Subject: port-x68k/36567: Panic when booting kernel after Jun 12 2007
To: None <port-x68k-maintainer@netbsd.org, gnats-admin@netbsd.org,>
From: None <oshima-ya@yagoto-urayama.jp>
List: netbsd-bugs
Date: 06/27/2007 16:25:00
>Number:         36567
>Category:       port-x68k
>Synopsis:       Panic when booting kernel after Jun 12 2007
>Confidential:   no
>Severity:       critical
>Priority:       high
>Responsible:    port-x68k-maintainer
>State:          open
>Class:          sw-bug
>Submitter-Id:   net
>Arrival-Date:   Wed Jun 27 16:25:00 +0000 2007
>Originator:     Yasushi Oshima
>Release:        NetBSD 4.99.21
>Organization:
>Environment:
NetBSD x68030 4.99.21 NetBSD 4.99.21 (GENERIC) #1: Thu Jun 27 04:30:47 JST 2007
root@sweety:/usr/src/sys/arch/x68k/compile/GENERIC x68k

>Description:
After changing sys/arch/x68k/x68k/{trap.c,locore.s} with http://mail-index.netbsd.org/source-changes/2007/06/12/0000.html, 
kernel panic occurs when booting.

uvm_fault(0x1d4970, 0x206f0000, 0x1) -> 0xe
  type 8, code [mmu,,ssw]: 401076d
trap type 8, code = 0x401076d, v = 0x206f0086
kernel program counter = 0xd571a
kernel: MMU fault trap
pid = 2, lid = 1, pc = 000D571A, ps = 2100, sfc = 1, dfc = 1
Registers:
             0        1        2        3        4        5        6        7
dreg: 02465A80 00000000 02469C18 7FFFFFFF FFFFFFFF 02464F50 00000000 00000000
areg: 206F003C 007C5FF0 0014911E 001E5428 02469C08 00000000 02CFFE14 FFFFCFFC

Kernel stack (02CFFBF8):
CFFBF8: 0014C98C 02CFFC80 00000080 02469C18 7FFFFFFF FFFFFFFF 02464F50 00000000
CFFC18: 00000000 0014911E 001E5428 02469C08 00000000 00000001 001E5428 00000000
CFFC38: 00000001 00000000 00000000 00000000 00000001 00000000 00000000 00000008
CFFC58: 00000000 00000000 00000000 00000000 02CFFE14 00000054 02CFFC80 00000008
CFFC78: 0401076D 206F0086 02465A80 00000000 02469C18 7FFFFFFF FFFFFFFF 02464F50
CFFC98: 00000000 00000000 206F003C 007C5FF0 0014911E 001E5428 02469C08 00000000
CFFCB8: 02CFFE14 FFFFCFFC 00000000 2100000D 571AB008 16EA076D 6DC0082C 206F0086
CFFCD8: 206F0086 206F003C 4A68004A 000D5722 000D5720 000D571E 206FFFFF 004A0040
CFFCF8: 000FF6EC 206F003C 00000000 00000040 00000040 A0200000 206F0086 00000000
CFFD18: 02465A80 02CFFD18 02469C40 02469C20 00149138 0000000A 00000000 02465A80
CFFD38: 02469C08 000E21E4 00000000 00000000 00000000 00000000 00000000 00000000
CFFD58: 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000
CFFD78: 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000
CFFD98: 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000
CFFDB8: 00000000 00000000 00000000 00000000 00000000 00000000 02CFFDDC 000FA1C6
CFFDD8: 007C5F90 02CFFE20 000FB0F2 001E5ED0 001E5ED0 02CFFE3C 007C5F90 02465A80
panic: MMU fault
Stopped in pid 2.1 (scsibus0) at        netbsd:cpu_Debugger+0x6:        unlk    a6
db> bt
cpu_Debugger(206f2100,8,fcec2,2cffc04,2cffc68) + 6
panic(1ae302,2469c18,7fffffff,ffffffff,2464f50) + 118
trap(2cffc80,8,401076d,206f0086) + 258
coredump(2465a80,0,2469c20) + c0
sigexit(2465a80,a) + d4
postsig(a,80,2469c08,2465a80,2469c08) + d2
lwp_userret(2465a80) + e6
trap(9,0,0) + 34e
rei(?)
mutex_vector_exit(1e65a8) + 9c
lwp_startup(2465c00,2465a80) + 1e
lwp_trampoline() + 4
db> ps
 PID           PPID     PGRP        UID S   FLAGS LWPS          COMMAND    WAIT
>2                0        0          0 2 0x20002    1         scsibus0
 1                0        0          0 2 0x20000    1             init initexe
 0               -1        0          0 2 0x20002    2           system       *
db> 

>How-To-Repeat:
Boot GENERIC kernel of NetBSD/x68k 4.99.21.

>Fix:
--- sys/arch/x68k/x68k/locore.s 12 Jun 2007 03:34:33 -0000      1.79
+++ sys/arch/x68k/x68k/locore.s 27 Jun 2007 15:41:55 -0000
@@ -721,8 +721,9 @@
        clrl    %sp@-                   | VA == none
        clrl    %sp@-                   | code == none
        movl    #T_SSIR,%sp@-           | type == software interrupt
+       pea     %sp@(12)                | fp = trap frame address
        jbsr    _C_LABEL(trap)          | go handle it
-       lea     %sp@(12),%sp            | pop value args
+       lea     %sp@(16),%sp            | pop value args
        movl    %sp@(FR_SP),%a0         | restore
        movl    %a0,%usp                |   user SP
        moveml  %sp@+,#0x7FFF           | and all remaining registers


And please pull-up this to netbsd-4.