Bug 21188

Created attachment 24802 [details]
Core dump backtrace including full

00:02.1 Display controller [0380]: Intel Corporation Mobile GM965/GL960 Integrated Graphics Controller [8086:2a03] (rev 03)

Debian sid on an core 2 duo, Linux 2.6.29.1 (Debian package), libdrm 2.4.9, intel 2.6.99.903, mesa 7.4 (Debian package)

Kdm 4.2.2 starts fine, but when I try to login X crashes. Find attached Xorg log and configuration. I'm not sure so far what is to blame, but this is the Xorg core backtrace I got:

#0  0x00007f59c4ff54af in ?? () from /lib/libgcc_s.so.1
#1  0x00007f59c4ff5d7b in _Unwind_Backtrace () from /lib/libgcc_s.so.1
#2  0x00007f59c5f2a45e in *__GI___backtrace (array=<value optimized out>,
    size=32) at ../sysdeps/x86_64/../ia64/backtrace.c:85
#3  0x00000000004ef046 in xorg_backtrace () at ../../os/backtrace.c:39
#4  0x0000000000484219 in xf86SigHandler (signo=11)
    at ../../../../hw/xfree86/common/xf86Events.c:385
#5  <signal handler called>
#6  0x0000000000000002 in ?? ()
#7  0x00007f59c3ee72c4 in i965_prepare_composite (op=3, pSrcPicture=0x44ee1b0,
    pMaskPicture=0x0, pDstPicture=0x44ed590, pSrc=0x54ab8e0, pMask=0x0,
    pDst=0x50c3890) at ../../src/i965_render.c:1350
#8  0x00007f59c344b322 in exaTryDriverComposite (op=3 '\003', pSrc=0x44ee1b0,
    pMask=0x0, pDst=0x44ed590, xSrc=0, ySrc=0, xMask=<value optimized out>,
    yMask=<value optimized out>, xDst=<value optimized out>,
    yDst=<value optimized out>, width=<value optimized out>,
    height=<value optimized out>) at ../../exa/exa_render.c:670
#9  0x00007f59c344bcbf in exaComposite (op=3 '\003', pSrc=0x44ee1b0,
    pMask=0x0, pDst=0x44ed590, xSrc=0, ySrc=0, xMask=0, yMask=0, xDst=0,
    yDst=0, width=1280, height=800) at ../../exa/exa_render.c:935
#10 0x0000000000535828 in damageComposite (op=48 '0', pSrc=0x44ee1b0,
    pMask=0x0, pDst=0x44ed590, xSrc=0, ySrc=0, xMask=-19472,
    yMask=<value optimized out>, xDst=<value optimized out>,
    yDst=<value optimized out>, width=<value optimized out>,
    height=<value optimized out>) at ../../../miext/damage/damage.c:643
#11 0x000000000052de3a in ProcRenderComposite (client=0x44dff20)
    at ../../render/render.c:720
#12 0x000000000044d214 in Dispatch () at ../../dix/dispatch.c:437
#13 0x000000000043310d in main (argc=8, argv=0x7fffd03f60b8,
    envp=<value optimized out>) at ../../dix/main.c:397

I'm really blocked here because I have the same problem with 2.6.3 (also with drm 2.4.5). In this case, backtrace also explicitly mention drm_intel_bo_unreference. I've also tried options "NoAccel", "ExaNoComposite" and "NoDRI" with, if any, subtle differences in backtrace, so I'd point the same root cause.

Same tests with 2.6.99.903 trying as well: "NoAccel", "ExaNoComposite", "NoDRI" and some combinations of them. Same scenario, with the exception of NoDRI, where I had a situation resembling #20956, once I applied Jesse's patch to libdrm I end up with the situation I'm describing in this bug.

I've also tried UXA, login won't work as well but apparently for a different reason, if you are curious I can provide further information. This was for 2.6.3. UXA on 2.6.99.903 also failed for yet a different reason, but I'd like to focus here for EXA.

I've been running this hardware using 2.6.1 and 2.4.5 libdrm so far acceptably well, but unfortunately I've been unable to go back to that situation.

To conclude this is some info I got from core dump frame 7:

(gdb) p pI830->gen4_render_state->composite_op
$1 = {op = 3, source_picture = 0x3e93f50, mask_picture = 0x0, dest_picture = 0x3f02e00, source = 0x4efe2a0, mask = 0x0, dest = 0x4b16250,
  binding_table_bo = 0x437ac30, src_filter = SAMPLER_STATE_FILTER_NEAREST, mask_filter = SAMPLER_STATE_FILTER_NEAREST,
  src_extend = SAMPLER_STATE_EXTEND_NONE, mask_extend = SAMPLER_STATE_EXTEND_NONE, is_affine = 1, wm_kernel = WM_KERNEL_NOMASK_AFFINE}

(gdb) p *pI830->gen4_render_state->composite_op->binding_table_bo
$3 = {size = 4096, align = 0, offset = 34037760, virtual = 0x0, bufmgr = 0x143b420, handle = 745}

(gdb) p *pI830->gen4_render_state->composite_op->binding_table_bo->bufmgr
$5 = {bo_alloc = 0, bo_alloc_for_render = 0x2175640, bo_reference = 0x2185610, bo_unreference = 0x2, bo_map = 0x7f541555b000, bo_unmap = 0,
  bo_subdata = 0, bo_get_subdata = 0, bo_wait_rendering = 0x500000000000, destroy = 0, bo_emit_reloc = 0, bo_exec = 0xb1, bo_pin = 0x1000,
  bo_unpin = 0, bo_set_tiling = 0, bo_get_tiling = 0, bo_flink = 0x41b0d70, check_aperture_space = 0xf3, debug = 1}

Looks like bufmgr is corrupted.

Regards,