Re: X.org (AGP) related panic

[Aleksej Saushev <asau%inbox.ru@localhost>]

Aleksej Saushev <asau%inbox.ru@localhost> writes:

> I'm observing reproducable panic with sources as of today,
> ca. 10:45 MSD, no crash dump is generated, system just hangs,
> handwritten backtrace follows:
>
> uvm_pglistalloc: page not on freelist
>
> uvm_pglist_add
> uvm_pglistalloc
> _bus_dmamem_alloc_range
> _bus_dmamem_alloc
> agp_generic_bind_memory
> cdev_ioctl
> spec_ioctl
> VOP_ioctl
> vn_ioctl
> sys_ioctl

As was suggested on IRC (Jared McNeil?), I've built test kernel
to print arguments of agp_generic_bind_memory (see the diff below).
The panic is reproduced with these messages:

Sep 24 19:58:56 asau /netbsd: agp_generic_bind_memory: sz=16777216 phys=0 off=0 
isbound=0
Sep 24 19:58:56 asau /netbsd: agp_generic_bind_memory: requested offset 16777216
Sep 24 19:58:57 asau /netbsd: agp_generic_bind_memory: sz=31457280 phys=0 off=0 
isbound=0
Sep 24 19:58:57 asau /netbsd: agp_generic_bind_memory: requested offset 33554432

This pattern repeats several times and before panic I see only
two lines similar to the first two:

Sep 24 19:58:56 asau /netbsd: agp_generic_bind_memory: sz=16777216 phys=0 off=0 
isbound=0
Sep 24 19:58:56 asau /netbsd: agp_generic_bind_memory: requested offset 16777216

Backtrace as above.

Any other information I should provide?
Further directions?


Index: dev/pci/agp.c
===================================================================
RCS file: /cvsroot/src/sys/dev/pci/agp.c,v
retrieving revision 1.61
diff -u -r1.61 agp.c
--- dev/pci/agp.c       22 Aug 2008 18:05:44 -0000      1.61
+++ dev/pci/agp.c       24 Sep 2008 16:38:16 -0000
@@ -280,7 +280,7 @@
        return (1);
 }
 
-static const int agp_max[][2] = {
+static const u_int agp_max[][2] = {
        {0,     0},
        {32,    4},
        {64,    28},
@@ -549,6 +549,12 @@
        bus_addr_t pa;
        int contigpages, nseg;
 
+       printf("agp_generic_bind_memory: sz=%llu phys=%llu off=%lld 
isbound=%d\n",
+              (unsigned long long)mem->am_size,
+              (unsigned long long)mem->am_physical,
+              (long long)mem->am_offset, mem->am_is_bound);
+       printf("agp_generic_bind_memory: requested offset %ld\n", (long)offset);
+
        mutex_enter(&sc->as_mtx);
 
        if (mem->am_is_bound) {


-- 
HE CE3OH...