Re: kern/57833: kernel panic on xorg exit

["David H. Gutteridge" <david%gutteridge.ca@localhost>]

The following reply was made to PR kern/57833; it has been noted by GNATS.

From: "David H. Gutteridge" <david%gutteridge.ca@localhost>
To: gnats-bugs%netbsd.org@localhost
Cc: Taylor R Campbell <riastradh%NetBSD.org@localhost>
Subject: Re: kern/57833: kernel panic on xorg exit
Date: Sun, 14 Jan 2024 00:19:26 -0500

 On Sat, 2024-01-13 at 22:41 +0100, Ramiro Aceves wrote:
 > Hello,
 >=20
 > This is the last recorded crash after Taylor's patch and compiling the
 > kernel with debugging symbols ad David suggested:
 >=20
 > netbsd-compal# dmesg -M /var/crash/netbsd.7.core -N
 > /var/crash/netbsd.7
 >=20
 > ...
 > ...
 > =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 4.324510] uhid1 at uhidev1 reportid 3: inp=
 ut=3D2, output=3D0,
 > feature=3D0
 > [=C2=A0=C2=A0=C2=A0 16.564698] wsdisplay0: screen 1 added (default, vt100=
  emulation)
 > [=C2=A0=C2=A0=C2=A0 16.564698] wsdisplay0: screen 2 added (default, vt100=
  emulation)
 > [=C2=A0=C2=A0=C2=A0 16.564698] wsdisplay0: screen 3 added (default, vt100=
  emulation)
 > [=C2=A0=C2=A0=C2=A0 16.564698] wsdisplay0: screen 4 added (default, vt100=
  emulation)
 > [=C2=A0=C2=A0 234.752732] uvm_fault(0xc151c400, 0xdd4e8000, 1) -> 0xe
 > [=C2=A0=C2=A0 234.752732] fatal page fault in supervisor mode
 > [=C2=A0=C2=A0 234.752732] trap type 6 code 0 eip 0xc0b02ece cs 0x8 eflags
 > 0x13287=20
 > cr2 0xdd4e8000 ilevel 0x8 esp 0x4bb1a000
 > [=C2=A0=C2=A0 234.752732] curlwp 0xc4341600 pid 0 lid 63 lowest kstack
 > 0xdc7e02c0
 > [=C2=A0=C2=A0 234.752732] panic: trap
 > [=C2=A0=C2=A0 234.752732] cpu0: Begin traceback...
 > [=C2=A0=C2=A0 234.752732]=20
 > vpanic(c1186d04,dc7e1d7c,dc7e1e38,c012fed8,c1186d04,dc7e1e44,dc7e1e44,
 > 3f,dc7e02c0,13287)=20
 > at netbsd:vpanic+0x196
 > [=C2=A0=C2=A0 234.752732]=20
 > panic(c1186d04,dc7e1e44,dc7e1e44,3f,dc7e02c0,13287,dd4e8000,8,4bb1a000
 > ,c157e960)=20
 > at netbsd:panic+0x18
 > [=C2=A0=C2=A0 234.752732] trap() at netbsd:trap+0xd51
 > [=C2=A0=C2=A0 234.752732] --- trap (number 6) ---
 > [=C2=A0=C2=A0 234.752732]=20
 > drm_clflush_virt_range(dd4e8000,1000,0,1000,0,0,c147c8c0,dd4e8000,db6f
 > f000,c5c423c0)=20
 > at netbsd:drm_clflush_virt_range+0x3f
 > [=C2=A0=C2=A0 234.752732]=20
 > i915_gem_object_put_pages_phys(c5c15900,c5c222c4,c5c15900,c5c15900,4,d
 > c7e1f48,c06cd688,c5c15900,54,0)=20
 > at netbsd:i915_gem_object_put_pages_phys+0x15a
 > [=C2=A0=C2=A0 234.752732]=20
 > __i915_gem_object_put_pages(c5c15900,54,0,c0c5dd4f,0,0,c3dff878,0,c5c1
 > 59b0,c5c159ac)=20
 > at netbsd:__i915_gem_object_put_pages+0x70
 > [=C2=A0=C2=A0 234.752732]=20
 > __i915_gem_free_objects(c3dfea1c,c42a2f00,0,0,120,c4341600,c42a2f1c,dc
 > 7e1f78,c42a2f04,c42a2f1c)=20
 > at netbsd:__i915_gem_free_objects+0x104
 > [=C2=A0=C2=A0 234.752732]=20
 > linux_workqueue_thread(c42a2f00,1848000,1853000,0,c01005a8,0,0,0,0,0)
 > at=20
 > netbsd:linux_workqueue_thread+0xe6
 > [=C2=A0=C2=A0 234.752732] cpu0: End traceback...
 >=20
 > [=C2=A0=C2=A0 234.752732] dumping to dev 0,1 offset 1023
 > [=C2=A0=C2=A0 234.752732] dump
 > netbsd-compal#
 >=20
 >=20
 > netbsd-compal# gdb /usr/src/sys/arch/i386/compile/MYKERNEL/netbsd.gdb
 > GNU gdb (GDB) 11.0.50.20200914-git
 > Copyright (C) 2020 Free Software Foundation, Inc.
 > License GPLv3+: GNU GPL version 3 or later=20
 > <http://gnu.org/licenses/gpl.html>
 > This is free software: you are free to change and redistribute it.
 > There is NO WARRANTY, to the extent permitted by law.
 > Type "show copying" and "show warranty" for details.
 > This GDB was configured as "i486--netbsdelf".
 > Type "show configuration" for configuration details.
 > For bug reporting instructions, please see:
 > <https://www.gnu.org/software/gdb/bugs/>.
 > Find the GDB manual and other documentation resources online at:
 > =C2=A0=C2=A0=C2=A0=C2=A0 <http://www.gnu.org/software/gdb/documentation/>=
 .
 >=20
 > For help, type "help".
 > Type "apropos word" to search for commands related to "word"...
 > Reading symbols from
 > /usr/src/sys/arch/i386/compile/MYKERNEL/netbsd.gdb...
 > (gdb) target kvm /var/crash/netbsd.7.core
 > 0xc012d6ed in maybe_dump (howto=3D260) at=20
 > ../../../../arch/i386/i386/machdep.c:725
 > 725			dumpsys();
 > (gdb) frame 0
 > #0=C2=A0 0xc012d6ed in maybe_dump (howto=3D260) at=20
 > ../../../../arch/i386/i386/machdep.c:725
 > 725			dumpsys();
 > (gdb) frame 1
 > #1=C2=A0 cpu_reboot (howto=3Dhowto@entry=3D260, bootstr=3Dbootstr@entry=
 =3D0x0) at=20
 > ../../../../arch/i386/i386/machdep.c:746
 > 746		maybe_dump(howto);
 > (gdb) frame 2
 > #2=C2=A0 0xc0c85e17 in kern_reboot (howto=3Dhowto@entry=3D260,=20
 > bootstr=3Dbootstr@entry=3D0x0) at ../../../../kern/kern_reboot.c:73
 > 73		cpu_reboot(howto, bootstr);
 > (gdb) frame 3
 > #3=C2=A0 0xc0cbc9d8 in vpanic (fmt=3Dfmt@entry=3D0xc1186d04 "trap",
 > ap=3D0xdc7e1d7c=20
 > "D\036~\334D\036~\334?")
 > =C2=A0=C2=A0=C2=A0=C2=A0 at ../../../../kern/subr_prf.c:291
 > 291		kern_reboot(bootopt, NULL);
 > (gdb) frame 4
 > #4=C2=A0 0xc0cbca91 in panic (fmt=3Dfmt@entry=3D0xc1186d04 "trap") at=20
 > ../../../../kern/subr_prf.c:208
 > 208		vpanic(fmt, ap);
 > (gdb) frame 5
 > #5=C2=A0 0xc012fed8 in trap (frame=3D0xdc7e1e44) at=20
 > ../../../../arch/i386/i386/trap.c:358
 > 358			panic("trap");
 > (gdb) frame 6
 > #6=C2=A0 0xc012529b in alltraps ()
 > (gdb) frame 7
 > #7=C2=A0 0xdc7e1e44 in ?? ()
 > (gdb) frame 8
 > #8=C2=A0 0xc06cf74c in i915_gem_object_put_pages_phys (obj=3D<optimized o=
 ut>,
 > pages=3D<optimized out>)
 > =C2=A0=C2=A0=C2=A0=C2=A0 at
 > ../../../../external/bsd/drm2/dist/drm/i915/gem/i915_gem_phys.c:206
 > 206				drm_clflush_virt_range(src,
 > PAGE_SIZE);
 > (gdb)
 > #8=C2=A0 0xc06cf74c in i915_gem_object_put_pages_phys (obj=3D<optimized o=
 ut>,
 > pages=3D<optimized out>)
 > =C2=A0=C2=A0=C2=A0=C2=A0 at
 > ../../../../external/bsd/drm2/dist/drm/i915/gem/i915_gem_phys.c:206
 > 206				drm_clflush_virt_range(src,
 > PAGE_SIZE);
 > (gdb) info locals
 > page =3D 0x40
 > dst =3D 0xdb6ff000 "\377\377\377\377\377\377\377\377"
 > mapping =3D <optimized out>
 > src =3D 0xdd4e8000
 > i =3D <optimized out>
 > dmat =3D <optimized out>
 > vaddr =3D <optimized out>
 > (gdb) frame 9
 > #9=C2=A0 0xc06cf1b2 in __i915_gem_object_put_pages
 > (obj=3Dobj@entry=3D0xc5c15900)
 > =C2=A0=C2=A0=C2=A0=C2=A0 at
 > ../../../../external/bsd/drm2/dist/drm/i915/gem/i915_gem_pages.c:246
 > 246			obj->ops->put_pages(obj, pages);
 > (gdb) info locals
 > pages =3D <optimized out>
 > err =3D <optimized out>
 > (gdb) frame 10
 > #10 0xc06cd688 in __i915_gem_free_objects (i915=3D0xc3dfd004,=20
 > freed=3D<optimized out>)
 > =C2=A0=C2=A0=C2=A0=C2=A0 at=20
 > ../../../../external/bsd/drm2/dist/drm/i915/gem/i915_gem_object.c:257
 > 257			__i915_gem_object_put_pages(obj);
 > (gdb) info locals
 > mmo =3D <optimized out>
 > mn =3D <optimized out>
 > obj =3D 0xc5c15900
 > on =3D 0x0
 > wakeref =3D <optimized out>
 > (gdb) frame 11
 > #11 0xc0aef695 in linux_workqueue_thread (cookie=3D0xc42a2f00) at=20
 > ../../../../external/bsd/common/linux/linux_work.c:455
 > 455					(*func)(work);
 > (gdb) info locals
 > func =3D 0xc06cd7f2 <__i915_gem_free_work>
 > wq =3D 0xc42a2f00
 > q =3D {0x0, 0xc42a2f24}
 > marker =3D {work_owner =3D 3291047360, work_entry =3D {tqe_next =3D 0x0,=
 =20
 > tqe_prev =3D 0xc42a2f1c}, func =3D 0xc42a2f00}
 > work =3D 0xc3dfea1c
 > i =3D <optimized out>
 > (gdb) frame 12
 > #12 0xc0102011 in lwp_trampoline ()
 > (gdb) info locals
 > No symbol table info available.
 > (gdb) frame 13
 > No frame at level 13.
 > (gdb)
 
 This is a different trace than the original one, so seems to be another
 point of failure. Taylor would have to advise here which frame would be
 of interest (my guess would be 8, but I am out of my depth here).
 
 Dave