re: More amd64 drmkms radeon

[matthew green <mrg%eterna.com.au@localhost>]

> Now it panics (and rebuilt the X server with symbols just in case):
> 
> panic: kernel diagnostic assertion "uvm_page_locked_p(pg)" failed: file 
> "../../../../arch/x86/x86/pmap.c", line 3316 
> cpu1: Begin traceback...
> vpanic() at netbsd:vpanic+0x13c
> kern_assert() at netbsd:kern_assert+0x4f
> pmap_remove_pte() at netbsd:pmap_remove_pte+0x2c6
> pmap_remove() at netbsd:pmap_remove+0x1ff
> uvm_unmap_remove() at netbsd:uvm_unmap_remove+0x283
> sys_munmap() at netbsd:sys_munmap+0x8a
> syscall() at netbsd:syscall+0x187
> --- syscall (number 73) ---
> 7f7ff430171a:
> cpu1: End traceback...
> 
> I seem to have acquired a successful kernel core dump too...

this problem is caused by the pmap_remove() taking the pmap->pm_lock,
but the page being removed not being held by that lock, so the assert
that this page is locked failed.  it belongs to a different uobject.

i have no idea why or how to fix it.

i instrumented this a little last weekend, to keep track of the last
few pages being freed via pmap_remove_pte(), and this is what we have:

pmap_remove_pte: not locked pg 0xffff800003401b18 va 0x7f7fecb00000
        opg[0..3] = 0xffff8000038d2548 0xffff8000038d2548 0xffff8000038d2548 
0xffff8000038ca7a8
        opm[0..3] = 0xffffffff80df0ac0 0xffffffff80df0ac0 0xffffffff80df0ac0 
0xffffffff80df0ac0
panic: kernel diagnostic assertion "uvm_page_locked_p(pg)" failed: file 
"/usr/src4/sys/arch/x86/x86/pmap.c", line 3320 pmap_remove_pte: not locked pg 
0xffff800003401b18 va 0x7f7fecb00000
cpu0: Begin traceback...
vpanic() at netbsd:vpanic+0x13c
kern_assert() at netbsd:kern_assert+0x4f
pmap_remove_pte() at netbsd:pmap_remove_pte+0x41a
pmap_remove() at netbsd:pmap_remove+0x1ff
uvm_unmap_remove() at netbsd:uvm_unmap_remove+0x283
sys_munmap() at netbsd:sys_munmap+0x8a
syscall() at netbsd:syscall+0x9a
--- syscall (number 73) ---
7f7ff430171a:
cpu0: End traceback...
fatal breakpoint trap in supervisor mode
trap type 1 code 0 rip ffffffff8021adcd cs 8 rflags 3246 cr2 7f7fefc0b7f8 
ilevel 0 rsp fffffe8045ed5c90
curlwp 0xfffffe80be01f680 pid 107.1 lowest kstack 0xfffffe8045ed22c0
Stopped in pid 107.1 (Xorg) at  netbsd:breakpoint+0x5:  leave
db{0}> show page 0xffff800003401b18
PAGE 0xffff800003401b18:
  flags=0x4<TABLED>, pqflags=0x4<AOBJ>, wire_count=1, pa=0xb45ba000
  uobject=0xfffffe80b4fff508, uanon=0x0, offset=0x0 loan_count=0
  [page ownership tracking disabled]
db{0}> show page 0xffff8000038d2548
PAGE 0xffff8000038d2548:
  flags=0x8c<TABLED,CLEAN,RDONLY>, pqflags=0x200<PRIVATE2>, wire_count=0, 
pa=0xbea14000
  uobject=0xfffffe80bea05820, uanon=0x0, offset=0x10c000 loan_count=0
  [page ownership tracking disabled]
db{0}> show page 0xffff8000038d2548
PAGE 0xffff8000038d2548:
  flags=0x8c<TABLED,CLEAN,RDONLY>, pqflags=0x200<PRIVATE2>, wire_count=0, 
pa=0xbea14000
  uobject=0xfffffe80bea05820, uanon=0x0, offset=0x10c000 loan_count=0
  [page ownership tracking disabled]
db{0}> show object 0xfffffe80b4fff508
OBJECT 0xfffffe80b4fff508: locked=0, pgops=0xffffffff809e1f40, npages=768, 
refs=1
db{0}> show object 0xfffffe80bea05820
OBJECT 0xfffffe80bea05820: locked=0, pgops=0xffffffff809e23c0, npages=1194, 
refs=65