kern/49195: drm2 panic in i915_gem.c

[apb%cequrux.com@localhost]

>Number:         49195
>Category:       kern
>Synopsis:       drm2 panic in i915_gem.c
>Confidential:   no
>Severity:       critical
>Priority:       medium
>Responsible:    kern-bug-people
>State:          open
>Class:          sw-bug
>Submitter-Id:   net
>Arrival-Date:   Thu Sep 11 10:55:00 +0000 2014
>Originator:     Alan Barrett
>Release:        NetBSD 7.99.1
>Organization:
Not much
>Environment:
NetBSD 7.99.1 i386
>Description:
I have seen this panic a few times.

kernel diagnostic assertion "!(obj->base.write_domain & ~(0x00000002 | 
0x00000004 | 0x00000008 | 0x00000010 | 0x00000020))" failed: file 
"src/sys/external/bsd/drm2/dist/drm/i915/i915_gem.c", line 2833

Here's a backtrace from gdb:

#10 0xc098c611 in vpanic (fmt=<optimized out>, ap=<optimized out>)
    at src/sys/kern/subr_prf.c:338
#11 0xc0b6489b in kern_assert (
    fmt=0xc0db35b6 "kernel %sassertion \"%s\" failed: file \"%s\", line %d ")
    at src/sys/lib/libkern/kern_assert.c:51
#12 0xc03fabf3 in i915_gem_object_move_to_inactive (obj=<optimized out>)
    at src/sys/external/bsd/drm2/dist/drm/i915/i915_gem.c:2833
#13 0xc03f6b3b in i915_gem_retire_requests_ring (ring=0xc49ea344)
    at src/sys/external/bsd/drm2/dist/drm/i915/i915_gem.c:3228
#14 0xc03f8910 in i915_gem_object_flush_active (obj=<optimized out>)
    at src/sys/external/bsd/drm2/dist/drm/i915/i915_gem.c:3326
#15 i915_gem_busy_ioctl (dev=<optimized out>, data=<optimized out>,
    file=<optimized out>)
    at src/sys/external/bsd/drm2/dist/drm/i915/i915_gem.c:4803
#16 0xc02f170e in drm_ioctl (fp=0xc6709500, cmd=3221775447, data=0x0)
    at src/sys/external/bsd/drm2/drm/drm_drv.c:664
#17 0xc09a7f0a in sys_ioctl (l=<optimized out>, uap=0x0, retval=0xdebbbf88)
    at src/sys/kern/sys_generic.c:681
#18 0xc09b3de4 in sy_call (sy=<unavailable>, l=<optimized out>,
    uap=<optimized out>, rval=<optimized out>)
    at src/sys/sys/syscallvar.h:61
#19 sy_invoke (sy=<unavailable>, l=<optimized out>, code=54,
    uap=<optimized out>, rval=<optimized out>)
    at src/sys/sys/syscallvar.h:85
#20 syscall (frame=<optimized out>)
    at src/sys/arch/x86/x86/syscall.c:156
#21 0xc01005cd in Xsyscall ()
#22 0xdebbbfa8 in ?? ()
Backtrace stopped: previous frame inner to this frame (corrupt stack?)

>How-To-Repeat:
Have an i386 kernel with drm2.  Use X11 for a while.  I don't know
how to replicate the problem, but I have seen it a few times.

>Fix: