NetBSD Problem Report #48492
From www@NetBSD.org Fri Jan 3 03:41:57 2014
Return-Path: <www@NetBSD.org>
Received: from mail.netbsd.org (mail.netbsd.org [149.20.53.66])
(using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits))
(Client CN "mail.NetBSD.org", Issuer "Postmaster NetBSD.org" (not verified))
by mollari.NetBSD.org (Postfix) with ESMTPS id 4210DA61B7
for <gnats-bugs@gnats.NetBSD.org>; Fri, 3 Jan 2014 03:41:57 +0000 (UTC)
Message-Id: <20140103034155.8C26FA646A@mollari.NetBSD.org>
Date: Fri, 3 Jan 2014 03:41:55 +0000 (UTC)
From: nullnilaki@gmail.com
Reply-To: nullnilaki@gmail.com
To: gnats-bugs@NetBSD.org
Subject: sys/dev/wscons/wsdisplay_glyphcache.c/glyphcache_wipe causes kernel panic.
X-Send-Pr-Version: www-1.0
>Number: 48492
>Category: kern
>Synopsis: sys/dev/wscons/wsdisplay_glyphcache.c/glyphcache_wipe causes kernel panic.
>Confidential: no
>Severity: critical
>Priority: high
>Responsible: macallan
>State: closed
>Class: sw-bug
>Submitter-Id: net
>Arrival-Date: Fri Jan 03 03:45:00 +0000 2014
>Closed-Date: Wed Apr 30 02:28:55 +0000 2014
>Last-Modified: Wed Apr 30 02:28:55 +0000 2014
>Originator: nullnilaki
>Release: NetBSD 6.99.28 (GENERIC-$Revision: 1.356 $) #0: Wed Jan 1
>Organization:
Japan
>Environment:
NetBSD 6.99.28 NetBSD 6.99.28 (GENERIC-$Revision: 1.356 $) #0: Wed Jan 1
21:32:40 JST 2014
naruaki@NetBSD:/usr/current/obj.alpha/sys/arch/alpha/compile/GENERIC alpha
>Description:
1.Defined RADEONFB_DEFAULT_DEPTH 32 in radeonfb.
http://nxr.netbsd.org/xref/src/sys/dev/pci/radeonfb.c#104
2.Use Video modes 1920x1200 display.
3.rd_stride is 7680.(1920 * 4).
http://nxr.netbsd.org/xref/src/sys/dev/pci/radeonfb.c#845
4.glyphcache_init is called.
http://nxr.netbsd.org/xref/src/sys/dev/pci/radeonfb.c#927
5.Third argument to glyphcache_init (int lines) is -112.
(0x800000 / 7680) - (1200 + 4) = -112.
6.If lines is under than zero,buckets is zero and return ENOMEM.
http://nxr.netbsd.org/source/xref/src/sys/dev/wscons/wsdisplay_glyphcache.c#70
70 if (lines < 0) lines = 0;
71 cache_lines = lines / cellheight; -> 0
72 gc->gc_numcells = cache_lines * gc->gc_cellsperline; -> 0
73
74 /* now allocate buckets */
75 buckets = (gc->gc_numcells / 223); -> 0
76 if ((buckets * 223) < gc->gc_numcells) ->false
77 buckets++;
78
79 /*
80 * if we don't have enough video memory to cache at least a few glyphs
81 * we stop right here
82 */
83 if (buckets < 1) -> true
84 return ENOMEM;
7.glyphcache_wipe is called in radeonfb.
http://nxr.netbsd.org/xref/src/sys/dev/pci/radeonfb.c#1127
8.Illegal memory access because gc->gc_buckets[0].gb_index is not allocated.
http://nxr.netbsd.org/source/xref/src/sys/dev/wscons/wsdisplay_glyphcache.c#127
----------------------------------------------------
Please see.
http://p.twipple.jp/lEJO3
(Sorry I cannot trace on console).
----------------------------------------------------
radeonfb0 at pci1 dev 7 function 0: ATI Technologies Radeon 7500 QW (rev. 0x00)
radeonfb0: Found 48 KB Legacy BIOS
radeonfb0: refclk = 27.000 MHz, refdiv = 8 minpll = 200000, maxpll = 350000
radeonfb0: 64 MB aperture at 0x40000000, 64 KB registers at 0x01080000
radeonfb0: display 0: initial virtual resolution 1920x1200 at 32 bpp
radeonfb0: port 0: physical 1920x1200 60Hz
radeonfb0: port 1: physical 1920x1200 60Hz
stride: 7680
lines -112
gc->gc_cellwidth 12
gc->gc_cellheight 22
gc->gc_firstline 1204
gc->gc_cellsperline 160
lines 0
cache_lines 0
gc->gc_numcells 0
buckets 0
wsdisplay0 at radeonfb0 kbdmux 1: console (fb, vt100 emulation), using wskbd0
>How-To-Repeat:
>Fix:
Sorry...
>Release-Note:
>Audit-Trail:
Responsible-Changed-From-To: kern-bug-people->macallan
Responsible-Changed-By: tsutsui@NetBSD.org
Responsible-Changed-When: Mon, 13 Jan 2014 15:15:34 +0000
Responsible-Changed-Why:
Can you take a look at this PR as an author?
It looks glyphcache functions should handle ENOMEM case properly.
From: "Michael Lorenz" <macallan@netbsd.org>
To: gnats-bugs@gnats.NetBSD.org
Cc:
Subject: PR/48492 CVS commit: src/sys/dev/wscons
Date: Mon, 13 Jan 2014 19:30:33 +0000
Module Name: src
Committed By: macallan
Date: Mon Jan 13 19:30:33 UTC 2014
Modified Files:
src/sys/dev/wscons: wsdisplay_glyphcache.c
Log Message:
try not to crash when calling glyphcache_wipe() on an uninitialized cache
first step to fix PR 48492
To generate a diff of this commit:
cvs rdiff -u -r1.5 -r1.6 src/sys/dev/wscons/wsdisplay_glyphcache.c
Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.
From: "Michael Lorenz" <macallan@netbsd.org>
To: gnats-bugs@gnats.NetBSD.org
Cc:
Subject: PR/48492 CVS commit: src/sys/dev/pci
Date: Tue, 14 Jan 2014 01:35:13 +0000
Module Name: src
Committed By: macallan
Date: Tue Jan 14 01:35:13 UTC 2014
Modified Files:
src/sys/dev/pci: radeonfb.c
Log Message:
- move cursor area to the end of each display's chunk of fb RAM
- use memory between display and cursor as glyph cache instead of blindly
trying to use 8MB
should fix PR 48492
To generate a diff of this commit:
cvs rdiff -u -r1.79 -r1.80 src/sys/dev/pci/radeonfb.c
Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.
From: "Naruaki.Etomi" <nullnilaki@gmail.com>
To: gnats-bugs@netbsd.org
Cc: macallan@netbsd.org, tsutsui@netbsd.org
Subject: Re: PR/48492 CVS commit: src/sys/dev/pci
Date: Sun, 19 Jan 2014 00:26:05 +0900
Dear Mr.Lorenz
Thank you for your mail!
I am very glad, because radeonfb work fine on AlphaStation.
--------------------------------------------------------------------------------------
radeonfb0 at pci1 dev 7 function 0: ATI Technologies Radeon 7500 QW (rev. 0x00)
radeonfb0: Found 48 KB Legacy BIOS
radeonfb0: refclk = 27.000 MHz, refdiv = 8 minpll = 200000, maxpll = 350000
radeonfb0: 64 MB aperture at 0x40000000, 64 KB registers at 0x01080000
radeonfb0: display 0: initial virtual resolution 1920x1200 at 32 bpp
radeonfb0: using 32 MB per display
radeonfb0: port 0: physical 1920x1200 60Hz
radeonfb0: port 1: physical 1920x1200 60Hz
wsdisplay0 at radeonfb0 kbdmux 1: console (fb, vt100 emulation), using wskbd0
wsmux1: connecting to wsdisplay0
--------------------------------------------------------------------------------------
Please see the pictures below
Twitter clients /pkgsrc/net/tw on mlterm-fb framebuffer console without X server
https://twitter.com/nullnilaki/status/424370741258096641/photo/1
Twitter clients /pkgsrc/net/mikutter on Xorg with radeonfb and wsfb driver.
https://twitter.com/nullnilaki/status/424380535062790144/photo/1
--------------------------------------------------------------------------------------
I cannot speak English very well, but I have some questions.
Why I used to "32bpp display mode" because Xorg with wsfb driver is
wrong on "8bpp display mode" and Xorg's radeon driver is wrong on
alpha.
--------------------------------------------------------------------------------------
Please read the send-pr.
http://gnats.netbsd.org/cgi-bin/query-pr-single.pl?number=48431
Please see the pictures below
https://twitter.com/nullnilaki/status/407561289502703616/photo/1
--------------------------------------------------------------------------------------
I guess radeonfb_getcmap function and radeonfb_putcmap function hasn't
been implemented yet.
It is a very difficult to implement radeonfb_getcmap function and
radeonfb_putcmap function for me.
If possible, would you be able to improvements to radeonfb?
I am looking forward to hearing from you soon.
Sincerely,
Naruaki Etomi
--
nullnilaki@gmail.com
State-Changed-From-To: open->feedback
State-Changed-By: dholland@NetBSD.org
State-Changed-When: Sat, 26 Apr 2014 04:33:28 +0000
State-Changed-Why:
Is this issue fixed? (There have been other more recent radeon alpha fixes)
From: "Naruaki.Etomi" <nullnilaki@gmail.com>
To: gnats-bugs@netbsd.org
Cc: dholland@netbsd.org, Michael <macallan@netbsd.org>
Subject: Re: kern/48492 (sys/dev/wscons/wsdisplay_glyphcache.c/glyphcache_wipe
causes kernel panic.)
Date: Wed, 30 Apr 2014 00:08:40 +0900
Dear macallan and Dear dholland.
>Is this issue fixed? (There have been other more recent radeon alpha fixes)
No problem.
I think that macallan-san's work is wonderful!
8bpp mode:
------------------------------------------------
Copyright (c) 1996, 1997, 1998, 1999, 2000, 2001, 2002, 2003, 2004, 2005,
2006, 2007, 2008, 2009, 2010, 2011, 2012, 2013, 2014
The NetBSD Foundation, Inc. All rights reserved.
Copyright (c) 1982, 1986, 1989, 1991, 1993
The Regents of the University of California. All rights reserved.
NetBSD 6.99.40 (GENERIC-$Revision: 1.358 $) #4: Tue Apr 29 14:09:37 UTC 2014
naruaki@:/usr/obj.alpha/sys/arch/alpha/compile/GENERIC
AlphaStation DS15, 1000MHz, s/n AY42501857
8192 byte page size, 1 processor.
total memory = 512 MB
(2880 KB reserved for PROM, 509 MB used by NetBSD)
avail memory = 490 MB
timecounter: Timecounters tick every 0.976 msec
mainbus0 (root)
cpu0 at mainbus0: ID 0 (primary), 21264C-6
cpu0: Architecture extensions: 0x1307<PAT,MVI,CIX,FIX,BWX>
tsc0 at mainbus0: 21274 Core Logic Chipset, Cchip rev 0
tsc0: 2 Dchips, 1 memory bus of 16 bytes
tsc0: arrays present: 512MB, 0MB, 0MB, 0MB, Dchip 0 rev 1
tsp0 at tsc0
pci0 at tsp0 bus 0
pci0: i/o space, memory space enabled, rd/line, rd/mult, wr/inv ok
sio0 at pci0 dev 7 function 0: Acer Labs M1533 PCI-ISA Bridge (rev. 0xc3)
ahc0 at pci0 dev 8 function 0: Adaptec aic7899 Ultra160 SCSI adapter
ahc0: interrupting at dec 6600 irq 13
ahc0: aic7899: Ultra160 Wide Channel A, SCSI Id=7, 32/253 SCBs
scsibus0 at ahc0: 16 targets, 8 luns per target
ahc1 at pci0 dev 8 function 1: Adaptec aic7899 Ultra160 SCSI adapter
ahc1: interrupting at dec 6600 irq 12
ahc1: aic7899: Ultra160 Wide Channel B, SCSI Id=7, 32/253 SCBs
scsibus1 at ahc1: 16 targets, 8 luns per target
fxp0 at pci0 dev 9 function 0: Intel i82559ER Ethernet (rev. 0x09)
fxp0: interrupting at dec 6600 irq 28
fxp0: May need receiver lock-up workaround
fxp0: Ethernet address 00:0f:20:2b:e1:24
inphy0 at fxp0 phy 1: i82555 10/100 media interface, rev. 4
inphy0: 10baseT, 10baseT-FDX, 100baseTX, 100baseTX-FDX, auto
fxp1 at pci0 dev 10 function 0: Intel i82559ER Ethernet (rev. 0x09)
fxp1: interrupting at dec 6600 irq 4
fxp1: May need receiver lock-up workaround
fxp1: Ethernet address 00:0f:20:2b:e1:23
inphy1 at fxp1 phy 1: i82555 10/100 media interface, rev. 4
inphy1: 10baseT, 10baseT-FDX, 100baseTX, 100baseTX-FDX, auto
aceride0 at pci0 dev 13 function 0: Acer Labs M5229 UDMA IDE
Controller (rev. 0xc1)
aceride0: bus-master DMA support present
aceride0: using PIO transfers above 137GB as workaround for 48bit DMA
access bug, expect reduced performance
aceride0: primary channel configured to compatibility mode
aceride0: primary channel interrupting at isa irq 14
atabus0 at aceride0 channel 0
aceride0: secondary channel configured to compatibility mode
aceride0: secondary channel interrupting at isa irq 15
atabus1 at aceride0 channel 1
isa0 at sio0
com0 at isa0 port 0x3f8-0x3ff irq 4: ns16550a, working fifo
com1 at isa0 port 0x2f8-0x2ff irq 3: ns16550a, working fifo
pckbc0 at isa0 port 0x60-0x64
pckbd0 at pckbc0 (kbd slot)
pckbc0: using irq 1 for kbd slot
wskbd0 at pckbd0: console keyboard
pms0 at pckbc0 (aux slot)
pckbc0: using irq 12 for aux slot
wsmouse0 at pms0 mux 0
attimer0 at isa0 port 0x40-0x43
pcppi0 at isa0 port 0x61
midi0 at pcppi0: PC speaker
spkr0 at pcppi0
isabeep0 at pcppi0
fdc0 at isa0 port 0x3f0-0x3f7 irq 6 drq 2
mcclock0 at isa0 port 0x70-0x71: mc146818 compatible time-of-day clock
attimer0: attached to pcppi0
tsp1 at tsc0
pci1 at tsp1 bus 0
pci1: i/o space, memory space enabled, rd/line, rd/mult, wr/inv ok
radeonfb0 at pci1 dev 7 function 0: ATI Technologies Radeon 7500 QW (rev. 0x00)
radeonfb0: Found 48 KB Legacy BIOS
radeonfb0: refclk = 27.000 MHz, refdiv = 8 minpll = 200000, maxpll = 350000
radeonfb0: 64 MB aperture at 0x40000000, 64 KB registers at 0x01080000
radeonfb0: display 0: initial virtual resolution 1920x1200 at 8 bpp
radeonfb0: using 32 MB per display
radeonfb0: port 0: physical 1920x1200 60Hz
radeonfb0: port 1: physical 1920x1200 60Hz
wsdisplay0 at radeonfb0 kbdmux 1: console (fb, vt100 emulation), using wskbd0
wsmux1: connecting to wsdisplay0
drm at radeonfb0 not configured
esiop0 at pci1 dev 8 function 0: Symbios Logic 53c895 (ultra2-wide scsi)
------------------------------------------------
32bpp mode:
------------------------------------------------
Copyright (c) 1996, 1997, 1998, 1999, 2000, 2001, 2002, 2003, 2004, 2005,
2006, 2007, 2008, 2009, 2010, 2011, 2012, 2013, 2014
The NetBSD Foundation, Inc. All rights reserved.
Copyright (c) 1982, 1986, 1989, 1991, 1993
The Regents of the University of California. All rights reserved.
NetBSD 6.99.40 (GENERIC-$Revision: 1.358 $) #2: Tue Apr 29 05:11:44 UTC 2014
naruaki@:/usr/obj.alpha/sys/arch/alpha/compile/GENERIC
AlphaStation DS15, 1000MHz, s/n AY42501857
8192 byte page size, 1 processor.
total memory = 512 MB
(2880 KB reserved for PROM, 509 MB used by NetBSD)
avail memory = 490 MB
timecounter: Timecounters tick every 0.976 msec
mainbus0 (root)
cpu0 at mainbus0: ID 0 (primary), 21264C-6
cpu0: Architecture extensions: 0x1307<PAT,MVI,CIX,FIX,BWX>
tsc0 at mainbus0: 21274 Core Logic Chipset, Cchip rev 0
tsc0: 2 Dchips, 1 memory bus of 16 bytes
tsc0: arrays present: 512MB, 0MB, 0MB, 0MB, Dchip 0 rev 1
tsp0 at tsc0
pci0 at tsp0 bus 0
pci0: i/o space, memory space enabled, rd/line, rd/mult, wr/inv ok
sio0 at pci0 dev 7 function 0: Acer Labs M1533 PCI-ISA Bridge (rev. 0xc3)
ahc0 at pci0 dev 8 function 0: Adaptec aic7899 Ultra160 SCSI adapter
ahc0: interrupting at dec 6600 irq 13
ahc0: aic7899: Ultra160 Wide Channel A, SCSI Id=7, 32/253 SCBs
scsibus0 at ahc0: 16 targets, 8 luns per target
ahc1 at pci0 dev 8 function 1: Adaptec aic7899 Ultra160 SCSI adapter
ahc1: interrupting at dec 6600 irq 12
ahc1: aic7899: Ultra160 Wide Channel B, SCSI Id=7, 32/253 SCBs
scsibus1 at ahc1: 16 targets, 8 luns per target
fxp0 at pci0 dev 9 function 0: Intel i82559ER Ethernet (rev. 0x09)
fxp0: interrupting at dec 6600 irq 28
fxp0: May need receiver lock-up workaround
fxp0: Ethernet address 00:0f:20:2b:e1:24
inphy0 at fxp0 phy 1: i82555 10/100 media interface, rev. 4
inphy0: 10baseT, 10baseT-FDX, 100baseTX, 100baseTX-FDX, auto
fxp1 at pci0 dev 10 function 0: Intel i82559ER Ethernet (rev. 0x09)
fxp1: interrupting at dec 6600 irq 4
fxp1: May need receiver lock-up workaround
fxp1: Ethernet address 00:0f:20:2b:e1:23
inphy1 at fxp1 phy 1: i82555 10/100 media interface, rev. 4
inphy1: 10baseT, 10baseT-FDX, 100baseTX, 100baseTX-FDX, auto
aceride0 at pci0 dev 13 function 0: Acer Labs M5229 UDMA IDE
Controller (rev. 0xc1)
aceride0: bus-master DMA support present
aceride0: using PIO transfers above 137GB as workaround for 48bit DMA
access bug, expect reduced performance
aceride0: primary channel configured to compatibility mode
aceride0: primary channel interrupting at isa irq 14
atabus0 at aceride0 channel 0
aceride0: secondary channel configured to compatibility mode
aceride0: secondary channel interrupting at isa irq 15
atabus1 at aceride0 channel 1
isa0 at sio0
com0 at isa0 port 0x3f8-0x3ff irq 4: ns16550a, working fifo
com1 at isa0 port 0x2f8-0x2ff irq 3: ns16550a, working fifo
pckbc0 at isa0 port 0x60-0x64
pckbd0 at pckbc0 (kbd slot)
pckbc0: using irq 1 for kbd slot
wskbd0 at pckbd0: console keyboard
pms0 at pckbc0 (aux slot)
pckbc0: using irq 12 for aux slot
wsmouse0 at pms0 mux 0
attimer0 at isa0 port 0x40-0x43
pcppi0 at isa0 port 0x61
midi0 at pcppi0: PC speaker
spkr0 at pcppi0
isabeep0 at pcppi0
fdc0 at isa0 port 0x3f0-0x3f7 irq 6 drq 2
mcclock0 at isa0 port 0x70-0x71: mc146818 compatible time-of-day clock
attimer0: attached to pcppi0
tsp1 at tsc0
pci1 at tsp1 bus 0
pci1: i/o space, memory space enabled, rd/line, rd/mult, wr/inv ok
radeonfb0 at pci1 dev 7 function 0: ATI Technologies Radeon 7500 QW (rev. 0x00)
radeonfb0: Found 48 KB Legacy BIOS
radeonfb0: refclk = 27.000 MHz, refdiv = 8 minpll = 200000, maxpll = 350000
radeonfb0: 64 MB aperture at 0x40000000, 64 KB registers at 0x01080000
radeonfb0: display 0: initial virtual resolution 1920x1200 at 32 bpp
radeonfb0: using 32 MB per display
radeonfb0: port 0: physical 1920x1200 60Hz
radeonfb0: port 1: physical 1920x1200 60Hz
wsdisplay0 at radeonfb0 kbdmux 1: console (fb, vt100 emulation), using wskbd0
wsmux1: connecting to wsdisplay0
drm at radeonfb0 not configured
esiop0 at pci1 dev 8 function 0: Symbios Logic 53c895 (ultra2-wide scsi)
------------------------------------------------
screen capture:
------------------------------------------------
https://twitter.com/nullnilaki/status/461148158278369280/photo/1
------------------------------------------------
That's very nice of you!
--
Naruaki.Etomi
nullnilaki@gmail.com
State-Changed-From-To: feedback->closed
State-Changed-By: dholland@NetBSD.org
State-Changed-When: Wed, 30 Apr 2014 02:28:55 +0000
State-Changed-Why:
It works! Yay :-)
>Unformatted:
(Contact us)
$NetBSD: query-full-pr,v 1.39 2013/11/01 18:47:49 spz Exp $
$NetBSD: gnats_config.sh,v 1.8 2006/05/07 09:23:38 tsutsui Exp $
Copyright © 1994-2007
The NetBSD Foundation, Inc. ALL RIGHTS RESERVED.