panic: vm_reserv_populate: reserv 0x... is already promoted

[dumbbell]

I hit the following panic quite frequently:

panic: vm_reserv_populate: reserv 0xfffff80422ad3580 is already promoted

#1  doadump (textdump=0)
    at /mnt/home/dumbbell/Projects/freebsd/src/GIT/sys/kern/kern_shutdown.c:298
#2  0xffffffff8267ac09 in vt_kms_postswitch (arg=<optimized out>)
    at /mnt/home/dumbbell/Projects/freebsd/src/GIT/sys/modules/drm2/drm2/../../../dev/drm2/linux_fb.c:82
#3  0xffffffff808d7ccb in vt_window_switch (
    vw=0xffffffff81709850 <vt_conswindow>)
    at /mnt/home/dumbbell/Projects/freebsd/src/GIT/sys/dev/vt/vt_core.c:540
#4  0xffffffff808d57c0 in vtterm_cngrab (tm=<optimized out>)
    at /mnt/home/dumbbell/Projects/freebsd/src/GIT/sys/dev/vt/vt_core.c:1465
#5  0xffffffff809eea32 in cngrab ()
    at /mnt/home/dumbbell/Projects/freebsd/src/GIT/sys/kern/kern_cons.c:368
#6  0xffffffff80a4a036 in vpanic (
    fmt=0xffffffff813e4fec "vm_reserv_populate: reserv %p is already promoted", ap=0xfffffe0456132e10)
    at /mnt/home/dumbbell/Projects/freebsd/src/GIT/sys/kern/kern_shutdown.c:745
#7  0xffffffff80a49f26 in kassert_panic (
    fmt=0xffffffff813e4fec "vm_reserv_populate: reserv %p is already promoted")
    at /mnt/home/dumbbell/Projects/freebsd/src/GIT/sys/kern/kern_shutdown.c:649
#8  0xffffffff80d4d0fb in vm_reserv_populate (rv=0xfffff80422ad3580, index=0)
    at /mnt/home/dumbbell/Projects/freebsd/src/GIT/sys/vm/vm_reserv.c:382
#9  0xffffffff80d4d484 in vm_reserv_alloc_page (
    object=0xffffffff81bb6068 <kmem_object_store>, pindex=<optimized out>, 
    mpred=<optimized out>)
    at /mnt/home/dumbbell/Projects/freebsd/src/GIT/sys/vm/vm_reserv.c:707
#10 0xffffffff80d407df in vm_page_alloc (
    object=0xffffffff81bb6068 <kmem_object_store>, pindex=2211840, 
    req=<optimized out>)
    at /mnt/home/dumbbell/Projects/freebsd/src/GIT/sys/vm/vm_page.c:1682
#11 0xffffffff80d2f898 in kmem_back (
    object=0xffffffff81bb6068 <kmem_object_store>, addr=18446741883745935360, 
    size=131072, flags=<optimized out>)
    at /mnt/home/dumbbell/Projects/freebsd/src/GIT/sys/vm/vm_kern.c:347
#12 0xffffffff80d2f742 in kmem_malloc (
    vmem=0xffffffff81a68480 <kmem_arena_storage>, size=131072, flags=2305)
    at /mnt/home/dumbbell/Projects/freebsd/src/GIT/sys/vm/vm_kern.c:317
#13 0xffffffff80d26fef in keg_alloc_slab (keg=0xfffff8000c5af600, 
    zone=0xfffff8000c5b1680, wait=<optimized out>)
    at /mnt/home/dumbbell/Projects/freebsd/src/GIT/sys/vm/uma_core.c:985
#14 0xffffffff80d2975e in keg_fetch_slab (keg=<optimized out>, 
    zone=<optimized out>, flags=<optimized out>)
    at /mnt/home/dumbbell/Projects/freebsd/src/GIT/sys/vm/uma_core.c:2343
#15 0xffffffff80d28f3e in zone_fetch_slab (zone=<optimized out>, 
    keg=<optimized out>, flags=<optimized out>)
    at /mnt/home/dumbbell/Projects/freebsd/src/GIT/sys/vm/uma_core.c:2375
#16 0xffffffff80d28fd0 in zone_import (zone=0xfffff8000c5b1680, 
    bucket=0xfffff8000c85db58, max=<optimized out>, flags=<optimized out>)
    at /mnt/home/dumbbell/Projects/freebsd/src/GIT/sys/vm/uma_core.c:2501
#17 0xffffffff80d25ae6 in zone_alloc_bucket (zone=0xfffff8000c5b1680, 
    udata=0xfffff800052276c0, flags=2)
    at /mnt/home/dumbbell/Projects/freebsd/src/GIT/sys/vm/uma_core.c:2531
#18 uma_zalloc_arg (zone=<optimized out>, udata=0xfffff800052276c0, 
    flags=<optimized out>)
    at /mnt/home/dumbbell/Projects/freebsd/src/GIT/sys/vm/uma_core.c:2257
#19 0xffffffff81f7860b in arc_get_data_buf (buf=0xfffff8019f1e4ca8)
    at /mnt/home/dumbbell/Projects/freebsd/src/GIT/sys/cddl/contrib/opensolaris/uts/common/fs/zfs/arc.c:4029
#20 0xffffffff81f7827f in arc_buf_alloc (spa=<optimized out>, size=131072, 
    tag=0x0, type=ARC_BUFC_DATA)
    at /mnt/home/dumbbell/Projects/freebsd/src/GIT/sys/cddl/contrib/opensolaris/uts/common/fs/zfs/arc.c:2143
#21 0xffffffff81f7ad6b in arc_read (pio=0xfffff8033c29b780, 
    spa=0xfffffe0004e30000, bp=<optimized out>, done=0x0, private=0x0, 
    priority=ZIO_PRIORITY_ASYNC_READ, zio_flags=0, arc_flags=<optimized out>, 
    zb=0x9d18d61511246b86)
    at /mnt/home/dumbbell/Projects/freebsd/src/GIT/sys/cddl/contrib/opensolaris/uts/common/fs/zfs/arc.c:4542
#22 0xffffffff81f8cc8f in dbuf_issue_final_prefetch (dpa=0xfffff8033fcbd900, 
    bp=0xfffffe0456133378)
    at /mnt/home/dumbbell/Projects/freebsd/src/GIT/sys/cddl/contrib/opensolaris/uts/common/fs/zfs/dbuf.c:2089
#23 0xffffffff81f8c29e in dbuf_prefetch (dn=<optimized out>, 
    level=<optimized out>, blkid=<optimized out>, prio=<optimized out>, 
    aflags=ARC_FLAG_PREDICTIVE_PREFETCH)
    at /mnt/home/dumbbell/Projects/freebsd/src/GIT/sys/cddl/contrib/opensolaris/uts/common/fs/zfs/dbuf.c:2244
#24 0xffffffff81fc5029 in dmu_zfetch (zf=<optimized out>, 
    blkid=<optimized out>, nblks=<optimized out>, fetch_data=<optimized out>)
    at /mnt/home/dumbbell/Projects/freebsd/src/GIT/sys/cddl/contrib/opensolaris/uts/common/fs/zfs/dmu_zfetch.c:338
#25 0xffffffff81f947dd in dmu_buf_hold_array_by_dnode (dn=<optimized out>, 
    offset=<optimized out>, length=<optimized out>, read=1, 
    tag=0xffffffff820b91df, numbufsp=<optimized out>, dbpp=<unavailable>, 
    flags=<optimized out>)
    at /mnt/home/dumbbell/Projects/freebsd/src/GIT/sys/cddl/contrib/opensolaris/uts/common/fs/zfs/dmu.c:463
#26 0xffffffff81f959b1 in dmu_read_uio_dnode (dn=<unavailable>, 
    uio=0xfffffe0456133970, size=1048576)
    at /mnt/home/dumbbell/Projects/freebsd/src/GIT/sys/cddl/contrib/opensolaris/uts/common/fs/zfs/dmu.c:1060
#27 0xffffffff81f9594b in dmu_read_uio_dbuf (zdb=0xfffff8021751eb88, 
    uio=0xfffffe0456133970, size=1048576)
    at /mnt/home/dumbbell/Projects/freebsd/src/GIT/sys/cddl/contrib/opensolaris/uts/common/fs/zfs/dmu.c:1134
#28 0xffffffff82052b42 in zfs_read (vp=<optimized out>, uio=<optimized out>, 
    ioflag=<optimized out>, cr=<optimized out>, ct=<optimized out>)
    at /mnt/home/dumbbell/Projects/freebsd/src/GIT/sys/cddl/contrib/opensolaris/uts/common/fs/zfs/zfs_vnops.c:813
#29 zfs_freebsd_read (ap=<optimized out>)
    at /mnt/home/dumbbell/Projects/freebsd/src/GIT/sys/cddl/contrib/opensolaris/uts/common/fs/zfs/zfs_vnops.c:6136
#30 0xffffffff80fc1eaa in VOP_READ_APV (vop=<optimized out>, a=<optimized out>)
    at vnode_if.c:932
#31 0xffffffff80b1cfe7 in VOP_READ (vp=0xfffff801f4f76938, 
    uio=0xfffffe0456133970, ioflag=<optimized out>, cred=<optimized out>)
    at ./vnode_if.h:384
#32 vn_read (fp=0xfffff8000cfa4c30, uio=0xfffffe0456133970, 
    active_cred=0x33200000, flags=<optimized out>, td=<unavailable>)
    at /mnt/home/dumbbell/Projects/freebsd/src/GIT/sys/kern/vfs_vnops.c:804
#33 0xffffffff80b1adc2 in vn_io_fault1 (vp=<optimized out>, 
    uio=<optimized out>, args=<optimized out>, td=<optimized out>)
    at /mnt/home/dumbbell/Projects/freebsd/src/GIT/sys/kern/vfs_vnops.c:1060
#34 0xffffffff80b190f7 in vn_io_fault (fp=<optimized out>, 
    uio=<optimized out>, active_cred=<optimized out>, flags=<optimized out>, 
    td=<optimized out>)
    at /mnt/home/dumbbell/Projects/freebsd/src/GIT/sys/kern/vfs_vnops.c:1165
#35 0xffffffff80aae30f in fo_read (uio=0xfffffe0456133970, 
    active_cred=<unavailable>, flags=<unavailable>, td=<optimized out>, 
    fp=<optimized out>)
    at /mnt/home/dumbbell/Projects/freebsd/src/GIT/sys/sys/file.h:304
#36 dofileread (td=<optimized out>, fd=<optimized out>, fp=<optimized out>, 
    auio=0xfffffe0456133970, offset=<optimized out>, flags=<optimized out>)
    at /mnt/home/dumbbell/Projects/freebsd/src/GIT/sys/kern/sys_generic.c:383
#37 0xffffffff80aadf88 in kern_readv (td=0xfffff8010ec59500, fd=3, 
    auio=0xfffffe0456133970)
    at /mnt/home/dumbbell/Projects/freebsd/src/GIT/sys/kern/sys_generic.c:295
#38 0xffffffff80aadf14 in sys_read (td=<unavailable>, uap=<optimized out>)
    at /mnt/home/dumbbell/Projects/freebsd/src/GIT/sys/kern/sys_generic.c:208
#39 0xffffffff80ebcb2b in syscallenter (td=0xfffff8010ec59500, 
    sa=<optimized out>)
    at /mnt/home/dumbbell/Projects/freebsd/src/GIT/sys/amd64/amd64/../../kern/subr_syscall.c:135
#40 amd64_syscall (td=0xfffff8010ec59500, traced=0)
    at /mnt/home/dumbbell/Projects/freebsd/src/GIT/sys/amd64/amd64/trap.c:942
#41 <signal handler called>
#42 0x000000080097e37a in ?? ()

This is on a Haswell laptop (Thinkpad T440p) using drm-next-4.6 de6f1ed

[mattmacy]

No one else is hitting this. Do you have any custom options?

[mattmacy]

And can you bisect to the change that introduced it for you?

[mattmacy]

I've been running the most recent code on Skylake and have yet to see any issues.

[dumbbell]

Here are some informations I already gave on IRC:

How to reproduce

1. Use a UHD monitor in its native resolution (3840x2160);
2. Start Firefox;
3. Play a 4k video;
4. Switch to fullscreen at the beginning of the video.

I get almost instant panic.

Configuration

• Oldest commit tried so far: 5b0d864.
• SNA is enabled; it doesn't seem to happen with UXA.
• Hardware video decoding is not used.

[mattmacy]

Does drm-next still do this?

[dumbbell]

I'm unable to play a YouTube video with any of the drm-next branches, so I can't try to reproduce this bug currently. YouTube is fine with plain HEAD.

I will try to debug this further next week if possible.

[dumbbell]

I fixed the problem with Firefox failing to play a YouTube video: it was PulseAudio misbehaving.

I confirm I still hit this issue: this time, I just started Firefox and the kernel crashed immediately.

Another apparently new issue is that there is no signal on the DisplayPort quite frequently. I don't have much details yet, but I will file a separate issue when the problem is clearer.

[mattmacy]

The only way that drm could be causing this (that I can come up with) is that drm's page allocation patterns somehow corrupt the vm reservation structures.

[mattmacy]

fixed