Bug 261166

Summary: LinuxKPI kernel panics: mi_switch: switch in a critical section – 14.0-CURRENT main-n252381-75d20a5e386 (2022-01-11)
Product: Base System Reporter: Graham Perrin <grahamperrin>
Component: kernAssignee: Vladimir Kondratyev <wulf>
Status: Closed FIXED    
Severity: Affects Some People CC: wulf
Priority: --- Keywords: patch-ready
Version: CURRENT   
Hardware: Any   
OS: Any   
URL: https://github.com/freebsd/drm-kmod/commit/0bdd260237163ce14163904fca0cef8cc7a00f67
See Also: https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=261218
Attachments:
Description Flags
core.txt.1
none
core.txt.2 is too large for Bugzilla; compressed
none
core.txt.4 panic with drm-current-kmod none

Description Graham Perrin freebsd_committer freebsd_triage 2022-01-13 02:54:36 UTC
Dump header from device: /dev/ada0p2
  Architecture: amd64
  Architecture Version: 2
  Dump Length: 1905860608
  Blocksize: 512
  Compression: none
  Dumptime: 2022-01-12 23:47:51 +0000
  Hostname: mowa219-gjp4-8570p-freebsd
  Magic: FreeBSD Kernel Dump
  Version String: FreeBSD 14.0-CURRENT #15 main-n252381-75d20a5e386: Wed Jan 12 04:39:40 GMT 2022
    root@mowa219-gjp4-8570p-freebsd:/usr/obj/usr/src/amd64.amd64/sys/GENERIC
  Panic String: mi_switch: switch in a critical section
  Dump Parity: 4235851625
  Bounds: 1
  Dump Status: good
/var/crash/info.1 (END)

----

Dump header from device: /dev/ada0p2
  Architecture: amd64
  Architecture Version: 2
  Dump Length: 3712352256
  Blocksize: 512
  Compression: none
  Dumptime: 2022-01-13 00:09:44 +0000
  Hostname: mowa219-gjp4-8570p-freebsd
  Magic: FreeBSD Kernel Dump
  Version String: FreeBSD 14.0-CURRENT #15 main-n252381-75d20a5e386: Wed Jan 12 04:39:40 GMT 2022
    root@mowa219-gjp4-8570p-freebsd:/usr/obj/usr/src/amd64.amd64/sys/GENERIC
  Panic String: mi_switch: switch in a critical section
  Dump Parity: 2474440553
  Bounds: 2
  Dump Status: good
/var/crash/info.2 (END)

----

root@mowa219-gjp4-8570p-freebsd:~ # grep PORTS_MODULES /etc/src.conf | grep -v \#
PORTS_MODULES= emulators/virtualbox-ose-kmod graphics/drm-devel-kmod graphics/gpu-firmware-kmod
root@mowa219-gjp4-8570p-freebsd:~ #
Comment 1 Graham Perrin freebsd_committer freebsd_triage 2022-01-13 02:58:01 UTC
Created attachment 230971 [details]
core.txt.1

Unread portion of the kernel message buffer:
panic: mi_switch: switch in a critical section
cpuid = 1
time = 1642031271
KDB: stack backtrace:
db_trace_self_wrapper() at db_trace_self_wrapper+0x2b/frame 0xfffffe01311a83a0
vpanic() at vpanic+0x17f/frame 0xfffffe01311a83f0
panic() at panic+0x43/frame 0xfffffe01311a8450
mi_switch() at mi_switch+0x19a/frame 0xfffffe01311a8470
__mtx_lock_sleep() at __mtx_lock_sleep+0x1d9/frame 0xfffffe01311a8500
__mtx_lock_flags() at __mtx_lock_flags+0xe5/frame 0xfffffe01311a8550
linux_wake_up() at linux_wake_up+0x38/frame 0xfffffe01311a85a0
radeon_fence_is_signaled() at radeon_fence_is_signaled+0x9b/frame 0xfffffe01311a85f0
dma_resv_add_shared_fence() at dma_resv_add_shared_fence+0x8a/frame 0xfffffe01311a8640
ttm_eu_fence_buffer_objects() at ttm_eu_fence_buffer_objects+0x6a/frame 0xfffffe01311a8670
radeon_cs_parser_fini() at radeon_cs_parser_fini+0x53/frame 0xfffffe01311a86a0
radeon_cs_ioctl() at radeon_cs_ioctl+0x788/frame 0xfffffe01311a8b20
drm_ioctl_kernel() at drm_ioctl_kernel+0xc7/frame 0xfffffe01311a8b70
drm_ioctl() at drm_ioctl+0x2c4/frame 0xfffffe01311a8c60
linux_file_ioctl() at linux_file_ioctl+0x30a/frame 0xfffffe01311a8cc0
kern_ioctl() at kern_ioctl+0x202/frame 0xfffffe01311a8d30
sys_ioctl() at sys_ioctl+0x126/frame 0xfffffe01311a8e00
amd64_syscall() at amd64_syscall+0x12e/frame 0xfffffe01311a8f30
fast_syscall_common() at fast_syscall_common+0xf8/frame 0xfffffe01311a8f30
--- syscall (54, FreeBSD ELF64, sys_ioctl), rip = 0x27a426f501a, rsp = 0x7fffde617ec8, rbp = 0x7fffde617ef0 ---
KDB: enter: panic
Uptime: 22m3s
(ada0:ahcich0:0:0:0): spin-down
Dumping 1817 out of 16265 MB:..1%..11%..21%..31%..41%..51%..61%..71%..81%..91%

__curthread () at /usr/src/sys/amd64/include/pcpu_aux.h:55
55		__asm("movq %%gs:%P1,%0" : "=r" (td) : "n" (offsetof(struct pcpu,
(kgdb) #0  __curthread () at /usr/src/sys/amd64/include/pcpu_aux.h:55
#1  doadump (textdump=textdump@entry=1)
    at /usr/src/sys/kern/kern_shutdown.c:399
#2  0xffffffff80c00ba4 in kern_reboot (howto=260)
    at /usr/src/sys/kern/kern_shutdown.c:487
#3  0xffffffff80c0100e in vpanic (
    fmt=0xffffffff811ac565 "mi_switch: switch in a critical section", 
    ap=<optimized out>) at /usr/src/sys/kern/kern_shutdown.c:920
#4  0xffffffff80c00d63 in panic (fmt=<unavailable>)
    at /usr/src/sys/kern/kern_shutdown.c:844
#5  0xffffffff80c0df5a in mi_switch (flags=flags@entry=259)
    at /usr/src/sys/kern/kern_synch.c:503
#6  0xffffffff80c67eea in turnstile_wait (ts=ts@entry=0xfffff8001f327240, 
    owner=owner@entry=0xfffffe015f7f03a0, queue=<optimized out>, 
    queue@entry=0) at /usr/src/sys/kern/subr_turnstile.c:817
#7  0xffffffff80bdc659 in __mtx_lock_sleep (c=c@entry=0xfffffe00de6798a8, 
    v=<optimized out>, opts=<optimized out>, opts@entry=0, 
    file=<optimized out>, 
    file@entry=0xffffffff81284276 "/usr/src/sys/compat/linuxkpi/common/src/linux_schedule.c", line=line@entry=207) at /usr/src/sys/kern/kern_mutex.c:668
#8  0xffffffff80bdc405 in __mtx_lock_flags (c=0xfffffe00de6798a8, 
    opts=<unavailable>, 
    file=0xffffffff81284276 "/usr/src/sys/compat/linuxkpi/common/src/linux_schedule.c", line=207) at /usr/src/sys/kern/kern_mutex.c:284
#9  0xffffffff80e7a028 in linux_wake_up (wqh=0xfffffe00de679890, state=3, 
    nr=0, locked=false)
    at /usr/src/sys/compat/linuxkpi/common/src/linux_schedule.c:207
#10 0xffffffff8394520b in radeon_fence_is_signaled ()
   from /boot/modules/radeonkms.ko
#11 0xffffffff83a890ca in dma_resv_add_shared_fence ()
   from /boot/modules/linuxkpi_gplv2.ko
#12 0xffffffff83a96a6a in ttm_eu_fence_buffer_objects ()
   from /boot/modules/ttm.ko
#13 0xffffffff83937513 in radeon_cs_parser_fini ()
   from /boot/modules/radeonkms.ko
#14 0xffffffff83937298 in radeon_cs_ioctl () from /boot/modules/radeonkms.ko
#15 0xffffffff83a2ca97 in drm_ioctl_kernel () from /boot/modules/drm.ko
#16 0xffffffff83a2ce54 in drm_ioctl () from /boot/modules/drm.ko
#17 0xffffffff80e6b7da in linux_file_ioctl_sub (fp=0xedef, filp=0x1, 
    fop=<optimized out>, cmd=<optimized out>, data=<optimized out>, 
    td=<optimized out>)
    at /usr/src/sys/compat/linuxkpi/common/src/linux_compat.c:1024
#18 linux_file_ioctl (fp=0xedef, 
    fp@entry=<error reading variable: value is not available>, 
    cmd=<unavailable>, 
    cmd@entry=<error reading variable: value is not available>, 
    data=<unavailable>, 
    data@entry=<error reading variable: value is not available>, 
    cred=<optimized out>, 
    cred@entry=<error reading variable: value is not available>, td=0x0, 
    td@entry=<error reading variable: value is not available>)
    at /usr/src/sys/compat/linuxkpi/common/src/linux_compat.c:1648
#19 0xffffffff80c77482 in fo_ioctl (fp=<optimized out>, com=3223348326, 
    data=<unavailable>, active_cred=<unavailable>, td=0xfffffe013480b020)
    at /usr/src/sys/sys/file.h:364
#20 kern_ioctl (td=<optimized out>, td@entry=0xfffffe013480b020, 
    fd=<optimized out>, com=com@entry=3223348326, data=<unavailable>, 
    data@entry=0xfffffe01311a8d50 "\003")
    at /usr/src/sys/kern/sys_generic.c:803
#21 0xffffffff80c771d6 in sys_ioctl (td=0xfffffe013480b020, 
    td@entry=<error reading variable: value is not available>, 
    uap=0xfffffe013480b410, 
    uap@entry=<error reading variable: value is not available>)
    at /usr/src/sys/kern/sys_generic.c:711
#22 0xffffffff810c93be in syscallenter (td=<optimized out>)
    at /usr/src/sys/amd64/amd64/../../kern/subr_syscall.c:189
#23 amd64_syscall (td=0xfffffe013480b020, traced=0)
    at /usr/src/sys/amd64/amd64/trap.c:1191
#24 <signal handler called>
#25 0x0000027a426f501a in ?? ()
Backtrace stopped: Cannot access memory at address 0x7fffde617ec8
(kgdb)
Comment 2 Graham Perrin freebsd_committer freebsd_triage 2022-01-13 03:03:43 UTC
Created attachment 230972 [details]
core.txt.2 is too large for Bugzilla; compressed

Unread portion of the kernel message buffer:
panic: mi_switch: switch in a critical section
cpuid = 1
time = 1642032584
KDB: stack backtrace:
db_trace_self_wrapper() at db_trace_self_wrapper+0x2b/frame 0xfffffe01982543a0
vpanic() at vpanic+0x17f/frame 0xfffffe01982543f0
panic() at panic+0x43/frame 0xfffffe0198254450
mi_switch() at mi_switch+0x19a/frame 0xfffffe0198254470
__mtx_lock_sleep() at __mtx_lock_sleep+0x1d9/frame 0xfffffe0198254500
__mtx_lock_flags() at __mtx_lock_flags+0xe5/frame 0xfffffe0198254550
linux_wake_up() at linux_wake_up+0x38/frame 0xfffffe01982545a0
radeon_fence_is_signaled() at radeon_fence_is_signaled+0x9b/frame 0xfffffe01982545f0
dma_resv_add_shared_fence() at dma_resv_add_shared_fence+0x8a/frame 0xfffffe0198254640
ttm_eu_fence_buffer_objects() at ttm_eu_fence_buffer_objects+0x6a/frame 0xfffffe0198254670
radeon_cs_parser_fini() at radeon_cs_parser_fini+0x53/frame 0xfffffe01982546a0
radeon_cs_ioctl() at radeon_cs_ioctl+0x788/frame 0xfffffe0198254b20
drm_ioctl_kernel() at drm_ioctl_kernel+0xc7/frame 0xfffffe0198254b70
drm_ioctl() at drm_ioctl+0x2c4/frame 0xfffffe0198254c60
linux_file_ioctl() at linux_file_ioctl+0x30a/frame 0xfffffe0198254cc0
kern_ioctl() at kern_ioctl+0x202/frame 0xfffffe0198254d30
sys_ioctl() at sys_ioctl+0x126/frame 0xfffffe0198254e00
amd64_syscall() at amd64_syscall+0x12e/frame 0xfffffe0198254f30
fast_syscall_common() at fast_syscall_common+0xf8/frame 0xfffffe0198254f30
--- syscall (54, FreeBSD ELF64, sys_ioctl), rip = 0x109e65a8901a, rsp = 0x7fffdeb1cec8, rbp = 0x7fffdeb1cef0 ---
KDB: enter: panic
Uptime: 20m26s
(ada0:ahcich0:0:0:0): spin-down
Dumping 3540 out of 16265 MB:..1%..11%..21%..31%..41%..51%..61%..71%..81%..91%

__curthread () at /usr/src/sys/amd64/include/pcpu_aux.h:55
55		__asm("movq %%gs:%P1,%0" : "=r" (td) : "n" (offsetof(struct pcpu,
(kgdb) #0  __curthread () at /usr/src/sys/amd64/include/pcpu_aux.h:55
#1  doadump (textdump=textdump@entry=1)
    at /usr/src/sys/kern/kern_shutdown.c:399
#2  0xffffffff80c00ba4 in kern_reboot (howto=260)
    at /usr/src/sys/kern/kern_shutdown.c:487
#3  0xffffffff80c0100e in vpanic (
    fmt=0xffffffff811ac565 "mi_switch: switch in a critical section", 
    ap=<optimized out>) at /usr/src/sys/kern/kern_shutdown.c:920
#4  0xffffffff80c00d63 in panic (fmt=<unavailable>)
    at /usr/src/sys/kern/kern_shutdown.c:844
#5  0xffffffff80c0df5a in mi_switch (flags=flags@entry=259)
    at /usr/src/sys/kern/kern_synch.c:503
#6  0xffffffff80c67eea in turnstile_wait (ts=ts@entry=0xfffff8031e18b600, 
    owner=owner@entry=0xfffffe018cb8bac0, queue=<optimized out>, 
    queue@entry=0) at /usr/src/sys/kern/subr_turnstile.c:817
#7  0xffffffff80bdc659 in __mtx_lock_sleep (c=c@entry=0xfffffe00de6698a8, 
    v=<optimized out>, opts=<optimized out>, opts@entry=0, 
    file=<optimized out>, 
    file@entry=0xffffffff81284276 "/usr/src/sys/compat/linuxkpi/common/src/linux_schedule.c", line=line@entry=207) at /usr/src/sys/kern/kern_mutex.c:668
#8  0xffffffff80bdc405 in __mtx_lock_flags (c=0xfffffe00de6698a8, 
    opts=<unavailable>, 
    file=0xffffffff81284276 "/usr/src/sys/compat/linuxkpi/common/src/linux_schedule.c", line=207) at /usr/src/sys/kern/kern_mutex.c:284
#9  0xffffffff80e7a028 in linux_wake_up (wqh=0xfffffe00de669890, state=3, 
    nr=0, locked=false)
    at /usr/src/sys/compat/linuxkpi/common/src/linux_schedule.c:207
#10 0xffffffff8394520b in radeon_fence_is_signaled ()
   from /boot/modules/radeonkms.ko
#11 0xffffffff83a890ca in dma_resv_add_shared_fence ()
   from /boot/modules/linuxkpi_gplv2.ko
#12 0xffffffff83a96a6a in ttm_eu_fence_buffer_objects ()
   from /boot/modules/ttm.ko
#13 0xffffffff83937513 in radeon_cs_parser_fini ()
   from /boot/modules/radeonkms.ko
#14 0xffffffff83937298 in radeon_cs_ioctl () from /boot/modules/radeonkms.ko
#15 0xffffffff83a2ca97 in drm_ioctl_kernel () from /boot/modules/drm.ko
#16 0xffffffff83a2ce54 in drm_ioctl () from /boot/modules/drm.ko
#17 0xffffffff80e6b7da in linux_file_ioctl_sub (fp=0x1c371, filp=0x1, 
    fop=<optimized out>, cmd=<optimized out>, data=<optimized out>, 
    td=<optimized out>)
    at /usr/src/sys/compat/linuxkpi/common/src/linux_compat.c:1024
#18 linux_file_ioctl (fp=0x1c371, 
    fp@entry=<error reading variable: value is not available>, 
    cmd=<unavailable>, 
    cmd@entry=<error reading variable: value is not available>, 
    data=<unavailable>, 
    data@entry=<error reading variable: value is not available>, 
    cred=<optimized out>, 
    cred@entry=<error reading variable: value is not available>, td=0x0, 
    td@entry=<error reading variable: value is not available>)
    at /usr/src/sys/compat/linuxkpi/common/src/linux_compat.c:1648
#19 0xffffffff80c77482 in fo_ioctl (fp=<optimized out>, com=3223348326, 
    data=<unavailable>, active_cred=<unavailable>, td=0xfffffe01980e3740)
    at /usr/src/sys/sys/file.h:364
#20 kern_ioctl (td=<optimized out>, td@entry=0xfffffe01980e3740, 
    fd=<optimized out>, com=com@entry=3223348326, data=<unavailable>, 
    data@entry=0xfffffe0198254d50 "\003")
    at /usr/src/sys/kern/sys_generic.c:803
#21 0xffffffff80c771d6 in sys_ioctl (td=0xfffffe01980e3740, 
    td@entry=<error reading variable: value is not available>, 
    uap=0xfffffe01980e3b30, 
    uap@entry=<error reading variable: value is not available>)
    at /usr/src/sys/kern/sys_generic.c:711
#22 0xffffffff810c93be in syscallenter (td=<optimized out>)
    at /usr/src/sys/amd64/amd64/../../kern/subr_syscall.c:189
#23 amd64_syscall (td=0xfffffe01980e3740, traced=0)
    at /usr/src/sys/amd64/amd64/trap.c:1191
#24 <signal handler called>
#25 0x0000109e65a8901a in ?? ()
Backtrace stopped: Cannot access memory at address 0x7fffdeb1cec8
(kgdb)
Comment 3 Graham Perrin freebsd_committer freebsd_triage 2022-01-13 10:06:30 UTC
Created attachment 230979 [details]
core.txt.4 panic with drm-current-kmod

Dump header from device: /dev/ada0p2
  Architecture: amd64
  Architecture Version: 2
  Dump Length: 3640209408
  Blocksize: 512
  Compression: none
  Dumptime: 2022-01-13 09:39:25 +0000
  Hostname: mowa219-gjp4-8570p-freebsd
  Magic: FreeBSD Kernel Dump
  Version String: FreeBSD 14.0-CURRENT #15 main-n252381-75d20a5e386: Wed Jan 12 04:39:40 GMT 2022
    root@mowa219-gjp4-8570p-freebsd:/usr/obj/usr/src/amd64.amd64/sys/GENERIC
  Panic String: mi_switch: switch in a critical section
  Dump Parity: 383973225
  Bounds: 4
  Dump Status: good
info.4 (END)
Comment 4 Graham Perrin freebsd_committer freebsd_triage 2022-01-13 10:08:40 UTC
Comment on attachment 230979 [details]
core.txt.4 panic with drm-current-kmod

Dump header from device: /dev/ada0p2
  Architecture: amd64
  Architecture Version: 2
  Dump Length: 3640209408
  Blocksize: 512
  Compression: none
  Dumptime: 2022-01-13 09:39:25 +0000
  Hostname: mowa219-gjp4-8570p-freebsd
  Magic: FreeBSD Kernel Dump
  Version String: FreeBSD 14.0-CURRENT #15 main-n252381-75d20a5e386: Wed Jan 12 04:39:40 GMT 2022
    root@mowa219-gjp4-8570p-freebsd:/usr/obj/usr/src/amd64.amd64/sys/GENERIC
  Panic String: mi_switch: switch in a critical section
  Dump Parity: 383973225
  Bounds: 4
  Dump Status: good
info.4 (END)

----

…
Unread portion of the kernel message buffer:
panic: mi_switch: switch in a critical section
cpuid = 0
time = 1642066765
KDB: stack backtrace:
db_trace_self_wrapper() at db_trace_self_wrapper+0x2b/frame 0xfffffe0196917390
vpanic() at vpanic+0x17f/frame 0xfffffe01969173e0
panic() at panic+0x43/frame 0xfffffe0196917440
mi_switch() at mi_switch+0x19a/frame 0xfffffe0196917460
__mtx_lock_sleep() at __mtx_lock_sleep+0x1d9/frame 0xfffffe01969174f0
__mtx_lock_flags() at __mtx_lock_flags+0xe5/frame 0xfffffe0196917540
linux_wake_up() at linux_wake_up+0x38/frame 0xfffffe0196917590
radeon_fence_is_signaled() at radeon_fence_is_signaled+0x9b/frame 0xfffffe01969175e0
dma_resv_add_shared_fence() at dma_resv_add_shared_fence+0x9a/frame 0xfffffe0196917630
ttm_eu_fence_buffer_objects() at ttm_eu_fence_buffer_objects+0x79/frame 0xfffffe0196917670
radeon_cs_parser_fini() at radeon_cs_parser_fini+0x52/frame 0xfffffe01969176a0
radeon_cs_ioctl() at radeon_cs_ioctl+0x788/frame 0xfffffe0196917b20
drm_ioctl_kernel() at drm_ioctl_kernel+0xc7/frame 0xfffffe0196917b70
drm_ioctl() at drm_ioctl+0x2bf/frame 0xfffffe0196917c60
linux_file_ioctl() at linux_file_ioctl+0x30a/frame 0xfffffe0196917cc0
kern_ioctl() at kern_ioctl+0x202/frame 0xfffffe0196917d30
sys_ioctl() at sys_ioctl+0x126/frame 0xfffffe0196917e00
amd64_syscall() at amd64_syscall+0x12e/frame 0xfffffe0196917f30
fast_syscall_common() at fast_syscall_common+0xf8/frame 0xfffffe0196917f30
--- syscall (54, FreeBSD ELF64, sys_ioctl), rip = 0x38e29d14301a, rsp = 0x1d3eec8, rbp = 0x1d3eef0 ---
KDB: enter: panic
Uptime: 8h54m14s
(ada0:ahcich0:0:0:0): spin-down
Dumping 3471 out of 16265 MB:..1%..11%..21%..31%..41%..51%..61%..71%..81%..91%

__curthread () at /usr/src/sys/amd64/include/pcpu_aux.h:55
55		__asm("movq %%gs:%P1,%0" : "=r" (td) : "n" (offsetof(struct pcpu,
(kgdb) #0  __curthread () at /usr/src/sys/amd64/include/pcpu_aux.h:55
#1  doadump (textdump=textdump@entry=1)
    at /usr/src/sys/kern/kern_shutdown.c:399
#2  0xffffffff80c00ba4 in kern_reboot (howto=260)
    at /usr/src/sys/kern/kern_shutdown.c:487
#3  0xffffffff80c0100e in vpanic (
    fmt=0xffffffff811ac565 "mi_switch: switch in a critical section", 
    ap=<optimized out>) at /usr/src/sys/kern/kern_shutdown.c:920
#4  0xffffffff80c00d63 in panic (fmt=<unavailable>)
    at /usr/src/sys/kern/kern_shutdown.c:844
#5  0xffffffff80c0df5a in mi_switch (flags=flags@entry=259)
    at /usr/src/sys/kern/kern_synch.c:503
#6  0xffffffff80c67eea in turnstile_wait (ts=ts@entry=0xfffff8020abcbc00, 
    owner=owner@entry=0xfffffe018636d000, queue=<optimized out>, 
    queue@entry=0) at /usr/src/sys/kern/subr_turnstile.c:817
#7  0xffffffff80bdc659 in __mtx_lock_sleep (c=c@entry=0xfffffe01224049b0, 
    v=<optimized out>, opts=<optimized out>, opts@entry=0, 
    file=<optimized out>, 
    file@entry=0xffffffff81284276 "/usr/src/sys/compat/linuxkpi/common/src/linux_schedule.c", line=line@entry=207) at /usr/src/sys/kern/kern_mutex.c:668
#8  0xffffffff80bdc405 in __mtx_lock_flags (c=0xfffffe01224049b0, 
    opts=<unavailable>, 
    file=0xffffffff81284276 "/usr/src/sys/compat/linuxkpi/common/src/linux_schedule.c", line=207) at /usr/src/sys/kern/kern_mutex.c:284
#9  0xffffffff80e7a028 in linux_wake_up (wqh=0xfffffe0122404998, state=3, 
    nr=0, locked=false)
    at /usr/src/sys/compat/linuxkpi/common/src/linux_schedule.c:207
#10 0xffffffff839434fb in radeon_fence_is_signaled ()
   from /boot/modules/radeonkms.ko
#11 0xffffffff83a8254a in dma_resv_add_shared_fence ()
   from /boot/modules/linuxkpi_gplv2.ko
#12 0xffffffff83a90f49 in ttm_eu_fence_buffer_objects ()
   from /boot/modules/ttm.ko
#13 0xffffffff83935e82 in radeon_cs_parser_fini ()
   from /boot/modules/radeonkms.ko
#14 0xffffffff83935c08 in radeon_cs_ioctl () from /boot/modules/radeonkms.ko
#15 0xffffffff83a282d7 in drm_ioctl_kernel () from /boot/modules/drm.ko
#16 0xffffffff83a2868f in drm_ioctl () from /boot/modules/drm.ko
#17 0xffffffff80e6b7da in linux_file_ioctl_sub (fp=0x1d3024, filp=0x1, 
    fop=<optimized out>, cmd=<optimized out>, data=<optimized out>, 
    td=<optimized out>)
    at /usr/src/sys/compat/linuxkpi/common/src/linux_compat.c:1024
#18 linux_file_ioctl (fp=0x1d3024, 
    fp@entry=<error reading variable: value is not available>, 
    cmd=<unavailable>, 
    cmd@entry=<error reading variable: value is not available>, 
    data=<unavailable>, 
    data@entry=<error reading variable: value is not available>, 
    cred=<optimized out>, 
    cred@entry=<error reading variable: value is not available>, td=0x0, 
    td@entry=<error reading variable: value is not available>)
    at /usr/src/sys/compat/linuxkpi/common/src/linux_compat.c:1648
#19 0xffffffff80c77482 in fo_ioctl (fp=<optimized out>, com=3223348326, 
    data=<unavailable>, active_cred=<unavailable>, td=0xfffffe0196b793a0)
    at /usr/src/sys/sys/file.h:364
#20 kern_ioctl (td=<optimized out>, td@entry=0xfffffe0196b793a0, 
    fd=<optimized out>, com=com@entry=3223348326, data=<unavailable>, 
    data@entry=0xfffffe0196917d50 "\003")
    at /usr/src/sys/kern/sys_generic.c:803
#21 0xffffffff80c771d6 in sys_ioctl (td=0xfffffe0196b793a0, 
    td@entry=<error reading variable: value is not available>, 
    uap=0xfffffe0196b79790, 
    uap@entry=<error reading variable: value is not available>)
    at /usr/src/sys/kern/sys_generic.c:711
#22 0xffffffff810c93be in syscallenter (td=<optimized out>)
    at /usr/src/sys/amd64/amd64/../../kern/subr_syscall.c:189
#23 amd64_syscall (td=0xfffffe0196b793a0, traced=0)
    at /usr/src/sys/amd64/amd64/trap.c:1191
#24 <signal handler called>
#25 0x000038e29d14301a in ?? ()
Backtrace stopped: Cannot access memory at address 0x1d3eec8
(kgdb) 
…
Comment 5 Graham Perrin freebsd_committer freebsd_triage 2022-01-13 12:34:47 UTC
(In reply to Graham Perrin from comment #3)

Given the panic with    drm-current-kmod    built, packaged and installed from 
source, I decided to (temporarily) downgrade to drm-current-kmod-5.4.144.g20211012
built from 61b661339366b6ee95ca1de0667979da9240c6b8 (2021-10-25). 

----

Maybe worth mentioning, at the times of the panics I had: 

% sysrc -f /etc/rc.conf kld_list
kld_list: fusefs radeonkms if_iwlwifi
% 

– loaded, however I was not actually using the driver (no compatible hardware at the moment). 

No longer. I'm back to just    fusefs radeonkms

----

Also, I nearly always build my CURRENT with GENERIC-NODEBUG. 

Unusually, I'm using GENERIC at the moment. 

----

Let's see how this goes for a few hours, days …


% date ; uptime ; pkg info -x drm-kmod drm-current-kmod drm-devel-kmod gpu-firmware-kmod
Thu 13 Jan 2022 12:14:37 GMT
12:14p.m.  up 14 mins, 5 users, load averages: 2.47, 3.54, 2.61
drm-kmod-g20190710_1
drm-current-kmod-5.4.144.g20211012
pkg: No package(s) matching drm-devel-kmod
gpu-firmware-kmod-g20210330
% pkg info drm-current-kmod
drm-current-kmod-5.4.144.g20211012
Name           : drm-current-kmod
Version        : 5.4.144.g20211012
Installed on   : Thu Jan 13 11:31:10 2022 GMT
Origin         : graphics/drm-current-kmod
Architecture   : FreeBSD:14:amd64
Prefix         : /usr/local
Categories     : graphics kld
Licenses       : BSD2CLAUSE, MIT, GPLv2
Maintainer     : x11@FreeBSD.org
WWW            : https://github.com/freebsd/drm-kmod/
Comment        : DRM modules for the linuxkpi-based KMS components
Options        :
        DEBUG          : off
        SOURCE         : off
Annotations    :
        FreeBSD_version: 1400046
        build_timestamp: 2022-01-13T10:42:12+0000
        built_by       : poudriere-git-3.3.99.20211130
        port_checkout_unclean: no
        port_git_hash  : 4519b9e814
        ports_top_checkout_unclean: yes
        ports_top_git_hash: 549b682dc1
        repo_type      : binary
        repository     : poudriere
Flat size      : 10.9MiB
Description    :
amdgpu, i915, and radeon DRM modules for the linuxkpi-based KMS components.
Currently corresponding to Linux 5.4.114 DRM.
This version is for FreeBSD CURRENT.

WWW: https://github.com/freebsd/drm-kmod/
% uname -aKU
FreeBSD mowa219-gjp4-8570p-freebsd 14.0-CURRENT FreeBSD 14.0-CURRENT #15 main-n252381-75d20a5e386: Wed Jan 12 04:39:40 GMT 2022     root@mowa219-gjp4-8570p-freebsd:/usr/obj/usr/src/amd64.amd64/sys/GENERIC  amd64 1400047 1400047
%
Comment 6 Vladimir Kondratyev freebsd_committer freebsd_triage 2022-01-13 23:55:34 UTC
Please test https://reviews.freebsd.org/D33887 and https://reviews.freebsd.org/D33888
Comment 7 Graham Perrin freebsd_committer freebsd_triage 2022-01-14 00:37:53 UTC
(In reply to Vladimir Kondratyev from comment #6)

Thank you! Will do.
Comment 8 Graham Perrin freebsd_committer freebsd_triage 2022-01-14 09:12:49 UTC
(In reply to Vladimir Kondratyev from comment #6)

With <https://reviews.freebsd.org/D33887#766378>, would you still like me to test (pre-landing)?

I made two or three attempts to build, each one was interrupted by a panic. 

(My bad. I weeded too many recent boot environments, didn't have handy any non-recent BE that was prepared for this type of thing.)
Comment 9 Graham Perrin freebsd_committer freebsd_triage 2022-01-14 23:58:23 UTC
(In reply to Vladimir Kondratyev from comment #6)

Testing. Thanks, everyone. 

Up for four hours, panic-free, with: 

* patched n252450-5efa7281a79

* drm-devel-kmod-5.5.19.g20211230


Prior to patching: 

* the shortest bugged uptime was probably less than ten minutes
  (maybe panictastic when setting a particular combination of 
  compositor preferences in KDE Plasma)

* the longest bugged uptime was around ten-and-a-half hours 
  (a panic not long after 19:22:25 GMT completion of buildkernel).


----

% grep "if (unlikely(curthread->td_critnest != 0))" /usr/src/sys/compat/linuxkpi/common/include/linux/spinlock.h
        if (unlikely(curthread->td_critnest != 0))      \
% grep "spin_lock_irqsave(&wqh->lock, flags);" /usr/src/sys/compat/linuxkpi/common/src/linux_schedule.c
                spin_lock_irqsave(&wqh->lock, flags);
% date ; uptime
Fri 14 Jan 2022 23:38:02 GMT
11:38p.m.  up  3:43, 5 users, load averages: 0.67, 0.84, 0.88
% bectl list -c creation
BE                    Active Mountpoint Space Created
n250511-5f73b3338ee-d -      -          8.11M 2021-11-13 15:43
n252381-75d20a5e386-a -      -          6.29G 2022-01-12 07:44
n252381-75d20a5e386-b -      -          20.1M 2022-01-12 23:23
n250511-5f73b3338ee-e -      -          14.6G 2022-01-14 06:59
n252450-5efa7281a79-a NR     /          95.3G 2022-01-14 19:27
% grep BOOT /var/log/messages
% zgrep BOOT /var/log/messages.0.bz2
Jan 14 07:15:26 mowa219-gjp4-8570p-freebsd kernel: ---<<BOOT>>---
Jan 14 07:45:47 mowa219-gjp4-8570p-freebsd kernel: ---<<BOOT>>---
Jan 14 08:40:58 mowa219-gjp4-8570p-freebsd kernel: ---<<BOOT>>---
Jan 14 08:51:29 mowa219-gjp4-8570p-freebsd kernel: ---<<BOOT>>---
Jan 14 19:37:55 mowa219-gjp4-8570p-freebsd kernel: ---<<BOOT>>---
Jan 14 19:55:27 mowa219-gjp4-8570p-freebsd kernel: ---<<BOOT>>---
Jan 14 19:55:28 mowa219-gjp4-8570p-freebsd kernel: ---<<BOOT>>---
% uname -aKU
FreeBSD mowa219-gjp4-8570p-freebsd 14.0-CURRENT FreeBSD 14.0-CURRENT #16 main-n252450-5efa7281a79-dirty: Fri Jan 14 18:59:09 GMT 2022     root@mowa219-gjp4-8570p-freebsd:/usr/obj/usr/src/amd64.amd64/sys/GENERIC  amd64 1400047 1400047
% bectl destroy -o n250511-5f73b3338ee-e
cannot promote 'august/ROOT/n250511-5f73b3338ee-d': permission denied
cannot destroy mounted boot env unless forced
% su -
Password:
root@mowa219-gjp4-8570p-freebsd:~ # bectl destroy -o n250511-5f73b3338ee-e
snapshot has clones
root@mowa219-gjp4-8570p-freebsd:~ # bectl list -s -c creation
BE/Dataset/Snapshot                                         Active Mountpoint Space Created

n250511-5f73b3338ee-d
  august/ROOT/n250511-5f73b3338ee-d                         -      -          9.21M 2021-11-13 15:43
    august/ROOT/n252450-5efa7281a79-a@2021-11-14-00:24:29-0 -      -          4.93G 2021-11-14 00:24
  n250511-5f73b3338ee-d@2022-01-14-06:59:29-0               -      -          3.28M 2022-01-14 06:59

n252381-75d20a5e386-a
  august/ROOT/n252381-75d20a5e386-a                         -      -          56.1M 2022-01-12 07:44
    august/ROOT/n252450-5efa7281a79-a@2022-01-12-23:23:17-0 -      -          6.23G 2022-01-12 23:23

n252381-75d20a5e386-b
  august/ROOT/n252381-75d20a5e386-b                         -      -          1.05M 2022-01-12 23:23
    august/ROOT/n252450-5efa7281a79-a@2022-01-14-19:27:21-0 -      -          19.0M 2022-01-14 19:27

n252450-5efa7281a79-a
  august/ROOT/n252450-5efa7281a79-a                         NR     /          95.3G 2022-01-14 19:27
  n252450-5efa7281a79-a@2021-07-10-04:31:39-0               -      -          13.8G 2021-07-10 04:31
  n252450-5efa7281a79-a@2021-11-13-15:43:33-0               -      -          4.94G 2021-11-13 15:43
  n252450-5efa7281a79-a@2021-11-14-00:24:29-0               -      -          4.93G 2021-11-14 00:24
  n252450-5efa7281a79-a@2022-01-12-23:23:17-0               -      -          6.23G 2022-01-12 23:23
  n252450-5efa7281a79-a@2022-01-14-19:27:21-0               -      -          19.0M 2022-01-14 19:27
root@mowa219-gjp4-8570p-freebsd:~ # bectl destroy -o n252381-75d20a5e386-a
root@mowa219-gjp4-8570p-freebsd:~ # bectl list -s -c creation
BE/Dataset/Snapshot                                         Active Mountpoint Space Created

n250511-5f73b3338ee-d
  august/ROOT/n250511-5f73b3338ee-d                         -      -          9.21M 2021-11-13 15:43
    august/ROOT/n252450-5efa7281a79-a@2021-11-14-00:24:29-0 -      -          4.93G 2021-11-14 00:24
  n250511-5f73b3338ee-d@2022-01-14-06:59:29-0               -      -          3.28M 2022-01-14 06:59

n252381-75d20a5e386-b
  august/ROOT/n252381-75d20a5e386-b                         -      -          1.05M 2022-01-12 23:23
    august/ROOT/n252450-5efa7281a79-a@2022-01-14-19:27:21-0 -      -          1.01G 2022-01-14 19:27

n252450-5efa7281a79-a
  august/ROOT/n252450-5efa7281a79-a                         NR     /          89.1G 2022-01-14 19:27
  n252450-5efa7281a79-a@2021-07-10-04:31:39-0               -      -          13.8G 2021-07-10 04:31
  n252450-5efa7281a79-a@2021-11-13-15:43:33-0               -      -          4.94G 2021-11-13 15:43
  n252450-5efa7281a79-a@2021-11-14-00:24:29-0               -      -          4.93G 2021-11-14 00:24
  n252450-5efa7281a79-a@2022-01-14-19:27:21-0               -      -          1.01G 2022-01-14 19:27
root@mowa219-gjp4-8570p-freebsd:~ # bectl list -c creation
BE                    Active Mountpoint Space Created
n250511-5f73b3338ee-d -      -          4.94G 2021-11-13 15:43
n252381-75d20a5e386-b -      -          1.01G 2022-01-12 23:23
n252450-5efa7281a79-a NR     /          89.1G 2022-01-14 19:27
root@mowa219-gjp4-8570p-freebsd:~ # pkg info -x drm-kmod drm-current-kmod drm-devel-kmod gpu-firmware-kmod
pkg: No package(s) matching drm-kmod
drm-devel-kmod-5.5.19.g20211230
gpu-firmware-kmod-g20210330
root@mowa219-gjp4-8570p-freebsd:~ # pkg info -x drm-current-kmod 
pkg: No package(s) matching drm-current-kmod
root@mowa219-gjp4-8570p-freebsd:~ # pkg info drm-devel-kmod
drm-devel-kmod-5.5.19.g20211230
Name           : drm-devel-kmod
Version        : 5.5.19.g20211230
Installed on   : Fri Jan 14 19:42:00 2022 GMT
Origin         : graphics/drm-devel-kmod
Architecture   : FreeBSD:14:amd64
Prefix         : /usr/local
Categories     : graphics kld
Licenses       : BSD2CLAUSE, MIT, GPLv2
Maintainer     : x11@FreeBSD.org
WWW            : https://github.com/freebsd/drm-kmod
Comment        : DRM modules for the linuxkpi-based KMS components (development version)
Options        :
        DEBUG          : on
Annotations    :
        FreeBSD_version: 1400047
Flat size      : 11.4MiB
Description    :
amdgpu, i915, and radeon DRM modules for the linuxkpi-based
KMS components.
Currently corresponding to Linux 5.5.19 DRM.
This version is the development version and only works on FreeBSD CURRENT.

WWW: https://github.com/freebsd/drm-kmod

root@mowa219-gjp4-8570p-freebsd:~ # exit
logout
% uptime
11:46p.m.  up  3:52, 5 users, load averages: 0.43, 0.77, 0.85
%
Comment 10 Graham Perrin freebsd_committer freebsd_triage 2022-01-17 00:06:49 UTC
Uptime, patched, without a kernel panic: 

forty-one hours, thirty minutes. 


% grep -e BOOT -e suspend /var/log/messages ; date ; uptime
Jan 15 03:10:24 mowa219-gjp4-8570p-freebsd acpi[42973]: suspend at 20220115 03:10:24
Jan 15 06:32:09 mowa219-gjp4-8570p-freebsd kernel: ---<<BOOT>>---
Jan 15 12:04:21 mowa219-gjp4-8570p-freebsd acpi[26301]: suspend at 20220115 12:04:21
Mon 17 Jan 2022 00:03:02 GMT
12:03a.m.  up 1 day, 17:30, 5 users, load averages: 4.03, 4.39, 4.53
% 


The sleep at 12:04 on 15th January was for test purposes. Slept for around ninety seconds before I woke the computer. 

Entirely problem-free.
Comment 11 Graham Perrin freebsd_committer freebsd_triage 2022-01-17 06:39:02 UTC
(In reply to Vladimir Kondratyev from comment #6)

I changed this bug to: 

* base
* bin
* LinuxKPI (not drm/kmod)

– please, is this a better classification?
Comment 12 commit-hook freebsd_committer freebsd_triage 2022-01-18 20:15:54 UTC
A commit in branch main references this bug:

URL: https://cgit.FreeBSD.org/src/commit/?id=89889ab470b9f1a1cd36913dd219b78efbf484df

commit 89889ab470b9f1a1cd36913dd219b78efbf484df
Author:     Vladimir Kondratyev <wulf@FreeBSD.org>
AuthorDate: 2022-01-18 20:14:13 +0000
Commit:     Vladimir Kondratyev <wulf@FreeBSD.org>
CommitDate: 2022-01-18 20:14:13 +0000

    LinuxKPI: Allow wake_up to be executed within a critical section

    by replaceing of spin_lock() call with spin_lock_irqsave()

    This fixes following panic in drm-kmod:

    panic: mi_switch: switch in a critical section
    cpuid = 2
    time = 1636939794
    KDB: stack backtrace:
    db_trace_self_wrapper() at db_trace_self_wrapper+0x2b
    vpanic() at vpanic+0x187
    panic() at panic+0x43
    mi_switch() at mi_switch+0x198
    __mtx_lock_sleep() at __mtx_lock_sleep+0x1c9
    __mtx_lock_flags() at __mtx_lock_flags+0xa2
    linux_wake_up() at linux_wake_up+0x38
    __active_retire() at __active_retire+0xb7
    dma_fence_signal() at dma_fence_signal+0x100
    dma_resv_add_shared_fence() at dma_resv_add_shared_fence+0x96
    i915_gem_do_execbuffer() at i915_gem_do_execbuffer+0x11d0
    i915_gem_execbuffer2_ioctl() at i915_gem_execbuffer2_ioctl+0x19a
    drm_ioctl_kernel() at drm_ioctl_kernel+0x72
    drm_ioctl() at drm_ioctl+0x2c4
    linux_file_ioctl() at linux_file_ioctl+0x297
    kern_ioctl() at kern_ioctl+0x1dc
    sys_ioctl() at sys_ioctl+0x124
    amd64_syscall() at amd64_syscall+0x124
    fast_syscall_common() at fast_syscall_common+0xf8
    --- syscall (54, FreeBSD ELF64, sys_ioctl)

    MFC after:      1 week
    Reviewed by:    manu
    Reported by:    Graham Perrin <grahamperrin_AT_gmail_DOT_com>
    PR:             261166
    Differential Revision:  https://reviews.freebsd.org/D33888

 sys/compat/linuxkpi/common/src/linux_schedule.c | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)
Comment 13 Graham Perrin freebsd_committer freebsd_triage 2022-01-19 07:12:17 UTC
Another commit in branch main references this bug:

<https://github.com/freebsd/freebsd-src/commit/02ea6033020e11afec6472bf560b0ddebd0fa97a>

<https://cgit.freebsd.org/src/commit/?id=02ea6033020e11afec6472bf560b0ddebd0fa97a>

author    Vladimir Kondratyev <wulf@𡀦…>	2022-01-18 20:14:12 +0000
committer Vladimir Kondratyev <wulf@…>	2022-01-18 20:14:12 +0000
commit    02ea6033020e11afec6472bf560b0ddebd0fa97a 

LinuxKPI: Allow spin_lock_irqsave to be called within a critical section with spinning on spin_trylock. dma-buf part of drm-kmod depends on this property and absence of it support results in "mi_switch: switch in a critical section" assertions [1][2].

[1] https://github.com/freebsd/drm-kmod/issues/116
[2] https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=261166

MFC after:	1 week
Reviewed by:	manu
Differential Revision:	https://reviews.freebsd.org/D33887
Comment 14 Graham Perrin freebsd_committer freebsd_triage 2022-10-02 15:17:30 UTC
MFC? 

One week was estimated in comment 12 and comment 13. 

Thanks
Comment 15 Vladimir Kondratyev freebsd_committer freebsd_triage 2022-10-02 15:35:02 UTC
The commits are reverted. No MFC though.

The bug was fixed on dma-buf side with elimination of critical section.

Closing this.
Comment 16 Graham Perrin freebsd_committer freebsd_triage 2022-10-02 18:09:04 UTC
(In reply to Vladimir Kondratyev from comment #15)

Thanks for the explanation 👍