kern/60732: amdgpu attempts to take (sleeping) mutex while holding a spin lock

["mrg%eterna23.net@localhost via gnats" <gnats-admin%NetBSD.org@localhost>]

>Number:         60732
>Category:       kern
>Synopsis:       amdgpu attempts to take (sleeping) mutex while holding a spin lock
>Confidential:   no
>Severity:       serious
>Priority:       medium
>Responsible:    kern-bug-people
>State:          open
>Class:          sw-bug
>Submitter-Id:   net
>Arrival-Date:   Wed Sep 16 00:30:00 +0000 2026
>Originator:     matthew green
>Release:        -current from 2026-09-15
>Organization:
people's front against (bozotic) www (softwar foundation)
>Environment:
NetBSD the-blessing.eterna23.net 11.99.8 NetBSD 11.99.8 (_blessing_) #472: Mon Sep 14 19:19:02 PDT 2026  mrg%yesterday-when-i-was-mad.eterna23.net@localhost:/var/obj/amd64-x86_64/usr/src/sys/arch/amd64/compile/_blessing_ amd64

>Description:
while trying to trigger a different locking issue in amdgpu (that annoyingly
disappeared when LOCKDEBUG was enabled), i triggered a locking issue after
restarting X a 4th time.  (i don't think 4 matters.  whatever causes this
problem just is not always happening.)

[ 7579.5137040] Mutex error: mutex_vector_enter,525: spin lock held
[ 7579.5237038] lock address : ffff8694655bb930
[ 7579.5237038] type         : spin
[ 7579.5237038] initialized  : netbsd:amdgpu_gtt_mgr_init+0x71
[ 7579.5337039] shared holds :                  0 exclusive:                  1
[ 7579.5437036] shares wanted:                  0 exclusive:                  0
[ 7579.5437036] relevant cpu :                 14 last held:                 14
[ 7579.5537038] relevant lwp : 0xffff86a34bed5800 last held: 0xffff86a34bed5800
[ 7579.5637033] last locked* : netbsd:amdgpu_gtt_mgr_recover+0x21
[ 7579.5637033] unlocked     : netbsd:amdgpu_gtt_mgr_del+0x41
[ 7579.5737033] owner field  : 0x0000000000010600 wait/spin:                0/1
[ 7579.5837034] panic: LOCKDEBUG: Mutex error: mutex_vector_enter,525: spin lock held

#4  0xffffffff8105112b in lockdebug_abort1 (func=0xffffffff81832640 <__func__.4> "mutex_vector_enter", line=525, ld=0xffff95008810a5c0, s=6, 
    msg=0xffffffff818cfbec "spin lock held", dopanic=true) at /usr/src/sys/kern/subr_lockdebug.c:818
#5  lockdebug_abort1 (func=0xffffffff81832640 <__func__.4> "mutex_vector_enter", line=525, ld=0xffff95008810a5c0, s=6, 
    msg=0xffffffff818cfbec "spin lock held", dopanic=<optimized out>) at /usr/src/sys/kern/subr_lockdebug.c:796
#6  0xffffffff81002b2c in mutex_vector_enter (mtx=0xffff950088143390) at /usr/src/sys/kern/kern_mutex.c:525
#7  0xffffffff809b37a4 in mutex_lock (mutex=0xffff950088143390) at /usr/src/sys/external/bsd/drm2/include/linux/mutex.h:76
#8  gmc_v10_0_flush_gpu_tlb (adev=0xffff95008813e008, vmid=0, vmhub=0, flush_type=<optimized out>)
    at /usr/src/sys/external/bsd/drm2/dist/drm/amd/amdgpu/amdgpu_gmc_v10_0.c:353
#9  0xffffffff80972447 in amdgpu_gart_post_update (adev=adev@entry=0xffff95008813e008, gpu_pgstart=gpu_pgstart@entry=1024, gpu_npages=gpu_npages@entry=1)
    at /usr/src/sys/external/bsd/drm2/dist/drm/amd/amdgpu/amdgpu_gart.c:299
#10 0xffffffff80972ba7 in amdgpu_gart_bind (adev=0xffff95008813e008, gpu_start=<optimized out>, npages=1, pages=<optimized out>, dmamap=<optimized out>, 
    flags=<optimized out>) at /usr/src/sys/external/bsd/drm2/dist/drm/amd/amdgpu/amdgpu_gart.c:523
#11 0xffffffff80a02b5f in amdgpu_ttm_gart_bind (adev=<optimized out>, tbo=<optimized out>, flags=844424930132087)
    at /usr/src/sys/external/bsd/drm2/dist/drm/amd/amdgpu/amdgpu_ttm.c:1093
#12 0xffffffff809baf11 in amdgpu_gtt_mgr_recover (man=man@entry=0xffff950088142e10) at /usr/src/sys/external/bsd/drm2/dist/drm/amd/amdgpu/amdgpu_gtt_mgr.c:339
#13 0xffffffff8096ae11 in amdgpu_do_asic_reset (hive=<optimized out>, device_list_handle=0xffff95125ce66e80, need_full_reset_arg=0xffff95125ce66e7f)
    at /usr/src/sys/external/bsd/drm2/dist/drm/amd/amdgpu/amdgpu_device.c:4121
#14 amdgpu_device_gpu_recover (adev=<optimized out>, job=job@entry=0xffff869466e4b488)
    at /usr/src/sys/external/bsd/drm2/dist/drm/amd/amdgpu/amdgpu_device.c:4391
#15 0xffffffff809be765 in amdgpu_job_timedout (s_job=0xffff869466e4b488) at /usr/src/sys/external/bsd/drm2/dist/drm/amd/amdgpu/amdgpu_job.c:58
#16 0xffffffff80e18c8a in drm_sched_job_timedout (work=0xffff9500881457e0) at /usr/src/sys/external/bsd/drm2/dist/drm/scheduler/sched_main.c:318
#17 0xffffffff80e0df7b in linux_workqueue_thread (cookie=0xffff86a34bed8000) at /usr/src/sys/external/bsd/common/linux/linux_work.c:455
#18 0xffffffff80210327 in lwp_trampoline ()

the problem is that at the higher level (frame 12 above), a spinlock is taken:

329     int amdgpu_gtt_mgr_recover(struct ttm_mem_type_manager *man)
...
336             spin_lock(&mgr->lock);
337             drm_mm_for_each_node(mm_node, &mgr->mm) {
338                     node = container_of(mm_node, struct amdgpu_gtt_node, node);
339                     r = amdgpu_ttm_recover_gart(node->tbo);
340                     if (r)
341                             break;
342             }
343             spin_unlock(&mgr->lock);

however, downstack at frame 8, this sleeping mutex is taken:

341     static void gmc_v10_0_flush_gpu_tlb(struct amdgpu_device *adev, uint32_t vmid,
342                                             uint32_t vmhub, uint32_t flush_type)
...
353             mutex_lock(&adev->mman.gtt_window_lock);

this violates locking and panic appears.
>How-To-Repeat:
startx multiple times with a AMD RX 5300 GPU installed.
>Fix:
don't take sleep mutex when holding spinlock? :-)

idea i did not look at to see if feasible or try, would be to
make the mutex into an spin mutex.