[Bug 26403] X crashes on startup with KMS (Alpha architecture)

[bugzilla-daemon at freedesktop.org]

https://bugs.freedesktop.org/show_bug.cgi?id=26403

Michael Cree <mcree at orcon.net.nz> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
          Component|Server/general              |Driver/Radeon
         AssignedTo|xorg-team at lists.x.org       |xorg-driver-ati at lists.x.org

--- Comment #7 from Michael Cree <mcree at orcon.net.nz> 2010-06-15 03:09:54 PDT ---
Further testing with kernel 2.6.35-rc3, Xserver 1.8.1.901 (1.8.2 RC 1), and
Radeon driver 6.13.99 with the HD4350 Radeon card.

I've reallocated this bug to driver/radeon since that seems more appropriate.

I see a similar crash on starting X with KMS as described before for earlier
kernels.

While starting Xorg under gdb I observe a Bus error as follows:

Program received signal SIGBUS, Bus error.
0x00000200003a547c in ?? () from /lib/libc.so.6.1
(gdb) bt
#0  0x00000200003a547c in ?? () from /lib/libc.so.6.1
#1  0x00000200003a53e4 in memcpy () from /lib/libc.so.6.1
#2  0x00000200008c8f94 in drmmode_load_cursor_argb (crtc=0x12026e510, 
    image=0x120289fc0) at drmmode_display.c:392
#3  0x000000012018d714 in xf86_crtc_convert_cursor_to_argb (crtc=0x12026e510, 
    src=<value optimized out>) at xf86Cursors.c:218
#4  0x000000012018e514 in xf86_load_cursor_image (scrn=<value optimized out>, 
    src=0x1204b5160 "") at xf86Cursors.c:452
#5  0x0000000120191f94 in xf86SetCursor (pScreen=0x120276430, 
    pCurs=0x120291850, x=840, y=525) at xf86HWCurs.c:148
#6  0x000000012018f148 in xf86CursorSetCursor (pDev=0x120463d20, 
    pScreen=0x120276430, pCurs=0x120291850, x=840, y=525) at xf86Cursor.c:353
#7  0x00000001200637bc in miPointerUpdateSprite (pDev=0x120463d20)
    at mipointer.c:402
#8  0x0000000120064280 in miPointerDisplayCursor (pDev=0x120463d20, 
    pScreen=0x120276430, pCursor=0x120291850) at mipointer.c:197
#9  0x00000001200c4584 in CursorDisplayCursor (pDev=0x120463d20, 
    pScreen=0x120276430, pCursor=0x1202b8990) at cursor.c:155
#10 0x0000000120169604 in AnimCurDisplayCursor (pDev=0x120463d20, 
    pScreen=0x120276430, pCursor=0x1202b8990) at animcur.c:247
#11 0x000000012003c80c in UpdateSpriteForScreen (pDev=0x120463d20, 
    pScreen=0x120276430) at events.c:3098
#12 0x0000000120063c30 in miPointerWarpCursor (pDev=0x120463d20, 
    pScreen=0x120276430, x=840, y=525) at mipointer.c:343
#13 0x000000012013b174 in xf86WarpCursor (pDev=<value optimized out>, 
    pScreen=0x120276430, x=<value optimized out>, y=<value optimized out>)
    at xf86Cursor.c:473
#14 0x0000000120063940 in miPointerSetCursorPosition (pDev=0x120463d20, 
    pScreen=0x120276430, x=<value optimized out>, y=<value optimized out>, 
    generateEvent=0) at mipointer.c:239
#15 0x0000000120168df4 in AnimCurSetCursorPosition (pDev=0x120463d20, 
    pScreen=0x120276430, x=<value optimized out>, y=<value optimized out>, 
    generateEvent=<value optimized out>) at animcur.c:266
#16 0x000000012003ca98 in InitializeSprite (pDev=0x120463d20, pWin=0x1202b77b0)
    at events.c:3025
#17 0x00000001200473a8 in EnableDevice (dev=0x120463d20, sendevent=1 '\001')
    at devices.c:299
#18 0x0000000120047d84 in InitCoreDevices () at devices.c:610
#19 0x0000000120024d10 in main (argc=539181728, argv=0x1, 
    envp=<value optimized out>) at main.c:257

Shifting the stack context up to the routine drmmode_load_cursor_argb() and
examining variables I see:

383    static void
384    drmmode_load_cursor_argb (xf86CrtcPtr crtc, CARD32 *image)
385    {
386        drmmode_crtc_private_ptr drmmode_crtc = crtc->driver_private;
387        void *ptr;
388    
389        /* cursor should be mapped already */
390        ptr = drmmode_crtc->cursor_bo->ptr;
391    
392        memcpy (ptr, image, 64 * 64 * 4);
393    
394        return;


(gdb) print *drmmode_crtc
$7 = {drmmode = 0x12026dc50, mode_crtc = 0x12026e2d0, hw_id = 0, 
  cursor_bo = 0x12026c7e0, rotate_bo = 0x0, rotate_fb_id = 0, lut_r = {
    0 <repeats 256 times>}, lut_g = {0 <repeats 256 times>}, lut_b = {
    0 <repeats 256 times>}}

(gdb) print *drmmode_crtc->cursor_bo
$8 = {ptr = 0x200009b8000, flags = 0, handle = 1, size = 16384}

(gdb) print *(long *)drmmode_crtc->cursor_bo->ptr
Cannot access memory at address 0x200009b8000

Shouldn't I be able to access the memory location (0x200009b8000) to which the
image at 0x120289fc0 is to be copied by the memcpy command?

Hope this helps in indicating where the problem might be.

Michael.

-- 
Configure bugmail: https://bugs.freedesktop.org/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.