From owner-freebsd-current@FreeBSD.ORG Fri Jan 4 10:19:31 2008 Return-Path: Delivered-To: freebsd-current@freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:4f8:fff6::34]) by hub.freebsd.org (Postfix) with ESMTP id A297916A419; Fri, 4 Jan 2008 10:19:31 +0000 (UTC) (envelope-from avatar@mmlab.cse.yzu.edu.tw) Received: from www.mmlab.cse.yzu.edu.tw (www.mmlab.cse.yzu.edu.tw [140.138.150.166]) by mx1.freebsd.org (Postfix) with ESMTP id 157B713C43E; Fri, 4 Jan 2008 10:19:30 +0000 (UTC) (envelope-from avatar@mmlab.cse.yzu.edu.tw) Received: by www.mmlab.cse.yzu.edu.tw (qmail, from userid 1000) id 362FA8CA013; Fri, 4 Jan 2008 18:19:29 +0800 (CST) Received: from localhost (localhost [127.0.0.1]) by www.mmlab.cse.yzu.edu.tw (qmail) with ESMTP id 3323C8C9F35; Fri, 4 Jan 2008 18:19:29 +0800 (CST) Date: Fri, 4 Jan 2008 18:19:28 +0800 (CST) From: Tai-hwa Liang To: John Baldwin In-Reply-To: <200801031652.20807.jhb@freebsd.org> Message-ID: <0801041816427.55589@www.mmlab.cse.yzu.edu.tw> References: <474D81DB.7020004@FreeBSD.org> <071130112653E.701@www.mmlab.cse.yzu.edu.tw> <200801031652.20807.jhb@freebsd.org> MIME-Version: 1.0 Content-Type: TEXT/PLAIN; charset=US-ASCII; format=flowed Cc: Remko Lodder , freebsd-current@freebsd.org, kib@freebsd.org Subject: Re: [Fwd: Re: kern/118258 sysctl causing panics on 7.0-xxx] X-BeenThere: freebsd-current@freebsd.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Discussions about the use of FreeBSD-current List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 04 Jan 2008 10:19:31 -0000 On Thu, 3 Jan 2008, John Baldwin wrote: > On Thursday 29 November 2007 10:53:32 pm Tai-hwa Liang wrote: >> On Wed, 28 Nov 2007, Remko Lodder wrote: >>> Hello, >>> >>> So as per Jeff's information, can someone from the -current >>> list either contact jeff or try to resolve the problems >>> mentioned? :) >> >> This is a longstanding bug which also exists in RELENG_6. It turns out >> that 'sysctl kern.ttys' after a terminal device is removed could trigger >> this panic reliably. For example, do 'sysctl kern.ttys' multiple times >> after detaching an USB serial-to-rs232 cable or a PCMCIA modem card. >> >> Alternatively, following script would demo the panic if you don't have >> a physically removable terminal device: >> >> #!/bin/sh >> # >> # Warning! Running this script as root will panic your CURRENT box... >> # >> while true; do >> kldload dcons >> kldunload dcons >> ls /dev >> sysctl kern.ttys >> sleep 1 >> done >> >> This seems to be a race between devfs and destroy_dev(), Cc'ing kib@ >> since he probably has more clues in this area. > > Try this patch. Also available at > http://www.FreeBSD.org/~jhb/patches/ttys_sysctl.patch With this patch, -CURRENT no longer boots and panics as follows: Unread portion of the kernel message buffer: <118>Configuring syscons: <118> keyrate Sleeping thread (tid 100048, pid 307) owns a non-sleepable lock sched_switch(c3b97a50,0,1,394c04af,12,...) at sched_switch+0x146 mi_switch(1,0,c3b97a50,f888caa8,c051788a,...) at mi_switch+0x137 sleepq_switch(c3b97a50,0,c06945ef,19b,c065bdc0,...) at sleepq_switch+0x7e sleepq_catch_signals(0,c3b97a50,f888cae8,c04b38d0,c3c999a8,...) at sleepq_catch_signals+0x24a sleepq_wait_sig(c3c999a8,c3c99990,c0694a50,101,0,...) at sleepq_wait_sig+0x15 _cv_wait_sig(c3c999a8,c3c99990,c103c800,0,f888cb74,...) at _cv_wait_sig+0x180 seltdwait(c3f551d4,1,c3a9f200,c3b97a50,c3f59e58,...) at seltdwait+0xd6 poll(c3b97a50,f888ccfc,c,12,88cd2c,...) at poll+0x489 syscall(f888cd38) at syscall+0x317 Xint0x80_syscall() at Xint0x80_syscall+0x20 --- syscall (209, FreeBSD ELF32, poll), eip = 0x28112baf, esp = 0xbfbfee1c, ebp = 0xbfbfee48 --- panic: sleeping thread KDB: enter: panic panic: from debugger Uptime: 8s Physical memory: 1014 MB Dumping 55 MB: 40 24 8 #0 doadump () at pcpu.h:195 195 pcpu.h: No such file or directory. in pcpu.h (kgdb) where #0 doadump () at pcpu.h:195 #1 0xc04ea575 in boot (howto=260) at ../../../kern/kern_shutdown.c:417 #2 0xc04ea797 in panic (fmt=Variable "fmt" is not available. ) at ../../../kern/kern_shutdown.c:571 #3 0xc0446da7 in db_panic (addr=Could not find the frame base for "db_panic". ) at ../../../ddb/db_command.c:444 #4 0xc044751c in db_command (last_cmdp=0xc06dd754, cmd_table=0x0, dopager=1) at ../../../ddb/db_command.c:411 #5 0xc044762a in db_command_loop () at ../../../ddb/db_command.c:464 #6 0xc044908d in db_trap (type=3, code=0) at ../../../ddb/db_main.c:228 #7 0xc0510034 in kdb_trap (type=3, code=0, tf=0xf88df8dc) at ../../../kern/subr_kdb.c:510 #8 0xc0667bc7 in trap (frame=0xf88df8dc) at ../../../i386/i386/trap.c:647 #9 0xc065584b in calltrap () at ../../../i386/i386/exception.s:146 #10 0xc051019a in kdb_enter (why=0xc0692272 "panic", msg=0xc0692272 "panic") at cpufunc.h:60 #11 0xc04ea77d in panic (fmt=0xc06949df "sleeping thread") at ../../../kern/kern_shutdown.c:555 #12 0xc051a34d in propagate_priority (td=0xc3b97a50) at ../../../kern/subr_turnstile.c:222 #13 0xc051ad59 in turnstile_wait (ts=0xc3a9b870, owner=0xc3b97a50, queue=Variable "queue" is not available.) at ../../../kern/subr_turnstile.c:739 #14 0xc04dcedd in _mtx_lock_sleep (m=0xc06f7640, tid=3290042896, opts=0, file=0x0, line=0) at ../../../kern/kern_mutex.c:404 #15 0xc0529ead in ttyrel (tp=0xc3c88c00) at ../../../kern/tty.c:2855 #16 0xc052c08a in tty_close (tp=0xc3c88c00) at ../../../kern/tty.c:346 #17 0xc048d9ff in scclose (dev=0xc3c87100, flag=1, mode=8192, td=0xc41a1210) at ../../../dev/syscons/syscons.c:585 #18 0xc04b55d3 in giant_close (dev=0xc3c87100, fflag=1, devtype=8192, td=0xc41a1210) at ../../../kern/kern_conf.c:327 #19 0xc0493353 in devfs_close (ap=0xf88dfaac) at ../../../fs/devfs/devfs_vnops.c:372 #20 0xc06717f2 in VOP_CLOSE_APV (vop=0xc06b8160, a=0xf88dfaac) at vnode_if.c:424 #21 0xc0574cf7 in vn_close (vp=0xc423e000, flags=1, file_cred=0xc3a9f200, td=0xc41a1210) at vnode_if.h:228 #22 0xc0574e34 in vn_closefile (fp=0xc3f563dc, td=0xc41a1210) at ../../../kern/vfs_vnops.c:872 #23 0xc0491ae9 in devfs_close_f (fp=0xc3f563dc, td=0xc41a1210) at ../../../fs/devfs/devfs_vnops.c:384 #24 0xc04b8f73 in _fdrop (fp=0xc3f563dc, td=0xc41a1210) at file.h:268 #25 0xc04ba458 in closef (fp=0xc3f563dc, td=0xc41a1210) at ../../../kern/kern_descrip.c:1945 #26 0xc04bb4f5 in fdfree (td=0xc41a1210) at ../../../kern/kern_descrip.c:1655 #27 0xc04c7235 in exit1 (td=0xc41a1210, rv=0) at ../../../kern/kern_exit.c:271 #28 0xc04c85bd in sys_exit (td=Could not find the frame base for "sys_exit". ) at ../../../kern/kern_exit.c:98 #29 0xc0667407 in syscall (frame=0xf88dfd38) at ../../../i386/i386/trap.c:1034 #30 0xc06558b0 in Xint0x80_syscall () at ../../../i386/i386/exception.s:203 #31 0x00000033 in ?? () Previous frame inner to this frame (corrupt stack?) -- Thanks, Tai-hwa Liang