From owner-freebsd-stable@FreeBSD.ORG Mon Dec 18 18:12:08 2006 Return-Path: X-Original-To: freebsd-stable@freebsd.org Delivered-To: freebsd-stable@freebsd.org Received: from mx1.FreeBSD.org (mx1.freebsd.org [69.147.83.52]) by hub.freebsd.org (Postfix) with ESMTP id B2E3C16A403; Mon, 18 Dec 2006 18:12:08 +0000 (UTC) (envelope-from gavin.atkinson@ury.york.ac.uk) Received: from mail-gw4.york.ac.uk (mail-gw4.york.ac.uk [144.32.128.249]) by mx1.FreeBSD.org (Postfix) with ESMTP id 0CA3F43CA2; Mon, 18 Dec 2006 18:12:05 +0000 (GMT) (envelope-from gavin.atkinson@ury.york.ac.uk) Received: from buffy.york.ac.uk (buffy-128.york.ac.uk [144.32.128.160]) by mail-gw4.york.ac.uk (8.13.6/8.13.6) with ESMTP id kBIIBfj8011272; Mon, 18 Dec 2006 18:11:41 GMT Received: from buffy.york.ac.uk (localhost [127.0.0.1]) by buffy.york.ac.uk (8.13.8/8.13.6) with ESMTP id kBIIBf3Y001387; Mon, 18 Dec 2006 18:11:41 GMT (envelope-from gavin.atkinson@ury.york.ac.uk) Received: (from ga9@localhost) by buffy.york.ac.uk (8.13.8/8.13.6/Submit) id kBIIBfqN001386; Mon, 18 Dec 2006 18:11:41 GMT (envelope-from gavin.atkinson@ury.york.ac.uk) X-Authentication-Warning: buffy.york.ac.uk: ga9 set sender to gavin.atkinson@ury.york.ac.uk using -f From: Gavin Atkinson To: freebsd-stable@freebsd.org In-Reply-To: <1166461097.1296.4.camel@buffy.york.ac.uk> References: <1166461097.1296.4.camel@buffy.york.ac.uk> Content-Type: text/plain Content-Transfer-Encoding: 7bit Date: Mon, 18 Dec 2006 18:11:40 +0000 Message-Id: <1166465500.1292.7.camel@buffy.york.ac.uk> Mime-Version: 1.0 X-Mailer: Evolution 2.6.1 FreeBSD GNOME Team Port X-York-MailScanner: Found to be clean X-York-MailScanner-From: gavin.atkinson@ury.york.ac.uk Cc: anholt@freebsd.org Subject: Re: radeon panic: mtx_lock() of destroyed mutex @ /usr/src/sys/modules/drm/radeon/../../../dev/drm/radeon_irq.c:128 X-BeenThere: freebsd-stable@freebsd.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Production branch of FreeBSD source code List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 18 Dec 2006 18:12:08 -0000 On Mon, 2006-12-18 at 16:58 +0000, Gavin Atkinson wrote: > I've determined that this lock has been destroyed even before glxgears > runs - I guess it's just the first attempt at 3D rendering that triggers > it? Indeed, what's happening is that something calls drm_irq_install() in src/sys/dev/drm/drm_irq.c. This code fails to allocate a resource: dev->irqrid = 0; dev->irqr = bus_alloc_resource_any(dev->device, SYS_RES_IRQ, &dev->irqrid, RF_SHAREABLE); The error handler is then called, which destroys the IRQ mutex. This all happens while X is initialising. Later on, when glxgears is run, radeon_wait_irq() in src/sys/dev/drm/radeon_irq.c is called, which does a DRM_WAIT_ON, which tries to acquire the destroyed mutex. So, it looks like there should be some checking somewhere that dev->irq_enabled is non-zero before trying to acquire this mutex. I don't know where it should go, though. Gavin