Re: Strange crash of DIAGNOSTIC kernel on cv_destroy(9)

[PHO <pho%cielonegro.org@localhost>]

On 7/22/23 22:41, Taylor R Campbell wrote:
> > Date: Sat, 22 Jul 2023 21:52:40 +0900
> > From: PHO <pho%cielonegro.org@localhost>
> >
> > Jul 17 00:52:34 netbsd-current /netbsd: [ 64017.6151161]
> > vmw_fence_wait() at netbsd:vmw_fence_wait+0xdc
>
> Just to confirm, what does `info line *(vmw_fence_wait+0xdc)' say in
> gdb?
>
> And, if you can get to the frame in gdb, what does gdb say &cb.wq is
> in the vmw_fence_wait frame, and what cv is in the cv_destroy frame?
>
> Let's confirm it is the cv you think it is -- I suspect it might be a
> different one.

I just encountered the crash and could obtain a crash dump. It is indeed 
the "DRM_DESTROY_WAITQUEUE(&cb.wq)" in vmw_fence_wait() but the contents 
of cb does not make sense to me:

-----
(gdb) fr 6
#6  vmw_fence_wait (f=0xffffaa67d3170608, intr=<optimized out>,
    timeout=<optimized out>)
    at 
/home/pho/sandbox/_netbsd/src/sys/external/bsd/drm2/dist/drm/vmwgfx/vmwgfx_fence.c:289
289             DRM_DESTROY_WAITQUEUE(&cb.wq);
(gdb) p cb
$11 = {base = {func = 0xffffffff814fbb80 <vmw_fence_ops>, fcb_entry = {
      tqe_next = 0xffffffff80df6a0b <mutex_vector_exit+149>,
      tqe_prev = 0xffffaa675e629238}, fcb_onqueue = 90}, wq = 
{cv_opaque = {
      0x1, 0xffffffff80fa0189 <linux_dma_fence_get_rcu+94>}}}
(gdb) fr 4
#4  0xffffffff80dcdd20 in cv_destroy (cv=cv@entry=0xffffbf8138b44630)
    at /home/pho/sandbox/_netbsd/src/sys/kern/kern_condvar.c:553
553             return !LIST_EMPTY(CV_SLEEPQ(cv));
(gdb) p *cv
$12 = {cv_opaque = {0x1, 0xffffffff80fa0189 <linux_dma_fence_get_rcu+94>}}
-----

CV_SLEEPQ(cv) is 0x01 (wtf) and CV_WMESG(cv) is not even a string? 
Here's the stack trace:

-----
#0  0xffffffff80239c85 in cpu_reboot (howto=howto@entry=260,
    bootstr=bootstr@entry=0x0)
    at /home/pho/sandbox/_netbsd/src/sys/arch/amd64/amd64/machdep.c:717
#1  0xffffffff80e03cee in kern_reboot (howto=howto@entry=260,
    bootstr=bootstr@entry=0x0)
    at /home/pho/sandbox/_netbsd/src/sys/kern/kern_reboot.c:73
#2  0xffffffff80e4c698 in vpanic (
    fmt=0xffffffff815a5cf8 "kernel %sassertion \"%s\" failed: file 
\"%s\", line
%d ", ap=ap@entry=0xffffbf8138b44578)
    at /home/pho/sandbox/_netbsd/src/sys/kern/subr_prf.c:292
#3  0xffffffff81012b8f in kern_assert (
    fmt=fmt@entry=0xffffffff815a5cf8 "kernel %sassertion \"%s\" failed: 
file \"%s\", line %d ")
    at /home/pho/sandbox/_netbsd/src/sys/lib/libkern/kern_assert.c:51
#4  0xffffffff80dcdd20 in cv_destroy (cv=cv@entry=0xffffbf8138b44630)
    at /home/pho/sandbox/_netbsd/src/sys/kern/kern_condvar.c:553
#5  0xffffffff80a72824 in DRM_DESTROY_WAITQUEUE (q=0xffffbf8138b44630)
    at 
/home/pho/sandbox/_netbsd/src/sys/external/bsd/drm2/include/drm/drm_wait_netbsd.h:59
#6  vmw_fence_wait (f=0xffffaa67d3170608, intr=<optimized out>,
    timeout=<optimized out>)
    at 
/home/pho/sandbox/_netbsd/src/sys/external/bsd/drm2/dist/drm/vmwgfx/vmwgfx_fence.c:289
#7  0xffffffff80fa2184 in linux_dma_fence_wait_timeout (
    fence=0xffffaa67d3170608, intr=intr@entry=false,
    timeout=timeout@entry=1500)
    at 
/home/pho/sandbox/_netbsd/src/sys/external/bsd/drm2/linux/linux_dma_fence.c:1005
#8  0xffffffff80fa4c96 in linux_dma_resv_wait_timeout_rcu (
    robj=0xffffaa675e629238, shared=shared@entry=true, 
intr=intr@entry=false,
    timeout=<optimized out>)
    at 
/home/pho/sandbox/_netbsd/src/sys/external/bsd/drm2/linux/linux_dma_resv.c:1213
#9  0xffffffff80fb5671 in ttm_bo_wait (bo=bo@entry=0xffffaa675e629170,
    interruptible=interruptible@entry=false, no_wait=<optimized out>)
    at 
/home/pho/sandbox/_netbsd/src/sys/external/bsd/drm2/dist/drm/ttm/ttm_bo.c:1896
#10 0xffffffff80a815d0 in vmw_resource_unbind_list (
    vbo=vbo@entry=0xffffaa675e629170)
    at 
/home/pho/sandbox/_netbsd/src/sys/external/bsd/drm2/dist/drm/vmwgfx/vmwgfx_resource.c:860
#11 0xffffffff80a6712c in vmw_bo_move_notify 
(bo=bo@entry=0xffffaa675e629170,
    mem=mem@entry=0xffffbf8138b44928)
    at 
/home/pho/sandbox/_netbsd/src/sys/external/bsd/drm2/dist/drm/vmwgfx/vmwgfx_bo.c:1205
#12 0xffffffff80a8a6c7 in vmw_move_notify (bo=0xffffaa675e629170,
    evict=<optimized out>, mem=0xffffbf8138b44928)
    at 
/home/pho/sandbox/_netbsd/src/sys/external/bsd/drm2/dist/drm/vmwgfx/vmwgfx_ttm_buffer.c:933
#13 0xffffffff80fb3505 in ttm_bo_handle_move_mem (
    bo=bo@entry=0xffffaa675e629170, mem=mem@entry=0xffffbf8138b44928,
    evict=evict@entry=true, ctx=ctx@entry=0xffffbf8138b44b00)
    at 
/home/pho/sandbox/_netbsd/src/sys/external/bsd/drm2/dist/drm/ttm/ttm_bo.c:380
#14 0xffffffff80fb4382 in ttm_bo_evict (ctx=0xffffbf8138b44b00,
    bo=0xffffaa675e629170)
    at 
/home/pho/sandbox/_netbsd/src/sys/external/bsd/drm2/dist/drm/ttm/ttm_bo.c:757
#15 ttm_mem_evict_first (bdev=bdev@entry=0xffffaa687f031008,
    mem_type=<optimized out>,
    place=place@entry=0xffffffff814fea78 <mob_placement_flags>,
    ctx=ctx@entry=0xffffbf8138b44b00, 
ticket=ticket@entry=0xffffbf8138b44c98)
    at 
/home/pho/sandbox/_netbsd/src/sys/external/bsd/drm2/dist/drm/ttm/ttm_bo.c:913
#16 0xffffffff80fb4850 in ttm_bo_mem_force_space (ctx=0xffffbf8138b44b00,
    mem=0xffffbf8138b44a58, place=0xffffffff814fea78 <mob_placement_flags>,
    bo=0xffffaa6752dd4b30)
    at 
/home/pho/sandbox/_netbsd/src/sys/external/bsd/drm2/dist/drm/ttm/ttm_bo.c:985
#17 ttm_bo_mem_space (bo=bo@entry=0xffffaa6752dd4b30,
    placement=placement@entry=0xffffffff81a73300 <vmw_mob_placement>,
    mem=mem@entry=0xffffbf8138b44a58, ctx=ctx@entry=0xffffbf8138b44b00)
    at 
/home/pho/sandbox/_netbsd/src/sys/external/bsd/drm2/dist/drm/ttm/ttm_bo.c:1159
#18 0xffffffff80fb4dbd in ttm_bo_move_buffer (ctx=0xffffbf8138b44b00,
    placement=0xffffffff81a73300 <vmw_mob_placement>, 
bo=0xffffaa6752dd4b30)
    at 
/home/pho/sandbox/_netbsd/src/sys/external/bsd/drm2/dist/drm/ttm/ttm_bo.c:1203
#19 ttm_bo_validate (bo=0xffffaa6752dd4b30,
    placement=0xffffffff81a73300 <vmw_mob_placement>, 
ctx=0xffffbf8138b44b00)
    at 
/home/pho/sandbox/_netbsd/src/sys/external/bsd/drm2/dist/drm/ttm/ttm_bo.c:1268
#20 0xffffffff80a8d9d4 in vmw_validation_bo_validate_single (
    bo=bo@entry=0xffffaa6752dd4b30, 
interruptible=interruptible@entry=true,
    validate_as_mob=<optimized out>)
    at 
/home/pho/sandbox/_netbsd/src/sys/external/bsd/drm2/dist/drm/vmwgfx/vmwgfx_validation.c:586
#21 0xffffffff80a8da9c in vmw_validation_bo_validate (
    ctx=ctx@entry=0xffffbf8138b44c50, intr=intr@entry=true)
    at 
/home/pho/sandbox/_netbsd/src/sys/external/bsd/drm2/dist/drm/vmwgfx/vmwgf
x_validation.c:635
#22 0xffffffff80a7151e in vmw_execbuf_process (
    file_priv=file_priv@entry=0xffffaa67a9571608,
    dev_priv=dev_priv@entry=0xffffaa687f031008, 
user_commands=<optimized out>,
    kernel_commands=<optimized out>, kernel_commands@entry=0x0,
    command_size=<optimized out>, throttle_us=<optimized out>,
    dx_context_handle=<optimized out>, user_fence_rep=<optimized out>,
    out_fence=<optimized out>, out_fence@entry=0x0, flags=<optimized out>)
    at 
/home/pho/sandbox/_netbsd/src/sys/external/bsd/drm2/dist/drm/vmwgfx/vmwgfx_execbuf.c:3775
#23 0xffffffff80a72166 in vmw_execbuf_ioctl (dev=<optimized out>,
    data=0xffffbf8138b44ee0, file_priv=0xffffaa67a9571608)
    at 
/home/pho/sandbox/_netbsd/src/sys/external/bsd/drm2/dist/drm/vmwgfx/vmwgfx_execbuf.c:4099
#24 0xffffffff80c6a79c in drm_ioctl (fp=<optimized out>, cmd=<optimized 
out>,
    data=0xffffbf8138b44ee0)
    at 
/home/pho/sandbox/_netbsd/src/sys/external/bsd/drm2/dist/drm/drm_ioctl.c:964
#25 0xffffffff80c35e6e in drm_ioctl_shim (fp=<optimized out>,
    cmd=<optimized out>, data=<optimized out>)
    at 
/home/pho/sandbox/_netbsd/src/sys/external/bsd/drm2/drm/drm_cdevsw.c:391
#26 0xffffffff80e5ee9d in sys_ioctl (l=<optimized out>,
    uap=0xffffbf8138b45000, retval=<optimized out>)
    at /home/pho/sandbox/_netbsd/src/sys/kern/sys_generic.c:675
#27 0xffffffff8059c47e in sy_call (rval=0xffffbf8138b44fb0,
    uap=0xffffbf8138b45000, l=0xffffaa676ac20780,
    sy=0xffffffff81a88ef0 <sysent+1296>)
    at /home/pho/sandbox/_netbsd/src/sys/sys/syscallvar.h:65
#28 sy_invoke (code=54, rval=0xffffbf8138b44fb0, uap=0xffffbf8138b45000,
    l=0xffffaa676ac20780, sy=0xffffffff81a88ef0 <sysent+1296>)
    at /home/pho/sandbox/_netbsd/src/sys/sys/syscallvar.h:94
#29 syscall (frame=0xffffbf8138b45000)
    at /home/pho/sandbox/_netbsd/src/sys/arch/x86/x86/syscall.c:138
#30 0xffffffff8021025d in handle_syscall ()
-----