port-evbarm/51048: raspberry pi 2 : omxplayer can make the kernel crash

[sylvain%sylvaingarrigues.com@localhost]

>Number:         51048
>Category:       port-evbarm
>Synopsis:       raspberry pi 2 : omxplayer can make the kernel crash
>Confidential:   no
>Severity:       serious
>Priority:       medium
>Responsible:    port-evbarm-maintainer
>State:          open
>Class:          sw-bug
>Submitter-Id:   net
>Arrival-Date:   Tue Apr 05 21:45:00 +0000 2016
>Originator:     Sylvain
>Release:        7-current
>Organization:
>Environment:
NetBSD rpi2 7.99.27 NetBSD 7.99.27 (RPI2.201604050320Z) evbarm
>Description:
This bug is specific to the Raspberry Pi kernel.

If I want to play a video and use the -r option of omxplayer (which changes the refresh rate of the HDMI TV to match the one of the TV), I get a translation fault (S) in uvm.

DDB comes up and says the kernel is stopped in pid 0.58 at netbsd: armv7_dcache_inv_range+0x28 (mcr p)
 
It works in FreeBSD, maybe our vchiq code is too old compared to FreeBSD or we did not keep up with the patches from gonzo (https://github.com/freebsd/freebsd/tree/master/sys/contrib/vchiq/interface)? I can see our version has been imported from Linux 2-3 years ago...

In case you are interested by the vchiq log (level 9) - date is wrong I'm not NTP synced:
...
Sep 25 13:20:44 rpi2 /netbsd: vchiq: Rcvd Msg DATA(5) from TVSV s:34 d:5 len:52
Sep 25 13:20:44 rpi2 /netbsd: vchiq: Rcvd: 00000000: 0a 00 12 00 0a 00 12 00 80 07 00 00 38 04 00 00 ............8...
Sep 25 13:20:44 rpi2 /netbsd: vchiq: Rcvd: 00000010: 32 00 00 00 01 00 00 00 1f 00 00 00 00 00 03 00 2...............
Sep 25 13:20:44 rpi2 /netbsd: vchiq: Rcvd: 00000020: 03 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
Sep 25 13:20:44 rpi2 /netbsd: vchiq: Rcvd: 00000030: 01 00 00 00                                     ....
Sep 25 13:20:44 rpi2 /netbsd: vchiq: 0: prs DATA@cad34228,34 (34->5)
Sep 25 13:20:44 rpi2 /netbsd: vchiq: 0: callback:5 (MESSAGE_AVAILABLE, cad34228, 0)
Sep 25 13:20:44 rpi2 /netbsd: vchiq: 0: qm DATA@cad576a8,8 (5->34)
Sep 25 13:20:44 rpi2 /netbsd: vchiq: Sent: 00000000: 06 00 00 00                                     ....
Sep 25 13:20:44 rpi2 /netbsd: vchiq: Sent Msg DATA(5) to TVSV s:5 d:34 len:8
Sep 25 13:20:44 rpi2 /netbsd: vchiq: Rcvd Msg DATA(5) from TVSV s:34 d:5 len:12
Sep 25 13:20:44 rpi2 /netbsd: vchiq: Rcvd: 00000000: 10 00 00 00 01 00 00 00 1f 00 00 00             ............
Sep 25 13:20:44 rpi2 /netbsd: vchiq: 0: prs DATA@cad34268,c (34->5)
Sep 25 13:20:44 rpi2 /netbsd: vchiq: 0: callback:5 (MESSAGE_AVAILABLE, cad34268, 0)
Sep 25 13:20:44 rpi2 /netbsd: vchiq: 0: qm DATA@cad576b8,c (5->34)
Sep 25 13:20:44 rpi2 /netbsd: vchiq: Sent: 00000000: 18 00 00 00                                     ....
Sep 25 13:20:44 rpi2 /netbsd: vchiq: Sent Msg DATA(5) to TVSV s:5 d:34 len:12
Sep 25 13:20:44 rpi2 /netbsd: vchiq: Sent Msg DATA(5) from TVSV s:34 d:5 len:12
Sep 25 13:20:44 rpi2 /netbsd: vchiq: Rcvd: 00000000: 10 00 00 00 01 00 00 00 1f 00 00 00             ............
Sep 25 13:20:44 rpi2 /netbsd: vchiq: 0: prs DATA@cad34280,c (34->5)
Sep 25 13:20:44 rpi2 /netbsd: vchiq: 0: callback:5 (MESSAGE_AVAILABLE, cad34280, 0)
Sep 25 13:20:44 rpi2 /netbsd: vchiq: 0: bt (5->34) rx 140@c19d0000 812394d0
Sep 25 13:20:44 rpi2 /netbsd: vchiq: 0: qm BULK_RX@cad576d0,8 (5->34)
Sep 25 13:20:44 rpi2 /netbsd: vchiq: Sent Msg BULK_RX(6) to ???? s:5 d:34 len:8
Sep 25 13:20:44 rpi2 /netbsd: vchiq: 0: bt:5 rx li=1 ri=0 p=0
Sep 25 13:20:44 rpi2 /netbsd: vchiq: Rcvd Msg BULK_RX_DONE(8) from TVSV s:34 d:5 len:4
Sep 25 13:20:44 rpi2 /netbsd: vchiq: Rcvd Msg BULK_RX_DONE(8) from TVSV s:34 d:5 len:434->5) 140@c19d0000
Sep 25 13:20:44 rpi2 /netbsd: vchiq: 0: prs:5 rx li=1 ri=1 p=0
Sep 25 13:20:44 rpi2 /netbsd: 
Sep 25 13:20:44 rpi2 /netbsd: uvm_fault(0x808e1710, 77b02000, 2) -> e
Sep 25 13:20:44 rpi2 /netbsd: Fatal kernel mode data abort: 'Translation Fault (S)'
>How-To-Repeat:
Play any video with omxplayer -r video.mp4
Using omxplayer-20150118nb5 from pkgsrc packages.
>Fix: