kern/49710: i386 radeondrmkms panic when starting Xorg

[jdbaker%mylinuxisp.com@localhost]

>Number:         49710
>Category:       kern
>Synopsis:       i386 radeondrmkms panic when starting Xorg
>Confidential:   no
>Severity:       serious
>Priority:       high
>Responsible:    kern-bug-people
>State:          open
>Class:          sw-bug
>Submitter-Id:   net
>Arrival-Date:   Mon Mar 02 00:25:00 +0000 2015
>Originator:     John D. Baker
>Release:        NetBSD/i386-7.99.5 (and 7.0_BETA)
>Organization:
>Environment:
NetBSD slab 7.99.5 NetBSD 7.99.5 (SLAB_KMS) #7: Sun Mar  1 14:17:39 CST 2015  sysop%skuld.technoskunk.fur@localhost:/d0/build/current/obj/i386/sys/arch/i386/compile/SLAB_KMS i386

>Description:
i386 radeondrmkms kernel panics when starting Xorg.  dmesg excerpt and
panic messages from serial console:

NetBSD 7.99.5 (SLAB_KMS) #7: Sun Mar  1 14:17:39 CST 2015
        sysop%skuld.technoskunk.fur@localhost:/d0/build/current/obj/i386/sys/arch/i386/compile/SLAB_KMS
[...]
com0 at acpi0 (UART, PNP0501): io 0x3f8-0x3ff irq 4   
com: ns16550a, working fifo                        
com0: console              
[...]
acpivga0 at acpi0 (VID): ACPI Display Adapter
acpiout0 at acpivga0 (LCD0, 0x0110): ACPI Display Output Device
acpiout1 at acpivga0 (CRT0, 0x0100): ACPI Display Output Device
acpiout2 at acpivga0 (TV0, 0x0200): ACPI Display Output Device 
acpiout3 at acpivga0 (DVI0, 0x0210): ACPI Display Output Device
[...]
pchb0 at pci0 dev 0 function 0: Intel 82845 Host (rev. 0x04)
agp0 at pchb0: aperture at 0xe0000000, size 0x4000000       
ppb0 at pci0 dev 1 function 0: Intel 82845 AGP (rev. 0x04)
pci1 at ppb0 bus 1                                        
radeon0 at pci1 dev 0 function 0: ATI Technologies FireGL Mobility 7800 M7 LX (rev. 0x00)
[...]
drm: initializing kernel modesetting (RV200 0x1002:0x4C58 0x1014:0x0518).
drm: register mmio base: 0xd0100000                                      
drm: register mmio size: 65536     
radeon0: info: GTT: 64M 0xE0000000 - 0xE3FFFFFF
radeon0: info: VRAM: 128M 0x00000000E8000000 - 0x00000000EFFFFFFF (64M used)
drm: Detected VRAM RAM=80M, BAR=128M                                        
drm: RAM width 128bits DDR          
Zone  kernel: Available graphics memory: 801196 kiB
drm: radeon: 64M of VRAM memory ready              
drm: radeon: 64M of GTT memory ready.
radeon0: info: WB disabled           
radeon0: info: fence driver on ring 0 use gpu addr 0x00000000e0000000 and cpu addr 0x0xdb4f0000
drm: Supports vblank timestamp caching Rev 2 (21.10.2013).
drm: Driver supports precise vblank timestamp query.      
radeon0: interrupting at irq 9 (radeon)             
drm: radeon: irq initialized.          
drm: Loading R100 Microcode  
drm: radeon: ring at 0x00000000E0001000
drm: ring test succeeded in 0 usecs    
drm: ib test succeeded in 0 usecs  
drm: Panel ID String: 1600x1200               
drm: Panel Size 1600x1200                     
drm: No TV DAC info found in BIOS
drm: Radeon Display Connectors   
drm: Connector 0:             
drm:   VGA-1     
drm:   DDC: 0x60 0x60 0x60 0x60 0x60 0x60 0x60 0x60
drm:   Encoders:                                   
drm:     CRT1: INTERNAL_DAC1
drm: Connector 1:           
drm:   DVI-D-1   
drm:   HPD1   
drm:   DDC: 0x64 0x64 0x64 0x64 0x64 0x64 0x64 0x64
drm:   Encoders:                                   
drm:     DFP1: INTERNAL_TMDS1
drm: Connector 2:            
drm:   LVDS-1    
drm:   Encoders:
drm:     LCD1: INTERNAL_LVDS
drm: Connector 3:           
drm:   SVIDEO-1  
drm:   Encoders:
drm:     TV1: INTERNAL_DAC2
radeondrmkmsfb0 at radeon0 
radeon0: info: registered panic notifier
wsdisplay0 at radeondrmkmsfb0 kbdmux 1  
[...]
[startx]
panic: kernel diagnostic assertion "ttm->caching_state == tt_cached" failed: file "/x/current/src/sys/external/bsd/drm2/dist/drm/ttm/ttm_tt.c", line 423 
fatal breakpoint trap in supervisor mode                                 
trap type 1 code 0 eip c02516b4 cs 8 eflags 3246 cr2 ba76f000 ilevel 0 esp dbeacd08
curlwp 0xc3802800 pid 235 lid 1 lowest kstack 0xdbeaa2c0
Stopped in pid 235.1 (Xorg) at  netbsd:breakpoint+0x4:  popl    %ebp
db{0}> bt                                                           
breakpoint(c097a3fe,c0b72e00,c095f884,dbeacd24,c4040308,c40402a8,7000,dbeacd18,c
0894093,c095f884) at netbsd:breakpoint+0x4                                     
vpanic(c095f884,dbeacd24,dbeacd3c,c07530b8,c095f884,c095fa35,c09d390c,c09d3890,1
a7,c4040308) at netbsd:vpanic+0x127                                            
kern_assert(c095f884,c095fa35,c09d390c,c09d3890,1a7,c4040308,c40402a8,dbeacd68,c
0751d40,c4040308) at netbsd:kern_assert+0x23                                   
ttm_tt_swapout(c4040308,0,c4040308,c48289fc,2,dbeacd78,c4040308,c48289fc,2,dbeac
d78) at netbsd:ttm_tt_swapout+0x148                                            
ttm_bus_dma_unpopulate(c4040308,c48289fc,dbeacd8c,c074cb31,c4040308,0,c4828a40,d
beacdd0,c074de6c,0) at netbsd:ttm_bus_dma_unpopulate+0x40                      
ttm_tt_destroy(c4040308,0,c4828a40,dbeacdd0,c074de6c,0,0,0,1,c4828a40) at netbsd
:ttm_tt_destroy+0x49                                                           
ttm_bo_cleanup_memtype_use(0,0,0,1,c4828a40,1,0,c3aecee5,c325cb0c,c0b1f980) at n
etbsd:ttm_bo_cleanup_memtype_use+0x41                                          
ttm_bo_release(c4828a40,0,0,1,c4828b58,dbeacdfc,c061ace0,dbeacdf8,c48289cc,dbeac
e24) at netbsd:ttm_bo_release+0x28c                                            
radeon_bo_unref(dbeacdf8,c48289cc,dbeace24,c0291df2,c4828b58,ffffffff,c029cab5,c
4828ba0,c4756488,c3c58518) at netbsd:radeon_bo_unref+0x40                      
radeon_gem_object_free(c4828b58,ffffffff,c029cab5,c4828ba0,c4756488,c3c58518,c3c
58544,c4828b58,dbeace44,c0292217) at netbsd:radeon_gem_object_free+0x20        
drm_gem_object_handle_unreference_unlocked(c4828b58,c3c58518,c374f70c,c08e8614,c
3c58518,c374f70c,dbeace70,c028b1dd,c3c58518,7) at netbsd:drm_gem_object_handle_u
nreference_unlocked+0x92                                                       
drm_gem_handle_delete(c3c58518,7,c3c58518,dbeace74,c06f3b3c,1,dbeacf68,c47ff500,
0,dbeacf3c) at netbsd:drm_gem_handle_delete+0x87                               
drm_ioctl(c47ff500,80086409,dbeaceb0,e020806f,c4781168,c1bc200c,1,0,8,0) at netb
sd:drm_ioctl+0x11d                                                             
sys_ioctl(c3802800,dbeacf68,dbeacf60,c36101a8,0,c0b126c8,dbeacf68,0,0,b) at netb
sd:sys_ioctl+0x1ae                                                             
syscall() at netbsd:syscall+0x82
--- syscall (number 54) ---     
bb77af77:                  
db{0}> sh reg
ds          c06f0010    extent_insert_and_optimize.isra.0+0x70
es          dbea0010                                          
fs          30      
gs          c0950010    kmem_cache_sizes+0xd0
edi         dbeacd24                         
esi         c095f884    ostype+0x9e7
ebp         dbeacce4                
ebx         104     
edx         1  
ecx         0
eax         1
eip         c02516b4    breakpoint+0x4
cs          8                         
eflags      3246
esp         dbeacce4
ss          10      
netbsd:breakpoint+0x4:  popl    %ebp
db{0}>

>How-To-Repeat:
With no "xorg.conf" or an "xorg.conf" without the "NoAccel" option,
attempt to start Xorg on an i386 system that uses radeondrmkms.
>Fix:
Workaround:  Create minimal "xorg.conf" with "NoAccel" option:

Section "Device"
        Option          "NoAccel"       "True"
        Identifier      "Card0"
        Driver          "radeon"
EndSection

This will prevent the panic but multimedia applications will basically
fail to perform w/o acceleration.