>Number:         34715
>Category:       port-hp700
>Synopsis:       hp700 installer image boots with serial console but not with framebuffer console
>Confidential:   no
>Severity:       serious
>Priority:       medium
>Responsible:    port-hp700-maintainer
>State:          open
>Class:          sw-bug
>Submitter-Id:   net
>Arrival-Date:   Wed Oct 04 17:35:00 +0000 2006
>Originator:     David H. Gutteridge
>Release:        current
>Organization:
>Environment:
NetBSD 4.99.2 (RAMDISK) #2: Mon Oct  2 14:05:05 BST 2006
nick@arthur:/usr/obj/hp700/usr/src-hp700/sys/arch/hp700/compile/RAMDISK
>Description:
If I boot the installer image provided for the disklabel fix (PR34547)
via a serial console, it works fine, it gets to sysinst.  But if I boot
using the framebuffer, a panic occurs.

So, here's the full dmesg as I get from booting via a serial console:

>> NetBSD/hp700 LIF/FFS/LFS Boot, Revision 1.3
>> (nick@arthur, Sun Oct  1 12:22:29 BST 2006)
>> Enter "reset" to reset system.
Boot: [[[lf0a:]netbsd][-a][-c][-d][-s][-v][-q]] :- 
9672976+2764800+471040=0xd162b4
Start @ 0x200000 [1=0xf16000-0xf162b4]...
PDC_CACHE_SETCS: 0, 0, 0, 0 (-2)
SPID bits: 0x0, error = -2
btlb info: minsz=128, maxsz=16384
btlb fixed: i=0, d=0, c=8
btlb varbl: i=0, d=0, c=0
pdc_hwtlb.min_size 0x1000
pdc_hwtlb.max_size 0x80000000
HP9000/778/B180L (Merlin L2+ 180), PA7300LC
  [ BTLB slot 0: r-x--- 0x00200000 @ 0x0:0x00200000 len 0x00200000 ]  
  [ BTLB slot 1: r-x--- 0x00400000 @ 0x0:0x00400000 len 0x00400000 ]  
  [ BTLB slot 2: r-x--- 0x00800000 @ 0x0:0x00800000 len 0x00400000 ]  
  [ BTLB slot 3: rw---- 0x00c00000 @ 0x0:0x00c00000 len 0x00400000 ]  
  [ BTLB slot 4: rw---- 0x01000000 @ 0x0:0x01000000 len 0x01000000 ]  
  [ BTLB slot 5: rw---- 0x02000000 @ 0x0:0x02000000 len 0x01000000 ]  
pdc_coproc: 0xc0, 0xc0
Loaded initial symtab at 0xf16000, strtab at 0x0, # entries 0
Copyright (c) 1996, 1997, 1998, 1999, 2000, 2001, 2002, 2003, 2004, 2005, 2006
    The NetBSD Foundation, Inc.  All rights reserved.
Copyright (c) 1982, 1986, 1989, 1991, 1993
    The Regents of the University of California.  All rights reserved.

NetBSD 4.99.2 (RAMDISK) #2: Mon Oct  2 14:05:05 BST 2006
        nick@arthur:/usr/obj/hp700/usr/src-hp700/sys/arch/hp700/compile/RAMDISK
HP9000/778/B180L (Merlin L2+ 180)
real mem = 512 MB (73728 reserved for PROM, 474 MB used by NetBSD)
avail mem = 466 MB
timecounter: Timecounters tick every 10.000 msec
mainbus0 (root) [flex fff80000]
pdc0 at mainbus0
cpu0 at mainbus0 hpa 0xfffbe000 path 62 irq 31 ipl 0: PA7300LC (Velociraptor) rev 12
cpu0: PCX-L2, PA-RISC 1.1e, lev 1, cat A, 180 MHz clk
cpu0: shadows, 64K/64K D/I caches, 96 shared TLB, 8 shared BTLB
cpu0: VR floating point, rev 1
mem0 at mainbus0 hpa 0xfffbf000 path 63: size 512MB, sltcv a898d000<avwl,edcen,edtag,l2ena>, 1MB L2 cache
phantomas0 at mainbus0 hpa 0xffc00000 path 8
dino0 at phantomas0 hpa 0xfff80000 path 8/0 irq 28 ipl 1: Dino V3.1
pci0 at dino0 bus 0
pci0: i/o space, memory space enabled
esiop0 at pci0 dev 19 function 0: Symbios Logic 53c875 (ultra-wide scsi)
esiop0: using on-board RAM
esiop0: interrupting at irq 3
esiop0: alloc new tag DSA table at PHY addr 0x2eab000
scsibus0 at esiop0: 16 targets, 8 luns per target
tlp0 at pci0 dev 20 function 0: DECchip 21143 Ethernet, pass 3.0
tlp0: interrupting at irq 0
tlp0: Ethernet address xx:xx:xx:xx:xx:xx
lxtphy0 at tlp0 phy 1: LXT970 10/100 media interface, rev. 0
lxtphy0: 10baseT, 10baseT-FDX, 100baseTX, 100baseTX-FDX, auto
lasi0 at phantomas0 hpa 0xffc00000 path 8/16 irq 27: rev 3.0
gsc0 at lasi0
lpt0 at gsc0 hpa 0xffd02000 path 8/16/0 irq 7 ipl 3
harmony0 at gsc0 hpa 0xffd04000 path 8/16/1 irq 13 ipl 4: rev 18
audio0 at harmony0: full duplex
com0 at gsc0 hpa 0xffd05000 path 8/16/4 irq 5 ipl 5: ns16550a, working fifo
com0: console
osiop0 at gsc0 hpa 0xffd06000 path 8/16/5 irq 9 ipl 6: NCR53C710 rev 2, 40MHz, SCSI ID 7
scsibus1 at osiop0: 8 targets, 8 luns per target
gsckbc0 at gsc0 hpa 0xffd08000 path 8/16/7 irq 26 ipl 7: keyboard
pckbd0 at gsckbc0 (kbd slot)
wskbd0 at pckbd0 mux 1
gsckbc1 at gsc0 hpa 0xffd08100 path 8/16/8: mouse
pms0 at gsckbc1 (aux slot)
wsmouse0 at pms0 mux 0
sti0 at phantomas0 hpa 0xf8000000 path 8/24: INTERNAL_EG_640 rev 8.07;9, ID 0x2D08C0A709A02587
sti0: 2048x2048 frame buffer, 640x480x8 display, offset 0x0
sti0: 8x16 font type 1, 16 bpc, charset 0-255
pwr_sw_init: pdc_power_info.addr=0xf0140000
biomask 00000342 netmask 00000346 ttymask 000007ee
pwr_sw_control=0 enable=1
timecounter: Timecounter "clockinterrupt" frequency 100 Hz quality 0
timecounter: selected timecounter "clockinterrupt" frequency 100 Hz quality 0
timecounter: Timecounter "itimer" frequency 180000000 Hz quality 100
timecounter: selected timecounter "itimer" frequency 180000000 Hz quality 100
wsdisplay0 at sti0 kbdmux 1
wsmux1: connecting to wsdisplay0
pckbport_cmd: send error
pckbd: error setting scanset 1
raidattach: Asked for 8 units
Kernelized RAIDframe activated
md0: internal 2048 KB image area
scsibus0: waiting 2 seconds for devices to settle...
scsibus1: waiting 2 seconds for devices to settle...
esiop0: alloc newcdb at PHY addr 0x2eda000
sd0 at scsibus0 target 6 lun 0: <IBM, DDRS-39130WS, HP01> disk fixed
sd0: 8678 MB, 8387 cyl, 10 head, 211 sec, 512 bytes/sect x 17773524 sectors
sd0: sync (50.00ns offset 15), 16-bit (40.000MB/s) transfers, tagged queueing
cd0 at scsibus1 target 2 lun 0: <TOSHIBA, CD-ROM XM-6201TA, 1037> cdrom removable
cd0: sync (100.00ns offset 8), 8-bit (10.000MB/s) transfers
Searching for RAID components...
sd0: fabricating a geometry
PROM boot device: hpa 0xf0fff000 path 8/0/20/0 dp_layers 0x10000/0xffec0030/0x656be3f2/0x27c7fe03/0xc0a80105/0xc0a8010a dp_f2
boot device: tlp0
root on md0a dumps on md0b
mountroot: trying lfs...
mountroot: trying ffs...
root file system type: ffs
WARNING: preposterous TOD clock time
WARNING: using filesystem time
WARNING: CHECK AND RESET THE DATE!
init: copying out flags `-s' 3
init: copying out path `/sbin/init' 11
erase ^H, werase ^W, kill ^U, intr ^C, status ^T
mount_mfs: Unable to determine file system size
Terminal type? [vt100]     
Erase is backspace.                                                     
(I)nstall, (S)hell or (H)alt ? 

And here's the equivalent ending bit I get when I boot using the
framebuffer:

sti0 at phantomas0 hpa 0xf8000000 path 8/24: INTERNAL_EG_640 rev 8.07;9, ID 0x2D08C0A709A02587
sti0: 2048x2048 frame buffer, 640x480x8 display, offset 0x0
sti0: 8x16 font type 1, 16 bpc, charset 0-255
pwr_sw_init: pdc_power_info.addr=0xf0140000
biomask 00000342 netmask 00000346 ttymask 000007ee
pwr_sw_control=0 enable=1
timecounter: Timecounter "clockinterrupt" frequency 100 Hz quality 0
timecounter: selected timecounter "clockinterrupt" frequency 100 Hz quality 0
timecounter: Timecounter "itimer" frequency 180000000 Hz quality 100
timecounter: selected timecounter "itimer" frequency 180000000 Hz quality 100
wsdisplay0 at sti0 kbdmux 1
wsmux1: connecting to wsdisplay0
crypto: assign driver 0, flags 2
crypto: driver 0 registers alg 1 flags 0 maxoplen 0
crypto: driver 0 rinsanity: where 0xdead01 type 0x4 tf 0xf18840 lwp 0xf12804 line 442 sp 0xf18840 pc 0x30ea0b0
Stopped in pid 0.1 (swapper) at 0x30ea0b4:      comiclr,=       0,%r8,%r22
db> bt
>> 32a193c, 30ea0b4, 20 (null)(0,0,0,6238) at 0x30ea0b4
>> 1, 20, 0     (null)(0,0,0,0) at 0x20
kernel: unaligned data ref trap, code=ffffffed
Caught exception in DDB; continuing...
db> 

So I tried:

db> continue
insanity: where 0xdead02 type 0x4 tf 0xf18840 lwp 0xf12804 line 442 sp 0xf18840 pc 0x30ea0b4
Stopped in pid 0.1 (swapper) at 0x30ea0b8:      ldi     1,%r22
db> bt
>> 32a193c, 30ea0b8, 20 (null)(0,0,0,6238) at 0x30ea0b8
>> 1, 20, 0     (null)(0,0,0,0) at 0x20
kernel: unaligned data ref trap, code=ffffffed
Caught exception in DDB; continuing...
db> continue
crypto: driver 0 registers alg 3 flags 0 maxoplen 0
crypto: driver 0 registers alg 4 flags 0 maxoplen 0
crypto: driver 0 registers alg 5 flags 0 maxoplen 0
crypto: driver 0 registers alg 5 flags 0 maxoplen 0insanity: where 0xdead01 type 0x4 tf 0xf18940 lwp 0xf12804 line 442 sp 0xf18940 pc 0x30ea6f4
Stopped in pid 0.1 (swapper) at 0x30ea6f8:    ldw     R'0(%r20),%r10
db> bt
>> 7ff778, 30ea6f8, 1    (null)(4b9c0048,487c0020,4b930050,487c3fb9) at 0x30ea6f8
>> 6b930060, 1, 8140256
db> 

At which point the machine froze and did not accept console input.
I had to yank the power cord to reset it.

>How-To-Repeat:
Try booting an installer image on a B180L using the framebuffer console.
>Fix: