NetBSD Problem Report #59776

From www@netbsd.org  Wed Nov 19 19:22:36 2025
Return-Path: <www@netbsd.org>
Received: from mail.netbsd.org (mail.netbsd.org [199.233.217.200])
	(using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits)
	 key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256
	 client-signature RSA-PSS (2048 bits) client-digest SHA256)
	(Client CN "mail.NetBSD.org", Issuer "mail.NetBSD.org CA" (not verified))
	by mollari.NetBSD.org (Postfix) with ESMTPS id 0D8ED1A9239
	for <gnats-bugs@gnats.NetBSD.org>; Wed, 19 Nov 2025 19:22:36 +0000 (UTC)
Message-Id: <20251119192234.CC5BB1A923A@mollari.NetBSD.org>
Date: Wed, 19 Nov 2025 19:22:34 +0000 (UTC)
From: denis@h3q.com
Reply-To: denis@h3q.com
To: gnats-bugs@NetBSD.org
Subject: 11.0_BETA Kernel from 15.11.25 crashes on MVME17x Board
X-Send-Pr-Version: www-1.0

>Number:         59776
>Category:       port-m68k
>Synopsis:       11.0_BETA Kernel from 15.11.25 crashes on MVME17x Board
>Confidential:   no
>Severity:       serious
>Priority:       medium
>Responsible:    thorpej
>State:          closed
>Class:          sw-bug
>Submitter-Id:   net
>Arrival-Date:   Wed Nov 19 19:25:01 +0000 2025
>Closed-Date:    Fri Nov 21 10:20:37 +0000 2025
>Last-Modified:  Fri Nov 21 10:20:37 +0000 2025
>Originator:     Denis Ahrens
>Release:        NetBSD 11.0_BETA (VME177) #0: Sat Nov 15 10:24:56 UTC 2025
>Organization:
hobby
>Environment:
NetBSD 11.0_BETA (VME177) #0: Sat Nov 15 10:24:56 UTC 2025
>Description:
NetBSD 11.0_BETA Kernel for MVME177 Boards crashes before it mounts the root-fs.

[   1.0000000] memc0 at mainbus0 address 0xfff43000: 32MB ECC Memory Controller Chip (Rev 0)
[   1.0000000] memc0: Base Address: 0x0, Fast RAM Read Disabled
[   1.0000000] memc0: Logging ECC errors at ipl 6
[   1.0000000] memc at mainbus0 address 0xfff43100 not configured
[   1.0000000] WARNING: system needs entropy for security; see entropy(7)
[   1.0096440] Kernel Illegal Instruction trap.
[   1.0096440] trap type 2, code = 0x0, v = 0x0
[   1.0096440] kernel program counter = 0x17bed4
[   1.0096440] pid = 0, lid = 0, pc = 0017BED4, ps = 2500, sfc = 1, dfc = 1
[   1.0096440] Registers:
[   1.0096440]              0        1        2        3        4        5        6        7
[   1.0096440] dreg: 000041A7 00002504 00000FFF 00000005 00000000 00000003 00000015 00000000
[   1.0096440] areg: 00215CD4 003D300A 0017BEC8 0021DDC0 0039ED90 03B0D000 00274D6C FFEFFFFC

[   1.0096440] Kernel stack (00274B90):
[   1.0096440] 274B90: 0000BD26 00274C64 00000080 00000FFF 00000005 00000000 00000003 00000015
[   1.0096440] 274BB0: 00000000 0017BEC8 0021DDC0 0039ED90 03B0D000 00274D6C 00000001 003A9074
[   1.0096440] 274BD0: 00000001 00000000 00000000 00000000 00000000 00000000 00000000 00000000
[   1.0096440] 274BF0: 00000000 00000002 00000000 00000000 00000000 00000000 00000000 00000000
[   1.0096440] 274C10: 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000
[   1.0096440] 274C30: 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000001
[   1.0096440] 274C50: 00008376 00274C64 00000002 00000000 00000000 000041A7 00002504 00000FFF
[   1.0096440] 274C70: 00000005 00000000 00000003 00000015 00000000 00215CD4 003D300A 0017BEC8
[   1.0096440] 274C90: 0021DDC0 0039ED90 03B0D000 00274D6C FFEFFFFC 00000000 25000017 BED400F4
[   1.0096440] 274CB0: 0001216C 00000058 003CF6A0 0000C6CA 00274CD8 00801723 00000000 00002000
[   1.0096440] 274CD0: 00000000 0000C730 03B0D000 00000001 00000000 00000000 2000000A 913C0160
[   1.0096440] 274CF0: 000AA47A 0021DDC0 0039ED90 00274DA8 0021DDC0 FFFFFFFF FFFFFFFF 00801723
[   1.0096440] 274D10: 00800001 00274E2C 00000000 00392BE0 00002000 FFFFFFFF FFFFFFFF 00000002
[   1.0096440] 274D30: 00000007 00000000 00000000 00392BE0 00000000 00000000 00000001 00080172
[   1.0096440] 274D50: 0021DDF0 00000000 000AAB30 0021DDC0 03B0D000 00002000 00000000 00274E30
[   1.0096440] 274D70: 000AAAA8 0021DDC0 00274DA8 00000000 00000003 00000001 0000F886 00000001
[   1.0096440] panic: Illegal instruction
[   1.0096440] rebooting...

checking the faulty mnemonic memory position this is listed:

177-Bug>ds 17bed4:3
0017BED4 4C100C01          MULS.L      (A0),D1:D0
0017BED8 E388              LSL.L       #$1,D0
0017BEDA E591              ROXL.L      #$2,D1
177-Bug>

the mnemonic MULS.L (64bit product) crashes the MC68060 CPU because that is an illegal opcode UNTIL the FPSP is installed (floating point emulation for specific FPU opcodes the MC68060 is missing).

>How-To-Repeat:
just boot again
>Fix:
avoid using the MULS.L opcode

>Release-Note:

>Audit-Trail:
From: Jason Thorpe <thorpej@me.com>
To: gnats-bugs@netbsd.org
Cc: kern-bug-people@netbsd.org,
 gnats-admin@netbsd.org,
 netbsd-bugs@netbsd.org
Subject: Re: kern/59776: 11.0_BETA Kernel from 15.11.25 crashes on MVME17x
 Board
Date: Thu, 20 Nov 2025 07:40:04 +0100

 > On Nov 19, 2025, at 8:25=E2=80=AFPM, denis@h3q.com wrote:
 >=20
 > [   1.0096440] panic: Illegal instruction
 > [   1.0096440] rebooting...
 >=20
 > checking the faulty mnemonic memory position this is listed:
 >=20
 > 177-Bug>ds 17bed4:3
 > 0017BED4 4C100C01          MULS.L      (A0),D1:D0
 > 0017BED8 E388              LSL.L       #$1,D0
 > 0017BEDA E591              ROXL.L      #$2,D1
 > 177-Bug>
 >=20
 > the mnemonic MULS.L (64bit product) crashes the MC68060 CPU because =
 that is an illegal opcode UNTIL the FPSP is installed (floating point =
 emulation for specific FPU opcodes the MC68060 is missing).

 This is curious.  The 060 FPSP should be initialized at this point.  I =
 will take a look to see if something obvious is missing.

 -- thorpej

From: Martin Husemann <martin@duskware.de>
To: gnats-bugs@netbsd.org
Cc: 
Subject: Re: kern/59776: 11.0_BETA Kernel from 15.11.25 crashes on MVME17x
 Board
Date: Thu, 20 Nov 2025 07:45:32 +0100

 On Wed, Nov 19, 2025 at 07:25:01PM +0000, denis@h3q.com wrote:
 > [   1.0000000] memc at mainbus0 address 0xfff43100 not configured
 > [   1.0000000] WARNING: system needs entropy for security; see entropy(7)
 > [   1.0096440] Kernel Illegal Instruction trap.
 > [   1.0096440] trap type 2, code = 0x0, v = 0x0
 > [   1.0096440] kernel program counter = 0x17bed4
 > [   1.0096440] pid = 0, lid = 0, pc = 0017BED4, ps = 2500, sfc = 1, dfc = 1

 According to gdb this should be here:

    0x17becc <bswap64>:  movel %sp@(4),%d1
    0x17bed0 <bswap64+4>:        movel %sp@(8),%d0
    0x17bed4 <bswap64+8>:        rolw #8,%d1
    0x17bed6 <bswap64+10>:       rolw #8,%d0
    0x17bed8 <bswap64+12>:       swap %d1
    0x17beda <bswap64+14>:       swap %d0
    0x17bedc <bswap64+16>:       rolw #8,%d0
    0x17bede <bswap64+18>:       rolw #8,%d1
    0x17bee0 <bswap64+20>:       rts
    0x17bee2:    nop

 and

 0x17bed4 <bswap64+8>:   0xe159e158

 Could this be something later overwritten? Bad RAM?

 Martin

From: Denis Ahrens <denis@h3q.com>
To: gnats-bugs@netbsd.org
Cc: 
Subject: Re: kern/59776: 11.0_BETA Kernel from 15.11.25 crashes on MVME17x
 Board
Date: Thu, 20 Nov 2025 11:27:10 +0100

 > On 20. Nov 2025, at 07:50, Martin Husemann via gnats =
 <gnats-admin@NetBSD.org> wrote:
 >=20
 > The following reply was made to PR kern/59776; it has been noted by =
 GNATS.
 >=20
 > From: Martin Husemann <martin@duskware.de>
 > To: gnats-bugs@netbsd.org
 > Cc:=20
 > Subject: Re: kern/59776: 11.0_BETA Kernel from 15.11.25 crashes on =
 MVME17x
 > Board
 > Date: Thu, 20 Nov 2025 07:45:32 +0100
 >=20
 > On Wed, Nov 19, 2025 at 07:25:01PM +0000, denis@h3q.com wrote:
 >> [   1.0000000] memc at mainbus0 address 0xfff43100 not configured
 >> [   1.0000000] WARNING: system needs entropy for security; see =
 entropy(7)
 >> [   1.0096440] Kernel Illegal Instruction trap.
 >> [   1.0096440] trap type 2, code =3D 0x0, v =3D 0x0
 >> [   1.0096440] kernel program counter =3D 0x17bed4
 >> [   1.0096440] pid =3D 0, lid =3D 0, pc =3D 0017BED4, ps =3D 2500, =
 sfc =3D 1, dfc =3D 1
 >=20
 > According to gdb this should be here:
 >=20
 >    0x17becc <bswap64>:  movel %sp@(4),%d1
 >    0x17bed0 <bswap64+4>:        movel %sp@(8),%d0
 >    0x17bed4 <bswap64+8>:        rolw #8,%d1
 >    0x17bed6 <bswap64+10>:       rolw #8,%d0
 >    0x17bed8 <bswap64+12>:       swap %d1
 >    0x17beda <bswap64+14>:       swap %d0
 >    0x17bedc <bswap64+16>:       rolw #8,%d0
 >    0x17bede <bswap64+18>:       rolw #8,%d1
 >    0x17bee0 <bswap64+20>:       rts
 >    0x17bee2:    nop
 >=20
 > and
 >=20
 > 0x17bed4 <bswap64+8>:   0xe159e158
 >=20
 > Could this be something later overwritten? Bad RAM?

 I did test again with the kernel from end of october and it crashes on a =
 different address with the same error:

 [   1.0096110] Kernel Illegal Instruction trap.
 [   1.0096110] trap type 2, code =3D 0x0, v =3D 0x0
 [   1.0096110] kernel program counter =3D 0x17be0c
 [   1.0096110] pid =3D 0, lid =3D 0, pc =3D 0017BE0C, ps =3D 2500, sfc =3D=
  1, dfc =3D 1
 [   1.0096110] Registers:
 [   1.0096110]              0        1        2        3        4        =
 5        6        7
 [   1.0096110] dreg: 000041A7 00002504 00000FFF 00000005 00000000 =
 00000000 00000000 00000008
 [   1.0096110] areg: 00215BD4 003D300A 0017BE00 004156C0 003979A4 =
 000C0AAC 003979A8 FFEFFFFC

 177-Bug>ds 17be00:10
 0017BE00 203C0000 41A7     MOVE.L      #$41A7,D0
 0017BE06 207C0021 5BD4     MOVEA.L     #$215BD4,A0
 0017BE0C 4C100C01          MULS.L      (A0),D1:D0
 0017BE10 E388              LSL.L       #$1,D0
 0017BE12 E591              ROXL.L      #$2,D1
 0017BE14 D081              ADD.L       D1,D0
 0017BE16 7201              MOVEQ.L     #$1,D1
 0017BE18 D181              ADDX.L      D1,D0
 0017BE1A E288              LSR.L       #$1,D0
 0017BE1C 2080              MOVE.L      D0,(A0)
 0017BE1E 4E75              RTS

Responsible-Changed-From-To: kern-bug-people->thorpej
Responsible-Changed-By: thorpej@NetBSD.org
Responsible-Changed-When: Thu, 20 Nov 2025 14:28:57 +0000
Responsible-Changed-Why:
Looks like there might be a options issue.  Will confirm definitively shortly.


From: Jason Thorpe <thorpej@me.com>
To: denis@h3q.com,
 gnats-bugs@netbsd.org
Cc: kern-bug-people@netbsd.org,
 gnats-admin@netbsd.org,
 netbsd-bugs@netbsd.org
Subject: Re: kern/59776: 11.0_BETA Kernel from 15.11.25 crashes on MVME17x
 Board
Date: Thu, 20 Nov 2025 15:27:12 +0100

 > On Nov 20, 2025, at 7:40=E2=80=AFAM, Jason Thorpe <thorpej@me.com> =
 wrote:
 >=20
 >> the mnemonic MULS.L (64bit product) crashes the MC68060 CPU because =
 that is an illegal opcode UNTIL the FPSP is installed (floating point =
 emulation for specific FPU opcodes the MC68060 is missing).
 >=20
 > This is curious.  The 060 FPSP should be initialized at this point.  I =
 will take a look to see if something obvious is missing.

 Ok, it does look like there might be a dumb problem.  I will confirm for =
 sure later this evening CET.

 -- thorpej

State-Changed-From-To: open->feedback
State-Changed-By: thorpej@NetBSD.org
State-Changed-When: Thu, 20 Nov 2025 18:09:15 +0000
State-Changed-Why:
Waiting for confirmation from originator.


From: "Jason R Thorpe" <thorpej@netbsd.org>
To: gnats-bugs@gnats.NetBSD.org
Cc: 
Subject: PR/59776 CVS commit: src/sys/arch
Date: Thu, 20 Nov 2025 18:05:01 +0000

 Module Name:	src
 Committed By:	thorpej
 Date:		Thu Nov 20 18:05:01 UTC 2025

 Modified Files:
 	src/sys/arch/amiga/conf: files.amiga
 	src/sys/arch/atari/conf: files.atari
 	src/sys/arch/m68k/conf: files.m68k
 	src/sys/arch/m68k/m68k: vectors.c
 	src/sys/arch/mvme68k/conf: files.mvme68k
 	src/sys/arch/mvme68k/mvme68k: machdep.c
 	src/sys/arch/virt68k/conf: files.virt68k
 	src/sys/arch/virt68k/virt68k: machdep.c
 	src/sys/arch/x68k/conf: files.x68k

 Log Message:
 Defflag the M060SP option in one place, and make sure to include opt_m060sp.h
 (and opt_fpsp.h) in the right places.

 PR port-m68k/59776


 To generate a diff of this commit:
 cvs rdiff -u -r1.186 -r1.187 src/sys/arch/amiga/conf/files.amiga
 cvs rdiff -u -r1.125 -r1.126 src/sys/arch/atari/conf/files.atari
 cvs rdiff -u -r1.57 -r1.58 src/sys/arch/m68k/conf/files.m68k
 cvs rdiff -u -r1.3 -r1.4 src/sys/arch/m68k/m68k/vectors.c
 cvs rdiff -u -r1.70 -r1.71 src/sys/arch/mvme68k/conf/files.mvme68k
 cvs rdiff -u -r1.170 -r1.171 src/sys/arch/mvme68k/mvme68k/machdep.c
 cvs rdiff -u -r1.5 -r1.6 src/sys/arch/virt68k/conf/files.virt68k
 cvs rdiff -u -r1.17 -r1.18 src/sys/arch/virt68k/virt68k/machdep.c
 cvs rdiff -u -r1.86 -r1.87 src/sys/arch/x68k/conf/files.x68k

 Please note that diffs are not public domain; they are subject to the
 copyright notices on the relevant files.

State-Changed-From-To: feedback->needs-pullups
State-Changed-By: thorpej@NetBSD.org
State-Changed-When: Thu, 20 Nov 2025 22:28:57 +0000
State-Changed-Why:
Originator confirms original issue fixed; fix needs to go to netbsd-11.


From: "Martin Husemann" <martin@netbsd.org>
To: gnats-bugs@gnats.NetBSD.org
Cc: 
Subject: PR/59776 CVS commit: [netbsd-11] src/sys/arch
Date: Fri, 21 Nov 2025 09:53:26 +0000

 Module Name:	src
 Committed By:	martin
 Date:		Fri Nov 21 09:53:26 UTC 2025

 Modified Files:
 	src/sys/arch/amiga/conf [netbsd-11]: files.amiga
 	src/sys/arch/atari/conf [netbsd-11]: files.atari
 	src/sys/arch/m68k/conf [netbsd-11]: files.m68k
 	src/sys/arch/m68k/m68k [netbsd-11]: vectors.c
 	src/sys/arch/mvme68k/conf [netbsd-11]: files.mvme68k
 	src/sys/arch/mvme68k/mvme68k [netbsd-11]: machdep.c
 	src/sys/arch/virt68k/conf [netbsd-11]: files.virt68k
 	src/sys/arch/virt68k/virt68k [netbsd-11]: machdep.c
 	src/sys/arch/x68k/conf [netbsd-11]: files.x68k

 Log Message:
 Pull up following revision(s) (requested by thorpej in ticket #95):

 	sys/arch/amiga/conf/files.amiga: revision 1.187
 	sys/arch/mvme68k/conf/files.mvme68k: revision 1.71
 	sys/arch/atari/conf/files.atari: revision 1.126
 	sys/arch/x68k/conf/files.x68k: revision 1.87
 	sys/arch/m68k/m68k/vectors.c: revision 1.4
 	sys/arch/mvme68k/mvme68k/machdep.c: revision 1.171
 	sys/arch/m68k/conf/files.m68k: revision 1.58
 	sys/arch/virt68k/virt68k/machdep.c: revision 1.18
 	sys/arch/virt68k/conf/files.virt68k: revision 1.6

 Defflag the M060SP option in one place, and make sure to include opt_m060sp.h
 (and opt_fpsp.h) in the right places.

 PR port-m68k/59776


 To generate a diff of this commit:
 cvs rdiff -u -r1.186 -r1.186.4.1 src/sys/arch/amiga/conf/files.amiga
 cvs rdiff -u -r1.125 -r1.125.4.1 src/sys/arch/atari/conf/files.atari
 cvs rdiff -u -r1.57 -r1.57.4.1 src/sys/arch/m68k/conf/files.m68k
 cvs rdiff -u -r1.3 -r1.3.4.1 src/sys/arch/m68k/m68k/vectors.c
 cvs rdiff -u -r1.69 -r1.69.4.1 src/sys/arch/mvme68k/conf/files.mvme68k
 cvs rdiff -u -r1.165 -r1.165.4.1 src/sys/arch/mvme68k/mvme68k/machdep.c
 cvs rdiff -u -r1.4 -r1.4.4.1 src/sys/arch/virt68k/conf/files.virt68k
 cvs rdiff -u -r1.9 -r1.9.4.1 src/sys/arch/virt68k/virt68k/machdep.c
 cvs rdiff -u -r1.85 -r1.85.2.1 src/sys/arch/x68k/conf/files.x68k

 Please note that diffs are not public domain; they are subject to the
 copyright notices on the relevant files.

State-Changed-From-To: needs-pullups->closed
State-Changed-By: thorpej@NetBSD.org
State-Changed-When: Fri, 21 Nov 2025 10:20:37 +0000
State-Changed-Why:
Pullups complete.


>Unformatted:

Home	PR Database Search