Hi,

when running current NetBSD/i386 (modified GENERIC kernel (4.99.17)
with `mgadrm* at vga?') on a system with a Matrox G400 card, starting
the X.org server crashes the system. Both x11/modular-xorg-server (with
option `glx') and x11/xf86-video-mga (using wip/mesa-dri) were built
from pkgsrc.

$ dmesg
[...]
vga0 at pci1 dev 0 function 0: Matrox MGA G400 AGP (rev. 0x04)
wsdisplay0 at vga0 kbdmux 1: console (80x25, vt100 emulation)
wsmux1: connecting to wsdisplay0
mgadrm0 at vga0
info: [drm] Matrox G400/G450 (AGP) (unit 0)
info: [drm] AGP at 0xf8000000 64MB
info: [drm] Initialized mga 3.2.2 20060319
[...]

$ sysctl -qw ddb.tee_msgbuf=1
$ sysctl -qw hw.dri.debug=1
$ xorgcfg
[screen is blanked]
[system seems to drop into ddb; typing `bt' and `sync']

This is what dmesg reported after the restart:

[drm:pid754:drm_open] open_count = 0
[drm:pid754:drm_open_helper] pid = 754, minor = 0
[drm:pid754:drm_addmap] offset = 0x00000000, size = 0x00002000, type = 2
[drm:pid754:drm_addmap] 8192 13 0xc1c1b000
[drm:pid754:drm_addmap] Added map 2 0xc1c1b000/0x2000
[drm:pid754:drm_firstopen] 
[drm:pid754:drm_ioctl] pid=754, cmd=0xc0246400, nr=0x00, dev 0xc1860800, auth=1
[drm:pid754:drm_ioctl] pid=754, cmd=0xc0246400, nr=0x00, dev 0xc1860800, auth=1
[drm:pid754:drm_close] open_count = 1
[drm:pid754:drm_close] setting priv->refs 1 to 1
[drm:pid754:drm_close] setting open_count 1 to 1
[drm:pid754:drm_close_pid] pid = 754, device = 0xc1860800, open_count = 1
[drm:pid754:drm_lastclose] 
[drm:pid754:mga_do_cleanup_dma] 
[drm:pid754:drm_lastclose] 
[drm:pid754:drm_open] open_count = 0
[drm:pid754:drm_open_helper] pid = 754, minor = 0
[drm:pid754:drm_addmap] offset = 0x00000000, size = 0x00002000, type = 2
[drm:pid754:drm_addmap] 8192 13 0xc1c1b000
[drm:pid754:drm_addmap] Added map 2 0xc1c1b000/0x2000
[drm:pid754:drm_firstopen] 
[drm:pid754:drm_ioctl] pid=754, cmd=0xc0246400, nr=0x00, dev 0xc1860800, auth=1
[drm:pid754:drm_ioctl] pid=754, cmd=0xc0246400, nr=0x00, dev 0xc1860800, auth=1
[drm:pid754:drm_close] open_count = 1
[drm:pid754:drm_close] setting priv->refs 1 to 1
[drm:pid754:drm_close] setting open_count 1 to 1
[drm:pid754:drm_close_pid] pid = 754, device = 0xc1860800, open_count = 1
[drm:pid754:drm_lastclose] 
[drm:pid754:mga_do_cleanup_dma] 
[drm:pid754:drm_lastclose] 
[drm:pid754:drm_open] open_count = 0
[drm:pid754:drm_open_helper] pid = 754, minor = 0
[drm:pid754:drm_addmap] offset = 0x00000000, size = 0x00002000, type = 2
[drm:pid754:drm_addmap] 8192 13 0xc1c1b000
[drm:pid754:drm_addmap] Added map 2 0xc1c1b000/0x2000
[drm:pid754:drm_firstopen] 
[drm:pid754:drm_ioctl] pid=754, cmd=0xc0106407, nr=0x07, dev 0xc1860800, auth=1
[drm:pid754:drm_ioctl] pid=754, cmd=0xc0086401, nr=0x01, dev 0xc1860800, auth=1
[drm:pid754:drm_ioctl] pid=754, cmd=0xc0086401, nr=0x01, dev 0xc1860800, auth=1
[drm:pid754:drm_ioctl] pid=754, cmd=0xc0106407, nr=0x07, dev 0xc1860800, auth=1
[drm:pid754:drm_ioctl] pid=754, cmd=0xc0186415, nr=0x15, dev 0xc1860800, auth=1
[drm:pid754:drm_addmap] offset = 0x00000000, size = 0x00002000, type = 2
[drm:pid754:drm_addmap] Found kernel map 2
[drm:pid754:drm_addmap] Added map 2 0xc1c1b000/0x2000
[drm:pid754:drm_ioctl] pid=754, cmd=0xc0186415, nr=0x15, dev 0xc1860800, auth=1
[drm:pid754:drm_addmap] offset = 0xf6000000, size = 0x02000000, type = 0
[drm:pid754:drm_mtrr_add] offset=f6000000 size=33554432
[drm:pid754:drm_addmap] Added map 0 0xf6000000/0x2000000
[drm:pid754:drm_ioctl] pid=754, cmd=0xc0086426, nr=0x26, dev 0xc1860800, auth=1
[drm:pid754:drm_ioctl] pid=754, cmd=0xc0086426, nr=0x26, dev 0xc1860800, auth=1
[drm:pid754:drm_ioctl] pid=754, cmd=0xc0246400, nr=0x00, dev 0xc1860800, auth=1
[drm:pid754:drm_ioctl] pid=754, cmd=0xc0246400, nr=0x00, dev 0xc1860800, auth=1
[drm:pid754:drm_ioctl] pid=754, cmd=0xc01c644c, nr=0x4c, dev 0xc1860800, auth=1
[drm:pid754:drm_addmap] offset = 0xf5000000, size = 0x00004000, type = 1
[drm:pid754:drm_ioremap] ioremap mem found: 0xcbfc9000
[drm:pid754:drm_addmap] Added map 1 0xf5000000/0x4000
[drm:pid754:drm_addmap] offset = 0x00000000, size = 0x00002000, type = 2
[drm:pid754:drm_addmap] Found kernel map 2
[drm:pid754:drm_addmap] Added map 2 0xc1c1b000/0x2000
[drm:pid754:drm_agp_bind] agp_bind, page_size=1000
[drm:pid754:drm_addmap] offset = 0x00000000, size = 0x00001000, type = 3
[drm:pid754:drm_addmap] Added map 3 0xf8000000/0x1000
[drm:pid754:drm_addmap] offset = 0x00001000, size = 0x00100000, type = 3
[drm:pid754:drm_addmap] Added map 3 0xf8001000/0x100000
[drm:pid754:drm_addmap] offset = 0x00101000, size = 0x00800000, type = 3
[drm:pid754:drm_addmap] Added map 3 0xf8101000/0x800000
[drm:pid754:drm_do_addbufs_agp] count:      128
[drm:pid754:drm_do_addbufs_agp] order:      16
[drm:pid754:drm_do_addbufs_agp] size:       65536
[drm:pid754:drm_do_addbufs_agp] agp_offset: 0xf8101000
[drm:pid754:drm_do_addbufs_agp] alignment:  65536
[drm:pid754:drm_do_addbufs_agp] page_order: 4
[drm:pid754:drm_do_addbufs_agp] total:      65536
[drm:pid754:drm_do_addbufs_agp] byte_count: 8388608
[drm:pid754:drm_do_addbufs_agp] dma->buf_count : 128
[drm:pid754:drm_do_addbufs_agp] entry->buf_count : 128
[drm:pid754:drm_addmap] offset = 0x00901000, size = 0x002ff000, type = 3
[drm:pid754:drm_addmap] Added map 3 0xf8901000/0x2ff000
[drm:pid754:drm_ioremap] ioremap agp mem found: 0xcbf9e000
[drm:pid754:drm_ioremap] ioremap agp mem found: 0xccd00000
[drm:pid754:drm_ioremap] ioremap agp mem found: 0xcce00000
info: [drm] Initialized card for AGP DMA.
[drm:pid754:drm_ioctl] pid=754, cmd=0xc0086420, nr=0x20, dev 0xc1860800, auth=1
[drm:pid754:drm_ctxbitmap_next] drm_ctxbitmap_next bit : 1
[drm:pid754:drm_addctx] 1
[drm:pid754:drm_ioctl] pid=754, cmd=0x80086422, nr=0x22, dev 0xc1860800, auth=1
[drm:pid754:drm_ioctl] pid=754, cmd=0x8008642a, nr=0x2a, dev 0xc1860800, auth=1
[drm:pid754:drm_lock] 1 (pid 754) requests lock (0x00000000), flags = 0x00000000
[drm:pid754:drm_lock] 1 has lock
[drm:pid754:drm_ioctl] pid=754, cmd=0x8004667d, nr=0x7d, dev 0xc1860800, auth=1
[drm:pid754:drm_ioctl] pid=754, cmd=0x8004667c, nr=0x7c, dev 0xc1860800, auth=1
[drm:pid754:drm_ioctl] pid=754, cmd=0x805c6440, nr=0x40, dev 0xc1860800, auth=1
[drm:pid754:mga_do_init_dma] 
[drm:pid754:mga_warp_install_microcode] MGA ucode size = 2047 bytes
[drm:pid754:mga_warp_install_g400_microcode]  pcbase = 0xf8000000  vcbase = 0xcbf9e000
[drm:pid754:mga_warp_install_g400_microcode]  pcbase = 0xf8000400  vcbase = 0xcbf9e400
[drm:pid754:mga_warp_install_g400_microcode]  pcbase = 0xf8000800  vcbase = 0xcbf9e800
[drm:pid754:mga_warp_install_g400_microcode]  pcbase = 0xf8000c00  vcbase = 0xcbf9ec00
[drm:pid754:mga_warp_install_g400_microcode]  pcbase = 0xf8001000  vcbase = 0xcbf9f000
uvm_fault(0xc0492840, 0xcbf9f000, 2) -> 0xe
kernel: supervisor trap page fault, code=0
Stopped in pid 754.1 (Xorg) at	netbsd:memcpy+0x15:	repe movsl	(%esi),%es:(%edi)
db> memcpy(c1861f00,2f2,c04184dc,c02a7112,c1bc8e58) at netbsd:memcpy+0x15
mga_dma_init(b400,805c6440,cbfc8b98,43,cbf11660) at netbsd:mga_dma_init+0x3ba
drm_ioctl(b400,805c6440,cbfc8b98,43,cbf11660) at netbsd:drm_ioctl+0x3c6
spec_ioctl(cbfc8a70,0,ffffc000,c04085e0,cc015200) at netbsd:spec_ioctl+0xc2
VOP_IOCTL(cc015200,805c6440,cbfc8b98,43,cbfa4544) at netbsd:VOP_IOCTL+0x3d
vn_ioctl(cbfa7cec,805c6440,cbfc8b98,cbf11660,cc01ba8c) at netbsd:vn_ioctl+0x71
sys_ioctl(cbf11660,cbfc8c48,cbfc8c68,cbfc0010,c0350030) at netbsd:sys_ioctl+0x164
syscall_plain() at netbsd:syscall_plain+0x106
--- syscall (number 54) ---
0xbbab5f07:
db> syncing disks... 6 done
unmounting file systems...
[...]

A crash dump from a previous crash is available:

$ gdb netbsd.1
GNU gdb 6.5
[...]
(gdb) target kvm netbsd.1.core
#0  0xc0353dca in cpu_reboot ()
(gdb) bt
#0  0xc0353dca in cpu_reboot ()
#1  0xc0160170 in db_sync_cmd ()
#2  0xc0160660 in db_command ()
#3  0xc0160a18 in db_command_loop ()
#4  0xc01637e7 in db_trap ()
#5  0xc034fdb6 in kdb_trap ()
#6  0xc035c385 in trap ()
#7  0xc0102ddf in calltrap ()
#8  0xc03dc46d in memcpy ()
#9  0xd2f90010 in ?? ()
#10 0xc0260030 in ufs_getattr ()
#11 0xc0386aca in mga_dma_init ()
#12 0xc019bf16 in drm_ioctl ()
#13 0xc030fdf2 in spec_ioctl ()
#14 0xc030a1ad in VOP_IOCTL ()
#15 0xc03074c1 in vn_ioctl ()
#16 0xc02d7d54 in sys_ioctl ()
#17 0xc035bd96 in syscall_plain ()
#18 0xc0100617 in syscall1 ()
(gdb) quit


Any additional information I should provide?

Regards, Jukka

-- 
bashian roulette:
$ ((RANDOM%6)) || rm -rf ~