<html> <head> <meta content="text/html; charset=ISO-8859-1" http-equiv="Content-Type"> </head> <body text="#000000" bgcolor="#FFFFFF"> <div class="moz-cite-prefix">On 05/13/2014 04:59 PM, Dominique Rodrigues wrote: </div> <blockquote cite="mid:537287B0.1020103@nanocloud.com" type="cite"> <meta content="text/html; charset=ISO-8859-1" http-equiv="Content-Type"> <div class="moz-cite-prefix">Which version of qemu-kvm do you use ? 2.0 ? </div> </blockquote> All packages are F20 standard: qemu-kvm-1.6.2-4.fc20.x86_64 However, the crash happens in the xorg package, which is: xorg-x11-drv-qxl-0.1.1-3.fc20.x86_64 <blockquote cite="mid:537287B0.1020103@nanocloud.com" type="cite"> <div class="moz-cite-prefix"> Le 13/05/2014 22:01, David Mansfield a écrit : </div> <blockquote cite="mid:53727A1C.5030401@dm.cobite.com" type="cite">Hi All: I'd like help tracking down the solution to a very repeatable xorg crash. I can cause the crash by either: 1) logging in and opening the second monitor without having removed ~/.config/monitors.xml first. 2) using "shutter" (screen capture utility) to capture a "selection" I have a few coredumps with what seem like valid backtraces. (see below for an example). The xorg crash is caused by an assert is happening in frame#4, function qxl_bo_output_bo_reloc(): if (qxl->cmds.n_reloc_bos >= MAX_RELOCS || qxl->cmds.n_relocs >= MAX_RELOCS) assert(0); According to GDB, both n_reloc_bos = 96 and n_relocs = 96. (MAX_RELOCS=96). It seems that the "loop" in qxl_image_create (qxl_image.c) is "chunking" the the create into pieces no bigger than "chunk_size" and that this size is not big enough (or MAX_RELOCS is too small). From GDB (inside qxl_image_create() on or about line 174): (gdb) print h $13 = 31 (gdb) print height $14 = 847 (gdb) print chunk_size $15 = 262144 (gdb) print n_lines $16 = 17 So we have 31 lines left to go (out of 847), and we're copying 17 lines at a time. Close but no cigar. Is the fix to increase the chunk_size or to increase MAX_RELOCS or is something else broken here? FYI: I'm running F20 fully updated guest, host and client (all same box). I'm running "dual head" 1920x1200 (3840x1200 total FB resolution). Thanks, David Mansfield Cobite, INC. Thread 1 (Thread 0x7f35578169c0 (LWP 1256)): #0 0x0000003810c35c39 in __GI_raise (sig=sig@entry=6) at ../nptl/sysdeps/unix/sysv/linux/raise.c:56 resultvar = 0 pid = 1256 selftid = 1256 #1 0x0000003810c37348 in __GI_abort () at abort.c:89 save_stage = 2 act = {__sigaction_handler = {sa_handler = 0x7fff57866f2a, sa_sigaction = 0x7fff57866f2a}, sa_mask = {__val = {240800730995, 139867066025450, 482, 4294967295, 240799384819, 4, 140734661805968, 49, 0, 140734661806112, 0, 0, 0, 21474836480, 139867078164480, 240800742792}}, sa_flags = 1456027411, sa_restorer = 0x7f3556c94720 <__PRETTY_FUNCTION__.25149>} sigs = {__val = {32, 0 <repeats 15 times>}} #2 0x0000003810c2eb96 in __assert_fail_base (fmt=0x3810d7bd88 "%s%s%s:%u: %s%sAssertion `%s' failed.\n%n", assertion=assertion@entry=0x7f3556c93713 "0", file=file@entry=0x7f3556c945ea "qxl_kms.c", line=line@entry=482, function=function@entry=0x7f3556c94720 <__PRETTY_FUNCTION__.25149> "qxl_bo_output_bo_reloc") at assert.c:92 str = 0x2832860 "" total = 4096 #3 0x0000003810c2ec42 in __GI___assert_fail (assertion=assertion@entry=0x7f3556c93713 "0", file=file@entry=0x7f3556c945ea "qxl_kms.c", line=line@entry=482, function=function@entry=0x7f3556c94720 <__PRETTY_FUNCTION__.25149> "qxl_bo_output_bo_reloc") at assert.c:101 No locals. #4 0x00007f3556c80005 in qxl_bo_output_bo_reloc (qxl=<optimized out>, dst_offset=<optimized out>, _dst_bo=<optimized out>, _src_bo=<optimized out>) at qxl_kms.c:482 qxl = <optimized out> dst_offset = <optimized out> _dst_bo = <optimized out> _src_bo = <optimized out> dst_bo = <optimized out> src_bo = <optimized out> r = <optimized out> #5 0x00007f3556c76e31 in qxl_image_create (qxl=qxl@entry=0x2226900, data=0x39338a0 "", data@entry=0x2d3f8a0 "", x=x@entry=0, y=y@entry=0, width=width@entry=3840, height=height@entry=847, stride=stride@entry=15360, Bpp=4, fallback=fallback@entry=0) at qxl_image.c:174 chunk_size = 262144 n_lines = 17 bo = 0x2621080 chunk = 0x7f354fc1c000 hash = <optimized out> image = <optimized out> head_bo = 0x2668620 tail_bo = 0x2621030 image_bo = <optimized out> dest_stride = 15360 h = 31 #6 0x00007f3556c77546 in qxl_surface_put_image_for_reals (dest=dest@entry=0x2244fb0, x=x@entry=0, y=y@entry=162, width=width@entry=3840, height=height@entry=847, src=src@entry=0x2d3f8a0 "", src_pitch=src_pitch@entry=15360) at qxl_surface.c:794 drawable_bo = 0x26204a0 drawable = <optimized out> qxl = 0x2226900 rect = {top = 162, left = 0, bottom = 1009, right = 3840} image_bo = <optimized out> #7 0x00007f3556c7888c in qxl_surface_put_image (dest=0x2244fb0, x=0, y=162, width=<optimized out>, height=<optimized out>, src=0x2d3f8a0 "", src_pitch=15360) at qxl_surface.c:824 gross = 847 h2 = 191 use_hack = 1 #8 0x00007f3556c84c6d in uxa_copy_n_to_n (pSrcDrawable=pSrcDrawable@entry=0x2ae0040, pDstDrawable=0x283e120, pGC=0x266c110, pbox=0x2a50358, pbox@entry=0x2a50350, nbox=0, nbox@entry=2, dx=dx@entry=0, dy=dy@entry=0, reverse=0, upsidedown=0, bitplane=bitplane@entry=0, closure=0x0) at uxa-accel.c:582 stride = <optimized out> bpp = 4 src = <optimized out> screen = 0x2230280 src_off_x = 0 src_off_y = 0 dst_off_x = 0 dst_off_y = 0 pSrcPixmap = <optimized out> pDstPixmap = 0x226a580 src_region = {extents = {x1 = 32, y1 = 0, x2 = 0, y2 = 0}, data = 0x48000000e00} dst_region = {extents = {x1 = 1, y1 = 0, x2 = 0, y2 = 0}, data = 0x40000002} __FUNCTION__ = "uxa_copy_n_to_n" #9 0x00000000005818ed in miCopyRegion (pSrcDrawable=pSrcDrawable@entry=0x2ae0040, pDstDrawable=pDstDrawable@entry=0x283e120, pGC=pGC@entry=0x266c110, pDstRegion=pDstRegion@entry=0x7fff57864cb0, dx=dx@entry=0, dy=dy@entry=0, copyProc=copyProc@entry=0x7f3556c84650 <uxa_copy_n_to_n>, bitPlane=bitPlane@entry=0, closure=closure@entry=0x0) at micopy.c:121 careful = <optimized out> reverse = <optimized out> upsidedown = <optimized out> pbox = 0x2a50350 nbox = 2 pboxNew1 = <optimized out> pboxNew2 = 0x0 pboxBase = <optimized out> pboxNext = <optimized out> pboxTmp = <optimized out> #10 0x0000000000581eb0 in miDoCopy (pSrcDrawable=0x2ae0040, pDstDrawable=0x283e120, pGC=0x266c110, xIn=0, yIn=0, widthSrc=3840, heightSrc=heightSrc@entry=1200, xOut=xOut@entry=0, yOut=yOut@entry=0, copyProc=copyProc@entry=0x7f3556c84650 <uxa_copy_n_to_n>, bitPlane=bitPlane@entry=0, closure=closure@entry=0x0) at micopy.c:297 prgnSrcClip = 0x0 freeSrcClip = 0 prgnExposed = 0x0 rgnDst = {extents = {x1 = 0, y1 = 0, x2 = 3840, y2 = 1200}, data = 0x2a50340} dx = 0 dy = 0 box_x1 = <optimized out> box_y1 = <optimized out> box_x2 = <optimized out> box_y2 = <optimized out> fastSrc = <optimized out> fastDst = <optimized out> fastExpose = <optimized out> #11 0x00007f3556c839be in uxa_copy_area (pSrcDrawable=<optimized out>, pDstDrawable=<optimized out>, pGC=<optimized out>, srcx=<optimized out>, srcy=<optimized out>, width=<optimized out>, height=1200, dstx=0, dsty=0) at uxa-accel.c:642 dsty = 0 srcx = <optimized out> pSrcDrawable = <optimized out> dstx = 0 height = 1200 width = <optimized out> srcy = <optimized out> pGC = <optimized out> pDstDrawable = <optimized out> #12 0x00000000004361c6 in ProcCopyArea (client=0x2612d30) at dispatch.c:1626 pDst = 0x283e120 pSrc = 0x2ae0040 pGC = 0x266c110 stuff = 0x293c3ac pRgn = <optimized out> rc = <optimized out> #13 0x000000000043a327 in Dispatch () at dispatch.c:432 clientReady = 0x24a9c70 result = <optimized out> client = 0x2612d30 nready = 0 icheck = 0x822670 <checkForInput> start_tick = 740 #14 0x00000000004288da in main (argc=12, argv=0x7fff57864f68, envp=<optimized out>) at main.c:298 i = <optimized out> alwaysCheckForInput = {0, 1} _______________________________________________ Spice-devel mailing list <a moz-do-not-send="true" class="moz-txt-link-abbreviated" href="mailto:Spice-devel@lists.freedesktop.org">Spice-devel@lists.freedesktop.org</a> <a moz-do-not-send="true" class="moz-txt-link-freetext" href="http://lists.freedesktop.org/mailman/listinfo/spice-devel">http://lists.freedesktop.org/mailman/listinfo/spice-devel</a> </blockquote> <div class="moz-signature">-- <div style="color:#617d8c;"> <h4>Dominique Rodrigues </h4> </div> </div> </blockquote> </body> </html>