Bug 13723

Created attachment 13190 [details]
Backtrace of the xserver crash

Created attachment 13191 [details]
xorg log file

It looks like this bug was fixed in commit 101abee6c4fc2c9284ff2ba6f9f9138327d6963d, I cannot reproduce this particular crash any more (I just found a different crash when running any GL application while compiz is running, I'll open another bug as soon as I manage to get a backtrace).

 I'm afraid this bug was not fixed after all : it looks like I overwrote my kernel drm modules from git with the stock ones and so mistakenly concluded that this bug was fixed...
 I'm still getting a server crash with the latest i915+drm kernel modules from git, invoving mipmaps in the logs (as usual, Alt-Tab with compiz is enough to reproduce if mipmaps are enabled):
Backtrace:
0: /usr/bin/X(xf86SigHandler+0x65) [0x4888b5]
1: /lib/libc.so.6 [0x2b585cb48100]
2: /usr/lib/dri/i915_dri.so [0x2b586f47c649]
3: /usr/lib/dri/i915_dri.so [0x2b586f47c7bc]
4: /usr/lib/dri/i915_dri.so(_mesa_generate_mipmap+0xbfb) [0x2b586f47d71b]
5: /usr/lib/dri/i915_dri.so(_mesa_GenerateMipmapEXT+0x107) [0x2b586f460b87]
6: /usr/lib/xorg/modules/extensions//libglx.so [0x2b585db6fa40]
7: /usr/lib/xorg/modules/extensions//libglx.so [0x2b585db736a0]
8: /usr/bin/X [0x5093c7]
9: /usr/bin/X(Dispatch+0x2fe) [0x44adee]
10: /usr/bin/X(main+0x45a) [0x43289a]
11: /lib/libc.so.6(__libc_start_main+0xf4) [0x2b585cb341c4]
12: /usr/bin/X(FontFileCompleteXLFD+0x269) [0x431cc9]

Using latest git from today (20080119), I still get an xserver crash with compiz unless I disable mipmaps in all compiz plugins.

The procedure to reproduce is still the same : run compiz, enable mipmaps in the application switcher plugin, press Alt-Tab.

Relevant information from Xorg.log :

(II) intel(0): Creating default Display subsection in Screen section
        "Default Screen" for depth/fbbpp 24/32
(**) intel(0): Depth 24, (--) framebuffer bpp 32
(==) intel(0): RGB weight 888
(==) intel(0): Default visual is TrueColor
(**) intel(0): Option "AccelMethod" "EXA"
(II) intel(0): Integrated Graphics Chipset: Intel(R) G33
(--) intel(0): Chipset: "G33"
(--) intel(0): Linear framebuffer at 0xE0000000
(--) intel(0): IO registers at addr 0xF2200000
(II) intel(0): 2 display pipes available.
(**) intel(0): Using EXA for acceleration

(II) [drm] DRM interface version 1.3
(II) [drm] DRM open master succeeded.
(II) intel(0): [drm] Using the DRM lock SAREA also for drawables.
(II) intel(0): [drm] framebuffer mapped by ddx driver
(II) intel(0): [drm] added 1 reserved context for kernel
(II) intel(0): X context handle = 0x1
(II) intel(0): [drm] installed DRM signal handler
(==) intel(0): VideoRam: 262144 KB
(**) intel(0): Framebuffer compression disabled
(**) intel(0): Tiling enabled
(II) intel(0): Attempting memory allocation with tiled buffers.
(WW) intel(0): Failed to allocate texture space.
(II) intel(0): Attempting memory allocation with untiled buffers.
(II) intel(0): Success.
(II) intel(0): [drm] Registers = 0xf2200000
(II) intel(0): [drm] ring buffer = 0xe0000000
(II) intel(0): [drm] Initialized kernel agp heap manager, 33554432
(II) intel(0): [dri] visual configs initialized
(II) intel(0): Page Flipping disabled
(II) intel(0): vgaHWGetIOBase: hwp->IOBase is 0x03d0, hwp->PIOOffset is 0x0000
(II) EXA(0): Offscreen pixmap area of 44236800 bytes
(II) EXA(0): Driver registered support for the following operations:
(II)         Solid
(II)         Copy
(II)         Composite (RENDER acceleration)
(==) intel(0): Backing store disabled
(==) intel(0): Silken mouse enabled
(II) intel(0): Initializing HW Cursor
(II) intel(0): [DRI] installation complete
(II) intel(0): [drm] dma control initialized, using IRQ 16
(II) intel(0): Current clock rate multiplier: 8
(II) intel(0): xf86BindGARTMemory: bind key 0 at 0x0b5d0000 (pgoffset 46544)
(II) intel(0): xf86BindGARTMemory: bind key 1 at 0x0e000000 (pgoffset 57344)
(II) intel(0): Fixed memory allocation layout:
(II) intel(0): 0x00000000-0x0001ffff: ring buffer (128 kB)
(II) intel(0): 0x00020000-0x00020fff: G33 hw status (4 kB)
(II) intel(0): 0x006ff000:            end of stolen memory
(II) intel(0): 0x006ff000-0x0b5cffff: DRI memory manager (179012 kB)
(II) intel(0): 0x0b5d0000-0x0dffffff: exa offscreen (43200 kB)
(II) intel(0): 0x0e000000-0x0fffffff: classic textures (32768 kB)
(II) intel(0): 0x10000000:            end of aperture
(II) intel(0): BO memory allocation layout:
(II) intel(0): 0x006ff000:            start of memory manager
(II) intel(0): 0x006ff000-0x0150efff: depth buffer (14400 kB)
(II) intel(0): 0x0150f000-0x0231efff: back buffer (14400 kB)
(II) intel(0): 0x02320000-0x0312ffff: front buffer (14400 kB)
(II) intel(0): 0x0231f000-0x0231ffff: overlay registers (4 kB)
(II) intel(0): 0x03130000-0x03137fff: logical 3D context (32 kB)
(II) intel(0): 0x03138000-0x03141fff: HW cursors (40 kB)
(II) intel(0): 0x0b5d0000:            end of memory manager

Backtrace :

-------------------------------------------------------------------------------
Program received signal SIGSEGV, Segmentation fault.
[Switching to Thread 0x2b63e1ec54b0 (LWP 7840)]
do_row (format=<value optimized out>, srcWidth=<value optimized out>, 
    srcRowA=0x0, srcRowB=0xc0, dstWidth=24, dstRow=0x1a57a00)
    at main/mipmap.c:162
162	            dst[i][0] = (rowA[j][0] + rowA[k][0] +
(gdb) bt
#0  do_row (format=<value optimized out>, srcWidth=<value optimized out>, 
    srcRowA=0x0, srcRowB=0xc0, dstWidth=24, dstRow=0x1a57a00)
    at main/mipmap.c:162
#1  0x00002b63f3c0fc8c in make_2d_mipmap (format=0x4, border=0, srcWidth=48, 
    srcHeight=48, srcPtr=0x0, srcRowStride=<value optimized out>, dstWidth=24, 
    dstHeight=24, dstPtr=0x1a57a00 "", dstRowStride=<value optimized out>)
    at main/mipmap.c:560
#2  0x00002b63f3c10beb in _mesa_generate_mipmap (ctx=0x10fe310, target=3553, 
    texUnit=<value optimized out>, texObj=0xa8f0f0) at main/mipmap.c:1135
#3  0x00002b63f3bf4097 in _mesa_GenerateMipmapEXT (target=3553)
    at main/fbobject.c:1547
#4  0x00002b63e2300a80 in __glXDisp_Render (cl=<value optimized out>, 
    pc=0x1a5738c "\b") at ../../../GL/glx/glxcmds.c:1778
#5  0x00002b63e23046e0 in __glXDispatch (client=0xa52ce0)
    at ../../../GL/glx/glxext.c:492
#6  0x000000000050a377 in XaceCatchExtProc (client=0xa52ce0)
    at ../../Xext/xace.c:307
#7  0x000000000044ae4e in Dispatch () at ../../dix/dispatch.c:467
#8  0x00000000004328ba in main (argc=10, argv=0x7fffcb53cf18, 
    envp=<value optimized out>) at ../../dix/main.c:448
-----------------------------------------------------------------------------
(gdb) bt full
#0  do_row (format=<value optimized out>, srcWidth=<value optimized out>, 
    srcRowA=0x0, srcRowB=0xc0, dstWidth=24, dstRow=0x1a57a00)
    at main/mipmap.c:162
	i = 1
	j = 2
	k = 3
	k0 = <value optimized out>
	colStride = 2
#1  0x00002b63f3c0fc8c in make_2d_mipmap (format=0x4, border=0, srcWidth=48, 
    srcHeight=48, srcPtr=0x0, srcRowStride=<value optimized out>, dstWidth=24, 
    dstHeight=24, dstPtr=0x1a57a00 "", dstRowStride=<value optimized out>)
    at main/mipmap.c:560
	bpt = 4
	srcWidthNB = 48
	dstWidthNB = 24
	dstHeightNB = 24
	srcRowBytes = <value optimized out>
	srcA = (const GLubyte *) 0x180 <Address 0x180 out of bounds>
	srcB = (const GLubyte *) 0x240 <Address 0x240 out of bounds>
	dst = (GLubyte *) 0x1a57a60 ""
	row = 1
#2  0x00002b63f3c10beb in _mesa_generate_mipmap (ctx=0x10fe310, target=3553, 
    texUnit=<value optimized out>, texObj=0xa8f0f0) at main/mipmap.c:1135
	dstImage = (struct gl_texture_image *) 0x1c28000
	srcWidth = 48
	srcHeight = 48
	dstDepth = 1
	border = 0
	srcImage = (const struct gl_texture_image *) 0xa8f590
	srcDepth = 1
	dstWidth = 24
	dstHeight = 24
	srcImage = (const struct gl_texture_image *) 0x2b63f3fbbd60
	convertFormat = (const struct gl_texture_format *) 0x2b63f3fbbd60
	srcData = (const GLubyte *) 0x0
	dstData = (GLubyte *) 0x1a57a00 ""
	level = 1
	maxLevels = <value optimized out>
	__PRETTY_FUNCTION__ = "_mesa_generate_mipmap"
#3  0x00002b63f3bf4097 in _mesa_GenerateMipmapEXT (target=3553)
    at main/fbobject.c:1547
	texUnit = (struct gl_texture_unit *) 0x11095b0
	texObj = (struct gl_texture_object *) 0xa8f0f0
	ctx = (GLcontext *) 0x4
#4  0x00002b63e2300a80 in __glXDisp_Render (cl=<value optimized out>, 
    pc=0x1a5738c "\b") at ../../../GL/glx/glxcmds.c:1778
	entry = {bytes = 8, varsize = 0}
	extra = 24
	proc = (
    __GLXdispatchRenderProcPtr) 0x2b63e23088b0 <__glXDisp_GenerateMipmapEXT>
	err = 0
	client = (ClientPtr) 0xa52ce0
	left = 292
	cmdlen = 8
	error = 0
	commandsDone = 8
	glxc = (__GLXcontext *) 0x9db9a0
	sw = <value optimized out>
#5  0x00002b63e23046e0 in __glXDispatch (client=0xa52ce0)
    at ../../../GL/glx/glxext.c:492
	stuff = (xGLXSingleReq *) 0x1a57300
	opcode = <value optimized out>
	proc = (__GLXdispatchSingleProcPtr) 0x2b63e23009b0 <__glXDisp_Render>
	cl = (__GLXclientState *) 0xa52e38
	retval = 1
#6  0x000000000050a377 in XaceCatchExtProc (client=0xa52ce0)
    at ../../Xext/xace.c:307
	major = 155
	ext = <value optimized out>
	rec = {client = 0xa52ce0, ext = 0x843250, access_mode = 16777216, 
  status = 0}
#7  0x000000000044ae4e in Dispatch () at ../../dix/dispatch.c:467
	clientReady = <value optimized out>
	result = <value optimized out>
	client = (ClientPtr) 0xa52ce0
	nready = 0
	start_tick = 820
#8  0x00000000004328ba in main (argc=10, argv=0x7fffcb53cf18, 
    envp=<value optimized out>) at ../../dix/main.c:448
	pScreen = <value optimized out>
	i = 1
	error = 0
	xauthfile = <value optimized out>
	alwaysCheckForInput = {0, 1}

Hi vincent,
   We have try the senario you posted, can't see the crash.
Can you update your mesa driver to have another check to see if the problem still exist?
Thanks 

Hi.

I can confirm that the bug is still there with the latest git of mesa+drm+xserver as of 2008-03-05.

Please note that there is a crash only if use the drm.ko and i915.ko from git, here are the relevant lines from dmesg when I use those modules:
-------------------------------------------------------
[drm] Initialized drm 1.1.0 20060810
[drm] Initialized i915 1.12.0 20070209 on minor 0
-------------------------------------------------------

I can provide yet another backtrace if necessary (but I suspect it will still be the same). I wonder why you couldn't reproduce, perhaps you didn't run with the kernel modules from libdrm/linux-core ?

we can't reproduce this issue on ubuntu, with drm, mesa, xserver, xf86-video-intel from git tip.

vincent, since you're pretty sure it's the kernel drm module that cause the issue, would you pls attach your drm module here? Let's see if we can use that to reproduce the issue locally...it'll be better if you can give us the last commit id when you check out from repo...

Created attachment 15132 [details]
kernel modules from latest git  1ea8a470fe9103036817ae3a960522c37901bddc

Here are my current kernel modules, compiled from libdrm 1ea8a470fe9103036817ae3a960522c37901bddc against the current linus kernel from git (lastest commit b663c6fd98c9cf586279db03cec3257c413efd00 + reiser4 patches).
Mesa and xserver are also from git master (don't have the exact commit number)
I can also send my current kernel package and/or make a new backtrace of the xserver crash if you want.

(In reply to comment #7)
> Hi.
> 
> I can confirm that the bug is still there with the latest git of
> mesa+drm+xserver as of 2008-03-05.
> 
> Please note that there is a crash only if use the drm.ko and i915.ko from git,
> here are the relevant lines from dmesg when I use those modules:
> -------------------------------------------------------
> [drm] Initialized drm 1.1.0 20060810
> [drm] Initialized i915 1.12.0 20070209 on minor 0
> -------------------------------------------------------

BTW, Vincent, it sounds to me from your above statement that there are other combination that _not_ crash. can you point it to us?

> 
> I can provide yet another backtrace if necessary (but I suspect it will still
> be the same). I wonder why you couldn't reproduce, perhaps you didn't run with
> the kernel modules from libdrm/linux-core ?
> 

(In reply to comment #11)
> (In reply to comment #7)
> > Hi.
> > 
> > I can confirm that the bug is still there with the latest git of
> > mesa+drm+xserver as of 2008-03-05.
> > 
> > Please note that there is a crash only if use the drm.ko and i915.ko from git,
> > here are the relevant lines from dmesg when I use those modules:
> > -------------------------------------------------------
> > [drm] Initialized drm 1.1.0 20060810
> > [drm] Initialized i915 1.12.0 20070209 on minor 0
> > -------------------------------------------------------
> 
> BTW, Vincent, it sounds to me from your above statement that there are other
> combination that _not_ crash. can you point it to us?
> 

Latest git of mesa+libdrm+xserver but not loading the kernel modules worked fine. I suppose it is because TTM is not enabled in that case ?

Created attachment 15636 [details]
test case

This simple test case can be used to reproduce this issue.

seems it's caused by _mesa_GenerateMipmapEXT->_mesa_generate_mipmap is not aware of the TTM memory object. It's always using texImage->Data as the data source, but texImage->Data is alwasy NULL when we're using memory object to store the data. we need to map it to texImage->Data before calling _mesa_generate_mipmap

With git tip, no ttm, there's no such issue, so close this one

verified

Mass version move, cvs -> git