Deterministic panic 9.0-BETA2 with X + drm/radeon

[Lawrence Stewart]

Hi,

I'm able to deterministically trigger a panic on my 9.0-BETA2 desktop.

Graphics card is a RV516 [Radeon X1300/X1550 Series] using the "radeon" 
6.14.2 xorg driver. I'm running xorg-7.5.1 built from ports.

To trigger the panic, I only need to start virtualbox and attempt to 
start a VM, which would normally bring up a new window with the virtual 
machine's console in it, but panics the machine immediately before the 
console window even shows up.

Kernel backtrace looks like this:

######################################################################
(kgdb) bt
#0  doadump (textdump=1298691600) at /usr/src/sys/kern/kern_shutdown.c:260
#1  0xffffffff802f65ec in db_fncall (dummy1=Variable "dummy1" is not 
available.
) at /usr/src/sys/ddb/db_command.c:572
#2  0xffffffff802f6921 in db_command (last_cmdp=0xffffffff810e9f40, 
cmd_table=Variable "cmd_table" is not available.
) at /usr/src/sys/ddb/db_command.c:448
#3  0xffffffff802f6b70 in db_command_loop () at 
/usr/src/sys/ddb/db_command.c:501
#4  0xffffffff802f8cb9 in db_trap (type=Variable "type" is not available.
) at /usr/src/sys/ddb/db_main.c:229
#5  0xffffffff808591e1 in kdb_trap (type=12, code=0, 
tf=0xffffff834d6878a0) at /usr/src/sys/kern/subr_kdb.c:631
#6  0xffffffff80b0bc2d in trap_fatal (frame=0xffffff834d6878a0, 
eva=Variable "eva" is not available.
) at /usr/src/sys/amd64/amd64/trap.c:800
#7  0xffffffff80b0c2b5 in trap (frame=0xffffff834d6878a0) at 
/usr/src/sys/amd64/amd64/trap.c:321
#8  0xffffffff80af63ef in calltrap () at 
/usr/src/sys/amd64/amd64/exception.S:228
#9  0xffffffff80b09af3 in copyout () at 
/usr/src/sys/amd64/amd64/support.S:250
#10 0xffffffff81996285 in radeon_cp_getparam (dev=0xfffffe000f831c00, 
data=0xfffffe006d12b6b0, file_priv=Variable "file_priv" is not available.
)
     at /usr/src/sys/modules/drm/radeon/../../../dev/drm/radeon_state.c:3092
#11 0xffffffff819ea192 in drm_ioctl (kdev=Variable "kdev" is not available.
) at /usr/src/sys/modules/drm/drm/../../../dev/drm/drm_drv.c:793
#12 0xffffffff80745faa in devfs_ioctl_f (fp=0xfffffe006d6fb780, 
com=3222299729, data=Variable "data" is not available.
)
     at /usr/src/sys/fs/devfs/devfs_vnops.c:744
#13 0xffffffff8087291d in kern_ioctl (td=Variable "td" is not available.
) at file.h:278
#14 0xffffffff80872bbd in ioctl (td=0xfffffe006d856460, 
uap=0xffffff834d687bc0) at /usr/src/sys/kern/sys_generic.c:681
#15 0xffffffff80b0b4ca in amd64_syscall (td=0xfffffe006d856460, 
traced=0) at subr_syscall.c:131
#16 0xffffffff80af66d7 in Xfast_syscall () at 
/usr/src/sys/amd64/amd64/exception.S:387
#17 0x0000000802ca437c in ?? ()
######################################################################




First part of the text dump shows:

######################################################################
Unread portion of the kernel message buffer:
Kernel page fault with the following non-sleepable locks held:
exclusive sleep mutex drmdev (drmdev) r = 0 (0xfffffe000f831ca0) locked 
@ /usr/src/sys/modules/drm/drm/../../../dev/drm/drm_drv.c:791
KDB: stack backtrace:
db_trace_self_wrapper() at db_trace_self_wrapper+0x2a
kdb_backtrace() at kdb_backtrace+0x37
_witness_debugger() at _witness_debugger+0x2e
witness_warn() at witness_warn+0x2c4
trap() at trap+0x2fe
calltrap() at calltrap+0x8
--- trap 0xc, rip = 0xffffffff80b09af3, rsp = 0xffffff834d687950, rbp = 
0xffffff834d6879a0 ---
copyout() at copyout+0x43
drm_ioctl() at drm_ioctl+0x2f2
devfs_ioctl_f() at devfs_ioctl_f+0x7a
kern_ioctl() at kern_ioctl+0xcd
ioctl() at ioctl+0xfd
amd64_syscall() at amd64_syscall+0x3ba
Xfast_syscall() at Xfast_syscall+0xf7
--- syscall (54, FreeBSD ELF64, ioctl), rip = 0x802ca437c, rsp = 
0x7fffffffd968, rbp = 0x7fffffffd9b0 ---


Fatal trap 12: page fault while in kernel mode
cpuid = 2; apic id = 04
fault virtual address   = 0x80323455c
fault code              = supervisor write data, protection violation
instruction pointer     = 0x20:0xffffffff80b09af3
stack pointer           = 0x28:0xffffff834d687950
frame pointer           = 0x28:0xffffff834d6879a0
code segment            = base 0x0, limit 0xfffff, type 0x1b
                         = DPL 0, pres 1, long 1, def32 0, gran 1
processor eflags        = interrupt enabled, resume, IOPL = 3
current process         = 2491 (Xorg)
lock order reversal: (Giant after non-sleepable)
  1st 0xfffffe000f831ca0 drmdev (drmdev) @ 
/usr/src/sys/modules/drm/drm/../../../dev/drm/drm_drv.c:791
  2nd 0xffffffff81127080 Giant (Giant) @ 
/usr/src/sys/dev/usb/input/ukbd.c:2020
######################################################################


I have 2 core files available to prod with kgdb if anyone has ideas on 
how to debug further?

Cheers,
Lawrence