Bootup Crash observed on kaanapali

[vnarapar]

Bootup crash observed on Kaanapali

Logs: https://lava-oss.qualcomm.com/scheduler/job/78415#L2559

[    7.777628][    C0] [drm:dpu_encoder_frame_done_timeout:2731] [dpu error]enc33 frame done timeout
[    7.779835][  T283] Unable to handle kernel paging request at virtual address ffff80008046e000
[    7.779844][  T283] Mem abort info:
[    7.779848][  T283]   ESR = 0x0000000096000007
[    7.779853][  T283]   EC = 0x25: DABT (current EL), IL = 32 bits
[    7.779859][  T283]   SET = 0, FnV = 0
[    7.779863][  T283]   EA = 0, S1PTW = 0
[    7.779867][  T283]   FSC = 0x07: level 3 translation fault
[    7.779872][  T283] Data abort info:
[    7.779875][  T283]   ISV = 0, ISS = 0x00000007, ISS2 = 0x00000000
[    7.779880][  T283]   CM = 0, WnR = 0, TnD = 0, TagAccess = 0
[    7.779885][  T283]   GCS = 0, Overlay = 0, DirtyBit = 0, Xs = 0
[    7.779890][  T283] swapper pgtable: 4k pages, 48-bit VAs, pgdp=0000000aa9cfc000
[    7.779897][  T283] [ffff80008046e000] pgd=0000000000000000, p4d=1000000880346403, pud=1000000880347403, pmd=1000000880bd2403, pte=0000000000000000

[yogeshlal]

KernelCI also observing similar issue on 7.1-rc1

Panic log:

[ 6.501261] msm_dpu 9801000.display-controller: bound 9ac0000.dsi (ops dsi_ops [msm])"}
[ 6.510415] [drm:dpu_kms_hw_init:1168] dpu hardware revision:0xd0000000"}
[ 6.525289] ufshcd-qcom 1d84000.ufs: uic cmd 0x16 with arg3 0x0 completion timeout"}
[ 6.533363] [drm] Initialized msm 1.13.0 for 9801000.display-controller on minor 0"}
[ 6.541154] msm_dpu 9801000.display-controller: no GPU device was found"}
[ 6.835947] Console: switching to colour frame buffer device 180x200"}
[ 6.835963] fb0: sys_imageblit: framebuffer is not in virtual address space."}
[ 6.881317] [drm:dpu_encoder_frame_done_timeout:2731] [dpu error]enc35 frame done timeout"}
[ 6.882796] Unable to handle kernel paging request at virtual address ffff8000801be000"}
[ 6.882797] Mem abort info:"}
[ 6.882797] ESR = 0x0000000096000007"}
[ 6.882798] EC = 0x25: DABT (current EL), IL = 32 bits"}
[ 6.882799] SET = 0, FnV = 0"}
[ 6.882799] EA = 0, S1PTW = 0"}
[ 6.882800] FSC = 0x07: level 3 translation fault"}
[ 6.882800] Data abort info:"}
[ 6.882801] ISV = 0, ISS = 0x00000007, ISS2 = 0x00000000"}
[ 6.882801] CM = 0, WnR = 0, TnD = 0, TagAccess = 0"}
[ 6.882801] GCS = 0, Overlay = 0, DirtyBit = 0, Xs = 0"}
[ 6.882802] swapper pgtable: 4k pages, 48-bit VAs, pgdp=0000000946f3b000"}
[ 6.882803] [ffff8000801be000] pgd=0000000000000000, p4d=100000088006e403, pud=100000088006f403, pmd=1000000880074403,

kernel Version info:

"kernel_revision": {
"tree": "mainline",
"url": "https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git",
"branch": "master",
"commit": "3b3bea6d4b9c162f9e555905d96b8c1da67ecd5b",
"describe": "v7.1-rc1-55-g3b3bea6d4b9c1",
"version": {
"version": 7,
"patchlevel": 1,
"sublevel": null,
"extra": "-rc1-55-g3b3bea6d4b9c1",
"name": null
},
"patchset": null,
"commit_tags": [],
"commit_message": "Merge tag 'cgroup-for-7.1-rc1-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/tj/cgroup\n\nPull cgroup fixes from Tejun Heo:\n\n - Fix UAF race in psi pressure_write() against cgroup file release by\n extending cgroup_mutex coverage and ordering of->priv access after\n cgroup_kn_lock_live()\n\n - Fix integer overflow in rdmacg_try_charge() when usage equals INT_MAX\n by performing the increment in s64\n\n - Fix asymmetric DL bandwidth accounting on cpuset attach rollback by\n recording the CPU used by dl_bw_alloc() so cancel_attach() returns\n the reservation to the same root domain\n\n - Fix nr_dying_subsys_* race that briefly showed 0 in cgroup.stat after\n rmdir by incrementing from kill_css() instead of offline_css()\n\n - Typo fix in cgroup-v2 documentation\n\n* tag 'cgroup-for-7.1-rc1-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/tj/cgroup:\n docs: cgroup: fix typo 'protetion' -> 'protection'\n cgroup: Increment nr_dying_subsys_* from rmdir context\n cgroup/cpuset: record DL BW alloc CPU for attach rollback\n cgroup/rdma: fix integer overflow in rdmacg_try_charge()\n sched/psi: fix race between file release and pressure write",
"tip_of_branch": true
},
"arch": "arm64",
"defconfig": "defconfig",
"config_full": "defconfig+lab-setup+kselftest",
"compiler": "gcc-14",

Kernel artifacts:

dtb : https://files.kernelci.org/kbuild-gcc-14-arm64-69f0079d9b5a96830910be34/dtbs/qcom/kaanapali-mtp.dtb
Kernel Image : https://files.kernelci.org/kbuild-gcc-14-arm64-69f0079d9b5a96830910be34/Image.gz
Kernel Modules : https://files.kernelci.org/kbuild-gcc-14-arm64-69f0079d9b5a96830910be34/modules.tar.xz

LAVA Job:

https://lava-oss.qualcomm.com/scheduler/job/81477

[sgaud-quic]

Issue is seen with default enablement of virtual planes in drm driver :
qualcomm-linux/kernel-topics@f66a882

Reverting this to unblock 7.0

[lumag]

The fix for the dumping code: https://patch.msgid.link/20260428-msm-fix-dsi-dump-v1-1-5d4cb5ccfac7@oss.qualcomm.com

[sgaud-quic]

The fix for the dumping code: https://patch.msgid.link/20260428-msm-fix-dsi-dump-v1-1-5d4cb5ccfac7@oss.qualcomm.com

Tried with the fix, still seeing a crash :
https://lava-oss.qualcomm.com/scheduler/job/86802

[   11.981567][  T386] pci_bus 0000:01: resource 1 [mem 0x40400000-0x406fffff]
[   11.982076][  T386] pcieport 0000:00:00.0: PME: Signaling with IRQ 243
[   11.982598][  T392] Unable to handle kernel paging request at virtual address ffff8000804de000
[   11.982608][  T392] Mem abort info:
[   11.982611][  T392]   ESR = 0x0000000096000007
[   11.982616][  T392]   EC = 0x25: DABT (current EL), IL = 32 bits
[   11.982622][  T392]   SET = 0, FnV = 0
[   11.982626][  T392]   EA = 0, S1PTW = 0
[   11.982630][  T392]   FSC = 0x07: level 3 translation fault
[   11.982635][  T392] Data abort info:
[   11.982639][  T392]   ISV = 0, ISS = 0x00000007, ISS2 = 0x00000000
[   11.982643][  T392]   CM = 0, WnR = 0, TnD = 0, TagAccess = 0
[   11.982648][  T392]   GCS = 0, Overlay = 0, DirtyBit = 0, Xs = 0
[   11.982654][  T392] swapper pgtable: 4k pages, 48-bit VAs, pgdp=0000000a3e0ac000
[   11.982660][  T392] [ffff8000804de000] pgd=0000000000000000, p4d=1000000880346403, pud=1000000880347403, pmd=1000000880bd2403, pte=0000000000000000
[   11.982685][  T392] Internal error: Oops: 0000000096000007 [#1]  SMP

[lumag]

Salendarsingh Gaud (@sgaud-quic) could you please check? The job that you've references #495 in its description. Could you please point out the tree that was used to build the kernel?

[sgaud-quic]

@sgaud-quic could you please check? The job that you've references #495 in its description. Could you please point out the tree that was used to build the kernel?

my bad i haven't updated the description before re-triggering the job, this is the build that was generated and pushed to S3 bucket :
https://qli-prd-kernel-gh-artifacts.s3.amazonaws.com/qualcomm-linux/kernel/debug/KNP_fix_1/qcom-multimedia-image-kaanapali-mtp.rootfs.qcomflash.tar.gz

Just for confirmation here is the SHA that i pulled in the WS :

commit **22456949b792a41f79cd1d40bc8ed2eede5b3347** (HEAD -> qcom-next-staging-7.0-20260420)
Author: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com>
Date:   Tue Apr 28 20:21:38 2026 +0300

    drm/msm/dsi: don't dump registers past the mapped region

and from lava job here is the kernel version which matches the SHA:

[    0.000000][    T0] Linux version 7.0.0-00699-g**22456949b792** (@a73879b19309) (aarch64-linux-gnu-gcc (Ubuntu 13.3.0-6ubuntu2~24.04.1) 13.3.0, GNU ld (GNU Binutils for Ubuntu) 2.42) #2 SMP PREEMPT Thu Apr 30 04:26:28 UTC 2026

[lumag]

On top of the previous patch:

https://patch.msgid.link/20260516-msm-fix-dsi-dump-2-v1-1-43928094d25b@oss.qualcomm.com

[lumag]

Updated the patch, https://patch.msgid.link/20260516-msm-fix-dsi-dump-2-v2-1-9e49fb2d240e@oss.qualcomm.com