NetBSD Problem Report #35068

From hauke@Espresso.Rhein-Neckar.DE  Fri Nov 17 20:55:18 2006
Return-Path: <hauke@Espresso.Rhein-Neckar.DE>
Received: from mail.netbsd.org (mail.netbsd.org [204.152.190.11])
	by narn.NetBSD.org (Postfix) with ESMTP id AC91063BC7F
	for <gnats-bugs@gnats.NetBSD.org>; Fri, 17 Nov 2006 20:55:18 +0000 (UTC)
Message-Id: <200611172043.kAHKhJUl003453@pizza.causeuse.org>
Date: Fri, 17 Nov 2006 21:43:19 +0100 (CET)
From: Hauke Fath <hauke@Espresso.Rhein-Neckar.DE>
Reply-To: Hauke Fath <hauke@Espresso.Rhein-Neckar.DE>
To: gnats-bugs@NetBSD.org
Cc: Hauke Fath <hauke@Espresso.Rhein-Neckar.DE>
Subject: 68030 Macintoshes panic at reboot
X-Send-Pr-Version: 3.95

>Number:         35068
>Category:       port-mac68k
>Synopsis:       68030 Macintoshes panic at reboot
>Confidential:   no
>Severity:       critical
>Priority:       medium
>Responsible:    chs
>State:          closed
>Class:          sw-bug
>Submitter-Id:   net
>Arrival-Date:   Fri Nov 17 21:00:00 +0000 2006
>Closed-Date:    Mon Jan 08 16:59:14 +0000 2007
>Last-Modified:  Tue Jan 09 22:40:01 +0000 2007
>Originator:     Hauke Fath <hauke@Espresso.Rhein-Neckar.DE>
>Release:        NetBSD 3.1_RC4 + 4.99.3
>Organization:
Falling Raindrops
>Environment:


System: NetBSD quiche 3.1_RC4 NetBSD 3.1_RC4 (GENERICSBC) #0: Thu Oct 19 19:34:55 CEST 2006  hf@Hochstuhl:/var/obj/netbsd-builds/3/mac68k/sys/arch/mac68k/compile/GENERICSBC mac68k

Architecture: m68k
Machine: mac68k
>Description:

	Shutting down a 68030 Macintosh results in a kernel panic
	before reboot:

[hauke@quiche] ~ > 
System shutdown time has arrived

About to run shutdown hooks...
Stopping cron.
Stopping inetd.
Waiting for PIDS: 508.
Fri Nov 17 20:27:48 CET 2006

Done running shutdown hooks.
Nov 17 20:27:57 quiche syslogd: Exiting on signal 15
syncing disks... done
unmounting file systems... done

The operating system has halted.
Please press any key to reboot.

rebooting...
uvm_fault(0x268120, 0x3000, 0, 0x2) -> 0xe
  type 8, code [mmu,,ssw]: 802070d
trap type 8, code = 0x802070d, v = 0x3af0
kernel program counter = 0x13ff028
kernel: MMU fault trap
pid = 617, lid = 1, pc = 013FF028, ps = 2714, sfc = 1, dfc = 1
Registers:
             0        1        2        3        4        5        6        7
dreg: 00000808 00000000 00796FB4 0084E4D0 00000200 00000000 00000000 00000000
areg: 013FF000 40800000 00141F76 00003AF0 FFFFBEF0 0062AB80 00796E74 FFFFBEEC

Kernel stack (013FF6E4):
3FF6E4: 001F3AAC 013FF760 00000080 00796FB4 0084E4D0 00000200 00000000 00000000
3FF704: 00000000 00141F76 00003AF0 FFFFBEF0 0062AB80 0085F004 00000001 00000000
3FF724: 00000000 00000000 00000001 00000000 00000000 00000008 00000000 00000000
3FF744: 00000000 4A47D87D 00796E74 00003090 00000008 0802070D 00003AF0 00000808
3FF764: 00000000 00796FB4 0084E4D0 00000200 00000000 00000000 00000000 013FF000
3FF784: 40800000 00141F76 00003AF0 FFFFBEF0 0062AB80 00796E74 FFFFBEEC 00000000
3FF7A4: 2714013F F028B008 0EEE070D 43E90090 00003AF0 00003AF0 00000000 F0134000
3FF7C4: 013FF030 013FF02E 013FF02C FFFFFFFF 4000FF0D 0002F24C 00000000 58032668
3FF7E4: 00004000 00000000 20200000 013FF016 00020000 00000000 00003AF0 25251900
3FF804: 4A8F8F00 6AFC0900 00FDFD8D 82208220 01822082 208220FE 20802080 2080208D
3FF824: FC090000 FDFD8D84 20A4A001 95208020 F1E08020 9520A4A0 84208DFC 090000FD
3FF844: FD8D8020 80200180 20802080 20802080 20802080 208DFF09 00008383 00000000
3FF864: 1FC01040 107C1044 10441044 1FC40404 10040404 0407FC00 00000423 A89F6572
3FF884: 00120901 000004F6 00020000 0002CFBD 00574445 460D1910 B0980E1C 180C6E09
3FF8A4: 056E0000 BA0C6EC0 00056B00 00B02055 2F100C78 3FFF2B02 8E53EEB0 62341400
3FF8C4: B80A806F AA190A9C AA1A3727 0F1C4F48 6F11AA42 544F1B1D 5101EC64 28C52D50
panic: MMU fault
Stopped in pid 617.1 (halt) at  netbsd:cpu_Debugger+0x6:        unlk    a6
db> t
cpu_Debugger(8022700,8,13ff760,13ff74c,1f3acc) + 6
db> ps
 PID           PPID     PGRP        UID S   FLAGS LWPS          COMMAND    WAIT
>617              1      622        100 2  0x4102    1             halt
 254              0        0          0 2 0x20200    1            nfsio  nfsidl
 264              0        0          0 2 0x20200    1            nfsio  nfsidl
 207              0        0          0 2 0x20200    1            nfsio  nfsidl
 221              0        0          0 2 0x20200    1            nfsio  nfsidl
 5                0        0          0 2 0x20200    1         aiodoned aiodone
 4                0        0          0 2 0x20200    1          ioflush
 3                0        0          0 2 0x20200    1       pagedaemon pgdaemo
 2                0        0          0 2 0x20200    1         scsibus0  sccomp
 1                0        1          0 2  0x4000    1             init    wait
 0               -1        0          0 2 0x20200    1          swapper schedul
db>  x/i 013FF0210
0x13ff010:      orib    #-0x16,a3@-
0x13ff014:      bneb    <emul_netbsd_aoutm68k_object+0x117c612> [addr:0x13ff022 ]
0x13ff016:      movq    #0,d0
0x13ff018:      movc    d0,cacr
0x13ff01c:      movc    d0,tc
0x13ff020:      brab    <emul_netbsd_aoutm68k_object+0x117c61c> [addr:0x13ff02c ]
0x13ff022:      movl    #0,a3@
0x13ff028:      pmovl   a3@,tc
0x13ff02c:      lea     a1@(0x90),a1
0x13ff030:      jmp     a1@
db> [-- hauke@localhost detached -- Fri Nov 17 20:32:05 2006]

There have been several confirmations for other '030 Macs on
port-mac68k, and I can reproduce it with a 2006-10 NetBSD 4.99.3
kernel.

>How-To-Repeat:

	Issue a 'shutdown -h now', then hit the 'Any' key to initate a
	reboot.

>Fix:

	According to the above disassembler listing, the panic happens
	in locore.s::doboot(), around the instruction to disable the
	PMMU. This may indicate a messed-up memory mapping. But,
	quoting the late Richard Rauch, "I probably don't know what
	I'm talking about."

>Release-Note:

>Audit-Trail:
From: Chuck Silvers <chs@netbsd.org>
To: gnats-bugs@NetBSD.org
Cc: 
Subject: PR/35068 CVS commit: src/sys/arch/mac68k/mac68k
Date: Mon,  8 Jan 2007 16:54:15 +0000 (UTC)

 Module Name:	src
 Committed By:	chs
 Date:		Mon Jan  8 16:54:15 UTC 2007

 Modified Files:
 	src/sys/arch/mac68k/mac68k: locore.s

 Log Message:
 in doboot, use "longscratch" as a scratch memory location instead of
 something in the (read-only) text section.  fixes PR 35068.


 To generate a diff of this commit:
 cvs rdiff -r1.145 -r1.146 src/sys/arch/mac68k/mac68k/locore.s

 Please note that diffs are not public domain; they are subject to the
 copyright notices on the relevant files.

Responsible-Changed-From-To: port-mac68k-maintainer->chs
Responsible-Changed-By: chs@netbsd.org
Responsible-Changed-When: Mon, 08 Jan 2007 16:59:14 +0000
Responsible-Changed-Why:
I fixed it.


State-Changed-From-To: open->closed
State-Changed-By: chs@netbsd.org
State-Changed-When: Mon, 08 Jan 2007 16:59:14 +0000
State-Changed-Why:
fixed by above checkin.


From: Matthias Scheler <tron@netbsd.org>
To: gnats-bugs@NetBSD.org
Cc: 
Subject: PR/35068 CVS commit: [netbsd-3] src/sys/arch/mac68k/mac68k
Date: Tue,  9 Jan 2007 22:28:57 +0000 (UTC)

 Module Name:	src
 Committed By:	tron
 Date:		Tue Jan  9 22:28:57 UTC 2007

 Modified Files:
 	src/sys/arch/mac68k/mac68k [netbsd-3]: locore.s

 Log Message:
 Pull up following revision(s) (requested by chs in ticket #1626):
 	sys/arch/mac68k/mac68k/locore.s: revision 1.146
 in doboot, use "longscratch" as a scratch memory location instead of
 something in the (read-only) text section.  fixes PR 35068.


 To generate a diff of this commit:
 cvs rdiff -r1.144 -r1.144.14.1 src/sys/arch/mac68k/mac68k/locore.s

 Please note that diffs are not public domain; they are subject to the
 copyright notices on the relevant files.

From: Matthias Scheler <tron@netbsd.org>
To: gnats-bugs@NetBSD.org
Cc: 
Subject: PR/35068 CVS commit: [netbsd-3-1] src/sys/arch/mac68k/mac68k
Date: Tue,  9 Jan 2007 22:30:56 +0000 (UTC)

 Module Name:	src
 Committed By:	tron
 Date:		Tue Jan  9 22:30:56 UTC 2007

 Modified Files:
 	src/sys/arch/mac68k/mac68k [netbsd-3-1]: locore.s

 Log Message:
 Pull up following revision(s) (requested by chs in ticket #1626):
 	sys/arch/mac68k/mac68k/locore.s: revision 1.146
 in doboot, use "longscratch" as a scratch memory location instead of
 something in the (read-only) text section.  fixes PR 35068.


 To generate a diff of this commit:
 cvs rdiff -r1.144 -r1.144.28.1 src/sys/arch/mac68k/mac68k/locore.s

 Please note that diffs are not public domain; they are subject to the
 copyright notices on the relevant files.

From: Matthias Scheler <tron@netbsd.org>
To: gnats-bugs@NetBSD.org
Cc: 
Subject: PR/35068 CVS commit: [netbsd-3-0] src/sys/arch/mac68k/mac68k
Date: Tue,  9 Jan 2007 22:31:56 +0000 (UTC)

 Module Name:	src
 Committed By:	tron
 Date:		Tue Jan  9 22:31:56 UTC 2007

 Modified Files:
 	src/sys/arch/mac68k/mac68k [netbsd-3-0]: locore.s

 Log Message:
 Pull up following revision(s) (requested by chs in ticket #1626):
 	sys/arch/mac68k/mac68k/locore.s: revision 1.146
 in doboot, use "longscratch" as a scratch memory location instead of
 something in the (read-only) text section.  fixes PR 35068.


 To generate a diff of this commit:
 cvs rdiff -r1.144 -r1.144.26.1 src/sys/arch/mac68k/mac68k/locore.s

 Please note that diffs are not public domain; they are subject to the
 copyright notices on the relevant files.

From: Matthias Scheler <tron@netbsd.org>
To: gnats-bugs@NetBSD.org
Cc: 
Subject: PR/35068 CVS commit: [netbsd-4] src/sys/arch/mac68k/mac68k
Date: Tue,  9 Jan 2007 22:36:04 +0000 (UTC)

 Module Name:	src
 Committed By:	tron
 Date:		Tue Jan  9 22:36:04 UTC 2007

 Modified Files:
 	src/sys/arch/mac68k/mac68k [netbsd-4]: locore.s

 Log Message:
 Pull up following revision(s) (requested by chs in ticket #345):
 	sys/arch/mac68k/mac68k/locore.s: revision 1.146
 in doboot, use "longscratch" as a scratch memory location instead of
 something in the (read-only) text section.  fixes PR 35068.


 To generate a diff of this commit:
 cvs rdiff -r1.145 -r1.145.24.1 src/sys/arch/mac68k/mac68k/locore.s

 Please note that diffs are not public domain; they are subject to the
 copyright notices on the relevant files.

>Unformatted:

Home	PR Database Search