pages_nodemask+0x424/0x758) from [<c038d038>] (_kgsl_sharedmem_page_alloc+0x180/0x3f8)
[52507.305326] c0 9556 [<c038d038>] (_kgsl_sharedmem_page_alloc+0x180/0x3f8) from [<c038d2e4>] (kgsl_sharedmem_page_alloc_user+0x34/0x70)
[52507.305357] c0 9556 [<c038d2e4>] (kgsl_sharedmem_page_alloc_user+0x34/0x70) from [<c03871e4>] (kgsl_ioctl_gpumem_alloc+0x114/0x248)
[52507.305357] c0 9556 [<c03871e4>] (kgsl_ioctl_gpumem_alloc+0x114/0x248) from [<c0386fac>] (kgsl_ioctl+0x200/0x2fc)
[52507.305387] c0 9556 [<c0386fac>] (kgsl_ioctl+0x200/0x2fc) from [<c015273c>] (do_vfs_ioctl+0x4d8/0x54c)
[52507.305387] c0 9556 [<c015273c>] (do_vfs_ioctl+0x4d8/0x54c) from [<c01527e4>] (sys_ioctl+0x34/0x54)
[52507.305418] c0 9556 [<c01527e4>] (sys_ioctl+0x34/0x54) from [<c000e480>] (ret_fast_syscall+0x0/0x30)

It was some memory paging or memory manipulation that came from ioctl that originated the schedule call.

In my chrome crash (harder to read, not as clean, have to trace more):

[ 3024.104522] c0 21584 BUG: scheduling while atomic: .android.chrome/21584/0x00000002
[ 3024.104522] c0 21584 Modules linked in: bcmdhd dm_crypt
[ 3024.104553] c0 21584 [<c0013d24>] (unwind_backtrace+0x0/0x11c) from [<c07eee38>] (__schedule+0x7c/0x5d8)
[ 3024.104553] c0 21584 [<c07eee38>] (__schedule+0x7c/0x5d8) from [<c000e4e0>] (ret_slow_syscall+0x0/0x4)
[ 3024.105041] c0 21584 Unable to handle kernel paging request at virtual address 79f2f528
[ 3024.105041] c0 21584 pgd = cae7c000
[ 3024.105041] c0 21584 [79f2f528] *pgd=849aa831, *pte=00000000, *ppte=00000000
[ 3024.105071] c0 21584 DFSR=00000817, TTBCR=00000000, TTBR0=8b87c06a, TTBR1=8060406a
[ 3024.105071] c0 21584 MAIR0=ff0881a8, MAIR1=40e040e0, SCTLR=10c5787d
[ 3024.105102] c0 21584 Internal error: Oops: 817 [#1] PREEMPT SMP ARM
[ 3024.105102] c0 21584 Modules linked in: bcmdhd dm_crypt
[ 3024.105132] c0 21584 CPU: 0 Tainted: G W (3.4.10-faux123-JB4.2.2-GE #151)
[ 3024.105132] c0 21584 PC is at 0x6bef7cd2
[ 3024.105132] c0 21584 LR is at 0x6bef7c5d
[ 3024.105163] c0 21584 pc : [<6bef7cd2>] lr : [<6bef7c5d>] psr: 00000030
[ 3024.105163] c0 21584 sp : 72136be8 ip : 72136c18 fp : 00000016
[ 3024.105163] c0 21584 r10: 70404b70 r9 : 00100000 r8 : 00000000
[ 3024.105163] c0 21584 r7 : 7712af90 r6 : 72136c0c r5 : 72136c18 r4 : 79d3f000
[ 3024.105193] c0 21584 r3 : 79f2f528 r2 : 001f0528 r1 : 72136c18 r0 : 00000001
[ 3024.105193] c0 21584 Flags: nzcv IRQs on FIQs on Mode USER_32 ISA Thumb Segment user
[ 3024.105193] c0 21584 Control: 10c5787d Table: 8b87c06a DAC: 00000015
[ 3024.105224] c0 21584 Process .android.chrome (pid: 21584, stack limit = 0xd7ed42f8)
[ 3024.105224] c0 21584 ---[ end trace f15b2444f409ff3d ]---
[ 3024.105254] c0 21584 Kernel panic - not syncing: .android.chrome PC:0x6bef7cd2 LR:0x6bef7c5d
[ 3024.105254] c1 21548 CPU1: stopping
[ 3024.105285] c1 21548 [<c0013d24>] (unwind_backtrace+0x0/0x11c) from [<c001305c>] (handle_IPI+0x100/0x1d8)
[ 3024.105285] c1 21548 [<c001305c>] (handle_IPI+0x100/0x1d8) from [<c00086b8>] (gic_handle_irq+0x17c/0x190)
[ 3024.105315] c1 21548 [<c00086b8>] (gic_handle_irq+0x17c/0x190) from [<c000e080>] (__irq_svc+0x40/0x70)
[ 3024.105315] c1 21548 Exception stack(0xcad23d98 to 0xcad23de0)
[ 3024.105315] c1 21548 3d80: c0d24ec0 00000000
[ 3024.105346] c1 21548 3da0: 3bd13bd1 00010000 60000113 60000113 c1e41160 c1e41160 00000000 00000029
[ 3024.105346] c1 21548 3dc0: cae7de88 ddacafc0 0000e13d cad23de0 c0128648 c07f0a2c 60000113 ffffffff
[ 3024.105346] c1 21548 [<c000e080>] (__irq_svc+0x40/0x70) from [<c07f0a2c>] (_raw_spin_unlock_irqrestore+0x78/0xb0)
[ 3024.105377] c1 21548 [<c07f0a2c>] (_raw_spin_unlock_irqrestore+0x78/0xb0) from [<c0128648>] (kmap_high_get+0x5c/0x6c)
[ 3024.105407] c1 21548 [<c0128648>] (kmap_high_get+0x5c/0x6c) from [<c001a37c>] (kmap_atomic+0x48/0x14c)
[ 3024.105407] c1 21548 [<c001a37c>] (kmap_atomic+0x48/0x14c) from [<c001a978>] (v6_clear_user_highpage_nonaliasing+0x8/0x20)
[ 3024.105438] c1 21548 [<c001a978>] (v6_clear_user_highpage_nonaliasing+0x8/0x20) from [<c012c0b4>] (handle_pte_fault+0x190/0x79c)
[ 3024.105438] c1 21548 [<c012c0b4>] (handle_pte_fault+0x190/0x79c) from [<c012c7cc>] (handle_mm_fault+0x10c/0x128)
[ 3024.105468] c1 21548 [<c012c7cc>] (handle_mm_fault+0x10c/0x128) from [<c0017ad4>] (do_page_fault+0xfc/0x320)
[ 3024.105468] c1 21548 [<c0017ad4>] (do_page_fault+0xfc/0x320) from [<c0008430>] (do_DataAbort+0x134/0x1a8)
[ 3024.105499] c1 21548 [<c0008430>] (do_DataAbort+0x134/0x1a8) from [<c000e1f4>] (__dabt_usr+0x34/0x40)
[ 3024.105499] c1 21548 Exception stack(0xcad23fb0 to 0xcad23ff8)
[ 3024.105499] c1 21548 3fa0: 77f30001 7a2db000 0002ce23 00030e1c
[ 3024.105499] c1 21548 3fc0: 766457c0 7665e720 00061c39 0000071b 7a2d7008 6c799e6f 6dcc57e0 00000016
[ 3024.105529] c1 21548 3fe0: 00000072 6f97eab8 4031c4a3 6c94b314 20000030 ffffffff
[ 3024.105529] c3 21538 CPU3: stopping
[ 3024.105560] c3 21538 [<c0013d24>] (unwind_backtrace+0x0/0x11c) from [<c001305c>] (handle_IPI+0x100/0x1d8)
[ 3024.105560] c3 21538 [<c001305c>] (handle_IPI+0x100/0x1d8) from [<c00086b8>] (gic_handle_irq+0x17c/0x190)
[ 3024.105560] c3 21538 [<c00086b8>] (gic_handle_irq+0x17c/0x190) from [<c000e23c>] (__irq_usr+0x3c/0x60)
[ 3024.105590] c3 21538 Exception stack(0xca427fb0 to 0xca427ff8)
[ 3024.105590] c3 21538 7fa0: 6fea3310 68316e00 6cc94780 6cc95054
[ 3024.105590] c3 21538 7fc0: 705a4320 67a45570 6fea2fb8 6ac36e08 67a45570 6cc6aabc 6b9d9cad 6dbbfa5d
[ 3024.105621] c3 21538 7fe0: 6ac36eec 6ac36dd8 6b3e5673 6b3e566c 80000030 ffffffff
[ 3025.787475] c0 21584 SMP: failed to stop secondary CPUs
[ 3025.787505] c0 21584 ------------[ cut here ]------------
[ 3025.787505] c0 21584 WARNING: at kernel/softirq.c:108 local_bh_enable_ip+0x4c/0xc8()
[ 3025.787536] c0 21584 Modules linked in: bcmdhd dm_crypt
[ 3025.787566] c0 21584 [<c0013d24>] (unwind_backtrace+0x0/0x11c) from [<c009061c>] (warn_slowpath_common+0x4c/0x64)
[ 3025.787566] c0 21584 [<c009061c>] (warn_slowpath_common+0x4c/0x64) from [<c009064c>] (warn_slowpath_null+0x18/0x1c)
[ 3025.787597] c0 21584 [<c009064c>] (warn_slowpath_null+0x18/0x1c) from [<c0096bf8>] (local_bh_enable_ip+0x4c/0xc8)
[ 3025.787597] c0 21584 [<c0096bf8>] (local_bh_enable_ip+0x4c/0xc8) from [<c01667d8>] (wakeup_flusher_threads+0x5c/0x84)
[ 3025.787627] c0 21584 [<c01667d8>] (wakeup_flusher_threads+0x5c/0x84) from [<c02740bc>] (dyn_fsync_force_flush+0x10/0x24)
[ 3025.787658] c0 21584 [<c02740bc>] (dyn_fsync_force_flush+0x10/0x24) from [<c02740e4>] (dyn_fsync_panic_event+0x14/0x20)
[ 3025.787658] c0 21584 [<c02740e4>] (dyn_fsync_panic_event+0x14/0x20) from [<c00b2568>] (notifier_call_chain+0x38/0x68)
[ 3025.787689] c0 21584 [<c00b2568>] (notifier_call_chain+0x38/0x68) from [<c00b272c>] (__atomic_notifier_call_chain+0x34/0x44)
[ 3025.787689] c0 21584 [<c00b272c>] (__atomic_notifier_call_chain+0x34/0x44) from [<c00b2750>] (atomic_notifier_call_chain+0x14/0x18)
[ 3025.787719] c0 21584 [<c00b2750>] (atomic_notifier_call_chain+0x14/0x18) from [<c07e3058>] (panic+0xa4/0x1cc)
[ 3025.787750] c0 21584 [<c07e3058>] (panic+0xa4/0x1cc) from [<c0011e58>] (die+0x15c/0x1c0)
[ 3025.787750] c0 21584 [<c0011e58>] (die+0x15c/0x1c0) from [<c00179b4>] (__do_kernel_fault+0xa4/0xc8)
[ 3025.787780] c0 21584 [<c00179b4>] (__do_kernel_fault+0xa4/0xc8) from [<c0017cdc>] (do_page_fault+0x304/0x320)
[ 3025.787780] c0 21584 [<c0017cdc>] (do_page_fault+0x304/0x320) from [<c0008430>] (do_DataAbort+0x134/0x1a8)
[ 3025.787780] c0 21584 [<c0008430>] (do_DataAbort+0x134/0x1a8) from [<c000e1f4>] (__dabt_usr+0x34/0x40)

It looks like the call came through copypage, which does stuff with cache and paging operations.

From what I can tell it does not appear to be linked to CPU governor, mpdecision or intelliplug, thermal daemon controls, etc.

Based on all this, those who are seeing the same types of crashes, please list out your IOSCHED, Z-CONTROL, and MISC>Dynamic file sync settings. I wonder if there's something in there that is causing us problems, but others have different settings and as such, don't have problems.