From owner-freebsd-current@FreeBSD.ORG Sat Jun 19 12:03:48 2004 Return-Path: Delivered-To: freebsd-current@freebsd.org Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125]) by hub.freebsd.org (Postfix) with ESMTP id 45B9916A4CE for ; Sat, 19 Jun 2004 12:03:48 +0000 (GMT) Received: from mailout1.informatik.tu-muenchen.de (mailout1.informatik.tu-muenchen.de [131.159.0.18]) by mx1.FreeBSD.org (Postfix) with ESMTP id 8A10543D5A for ; Sat, 19 Jun 2004 12:03:47 +0000 (GMT) (envelope-from barner@in.tum.de) Received: by zi025.glhnet.mhn.de (Postfix, from userid 1000) id C80663EF7; Sat, 19 Jun 2004 13:58:53 +0200 (CEST) Date: Sat, 19 Jun 2004 13:58:53 +0200 From: Simon Barner To: Bruce Evans Message-ID: <20040619115853.GA904@zi025.glhnet.mhn.de> References: <20040616105706.GC1140@zi025.glhnet.mhn.de> <20040617134101.V1345@gamplex.bde.org> <20040618134944.GC1049@zi025.glhnet.mhn.de> <20040619152924.F3372@gamplex.bde.org> Mime-Version: 1.0 Content-Type: multipart/signed; micalg=pgp-sha1; protocol="application/pgp-signature"; boundary="jy6Sn24JjFx/iggw" Content-Disposition: inline In-Reply-To: <20040619152924.F3372@gamplex.bde.org> User-Agent: Mutt/1.5.6i X-Virus-Scanned: by amavisd-new at informatik.tu-muenchen.de cc: current@freebsd.org Subject: Re: Bogus signal handler causes kernel panic (5.2.1-p8/i386) X-BeenThere: freebsd-current@freebsd.org X-Mailman-Version: 2.1.1 Precedence: list List-Id: Discussions about the use of FreeBSD-current List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sat, 19 Jun 2004 12:03:48 -0000 --jy6Sn24JjFx/iggw Content-Type: multipart/mixed; boundary="LyciRD1jyfeSSjG0" Content-Disposition: inline --LyciRD1jyfeSSjG0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline Content-Transfer-Encoding: quoted-printable Hi, I'll call that one patch3. > Index: machdep.c > =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D > RCS file: /home/ncvs/src/sys/i386/i386/machdep.c,v > retrieving revision 1.590 > diff -u -2 -r1.590 machdep.c > --- machdep.c 11 Jun 2004 11:16:22 -0000 1.590 > +++ machdep.c 19 Jun 2004 05:27:18 -0000 > @@ -1134,4 +1134,7 @@ > } >=20 > + /* XXX drop the FP state correctly, unlike in the next 3 statements. */ > + fpstate_drop(td); > + > /* > * Initialize the math emulator (if any) for the current process. > %%% I was not sure whether to back out patch2 (against npx.c) before applying patch3, so I tried both combinations. Unfortunately, I have to refer you to the attached stack traces once again :( Anyway, thanks a lot for your time and effort! Simon --LyciRD1jyfeSSjG0 Content-Type: text/plain; charset=iso-8859-1 Content-Disposition: attachment; filename="panic-patch2+3.log" Content-Transfer-Encoding: quoted-printable Copyright 2002 Free Software Foundation, Inc. GDB is free software, covered by the GNU General Public License, and you are welcome to change it and/or distribute copies of it under certain condition= s. Type "show copying" to see the conditions. There is absolutely no warranty for GDB. Type "show warranty" for details. This GDB was configured as "i386-unknown-freebsd"... panic: arithmetic trap panic messages: --- Fatal trap 6: arithmetic trap while in kernel mode instruction pointer =3D 0x8:0xc061671a stack pointer =3D 0x10:0xcc43d9e4 frame pointer =3D 0x10:0xcc43d9e4 code segment =3D base 0x0, limit 0xfffff, type 0x1b =3D DPL 0, pres 1, def32 1, gran 1 processor eflags =3D resume, IOPL =3D 0 current process =3D 694 (a.out) trap number =3D 6 panic: arithmetic trap syncing disks, buffers remaining... 800 800 800 800 800 800 800 800 800 800= 800 800 800 800 800 800 800 800 800 800=20 giving up on 589 buffers Uptime: 1m16s Dumping 192 MB 16 32 48 64 80 96 112 128 144 160 176 --- Reading symbols from /usr/src/sys/i386/compile/KISTE/modules/usr/src/sys/mo= dules/fdescfs/fdescfs.ko.debug...done. Loaded symbols for /usr/src/sys/i386/compile/KISTE/modules/usr/src/sys/modu= les/fdescfs/fdescfs.ko.debug Reading symbols from /boot/kernel/green_saver.ko...done. Loaded symbols for /boot/kernel/green_saver.ko #0 doadump () at ../../../kern/kern_shutdown.c:240 240 dumping++; (kgdb) bt #0 doadump () at ../../../kern/kern_shutdown.c:240 #1 0xc04f0cbb in boot (howto=3D256) at ../../../kern/kern_shutdown.c:372 #2 0xc04f0f91 in panic () at ../../../kern/kern_shutdown.c:550 #3 0xc0611f70 in trap_fatal (frame=3D0xcc43d9a4, eva=3D0) at ../../../i386/i386/trap.c:821 #4 0xc0611abc in trap (frame=3D {tf_fs =3D 24, tf_es =3D 16, tf_ds =3D 16, tf_edi =3D 0, tf_esi =3D -= 1034840832, tf_ebp =3D -867968540, tf_isp =3D -867968560, tf_ebx =3D 514, t= f_edx =3D -1034840832, tf_ecx =3D -867968368, tf_eax =3D -867968368, tf_tra= pno =3D 6, tf_err =3D 0, tf_eip =3D -1067358438, tf_cs =3D 8, tf_eflags =3D= 65606, tf_esp =3D -867968524, tf_ss =3D -1067358516}) at ../../../i386/i386/trap.c:618 #5 0xc0605998 in calltrap () at {standard input}:94 #6 0xc06166cc in npxsetregs (td=3D0x0, addr=3D0x0) at ../../../i386/isa/np= x.c:963 #7 0xc060bd73 in set_fpcontext (td=3D0xc2519500, mcp=3D0x0) at ../../../i386/i386/machdep.c:2532 #8 0xc060a76a in sigreturn (td=3D0xc2519500, uap=3D0x0) at ../../../i386/i386/machdep.c:982 #9 0xc0612253 in syscall (frame=3D {tf_fs =3D 47, tf_es =3D 47, tf_ds =3D 47, tf_edi =3D -1077940888, tf= _esi =3D -1077940880, tf_ebp =3D -1077940960, tf_isp =3D -867967628, tf_ebx= =3D 1, tf_edx =3D 672409248, tf_ecx =3D 13, tf_eax =3D 417, tf_trapno =3D = 22, tf_err =3D 2, tf_eip =3D -1077936211, tf_cs =3D 31, tf_eflags =3D 582, = tf_esp =3D -1077941832, tf_ss =3D 47}) at ../../../i386/i386/trap.c:1010 #10 0xc06059ed in Xint0x80_syscall () at {standard input}:136 ---Can't read userspace from dump, or kernel process--- (kgdb) bt full #0 doadump () at ../../../kern/kern_shutdown.c:240 No locals. #1 0xc04f0cbb in boot (howto=3D256) at ../../../kern/kern_shutdown.c:372 No locals. #2 0xc04f0f91 in panic () at ../../../kern/kern_shutdown.c:550 td =3D (struct thread *) 0xc2519500 bootopt =3D 256 newpanic =3D 0 ap =3D 0xcc43d94c "g\001e=C0" buf =3D "arithmetic trap", '\0' #3 0xc0611f70 in trap_fatal (frame=3D0xcc43d9a4, eva=3D0) at ../../../i386/i386/trap.c:821 code =3D 16 type =3D 6 ss =3D 16 esp =3D 0 softseg =3D {ssd_base =3D 0, ssd_limit =3D 1048575, ssd_type =3D 27,=20 ssd_dpl =3D 0, ssd_p =3D 1, ssd_xx =3D 5, ssd_xx1 =3D 1, ssd_def32 =3D 1,= ssd_gran =3D 1} #4 0xc0611abc in trap (frame=3D {tf_fs =3D 24, tf_es =3D 16, tf_ds =3D 16, tf_edi =3D 0, tf_esi =3D -= 1034840832, tf_ebp =3D -867968540, tf_isp =3D -867968560, tf_ebx =3D 514, t= f_edx =3D -1034840832, tf_ecx =3D -867968368, tf_eax =3D -867968368, tf_tra= pno =3D 6, tf_err =3D 0, tf_eip =3D -1067358438, tf_cs =3D 8, tf_eflags =3D= 65606, tf_esp =3D -867968524, tf_ss =3D -1067358516}) at ../../../i386/i386/trap.c:618 ---Type to continue, or q to quit--- td =3D (struct thread *) 0xc2519500 p =3D (struct proc *) 0xc251854c sticks =3D 3260122444 i =3D 0 ucode =3D 0 type =3D 6 code =3D 0 eva =3D 0 #5 0xc0605998 in calltrap () at {standard input}:94 No locals. #6 0xc06166cc in npxsetregs (td=3D0x0, addr=3D0x0) at ../../../i386/isa/np= x.c:963 s =3D 514 #7 0xc060bd73 in set_fpcontext (td=3D0xc2519500, mcp=3D0x0) at ../../../i386/i386/machdep.c:2532 addr =3D (union savefpu *) 0xcc43da90 #8 0xc060a76a in sigreturn (td=3D0xc2519500, uap=3D0x0) at ../../../i386/i386/machdep.c:982 uc =3D {uc_sigmask =3D {__bits =3D {0, 0, 0, 0}}, uc_mcontext =3D { mc_onstack =3D 0, mc_gs =3D 47, mc_fs =3D 47, mc_es =3D 47, mc_ds =3D 4= 7,=20 mc_edi =3D -1077940888, mc_esi =3D -1077940880, mc_ebp =3D -1077940960,= =20 mc_isp =3D -867967628, mc_ebx =3D 1, mc_edx =3D 672409248, mc_ecx =3D 1= 3,=20 mc_eax =3D 1, mc_trapno =3D 12, mc_err =3D 2, mc_eip =3D 671874187, mc_= cs =3D 31,=20 mc_eflags =3D 662, mc_esp =3D -1077941012, mc_ss =3D 47, mc_len =3D 640= ,=20 mc_fpformat =3D 65537, mc_ownedfp =3D 131074, mc_spare1 =3D {0}, mc_fps= tate =3D { ---Type to continue, or q to quit--- -60801, -65536, -1, 0, 0, 0, -65536, 0, 0, 0, 0, 0, 0, 0, 0, 0,=20 1072726020, 0, -2147483648, 16355, 0, 1071874048, 40544256, -30851378= ,=20 1744846849, -1351024913, 1072994650, 0 },=20 mc_spare2 =3D {0, 0, 0, 0, 0, 0, 0, 0}}, uc_link =3D 0x0, uc_stack =3D { ss_sp =3D 0x0, ss_size =3D 0, ss_flags =3D 4}, uc_flags =3D 0, __spare_= _ =3D {0, 0,=20 0, 0}} p =3D (struct proc *) 0xc251854c regs =3D (struct trapframe *) 0xcc43dd48 cs =3D 0 eflags =3D 662 error =3D 0 ret =3D 0 #9 0xc0612253 in syscall (frame=3D {tf_fs =3D 47, tf_es =3D 47, tf_ds =3D 47, tf_edi =3D -1077940888, tf= _esi =3D -1077940880, tf_ebp =3D -1077940960, tf_isp =3D -867967628, tf_ebx= =3D 1, tf_edx =3D 672409248, tf_ecx =3D 13, tf_eax =3D 417, tf_trapno =3D = 22, tf_err =3D 2, tf_eip =3D -1077936211, tf_cs =3D 31, tf_eflags =3D 582, = tf_esp =3D -1077941832, tf_ss =3D 47}) at ../../../i386/i386/trap.c:1010 params =3D 0xbfbfe9bc---Can't read userspace from dump, or kernel process-= -- --LyciRD1jyfeSSjG0 Content-Type: text/plain; charset=iso-8859-1 Content-Disposition: attachment; filename="panic-patch3.log" Content-Transfer-Encoding: quoted-printable Copyright 2002 Free Software Foundation, Inc. GDB is free software, covered by the GNU General Public License, and you are welcome to change it and/or distribute copies of it under certain condition= s. Type "show copying" to see the conditions. There is absolutely no warranty for GDB. Type "show warranty" for details. This GDB was configured as "i386-unknown-freebsd"... panic: arithmetic trap panic messages: --- Fatal trap 6: arithmetic trap while in kernel mode instruction pointer =3D 0x8:0xc061671a stack pointer =3D 0x10:0xcbd139e4 frame pointer =3D 0x10:0xcbd139e4 code segment =3D base 0x0, limit 0xfffff, type 0x1b =3D DPL 0, pres 1, def32 1, gran 1 processor eflags =3D resume, IOPL =3D 0 current process =3D 655 (a.out) trap number =3D 6 panic: arithmetic trap syncing disks, buffers remaining... 818 818 817 817 817 817 817 817 817 817= 817 817 817 817 817 817 817 817 817 817 817 817=20 giving up on 598 buffers Uptime: 1m12s Dumping 192 MB 16 32 48 64 80 96 112 128 144 160 176 --- Reading symbols from /usr/src/sys/i386/compile/KISTE/modules/usr/src/sys/mo= dules/fdescfs/fdescfs.ko.debug...done. Loaded symbols for /usr/src/sys/i386/compile/KISTE/modules/usr/src/sys/modu= les/fdescfs/fdescfs.ko.debug Reading symbols from /boot/kernel/green_saver.ko...done. Loaded symbols for /boot/kernel/green_saver.ko #0 doadump () at ../../../kern/kern_shutdown.c:240 240 dumping++; (kgdb) bt #0 doadump () at ../../../kern/kern_shutdown.c:240 #1 0xc04f0cbb in boot (howto=3D256) at ../../../kern/kern_shutdown.c:372 #2 0xc04f0f91 in panic () at ../../../kern/kern_shutdown.c:550 #3 0xc0611f70 in trap_fatal (frame=3D0xcbd139a4, eva=3D0) at ../../../i386/i386/trap.c:821 #4 0xc0611abc in trap (frame=3D {tf_fs =3D 24, tf_es =3D 16, tf_ds =3D 16, tf_edi =3D 0, tf_esi =3D -= 1036587584, tf_ebp =3D -875480604, tf_isp =3D -875480624, tf_ebx =3D 514, t= f_edx =3D -1036587584, tf_ecx =3D -875480432, tf_eax =3D -875480432, tf_tra= pno =3D 6, tf_err =3D 0, tf_eip =3D -1067358438, tf_cs =3D 8, tf_eflags =3D= 65606, tf_esp =3D -875480588, tf_ss =3D -1067358516}) at ../../../i386/i386/trap.c:618 #5 0xc0605998 in calltrap () at {standard input}:94 #6 0xc06166cc in npxsetregs (td=3D0x0, addr=3D0x0) at ../../../i386/isa/np= x.c:954 #7 0xc060bd73 in set_fpcontext (td=3D0xc236edc0, mcp=3D0x0) at ../../../i386/i386/machdep.c:2532 #8 0xc060a76a in sigreturn (td=3D0xc236edc0, uap=3D0x0) at ../../../i386/i386/machdep.c:982 #9 0xc0612253 in syscall (frame=3D {tf_fs =3D 47, tf_es =3D 47, tf_ds =3D 47, tf_edi =3D -1077940888, tf= _esi =3D -1077940880, tf_ebp =3D -1077940960, tf_isp =3D -875479692, tf_ebx= =3D 1, tf_edx =3D 672409248, tf_ecx =3D 13, tf_eax =3D 417, tf_trapno =3D = 22, tf_err =3D 2, tf_eip =3D -1077936211, tf_cs =3D 31, tf_eflags =3D 582, = tf_esp =3D -1077941832, tf_ss =3D 47}) at ../../../i386/i386/trap.c:1010 #10 0xc06059ed in Xint0x80_syscall () at {standard input}:136 ---Can't read userspace from dump, or kernel process--- (kgdb) bt full #0 doadump () at ../../../kern/kern_shutdown.c:240 No locals. #1 0xc04f0cbb in boot (howto=3D256) at ../../../kern/kern_shutdown.c:372 No locals. #2 0xc04f0f91 in panic () at ../../../kern/kern_shutdown.c:550 td =3D (struct thread *) 0xc236edc0 bootopt =3D 256 newpanic =3D 0 ap =3D 0xcbd1394c "g\001e=C0" buf =3D "arithmetic trap", '\0' #3 0xc0611f70 in trap_fatal (frame=3D0xcbd139a4, eva=3D0) at ../../../i386/i386/trap.c:821 code =3D 16 type =3D 6 ss =3D 16 esp =3D 0 softseg =3D {ssd_base =3D 0, ssd_limit =3D 1048575, ssd_type =3D 27,=20 ssd_dpl =3D 0, ssd_p =3D 1, ssd_xx =3D 0, ssd_xx1 =3D 0, ssd_def32 =3D 1,= ssd_gran =3D 1} #4 0xc0611abc in trap (frame=3D {tf_fs =3D 24, tf_es =3D 16, tf_ds =3D 16, tf_edi =3D 0, tf_esi =3D -= 1036587584, tf_ebp =3D -875480604, tf_isp =3D -875480624, tf_ebx =3D 514, t= f_edx =3D -1036587584, tf_ecx =3D -875480432, tf_eax =3D -875480432, tf_tra= pno =3D 6, tf_err =3D 0, tf_eip =3D -1067358438, tf_cs =3D 8, tf_eflags =3D= 65606, tf_esp =3D -875480588, tf_ss =3D -1067358516}) at ../../../i386/i386/trap.c:618 ---Type to continue, or q to quit--- td =3D (struct thread *) 0xc236edc0 p =3D (struct proc *) 0xc2523000 sticks =3D 3260166144 i =3D 0 ucode =3D 0 type =3D 6 code =3D 0 eva =3D 0 #5 0xc0605998 in calltrap () at {standard input}:94 No locals. #6 0xc06166cc in npxsetregs (td=3D0x0, addr=3D0x0) at ../../../i386/isa/np= x.c:954 s =3D 514 #7 0xc060bd73 in set_fpcontext (td=3D0xc236edc0, mcp=3D0x0) at ../../../i386/i386/machdep.c:2532 addr =3D (union savefpu *) 0xcbd13a90 #8 0xc060a76a in sigreturn (td=3D0xc236edc0, uap=3D0x0) at ../../../i386/i386/machdep.c:982 uc =3D {uc_sigmask =3D {__bits =3D {0, 0, 0, 0}}, uc_mcontext =3D { mc_onstack =3D 0, mc_gs =3D 47, mc_fs =3D 47, mc_es =3D 47, mc_ds =3D 4= 7,=20 mc_edi =3D -1077940888, mc_esi =3D -1077940880, mc_ebp =3D -1077940960,= =20 mc_isp =3D -875479692, mc_ebx =3D 1, mc_edx =3D 672409248, mc_ecx =3D 1= 3,=20 mc_eax =3D 1, mc_trapno =3D 12, mc_err =3D 2, mc_eip =3D 671874187, mc_= cs =3D 31,=20 mc_eflags =3D 662, mc_esp =3D -1077941012, mc_ss =3D 47, mc_len =3D 640= ,=20 mc_fpformat =3D 65537, mc_ownedfp =3D 131074, mc_spare1 =3D {0}, mc_fps= tate =3D { ---Type to continue, or q to quit--- -60801, -65536, -1, 0, 0, 0, -65536, 0, 0, 0, 0, 0, 0, 0, 0, 0,=20 1072726020, 0, -2147483648, 16355, 0, 1071874048, 177295360, -2650967= 6,=20 -805289983, 1914524621, 1072946227, 0 }, mc_spare2= =3D { 0, 0, 0, 0, 0, 0, 0, 0}}, uc_link =3D 0x0, uc_stack =3D {ss_sp =3D 0x= 0,=20 ss_size =3D 0, ss_flags =3D 4}, uc_flags =3D 0, __spare__ =3D {0, 0, 0,= 0}} p =3D (struct proc *) 0xc2523000 regs =3D (struct trapframe *) 0xcbd13d48 cs =3D 0 eflags =3D 662 error =3D 0 ret =3D 0 #9 0xc0612253 in syscall (frame=3D {tf_fs =3D 47, tf_es =3D 47, tf_ds =3D 47, tf_edi =3D -1077940888, tf= _esi =3D -1077940880, tf_ebp =3D -1077940960, tf_isp =3D -875479692, tf_ebx= =3D 1, tf_edx =3D 672409248, tf_ecx =3D 13, tf_eax =3D 417, tf_trapno =3D = 22, tf_err =3D 2, tf_eip =3D -1077936211, tf_cs =3D 31, tf_eflags =3D 582, = tf_esp =3D -1077941832, tf_ss =3D 47}) at ../../../i386/i386/trap.c:1010 params =3D 0xbfbfe9bc---Can't read userspace from dump, or kernel process-= -- --LyciRD1jyfeSSjG0-- --jy6Sn24JjFx/iggw Content-Type: application/pgp-signature; name="signature.asc" Content-Description: Digital signature Content-Disposition: inline -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.2.4 (FreeBSD) iD8DBQFA1Cp9Ckn+/eutqCoRAiCAAJ9haF7uis2ySYtJKZtayFm2bCsJIgCfd8Qp uAW5algOfqbL4fYsxiHj0tQ= =/E2U -----END PGP SIGNATURE----- --jy6Sn24JjFx/iggw--