[i915] NULL pointer on Linux 4.18.0-14-generic / cosmic

After updated an old laptop to Ubuntu Cosmic (was running Xenial before) the graphic hangs at startup, nothing is displayed but a grey screen (grub residual), note that the recovery boot option using `nodmodeset` displays a text console and I'm still able to log-in over a serial tty on normal boot so kernel is alive but computer is not usable due to lack graphic support.

Computer is a Thinkpad X61 Tablet plugged on an X6 Tablet UltraBase
- http://www.thinkwiki.org/wiki/Category:X61_Tablet
- http://www.thinkwiki.org/wiki/ThinkPad_X6_Tablet_UltraBase
GPU is an Intel GMA X3100
- http://www.thinkwiki.org/wiki/Intel_Graphics_Media_Accelerator_X3100

Some information:

# lsb_release -a
No LSB modules are available.
Distributor ID: Ubuntu
Description: Ubuntu 18.10
Release: 18.10
Codename: cosmic

# uname -a
Linux arwen 4.18.0-14-generic #15-Ubuntu SMP Mon Jan 14 09:01:02 UTC 2019 x86_64 x86_64 x86_64 GNU/Linux

# lspci -vvv -nn -s 00:02.0
00:02.0 VGA compatible controller [0300]: Intel Corporation Mobile GM965/GL960 Integrated Graphics Controller (primary) [8086:2a02] (rev 0c) (prog-if 00 [VGA controller])
 Subsystem: Lenovo GM965 [X3100] on ThinkPad T61/R61 [17aa:20b5]
 Control: I/O+ Mem+ BusMaster+ SpecCycle- MemWINV- VGASnoop- ParErr- Stepping- SERR- FastB2B- DisINTx-
 Status: Cap+ 66MHz- UDF- FastB2B+ ParErr- DEVSEL=fast >TAbort- <TAbort- <MAbort- >SERR- <PERR- INTx-
 Latency: 0
 Interrupt: pin A routed to IRQ 16
 Region 0: Memory at f8000000 (64-bit, non-prefetchable) [size=1M]
 Region 2: Memory at e0000000 (64-bit, prefetchable) [size=256M]
 Region 4: I/O ports at 1800 [size=8]
 [virtual] Expansion ROM at 000c0000 [disabled] [size=128K]
 Capabilities: [90] MSI: Enable- Count=1/1 Maskable- 64bit-
  Address: 00000000 Data: 0000
 Capabilities: [d0] Power Management version 3
  Flags: PMEClk- DSI+ D1- D2- AuxCurrent=0mA PME(D0-,D1-,D2-,D3hot-,D3cold-)
  Status: D0 NoSoftRst- PME-Enable- DSel=0 DScale=0 PME-
  Bridge: PM- B3+
 Kernel driver in use: i915
 Kernel modules: i915, intelfb

Useful bits from dmesg:

[ 0.000000] microcode: microcode updated early to revision 0xba, date = 2010-10-03
[ 0.000000] Linux version 4.18.0-14-generic (buildd@lgw01-amd64-036) (gcc version 8.2.0 (Ubuntu 8.2.0-7ubuntu1)) #15-Ubuntu SMP Mon Jan 14 09:01:02 UTC 2019 (Ubuntu 4.18.0-14.15-generic 4.18.20)
[ 0.000000] Command line: BOOT_IMAGE=/boot/vmlinuz-4.18.0-14-generic root=/dev/mapper/arwen--vg-arwen--disk ro console=tty0 console=ttyS0,9600n8 quiet splash vt.handoff=1
[ 0.000000] DMI: LENOVO 7762B6G/7762B6G, BIOS 7SET38WW (1.24 ) 10/12/2009
[ 0.000000] total RAM covered: 2023M
[ 0.000000] ACPI BIOS Warning (bug): 32/64X length mismatch in FADT/Gpe0Block: 64/32 (20180531/tbfadt-569)
[ 0.000000] ACPI BIOS Warning (bug): Optional FADT field Gpe1Block has valid Address but zero Length: 0x000000000000102C/0x0 (20180531/tbfadt-624)
[ 0.000000] Reserving Intel graphics memory at [mem 0x7e800000-0x7effffff]
[ 0.000000] vt handoff: transparent VT on vt#1
[ 0.000000] Console: colour dummy device 80x25
[ 0.000000] console [tty0] enabled
[ 0.000000] console [ttyS0] enabled
[ 0.036000] smpboot: CPU0: Intel(R) Core(TM)2 Duo CPU L7500 @ 1.60GHz (family: 0x6, model: 0xf, stepping: 0xb)
[ 0.150851] pci 0000:00:02.0: vgaarb: setting as boot VGA device
[ 0.150851] pci 0000:00:02.0: vgaarb: VGA device added: decodes=io+mem,owns=io+mem,locks=none
[ 0.150851] pci 0000:00:02.0: vgaarb: bridge control possible
[ 0.150851] vgaarb: loaded
[ 1.812994] vesafb: mode is 1024x768x32, linelength=4096, pages=0
[ 1.812996] vesafb: scrolling: redraw
[ 1.812999] vesafb: Truecolor: size=8:8:8:8, shift=24:16:8:0
[ 1.813021] vesafb: framebuffer at 0xe0000000, mapped to 0x(____ptrval____), using 3072k, total 3072k
[ 1.813205] Console: switching to colour frame buffer device 128x48
[ 1.813241] fb0: VESA VGA frame buffer device
[ 1.813268] intel_idle: does not run on family 6 model 15
[ 2.033228] rtc_cmos 00:02: setting system clock to 2019-01-28 00:00:16 UTC (1548633616)
[ 2.037838] Unstable clock detected, switching default tracing clock to "global"
               If you want to keep using the local clock, then add:
                 "trace_clock=local"
               on the kernel command line
[ 2.648281] pci 0000:00:00.0: Intel 965GM Chipset
[ 2.648317] pci 0000:00:00.0: detected gtt size: 524288K total, 262144K mappable
[ 2.649759] pci 0000:00:00.0: detected 8192K stolen memory
[ 2.650159] checking generic (e0000000 300000) vs hw (e0000000 10000000)
[ 2.650161] fb: switching to inteldrmfb from VESA VGA
[ 2.650208] Console: switching to colour dummy device 80x25
[ 2.650405] [drm] Replacing VGA console driver
[ 2.664856] [drm] Supports vblank timestamp caching Rev 2 (21.10.2013).
[ 2.664858] [drm] Driver supports precise vblank timestamp query.
[ 2.672436] gpio_ich: GPIO from 462 to 511 on gpio_ich
[ 2.686494] i915 0000:00:02.0: vgaarb: changed VGA decodes: olddecodes=io+mem,decodes=io+mem:owns=io+mem
[ 2.705212] [drm] RC6 disabled, disabling runtime PM support
[ 2.705253] BUG: unable to handle kernel NULL pointer dereference at 0000000000000008
[ 2.709180] PGD 0 P4D 0
[ 2.709180] Oops: 0000 [#1] SMP PTI
[ 2.709180] CPU: 0 PID: 164 Comm: systemd-udevd Not tainted 4.18.0-14-generic #15-Ubuntu
[ 2.709180] Hardware name: LENOVO 7762B6G/7762B6G, BIOS 7SET38WW (1.24 ) 10/12/2009
[ 2.709180] RIP: 0010:gen4_render_ring_flush+0x60/0x110 [i915]
[ 2.709180] Code: 00 48 89 df e8 51 fe ff ff 48 3d 00 f0 ff ff 77 6c 44 89 20 48 8d 48 44 c7 40 04 02 40 00 7a 48 8b 53 78 48 8b 92 10 02 00 00 <48> 8b 52 08 48 c7 40 0c 00 00 00 00 83 ca 04 89 50 08 48 8d 50 14
[ 2.709180] RSP: 0018:ffffc2718067b978 EFLAGS: 00010287
[ 2.709180] RAX: ffffc27190303000 RBX: ffff9e5533e87200 RCX: ffffc27190303044
[ 2.709180] RDX: 0000000000000000 RSI: 00000000000001a8 RDI: 0000000000000150
[ 2.709180] RBP: ffffc2718067b988 R08: 0000000000000001 R09: 0000000000000002
[ 2.709180] R10: 0000000000000001 R11: ffff9e5533e87200 R12: 0000000002000002
[ 2.709180] R13: ffff9e5533e87200 R14: ffff9e553380ac00 R15: ffff9e5533ab8000
[ 2.709180] FS: 00007fd9f63c88c0(0000) GS:ffff9e557e400000(0000) knlGS:0000000000000000
[ 2.709180] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 2.709180] CR2: 0000000000000008 CR3: 0000000034302000 CR4: 00000000000006f0
[ 2.709180] Call Trace:
[ 2.709180] i915_request_alloc+0x24e/0x370 [i915]
[ 2.709180] i915_gem_init+0x26b/0x470 [i915]
[ 2.709180] i915_driver_load+0xab8/0xd80 [i915]
[ 2.709180] ? mutex_lock+0x12/0x30
[ 2.709180] i915_pci_probe+0x46/0x60 [i915]
[ 2.709180] local_pci_probe+0x46/0x90
[ 2.709180] pci_device_probe+0x11c/0x1a0
[ 2.709180] driver_probe_device+0x2e3/0x460
[ 2.709180] __driver_attach+0xe4/0x110
[ 2.709180] ? driver_probe_device+0x460/0x460
[ 2.709180] bus_for_each_dev+0x74/0xb0
[ 2.709180] ? kmem_cache_alloc_trace+0x1c4/0x1d0
[ 2.709180] driver_attach+0x1e/0x20
[ 2.709180] bus_add_driver+0x159/0x230
[ 2.709180] ? 0xffffffffc0474000
[ 2.709180] driver_register+0x70/0xc0
[ 2.709180] ? 0xffffffffc0474000
[ 2.709180] __pci_register_driver+0x57/0x60
[ 2.709180] i915_init+0x55/0x58 [i915]
[ 2.709180] do_one_initcall+0x4a/0x1c4
[ 2.709180] ? _cond_resched+0x19/0x30
[ 2.709180] ? kmem_cache_alloc_trace+0xb8/0x1d0
[ 2.709180] ? do_init_module+0x27/0x220
[ 2.709180] do_init_module+0x60/0x220
[ 2.709180] load_module+0x14f4/0x1890
[ 2.709180] __do_sys_finit_module+0xbd/0x120
[ 2.709180] ? __do_sys_finit_module+0xbd/0x120
[ 2.709180] __x64_sys_finit_module+0x1a/0x20
[ 2.709180] do_syscall_64+0x5a/0x110
[ 2.709180] entry_SYSCALL_64_after_hwframe+0x44/0xa9
[ 2.709180] RIP: 0033:0x7fd9f6e4d219
[ 2.709180] Code: 00 c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 8b 0d 47 fc 0c 00 f7 d8 64 89 01 48
[ 2.709180] RSP: 002b:00007ffc11865868 EFLAGS: 00000246 ORIG_RAX: 0000000000000139
[ 2.709180] RAX: ffffffffffffffda RBX: 00005580d38f98c0 RCX: 00007fd9f6e4d219
[ 2.709180] RDX: 0000000000000000 RSI: 00007fd9f6d31cad RDI: 0000000000000012
[ 2.709180] RBP: 00007fd9f6d31cad R08: 0000000000000000 R09: 0000000000000000
[ 2.709180] R10: 0000000000000012 R11: 0000000000000246 R12: 0000000000000000
[ 2.709180] R13: 00005580d3913ae0 R14: 0000000000020000 R15: 00005580d38f98c0
[ 2.709180] Modules linked in: gpio_ich i915(+) i2c_algo_bit drm_kms_helper syscopyarea sysfillrect sdhci_pci sysimgblt cqhci ahci psmouse libahci pata_acpi lpc_ich sdhci firewire_ohci firewire_core fb_sys_fops crc_itu_t drm e1000e(+) video
[ 2.709180] CR2: 0000000000000008
[ 6.662940] ---[ end trace f94080e81515a639 ]---
[ 6.718286] RIP: 0010:gen4_render_ring_flush+0x60/0x110 [i915]

You'll notice the `console=tty0 console=ttyS0,9600n8` kernel boot options I added for serial fallback, the hang also occurs without them of course. Removing the `quiet splash` kernel boot options does not help.

Note that some people reported slowness with this GPU on Ubuntu Bionic but suggested workaround changes nothing for me, this seems unrelated:
- https://doc.ubuntu-fr.org/intel_graphics#gm_965lenteur_lors_du_demarrage_d_ubuntu_1804
- https://bugzilla.redhat.com/show_bug.cgi?id=1398424
The graphic hang I experience looks to not be related to that other bug.

It's also good to know that reboot never succeeds. I always have to shutdown the computer the hardware way once everything is stopped by systemd. But if I started with `nomodeset` the computer reboots correctly.

Sometime it displays stuff about udev while trying (but failing) to reboot:

 OK tarting Reboot...
[ 301.785271] systemd-udevd[476]: giving up waiting for workers to finish
[ 301.864596] systemd-udevd[476]: event loop failed: Connection timed out

Removing the `$vt_handoff` option helps to flush the grey screen.
Removing `quiet splash` and `$vt_handoff` displays an console on screen with correct resolution (`nomodeset` is not set) but the bug occurs lately:

[ 30.383137] fb: switching to inteldrmfb from VESA VGA
[ 30.649155] Console: switching to colour dummy device 80x25
[ 31.249173] [drm] Supports vblank timestamp caching Rev 2 (21.10.2013).
[ 31.328438] [drm] Driver supports precise vblank timestamp query.
[ 31.404156] i915 0000:00:02.0: vgaarb: changed VGA decodes: olddecodes=io+mem,decodes=io+mem:owns=io+mem
[ 31.534177] [drm] RC6 disabled, disabling runtime PM support
[ 31.602002] BUG: unable to handle kernel NULL pointer dereference at 0000000000000008
[ 31.605932] PGD 0 P4D 0
[ 31.605932] Oops: 0000 [#1] SMP PTI
[ 31.605932] CPU: 1 PID: 170 Comm: systemd-udevd Not tainted 4.18.0-14-generic #15-Ubuntu
[ 31.605932] Hardware name: LENOVO 7762B6G/7762B6G, BIOS 7SET38WW (1.24 ) 10/12/2009
[ 31.605932] RIP: 0010:gen4_render_ring_flush+0x60/0x110 [i915]
[ 31.605932] Code:
[ 31.784553] 00 48 89 df e8 51 fe ff ff 48 3d 00 f0 ff ff 77 6c 44 89 20 48 8d 48 44 c7 40 04 02 40 00 7a 48 8b 53 78 48 8b 92 10 02 00 00 <48> 8b 52 08 48 c7 40 0c 00 00 00 00 83 ca 04 89 50 08 48 8d 50 14
[ 31.856932] RSP: 0018:ffffbc194066b978 EFLAGS: 00010287
[ 31.856932] RAX: ffffbc1950303000 RBX: ffff9d7033ebdd40 RCX: ffffbc1950303044
[ 31.856932] RDX: 0000000000000000 RSI: 00000000000001a8 RDI: 0000000000000150
[ 31.856932] RBP: ffffbc194066b988 R08: 0000000000000001 R09: 0000000000000002
[ 31.856932] R10: ffff9d707e6857c8 R11: ffff9d7033ebdd40 R12: 0000000002000002
[ 31.856932] R13: ffff9d7033ebdd40 R14: ffff9d70338e7c00 R15: ffff9d70335e0000
[ 31.856932] FS: 00007fae02a828c0(0000) GS:ffff9d707e500000(0000) knlGS:0000000000000000
[ 31.856932] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 31.856932] CR2: 0000000000000008 CR3: 000000003390a000 CR4: 00000000000006e0
[ 31.856932] Call Trace:
[ 31.856932] i915_request_alloc+0x24e/0x370 [i915]
[ 31.856932] i915_gem_init+0x26b/0x470 [i915]
[ 31.856932] i915_driver_load+0xab8/0xd80 [i915]
[ 31.856932] ? mutex_lock+0x12/0x30
[ 31.856932] i915_pci_probe+0x46/0x60 [i915]
[ 31.856932] local_pci_probe+0x46/0x90
[ 31.856932] pci_device_probe+0x11c/0x1a0
[ 31.856932] driver_probe_device+0x2e3/0x460
[ 31.856932] __driver_attach+0xe4/0x110
[ 31.856932] ? driver_probe_device+0x460/0x460
[ 31.856932] bus_for_each_dev+0x74/0xb0
[ 31.856932] ? kmem_cache_alloc_trace+0x1c4/0x1d0
[ 31.856932] driver_attach+0x1e/0x20
[ 31.856932] bus_add_driver+0x159/0x230
[ 31.856932] ? 0xffffffffc03f3000
[ 31.856932] driver_register+0x70/0xc0
[ 31.856932] ? 0xffffffffc03f3000
[ 31.856932] __pci_register_driver+0x57/0x60
[ 31.856932] i915_init+0x55/0x58 [i915]
[ 31.856932] do_one_initcall+0x4a/0x1c4
[ 31.856932] ? _cond_resched+0x19/0x30
[ 31.856932] ? kmem_cache_alloc_trace+0xb8/0x1d0
[ 31.856932] ? do_init_module+0x27/0x220
[ 31.856932] do_init_module+0x60/0x220
[ 31.856932] load_module+0x14f4/0x1890
[ 31.856932] __do_sys_finit_module+0xbd/0x120
[ 31.856932] ? __do_sys_finit_module+0xbd/0x120
[ 31.856932] __x64_sys_finit_module+0x1a/0x20
[ 31.856932] do_syscall_64+0x5a/0x110
[ 31.856932] entry_SYSCALL_64_after_hwframe+0x44/0xa9
[ 31.856932] RIP: 0033:0x7fae03507219
[ 31.856932] Code: 00 c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 8b 0d 47 fc 0c 00 f7 d8 64 89 01 48
[ 31.856932] RSP: 002b:00007fff8b162d68 EFLAGS: 00000246 ORIG_RAX: 0000000000000139
[ 31.856932] RAX: ffffffffffffffda RBX: 000055d27a1d8da0 RCX: 00007fae03507219
[ 31.856932] RDX: 0000000000000000 RSI: 00007fae033ebcad RDI: 0000000000000012
[ 31.856932] RBP: 00007fae033ebcad R08: 0000000000000000 R09: 0000000000000000
[ 31.856932] R10: 0000000000000012 R11: 0000000000000246 R12: 0000000000000000
[ 31.856932] R13: 000055d27a1ce9e0 R14: 0000000000020000 R15: 000055d27a1d8da0
[ 31.856932] Modules linked in: i915(+) i2c_algo_bit drm_kms_helper syscopyarea sysfillrect sysimgblt hid_generic firewire_ohci fb_sys_fops usbhid sdhci_pci cqhci firewire_core psmouse drm pata_acpi ahci libahci gpio_ich sdhci lpc_ich crc_itu_t hid e1000e video
[ 31.856932] CR2: 0000000000000008
[ 35.778712] ---[ end trace 47fce85f566a6373 ]---
[ 35.834067] RIP: 0010:gen4_render_ring_flush+0x60/0x110 [i915]
[ 35.903864] Code: 00 48 89 df e8 51 fe ff ff 48 3d 00 f0 ff ff 77 6c 44 89 20 48 8d 48 44 c7 40 04 02 40 00 7a 48 8b 53 78 48 8b 92 10 02 00 00 <48> 8b 52 08 48 c7 40 0c 00 00 00 00 83 ca 04 89 50 08 48 8d 50 14

So currently the only way to use the computer is to use it on serial line or to remove `quiet splash` and `$vt_handoff` to set `nomodeset` instead to get a text-only console on screen using commands like that:

systemctl start <email address hidden>
systemctl start <email address hidden>

It's possible to not remove `$vt_handoff` and get a network console over ssh but there will be nothing displayed on screen so if there is cryptsetup disk unlocking step to do on startup it has to be done blindly.