NetBSD Problem Report #57833
From www@netbsd.org Wed Jan 10 09:00:12 2024
Return-Path: <www@netbsd.org>
Received: from mail.netbsd.org (mail.netbsd.org [199.233.217.200])
(using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits))
(Client CN "mail.NetBSD.org", Issuer "mail.NetBSD.org CA" (not verified))
by mollari.NetBSD.org (Postfix) with ESMTPS id 034D81A923A
for <gnats-bugs@gnats.NetBSD.org>; Wed, 10 Jan 2024 09:00:12 +0000 (UTC)
Message-Id: <20240110090008.4551C1A923C@mollari.NetBSD.org>
Date: Wed, 10 Jan 2024 09:00:08 +0000 (UTC)
From: ea1abz@gmail.com
Reply-To: ea1abz@gmail.com
To: gnats-bugs@NetBSD.org
Subject: kernel panic on xorg exit
X-Send-Pr-Version: www-1.0
>Number: 57833
>Category: kern
>Synopsis: kernel panic on xorg exit
>Confidential: no
>Severity: serious
>Priority: medium
>Responsible: riastradh
>State: closed
>Class: sw-bug
>Submitter-Id: net
>Arrival-Date: Wed Jan 10 09:05:00 +0000 2024
>Closed-Date: Sat Feb 03 15:12:30 +0000 2024
>Last-Modified: Sat Feb 03 15:12:30 +0000 2024
>Originator: Ramiro Aceves
>Release: NetBSD 10.0_RC2
>Organization:
>Environment:
netbsd-compal# uname -a
NetBSD netbsd-compal.remigio 10.0_RC2 NetBSD 10.0_RC2 (GENERIC) #0: Mon Jan 1 14:04:52 UTC 2024 mkrepro@mkrepro.NetBSD.org:/usr/src/sys/arch/i386/compile/GENERIC i386
netbsd-co
>Description:
Hello,
I start ctwm (or XFCE, same behaviour) with startx command. Everything works fine inside the desktop. But when I exit with "Quit" (or Log out in XFCE) the screen goes dark and computer reboots needed fsck.
Crash dumps where recorded on /var/crash (I have gunziped them):
netbsd-compal# ls -l
total 710596
-rw------- 1 root wheel 2 Jan 10 07:17 bounds
-rw------- 1 root wheel 5 Jan 1 15:04 minfree
-rw------- 1 root wheel 1958710 Jan 9 19:21 netbsd.0
-rw------- 1 root wheel 154079764 Jan 9 19:21 netbsd.0.core
-rw------- 1 root wheel 1958710 Jan 9 19:24 netbsd.1
-rw------- 1 root wheel 117210132 Jan 9 19:24 netbsd.1.core
-rw------- 1 root wheel 1958710 Jan 9 20:14 netbsd.2
-rw------- 1 root wheel 202709524 Jan 9 20:14 netbsd.2.core
-rw------- 1 root wheel 1958710 Jan 10 07:18 netbsd.3
-rw------- 1 root wheel 245231124 Jan 10 07:18 netbsd.3.core
following hubertf's NetBSD Blog:
netbsd-compal# dmesg -M netbsd.3.core -N netbsd.3
...
...
[ 78.355023] wsdisplay0: screen 3 added (default, vt100 emulation)
[ 78.355023] wsdisplay0: screen 4 added (default, vt100 emulation)
[ 2944.322629] uvm_fault(0xc157f960, 0, 1) -> 0xe
[ 2944.322629] fatal page fault in supervisor mode
[ 2944.322629] trap type 6 code 0 eip 0xc0c47b88 cs 0x8 eflags 0x10282 cr2 0x10 ilevel 0 esp 0xdc7e1ee8
[ 2944.322629] curlwp 0xc4341600 pid 0 lid 63 lowest kstack 0xdc7e02c0
[ 2944.322629] panic: trap
[ 2944.322629] cpu0: Begin traceback...
[ 2944.322629] vpanic(c1186ce0,dc7e1dc0,dc7e1e7c,c012fed8,c1186ce0,dc7e1e88,dc7e1e88,3f,dc7e02c0,10282) at netbsd:vpanic+0x196
[ 2944.322629] panic(c1186ce0,dc7e1e88,dc7e1e88,3f,dc7e02c0,10282,10,0,dc7e1ee8,c157f960) at netbsd:panic+0x18
[ 2944.322629] trap() at netbsd:trap+0xd51
[ 2944.332632] --- trap (number 6) ---
[ 2944.332632] uvm_vm_page_to_phys(0,c3dfd004,c937c900,dc7e1efc,0,c937c900,dc7e1efc,c06cd118,0,c937c9b0) at netbsd:uvm_vm_page_to_phys+0x6
[ 2944.332632] pmap_page_remove(0,c937c9b0,c937c900,dc7e1f48,c06cd604,c937c900,1,0,c0c5dbef,0) at netbsd:pmap_page_remove+0x13
[ 2944.332632] i915_gem_object_release_mmap_offset(c937c900,1,0,c0c5dbef,0,0,c3dff878,0,c937c9b0,c937c9ac) at netbsd:i915_gem_object_release_mmap_offset+0x3b
[ 2944.332632] __i915_gem_free_objects(c3dfea1c,c42a2f00,fffffffe,ffffffff,120,c4341600,c42a2f1c,dc7e1f78,c42a2f04,c42a2f1c) at netbsd:__i915_gem_free_objects+0x80
[ 2944.332632] linux_workqueue_thread(c42a2f00,1849000,1854000,0,c01005a8,0,0,0,0,0) at netbsd:linux_workqueue_thread+0xe6
[ 2944.332632] cpu0: End traceback...
[ 2944.332632] dumping to dev 0,1 offset 1023
[ 2944.332632] dump succeeded
[ 2944.390275] rebooting...
[ 1.000000] Copyright (c) 1996, 1997, 1998, 1999, 2000, 2001, 2002, 2003,
[ 1.000000] 2004, 2005, 2006, 2007, 2008, 2009, 2010, 2011, 2012, 2013,
[ 1.000000] 2014, 2015, 2016, 2017, 2018, 2019, 2020, 2021, 2022, 2023,
[ 1.000000] 2024
[ 1.000000] The NetBSD Foundation, Inc. All rights reserved.
[ 1.000000] Copyright (c) 1982, 1986, 1989, 1991, 1993
[ 1.000000] The Regents of the University of California. All rights reserved.
[ 1.000000] NetBSD 10.0_RC2 (GENERIC) #0: Mon Jan 1 14:04:52 UTC 2024
[ 1.000000] mkrepro@mkrepro.NetBSD.org:/usr/src/sys/arch/i386/compile/GENERIC
[ 1.000000] total memory = 2039 MB
[ 1.000000] avail memory = 1978 MB
[ 1.000000] timecounter: Timecounters tick every 10.000 msec
[ 1.000000] Kernelized RAIDframe activated
[ 1.000000] timecounter: Timecounter "i8254" frequency 1193182 Hz quality 100
[ 1.000004] mainbus0 (root)
[ 1.000004] cpu0 at mainbus0
[ 1.000004] ACPI Error: AE_BAD_PARAMETER, Thread 3242924096 could not acquire Mutex [ACPI_MTX_Tables] (0x2) (20221020/utmutex-326)
[ 1.000004] cpu0: Use lfence to serialize rdtsc
[ 1.000004] cpu0: Intel(R) Pentium(R) M processor 1.86GHz, id 0x6d8
[ 1.000004] cpu0: node 0, package 0, core 0, smt 0
[ 1.000004] pci0 at mainbus0 bus 0: configuration mode 1
[ 1.000004] pci0: i/o space, memory space enabled, rd/line, rd/mult, wr/inv ok
[ 1.000004] pchb0 at pci0 dev 0 function 0: Intel 82915PM/GM/GMS,82910GML Host Bridge (rev. 0x04)
[ 1.000004] agp0 at pchb0: i915-family chipset
[ 1.000004] agp0: detected 7932k stolen memory
[ 1.000004] agp0: aperture at 0xa0000000, size 0x10000000
[ 1.000004] i915drmkms0 at pci0 dev 2 function 0: Intel 82915GM/GMS,82910GML Integrated Graphics Device (rev. 0x04)
[ 1.000004] Intel 82915GM/GMS IGD Companion (miscellaneous display, revision 0x04) at pci0 dev 2 function 1 not configured
[ 1.000004] uhci0 at pci0 dev 29 function 0: Intel 82801FB/FR USB UHCI Controller (rev. 0x04)
[ 1.000004] uhci0: interrupting at irq 7
[ 1.000004] usb0 at uhci0: USB revision 1.0
[ 1.000004] uhci1 at pci0 dev 29 function 1: Intel 82801FB/FR USB UHCI Controller (rev. 0x04)
[ 1.000004] uhci1: interrupting at irq 3
[ 1.000004] usb1 at uhci1: USB revision 1.0
[ 1.000004] uhci2 at pci0 dev 29 function 2: Intel 82801FB/FR USB UHCI Controller (rev. 0x04)
[ 1.000004] uhci2: interrupting at irq 11
[ 1.000004] usb2 at uhci2: USB revision 1.0
[ 1.000004] uhci3 at pci0 dev 29 function 3: Intel 82801FB/FR USB UHCI Controller (rev. 0x04)
[ 1.000004] uhci3: interrupting at irq 11
[ 1.000004] usb3 at uhci3: USB revision 1.0
[ 1.000004] ehci0 at pci0 dev 29 function 7: Intel 82801FB/FR USB EHCI Controller (rev. 0x04)
[ 1.000004] ehci0: 64-bit DMA - limited
[ 1.000004] ehci0: interrupting at irq 7
[ 1.000004] ehci0: EHCI version 1.0
[ 1.000004] ehci0: 4 companion controllers, 2 ports each: uhci0 uhci1 uhci2 uhci3
[ 1.000004] ehci0: Using DMA subregion for control data structures
[ 1.000004] usb4 at ehci0: USB revision 2.0
[ 1.000004] ppb0 at pci0 dev 30 function 0: Intel 82801BAM Hub-PCI Bridge (rev. 0xd4)
[ 1.000004] pci1 at ppb0 bus 1
[ 1.000004] pci1: i/o space, memory space enabled
[ 1.000004] fwohci0 at pci1 dev 0 function 0: VIA Technologies VT6306 IEEE 1394 Host Controller (rev. 0x80)
[ 1.000004] fwohci0: interrupting at irq 10
[ 1.000004] fwohci0: OHCI version 1.0 (ROM=1)
[ 1.000004] fwohci0: No. of Isochronous channels is 4.
[ 1.000004] fwohci0: EUI64 00:02:3f:59:88:40:01:0f
[ 1.000004] fwohci0: Phy 1394a available S400, 2 ports.
[ 1.000004] fwohci0: Link S400, max_rec 512 bytes.
[ 1.000004] fwohci0: max_rec 512 -> 2048
[ 1.000004] ieee1394if0 at fwohci0: IEEE1394 bus
[ 1.000004] fwip0 at ieee1394if0: IP over IEEE1394
[ 1.000004] fwohci0: Initiate bus reset
[ 1.000004] re0 at pci1 dev 1 function 0: RealTek 8169/8110 Gigabit Ethernet (rev. 0x10)
[ 1.000004] re0: interrupting at irq 11
[ 1.000004] re0: RTL8169/8110SB (0x1000)
[ 1.000004] re0: Ethernet address 00:0f:b0:93:6f:e1
[ 1.000004] re0: using 256 tx descriptors
[ 1.000004] rgephy0 at re0 phy 7: RTL8211B 1000BASE-T media interface
[ 1.000004] rgephy0: 10baseT, 10baseT-FDX, 100baseTX, 100baseTX-FDX, 1000baseT, 1000baseT-FDX, auto
[ 1.000004] iwi0 at pci1 dev 2 function 0: Intel PRO/Wireless LAN 2200BG Mini-PCI Adapter (rev. 0x05)
[ 1.000004] iwi0: interrupting at irq 11
[ 1.000004] iwi0: 802.11 address 00:13:ce:6b:7d:01
[ 1.000004] cbb0 at pci1 dev 4 function 0: ENE Technology CB710 CardBus Controller (rev. 0x00)
[ 1.000004] ENE Technology product 0530 (flash memory) at pci1 dev 4 function 1 not configured
[ 1.000004] sdhc0 at pci1 dev 4 function 2: ENE Technology CB712/714/810 PCI SD Card Reader Controller (rev. 0x00)
[ 1.000004] sdhc0: interrupting at irq 5
[ 1.000004] sdhc0: SDHC 1.0, rev 0, caps <01e021a1/00000000>, SDMA, 33000 kHz, HS 3.3V, 512 byte blocks
[ 1.000004] sdmmc0 at sdhc0 slot 0
[ 1.000004] cbb0: cacheline 0x8 lattimer 0x40
[ 1.000004] cbb0: bhlc 0x824008
[ 1.000004] cbb0: autoconfiguration error: secondary bus number uninitialized; try PCI_BUS_FIXUP
[ 1.000004] pci_intr_map: no mapping for pin A (line=ff)
[ 1.000004] cbb0: autoconfiguration error: couldn't map interrupt
[ 1.000004] cardslot0 at cbb0
[ 1.000004] pcmcia0 at cardslot0
[ 1.000004] auich0 at pci0 dev 30 function 2: i82801FB (ICH6) AC-97 Audio
[ 1.000004] auich0: interrupting at irq 5
[ 1.000004] auich0: ac97: Avance Logic unknown (0x414c4752) codec; headphone, 20 bit DAC, 18 bit ADC, no 3D stereo
[ 1.000004] auich0: ac97: ext id 0xa07<AC97_23,AMAP,SPDIF,DRA,VRA>
[ 1.000004] Intel 82801FB/FR AC'97 Modem Controller (modem communications, revision 0x04) at pci0 dev 30 function 3 not configured
[ 1.000004] ichlpcib0 at pci0 dev 31 function 0: Intel 82801FBM ICH6M LPC Interface Bridge (rev. 0x04)
[ 1.000004] timecounter: Timecounter "ichlpcib0" frequency 3579545 Hz quality 1000
[ 1.006336] ichlpcib0: 24-bit timer
[ 1.006336] tco0 at ichlpcib0: TCO (watchdog) timer configured.
[ 1.006336] tco0: Min/Max interval 1/367 seconds
[ 1.006336] piixide0 at pci0 dev 31 function 1: Intel 82801FB IDE Controller (ICH6) (rev. 0x04)
[ 1.006336] piixide0: bus-master DMA support present
[ 1.006336] piixide0: primary channel configured to compatibility mode
[ 1.006336] piixide0: primary channel interrupting at irq 14
[ 1.006336] atabus0 at piixide0 channel 0
[ 1.006336] piixide0: secondary channel configured to compatibility mode
[ 1.006336] piixide0: secondary channel interrupting at irq 15
[ 1.006336] atabus1 at piixide0 channel 1
[ 1.006336] ichsmb0 at pci0 dev 31 function 3: Intel 82801FB/FR SMBus Controller (rev. 0x04)
[ 1.006336] ichsmb0: interrupting at irq 3
[ 1.006336] iic0 at ichsmb0: I2C bus
[ 1.006336] isa0 at ichlpcib0
[ 1.006336] pckbc0 at isa0 port 0x60-0x64
[ 1.006336] pckbd0 at pckbc0 (kbd slot)
[ 1.006336] pckbc0: using irq 1 for kbd slot
[ 1.006336] wskbd0 at pckbd0: console keyboard
[ 1.006336] pms0 at pckbc0 (aux slot)
[ 1.006336] pms0: ALPS PS/2 V2 pointing device
[ 1.006336] pckbc0: using irq 12 for aux slot
[ 1.006336] wsmouse0 at pms0 mux 0
[ 1.006336] attimer0 at isa0 port 0x40-0x43
[ 1.006336] pcppi0 at isa0 port 0x61
[ 1.006336] midi0 at pcppi0: PC speaker
[ 1.006336] sysbeep0 at pcppi0
[ 1.006336] attimer0: attached to pcppi0
[ 1.006336] est0 at cpu0: Enhanced SpeedStep
[ 1.006336] fwohci0: BUS reset
[ 1.006336] fwohci0: node_id=0xc000ffc0, gen=1, CYCLEMASTER mode
[ 1.006336] ieee1394if0: 1 nodes, maxhop <= 0 cable IRM irm(0) (me)
[ 1.006336] ieee1394if0: bus manager 0
[ 1.006336] WARNING: system needs entropy for security; see entropy(7)
[ 1.242502] timecounter: Timecounter "clockinterrupt" frequency 100 Hz quality 0
[ 1.574789] auich0: measured ac97 link rate at 48000 Hz
[ 1.574789] audio0 at auich0: playback, capture, full duplex, independent
[ 1.574789] audio0: slinear_le:16 2ch 48000Hz, blk 1920 bytes (10ms) for playback
[ 1.574789] audio0: slinear_le:16 2ch 48000Hz, blk 1920 bytes (10ms) for recording
[ 1.574789] uhub0 at usb0: NetBSD (0x0000) UHCI root hub (0x0000), class 9/0, rev 1.00/1.00, addr 1
[ 1.574789] uhub0: 2 ports with 2 removable, self powered
[ 1.574789] uhub1 at usb1: NetBSD (0x0000) UHCI root hub (0x0000), class 9/0, rev 1.00/1.00, addr 1
[ 1.574789] uhub1: 2 ports with 2 removable, self powered
[ 1.574789] uhub2 at usb2: NetBSD (0x0000) UHCI root hub (0x0000), class 9/0, rev 1.00/1.00, addr 1
[ 1.574789] uhub2: 2 ports with 2 removable, self powered
[ 1.574789] uhub3 at usb3: NetBSD (0x0000) UHCI root hub (0x0000), class 9/0, rev 1.00/1.00, addr 1
[ 1.574789] uhub3: 2 ports with 2 removable, self powered
[ 1.574789] uhub4 at usb4: NetBSD (0x0000) EHCI root hub (0x0000), class 9/0, rev 2.00/1.00, addr 1
[ 1.574789] uhub4: 8 ports with 8 removable, self powered
[ 1.584792] IPsec: Initialized Security Association Processing.
[ 1.594790] atapibus0 at atabus0: 2 targets
[ 1.684790] cd0 at atapibus0 drive 1: <TSSTcorpCD/DVDW TS-L632B, 95WK401090, TI33> cdrom removable
[ 1.684790] cd0: 32-bit data port
[ 1.684790] cd0: drive supports PIO mode 4, DMA mode 2, Ultra-DMA mode 2 (Ultra/33)
[ 1.684790] wd0 at atabus0 drive 0
[ 1.694791] wd0: <IC25N080ATMR04-0>
[ 1.694791] wd0: drive supports 16-sector PIO transfers, LBA48 addressing
[ 1.694791] wd0: 76319 MB, 155061 cyl, 16 head, 63 sec, 512 bytes/sect x 156301488 sectors
[ 2.144797] wd0: 32-bit data port
[ 2.144797] wd0: drive supports PIO mode 4, DMA mode 2, Ultra-DMA mode 5 (Ultra/100)
[ 2.144797] wd0(piixide0:0:0): using PIO mode 4, Ultra-DMA mode 5 (Ultra/100) (using DMA)
[ 2.144797] cd0(piixide0:0:1): using PIO mode 4, Ultra-DMA mode 2 (Ultra/33) (using DMA)
[ 2.234799] swwdog0: software watchdog initialized
[ 2.284800] WARNING: 2 errors while detecting hardware; check system log.
[ 2.284800] boot device: wd0
[ 2.284800] root on wd0a dumps on wd0b
[ 2.324801] root file system type: ffs
[ 2.324801] kern.module.path=/stand/i386/10.0/modules
[ 2.335349] [drm] Supports vblank timestamp caching Rev 2 (21.10.2013).
[ 2.335349] [drm] Driver supports precise vblank timestamp query.
[ 2.335349] i915drmkms0: interrupting at irq 11 (i915drmkms0)
[ 2.364802] [drm] Initialized overlay support.
[ 2.364802] [drm] Initialized i915 1.6.0 20200114 for i915drmkms0 on minor 0
[ 2.514811] intelfb0 at i915drmkms0
[ 2.514811] [drm] DRM_I915_DEBUG enabled
[ 2.514811] [drm] DRM_I915_DEBUG_GEM enabled
[ 2.514811] intelfb0: framebuffer at 0xa0009000, size 1280x800, depth 32, stride 5120
[ 3.094813] wsdisplay0 at intelfb0 kbdmux 1: console (default, vt100 emulation), using wskbd0
[ 3.094813] wsmux1: connecting to wsdisplay0
[ 4.274834] uhidev0 at uhub2 port 1 configuration 1 interface 0
[ 4.274834] uhidev0: vendor 1997 (0x1997) mini keyboard (0x2433), rev 1.10/1.10, addr 2, iclass 3/1
[ 4.284831] ukbd0 at uhidev0
[ 4.284831] wskbd1 at ukbd0 mux 1
[ 4.284831] wskbd1: connecting to wsdisplay0
[ 4.284831] uhidev1 at uhub2 port 1 configuration 1 interface 1
[ 4.284831] uhidev1: vendor 1997 (0x1997) mini keyboard (0x2433), rev 1.10/1.10, addr 2, iclass 3/1
[ 4.304832] uhidev1: 3 report ids
[ 4.304832] ums0 at uhidev1 reportid 1: 5 buttons and Z dir
[ 4.304832] wsmouse1 at ums0 mux 0
[ 4.304832] uhid0 at uhidev1 reportid 2: input=1, output=0, feature=0
[ 4.304832] uhid1 at uhidev1 reportid 3: input=2, output=0, feature=0
[ 4.304832] entropy: best effort
[ 74.355907] wsdisplay0: screen 1 added (default, vt100 emulation)
[ 74.365910] wsdisplay0: screen 2 added (default, vt100 emulation)
[ 74.365910] wsdisplay0: screen 3 added (default, vt100 emulation)
[ 74.365910] wsdisplay0: screen 4 added (default, vt100 emulation)
[ 7459.551443] uvm_fault(0xc157f960, 0, 1) -> 0xe
[ 7459.551443] fatal page fault in supervisor mode
[ 7459.551443] trap type 6 code 0 eip 0xc0c47b88 cs 0x8 eflags 0x13282 cr2 0x10 ilevel 0 esp 0xdc7e1ee8
[ 7459.551443] curlwp 0xc4341600 pid 0 lid 63 lowest kstack 0xdc7e02c0
[ 7459.551443] panic: trap
[ 7459.551443] cpu0: Begin traceback...
[ 7459.551443] vpanic(c1186ce0,dc7e1dc0,dc7e1e7c,c012fed8,c1186ce0,dc7e1e88,dc7e1e88,3f,dc7e02c0,13282) at netbsd:vpanic+0x196
[ 7459.551443] panic(c1186ce0,dc7e1e88,dc7e1e88,3f,dc7e02c0,13282,10,0,dc7e1ee8,c157f960) at netbsd:panic+0x18
[ 7459.561447] trap() at netbsd:trap+0xd51
[ 7459.561447] --- trap (number 6) ---
[ 7459.561447] uvm_vm_page_to_phys(0,c3dfd004,c5ace900,dc7e1efc,0,c5ace900,dc7e1efc,c06cd118,0,c5ace9b0) at netbsd:uvm_vm_page_to_phys+0x6
[ 7459.561447] pmap_page_remove(0,c5ace9b0,c5ace900,dc7e1f48,c06cd604,c5ace900,1,0,c0c5dbef,0) at netbsd:pmap_page_remove+0x13
[ 7459.561447] i915_gem_object_release_mmap_offset(c5ace900,1,0,c0c5dbef,0,0,c3dff878,0,c5ace9b0,c5ace9ac) at netbsd:i915_gem_object_release_mmap_offset+0x3b
[ 7459.561447] __i915_gem_free_objects(c3dfea1c,c42a2f00,fffffffe,ffffffff,120,c4341600,c42a2f1c,dc7e1f78,c42a2f04,c42a2f1c) at netbsd:__i915_gem_free_objects+0x80
[ 7459.561447] linux_workqueue_thread(c42a2f00,1849000,1854000,0,c01005a8,0,0,0,0,0) at netbsd:linux_workqueue_thread+0xe6
[ 7459.571447] cpu0: End traceback...
[ 7459.571447] dumping to dev 0,1 offset 1023
[ 7459.571447] dump
netbsd-compal#
netbsd-compal# vmstat -M netbsd.3.core -N netbsd.3 -s
4096 bytes per page
64 page colors
506685 pages managed
84453 pages free
0 pages paging
35468 pages wired
1 reserve pagedaemon pages
5 reserve kernel pages
9402 boot kernel pages
40517 kernel pool pages
47888 anonymous pages
314479 cached file pages
16838 cached executable pages
256 minimum free pages
341 target free pages
168895 maximum wired pages
1 swap devices
522237 swap pages
0 swap pages in use
0 swap allocations
1702737 total faults taken
1592937 traps
2257774 device interrupts
2519014 CPU context switches
2612315 software interrupts
6872736 system calls
0 pagein requests
0 pageout requests
0 pages swapped in
0 pages swapped out
1777 forks total
749 forks blocked parent
749 forks shared address space with parent
2078128 pagealloc desired color avail
476938 pagealloc desired color not avail
0 pagealloc local cpu avail
2555066 pagealloc local cpu not avail
46 faults with no memory
0 faults with no anons
0 faults had to wait on pages
0 faults found released page
161864 faults relock (161850 ok)
188751 anon page faults
0 anon retry faults
115801 amap copy faults
0 neighbour anon page faults
857960 neighbour object page faults
559639 locked pager get faults
161864 unlocked pager get faults
163900 anon faults
24851 anon copy on write faults
508886 object faults
50736 promote copy faults
407127 promote zero fill faults
0 faults upgraded lock
0 faults couldn't upgrade lock
991 times daemon wokeup
991 revolutions of the clock hand
1316572 pages freed by daemon
1525176 pages scanned by daemon
0 anonymous pages scanned by daemon
1316572 object pages scanned by daemon
724 pages reactivated
0 pages found busy by daemon
0 total pending pageouts
1710899 pages deactivated
0 per-cpu stats synced
0 anon pages possibly dirty
0 anon pages dirty
0 anon pages clean
0 file pages possibly dirty
0 file pages dirty
0 file pages clean
1192643 total name lookups
919841 good hits
145944 negative hits
2291 bad hits
0 false hits
124567 miss
0 too long
357 pass2 hits
515 2passes
1645 reverse hits
3 reverse miss
0 access denied
cache hits (77% pos + 12% neg) system 0% per-process
deletions 0%, falsehits 0%, toolong 0%
netbsd-compal#
netbsd-compal# gdb netbsd.3
netbsd.3 netbsd.3.core
netbsd-compal# gdb netbsd.3
GNU gdb (GDB) 11.0.50.20200914-git
Copyright (C) 2020 Free Software Foundation, Inc.
License GPLv3+: GNU GPL version 3 or later <http://gnu.org/licenses/gpl.html>
This is free software: you are free to change and redistribute it.
There is NO WARRANTY, to the extent permitted by law.
Type "show copying" and "show warranty" for details.
This GDB was configured as "i486--netbsdelf".
Type "show configuration" for configuration details.
For bug reporting instructions, please see:
<https://www.gnu.org/software/gdb/bugs/>.
Find the GDB manual and other documentation resources online at:
<http://www.gnu.org/software/gdb/documentation/>.
For help, type "help".
Type "apropos word" to search for commands related to "word"...
BFD: warning: /var/crash/netbsd.3 has a section extending past end of file
Reading symbols from netbsd.3...
(No debugging symbols found in netbsd.3)
(gdb) target kcore netbsd.3.core
Undefined target command: "kcore netbsd.3.core". Try "help target".
(gdb) target kvm netbsd.3.core
0xc012d6ed in cpu_reboot ()
(gdb) bt
#0 0xc012d6ed in cpu_reboot ()
#1 0xc0c85ca7 in kern_reboot ()
#2 0xc0cbc868 in vpanic ()
#3 0xc0cbc921 in panic ()
#4 0xc012fed8 in trap ()
#5 0xc012529b in alltraps ()
#6 0xdc7e1e88 in end ()
#7 0xc0b20010 in drm_mode_dirtyfb_ioctl ()
#8 0xc049813a in pmap_page_remove ()
#9 0xc06cd118 in i915_gem_object_release_mmap_offset ()
#10 0xc06cd604 in __i915_gem_free_objects ()
#11 0xc0aef545 in linux_workqueue_thread ()
#12 0xc0102011 in lwp_trampoline ()
(gdb)
netbsd-compal# cat /var/log/Xorg.0.log
[ 156.709]
X.Org X Server 1.21.1.9
X Protocol Version 11, Revision 0
[ 156.709] Current Operating System: NetBSD netbsd-compal.remigio 10.0_RC2 NetBSD 10.0_RC2 (GENERIC) #0: Mon Jan 1 14:04:52 UTC 2024 mkrepro@mkrepro.NetBSD.org:/usr/src/sys/arch/i386/compile/GENERIC i386
[ 156.709]
[ 156.709] Current version of pixman: 0.38.4
[ 156.709] Before reporting problems, check http://wiki.x.org
to make sure that you have the latest version.
[ 156.709] Markers: (--) probed, (**) from config file, (==) default setting,
(++) from command line, (!!) notice, (II) informational,
(WW) warning, (EE) error, (NI) not implemented, (??) unknown.
[ 156.710] (==) Log file: "/var/log/Xorg.0.log", Time: Tue Jan 9 19:15:50 2024
[ 156.740] (II) Loader magic: 0xa64c80
[ 156.740] (II) Module ABI versions:
[ 156.740] X.Org ANSI C Emulation: 0.4
[ 156.740] X.Org Video Driver: 25.2
[ 156.740] X.Org XInput driver : 24.4
[ 156.740] X.Org Server Extension : 10.0
[ 156.750] (--) PCI:*(0@0:2:0) 8086:2592:14c0:0012 rev 4, Mem @ 0xd0000000/524288, 0xa0000000/268435456, 0xd0080000/262144, I/O @ 0x0000e000/8
[ 156.750] (--) PCI: (0@0:2:1) 8086:2792:14c0:0012 rev 4, Mem @ 0xd0100000/524288
[ 156.751] (==) Using default built-in configuration (39 lines)
[ 156.751] (==) --- Start of built-in configuration ---
[ 156.751] Section "Device"
[ 156.751] Identifier "Builtin Default intel Device 0"
[ 156.751] Driver "intel"
[ 156.751] EndSection
[ 156.751] Section "Screen"
[ 156.751] Identifier "Builtin Default intel Screen 0"
[ 156.751] Device "Builtin Default intel Device 0"
[ 156.751] EndSection
[ 156.751] Section "Device"
[ 156.751] Identifier "Builtin Default modesetting Device 0"
[ 156.751] Driver "modesetting"
[ 156.751] EndSection
[ 156.751] Section "Screen"
[ 156.751] Identifier "Builtin Default modesetting Screen 0"
[ 156.751] Device "Builtin Default modesetting Device 0"
[ 156.751] EndSection
[ 156.751] Section "Device"
[ 156.751] Identifier "Builtin Default vesa Device 0"
[ 156.751] Driver "vesa"
[ 156.751] EndSection
[ 156.751] Section "Screen"
[ 156.751] Identifier "Builtin Default vesa Screen 0"
[ 156.751] Device "Builtin Default vesa Device 0"
[ 156.751] EndSection
[ 156.751] Section "Device"
[ 156.751] Identifier "Builtin Default wsfb Device 0"
[ 156.751] Driver "wsfb"
[ 156.751] EndSection
[ 156.751] Section "Screen"
[ 156.751] Identifier "Builtin Default wsfb Screen 0"
[ 156.751] Device "Builtin Default wsfb Device 0"
[ 156.751] EndSection
[ 156.751] Section "ServerLayout"
[ 156.751] Identifier "Builtin Default Layout"
[ 156.752] Screen "Builtin Default intel Screen 0"
[ 156.752] Screen "Builtin Default modesetting Screen 0"
[ 156.752] Screen "Builtin Default vesa Screen 0"
[ 156.752] Screen "Builtin Default wsfb Screen 0"
[ 156.752] EndSection
[ 156.752] (==) --- End of built-in configuration ---
[ 156.752] (==) ServerLayout "Builtin Default Layout"
[ 156.752] (**) |-->Screen "Builtin Default intel Screen 0" (0)
[ 156.752] (**) | |-->Monitor "<default monitor>"
[ 156.764] (**) | |-->Device "Builtin Default intel Device 0"
[ 156.764] (==) No monitor specified for screen "Builtin Default intel Screen 0".
Using a default monitor configuration.
[ 156.764] (**) |-->Screen "Builtin Default modesetting Screen 0" (1)
[ 156.764] (**) | |-->Monitor "<default monitor>"
[ 156.765] (**) | |-->Device "Builtin Default modesetting Device 0"
[ 156.765] (==) No monitor specified for screen "Builtin Default modesetting Screen 0".
Using a default monitor configuration.
[ 156.765] (**) |-->Screen "Builtin Default vesa Screen 0" (2)
[ 156.765] (**) | |-->Monitor "<default monitor>"
[ 156.765] (**) | |-->Device "Builtin Default vesa Device 0"
[ 156.765] (==) No monitor specified for screen "Builtin Default vesa Screen 0".
Using a default monitor configuration.
[ 156.765] (**) |-->Screen "Builtin Default wsfb Screen 0" (3)
[ 156.765] (**) | |-->Monitor "<default monitor>"
[ 156.766] (**) | |-->Device "Builtin Default wsfb Device 0"
[ 156.766] (==) No monitor specified for screen "Builtin Default wsfb Screen 0".
Using a default monitor configuration.
[ 156.766] (==) Automatically adding devices
[ 156.766] (==) Automatically enabling devices
[ 156.766] (==) Not automatically adding GPU devices
[ 156.766] (==) Automatically binding GPU devices
[ 156.766] (==) Max clients allowed: 256, resource mask: 0x1fffff
[ 156.801] (WW) The directory "/usr/pkg/share/fonts/X11/misc/" does not exist.
[ 156.801] Entry deleted from font path.
[ 156.801] (WW) The directory "/usr/pkg/share/fonts/X11/TTF/" does not exist.
[ 156.801] Entry deleted from font path.
[ 156.801] (WW) The directory "/usr/pkg/share/fonts/X11/Type1/" does not exist.
[ 156.801] Entry deleted from font path.
[ 156.802] (WW) The directory "/usr/pkg/share/fonts/X11/75dpi/" does not exist.
[ 156.802] Entry deleted from font path.
[ 156.802] (WW) The directory "/usr/pkg/share/fonts/X11/100dpi/" does not exist.
[ 156.802] Entry deleted from font path.
[ 156.802] (==) FontPath set to:
/usr/X11R7/lib/X11/fonts/misc/,
/usr/X11R7/lib/X11/fonts/TTF/,
/usr/X11R7/lib/X11/fonts/Type1/,
/usr/X11R7/lib/X11/fonts/75dpi/,
/usr/X11R7/lib/X11/fonts/100dpi/
[ 156.802] (==) ModulePath set to "/usr/X11R7/lib/modules"
[ 156.802] (II) The server relies on wscons to provide the list of input devices.
If no devices become available, reconfigure wscons or disable AutoAddDevices.
[ 156.802] (II) LoadModule: "glx"
[ 156.818] (II) Loading /usr/X11R7/lib/modules/extensions/libglx.so
[ 156.842] (II) Module glx: vendor="X.Org Foundation"
[ 156.842] compiled for 1.21.1.9, module version = 1.0.0
[ 156.842] ABI class: X.Org Server Extension, version 10.0
[ 156.861] (II) LoadModule: "intel"
[ 156.862] (II) Loading /usr/X11R7/lib/modules/drivers/intel_drv.so
[ 156.933] (II) Module intel: vendor="X.Org Foundation"
[ 156.933] compiled for 1.21.1.9, module version = 2.99.917
[ 156.933] Module class: X.Org Video Driver
[ 156.933] ABI class: X.Org Video Driver, version 25.2
[ 156.941] (II) LoadModule: "modesetting"
[ 156.942] (II) Loading /usr/X11R7/lib/modules/drivers/modesetting_drv.so
[ 156.964] (II) Module modesetting: vendor="X.Org Foundation"
[ 156.964] compiled for 1.21.1.9, module version = 1.21.1
[ 156.964] Module class: X.Org Video Driver
[ 156.964] ABI class: X.Org Video Driver, version 25.2
[ 156.964] (II) LoadModule: "vesa"
[ 156.965] (II) Loading /usr/X11R7/lib/modules/drivers/vesa_drv.so
[ 156.984] (II) Module vesa: vendor="X.Org Foundation"
[ 156.984] compiled for 1.21.1.9, module version = 2.5.0
[ 156.984] Module class: X.Org Video Driver
[ 156.984] ABI class: X.Org Video Driver, version 25.2
[ 156.984] (II) LoadModule: "wsfb"
[ 156.984] (II) Loading /usr/X11R7/lib/modules/drivers/wsfb_drv.so
[ 156.989] (II) Module wsfb: vendor="X.Org Foundation"
[ 156.989] compiled for 1.21.1.9, module version = 0.4.0
[ 156.990] ABI class: X.Org Video Driver, version 25.2
[ 156.990] (II) intel: Driver for Intel(R) Integrated Graphics Chipsets:
i810, i810-dc100, i810e, i815, i830M, 845G, 854, 852GM/855GM, 865G,
915G, E7221 (i915), 915GM, 945G, 945GM, 945GME, Pineview GM,
Pineview G, 965G, G35, 965Q, 946GZ, 965GM, 965GME/GLE, G33, Q35, Q33,
GM45, 4 Series, G45/G43, Q45/Q43, G41, B43
[ 156.990] (II) intel: Driver for Intel(R) HD Graphics
[ 156.990] (II) intel: Driver for Intel(R) Iris(TM) Graphics
[ 156.990] (II) intel: Driver for Intel(R) Iris(TM) Pro Graphics
[ 156.990] (II) modesetting: Driver for Modesetting Kernel Drivers: kms
[ 156.990] (II) VESA: driver for VESA chipsets: vesa
[ 156.990] (II) wsfb: driver for wsdisplay framebuffer: wsfb
[ 156.990] (--) Using wscons driver on /dev/ttyE4 in pcvt compatibility mode (version 3.32)
[ 156.990] (--) using VT number 5
[ 157.030] (II) intel(0): Using Kernel Mode Setting driver: i915, version 1.6.0 20200114
[ 157.033] (WW) Falling back to old probe method for modesetting
[ 157.033] (WW) Falling back to old probe method for wsfb
[ 157.033] (WW) VGA arbiter: cannot open kernel arbiter, no multi-card support
[ 157.034] (--) intel(0): Integrated Graphics Chipset: Intel(R) 915GM
[ 157.034] (--) intel(0): CPU: x86, sse2; using a maximum of 1 threads
[ 157.034] (II) intel(0): Creating default Display subsection in Screen section
"Builtin Default intel Screen 0" for depth/fbbpp 24/32
[ 157.034] (==) intel(0): Depth 24, (--) framebuffer bpp 32
[ 157.034] (==) intel(0): RGB weight 888
[ 157.034] (==) intel(0): Default visual is TrueColor
[ 157.065] (II) intel(0): Output LVDS1 has no monitor section
[ 157.078] (II) intel(0): Enabled output LVDS1
[ 157.078] (II) intel(0): Output VGA1 has no monitor section
[ 157.078] (II) intel(0): Enabled output VGA1
[ 157.078] (II) intel(0): Output TV1 has no monitor section
[ 157.078] (II) intel(0): Enabled output TV1
[ 157.078] (--) intel(0): Using a maximum size of 256x256 for hardware cursors
[ 157.079] (II) intel(0): Output VIRTUAL1 has no monitor section
[ 157.079] (II) intel(0): Enabled output VIRTUAL1
[ 157.079] (--) intel(0): Output LVDS1 using initial mode 1280x800 on pipe 1
[ 157.079] (==) intel(0): TearFree enabled
[ 157.079] (==) intel(0): Using gamma correction (1.0, 1.0, 1.0)
[ 157.079] (==) intel(0): DPI set to (96, 96)
[ 157.079] (II) Loading sub module "dri2"
[ 157.079] (II) LoadModule: "dri2"
[ 157.079] (II) Module "dri2" already built-in
[ 157.079] (II) UnloadModule: "modesetting"
[ 157.079] (II) Unloading modesetting
[ 157.079] (II) UnloadModule: "vesa"
[ 157.079] (II) Unloading vesa
[ 157.079] (II) UnloadModule: "wsfb"
[ 157.079] (II) Unloading wsfb
[ 157.131] (II) intel(0): SNA initialized with Alviso (gen3) backend
[ 157.131] (==) intel(0): Backing store enabled
[ 157.131] (==) intel(0): Silken mouse enabled
[ 157.141] (II) intel(0): HW Cursor enabled
[ 157.144] (==) intel(0): DPMS enabled
[ 157.177] (II) intel(0): [DRI2] Setup complete
[ 157.177] (II) intel(0): [DRI2] DRI driver: i915
[ 157.177] (II) intel(0): [DRI2] VDPAU driver: va_gl
[ 157.177] (II) intel(0): direct rendering: DRI2 enabled
[ 157.192] (II) Initializing extension Generic Event Extension
[ 157.193] (II) Initializing extension SHAPE
[ 157.193] (II) Initializing extension MIT-SHM
[ 157.194] (II) Initializing extension XInputExtension
[ 157.196] (II) Initializing extension XTEST
[ 157.197] (II) Initializing extension BIG-REQUESTS
[ 157.197] (II) Initializing extension SYNC
[ 157.198] (II) Initializing extension XKEYBOARD
[ 157.208] (II) Initializing extension XC-MISC
[ 157.209] (II) Initializing extension SECURITY
[ 157.210] (II) Initializing extension XFIXES
[ 157.211] (II) Initializing extension XFree86-Bigfont
[ 157.212] (II) Initializing extension RENDER
[ 157.213] (II) Initializing extension RANDR
[ 157.214] (II) Initializing extension COMPOSITE
[ 157.222] (II) Initializing extension DAMAGE
[ 157.223] (II) Initializing extension MIT-SCREEN-SAVER
[ 157.231] (II) Initializing extension DOUBLE-BUFFER
[ 157.236] (II) Initializing extension RECORD
[ 157.237] (II) Initializing extension DPMS
[ 157.237] (II) Initializing extension Present
[ 157.239] (II) Initializing extension DRI3
[ 157.239] (II) Initializing extension X-Resource
[ 157.240] (II) Initializing extension XVideo
[ 157.240] (II) Initializing extension XVideo-MotionCompensation
[ 157.240] (II) Initializing extension GLX
[ 157.690] (II) AIGLX: Loaded and initialized i915
[ 157.690] (II) GLX: Initialized DRI2 GL provider for screen 0
[ 157.690] (II) Initializing extension XFree86-VidModeExtension
[ 157.691] (II) Initializing extension XFree86-DGA
[ 157.692] (II) Initializing extension XFree86-DRI
[ 157.692] (II) Initializing extension DRI2
[ 157.751] (II) intel(0): switch to mode 1280x800@60.0 on LVDS1 using pipe 1, position (0, 0), rotation normal, reflection none
[ 157.761] (II) intel(0): Setting screen physical size to 338 x 211
[ 158.451] (II) config/wscons: checking input device /dev/wskbd
[ 158.451] (II) wskbd: using layout es
[ 158.461] (II) LoadModule: "kbd"
[ 158.462] (II) Loading /usr/X11R7/lib/modules/drivers/kbd_drv.so
[ 158.487] (II) Module kbd: vendor="X.Org Foundation"
[ 158.487] compiled for 1.21.1.9, module version = 2.0.0
[ 158.487] Module class: X.Org XInput Driver
[ 158.487] ABI class: X.Org XInput driver, version 24.4
[ 158.487] (II) Using input driver 'kbd' for '/dev/wskbd'
[ 158.487] (**) /dev/wskbd: always reports core events
[ 158.487] (**) /dev/wskbd: always reports core events
[ 158.487] (**) Option "Protocol" "standard"
[ 158.487] (**) Option "XkbRules" "base"
[ 158.487] (**) Option "XkbModel" "pc105"
[ 158.487] (**) Option "XkbLayout" "es"
[ 158.487] (II) XINPUT: Adding extended input device "/dev/wskbd" (type: KEYBOARD, id 6)
[ 158.587] (II) config/wscons: checking input device /dev/wsmouse
[ 158.587] (II) LoadModule: "ws"
[ 158.588] (II) Loading /usr/X11R7/lib/modules/drivers/ws_drv.so
[ 158.595] (II) Module ws: vendor="X.Org Foundation"
[ 158.595] compiled for 1.21.1.9, module version = 1.3.0
[ 158.595] Module class: X.Org XInput Driver
[ 158.595] ABI class: X.Org XInput driver, version 24.4
[ 158.595] (II) Using input driver 'ws' for '/dev/wsmouse'
[ 158.595] (**) /dev/wsmouse: always reports core events
[ 158.595] (II) /dev/wsmouse: debuglevel 0
[ 158.595] (**) /dev/wsmouse: ZAxisMapping: buttons 4 and 5
[ 158.595] (**) /dev/wsmouse associated screen: 0
[ 158.595] (**) Option "Device" "/dev/wsmouse"
[ 158.598] (II) /dev/wsmouse minimum x position: 0
[ 158.598] (II) /dev/wsmouse maximum x position: 1279
[ 158.598] (II) /dev/wsmouse minimum y position: 0
[ 158.598] (II) /dev/wsmouse maximum y position: 799
[ 158.598] (**) /dev/wsmouse: Buttons: 5
[ 158.637] (II) XINPUT: Adding extended input device "/dev/wsmouse" (type: MOUSE, id 7)
[ 158.640] (**) /dev/wsmouse: (accel) keeping acceleration scheme 1
[ 158.640] (**) /dev/wsmouse: (accel) acceleration profile 0
[ 158.640] (**) /dev/wsmouse: (accel) acceleration factor: 2.000
[ 158.640] (**) /dev/wsmouse: (accel) acceleration threshold: 4
[ 159.168] (II) intel(0): EDID vendor "CMO", prod id 5380
[ 159.168] (II) intel(0): Printing DDC gathered Modelines:
[ 159.168] (II) intel(0): Modeline "1280x800"x0.0 71.00 1280 1328 1360 1440 800 803 809 823 -hsync -vsync (49.3 kHz eP)
netbsd-compal#
>How-To-Repeat:
Just exit the desktop.
>Fix:
No fix known
>Release-Note:
>Audit-Trail:
From: "David H. Gutteridge" <david@gutteridge.ca>
To: gnats-bugs@netbsd.org
Cc:
Subject: Re: kern/57833: kernel panic on xorg exit
Date: Wed, 10 Jan 2024 10:30:02 -0500
This is 100% reproducible for me with similar hardware. I hadn't got
around to filing it, thanks. Certainly on exit from X, every time I
get a kernel panic. There may be a second path, where I was doing
something still inside a WM (awesome, not that I think that matters)
which may have also tripped the same issue. This is a regression from
9.3_STABLE.
Dave
From: Ramiro Aceves <ea1abz@gmail.com>
To: gnats-bugs@netbsd.org, kern-bug-people@netbsd.org,
gnats-admin@netbsd.org, netbsd-bugs@netbsd.org
Cc: "David H. Gutteridge" <david@gutteridge.ca>
Subject: Re: kern/57833: kernel panic on xorg exit
Date: Wed, 10 Jan 2024 19:23:35 +0100
El 10/1/24 a las 16:35, David H. Gutteridge escribió:
> The following reply was made to PR kern/57833; it has been noted by GNATS.
>
> From: "David H. Gutteridge" <david@gutteridge.ca>
> To: gnats-bugs@netbsd.org
> Cc:
> Subject: Re: kern/57833: kernel panic on xorg exit
> Date: Wed, 10 Jan 2024 10:30:02 -0500
>
> This is 100% reproducible for me with similar hardware. I hadn't got
> around to filing it, thanks. Certainly on exit from X, every time I
> get a kernel panic. There may be a second path, where I was doing
> something still inside a WM (awesome, not that I think that matters)
> which may have also tripped the same issue. This is a regression from
> 9.3_STABLE.
>
> Dave
>
Interesting.
Disabling i915drmkms driver at boot removes the panics but screen
horizontal resolution in Xorg is reduced to 1024 (from 1280 with the
i915 driver.)
Ramiro.
From: RVP <rvp@SDF.ORG>
To: Ramiro Aceves <ea1abz@gmail.com>
Cc: gnats-bugs@netbsd.org, "David H. Gutteridge" <david@gutteridge.ca>
Subject: Re: kern/57833: kernel panic on xorg exit
Date: Wed, 10 Jan 2024 23:34:50 +0000 (UTC)
On Wed, 10 Jan 2024, Ramiro Aceves wrote:
> Disabling i915drmkms driver at boot removes the panics but screen horizontal
> resolution in Xorg is reduced to 1024 (from 1280 with the i915 driver.)
>
Set a higher resolution in the bootloader using the `vesa' or `gop' command:
https://wiki.netbsd.org/tutorials/x11/how_to_use_wsfb_uefi_bios_framebuffer/
-RVP
From: Taylor R Campbell <riastradh@NetBSD.org>
To: Ramiro Aceves <ea1abz@gmail.com>,
"David H. Gutteridge" <david@gutteridge.ca>
Cc: gnats-bugs@NetBSD.org, netbsd-bugs@NetBSD.org
Subject: Re: kern/57833: kernel panic on xorg exit
Date: Thu, 11 Jan 2024 03:23:52 +0000
This is a multi-part message in MIME format.
--=_0HRkmbj5w4l3btWdYGspzomvaep+joYl
Can you please try the attached patch and see if it makes progress?
I don't know if this condition should be possible, so this might be
papering over the symptom rather than addressing the problem, but
maybe it'll work as a stop-gap measure.
--=_0HRkmbj5w4l3btWdYGspzomvaep+joYl
Content-Type: text/plain; charset="ISO-8859-1"; name="pr57833-i915gemrelmmapoffnullpage"
Content-Transfer-Encoding: quoted-printable
Content-Disposition: attachment; filename="pr57833-i915gemrelmmapoffnullpage.patch"
diff --git a/sys/external/bsd/drm2/dist/drm/i915/gem/i915_gem_mman.c b/sys/=
external/bsd/drm2/dist/drm/i915/gem/i915_gem_mman.c
index 8e592f008ef7..276ebbdbc234 100644
--- a/sys/external/bsd/drm2/dist/drm/i915/gem/i915_gem_mman.c
+++ b/sys/external/bsd/drm2/dist/drm/i915/gem/i915_gem_mman.c
@@ -677,6 +677,8 @@ void i915_gem_object_release_mmap_offset(struct drm_i91=
5_gem_object *obj)
return;
for (i =3D 0; i < obj->base.size >> PAGE_SHIFT; i++) {
page =3D obj->mm.pages->sgl->sg_pgs[i];
+ if (page =3D=3D NULL)
+ continue;
vm_page =3D &page->p_vmp;
pmap_page_protect(vm_page, VM_PROT_NONE);
}
--=_0HRkmbj5w4l3btWdYGspzomvaep+joYl--
From: Taylor R Campbell <riastradh@NetBSD.org>
To: Ramiro Aceves <ea1abz@gmail.com>,
"David H. Gutteridge" <david@gutteridge.ca>
Cc: gnats-bugs@NetBSD.org, netbsd-bugs@NetBSD.org
Subject: Re: kern/57833: kernel panic on xorg exit
Date: Thu, 11 Jan 2024 03:35:34 +0000
This is a multi-part message in MIME format.
--=_N0hLBzU5DjcEYheFlzRdAXMCmk/RN49m
Aside from working around the symptom -- do you get a core dump, and do you
have netbsd.gdb for a kernel which produces it?
If so, can you go to the i915_gem_object_release_mmap_offset frame,
and print some information?
# gdb ./netbsd.gdb
(gdb) target kvm netbsd.42.core
(gdb) frame 3 # or whatever the frame number is
(gdb) info locals
(gdb) print *obj
(gdb) print *obj->mm.pages
(gdb) print obj->mm.pages->sgl->sg_pgs[0]
--=_N0hLBzU5DjcEYheFlzRdAXMCmk/RN49m
Content-Type: text/plain; charset="ISO-8859-1"; name="pr57833-i915gemrelmmapoffnullpage"
Content-Transfer-Encoding: quoted-printable
Content-Disposition: attachment; filename="pr57833-i915gemrelmmapoffnullpage.patch"
diff --git a/sys/external/bsd/drm2/dist/drm/i915/gem/i915_gem_mman.c b/sys/=
external/bsd/drm2/dist/drm/i915/gem/i915_gem_mman.c
index 8e592f008ef7..276ebbdbc234 100644
--- a/sys/external/bsd/drm2/dist/drm/i915/gem/i915_gem_mman.c
+++ b/sys/external/bsd/drm2/dist/drm/i915/gem/i915_gem_mman.c
@@ -677,6 +677,8 @@ void i915_gem_object_release_mmap_offset(struct drm_i91=
5_gem_object *obj)
return;
for (i =3D 0; i < obj->base.size >> PAGE_SHIFT; i++) {
page =3D obj->mm.pages->sgl->sg_pgs[i];
+ if (page =3D=3D NULL)
+ continue;
vm_page =3D &page->p_vmp;
pmap_page_protect(vm_page, VM_PROT_NONE);
}
--=_N0hLBzU5DjcEYheFlzRdAXMCmk/RN49m--
State-Changed-From-To: open->feedback
State-Changed-By: riastradh@NetBSD.org
State-Changed-When: Thu, 11 Jan 2024 03:48:49 +0000
State-Changed-Why:
feedback requested
From: Taylor R Campbell <riastradh@NetBSD.org>
To: Ramiro Aceves <ea1abz@gmail.com>,
"David H. Gutteridge" <david@gutteridge.ca>
Cc: gnats-bugs@NetBSD.org, netbsd-bugs@NetBSD.org
Subject: Re: kern/57833: kernel panic on xorg exit
Date: Thu, 11 Jan 2024 04:37:03 +0000
This is a multi-part message in MIME format.
--=_rcF9s9y1wcdKoxr8Pe72O3MsTry8XuO4
Can you also try the attached patch, instead of the other one, to see
what happens?
(This might break things more spectacularly -- I haven't thought about
whether it makes a lot of sense -- but it should at least prevent the
particular crash you observed, if we ever get that far with it.)
--=_rcF9s9y1wcdKoxr8Pe72O3MsTry8XuO4
Content-Type: text/plain; charset="ISO-8859-1"; name="pr57833-i915gempages"
Content-Transfer-Encoding: quoted-printable
Content-Disposition: attachment; filename="pr57833-i915gempages.patch"
diff --git a/sys/external/bsd/drm2/dist/drm/i915/gem/i915_gem_mman.c b/sys/=
external/bsd/drm2/dist/drm/i915/gem/i915_gem_mman.c
index 8e592f008ef7..276ebbdbc234 100644
--- a/sys/external/bsd/drm2/dist/drm/i915/gem/i915_gem_mman.c
+++ b/sys/external/bsd/drm2/dist/drm/i915/gem/i915_gem_mman.c
@@ -677,6 +677,8 @@ void i915_gem_object_release_mmap_offset(struct drm_i91=
5_gem_object *obj)
return;
for (i =3D 0; i < obj->base.size >> PAGE_SHIFT; i++) {
page =3D obj->mm.pages->sgl->sg_pgs[i];
+ if (page =3D=3D NULL)
+ continue;
vm_page =3D &page->p_vmp;
pmap_page_protect(vm_page, VM_PROT_NONE);
}
diff --git a/sys/external/bsd/drm2/dist/drm/i915/gem/i915_gem_phys.c b/sys/=
external/bsd/drm2/dist/drm/i915/gem/i915_gem_phys.c
index 3f68276eea5f..29772bdbd8d9 100644
--- a/sys/external/bsd/drm2/dist/drm/i915/gem/i915_gem_phys.c
+++ b/sys/external/bsd/drm2/dist/drm/i915/gem/i915_gem_phys.c
@@ -83,8 +83,14 @@ static int i915_gem_object_get_pages_phys(struct drm_i91=
5_gem_object *obj)
if (!st)
goto err_pci;
=20
+#ifdef __NetBSD__
+ if (sg_alloc_table_from_bus_dmamem(st, dmat, &obj->mm.u.phys.seg, 1,
+ GFP_KERNEL))
+ goto err_st;
+#else
if (sg_alloc_table(st, 1, GFP_KERNEL))
goto err_st;
+#endif
=20
sg =3D st->sgl;
#ifdef __NetBSD__
diff --git a/sys/external/bsd/drm2/dist/drm/i915/gem/i915_gem_region.c b/sy=
s/external/bsd/drm2/dist/drm/i915/gem/i915_gem_region.c
index 1a928988bd5f..5e8232b9634f 100644
--- a/sys/external/bsd/drm2/dist/drm/i915/gem/i915_gem_region.c
+++ b/sys/external/bsd/drm2/dist/drm/i915/gem/i915_gem_region.c
@@ -85,7 +85,15 @@ i915_gem_object_get_pages_buddy(struct drm_i915_gem_obje=
ct *obj)
=20
segs[i].ds_addr =3D mem->region.start + offset;
segs[i].ds_len =3D block_size;
+ i++;
}
+ KASSERT(i =3D=3D nsegs);
+
+ /* XXX errno NetBSD->Linux */
+ ret =3D -bus_dmamem_export_pages(dmat, segs, nsegs, sg->sg_pgs,
+ sg->sg_npgs);
+ if (ret)
+ goto err;
=20
/* XXX errno NetBSD->Linux */
ret =3D -bus_dmamap_create(dmat, size, nsegs, size, 0, BUS_DMA_WAITOK,
diff --git a/sys/external/bsd/drm2/dist/drm/i915/gem/i915_gem_stolen.c b/sy=
s/external/bsd/drm2/dist/drm/i915/gem/i915_gem_stolen.c
index b53d543fa894..08cf7f0001bf 100644
--- a/sys/external/bsd/drm2/dist/drm/i915/gem/i915_gem_stolen.c
+++ b/sys/external/bsd/drm2/dist/drm/i915/gem/i915_gem_stolen.c
@@ -506,14 +506,13 @@ i915_pages_create_for_stolen(struct drm_device *dev,
{
struct drm_i915_private *i915 =3D to_i915(dev);
struct sg_table *st;
+ struct scatterlist *sg;
#ifdef __NetBSD__
bus_dma_tag_t dmat =3D i915->drm.dmat;
bus_dma_segment_t *seg =3D NULL;
int nseg =3D 0, i;
bool loaded =3D false;
int ret;
-#else
- struct scatterlist *sg;
#endif
=20
GEM_BUG_ON(range_overflows(offset, size, resource_size(&i915->dsm)));
@@ -532,6 +531,7 @@ i915_pages_create_for_stolen(struct drm_device *dev,
return ERR_PTR(-ENOMEM);
}
=20
+ sg =3D st->sgl;
#ifdef __NetBSD__
KASSERT((size % PAGE_SIZE) =3D=3D 0);
nseg =3D size / PAGE_SIZE;
@@ -548,19 +548,25 @@ i915_pages_create_for_stolen(struct drm_device *dev,
seg[i].ds_len =3D PAGE_SIZE;
}
=20
+ /* XXX errno NetBSD->Linux */
+ ret =3D -bus_dmamem_export_pages(dmat, seg, nseg, sg->sg_pgs,
+ sg->sg_npgs);
+ if (ret)
+ goto err;
+
/* XXX errno NetBSD->Linux */
ret =3D -bus_dmamap_create(dmat, size, nseg, PAGE_SIZE, 0,
- BUS_DMA_WAITOK, &st->sgl->sg_dmamap);
+ BUS_DMA_WAITOK, &sg->sg_dmamap);
if (ret) {
DRM_ERROR("failed to create DMA map for stolen object: %d\n",
ret);
- st->sgl->sg_dmamap =3D NULL;
+ sg->sg_dmamap =3D NULL;
goto out;
}
- st->sgl->sg_dmat =3D dmat;
+ sg->sg_dmat =3D dmat;
=20
/* XXX errno NetBSD->Liux */
- ret =3D -bus_dmamap_load_raw(dmat, st->sgl->sg_dmamap, seg, nseg, size,
+ ret =3D -bus_dmamap_load_raw(dmat, sg->sg_dmamap, seg, nseg, size,
BUS_DMA_WAITOK);
if (ret) {
DRM_ERROR("failed to load DMA map for stolen object: %d\n",
@@ -571,13 +577,12 @@ i915_pages_create_for_stolen(struct drm_device *dev,
=20
out: if (ret) {
if (loaded)
- bus_dmamap_unload(dmat, st->sgl->sg_dmamap);
+ bus_dmamap_unload(dmat, sg->sg_dmamap);
sg_free_table(st);
kfree(st);
return ERR_PTR(ret);
}
#else
- sg =3D st->sgl;
sg->offset =3D 0;
sg->length =3D size;
=20
--=_rcF9s9y1wcdKoxr8Pe72O3MsTry8XuO4--
From: "David H. Gutteridge" <david@gutteridge.ca>
To: Taylor R Campbell <riastradh@netbsd.org>
Cc: gnats-bugs@netbsd.org
Subject: Re: kern/57833: kernel panic on xorg exit
Date: Thu, 11 Jan 2024 18:04:44 -0500
--=_79cd473ca3d4e19fbe52c232ee5dd792
Content-Transfer-Encoding: 7bit
Content-Type: text/plain; charset=US-ASCII;
format=flowed
On 2024-01-10 23:37, Taylor R Campbell wrote:
> Can you also try the attached patch, instead of the other one, to see
> what happens?
>
> (This might break things more spectacularly -- I haven't thought about
> whether it makes a lot of sense -- but it should at least prevent the
> particular crash you observed, if we ever get that far with it.)
I've supplied a debug log. (It can be found at:
https://www.netbsd.org/~gutteridge/pr57833_debug.log .)
Applying the first (small) patch did not prevent the panics. But the
larger patch did fix the problem for me. There was a slight coding
error with the second patch (wrong label for a goto statement), so it
didn't compile as-is. I've attached a revised patch that fixes that one
line, should anyone else want to test this.
Thanks,
Dave
--=_79cd473ca3d4e19fbe52c232ee5dd792
Content-Transfer-Encoding: base64
Content-Type: text/x-diff;
name=pr57833-i915gempages-v2.patch
Content-Disposition: attachment;
filename=pr57833-i915gempages-v2.patch;
size=4173
ZGlmZiAtLWdpdCBhL3N5cy9leHRlcm5hbC9ic2QvZHJtMi9kaXN0L2RybS9pOTE1L2dlbS9pOTE1
X2dlbV9tbWFuLmMgYi9zeXMvZXh0ZXJuYWwvYnNkL2RybTIvZGlzdC9kcm0vaTkxNS9nZW0vaTkx
NV9nZW1fbW1hbi5jCmluZGV4IDhlNTkyZjAwOGVmNy4uMjc2ZWJiZGJjMjM0IDEwMDY0NAotLS0g
YS9zeXMvZXh0ZXJuYWwvYnNkL2RybTIvZGlzdC9kcm0vaTkxNS9nZW0vaTkxNV9nZW1fbW1hbi5j
CisrKyBiL3N5cy9leHRlcm5hbC9ic2QvZHJtMi9kaXN0L2RybS9pOTE1L2dlbS9pOTE1X2dlbV9t
bWFuLmMKQEAgLTY3Nyw2ICs2NzcsOCBAQCB2b2lkIGk5MTVfZ2VtX29iamVjdF9yZWxlYXNlX21t
YXBfb2Zmc2V0KHN0cnVjdCBkcm1faTkxNV9nZW1fb2JqZWN0ICpvYmopCiAJCXJldHVybjsKIAlm
b3IgKGkgPSAwOyBpIDwgb2JqLT5iYXNlLnNpemUgPj4gUEFHRV9TSElGVDsgaSsrKSB7CiAJCXBh
Z2UgPSBvYmotPm1tLnBhZ2VzLT5zZ2wtPnNnX3Bnc1tpXTsKKwkJaWYgKHBhZ2UgPT0gTlVMTCkK
KwkJCWNvbnRpbnVlOwogCQl2bV9wYWdlID0gJnBhZ2UtPnBfdm1wOwogCQlwbWFwX3BhZ2VfcHJv
dGVjdCh2bV9wYWdlLCBWTV9QUk9UX05PTkUpOwogCX0KZGlmZiAtLWdpdCBhL3N5cy9leHRlcm5h
bC9ic2QvZHJtMi9kaXN0L2RybS9pOTE1L2dlbS9pOTE1X2dlbV9waHlzLmMgYi9zeXMvZXh0ZXJu
YWwvYnNkL2RybTIvZGlzdC9kcm0vaTkxNS9nZW0vaTkxNV9nZW1fcGh5cy5jCmluZGV4IDNmNjgy
NzZlZWE1Zi4uMjk3NzJiZGJkOGQ5IDEwMDY0NAotLS0gYS9zeXMvZXh0ZXJuYWwvYnNkL2RybTIv
ZGlzdC9kcm0vaTkxNS9nZW0vaTkxNV9nZW1fcGh5cy5jCisrKyBiL3N5cy9leHRlcm5hbC9ic2Qv
ZHJtMi9kaXN0L2RybS9pOTE1L2dlbS9pOTE1X2dlbV9waHlzLmMKQEAgLTgzLDggKzgzLDE0IEBA
IHN0YXRpYyBpbnQgaTkxNV9nZW1fb2JqZWN0X2dldF9wYWdlc19waHlzKHN0cnVjdCBkcm1faTkx
NV9nZW1fb2JqZWN0ICpvYmopCiAJaWYgKCFzdCkKIAkJZ290byBlcnJfcGNpOwogCisjaWZkZWYg
X19OZXRCU0RfXworCWlmIChzZ19hbGxvY190YWJsZV9mcm9tX2J1c19kbWFtZW0oc3QsIGRtYXQs
ICZvYmotPm1tLnUucGh5cy5zZWcsIDEsCisJCUdGUF9LRVJORUwpKQorCQlnb3RvIGVycl9zdDsK
KyNlbHNlCiAJaWYgKHNnX2FsbG9jX3RhYmxlKHN0LCAxLCBHRlBfS0VSTkVMKSkKIAkJZ290byBl
cnJfc3Q7CisjZW5kaWYKIAogCXNnID0gc3QtPnNnbDsKICNpZmRlZiBfX05ldEJTRF9fCmRpZmYg
LS1naXQgYS9zeXMvZXh0ZXJuYWwvYnNkL2RybTIvZGlzdC9kcm0vaTkxNS9nZW0vaTkxNV9nZW1f
cmVnaW9uLmMgYi9zeXMvZXh0ZXJuYWwvYnNkL2RybTIvZGlzdC9kcm0vaTkxNS9nZW0vaTkxNV9n
ZW1fcmVnaW9uLmMKaW5kZXggMWE5Mjg5ODhiZDVmLi41ZTgyMzJiOTYzNGYgMTAwNjQ0Ci0tLSBh
L3N5cy9leHRlcm5hbC9ic2QvZHJtMi9kaXN0L2RybS9pOTE1L2dlbS9pOTE1X2dlbV9yZWdpb24u
YworKysgYi9zeXMvZXh0ZXJuYWwvYnNkL2RybTIvZGlzdC9kcm0vaTkxNS9nZW0vaTkxNV9nZW1f
cmVnaW9uLmMKQEAgLTg1LDcgKzg1LDE1IEBAIGk5MTVfZ2VtX29iamVjdF9nZXRfcGFnZXNfYnVk
ZHkoc3RydWN0IGRybV9pOTE1X2dlbV9vYmplY3QgKm9iaikKIAogCQlzZWdzW2ldLmRzX2FkZHIg
PSBtZW0tPnJlZ2lvbi5zdGFydCArIG9mZnNldDsKIAkJc2Vnc1tpXS5kc19sZW4gPSBibG9ja19z
aXplOworCQlpKys7CiAJfQorCUtBU1NFUlQoaSA9PSBuc2Vncyk7CisKKwkvKiBYWFggZXJybm8g
TmV0QlNELT5MaW51eCAqLworCXJldCA9IC1idXNfZG1hbWVtX2V4cG9ydF9wYWdlcyhkbWF0LCBz
ZWdzLCBuc2Vncywgc2ctPnNnX3BncywKKwkgICAgc2ctPnNnX25wZ3MpOworCWlmIChyZXQpCisJ
CWdvdG8gZXJyOwogCiAJLyogWFhYIGVycm5vIE5ldEJTRC0+TGludXggKi8KIAlyZXQgPSAtYnVz
X2RtYW1hcF9jcmVhdGUoZG1hdCwgc2l6ZSwgbnNlZ3MsIHNpemUsIDAsIEJVU19ETUFfV0FJVE9L
LApkaWZmIC0tZ2l0IGEvc3lzL2V4dGVybmFsL2JzZC9kcm0yL2Rpc3QvZHJtL2k5MTUvZ2VtL2k5
MTVfZ2VtX3N0b2xlbi5jIGIvc3lzL2V4dGVybmFsL2JzZC9kcm0yL2Rpc3QvZHJtL2k5MTUvZ2Vt
L2k5MTVfZ2VtX3N0b2xlbi5jCmluZGV4IGI1M2Q1NDNmYTg5NC4uMDhjZjdmMDAwMWJmIDEwMDY0
NAotLS0gYS9zeXMvZXh0ZXJuYWwvYnNkL2RybTIvZGlzdC9kcm0vaTkxNS9nZW0vaTkxNV9nZW1f
c3RvbGVuLmMKKysrIGIvc3lzL2V4dGVybmFsL2JzZC9kcm0yL2Rpc3QvZHJtL2k5MTUvZ2VtL2k5
MTVfZ2VtX3N0b2xlbi5jCkBAIC01MDYsMTQgKzUwNiwxMyBAQCBpOTE1X3BhZ2VzX2NyZWF0ZV9m
b3Jfc3RvbGVuKHN0cnVjdCBkcm1fZGV2aWNlICpkZXYsCiB7CiAJc3RydWN0IGRybV9pOTE1X3By
aXZhdGUgKmk5MTUgPSB0b19pOTE1KGRldik7CiAJc3RydWN0IHNnX3RhYmxlICpzdDsKKwlzdHJ1
Y3Qgc2NhdHRlcmxpc3QgKnNnOwogI2lmZGVmIF9fTmV0QlNEX18KIAlidXNfZG1hX3RhZ190IGRt
YXQgPSBpOTE1LT5kcm0uZG1hdDsKIAlidXNfZG1hX3NlZ21lbnRfdCAqc2VnID0gTlVMTDsKIAlp
bnQgbnNlZyA9IDAsIGk7CiAJYm9vbCBsb2FkZWQgPSBmYWxzZTsKIAlpbnQgcmV0OwotI2Vsc2UK
LQlzdHJ1Y3Qgc2NhdHRlcmxpc3QgKnNnOwogI2VuZGlmCiAKIAlHRU1fQlVHX09OKHJhbmdlX292
ZXJmbG93cyhvZmZzZXQsIHNpemUsIHJlc291cmNlX3NpemUoJmk5MTUtPmRzbSkpKTsKQEAgLTUz
Miw2ICs1MzEsNyBAQCBpOTE1X3BhZ2VzX2NyZWF0ZV9mb3Jfc3RvbGVuKHN0cnVjdCBkcm1fZGV2
aWNlICpkZXYsCiAJCXJldHVybiBFUlJfUFRSKC1FTk9NRU0pOwogCX0KIAorCXNnID0gc3QtPnNn
bDsKICNpZmRlZiBfX05ldEJTRF9fCiAJS0FTU0VSVCgoc2l6ZSAlIFBBR0VfU0laRSkgPT0gMCk7
CiAJbnNlZyA9IHNpemUgLyBQQUdFX1NJWkU7CkBAIC01NDgsMTkgKzU0OCwyNSBAQCBpOTE1X3Bh
Z2VzX2NyZWF0ZV9mb3Jfc3RvbGVuKHN0cnVjdCBkcm1fZGV2aWNlICpkZXYsCiAJCXNlZ1tpXS5k
c19sZW4gPSBQQUdFX1NJWkU7CiAJfQogCisJLyogWFhYIGVycm5vIE5ldEJTRC0+TGludXggKi8K
KwlyZXQgPSAtYnVzX2RtYW1lbV9leHBvcnRfcGFnZXMoZG1hdCwgc2VnLCBuc2VnLCBzZy0+c2df
cGdzLAorCSAgICBzZy0+c2dfbnBncyk7CisJaWYgKHJldCkKKwkJZ290byBvdXQ7CisKIAkvKiBY
WFggZXJybm8gTmV0QlNELT5MaW51eCAqLwogCXJldCA9IC1idXNfZG1hbWFwX2NyZWF0ZShkbWF0
LCBzaXplLCBuc2VnLCBQQUdFX1NJWkUsIDAsCi0JICAgIEJVU19ETUFfV0FJVE9LLCAmc3QtPnNn
bC0+c2dfZG1hbWFwKTsKKwkgICAgQlVTX0RNQV9XQUlUT0ssICZzZy0+c2dfZG1hbWFwKTsKIAlp
ZiAocmV0KSB7CiAJCURSTV9FUlJPUigiZmFpbGVkIHRvIGNyZWF0ZSBETUEgbWFwIGZvciBzdG9s
ZW4gb2JqZWN0OiAlZFxuIiwKIAkJICAgIHJldCk7Ci0JCXN0LT5zZ2wtPnNnX2RtYW1hcCA9IE5V
TEw7CisJCXNnLT5zZ19kbWFtYXAgPSBOVUxMOwogCQlnb3RvIG91dDsKIAl9Ci0Jc3QtPnNnbC0+
c2dfZG1hdCA9IGRtYXQ7CisJc2ctPnNnX2RtYXQgPSBkbWF0OwogCiAJLyogWFhYIGVycm5vIE5l
dEJTRC0+TGl1eCAqLwotCXJldCA9IC1idXNfZG1hbWFwX2xvYWRfcmF3KGRtYXQsIHN0LT5zZ2wt
PnNnX2RtYW1hcCwgc2VnLCBuc2VnLCBzaXplLAorCXJldCA9IC1idXNfZG1hbWFwX2xvYWRfcmF3
KGRtYXQsIHNnLT5zZ19kbWFtYXAsIHNlZywgbnNlZywgc2l6ZSwKIAkgICAgQlVTX0RNQV9XQUlU
T0spOwogCWlmIChyZXQpIHsKIAkJRFJNX0VSUk9SKCJmYWlsZWQgdG8gbG9hZCBETUEgbWFwIGZv
ciBzdG9sZW4gb2JqZWN0OiAlZFxuIiwKQEAgLTU3MSwxMyArNTc3LDEyIEBAIGk5MTVfcGFnZXNf
Y3JlYXRlX2Zvcl9zdG9sZW4oc3RydWN0IGRybV9kZXZpY2UgKmRldiwKIAogb3V0OglpZiAocmV0
KSB7CiAJCWlmIChsb2FkZWQpCi0JCQlidXNfZG1hbWFwX3VubG9hZChkbWF0LCBzdC0+c2dsLT5z
Z19kbWFtYXApOworCQkJYnVzX2RtYW1hcF91bmxvYWQoZG1hdCwgc2ctPnNnX2RtYW1hcCk7CiAJ
CXNnX2ZyZWVfdGFibGUoc3QpOwogCQlrZnJlZShzdCk7CiAJCXJldHVybiBFUlJfUFRSKHJldCk7
CiAJfQogI2Vsc2UKLQlzZyA9IHN0LT5zZ2w7CiAJc2ctPm9mZnNldCA9IDA7CiAJc2ctPmxlbmd0
aCA9IHNpemU7CiAK
--=_79cd473ca3d4e19fbe52c232ee5dd792--
State-Changed-From-To: feedback->open
State-Changed-By: gutteridge@NetBSD.org
State-Changed-When: Thu, 11 Jan 2024 23:11:07 +0000
State-Changed-Why:
Feedback supplied.
From: Ramiro Aceves <ea1abz@gmail.com>
To: gnats-bugs@netbsd.org, kern-bug-people@netbsd.org,
gnats-admin@netbsd.org, netbsd-bugs@netbsd.org
Cc: rvP <rvp@SDF.ORG>
Subject: Re: kern/57833: kernel panic on xorg exit
Date: Fri, 12 Jan 2024 19:35:21 +0100
El 11/1/24 a las 0:35, RVP escribió:
> The following reply was made to PR kern/57833; it has been noted by GNATS.
>
> From: RVP <rvp@SDF.ORG>
> To: Ramiro Aceves <ea1abz@gmail.com>
> Cc: gnats-bugs@netbsd.org, "David H. Gutteridge" <david@gutteridge.ca>
> Subject: Re: kern/57833: kernel panic on xorg exit
> Date: Wed, 10 Jan 2024 23:34:50 +0000 (UTC)
>
> On Wed, 10 Jan 2024, Ramiro Aceves wrote:
>
> > Disabling i915drmkms driver at boot removes the panics but screen horizontal
> > resolution in Xorg is reduced to 1024 (from 1280 with the i915 driver.)
> >
>
> Set a higher resolution in the bootloader using the `vesa' or `gop' command:
Thanks RVP for the tip, but the maximum resolution available with "vesa
list" is 1024x768
Ramiro.
>
> https://wiki.netbsd.org/tutorials/x11/how_to_use_wsfb_uefi_bios_framebuffer/
>
> -RVP
>
From: Ramiro Aceves <ea1abz@gmail.com>
To: gnats-bugs@netbsd.org, kern-bug-people@netbsd.org,
gnats-admin@netbsd.org, netbsd-bugs@netbsd.org
Cc: "David H. Gutteridge" <david@gutteridge.ca>,
Taylor R Campbell <riastradh@NetBSD.org>
Subject: Re: kern/57833: kernel panic on xorg exit
Date: Fri, 12 Jan 2024 23:52:23 +0100
El 12/1/24 a las 0:05, David H. Gutteridge escribió:
> The following reply was made to PR kern/57833; it has been noted by GNATS.
>
> From: "David H. Gutteridge" <david@gutteridge.ca>
> To: Taylor R Campbell <riastradh@netbsd.org>
> Cc: gnats-bugs@netbsd.org
> Subject: Re: kern/57833: kernel panic on xorg exit
> Date: Thu, 11 Jan 2024 18:04:44 -0500
>
> --=_79cd473ca3d4e19fbe52c232ee5dd792
> Content-Transfer-Encoding: 7bit
> Content-Type: text/plain; charset=US-ASCII;
> format=flowed
>
> On 2024-01-10 23:37, Taylor R Campbell wrote:
> > Can you also try the attached patch, instead of the other one, to see
> > what happens?
> >
> > (This might break things more spectacularly -- I haven't thought about
> > whether it makes a lot of sense -- but it should at least prevent the
> > particular crash you observed, if we ever get that far with it.)
>
> I've supplied a debug log. (It can be found at:
> https://www.netbsd.org/~gutteridge/pr57833_debug.log .)
>
> Applying the first (small) patch did not prevent the panics. But the
> larger patch did fix the problem for me. There was a slight coding
> error with the second patch (wrong label for a goto statement), so it
> didn't compile as-is. I've attached a revised patch that fixes that one
> line, should anyone else want to test this.
>
> Thanks,
>
> Dave
Hello Dave, thanks for feedback. Here I had the same problem, I applied
the patch and could not compile the kernel because en error in 555 line
when compiling i915_gem_stolen.c file. I changed
goto err;
to
goto out;
(not sure if that is the right fix)
File compiled ok. Rebuilt the kernel and I had the same panic the first
time abandoned Xorg session.
Ramiro.
>
> --=_79cd473ca3d4e19fbe52c232ee5dd792
> Content-Transfer-Encoding: base64
> Content-Type: text/x-diff;
> name=pr57833-i915gempages-v2.patch
> Content-Disposition: attachment;
> filename=pr57833-i915gempages-v2.patch;
> size=4173
>
> ZGlmZiAtLWdpdCBhL3N5cy9leHRlcm5hbC9ic2QvZHJtMi9kaXN0L2RybS9pOTE1L2dlbS9pOTE1
> X2dlbV9tbWFuLmMgYi9zeXMvZXh0ZXJuYWwvYnNkL2RybTIvZGlzdC9kcm0vaTkxNS9nZW0vaTkx
> NV9nZW1fbW1hbi5jCmluZGV4IDhlNTkyZjAwOGVmNy4uMjc2ZWJiZGJjMjM0IDEwMDY0NAotLS0g
> YS9zeXMvZXh0ZXJuYWwvYnNkL2RybTIvZGlzdC9kcm0vaTkxNS9nZW0vaTkxNV9nZW1fbW1hbi5j
> CisrKyBiL3N5cy9leHRlcm5hbC9ic2QvZHJtMi9kaXN0L2RybS9pOTE1L2dlbS9pOTE1X2dlbV9t
> bWFuLmMKQEAgLTY3Nyw2ICs2NzcsOCBAQCB2b2lkIGk5MTVfZ2VtX29iamVjdF9yZWxlYXNlX21t
> YXBfb2Zmc2V0KHN0cnVjdCBkcm1faTkxNV9nZW1fb2JqZWN0ICpvYmopCiAJCXJldHVybjsKIAlm
> b3IgKGkgPSAwOyBpIDwgb2JqLT5iYXNlLnNpemUgPj4gUEFHRV9TSElGVDsgaSsrKSB7CiAJCXBh
> Z2UgPSBvYmotPm1tLnBhZ2VzLT5zZ2wtPnNnX3Bnc1tpXTsKKwkJaWYgKHBhZ2UgPT0gTlVMTCkK
> KwkJCWNvbnRpbnVlOwogCQl2bV9wYWdlID0gJnBhZ2UtPnBfdm1wOwogCQlwbWFwX3BhZ2VfcHJv
> dGVjdCh2bV9wYWdlLCBWTV9QUk9UX05PTkUpOwogCX0KZGlmZiAtLWdpdCBhL3N5cy9leHRlcm5h
> bC9ic2QvZHJtMi9kaXN0L2RybS9pOTE1L2dlbS9pOTE1X2dlbV9waHlzLmMgYi9zeXMvZXh0ZXJu
> YWwvYnNkL2RybTIvZGlzdC9kcm0vaTkxNS9nZW0vaTkxNV9nZW1fcGh5cy5jCmluZGV4IDNmNjgy
> NzZlZWE1Zi4uMjk3NzJiZGJkOGQ5IDEwMDY0NAotLS0gYS9zeXMvZXh0ZXJuYWwvYnNkL2RybTIv
> ZGlzdC9kcm0vaTkxNS9nZW0vaTkxNV9nZW1fcGh5cy5jCisrKyBiL3N5cy9leHRlcm5hbC9ic2Qv
> ZHJtMi9kaXN0L2RybS9pOTE1L2dlbS9pOTE1X2dlbV9waHlzLmMKQEAgLTgzLDggKzgzLDE0IEBA
> IHN0YXRpYyBpbnQgaTkxNV9nZW1fb2JqZWN0X2dldF9wYWdlc19waHlzKHN0cnVjdCBkcm1faTkx
> NV9nZW1fb2JqZWN0ICpvYmopCiAJaWYgKCFzdCkKIAkJZ290byBlcnJfcGNpOwogCisjaWZkZWYg
> X19OZXRCU0RfXworCWlmIChzZ19hbGxvY190YWJsZV9mcm9tX2J1c19kbWFtZW0oc3QsIGRtYXQs
> ICZvYmotPm1tLnUucGh5cy5zZWcsIDEsCisJCUdGUF9LRVJORUwpKQorCQlnb3RvIGVycl9zdDsK
> KyNlbHNlCiAJaWYgKHNnX2FsbG9jX3RhYmxlKHN0LCAxLCBHRlBfS0VSTkVMKSkKIAkJZ290byBl
> cnJfc3Q7CisjZW5kaWYKIAogCXNnID0gc3QtPnNnbDsKICNpZmRlZiBfX05ldEJTRF9fCmRpZmYg
> LS1naXQgYS9zeXMvZXh0ZXJuYWwvYnNkL2RybTIvZGlzdC9kcm0vaTkxNS9nZW0vaTkxNV9nZW1f
> cmVnaW9uLmMgYi9zeXMvZXh0ZXJuYWwvYnNkL2RybTIvZGlzdC9kcm0vaTkxNS9nZW0vaTkxNV9n
> ZW1fcmVnaW9uLmMKaW5kZXggMWE5Mjg5ODhiZDVmLi41ZTgyMzJiOTYzNGYgMTAwNjQ0Ci0tLSBh
> L3N5cy9leHRlcm5hbC9ic2QvZHJtMi9kaXN0L2RybS9pOTE1L2dlbS9pOTE1X2dlbV9yZWdpb24u
> YworKysgYi9zeXMvZXh0ZXJuYWwvYnNkL2RybTIvZGlzdC9kcm0vaTkxNS9nZW0vaTkxNV9nZW1f
> cmVnaW9uLmMKQEAgLTg1LDcgKzg1LDE1IEBAIGk5MTVfZ2VtX29iamVjdF9nZXRfcGFnZXNfYnVk
> ZHkoc3RydWN0IGRybV9pOTE1X2dlbV9vYmplY3QgKm9iaikKIAogCQlzZWdzW2ldLmRzX2FkZHIg
> PSBtZW0tPnJlZ2lvbi5zdGFydCArIG9mZnNldDsKIAkJc2Vnc1tpXS5kc19sZW4gPSBibG9ja19z
> aXplOworCQlpKys7CiAJfQorCUtBU1NFUlQoaSA9PSBuc2Vncyk7CisKKwkvKiBYWFggZXJybm8g
> TmV0QlNELT5MaW51eCAqLworCXJldCA9IC1idXNfZG1hbWVtX2V4cG9ydF9wYWdlcyhkbWF0LCBz
> ZWdzLCBuc2Vncywgc2ctPnNnX3BncywKKwkgICAgc2ctPnNnX25wZ3MpOworCWlmIChyZXQpCisJ
> CWdvdG8gZXJyOwogCiAJLyogWFhYIGVycm5vIE5ldEJTRC0+TGludXggKi8KIAlyZXQgPSAtYnVz
> X2RtYW1hcF9jcmVhdGUoZG1hdCwgc2l6ZSwgbnNlZ3MsIHNpemUsIDAsIEJVU19ETUFfV0FJVE9L
> LApkaWZmIC0tZ2l0IGEvc3lzL2V4dGVybmFsL2JzZC9kcm0yL2Rpc3QvZHJtL2k5MTUvZ2VtL2k5
> MTVfZ2VtX3N0b2xlbi5jIGIvc3lzL2V4dGVybmFsL2JzZC9kcm0yL2Rpc3QvZHJtL2k5MTUvZ2Vt
> L2k5MTVfZ2VtX3N0b2xlbi5jCmluZGV4IGI1M2Q1NDNmYTg5NC4uMDhjZjdmMDAwMWJmIDEwMDY0
> NAotLS0gYS9zeXMvZXh0ZXJuYWwvYnNkL2RybTIvZGlzdC9kcm0vaTkxNS9nZW0vaTkxNV9nZW1f
> c3RvbGVuLmMKKysrIGIvc3lzL2V4dGVybmFsL2JzZC9kcm0yL2Rpc3QvZHJtL2k5MTUvZ2VtL2k5
> MTVfZ2VtX3N0b2xlbi5jCkBAIC01MDYsMTQgKzUwNiwxMyBAQCBpOTE1X3BhZ2VzX2NyZWF0ZV9m
> b3Jfc3RvbGVuKHN0cnVjdCBkcm1fZGV2aWNlICpkZXYsCiB7CiAJc3RydWN0IGRybV9pOTE1X3By
> aXZhdGUgKmk5MTUgPSB0b19pOTE1KGRldik7CiAJc3RydWN0IHNnX3RhYmxlICpzdDsKKwlzdHJ1
> Y3Qgc2NhdHRlcmxpc3QgKnNnOwogI2lmZGVmIF9fTmV0QlNEX18KIAlidXNfZG1hX3RhZ190IGRt
> YXQgPSBpOTE1LT5kcm0uZG1hdDsKIAlidXNfZG1hX3NlZ21lbnRfdCAqc2VnID0gTlVMTDsKIAlp
> bnQgbnNlZyA9IDAsIGk7CiAJYm9vbCBsb2FkZWQgPSBmYWxzZTsKIAlpbnQgcmV0OwotI2Vsc2UK
> LQlzdHJ1Y3Qgc2NhdHRlcmxpc3QgKnNnOwogI2VuZGlmCiAKIAlHRU1fQlVHX09OKHJhbmdlX292
> ZXJmbG93cyhvZmZzZXQsIHNpemUsIHJlc291cmNlX3NpemUoJmk5MTUtPmRzbSkpKTsKQEAgLTUz
> Miw2ICs1MzEsNyBAQCBpOTE1X3BhZ2VzX2NyZWF0ZV9mb3Jfc3RvbGVuKHN0cnVjdCBkcm1fZGV2
> aWNlICpkZXYsCiAJCXJldHVybiBFUlJfUFRSKC1FTk9NRU0pOwogCX0KIAorCXNnID0gc3QtPnNn
> bDsKICNpZmRlZiBfX05ldEJTRF9fCiAJS0FTU0VSVCgoc2l6ZSAlIFBBR0VfU0laRSkgPT0gMCk7
> CiAJbnNlZyA9IHNpemUgLyBQQUdFX1NJWkU7CkBAIC01NDgsMTkgKzU0OCwyNSBAQCBpOTE1X3Bh
> Z2VzX2NyZWF0ZV9mb3Jfc3RvbGVuKHN0cnVjdCBkcm1fZGV2aWNlICpkZXYsCiAJCXNlZ1tpXS5k
> c19sZW4gPSBQQUdFX1NJWkU7CiAJfQogCisJLyogWFhYIGVycm5vIE5ldEJTRC0+TGludXggKi8K
> KwlyZXQgPSAtYnVzX2RtYW1lbV9leHBvcnRfcGFnZXMoZG1hdCwgc2VnLCBuc2VnLCBzZy0+c2df
> cGdzLAorCSAgICBzZy0+c2dfbnBncyk7CisJaWYgKHJldCkKKwkJZ290byBvdXQ7CisKIAkvKiBY
> WFggZXJybm8gTmV0QlNELT5MaW51eCAqLwogCXJldCA9IC1idXNfZG1hbWFwX2NyZWF0ZShkbWF0
> LCBzaXplLCBuc2VnLCBQQUdFX1NJWkUsIDAsCi0JICAgIEJVU19ETUFfV0FJVE9LLCAmc3QtPnNn
> bC0+c2dfZG1hbWFwKTsKKwkgICAgQlVTX0RNQV9XQUlUT0ssICZzZy0+c2dfZG1hbWFwKTsKIAlp
> ZiAocmV0KSB7CiAJCURSTV9FUlJPUigiZmFpbGVkIHRvIGNyZWF0ZSBETUEgbWFwIGZvciBzdG9s
> ZW4gb2JqZWN0OiAlZFxuIiwKIAkJICAgIHJldCk7Ci0JCXN0LT5zZ2wtPnNnX2RtYW1hcCA9IE5V
> TEw7CisJCXNnLT5zZ19kbWFtYXAgPSBOVUxMOwogCQlnb3RvIG91dDsKIAl9Ci0Jc3QtPnNnbC0+
> c2dfZG1hdCA9IGRtYXQ7CisJc2ctPnNnX2RtYXQgPSBkbWF0OwogCiAJLyogWFhYIGVycm5vIE5l
> dEJTRC0+TGl1eCAqLwotCXJldCA9IC1idXNfZG1hbWFwX2xvYWRfcmF3KGRtYXQsIHN0LT5zZ2wt
> PnNnX2RtYW1hcCwgc2VnLCBuc2VnLCBzaXplLAorCXJldCA9IC1idXNfZG1hbWFwX2xvYWRfcmF3
> KGRtYXQsIHNnLT5zZ19kbWFtYXAsIHNlZywgbnNlZywgc2l6ZSwKIAkgICAgQlVTX0RNQV9XQUlU
> T0spOwogCWlmIChyZXQpIHsKIAkJRFJNX0VSUk9SKCJmYWlsZWQgdG8gbG9hZCBETUEgbWFwIGZv
> ciBzdG9sZW4gb2JqZWN0OiAlZFxuIiwKQEAgLTU3MSwxMyArNTc3LDEyIEBAIGk5MTVfcGFnZXNf
> Y3JlYXRlX2Zvcl9zdG9sZW4oc3RydWN0IGRybV9kZXZpY2UgKmRldiwKIAogb3V0OglpZiAocmV0
> KSB7CiAJCWlmIChsb2FkZWQpCi0JCQlidXNfZG1hbWFwX3VubG9hZChkbWF0LCBzdC0+c2dsLT5z
> Z19kbWFtYXApOworCQkJYnVzX2RtYW1hcF91bmxvYWQoZG1hdCwgc2ctPnNnX2RtYW1hcCk7CiAJ
> CXNnX2ZyZWVfdGFibGUoc3QpOwogCQlrZnJlZShzdCk7CiAJCXJldHVybiBFUlJfUFRSKHJldCk7
> CiAJfQogI2Vsc2UKLQlzZyA9IHN0LT5zZ2w7CiAJc2ctPm9mZnNldCA9IDA7CiAJc2ctPmxlbmd0
> aCA9IHNpemU7CiAK
> --=_79cd473ca3d4e19fbe52c232ee5dd792--
>
From: "David H. Gutteridge" <david@gutteridge.ca>
To: Gnats Bugs <gnats-bugs@netbsd.org>
Cc: Taylor R Campbell <riastradh@netbsd.org>
Subject: Re: kern/57833: kernel panic on xorg exit
Date: Fri, 12 Jan 2024 19:37:16 -0500
On 2024-01-12 17:52, Ramiro Aceves wrote:
> El 12/1/24 a las 0:05, David H. Gutteridge escribió:
>
>> The following reply was made to PR kern/57833; it has been noted by
>> GNATS.
>>
>> From: "David H. Gutteridge" <david@gutteridge.ca>
>> To: Taylor R Campbell <riastradh@netbsd.org>
>> Cc: gnats-bugs@netbsd.org
>> Subject: Re: kern/57833: kernel panic on xorg exit
>> Date: Thu, 11 Jan 2024 18:04:44 -0500
>>
>> --=_79cd473ca3d4e19fbe52c232ee5dd792
>> Content-Transfer-Encoding: 7bit
>> Content-Type: text/plain; charset=US-ASCII;
>> format=flowed
>> On 2024-01-10 23:37, Taylor R Campbell wrote:
>>> Can you also try the attached patch, instead of the other one, to see
>>> what happens?
>>>
>>> (This might break things more spectacularly -- I haven't thought
>>> about
>>> whether it makes a lot of sense -- but it should at least prevent the
>>> particular crash you observed, if we ever get that far with it.)
>> I've supplied a debug log. (It can be found at:
>> https://www.netbsd.org/~gutteridge/pr57833_debug.log .)
>> Applying the first (small) patch did not prevent the panics. But the
>> larger patch did fix the problem for me. There was a slight coding
>> error with the second patch (wrong label for a goto statement), so it
>> didn't compile as-is. I've attached a revised patch that fixes that
>> one
>> line, should anyone else want to test this.
>> Thanks,
>> Dave
>
> Hello Dave, thanks for feedback. Here I had the same problem, I applied
> the patch and could not compile the kernel because en error in 555
> line when compiling i915_gem_stolen.c file. I changed
>
> goto err;
>
> to
>
> goto out;
>
> (not sure if that is the right fix)
Yes, it is.
> File compiled ok. Rebuilt the kernel and I had the same panic the first
> time abandoned Xorg session.
There must be something different about your hardware than mine here,
then. (Mine is Intel 945GME.) The patch did work for me, but I guess
there's more to it.
Do you have a build that includes a netbsd.gdb file? If not, you can
generate one (e.g., for your patched kernel) by un-commenting the
line
makeoptions DEBUG="-g"
in your kernel config file (I assume GENERIC?) and re-building. The
extra file should appear.
Then we would have the means to get the other details Taylor is looking
for here (see the email from Thu, 11 Jan 2024 03:45UTC).
Dave
PS Sorry I was not able to send you a patch again earlier. GMail is not
accepting email from my domain, so my email bounced. Evidently my emails
do make it when funnelled through GNATS.
From: Ramiro Aceves <ea1abz@gmail.com>
To: gnats-bugs@netbsd.org, kern-bug-people@netbsd.org,
gnats-admin@netbsd.org, netbsd-bugs@netbsd.org
Cc: "David H. Gutteridge" <david@gutteridge.ca>,
Taylor R Campbell <riastradh@NetBSD.org>
Subject: Re: kern/57833: kernel panic on xorg exit
Date: Sat, 13 Jan 2024 11:28:46 +0100
El 13/1/24 a las 1:40, David H. Gutteridge escribió:
> The following reply was made to PR kern/57833; it has been noted by GNATS.
>
> From: "David H. Gutteridge" <david@gutteridge.ca>
> To: Gnats Bugs <gnats-bugs@netbsd.org>
> Cc: Taylor R Campbell <riastradh@netbsd.org>
> Subject: Re: kern/57833: kernel panic on xorg exit
> Date: Fri, 12 Jan 2024 19:37:16 -0500
>
> On 2024-01-12 17:52, Ramiro Aceves wrote:
> > El 12/1/24 a las 0:05, David H. Gutteridge escribió:
> >
> >> The following reply was made to PR kern/57833; it has been noted by
> >> GNATS.
> >>
> >> From: "David H. Gutteridge" <david@gutteridge.ca>
> >> To: Taylor R Campbell <riastradh@netbsd.org>
> >> Cc: gnats-bugs@netbsd.org
> >> Subject: Re: kern/57833: kernel panic on xorg exit
> >> Date: Thu, 11 Jan 2024 18:04:44 -0500
> >>
> >> --=_79cd473ca3d4e19fbe52c232ee5dd792
> >> Content-Transfer-Encoding: 7bit
> >> Content-Type: text/plain; charset=US-ASCII;
> >> format=flowed
> >> On 2024-01-10 23:37, Taylor R Campbell wrote:
> >>> Can you also try the attached patch, instead of the other one, to see
> >>> what happens?
> >>>
> >>> (This might break things more spectacularly -- I haven't thought
> >>> about
> >>> whether it makes a lot of sense -- but it should at least prevent the
> >>> particular crash you observed, if we ever get that far with it.)
> >> I've supplied a debug log. (It can be found at:
> >> https://www.netbsd.org/~gutteridge/pr57833_debug.log .)
> >> Applying the first (small) patch did not prevent the panics. But the
> >> larger patch did fix the problem for me. There was a slight coding
> >> error with the second patch (wrong label for a goto statement), so it
> >> didn't compile as-is. I've attached a revised patch that fixes that
> >> one
> >> line, should anyone else want to test this.
> >> Thanks,
> >> Dave
> >
> > Hello Dave, thanks for feedback. Here I had the same problem, I applied
> > the patch and could not compile the kernel because en error in 555
> > line when compiling i915_gem_stolen.c file. I changed
> >
> > goto err;
> >
> > to
> >
> > goto out;
> >
> > (not sure if that is the right fix)
>
> Yes, it is.
>
> > File compiled ok. Rebuilt the kernel and I had the same panic the first
> > time abandoned Xorg session.
>
> There must be something different about your hardware than mine here,
> then. (Mine is Intel 945GME.) The patch did work for me, but I guess
> there's more to it.
Hello Dave, thanks for your help.
Yes, there must be sometihng different between my system and yours. I
have notice something since I use the patched kernel. I do not know if
it is related or not, but /var/crash/netbsd.4.gz file cannot be extracted.
netbsd-compal# cd /var/crash/
netbsd-compal# ls -al
total 1904080
drwxrwx--- 2 root wheel 512 Jan 13 10:57 .
drwxr-xr-x 26 root wheel 512 Jan 9 19:14 ..
-rw------- 1 root wheel 2 Jan 13 10:56 bounds
-rw------- 1 root wheel 5 Jan 1 15:04 minfree
-rw------- 1 root wheel 1958710 Jan 9 19:21 netbsd.0
-rw------- 1 root wheel 154079764 Jan 9 19:21 netbsd.0.core
-rw------- 1 root wheel 1958710 Jan 9 19:24 netbsd.1
-rw------- 1 root wheel 117210132 Jan 9 19:24 netbsd.1.core
-rw------- 1 root wheel 1958710 Jan 9 20:14 netbsd.2
-rw------- 1 root wheel 202709524 Jan 9 20:14 netbsd.2.core
-rw------- 1 root wheel 1958710 Jan 10 07:18 netbsd.3
-rw------- 1 root wheel 245231124 Jan 10 07:18 netbsd.3.core
-rw------- 1 root wheel 122661396 Jan 12 19:29 netbsd.4.core
-rw------- 1 root wheel 843776 Jan 12 19:29 netbsd.4.gz
-rw------- 1 root wheel 122661396 Jan 13 10:56 netbsd.5.core
-rw------- 1 root wheel 843776 Jan 13 10:56 netbsd.5.
Look at this. 0, 1, 2 and 3 are the crashes with the GENERIC kernel. I
started xorg ONLY ONCE and when exiting, the panic was produced.
netbsd-compal# gunzip netbsd.4.gz
gunzip: netbsd.4.gz: unexpected end of file
gunzip: netbsd.4.gz: uncompress failed
And whent to bed.
Today I started the operating system but I did not entered in Xorg, but
at boot the system tried to save netbsd.5.gz and I could see a segfault
on the screen. In the same way, netbsd.5.gz could not be extracted.
netbsd-compal# gunzip netbsd.5.gz
gunzip: netbsd.5.gz: unexpected end of file
gunzip: netbsd.5.gz: uncompress failed
>
> Do you have a build that includes a netbsd.gdb file? If not, you can
> generate one (e.g., for your patched kernel) by un-commenting the
> line
>
> makeoptions DEBUG="-g"
I am compiling now, lets wait to see what happens. This old machine
takes 32 minutes to compile the kernel without debugging symbols. With
them, I do not know. I am very newbie to all of this but it is fun and a
good learning experience!
>
> in your kernel config file (I assume GENERIC?) and re-building. The
> extra file should appear.
Yes, I use GENERIC renamed to MYKERNEL as the guide says :-)
>
> Then we would have the means to get the other details Taylor is looking
> for here (see the email from Thu, 11 Jan 2024 03:45UTC).
ok.
>
> Dave
>
> PS Sorry I was not able to send you a patch again earlier. GMail is not
> accepting email from my domain, so my email bounced. Evidently my emails
> do make it when funnelled through GNATS.
>
No problem. I had indeed a bad experience with gmail. I downloaded
Taylor patches using Thunderbird and they ended in DOS format instead of
UNIX. Patching failed in a very strange manner, but beeing a newbie I
thought I did not know how to patch a file. I were struggling my mind
several hours searching on the internet until Vim said that the file was
in DOS format. I changed format to UNIX and patches were applied fine
using inside /usr/src:
patch -p1 <patch.file
Also noticed that Gmail marks as spam many emails addreses of netbsd
users. I do not know...
Ramiro.
From: Ramiro Aceves <ea1abz@gmail.com>
To: gnats-bugs@netbsd.org, kern-bug-people@netbsd.org,
gnats-admin@netbsd.org, netbsd-bugs@netbsd.org
Cc: "David H. Gutteridge" <david@gutteridge.ca>,
Taylor R Campbell <riastradh@NetBSD.org>
Subject: Re: kern/57833: kernel panic on xorg exit
Date: Sat, 13 Jan 2024 12:41:36 +0100
El 13/1/24 a las 11:30, Ramiro Aceves escribió:
> The following reply was made to PR kern/57833; it has been noted by GNATS.
>
> From: Ramiro Aceves <ea1abz@gmail.com>
> To: gnats-bugs@netbsd.org, kern-bug-people@netbsd.org,
> gnats-admin@netbsd.org, netbsd-bugs@netbsd.org
> Cc: "David H. Gutteridge" <david@gutteridge.ca>,
> Taylor R Campbell <riastradh@NetBSD.org>
> Subject: Re: kern/57833: kernel panic on xorg exit
> Date: Sat, 13 Jan 2024 11:28:46 +0100
>
> El 13/1/24 a las 1:40, David H. Gutteridge escribió:
> > The following reply was made to PR kern/57833; it has been noted by GNATS.
> >
> > From: "David H. Gutteridge" <david@gutteridge.ca>
> > To: Gnats Bugs <gnats-bugs@netbsd.org>
> > Cc: Taylor R Campbell <riastradh@netbsd.org>
> > Subject: Re: kern/57833: kernel panic on xorg exit
> > Date: Fri, 12 Jan 2024 19:37:16 -0500
> >
> > On 2024-01-12 17:52, Ramiro Aceves wrote:
> > > El 12/1/24 a las 0:05, David H. Gutteridge escribió:
> > >
> > >> The following reply was made to PR kern/57833; it has been noted by
> > >> GNATS.
> > >>
> > >> From: "David H. Gutteridge" <david@gutteridge.ca>
> > >> To: Taylor R Campbell <riastradh@netbsd.org>
> > >> Cc: gnats-bugs@netbsd.org
> > >> Subject: Re: kern/57833: kernel panic on xorg exit
> > >> Date: Thu, 11 Jan 2024 18:04:44 -0500
> > >>
> > >> --=_79cd473ca3d4e19fbe52c232ee5dd792
> > >> Content-Transfer-Encoding: 7bit
> > >> Content-Type: text/plain; charset=US-ASCII;
> > >> format=flowed
> > >> On 2024-01-10 23:37, Taylor R Campbell wrote:
> > >>> Can you also try the attached patch, instead of the other one, to see
> > >>> what happens?
> > >>>
> > >>> (This might break things more spectacularly -- I haven't thought
> > >>> about
> > >>> whether it makes a lot of sense -- but it should at least prevent the
> > >>> particular crash you observed, if we ever get that far with it.)
> > >> I've supplied a debug log. (It can be found at:
> > >> https://www.netbsd.org/~gutteridge/pr57833_debug.log .)
> > >> Applying the first (small) patch did not prevent the panics. But the
> > >> larger patch did fix the problem for me. There was a slight coding
> > >> error with the second patch (wrong label for a goto statement), so it
> > >> didn't compile as-is. I've attached a revised patch that fixes that
> > >> one
> > >> line, should anyone else want to test this.
> > >> Thanks,
> > >> Dave
> > >
> > > Hello Dave, thanks for feedback. Here I had the same problem, I applied
> > > the patch and could not compile the kernel because en error in 555
> > > line when compiling i915_gem_stolen.c file. I changed
> > >
> > > goto err;
> > >
> > > to
> > >
> > > goto out;
> > >
> > > (not sure if that is the right fix)
> >
> > Yes, it is.
> >
> > > File compiled ok. Rebuilt the kernel and I had the same panic the first
> > > time abandoned Xorg session.
> >
> > There must be something different about your hardware than mine here,
> > then. (Mine is Intel 945GME.) The patch did work for me, but I guess
> > there's more to it.
>
>
> Hello Dave, thanks for your help.
>
> Yes, there must be sometihng different between my system and yours. I
> have notice something since I use the patched kernel. I do not know if
> it is related or not, but /var/crash/netbsd.4.gz file cannot be extracted.
>
> netbsd-compal# cd /var/crash/
> netbsd-compal# ls -al
> total 1904080
> drwxrwx--- 2 root wheel 512 Jan 13 10:57 .
> drwxr-xr-x 26 root wheel 512 Jan 9 19:14 ..
> -rw------- 1 root wheel 2 Jan 13 10:56 bounds
> -rw------- 1 root wheel 5 Jan 1 15:04 minfree
> -rw------- 1 root wheel 1958710 Jan 9 19:21 netbsd.0
> -rw------- 1 root wheel 154079764 Jan 9 19:21 netbsd.0.core
> -rw------- 1 root wheel 1958710 Jan 9 19:24 netbsd.1
> -rw------- 1 root wheel 117210132 Jan 9 19:24 netbsd.1.core
> -rw------- 1 root wheel 1958710 Jan 9 20:14 netbsd.2
> -rw------- 1 root wheel 202709524 Jan 9 20:14 netbsd.2.core
> -rw------- 1 root wheel 1958710 Jan 10 07:18 netbsd.3
> -rw------- 1 root wheel 245231124 Jan 10 07:18 netbsd.3.core
> -rw------- 1 root wheel 122661396 Jan 12 19:29 netbsd.4.core
> -rw------- 1 root wheel 843776 Jan 12 19:29 netbsd.4.gz
> -rw------- 1 root wheel 122661396 Jan 13 10:56 netbsd.5.core
> -rw------- 1 root wheel 843776 Jan 13 10:56 netbsd.5.
>
> Look at this. 0, 1, 2 and 3 are the crashes with the GENERIC kernel. I
> started xorg ONLY ONCE and when exiting, the panic was produced.
>
>
> netbsd-compal# gunzip netbsd.4.gz
> gunzip: netbsd.4.gz: unexpected end of file
> gunzip: netbsd.4.gz: uncompress failed
>
> And whent to bed.
>
> Today I started the operating system but I did not entered in Xorg, but
> at boot the system tried to save netbsd.5.gz and I could see a segfault
> on the screen. In the same way, netbsd.5.gz could not be extracted.
>
> netbsd-compal# gunzip netbsd.5.gz
> gunzip: netbsd.5.gz: unexpected end of file
> gunzip: netbsd.5.gz: uncompress failed
>
Hello
I rebooted again (not touching xorg at all, so not panics) and this time
the system could save a good netbsd.6.gz and could be extracted. I do
not know...
After that, I compiled the kernel with the debug on as you suggested (51
minutes)
netbsd-compal# cd /usr/src/sys/arch/i386/compile/MYKERNEL/
netbsd-compal# ls -l netbsd*
-rwxr-xr-x 1 root wsrc 23870560 Jan 13 12:00 netbsd
-rwxr-xr-x 1 root wsrc 133343616 Jan 13 12:00 netbsd-MYKERNEL.debug
-rwxr-xr-x 1 root wsrc 154132948 Jan 13 12:00 netbsd.gdb
-rw-r--r-- 1 root wsrc 899 Jan 13 11:08 netbsd.ldscript
-rw-r--r-- 1 root wsrc 12710983 Jan 13 11:58 netbsd.map
Copied netbsd file to /netbsd and rebooted.
I started xorg, and at exit, I got the usual panic.
netbsd-compal# gunzip netbsd.7.
netbsd.7.core.gz netbsd.7.gz
netbsd-compal# gunzip netbsd.7.*
netbsd-compal# ls -al
total 1197912
drwxrwx--- 2 root wheel 512 Jan 13 12:36 .
drwxr-xr-x 26 root wheel 512 Jan 9 19:14 ..
-rw------- 1 root wheel 2 Jan 13 12:31 bounds
-rw------- 1 root wheel 5 Jan 1 15:04 minfree
-rw------- 1 root wheel 1958710 Jan 9 19:21 netbsd.0
-rw------- 1 root wheel 154079764 Jan 9 19:21 netbsd.0.core
-rw------- 1 root wheel 1958710 Jan 9 19:24 netbsd.1
-rw------- 1 root wheel 117210132 Jan 9 19:24 netbsd.1.core
-rw------- 1 root wheel 1958710 Jan 9 20:14 netbsd.2
-rw------- 1 root wheel 202709524 Jan 9 20:14 netbsd.2.core
-rw------- 1 root wheel 1958710 Jan 10 07:18 netbsd.3
-rw------- 1 root wheel 245231124 Jan 10 07:18 netbsd.3.core
-rw------- 1 root wheel 122661396 Jan 12 19:29 netbsd.4.core
-rw------- 1 root wheel 843776 Jan 12 19:29 netbsd.4.gz
-rw------- 1 root wheel 122661396 Jan 13 10:56 netbsd.5.core
-rw------- 1 root wheel 843776 Jan 13 10:56 netbsd.5.gz
-rw------- 1 root wheel 2063492 Jan 13 12:12 netbsd.6
-rw------- 1 root wheel 122661396 Jan 13 12:12 netbsd.6.core
-rw------- 1 root wheel 1958653 Jan 13 12:31 netbsd.7
-rw------- 1 root wheel 124865556 Jan 13 12:31 netbsd.7.core
this time the seventh crash could be gunziped without errors.
Do you think it would be quicker that I place the files in my little
Raspberry server or somewhere for you to download and play with them? I
do not have any experience with the debugger and I do not know what I am
doing.
I wait for your advice. Thanks so much.
Regards.
Ramiro.
>
>
> >
> > Do you have a build that includes a netbsd.gdb file? If not, you can
> > generate one (e.g., for your patched kernel) by un-commenting the
> > line
> >
> > makeoptions DEBUG="-g"
>
> I am compiling now, lets wait to see what happens. This old machine
> takes 32 minutes to compile the kernel without debugging symbols. With
> them, I do not know. I am very newbie to all of this but it is fun and a
> good learning experience!
> >
> > in your kernel config file (I assume GENERIC?) and re-building. The
> > extra file should appear.
>
> Yes, I use GENERIC renamed to MYKERNEL as the guide says :-)
>
> >
> > Then we would have the means to get the other details Taylor is looking
> > for here (see the email from Thu, 11 Jan 2024 03:45UTC).
>
> ok.
>
> >
> > Dave
> >
> > PS Sorry I was not able to send you a patch again earlier. GMail is not
> > accepting email from my domain, so my email bounced. Evidently my emails
> > do make it when funnelled through GNATS.
> >
>
> No problem. I had indeed a bad experience with gmail. I downloaded
> Taylor patches using Thunderbird and they ended in DOS format instead of
> UNIX. Patching failed in a very strange manner, but beeing a newbie I
> thought I did not know how to patch a file. I were struggling my mind
> several hours searching on the internet until Vim said that the file was
> in DOS format. I changed format to UNIX and patches were applied fine
> using inside /usr/src:
>
> patch -p1 <patch.file
>
> Also noticed that Gmail marks as spam many emails addreses of netbsd
> users. I do not know...
>
> Ramiro.
>
>
>
>
>
>
>
From: RVP <rvp@SDF.ORG>
To: gnats-bugs@netbsd.org
Cc: kern-bug-people@netbsd.org, ea1abz@gmail.com,
"David H. Gutteridge" <david@gutteridge.ca>
Subject: Re: kern/57833: kernel panic on xorg exit
Date: Sat, 13 Jan 2024 12:29:49 +0000 (UTC)
On Sat, 13 Jan 2024, David H. Gutteridge wrote:
> There must be something different about your hardware than mine here,
> then. (Mine is Intel 945GME.) The patch did work for me, but I guess
> there's more to it.
>
Might have something to do with turning ACPI off on OP's laptop. See PR# 57826.
David, does Taylor's still patch work if you `boot -2' on this machine of yours?
-RVP
From: Ramiro Aceves <ea1abz@gmail.com>
To: gnats-bugs@netbsd.org, kern-bug-people@netbsd.org,
gnats-admin@netbsd.org, netbsd-bugs@netbsd.org
Cc: Taylor R Campbell <riastradh@NetBSD.org>,
"David H. Gutteridge" <david@gutteridge.ca>
Subject: Re: kern/57833: kernel panic on xorg exit
Date: Sat, 13 Jan 2024 22:41:49 +0100
El 13/1/24 a las 1:40, David H. Gutteridge escribió:
> The following reply was made to PR kern/57833; it has been noted by GNATS.
>
> From: "David H. Gutteridge" <david@gutteridge.ca>
> To: Gnats Bugs <gnats-bugs@netbsd.org>
> Cc: Taylor R Campbell <riastradh@netbsd.org>
> Subject: Re: kern/57833: kernel panic on xorg exit
> Date: Fri, 12 Jan 2024 19:37:16 -0500
>
> On 2024-01-12 17:52, Ramiro Aceves wrote:
> > El 12/1/24 a las 0:05, David H. Gutteridge escribió:
> >
> >> The following reply was made to PR kern/57833; it has been noted by
> >> GNATS.
> >>
> >> From: "David H. Gutteridge" <david@gutteridge.ca>
> >> To: Taylor R Campbell <riastradh@netbsd.org>
> >> Cc: gnats-bugs@netbsd.org
> >> Subject: Re: kern/57833: kernel panic on xorg exit
> >> Date: Thu, 11 Jan 2024 18:04:44 -0500
> >>
> >> --=_79cd473ca3d4e19fbe52c232ee5dd792
> >> Content-Transfer-Encoding: 7bit
> >> Content-Type: text/plain; charset=US-ASCII;
> >> format=flowed
> >> On 2024-01-10 23:37, Taylor R Campbell wrote:
> >>> Can you also try the attached patch, instead of the other one, to see
> >>> what happens?
> >>>
> >>> (This might break things more spectacularly -- I haven't thought
> >>> about
> >>> whether it makes a lot of sense -- but it should at least prevent the
> >>> particular crash you observed, if we ever get that far with it.)
> >> I've supplied a debug log. (It can be found at:
> >> https://www.netbsd.org/~gutteridge/pr57833_debug.log .)
> >> Applying the first (small) patch did not prevent the panics. But the
> >> larger patch did fix the problem for me. There was a slight coding
> >> error with the second patch (wrong label for a goto statement), so it
> >> didn't compile as-is. I've attached a revised patch that fixes that
> >> one
> >> line, should anyone else want to test this.
> >> Thanks,
> >> Dave
> >
> > Hello Dave, thanks for feedback. Here I had the same problem, I applied
> > the patch and could not compile the kernel because en error in 555
> > line when compiling i915_gem_stolen.c file. I changed
> >
> > goto err;
> >
> > to
> >
> > goto out;
> >
> > (not sure if that is the right fix)
>
> Yes, it is.
>
> > File compiled ok. Rebuilt the kernel and I had the same panic the first
> > time abandoned Xorg session.
>
> There must be something different about your hardware than mine here,
> then. (Mine is Intel 945GME.) The patch did work for me, but I guess
> there's more to it.
>
> Do you have a build that includes a netbsd.gdb file? If not, you can
> generate one (e.g., for your patched kernel) by un-commenting the
> line
>
> makeoptions DEBUG="-g"
>
> in your kernel config file (I assume GENERIC?) and re-building. The
> extra file should appear.
>
> Then we would have the means to get the other details Taylor is looking
> for here (see the email from Thu, 11 Jan 2024 03:45UTC).
>
> Dave
>
> PS Sorry I was not able to send you a patch again earlier. GMail is not
> accepting email from my domain, so my email bounced. Evidently my emails
> do make it when funnelled through GNATS.
>
Hello,
This is the last recorded crash after Taylor's patch and compiling the
kernel with debugging symbols ad David suggested:
netbsd-compal# dmesg -M /var/crash/netbsd.7.core -N /var/crash/netbsd.7
...
...
4.324510] uhid1 at uhidev1 reportid 3: input=2, output=0, feature=0
[ 16.564698] wsdisplay0: screen 1 added (default, vt100 emulation)
[ 16.564698] wsdisplay0: screen 2 added (default, vt100 emulation)
[ 16.564698] wsdisplay0: screen 3 added (default, vt100 emulation)
[ 16.564698] wsdisplay0: screen 4 added (default, vt100 emulation)
[ 234.752732] uvm_fault(0xc151c400, 0xdd4e8000, 1) -> 0xe
[ 234.752732] fatal page fault in supervisor mode
[ 234.752732] trap type 6 code 0 eip 0xc0b02ece cs 0x8 eflags 0x13287
cr2 0xdd4e8000 ilevel 0x8 esp 0x4bb1a000
[ 234.752732] curlwp 0xc4341600 pid 0 lid 63 lowest kstack 0xdc7e02c0
[ 234.752732] panic: trap
[ 234.752732] cpu0: Begin traceback...
[ 234.752732]
vpanic(c1186d04,dc7e1d7c,dc7e1e38,c012fed8,c1186d04,dc7e1e44,dc7e1e44,3f,dc7e02c0,13287)
at netbsd:vpanic+0x196
[ 234.752732]
panic(c1186d04,dc7e1e44,dc7e1e44,3f,dc7e02c0,13287,dd4e8000,8,4bb1a000,c157e960)
at netbsd:panic+0x18
[ 234.752732] trap() at netbsd:trap+0xd51
[ 234.752732] --- trap (number 6) ---
[ 234.752732]
drm_clflush_virt_range(dd4e8000,1000,0,1000,0,0,c147c8c0,dd4e8000,db6ff000,c5c423c0)
at netbsd:drm_clflush_virt_range+0x3f
[ 234.752732]
i915_gem_object_put_pages_phys(c5c15900,c5c222c4,c5c15900,c5c15900,4,dc7e1f48,c06cd688,c5c15900,54,0)
at netbsd:i915_gem_object_put_pages_phys+0x15a
[ 234.752732]
__i915_gem_object_put_pages(c5c15900,54,0,c0c5dd4f,0,0,c3dff878,0,c5c159b0,c5c159ac)
at netbsd:__i915_gem_object_put_pages+0x70
[ 234.752732]
__i915_gem_free_objects(c3dfea1c,c42a2f00,0,0,120,c4341600,c42a2f1c,dc7e1f78,c42a2f04,c42a2f1c)
at netbsd:__i915_gem_free_objects+0x104
[ 234.752732]
linux_workqueue_thread(c42a2f00,1848000,1853000,0,c01005a8,0,0,0,0,0) at
netbsd:linux_workqueue_thread+0xe6
[ 234.752732] cpu0: End traceback...
[ 234.752732] dumping to dev 0,1 offset 1023
[ 234.752732] dump
netbsd-compal#
netbsd-compal# gdb /usr/src/sys/arch/i386/compile/MYKERNEL/netbsd.gdb
GNU gdb (GDB) 11.0.50.20200914-git
Copyright (C) 2020 Free Software Foundation, Inc.
License GPLv3+: GNU GPL version 3 or later
<http://gnu.org/licenses/gpl.html>
This is free software: you are free to change and redistribute it.
There is NO WARRANTY, to the extent permitted by law.
Type "show copying" and "show warranty" for details.
This GDB was configured as "i486--netbsdelf".
Type "show configuration" for configuration details.
For bug reporting instructions, please see:
<https://www.gnu.org/software/gdb/bugs/>.
Find the GDB manual and other documentation resources online at:
<http://www.gnu.org/software/gdb/documentation/>.
For help, type "help".
Type "apropos word" to search for commands related to "word"...
Reading symbols from /usr/src/sys/arch/i386/compile/MYKERNEL/netbsd.gdb...
(gdb) target kvm /var/crash/netbsd.7.core
0xc012d6ed in maybe_dump (howto=260) at
../../../../arch/i386/i386/machdep.c:725
725 dumpsys();
(gdb) frame 0
#0 0xc012d6ed in maybe_dump (howto=260) at
../../../../arch/i386/i386/machdep.c:725
725 dumpsys();
(gdb) frame 1
#1 cpu_reboot (howto=howto@entry=260, bootstr=bootstr@entry=0x0) at
../../../../arch/i386/i386/machdep.c:746
746 maybe_dump(howto);
(gdb) frame 2
#2 0xc0c85e17 in kern_reboot (howto=howto@entry=260,
bootstr=bootstr@entry=0x0) at ../../../../kern/kern_reboot.c:73
73 cpu_reboot(howto, bootstr);
(gdb) frame 3
#3 0xc0cbc9d8 in vpanic (fmt=fmt@entry=0xc1186d04 "trap", ap=0xdc7e1d7c
"D\036~\334D\036~\334?")
at ../../../../kern/subr_prf.c:291
291 kern_reboot(bootopt, NULL);
(gdb) frame 4
#4 0xc0cbca91 in panic (fmt=fmt@entry=0xc1186d04 "trap") at
../../../../kern/subr_prf.c:208
208 vpanic(fmt, ap);
(gdb) frame 5
#5 0xc012fed8 in trap (frame=0xdc7e1e44) at
../../../../arch/i386/i386/trap.c:358
358 panic("trap");
(gdb) frame 6
#6 0xc012529b in alltraps ()
(gdb) frame 7
#7 0xdc7e1e44 in ?? ()
(gdb) frame 8
#8 0xc06cf74c in i915_gem_object_put_pages_phys (obj=<optimized out>,
pages=<optimized out>)
at ../../../../external/bsd/drm2/dist/drm/i915/gem/i915_gem_phys.c:206
206 drm_clflush_virt_range(src, PAGE_SIZE);
(gdb)
#8 0xc06cf74c in i915_gem_object_put_pages_phys (obj=<optimized out>,
pages=<optimized out>)
at ../../../../external/bsd/drm2/dist/drm/i915/gem/i915_gem_phys.c:206
206 drm_clflush_virt_range(src, PAGE_SIZE);
(gdb) info locals
page = 0x40
dst = 0xdb6ff000 "\377\377\377\377\377\377\377\377"
mapping = <optimized out>
src = 0xdd4e8000
i = <optimized out>
dmat = <optimized out>
vaddr = <optimized out>
(gdb) frame 9
#9 0xc06cf1b2 in __i915_gem_object_put_pages (obj=obj@entry=0xc5c15900)
at ../../../../external/bsd/drm2/dist/drm/i915/gem/i915_gem_pages.c:246
246 obj->ops->put_pages(obj, pages);
(gdb) info locals
pages = <optimized out>
err = <optimized out>
(gdb) frame 10
#10 0xc06cd688 in __i915_gem_free_objects (i915=0xc3dfd004,
freed=<optimized out>)
at
../../../../external/bsd/drm2/dist/drm/i915/gem/i915_gem_object.c:257
257 __i915_gem_object_put_pages(obj);
(gdb) info locals
mmo = <optimized out>
mn = <optimized out>
obj = 0xc5c15900
on = 0x0
wakeref = <optimized out>
(gdb) frame 11
#11 0xc0aef695 in linux_workqueue_thread (cookie=0xc42a2f00) at
../../../../external/bsd/common/linux/linux_work.c:455
455 (*func)(work);
(gdb) info locals
func = 0xc06cd7f2 <__i915_gem_free_work>
wq = 0xc42a2f00
q = {0x0, 0xc42a2f24}
marker = {work_owner = 3291047360, work_entry = {tqe_next = 0x0,
tqe_prev = 0xc42a2f1c}, func = 0xc42a2f00}
work = 0xc3dfea1c
i = <optimized out>
(gdb) frame 12
#12 0xc0102011 in lwp_trampoline ()
(gdb) info locals
No symbol table info available.
(gdb) frame 13
No frame at level 13.
(gdb)
Ramiro.
From: "David H. Gutteridge" <david@gutteridge.ca>
To: RVP <rvp@SDF.ORG>, gnats-bugs@netbsd.org
Cc:
Subject: Re: kern/57833: kernel panic on xorg exit
Date: Sun, 14 Jan 2024 00:13:55 -0500
On Sat, 2024-01-13 at 12:29 +0000, RVP wrote:
> On Sat, 13 Jan 2024, David H. Gutteridge wrote:
>=20
> > There must be something different about your hardware than mine
> > here,
> > then. (Mine is Intel 945GME.) The patch did work for me, but I guess
> > there's more to it.
> >=20
>=20
> Might have something to do with turning ACPI off on OP's laptop. See
> PR# 57826.
> David, does Taylor's still patch work if you `boot -2' on this machine
> of yours?
If I disable ACPI, it makes no difference, X still exits cleanly for me.
Dave
From: "David H. Gutteridge" <david@gutteridge.ca>
To: gnats-bugs@netbsd.org
Cc: Taylor R Campbell <riastradh@NetBSD.org>
Subject: Re: kern/57833: kernel panic on xorg exit
Date: Sun, 14 Jan 2024 00:19:26 -0500
On Sat, 2024-01-13 at 22:41 +0100, Ramiro Aceves wrote:
> Hello,
>=20
> This is the last recorded crash after Taylor's patch and compiling the
> kernel with debugging symbols ad David suggested:
>=20
> netbsd-compal# dmesg -M /var/crash/netbsd.7.core -N
> /var/crash/netbsd.7
>=20
> ...
> ...
> =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 4.324510] uhid1 at uhidev1 reportid 3: inp=
ut=3D2, output=3D0,
> feature=3D0
> [=C2=A0=C2=A0=C2=A0 16.564698] wsdisplay0: screen 1 added (default, vt100=
emulation)
> [=C2=A0=C2=A0=C2=A0 16.564698] wsdisplay0: screen 2 added (default, vt100=
emulation)
> [=C2=A0=C2=A0=C2=A0 16.564698] wsdisplay0: screen 3 added (default, vt100=
emulation)
> [=C2=A0=C2=A0=C2=A0 16.564698] wsdisplay0: screen 4 added (default, vt100=
emulation)
> [=C2=A0=C2=A0 234.752732] uvm_fault(0xc151c400, 0xdd4e8000, 1) -> 0xe
> [=C2=A0=C2=A0 234.752732] fatal page fault in supervisor mode
> [=C2=A0=C2=A0 234.752732] trap type 6 code 0 eip 0xc0b02ece cs 0x8 eflags
> 0x13287=20
> cr2 0xdd4e8000 ilevel 0x8 esp 0x4bb1a000
> [=C2=A0=C2=A0 234.752732] curlwp 0xc4341600 pid 0 lid 63 lowest kstack
> 0xdc7e02c0
> [=C2=A0=C2=A0 234.752732] panic: trap
> [=C2=A0=C2=A0 234.752732] cpu0: Begin traceback...
> [=C2=A0=C2=A0 234.752732]=20
> vpanic(c1186d04,dc7e1d7c,dc7e1e38,c012fed8,c1186d04,dc7e1e44,dc7e1e44,
> 3f,dc7e02c0,13287)=20
> at netbsd:vpanic+0x196
> [=C2=A0=C2=A0 234.752732]=20
> panic(c1186d04,dc7e1e44,dc7e1e44,3f,dc7e02c0,13287,dd4e8000,8,4bb1a000
> ,c157e960)=20
> at netbsd:panic+0x18
> [=C2=A0=C2=A0 234.752732] trap() at netbsd:trap+0xd51
> [=C2=A0=C2=A0 234.752732] --- trap (number 6) ---
> [=C2=A0=C2=A0 234.752732]=20
> drm_clflush_virt_range(dd4e8000,1000,0,1000,0,0,c147c8c0,dd4e8000,db6f
> f000,c5c423c0)=20
> at netbsd:drm_clflush_virt_range+0x3f
> [=C2=A0=C2=A0 234.752732]=20
> i915_gem_object_put_pages_phys(c5c15900,c5c222c4,c5c15900,c5c15900,4,d
> c7e1f48,c06cd688,c5c15900,54,0)=20
> at netbsd:i915_gem_object_put_pages_phys+0x15a
> [=C2=A0=C2=A0 234.752732]=20
> __i915_gem_object_put_pages(c5c15900,54,0,c0c5dd4f,0,0,c3dff878,0,c5c1
> 59b0,c5c159ac)=20
> at netbsd:__i915_gem_object_put_pages+0x70
> [=C2=A0=C2=A0 234.752732]=20
> __i915_gem_free_objects(c3dfea1c,c42a2f00,0,0,120,c4341600,c42a2f1c,dc
> 7e1f78,c42a2f04,c42a2f1c)=20
> at netbsd:__i915_gem_free_objects+0x104
> [=C2=A0=C2=A0 234.752732]=20
> linux_workqueue_thread(c42a2f00,1848000,1853000,0,c01005a8,0,0,0,0,0)
> at=20
> netbsd:linux_workqueue_thread+0xe6
> [=C2=A0=C2=A0 234.752732] cpu0: End traceback...
>=20
> [=C2=A0=C2=A0 234.752732] dumping to dev 0,1 offset 1023
> [=C2=A0=C2=A0 234.752732] dump
> netbsd-compal#
>=20
>=20
> netbsd-compal# gdb /usr/src/sys/arch/i386/compile/MYKERNEL/netbsd.gdb
> GNU gdb (GDB) 11.0.50.20200914-git
> Copyright (C) 2020 Free Software Foundation, Inc.
> License GPLv3+: GNU GPL version 3 or later=20
> <http://gnu.org/licenses/gpl.html>
> This is free software: you are free to change and redistribute it.
> There is NO WARRANTY, to the extent permitted by law.
> Type "show copying" and "show warranty" for details.
> This GDB was configured as "i486--netbsdelf".
> Type "show configuration" for configuration details.
> For bug reporting instructions, please see:
> <https://www.gnu.org/software/gdb/bugs/>.
> Find the GDB manual and other documentation resources online at:
> =C2=A0=C2=A0=C2=A0=C2=A0 <http://www.gnu.org/software/gdb/documentation/>=
.
>=20
> For help, type "help".
> Type "apropos word" to search for commands related to "word"...
> Reading symbols from
> /usr/src/sys/arch/i386/compile/MYKERNEL/netbsd.gdb...
> (gdb) target kvm /var/crash/netbsd.7.core
> 0xc012d6ed in maybe_dump (howto=3D260) at=20
> ../../../../arch/i386/i386/machdep.c:725
> 725 dumpsys();
> (gdb) frame 0
> #0=C2=A0 0xc012d6ed in maybe_dump (howto=3D260) at=20
> ../../../../arch/i386/i386/machdep.c:725
> 725 dumpsys();
> (gdb) frame 1
> #1=C2=A0 cpu_reboot (howto=3Dhowto@entry=3D260, bootstr=3Dbootstr@entry=
=3D0x0) at=20
> ../../../../arch/i386/i386/machdep.c:746
> 746 maybe_dump(howto);
> (gdb) frame 2
> #2=C2=A0 0xc0c85e17 in kern_reboot (howto=3Dhowto@entry=3D260,=20
> bootstr=3Dbootstr@entry=3D0x0) at ../../../../kern/kern_reboot.c:73
> 73 cpu_reboot(howto, bootstr);
> (gdb) frame 3
> #3=C2=A0 0xc0cbc9d8 in vpanic (fmt=3Dfmt@entry=3D0xc1186d04 "trap",
> ap=3D0xdc7e1d7c=20
> "D\036~\334D\036~\334?")
> =C2=A0=C2=A0=C2=A0=C2=A0 at ../../../../kern/subr_prf.c:291
> 291 kern_reboot(bootopt, NULL);
> (gdb) frame 4
> #4=C2=A0 0xc0cbca91 in panic (fmt=3Dfmt@entry=3D0xc1186d04 "trap") at=20
> ../../../../kern/subr_prf.c:208
> 208 vpanic(fmt, ap);
> (gdb) frame 5
> #5=C2=A0 0xc012fed8 in trap (frame=3D0xdc7e1e44) at=20
> ../../../../arch/i386/i386/trap.c:358
> 358 panic("trap");
> (gdb) frame 6
> #6=C2=A0 0xc012529b in alltraps ()
> (gdb) frame 7
> #7=C2=A0 0xdc7e1e44 in ?? ()
> (gdb) frame 8
> #8=C2=A0 0xc06cf74c in i915_gem_object_put_pages_phys (obj=3D<optimized o=
ut>,
> pages=3D<optimized out>)
> =C2=A0=C2=A0=C2=A0=C2=A0 at
> ../../../../external/bsd/drm2/dist/drm/i915/gem/i915_gem_phys.c:206
> 206 drm_clflush_virt_range(src,
> PAGE_SIZE);
> (gdb)
> #8=C2=A0 0xc06cf74c in i915_gem_object_put_pages_phys (obj=3D<optimized o=
ut>,
> pages=3D<optimized out>)
> =C2=A0=C2=A0=C2=A0=C2=A0 at
> ../../../../external/bsd/drm2/dist/drm/i915/gem/i915_gem_phys.c:206
> 206 drm_clflush_virt_range(src,
> PAGE_SIZE);
> (gdb) info locals
> page =3D 0x40
> dst =3D 0xdb6ff000 "\377\377\377\377\377\377\377\377"
> mapping =3D <optimized out>
> src =3D 0xdd4e8000
> i =3D <optimized out>
> dmat =3D <optimized out>
> vaddr =3D <optimized out>
> (gdb) frame 9
> #9=C2=A0 0xc06cf1b2 in __i915_gem_object_put_pages
> (obj=3Dobj@entry=3D0xc5c15900)
> =C2=A0=C2=A0=C2=A0=C2=A0 at
> ../../../../external/bsd/drm2/dist/drm/i915/gem/i915_gem_pages.c:246
> 246 obj->ops->put_pages(obj, pages);
> (gdb) info locals
> pages =3D <optimized out>
> err =3D <optimized out>
> (gdb) frame 10
> #10 0xc06cd688 in __i915_gem_free_objects (i915=3D0xc3dfd004,=20
> freed=3D<optimized out>)
> =C2=A0=C2=A0=C2=A0=C2=A0 at=20
> ../../../../external/bsd/drm2/dist/drm/i915/gem/i915_gem_object.c:257
> 257 __i915_gem_object_put_pages(obj);
> (gdb) info locals
> mmo =3D <optimized out>
> mn =3D <optimized out>
> obj =3D 0xc5c15900
> on =3D 0x0
> wakeref =3D <optimized out>
> (gdb) frame 11
> #11 0xc0aef695 in linux_workqueue_thread (cookie=3D0xc42a2f00) at=20
> ../../../../external/bsd/common/linux/linux_work.c:455
> 455 (*func)(work);
> (gdb) info locals
> func =3D 0xc06cd7f2 <__i915_gem_free_work>
> wq =3D 0xc42a2f00
> q =3D {0x0, 0xc42a2f24}
> marker =3D {work_owner =3D 3291047360, work_entry =3D {tqe_next =3D 0x0,=
=20
> tqe_prev =3D 0xc42a2f1c}, func =3D 0xc42a2f00}
> work =3D 0xc3dfea1c
> i =3D <optimized out>
> (gdb) frame 12
> #12 0xc0102011 in lwp_trampoline ()
> (gdb) info locals
> No symbol table info available.
> (gdb) frame 13
> No frame at level 13.
> (gdb)
This is a different trace than the original one, so seems to be another
point of failure. Taylor would have to advise here which frame would be
of interest (my guess would be 8, but I am out of my depth here).
Dave
From: Taylor R Campbell <riastradh@NetBSD.org>
To: Ramiro Aceves <ea1abz@gmail.com>,
"David H. Gutteridge" <david@gutteridge.ca>
Cc: gnats-bugs@NetBSD.org, netbsd-bugs@NetBSD.org
Subject: Re: kern/57833: kernel panic on xorg exit
Date: Mon, 15 Jan 2024 05:39:40 +0000
This is a multi-part message in MIME format.
--=_kfI//mdIC0kx2NGNjppVUyLgYbxCgVBW
Can you please try the attached patch and see if it helps?
--=_kfI//mdIC0kx2NGNjppVUyLgYbxCgVBW
Content-Type: text/plain; charset="ISO-8859-1"; name="pr57833-i915gempages-v3"
Content-Transfer-Encoding: quoted-printable
Content-Disposition: attachment; filename="pr57833-i915gempages-v3.patch"
From 56ff365790fbb65134f61ec5c18521c9c709caf7 Mon Sep 17 00:00:00 2001
From: Taylor R Campbell <riastradh@NetBSD.org>
Date: Sun, 14 Jan 2024 22:35:09 +0000
Subject: [PATCH] i915: Ensure every get_pages method fills the sg pages.
This is needed by i915 gem fault, which maps user virtual addresses
to those pages, and by i915 gem object destruction, which does
pmap_page_protect on the pages to remove any of those user virtual
mappings.
Note: This requires i915_gem_phys.c to use pmap_kenter_pa to preserve
the _kernel's_ mapping of the pages after pmap_page_protect, but
bus_dmamem_map currently uses pmap_enter(pmap_kernel(), ...) instead
which creates a mapping that is removed by pmap_page_protect. So we
use a variant of bus_dmamem_map that uses pmap_kenter_pa instead --
perhaps bus_dmamem_map should do this itself, but this change is less
risky to pull up than a change to bus_dmamem_map itself.
While here, make iteration over sg_pgs a little more robust, and
reduce diff from upstream where convenient.
PR kern/57833
XXX pullup-10
---
.../drm2/dist/drm/i915/gem/i915_gem_mman.c | 2 +-
.../drm2/dist/drm/i915/gem/i915_gem_pages.c | 9 ++++
.../drm2/dist/drm/i915/gem/i915_gem_phys.c | 54 ++++++++++++++++++-
.../drm2/dist/drm/i915/gem/i915_gem_region.c | 23 ++++++--
.../drm2/dist/drm/i915/gem/i915_gem_stolen.c | 44 +++++++++------
5 files changed, 110 insertions(+), 22 deletions(-)
diff --git a/sys/external/bsd/drm2/dist/drm/i915/gem/i915_gem_mman.c b/sys/=
external/bsd/drm2/dist/drm/i915/gem/i915_gem_mman.c
index 8e592f008ef7..d0265738e2c8 100644
--- a/sys/external/bsd/drm2/dist/drm/i915/gem/i915_gem_mman.c
+++ b/sys/external/bsd/drm2/dist/drm/i915/gem/i915_gem_mman.c
@@ -675,7 +675,7 @@ void i915_gem_object_release_mmap_offset(struct drm_i91=
5_gem_object *obj)
=20
if (!i915_gem_object_has_pages(obj))
return;
- for (i =3D 0; i < obj->base.size >> PAGE_SHIFT; i++) {
+ for (i =3D 0; i < obj->mm.pages->sgl->sg_npgs; i++) {
page =3D obj->mm.pages->sgl->sg_pgs[i];
vm_page =3D &page->p_vmp;
pmap_page_protect(vm_page, VM_PROT_NONE);
diff --git a/sys/external/bsd/drm2/dist/drm/i915/gem/i915_gem_pages.c b/sys=
/external/bsd/drm2/dist/drm/i915/gem/i915_gem_pages.c
index 58075877254a..32c188352dbb 100644
--- a/sys/external/bsd/drm2/dist/drm/i915/gem/i915_gem_pages.c
+++ b/sys/external/bsd/drm2/dist/drm/i915/gem/i915_gem_pages.c
@@ -42,6 +42,15 @@ void __i915_gem_object_set_pages(struct drm_i915_gem_obj=
ect *obj,
}
=20
#ifndef __NetBSD__
+ /*
+ * Paranoia: In NetBSD, a scatterlist is just an array of
+ * pages, not an array of segments that might be larger than
+ * pages, so the number of entries must exactly match the size
+ * of the object (which should also be page-aligned).
+ */
+ KASSERTMSG(pages->sgl->sg_npgs =3D=3D obj->base.size >> PAGE_SHIFT,
+ "npgs=3D%zu size=3D%zu", pages->sgl->sg_npgs, obj->base.size);
+
obj->mm.get_page.sg_pos =3D pages->sgl;
obj->mm.get_page.sg_idx =3D 0;
#endif
diff --git a/sys/external/bsd/drm2/dist/drm/i915/gem/i915_gem_phys.c b/sys/=
external/bsd/drm2/dist/drm/i915/gem/i915_gem_phys.c
index 3f68276eea5f..41dc1031fba8 100644
--- a/sys/external/bsd/drm2/dist/drm/i915/gem/i915_gem_phys.c
+++ b/sys/external/bsd/drm2/dist/drm/i915/gem/i915_gem_phys.c
@@ -26,6 +26,53 @@ __KERNEL_RCSID(0, "$NetBSD: i915_gem_phys.c,v 1.8 2021/1=
2/19 12:45:43 riastradh
=20
#include <linux/nbsd-namespace.h>
=20
+#ifdef __NetBSD__
+#include <uvm/uvm.h>
+#include <uvm/uvm_extern.h>
+/*
+ * Version of bus_dmamem_map that uses pmap_kenter_pa, not pmap_enter,
+ * so that it isn't affected by pmap_page_protect on the physical
+ * address. Adapted from sys/arch/x86/x86/bus_dma.c.
+ */
+static int
+bus_dmamem_kmap(bus_dma_tag_t dmat, const bus_dma_segment_t *segs, int nse=
gs,
+ size_t size, void **kvap, int flags)
+{
+ vaddr_t va;
+ bus_addr_t addr;
+ int curseg;
+ const uvm_flag_t kmflags =3D
+ (flags & BUS_DMA_NOWAIT) !=3D 0 ? UVM_KMF_NOWAIT : 0;
+ u_int pmapflags =3D PMAP_WIRED | VM_PROT_READ | VM_PROT_WRITE;
+
+ size =3D round_page(size);
+ if (flags & BUS_DMA_NOCACHE)
+ pmapflags |=3D PMAP_NOCACHE;
+
+ va =3D uvm_km_alloc(kernel_map, size, 0, UVM_KMF_VAONLY | kmflags);
+
+ if (va =3D=3D 0)
+ return ENOMEM;
+
+ *kvap =3D (void *)va;
+
+ for (curseg =3D 0; curseg < nsegs; curseg++) {
+ for (addr =3D segs[curseg].ds_addr;
+ addr < (segs[curseg].ds_addr + segs[curseg].ds_len);
+ addr +=3D PAGE_SIZE, va +=3D PAGE_SIZE, size -=3D PAGE_SIZE) {
+ if (size =3D=3D 0)
+ panic("_bus_dmamem_map: size botch");
+ pmap_kenter_pa(va, addr,
+ VM_PROT_READ | VM_PROT_WRITE,
+ pmapflags);
+ }
+ }
+ pmap_update(pmap_kernel());
+
+ return 0;
+}
+#endif
+
static int i915_gem_object_get_pages_phys(struct drm_i915_gem_object *obj)
{
#ifdef __NetBSD__
@@ -65,7 +112,7 @@ static int i915_gem_object_get_pages_phys(struct drm_i91=
5_gem_object *obj)
if (ret)
return -ENOMEM;
KASSERT(rsegs =3D=3D 1);
- ret =3D -bus_dmamem_map(dmat, &obj->mm.u.phys.seg, 1,
+ ret =3D -bus_dmamem_kmap(dmat, &obj->mm.u.phys.seg, 1,
roundup_pow_of_two(obj->base.size), &vaddr,
BUS_DMA_WAITOK|BUS_DMA_COHERENT);
if (ret)
@@ -83,7 +130,12 @@ static int i915_gem_object_get_pages_phys(struct drm_i9=
15_gem_object *obj)
if (!st)
goto err_pci;
=20
+#ifdef __NetBSD__
+ if (sg_alloc_table_from_bus_dmamem(st, dmat, &obj->mm.u.phys.seg, 1,
+ GFP_KERNEL))
+#else
if (sg_alloc_table(st, 1, GFP_KERNEL))
+#endif
goto err_st;
=20
sg =3D st->sgl;
diff --git a/sys/external/bsd/drm2/dist/drm/i915/gem/i915_gem_region.c b/sy=
s/external/bsd/drm2/dist/drm/i915/gem/i915_gem_region.c
index 1a928988bd5f..85a1de8cb7ea 100644
--- a/sys/external/bsd/drm2/dist/drm/i915/gem/i915_gem_region.c
+++ b/sys/external/bsd/drm2/dist/drm/i915/gem/i915_gem_region.c
@@ -45,10 +45,12 @@ i915_gem_object_get_pages_buddy(struct drm_i915_gem_obj=
ect *obj)
if (!st)
return -ENOMEM;
=20
+#ifndef __NetBSD__
if (sg_alloc_table(st, size >> ilog2(mem->mm.chunk_size), GFP_KERNEL)) {
kfree(st);
return -ENOMEM;
}
+#endif
=20
flags =3D I915_ALLOC_MIN_PAGE_SIZE;
if (obj->flags & I915_BO_ALLOC_CONTIGUOUS)
@@ -60,15 +62,15 @@ i915_gem_object_get_pages_buddy(struct drm_i915_gem_obj=
ect *obj)
=20
GEM_BUG_ON(list_empty(blocks));
=20
- sg =3D st->sgl;
#ifdef __NetBSD__
__USE(prev_end);
- __USE(sg_page_sizes);
bus_dma_tag_t dmat =3D obj->base.dev->dmat;
bus_dma_segment_t *segs =3D NULL;
int i =3D 0, nsegs =3D 0;
bool loaded =3D false;
=20
+ sg =3D NULL;
+
list_for_each_entry(block, blocks, link) {
if (nsegs >=3D INT_MAX ||
nsegs >=3D SIZE_MAX/sizeof(segs[0]))
@@ -85,7 +87,15 @@ i915_gem_object_get_pages_buddy(struct drm_i915_gem_obje=
ct *obj)
=20
segs[i].ds_addr =3D mem->region.start + offset;
segs[i].ds_len =3D block_size;
+ i++;
}
+ KASSERT(i =3D=3D nsegs);
+
+ ret =3D sg_alloc_table_from_bus_dmamem(st, dmat, segs, nsegs,
+ GFP_KERNEL);
+ if (ret)
+ goto err;
+ sg =3D st->sgl;
=20
/* XXX errno NetBSD->Linux */
ret =3D -bus_dmamap_create(dmat, size, nsegs, size, 0, BUS_DMA_WAITOK,
@@ -106,8 +116,9 @@ i915_gem_object_get_pages_buddy(struct drm_i915_gem_obj=
ect *obj)
kmem_free(segs, nsegs * sizeof(segs[0]));
segs =3D NULL;
=20
- __i915_gem_object_set_pages(obj, st, i915_sg_page_sizes(sg));
+ sg_page_sizes =3D i915_sg_page_sizes(sg);
#else
+ sg =3D st->sgl;
st->nents =3D 0;
sg_page_sizes =3D 0;
prev_end =3D (resource_size_t)-1;
@@ -145,16 +156,18 @@ i915_gem_object_get_pages_buddy(struct drm_i915_gem_o=
bject *obj)
sg_page_sizes |=3D sg->length;
sg_mark_end(sg);
i915_sg_trim(st);
+#endif
=20
__i915_gem_object_set_pages(obj, st, sg_page_sizes);
-#endif
=20
return 0;
=20
#ifdef __NetBSD__
err:
if (loaded)
- bus_dmamap_unload(dmat, st->sgl->sg_dmamap);
+ bus_dmamap_unload(dmat, sg->sg_dmamap);
+ if (sg && sg->sg_dmamap)
+ bus_dmamap_destroy(dmat, sg->sg_dmamap);
if (segs)
kmem_free(segs, nsegs * sizeof(segs[0]));
__intel_memory_region_put_pages_buddy(mem, blocks);
diff --git a/sys/external/bsd/drm2/dist/drm/i915/gem/i915_gem_stolen.c b/sy=
s/external/bsd/drm2/dist/drm/i915/gem/i915_gem_stolen.c
index b53d543fa894..1635e57befd7 100644
--- a/sys/external/bsd/drm2/dist/drm/i915/gem/i915_gem_stolen.c
+++ b/sys/external/bsd/drm2/dist/drm/i915/gem/i915_gem_stolen.c
@@ -506,14 +506,13 @@ i915_pages_create_for_stolen(struct drm_device *dev,
{
struct drm_i915_private *i915 =3D to_i915(dev);
struct sg_table *st;
+ struct scatterlist *sg;
#ifdef __NetBSD__
bus_dma_tag_t dmat =3D i915->drm.dmat;
bus_dma_segment_t *seg =3D NULL;
int nseg =3D 0, i;
bool loaded =3D false;
int ret;
-#else
- struct scatterlist *sg;
#endif
=20
GEM_BUG_ON(range_overflows(offset, size, resource_size(&i915->dsm)));
@@ -527,11 +526,6 @@ i915_pages_create_for_stolen(struct drm_device *dev,
if (st =3D=3D NULL)
return ERR_PTR(-ENOMEM);
=20
- if (sg_alloc_table(st, 1, GFP_KERNEL)) {
- kfree(st);
- return ERR_PTR(-ENOMEM);
- }
-
#ifdef __NetBSD__
KASSERT((size % PAGE_SIZE) =3D=3D 0);
nseg =3D size / PAGE_SIZE;
@@ -548,19 +542,30 @@ i915_pages_create_for_stolen(struct drm_device *dev,
seg[i].ds_len =3D PAGE_SIZE;
}
=20
+ sg =3D NULL;
+
+ ret =3D sg_alloc_table_from_bus_dmamem(st, dmat, seg, nseg, GFP_KERNEL);
+ if (ret) {
+ DRM_ERROR("failed to alloc sg table for stolen object: %d\n",
+ ret);
+ ret =3D -ENOMEM;
+ goto out;
+ }
+ sg =3D st->sgl;
+
/* XXX errno NetBSD->Linux */
ret =3D -bus_dmamap_create(dmat, size, nseg, PAGE_SIZE, 0,
- BUS_DMA_WAITOK, &st->sgl->sg_dmamap);
+ BUS_DMA_WAITOK, &sg->sg_dmamap);
if (ret) {
DRM_ERROR("failed to create DMA map for stolen object: %d\n",
ret);
- st->sgl->sg_dmamap =3D NULL;
+ sg->sg_dmamap =3D NULL;
goto out;
}
- st->sgl->sg_dmat =3D dmat;
+ sg->sg_dmat =3D dmat;
=20
- /* XXX errno NetBSD->Liux */
- ret =3D -bus_dmamap_load_raw(dmat, st->sgl->sg_dmamap, seg, nseg, size,
+ /* XXX errno NetBSD->Linux */
+ ret =3D -bus_dmamap_load_raw(dmat, sg->sg_dmamap, seg, nseg, size,
BUS_DMA_WAITOK);
if (ret) {
DRM_ERROR("failed to load DMA map for stolen object: %d\n",
@@ -569,14 +574,23 @@ i915_pages_create_for_stolen(struct drm_device *dev,
}
loaded =3D true;
=20
-out: if (ret) {
+out: kmem_free(seg, nseg * sizeof(seg[0]));
+ if (ret) {
if (loaded)
- bus_dmamap_unload(dmat, st->sgl->sg_dmamap);
- sg_free_table(st);
+ bus_dmamap_unload(dmat, sg->sg_dmamap);
+ if (sg && sg->sg_dmamap)
+ bus_dmamap_destroy(dmat, sg->sg_dmamap);
+ if (sg)
+ sg_free_table(st);
kfree(st);
return ERR_PTR(ret);
}
#else
+ if (sg_alloc_table(st, 1, GFP_KERNEL)) {
+ kfree(st);
+ return ERR_PTR(-ENOMEM);
+ }
+
sg =3D st->sgl;
sg->offset =3D 0;
sg->length =3D size;
--=_kfI//mdIC0kx2NGNjppVUyLgYbxCgVBW--
Responsible-Changed-From-To: kern-bug-people->riastradh
Responsible-Changed-By: riastradh@NetBSD.org
Responsible-Changed-When: Mon, 15 Jan 2024 15:23:40 +0000
Responsible-Changed-Why:
mine
From: Taylor R Campbell <riastradh@NetBSD.org>
To: Ramiro Aceves <ea1abz@gmail.com>,
"David H. Gutteridge" <david@gutteridge.ca>
Cc: gnats-bugs@NetBSD.org, netbsd-bugs@NetBSD.org
Subject: Re: kern/57833: kernel panic on xorg exit
Date: Mon, 15 Jan 2024 17:19:21 +0000
This is a multi-part message in MIME format.
--=_doTlMKKkYbLBtme6fab/51tYZGWhbizH
Small update to previous patch -- if we use pmap_kenter_pa then we
need to use pmap_kremove later on, not pmap_remove.
--=_doTlMKKkYbLBtme6fab/51tYZGWhbizH
Content-Type: text/plain; charset="ISO-8859-1"; name="pr57833-i915gempages-v4"
Content-Transfer-Encoding: quoted-printable
Content-Disposition: attachment; filename="pr57833-i915gempages-v4.patch"
From cc07bce236934283926a18f9ba19e47e4d29869a Mon Sep 17 00:00:00 2001
From: Taylor R Campbell <riastradh@NetBSD.org>
Date: Sun, 14 Jan 2024 22:35:09 +0000
Subject: [PATCH] i915: Ensure every get_pages method fills the sg pages.
This is needed by i915 gem fault, which maps user virtual addresses
to those pages, and by i915 gem object destruction, which does
pmap_page_protect on the pages to remove any of those user virtual
mappings.
Note: This requires i915_gem_phys.c to use pmap_kenter_pa to preserve
the _kernel's_ mapping of the pages after pmap_page_protect, but
bus_dmamem_map currently uses pmap_enter(pmap_kernel(), ...) instead
which creates a mapping that is removed by pmap_page_protect. So we
use a variant of bus_dmamem_map that uses pmap_kenter_pa instead --
perhaps bus_dmamem_map should do this itself, but this change is less
risky to pull up than a change to bus_dmamem_map itself.
While here, make iteration over sg_pgs a little more robust, and
reduce diff from upstream where convenient.
PR kern/57833
XXX pullup-10
---
.../drm2/dist/drm/i915/gem/i915_gem_mman.c | 2 +-
.../drm2/dist/drm/i915/gem/i915_gem_pages.c | 9 ++
.../drm2/dist/drm/i915/gem/i915_gem_phys.c | 89 ++++++++++++++++++-
.../drm2/dist/drm/i915/gem/i915_gem_region.c | 23 +++--
.../drm2/dist/drm/i915/gem/i915_gem_stolen.c | 44 +++++----
5 files changed, 143 insertions(+), 24 deletions(-)
diff --git a/sys/external/bsd/drm2/dist/drm/i915/gem/i915_gem_mman.c b/sys/=
external/bsd/drm2/dist/drm/i915/gem/i915_gem_mman.c
index 8e592f008ef7..d0265738e2c8 100644
--- a/sys/external/bsd/drm2/dist/drm/i915/gem/i915_gem_mman.c
+++ b/sys/external/bsd/drm2/dist/drm/i915/gem/i915_gem_mman.c
@@ -675,7 +675,7 @@ void i915_gem_object_release_mmap_offset(struct drm_i91=
5_gem_object *obj)
=20
if (!i915_gem_object_has_pages(obj))
return;
- for (i =3D 0; i < obj->base.size >> PAGE_SHIFT; i++) {
+ for (i =3D 0; i < obj->mm.pages->sgl->sg_npgs; i++) {
page =3D obj->mm.pages->sgl->sg_pgs[i];
vm_page =3D &page->p_vmp;
pmap_page_protect(vm_page, VM_PROT_NONE);
diff --git a/sys/external/bsd/drm2/dist/drm/i915/gem/i915_gem_pages.c b/sys=
/external/bsd/drm2/dist/drm/i915/gem/i915_gem_pages.c
index 58075877254a..32c188352dbb 100644
--- a/sys/external/bsd/drm2/dist/drm/i915/gem/i915_gem_pages.c
+++ b/sys/external/bsd/drm2/dist/drm/i915/gem/i915_gem_pages.c
@@ -42,6 +42,15 @@ void __i915_gem_object_set_pages(struct drm_i915_gem_obj=
ect *obj,
}
=20
#ifndef __NetBSD__
+ /*
+ * Paranoia: In NetBSD, a scatterlist is just an array of
+ * pages, not an array of segments that might be larger than
+ * pages, so the number of entries must exactly match the size
+ * of the object (which should also be page-aligned).
+ */
+ KASSERTMSG(pages->sgl->sg_npgs =3D=3D obj->base.size >> PAGE_SHIFT,
+ "npgs=3D%zu size=3D%zu", pages->sgl->sg_npgs, obj->base.size);
+
obj->mm.get_page.sg_pos =3D pages->sgl;
obj->mm.get_page.sg_idx =3D 0;
#endif
diff --git a/sys/external/bsd/drm2/dist/drm/i915/gem/i915_gem_phys.c b/sys/=
external/bsd/drm2/dist/drm/i915/gem/i915_gem_phys.c
index 3f68276eea5f..a5aec14d48a4 100644
--- a/sys/external/bsd/drm2/dist/drm/i915/gem/i915_gem_phys.c
+++ b/sys/external/bsd/drm2/dist/drm/i915/gem/i915_gem_phys.c
@@ -24,6 +24,84 @@ __KERNEL_RCSID(0, "$NetBSD: i915_gem_phys.c,v 1.8 2021/1=
2/19 12:45:43 riastradh
#include "i915_gem_region.h"
#include "i915_scatterlist.h"
=20
+#ifdef __NetBSD__
+
+#include <uvm/uvm.h>
+#include <uvm/uvm_extern.h>
+
+#include <machine/pmap_private.h> /* kvtopte, pmap_pte_clearbits */
+
+/*
+ * Version of bus_dmamem_map that uses pmap_kenter_pa, not pmap_enter,
+ * so that it isn't affected by pmap_page_protect on the physical
+ * address. Adapted from sys/arch/x86/x86/bus_dma.c.
+ */
+static int
+bus_dmamem_kmap(bus_dma_tag_t dmat, const bus_dma_segment_t *segs, int nse=
gs,
+ size_t size, void **kvap, int flags)
+{
+ vaddr_t va;
+ bus_addr_t addr;
+ int curseg;
+ const uvm_flag_t kmflags =3D
+ (flags & BUS_DMA_NOWAIT) !=3D 0 ? UVM_KMF_NOWAIT : 0;
+ u_int pmapflags =3D PMAP_WIRED | VM_PROT_READ | VM_PROT_WRITE;
+
+ size =3D round_page(size);
+ if (flags & BUS_DMA_NOCACHE)
+ pmapflags |=3D PMAP_NOCACHE;
+
+ va =3D uvm_km_alloc(kernel_map, size, 0, UVM_KMF_VAONLY | kmflags);
+
+ if (va =3D=3D 0)
+ return ENOMEM;
+
+ *kvap =3D (void *)va;
+
+ for (curseg =3D 0; curseg < nsegs; curseg++) {
+ for (addr =3D segs[curseg].ds_addr;
+ addr < (segs[curseg].ds_addr + segs[curseg].ds_len);
+ addr +=3D PAGE_SIZE, va +=3D PAGE_SIZE, size -=3D PAGE_SIZE) {
+ if (size =3D=3D 0)
+ panic("_bus_dmamem_map: size botch");
+ pmap_kenter_pa(va, addr,
+ VM_PROT_READ | VM_PROT_WRITE,
+ pmapflags);
+ }
+ }
+ pmap_update(pmap_kernel());
+
+ return 0;
+}
+
+static void
+bus_dmamem_kunmap(bus_dma_tag_t t, void *kva, size_t size)
+{
+ pt_entry_t *pte, opte;
+ vaddr_t va, sva, eva;
+
+ KASSERTMSG(((uintptr_t)kva & PGOFSET) =3D=3D 0, "kva=3D%p", kva);
+
+ size =3D round_page(size);
+ sva =3D (vaddr_t)kva;
+ eva =3D sva + size;
+
+ /*
+ * mark pages cacheable again.
+ */
+ for (va =3D sva; va < eva; va +=3D PAGE_SIZE) {
+ pte =3D kvtopte(va);
+ opte =3D *pte;
+ if ((opte & PTE_PCD) !=3D 0)
+ pmap_pte_clearbits(pte, PTE_PCD);
+ }
+ pmap_kremove((vaddr_t)kva, size);
+ pmap_update(pmap_kernel());
+ uvm_km_free(kernel_map, (vaddr_t)kva, size, UVM_KMF_VAONLY);
+}
+
+#endif
+
#include <linux/nbsd-namespace.h>
=20
static int i915_gem_object_get_pages_phys(struct drm_i915_gem_object *obj)
@@ -65,7 +143,7 @@ static int i915_gem_object_get_pages_phys(struct drm_i91=
5_gem_object *obj)
if (ret)
return -ENOMEM;
KASSERT(rsegs =3D=3D 1);
- ret =3D -bus_dmamem_map(dmat, &obj->mm.u.phys.seg, 1,
+ ret =3D -bus_dmamem_kmap(dmat, &obj->mm.u.phys.seg, 1,
roundup_pow_of_two(obj->base.size), &vaddr,
BUS_DMA_WAITOK|BUS_DMA_COHERENT);
if (ret)
@@ -83,7 +161,12 @@ static int i915_gem_object_get_pages_phys(struct drm_i9=
15_gem_object *obj)
if (!st)
goto err_pci;
=20
+#ifdef __NetBSD__
+ if (sg_alloc_table_from_bus_dmamem(st, dmat, &obj->mm.u.phys.seg, 1,
+ GFP_KERNEL))
+#else
if (sg_alloc_table(st, 1, GFP_KERNEL))
+#endif
goto err_st;
=20
sg =3D st->sgl;
@@ -151,7 +234,7 @@ err_st:
err_pci:
#ifdef __NetBSD__
if (vaddr) {
- bus_dmamem_unmap(dmat, vaddr,
+ bus_dmamem_kunmap(dmat, vaddr,
roundup_pow_of_two(obj->base.size));
}
obj->mm.u.phys.kva =3D NULL;
@@ -225,7 +308,7 @@ i915_gem_object_put_pages_phys(struct drm_i915_gem_obje=
ct *obj,
kfree(pages);
=20
#ifdef __NetBSD__
- bus_dmamem_unmap(dmat, obj->mm.u.phys.kva,
+ bus_dmamem_kunmap(dmat, obj->mm.u.phys.kva,
roundup_pow_of_two(obj->base.size));
obj->mm.u.phys.kva =3D NULL;
bus_dmamem_free(dmat, &obj->mm.u.phys.seg, 1);
diff --git a/sys/external/bsd/drm2/dist/drm/i915/gem/i915_gem_region.c b/sy=
s/external/bsd/drm2/dist/drm/i915/gem/i915_gem_region.c
index 1a928988bd5f..85a1de8cb7ea 100644
--- a/sys/external/bsd/drm2/dist/drm/i915/gem/i915_gem_region.c
+++ b/sys/external/bsd/drm2/dist/drm/i915/gem/i915_gem_region.c
@@ -45,10 +45,12 @@ i915_gem_object_get_pages_buddy(struct drm_i915_gem_obj=
ect *obj)
if (!st)
return -ENOMEM;
=20
+#ifndef __NetBSD__
if (sg_alloc_table(st, size >> ilog2(mem->mm.chunk_size), GFP_KERNEL)) {
kfree(st);
return -ENOMEM;
}
+#endif
=20
flags =3D I915_ALLOC_MIN_PAGE_SIZE;
if (obj->flags & I915_BO_ALLOC_CONTIGUOUS)
@@ -60,15 +62,15 @@ i915_gem_object_get_pages_buddy(struct drm_i915_gem_obj=
ect *obj)
=20
GEM_BUG_ON(list_empty(blocks));
=20
- sg =3D st->sgl;
#ifdef __NetBSD__
__USE(prev_end);
- __USE(sg_page_sizes);
bus_dma_tag_t dmat =3D obj->base.dev->dmat;
bus_dma_segment_t *segs =3D NULL;
int i =3D 0, nsegs =3D 0;
bool loaded =3D false;
=20
+ sg =3D NULL;
+
list_for_each_entry(block, blocks, link) {
if (nsegs >=3D INT_MAX ||
nsegs >=3D SIZE_MAX/sizeof(segs[0]))
@@ -85,7 +87,15 @@ i915_gem_object_get_pages_buddy(struct drm_i915_gem_obje=
ct *obj)
=20
segs[i].ds_addr =3D mem->region.start + offset;
segs[i].ds_len =3D block_size;
+ i++;
}
+ KASSERT(i =3D=3D nsegs);
+
+ ret =3D sg_alloc_table_from_bus_dmamem(st, dmat, segs, nsegs,
+ GFP_KERNEL);
+ if (ret)
+ goto err;
+ sg =3D st->sgl;
=20
/* XXX errno NetBSD->Linux */
ret =3D -bus_dmamap_create(dmat, size, nsegs, size, 0, BUS_DMA_WAITOK,
@@ -106,8 +116,9 @@ i915_gem_object_get_pages_buddy(struct drm_i915_gem_obj=
ect *obj)
kmem_free(segs, nsegs * sizeof(segs[0]));
segs =3D NULL;
=20
- __i915_gem_object_set_pages(obj, st, i915_sg_page_sizes(sg));
+ sg_page_sizes =3D i915_sg_page_sizes(sg);
#else
+ sg =3D st->sgl;
st->nents =3D 0;
sg_page_sizes =3D 0;
prev_end =3D (resource_size_t)-1;
@@ -145,16 +156,18 @@ i915_gem_object_get_pages_buddy(struct drm_i915_gem_o=
bject *obj)
sg_page_sizes |=3D sg->length;
sg_mark_end(sg);
i915_sg_trim(st);
+#endif
=20
__i915_gem_object_set_pages(obj, st, sg_page_sizes);
-#endif
=20
return 0;
=20
#ifdef __NetBSD__
err:
if (loaded)
- bus_dmamap_unload(dmat, st->sgl->sg_dmamap);
+ bus_dmamap_unload(dmat, sg->sg_dmamap);
+ if (sg && sg->sg_dmamap)
+ bus_dmamap_destroy(dmat, sg->sg_dmamap);
if (segs)
kmem_free(segs, nsegs * sizeof(segs[0]));
__intel_memory_region_put_pages_buddy(mem, blocks);
diff --git a/sys/external/bsd/drm2/dist/drm/i915/gem/i915_gem_stolen.c b/sy=
s/external/bsd/drm2/dist/drm/i915/gem/i915_gem_stolen.c
index b53d543fa894..1635e57befd7 100644
--- a/sys/external/bsd/drm2/dist/drm/i915/gem/i915_gem_stolen.c
+++ b/sys/external/bsd/drm2/dist/drm/i915/gem/i915_gem_stolen.c
@@ -506,14 +506,13 @@ i915_pages_create_for_stolen(struct drm_device *dev,
{
struct drm_i915_private *i915 =3D to_i915(dev);
struct sg_table *st;
+ struct scatterlist *sg;
#ifdef __NetBSD__
bus_dma_tag_t dmat =3D i915->drm.dmat;
bus_dma_segment_t *seg =3D NULL;
int nseg =3D 0, i;
bool loaded =3D false;
int ret;
-#else
- struct scatterlist *sg;
#endif
=20
GEM_BUG_ON(range_overflows(offset, size, resource_size(&i915->dsm)));
@@ -527,11 +526,6 @@ i915_pages_create_for_stolen(struct drm_device *dev,
if (st =3D=3D NULL)
return ERR_PTR(-ENOMEM);
=20
- if (sg_alloc_table(st, 1, GFP_KERNEL)) {
- kfree(st);
- return ERR_PTR(-ENOMEM);
- }
-
#ifdef __NetBSD__
KASSERT((size % PAGE_SIZE) =3D=3D 0);
nseg =3D size / PAGE_SIZE;
@@ -548,19 +542,30 @@ i915_pages_create_for_stolen(struct drm_device *dev,
seg[i].ds_len =3D PAGE_SIZE;
}
=20
+ sg =3D NULL;
+
+ ret =3D sg_alloc_table_from_bus_dmamem(st, dmat, seg, nseg, GFP_KERNEL);
+ if (ret) {
+ DRM_ERROR("failed to alloc sg table for stolen object: %d\n",
+ ret);
+ ret =3D -ENOMEM;
+ goto out;
+ }
+ sg =3D st->sgl;
+
/* XXX errno NetBSD->Linux */
ret =3D -bus_dmamap_create(dmat, size, nseg, PAGE_SIZE, 0,
- BUS_DMA_WAITOK, &st->sgl->sg_dmamap);
+ BUS_DMA_WAITOK, &sg->sg_dmamap);
if (ret) {
DRM_ERROR("failed to create DMA map for stolen object: %d\n",
ret);
- st->sgl->sg_dmamap =3D NULL;
+ sg->sg_dmamap =3D NULL;
goto out;
}
- st->sgl->sg_dmat =3D dmat;
+ sg->sg_dmat =3D dmat;
=20
- /* XXX errno NetBSD->Liux */
- ret =3D -bus_dmamap_load_raw(dmat, st->sgl->sg_dmamap, seg, nseg, size,
+ /* XXX errno NetBSD->Linux */
+ ret =3D -bus_dmamap_load_raw(dmat, sg->sg_dmamap, seg, nseg, size,
BUS_DMA_WAITOK);
if (ret) {
DRM_ERROR("failed to load DMA map for stolen object: %d\n",
@@ -569,14 +574,23 @@ i915_pages_create_for_stolen(struct drm_device *dev,
}
loaded =3D true;
=20
-out: if (ret) {
+out: kmem_free(seg, nseg * sizeof(seg[0]));
+ if (ret) {
if (loaded)
- bus_dmamap_unload(dmat, st->sgl->sg_dmamap);
- sg_free_table(st);
+ bus_dmamap_unload(dmat, sg->sg_dmamap);
+ if (sg && sg->sg_dmamap)
+ bus_dmamap_destroy(dmat, sg->sg_dmamap);
+ if (sg)
+ sg_free_table(st);
kfree(st);
return ERR_PTR(ret);
}
#else
+ if (sg_alloc_table(st, 1, GFP_KERNEL)) {
+ kfree(st);
+ return ERR_PTR(-ENOMEM);
+ }
+
sg =3D st->sgl;
sg->offset =3D 0;
sg->length =3D size;
--=_doTlMKKkYbLBtme6fab/51tYZGWhbizH--
From: Ramiro Aceves <ea1abz@gmail.com>
To: Taylor R Campbell <riastradh@NetBSD.org>,
"David H. Gutteridge" <david@gutteridge.ca>
Cc: gnats-bugs@NetBSD.org, netbsd-bugs@NetBSD.org
Subject: Re: kern/57833: kernel panic on xorg exit
Date: Tue, 16 Jan 2024 07:21:55 +0100
El 15/1/24 a las 18:19, Taylor R Campbell escribió:
> Small update to previous patch -- if we use pmap_kenter_pa then we
> need to use pmap_kremove later on, not pmap_remove.
Hello Taylor
Thanks for your help and efforts. I have tried v4 patch and the
situation is even worse, the panic occurs after issuing startx command,
black screen and panic.
netbsd-compal# uname -a
NetBSD netbsd-compal.remigio 10.0_RC2 NetBSD 10.0_RC2 (MYKERNEL) #4: Mon
Jan 15 20:34:13 CET 2024
root@netbsd-compal.remigio:/usr/src/sys/arch/i386/compile/MYKERNEL i386
netbsd-compal# ls -l /var/crash
total 1228356
-rw------- 1 root wheel 2 Jan 15 22:28 bounds
-rw------- 1 root wheel 5 Jan 1 15:04 minfree
-rw------- 1 root wheel 1958710 Jan 9 19:21 netbsd.0
-rw------- 1 root wheel 154079764 Jan 9 19:21 netbsd.0.core
-rw------- 1 root wheel 1958710 Jan 9 19:24 netbsd.1
-rw------- 1 root wheel 117210132 Jan 9 19:24 netbsd.1.core
-rw------- 1 root wheel 1958710 Jan 9 20:14 netbsd.2
-rw------- 1 root wheel 202709524 Jan 9 20:14 netbsd.2.core
-rw------- 1 root wheel 1958710 Jan 10 07:18 netbsd.3
-rw------- 1 root wheel 245231124 Jan 10 07:18 netbsd.3.core
-rw------- 1 root wheel 122661396 Jan 12 19:29 netbsd.4.core
-rw------- 1 root wheel 843776 Jan 12 19:29 netbsd.4.gz
-rw------- 1 root wheel 122661396 Jan 13 10:56 netbsd.5.core
-rw------- 1 root wheel 843776 Jan 13 10:56 netbsd.5.gz
-rw------- 1 root wheel 2063492 Jan 13 12:12 netbsd.6
-rw------- 1 root wheel 122661396 Jan 13 12:12 netbsd.6.core
-rw------- 1 root wheel 1958653 Jan 13 12:31 netbsd.7
-rw------- 1 root wheel 124865556 Jan 13 12:31 netbsd.7.core
-rw------- 1 root wheel 30271982 Jan 15 22:28 netbsd.8.core.gz
-rw------- 1 root wheel 853430 Jan 15 22:28 netbsd.8.gz
dmesg -M /var/crash/netbsd.8.core -N /var/crash/netbsd.8
...
...
[ 56644.606442] wd0: detached
[ 56644.606442] atabus0: detached
[ 56644.606442] rebooting...
[ 1.000000] Copyright (c) 1996, 1997, 1998, 1999, 2000, 2001, 2002,
2003,
[ 1.000000] 2004, 2005, 2006, 2007, 2008, 2009, 2010, 2011,
2012, 2013,
[ 1.000000] 2014, 2015, 2016, 2017, 2018, 2019, 2020, 2021,
2022, 2023,
[ 1.000000] 2024
[ 1.000000] The NetBSD Foundation, Inc. All rights reserved.
[ 1.000000] Copyright (c) 1982, 1986, 1989, 1991, 1993
[ 1.000000] The Regents of the University of California. All
rights reserved.
[ 1.000000] NetBSD 10.0_RC2 (MYKERNEL) #4: Mon Jan 15 20:34:13 CET 2024
[ 1.000000]
root@netbsd-compal.remigio:/usr/src/sys/arch/i386/compile/MYKERNEL
[ 1.000000] total memory = 2039 MB
[ 1.000000] avail memory = 1978 MB
[ 1.000000] timecounter: Timecounters tick every 10.000 msec
[ 1.000000] Kernelized RAIDframe activated
[ 1.000000] timecounter: Timecounter "i8254" frequency 1193182 Hz
quality 100
[ 1.000004] mainbus0 (root)
[ 1.000004] cpu0 at mainbus0
[ 1.000004] ACPI Error: AE_BAD_PARAMETER, Thread 3242920000 could
not acquire Mutex [ACPI_MTX_Tables] (0x2) (20221020/utmutex-326)
[ 1.000004] cpu0: Use lfence to serialize rdtsc
[ 1.000004] cpu0: Intel(R) Pentium(R) M processor 1.86GHz, id 0x6d8
[ 1.000004] cpu0: node 0, package 0, core 0, smt 0
[ 1.000004] pci0 at mainbus0 bus 0: configuration mode 1
[ 1.000004] pci0: i/o space, memory space enabled, rd/line, rd/mult,
wr/inv ok
[ 1.000004] pchb0 at pci0 dev 0 function 0: Intel
82915PM/GM/GMS,82910GML Host Bridge (rev. 0x04)
[ 1.000004] agp0 at pchb0: i915-family chipset
[ 1.000004] agp0: detected 7932k stolen memory
[ 1.000004] agp0: aperture at 0xa0000000, size 0x10000000
[ 1.000004] i915drmkms0 at pci0 dev 2 function 0: Intel
82915GM/GMS,82910GML Integrated Graphics Device (rev. 0x04)
[ 1.000004] Intel 82915GM/GMS IGD Companion (miscellaneous display,
revision 0x04) at pci0 dev 2 function 1 not configured
[ 1.000004] uhci0 at pci0 dev 29 function 0: Intel 82801FB/FR USB
UHCI Controller (rev. 0x04)
[ 1.000004] uhci0: interrupting at irq 7
[ 1.000004] usb0 at uhci0: USB revision 1.0
[ 1.000004] uhci1 at pci0 dev 29 function 1: Intel 82801FB/FR USB
UHCI Controller (rev. 0x04)
[ 1.000004] uhci1: interrupting at irq 3
[ 1.000004] usb1 at uhci1: USB revision 1.0
[ 1.000004] uhci2 at pci0 dev 29 function 2: Intel 82801FB/FR USB
UHCI Controller (rev. 0x04)
[ 1.000004] uhci2: interrupting at irq 11
[ 1.000004] usb2 at uhci2: USB revision 1.0
[ 1.000004] uhci3 at pci0 dev 29 function 3: Intel 82801FB/FR USB
UHCI Controller (rev. 0x04)
[ 1.000004] uhci3: interrupting at irq 11
[ 1.000004] usb3 at uhci3: USB revision 1.0
[ 1.000004] ehci0 at pci0 dev 29 function 7: Intel 82801FB/FR USB
EHCI Controller (rev. 0x04)
[ 1.000004] ehci0: 64-bit DMA - limited
[ 1.000004] ehci0: interrupting at irq 7
[ 1.000004] ehci0: EHCI version 1.0
[ 1.000004] ehci0: 4 companion controllers, 2 ports each: uhci0
uhci1 uhci2 uhci3
[ 1.000004] ehci0: Using DMA subregion for control data structures
[ 1.000004] usb4 at ehci0: USB revision 2.0
[ 1.000004] ppb0 at pci0 dev 30 function 0: Intel 82801BAM Hub-PCI
Bridge (rev. 0xd4)
[ 1.000004] pci1 at ppb0 bus 1
[ 1.000004] pci1: i/o space, memory space enabled
[ 1.000004] fwohci0 at pci1 dev 0 function 0: VIA Technologies
VT6306 IEEE 1394 Host Controller (rev. 0x80)
[ 1.000004] fwohci0: interrupting at irq 10
[ 1.000004] fwohci0: OHCI version 1.0 (ROM=1)
[ 1.000004] fwohci0: No. of Isochronous channels is 4.
[ 1.000004] fwohci0: EUI64 00:02:3f:59:88:40:01:0f
[ 1.000004] fwohci0: Phy 1394a available S400, 2 ports.
[ 1.000004] fwohci0: Link S400, max_rec 512 bytes.
[ 1.000004] fwohci0: max_rec 512 -> 2048
[ 1.000004] ieee1394if0 at fwohci0: IEEE1394 bus
[ 1.000004] fwip0 at ieee1394if0: IP over IEEE1394
[ 1.000004] fwohci0: Initiate bus reset
[ 1.000004] re0 at pci1 dev 1 function 0: RealTek 8169/8110 Gigabit
Ethernet (rev. 0x10)
[ 1.000004] re0: interrupting at irq 11
[ 1.000004] re0: RTL8169/8110SB (0x1000)
[ 1.000004] re0: Ethernet address 00:0f:b0:93:6f:e1
[ 1.000004] re0: using 256 tx descriptors
[ 1.000004] rgephy0 at re0 phy 7: RTL8211B 1000BASE-T media interface
[ 1.000004] rgephy0: 10baseT, 10baseT-FDX, 100baseTX, 100baseTX-FDX,
1000baseT, 1000baseT-FDX, auto
[ 1.000004] iwi0 at pci1 dev 2 function 0: Intel PRO/Wireless LAN
2200BG Mini-PCI Adapter (rev. 0x05)
[ 1.000004] iwi0: interrupting at irq 11
[ 1.000004] iwi0: 802.11 address 00:13:ce:6b:7d:01
[ 1.000004] cbb0 at pci1 dev 4 function 0: ENE Technology CB710
CardBus Controller (rev. 0x00)
[ 1.000004] ENE Technology product 0530 (flash memory) at pci1 dev 4
function 1 not configured
[ 1.000004] sdhc0 at pci1 dev 4 function 2: ENE Technology
CB712/714/810 PCI SD Card Reader Controller (rev. 0x00)
[ 1.000004] sdhc0: interrupting at irq 5
[ 1.000004] sdhc0: SDHC 1.0, rev 0, caps <01e021a1/00000000>, SDMA,
33000 kHz, HS 3.3V, 512 byte blocks
[ 1.000004] sdmmc0 at sdhc0 slot 0
[ 1.000004] cbb0: cacheline 0x8 lattimer 0x40
[ 1.000004] cbb0: bhlc 0x824008
[ 1.000004] cbb0: autoconfiguration error: secondary bus number
uninitialized; try PCI_BUS_FIXUP
[ 1.000004] pci_intr_map: no mapping for pin A (line=ff)
[ 1.000004] cbb0: autoconfiguration error: couldn't map interrupt
[ 1.000004] cardslot0 at cbb0
[ 1.000004] pcmcia0 at cardslot0
[ 1.000004] auich0 at pci0 dev 30 function 2: i82801FB (ICH6) AC-97
Audio
[ 1.000004] auich0: interrupting at irq 5
[ 1.000004] auich0: ac97: Avance Logic unknown (0x414c4752) codec;
headphone, 20 bit DAC, 18 bit ADC, no 3D stereo
[ 1.000004] auich0: ac97: ext id 0xa07<AC97_23,AMAP,SPDIF,DRA,VRA>
[ 1.000004] Intel 82801FB/FR AC'97 Modem Controller (modem
communications, revision 0x04) at pci0 dev 30 function 3 not configured
[ 1.000004] ichlpcib0 at pci0 dev 31 function 0: Intel 82801FBM
ICH6M LPC Interface Bridge (rev. 0x04)
[ 1.000004] timecounter: Timecounter "ichlpcib0" frequency 3579545
Hz quality 1000
[ 1.006137] ichlpcib0: 24-bit timer
[ 1.006137] tco0 at ichlpcib0: TCO (watchdog) timer configured.
[ 1.006137] tco0: Min/Max interval 1/367 seconds
[ 1.006137] piixide0 at pci0 dev 31 function 1: Intel 82801FB IDE
Controller (ICH6) (rev. 0x04)
[ 1.006137] piixide0: bus-master DMA support present
[ 1.006137] piixide0: primary channel configured to compatibility mode
[ 1.006137] piixide0: primary channel interrupting at irq 14
[ 1.006137] atabus0 at piixide0 channel 0
[ 1.006137] piixide0: secondary channel configured to compatibility mode
[ 1.006137] piixide0: secondary channel interrupting at irq 15
[ 1.006137] atabus1 at piixide0 channel 1
[ 1.006137] ichsmb0 at pci0 dev 31 function 3: Intel 82801FB/FR
SMBus Controller (rev. 0x04)
[ 1.006137] ichsmb0: interrupting at irq 3
[ 1.006137] iic0 at ichsmb0: I2C bus
[ 1.006137] isa0 at ichlpcib0
[ 1.006137] pckbc0 at isa0 port 0x60-0x64
[ 1.006137] pckbd0 at pckbc0 (kbd slot)
[ 1.006137] pckbc0: using irq 1 for kbd slot
[ 1.006137] wskbd0 at pckbd0: console keyboard
[ 1.006137] pms0 at pckbc0 (aux slot)
[ 1.006137] pms0: ALPS PS/2 V2 pointing device
[ 1.006137] pckbc0: using irq 12 for aux slot
[ 1.006137] wsmouse0 at pms0 mux 0
[ 1.006137] attimer0 at isa0 port 0x40-0x43
[ 1.006137] pcppi0 at isa0 port 0x61
[ 1.006137] midi0 at pcppi0: PC speaker
[ 1.006137] sysbeep0 at pcppi0
[ 1.006137] attimer0: attached to pcppi0
[ 1.006137] est0 at cpu0: Enhanced SpeedStep
[ 1.006137] fwohci0: BUS reset
[ 1.006137] fwohci0: node_id=0xc000ffc0, gen=1, CYCLEMASTER mode
[ 1.006137] ieee1394if0: 1 nodes, maxhop <= 0 cable IRM irm(0) (me)
[ 1.006137] ieee1394if0: bus manager 0
[ 1.241472] timecounter: Timecounter "clockinterrupt" frequency 100
Hz quality 0
[ 1.574164] auich0: measured ac97 link rate at 48000 Hz
[ 1.574164] audio0 at auich0: playback, capture, full duplex,
independent
[ 1.574164] audio0: slinear_le:16 2ch 48000Hz, blk 1920 bytes (10ms)
for playback
[ 1.574164] audio0: slinear_le:16 2ch 48000Hz, blk 1920 bytes (10ms)
for recording
[ 1.574164] uhub0 at usb0: NetBSD (0x0000) UHCI root hub (0x0000),
class 9/0, rev 1.00/1.00, addr 1
[ 1.574164] uhub0: 2 ports with 2 removable, self powered
[ 1.574164] uhub1 at usb1: NetBSD (0x0000) UHCI root hub (0x0000),
class 9/0, rev 1.00/1.00, addr 1
[ 1.574164] uhub1: 2 ports with 2 removable, self powered
[ 1.574164] uhub2 at usb2: NetBSD (0x0000) UHCI root hub (0x0000),
class 9/0, rev 1.00/1.00, addr 1
[ 1.574164] uhub2: 2 ports with 2 removable, self powered
[ 1.574164] uhub3 at usb3: NetBSD (0x0000) UHCI root hub (0x0000),
class 9/0, rev 1.00/1.00, addr 1
[ 1.574164] uhub3: 2 ports with 2 removable, self powered
[ 1.574164] uhub4 at usb4: NetBSD (0x0000) EHCI root hub (0x0000),
class 9/0, rev 2.00/1.00, addr 1
[ 1.574164] uhub4: 8 ports with 8 removable, self powered
[ 1.584167] IPsec: Initialized Security Association Processing.
[ 1.594164] atapibus0 at atabus0: 2 targets
[ 1.684165] cd0 at atapibus0 drive 1: <TSSTcorpCD/DVDW TS-L632B,
95WK401090, TI33> cdrom removable
[ 1.684165] cd0: 32-bit data port
[ 1.684165] cd0: drive supports PIO mode 4, DMA mode 2, Ultra-DMA
mode 2 (Ultra/33)
[ 1.684165] wd0 at atabus0 drive 0
[ 1.694165] wd0: <IC25N080ATMR04-0>
[ 1.694165] wd0: drive supports 16-sector PIO transfers, LBA48
addressing
[ 1.694165] wd0: 76319 MB, 155061 cyl, 16 head, 63 sec, 512
bytes/sect x 156301488 sectors
[ 2.164173] wd0: 32-bit data port
[ 2.164173] wd0: drive supports PIO mode 4, DMA mode 2, Ultra-DMA
mode 5 (Ultra/100)
[ 2.164173] wd0(piixide0:0:0): using PIO mode 4, Ultra-DMA mode 5
(Ultra/100) (using DMA)
[ 2.164173] cd0(piixide0:0:1): using PIO mode 4, Ultra-DMA mode 2
(Ultra/33) (using DMA)
[ 2.164173] swwdog0: software watchdog initialized
[ 2.224173] WARNING: 2 errors while detecting hardware; check system
log.
[ 2.224173] boot device: wd0
[ 2.224173] root on wd0a dumps on wd0b
[ 2.254174] root file system type: ffs
[ 2.264174] kern.module.path=/stand/i386/10.0/modules
[ 2.264174] [drm] Supports vblank timestamp caching Rev 2 (21.10.2013).
[ 2.264174] [drm] Driver supports precise vblank timestamp query.
[ 2.264174] i915drmkms0: interrupting at irq 11 (i915drmkms0)
[ 2.304175] [drm] Initialized overlay support.
[ 2.304175] [drm] Initialized i915 1.6.0 20200114 for i915drmkms0 on
minor 0
[ 2.444179] intelfb0 at i915drmkms0
[ 2.444179] [drm] DRM_I915_DEBUG enabled
[ 2.444179] [drm] DRM_I915_DEBUG_GEM enabled
[ 2.444179] intelfb0: framebuffer at 0xa0009000, size 1280x800,
depth 32, stride 5120
[ 3.094187] wsdisplay0 at intelfb0 kbdmux 1: console (default, vt100
emulation), using wskbd0
[ 3.105786] wsmux1: connecting to wsdisplay0
[ 16.124387] wsdisplay0: screen 1 added (default, vt100 emulation)
[ 16.124387] wsdisplay0: screen 2 added (default, vt100 emulation)
[ 16.124387] wsdisplay0: screen 3 added (default, vt100 emulation)
[ 16.124387] wsdisplay0: screen 4 added (default, vt100 emulation)
[ 60.455840] panic: _bus_dmamem_map: size botch
[ 60.455840] cpu0: Begin traceback...
[ 60.455840]
vpanic(c11d9795,dcbeea90,dcbeeae4,c06cfe6c,c11d9795,0,0,4,0,7f7cefff) at
netbsd:vpanic+0x196
[ 60.455840] panic(c11d9795,0,0,4,0,7f7cefff,dcbeead4,0,c5c24a5c,0)
at netbsd:panic+0x18
[ 60.465846]
i915_gem_object_get_pages_phys(c5c24900,1,2,c4353004,c4348804,c434a084,c4353000,c52c8c44,c5286f04,1)
at netbsd:i915_gem_object_get_pages_phys+0x4fc
[ 60.465846]
i915_gem_object_attach_phys(c5c24900,1000,c0af8654,c3dfd004,c5c24900,c5c24a18,dcbeeb6c,c0673d15,c5c24a18,1)
at netbsd:i915_gem_object_attach_phys+0xb4
[ 60.465846]
intel_plane_pin_fb(c5c24a18,1,2,c0b2f858,c4352010,c4353000,c3dfd004,c5b9c804,c4352004,c5b9c804)
at netbsd:intel_plane_pin_fb+0x62
[ 60.465846]
intel_prepare_plane_fb(c434a084,c52c8c44,c3dff878,10001,c5b9c804,c4353004,c3dff878,dcbeebb8,c066abaf,c3dfd004)
at netbsd:intel_prepare_plane_fb+0xcf
[ 60.465846]
drm_atomic_helper_prepare_planes(c3dfd004,c5b9c804,1,c5b9cd64,0,c5b9c804,c3dfd004,c52c8c44,dcbeebd4,c0af8a55)
at netbsd:drm_atomic_helper_prepare_planes+0x7a
[ 60.475844]
intel_atomic_commit(c3dfd004,c5b9c804,0,c434a084,c5b9c804,dcbeebfc,c0afde20,c5b9c804,c5286f04,40)
at netbsd:intel_atomic_commit+0x9c
[ 60.475844]
drm_atomic_commit(c5b9c804,c5286f04,40,0,400000,c434a084,c5286f04,18f,dcbeec64,c0b2b344)
at netbsd:drm_atomic_commit+0x52
[ 60.475844]
drm_atomic_helper_update_plane(c434a084,c4348804,c5286f04,27f,18f,40,40,0,0,400000)
at netbsd:drm_atomic_helper_update_plane+0xd9
[ 60.475844]
__setplane_atomic(27f,18f,40,40,0,0,400000,400000,dcbeecb8,400000) at
netbsd:__setplane_atomic+0x10b
[ 60.475844]
drm_mode_cursor_common(3,2c,27f,18f,40,40,b,0,0,dcbeee54) at
netbsd:drm_mode_cursor_common+0x261
[ 60.485842]
drm_mode_cursor_ioctl(c3dfd004,dcbeeeac,c5286104,dcbeedc4,1c,dcbeeeac,63,dcbeedc4,c3dfd360,c5286104)
at netbsd:drm_mode_cursor_ioctl+0x4e
[ 60.485842]
drm_ioctl(c5b908c0,c01c64a3,dcbeeeac,dcbeef38,c0cc9817,c5b908c0,c01c64a3,dcbeeeac,c0c45367,c429dd24)
at netbsd:drm_ioctl+0x42d
[ 60.485842]
drm_ioctl_shim(c5b908c0,c01c64a3,dcbeeeac,c0c45367,c429dd24,dcbeef10,0,c5b95fb8,c5b908c0,0)
at netbsd:drm_ioctl_shim+0x43
[ 60.485842]
sys_ioctl(c4361940,dcbeef68,dcbeef60,c5281500,0,36,dcbeef60,dcbeef68,0,0)
at netbsd:sys_ioctl+0x35b
[ 60.485842] syscall() at netbsd:syscall+0x1d6
[ 60.485842] --- syscall (number 54) ---
[ 60.485842] af601dc7:
[ 60.485842] cpu0: End traceback...
[ 60.485842] dumping to dev 0,1 offset 1023
[ 60.485842] dump
netbsd-compal#
netbsd-compal# gdb /usr/src/sys/arch/i386/compile/MYKERNEL/netbsd.gdb
GNU gdb (GDB) 11.0.50.20200914-git
Copyright (C) 2020 Free Software Foundation, Inc.
License GPLv3+: GNU GPL version 3 or later
<http://gnu.org/licenses/gpl.html>
This is free software: you are free to change and redistribute it.
There is NO WARRANTY, to the extent permitted by law.
Type "show copying" and "show warranty" for details.
This GDB was configured as "i486--netbsdelf".
Type "show configuration" for configuration details.
For bug reporting instructions, please see:
<https://www.gnu.org/software/gdb/bugs/>.
Find the GDB manual and other documentation resources online at:
<http://www.gnu.org/software/gdb/documentation/>.
For help, type "help".
Type "apropos word" to search for commands related to "word"...
Reading symbols from /usr/src/sys/arch/i386/compile/MYKERNEL/netbsd.gdb...
(gdb) target kvm /var/crash/netbsd.8.core
0xc012d6ed in maybe_dump (howto=260)
at ../../../../arch/i386/i386/machdep.c:725
725 dumpsys();
(gdb) frame 0
#0 0xc012d6ed in maybe_dump (howto=260)
at ../../../../arch/i386/i386/machdep.c:725
725 dumpsys();
(gdb) frame 1
#1 cpu_reboot (howto=howto@entry=260, bootstr=bootstr@entry=0x0)
at ../../../../arch/i386/i386/machdep.c:746
746 maybe_dump(howto);
(gdb) frame 2
#2 0xc0c85d87 in kern_reboot (howto=howto@entry=260,
bootstr=bootstr@entry=0x0) at ../../../../kern/kern_reboot.c:73
73 cpu_reboot(howto, bootstr);
(gdb) frame 3
#3 0xc0cbc948 in vpanic (
fmt=fmt@entry=0xc11d9795 "_bus_dmamem_map: size botch",
ap=0xdcbeea90 "")
at ../../../../kern/subr_prf.c:291
291 kern_reboot(bootopt, NULL);
(gdb) frame 4
#4 0xc0cbca01 in panic (
fmt=fmt@entry=0xc11d9795 "_bus_dmamem_map: size botch")
at ../../../../kern/subr_prf.c:208
208 vpanic(fmt, ap);
(gdb) frame 5
#5 0xc06cfe6c in bus_dmamem_kmap (nsegs=1, flags=4,
dmat=0xc147c8c0 <pci_bus_dma_tag>, kvap=<synthetic pointer>,
size=<optimized out>, segs=0xc5c24a34)
at ../../../../external/bsd/drm2/dist/drm/i915/gem/i915_gem_phys.c:66
66 panic("_bus_dmamem_map: size botch");
(gdb) frame 6
#6 i915_gem_object_get_pages_phys (obj=0xc5c24900)
at ../../../../external/bsd/drm2/dist/drm/i915/gem/i915_gem_phys.c:146
146 ret = -bus_dmamem_kmap(dmat, &obj->mm.u.phys.seg, 1,
(gdb) frame 7
#7 0xc06cff89 in i915_gem_object_attach_phys (obj=0xc5c24900, align=4096)
at ../../../../external/bsd/drm2/dist/drm/i915/gem/i915_gem_phys.c:378
378 err = ____i915_gem_object_get_pages(obj);
(gdb) frame 8
#8 0xc06653cb in intel_plane_pin_fb
(plane_state=plane_state@entry=0xc52c8c44)
at
../../../../external/bsd/drm2/dist/drm/i915/display/intel_display.c:15729
15729 err = i915_gem_object_attach_phys(obj, align);
(gdb) frame 9
#9 0xc0673d15 in intel_prepare_plane_fb (plane=0xc434a084,
_new_plane_state=0xc52c8c44)
at
../../../../external/bsd/drm2/dist/drm/i915/display/intel_display.c:15832
15832 ret = intel_plane_pin_fb(new_plane_state);
(gdb) frame 10
#10 0xc0afcd48 in drm_atomic_helper_prepare_planes (dev=<optimized out>,
state=<optimized out>)
at ../../../../external/bsd/drm2/dist/drm/drm_atomic_helper.c:2399
2399 ret = funcs->prepare_fb(plane, new_plane_state);
(gdb) frame 11
#11 drm_atomic_helper_prepare_planes (dev=0xc3dfd004,
state=state@entry=0xc5b9c804)
at ../../../../external/bsd/drm2/dist/drm/drm_atomic_helper.c:2375
2375 int drm_atomic_helper_prepare_planes(struct drm_device *dev,
(gdb) frame 12
#12 0xc066abaf in intel_atomic_prepare_commit (state=0xc5b9c804)
at
../../../../external/bsd/drm2/dist/drm/i915/display/intel_display.c:14760
14760 return drm_atomic_helper_prepare_planes(state->base.dev,
(gdb) frame 13
#13 intel_atomic_commit (dev=0xc3dfd004, _state=0xc5b9c804, nonblock=false)
at
../../../../external/bsd/drm2/dist/drm/i915/display/intel_display.c:15595
15595 ret = intel_atomic_prepare_commit(state);
(gdb) frame 14
#14 0xc0af8a55 in drm_atomic_commit (state=state@entry=0xc5b9c804)
at ../../../../external/bsd/drm2/dist/drm/drm_atomic.c:1238
1238 return config->funcs->atomic_commit(state->dev, state, false);
(gdb) frame 15
#15 0xc0afde20 in drm_atomic_helper_update_plane (plane=0xc434a084,
crtc=0xc4348804, fb=0xc5286f04, crtc_x=639, crtc_y=399, crtc_w=64,
crtc_h=64, src_x=0, src_y=0, src_w=4194304, src_h=4194304,
ctx=0xdcbeecb8)
at ../../../../external/bsd/drm2/dist/drm/drm_atomic_helper.c:2910
2910 ret = drm_atomic_commit(state);
(gdb) frame 16
#16 0xc0b2b344 in __setplane_atomic (plane=plane@entry=0xc434a084,
crtc=crtc@entry=0xc4348804, fb=fb@entry=0xc5286f04,
crtc_x=crtc_x@entry=639, crtc_y=crtc_y@entry=399, crtc_w=64,
crtc_h=64,
src_x=src_x@entry=0, src_y=src_y@entry=0, src_w=src_w@entry=4194304,
src_h=src_h@entry=4194304, ctx=ctx@entry=0xdcbeecb8)
at ../../../../external/bsd/drm2/dist/drm/drm_plane.c:761
761 return plane->funcs->update_plane(plane, crtc, fb,
(gdb) frame 17
#17 0xc0b2b77d in drm_mode_cursor_universal (ctx=0xdcbeecb8,
file_priv=0xc5286104, req=0xdcbeed64, crtc=0xc4348804)
at ../../../../external/bsd/drm2/dist/drm/drm_plane.c:914
914 ret = __setplane_atomic(plane, crtc, fb,
(gdb) frame 18
#18 drm_mode_cursor_common (dev=dev@entry=0xc3dfd004,
req=req@entry=0xdcbeed64, file_priv=file_priv@entry=0xc5286104)
at ../../../../external/bsd/drm2/dist/drm/drm_plane.c:973
973 ret = drm_mode_cursor_universal(crtc, req, file_priv, &ctx);
(gdb) frame 19
#19 0xc0b2bdcb in drm_mode_cursor_ioctl (dev=0xc3dfd004, data=0xdcbeeeac,
file_priv=0xc5286104)
at ../../../../external/bsd/drm2/dist/drm/drm_plane.c:1023
1023 return drm_mode_cursor_common(dev, &new_req, file_priv);
(gdb) frame 20
#20 0xc0b23b5c in drm_ioctl (fp=<optimized out>, cmd=<optimized out>,
data=<optimized out>)
at ../../../../external/bsd/drm2/dist/drm/drm_ioctl.c:968
968 error = -(*ioctl->func)(dev, data0, file);
(gdb) frame 21
#21 0xc0af1d36 in drm_ioctl_shim (fp=0xc5b908c0, cmd=3223086243,
data=0xdcbeeeac) at ../../../../external/bsd/drm2/drm/drm_cdevsw.c:393
393
Regards.
Ramiro.
From: "David H. Gutteridge" <david@gutteridge.ca>
To: Gnats Bugs <gnats-bugs@netbsd.org>
Cc:
Subject: Re: kern/57833: kernel panic on xorg exit
Date: Tue, 16 Jan 2024 19:27:27 -0500
On 2024-01-16 01:21, Ramiro Aceves wrote:
> Thanks for your help and efforts. I have tried v4 patch and the
> situation is even worse, the panic occurs after issuing startx command,
> black screen and panic.
I tested the "v4" patch set. Different behaviour encountered on my
machine. Does not panic on boot. However, starting X results in a
blank screen with all VTs then unusable. I was not able to get a
trace from the kernel (doesn't seem to actually panic) nor X. (I
haven't tried setting up the machine so I can log in remotely and
monitor that way.)
Dave
From: Taylor R Campbell <riastradh@NetBSD.org>
To: Ramiro Aceves <ea1abz@gmail.com>
Cc: "David H. Gutteridge" <david@gutteridge.ca>,
gnats-bugs@NetBSD.org, netbsd-bugs@NetBSD.org
Subject: Re: kern/57833: kernel panic on xorg exit
Date: Wed, 17 Jan 2024 02:12:07 +0000
This is a multi-part message in MIME format.
--=_iH22Mq8cEGadrlwrn55fhppMX7+AHtfW
OK, that's frustrating! Here's one more change, attached as
pr57833-i915gempages-v5.diff -- this will print some information that
got optimized away and unavailable in gdb.
If it still crashes: Can you find the i915_gem_object_get_pages_phys
frame and share the output of `print *obj', in addition to dmesg
output and `info locals' in all the frames?
Attached as pr57833-i915gempages-v5.patch is a step-by-step patch
series. If you have the time, and the single giant .diff still
doesn't work, it would be helpful if you could use bisection to find
where the old symptom goes away and the new symptom appears. (It's
possible I made a mistake in some of the related changes to files
other than i915_gem_phys.c.)
--=_iH22Mq8cEGadrlwrn55fhppMX7+AHtfW
Content-Type: text/plain; charset="ISO-8859-1"; name="pr57833-i915gempages-v5"
Content-Transfer-Encoding: quoted-printable
Content-Disposition: attachment; filename="pr57833-i915gempages-v5.diff"
diff --git a/sys/external/bsd/drm2/dist/drm/i915/gem/i915_gem_mman.c b/sys/=
external/bsd/drm2/dist/drm/i915/gem/i915_gem_mman.c
index 8e592f008ef7..d0265738e2c8 100644
--- a/sys/external/bsd/drm2/dist/drm/i915/gem/i915_gem_mman.c
+++ b/sys/external/bsd/drm2/dist/drm/i915/gem/i915_gem_mman.c
@@ -675,7 +675,7 @@ void i915_gem_object_release_mmap_offset(struct drm_i91=
5_gem_object *obj)
=20
if (!i915_gem_object_has_pages(obj))
return;
- for (i =3D 0; i < obj->base.size >> PAGE_SHIFT; i++) {
+ for (i =3D 0; i < obj->mm.pages->sgl->sg_npgs; i++) {
page =3D obj->mm.pages->sgl->sg_pgs[i];
vm_page =3D &page->p_vmp;
pmap_page_protect(vm_page, VM_PROT_NONE);
diff --git a/sys/external/bsd/drm2/dist/drm/i915/gem/i915_gem_pages.c b/sys=
/external/bsd/drm2/dist/drm/i915/gem/i915_gem_pages.c
index 58075877254a..2bc7b11695ec 100644
--- a/sys/external/bsd/drm2/dist/drm/i915/gem/i915_gem_pages.c
+++ b/sys/external/bsd/drm2/dist/drm/i915/gem/i915_gem_pages.c
@@ -42,6 +42,18 @@ void __i915_gem_object_set_pages(struct drm_i915_gem_obj=
ect *obj,
}
=20
#ifndef __NetBSD__
+ /*
+ * Paranoia: In NetBSD, a scatterlist is just an array of
+ * pages, not an array of segments that might be larger than
+ * pages, so the number of entries must exactly match the size
+ * of the object (which should also be page-aligned).
+ *
+ * Both vm_fault_cpu and i915_gem_object_release_mmap_offset in
+ * i915_gem_mman.c rely on this page array as such.
+ */
+ KASSERTMSG(pages->sgl->sg_npgs =3D=3D obj->base.size >> PAGE_SHIFT,
+ "npgs=3D%zu size=3D%zu", pages->sgl->sg_npgs, obj->base.size);
+
obj->mm.get_page.sg_pos =3D pages->sgl;
obj->mm.get_page.sg_idx =3D 0;
#endif
diff --git a/sys/external/bsd/drm2/dist/drm/i915/gem/i915_gem_phys.c b/sys/=
external/bsd/drm2/dist/drm/i915/gem/i915_gem_phys.c
index 3f68276eea5f..07f7825ec0db 100644
--- a/sys/external/bsd/drm2/dist/drm/i915/gem/i915_gem_phys.c
+++ b/sys/external/bsd/drm2/dist/drm/i915/gem/i915_gem_phys.c
@@ -24,6 +24,87 @@ __KERNEL_RCSID(0, "$NetBSD: i915_gem_phys.c,v 1.8 2021/1=
2/19 12:45:43 riastradh
#include "i915_gem_region.h"
#include "i915_scatterlist.h"
=20
+#ifdef __NetBSD__
+
+#include <uvm/uvm.h>
+#include <uvm/uvm_extern.h>
+
+#include <machine/pmap_private.h> /* kvtopte, pmap_pte_clearbits */
+
+/*
+ * Version of bus_dmamem_map that uses pmap_kenter_pa, not pmap_enter,
+ * so that it isn't affected by pmap_page_protect on the physical
+ * address. Adapted from sys/arch/x86/x86/bus_dma.c.
+ */
+static int
+bus_dmamem_kmap(bus_dma_tag_t t, bus_dma_segment_t *segs, int nsegs,
+ size_t size, void **kvap, int flags)
+{
+ vaddr_t va;
+ bus_addr_t addr;
+ int curseg;
+ const uvm_flag_t kmflags =3D
+ (flags & BUS_DMA_NOWAIT) !=3D 0 ? UVM_KMF_NOWAIT : 0;
+ u_int pmapflags =3D PMAP_WIRED | VM_PROT_READ | VM_PROT_WRITE;
+
+ printf("%s: t=3D%p segs=3D%p nsegs=3D%d size=3D0x%zx kvap=3D%p flags=3D0x=
%x\n",
+ __func__, t, segs, nsegs, size, kvap, flags);
+
+ size =3D round_page(size);
+ if (flags & BUS_DMA_NOCACHE)
+ pmapflags |=3D PMAP_NOCACHE;
+
+ va =3D uvm_km_alloc(kernel_map, size, 0, UVM_KMF_VAONLY | kmflags);
+
+ if (va =3D=3D 0)
+ return ENOMEM;
+
+ *kvap =3D (void *)va;
+
+ for (curseg =3D 0; curseg < nsegs; curseg++) {
+ for (addr =3D segs[curseg].ds_addr;
+ addr < (segs[curseg].ds_addr + segs[curseg].ds_len);
+ addr +=3D PAGE_SIZE, va +=3D PAGE_SIZE, size -=3D PAGE_SIZE) {
+ if (size =3D=3D 0)
+ panic("_bus_dmamem_kmap: size botch");
+ pmap_kenter_pa(va, addr,
+ VM_PROT_READ | VM_PROT_WRITE,
+ pmapflags);
+ }
+ }
+ pmap_update(pmap_kernel());
+
+ return 0;
+}
+
+static void
+bus_dmamem_kunmap(bus_dma_tag_t t, void *kva, size_t size)
+{
+ pt_entry_t *pte, opte;
+ vaddr_t va, sva, eva;
+
+ KASSERTMSG(((uintptr_t)kva & PGOFSET) =3D=3D 0, "kva=3D%p", kva);
+
+ size =3D round_page(size);
+ sva =3D (vaddr_t)kva;
+ eva =3D sva + size;
+
+ /*
+ * mark pages cacheable again.
+ */
+ for (va =3D sva; va < eva; va +=3D PAGE_SIZE) {
+ pte =3D kvtopte(va);
+ opte =3D *pte;
+ if ((opte & PTE_PCD) !=3D 0)
+ pmap_pte_clearbits(pte, PTE_PCD);
+ }
+ pmap_kremove((vaddr_t)kva, size);
+ pmap_update(pmap_kernel());
+ uvm_km_free(kernel_map, (vaddr_t)kva, size, UVM_KMF_VAONLY);
+}
+
+#endif
+
#include <linux/nbsd-namespace.h>
=20
static int i915_gem_object_get_pages_phys(struct drm_i915_gem_object *obj)
@@ -65,7 +146,7 @@ static int i915_gem_object_get_pages_phys(struct drm_i91=
5_gem_object *obj)
if (ret)
return -ENOMEM;
KASSERT(rsegs =3D=3D 1);
- ret =3D -bus_dmamem_map(dmat, &obj->mm.u.phys.seg, 1,
+ ret =3D -bus_dmamem_kmap(dmat, &obj->mm.u.phys.seg, 1,
roundup_pow_of_two(obj->base.size), &vaddr,
BUS_DMA_WAITOK|BUS_DMA_COHERENT);
if (ret)
@@ -83,7 +164,12 @@ static int i915_gem_object_get_pages_phys(struct drm_i9=
15_gem_object *obj)
if (!st)
goto err_pci;
=20
+#ifdef __NetBSD__
+ if (sg_alloc_table_from_bus_dmamem(st, dmat, &obj->mm.u.phys.seg, 1,
+ GFP_KERNEL))
+#else
if (sg_alloc_table(st, 1, GFP_KERNEL))
+#endif
goto err_st;
=20
sg =3D st->sgl;
@@ -151,7 +237,7 @@ err_st:
err_pci:
#ifdef __NetBSD__
if (vaddr) {
- bus_dmamem_unmap(dmat, vaddr,
+ bus_dmamem_kunmap(dmat, vaddr,
roundup_pow_of_two(obj->base.size));
}
obj->mm.u.phys.kva =3D NULL;
@@ -225,7 +311,7 @@ i915_gem_object_put_pages_phys(struct drm_i915_gem_obje=
ct *obj,
kfree(pages);
=20
#ifdef __NetBSD__
- bus_dmamem_unmap(dmat, obj->mm.u.phys.kva,
+ bus_dmamem_kunmap(dmat, obj->mm.u.phys.kva,
roundup_pow_of_two(obj->base.size));
obj->mm.u.phys.kva =3D NULL;
bus_dmamem_free(dmat, &obj->mm.u.phys.seg, 1);
diff --git a/sys/external/bsd/drm2/dist/drm/i915/gem/i915_gem_region.c b/sy=
s/external/bsd/drm2/dist/drm/i915/gem/i915_gem_region.c
index 1a928988bd5f..72efd363fdc7 100644
--- a/sys/external/bsd/drm2/dist/drm/i915/gem/i915_gem_region.c
+++ b/sys/external/bsd/drm2/dist/drm/i915/gem/i915_gem_region.c
@@ -45,10 +45,12 @@ i915_gem_object_get_pages_buddy(struct drm_i915_gem_obj=
ect *obj)
if (!st)
return -ENOMEM;
=20
+#ifndef __NetBSD__
if (sg_alloc_table(st, size >> ilog2(mem->mm.chunk_size), GFP_KERNEL)) {
kfree(st);
return -ENOMEM;
}
+#endif
=20
flags =3D I915_ALLOC_MIN_PAGE_SIZE;
if (obj->flags & I915_BO_ALLOC_CONTIGUOUS)
@@ -60,15 +62,15 @@ i915_gem_object_get_pages_buddy(struct drm_i915_gem_obj=
ect *obj)
=20
GEM_BUG_ON(list_empty(blocks));
=20
- sg =3D st->sgl;
#ifdef __NetBSD__
__USE(prev_end);
- __USE(sg_page_sizes);
bus_dma_tag_t dmat =3D obj->base.dev->dmat;
bus_dma_segment_t *segs =3D NULL;
int i =3D 0, nsegs =3D 0;
bool loaded =3D false;
=20
+ sg =3D NULL;
+
list_for_each_entry(block, blocks, link) {
if (nsegs >=3D INT_MAX ||
nsegs >=3D SIZE_MAX/sizeof(segs[0]))
@@ -85,7 +87,15 @@ i915_gem_object_get_pages_buddy(struct drm_i915_gem_obje=
ct *obj)
=20
segs[i].ds_addr =3D mem->region.start + offset;
segs[i].ds_len =3D block_size;
+ i++;
}
+ KASSERT(i =3D=3D nsegs);
+
+ ret =3D sg_alloc_table_from_bus_dmamem(st, dmat, segs, nsegs,
+ GFP_KERNEL);
+ if (ret)
+ goto err;
+ sg =3D st->sgl;
=20
/* XXX errno NetBSD->Linux */
ret =3D -bus_dmamap_create(dmat, size, nsegs, size, 0, BUS_DMA_WAITOK,
@@ -106,8 +116,9 @@ i915_gem_object_get_pages_buddy(struct drm_i915_gem_obj=
ect *obj)
kmem_free(segs, nsegs * sizeof(segs[0]));
segs =3D NULL;
=20
- __i915_gem_object_set_pages(obj, st, i915_sg_page_sizes(sg));
+ sg_page_sizes =3D i915_sg_page_sizes(sg);
#else
+ sg =3D st->sgl;
st->nents =3D 0;
sg_page_sizes =3D 0;
prev_end =3D (resource_size_t)-1;
@@ -145,9 +156,9 @@ i915_gem_object_get_pages_buddy(struct drm_i915_gem_obj=
ect *obj)
sg_page_sizes |=3D sg->length;
sg_mark_end(sg);
i915_sg_trim(st);
+#endif
=20
__i915_gem_object_set_pages(obj, st, sg_page_sizes);
-#endif
=20
return 0;
=20
@@ -155,6 +166,8 @@ i915_gem_object_get_pages_buddy(struct drm_i915_gem_obj=
ect *obj)
err:
if (loaded)
bus_dmamap_unload(dmat, st->sgl->sg_dmamap);
+ if (sg && sg->sg_dmamap)
+ bus_dmamap_destroy(dmat, sg->sg_dmamap);
if (segs)
kmem_free(segs, nsegs * sizeof(segs[0]));
__intel_memory_region_put_pages_buddy(mem, blocks);
diff --git a/sys/external/bsd/drm2/dist/drm/i915/gem/i915_gem_stolen.c b/sy=
s/external/bsd/drm2/dist/drm/i915/gem/i915_gem_stolen.c
index b53d543fa894..1635e57befd7 100644
--- a/sys/external/bsd/drm2/dist/drm/i915/gem/i915_gem_stolen.c
+++ b/sys/external/bsd/drm2/dist/drm/i915/gem/i915_gem_stolen.c
@@ -506,14 +506,13 @@ i915_pages_create_for_stolen(struct drm_device *dev,
{
struct drm_i915_private *i915 =3D to_i915(dev);
struct sg_table *st;
+ struct scatterlist *sg;
#ifdef __NetBSD__
bus_dma_tag_t dmat =3D i915->drm.dmat;
bus_dma_segment_t *seg =3D NULL;
int nseg =3D 0, i;
bool loaded =3D false;
int ret;
-#else
- struct scatterlist *sg;
#endif
=20
GEM_BUG_ON(range_overflows(offset, size, resource_size(&i915->dsm)));
@@ -527,11 +526,6 @@ i915_pages_create_for_stolen(struct drm_device *dev,
if (st =3D=3D NULL)
return ERR_PTR(-ENOMEM);
=20
- if (sg_alloc_table(st, 1, GFP_KERNEL)) {
- kfree(st);
- return ERR_PTR(-ENOMEM);
- }
-
#ifdef __NetBSD__
KASSERT((size % PAGE_SIZE) =3D=3D 0);
nseg =3D size / PAGE_SIZE;
@@ -548,19 +542,30 @@ i915_pages_create_for_stolen(struct drm_device *dev,
seg[i].ds_len =3D PAGE_SIZE;
}
=20
+ sg =3D NULL;
+
+ ret =3D sg_alloc_table_from_bus_dmamem(st, dmat, seg, nseg, GFP_KERNEL);
+ if (ret) {
+ DRM_ERROR("failed to alloc sg table for stolen object: %d\n",
+ ret);
+ ret =3D -ENOMEM;
+ goto out;
+ }
+ sg =3D st->sgl;
+
/* XXX errno NetBSD->Linux */
ret =3D -bus_dmamap_create(dmat, size, nseg, PAGE_SIZE, 0,
- BUS_DMA_WAITOK, &st->sgl->sg_dmamap);
+ BUS_DMA_WAITOK, &sg->sg_dmamap);
if (ret) {
DRM_ERROR("failed to create DMA map for stolen object: %d\n",
ret);
- st->sgl->sg_dmamap =3D NULL;
+ sg->sg_dmamap =3D NULL;
goto out;
}
- st->sgl->sg_dmat =3D dmat;
+ sg->sg_dmat =3D dmat;
=20
- /* XXX errno NetBSD->Liux */
- ret =3D -bus_dmamap_load_raw(dmat, st->sgl->sg_dmamap, seg, nseg, size,
+ /* XXX errno NetBSD->Linux */
+ ret =3D -bus_dmamap_load_raw(dmat, sg->sg_dmamap, seg, nseg, size,
BUS_DMA_WAITOK);
if (ret) {
DRM_ERROR("failed to load DMA map for stolen object: %d\n",
@@ -569,14 +574,23 @@ i915_pages_create_for_stolen(struct drm_device *dev,
}
loaded =3D true;
=20
-out: if (ret) {
+out: kmem_free(seg, nseg * sizeof(seg[0]));
+ if (ret) {
if (loaded)
- bus_dmamap_unload(dmat, st->sgl->sg_dmamap);
- sg_free_table(st);
+ bus_dmamap_unload(dmat, sg->sg_dmamap);
+ if (sg && sg->sg_dmamap)
+ bus_dmamap_destroy(dmat, sg->sg_dmamap);
+ if (sg)
+ sg_free_table(st);
kfree(st);
return ERR_PTR(ret);
}
#else
+ if (sg_alloc_table(st, 1, GFP_KERNEL)) {
+ kfree(st);
+ return ERR_PTR(-ENOMEM);
+ }
+
sg =3D st->sgl;
sg->offset =3D 0;
sg->length =3D size;
--=_iH22Mq8cEGadrlwrn55fhppMX7+AHtfW
Content-Type: text/plain; charset="ISO-8859-1"; name="pr57833-i915gempages-v5"
Content-Transfer-Encoding: quoted-printable
Content-Disposition: attachment; filename="pr57833-i915gempages-v5.patch"
From 7fb48cd42a6dc1e58f9c6b27c7853d721d9f96da Mon Sep 17 00:00:00 2001
From: Taylor R Campbell <riastradh@NetBSD.org>
Date: Mon, 15 Jan 2024 22:38:08 +0000
Subject: [PATCH 1/9] i915_gem_region: Reduce diff from upstream a little.
No functional change intended.
---
sys/external/bsd/drm2/dist/drm/i915/gem/i915_gem_region.c | 5 ++---
1 file changed, 2 insertions(+), 3 deletions(-)
diff --git a/sys/external/bsd/drm2/dist/drm/i915/gem/i915_gem_region.c b/sy=
s/external/bsd/drm2/dist/drm/i915/gem/i915_gem_region.c
index 1a928988bd5f..e539dc4530dc 100644
--- a/sys/external/bsd/drm2/dist/drm/i915/gem/i915_gem_region.c
+++ b/sys/external/bsd/drm2/dist/drm/i915/gem/i915_gem_region.c
@@ -63,7 +63,6 @@ i915_gem_object_get_pages_buddy(struct drm_i915_gem_objec=
t *obj)
sg =3D st->sgl;
#ifdef __NetBSD__
__USE(prev_end);
- __USE(sg_page_sizes);
bus_dma_tag_t dmat =3D obj->base.dev->dmat;
bus_dma_segment_t *segs =3D NULL;
int i =3D 0, nsegs =3D 0;
@@ -106,7 +105,7 @@ i915_gem_object_get_pages_buddy(struct drm_i915_gem_obj=
ect *obj)
kmem_free(segs, nsegs * sizeof(segs[0]));
segs =3D NULL;
=20
- __i915_gem_object_set_pages(obj, st, i915_sg_page_sizes(sg));
+ sg_page_sizes =3D i915_sg_page_sizes(sg);
#else
st->nents =3D 0;
sg_page_sizes =3D 0;
@@ -145,9 +144,9 @@ i915_gem_object_get_pages_buddy(struct drm_i915_gem_obj=
ect *obj)
sg_page_sizes |=3D sg->length;
sg_mark_end(sg);
i915_sg_trim(st);
+#endif
=20
__i915_gem_object_set_pages(obj, st, sg_page_sizes);
-#endif
=20
return 0;
=20
From 97510e276148cfc6f223b397704b3d81905f8eb0 Mon Sep 17 00:00:00 2001
From: Taylor R Campbell <riastradh@NetBSD.org>
Date: Mon, 15 Jan 2024 22:38:38 +0000
Subject: [PATCH 2/9] i915_gem: Avoid walking off end of sg_pgs.
sg_npgs currently fails to match obj->base.size/PAGE_SIZE only due to
bugs in the construction of sg_pgs in various i915 gem object types,
which we should also fix, but let's avoid compounding it here.
Related to PR kern/57833.
XXX pullup-10
---
sys/external/bsd/drm2/dist/drm/i915/gem/i915_gem_mman.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/sys/external/bsd/drm2/dist/drm/i915/gem/i915_gem_mman.c b/sys/=
external/bsd/drm2/dist/drm/i915/gem/i915_gem_mman.c
index 8e592f008ef7..d0265738e2c8 100644
--- a/sys/external/bsd/drm2/dist/drm/i915/gem/i915_gem_mman.c
+++ b/sys/external/bsd/drm2/dist/drm/i915/gem/i915_gem_mman.c
@@ -675,7 +675,7 @@ void i915_gem_object_release_mmap_offset(struct drm_i91=
5_gem_object *obj)
=20
if (!i915_gem_object_has_pages(obj))
return;
- for (i =3D 0; i < obj->base.size >> PAGE_SHIFT; i++) {
+ for (i =3D 0; i < obj->mm.pages->sgl->sg_npgs; i++) {
page =3D obj->mm.pages->sgl->sg_pgs[i];
vm_page =3D &page->p_vmp;
pmap_page_protect(vm_page, VM_PROT_NONE);
From 4fabd36d0f4f0b06ff600d91789c56730a6698a7 Mon Sep 17 00:00:00 2001
From: Taylor R Campbell <riastradh@NetBSD.org>
Date: Wed, 17 Jan 2024 01:33:22 +0000
Subject: [PATCH 3/9] i915_gem: Assert page array size.
Let's detect the bug of sg_npgs failing to match
obj->base.size/PAGE_SIZE earlier.
Related to PR kern/57833.
XXX pullup-10
---
.../bsd/drm2/dist/drm/i915/gem/i915_gem_pages.c | 12 ++++++++++++
1 file changed, 12 insertions(+)
diff --git a/sys/external/bsd/drm2/dist/drm/i915/gem/i915_gem_pages.c b/sys=
/external/bsd/drm2/dist/drm/i915/gem/i915_gem_pages.c
index 58075877254a..2bc7b11695ec 100644
--- a/sys/external/bsd/drm2/dist/drm/i915/gem/i915_gem_pages.c
+++ b/sys/external/bsd/drm2/dist/drm/i915/gem/i915_gem_pages.c
@@ -42,6 +42,18 @@ void __i915_gem_object_set_pages(struct drm_i915_gem_obj=
ect *obj,
}
=20
#ifndef __NetBSD__
+ /*
+ * Paranoia: In NetBSD, a scatterlist is just an array of
+ * pages, not an array of segments that might be larger than
+ * pages, so the number of entries must exactly match the size
+ * of the object (which should also be page-aligned).
+ *
+ * Both vm_fault_cpu and i915_gem_object_release_mmap_offset in
+ * i915_gem_mman.c rely on this page array as such.
+ */
+ KASSERTMSG(pages->sgl->sg_npgs =3D=3D obj->base.size >> PAGE_SHIFT,
+ "npgs=3D%zu size=3D%zu", pages->sgl->sg_npgs, obj->base.size);
+
obj->mm.get_page.sg_pos =3D pages->sgl;
obj->mm.get_page.sg_idx =3D 0;
#endif
From 2911d578f7bb1b45ba50dd0caa08e1d54883befc Mon Sep 17 00:00:00 2001
From: Taylor R Campbell <riastradh@NetBSD.org>
Date: Mon, 15 Jan 2024 22:49:04 +0000
Subject: [PATCH 4/9] i915_gem_phys: Fill sg_pgs.
This is needed by i915 gem fault, which maps user virtual addresses
to those pages, and by i915 gem object destruction, which does
pmap_page_protect on the pages to remove any of those user virtual
mappings.
This needs pmap_kenter_pa rather than pmap_enter(pmap_kernel(), ...)
in order to preserve the _kernel's_ mapping of the pages after
pmap_page_protect.
But bus_dmamem_map currently uses pmap_enter(pmap_kernel(), ...)
instead which creates a mapping that is removed by pmap_page_protect.
So we use a variant of bus_dmamem_map that uses pmap_kenter_pa
instead. Perhaps bus_dmamem_map should do this itself, but this
change is less risky to pull up than a change to bus_dmamem_map
itself.
PR kern/57833: kernel panic on xorg exit
XXX pullup-10
---
.../drm2/dist/drm/i915/gem/i915_gem_phys.c | 89 ++++++++++++++++++-
1 file changed, 86 insertions(+), 3 deletions(-)
diff --git a/sys/external/bsd/drm2/dist/drm/i915/gem/i915_gem_phys.c b/sys/=
external/bsd/drm2/dist/drm/i915/gem/i915_gem_phys.c
index 3f68276eea5f..a96e039c21a8 100644
--- a/sys/external/bsd/drm2/dist/drm/i915/gem/i915_gem_phys.c
+++ b/sys/external/bsd/drm2/dist/drm/i915/gem/i915_gem_phys.c
@@ -24,6 +24,84 @@ __KERNEL_RCSID(0, "$NetBSD: i915_gem_phys.c,v 1.8 2021/1=
2/19 12:45:43 riastradh
#include "i915_gem_region.h"
#include "i915_scatterlist.h"
=20
+#ifdef __NetBSD__
+
+#include <uvm/uvm.h>
+#include <uvm/uvm_extern.h>
+
+#include <machine/pmap_private.h> /* kvtopte, pmap_pte_clearbits */
+
+/*
+ * Version of bus_dmamem_map that uses pmap_kenter_pa, not pmap_enter,
+ * so that it isn't affected by pmap_page_protect on the physical
+ * address. Adapted from sys/arch/x86/x86/bus_dma.c.
+ */
+static int
+bus_dmamem_kmap(bus_dma_tag_t t, bus_dma_segment_t *segs, int nsegs,
+ size_t size, void **kvap, int flags)
+{
+ vaddr_t va;
+ bus_addr_t addr;
+ int curseg;
+ const uvm_flag_t kmflags =3D
+ (flags & BUS_DMA_NOWAIT) !=3D 0 ? UVM_KMF_NOWAIT : 0;
+ u_int pmapflags =3D PMAP_WIRED | VM_PROT_READ | VM_PROT_WRITE;
+
+ size =3D round_page(size);
+ if (flags & BUS_DMA_NOCACHE)
+ pmapflags |=3D PMAP_NOCACHE;
+
+ va =3D uvm_km_alloc(kernel_map, size, 0, UVM_KMF_VAONLY | kmflags);
+
+ if (va =3D=3D 0)
+ return ENOMEM;
+
+ *kvap =3D (void *)va;
+
+ for (curseg =3D 0; curseg < nsegs; curseg++) {
+ for (addr =3D segs[curseg].ds_addr;
+ addr < (segs[curseg].ds_addr + segs[curseg].ds_len);
+ addr +=3D PAGE_SIZE, va +=3D PAGE_SIZE, size -=3D PAGE_SIZE) {
+ if (size =3D=3D 0)
+ panic("_bus_dmamem_kmap: size botch");
+ pmap_kenter_pa(va, addr,
+ VM_PROT_READ | VM_PROT_WRITE,
+ pmapflags);
+ }
+ }
+ pmap_update(pmap_kernel());
+
+ return 0;
+}
+
+static void
+bus_dmamem_kunmap(bus_dma_tag_t t, void *kva, size_t size)
+{
+ pt_entry_t *pte, opte;
+ vaddr_t va, sva, eva;
+
+ KASSERTMSG(((uintptr_t)kva & PGOFSET) =3D=3D 0, "kva=3D%p", kva);
+
+ size =3D round_page(size);
+ sva =3D (vaddr_t)kva;
+ eva =3D sva + size;
+
+ /*
+ * mark pages cacheable again.
+ */
+ for (va =3D sva; va < eva; va +=3D PAGE_SIZE) {
+ pte =3D kvtopte(va);
+ opte =3D *pte;
+ if ((opte & PTE_PCD) !=3D 0)
+ pmap_pte_clearbits(pte, PTE_PCD);
+ }
+ pmap_kremove((vaddr_t)kva, size);
+ pmap_update(pmap_kernel());
+ uvm_km_free(kernel_map, (vaddr_t)kva, size, UVM_KMF_VAONLY);
+}
+
+#endif
+
#include <linux/nbsd-namespace.h>
=20
static int i915_gem_object_get_pages_phys(struct drm_i915_gem_object *obj)
@@ -65,7 +143,7 @@ static int i915_gem_object_get_pages_phys(struct drm_i91=
5_gem_object *obj)
if (ret)
return -ENOMEM;
KASSERT(rsegs =3D=3D 1);
- ret =3D -bus_dmamem_map(dmat, &obj->mm.u.phys.seg, 1,
+ ret =3D -bus_dmamem_kmap(dmat, &obj->mm.u.phys.seg, 1,
roundup_pow_of_two(obj->base.size), &vaddr,
BUS_DMA_WAITOK|BUS_DMA_COHERENT);
if (ret)
@@ -83,7 +161,12 @@ static int i915_gem_object_get_pages_phys(struct drm_i9=
15_gem_object *obj)
if (!st)
goto err_pci;
=20
+#ifdef __NetBSD__
+ if (sg_alloc_table_from_bus_dmamem(st, dmat, &obj->mm.u.phys.seg, 1,
+ GFP_KERNEL))
+#else
if (sg_alloc_table(st, 1, GFP_KERNEL))
+#endif
goto err_st;
=20
sg =3D st->sgl;
@@ -151,7 +234,7 @@ err_st:
err_pci:
#ifdef __NetBSD__
if (vaddr) {
- bus_dmamem_unmap(dmat, vaddr,
+ bus_dmamem_kunmap(dmat, vaddr,
roundup_pow_of_two(obj->base.size));
}
obj->mm.u.phys.kva =3D NULL;
@@ -225,7 +308,7 @@ i915_gem_object_put_pages_phys(struct drm_i915_gem_obje=
ct *obj,
kfree(pages);
=20
#ifdef __NetBSD__
- bus_dmamem_unmap(dmat, obj->mm.u.phys.kva,
+ bus_dmamem_kunmap(dmat, obj->mm.u.phys.kva,
roundup_pow_of_two(obj->base.size));
obj->mm.u.phys.kva =3D NULL;
bus_dmamem_free(dmat, &obj->mm.u.phys.seg, 1);
From 43593f6fbccce1cfe499bbed9822889cc2413e39 Mon Sep 17 00:00:00 2001
From: Taylor R Campbell <riastradh@NetBSD.org>
Date: Mon, 15 Jan 2024 22:55:15 +0000
Subject: [PATCH 5/9] i915_gem_region: Fill sg_pgs, with size/PAGE_SIZE
entries.
Use sg_alloc_table_from_bus_dmamem to do this.
i915_gem_mman.c vm_fault_cpu and i915_gem_object_release_mmap_offset
both rely on sg_pgs to be a page array, so using something else like
size >> ilog2(mem->mm.chunk_size) entries doesn't work. And they
rely on the sg_pgs entries to be initialized, which we weren't doing
before, and which sg_alloc_table_from_bus_dmamem does for us.
Related to PR kern/57833.
XXX pullup-10
---
.../bsd/drm2/dist/drm/i915/gem/i915_gem_region.c | 16 +++++++++++++++-
1 file changed, 15 insertions(+), 1 deletion(-)
diff --git a/sys/external/bsd/drm2/dist/drm/i915/gem/i915_gem_region.c b/sy=
s/external/bsd/drm2/dist/drm/i915/gem/i915_gem_region.c
index e539dc4530dc..72efd363fdc7 100644
--- a/sys/external/bsd/drm2/dist/drm/i915/gem/i915_gem_region.c
+++ b/sys/external/bsd/drm2/dist/drm/i915/gem/i915_gem_region.c
@@ -45,10 +45,12 @@ i915_gem_object_get_pages_buddy(struct drm_i915_gem_obj=
ect *obj)
if (!st)
return -ENOMEM;
=20
+#ifndef __NetBSD__
if (sg_alloc_table(st, size >> ilog2(mem->mm.chunk_size), GFP_KERNEL)) {
kfree(st);
return -ENOMEM;
}
+#endif
=20
flags =3D I915_ALLOC_MIN_PAGE_SIZE;
if (obj->flags & I915_BO_ALLOC_CONTIGUOUS)
@@ -60,7 +62,6 @@ i915_gem_object_get_pages_buddy(struct drm_i915_gem_objec=
t *obj)
=20
GEM_BUG_ON(list_empty(blocks));
=20
- sg =3D st->sgl;
#ifdef __NetBSD__
__USE(prev_end);
bus_dma_tag_t dmat =3D obj->base.dev->dmat;
@@ -68,6 +69,8 @@ i915_gem_object_get_pages_buddy(struct drm_i915_gem_objec=
t *obj)
int i =3D 0, nsegs =3D 0;
bool loaded =3D false;
=20
+ sg =3D NULL;
+
list_for_each_entry(block, blocks, link) {
if (nsegs >=3D INT_MAX ||
nsegs >=3D SIZE_MAX/sizeof(segs[0]))
@@ -84,7 +87,15 @@ i915_gem_object_get_pages_buddy(struct drm_i915_gem_obje=
ct *obj)
=20
segs[i].ds_addr =3D mem->region.start + offset;
segs[i].ds_len =3D block_size;
+ i++;
}
+ KASSERT(i =3D=3D nsegs);
+
+ ret =3D sg_alloc_table_from_bus_dmamem(st, dmat, segs, nsegs,
+ GFP_KERNEL);
+ if (ret)
+ goto err;
+ sg =3D st->sgl;
=20
/* XXX errno NetBSD->Linux */
ret =3D -bus_dmamap_create(dmat, size, nsegs, size, 0, BUS_DMA_WAITOK,
@@ -107,6 +118,7 @@ i915_gem_object_get_pages_buddy(struct drm_i915_gem_obj=
ect *obj)
=20
sg_page_sizes =3D i915_sg_page_sizes(sg);
#else
+ sg =3D st->sgl;
st->nents =3D 0;
sg_page_sizes =3D 0;
prev_end =3D (resource_size_t)-1;
@@ -154,6 +166,8 @@ i915_gem_object_get_pages_buddy(struct drm_i915_gem_obj=
ect *obj)
err:
if (loaded)
bus_dmamap_unload(dmat, st->sgl->sg_dmamap);
+ if (sg && sg->sg_dmamap)
+ bus_dmamap_destroy(dmat, sg->sg_dmamap);
if (segs)
kmem_free(segs, nsegs * sizeof(segs[0]));
__intel_memory_region_put_pages_buddy(mem, blocks);
From 57ce19c53c6db50be440740495d8a87f9cef3a9c Mon Sep 17 00:00:00 2001
From: Taylor R Campbell <riastradh@NetBSD.org>
Date: Tue, 16 Jan 2024 00:28:23 +0000
Subject: [PATCH 6/9] i915_gem_stolen: Fix memory leak.
Found while trying to address the PR 57833 class of problems.
XXX pullup-10
---
sys/external/bsd/drm2/dist/drm/i915/gem/i915_gem_stolen.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/sys/external/bsd/drm2/dist/drm/i915/gem/i915_gem_stolen.c b/sy=
s/external/bsd/drm2/dist/drm/i915/gem/i915_gem_stolen.c
index b53d543fa894..9ad5df8c75c8 100644
--- a/sys/external/bsd/drm2/dist/drm/i915/gem/i915_gem_stolen.c
+++ b/sys/external/bsd/drm2/dist/drm/i915/gem/i915_gem_stolen.c
@@ -569,7 +569,8 @@ i915_pages_create_for_stolen(struct drm_device *dev,
}
loaded =3D true;
=20
-out: if (ret) {
+out: kmem_free(seg, nseg * sizeof(seg[0]));
+ if (ret) {
if (loaded)
bus_dmamap_unload(dmat, st->sgl->sg_dmamap);
sg_free_table(st);
From 30b321cb3cd94f9b77bab1b409c7fab289a9f128 Mon Sep 17 00:00:00 2001
From: Taylor R Campbell <riastradh@NetBSD.org>
Date: Tue, 16 Jan 2024 00:40:20 +0000
Subject: [PATCH 7/9] i915_gem_stolen: Fill sg_pgs, with size/PAGE_SIZE
entries.
Use sg_alloc_table_from_bus_dmamem to do this.
i915_gem_mman.c vm_fault_cpu and i915_gem_object_release_mmap_offset
both rely on sg_pgs to be a page array, so providing a table with
only one entry doesn't work (except by accident, if the object is
page-sized anyway). And they rely on the sg_pgs entries to be
initialized, which we weren't doing before, and which
sg_alloc_table_from_bus_dmamem does for us.
Related to PR kern/57833.
XXX pullup-10
---
.../drm2/dist/drm/i915/gem/i915_gem_stolen.c | 29 ++++++++++++++-----
1 file changed, 21 insertions(+), 8 deletions(-)
diff --git a/sys/external/bsd/drm2/dist/drm/i915/gem/i915_gem_stolen.c b/sy=
s/external/bsd/drm2/dist/drm/i915/gem/i915_gem_stolen.c
index 9ad5df8c75c8..1e7398090d11 100644
--- a/sys/external/bsd/drm2/dist/drm/i915/gem/i915_gem_stolen.c
+++ b/sys/external/bsd/drm2/dist/drm/i915/gem/i915_gem_stolen.c
@@ -506,14 +506,13 @@ i915_pages_create_for_stolen(struct drm_device *dev,
{
struct drm_i915_private *i915 =3D to_i915(dev);
struct sg_table *st;
+ struct scatterlist *sg;
#ifdef __NetBSD__
bus_dma_tag_t dmat =3D i915->drm.dmat;
bus_dma_segment_t *seg =3D NULL;
int nseg =3D 0, i;
bool loaded =3D false;
int ret;
-#else
- struct scatterlist *sg;
#endif
=20
GEM_BUG_ON(range_overflows(offset, size, resource_size(&i915->dsm)));
@@ -527,11 +526,6 @@ i915_pages_create_for_stolen(struct drm_device *dev,
if (st =3D=3D NULL)
return ERR_PTR(-ENOMEM);
=20
- if (sg_alloc_table(st, 1, GFP_KERNEL)) {
- kfree(st);
- return ERR_PTR(-ENOMEM);
- }
-
#ifdef __NetBSD__
KASSERT((size % PAGE_SIZE) =3D=3D 0);
nseg =3D size / PAGE_SIZE;
@@ -548,6 +542,17 @@ i915_pages_create_for_stolen(struct drm_device *dev,
seg[i].ds_len =3D PAGE_SIZE;
}
=20
+ sg =3D NULL;
+
+ ret =3D sg_alloc_table_from_bus_dmamem(st, dmat, seg, nseg, GFP_KERNEL);
+ if (ret) {
+ DRM_ERROR("failed to alloc sg table for stolen object: %d\n",
+ ret);
+ ret =3D -ENOMEM;
+ goto out;
+ }
+ sg =3D st->sgl;
+
/* XXX errno NetBSD->Linux */
ret =3D -bus_dmamap_create(dmat, size, nseg, PAGE_SIZE, 0,
BUS_DMA_WAITOK, &st->sgl->sg_dmamap);
@@ -573,11 +578,19 @@ out: kmem_free(seg, nseg * sizeof(seg[0]));
if (ret) {
if (loaded)
bus_dmamap_unload(dmat, st->sgl->sg_dmamap);
- sg_free_table(st);
+ if (sg && sg->sg_dmamap)
+ bus_dmamap_destroy(dmat, sg->sg_dmamap);
+ if (sg)
+ sg_free_table(st);
kfree(st);
return ERR_PTR(ret);
}
#else
+ if (sg_alloc_table(st, 1, GFP_KERNEL)) {
+ kfree(st);
+ return ERR_PTR(-ENOMEM);
+ }
+
sg =3D st->sgl;
sg->offset =3D 0;
sg->length =3D size;
From 74e265bc6fa36862a55163f44788d8963f0689fc Mon Sep 17 00:00:00 2001
From: Taylor R Campbell <riastradh@NetBSD.org>
Date: Tue, 16 Jan 2024 00:42:08 +0000
Subject: [PATCH 8/9] i915_gem_stolen: Take advantage of a local variable.
No functional change intended.
Prompted by PR kern/57833.
XXX pullup-10
---
.../bsd/drm2/dist/drm/i915/gem/i915_gem_stolen.c | 12 ++++++------
1 file changed, 6 insertions(+), 6 deletions(-)
diff --git a/sys/external/bsd/drm2/dist/drm/i915/gem/i915_gem_stolen.c b/sy=
s/external/bsd/drm2/dist/drm/i915/gem/i915_gem_stolen.c
index 1e7398090d11..1635e57befd7 100644
--- a/sys/external/bsd/drm2/dist/drm/i915/gem/i915_gem_stolen.c
+++ b/sys/external/bsd/drm2/dist/drm/i915/gem/i915_gem_stolen.c
@@ -555,17 +555,17 @@ i915_pages_create_for_stolen(struct drm_device *dev,
=20
/* XXX errno NetBSD->Linux */
ret =3D -bus_dmamap_create(dmat, size, nseg, PAGE_SIZE, 0,
- BUS_DMA_WAITOK, &st->sgl->sg_dmamap);
+ BUS_DMA_WAITOK, &sg->sg_dmamap);
if (ret) {
DRM_ERROR("failed to create DMA map for stolen object: %d\n",
ret);
- st->sgl->sg_dmamap =3D NULL;
+ sg->sg_dmamap =3D NULL;
goto out;
}
- st->sgl->sg_dmat =3D dmat;
+ sg->sg_dmat =3D dmat;
=20
- /* XXX errno NetBSD->Liux */
- ret =3D -bus_dmamap_load_raw(dmat, st->sgl->sg_dmamap, seg, nseg, size,
+ /* XXX errno NetBSD->Linux */
+ ret =3D -bus_dmamap_load_raw(dmat, sg->sg_dmamap, seg, nseg, size,
BUS_DMA_WAITOK);
if (ret) {
DRM_ERROR("failed to load DMA map for stolen object: %d\n",
@@ -577,7 +577,7 @@ i915_pages_create_for_stolen(struct drm_device *dev,
out: kmem_free(seg, nseg * sizeof(seg[0]));
if (ret) {
if (loaded)
- bus_dmamap_unload(dmat, st->sgl->sg_dmamap);
+ bus_dmamap_unload(dmat, sg->sg_dmamap);
if (sg && sg->sg_dmamap)
bus_dmamap_destroy(dmat, sg->sg_dmamap);
if (sg)
From 28b6c22d35054a2c62eb8bd4d0fb955a00a2517f Mon Sep 17 00:00:00 2001
From: Taylor R Campbell <riastradh@NetBSD.org>
Date: Wed, 17 Jan 2024 01:36:11 +0000
Subject: [PATCH 9/9] WIP: i915: debug bus_dmamem_kmap
---
sys/external/bsd/drm2/dist/drm/i915/gem/i915_gem_phys.c | 3 +++
1 file changed, 3 insertions(+)
diff --git a/sys/external/bsd/drm2/dist/drm/i915/gem/i915_gem_phys.c b/sys/=
external/bsd/drm2/dist/drm/i915/gem/i915_gem_phys.c
index a96e039c21a8..07f7825ec0db 100644
--- a/sys/external/bsd/drm2/dist/drm/i915/gem/i915_gem_phys.c
+++ b/sys/external/bsd/drm2/dist/drm/i915/gem/i915_gem_phys.c
@@ -47,6 +47,9 @@ bus_dmamem_kmap(bus_dma_tag_t t, bus_dma_segment_t *segs,=
int nsegs,
(flags & BUS_DMA_NOWAIT) !=3D 0 ? UVM_KMF_NOWAIT : 0;
u_int pmapflags =3D PMAP_WIRED | VM_PROT_READ | VM_PROT_WRITE;
=20
+ printf("%s: t=3D%p segs=3D%p nsegs=3D%d size=3D0x%zx kvap=3D%p flags=3D0x=
%x\n",
+ __func__, t, segs, nsegs, size, kvap, flags);
+
size =3D round_page(size);
if (flags & BUS_DMA_NOCACHE)
pmapflags |=3D PMAP_NOCACHE;
--=_iH22Mq8cEGadrlwrn55fhppMX7+AHtfW--
From: Ramiro Aceves <ea1abz@gmail.com>
To: Taylor R Campbell <riastradh@NetBSD.org>
Cc: "David H. Gutteridge" <david@gutteridge.ca>, gnats-bugs@NetBSD.org,
netbsd-bugs@NetBSD.org, RVP <rvp@SDF.ORG>
Subject: Re: kern/57833: kernel panic on xorg exit
Date: Wed, 17 Jan 2024 21:09:53 +0100
El 17/1/24 a las 3:12, Taylor R Campbell escribió:
> OK, that's frustrating! Here's one more change, attached as
> pr57833-i915gempages-v5.diff -- this will print some information that
> got optimized away and unavailable in gdb.
>
> If it still crashes: Can you find the i915_gem_object_get_pages_phys
> frame and share the output of `print *obj', in addition to dmesg
> output and `info locals' in all the frames?
>
> Attached as pr57833-i915gempages-v5.patch is a step-by-step patch
> series. If you have the time, and the single giant .diff still
> doesn't work, it would be helpful if you could use bisection to find
> where the old symptom goes away and the new symptom appears. (It's
> possible I made a mistake in some of the related changes to files
> other than i915_gem_phys.c.)
Hello Taylor,
Thanks for your help and efforts, I appreciate them very much.
I have applied v5.diff big patch and ended in a panic just after the
startx command. Please see bellow for the details you asked for.
After this, I am not sure how to apply the step by step patch (sorry for
my ignorance with all of this things) I think that after getting a fresh
kernel files, I have to apply one step patch, then another step patch
over the last patch, and so on until the 9th patch. ¿Is there a way to
apply them one by one with a command without spliting the patch in 9
small files? ¿One for each email? I think am missing something ;-)
Thanks.
netbsd-compal# dmesg -M netbsd.9.core -N netbsd.9
...
...
[ 1.000000] Copyright (c) 1996, 1997, 1998, 1999, 2000, 2001, 2002,
2003,
[ 1.000000] 2004, 2005, 2006, 2007, 2008, 2009, 2010, 2011,
2012, 2013,
[ 1.000000] 2014, 2015, 2016, 2017, 2018, 2019, 2020, 2021,
2022, 2023,
[ 1.000000] 2024
[ 1.000000] The NetBSD Foundation, Inc. All rights reserved.
[ 1.000000] Copyright (c) 1982, 1986, 1989, 1991, 1993
[ 1.000000] The Regents of the University of California. All
rights reserved.
[ 1.000000] NetBSD 10.0_RC2 (MYKERNEL) #5: Wed Jan 17 11:20:28 CET 2024
[ 1.000000]
ramiro@netbsd-compal.remigio:/usr/src/sys/arch/i386/compile/MYKERNEL
[ 1.000000] total memory = 2039 MB
[ 1.000000] avail memory = 1978 MB
[ 1.000000] timecounter: Timecounters tick every 10.000 msec
[ 1.000000] Kernelized RAIDframe activated
[ 1.000000] timecounter: Timecounter "i8254" frequency 1193182 Hz
quality 100
[ 1.000004] mainbus0 (root)
[ 1.000004] cpu0 at mainbus0
[ 1.000004] ACPI Error: AE_BAD_PARAMETER, Thread 3242924096 could
not acquire Mutex [ACPI_MTX_Tables] (0x2) (20221020/utmutex-326)
[ 1.000004] cpu0: Use lfence to serialize rdtsc
[ 1.000004] cpu0: Intel(R) Pentium(R) M processor 1.86GHz, id 0x6d8
[ 1.000004] cpu0: node 0, package 0, core 0, smt 0
[ 1.000004] pci0 at mainbus0 bus 0: configuration mode 1
[ 1.000004] pci0: i/o space, memory space enabled, rd/line, rd/mult,
wr/inv ok
[ 1.000004] pchb0 at pci0 dev 0 function 0: Intel
82915PM/GM/GMS,82910GML Host Bridge (rev. 0x04)
[ 1.000004] agp0 at pchb0: i915-family chipset
[ 1.000004] agp0: detected 7932k stolen memory
[ 1.000004] agp0: aperture at 0xa0000000, size 0x10000000
[ 1.000004] i915drmkms0 at pci0 dev 2 function 0: Intel
82915GM/GMS,82910GML Integrated Graphics Device (rev. 0x04)
[ 1.000004] Intel 82915GM/GMS IGD Companion (miscellaneous display,
revision 0x04) at pci0 dev 2 function 1 not configured
[ 1.000004] uhci0 at pci0 dev 29 function 0: Intel 82801FB/FR USB
UHCI Controller (rev. 0x04)
[ 1.000004] uhci0: interrupting at irq 7
[ 1.000004] usb0 at uhci0: USB revision 1.0
[ 1.000004] uhci1 at pci0 dev 29 function 1: Intel 82801FB/FR USB
UHCI Controller (rev. 0x04)
[ 1.000004] uhci1: interrupting at irq 3
[ 1.000004] usb1 at uhci1: USB revision 1.0
[ 1.000004] uhci2 at pci0 dev 29 function 2: Intel 82801FB/FR USB
UHCI Controller (rev. 0x04)
[ 1.000004] uhci2: interrupting at irq 11
[ 1.000004] usb2 at uhci2: USB revision 1.0
[ 1.000004] uhci3 at pci0 dev 29 function 3: Intel 82801FB/FR USB
UHCI Controller (rev. 0x04)
[ 1.000004] uhci3: interrupting at irq 11
[ 1.000004] usb3 at uhci3: USB revision 1.0
[ 1.000004] ehci0 at pci0 dev 29 function 7: Intel 82801FB/FR USB
EHCI Controller (rev. 0x04)
[ 1.000004] ehci0: 64-bit DMA - limited
[ 1.000004] ehci0: interrupting at irq 7
[ 1.000004] ehci0: EHCI version 1.0
[ 1.000004] ehci0: 4 companion controllers, 2 ports each: uhci0
uhci1 uhci2 uhci3
[ 1.000004] ehci0: Using DMA subregion for control data structures
[ 1.000004] usb4 at ehci0: USB revision 2.0
[ 1.000004] ppb0 at pci0 dev 30 function 0: Intel 82801BAM Hub-PCI
Bridge (rev. 0xd4)
[ 1.000004] pci1 at ppb0 bus 1
[ 1.000004] pci1: i/o space, memory space enabled
[ 1.000004] fwohci0 at pci1 dev 0 function 0: VIA Technologies
VT6306 IEEE 1394 Host Controller (rev. 0x80)
[ 1.000004] fwohci0: interrupting at irq 10
[ 1.000004] fwohci0: OHCI version 1.0 (ROM=1)
[ 1.000004] fwohci0: No. of Isochronous channels is 4.
[ 1.000004] fwohci0: EUI64 00:02:3f:59:88:40:01:0f
[ 1.000004] fwohci0: Phy 1394a available S400, 2 ports.
[ 1.000004] fwohci0: Link S400, max_rec 512 bytes.
[ 1.000004] fwohci0: max_rec 512 -> 2048
[ 1.000004] ieee1394if0 at fwohci0: IEEE1394 bus
[ 1.000004] fwip0 at ieee1394if0: IP over IEEE1394
[ 1.000004] fwohci0: Initiate bus reset
[ 1.000004] re0 at pci1 dev 1 function 0: RealTek 8169/8110 Gigabit
Ethernet (rev. 0x10)
[ 1.000004] re0: interrupting at irq 11
[ 1.000004] re0: RTL8169/8110SB (0x1000)
[ 1.000004] re0: Ethernet address 00:0f:b0:93:6f:e1
[ 1.000004] re0: using 256 tx descriptors
[ 1.000004] rgephy0 at re0 phy 7: RTL8211B 1000BASE-T media interface
[ 1.000004] rgephy0: 10baseT, 10baseT-FDX, 100baseTX, 100baseTX-FDX,
1000baseT, 1000baseT-FDX, auto
[ 1.000004] iwi0 at pci1 dev 2 function 0: Intel PRO/Wireless LAN
2200BG Mini-PCI Adapter (rev. 0x05)
[ 1.000004] iwi0: interrupting at irq 11
[ 1.000004] iwi0: 802.11 address 00:13:ce:6b:7d:01
[ 1.000004] cbb0 at pci1 dev 4 function 0: ENE Technology CB710
CardBus Controller (rev. 0x00)
[ 1.000004] ENE Technology product 0530 (flash memory) at pci1 dev 4
function 1 not configured
[ 1.000004] sdhc0 at pci1 dev 4 function 2: ENE Technology
CB712/714/810 PCI SD Card Reader Controller (rev. 0x00)
[ 1.000004] sdhc0: interrupting at irq 5
[ 1.000004] sdhc0: SDHC 1.0, rev 0, caps <01e021a1/00000000>, SDMA,
33000 kHz, HS 3.3V, 512 byte blocks
[ 1.000004] sdmmc0 at sdhc0 slot 0
[ 1.000004] cbb0: cacheline 0x8 lattimer 0x40
[ 1.000004] cbb0: bhlc 0x824008
[ 1.000004] cbb0: autoconfiguration error: secondary bus number
uninitialized; try PCI_BUS_FIXUP
[ 1.000004] pci_intr_map: no mapping for pin A (line=ff)
[ 1.000004] cbb0: autoconfiguration error: couldn't map interrupt
[ 1.000004] cardslot0 at cbb0
[ 1.000004] pcmcia0 at cardslot0
[ 1.000004] auich0 at pci0 dev 30 function 2: i82801FB (ICH6) AC-97
Audio
[ 1.000004] auich0: interrupting at irq 5
[ 1.000004] auich0: ac97: Avance Logic unknown (0x414c4752) codec;
headphone, 20 bit DAC, 18 bit ADC, no 3D stereo
[ 1.000004] auich0: ac97: ext id 0xa07<AC97_23,AMAP,SPDIF,DRA,VRA>
[ 1.000004] Intel 82801FB/FR AC'97 Modem Controller (modem
communications, revision 0x04) at pci0 dev 30 function 3 not configured
[ 1.000004] ichlpcib0 at pci0 dev 31 function 0: Intel 82801FBM
ICH6M LPC Interface Bridge (rev. 0x04)
[ 1.000004] timecounter: Timecounter "ichlpcib0" frequency 3579545
Hz quality 1000
[ 1.006162] ichlpcib0: 24-bit timer
[ 1.006162] tco0 at ichlpcib0: TCO (watchdog) timer configured.
[ 1.006162] tco0: Min/Max interval 1/367 seconds
[ 1.006162] piixide0 at pci0 dev 31 function 1: Intel 82801FB IDE
Controller (ICH6) (rev. 0x04)
[ 1.006162] piixide0: bus-master DMA support present
[ 1.006162] piixide0: primary channel configured to compatibility mode
[ 1.006162] piixide0: primary channel interrupting at irq 14
[ 1.006162] atabus0 at piixide0 channel 0
[ 1.006162] piixide0: secondary channel configured to compatibility mode
[ 1.006162] piixide0: secondary channel interrupting at irq 15
[ 1.006162] atabus1 at piixide0 channel 1
[ 1.006162] ichsmb0 at pci0 dev 31 function 3: Intel 82801FB/FR
SMBus Controller (rev. 0x04)
[ 1.006162] ichsmb0: interrupting at irq 3
[ 1.006162] iic0 at ichsmb0: I2C bus
[ 1.006162] isa0 at ichlpcib0
[ 1.006162] pckbc0 at isa0 port 0x60-0x64
[ 1.006162] pckbd0 at pckbc0 (kbd slot)
[ 1.006162] pckbc0: using irq 1 for kbd slot
[ 1.006162] wskbd0 at pckbd0: console keyboard
[ 1.006162] pms0 at pckbc0 (aux slot)
[ 1.006162] pms0: ALPS PS/2 V2 pointing device
[ 1.006162] pckbc0: using irq 12 for aux slot
[ 1.006162] wsmouse0 at pms0 mux 0
[ 1.006162] attimer0 at isa0 port 0x40-0x43
[ 1.006162] pcppi0 at isa0 port 0x61
[ 1.006162] midi0 at pcppi0: PC speaker
[ 1.006162] sysbeep0 at pcppi0
[ 1.006162] attimer0: attached to pcppi0
[ 1.006162] est0 at cpu0: Enhanced SpeedStep
[ 1.006162] fwohci0: BUS reset
[ 1.006162] fwohci0: node_id=0xc000ffc0, gen=1, CYCLEMASTER mode
[ 1.006162] ieee1394if0: 1 nodes, maxhop <= 0 cable IRM irm(0) (me)
[ 1.006162] ieee1394if0: bus manager 0
[ 1.243701] timecounter: Timecounter "clockinterrupt" frequency 100
Hz quality 0
[ 1.574365] auich0: measured ac97 link rate at 48000 Hz
[ 1.574365] audio0 at auich0: playback, capture, full duplex,
independent
[ 1.574365] audio0: slinear_le:16 2ch 48000Hz, blk 1920 bytes (10ms)
for playback
[ 1.574365] audio0: slinear_le:16 2ch 48000Hz, blk 1920 bytes (10ms)
for recording
[ 1.574365] uhub0 at usb0: NetBSD (0x0000) UHCI root hub (0x0000),
class 9/0, rev 1.00/1.00, addr 1
[ 1.574365] uhub0: 2 ports with 2 removable, self powered
[ 1.574365] uhub1 at usb1: NetBSD (0x0000) UHCI root hub (0x0000),
class 9/0, rev 1.00/1.00, addr 1
[ 1.584368] uhub1: 2 ports with 2 removable, self powered
[ 1.584368] uhub2 at usb2: NetBSD (0x0000) UHCI root hub (0x0000),
class 9/0, rev 1.00/1.00, addr 1
[ 1.584368] uhub2: 2 ports with 2 removable, self powered
[ 1.584368] uhub3 at usb3: NetBSD (0x0000) UHCI root hub (0x0000),
class 9/0, rev 1.00/1.00, addr 1
[ 1.584368] uhub3: 2 ports with 2 removable, self powered
[ 1.584368] uhub4 at usb4: NetBSD (0x0000) EHCI root hub (0x0000),
class 9/0, rev 2.00/1.00, addr 1
[ 1.584368] uhub4: 8 ports with 8 removable, self powered
[ 1.594366] atapibus0 at atabus0: 2 targets
[ 1.594366] IPsec: Initialized Security Association Processing.
[ 1.674366] cd0 at atapibus0 drive 1: <TSSTcorpCD/DVDW TS-L632B,
95WK401090, TI33> cdrom removable
[ 1.684366] cd0: 32-bit data port
[ 1.684366] cd0: drive supports PIO mode 4, DMA mode 2, Ultra-DMA
mode 2 (Ultra/33)
[ 1.684366] wd0 at atabus0 drive 0
[ 1.684366] wd0: <IC25N080ATMR04-0>
[ 1.684366] wd0: drive supports 16-sector PIO transfers, LBA48
addressing
[ 1.684366] wd0: 76319 MB, 155061 cyl, 16 head, 63 sec, 512
bytes/sect x 156301488 sectors
[ 2.124373] wd0: 32-bit data port
[ 2.124373] wd0: drive supports PIO mode 4, DMA mode 2, Ultra-DMA
mode 5 (Ultra/100)
[ 2.124373] wd0(piixide0:0:0): using PIO mode 4, Ultra-DMA mode 5
(Ultra/100) (using DMA)
[ 2.124373] cd0(piixide0:0:1): using PIO mode 4, Ultra-DMA mode 2
(Ultra/33) (using DMA)
[ 2.134373] swwdog0: software watchdog initialized
[ 2.174373] WARNING: 2 errors while detecting hardware; check system
log.
[ 2.174373] boot device: wd0
[ 2.174373] root on wd0a dumps on wd0b
[ 2.204374] root file system type: ffs
[ 2.214374] kern.module.path=/stand/i386/10.0/modules
[ 2.214374] [drm] Supports vblank timestamp caching Rev 2 (21.10.2013).
[ 2.214374] [drm] Driver supports precise vblank timestamp query.
[ 2.214374] i915drmkms0: interrupting at irq 11 (i915drmkms0)
[ 2.254375] [drm] Initialized overlay support.
[ 2.254375] [drm] Initialized i915 1.6.0 20200114 for i915drmkms0 on
minor 0
[ 2.394380] intelfb0 at i915drmkms0
[ 2.394380] [drm] DRM_I915_DEBUG enabled
[ 2.394380] [drm] DRM_I915_DEBUG_GEM enabled
[ 2.394380] intelfb0: framebuffer at 0xa0009000, size 1280x800,
depth 32, stride 5120
[ 3.034388] wsdisplay0 at intelfb0 kbdmux 1: console (default, vt100
emulation), using wskbd0
[ 3.034388] wsmux1: connecting to wsdisplay0
[ 17.214604] wsdisplay0: screen 1 added (default, vt100 emulation)
[ 17.214604] wsdisplay0: screen 2 added (default, vt100 emulation)
[ 17.214604] wsdisplay0: screen 3 added (default, vt100 emulation)
[ 17.214604] wsdisplay0: screen 4 added (default, vt100 emulation)
[ 64.776202] bus_dmamem_kmap: t=0xc147d8c0 segs=0xc5c20a34 nsegs=1
size=0x4000 kvap=0xdcbeead0 flags=0x4
[ 64.776202] panic: _bus_dmamem_kmap: size botch
[ 64.776202] cpu0: Begin traceback...
[ 64.776202]
vpanic(c1214668,dcbeea90,dcbeeae4,c06cfeba,c1214668,0,0,4,1,4000) at
netbsd:vpanic+0x196
[ 64.776202] panic(c1214668,0,0,4,1,4000,dcbeead0,4,c5c20a5c,0) at
netbsd:panic+0x18
[ 64.776202]
i915_gem_object_get_pages_phys(c5c20900,1,2,c4353004,c4348804,c434a084,c4353000,c53b1c44,c5340a04,1)
at netbsd:i915_gem_object_get_pages_phys+0x54a
[ 64.786211]
i915_gem_object_attach_phys(c5c20900,1000,c0af86a4,c3dfd004,c5c20900,c5c20a18,dcbeeb6c,c0673d15,c5c20a18,1)
at netbsd:i915_gem_object_attach_phys+0xb4
[ 64.786211]
intel_plane_pin_fb(c5c20a18,1,2,c0b2f8a8,c4352010,c4353000,c3dfd004,c50f1004,c4352004,c50f1004)
at netbsd:intel_plane_pin_fb+0x62
[ 64.786211]
intel_prepare_plane_fb(c434a084,c53b1c44,c3dff878,10001,c50f1004,c4353004,c3dff878,dcbeebb8,c066abaf,c3dfd004)
at netbsd:intel_prepare_plane_fb+0xcf
[ 64.786211]
drm_atomic_helper_prepare_planes(c3dfd004,c50f1004,1,c50f1564,0,c50f1004,c3dfd004,c53b1c44,dcbeebd4,c0af8aa5)
at netbsd:drm_atomic_helper_prepare_planes+0x7a
[ 64.786211]
intel_atomic_commit(c3dfd004,c50f1004,0,c434a084,c50f1004,dcbeebfc,c0afde70,c50f1004,c5340a04,40)
at netbsd:intel_atomic_commit+0x9c
[ 64.796205]
drm_atomic_commit(c50f1004,c5340a04,40,0,400000,c434a084,c5340a04,18f,dcbeec64,c0b2b394)
at netbsd:drm_atomic_commit+0x52
[ 64.796205]
drm_atomic_helper_update_plane(c434a084,c4348804,c5340a04,27f,18f,40,40,0,0,400000)
at netbsd:drm_atomic_helper_update_plane+0xd9
[ 64.796205]
__setplane_atomic(27f,18f,40,40,0,0,400000,400000,dcbeecb8,400000) at
netbsd:__setplane_atomic+0x10b
[ 64.796205]
drm_mode_cursor_common(3,2c,27f,18f,40,40,b,0,0,dcbeee54) at
netbsd:drm_mode_cursor_common+0x261
[ 64.796205]
drm_mode_cursor_ioctl(c3dfd004,dcbeeeac,c5bfa004,dcbeedc4,1c,dcbeeeac,63,dcbeedc4,c3dfd360,c5bfa004)
at netbsd:drm_mode_cursor_ioctl+0x4e
[ 64.796205]
drm_ioctl(c5b908c0,c01c64a3,dcbeeeac,dcbeef38,c0cc9867,c5b908c0,c01c64a3,dcbeeeac,c0c453b7,c429fd24)
at netbsd:drm_ioctl+0x42d
[ 64.806208]
drm_ioctl_shim(c5b908c0,c01c64a3,dcbeeeac,c0c453b7,c429fd24,dcbeef10,0,c5bcc178,c5b908c0,0)
at netbsd:drm_ioctl_shim+0x43
[ 64.806208]
sys_ioctl(c4361940,dcbeef68,dcbeef60,c5339500,0,36,dcbeef60,dcbeef68,0,0)
at netbsd:sys_ioctl+0x35b
[ 64.806208] syscall() at netbsd:syscall+0x1d6
[ 64.806208] --- syscall (number 54) ---
[ 64.806208] b96fbdc7:
[ 64.806208] cpu0: End traceback...
[ 64.806208] dumping to dev 0,1 offset 1023
[ 64.806208] dump
netbsd-compal# gdb /usr/src/sys/arch/i386/compile/MYKERNEL/netbsd.gdb
GNU gdb (GDB) 11.0.50.20200914-git
Copyright (C) 2020 Free Software Foundation, Inc.
License GPLv3+: GNU GPL version 3 or later
<http://gnu.org/licenses/gpl.html>
This is free software: you are free to change and redistribute it.
There is NO WARRANTY, to the extent permitted by law.
Type "show copying" and "show warranty" for details.
This GDB was configured as "i486--netbsdelf".
Type "show configuration" for configuration details.
For bug reporting instructions, please see:
<https://www.gnu.org/software/gdb/bugs/>.
Find the GDB manual and other documentation resources online at:
<http://www.gnu.org/software/gdb/documentation/>.
For help, type "help".
Type "apropos word" to search for commands related to "word"...
Reading symbols from /usr/src/sys/arch/i386/compile/MYKERNEL/netbsd.gdb...
(gdb) target kvm /var/crash/netbsd.9.core
0xc012d6ed in maybe_dump (howto=260) at
../../../../arch/i386/i386/machdep.c:725
725 dumpsys();
(gdb) frame 0
#0 0xc012d6ed in maybe_dump (howto=260) at
../../../../arch/i386/i386/machdep.c:725
725 dumpsys();
(gdb) info locals
s = 0
s = <optimized out>
(gdb) frame 1
#1 cpu_reboot (howto=howto@entry=260, bootstr=bootstr@entry=0x0)
at ../../../../arch/i386/i386/machdep.c:746
746 maybe_dump(howto);
(gdb) info locals
syncdone = false
s = 0
(gdb) frame 2
#2 0xc0c85dd7 in kern_reboot (howto=howto@entry=260,
bootstr=bootstr@entry=0x0)
at ../../../../kern/kern_reboot.c:73
73 cpu_reboot(howto, bootstr);
(gdb) info locals
rebooter = 0xc4361940
l = 0x0
(gdb) frame 3
#3 0xc0cbc998 in vpanic (fmt=fmt@entry=0xc1214668 "_bus_dmamem_kmap:
size botch",
ap=0xdcbeea90 "") at ../../../../kern/subr_prf.c:291
291 kern_reboot(bootopt, NULL);
(gdb) info locals
cii = <optimized out>
ci = <optimized out>
oci = <optimized out>
bootopt = 260
scratchstr = "_bus_dmamem_kmap: size botch", '\000' <repeats 355 times>
(gdb) frame 4
#4 0xc0cbca51 in panic (fmt=fmt@entry=0xc1214668 "_bus_dmamem_kmap:
size botch")
at ../../../../kern/subr_prf.c:208
208 vpanic(fmt, ap);
(gdb) info locals
ap = 0xdcbeea90 ""
(gdb) frame 5
#5 0xc06cfeba in bus_dmamem_kmap (nsegs=1, flags=4, kvap=0xdcbeead0,
size=<optimized out>, segs=0xc5c20a34, t=0xc147d8c0 <pci_bus_dma_tag>)
at ../../../../external/bsd/drm2/dist/drm/i915/gem/i915_gem_phys.c:69
69 panic("_bus_dmamem_kmap: size botch");
(gdb) info locals
kmflags = 0
pmapflags = 19
va = <optimized out>
addr = <optimized out>
curseg = 0
va = <optimized out>
addr = <optimized out>
curseg = <optimized out>
kmflags = <optimized out>
pmapflags = <optimized out>
__func__ = "bus_dmamem_kmap"
(gdb) frame 6
#6 i915_gem_object_get_pages_phys (obj=0xc5c20900)
at ../../../../external/bsd/drm2/dist/drm/i915/gem/i915_gem_phys.c:149
149 ret = -bus_dmamem_kmap(dmat, &obj->mm.u.phys.seg, 1,
(gdb) info locals
mapping = 0xc5c61300
sg = <optimized out>
st = <optimized out>
dma = <optimized out>
vaddr = 0xdb5b4000
dst = <optimized out>
i = <optimized out>
dmat = 0xc147d8c0 <pci_bus_dma_tag>
loaded = false
rsegs = 1
ret = <optimized out>
(gdb) print *obj
$1 = {base = {refcount = {kr_count = 3}, handle_count = 1, dev =
0xc3dfd004,
filp = 0xc5c61300, gemo_uvmobj = {vmobjlock = 0xc5c706c0,
pgops = 0xc1086780 <i915_gem_uvm_ops>, uo_npages = 0, uo_refs =
1, uo_pages = {
t_root = 0x0, t_height = 0}, uo_ubc = {lh_first = 0x0}},
vma_node = {von_lock = {
rw_owner = 0}, von_startpage = 0, von_npages = 0, von_files = {
rbt_root = 0xc5b2c914, rbt_ops = 0xc11480ec
<drm_vma_file_rb_ops>, rbt_minmax = {
0xc5b2c914, 0xc5b2c914}}, von_rb_node = {rb_nodes = {0x0,
0x0}, rb_info = 0},
readonly = false}, size = 16384, name = 0, dma_buf = 0x0,
import_attach = 0x0,
resv = 0xc5c2096c, _resv = {lock = {wwm_state = 0 '\000', wwm_debug
= false, wwm_u = {
owner = 0x0, ctx = 0x0}, wwm_lock = {u = {mtxa_owner = 1537,
s = {
mtxs_dummy = 1 '\001', mtxs_ipl = {_ipl = 6 '\006'},
mtxs_lock = 0 '\000',
mtxs_unused = 0 '\000'}}},
wwm_class = 0xc14d1cc0 <linux_reservation_ww_class>,
wwm_waiters = {
rbt_root = 0x0, rbt_ops = 0xc117b290 <ww_acquire_ctx_rb_ops>,
rbt_minmax = {0x0,
0x0}}, wwm_cv = {cv_opaque = {0x0, 0xc1276960}}}, seq =
{sqc_gen = 0},
fence_excl = 0x0, fence = 0x0, robj_prealloc = 0x0}, funcs = 0x0},
ops = 0xc10867e0 <i915_gem_phys_ops>, vma = {lock = {sl_lock = {u =
{mtxa_owner = 1537,
s = {mtxs_dummy = 1 '\001', mtxs_ipl = {_ipl = 6 '\006'},
mtxs_lock = 0 '\000',
mtxs_unused = 0 '\000'}}}}, list = {prev = 0xc4355f80, next
= 0xc4355f80},
tree = {rbr_tree = {rbt_root = 0xc4355f88, rbt_ops = 0xc10903fc
<vma_tree_rb_ops>,
rbt_minmax = {0xc4355f88, 0xc4355f88}}}}, lut_list = {prev =
0xc5c209c8,
next = 0xc5c209c8}, stolen = 0x0, {rcu = {rcuh_u = {callback = 0x0,
obj = 0x0},
rcuh_next = 0x0}, freed = {next = 0x0}}, userfault_count = 0,
userfault_link = {
prev = 0x2, next = 0x1}, mmo = {lock = {sl_lock = {u = {mtxa_owner
= 1537, s = {
mtxs_dummy = 1 '\001', mtxs_ipl = {_ipl = 6 '\006'},
mtxs_lock = 0 '\000',
mtxs_unused = 0 '\000'}}}}, offsets = {0xc5bcc144, 0x0,
0x0, 0x0}}, flags = 0,
cache_level = 0, cache_coherent = 0, cache_dirty = 0, read_domains = 64,
write_domain = 64, frontbuffer = 0xc5c4b184, tiling_and_stride = 0,
bind_count = {a_u = {
--Type <RET> for more, q to quit, c to continue without paging--
au_int = 0, au_uint = 0}}, mm = {lock = {mtx_lock = {u =
{mtxa_owner = 3291879744,
s = {mtxs_dummy = 64 '@', mtxs_ipl = {_ipl = 25 '\031'},
mtxs_lock = 54 '6',
mtxs_unused = 196 '\304'}}}}, pages_pin_count = {a_u =
{au_int = 1,
au_uint = 1}}, shrink_pin = {a_u = {au_int = 1, au_uint = 1}},
region = 0xc4290f04, blocks = {prev = 0xc5c20a24, next =
0xc5c20a24}, region_link = {
prev = 0xc4290fe0, next = 0xc5c2086c}, u = {internal = {segs =
0x4afb8000,
nsegs = 16384, rsegs = 0}, phys = {seg = {ds_addr = 1257996288,
ds_len = 16384},
kva = 0x0}}, pages = 0x0, mapping = 0x0, page_sizes = {phys =
0, sg = 0, gtt = 0},
get_page = {sg_pos = 0x0, sg_idx = 0, radix = {rtr_tree = {t_root =
0x0,
t_height = 0}, rtr_lock = 0 '\000'}, lock = {mtx_lock = {u =
{mtxa_owner = 0,
s = {mtxs_dummy = 0 '\000', mtxs_ipl = {_ipl = 0 '\000'},
mtxs_lock = 0 '\000', mtxs_unused = 0 '\000'}}}}}, link = {
prev = 0xc5c20a6c, next = 0xc5c20a6c}, madv = 0, dirty = true,
quirked = false},
bit_17 = 0x0, {userptr = {ptr = 0, mm = 0x0, mmu_object = 0x0, work =
0x0}, scratch = 0,
gvt_info = 0x0}}
(gdb) frame 7
#7 0xc06cffd9 in i915_gem_object_attach_phys (obj=0xc5c20900, align=4096)
at ../../../../external/bsd/drm2/dist/drm/i915/gem/i915_gem_phys.c:381
381 err = ____i915_gem_object_get_pages(obj);
(gdb) info locals
pages = 0xc5c352e4
err = <optimized out>
(gdb) frame 8
#8 0xc06653cb in intel_plane_pin_fb
(plane_state=plane_state@entry=0xc53b1c44)
at
../../../../external/bsd/drm2/dist/drm/i915/display/intel_display.c:15729
15729 err = i915_gem_object_attach_phys(obj, align);
(gdb) info locals
obj = <optimized out>
align = <optimized out>
err = <optimized out>
plane = <optimized out>
dev_priv = <optimized out>
fb = 0xc5340a04
vma = <optimized out>
(gdb) frame 9
#9 0xc0673d15 in intel_prepare_plane_fb (plane=0xc434a084,
_new_plane_state=0xc53b1c44)
at
../../../../external/bsd/drm2/dist/drm/i915/display/intel_display.c:15832
15832 ret = intel_plane_pin_fb(new_plane_state);
(gdb) info locals
new_plane_state = 0xc53b1c44
intel_state = 0xc50f1004
dev_priv = 0xc3dfd004
fb = <optimized out>
obj = 0xc5c20900
old_obj = <optimized out>
ret = <optimized out>
(gdb) frame 10
#10 0xc0afcd98 in drm_atomic_helper_prepare_planes (dev=<optimized out>,
state=<optimized out>)
at ../../../../external/bsd/drm2/dist/drm/drm_atomic_helper.c:2399
2399 ret = funcs->prepare_fb(plane, new_plane_state);
(gdb) info locals
funcs = <optimized out>
connector = <optimized out>
new_plane_state = <optimized out>
ret = <optimized out>
i = 3
new_conn_state = <optimized out>
plane = <optimized out>
j = <optimized out>
connector = <optimized out>
new_conn_state = <optimized out>
plane = <optimized out>
new_plane_state = <optimized out>
ret = <optimized out>
i = <optimized out>
j = <optimized out>
fail = <optimized out>
funcs = <optimized out>
funcs = <optimized out>
(gdb) frame 11
#11 drm_atomic_helper_prepare_planes (dev=0xc3dfd004,
state=state@entry=0xc50f1004)
at ../../../../external/bsd/drm2/dist/drm/drm_atomic_helper.c:2375
2375 int drm_atomic_helper_prepare_planes(struct drm_device *dev,
(gdb) info locals
connector = <optimized out>
new_conn_state = <optimized out>
plane = <optimized out>
new_plane_state = <optimized out>
ret = <optimized out>
i = <optimized out>
j = <optimized out>
fail = <optimized out>
funcs = <optimized out>
funcs = <optimized out>
(gdb) frame 12
#12 0xc066abaf in intel_atomic_prepare_commit (state=0xc50f1004)
at
../../../../external/bsd/drm2/dist/drm/i915/display/intel_display.c:14760
14760 return drm_atomic_helper_prepare_planes(state->base.dev,
(gdb) info locals
No locals.
(gdb) frame 13
#13 intel_atomic_commit (dev=0xc3dfd004, _state=0xc50f1004, nonblock=false)
at
../../../../external/bsd/drm2/dist/drm/i915/display/intel_display.c:15595
15595 ret = intel_atomic_prepare_commit(state);
(gdb) info locals
state = 0xc50f1004
dev_priv = 0xc3dfd004
ret = 0
(gdb) frame 14
#14 0xc0af8aa5 in drm_atomic_commit (state=state@entry=0xc50f1004)
at ../../../../external/bsd/drm2/dist/drm/drm_atomic.c:1238
1238 return config->funcs->atomic_commit(state->dev, state, false);
(gdb) info locals
config = 0xc3dfd0c8
ret = <optimized out>
(gdb) frame 15
#15 0xc0afde70 in drm_atomic_helper_update_plane (plane=0xc434a084,
crtc=0xc4348804,
fb=0xc5340a04, crtc_x=639, crtc_y=399, crtc_w=64, crtc_h=64,
src_x=0, src_y=0,
src_w=4194304, src_h=4194304, ctx=0xdcbeecb8)
at ../../../../external/bsd/drm2/dist/drm/drm_atomic_helper.c:2910
2910 ret = drm_atomic_commit(state);
(gdb) info locals
state = 0xc50f1004
plane_state = 0xc53b1c44
ret = 0
(gdb) frame 16
#16 0xc0b2b394 in __setplane_atomic (plane=plane@entry=0xc434a084,
crtc=crtc@entry=0xc4348804, fb=fb@entry=0xc5340a04,
crtc_x=crtc_x@entry=639,
crtc_y=crtc_y@entry=399, crtc_w=64, crtc_h=64, src_x=src_x@entry=0,
src_y=src_y@entry=0, src_w=src_w@entry=4194304,
src_h=src_h@entry=4194304,
ctx=ctx@entry=0xdcbeecb8) at
../../../../external/bsd/drm2/dist/drm/drm_plane.c:761
761 return plane->funcs->update_plane(plane, crtc, fb,
(gdb) info locals
ret = <optimized out>
(gdb) frame 17
#17 0xc0b2b7cd in drm_mode_cursor_universal (ctx=0xdcbeecb8,
file_priv=0xc5bfa004,
req=0xdcbeed64, crtc=0xc4348804)
at ../../../../external/bsd/drm2/dist/drm/drm_plane.c:914
914 ret = __setplane_atomic(plane, crtc, fb,
(gdb) info locals
plane = 0xc434a084
fbreq = {fb_id = 0, width = 64, height = 64, pixel_format = 875713089,
flags = 0,
handles = {11, 0, 0, 0}, pitches = {256, 0, 0, 0}, offsets = {0, 0,
0, 0}, modifier = {
0, 0, 0, 0}}
crtc_x = 639
crtc_y = 399
src_w = 4194304
src_h = 4194304
ret = 0
dev = 0xc3dfd004
fb = 0xc5340a04
crtc_w = <optimized out>
crtc_h = <optimized out>
dev = <optimized out>
plane = <optimized out>
fb = <optimized out>
fbreq = {fb_id = <optimized out>, width = <optimized out>, height =
<optimized out>,
pixel_format = <optimized out>, flags = <optimized out>, handles =
{<optimized out>,
<optimized out>, <optimized out>, <optimized out>}, pitches =
{<optimized out>,
<optimized out>, <optimized out>, <optimized out>}, offsets =
{<optimized out>,
<optimized out>, <optimized out>, <optimized out>}, modifier =
{<optimized out>,
<optimized out>, <optimized out>, <optimized out>}}
crtc_x = <optimized out>
crtc_y = <optimized out>
crtc_w = <optimized out>
crtc_h = <optimized out>
src_w = <optimized out>
src_h = <optimized out>
--Type <RET> for more, q to quit, c to continue without paging--
ret = <optimized out>
(gdb) frame 18
#18 drm_mode_cursor_common (dev=dev@entry=0xc3dfd004,
req=req@entry=0xdcbeed64,
file_priv=file_priv@entry=0xc5bfa004)
at ../../../../external/bsd/drm2/dist/drm/drm_plane.c:973
973 ret = drm_mode_cursor_universal(crtc, req, file_priv, &ctx);
(gdb) info locals
crtc = 0xc4348804
ctx = {ww_ctx = {wwx_class = 0xc14ab70c <crtc_ww_class>, wwx_owner =
0xc4361940,
wwx_ticket = 37, wwx_acquired = 2, wwx_acquire_done = false,
wwx_rb_node = {
rb_nodes = {0x0, 0x0}, rb_info = 0}}, contended = 0x0, locked =
{prev = 0xc4348840,
next = 0xc434a0bc}, trylock_only = false, interruptible = true}
ret = <optimized out>
(gdb) frame 19
#19 0xc0b2be1b in drm_mode_cursor_ioctl (dev=0xc3dfd004, data=0xdcbeeeac,
file_priv=0xc5bfa004) at
../../../../external/bsd/drm2/dist/drm/drm_plane.c:1023
1023 return drm_mode_cursor_common(dev, &new_req, file_priv);
(gdb) info locals
req = 0xdcbeeeac
new_req = {flags = 3, crtc_id = 44, x = 639, y = 399, width = 64, height
= 64,
handle = 11, hot_x = 0, hot_y = 0}
(gdb) frame 20
#20 0xc0b23bac in drm_ioctl (fp=<optimized out>, cmd=<optimized out>,
data=<optimized out>)
at ../../../../external/bsd/drm2/dist/drm/drm_ioctl.c:968
968 error = -(*ioctl->func)(dev, data0, file);
(gdb) info locals
stackbuf =
"B\000\000\000@\035\277\305P\375)\304\000\000\257\266\000\000\000\000\000\000\000\000\060\001\000\000\000\000\000\000\000\301\274\305\000\000\000\000\000\000\000\001\000\000\000\000\003\000\000\000\000\000\000\000@{\272\305\001\000\000\000$\375)\304\000\340\256\266\000\020\000\000$\375)\304|\004\000\000\000\v\303\305\000\020\000\000\002\000\000\000\000\340\256\266\001\000\000\000\000\000\000\000\001\000\000\001\003",
'\000' <repeats 11 times>, "\001\000\000"
buf = 0xdcbeedc4 "B"
data0 = 0xdcbeeeac
file = <optimized out>
nr = <optimized out>
error = <optimized out>
dev = 0xc3dfd004
ioctl = <optimized out>
is_driver_ioctl = <optimized out>
(gdb) frame 21
#21 0xc0af1d86 in drm_ioctl_shim (fp=0xc5b908c0, cmd=3223086243,
data=0xdcbeeeac)
at ../../../../external/bsd/drm2/drm/drm_cdevsw.c:393
393 error = drm_ioctl(fp, cmd, data);
(gdb) info locals
file = <optimized out>
driver = <optimized out>
error = <optimized out>
(gdb) frame 22
#22 0xc0cc9867 in sys_ioctl (l=<optimized out>, uap=<optimized out>,
retval=<optimized out>) at ../../../../kern/sys_generic.c:675
675 error = (*fp->f_ops->fo_ioctl)(fp, com, data);
(gdb) info locals
fp = <optimized out>
p = <optimized out>
com = <optimized out>
error = <optimized out>
size = <optimized out>
alloc_size = <optimized out>
data = 0xdcbeeeac
memp = 0x0
stkbuf = {3, 44, 639, 399, 64, 64, 11, 262, 3291879744, 2, 3703500700,
3222468089,
3291086116, 3064913920, 2, 0, 0, 1, 3, 1, 3317481848, 3291086116, 0,
3064913920,
3064913920, 3291086116, 0, 3291065536, 3703492608, 3703500712, 0, 0}
(gdb) frame 23
#23 0xc049b4c6 in sy_call (rval=0xdcbeef60, uap=0xdcbeef68, l=0xc4361940,
sy=0xc14ae998 <sysent+1080>) at ../../../../sys/syscallvar.h:65
65 error = (*sy->sy_call)(l, uap, rval);
(gdb) info locals
error = <optimized out>
error = <optimized out>
(gdb) frame 24
#24 sy_invoke (code=<optimized out>, rval=0xdcbeef60, uap=0xdcbeef68,
l=0xc4361940,
sy=0xc14ae998 <sysent+1080>) at ../../../../sys/syscallvar.h:94
94 error = sy_call(sy, l, uap, rval);
(gdb) info locals
do_trace = <optimized out>
error = <optimized out>
do_trace = <optimized out>
error = <optimized out>
(gdb) frame 25
#25 syscall (frame=0xdcbeefa8) at ../../../../arch/x86/x86/syscall.c:138
138 error = sy_invoke(callp, l, args, rval, code);
(gdb) info locals
callp = 0xc14ae998 <sysent+1080>
p = <optimized out>
l = 0xc4361940
error = <optimized out>
code = <optimized out>
rval = {0, 0}
args = {10, -1071881053, -1078530356, -1195388928, 10, 0, 281542656, 0,
-1195388928,
-1078530476}
(gdb) frame 26
#26 0xc0102230 in Xsyscall ()
(gdb) info locals
No symbol table info available.
(gdb) frame 27
#27 0xdcbeefa8 in ?? ()
(gdb) info locals
No symbol table info available.
(gdb) frame 28
No frame at level 28.
(gdb)
Thanks
Ramiro.
From: Taylor R Campbell <riastradh@NetBSD.org>
To: Ramiro Aceves <ea1abz@gmail.com>
Cc: "David H. Gutteridge" <david@gutteridge.ca>,
gnats-bugs@NetBSD.org, netbsd-bugs@NetBSD.org, RVP <rvp@SDF.ORG>
Subject: Re: kern/57833: kernel panic on xorg exit
Date: Thu, 18 Jan 2024 03:11:09 +0000
This is a multi-part message in MIME format.
--=_yZfuFEUR5sBHB86OQy7idKn1uESPEWyt
OK, that's getting pretty weird. Can you please revert all your local
changes, and apply just the attached patch?
If it crashes, same request as before -- `print *obj', `info locals'
in all frames, dmesg, plus `print segs[0]' in the bus_dmamem_kmap
frame (which was frame 5 in your last reply).
P.S. The pr57833-i915gempages-v5.patch file I gave you earlier is a
git patch series. You can apply it on top of a git repository wit the
`git am' command, and bisect with `git bisect'. If the smaller
i915_gem_phys.patch attached to this message works, we can use that to
try finding which other part of the changes might have broken things.
--=_yZfuFEUR5sBHB86OQy7idKn1uESPEWyt
Content-Type: text/plain; charset="ISO-8859-1"; name="i915_gem_phys"
Content-Transfer-Encoding: quoted-printable
Content-Disposition: attachment; filename="i915_gem_phys.patch"
diff --git a/sys/external/bsd/drm2/dist/drm/i915/gem/i915_gem_phys.c b/sys/=
external/bsd/drm2/dist/drm/i915/gem/i915_gem_phys.c
index 3f68276eea5f..375246c43af6 100644
--- a/sys/external/bsd/drm2/dist/drm/i915/gem/i915_gem_phys.c
+++ b/sys/external/bsd/drm2/dist/drm/i915/gem/i915_gem_phys.c
@@ -24,6 +24,98 @@ __KERNEL_RCSID(0, "$NetBSD: i915_gem_phys.c,v 1.8 2021/1=
2/19 12:45:43 riastradh
#include "i915_gem_region.h"
#include "i915_scatterlist.h"
=20
+#ifdef __NetBSD__
+
+#include <uvm/uvm.h>
+#include <uvm/uvm_extern.h>
+
+#include <machine/pmap_private.h> /* kvtopte, pmap_pte_clearbits */
+
+/*
+ * Version of bus_dmamem_map that uses pmap_kenter_pa, not pmap_enter,
+ * so that it isn't affected by pmap_page_protect on the physical
+ * address. Adapted from sys/arch/x86/x86/bus_dma.c.
+ */
+static int
+bus_dmamem_kmap(bus_dma_tag_t t, bus_dma_segment_t *segs, int nsegs,
+ size_t size, void **kvap, int flags)
+{
+ vaddr_t va;
+ bus_addr_t addr;
+ int curseg;
+ const uvm_flag_t kmflags =3D
+ (flags & BUS_DMA_NOWAIT) !=3D 0 ? UVM_KMF_NOWAIT : 0;
+ u_int pmapflags =3D PMAP_WIRED | VM_PROT_READ | VM_PROT_WRITE;
+
+ CTASSERT(PAGE_SIZE =3D=3D 4096);
+ printf("%s: t=3D%p segs=3D%p nsegs=3D%d size=3D0x%zx kvap=3D%p flags=3D0x=
%x\n",
+ __func__, t, segs, nsegs, size, kvap, flags);
+
+ size =3D round_page(size);
+ if (flags & BUS_DMA_NOCACHE)
+ pmapflags |=3D PMAP_NOCACHE;
+
+ va =3D uvm_km_alloc(kernel_map, size, 0, UVM_KMF_VAONLY | kmflags);
+
+ if (va =3D=3D 0)
+ return ENOMEM;
+
+ printf("%s: va=3D%"PRIxVADDR"\n", __func__, va);
+ *kvap =3D (void *)va;
+
+ for (curseg =3D 0; curseg < nsegs; curseg++) {
+ printf("%s:%d size=3D0x%"PRIxBUSSIZE
+ " curseg=3D%d addr=3D0x%"PRIxBUSADDR" len=3D0x%"PRIxBUSSIZE
+ " end=3D0x%"PRIxBUSADDR"\n",
+ __func__, __LINE__, size,
+ curseg, segs[curseg].ds_addr, segs[curseg].ds_len,
+ segs[curseg].ds_addr + segs[curseg].ds_len);
+ for (addr =3D segs[curseg].ds_addr;
+ addr < (segs[curseg].ds_addr + segs[curseg].ds_len);
+ addr +=3D PAGE_SIZE, va +=3D PAGE_SIZE, size -=3D PAGE_SIZE) {
+ printf("%s:%d: size=3D0x%"PRIxBUSSIZE
+ " addr=3D0x%"PRIxBUSADDR,
+ __func__, __LINE__, size, addr);
+ if (size =3D=3D 0)
+ panic("_bus_dmamem_kmap: size botch");
+ pmap_kenter_pa(va, addr,
+ VM_PROT_READ | VM_PROT_WRITE,
+ pmapflags);
+ }
+ }
+ pmap_update(pmap_kernel());
+
+ return 0;
+}
+
+static void
+bus_dmamem_kunmap(bus_dma_tag_t t, void *kva, size_t size)
+{
+ pt_entry_t *pte, opte;
+ vaddr_t va, sva, eva;
+
+ KASSERTMSG(((uintptr_t)kva & PGOFSET) =3D=3D 0, "kva=3D%p", kva);
+
+ size =3D round_page(size);
+ sva =3D (vaddr_t)kva;
+ eva =3D sva + size;
+
+ /*
+ * mark pages cacheable again.
+ */
+ for (va =3D sva; va < eva; va +=3D PAGE_SIZE) {
+ pte =3D kvtopte(va);
+ opte =3D *pte;
+ if ((opte & PTE_PCD) !=3D 0)
+ pmap_pte_clearbits(pte, PTE_PCD);
+ }
+ pmap_kremove((vaddr_t)kva, size);
+ pmap_update(pmap_kernel());
+ uvm_km_free(kernel_map, (vaddr_t)kva, size, UVM_KMF_VAONLY);
+}
+
+#endif
+
#include <linux/nbsd-namespace.h>
=20
static int i915_gem_object_get_pages_phys(struct drm_i915_gem_object *obj)
@@ -65,7 +157,7 @@ static int i915_gem_object_get_pages_phys(struct drm_i91=
5_gem_object *obj)
if (ret)
return -ENOMEM;
KASSERT(rsegs =3D=3D 1);
- ret =3D -bus_dmamem_map(dmat, &obj->mm.u.phys.seg, 1,
+ ret =3D -bus_dmamem_kmap(dmat, &obj->mm.u.phys.seg, 1,
roundup_pow_of_two(obj->base.size), &vaddr,
BUS_DMA_WAITOK|BUS_DMA_COHERENT);
if (ret)
@@ -83,7 +175,12 @@ static int i915_gem_object_get_pages_phys(struct drm_i9=
15_gem_object *obj)
if (!st)
goto err_pci;
=20
+#ifdef __NetBSD__
+ if (sg_alloc_table_from_bus_dmamem(st, dmat, &obj->mm.u.phys.seg, 1,
+ GFP_KERNEL))
+#else
if (sg_alloc_table(st, 1, GFP_KERNEL))
+#endif
goto err_st;
=20
sg =3D st->sgl;
@@ -151,7 +248,7 @@ err_st:
err_pci:
#ifdef __NetBSD__
if (vaddr) {
- bus_dmamem_unmap(dmat, vaddr,
+ bus_dmamem_kunmap(dmat, vaddr,
roundup_pow_of_two(obj->base.size));
}
obj->mm.u.phys.kva =3D NULL;
@@ -225,7 +322,7 @@ i915_gem_object_put_pages_phys(struct drm_i915_gem_obje=
ct *obj,
kfree(pages);
=20
#ifdef __NetBSD__
- bus_dmamem_unmap(dmat, obj->mm.u.phys.kva,
+ bus_dmamem_kunmap(dmat, obj->mm.u.phys.kva,
roundup_pow_of_two(obj->base.size));
obj->mm.u.phys.kva =3D NULL;
bus_dmamem_free(dmat, &obj->mm.u.phys.seg, 1);
--=_yZfuFEUR5sBHB86OQy7idKn1uESPEWyt--
From: Ramiro Aceves <ea1abz@gmail.com>
To: Taylor R Campbell <riastradh@NetBSD.org>
Cc: "David H. Gutteridge" <david@gutteridge.ca>, gnats-bugs@NetBSD.org,
netbsd-bugs@NetBSD.org, RVP <rvp@SDF.ORG>
Subject: Re: kern/57833: kernel panic on xorg exit
Date: Thu, 18 Jan 2024 21:44:23 +0100
El 18/1/24 a las 4:11, Taylor R Campbell escribió:
> OK, that's getting pretty weird. Can you please revert all your local
> changes, and apply just the attached patch?
>
> If it crashes, same request as before -- `print *obj', `info locals'
> in all frames, dmesg, plus `print segs[0]' in the bus_dmamem_kmap
> frame (which was frame 5 in your last reply).
>
>
> P.S. The pr57833-i915gempages-v5.patch file I gave you earlier is a
> git patch series. You can apply it on top of a git repository wit the
> `git am' command, and bisect with `git bisect'. If the smaller
> i915_gem_phys.patch attached to this message works, we can use that to
> try finding which other part of the changes might have broken things.
Hello Taylor,
Thanks for reply and the new patch. New panic today as soon as I
entered in xorg with startx command. Please see below.
Thanks so much.
netbsd-compal# pwd
/var/crash
netbsd-compal# ls -al
total 1538712
drwxrwx--- 2 root wheel 1024 Jan 18 19:23 .
drwxr-xr-x 26 root wheel 512 Jan 9 19:14 ..
-rw------- 1 root wheel 3 Jan 18 19:13 bounds
-rw------- 1 root wheel 5 Jan 1 15:04 minfree
-rw------- 1 root wheel 1958710 Jan 9 19:21 netbsd.0
-rw------- 1 root wheel 154079764 Jan 9 19:21 netbsd.0.core
-rw------- 1 root wheel 1958710 Jan 9 19:24 netbsd.1
-rw------- 1 root wheel 117210132 Jan 9 19:24 netbsd.1.core
-rw------- 1 root wheel 1958027 Jan 18 19:13 netbsd.10
-rw------- 1 root wheel 114651156 Jan 18 19:13 netbsd.10.core
-rw------- 1 root wheel 1958710 Jan 9 20:14 netbsd.2
-rw------- 1 root wheel 202709524 Jan 9 20:14 netbsd.2.core
-rw------- 1 root wheel 1958710 Jan 10 07:18 netbsd.3
-rw------- 1 root wheel 245231124 Jan 10 07:18 netbsd.3.core
-rw------- 1 root wheel 122661396 Jan 12 19:29 netbsd.4.core
-rw------- 1 root wheel 843776 Jan 12 19:29 netbsd.4.gz
-rw------- 1 root wheel 122661396 Jan 13 10:56 netbsd.5.core
-rw------- 1 root wheel 843776 Jan 13 10:56 netbsd.5.gz
-rw------- 1 root wheel 2063492 Jan 13 12:12 netbsd.6
-rw------- 1 root wheel 122661396 Jan 13 12:12 netbsd.6.core
-rw------- 1 root wheel 1958653 Jan 13 12:31 netbsd.7
-rw------- 1 root wheel 124865556 Jan 13 12:31 netbsd.7.core
-rw------- 1 root wheel 1958011 Jan 15 22:28 netbsd.8
-rw------- 1 root wheel 114051092 Jan 15 22:28 netbsd.8.core
-rw------- 1 root wheel 1958027 Jan 17 19:01 netbsd.9
-rw------- 1 root wheel 114056212 Jan 17 19:01 netbsd.9.core
netbsd-compal#
netbsd-compal# dmesg -M netbsd.10.core -N netbsd.10
...
...
...
[ 1.000000] Copyright (c) 1996, 1997, 1998, 1999, 2000, 2001, 2002,
2003,
[ 1.000000] 2004, 2005, 2006, 2007, 2008, 2009, 2010, 2011,
2012, 2013,
[ 1.000000] 2014, 2015, 2016, 2017, 2018, 2019, 2020, 2021,
2022, 2023,
[ 1.000000] 2024
[ 1.000000] The NetBSD Foundation, Inc. All rights reserved.
[ 1.000000] Copyright (c) 1982, 1986, 1989, 1991, 1993
[ 1.000000] The Regents of the University of California. All
rights reserved.
[ 1.000000] NetBSD 10.0_RC2 (MYKERNEL) #6: Thu Jan 18 09:26:12 CET 2024
[ 1.000000]
ramiro@netbsd-compal.remigio:/usr/src/sys/arch/i386/compile/MYKERNEL
[ 1.000000] total memory = 2039 MB
[ 1.000000] avail memory = 1978 MB
[ 1.000000] timecounter: Timecounters tick every 10.000 msec
[ 1.000000] Kernelized RAIDframe activated
[ 1.000000] timecounter: Timecounter "i8254" frequency 1193182 Hz
quality 100
[ 1.000004] mainbus0 (root)
[ 1.000004] cpu0 at mainbus0
[ 1.000004] ACPI Error: AE_BAD_PARAMETER, Thread 3242924096 could
not acquire Mutex [ACPI_MTX_Tables] (0x2) (20221020/utmutex-326)
[ 1.000004] cpu0: Use lfence to serialize rdtsc
[ 1.000004] cpu0: Intel(R) Pentium(R) M processor 1.86GHz, id 0x6d8
[ 1.000004] cpu0: node 0, package 0, core 0, smt 0
[ 1.000004] pci0 at mainbus0 bus 0: configuration mode 1
[ 1.000004] pci0: i/o space, memory space enabled, rd/line, rd/mult,
wr/inv ok
[ 1.000004] pchb0 at pci0 dev 0 function 0: Intel
82915PM/GM/GMS,82910GML Host Bridge (rev. 0x04)
[ 1.000004] agp0 at pchb0: i915-family chipset
[ 1.000004] agp0: detected 7932k stolen memory
[ 1.000004] agp0: aperture at 0xa0000000, size 0x10000000
[ 1.000004] i915drmkms0 at pci0 dev 2 function 0: Intel
82915GM/GMS,82910GML Integrated Graphics Device (rev. 0x04)
[ 1.000004] Intel 82915GM/GMS IGD Companion (miscellaneous display,
revision 0x04) at pci0 dev 2 function 1 not configured
[ 1.000004] uhci0 at pci0 dev 29 function 0: Intel 82801FB/FR USB
UHCI Controller (rev. 0x04)
[ 1.000004] uhci0: interrupting at irq 7
[ 1.000004] usb0 at uhci0: USB revision 1.0
[ 1.000004] uhci1 at pci0 dev 29 function 1: Intel 82801FB/FR USB
UHCI Controller (rev. 0x04)
[ 1.000004] uhci1: interrupting at irq 3
[ 1.000004] usb1 at uhci1: USB revision 1.0
[ 1.000004] uhci2 at pci0 dev 29 function 2: Intel 82801FB/FR USB
UHCI Controller (rev. 0x04)
[ 1.000004] uhci2: interrupting at irq 11
[ 1.000004] usb2 at uhci2: USB revision 1.0
[ 1.000004] uhci3 at pci0 dev 29 function 3: Intel 82801FB/FR USB
UHCI Controller (rev. 0x04)
[ 1.000004] uhci3: interrupting at irq 11
[ 1.000004] usb3 at uhci3: USB revision 1.0
[ 1.000004] ehci0 at pci0 dev 29 function 7: Intel 82801FB/FR USB
EHCI Controller (rev. 0x04)
[ 1.000004] ehci0: 64-bit DMA - limited
[ 1.000004] ehci0: interrupting at irq 7
[ 1.000004] ehci0: EHCI version 1.0
[ 1.000004] ehci0: 4 companion controllers, 2 ports each: uhci0
uhci1 uhci2 uhci3
[ 1.000004] ehci0: Using DMA subregion for control data structures
[ 1.000004] usb4 at ehci0: USB revision 2.0
[ 1.000004] ppb0 at pci0 dev 30 function 0: Intel 82801BAM Hub-PCI
Bridge (rev. 0xd4)
[ 1.000004] pci1 at ppb0 bus 1
[ 1.000004] pci1: i/o space, memory space enabled
[ 1.000004] fwohci0 at pci1 dev 0 function 0: VIA Technologies
VT6306 IEEE 1394 Host Controller (rev. 0x80)
[ 1.000004] fwohci0: interrupting at irq 10
[ 1.000004] fwohci0: OHCI version 1.0 (ROM=1)
[ 1.000004] fwohci0: No. of Isochronous channels is 4.
[ 1.000004] fwohci0: EUI64 00:02:3f:59:88:40:01:0f
[ 1.000004] fwohci0: Phy 1394a available S400, 2 ports.
[ 1.000004] fwohci0: Link S400, max_rec 512 bytes.
[ 1.000004] fwohci0: max_rec 512 -> 2048
[ 1.000004] ieee1394if0 at fwohci0: IEEE1394 bus
[ 1.000004] fwip0 at ieee1394if0: IP over IEEE1394
[ 1.000004] fwohci0: Initiate bus reset
[ 1.000004] re0 at pci1 dev 1 function 0: RealTek 8169/8110 Gigabit
Ethernet (rev. 0x10)
[ 1.000004] re0: interrupting at irq 11
[ 1.000004] re0: RTL8169/8110SB (0x1000)
[ 1.000004] re0: Ethernet address 00:0f:b0:93:6f:e1
[ 1.000004] re0: using 256 tx descriptors
[ 1.000004] rgephy0 at re0 phy 7: RTL8211B 1000BASE-T media interface
[ 1.000004] rgephy0: 10baseT, 10baseT-FDX, 100baseTX, 100baseTX-FDX,
1000baseT, 1000baseT-FDX, auto
[ 1.000004] iwi0 at pci1 dev 2 function 0: Intel PRO/Wireless LAN
2200BG Mini-PCI Adapter (rev. 0x05)
[ 1.000004] iwi0: interrupting at irq 11
[ 1.000004] iwi0: 802.11 address 00:13:ce:6b:7d:01
[ 1.000004] cbb0 at pci1 dev 4 function 0: ENE Technology CB710
CardBus Controller (rev. 0x00)
[ 1.000004] ENE Technology product 0530 (flash memory) at pci1 dev 4
function 1 not configured
[ 1.000004] sdhc0 at pci1 dev 4 function 2: ENE Technology
CB712/714/810 PCI SD Card Reader Controller (rev. 0x00)
[ 1.000004] sdhc0: interrupting at irq 5
[ 1.000004] sdhc0: SDHC 1.0, rev 0, caps <01e021a1/00000000>, SDMA,
33000 kHz, HS 3.3V, 512 byte blocks
[ 1.000004] sdmmc0 at sdhc0 slot 0
[ 1.000004] cbb0: cacheline 0x8 lattimer 0x40
[ 1.000004] cbb0: bhlc 0x824008
[ 1.000004] cbb0: autoconfiguration error: secondary bus number
uninitialized; try PCI_BUS_FIXUP
[ 1.000004] pci_intr_map: no mapping for pin A (line=ff)
[ 1.000004] cbb0: autoconfiguration error: couldn't map interrupt
[ 1.000004] cardslot0 at cbb0
[ 1.000004] pcmcia0 at cardslot0
[ 1.000004] auich0 at pci0 dev 30 function 2: i82801FB (ICH6) AC-97
Audio
[ 1.000004] auich0: interrupting at irq 5
[ 1.000004] auich0: ac97: Avance Logic unknown (0x414c4752) codec;
headphone, 20 bit DAC, 18 bit ADC, no 3D stereo
[ 1.000004] auich0: ac97: ext id 0xa07<AC97_23,AMAP,SPDIF,DRA,VRA>
[ 1.000004] Intel 82801FB/FR AC'97 Modem Controller (modem
communications, revision 0x04) at pci0 dev 30 function 3 not configured
[ 1.000004] ichlpcib0 at pci0 dev 31 function 0: Intel 82801FBM
ICH6M LPC Interface Bridge (rev. 0x04)
[ 1.000004] timecounter: Timecounter "ichlpcib0" frequency 3579545
Hz quality 1000
[ 1.006042] ichlpcib0: 24-bit timer
[ 1.006042] tco0 at ichlpcib0: TCO (watchdog) timer configured.
[ 1.006042] tco0: Min/Max interval 1/367 seconds
[ 1.006042] piixide0 at pci0 dev 31 function 1: Intel 82801FB IDE
Controller (ICH6) (rev. 0x04)
[ 1.006042] piixide0: bus-master DMA support present
[ 1.006042] piixide0: primary channel configured to compatibility mode
[ 1.006042] piixide0: primary channel interrupting at irq 14
[ 1.006042] atabus0 at piixide0 channel 0
[ 1.006042] piixide0: secondary channel configured to compatibility mode
[ 1.006042] piixide0: secondary channel interrupting at irq 15
[ 1.006042] atabus1 at piixide0 channel 1
[ 1.006042] ichsmb0 at pci0 dev 31 function 3: Intel 82801FB/FR
SMBus Controller (rev. 0x04)
[ 1.006042] ichsmb0: interrupting at irq 3
[ 1.006042] iic0 at ichsmb0: I2C bus
[ 1.006042] isa0 at ichlpcib0
[ 1.006042] pckbc0 at isa0 port 0x60-0x64
[ 1.006042] pckbd0 at pckbc0 (kbd slot)
[ 1.006042] pckbc0: using irq 1 for kbd slot
[ 1.006042] wskbd0 at pckbd0: console keyboard
[ 1.006042] pms0 at pckbc0 (aux slot)
[ 1.006042] pms0: ALPS PS/2 V2 pointing device
[ 1.006042] pckbc0: using irq 12 for aux slot
[ 1.006042] wsmouse0 at pms0 mux 0
[ 1.006042] attimer0 at isa0 port 0x40-0x43
[ 1.006042] pcppi0 at isa0 port 0x61
[ 1.006042] midi0 at pcppi0: PC speaker
[ 1.006042] sysbeep0 at pcppi0
[ 1.006042] attimer0: attached to pcppi0
[ 1.006042] est0 at cpu0: Enhanced SpeedStep
[ 1.006042] fwohci0: BUS reset
[ 1.006042] fwohci0: node_id=0xc000ffc0, gen=1, CYCLEMASTER mode
[ 1.006042] ieee1394if0: 1 nodes, maxhop <= 0 cable IRM irm(0) (me)
[ 1.006042] ieee1394if0: bus manager 0
[ 1.241923] timecounter: Timecounter "clockinterrupt" frequency 100
Hz quality 0
[ 1.573274] auich0: measured ac97 link rate at 48000 Hz
[ 1.573274] audio0 at auich0: playback, capture, full duplex,
independent
[ 1.573274] audio0: slinear_le:16 2ch 48000Hz, blk 1920 bytes (10ms)
for playback
[ 1.573274] audio0: slinear_le:16 2ch 48000Hz, blk 1920 bytes (10ms)
for recording
[ 1.573274] uhub0 at usb0: NetBSD (0x0000) UHCI root hub (0x0000),
class 9/0, rev 1.00/1.00, addr 1
[ 1.573274] uhub0: 2 ports with 2 removable, self powered
[ 1.573274] uhub1 at usb1: NetBSD (0x0000) UHCI root hub (0x0000),
class 9/0, rev 1.00/1.00, addr 1
[ 1.573274] uhub1: 2 ports with 2 removable, self powered
[ 1.573274] uhub2 at usb2: NetBSD (0x0000) UHCI root hub (0x0000),
class 9/0, rev 1.00/1.00, addr 1
[ 1.573274] uhub2: 2 ports with 2 removable, self powered
[ 1.573274] uhub3 at usb3: NetBSD (0x0000) UHCI root hub (0x0000),
class 9/0, rev 1.00/1.00, addr 1
[ 1.573274] uhub3: 2 ports with 2 removable, self powered
[ 1.573274] uhub4 at usb4: NetBSD (0x0000) EHCI root hub (0x0000),
class 9/0, rev 2.00/1.00, addr 1
[ 1.583299] uhub4: 8 ports with 8 removable, self powered
[ 1.583299] IPsec: Initialized Security Association Processing.
[ 1.593275] atapibus0 at atabus0: 2 targets
[ 1.683275] cd0 at atapibus0 drive 1: <TSSTcorpCD/DVDW TS-L632B,
95WK401090, TI33> cdrom removable
[ 1.683275] cd0: 32-bit data port
[ 1.683275] cd0: drive supports PIO mode 4, DMA mode 2, Ultra-DMA
mode 2 (Ultra/33)
[ 1.693276] wd0 at atabus0 drive 0
[ 1.693276] wd0: <IC25N080ATMR04-0>
[ 1.693276] wd0: drive supports 16-sector PIO transfers, LBA48
addressing
[ 1.693276] wd0: 76319 MB, 155061 cyl, 16 head, 63 sec, 512
bytes/sect x 156301488 sectors
[ 2.103282] wd0: 32-bit data port
[ 2.103282] wd0: drive supports PIO mode 4, DMA mode 2, Ultra-DMA
mode 5 (Ultra/100)
[ 2.103282] wd0(piixide0:0:0): using PIO mode 4, Ultra-DMA mode 5
(Ultra/100) (using DMA)
[ 2.103282] cd0(piixide0:0:1): using PIO mode 4, Ultra-DMA mode 2
(Ultra/33) (using DMA)
[ 2.103282] swwdog0: software watchdog initialized
[ 2.143282] WARNING: 2 errors while detecting hardware; check system
log.
[ 2.143282] boot device: wd0
[ 2.143282] root on wd0a dumps on wd0b
[ 2.183283] root file system type: ffs
[ 2.183283] kern.module.path=/stand/i386/10.0/modules
[ 2.193289] [drm] Supports vblank timestamp caching Rev 2 (21.10.2013).
[ 2.193289] [drm] Driver supports precise vblank timestamp query.
[ 2.193289] i915drmkms0: interrupting at irq 11 (i915drmkms0)
[ 2.213284] [drm] Initialized overlay support.
[ 2.213284] [drm] Initialized i915 1.6.0 20200114 for i915drmkms0 on
minor 0
[ 2.363286] intelfb0 at i915drmkms0
[ 2.363286] [drm] DRM_I915_DEBUG enabled
[ 2.363286] [drm] DRM_I915_DEBUG_GEM enabled
[ 2.363286] intelfb0: framebuffer at 0xa0009000, size 1280x800,
depth 32, stride 5120
[ 2.943296] wsdisplay0 at intelfb0 kbdmux 1: console (default, vt100
emulation), using wskbd0
[ 2.957024] wsmux1: connecting to wsdisplay0
[ 17.173515] wsdisplay0: screen 1 added (default, vt100 emulation)
[ 17.173515] wsdisplay0: screen 2 added (default, vt100 emulation)
[ 17.173515] wsdisplay0: screen 3 added (default, vt100 emulation)
[ 17.173515] wsdisplay0: screen 4 added (default, vt100 emulation)
[ 60.224927] bus_dmamem_kmap: t=0xc147d8c0 segs=0xc5c6ba34 nsegs=1
size=0x4000 kvap=0xdcbeead0 flags=0x4
[ 60.224927] bus_dmamem_kmap: va=db5b4000
[ 60.224927] bus_dmamem_kmap:70 size=0x0 curseg=0 addr=0x4b2b8000
len=0x4000 end=0x4b2bc000
[ 60.224927] bus_dmamem_kmap:78: size=0x0 addr=0x4b2b8000panic:
_bus_dmamem_kmap: size botch
[ 60.224927] cpu0: Begin traceback...
[ 60.224927]
vpanic(c12146cd,dcbeea90,dcbeeae4,c06cff50,c12146cd,c10867c0,4e,0,4b2b8000,4b2b8000)
at netbsd:vpanic+0x196
[ 60.224927]
panic(c12146cd,c10867c0,4e,0,4b2b8000,4b2b8000,4000,4b2bc000,c5c6ba5c,0)
at netbsd:panic+0x18
[ 60.224927]
i915_gem_object_get_pages_phys(c5c6b900,1,2,c4353004,c4348804,c434a084,c4353000,c521cc44,c48ac404,1)
at netbsd:i915_gem_object_get_pages_phys+0x5d0
[ 60.234933]
i915_gem_object_attach_phys(c5c6b900,1000,c0af8784,c3dfd004,c5c6b900,c5c6ba18,dcbeeb6c,c0673d15,c5c6ba18,1)
at netbsd:i915_gem_object_attach_phys+0xb4
[ 60.234933]
intel_plane_pin_fb(c5c6ba18,1,2,c0b2f988,c4352010,c4353000,c3dfd004,c5bb5804,c4352004,c5bb5804)
at netbsd:intel_plane_pin_fb+0x62
[ 60.234933]
intel_prepare_plane_fb(c434a084,c521cc44,c3dff878,10001,c5bb5804,c4353004,c3dff878,dcbeebb8,c066abaf,c3dfd004)
at netbsd:intel_prepare_plane_fb+0xcf
[ 60.234933]
drm_atomic_helper_prepare_planes(c3dfd004,c5bb5804,1,c5bb5d64,0,c5bb5804,c3dfd004,c521cc44,dcbeebd4,c0af8b85)
at netbsd:drm_atomic_helper_prepare_planes+0x7a
[ 60.234933]
intel_atomic_commit(c3dfd004,c5bb5804,0,c434a084,c5bb5804,dcbeebfc,c0afdf50,c5bb5804,c48ac404,40)
at netbsd:intel_atomic_commit+0x9c
[ 60.234933]
drm_atomic_commit(c5bb5804,c48ac404,40,0,400000,c434a084,c48ac404,18f,dcbeec64,c0b2b474)
at netbsd:drm_atomic_commit+0x52
[ 60.244929]
drm_atomic_helper_update_plane(c434a084,c4348804,c48ac404,27f,18f,40,40,0,0,400000)
at netbsd:drm_atomic_helper_update_plane+0xd9
[ 60.244929]
__setplane_atomic(27f,18f,40,40,0,0,400000,400000,dcbeecb8,400000) at
netbsd:__setplane_atomic+0x10b
[ 60.244929]
drm_mode_cursor_common(3,2c,27f,18f,40,40,b,0,0,dcbeee54) at
netbsd:drm_mode_cursor_common+0x261
[ 60.244929]
drm_mode_cursor_ioctl(c3dfd004,dcbeeeac,c4e67a04,dcbeedc4,1c,dcbeeeac,63,dcbeedc4,c3dfd360,c4e67a04)
at netbsd:drm_mode_cursor_ioctl+0x4e
[ 60.244929]
drm_ioctl(c5bcc8c0,c01c64a3,dcbeeeac,dcbeef38,c0cc9947,c5bcc8c0,c01c64a3,dcbeeeac,c0c45497,c429dd24)
at netbsd:drm_ioctl+0x42d
[ 60.254928]
drm_ioctl_shim(c5bcc8c0,c01c64a3,dcbeeeac,c0c45497,c429dd24,dcbeef10,0,c5c26078,c5bcc8c0,0)
at netbsd:drm_ioctl_shim+0x43
[ 60.254928]
sys_ioctl(c4361940,dcbeef68,dcbeef60,c51a1500,0,36,dcbeef60,dcbeef68,0,0)
at netbsd:sys_ioctl+0x35b
[ 60.254928] syscall() at netbsd:syscall+0x1d6
[ 60.254928] --- syscall (number 54) ---
[ 60.254928] b1833dc7:
[ 60.254928] cpu0: End traceback...
[ 60.254928] dumping to dev 0,1 offset 1023
[ 60.254928] dump
netbsd-compal#
netbsd-compal# gdb /usr/src/sys/arch/i386/compile/MYKERNEL/netbsd.gdb
GNU gdb (GDB) 11.0.50.20200914-git
Copyright (C) 2020 Free Software Foundation, Inc.
License GPLv3+: GNU GPL version 3 or later
<http://gnu.org/licenses/gpl.html>
This is free software: you are free to change and redistribute it.
There is NO WARRANTY, to the extent permitted by law.
Type "show copying" and "show warranty" for details.
This GDB was configured as "i486--netbsdelf".
Type "show configuration" for configuration details.
For bug reporting instructions, please see:
<https://www.gnu.org/software/gdb/bugs/>.
Find the GDB manual and other documentation resources online at:
<http://www.gnu.org/software/gdb/documentation/>.
For help, type "help".
Type "apropos word" to search for commands related to "word"...
Reading symbols from /usr/src/sys/arch/i386/compile/MYKERNEL/netbsd.gdb...
(gdb) target kvm /var/crash/netbsd.10.core
0xc012d6ed in maybe_dump (howto=260) at
../../../../arch/i386/i386/machdep.c:725
725 dumpsys();
(gdb) frame 0
#0 0xc012d6ed in maybe_dump (howto=260) at
../../../../arch/i386/i386/machdep.c:725
725 dumpsys();
(gdb) print *obj
No symbol "obj" in current context.
(gdb) info locals
s = 0
s = <optimized out>
(gdb) frame 1
#1 cpu_reboot (howto=howto@entry=260, bootstr=bootstr@entry=0x0)
at ../../../../arch/i386/i386/machdep.c:746
746 maybe_dump(howto);
(gdb) print *obj
No symbol "obj" in current context.
(gdb) info locals
syncdone = false
s = 0
(gdb) frame 2
#2 0xc0c85eb7 in kern_reboot (howto=howto@entry=260,
bootstr=bootstr@entry=0x0)
at ../../../../kern/kern_reboot.c:73
73 cpu_reboot(howto, bootstr);
(gdb) print *obj
No symbol "obj" in current context.
(gdb) info locals
rebooter = 0xc4361940
l = 0x0
(gdb) frame 3
#3 0xc0cbca78 in vpanic (fmt=fmt@entry=0xc12146cd "_bus_dmamem_kmap:
size botch",
ap=0xdcbeea90 "\300g\b\301N") at ../../../../kern/subr_prf.c:291
291 kern_reboot(bootopt, NULL);
(gdb) print *obj
No symbol "obj" in current context.
(gdb) info locals
cii = <optimized out>
ci = <optimized out>
oci = <optimized out>
bootopt = 260
scratchstr = "_bus_dmamem_kmap: size botch", '\000' <repeats 355 times>
(gdb) frame 4
#4 0xc0cbcb31 in panic (fmt=fmt@entry=0xc12146cd "_bus_dmamem_kmap:
size botch")
at ../../../../kern/subr_prf.c:208
208 vpanic(fmt, ap);
(gdb) print *obj
No symbol "obj" in current context.
(gdb) info locals
ap = 0xdcbeea90 "\300g\b\301N"
(gdb) frame 5
#5 0xc06cff50 in bus_dmamem_kmap (nsegs=1, flags=4, kvap=0xdcbeead0,
size=0, segs=0xc5c6ba34,
t=0xc147d8c0 <pci_bus_dma_tag>)
at ../../../../external/bsd/drm2/dist/drm/i915/gem/i915_gem_phys.c:80
80 panic("_bus_dmamem_kmap: size botch");
(gdb) print *obj
No symbol "obj" in current context.
(gdb) info locals
kmflags = 0
pmapflags = 19
va = 3680190464
addr = 1261142016
curseg = 0
va = <optimized out>
addr = <optimized out>
curseg = <optimized out>
kmflags = <optimized out>
pmapflags = <optimized out>
__func__ = "bus_dmamem_kmap"
(gdb) print segs[0]
$1 = {ds_addr = 1261142016, ds_len = 16384}
(gdb) frame 6
#6 i915_gem_object_get_pages_phys (obj=0xc5c6b900)
at ../../../../external/bsd/drm2/dist/drm/i915/gem/i915_gem_phys.c:160
160 ret = -bus_dmamem_kmap(dmat, &obj->mm.u.phys.seg, 1,
(gdb) print *obj
$2 = {base = {refcount = {kr_count = 3}, handle_count = 1, dev =
0xc3dfd004, filp = 0xc5c72b80,
gemo_uvmobj = {vmobjlock = 0xc5cb4900, pgops = 0xc1086780
<i915_gem_uvm_ops>, uo_npages = 0,
uo_refs = 1, uo_pages = {t_root = 0x0, t_height = 0}, uo_ubc =
{lh_first = 0x0}}, vma_node = {
von_lock = {rw_owner = 0}, von_startpage = 0, von_npages = 0,
von_files = {
rbt_root = 0xc519c8e4, rbt_ops = 0xc11480ec
<drm_vma_file_rb_ops>, rbt_minmax = {0xc519c8e4,
0xc519c8e4}}, von_rb_node = {rb_nodes = {0x0, 0x0}, rb_info =
0}, readonly = false},
size = 16384, name = 0, dma_buf = 0x0, import_attach = 0x0, resv =
0xc5c6b96c, _resv = {lock = {
wwm_state = 0 '\000', wwm_debug = false, wwm_u = {owner = 0x0,
ctx = 0x0}, wwm_lock = {u = {
mtxa_owner = 1537, s = {mtxs_dummy = 1 '\001', mtxs_ipl =
{_ipl = 6 '\006'},
mtxs_lock = 0 '\000', mtxs_unused = 0 '\000'}}},
wwm_class = 0xc14d1cc0 <linux_reservation_ww_class>,
wwm_waiters = {rbt_root = 0x0,
rbt_ops = 0xc117b290 <ww_acquire_ctx_rb_ops>, rbt_minmax =
{0x0, 0x0}}, wwm_cv = {
cv_opaque = {0x0, 0xc1276994}}}, seq = {sqc_gen = 0},
fence_excl = 0x0, fence = 0x0,
robj_prealloc = 0x0}, funcs = 0x0}, ops = 0xc10867e0
<i915_gem_phys_ops>, vma = {lock = {
sl_lock = {u = {mtxa_owner = 1537, s = {mtxs_dummy = 1 '\001',
mtxs_ipl = {_ipl = 6 '\006'},
mtxs_lock = 0 '\000', mtxs_unused = 0 '\000'}}}}, list =
{prev = 0xc4355f80,
next = 0xc4355f80}, tree = {rbr_tree = {rbt_root = 0xc4355f88,
rbt_ops = 0xc10903fc <vma_tree_rb_ops>, rbt_minmax =
{0xc4355f88, 0xc4355f88}}}}, lut_list = {
prev = 0xc5c6b9c8, next = 0xc5c6b9c8}, stolen = 0x0, {rcu = {rcuh_u
= {callback = 0x0, obj = 0x0},
rcuh_next = 0x0}, freed = {next = 0x0}}, userfault_count = 0,
userfault_link = {prev = 0x2,
next = 0x1}, mmo = {lock = {sl_lock = {u = {mtxa_owner = 1537, s =
{mtxs_dummy = 1 '\001',
mtxs_ipl = {_ipl = 6 '\006'}, mtxs_lock = 0 '\000',
mtxs_unused = 0 '\000'}}}}, offsets = {
0xc5c26044, 0x0, 0x0, 0x0}}, flags = 0, cache_level = 0,
cache_coherent = 0, cache_dirty = 0,
read_domains = 64, write_domain = 64, frontbuffer = 0xc5c26e44,
tiling_and_stride = 0, bind_count = {
a_u = {au_int = 0, au_uint = 0}}, mm = {lock = {mtx_lock = {u =
{mtxa_owner = 3291879744, s = {
--Type <RET> for more, q to quit, c to continue without paging--
mtxs_dummy = 64 '@', mtxs_ipl = {_ipl = 25 '\031'},
mtxs_lock = 54 '6',
mtxs_unused = 196 '\304'}}}}, pages_pin_count = {a_u =
{au_int = 1, au_uint = 1}},
shrink_pin = {a_u = {au_int = 1, au_uint = 1}}, region =
0xc4290f04, blocks = {prev = 0xc5c6ba24,
next = 0xc5c6ba24}, region_link = {prev = 0xc4290fe0, next =
0xc5c6b86c}, u = {internal = {
segs = 0x4b2b8000, nsegs = 16384, rsegs = 0}, phys = {seg =
{ds_addr = 1261142016,
ds_len = 16384}, kva = 0x0}}, pages = 0x0, mapping = 0x0,
page_sizes = {phys = 0, sg = 0,
gtt = 0}, get_page = {sg_pos = 0x0, sg_idx = 0, radix = {rtr_tree
= {t_root = 0x0,
t_height = 0}, rtr_lock = 0 '\000'}, lock = {mtx_lock = {u =
{mtxa_owner = 0, s = {
mtxs_dummy = 0 '\000', mtxs_ipl = {_ipl = 0 '\000'},
mtxs_lock = 0 '\000',
mtxs_unused = 0 '\000'}}}}}, link = {prev = 0xc5c6ba6c,
next = 0xc5c6ba6c}, madv = 0,
dirty = true, quirked = false}, bit_17 = 0x0, {userptr = {ptr = 0,
mm = 0x0, mmu_object = 0x0,
work = 0x0}, scratch = 0, gvt_info = 0x0}}
(gdb) info locals
mapping = 0xc5c72b80
sg = <optimized out>
st = <optimized out>
dma = <optimized out>
vaddr = 0xdb5b4000
dst = <optimized out>
i = <optimized out>
dmat = 0xc147d8c0 <pci_bus_dma_tag>
loaded = false
rsegs = 1
ret = <optimized out>
(gdb) frame 7
#7 0xc06d006d in i915_gem_object_attach_phys (obj=0xc5c6b900, align=4096)
at ../../../../external/bsd/drm2/dist/drm/i915/gem/i915_gem_phys.c:392
392 err = ____i915_gem_object_get_pages(obj);
(gdb) print *obj
$3 = {base = {refcount = {kr_count = 3}, handle_count = 1, dev =
0xc3dfd004, filp = 0xc5c72b80,
gemo_uvmobj = {vmobjlock = 0xc5cb4900, pgops = 0xc1086780
<i915_gem_uvm_ops>, uo_npages = 0,
uo_refs = 1, uo_pages = {t_root = 0x0, t_height = 0}, uo_ubc =
{lh_first = 0x0}}, vma_node = {
von_lock = {rw_owner = 0}, von_startpage = 0, von_npages = 0,
von_files = {
rbt_root = 0xc519c8e4, rbt_ops = 0xc11480ec
<drm_vma_file_rb_ops>, rbt_minmax = {0xc519c8e4,
0xc519c8e4}}, von_rb_node = {rb_nodes = {0x0, 0x0}, rb_info =
0}, readonly = false},
size = 16384, name = 0, dma_buf = 0x0, import_attach = 0x0, resv =
0xc5c6b96c, _resv = {lock = {
wwm_state = 0 '\000', wwm_debug = false, wwm_u = {owner = 0x0,
ctx = 0x0}, wwm_lock = {u = {
mtxa_owner = 1537, s = {mtxs_dummy = 1 '\001', mtxs_ipl =
{_ipl = 6 '\006'},
mtxs_lock = 0 '\000', mtxs_unused = 0 '\000'}}},
wwm_class = 0xc14d1cc0 <linux_reservation_ww_class>,
wwm_waiters = {rbt_root = 0x0,
rbt_ops = 0xc117b290 <ww_acquire_ctx_rb_ops>, rbt_minmax =
{0x0, 0x0}}, wwm_cv = {
cv_opaque = {0x0, 0xc1276994}}}, seq = {sqc_gen = 0},
fence_excl = 0x0, fence = 0x0,
robj_prealloc = 0x0}, funcs = 0x0}, ops = 0xc10867e0
<i915_gem_phys_ops>, vma = {lock = {
sl_lock = {u = {mtxa_owner = 1537, s = {mtxs_dummy = 1 '\001',
mtxs_ipl = {_ipl = 6 '\006'},
mtxs_lock = 0 '\000', mtxs_unused = 0 '\000'}}}}, list =
{prev = 0xc4355f80,
next = 0xc4355f80}, tree = {rbr_tree = {rbt_root = 0xc4355f88,
rbt_ops = 0xc10903fc <vma_tree_rb_ops>, rbt_minmax =
{0xc4355f88, 0xc4355f88}}}}, lut_list = {
prev = 0xc5c6b9c8, next = 0xc5c6b9c8}, stolen = 0x0, {rcu = {rcuh_u
= {callback = 0x0, obj = 0x0},
rcuh_next = 0x0}, freed = {next = 0x0}}, userfault_count = 0,
userfault_link = {prev = 0x2,
next = 0x1}, mmo = {lock = {sl_lock = {u = {mtxa_owner = 1537, s =
{mtxs_dummy = 1 '\001',
mtxs_ipl = {_ipl = 6 '\006'}, mtxs_lock = 0 '\000',
mtxs_unused = 0 '\000'}}}}, offsets = {
0xc5c26044, 0x0, 0x0, 0x0}}, flags = 0, cache_level = 0,
cache_coherent = 0, cache_dirty = 0,
read_domains = 64, write_domain = 64, frontbuffer = 0xc5c26e44,
tiling_and_stride = 0, bind_count = {
a_u = {au_int = 0, au_uint = 0}}, mm = {lock = {mtx_lock = {u =
{mtxa_owner = 3291879744, s = {
--Type <RET> for more, q to quit, c to continue without paging--
mtxs_dummy = 64 '@', mtxs_ipl = {_ipl = 25 '\031'},
mtxs_lock = 54 '6',
mtxs_unused = 196 '\304'}}}}, pages_pin_count = {a_u =
{au_int = 1, au_uint = 1}},
shrink_pin = {a_u = {au_int = 1, au_uint = 1}}, region =
0xc4290f04, blocks = {prev = 0xc5c6ba24,
next = 0xc5c6ba24}, region_link = {prev = 0xc4290fe0, next =
0xc5c6b86c}, u = {internal = {
segs = 0x4b2b8000, nsegs = 16384, rsegs = 0}, phys = {seg =
{ds_addr = 1261142016,
ds_len = 16384}, kva = 0x0}}, pages = 0x0, mapping = 0x0,
page_sizes = {phys = 0, sg = 0,
gtt = 0}, get_page = {sg_pos = 0x0, sg_idx = 0, radix = {rtr_tree
= {t_root = 0x0,
t_height = 0}, rtr_lock = 0 '\000'}, lock = {mtx_lock = {u =
{mtxa_owner = 0, s = {
mtxs_dummy = 0 '\000', mtxs_ipl = {_ipl = 0 '\000'},
mtxs_lock = 0 '\000',
mtxs_unused = 0 '\000'}}}}}, link = {prev = 0xc5c6ba6c,
next = 0xc5c6ba6c}, madv = 0,
dirty = true, quirked = false}, bit_17 = 0x0, {userptr = {ptr = 0,
mm = 0x0, mmu_object = 0x0,
work = 0x0}, scratch = 0, gvt_info = 0x0}}
(gdb) info locals
pages = 0xc5c6e524
err = <optimized out>
(gdb) frame 8
#8 0xc06653cb in intel_plane_pin_fb
(plane_state=plane_state@entry=0xc521cc44)
at
../../../../external/bsd/drm2/dist/drm/i915/display/intel_display.c:15729
15729 err = i915_gem_object_attach_phys(obj, align);
(gdb) print *obj
value has been optimized out
(gdb) info locals
obj = <optimized out>
align = <optimized out>
err = <optimized out>
plane = <optimized out>
dev_priv = <optimized out>
fb = 0xc48ac404
vma = <optimized out>
(gdb) frame 9
#9 0xc0673d15 in intel_prepare_plane_fb (plane=0xc434a084,
_new_plane_state=0xc521cc44)
at
../../../../external/bsd/drm2/dist/drm/i915/display/intel_display.c:15832
15832 ret = intel_plane_pin_fb(new_plane_state);
(gdb) print *obj
$4 = {base = {refcount = {kr_count = 3}, handle_count = 1, dev =
0xc3dfd004, filp = 0xc5c72b80,
gemo_uvmobj = {vmobjlock = 0xc5cb4900, pgops = 0xc1086780
<i915_gem_uvm_ops>, uo_npages = 0,
uo_refs = 1, uo_pages = {t_root = 0x0, t_height = 0}, uo_ubc =
{lh_first = 0x0}}, vma_node = {
von_lock = {rw_owner = 0}, von_startpage = 0, von_npages = 0,
von_files = {
rbt_root = 0xc519c8e4, rbt_ops = 0xc11480ec
<drm_vma_file_rb_ops>, rbt_minmax = {0xc519c8e4,
0xc519c8e4}}, von_rb_node = {rb_nodes = {0x0, 0x0}, rb_info =
0}, readonly = false},
size = 16384, name = 0, dma_buf = 0x0, import_attach = 0x0, resv =
0xc5c6b96c, _resv = {lock = {
wwm_state = 0 '\000', wwm_debug = false, wwm_u = {owner = 0x0,
ctx = 0x0}, wwm_lock = {u = {
mtxa_owner = 1537, s = {mtxs_dummy = 1 '\001', mtxs_ipl =
{_ipl = 6 '\006'},
mtxs_lock = 0 '\000', mtxs_unused = 0 '\000'}}},
wwm_class = 0xc14d1cc0 <linux_reservation_ww_class>,
wwm_waiters = {rbt_root = 0x0,
rbt_ops = 0xc117b290 <ww_acquire_ctx_rb_ops>, rbt_minmax =
{0x0, 0x0}}, wwm_cv = {
cv_opaque = {0x0, 0xc1276994}}}, seq = {sqc_gen = 0},
fence_excl = 0x0, fence = 0x0,
robj_prealloc = 0x0}, funcs = 0x0}, ops = 0xc10867e0
<i915_gem_phys_ops>, vma = {lock = {
sl_lock = {u = {mtxa_owner = 1537, s = {mtxs_dummy = 1 '\001',
mtxs_ipl = {_ipl = 6 '\006'},
mtxs_lock = 0 '\000', mtxs_unused = 0 '\000'}}}}, list =
{prev = 0xc4355f80,
next = 0xc4355f80}, tree = {rbr_tree = {rbt_root = 0xc4355f88,
rbt_ops = 0xc10903fc <vma_tree_rb_ops>, rbt_minmax =
{0xc4355f88, 0xc4355f88}}}}, lut_list = {
prev = 0xc5c6b9c8, next = 0xc5c6b9c8}, stolen = 0x0, {rcu = {rcuh_u
= {callback = 0x0, obj = 0x0},
rcuh_next = 0x0}, freed = {next = 0x0}}, userfault_count = 0,
userfault_link = {prev = 0x2,
next = 0x1}, mmo = {lock = {sl_lock = {u = {mtxa_owner = 1537, s =
{mtxs_dummy = 1 '\001',
mtxs_ipl = {_ipl = 6 '\006'}, mtxs_lock = 0 '\000',
mtxs_unused = 0 '\000'}}}}, offsets = {
0xc5c26044, 0x0, 0x0, 0x0}}, flags = 0, cache_level = 0,
cache_coherent = 0, cache_dirty = 0,
read_domains = 64, write_domain = 64, frontbuffer = 0xc5c26e44,
tiling_and_stride = 0, bind_count = {
a_u = {au_int = 0, au_uint = 0}}, mm = {lock = {mtx_lock = {u =
{mtxa_owner = 3291879744, s = {
--Type <RET> for more, q to quit, c to continue without paging--
mtxs_dummy = 64 '@', mtxs_ipl = {_ipl = 25 '\031'},
mtxs_lock = 54 '6',
mtxs_unused = 196 '\304'}}}}, pages_pin_count = {a_u =
{au_int = 1, au_uint = 1}},
shrink_pin = {a_u = {au_int = 1, au_uint = 1}}, region =
0xc4290f04, blocks = {prev = 0xc5c6ba24,
next = 0xc5c6ba24}, region_link = {prev = 0xc4290fe0, next =
0xc5c6b86c}, u = {internal = {
segs = 0x4b2b8000, nsegs = 16384, rsegs = 0}, phys = {seg =
{ds_addr = 1261142016,
ds_len = 16384}, kva = 0x0}}, pages = 0x0, mapping = 0x0,
page_sizes = {phys = 0, sg = 0,
gtt = 0}, get_page = {sg_pos = 0x0, sg_idx = 0, radix = {rtr_tree
= {t_root = 0x0,
t_height = 0}, rtr_lock = 0 '\000'}, lock = {mtx_lock = {u =
{mtxa_owner = 0, s = {
mtxs_dummy = 0 '\000', mtxs_ipl = {_ipl = 0 '\000'},
mtxs_lock = 0 '\000',
mtxs_unused = 0 '\000'}}}}}, link = {prev = 0xc5c6ba6c,
next = 0xc5c6ba6c}, madv = 0,
dirty = true, quirked = false}, bit_17 = 0x0, {userptr = {ptr = 0,
mm = 0x0, mmu_object = 0x0,
work = 0x0}, scratch = 0, gvt_info = 0x0}}
(gdb) info locals
new_plane_state = 0xc521cc44
intel_state = 0xc5bb5804
dev_priv = 0xc3dfd004
fb = <optimized out>
obj = 0xc5c6b900
old_obj = <optimized out>
ret = <optimized out>
(gdb) frame 10
#10 0xc0afce78 in drm_atomic_helper_prepare_planes (dev=<optimized out>,
state=<optimized out>)
at ../../../../external/bsd/drm2/dist/drm/drm_atomic_helper.c:2399
2399 ret = funcs->prepare_fb(plane, new_plane_state);
(gdb) print *obj
No symbol "obj" in current context.
(gdb) info locals
funcs = <optimized out>
connector = <optimized out>
new_plane_state = <optimized out>
ret = <optimized out>
i = 3
new_conn_state = <optimized out>
plane = <optimized out>
j = <optimized out>
connector = <optimized out>
new_conn_state = <optimized out>
plane = <optimized out>
new_plane_state = <optimized out>
ret = <optimized out>
i = <optimized out>
j = <optimized out>
fail = <optimized out>
funcs = <optimized out>
funcs = <optimized out>
(gdb) frame 11
#11 drm_atomic_helper_prepare_planes (dev=0xc3dfd004,
state=state@entry=0xc5bb5804)
at ../../../../external/bsd/drm2/dist/drm/drm_atomic_helper.c:2375
2375 int drm_atomic_helper_prepare_planes(struct drm_device *dev,
(gdb) print *obj
No symbol "obj" in current context.
(gdb) info locals
connector = <optimized out>
new_conn_state = <optimized out>
plane = <optimized out>
new_plane_state = <optimized out>
ret = <optimized out>
i = <optimized out>
j = <optimized out>
fail = <optimized out>
funcs = <optimized out>
funcs = <optimized out>
(gdb) frame 12
#12 0xc066abaf in intel_atomic_prepare_commit (state=0xc5bb5804)
at
../../../../external/bsd/drm2/dist/drm/i915/display/intel_display.c:14760
14760 return drm_atomic_helper_prepare_planes(state->base.dev,
(gdb) print *obj
No symbol "obj" in current context.
(gdb) info locals
No locals.
(gdb) frame 13
#13 intel_atomic_commit (dev=0xc3dfd004, _state=0xc5bb5804, nonblock=false)
at
../../../../external/bsd/drm2/dist/drm/i915/display/intel_display.c:15595
15595 ret = intel_atomic_prepare_commit(state);
(gdb) print *obj
No symbol "obj" in current context.
(gdb) info locals
state = 0xc5bb5804
dev_priv = 0xc3dfd004
ret = 0
(gdb) frame 14
#14 0xc0af8b85 in drm_atomic_commit (state=state@entry=0xc5bb5804)
at ../../../../external/bsd/drm2/dist/drm/drm_atomic.c:1238
1238 return config->funcs->atomic_commit(state->dev, state, false);
(gdb) print *obj
No symbol "obj" in current context.
(gdb) info locals
config = 0xc3dfd0c8
ret = <optimized out>
(gdb) frame 15
#15 0xc0afdf50 in drm_atomic_helper_update_plane (plane=0xc434a084,
crtc=0xc4348804, fb=0xc48ac404,
crtc_x=639, crtc_y=399, crtc_w=64, crtc_h=64, src_x=0, src_y=0,
src_w=4194304, src_h=4194304,
ctx=0xdcbeecb8) at
../../../../external/bsd/drm2/dist/drm/drm_atomic_helper.c:2910
2910 ret = drm_atomic_commit(state);
(gdb) print *obj
No symbol "obj" in current context.
(gdb) info locals
state = 0xc5bb5804
plane_state = 0xc521cc44
ret = 0
(gdb) frame 16
#16 0xc0b2b474 in __setplane_atomic (plane=plane@entry=0xc434a084,
crtc=crtc@entry=0xc4348804,
fb=fb@entry=0xc48ac404, crtc_x=crtc_x@entry=639,
crtc_y=crtc_y@entry=399, crtc_w=64, crtc_h=64,
src_x=src_x@entry=0, src_y=src_y@entry=0,
src_w=src_w@entry=4194304, src_h=src_h@entry=4194304,
ctx=ctx@entry=0xdcbeecb8) at
../../../../external/bsd/drm2/dist/drm/drm_plane.c:761
761 return plane->funcs->update_plane(plane, crtc, fb,
(gdb) print *obj
No symbol "obj" in current context.
(gdb) info locals
ret = <optimized out>
(gdb) frame 17
#17 0xc0b2b8ad in drm_mode_cursor_universal (ctx=0xdcbeecb8,
file_priv=0xc4e67a04, req=0xdcbeed64,
crtc=0xc4348804) at
../../../../external/bsd/drm2/dist/drm/drm_plane.c:914
914 ret = __setplane_atomic(plane, crtc, fb,
(gdb) print *obj
No symbol "obj" in current context.
(gdb) info locals
plane = 0xc434a084
fbreq = {fb_id = 0, width = 64, height = 64, pixel_format = 875713089,
flags = 0, handles = {11, 0, 0,
0}, pitches = {256, 0, 0, 0}, offsets = {0, 0, 0, 0}, modifier =
{0, 0, 0, 0}}
crtc_x = 639
crtc_y = 399
src_w = 4194304
src_h = 4194304
ret = 0
dev = 0xc3dfd004
fb = 0xc48ac404
crtc_w = <optimized out>
crtc_h = <optimized out>
dev = <optimized out>
plane = <optimized out>
fb = <optimized out>
fbreq = {fb_id = <optimized out>, width = <optimized out>, height =
<optimized out>,
pixel_format = <optimized out>, flags = <optimized out>, handles =
{<optimized out>,
<optimized out>, <optimized out>, <optimized out>}, pitches =
{<optimized out>, <optimized out>,
<optimized out>, <optimized out>}, offsets = {<optimized out>,
<optimized out>, <optimized out>,
<optimized out>}, modifier = {<optimized out>, <optimized out>,
<optimized out>, <optimized out>}}
crtc_x = <optimized out>
crtc_y = <optimized out>
crtc_w = <optimized out>
crtc_h = <optimized out>
src_w = <optimized out>
--Type <RET> for more, q to quit, c to continue without paging--
src_h = <optimized out>
ret = <optimized out>
(gdb) frame 18
#18 drm_mode_cursor_common (dev=dev@entry=0xc3dfd004,
req=req@entry=0xdcbeed64,
file_priv=file_priv@entry=0xc4e67a04) at
../../../../external/bsd/drm2/dist/drm/drm_plane.c:973
973 ret = drm_mode_cursor_universal(crtc, req, file_priv, &ctx);
(gdb) print *obj
No symbol "obj" in current context.
(gdb) info locals
crtc = 0xc4348804
ctx = {ww_ctx = {wwx_class = 0xc14ab70c <crtc_ww_class>, wwx_owner =
0xc4361940, wwx_ticket = 35,
wwx_acquired = 2, wwx_acquire_done = false, wwx_rb_node = {rb_nodes
= {0x0, 0x0}, rb_info = 0}},
contended = 0x0, locked = {prev = 0xc4348840, next = 0xc434a0bc},
trylock_only = false,
interruptible = true}
ret = <optimized out>
(gdb) frame 19
#19 0xc0b2befb in drm_mode_cursor_ioctl (dev=0xc3dfd004,
data=0xdcbeeeac, file_priv=0xc4e67a04)
at ../../../../external/bsd/drm2/dist/drm/drm_plane.c:1023
1023 return drm_mode_cursor_common(dev, &new_req, file_priv);
(gdb) print *obj
No symbol "obj" in current context.
(gdb) info locals
req = 0xdcbeeeac
new_req = {flags = 3, crtc_id = 44, x = 639, y = 399, width = 64, height
= 64, handle = 11, hot_x = 0,
hot_y = 0}
(gdb) frame 20
#20 0xc0b23c8c in drm_ioctl (fp=<optimized out>, cmd=<optimized out>,
data=<optimized out>)
at ../../../../external/bsd/drm2/dist/drm/drm_ioctl.c:968
968 error = -(*ioctl->func)(dev, data0, file);
(gdb) print *obj
No symbol "obj" in current context.
(gdb) info locals
stackbuf =
"B\000\000\000\300\236\303\305P\335)\304\000\200\302\256\000\000\000\000\000\000\000\000\060\001\000\000\000\000\000\000\000`\302\305\000\000\000\000\000\000\000\001\000\000\000\000\003\000\000\000\000\000\000\000\000V\300\305\001\000\000\000$\335)\304\000`\302\256\000\020\000\000$\335)\304~\004\000\000\200|\307\305\000\020\000\000\002\000\000\000\000`\302\256\001\000\000\000\000\000\000\000\001\000\000\001\003",
'\000' <repeats 11 times>, "\001\000\000"
buf = 0xdcbeedc4 "B"
data0 = 0xdcbeeeac
file = <optimized out>
nr = <optimized out>
error = <optimized out>
dev = 0xc3dfd004
ioctl = <optimized out>
is_driver_ioctl = <optimized out>
(gdb) frame 21
#21 0xc0af1e66 in drm_ioctl_shim (fp=0xc5bcc8c0, cmd=3223086243,
data=0xdcbeeeac)
at ../../../../external/bsd/drm2/drm/drm_cdevsw.c:393
393 error = drm_ioctl(fp, cmd, data);
(gdb) print *obj
No symbol "obj" in current context.
(gdb) info locals
file = <optimized out>
driver = <optimized out>
error = <optimized out>
(gdb) frame 22
#22 0xc0cc9947 in sys_ioctl (l=<optimized out>, uap=<optimized out>,
retval=<optimized out>)
at ../../../../kern/sys_generic.c:675
675 error = (*fp->f_ops->fo_ioctl)(fp, com, data);
(gdb) print *obj
No symbol "obj" in current context.
(gdb) info locals
fp = <optimized out>
p = <optimized out>
com = <optimized out>
error = <optimized out>
size = <optimized out>
alloc_size = <optimized out>
data = 0xdcbeeeac
memp = 0x0
stkbuf = {3, 44, 639, 399, 64, 64, 11, 262, 3291879744, 2, 3703500700,
3222468089, 3291077924,
2931974144, 2, 0, 0, 1, 3, 1, 3317850232, 3291077924, 0, 2931974144,
2931974144, 3291077924, 0,
3291057344, 3703492608, 3703500712, 0, 0}
(gdb) frame 23
#23 0xc049b4c6 in sy_call (rval=0xdcbeef60, uap=0xdcbeef68,
l=0xc4361940, sy=0xc14ae998 <sysent+1080>)
at ../../../../sys/syscallvar.h:65
65 error = (*sy->sy_call)(l, uap, rval);
(gdb) print *obj
No symbol "obj" in current context.
(gdb) info locals
error = <optimized out>
error = <optimized out>
(gdb) frame 24
#24 sy_invoke (code=<optimized out>, rval=0xdcbeef60, uap=0xdcbeef68,
l=0xc4361940,
sy=0xc14ae998 <sysent+1080>) at ../../../../sys/syscallvar.h:94
94 error = sy_call(sy, l, uap, rval);
(gdb) print *obj
No symbol "obj" in current context.
(gdb) info locals
do_trace = <optimized out>
error = <optimized out>
do_trace = <optimized out>
error = <optimized out>
(gdb) frame 25
#25 syscall (frame=0xdcbeefa8) at ../../../../arch/x86/x86/syscall.c:138
138 error = sy_invoke(callp, l, args, rval, code);
(gdb) print *obj
No symbol "obj" in current context.
(gdb) info locals
callp = 0xc14ae998 <sysent+1080>
p = <optimized out>
l = 0xc4361940
error = <optimized out>
code = <optimized out>
rval = {0, 0}
args = {10, -1071881053, -1078913788, -1325424640, 10, 0, 281542656, 0,
-1325424640, -1078913908}
(gdb) frame 26
#26 0xc0102230 in Xsyscall ()
(gdb) print *obj
No symbol "obj" in current context.
(gdb) info locals
No symbol table info available.
(gdb) frame 27
#27 0xdcbeefa8 in ?? ()
(gdb) print *obj
No symbol "obj" in current context.
(gdb) info locals
No symbol table info available.
(gdb) frame 28
No frame at level 28.
(gdb)
From: Taylor R Campbell <riastradh@NetBSD.org>
To: Ramiro Aceves <ea1abz@gmail.com>
Cc: "David H. Gutteridge" <david@gutteridge.ca>,
gnats-bugs@NetBSD.org, netbsd-bugs@NetBSD.org, RVP <rvp@SDF.ORG>
Subject: Re: kern/57833: kernel panic on xorg exit
Date: Thu, 18 Jan 2024 22:24:47 +0000
This is a multi-part message in MIME format.
--=_zuuYtksK0C8RJaF9J8AwVVP/KZSlw/L+
OK, I think I found the problem with my patch: a side effect of
Linux's backwards definition of PAGE_MASK from NetBSD's, causing
round_page(size) to return 0 instead of 0x4000 when size=0x4000.
Try this one?
(Posting this again as one giant diff in .diff, and an incremental
git patch series in .patch, in case that's helpful, whichever is
easier for you to deal with.)
--=_zuuYtksK0C8RJaF9J8AwVVP/KZSlw/L+
Content-Type: text/plain; charset="ISO-8859-1"; name="pr57833-i915gempages-v6"
Content-Transfer-Encoding: quoted-printable
Content-Disposition: attachment; filename="pr57833-i915gempages-v6.diff"
diff --git a/sys/external/bsd/drm2/dist/drm/i915/gem/i915_gem_mman.c b/sys/=
external/bsd/drm2/dist/drm/i915/gem/i915_gem_mman.c
index 8e592f008ef7..d0265738e2c8 100644
--- a/sys/external/bsd/drm2/dist/drm/i915/gem/i915_gem_mman.c
+++ b/sys/external/bsd/drm2/dist/drm/i915/gem/i915_gem_mman.c
@@ -675,7 +675,7 @@ void i915_gem_object_release_mmap_offset(struct drm_i91=
5_gem_object *obj)
=20
if (!i915_gem_object_has_pages(obj))
return;
- for (i =3D 0; i < obj->base.size >> PAGE_SHIFT; i++) {
+ for (i =3D 0; i < obj->mm.pages->sgl->sg_npgs; i++) {
page =3D obj->mm.pages->sgl->sg_pgs[i];
vm_page =3D &page->p_vmp;
pmap_page_protect(vm_page, VM_PROT_NONE);
diff --git a/sys/external/bsd/drm2/dist/drm/i915/gem/i915_gem_pages.c b/sys=
/external/bsd/drm2/dist/drm/i915/gem/i915_gem_pages.c
index 58075877254a..2bc7b11695ec 100644
--- a/sys/external/bsd/drm2/dist/drm/i915/gem/i915_gem_pages.c
+++ b/sys/external/bsd/drm2/dist/drm/i915/gem/i915_gem_pages.c
@@ -42,6 +42,18 @@ void __i915_gem_object_set_pages(struct drm_i915_gem_obj=
ect *obj,
}
=20
#ifndef __NetBSD__
+ /*
+ * Paranoia: In NetBSD, a scatterlist is just an array of
+ * pages, not an array of segments that might be larger than
+ * pages, so the number of entries must exactly match the size
+ * of the object (which should also be page-aligned).
+ *
+ * Both vm_fault_cpu and i915_gem_object_release_mmap_offset in
+ * i915_gem_mman.c rely on this page array as such.
+ */
+ KASSERTMSG(pages->sgl->sg_npgs =3D=3D obj->base.size >> PAGE_SHIFT,
+ "npgs=3D%zu size=3D%zu", pages->sgl->sg_npgs, obj->base.size);
+
obj->mm.get_page.sg_pos =3D pages->sgl;
obj->mm.get_page.sg_idx =3D 0;
#endif
diff --git a/sys/external/bsd/drm2/dist/drm/i915/gem/i915_gem_phys.c b/sys/=
external/bsd/drm2/dist/drm/i915/gem/i915_gem_phys.c
index 3f68276eea5f..257f386695f3 100644
--- a/sys/external/bsd/drm2/dist/drm/i915/gem/i915_gem_phys.c
+++ b/sys/external/bsd/drm2/dist/drm/i915/gem/i915_gem_phys.c
@@ -9,6 +9,90 @@
#include <sys/cdefs.h>
__KERNEL_RCSID(0, "$NetBSD: i915_gem_phys.c,v 1.8 2021/12/19 12:45:43 rias=
tradh Exp $");
=20
+#ifdef __NetBSD__
+/*
+ * Make sure this block comes before any linux includes, so we don't
+ * get mixed up by the PAGE_MASK complementation.
+ */
+
+#include <sys/bus.h>
+
+#include <uvm/uvm.h>
+#include <uvm/uvm_extern.h>
+
+#include <machine/pmap_private.h> /* kvtopte, pmap_pte_clearbits */
+
+/*
+ * Version of bus_dmamem_map that uses pmap_kenter_pa, not pmap_enter,
+ * so that it isn't affected by pmap_page_protect on the physical
+ * address. Adapted from sys/arch/x86/x86/bus_dma.c.
+ */
+static int
+bus_dmamem_kmap(bus_dma_tag_t t, bus_dma_segment_t *segs, int nsegs,
+ size_t size, void **kvap, int flags)
+{
+ vaddr_t va;
+ bus_addr_t addr;
+ int curseg;
+ const uvm_flag_t kmflags =3D
+ (flags & BUS_DMA_NOWAIT) !=3D 0 ? UVM_KMF_NOWAIT : 0;
+ u_int pmapflags =3D PMAP_WIRED | VM_PROT_READ | VM_PROT_WRITE;
+
+ size =3D round_page(size);
+ if (flags & BUS_DMA_NOCACHE)
+ pmapflags |=3D PMAP_NOCACHE;
+
+ va =3D uvm_km_alloc(kernel_map, size, 0, UVM_KMF_VAONLY | kmflags);
+
+ if (va =3D=3D 0)
+ return ENOMEM;
+
+ *kvap =3D (void *)va;
+
+ for (curseg =3D 0; curseg < nsegs; curseg++) {
+ for (addr =3D segs[curseg].ds_addr;
+ addr < (segs[curseg].ds_addr + segs[curseg].ds_len);
+ addr +=3D PAGE_SIZE, va +=3D PAGE_SIZE, size -=3D PAGE_SIZE) {
+ if (size =3D=3D 0)
+ panic("bus_dmamem_kmap: size botch");
+ pmap_kenter_pa(va, addr,
+ VM_PROT_READ | VM_PROT_WRITE,
+ pmapflags);
+ }
+ }
+ pmap_update(pmap_kernel());
+
+ return 0;
+}
+
+static void
+bus_dmamem_kunmap(bus_dma_tag_t t, void *kva, size_t size)
+{
+ pt_entry_t *pte, opte;
+ vaddr_t va, sva, eva;
+
+ KASSERTMSG(((uintptr_t)kva & PGOFSET) =3D=3D 0, "kva=3D%p", kva);
+
+ size =3D round_page(size);
+ sva =3D (vaddr_t)kva;
+ eva =3D sva + size;
+
+ /*
+ * mark pages cacheable again.
+ */
+ for (va =3D sva; va < eva; va +=3D PAGE_SIZE) {
+ pte =3D kvtopte(va);
+ opte =3D *pte;
+ if ((opte & PTE_PCD) !=3D 0)
+ pmap_pte_clearbits(pte, PTE_PCD);
+ }
+ pmap_kremove((vaddr_t)kva, size);
+ pmap_update(pmap_kernel());
+ uvm_km_free(kernel_map, (vaddr_t)kva, size, UVM_KMF_VAONLY);
+}
+
+#endif
+
#include <linux/highmem.h>
#include <linux/shmem_fs.h>
#include <linux/swap.h>
@@ -65,7 +149,7 @@ static int i915_gem_object_get_pages_phys(struct drm_i91=
5_gem_object *obj)
if (ret)
return -ENOMEM;
KASSERT(rsegs =3D=3D 1);
- ret =3D -bus_dmamem_map(dmat, &obj->mm.u.phys.seg, 1,
+ ret =3D -bus_dmamem_kmap(dmat, &obj->mm.u.phys.seg, 1,
roundup_pow_of_two(obj->base.size), &vaddr,
BUS_DMA_WAITOK|BUS_DMA_COHERENT);
if (ret)
@@ -83,7 +167,12 @@ static int i915_gem_object_get_pages_phys(struct drm_i9=
15_gem_object *obj)
if (!st)
goto err_pci;
=20
+#ifdef __NetBSD__
+ if (sg_alloc_table_from_bus_dmamem(st, dmat, &obj->mm.u.phys.seg, 1,
+ GFP_KERNEL))
+#else
if (sg_alloc_table(st, 1, GFP_KERNEL))
+#endif
goto err_st;
=20
sg =3D st->sgl;
@@ -151,7 +240,7 @@ err_st:
err_pci:
#ifdef __NetBSD__
if (vaddr) {
- bus_dmamem_unmap(dmat, vaddr,
+ bus_dmamem_kunmap(dmat, vaddr,
roundup_pow_of_two(obj->base.size));
}
obj->mm.u.phys.kva =3D NULL;
@@ -225,7 +314,7 @@ i915_gem_object_put_pages_phys(struct drm_i915_gem_obje=
ct *obj,
kfree(pages);
=20
#ifdef __NetBSD__
- bus_dmamem_unmap(dmat, obj->mm.u.phys.kva,
+ bus_dmamem_kunmap(dmat, obj->mm.u.phys.kva,
roundup_pow_of_two(obj->base.size));
obj->mm.u.phys.kva =3D NULL;
bus_dmamem_free(dmat, &obj->mm.u.phys.seg, 1);
diff --git a/sys/external/bsd/drm2/dist/drm/i915/gem/i915_gem_region.c b/sy=
s/external/bsd/drm2/dist/drm/i915/gem/i915_gem_region.c
index 1a928988bd5f..72efd363fdc7 100644
--- a/sys/external/bsd/drm2/dist/drm/i915/gem/i915_gem_region.c
+++ b/sys/external/bsd/drm2/dist/drm/i915/gem/i915_gem_region.c
@@ -45,10 +45,12 @@ i915_gem_object_get_pages_buddy(struct drm_i915_gem_obj=
ect *obj)
if (!st)
return -ENOMEM;
=20
+#ifndef __NetBSD__
if (sg_alloc_table(st, size >> ilog2(mem->mm.chunk_size), GFP_KERNEL)) {
kfree(st);
return -ENOMEM;
}
+#endif
=20
flags =3D I915_ALLOC_MIN_PAGE_SIZE;
if (obj->flags & I915_BO_ALLOC_CONTIGUOUS)
@@ -60,15 +62,15 @@ i915_gem_object_get_pages_buddy(struct drm_i915_gem_obj=
ect *obj)
=20
GEM_BUG_ON(list_empty(blocks));
=20
- sg =3D st->sgl;
#ifdef __NetBSD__
__USE(prev_end);
- __USE(sg_page_sizes);
bus_dma_tag_t dmat =3D obj->base.dev->dmat;
bus_dma_segment_t *segs =3D NULL;
int i =3D 0, nsegs =3D 0;
bool loaded =3D false;
=20
+ sg =3D NULL;
+
list_for_each_entry(block, blocks, link) {
if (nsegs >=3D INT_MAX ||
nsegs >=3D SIZE_MAX/sizeof(segs[0]))
@@ -85,7 +87,15 @@ i915_gem_object_get_pages_buddy(struct drm_i915_gem_obje=
ct *obj)
=20
segs[i].ds_addr =3D mem->region.start + offset;
segs[i].ds_len =3D block_size;
+ i++;
}
+ KASSERT(i =3D=3D nsegs);
+
+ ret =3D sg_alloc_table_from_bus_dmamem(st, dmat, segs, nsegs,
+ GFP_KERNEL);
+ if (ret)
+ goto err;
+ sg =3D st->sgl;
=20
/* XXX errno NetBSD->Linux */
ret =3D -bus_dmamap_create(dmat, size, nsegs, size, 0, BUS_DMA_WAITOK,
@@ -106,8 +116,9 @@ i915_gem_object_get_pages_buddy(struct drm_i915_gem_obj=
ect *obj)
kmem_free(segs, nsegs * sizeof(segs[0]));
segs =3D NULL;
=20
- __i915_gem_object_set_pages(obj, st, i915_sg_page_sizes(sg));
+ sg_page_sizes =3D i915_sg_page_sizes(sg);
#else
+ sg =3D st->sgl;
st->nents =3D 0;
sg_page_sizes =3D 0;
prev_end =3D (resource_size_t)-1;
@@ -145,9 +156,9 @@ i915_gem_object_get_pages_buddy(struct drm_i915_gem_obj=
ect *obj)
sg_page_sizes |=3D sg->length;
sg_mark_end(sg);
i915_sg_trim(st);
+#endif
=20
__i915_gem_object_set_pages(obj, st, sg_page_sizes);
-#endif
=20
return 0;
=20
@@ -155,6 +166,8 @@ i915_gem_object_get_pages_buddy(struct drm_i915_gem_obj=
ect *obj)
err:
if (loaded)
bus_dmamap_unload(dmat, st->sgl->sg_dmamap);
+ if (sg && sg->sg_dmamap)
+ bus_dmamap_destroy(dmat, sg->sg_dmamap);
if (segs)
kmem_free(segs, nsegs * sizeof(segs[0]));
__intel_memory_region_put_pages_buddy(mem, blocks);
diff --git a/sys/external/bsd/drm2/dist/drm/i915/gem/i915_gem_stolen.c b/sy=
s/external/bsd/drm2/dist/drm/i915/gem/i915_gem_stolen.c
index b53d543fa894..1635e57befd7 100644
--- a/sys/external/bsd/drm2/dist/drm/i915/gem/i915_gem_stolen.c
+++ b/sys/external/bsd/drm2/dist/drm/i915/gem/i915_gem_stolen.c
@@ -506,14 +506,13 @@ i915_pages_create_for_stolen(struct drm_device *dev,
{
struct drm_i915_private *i915 =3D to_i915(dev);
struct sg_table *st;
+ struct scatterlist *sg;
#ifdef __NetBSD__
bus_dma_tag_t dmat =3D i915->drm.dmat;
bus_dma_segment_t *seg =3D NULL;
int nseg =3D 0, i;
bool loaded =3D false;
int ret;
-#else
- struct scatterlist *sg;
#endif
=20
GEM_BUG_ON(range_overflows(offset, size, resource_size(&i915->dsm)));
@@ -527,11 +526,6 @@ i915_pages_create_for_stolen(struct drm_device *dev,
if (st =3D=3D NULL)
return ERR_PTR(-ENOMEM);
=20
- if (sg_alloc_table(st, 1, GFP_KERNEL)) {
- kfree(st);
- return ERR_PTR(-ENOMEM);
- }
-
#ifdef __NetBSD__
KASSERT((size % PAGE_SIZE) =3D=3D 0);
nseg =3D size / PAGE_SIZE;
@@ -548,19 +542,30 @@ i915_pages_create_for_stolen(struct drm_device *dev,
seg[i].ds_len =3D PAGE_SIZE;
}
=20
+ sg =3D NULL;
+
+ ret =3D sg_alloc_table_from_bus_dmamem(st, dmat, seg, nseg, GFP_KERNEL);
+ if (ret) {
+ DRM_ERROR("failed to alloc sg table for stolen object: %d\n",
+ ret);
+ ret =3D -ENOMEM;
+ goto out;
+ }
+ sg =3D st->sgl;
+
/* XXX errno NetBSD->Linux */
ret =3D -bus_dmamap_create(dmat, size, nseg, PAGE_SIZE, 0,
- BUS_DMA_WAITOK, &st->sgl->sg_dmamap);
+ BUS_DMA_WAITOK, &sg->sg_dmamap);
if (ret) {
DRM_ERROR("failed to create DMA map for stolen object: %d\n",
ret);
- st->sgl->sg_dmamap =3D NULL;
+ sg->sg_dmamap =3D NULL;
goto out;
}
- st->sgl->sg_dmat =3D dmat;
+ sg->sg_dmat =3D dmat;
=20
- /* XXX errno NetBSD->Liux */
- ret =3D -bus_dmamap_load_raw(dmat, st->sgl->sg_dmamap, seg, nseg, size,
+ /* XXX errno NetBSD->Linux */
+ ret =3D -bus_dmamap_load_raw(dmat, sg->sg_dmamap, seg, nseg, size,
BUS_DMA_WAITOK);
if (ret) {
DRM_ERROR("failed to load DMA map for stolen object: %d\n",
@@ -569,14 +574,23 @@ i915_pages_create_for_stolen(struct drm_device *dev,
}
loaded =3D true;
=20
-out: if (ret) {
+out: kmem_free(seg, nseg * sizeof(seg[0]));
+ if (ret) {
if (loaded)
- bus_dmamap_unload(dmat, st->sgl->sg_dmamap);
- sg_free_table(st);
+ bus_dmamap_unload(dmat, sg->sg_dmamap);
+ if (sg && sg->sg_dmamap)
+ bus_dmamap_destroy(dmat, sg->sg_dmamap);
+ if (sg)
+ sg_free_table(st);
kfree(st);
return ERR_PTR(ret);
}
#else
+ if (sg_alloc_table(st, 1, GFP_KERNEL)) {
+ kfree(st);
+ return ERR_PTR(-ENOMEM);
+ }
+
sg =3D st->sgl;
sg->offset =3D 0;
sg->length =3D size;
--=_zuuYtksK0C8RJaF9J8AwVVP/KZSlw/L+
Content-Type: text/plain; charset="ISO-8859-1"; name="pr57833-i915gempages-v6"
Content-Transfer-Encoding: quoted-printable
Content-Disposition: attachment; filename="pr57833-i915gempages-v6.patch"
From 7fb48cd42a6dc1e58f9c6b27c7853d721d9f96da Mon Sep 17 00:00:00 2001
From: Taylor R Campbell <riastradh@NetBSD.org>
Date: Mon, 15 Jan 2024 22:38:08 +0000
Subject: [PATCH 1/8] i915_gem_region: Reduce diff from upstream a little.
No functional change intended.
---
sys/external/bsd/drm2/dist/drm/i915/gem/i915_gem_region.c | 5 ++---
1 file changed, 2 insertions(+), 3 deletions(-)
diff --git a/sys/external/bsd/drm2/dist/drm/i915/gem/i915_gem_region.c b/sy=
s/external/bsd/drm2/dist/drm/i915/gem/i915_gem_region.c
index 1a928988bd5f..e539dc4530dc 100644
--- a/sys/external/bsd/drm2/dist/drm/i915/gem/i915_gem_region.c
+++ b/sys/external/bsd/drm2/dist/drm/i915/gem/i915_gem_region.c
@@ -63,7 +63,6 @@ i915_gem_object_get_pages_buddy(struct drm_i915_gem_objec=
t *obj)
sg =3D st->sgl;
#ifdef __NetBSD__
__USE(prev_end);
- __USE(sg_page_sizes);
bus_dma_tag_t dmat =3D obj->base.dev->dmat;
bus_dma_segment_t *segs =3D NULL;
int i =3D 0, nsegs =3D 0;
@@ -106,7 +105,7 @@ i915_gem_object_get_pages_buddy(struct drm_i915_gem_obj=
ect *obj)
kmem_free(segs, nsegs * sizeof(segs[0]));
segs =3D NULL;
=20
- __i915_gem_object_set_pages(obj, st, i915_sg_page_sizes(sg));
+ sg_page_sizes =3D i915_sg_page_sizes(sg);
#else
st->nents =3D 0;
sg_page_sizes =3D 0;
@@ -145,9 +144,9 @@ i915_gem_object_get_pages_buddy(struct drm_i915_gem_obj=
ect *obj)
sg_page_sizes |=3D sg->length;
sg_mark_end(sg);
i915_sg_trim(st);
+#endif
=20
__i915_gem_object_set_pages(obj, st, sg_page_sizes);
-#endif
=20
return 0;
=20
From 97510e276148cfc6f223b397704b3d81905f8eb0 Mon Sep 17 00:00:00 2001
From: Taylor R Campbell <riastradh@NetBSD.org>
Date: Mon, 15 Jan 2024 22:38:38 +0000
Subject: [PATCH 2/8] i915_gem: Avoid walking off end of sg_pgs.
sg_npgs currently fails to match obj->base.size/PAGE_SIZE only due to
bugs in the construction of sg_pgs in various i915 gem object types,
which we should also fix, but let's avoid compounding it here.
Related to PR kern/57833.
XXX pullup-10
---
sys/external/bsd/drm2/dist/drm/i915/gem/i915_gem_mman.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/sys/external/bsd/drm2/dist/drm/i915/gem/i915_gem_mman.c b/sys/=
external/bsd/drm2/dist/drm/i915/gem/i915_gem_mman.c
index 8e592f008ef7..d0265738e2c8 100644
--- a/sys/external/bsd/drm2/dist/drm/i915/gem/i915_gem_mman.c
+++ b/sys/external/bsd/drm2/dist/drm/i915/gem/i915_gem_mman.c
@@ -675,7 +675,7 @@ void i915_gem_object_release_mmap_offset(struct drm_i91=
5_gem_object *obj)
=20
if (!i915_gem_object_has_pages(obj))
return;
- for (i =3D 0; i < obj->base.size >> PAGE_SHIFT; i++) {
+ for (i =3D 0; i < obj->mm.pages->sgl->sg_npgs; i++) {
page =3D obj->mm.pages->sgl->sg_pgs[i];
vm_page =3D &page->p_vmp;
pmap_page_protect(vm_page, VM_PROT_NONE);
From 4fabd36d0f4f0b06ff600d91789c56730a6698a7 Mon Sep 17 00:00:00 2001
From: Taylor R Campbell <riastradh@NetBSD.org>
Date: Wed, 17 Jan 2024 01:33:22 +0000
Subject: [PATCH 3/8] i915_gem: Assert page array size.
Let's detect the bug of sg_npgs failing to match
obj->base.size/PAGE_SIZE earlier.
Related to PR kern/57833.
XXX pullup-10
---
.../bsd/drm2/dist/drm/i915/gem/i915_gem_pages.c | 12 ++++++++++++
1 file changed, 12 insertions(+)
diff --git a/sys/external/bsd/drm2/dist/drm/i915/gem/i915_gem_pages.c b/sys=
/external/bsd/drm2/dist/drm/i915/gem/i915_gem_pages.c
index 58075877254a..2bc7b11695ec 100644
--- a/sys/external/bsd/drm2/dist/drm/i915/gem/i915_gem_pages.c
+++ b/sys/external/bsd/drm2/dist/drm/i915/gem/i915_gem_pages.c
@@ -42,6 +42,18 @@ void __i915_gem_object_set_pages(struct drm_i915_gem_obj=
ect *obj,
}
=20
#ifndef __NetBSD__
+ /*
+ * Paranoia: In NetBSD, a scatterlist is just an array of
+ * pages, not an array of segments that might be larger than
+ * pages, so the number of entries must exactly match the size
+ * of the object (which should also be page-aligned).
+ *
+ * Both vm_fault_cpu and i915_gem_object_release_mmap_offset in
+ * i915_gem_mman.c rely on this page array as such.
+ */
+ KASSERTMSG(pages->sgl->sg_npgs =3D=3D obj->base.size >> PAGE_SHIFT,
+ "npgs=3D%zu size=3D%zu", pages->sgl->sg_npgs, obj->base.size);
+
obj->mm.get_page.sg_pos =3D pages->sgl;
obj->mm.get_page.sg_idx =3D 0;
#endif
From b63c51da1202bfbe0a633a72ca9b7e2575dfb3ca Mon Sep 17 00:00:00 2001
From: Taylor R Campbell <riastradh@NetBSD.org>
Date: Mon, 15 Jan 2024 22:49:04 +0000
Subject: [PATCH 4/8] i915_gem_phys: Fill sg_pgs.
This is needed by i915 gem fault, which maps user virtual addresses
to those pages, and by i915 gem object destruction, which does
pmap_page_protect on the pages to remove any of those user virtual
mappings.
This needs pmap_kenter_pa rather than pmap_enter(pmap_kernel(), ...)
in order to preserve the _kernel's_ mapping of the pages after
pmap_page_protect.
But bus_dmamem_map currently uses pmap_enter(pmap_kernel(), ...)
instead which creates a mapping that is removed by pmap_page_protect.
So we use a variant of bus_dmamem_map that uses pmap_kenter_pa
instead. Perhaps bus_dmamem_map should do this itself, but this
change is less risky to pull up than a change to bus_dmamem_map
itself.
PR kern/57833: kernel panic on xorg exit
XXX pullup-10
---
.../drm2/dist/drm/i915/gem/i915_gem_phys.c | 95 ++++++++++++++++++-
1 file changed, 92 insertions(+), 3 deletions(-)
diff --git a/sys/external/bsd/drm2/dist/drm/i915/gem/i915_gem_phys.c b/sys/=
external/bsd/drm2/dist/drm/i915/gem/i915_gem_phys.c
index 3f68276eea5f..257f386695f3 100644
--- a/sys/external/bsd/drm2/dist/drm/i915/gem/i915_gem_phys.c
+++ b/sys/external/bsd/drm2/dist/drm/i915/gem/i915_gem_phys.c
@@ -9,6 +9,90 @@
#include <sys/cdefs.h>
__KERNEL_RCSID(0, "$NetBSD: i915_gem_phys.c,v 1.8 2021/12/19 12:45:43 rias=
tradh Exp $");
=20
+#ifdef __NetBSD__
+/*
+ * Make sure this block comes before any linux includes, so we don't
+ * get mixed up by the PAGE_MASK complementation.
+ */
+
+#include <sys/bus.h>
+
+#include <uvm/uvm.h>
+#include <uvm/uvm_extern.h>
+
+#include <machine/pmap_private.h> /* kvtopte, pmap_pte_clearbits */
+
+/*
+ * Version of bus_dmamem_map that uses pmap_kenter_pa, not pmap_enter,
+ * so that it isn't affected by pmap_page_protect on the physical
+ * address. Adapted from sys/arch/x86/x86/bus_dma.c.
+ */
+static int
+bus_dmamem_kmap(bus_dma_tag_t t, bus_dma_segment_t *segs, int nsegs,
+ size_t size, void **kvap, int flags)
+{
+ vaddr_t va;
+ bus_addr_t addr;
+ int curseg;
+ const uvm_flag_t kmflags =3D
+ (flags & BUS_DMA_NOWAIT) !=3D 0 ? UVM_KMF_NOWAIT : 0;
+ u_int pmapflags =3D PMAP_WIRED | VM_PROT_READ | VM_PROT_WRITE;
+
+ size =3D round_page(size);
+ if (flags & BUS_DMA_NOCACHE)
+ pmapflags |=3D PMAP_NOCACHE;
+
+ va =3D uvm_km_alloc(kernel_map, size, 0, UVM_KMF_VAONLY | kmflags);
+
+ if (va =3D=3D 0)
+ return ENOMEM;
+
+ *kvap =3D (void *)va;
+
+ for (curseg =3D 0; curseg < nsegs; curseg++) {
+ for (addr =3D segs[curseg].ds_addr;
+ addr < (segs[curseg].ds_addr + segs[curseg].ds_len);
+ addr +=3D PAGE_SIZE, va +=3D PAGE_SIZE, size -=3D PAGE_SIZE) {
+ if (size =3D=3D 0)
+ panic("bus_dmamem_kmap: size botch");
+ pmap_kenter_pa(va, addr,
+ VM_PROT_READ | VM_PROT_WRITE,
+ pmapflags);
+ }
+ }
+ pmap_update(pmap_kernel());
+
+ return 0;
+}
+
+static void
+bus_dmamem_kunmap(bus_dma_tag_t t, void *kva, size_t size)
+{
+ pt_entry_t *pte, opte;
+ vaddr_t va, sva, eva;
+
+ KASSERTMSG(((uintptr_t)kva & PGOFSET) =3D=3D 0, "kva=3D%p", kva);
+
+ size =3D round_page(size);
+ sva =3D (vaddr_t)kva;
+ eva =3D sva + size;
+
+ /*
+ * mark pages cacheable again.
+ */
+ for (va =3D sva; va < eva; va +=3D PAGE_SIZE) {
+ pte =3D kvtopte(va);
+ opte =3D *pte;
+ if ((opte & PTE_PCD) !=3D 0)
+ pmap_pte_clearbits(pte, PTE_PCD);
+ }
+ pmap_kremove((vaddr_t)kva, size);
+ pmap_update(pmap_kernel());
+ uvm_km_free(kernel_map, (vaddr_t)kva, size, UVM_KMF_VAONLY);
+}
+
+#endif
+
#include <linux/highmem.h>
#include <linux/shmem_fs.h>
#include <linux/swap.h>
@@ -65,7 +149,7 @@ static int i915_gem_object_get_pages_phys(struct drm_i91=
5_gem_object *obj)
if (ret)
return -ENOMEM;
KASSERT(rsegs =3D=3D 1);
- ret =3D -bus_dmamem_map(dmat, &obj->mm.u.phys.seg, 1,
+ ret =3D -bus_dmamem_kmap(dmat, &obj->mm.u.phys.seg, 1,
roundup_pow_of_two(obj->base.size), &vaddr,
BUS_DMA_WAITOK|BUS_DMA_COHERENT);
if (ret)
@@ -83,7 +167,12 @@ static int i915_gem_object_get_pages_phys(struct drm_i9=
15_gem_object *obj)
if (!st)
goto err_pci;
=20
+#ifdef __NetBSD__
+ if (sg_alloc_table_from_bus_dmamem(st, dmat, &obj->mm.u.phys.seg, 1,
+ GFP_KERNEL))
+#else
if (sg_alloc_table(st, 1, GFP_KERNEL))
+#endif
goto err_st;
=20
sg =3D st->sgl;
@@ -151,7 +240,7 @@ err_st:
err_pci:
#ifdef __NetBSD__
if (vaddr) {
- bus_dmamem_unmap(dmat, vaddr,
+ bus_dmamem_kunmap(dmat, vaddr,
roundup_pow_of_two(obj->base.size));
}
obj->mm.u.phys.kva =3D NULL;
@@ -225,7 +314,7 @@ i915_gem_object_put_pages_phys(struct drm_i915_gem_obje=
ct *obj,
kfree(pages);
=20
#ifdef __NetBSD__
- bus_dmamem_unmap(dmat, obj->mm.u.phys.kva,
+ bus_dmamem_kunmap(dmat, obj->mm.u.phys.kva,
roundup_pow_of_two(obj->base.size));
obj->mm.u.phys.kva =3D NULL;
bus_dmamem_free(dmat, &obj->mm.u.phys.seg, 1);
From 3229d55123905abf7bc15757d6a6a06e3bac9e8e Mon Sep 17 00:00:00 2001
From: Taylor R Campbell <riastradh@NetBSD.org>
Date: Mon, 15 Jan 2024 22:55:15 +0000
Subject: [PATCH 5/8] i915_gem_region: Fill sg_pgs, with size/PAGE_SIZE
entries.
Use sg_alloc_table_from_bus_dmamem to do this.
i915_gem_mman.c vm_fault_cpu and i915_gem_object_release_mmap_offset
both rely on sg_pgs to be a page array, so using something else like
size >> ilog2(mem->mm.chunk_size) entries doesn't work. And they
rely on the sg_pgs entries to be initialized, which we weren't doing
before, and which sg_alloc_table_from_bus_dmamem does for us.
Related to PR kern/57833.
XXX pullup-10
---
.../bsd/drm2/dist/drm/i915/gem/i915_gem_region.c | 16 +++++++++++++++-
1 file changed, 15 insertions(+), 1 deletion(-)
diff --git a/sys/external/bsd/drm2/dist/drm/i915/gem/i915_gem_region.c b/sy=
s/external/bsd/drm2/dist/drm/i915/gem/i915_gem_region.c
index e539dc4530dc..72efd363fdc7 100644
--- a/sys/external/bsd/drm2/dist/drm/i915/gem/i915_gem_region.c
+++ b/sys/external/bsd/drm2/dist/drm/i915/gem/i915_gem_region.c
@@ -45,10 +45,12 @@ i915_gem_object_get_pages_buddy(struct drm_i915_gem_obj=
ect *obj)
if (!st)
return -ENOMEM;
=20
+#ifndef __NetBSD__
if (sg_alloc_table(st, size >> ilog2(mem->mm.chunk_size), GFP_KERNEL)) {
kfree(st);
return -ENOMEM;
}
+#endif
=20
flags =3D I915_ALLOC_MIN_PAGE_SIZE;
if (obj->flags & I915_BO_ALLOC_CONTIGUOUS)
@@ -60,7 +62,6 @@ i915_gem_object_get_pages_buddy(struct drm_i915_gem_objec=
t *obj)
=20
GEM_BUG_ON(list_empty(blocks));
=20
- sg =3D st->sgl;
#ifdef __NetBSD__
__USE(prev_end);
bus_dma_tag_t dmat =3D obj->base.dev->dmat;
@@ -68,6 +69,8 @@ i915_gem_object_get_pages_buddy(struct drm_i915_gem_objec=
t *obj)
int i =3D 0, nsegs =3D 0;
bool loaded =3D false;
=20
+ sg =3D NULL;
+
list_for_each_entry(block, blocks, link) {
if (nsegs >=3D INT_MAX ||
nsegs >=3D SIZE_MAX/sizeof(segs[0]))
@@ -84,7 +87,15 @@ i915_gem_object_get_pages_buddy(struct drm_i915_gem_obje=
ct *obj)
=20
segs[i].ds_addr =3D mem->region.start + offset;
segs[i].ds_len =3D block_size;
+ i++;
}
+ KASSERT(i =3D=3D nsegs);
+
+ ret =3D sg_alloc_table_from_bus_dmamem(st, dmat, segs, nsegs,
+ GFP_KERNEL);
+ if (ret)
+ goto err;
+ sg =3D st->sgl;
=20
/* XXX errno NetBSD->Linux */
ret =3D -bus_dmamap_create(dmat, size, nsegs, size, 0, BUS_DMA_WAITOK,
@@ -107,6 +118,7 @@ i915_gem_object_get_pages_buddy(struct drm_i915_gem_obj=
ect *obj)
=20
sg_page_sizes =3D i915_sg_page_sizes(sg);
#else
+ sg =3D st->sgl;
st->nents =3D 0;
sg_page_sizes =3D 0;
prev_end =3D (resource_size_t)-1;
@@ -154,6 +166,8 @@ i915_gem_object_get_pages_buddy(struct drm_i915_gem_obj=
ect *obj)
err:
if (loaded)
bus_dmamap_unload(dmat, st->sgl->sg_dmamap);
+ if (sg && sg->sg_dmamap)
+ bus_dmamap_destroy(dmat, sg->sg_dmamap);
if (segs)
kmem_free(segs, nsegs * sizeof(segs[0]));
__intel_memory_region_put_pages_buddy(mem, blocks);
From c5314565868d7d7180b329eac2a88d02914d31f9 Mon Sep 17 00:00:00 2001
From: Taylor R Campbell <riastradh@NetBSD.org>
Date: Tue, 16 Jan 2024 00:28:23 +0000
Subject: [PATCH 6/8] i915_gem_stolen: Fix memory leak.
Found while trying to address the PR 57833 class of problems.
XXX pullup-10
---
sys/external/bsd/drm2/dist/drm/i915/gem/i915_gem_stolen.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/sys/external/bsd/drm2/dist/drm/i915/gem/i915_gem_stolen.c b/sy=
s/external/bsd/drm2/dist/drm/i915/gem/i915_gem_stolen.c
index b53d543fa894..9ad5df8c75c8 100644
--- a/sys/external/bsd/drm2/dist/drm/i915/gem/i915_gem_stolen.c
+++ b/sys/external/bsd/drm2/dist/drm/i915/gem/i915_gem_stolen.c
@@ -569,7 +569,8 @@ i915_pages_create_for_stolen(struct drm_device *dev,
}
loaded =3D true;
=20
-out: if (ret) {
+out: kmem_free(seg, nseg * sizeof(seg[0]));
+ if (ret) {
if (loaded)
bus_dmamap_unload(dmat, st->sgl->sg_dmamap);
sg_free_table(st);
From 86efff2fa17f45b558e29e065f3616e891b1393f Mon Sep 17 00:00:00 2001
From: Taylor R Campbell <riastradh@NetBSD.org>
Date: Tue, 16 Jan 2024 00:40:20 +0000
Subject: [PATCH 7/8] i915_gem_stolen: Fill sg_pgs, with size/PAGE_SIZE
entries.
Use sg_alloc_table_from_bus_dmamem to do this.
i915_gem_mman.c vm_fault_cpu and i915_gem_object_release_mmap_offset
both rely on sg_pgs to be a page array, so providing a table with
only one entry doesn't work (except by accident, if the object is
page-sized anyway). And they rely on the sg_pgs entries to be
initialized, which we weren't doing before, and which
sg_alloc_table_from_bus_dmamem does for us.
Related to PR kern/57833.
XXX pullup-10
---
.../drm2/dist/drm/i915/gem/i915_gem_stolen.c | 29 ++++++++++++++-----
1 file changed, 21 insertions(+), 8 deletions(-)
diff --git a/sys/external/bsd/drm2/dist/drm/i915/gem/i915_gem_stolen.c b/sy=
s/external/bsd/drm2/dist/drm/i915/gem/i915_gem_stolen.c
index 9ad5df8c75c8..1e7398090d11 100644
--- a/sys/external/bsd/drm2/dist/drm/i915/gem/i915_gem_stolen.c
+++ b/sys/external/bsd/drm2/dist/drm/i915/gem/i915_gem_stolen.c
@@ -506,14 +506,13 @@ i915_pages_create_for_stolen(struct drm_device *dev,
{
struct drm_i915_private *i915 =3D to_i915(dev);
struct sg_table *st;
+ struct scatterlist *sg;
#ifdef __NetBSD__
bus_dma_tag_t dmat =3D i915->drm.dmat;
bus_dma_segment_t *seg =3D NULL;
int nseg =3D 0, i;
bool loaded =3D false;
int ret;
-#else
- struct scatterlist *sg;
#endif
=20
GEM_BUG_ON(range_overflows(offset, size, resource_size(&i915->dsm)));
@@ -527,11 +526,6 @@ i915_pages_create_for_stolen(struct drm_device *dev,
if (st =3D=3D NULL)
return ERR_PTR(-ENOMEM);
=20
- if (sg_alloc_table(st, 1, GFP_KERNEL)) {
- kfree(st);
- return ERR_PTR(-ENOMEM);
- }
-
#ifdef __NetBSD__
KASSERT((size % PAGE_SIZE) =3D=3D 0);
nseg =3D size / PAGE_SIZE;
@@ -548,6 +542,17 @@ i915_pages_create_for_stolen(struct drm_device *dev,
seg[i].ds_len =3D PAGE_SIZE;
}
=20
+ sg =3D NULL;
+
+ ret =3D sg_alloc_table_from_bus_dmamem(st, dmat, seg, nseg, GFP_KERNEL);
+ if (ret) {
+ DRM_ERROR("failed to alloc sg table for stolen object: %d\n",
+ ret);
+ ret =3D -ENOMEM;
+ goto out;
+ }
+ sg =3D st->sgl;
+
/* XXX errno NetBSD->Linux */
ret =3D -bus_dmamap_create(dmat, size, nseg, PAGE_SIZE, 0,
BUS_DMA_WAITOK, &st->sgl->sg_dmamap);
@@ -573,11 +578,19 @@ out: kmem_free(seg, nseg * sizeof(seg[0]));
if (ret) {
if (loaded)
bus_dmamap_unload(dmat, st->sgl->sg_dmamap);
- sg_free_table(st);
+ if (sg && sg->sg_dmamap)
+ bus_dmamap_destroy(dmat, sg->sg_dmamap);
+ if (sg)
+ sg_free_table(st);
kfree(st);
return ERR_PTR(ret);
}
#else
+ if (sg_alloc_table(st, 1, GFP_KERNEL)) {
+ kfree(st);
+ return ERR_PTR(-ENOMEM);
+ }
+
sg =3D st->sgl;
sg->offset =3D 0;
sg->length =3D size;
From f00c3079c6dc7eb6ff62c12a2b6d08e1144db957 Mon Sep 17 00:00:00 2001
From: Taylor R Campbell <riastradh@NetBSD.org>
Date: Tue, 16 Jan 2024 00:42:08 +0000
Subject: [PATCH 8/8] i915_gem_stolen: Take advantage of a local variable.
No functional change intended.
Prompted by PR kern/57833.
XXX pullup-10
---
.../bsd/drm2/dist/drm/i915/gem/i915_gem_stolen.c | 12 ++++++------
1 file changed, 6 insertions(+), 6 deletions(-)
diff --git a/sys/external/bsd/drm2/dist/drm/i915/gem/i915_gem_stolen.c b/sy=
s/external/bsd/drm2/dist/drm/i915/gem/i915_gem_stolen.c
index 1e7398090d11..1635e57befd7 100644
--- a/sys/external/bsd/drm2/dist/drm/i915/gem/i915_gem_stolen.c
+++ b/sys/external/bsd/drm2/dist/drm/i915/gem/i915_gem_stolen.c
@@ -555,17 +555,17 @@ i915_pages_create_for_stolen(struct drm_device *dev,
=20
/* XXX errno NetBSD->Linux */
ret =3D -bus_dmamap_create(dmat, size, nseg, PAGE_SIZE, 0,
- BUS_DMA_WAITOK, &st->sgl->sg_dmamap);
+ BUS_DMA_WAITOK, &sg->sg_dmamap);
if (ret) {
DRM_ERROR("failed to create DMA map for stolen object: %d\n",
ret);
- st->sgl->sg_dmamap =3D NULL;
+ sg->sg_dmamap =3D NULL;
goto out;
}
- st->sgl->sg_dmat =3D dmat;
+ sg->sg_dmat =3D dmat;
=20
- /* XXX errno NetBSD->Liux */
- ret =3D -bus_dmamap_load_raw(dmat, st->sgl->sg_dmamap, seg, nseg, size,
+ /* XXX errno NetBSD->Linux */
+ ret =3D -bus_dmamap_load_raw(dmat, sg->sg_dmamap, seg, nseg, size,
BUS_DMA_WAITOK);
if (ret) {
DRM_ERROR("failed to load DMA map for stolen object: %d\n",
@@ -577,7 +577,7 @@ i915_pages_create_for_stolen(struct drm_device *dev,
out: kmem_free(seg, nseg * sizeof(seg[0]));
if (ret) {
if (loaded)
- bus_dmamap_unload(dmat, st->sgl->sg_dmamap);
+ bus_dmamap_unload(dmat, sg->sg_dmamap);
if (sg && sg->sg_dmamap)
bus_dmamap_destroy(dmat, sg->sg_dmamap);
if (sg)
--=_zuuYtksK0C8RJaF9J8AwVVP/KZSlw/L+--
From: Ramiro Aceves <ea1abz@gmail.com>
To: Taylor R Campbell <riastradh@NetBSD.org>
Cc: "David H. Gutteridge" <david@gutteridge.ca>, gnats-bugs@NetBSD.org,
netbsd-bugs@NetBSD.org, RVP <rvp@SDF.ORG>
Subject: Re: kern/57833: kernel panic on xorg exit
Date: Fri, 19 Jan 2024 07:32:04 +0100
El 18/1/24 a las 23:24, Taylor R Campbell escribió:
> OK, I think I found the problem with my patch: a side effect of
> Linux's backwards definition of PAGE_MASK from NetBSD's, causing
> round_page(size) to return 0 instead of 0x4000 when size=0x4000.
>
> Try this one?
>
> (Posting this again as one giant diff in .diff, and an incremental
> git patch series in .patch, in case that's helpful, whichever is
> easier for you to deal with.)
Hello Taylor, you are absolutely amazing! :-) I got up earlier in the
morning before going work to compile and install v6.diff patch. Now I
can enter and abandon xorg without panics!
If you need more test here I am ready.
Thank you very much.
Ramiro.
From: "David H. Gutteridge" <david@gutteridge.ca>
To: Gnats Bugs <gnats-bugs@netbsd.org>
Cc:
Subject: Re: kern/57833: kernel panic on xorg exit
Date: Fri, 19 Jan 2024 17:18:47 -0500
On 2024-01-18 17:24, Taylor R Campbell wrote:
> OK, I think I found the problem with my patch: a side effect of
> Linux's backwards definition of PAGE_MASK from NetBSD's, causing
> round_page(size) to return 0 instead of 0x4000 when size=0x4000.
>
> Try this one?
>
> (Posting this again as one giant diff in .diff, and an incremental
> git patch series in .patch, in case that's helpful, whichever is
> easier for you to deal with.)
Confirming your "v6" patch set works fine with my hardware. I can
repeatedly exit an X session without a panic.
Thanks,
Dave
From: "Taylor R Campbell" <riastradh@netbsd.org>
To: gnats-bugs@gnats.NetBSD.org
Cc:
Subject: PR/57833 CVS commit: src/sys/external/bsd/drm2/dist/drm/i915/gem
Date: Fri, 19 Jan 2024 22:22:27 +0000
Module Name: src
Committed By: riastradh
Date: Fri Jan 19 22:22:27 UTC 2024
Modified Files:
src/sys/external/bsd/drm2/dist/drm/i915/gem: i915_gem_region.c
Log Message:
i915_gem_region: Reduce diff from upstream a little.
No functional change intended.
Prompted by upcoming nearby changes related to PR kern/57833.
XXX pullup-10 (to make subsequent pullups easier)
To generate a diff of this commit:
cvs rdiff -u -r1.4 -r1.5 \
src/sys/external/bsd/drm2/dist/drm/i915/gem/i915_gem_region.c
Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.
From: "Taylor R Campbell" <riastradh@netbsd.org>
To: gnats-bugs@gnats.NetBSD.org
Cc:
Subject: PR/57833 CVS commit: src/sys/external/bsd/drm2/dist/drm/i915/gem
Date: Fri, 19 Jan 2024 22:22:40 +0000
Module Name: src
Committed By: riastradh
Date: Fri Jan 19 22:22:40 UTC 2024
Modified Files:
src/sys/external/bsd/drm2/dist/drm/i915/gem: i915_gem_mman.c
Log Message:
i915_gem: Avoid walking off end of sg_pgs.
sg_npgs currently fails to match obj->base.size/PAGE_SIZE only due to
bugs in the construction of sg_pgs in various i915 gem object types,
which we should also fix, but let's avoid compounding it here.
Related to PR kern/57833.
XXX pullup-10
To generate a diff of this commit:
cvs rdiff -u -r1.21 -r1.22 \
src/sys/external/bsd/drm2/dist/drm/i915/gem/i915_gem_mman.c
Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.
From: "Taylor R Campbell" <riastradh@netbsd.org>
To: gnats-bugs@gnats.NetBSD.org
Cc:
Subject: PR/57833 CVS commit: src/sys/external/bsd/drm2/dist/drm/i915/gem
Date: Fri, 19 Jan 2024 22:22:54 +0000
Module Name: src
Committed By: riastradh
Date: Fri Jan 19 22:22:54 UTC 2024
Modified Files:
src/sys/external/bsd/drm2/dist/drm/i915/gem: i915_gem_pages.c
Log Message:
i915_gem: Assert page array size.
Let's detect the bug of sg_npgs failing to match
obj->base.size/PAGE_SIZE earlier.
Related to PR kern/57833.
XXX pullup-10
To generate a diff of this commit:
cvs rdiff -u -r1.6 -r1.7 \
src/sys/external/bsd/drm2/dist/drm/i915/gem/i915_gem_pages.c
Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.
From: "Taylor R Campbell" <riastradh@netbsd.org>
To: gnats-bugs@gnats.NetBSD.org
Cc:
Subject: PR/57833 CVS commit: src/sys/external/bsd/drm2/dist/drm/i915/gem
Date: Fri, 19 Jan 2024 22:23:04 +0000
Module Name: src
Committed By: riastradh
Date: Fri Jan 19 22:23:04 UTC 2024
Modified Files:
src/sys/external/bsd/drm2/dist/drm/i915/gem: i915_gem_phys.c
Log Message:
i915_gem_phys: Fill sg_pgs.
This is needed by i915 gem fault, which maps user virtual addresses
to those pages, and by i915 gem object destruction, which does
pmap_page_protect on the pages to remove any of those user virtual
mappings.
This needs pmap_kenter_pa rather than pmap_enter(pmap_kernel(), ...)
in order to preserve the _kernel's_ mapping of the pages after
pmap_page_protect.
But bus_dmamem_map currently uses pmap_enter(pmap_kernel(), ...)
instead which creates a mapping that is removed by pmap_page_protect.
So we use a variant of bus_dmamem_map that uses pmap_kenter_pa
instead. Perhaps bus_dmamem_map should do this itself, but this
change is less risky to pull up than a change to bus_dmamem_map
itself.
PR kern/57833: kernel panic on xorg exit
XXX pullup-10
To generate a diff of this commit:
cvs rdiff -u -r1.8 -r1.9 \
src/sys/external/bsd/drm2/dist/drm/i915/gem/i915_gem_phys.c
Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.
From: "Taylor R Campbell" <riastradh@netbsd.org>
To: gnats-bugs@gnats.NetBSD.org
Cc:
Subject: PR/57833 CVS commit: src/sys/external/bsd/drm2/dist/drm/i915/gem
Date: Fri, 19 Jan 2024 22:23:19 +0000
Module Name: src
Committed By: riastradh
Date: Fri Jan 19 22:23:19 UTC 2024
Modified Files:
src/sys/external/bsd/drm2/dist/drm/i915/gem: i915_gem_region.c
Log Message:
i915_gem_region: Fill sg_pgs, with size/PAGE_SIZE entries.
Use sg_alloc_table_from_bus_dmamem to do this.
i915_gem_mman.c vm_fault_cpu and i915_gem_object_release_mmap_offset
both rely on sg_pgs to be a page array, so using something else like
size >> ilog2(mem->mm.chunk_size) entries doesn't work. And they
rely on the sg_pgs entries to be initialized, which we weren't doing
before, and which sg_alloc_table_from_bus_dmamem does for us.
Related to PR kern/57833.
XXX pullup-10
To generate a diff of this commit:
cvs rdiff -u -r1.5 -r1.6 \
src/sys/external/bsd/drm2/dist/drm/i915/gem/i915_gem_region.c
Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.
From: "Taylor R Campbell" <riastradh@netbsd.org>
To: gnats-bugs@gnats.NetBSD.org
Cc:
Subject: PR/57833 CVS commit: src/sys/external/bsd/drm2/dist/drm/i915/gem
Date: Fri, 19 Jan 2024 22:24:27 +0000
Module Name: src
Committed By: riastradh
Date: Fri Jan 19 22:24:27 UTC 2024
Modified Files:
src/sys/external/bsd/drm2/dist/drm/i915/gem: i915_gem_stolen.c
Log Message:
i915_gem_stolen: Fix memory leak.
Found while trying to address the PR 57833 class of problems.
XXX pullup-10
To generate a diff of this commit:
cvs rdiff -u -r1.5 -r1.6 \
src/sys/external/bsd/drm2/dist/drm/i915/gem/i915_gem_stolen.c
Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.
From: "Taylor R Campbell" <riastradh@netbsd.org>
To: gnats-bugs@gnats.NetBSD.org
Cc:
Subject: PR/57833 CVS commit: src/sys/external/bsd/drm2/dist/drm/i915/gem
Date: Fri, 19 Jan 2024 22:24:38 +0000
Module Name: src
Committed By: riastradh
Date: Fri Jan 19 22:24:38 UTC 2024
Modified Files:
src/sys/external/bsd/drm2/dist/drm/i915/gem: i915_gem_stolen.c
Log Message:
i915_gem_stolen: Fill sg_pgs, with size/PAGE_SIZE entries.
Use sg_alloc_table_from_bus_dmamem to do this.
i915_gem_mman.c vm_fault_cpu and i915_gem_object_release_mmap_offset
both rely on sg_pgs to be a page array, so providing a table with
only one entry doesn't work (except by accident, if the object is
page-sized anyway). And they rely on the sg_pgs entries to be
initialized, which we weren't doing before, and which
sg_alloc_table_from_bus_dmamem does for us.
Related to PR kern/57833.
XXX pullup-10
To generate a diff of this commit:
cvs rdiff -u -r1.6 -r1.7 \
src/sys/external/bsd/drm2/dist/drm/i915/gem/i915_gem_stolen.c
Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.
State-Changed-From-To: open->needs-pullups
State-Changed-By: riastradh@NetBSD.org
State-Changed-When: Fri, 19 Jan 2024 23:23:45 +0000
State-Changed-Why:
fix committed to HEAD, needs pullup-10, inapplicable to <10
State-Changed-From-To: needs-pullups->pending-pullups
State-Changed-By: gutteridge@NetBSD.org
State-Changed-When: Tue, 23 Jan 2024 22:47:43 +0000
State-Changed-Why:
riastradh@ submitted pullup ticket #559 for the netbsd-10 branch.
From: "Martin Husemann" <martin@netbsd.org>
To: gnats-bugs@gnats.NetBSD.org
Cc:
Subject: PR/57833 CVS commit: [netbsd-10] src/sys/external/bsd/drm2/dist/drm/i915/gem
Date: Sat, 3 Feb 2024 11:15:12 +0000
Module Name: src
Committed By: martin
Date: Sat Feb 3 11:15:12 UTC 2024
Modified Files:
src/sys/external/bsd/drm2/dist/drm/i915/gem [netbsd-10]:
i915_gem_mman.c i915_gem_pages.c i915_gem_phys.c i915_gem_region.c
i915_gem_stolen.c
Log Message:
Pull up following revision(s) (requested by riastradh in ticket #559):
sys/external/bsd/drm2/dist/drm/i915/gem/i915_gem_stolen.c: revision 1.6
sys/external/bsd/drm2/dist/drm/i915/gem/i915_gem_stolen.c: revision 1.7
sys/external/bsd/drm2/dist/drm/i915/gem/i915_gem_pages.c: revision 1.7
sys/external/bsd/drm2/dist/drm/i915/gem/i915_gem_phys.c: revision 1.9
sys/external/bsd/drm2/dist/drm/i915/gem/i915_gem_mman.c: revision 1.22
sys/external/bsd/drm2/dist/drm/i915/gem/i915_gem_region.c: revision 1.5
sys/external/bsd/drm2/dist/drm/i915/gem/i915_gem_region.c: revision 1.6
i915_gem_region: Reduce diff from upstream a little.
No functional change intended.
Prompted by upcoming nearby changes related to PR kern/57833.
i915_gem: Avoid walking off end of sg_pgs.
sg_npgs currently fails to match obj->base.size/PAGE_SIZE only due to
bugs in the construction of sg_pgs in various i915 gem object types,
which we should also fix, but let's avoid compounding it here.
Related to PR kern/57833.
i915_gem: Assert page array size.
Let's detect the bug of sg_npgs failing to match
obj->base.size/PAGE_SIZE earlier.
Related to PR kern/57833.
i915_gem_phys: Fill sg_pgs.
This is needed by i915 gem fault, which maps user virtual addresses
to those pages, and by i915 gem object destruction, which does
pmap_page_protect on the pages to remove any of those user virtual
mappings.
This needs pmap_kenter_pa rather than pmap_enter(pmap_kernel(), ...)
in order to preserve the _kernel's_ mapping of the pages after
pmap_page_protect.
But bus_dmamem_map currently uses pmap_enter(pmap_kernel(), ...)
instead which creates a mapping that is removed by pmap_page_protect.
So we use a variant of bus_dmamem_map that uses pmap_kenter_pa
instead. Perhaps bus_dmamem_map should do this itself, but this
change is less risky to pull up than a change to bus_dmamem_map
itself.
PR kern/57833: kernel panic on xorg exit
i915_gem_region: Fill sg_pgs, with size/PAGE_SIZE entries.
Use sg_alloc_table_from_bus_dmamem to do this.
i915_gem_mman.c vm_fault_cpu and i915_gem_object_release_mmap_offset
both rely on sg_pgs to be a page array, so using something else like
size >> ilog2(mem->mm.chunk_size) entries doesn't work. And they
rely on the sg_pgs entries to be initialized, which we weren't doing
before, and which sg_alloc_table_from_bus_dmamem does for us.
Related to PR kern/57833.
i915_gem_stolen: Fix memory leak.
Found while trying to address the PR 57833 class of problems.
i915_gem_stolen: Fill sg_pgs, with size/PAGE_SIZE entries.
Use sg_alloc_table_from_bus_dmamem to do this.
i915_gem_mman.c vm_fault_cpu and i915_gem_object_release_mmap_offset
both rely on sg_pgs to be a page array, so providing a table with
only one entry doesn't work (except by accident, if the object is
page-sized anyway). And they rely on the sg_pgs entries to be
initialized, which we weren't doing before, and which
sg_alloc_table_from_bus_dmamem does for us.
Related to PR kern/57833.
To generate a diff of this commit:
cvs rdiff -u -r1.21 -r1.21.4.1 \
src/sys/external/bsd/drm2/dist/drm/i915/gem/i915_gem_mman.c
cvs rdiff -u -r1.6 -r1.6.4.1 \
src/sys/external/bsd/drm2/dist/drm/i915/gem/i915_gem_pages.c
cvs rdiff -u -r1.8 -r1.8.4.1 \
src/sys/external/bsd/drm2/dist/drm/i915/gem/i915_gem_phys.c
cvs rdiff -u -r1.4 -r1.4.4.1 \
src/sys/external/bsd/drm2/dist/drm/i915/gem/i915_gem_region.c
cvs rdiff -u -r1.5 -r1.5.4.1 \
src/sys/external/bsd/drm2/dist/drm/i915/gem/i915_gem_stolen.c
Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.
State-Changed-From-To: pending-pullups->closed
State-Changed-By: riastradh@NetBSD.org
State-Changed-When: Sat, 03 Feb 2024 15:12:30 +0000
State-Changed-Why:
fixed and pulled up
>Unformatted:
(Contact us)
$NetBSD: query-full-pr,v 1.47 2022/09/11 19:34:41 kim Exp $
$NetBSD: gnats_config.sh,v 1.9 2014/08/02 14:16:04 spz Exp $
Copyright © 1994-2024
The NetBSD Foundation, Inc. ALL RIGHTS RESERVED.
Home