NetBSD Problem Report #50079

From tsutsui@ceres.dti.ne.jp  Wed Jul 22 17:20:08 2015
Return-Path: <tsutsui@ceres.dti.ne.jp>
Received: from mail.netbsd.org (mail.netbsd.org [149.20.53.66])
	(using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits))
	(Client CN "mail.netbsd.org", Issuer "Postmaster NetBSD.org" (verified OK))
	by mollari.NetBSD.org (Postfix) with ESMTPS id A540EA5B2E
	for <gnats-bugs@gnats.NetBSD.org>; Wed, 22 Jul 2015 17:20:08 +0000 (UTC)
Message-Id: <201507221616.t6MGGJBL017086@mirage.localdomain>
Date: Thu, 23 Jul 2015 01:16:19 +0900 (JST)
From: Izumi Tsutsui <tsutsui@ceres.dti.ne.jp>
Reply-To: tsutsui@ceres.dti.ne.jp
To: gnats-bugs@NetBSD.org
Cc: tsutsui@ceres.dti.ne.jp
Subject: 7.0_RC1 kernel crash on starting X on Intel 82855GM integrated graphics
X-Send-Pr-Version: 3.95

>Number:         50079
>Category:       port-i386
>Synopsis:       7.0_RC1 kernel crash on starting X on Intel 82855GM integrated graphics
>Confidential:   no
>Severity:       serious
>Priority:       medium
>Responsible:    port-i386-maintainer
>State:          closed
>Class:          sw-bug
>Submitter-Id:   net
>Arrival-Date:   Wed Jul 22 17:25:00 +0000 2015
>Closed-Date:    Sat Jul 25 07:24:46 +0000 2015
>Last-Modified:  Sat Jul 25 07:24:46 +0000 2015
>Originator:     Izumi Tsutsui
>Release:        NetBSD 7.0_RC1
>Organization:
>Environment:
System: NetBSD mirage 7.0_RC1 NetBSD 7.0_RC1 (GENERIC.201506190427Z) i386
Architecture: i386
Machine: i386 (Panasonic Let's Note CF-T2)
>Description:
NetBSD/i386 7.0_RC1 GENERIC kernel gets panic
right after Xserver is started on the CF-T2 with
Intel 82855GM integrated graphics.
According to crash dump, it seems intel_pin_and_fence_fb_obj()
triggers crash.
http://nxr.netbsd.org/xref/src/sys/external/bsd/drm2/dist/drm/i915/intel_display.c?r=1.10.2.3#1963

crash dump trace (the machine doesn't have serial port for debug):
---
teokure# gdb /netbsd
GNU gdb (GDB) 7.7.1
Copyright (C) 2014 Free Software Foundation, Inc.
License GPLv3+: GNU GPL version 3 or later <http://gnu.org/licenses/gpl.html>
This is free software: you are free to change and redistribute it.
There is NO WARRANTY, to the extent permitted by law.  Type "show copying"
and "show warranty" for details.
This GDB was configured as "i486--netbsdelf".
Type "show configuration" for configuration details.
For bug reporting instructions, please see:
<http://www.gnu.org/software/gdb/bugs/>.
Find the GDB manual and other documentation resources online at:
<http://www.gnu.org/software/gdb/documentation/>.
For help, type "help".
Type "apropos word" to search for commands related to "word"...
Reading symbols from /netbsd...done.
(gdb) target kvm /var/crash/netbsd.0.core
0xc06cdc46 in cpu_reboot ()
(gdb) bt
#0  0xc06cdc46 in cpu_reboot ()
#1  0xc02be93d in db_sync_cmd ()
#2  0xc02bf11d in db_command ()
#3  0xc02bf4bf in db_command_loop ()
#4  0xc02c4e9c in db_trap ()
#5  0xc02c1bfb in kdb_trap ()
#6  0xc096a0e8 in trap ()
#7  0xc010ce78 in alltraps ()
#8  0xdb319b84 in ?? ()
#9  0xc056a1f6 in intel_pin_and_fence_fb_obj ()
#10 0xc056afc5 in intel_pipe_set_base ()
#11 0xc056b951 in i9xx_crtc_mode_set ()
#12 0xc0571523 in __intel_set_mode ()
#13 0xc0574dce in intel_set_mode ()
#14 0xc0575b2b in intel_crtc_set_config ()
#15 0xc02da18b in drm_mode_set_config_internal ()
#16 0xc02da505 in drm_mode_setcrtc ()
#17 0xc02e07b6 in drm_ioctl ()
#18 0xc0931d90 in sys_ioctl ()
#19 0xc093c9ff in syscall ()
#20 0xc010055d in Xsyscall ()
#21 0xdb319fa8 in ?? ()
Backtrace stopped: previous frame inner to this frame (corrupt stack?)
(gdb) 

---

dmesg:
---
Copyright (c) 1996, 1997, 1998, 1999, 2000, 2001, 2002, 2003, 2004, 2005,
    2006, 2007, 2008, 2009, 2010, 2011, 2012, 2013, 2014
    The NetBSD Foundation, Inc.  All rights reserved.
Copyright (c) 1982, 1986, 1989, 1991, 1993
    The Regents of the University of California.  All rights reserved.

NetBSD 7.0_RC1 (GENERIC.201506190427Z)
total memory = 1270 MB
avail memory = 1232 MB
kern.module.path=/stand/i386/7.0/modules
timecounter: Timecounters tick every 10.000 msec
timecounter: Timecounter "i8254" frequency 1193182 Hz quality 100
Matsushita Electric Industrial Co.,Ltd. CF-T2AC1A2S (001)
mainbus0 (root)
ACPI: RSDP 0xf7b80 000014 (v00 PTLTD )
ACPI: RSDT 0x4f6f6ecb 000030 (v01 PTLTD    RSDT   06040000  LTP 00000000)
ACPI: FACP 0x4f6fbf54 000084 (v02 MATBIO CFT2-1   06040000 MAT  00000001)
ACPI: DSDT 0x4f6f7272 004CE2 (v01 MATBIO   CFT2-1 06040000 MSFT 0100000E)
ACPI: FACS 0x4f6fcfc0 000040
ACPI: BOOT 0x4f6fbfd8 000028 (v01 PTLTD  $SBFTBL$ 06040000  LTP 00000001)
ACPI: SSDT 0x4f6f6efb 000125 (v01 MATBIO   CFT2-1 06040000 MSFT 0100000E)
ACPI: All ACPI Tables successfully acquired
cpu0 at mainbus0: Intel(R) Pentium(R) M processor  900MHz, id 0x695
acpi0 at mainbus0: Intel ACPICA 20131218
acpi0: X/RSDT: OemId <PTLTD ,  RSDT  ,06040000>, AslId < LTP,00000000>
LNKC: ACPI: Found matching pin for 0.31.INTA at func 1: 255
LNKB: ACPI: Found matching pin for 0.31.INTB at func 3: 9
LNKA: ACPI: Found matching pin for 0.29.INTA at func 0: 9
LNKH: ACPI: Found matching pin for 0.29.INTD at func 7: 11
LNKA: ACPI: Found matching pin for 0.2.INTA at func 0: 9
LNKG: ACPI: Found matching pin for 1.5.INTA at func 0: 255
LNKE: ACPI: Found matching pin for 1.5.INTB at func 1: 5
LNKD: ACPI: Found matching pin for 1.1.INTA at func 0: 3
acpi0: SCI interrupting at int 9
timecounter: Timecounter "ACPI-Fast" frequency 3579545 Hz quality 1000
acpiec0 at acpi0 (EC0, PNP0C09)
: io 0x62,0x66
RBAR (PNP0C02) at acpi0 not configured
acpivga0 at acpi0 (GRFX): ACPI Display Adapter
acpiout0 at acpivga0 (CRT1, 0x0100): ACPI Display Output Device
acpiout1 at acpivga0 (LCD1, 0x0400): ACPI Display Output Device
acpivga0: connected output devices:
acpivga0:   0x0100 (acpiout0): Ext. Monitor, head 0, bios detect
acpivga0:   0x0400 (acpiout1): Unknown Output Device, head 0, bios detect
MBRD (PNP0C02) at acpi0 not configured
attimer1 at acpi0 (TIME, PNP0100): io 0x40-0x43 irq 0
pcppi1 at acpi0 (SPKR, PNP0800): io 0x61
midi0 at pcppi1: PC speaker
sysbeep0 at pcppi1
MATH (PNP0C04) at acpi0 not configured
pckbc1 at acpi0 (K106, PNP0320) (kbd port): io 0x60,0x64 irq 1
pckbc2 at acpi0 (MOU3, SYN0002) (aux port): irq 12
acpibut0 at acpi0 (PWRB, PNP0C0C-0): ACPI Power Button
acpiacad0 at acpi0 (AC, ACPI0003-0): ACPI AC Adapter
acpibat0 at acpi0 (BATA, PNP0C0A-0): ACPI Battery
acpibat0: Panasonic LION rechargeable battery
acpibat0: granularity: low->warn 0.010 Wh, warn->full 0.010 Wh
HKEY (MAT0019) at acpi0 not configured
acpilid0 at acpi0 (LID, PNP0C0D-0): ACPI Lid Switch
acpitz0 at acpi0 (TZC): cpu0
acpitz0: levels: critical 99.8 C, passive 93.8 C, passive cooling
apm0 at acpi0: Power Management spec V1.2
ACPI Exception: AE_NOT_FOUND, While evaluating Sleep State [\_S1_] (20131218/hwxface-646)
ACPI Exception: AE_NOT_FOUND, While evaluating Sleep State [\_S2_] (20131218/hwxface-646)
attimer1: attached to pcppi1
pckbd0 at pckbc1 (kbd slot)
pckbc1: using irq 1 for kbd slot
wskbd0 at pckbd0: console keyboard
pms0 at pckbc1 (aux slot)
pms0: Synaptics touchpad version 5.9
pms0: Palm detect, Multi-finger
pckbc1: using irq 12 for aux slot
wsmouse0 at pms0 mux 0
pci0 at mainbus0 bus 0: configuration mode 1
pci0: i/o space, memory space enabled, rd/line, rd/mult, wr/inv ok
pchb0 at pci0 dev 0 function 0: vendor 0x8086 product 0x3580 (rev. 0x02)
agp0 at pchb0: i855-family chipset
agp0: detected 8060k stolen memory
agp0: aperture at 0xe8000000, size 0x8000000
vendor 0x8086 product 0x3584 (miscellaneous system, revision 0x02) at pci0 dev 0 function 1 not configured
vendor 0x8086 product 0x3585 (miscellaneous system, revision 0x02) at pci0 dev 0 function 3 not configured
i915drmkms0 at pci0 dev 2 function 0: vendor 0x8086 product 0x3582 (rev. 0x02)
drm: Memory usable by graphics device = 128M
drm: Supports vblank timestamp caching Rev 2 (21.10.2013).
drm: Driver supports precise vblank timestamp query.
i915drmkms0: interrupting at irq 9 (i915)
drm: GMBUS [i915 gmbus panel] timed out, falling back to bit banging on pin 3
drm: initialized overlay support
intelfb0 at i915drmkms0
i915drmkms0: info: registered panic notifier
intelfb0: framebuffer at 0xda673000, size 1024x768, depth 32, stride 4096
wsdisplay0 at intelfb0 kbdmux 1: console (default, vt100 emulation), using wskbd0
wsmux1: connecting to wsdisplay0
vendor 0x8086 product 0x3582 (miscellaneous display, revision 0x02) at pci0 dev 2 function 1 not configured
uhci0 at pci0 dev 29 function 0: vendor 0x8086 product 0x24c2 (rev. 0x03)
uhci0: interrupting at irq 9
usb0 at uhci0: USB revision 1.0
ehci0 at pci0 dev 29 function 7: vendor 0x8086 product 0x24cd (rev. 0x03)
ehci0: interrupting at irq 11
ehci0: EHCI version 1.0
ehci0: companion controller, 2 ports each: uhci0
usb1 at ehci0: USB revision 2.0
ppb0 at pci0 dev 30 function 0: vendor 0x8086 product 0x2448 (rev. 0x83)
pci1 at ppb0 bus 1
pci1: i/o space, memory space enabled
rtk0 at pci1 dev 1 function 0: Realtek 8139 10/100BaseTX (rev. 0x10)
rtk0: interrupting at irq 3
rtk0: Ethernet address xx:xx:xx:xx:xx:xx
rlphy0 at rtk0 phy 7: Realtek internal PHY
rlphy0: 10baseT, 10baseT-FDX, 100baseTX, 100baseTX-FDX, auto
cbb0 at pci1 dev 5 function 0: vendor 0x1180 product 0x0475 (rev. 0x88)
vendor 0x1180 product 0x0575 (miscellaneous system) at pci1 dev 5 function 1 not configured
cbb0: cacheline 0x0 lattimer 0x40
cbb0: bhlc 0x824000
LNKG: Picked IRQ 9 with weight 2
cbb0: interrupting at irq 9
cardslot0 at cbb0
cardbus0 at cardslot0: bus 2
pcmcia0 at cardslot0
ichlpcib0 at pci0 dev 31 function 0: vendor 0x8086 product 0x24cc (rev. 0x03)
timecounter: Timecounter "ichlpcib0" frequency 3579545 Hz quality 1000
ichlpcib0: 24-bit timer
ichlpcib0: TCO (watchdog) timer configured.
ichlpcib0: SpeedStep enabled
gpio0 at ichlpcib0: 64 pins
piixide0 at pci0 dev 31 function 1: Intel 82801DBM IDE Controller (ICH4-M) (rev. 0x03)
piixide0: bus-master DMA support present
piixide0: primary channel configured to compatibility mode
piixide0: primary channel interrupting at irq 14
atabus0 at piixide0 channel 0
piixide0: secondary channel configured to compatibility mode
piixide0: secondary channel ignored (disabled)
ichsmb0 at pci0 dev 31 function 3: vendor 0x8086 product 0x24c3 (rev. 0x03)
ichsmb0: interrupting at irq 9
iic0 at ichsmb0: I2C bus
auich0 at pci0 dev 31 function 5: i82801DB/DBM (ICH4/ICH4M) AC-97 Audio
auich0: interrupting at irq 9
auich0: ac97: SigmaTel STAC9752/53 codec; headphone, 20 bit DAC, 20 bit ADC, SigmaTel 3D
auich0: ac97: ext id 0xa01<AC97_23,AMAP,VRA>
isa0 at ichlpcib0
acpicpu0 at cpu0: ACPI CPU
acpicpu0: C1: HLT, lat   0 us, pow     0 mW
acpicpu0: C2: I/O, lat   1 us, pow     0 mW
acpicpu0: C3: I/O, lat 185 us, pow     0 mW
acpicpu0: P0: FFH, lat  10 us, pow  7000 mW,  900 MHz
acpicpu0: P1: FFH, lat  10 us, pow  6000 mW,  800 MHz
acpicpu0: P2: FFH, lat  10 us, pow  4000 mW,  600 MHz
acpicpu0: T0: I/O, lat   1 us, pow     0 mW, 100 %
acpicpu0: T1: I/O, lat   1 us, pow     0 mW,  88 %
acpicpu0: T2: I/O, lat   1 us, pow     0 mW,  76 %
acpicpu0: T3: I/O, lat   1 us, pow     0 mW,  64 %
acpicpu0: T4: I/O, lat   1 us, pow     0 mW,  52 %
acpicpu0: T5: I/O, lat   1 us, pow     0 mW,  40 %
acpicpu0: T6: I/O, lat   1 us, pow     0 mW,  28 %
acpicpu0: T7: I/O, lat   1 us, pow     0 mW,  16 %
timecounter: Timecounter "clockinterrupt" frequency 100 Hz quality 0
auich0: measured ac97 link rate at 47998 Hz, will use 48000 Hz
audio0 at auich0: full duplex, playback, capture, mmap, independent
uhub0 at usb0: vendor 0x8086 UHCI root hub, class 9/0, rev 1.00/1.00, addr 1
uhub0: 2 ports with 2 removable, self powered
uhub1 at usb1: vendor 0x8086 EHCI root hub, class 9/0, rev 2.00/1.00, addr 1
uhub1: 2 ports with 2 removable, self powered
acpiacad0: AC adapter online.
IPsec: Initialized Security Association Processing.
umass0 at uhub1 port 1 configuration 1 interface 0
umass0: JetFlash Mass Storage Device, rev 2.10/10.75, addr 2
umass0: using SCSI over Bulk-Only
scsibus0 at umass0: 2 targets, 1 lun per target
sd0 at scsibus0 target 0 lun 0: <JetFlash, Transcend 32GB, 1.00> disk removable
sd0: fabricating a geometry
sd0: 30144 MB, 30144 cyl, 64 head, 32 sec, 512 bytes/sect x 61734912 sectors
sd0: fabricating a geometry
wd0 at atabus0 drive 0
wd0: <CFD CSSD-PMM64WJ2>
wd0: drive supports 16-sector PIO transfers, LBA48 addressing
wd0: 61057 MB, 124053 cyl, 16 head, 63 sec, 512 bytes/sect x 125045424 sectors
wd0: 32-bit data port
wd0: drive supports PIO mode 4, DMA mode 2, Ultra-DMA mode 6 (Ultra/133)
wd0(piixide0:0:0): using PIO mode 4, Ultra-DMA mode 5 (Ultra/100) (using DMA)
Kernelized RAIDframe activated
boot device: sd0
root on sd0a dumps on sd0b
root file system type: ffs
---

output of "pcictl /dev/pci0 list"
---
000:00:0: Intel 82855GM Host-Hub Controller (host bridge, revision 0x02)
000:00:1: Intel 82855GM GMCH Memory Controller (miscellaneous system, revision 0x02)
000:00:3: Intel 82855GM GMCH Configuration Process (miscellaneous system, revision 0x02)
000:02:0: Intel 82855GM GMCH Integrated Graphics Device (VGA display, revision 0x02)
000:02:1: Intel 82855GM GMCH Integrated Graphics Device (miscellaneous display, revision 0x02)
000:29:0: Intel 82801DB USB UHCI Controller (USB serial bus, UHCI, revision 0x03)
000:29:7: Intel 82801DB USB EHCI Controller (USB serial bus, EHCI, revision 0x03)
000:30:0: Intel 82801BAM Hub-PCI Bridge (PCI bridge, revision 0x83)
000:31:0: Intel 82801DB LPC Interface Bridge (ISA bridge, revision 0x03)
000:31:1: Intel 82801DBM IDE Controller (IDE mass storage, interface 0x8a, revision 0x03)
000:31:3: Intel 82801DB SMBus Controller (SMBus serial bus, revision 0x03)
000:31:5: Intel 82801DB AC97 Audio Controller (audio multimedia, revision 0x03)
001:01:0: Realtek Semiconductor 8139 10/100 Ethernet (ethernet network, revision 0x10)
001:05:0: Ricoh 5C475 PCI-CardBus Bridge (CardBus bridge, revision 0x88)
001:05:1: Ricoh product 0x0575 (miscellaneous system)
---

>How-To-Repeat:
Boot NetBSD/i386 7.0_RC1 liveimage on CF-T2
(or other ancient 82855GM machines?)
and start X.

>Fix:
No idea.

>Release-Note:

>Audit-Trail:

Responsible-Changed-From-To: gnats-admin->port-i386-maintainer
Responsible-Changed-By: tsutsui@NetBSD.org
Responsible-Changed-When: Thu, 23 Jul 2015 13:51:08 +0000
Responsible-Changed-Why:
Fix wrong category.


State-Changed-From-To: open->closed
State-Changed-By: tsutsui@NetBSD.org
State-Changed-When: Sat, 25 Jul 2015 07:24:46 +0000
State-Changed-Why:
Dup of PR kern/49875 and as mentioned in the PR upstream commit
http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=19656430a874132a1d79c56387a6eec1ef9a5689
also works around on my CF-T2, though it still emits error messages.


>Unformatted:

NetBSD Home
NetBSD PR Database Search

(Contact us) $NetBSD: query-full-pr,v 1.39 2013/11/01 18:47:49 spz Exp $
$NetBSD: gnats_config.sh,v 1.8 2006/05/07 09:23:38 tsutsui Exp $
Copyright © 1994-2014 The NetBSD Foundation, Inc. ALL RIGHTS RESERVED.