| Summary: | Massive memory corruption in Planetary Annihilation Alpha | ||
|---|---|---|---|
| Product: | Mesa | Reporter: | Andreas Ringlstetter <andreas.ringlstetter> |
| Component: | Drivers/Gallium/r300 | Assignee: | Default DRI bug account <dri-devel> |
| Status: | RESOLVED INVALID | QA Contact: | |
| Severity: | normal | ||
| Priority: | medium | CC: | sobkas |
| Version: | git | ||
| Hardware: | x86-64 (AMD64) | ||
| OS: | Linux (All) | ||
| Whiteboard: | |||
| i915 platform: | i915 features: | ||
| Attachments: |
Example of corruption in PA. The skybox texture has been completely overwritten, partly with textures from other programms, corruption in other textures is already starting.
Xorg log glxinfo log Example of corruption in PA. The skybox texture has been completely overwritten, partly with textures from other programms, corruption in other textures is already starting. |
||
Created attachment 81106 [details]
Xorg log
Created attachment 81107 [details]
glxinfo log
Created attachment 81108 [details]
Example of corruption in PA. The skybox texture has been completely overwritten, partly with textures from other programms, corruption in other textures is already starting.
PS: I will not be able to test with 9.0 or 9.1 since one of the shaders causes a segfault while compiling in these version. This has only recently (last 1-2 months) been fixed in git. This was caused by a faulty implementation of peephole_mul_omod() in compiler/radeon_optimize.c, the SIGSEGV was thrown in rc_variable_list_get_writers_one_reader due to writer_list beeing NULL. You could try setting the env var RADEON_DEBUG=noopt, maybe it helps. Additionally you should be able to test 9.0 and 9.1 with this env var. RADEON_DEBUG=help prints some other debug flags you could try. E.g disable hyper-z or msaa RADEON_DEBUG=noopt is not possible, the pixel shader programs are to big to be loaded without size optimizations. Hard limit of 512 instruction slots per pixel shader: http://developer.amd.com/wordpress/media/2012/10/Radeon_X1x00_Programming_Guide.pdf page 13 This limit is exceeded by far due to all the virtual texturing code, the optimized shader barely fits. I did try it in 9.0 and 9.1 with noopt and I did get past the segfault in peephole_mul_omod() this way, but it did fail then because the resulting shader program was to big. Deactivating hyper-z has no measurable impact, and it didn't prevent the corruption either. Antialiasing hasn't even been enabled in the application by default, so turning it off makes no difference at all. Planetary Annihilation is using compat profile. When I override the Mesa version with MESA_GL_VERSION_OVERRIDE=3.1COMPAT the corruptions are fixed but it later crashes. Actually no I take that back it is using core profile. (In reply to Timothy Arceri from comment #8) > Actually no I take that back it is using core profile. It's requesting a core profile and using compat features. (In reply to Timothy Arceri from comment #9) > (In reply to Timothy Arceri from comment #8) > > Actually no I take that back it is using core profile. > > It's requesting a core profile and using compat features. Actually I'm not sure that's true either. Anyway here is a trace (warning its 3.6GB). https://drive.google.com/open?id=0B-f68fD4PtpBenBiekxITllIbzg The game runs (mostly fine on) i965, and a trace from i965 seem to run without issue on radeonsi. However running the radeonsi trace on the nvidia blob results in the same corruptions. It's a bug in PA itself, not in Mesa. The root cause is a race condition on the shared buffer which is used to transfer the rendered HTML UI from the Coherent host process back to PA. There is a missing mutex inside PA when the buffer gets reallocated as a result of a window resize event. Effectively, this results in a use-after-free by the render thread of the PA process. The faster the realloc, the lower the chance of this bug occurring. It's also subject to possibly missing protections against use after free conditions on previously shared buffers. And also to the memory allocation strategy, as a reuse of the same memory region without a clear leads to the most visible effect. Unfortunately, various Mesa drivers so not wipe the video memory after a buffer was returned to the global pool! |
Use of freedesktop.org services, including Bugzilla, is subject to our Code of Conduct. How we collect and use information is described in our Privacy Policy.
Created attachment 81105 [details] Example of corruption in PA. The skybox texture has been completely overwritten, partly with textures from other programms, corruption in other textures is already starting. Using the R300 driver (git version from 2013-06-19) on a Mobility Radeon X1400 (128MB dedicated ???), I get massive memory corruption which can be seen in the attached screenshot when running the Planetary Annihilation Alpha. The game makes use of virtual texturing, thats means a mega texture which won't possibly fit in the RAM in one piece. However, it appears like textures which are NOT part of the mega texture have been mapped into the same address space. I could see other textures, and even bitmaps from other applications. In the screenshot, there are large grey stripes for example, however there is no such texture in the game. The color does match the color of the window border though. Performing further tests, I even managed to get parts of album covers from Banshee into PA. This issue is not only limited to Planetary Annihilation though and the corruption also works other way around, where applications overwrite the bitmaps of other applications. The effects of the corruption are clearly visible in PA due to the large textures. They are not deterministic, but appear very reliable, most likely due to the high memory usage. Using other applications which frequently allocate new textures (like Banshee with album covers) speeds up the corruption and makes it even visible in other applications like Firefox, Cinnamon etc., although not reliable. Attached are: Screenshot of corruption Xorg-log glxinfo output