NetBSD Problem Report #59767

From www@netbsd.org  Sun Nov 16 20:05:02 2025
Return-Path: <www@netbsd.org>
Received: from mail.netbsd.org (mail.netbsd.org [199.233.217.200])
	(using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits)
	 key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256
	 client-signature RSA-PSS (2048 bits) client-digest SHA256)
	(Client CN "mail.NetBSD.org", Issuer "mail.NetBSD.org CA" (not verified))
	by mollari.NetBSD.org (Postfix) with ESMTPS id 7E2471A9239
	for <gnats-bugs@gnats.NetBSD.org>; Sun, 16 Nov 2025 20:05:02 +0000 (UTC)
Message-Id: <20251116200500.CA6361A923A@mollari.NetBSD.org>
Date: Sun, 16 Nov 2025 20:05:00 +0000 (UTC)
From: schaecsn@gmx.net
Reply-To: schaecsn@gmx.net
To: gnats-bugs@NetBSD.org
Subject: nouveau driver crashes kernel in  bus_dmamem_unmap
X-Send-Pr-Version: www-1.0

>Number:         59767
>Category:       kern
>Synopsis:       nouveau driver crashes kernel in  bus_dmamem_unmap
>Confidential:   no
>Severity:       serious
>Priority:       medium
>Responsible:    kern-bug-people
>State:          open
>Class:          sw-bug
>Submitter-Id:   net
>Arrival-Date:   Sun Nov 16 20:10:00 +0000 2025
>Last-Modified:  Fri Nov 21 04:45:01 +0000 2025
>Originator:     Stefan Schaeckeler
>Release:        10.1
>Organization:
>Environment:
NetBSD dell 10.1 NetBSD 10.1 (GENERIC) #0: Sat Jan 18 11:07:43 PST 2025  root@dell:/usr/obj/sys/arch/amd64/compile/GENERIC amd64

>Description:
Restarted firefox. Last active tab: youtube.com. Kernel crashes. I did not find a kdump upon boot.

Nvidia GeForce 9500 512MB


bootup (grep for nouveau):

[     1.033666] nouveau0 at pci1 dev 0 function 0: NVIDIA GeForce 9500 GT (rev. 0xa1)
[    22.237610] nouveau0: NVIDIA G96 (096000a1)
[    22.357610] nouveau0: bios: version 62.94.4e.00.00
[    22.377610] nouveau0: interrupting at msi2 vec 0 (nouveau0)
[    22.377610] nouveau0: notice: bios: M0203T not found
[    22.377610] nouveau0: notice: bios: M0203E not matched!
[    22.377610] nouveau0: fb: 512 MiB DDR2
[    22.417610] nouveau0: DRM: VRAM: 512 MiB
[    22.417610] nouveau0: DRM: GART: 1048576 MiB
[    22.417610] nouveau0: DRM: TMDS table version 2.0
[    22.417610] nouveau0: DRM: DCB version 4.0
[    22.417610] nouveau0: DRM: DCB outp 00: 02000300 00000028
[    22.417610] nouveau0: DRM: DCB outp 01: 01000302 00020030
[    22.417610] nouveau0: DRM: DCB outp 02: 04011310 00000028
[    22.417610] nouveau0: DRM: DCB outp 03: 02022332 00020010
[    22.417610] nouveau0: DRM: DCB conn 00: 00001030
[    22.417610] nouveau0: DRM: DCB conn 01: 00000100
[    22.417610] nouveau0: DRM: DCB conn 02: 00002261
[    22.427612] nouveau0: DRM: MM: using CRYPT for buffer copies
[    22.527611] nouveaufb0 at nouveau0
[    22.527611] [drm] Initialized nouveau 1.3.1 20120801 for nouveau0 on minor 0
[    22.527611] nouveaufb0: framebuffer at 0xc0006000, size 1920x1080, depth 32, stride 7680
[    24.527620] nouveau0: autoconfiguration error: error: DRM: core notifier timeout
[    26.527629] nouveau0: autoconfiguration error: error: DRM: base-0: timeout
[    26.937631] wsdisplay0 at nouveaufb0 kbdmux 1: console (default, vt100 emulation), using wskbd0

...

crash - last lines from dmesg

[ 747296.261851] uvm_fault(0xffffe0e3d5166650, 0x0, 1) -> e
[ 747296.261851] fatal page fault in supervisor mode
[ 747296.261851] trap type 6 code 0 rip 0xffffffff805646d3 cs 0x8 rflags 0x10246 cr2 0x11 ilevel 0 rsp 0xffff8981fb5f4b08
[ 747296.261851] curlwp 0xffffe0e35f3bf5c0 pid 16513.15236 lowest kstack 0xffff8981fb5f02c0
[ 747296.261851] panic: trap
[ 747296.261851] cpu0: Begin traceback...
[ 747296.261851] vpanic() at netbsd:vpanic+0x183
[ 747296.261851] panic() at netbsd:panic+0x3c
[ 747296.261851] trap() at netbsd:trap+0xbaf
[ 747296.271851] --- trap (number 6) ---
[ 747296.271851] bus_dmamem_unmap() at netbsd:bus_dmamem_unmap+0x9
[ 747296.271851] nvkm_object_dtor() at netbsd:nvkm_object_dtor+0x92
[ 747296.271851] nvkm_object_del() at netbsd:nvkm_object_del+0x20
[ 747296.271851] nvkm_ioctl_del() at netbsd:nvkm_ioctl_del+0x8b
[ 747296.281851] nvkm_ioctl() at netbsd:nvkm_ioctl+0x100
[ 747296.281851] nvif_object_fini() at netbsd:nvif_object_fini+0x53
[ 747296.281851] nouveau_mem_fini() at netbsd:nouveau_mem_fini+0x56
[ 747296.281851] nouveau_mem_del() at netbsd:nouveau_mem_del+0x14
[ 747296.281851] ttm_bo_release() at netbsd:ttm_bo_release+0x302
[ 747296.281851] drm_gem_object_release_handle() at netbsd:drm_gem_object_release_handle+0x75
[ 747296.291850] drm_gem_handle_delete() at netbsd:drm_gem_handle_delete+0x5c
[ 747296.291850] drm_ioctl() at netbsd:drm_ioctl+0x3fb
[ 747296.291850] drm_ioctl_shim() at netbsd:drm_ioctl_shim+0x25
[ 747296.291850] sys_ioctl() at netbsd:sys_ioctl+0x56e
[ 747296.291850] syscall() at netbsd:syscall+0x1fc
[ 747296.291850] --- syscall (number 54) ---
[ 747296.291850] netbsd:syscall+0x1fc:
[ 747296.291850] cpu0: End traceback...

[ 747296.301858] dumping to dev 0,1 (offset=29395663, size=1568422):
[ 747296.301858] dump
>How-To-Repeat:

>Fix:

>Audit-Trail:
From: Stefan Schaeckeler <schaecsn@gmx.net>
To: gnats-bugs@netbsd.org
Cc: 
Subject: Re: kern/59767: nouveau driver crashes kernel in bus_dmamem_unmap
Date: Thu, 20 Nov 2025 20:43:10 -0800

 > Restarted firefox. Last active tab: youtube.com. Kernel crashes. I did n=
 ot find a kdump upon boot.

 > Nvidia GeForce 9500 512MB

 4 days later, the next kernel crash in the nouveau driver (no kdump).

 Activity: firefox in the background (no multimedia website), thunderbird s=
 ending out an email.


 [ 469922.104316] panic: pmap_pv_remove: page not pv-tracked: 0xd5a80000
 [ 469922.104316] cpu1: Begin traceback...
 [ 469922.104316] vpanic() at netbsd:vpanic+0x183
 [ 469922.104316] panic() at netbsd:panic+0x3c
 [ 469922.104316] pmap_pv_remove() at netbsd:pmap_pv_remove+0x74
 [ 469922.104316] ttm_bo_unmap_virtual_locked() at netbsd:ttm_bo_unmap_virt=
 ual_locked+0x3e
 [ 469922.114316] ttm_bo_handle_move_mem() at netbsd:ttm_bo_handle_move_mem=
 +0xa4
 [ 469922.114316] ttm_mem_evict_first() at netbsd:ttm_mem_evict_first+0x64d
 [ 469922.114316] ttm_bo_mem_space() at netbsd:ttm_bo_mem_space+0x21e
 [ 469922.114316] ttm_bo_validate() at netbsd:ttm_bo_validate+0xe6
 [ 469922.114316] ttm_bo_init_reserved() at netbsd:ttm_bo_init_reserved+0x3=
 23
 [ 469922.124316] ttm_bo_init() at netbsd:ttm_bo_init+0x65
 [ 469922.124316] nouveau_bo_init() at netbsd:nouveau_bo_init+0xb0
 [ 469922.124316] nouveau_gem_new() at netbsd:nouveau_gem_new+0xd6
 [ 469922.124316] nouveau_gem_ioctl_new() at netbsd:nouveau_gem_ioctl_new+0=
 x4a
 [ 469922.124316] drm_ioctl() at netbsd:drm_ioctl+0x246
 [ 469922.124316] drm_ioctl_shim() at netbsd:drm_ioctl_shim+0x25
 [ 469922.134316] sys_ioctl() at netbsd:sys_ioctl+0x56e
 [ 469922.134316] syscall() at netbsd:syscall+0x1fc
 [ 469922.134316] --- syscall (number 54) ---
 [ 469922.134316] netbsd:syscall+0x1fc:
 [ 469922.134316] cpu1: End traceback...

 [ 469922.134316] dumping to dev 0,1 (offset=3D29395663, size=3D1568422):
 [ 469922.134316] dump=20

 ~ Stefan

Home	PR Database Search