kernel panic on i915kms module load (i7-6700T)

[nomadlogic]

$ sysctl hw.model hw.model: Intel(R) Core(TM) i7-6700T CPU @ 2.80GHz

I have a reproduce-able kernel panic on the above system. bellow is the backtrace - i've also included it on this ticket for easier analysis kgdb.txt :

Fatal trap 12: page fault while in kernel mode
cpuid = 4; apic id = 04
fault virtual address   = 0x0
fault code              = supervisor read data, page not present
instruction pointer     = 0x20:0xffffffff80ff2354
stack pointer           = 0x28:0xfffffe022f2949f0
frame pointer           = 0x28:0xfffffe022f294a40
code segment            = base 0x0, limit 0xfffff, type 0x1b
                        = DPL 0, pres 1, long 1, def32 0, gran 1
processor eflags        = interrupt enabled, resume, IOPL = 0
current process         = 1126 (kldload)

<snip>

#0  doadump (textdump=0) at /usr/home/pwright/git/freebsd-base-graphics/sys/kern/kern_shutdown.c:298
298             dumptid = curthread->td_tid;
(kgdb) bt
#0  doadump (textdump=0) at /usr/home/pwright/git/freebsd-base-graphics/sys/kern/kern_shutdown.c:298
#1  0xffffffff803f0bb2 in db_dump (dummy=-2130762924, dummy2=false, dummy3=-1, dummy4=0xfffffe022f294170 "")
    at /usr/home/pwright/git/freebsd-base-graphics/sys/ddb/db_command.c:533
#2  0xffffffff803f099e in db_command (last_cmdp=0xffffffff821c4ea8, cmd_table=0x0, dopager=1)
    at /usr/home/pwright/git/freebsd-base-graphics/sys/ddb/db_command.c:440
#3  0xffffffff803f053e in db_command_loop () at /usr/home/pwright/git/freebsd-base-graphics/sys/ddb/db_command.c:493
#4  0xffffffff803f5433 in db_trap (type=12, code=0) at /usr/home/pwright/git/freebsd-base-graphics/sys/ddb/db_main.c:251
#5  0xffffffff80ffdadf in kdb_trap (type=12, code=0, tf=0xfffffe022f294940)
    at /usr/home/pwright/git/freebsd-base-graphics/sys/kern/subr_kdb.c:654
#6  0xffffffff81634ab4 in trap_fatal (frame=0xfffffe022f294940, eva=0)
    at /usr/home/pwright/git/freebsd-base-graphics/sys/amd64/amd64/trap.c:836
#7  0xffffffff81634d26 in trap_pfault (frame=0xfffffe022f294940, usermode=0)
    at /usr/home/pwright/git/freebsd-base-graphics/sys/amd64/amd64/trap.c:716
#8  0xffffffff81633d72 in trap (frame=0xfffffe022f294940) at /usr/home/pwright/git/freebsd-base-graphics/sys/amd64/amd64/trap.c:442
#9  0xffffffff816351ca in trap_check (frame=0xfffffe022f294940) at /usr/home/pwright/git/freebsd-base-graphics/sys/amd64/amd64/trap.c:635
#10 0xffffffff8160c791 in calltrap () at /usr/home/pwright/git/freebsd-base-graphics/sys/amd64/amd64/exception.S:236
#11 0xffffffff80ff2354 in BUS_HINT_DEVICE_UNIT (_dev=0x0, _child=0xfffff800049a9800, _name=0xfffff80004744bd8 "drm", _unitp=0xfffffe022f294ac4)
    at bus_if.h:920
#12 0xffffffff80ff204c in devclass_alloc_unit (dc=0xfffff80004744b80, dev=0xfffff800049a9800, unitp=0xfffff800049a9850)
    at /usr/home/pwright/git/freebsd-base-graphics/sys/kern/subr_bus.c:1634
#13 0xffffffff80feb3cc in devclass_add_device (dc=0xfffff80004744b80, dev=0xfffff800049a9800)
    at /usr/home/pwright/git/freebsd-base-graphics/sys/kern/subr_bus.c:1723
#14 0xffffffff80fe94f7 in make_device (parent=0x0, name=0xfffff80039a329b0 "drm", unit=-1)
    at /usr/home/pwright/git/freebsd-base-graphics/sys/kern/subr_bus.c:1818
#15 0xffffffff80fe90d0 in device_add_child_ordered (dev=0x0, order=0, name=0xfffff80039a329b0 "drm", unit=-1)
    at /usr/home/pwright/git/freebsd-base-graphics/sys/kern/subr_bus.c:1904
#16 0xffffffff80fe8faa in device_add_child (dev=0x0, name=0xfffff80039a329b0 "drm", unit=-1)
    at /usr/home/pwright/git/freebsd-base-graphics/sys/kern/subr_bus.c:1870
#17 0xffffffff834a668b in device_register () at device.h:414
#18 0xffffffff834a627f in i2c_add_adapter (adapter=0xfffff8016d013150)
    at /usr/home/pwright/git/freebsd-base-graphics/sys/modules/linuxkpi/../../compat/linuxkpi/common/src/linux_i2c.c:116
#19 0xffffffff8352c73f in gen6_rps_irq_handler (dev_priv=0xfffff8016d00e800, pm_iir=0)
    at /usr/home/pwright/git/freebsd-base-graphics/sys/modules/drm2/i915/i915kms/../../../../dev/drm2/i915/i915_irq.c:1627
#20 0xffffffff8350341d in gen8_alloc_va_range_3lvl (vm=0x41000, pdp=0xfffff801022a2000, start=3, length=7)
    at /usr/home/pwright/git/freebsd-base-graphics/sys/modules/drm2/i915/i915kms/../../../../dev/drm2/i915/i915_gem_gtt.c:1274
#21 0xffffffff8350e5e6 in refcount_acquire (count=0xfffffe0002658000) at refcount.h:52
#22 0xffffffff834c3be5 in pci_get_domain (dev=0xffffffff83587730) at pcivar.h:314
#23 0xffffffff8343f555 in drm_dev_register (dev=0x42, flags=18446735283740291072)
    at /usr/home/pwright/git/freebsd-base-graphics/sys/modules/drm2/drm2/../../../dev/drm2/drm_drv.c:785
#24 0xffffffff834588f9 in drm_get_pci_dev (pdev=0xfffff80004298000, ent=0xffffffff83586780, driver=<value optimized out>)
    at /usr/home/pwright/git/freebsd-base-graphics/sys/modules/drm2/drm2/../../../dev/drm2/drm_pci.c:323
#25 0xffffffff834a8f83 in linux_pci_attach (dev=<value optimized out>)
    at /usr/home/pwright/git/freebsd-base-graphics/sys/modules/linuxkpi/../../compat/linuxkpi/common/src/linux_pci.c:193
#26 0xffffffff80febf87 in DEVICE_ATTACH (dev=0xfffff800049a9700) at device_if.h:180
#27 0xffffffff80feb826 in device_attach (dev=0xfffff800049a9700) at /usr/home/pwright/git/freebsd-base-graphics/sys/kern/subr_bus.c:2900
#28 0xffffffff80feb75e in device_probe_and_attach (dev=0xfffff800049a9700)
    at /usr/home/pwright/git/freebsd-base-graphics/sys/kern/subr_bus.c:2858
#29 0xffffffff80fee0f1 in bus_generic_driver_added (dev=0xfffff800049aa300, driver=0xffffffff835b6cf0)
    at /usr/home/pwright/git/freebsd-base-graphics/sys/kern/subr_bus.c:3920
---Type <return> to continue, or q <return> to quit--- 
#30 0xffffffff80ff1dcf in BUS_DRIVER_ADDED (_dev=0xfffff800049aa300, _driver=0xffffffff835b6cf0) at bus_if.h:204
#31 0xffffffff80fe85a5 in devclass_driver_added (dc=0xfffff80004560100, driver=0xffffffff835b6cf0)
    at /usr/home/pwright/git/freebsd-base-graphics/sys/kern/subr_bus.c:1099
#32 0xffffffff80fe838f in devclass_add_driver (dc=0xfffff80004560100, driver=0xffffffff835b6cf0, pass=2147483647, dcp=0xffffffff8348c540)
    at /usr/home/pwright/git/freebsd-base-graphics/sys/kern/subr_bus.c:1172
#33 0xffffffff834a8816 in pci_register_driver (pdrv=<value optimized out>)
    at /usr/home/pwright/git/freebsd-base-graphics/sys/modules/linuxkpi/../../compat/linuxkpi/common/src/linux_pci.c:297
#34 0xffffffff834c6dcc in _sg_iter_next (iter=0x7fffffffee48) at scatterlist.h:309
#35 0xffffffff80f56809 in linker_file_sysinit (lf=0xfffff800042ca000) at /usr/home/pwright/git/freebsd-base-graphics/sys/kern/kern_linker.c:230
#36 0xffffffff80f5546c in linker_load_file (filename=0xfffff800042cfd20 "/boot/kernel/i915kms.ko", result=0xfffffe022f2956a8)
    at /usr/home/pwright/git/freebsd-base-graphics/sys/kern/kern_linker.c:430
#37 0xffffffff80f507d4 in linker_load_module (kldname=0x0, modname=0xfffff80009dbbc00 "i915kms", parent=0x0, verinfo=0x0, 
    lfpp=0xfffffe022f295728) at /usr/home/pwright/git/freebsd-base-graphics/sys/kern/kern_linker.c:2003
#38 0xffffffff80f526c3 in kern_kldload (td=0xfffff80009b5d000, file=0xfffff80009dbbc00 "i915kms", fileid=0xfffffe022f295790)
    at /usr/home/pwright/git/freebsd-base-graphics/sys/kern/kern_linker.c:1037
#39 0xffffffff80f527e8 in sys_kldload (td=0xfffff80009b5d000, uap=0xfffffe022f295958)
    at /usr/home/pwright/git/freebsd-base-graphics/sys/kern/kern_linker.c:1063
#40 0xffffffff81635cd1 in syscallenter (td=0xfffff80009b5d000, sa=0xfffffe022f295948) at subr_syscall.c:135
#41 0xffffffff8163557a in amd64_syscall (td=0xfffff80009b5d000, traced=0)
    at /usr/home/pwright/git/freebsd-base-graphics/sys/amd64/amd64/trap.c:942
#42 0xffffffff8160ca7b in Xfast_syscall () at /usr/home/pwright/git/freebsd-base-graphics/sys/amd64/amd64/exception.S:396
#43 0x000000080086d12a in ?? ()
Previous frame inner to this frame (corrupt stack?)
Current language:  auto; currently minimal
(kgdb) 

[nomadlogic]

You can grab the corefile from this panic in the tar-ball located here: http://www.nomadlogic.org/fbsd_gfx/i915_panic.tar.xz

[mattmacy]

parent isn't getting set

static int devclass_alloc_unit(devclass_t dc, device_t dev, int unitp) { const char s; int unit = *unitp;

PDEBUG(("unit %d in devclass %s", unit, DEVCLANAME(dc)));

/* Ask the parent bus if it wants to wire this device. */
if (unit == -1)
    BUS_HINT_DEVICE_UNIT(device_get_parent(dev), dev, dc->name,
        &unit);

[mattmacy]

It looks like device_add_child is being called with a null first argument.

This last commit adds an assert that parent's bsddev is non-NULL.

https://github.com/FreeBSDDesktop/freebsd-base-graphics/commit/53cf7e58390403e077c53f87b69fc4b46ac508fd

Please pull and try again.

static inline int
device_register(struct device *dev)
{
    device_t bsddev;
    int unit;

    bsddev = NULL;
    unit = -1;

    if (dev->devt) {
        unit = MINOR(dev->devt);
        bsddev = devclass_get_device(dev->class->bsdclass, unit);
    } else if (dev->parent == NULL) {
        bsddev = devclass_get_device(dev->class->bsdclass, 0);
    }
    if (bsddev == NULL && dev->parent != NULL) {
        bsddev = device_add_child(dev->parent->bsddev,
            dev->class->kobj.name, unit);
    }
    if (bsddev != NULL) {
        if (dev->devt == 0)
            dev->devt = makedev(0, device_get_unit(bsddev));
        device_set_softc(bsddev, dev);
    }
    dev->bsddev = bsddev;
    kobject_init(&dev->kobj, &linux_dev_ktype);
    kobject_add(&dev->kobj, &dev->class->kobj, dev_name(dev));

    return (0);
}

[nomadlogic]

looks like this is still happening on my system using the latest image: "cftdisk_2016053119.img"

boot system, login as root. kldload i915kms -> kernel panic.

panic: Assertion aux->dev->bsddev != NULL failed at /usr/home/mmacy/devel/freebsd-base-graphics/sys/modules/drm2/drm2/../../../dev/drm2/drm_dp_helper.c:776
cpuid = 0
KDB: stack backtrace:
db_trace_self_wrapper() at db_trace_self_wrapper+0x2b/frame 0xfffffe022fbddc70
vpanic() at vpanic+0x182/frame 0xfffffe022fbddcf0
kassert_panic() at kassert_panic+0x126/frame 0xfffffe022fbddd60
drm_dp_aux_register() at drm_dp_aux_register+0xbb/frame 0xfffffe022fbddd80
intel_dp_init_connector() at intel_dp_init_connector+0x8af/frame 0xfffffe022fbdde40
intel_ddi_init() at intel_ddi_init+0x1fd/frame 0xfffffe022fbdde90
intel_modeset_init() at intel_modeset_init+0x1076/frame 0xfffffe022fbddfa0
i915_driver_load() at i915_driver_load+0x1635/frame 0xfffffe022fbde160
drm_dev_register() at drm_dev_register+0x65/frame 0xfffffe022fbde190
drm_get_pci_dev() at drm_get_pci_dev+0x1d9/frame 0xfffffe022fbde210
linux_pci_attach() at linux_pci_attach+0x279/frame 0xfffffe022fbde300
device_attach() at device_attach+0x420/frame 0xfffffe022fbde360
bus_generic_driver_added() at bus_generic_driver_added+0x96/frame 0xfffffe022fbde380
devclass_driver_added() at devclass_driver_added+0x7d/frame 0xfffffe022fbde3c0
devclass_add_driver() at devclass_add_driver+0x181/frame 0xfffffe022fbde400
pci_register_driver() at pci_register_driver+0xff/frame 0xfffffe022fbde4d0
_module_run() at _module_run+0x9c/frame 0xfffffe022fbde510
linker_load_module() at linker_load_module+0xc88/frame 0xfffffe022fbde830
kern_kldload() at kern_kldload+0xa7/frame 0xfffffe022fbde870
sys_kldload() at sys_kldload+0x5b/frame 0xfffffe022fbde8a0
amd64_syscall() at amd64_syscall+0x2db/frame 0xfffffe022fbde9b0
Xfast_syscall() at Xfast_syscall+0xfb/frame 0xfffffe022fbde9b0
--- syscall (304, FreeBSD ELF64, sys_kldload), rip = 0x80086d17a, rsp = 0x7fffffffe688, rbp = 0x7fffffffeba0 ---
KDB: enter: panic

<snip>

(kgdb) #0  doadump (textdump=0) at pcpu.h:221
#1  0xffffffff8039120b in db_dump (dummy=<value optimized out>, dummy2=false, 
    dummy3=0, dummy4=0x0)
    at /usr/home/mmacy/devel/freebsd-base-graphics/sys/ddb/db_command.c:533
#2  0xffffffff80391009 in db_command (cmd_table=<value optimized out>)
    at /usr/home/mmacy/devel/freebsd-base-graphics/sys/ddb/db_command.c:440
#3  0xffffffff80390d64 in db_command_loop ()
    at /usr/home/mmacy/devel/freebsd-base-graphics/sys/ddb/db_command.c:493
#4  0xffffffff80393c9b in db_trap (type=<value optimized out>, 
    code=<value optimized out>)
    at /usr/home/mmacy/devel/freebsd-base-graphics/sys/ddb/db_main.c:251
#5  0xffffffff80a86e83 in kdb_trap (type=<value optimized out>, 
    code=<value optimized out>, tf=<value optimized out>)
    at /usr/home/mmacy/devel/freebsd-base-graphics/sys/kern/subr_kdb.c:654
#6  0xffffffff80eb4b0d in trap (frame=0xfffffe022fbddba0)
    at /usr/home/mmacy/devel/freebsd-base-graphics/sys/amd64/amd64/trap.c:556
#7  0xffffffff80e94fd1 in calltrap ()
    at /usr/home/mmacy/devel/freebsd-base-graphics/sys/amd64/amd64/exception.S:236
#8  0xffffffff80a8652b in kdb_enter (why=0xffffffff813db91c "panic", 
    msg=0x80 <Address 0x80 out of bounds>) at cpufunc.h:63
#9  0xffffffff80a4686f in vpanic (fmt=<value optimized out>, 
    ap=0xfffffe022fbddd30)
    at /usr/home/mmacy/devel/freebsd-base-graphics/sys/kern/kern_shutdown.c:760
#10 0xffffffff80a466c6 in kassert_panic (fmt=<value optimized out>)
    at /usr/home/mmacy/devel/freebsd-base-graphics/sys/kern/kern_shutdown.c:649
#11 0xffffffff82f3bc7b in drm_dp_aux_register (aux=0xfffff8004c71b148)
    at /usr/home/mmacy/devel/freebsd-base-graphics/sys/modules/drm2/drm2/../../../dev/drm2/drm_dp_helper.c:776
#12 0xffffffff82e7aabf in intel_dp_init_connector (
    intel_dig_port=<value optimized out>, 
    intel_connector=<value optimized out>)
    at /usr/home/mmacy/devel/freebsd-base-graphics/sys/modules/drm2/i915/i915kms/../../../../dev/drm2/i915/intel_dp.c:1214
#13 0xffffffff82e5070d in intel_ddi_init (dev=<value optimized out>, 
    port=PORT_B)
    at /usr/home/mmacy/devel/freebsd-base-graphics/sys/modules/drm2/i915/i915kms/../../../../dev/drm2/i915/intel_ddi.c:3245
#14 0xffffffff82e5be66 in intel_modeset_init (dev=<value optimized out>)
    at /usr/home/mmacy/devel/freebsd-base-graphics/sys/modules/drm2/i915/i915kms/../../../../dev/drm2/i915/intel_display.c:14492
#15 0xffffffff82e0fb15 in i915_driver_load (dev=<value optimized out>, 
    flags=<value optimized out>)
    at /usr/home/mmacy/devel/freebsd-base-graphics/sys/modules/drm2/i915/i915kms/../../../../dev/drm2/i915/i915_dma.c:410
#16 0xffffffff82f43f75 in drm_dev_register (dev=0xfffff8004c473000, 
    flags=18446744071611181040)
    at /usr/home/mmacy/devel/freebsd-base-graphics/sys/modules/drm2/drm2/../../../dev/drm2/drm_drv.c:785
#17 0xffffffff82f5d869 in drm_get_pci_dev (pdev=0xfffff80004bbb800, 
    ent=0xffffffff82ed5840, driver=<value optimized out>)
    at /usr/home/mmacy/devel/freebsd-base-graphics/sys/modules/drm2/drm2/../../../dev/drm2/drm_pci.c:323
#18 0xffffffff82fb0be9 in linux_pci_attach (dev=<value optimized out>)
    at /usr/home/mmacy/devel/freebsd-base-graphics/sys/modules/linuxkpi/../../compat/linuxkpi/common/src/linux_pci.c:210
#19 0xffffffff80a7aa50 in device_attach (dev=0xfffff80004970e00)
    at device_if.h:180
#20 0xffffffff80a7c136 in bus_generic_driver_added (
    dev=<value optimized out>, driver=<value optimized out>)
    at /usr/home/mmacy/devel/freebsd-base-graphics/sys/kern/subr_bus.c:2858
#21 0xffffffff80a7841d in devclass_driver_added (dc=<value optimized out>, 
    driver=<value optimized out>) at bus_if.h:204
#22 0xffffffff80a78341 in devclass_add_driver (dc=<value optimized out>, 
    driver=<value optimized out>, pass=<value optimized out>, 
    dcp=<value optimized out>)
    at /usr/home/mmacy/devel/freebsd-base-graphics/sys/kern/subr_bus.c:1172
#23 0xffffffff82fb03ff in pci_register_driver (pdrv=<value optimized out>)
    at /usr/home/mmacy/devel/freebsd-base-graphics/sys/modules/linuxkpi/../../compat/linuxkpi/common/src/linux_pci.c:327
#24 0xffffffff82e12ddc in _module_run (arg=<value optimized out>)
    at module.h:80
#25 0xffffffff80a19d38 in linker_load_module (kldname=<value optimized out>, 
    modname=0xfffff8000e3b8000 "i915kms", parent=<value optimized out>, 
    verinfo=<value optimized out>, lfpp=<value optimized out>)
    at /usr/home/mmacy/devel/freebsd-base-graphics/sys/kern/kern_linker.c:230
#26 0xffffffff80a1b397 in kern_kldload (td=<value optimized out>, 
    file=<value optimized out>, fileid=0xfffffe022fbde884)
    at /usr/home/mmacy/devel/freebsd-base-graphics/sys/kern/kern_linker.c:1037
#27 0xffffffff80a1b45b in sys_kldload (td=0xfffff8000e687500, 
    uap=<value optimized out>)
    at /usr/home/mmacy/devel/freebsd-base-graphics/sys/kern/kern_linker.c:1063
#28 0xffffffff80eb5beb in amd64_syscall (td=0xfffff8000e687500, traced=0)
    at subr_syscall.c:135
#29 0xffffffff80e952bb in Xfast_syscall ()
    at /usr/home/mmacy/devel/freebsd-base-graphics/sys/amd64/amd64/exception.S:396
#30 0x000000080086d17a in ?? ()
Previous frame inner to this frame (corrupt stack?)
Current language:  auto; currently minimal
(kgdb)

[mattmacy]

Yes, but now it's hitting an assert. So I know where it's happening.

[mattmacy]

Can you pull and try again? It's expected to panic. I'm trying to narrow down where the device is being allocated without the bsddev being set.

[mattmacy]

I think this is fixed with my most recent change: https://github.com/FreeBSDDesktop/freebsd-base-graphics/commit/7a441a69d392d7f83cc5ab80401c6c82021785d0 - please test

[nomadlogic]

I can confirm that 7a441a6 did the trick closing this bug!