Bug 25949 - libIntelXvMC segmentation fault
Summary: libIntelXvMC segmentation fault
Status: VERIFIED FIXED
Alias: None
Product: xorg
Classification: Unclassified
Component: Driver/intel (show other bugs)
Version: unspecified
Hardware: x86 (IA32) Linux (All)
: high major
Assignee: Daniel Vetter
QA Contact: Xorg Project Team
URL:
Whiteboard:
Keywords:
Depends on:
Blocks:
 
Reported: 2010-01-08 07:25 UTC by Andrej Gelenberg
Modified: 2010-03-08 19:32 UTC (History)
3 users (show)

See Also:
i915 platform:
i915 features:


Attachments
patch against xf86-video-intel (507 bytes, patch)
2010-01-12 00:17 UTC, Daniel Vetter
no flags Details | Splinter Review
patch against xf86-video-intel (3.06 KB, patch)
2010-01-12 06:00 UTC, Daniel Vetter
no flags Details | Splinter Review
new patch against xf86-video-intel (3.95 KB, patch)
2010-01-12 08:09 UTC, Daniel Vetter
no flags Details | Splinter Review
xvmc error info on 945GM (3.31 KB, text/plain)
2010-01-14 21:13 UTC, fangxun
no flags Details
patch against xf86-video-intel (6.67 KB, patch)
2010-01-15 02:41 UTC, Daniel Vetter
no flags Details | Splinter Review
wrong color while playing video (723.58 KB, image/png)
2010-03-07 21:36 UTC, fangxun
no flags Details

Description Andrej Gelenberg 2010-01-08 07:25:19 UTC
segfault in libIntelXvMc
$ valgrind mplayer -vo xvmc -vc ffmpeg12mc -fs /usr/share/texmf-dist/doc/latex/aastex/video3.mpg

output:
...
==25040== Invalid write of size 1
==25040==    at 0x4024E64: memcpy (in /usr/lib/valgrind/vgpreload_memcheck-x86-linux.so)
==25040==    by 0x695282C: intelBatchbufferData (in /usr/lib/libIntelXvMC.so.1.0.0)
==25040==    by 0x12: ???
==25040==  Address 0xb7718044 is not stack'd, malloc'd or (recently) free'd
==25040==
==25040== Invalid write of size 1
==25040==    at 0x4024E6C: memcpy (in /usr/lib/valgrind/vgpreload_memcheck-x86-linux.so)
==25040==    by 0x695282C: intelBatchbufferData (in /usr/lib/libIntelXvMC.so.1.0.0)
==25040==    by 0x12: ???
==25040==  Address 0xb7718045 is not stack'd, malloc'd or (recently) free'd
==25040==
==25040== Invalid write of size 1
==25040==    at 0x4024E75: memcpy (in /usr/lib/valgrind/vgpreload_memcheck-x86-linux.so)
==25040==    by 0x695282C: intelBatchbufferData (in /usr/lib/libIntelXvMC.so.1.0.0)
==25040==    by 0x12: ???
==25040==  Address 0xb7718046 is not stack'd, malloc'd or (recently) free'd
==25040==
==25040== Invalid write of size 1
==25040==    at 0x4024E7E: memcpy (in /usr/lib/valgrind/vgpreload_memcheck-x86-linux.so)
==25040==    by 0x695282C: intelBatchbufferData (in /usr/lib/libIntelXvMC.so.1.0.0)
==25040==    by 0x12: ???
==25040==  Address 0xb7718047 is not stack'd, malloc'd or (recently) free'd
==25040==
==25040== Invalid write of size 1
==25040==    at 0x4024E64: memcpy (in /usr/lib/valgrind/vgpreload_memcheck-x86-linux.so)
==25040==    by 0x695282C: intelBatchbufferData (in /usr/lib/libIntelXvMC.so.1.0.0)
==25040==    by 0x13: ???
==25040==  Address 0xb7718044 is not stack'd, malloc'd or (recently) free'd
==25040==
==25040== Invalid write of size 1
==25040==    at 0x4024E6C: memcpy (in /usr/lib/valgrind/vgpreload_memcheck-x86-linux.so)
==25040==    by 0x695282C: intelBatchbufferData (in /usr/lib/libIntelXvMC.so.1.0.0)
==25040==    by 0x13: ???
==25040==  Address 0xb7718045 is not stack'd, malloc'd or (recently) free'd
==25040==
...

Driver: xf86-intel-driver 2.10.0
Mplayer: git-20100107
Comment 1 Gordon Jin 2010-01-10 17:18:38 UTC
which chipset (945,965...)?
Comment 2 Shuang He 2010-01-10 17:25:34 UTC
And could you please provide a backtrace for the segmentation fault?
Comment 3 Andrej Gelenberg 2010-01-11 02:00:19 UTC
lspci:
00:02.0 VGA compatible controller: Intel Corporation Mobile 945GME Express Integrated Graphics Controller (rev 03)
00:02.1 Display controller: Intel Corporation Mobile 945GM/GMS/GME, 943/940GML Express Integrated Graphics Controller (rev 03)

Xorg.0.log:
(II) intel(0): Integrated Graphics Chipset: Intel(R) 945GME
(--) intel(0): Chipset: "945GME"
Comment 4 Shuang He 2010-01-11 19:22:20 UTC
(In reply to comment #3)
> lspci:
> 00:02.0 VGA compatible controller: Intel Corporation Mobile 945GME Express
> Integrated Graphics Controller (rev 03)
> 00:02.1 Display controller: Intel Corporation Mobile 945GM/GMS/GME, 943/940GML
> Express Integrated Graphics Controller (rev 03)
> Xorg.0.log:
> (II) intel(0): Integrated Graphics Chipset: Intel(R) 945GME
> (--) intel(0): Chipset: "945GME"

OK, I can confirm this issue on 945GME, and bisect shows that it's caused by Daniel Vetter's following commits:
commit 229d23fb18d696fb7ad476ce335be14ec9811bd3
commit ce7ba18f577cc9aedddaff303dbc9662a276b4cf
commit 1ac7c94083a3266e2d5dd932709118436074dd00
commit 31f13fa8a0d4cd28067de37d0d31d23e8200d0ff

And the last 3 commits failed to build and have different issues. So I'm not which of those 4 commit cause this issue.

Comment 5 fangxun 2010-01-11 20:03:32 UTC
The same issue on piketon.
Comment 6 Daniel Vetter 2010-01-12 00:17:30 UTC
Created attachment 32582 [details] [review]
patch against xf86-video-intel

Quick shot in the dark: Does this help (I don't have the hw, so I can't test).
Comment 7 Daniel Vetter 2010-01-12 00:25:54 UTC
If my patch doesn't help, can you please narrow down which one of the four commits broke stuff? I've pushed a rebase tree with the intermediate compile breakage fixed to

git://gitorious.org/daniel-s-linux-stuff/xf86-video-intel.git bugs/xvmc-crash-on-945

Thanks, Daniel
Comment 8 Shuang He 2010-01-12 00:36:09 UTC
(In reply to comment #7)
> If my patch doesn't help, can you please narrow down which one of the four
> commits broke stuff? I've pushed a rebase tree with the intermediate compile
> breakage fixed to
> 
> git://gitorious.org/daniel-s-linux-stuff/xf86-video-intel.git
> bugs/xvmc-crash-on-945
> 
> Thanks, Daniel
> 

Seems there's some problem git-clone from your tree.
It will complains:
warning: remote HEAD refers to nonexistent ref, unable to checkout.
Comment 9 Shuang He 2010-01-12 00:52:33 UTC
(In reply to comment #8)
> (In reply to comment #7)
> > If my patch doesn't help, can you please narrow down which one of the four
> > commits broke stuff? I've pushed a rebase tree with the intermediate compile
> > breakage fixed to
> > 
> > git://gitorious.org/daniel-s-linux-stuff/xf86-video-intel.git
> > bugs/xvmc-crash-on-945
> > 
> > Thanks, Daniel
> > 
> 
> Seems there's some problem git-clone from your tree.
> It will complains:
> warning: remote HEAD refers to nonexistent ref, unable to checkout.
> 

Ok, ignore this. I started bisect. 
And for your information, since it also happened on clarkdale, the patch in comment #6 won't fix them all at least.
Comment 10 Shuang He 2010-01-12 00:59:07 UTC
OK, I have tried those commits on your branch.
Now it's narrow down to two commits:
93a744d40c2f9c5407682c7c441cc1cb8b54120e
f637726e547cd3a1d5d9774b716b044f0e8630da

commits f637726e547cd3a1d5d9774b716b044f0e8630da will complain a lot about:
 X11 error: BadAlloc (insufficient resources for operation)
Comment 11 Daniel Vetter 2010-01-12 01:29:54 UTC
On Tue, Jan 12, 2010 at 12:59:08AM -0800, bugzilla-daemon@freedesktop.org wrote:
> --- Comment #10 from Shuang He <shuang.he@intel.com>  2010-01-12 00:59:07 PST ---
> OK, I have tried those commits on your branch.
> Now it's narrow down to two commits:
> 93a744d40c2f9c5407682c7c441cc1cb8b54120e
> f637726e547cd3a1d5d9774b716b044f0e8630da
> 
> commits f637726e547cd3a1d5d9774b716b044f0e8630da will complain a lot about:
>  X11 error: BadAlloc (insufficient resources for operation)

This is expected (when you're on a 945). Just a few questions to clarify
stuff for me:

- Did xvmc on 945 really work beforehand?
- What are the other chips that affected by this? I have no clue how intel
  codenames map to the IS_ macros.

-Daniel
Comment 12 Shuang He 2010-01-12 04:55:56 UTC
(In reply to comment #11)
> On Tue, Jan 12, 2010 at 12:59:08AM -0800, bugzilla-daemon@freedesktop.org
> wrote:
> > --- Comment #10 from Shuang He <shuang.he@intel.com>  2010-01-12 00:59:07 PST ---
> > OK, I have tried those commits on your branch.
> > Now it's narrow down to two commits:
> > 93a744d40c2f9c5407682c7c441cc1cb8b54120e
> > f637726e547cd3a1d5d9774b716b044f0e8630da
> > 
> > commits f637726e547cd3a1d5d9774b716b044f0e8630da will complain a lot about:
> >  X11 error: BadAlloc (insufficient resources for operation)
> 
> This is expected (when you're on a 945). Just a few questions to clarify
> stuff for me:
> 
> - Did xvmc on 945 really work beforehand?
> - What are the other chips that affected by this? I have no clue how intel
>   codenames map to the IS_ macros.
> 
> -Daniel
> 

Sure, it used to be working on 945GM before your changes. It is the baseline to do bisection.
And to be clear, 945GM is working well with the commit a16a769b0e65afb30cc0cdcba651667b8f7c9251, which is just the commit before f637726e547cd3a1d5d9774b716b044f0e8630da
Clarkdale is the latest intel 32nm CPU that integrated GPU, I haven't tried it on other platforms
Comment 13 Daniel Vetter 2010-01-12 05:31:48 UTC
On Tue, Jan 12, 2010 at 04:55:57AM -0800, bugzilla-daemon@freedesktop.org wrote:
> Sure, it used to be working on 945GM before your changes. It is the baseline to
> do bisection.
> And to be clear, 945GM is working well with the commit
> a16a769b0e65afb30cc0cdcba651667b8f7c9251, which is just the commit before
> f637726e547cd3a1d5d9774b716b044f0e8630da
> Clarkdale is the latest intel 32nm CPU that integrated GPU, I haven't tried it
> on other platforms

Argh, I think I've found it. i915_video.c does some funky spaghetti-code
logic that magically passes around a few things. I've overlooked this when
doing the original patch series.  Furthermore I've found a small omission
that explains why xvmc broke on all supported configs. I hope I have a
patch ready later today.
Comment 14 Daniel Vetter 2010-01-12 06:00:33 UTC
Created attachment 32589 [details] [review]
patch against xf86-video-intel

This hopefully fixes xvmc for 4th gen chipsets (clarkdale).
Comment 15 Daniel Vetter 2010-01-12 08:09:22 UTC
Created attachment 32592 [details] [review]
new patch against xf86-video-intel

Now hopefully also with fixed-up 945 xvmc support.

Please test, thx Daniel
Comment 16 Shuang He 2010-01-12 16:55:45 UTC
Xun, Could you help following up this issue. Thanks
Comment 17 fangxun 2010-01-12 19:11:47 UTC
Test with the patch on piketon and 945GM. It works well on piketon(clarkdale).
For 945GM, video can be played, but the output is green screen.  
Comment 18 Daniel Vetter 2010-01-13 00:11:54 UTC
> --- Comment #17 from fangxun <xunx.fang@intel.com>  2010-01-12 19:11:47 PST ---
> Test with the patch on piketon and 945GM. It works well on piketon(clarkdale).
> For 945GM, video can be played, but the output is green screen.  

Ok, looks like I've the pointer fixup stuff is not quite right, yet. I'll
stare at the code some more ...
Comment 19 Daniel Vetter 2010-01-14 04:35:23 UTC
> --- Comment #18 from Daniel Vetter <daniel@ffwll.ch>  2010-01-13 00:11:54 PST ---
> Ok, looks like I've the pointer fixup stuff is not quite right, yet. I'll
> stare at the code some more ...

Ok, I've got a new idea as to where I've screwed up. Can you tell me what
the source dimension is of the video you're using to test this? Can you
also test with HD-content (more specific: 2048 > width > 1024 pixels)?

Thanks, Daniel
Comment 20 fangxun 2010-01-14 21:13:01 UTC
Created attachment 32650 [details]
xvmc error info on 945GM

The video we're using to test is 720x576. 

Tested with HD-content video(1920 x 1080), the video can not be played. Pls see attached file.
Comment 21 Daniel Vetter 2010-01-15 02:41:52 UTC
Created attachment 32654 [details] [review]
patch against xf86-video-intel

Please apply this on top of the other patch. This hopefully fixes the
xvmc breakage on 945.
Comment 22 fangxun 2010-01-18 23:02:49 UTC
Still fails with the patch. For 720x576 video, it can be played, but the output is green screen. For HD-content video(1920 x 1080), it can not be played.
Comment 23 Andrej Gelenberg 2010-02-09 06:20:39 UTC
Work now for me with new linux kernel 2.6.33-rc7
xf86-video-intel: 2.10.0
MPlayer SVN-r30519-4.4.3
Comment 24 Shuang He 2010-02-09 06:21:47 UTC
Shuang He is OOO during 2-8 and 2-19.
Comment 25 Daniel Vetter 2010-03-02 04:26:26 UTC
I've submitted new patches for inclusion that should also fix xvmc on i945.

Please reopen if they do not work as advertised.

Thanks, Daniel
Comment 26 Gordon Jin 2010-03-04 00:00:06 UTC
Daniel, thanks for the patch. But let's keep this bug open until the patches committed. This will also remind us to include it in 2.11 release (P1 major bugs appear on our release blocker list)
Comment 27 Daniel Vetter 2010-03-05 06:25:28 UTC
Patched arrived in the master branch. Please test and reopen in case it doesn't work as advertised.
Comment 28 fangxun 2010-03-07 21:36:34 UTC
Created attachment 33848 [details]
wrong color while playing video

With this patch, video(720x576) can be played on 945GM. But the video's output color is wrong.
Comment 29 Daniel Vetter 2010-03-08 01:09:41 UTC
> --- Comment #28 from fangxun <xunx.fang@intel.com>  2010-03-07 21:36:34 PST ---
> Created an attachment (id=33848)
>  --> (http://bugs.freedesktop.org/attachment.cgi?id=33848)
> wrong color while playing video
> 
> With this patch, video(720x576) can be played on 945GM. But the video's output
> color is wrong. 

Gosh, I think we can safely assume that I'm colorblind ... ;) I've mixed
up the UV plane ordering somewhere, which caused these funny colors.

I'll send a patch asap.
Comment 30 fangxun 2010-03-08 19:32:56 UTC
It works well now. Verified.


Use of freedesktop.org services, including Bugzilla, is subject to our Code of Conduct. How we collect and use information is described in our Privacy Policy.