Google Groups no longer supports new Usenet posts or subscriptions. Historical content remains viewable.
Dismiss

Removing options MIPS3 cause DS5000 to loop during boot

10 views
Skip to first unread message

Erik Bertelsen

unread,
Apr 21, 2011, 11:42:52 AM4/21/11
to
I have a DS5000/133 where I try to keep NetBSD running and self-buildable.

This has not been possible for the last year or so, but after recent
work on the mips architecture, the situation has improved somewhat.

I used to have a trimmed-down custom kernel that just supports the
hardware present in the machine, but this kernel does not work. A
current GENERIC kernel does, however, boot and then fails when going
multi-user, but that's another story about updating userland.

Now I have started from scratch and done several reductions from
GENERIC to see when it stops working.

If I remove support for non 3MIN machines like this:

diff S2 S4
34,36d33
< options DEC_3100 # DECstation 2100, 3100 (kn01)
< options DEC_5100 # DECsystem 5100 (kn230)
< options DEC_3MAX # DECstation 5000/200 (kn02)
38,43d34
< options DEC_MAXINE # Personal DECstation 5000/xx (kn02ca)
< options DEC_3MAXPLUS # DECstation 5000/240 (kn03), 5000/260 (kn05)
<
< #options DEC_5400 # DECsystem 5400 (kn210)
< #options DEC_5500 # DECsystem 5500 (kn220)
< #options DEC_5800 # DECsystem 58x0 (kn5800)
211,220d201
< # 3MAX has TURBOchannel but no IOASIC
< ibus0 at tc? slot ? offset ? # 3MAX system slot
<
< # PMAX, 3MAX and MIPSMATE common devices
< mcclock* at ibus0 addr ? # DS1287 RTC
< dz* at ibus0 addr ? # DC7085 quad line serial device
<
< lkkbd* at dz? line 0 # Keyboard
< vsms* at dz? line 1 # Mouse
<
236,241d216
< # PMAX and MIPSMATE
< ibus0 at mainbus0
< pm* at ibus0 addr ? # 3100 onboard fb
< le* at ibus0 addr ? # 3100, 5100 onboard LANCE
< sii* at ibus0 addr ? # DC7061 onboard SCSI
<
257d231
< wsdisplay* at pm?
264d237
< scsibus* at sii?

the machine can still boot to single user and give me a prompt where I can work.

If I further remove MIPS3 support:

diff S4 S5
30d29
< options MIPS3 # R4000/R4400 CPUs

then the machine boots to the point of starting init and then hangs
solidly -- the only recovery seems to power cycle the machine.

The full console output is:

KN02-BA V5.7j
>>boot 3/rz4/netbsd.s5

NetBSD/pmax 1.6ZC FFS Primary Bootstrap

NetBSD/pmax 5.99.40 Secondary Bootstrap, Revision 1.5
(ro...@sockdev.h.erikb.net, Sat Oct 10 23:31:25 CEST 2009)

Boot: 3/rz4/netbsd.s5
3056528+110568 [189424+184633]=0x360db8
Starting at 0x80030000

segment 0 start 00000000 size 02000000
phys segment: 0x2000000 @ 0
adding 0x46d000 @ 0x393000 to freelist 1
adding 0x1800000 @ 0x800000 to freelist 0
pmap_steal_memory: seg 0: 0x393 0x393 0x800 0x800
pmap_steal_memory: seg 0: 0x3b9 0x3b9 0x800 0x800
Copyright (c) 1996, 1997, 1998, 1999, 2000, 2001, 2002, 2003, 2004, 2005,
2006, 2007, 2008, 2009, 2010, 2011
The NetBSD Foundation, Inc. All rights reserved.
Copyright (c) 1982, 1986, 1989, 1991, 1993
The Regents of the University of California. All rights reserved.

NetBSD 5.99.49 (S5) #0: Thu Apr 21 17:21:51 CEST 2011
er...@x8-nb.h.recerik.dk:/home/NetBSD/crossbuild/obj.pmax/sys/arch/pmax/compile/S5
DECstation 5000/133 (3MIN)
total memory = 32768 KB
avail memory = 28304 KB
mainbus0 (root)
cpu0 at mainbus0: MIPS R3000A CPU (0x230) Rev. 3.0 with MIPS R3010 FPC Rev. 4.0
cpu0: 64KB/4B direct-mapped Instruction cache, 64 TLB entries
cpu0: 128KB/4B direct-mapped write-through Data cache
tc0 at mainbus0: 12.5 MHz clock
ioasic0 at tc0 slot 3 offset 0x0
le0 at ioasic0 offset 0xc0000: address 08:00:2b:32:56:6f
le0: 32 receive buffers, 8 transmit buffers
zsc0 at ioasic0 offset 0x100000
vsms0 at zsc0 channel 0
wsmouse0 at vsms0 mux 0
zstty0 at zsc0 channel 1
zsc1 at ioasic0 offset 0x180000
lkkbd0 at zsc1 channel 0
wskbd0 at lkkbd0 mux 1
zstty1 at zsc1 channel 1 (console i/o)
mcclock0 at ioasic0 offset 0x200000: mc146818 or compatible
asc0 at ioasic0 offset 0x300000: NCR53C94, 25MHz, SCSI ID 7
scsibus0 at asc0: 8 targets, 8 luns per target
scsibus0: waiting 2 seconds for devices to settle...
sd0 at scsibus0 target 4 lun 0: <QUANTUM, QM39100TD-S, N1B0> disk fixed
sd0: 8683 MB, 8057 cyl, 10 head, 220 sec, 512 bytes/sect x 17783249 sectors
sd0: sync (200.00ns offset 15), 8-bit (5.000MB/s) transfers, tagged queueing
boot device: sd0
root on sd0a dumps on sd0b
root file system type: ffs
pid 1(init): ABI set to O32 (e_flags=0x1007)


There is not difference in the console messages between the S4 and S5
kernels except that the 'avail memory' has increased slightly (because
of a smaller kernel?)

Can anyone explain this? I'll be happy to test patches to resolve this.

kind regards
- Erik

--
Posted automagically by a mail2news gateway at muc.de e.V.
Please direct questions, flames, donations, etc. to news-...@muc.de

Erik Bertelsen

unread,
Apr 21, 2011, 12:00:30 PM4/21/11
to
Sorry to follow up to myself.

>  diff S4 S5
> 30d29
> < options       MIPS3           # R4000/R4400 CPUs
>
> then the machine boots to the point of starting init and then hangs
> solidly -- the only recovery seems to power cycle the machine.
>

Observing that neither DEBUG nor DIAGNOSTIC were enabled, I tried to add them:

diff S5 S6
40,41c40,41
< #options DIAGNOSTIC # extra kernel debugging checks
< #options DEBUG # extra kernel debugging support
---
> options DIAGNOSTIC # extra kernel debugging checks
> options DEBUG # extra kernel debugging support

Booting the S6 kernel actually produces an error message rather than
just hanging:

Boot: 3/rz4/netbsd.s6
3455120+143648 [192336+187118]=0x3cb904
Starting at 0x80030000

mips_fixup_stubs: 6768 fixups done in 0 cycles
Loaded initial symtab at 0x8039e9b0, strtab at 0x803cde14, # entries 12000
mcclock: iters 11680 computed MHz 33, instrs per usec=19


segment 0 start 00000000 size 02000000
phys segment: 0x2000000 @ 0

adding 0x402000 @ 0x3fe000 to freelist 1


adding 0x1800000 @ 0x800000 to freelist 0

pmap_steal_memory: seg 0: 0x3fe 0x3fe 0x800 0x800
pmap_steal_memory: seg 0: 0x424 0x424 0x800 0x800


Copyright (c) 1996, 1997, 1998, 1999, 2000, 2001, 2002, 2003, 2004, 2005,
2006, 2007, 2008, 2009, 2010, 2011
The NetBSD Foundation, Inc. All rights reserved.
Copyright (c) 1982, 1986, 1989, 1991, 1993
The Regents of the University of California. All rights reserved.

NetBSD 5.99.49 (S6) #0: Thu Apr 21 17:47:27 CEST 2011
er...@x8-nb.h.recerik.dk:/home/NetBSD/crossbuild/obj.pmax/sys/arch/pmax/compile/S6


DECstation 5000/133 (3MIN)
total memory = 32768 KB

avail memory = 27884 KB


mainbus0 (root)
cpu0 at mainbus0: MIPS R3000A CPU (0x230) Rev. 3.0 with MIPS R3010 FPC Rev. 4.0
cpu0: 64KB/4B direct-mapped Instruction cache, 64 TLB entries
cpu0: 128KB/4B direct-mapped write-through Data cache
tc0 at mainbus0: 12.5 MHz clock
ioasic0 at tc0 slot 3 offset 0x0
le0 at ioasic0 offset 0xc0000: address 08:00:2b:32:56:6f
le0: 32 receive buffers, 8 transmit buffers

3MIN: imask 1030, enabling slot 0x2, dev 0xc362ac18 handler 0x80033280


zsc0 at ioasic0 offset 0x100000
vsms0 at zsc0 channel 0
wsmouse0 at vsms0 mux 0
zstty0 at zsc0 channel 1

3MIN: imask 1130, enabling slot 0x0, dev 0xc362ac18 handler 0x802fef4c


zsc1 at ioasic0 offset 0x180000
lkkbd0 at zsc1 channel 0
wskbd0 at lkkbd0 mux 1
zstty1 at zsc1 channel 1 (console i/o)

3MIN: imask 1170, enabling slot 0x1, dev 0xc362ac18 handler 0x802fef4c


mcclock0 at ioasic0 offset 0x200000: mc146818 or compatible

asc0 at ioasic0 offset 0x3000003MIN: imask 11f0, enabling slot 0x3,
dev 0xc362ac18 handler 0x80183270


: NCR53C94, 25MHz, SCSI ID 7
scsibus0 at asc0: 8 targets, 8 luns per target
scsibus0: waiting 2 seconds for devices to settle...
sd0 at scsibus0 target 4 lun 0: <QUANTUM, QM39100TD-S, N1B0> disk fixed
sd0: 8683 MB, 8057 cyl, 10 head, 220 sec, 512 bytes/sect x 17783249 sectors
sd0: sync (200.00ns offset 15), 8-bit (5.000MB/s) transfers, tagged queueing
boot device: sd0
root on sd0a dumps on sd0b

mountroot: trying nfs...
mountroot: trying lfs...
mountroot: trying ffs...


root file system type: ffs

init: copying out flags `-s' 3
init: copying out path `/sbin/init' 11


pid 1(init): ABI set to O32 (e_flags=0x1007)

pid 1(init): trap: cpu0, TLB miss (load or instr. fetch) in kernel mode
status=0x20080014, cause=0x30000008, epc=0x80125a3c, vaddr=0xff00
tf=0xc3e7fa90 ksp=0xc3e7fb30 ra=0x801d4db4 ppl=0x81ee5e44
kernel: TLB miss (load or instr. fetch) trap
Stopped in pid 1.1 (init) at netbsd:mutex_abort: lw v1,0(a0)
db> t
0xc3e7fb30: mutex_abort+0 (ff00,80329ca0,80344378,8036dc50) ra 801d4db4 sz 0
0xc3e7fb30: pmap_page_protect+d4 (ff00,80329ca0,80344378,8036dc50) ra 802a3b50 s
z 48
0xc3e7fb60: uvm_anfree+18c (ff00,80329ca0,80344378,8036dc50) ra 802a1a20 sz 32
0xc3e7fb80: amap_wipeout+140 (ff00,80329ca0,80344378,8036dc50) ra 802b5504 sz 40

0xc3e7fba8: uvm_unmap_detach+74 (ff00,80329ca0,80344378,8036dc50) ra 802b563c sz
40
0xc3e7fbd0: uvm_unmap1+8c (ff00,80329ca0,80344378,8036dc50) ra 802b58c4 sz 64
0xc3e7fc10: uvmspace_exec+d8 (ff00,80329ca0,80344378,8036dc50) ra 80116674 sz 40

0xc3e7fc38: execve1+7b0 (ff00,7fff7ff2,7fff7fe4,0) ra 80117460 sz 512
0xc3e7fe38: sys_execve+28 (ff00,7fff7ff2,7fff7fe4,0) ra 800c51b8 sz 32
0xc3e7fe58: start_init+39c (81f0b340,7fff7ff2,7fff7fe4,0) ra 8017745c sz 240
0xc3e7ff48: mips1_lwp_trampoline+18 (81f0b340,7fff7ff2,7fff7fe4,0) ra 0 sz 24
User-level: pid 1.1
db>


I hope that this makes it easier for one of the mips gurus to
determine the cause of failure.

Izumi Tsutsui

unread,
Apr 29, 2011, 1:19:04 PM4/29/11
to
> If I further remove MIPS3 support:
:

> Can anyone explain this? I'll be happy to test patches to resolve this.

I confirmed that it (no MIPS3 kernel doesn't boot on MIPS1)
also happens on NWS-3470D (R3000 newsmips) and
I find one obvious botch in pmap.c.

Could you try this patch?

Index: mips/pmap.c
===================================================================
RCS file: /cvsroot/src/sys/arch/mips/mips/pmap.c,v
retrieving revision 1.198
diff -u -p -r1.198 pmap.c
--- mips/pmap.c 15 Mar 2011 07:31:33 -0000 1.198
+++ mips/pmap.c 29 Apr 2011 17:10:53 -0000
@@ -2345,6 +2345,7 @@ pmap_remove_pv(pmap_t pmap, vaddr_t va,
pmap_page_cache(pg, true);
}
#endif
+#endif /* MIPS3_PLUS */

pmap_check_pvlist(md);
PG_MD_PVLIST_UNLOCK(md);
@@ -2371,6 +2372,7 @@ pmap_remove_pv(pmap_t pmap, vaddr_t va,
PMAP_COUNT(exec_synced_remove);
}
}
+#ifdef MIPS3_PLUS /* XXX mmu XXX */
if (MIPS_HAS_R4K_MMU && last) /* XXX why */
mips_dcache_wbinv_range_index(va, PAGE_SIZE);
#endif /* MIPS3_PLUS */


---

(though I have not tried options DIAGNOSTIC one)

---
Izumi Tsutsui

Izumi Tsutsui

unread,
May 1, 2011, 11:57:22 AM5/1/11
to
> However the S6 kernel (S5 with options DEBUG and DIAGNOSTIC added) panics:
:
> panic: tlb_hi (0xc3ec1000) asid (0) != current asid (0x3)

I guess this will also happen with options MIPS3...

Izumi Tsutsui

unread,
May 2, 2011, 7:59:49 AM5/2/11
to
Could you file a PR?

I saw the same panic on newsmips but not always, I also got
>> panic: kernel diagnostic assertion "pcb->pcb_context.val[_L_SR] & MIPS_SR_INT_IE" failed
etc.

---
Izumi Tsutsui

In <BANLkTika8JE6Wj8H...@mail.gmail.com>
Erik Bertelsen wrote:

> 2011/5/1 Izumi Tsutsui <tsu...@ceres.dti.ne.jp>:


> >> However the S6 kernel (S5 with options DEBUG and DIAGNOSTIC added) panics:
> > :
> >> panic: tlb_hi (0xc3ec1000) asid (0) != current asid (0x3)
> >
> > I guess this will also happen with options MIPS3...

> I can confirm this -- adding DEBUG and DIAGNOSTIC to my S4 kernel results in:


>
> init: copying out flags `-s' 3
> init: copying out path `/sbin/init' 11
> pid 1(init): ABI set to O32 (e_flags=0x1007)

> panic: tlb_hi (0xc3ec3000) asid (0) != current asid (0x3)
> cpu0: Begin traceback...
> pid -1007928440 not found
> cpu0: End traceback...
> 0xc3ec3b70: cpu_reboot+3c (104,0,b1,8035fee4) ra 8022bdfc sz 24
> 0xc3ec3b88: panic+258 (104,c3ec3000,0,3) ra 801dd68c sz 56
> 0xc3ec3bc0: pmap_tlb_asid_check+6c (104,c3ec3000,0,3) ra 801ddefc sz 24
> 0xc3ec3bd8: pmap_tlb_update_addr+80 (104,c3ec3000,0,3) ra 801dc048 sz 40
> 0xc3ec3c00: pmap_enter+2c8 (104,c3ec3000,0,3) ra 802b146c sz 72
> 0xc3ec3c48: uvm_fault_lower+618 (104,c3ec3000,0,3) ra 802b299c sz 96
> 0xc3ec3ca8: uvm_fault_internal+834 (81ee5d20,c3ec3000,7de69000,0) ra
> 8026b9a0 sz 272
> 0xc3ec3db8: trap+a6c (ff3c,8,7de69000,7de69c08) ra 8017ad50 sz 400
> 0xc3ec3f48: mips1_user_gen_exception+e0 (ff3c,8,7de69000,7de69c08) ra 0 sz 0
> User-level: pid 2.1
>
> dumping to dev 19,1 offset 1332112
> dump 32 31 30 29 28 27 26 25 24 23 22 21 20 19 18 17 16 15 14 13 12 11
> 10 9 8 7 6 5 4 3 2 1 succeeded

Erik Bertelsen

unread,
May 1, 2011, 2:00:42 PM5/1/11
to
2011/5/1 Izumi Tsutsui <tsu...@ceres.dti.ne.jp>:

>> However the S6 kernel (S5 with options DEBUG and DIAGNOSTIC added) panics:
>  :
>> panic: tlb_hi (0xc3ec1000) asid (0) != current asid (0x3)
>
> I guess this will also happen with options MIPS3...
>
> ---
> Izumi Tsutsui
>

I can confirm this -- adding DEBUG and DIAGNOSTIC to my S4 kernel results in:

init: copying out flags `-s' 3
init: copying out path `/sbin/init' 11
pid 1(init): ABI set to O32 (e_flags=0x1007)
panic: tlb_hi (0xc3ec3000) asid (0) != current asid (0x3)
cpu0: Begin traceback...
pid -1007928440 not found
cpu0: End traceback...
0xc3ec3b70: cpu_reboot+3c (104,0,b1,8035fee4) ra 8022bdfc sz 24
0xc3ec3b88: panic+258 (104,c3ec3000,0,3) ra 801dd68c sz 56
0xc3ec3bc0: pmap_tlb_asid_check+6c (104,c3ec3000,0,3) ra 801ddefc sz 24
0xc3ec3bd8: pmap_tlb_update_addr+80 (104,c3ec3000,0,3) ra 801dc048 sz 40
0xc3ec3c00: pmap_enter+2c8 (104,c3ec3000,0,3) ra 802b146c sz 72
0xc3ec3c48: uvm_fault_lower+618 (104,c3ec3000,0,3) ra 802b299c sz 96
0xc3ec3ca8: uvm_fault_internal+834 (81ee5d20,c3ec3000,7de69000,0) ra
8026b9a0 sz 272
0xc3ec3db8: trap+a6c (ff3c,8,7de69000,7de69c08) ra 8017ad50 sz 400
0xc3ec3f48: mips1_user_gen_exception+e0 (ff3c,8,7de69000,7de69c08) ra 0 sz 0
User-level: pid 2.1

dumping to dev 19,1 offset 1332112
dump 32 31 30 29 28 27 26 25 24 23 22 21 20 19 18 17 16 15 14 13 12 11
10 9 8 7 6 5 4 3 2 1 succeeded


kind regards
Erik

Erik Bertelsen

unread,
May 1, 2011, 11:21:32 AM5/1/11
to
2011/4/29 Izumi Tsutsui <tsu...@ceres.dti.ne.jp>:

> Could you try this patch?
>
> Index: mips/pmap.c
> ===================================================================
> RCS file: /cvsroot/src/sys/arch/mips/mips/pmap.c,v
> retrieving revision 1.198
> diff -u -p -r1.198 pmap.c
> --- mips/pmap.c 15 Mar 2011 07:31:33 -0000      1.198
> +++ mips/pmap.c 29 Apr 2011 17:10:53 -0000
> @@ -2345,6 +2345,7 @@ pmap_remove_pv(pmap_t pmap, vaddr_t va,
>                        pmap_page_cache(pg, true);
>        }
>  #endif
> +#endif /* MIPS3_PLUS */
>
>        pmap_check_pvlist(md);
>        PG_MD_PVLIST_UNLOCK(md);
> @@ -2371,6 +2372,7 @@ pmap_remove_pv(pmap_t pmap, vaddr_t va,
>                        PMAP_COUNT(exec_synced_remove);
>                }
>        }
> +#ifdef MIPS3_PLUS      /* XXX mmu XXX */
>        if (MIPS_HAS_R4K_MMU && last)   /* XXX why */
>                mips_dcache_wbinv_range_index(va, PAGE_SIZE);
>  #endif /* MIPS3_PLUS */
>
>
> ---
>
> (though I have not tried options DIAGNOSTIC one)


With sources updated about half an hour ago and your patch added to
pmap.c, the situation is:

The S4 kernel (including options MIPS3) continues to work and may boot
to multi-user.

The S5 kernel (S4 but with options MIPS3 line removed) now also boots
into multi-user -- this is the kernel that previously looped
indefinitely.

However the S6 kernel (S5 with options DEBUG and DIAGNOSTIC added) panics:

Boot: 3/rz4/netbsd.s6
3454800+143520 [192208+187028]=0x3cb668
Starting at 0x80030000

mips_fixup_stubs: 6762 fixups done in 0 cycles
Loaded initial symtab at 0x8039e7f0, strtab at 0x803cdbd4, # entries 11992


mcclock: iters 11680 computed MHz 33, instrs per usec=19

segment 0 start 00000000 size 02000000
phys segment: 0x2000000 @ 0

adding 0x402000 @ 0x3fe000 to freelist 1


adding 0x1800000 @ 0x800000 to freelist 0

pmap_steal_memory: seg 0: 0x3fe 0x3fe 0x800 0x800
pmap_steal_memory: seg 0: 0x424 0x424 0x800 0x800


Copyright (c) 1996, 1997, 1998, 1999, 2000, 2001, 2002, 2003, 2004, 2005,
2006, 2007, 2008, 2009, 2010, 2011
The NetBSD Foundation, Inc. All rights reserved.
Copyright (c) 1982, 1986, 1989, 1991, 1993
The Regents of the University of California. All rights reserved.

NetBSD 5.99.51 (S6) #1: Sun May 1 16:50:49 CEST 2011
er...@x8-nb.h.recerik.dk:/home/NetBSD/crossbuild/obj.pmax/sys/arch/pmax/compile/S6


DECstation 5000/133 (3MIN)
total memory = 32768 KB

avail memory = 27884 KB


mainbus0 (root)
cpu0 at mainbus0: MIPS R3000A CPU (0x230) Rev. 3.0 with MIPS R3010 FPC Rev. 4.0
cpu0: 64KB/4B direct-mapped Instruction cache, 64 TLB entries
cpu0: 128KB/4B direct-mapped write-through Data cache
tc0 at mainbus0: 12.5 MHz clock
ioasic0 at tc0 slot 3 offset 0x0
le0 at ioasic0 offset 0xc0000: address 08:00:2b:32:56:6f
le0: 32 receive buffers, 8 transmit buffers

3MIN: imask 1030, enabling slot 0x2, dev 0xc362ac18 handler 0x80033280

zsc0 at ioasic0 offset 0x100000
vsms0 at zsc0 channel 0
wsmouse0 at vsms0 mux 0
zstty0 at zsc0 channel 1

3MIN: imask 1130, enabling slot 0x0, dev 0xc362ac18 handler 0x802fec3c


zsc1 at ioasic0 offset 0x180000
lkkbd0 at zsc1 channel 0
wskbd0 at lkkbd0 mux 1
zstty1 at zsc1 channel 1 (console i/o)

3MIN: imask 1170, enabling slot 0x1, dev 0xc362ac18 handler 0x802fec3c


mcclock0 at ioasic0 offset 0x200000: mc146818 or compatible

asc0 at ioasic0 offset 0x3000003MIN: imask 11f0, enabling slot 0x3,

dev 0xc362ac18 handler 0x80182d90


: NCR53C94, 25MHz, SCSI ID 7
scsibus0 at asc0: 8 targets, 8 luns per target
scsibus0: waiting 2 seconds for devices to settle...
sd0 at scsibus0 target 4 lun 0: <QUANTUM, QM39100TD-S, N1B0> disk fixed
sd0: 8683 MB, 8057 cyl, 10 head, 220 sec, 512 bytes/sect x 17783249 sectors
sd0: sync (200.00ns offset 15), 8-bit (5.000MB/s) transfers, tagged queueing
boot device: sd0
root on sd0a dumps on sd0b

mountroot: trying nfs...
mountroot: trying lfs...
mountroot: trying ffs...

root file system type: ffs

init: copying out flags `-s' 3
init: copying out path `/sbin/init' 11

pid 1(init): ABI set to O32 (e_flags=0x1007)

panic: tlb_hi (0xc3ec1000) asid (0) != current asid (0x3)

cpu0: Begin traceback...
pid -1007936632 not found
cpu0: End traceback...
0xc3ec1b70: cpu_reboot+3c (104,0,b1,80357858) ra 802242fc sz 24
0xc3ec1b88: panic+258 (104,c3ec1000,0,3) ra 801d5d7c sz 56
0xc3ec1bc0: pmap_tlb_asid_check+4c (104,c3ec1000,0,3) ra 801d65dc sz 24
0xc3ec1bd8: pmap_tlb_update_addr+8c (104,c3ec1000,0,3) ra 801d4a2c sz 40
0xc3ec1c00: pmap_enter+220 (104,c3ec1000,0,3) ra 802a961c sz 72
0xc3ec1c48: uvm_fault_lower+618 (104,c3ec1000,0,3) ra 802aab4c sz 96
0xc3ec1ca8: uvm_fault_internal+834 (81ee5d20,c3ec1000,7de99000,0) ra
80263db4 sz 272
0xc3ec1db8: trap+970 (8,8,7de99000,7de99c08) ra 80176950 sz 400
0xc3ec1f48: mips1_user_gen_exception+e0 (8,8,7de99000,7de99c08) ra 0 sz 0
User-level: pid 2.1

dumping to dev 19,1 offset 1332112
dump 32 31 30 29 28 27 26 25 24 23 22 21 20 19 18 17 16 15 14 13 12 11
10 9 8 7 6 5 4 3 2 1 succeeded


rebooting...

But at least you seem to have identified at least part of the problem.

kind regards
- Erik

Izumi Tsutsui

unread,
May 8, 2011, 3:14:29 AM5/8/11
to
Erik Bertelsen wrote on port-pmax@:
http://mail-index.NetBSD.org/port-pmax/2011/05/02/msg000107.html

> pid 1(init): ABI set to O32 (e_flags=0x1007)
> panic: tlb_hi (0xc3ec1000) asid (0) != current asid (0x3)
> cpu0: Begin traceback...
> pid -1007936632 not found
> cpu0: End traceback...
> 0xc3ec1b70: cpu_reboot+3c (104,0,b1,80357858) ra 802242fc sz 24
> 0xc3ec1b88: panic+258 (104,c3ec1000,0,3) ra 801d5d7c sz 56
> 0xc3ec1bc0: pmap_tlb_asid_check+4c (104,c3ec1000,0,3) ra 801d65dc sz 24
> 0xc3ec1bd8: pmap_tlb_update_addr+8c (104,c3ec1000,0,3) ra 801d4a2c sz 40
> 0xc3ec1c00: pmap_enter+220 (104,c3ec1000,0,3) ra 802a961c sz 72
> 0xc3ec1c48: uvm_fault_lower+618 (104,c3ec1000,0,3) ra 802aab4c sz 96
> 0xc3ec1ca8: uvm_fault_internal+834 (81ee5d20,c3ec1000,7de99000,0) ra
> 80263db4 sz 272
> 0xc3ec1db8: trap+970 (8,8,7de99000,7de99c08) ra 80176950 sz 400
> 0xc3ec1f48: mips1_user_gen_exception+e0 (8,8,7de99000,7de99c08) ra 0 sz 0
> User-level: pid 2.1

This is reproducible on gxemul emulating 3MAX:

---

Building databases: dev, utmp, utmpx done
Starting syslogd.
panic: tlb_hi (0xc645f000) asid (0) != current asid (0xf)
kernel: breakpoint trap
Stopped in pid 122.1 (sh) at netbsd:cpu_Debugger+0x4: jr ra
bdslot: nop
db> tr
0xc6463e80: cpu_Debugger+4 (83fff000,803d9b18,b1,803d9b34) ra 80291fb4 sz 0
0xc6463e80: panic+260 (83fff000,c645f000,0,f) ra 8020a8bc sz 56
0xc6463eb8: pmap_tlb_asid_check+6c (83fff000,c645f000,0,f) ra 8020acd8 sz 24
0xc6463ed0: pmap_tlb_asid_acquire+3d0 (83fff000,c645f000,0,f) ra 802073cc sz 56
0xc6463f08: pmap_activate+50 (83fff000,c645f000,0,f) ra 80150494 sz 32
0xc646ef28: lwp_startup+74 (83fff000,c645f000,0,f) ra 801a7154 sz 32
0xc6463f48: mips1_lwp_trampoline+10 (83fff000,c645f000,0,f) ra 0 sz 24
User-level: pid 122.1
db>

---

I wonder how pmap_tlb_asid_check called from pmap_tlb_asid_acquire()
could fail..

---
pmap_tlb_asid_acquire(pmap_t pm, struct lwp *l)
{
struct cpu_info * const ci = l->l_cpu;
struct pmap_tlb_info * const ti = ci->ci_tlb_info;
struct pmap_asid_info * const pai = PMAP_PAI(pm, ti);

:
if (l == curlwp) {
:
ci->ci_pmap_asid_cur = pai->pai_asid;
tlb_set_asid(pai->pai_asid);
pmap_tlb_asid_check();

:

void
pmap_tlb_asid_check(void)
{
#ifdef DEBUG
kpreempt_disable();
uint32_t tlb_hi;
__asm("mfc0 %0,$%1" : "=r"(tlb_hi) : "n"(MIPS_COP_0_TLB_HI));
uint32_t asid = (tlb_hi & MIPS_TLB_PID) >> MIPS_TLB_PID_SHIFT;
KDASSERTMSG(asid == curcpu()->ci_pmap_asid_cur,
("tlb_hi (%#x) asid (%#x) != current asid (%#x)",
tlb_hi, asid, curcpu()->ci_pmap_asid_cur));
kpreempt_enable();
#endif
}

---


I put the following changes to locore_mips1.S, but the asid assetion
still happens. (I'm not sure if these fixes are necessary)

- use MIPS1_TLB_PID and MIPS1_TLB_PID_SHIFT rather than
PG_ASID to get ASID in tlb_invalidates_asids()
- use MIPS1_TLB_PID and MIPS1_TLB_PID_SHIFT rather than
PG_ASID and MIPS1_TLB_INDEX_SHIFT to get ASID in tlb_record_asids()
- save and restore MIPS_COP_0_TLB_HI in tlb_invalidate_all() and
cpu_switch_resume as mipsX_subr.S does

---
Izumi Tsutsui

0 new messages