From owner-freebsd-stable@FreeBSD.ORG Sun Jan 7 23:00:49 2007 Return-Path: X-Original-To: stable@freebsd.org Delivered-To: freebsd-stable@FreeBSD.ORG Received: from mx1.freebsd.org (mx1.freebsd.org [69.147.83.52]) by hub.freebsd.org (Postfix) with ESMTP id 7E0DF16A492 for ; Sun, 7 Jan 2007 23:00:49 +0000 (UTC) (envelope-from sven@dmv.com) Received: from smtp-gw-cl-c.dmv.com (smtp-gw-cl-c.dmv.com [216.240.97.41]) by mx1.freebsd.org (Postfix) with ESMTP id 395EA13C45E for ; Sun, 7 Jan 2007 23:00:47 +0000 (UTC) (envelope-from sven@dmv.com) Received: from mail-gw-cl-a.dmv.com (mail-gw-cl-a.dmv.com [216.240.97.38]) by smtp-gw-cl-c.dmv.com (8.12.10/8.12.10) with ESMTP id l07N0k0F061559; Sun, 7 Jan 2007 18:00:46 -0500 (EST) (envelope-from sven@dmv.com) Received: from lanshark.dmv.com (lanshark.dmv.com [216.240.97.46]) by mail-gw-cl-a.dmv.com (8.12.9/8.12.9) with ESMTP id l07N0jXi009733; Sun, 7 Jan 2007 18:00:45 -0500 (EST) (envelope-from sven@dmv.com) From: Sven Willenberger To: stable@freebsd.org Content-Type: text/plain Date: Sun, 07 Jan 2007 18:06:45 -0500 Message-Id: <1168211205.22629.6.camel@lanshark.dmv.com> Mime-Version: 1.0 X-Mailer: Evolution 2.6.3 Content-Transfer-Encoding: 7bit X-Scanned-By: MIMEDefang 2.39 X-Scanned-By: MIMEDefang 2.48 on 216.240.97.38 Cc: freebsd-amd64@freebsd.org Subject: Panic in 6.2-PRERELEASE with bge on amd64 X-BeenThere: freebsd-stable@freebsd.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Production branch of FreeBSD source code List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sun, 07 Jan 2007 23:00:49 -0000 I am starting a new thread on this as what I had assumed was a panic in nfsd turns out to be an issue with the bge driver. This is an amd64 box, dual processor (SMP kernel) that happens to be running nfsd. About every 3-5 days the kernel panics and I have finally managed to get a core dump. The system: FreeBSD 6.2-PRERELEASE #8: Tue Jan 2 10:57:39 EST 2007 The short and dirty of the dump: # kgdb /usr/obj/usr/src/sys/MSPOOL/kernel.debug /var/crash/vmcore.0 [GDB will not be able to debug user-mode threads: /usr/lib/libthread_db.so: Undefined symbol "ps_pglobal_lookup"] GNU gdb 6.1.1 [FreeBSD] Copyright 2004 Free Software Foundation, Inc. GDB is free software, covered by the GNU General Public License, and you are welcome to change it and/or distribute copies of it under certain conditions. Type "show copying" to see the conditions. There is absolutely no warranty for GDB. Type "show warranty" for details. This GDB was configured as "amd64-marcel-freebsd". Unread portion of the kernel message buffer: lock order reversal: (sleepable after non-sleepable) 1st 0xffffffff8836b010 bge0 (network driver) @ /usr/src/sys/dev/bge/if_bge.c:2675 2nd 0xffffffff805f26b0 user map (user map) @ /usr/src/sys/vm/vm_map.c:3074 KDB: stack backtrace: witness_checkorder() at witness_checkorder+0x4da _sx_xlock() at _sx_xlock+0x51 vm_map_lookup() at vm_map_lookup+0x44 vm_fault() at vm_fault+0xba trap_pfault() at trap_pfault+0x13c trap() at trap+0x1f9 calltrap() at calltrap+0x5 --- trap 0xc, rip = 0xffffffff801d5f17, rsp = 0xffffffffb371ab50, rbp = 0xffffffffb371aba0 --- bge_rxeof() at bge_rxeof+0x3b7 bge_intr() at bge_intr+0x1c8 ithread_loop() at ithread_loop+0x14c fork_exit() at fork_exit+0xbb fork_trampoline() at fork_trampoline+0xe --- trap 0, rip = 0, rsp = 0xffffffffb371ad00, rbp = 0 --- Fatal trap 12: page fault while in kernel mode cpuid = 1; apic id = 01 fault virtual address = 0x28 fault code = supervisor write, page not present instruction pointer = 0x8:0xffffffff801d5f17 stack pointer = 0x10:0xffffffffb371ab50 frame pointer = 0x10:0xffffffffb371aba0 code segment = base 0x0, limit 0xfffff, type 0x1b = DPL 0, pres 1, long 1, def32 0, gran 1 processor eflags = interrupt enabled, resume, IOPL = 0 current process = 28 (irq24: bge0) trap number = 12 panic: page fault cpuid = 1 Uptime: 3d4h18m42s #0 doadump () at pcpu.h:172 172 pcpu.h: No such file or directory. in pcpu.h (kgdb) bt #0 doadump () at pcpu.h:172 #1 0xffffffff802771b9 in boot (howto=260) at /usr/src/sys/kern/kern_shutdown.c:409 #2 0xffffffff80276c4b in panic (fmt=0xffffffff8044160c "%s") at /usr/src/sys/kern/kern_shutdown.c:565 #3 0xffffffff803ebba6 in trap_fatal (frame=0xc, eva=18446742978291675136) at /usr/src/sys/amd64/amd64/trap.c:660 #4 0xffffffff803ebee3 in trap_pfault (frame=0xffffffffb371aaa0, usermode=0) at /usr/src/sys/amd64/amd64/trap.c:573 #5 0xffffffff803ec0f9 in trap (frame= {tf_rdi = 0, tf_rsi = 0, tf_rdx = 1, tf_rcx = 499, tf_r8 = 2521427970, tf_r9 = -1099500152320, tf_rax = 0, tf_rbx = -1263948192, tf_rbp = -1284396128, tf_r10 = 0, tf_r11 = 0, tf_r12 = -2009681920, tf_r13 = 0, tf_r14 = 0, tf_r15 = -1099499984896, tf_trapno = 12, tf_addr = 40, tf_flags = -1263948192, tf_err = 2, tf_rip = -2145558761, tf_cs = 8, tf_rflags = 66071, tf_rsp = -1284396192, tf_ss = 16}) at /usr/src/sys/amd64/amd64/trap.c:352 #6 0xffffffff803d779b in calltrap () at /usr/src/sys/amd64/amd64/exception.S:168 #7 0xffffffff801d5f17 in bge_rxeof (sc=0xffffffff8836b000) at /usr/src/sys/dev/bge/if_bge.c:2528 #8 0xffffffff801db818 in bge_intr (xsc=0x0) at /usr/src/sys/dev/bge/if_bge.c:2707 #9 0xffffffff8025f2bc in ithread_loop (arg=0xffffff0000b1b320) at /usr/src/sys/kern/kern_intr.c:682 #10 0xffffffff8025e00b in fork_exit (callout=0xffffffff8025f170 , arg=0xffffff0000b1b320, frame=0xffffffffb371ac50) at /usr/src/sys/kern/kern_fork.c:821 #11 0xffffffff803d7afe in fork_trampoline () at /usr/src/sys/amd64/amd64/exception.S:394 If more information is needed (disassemble, etc) please let me know. In the interim I may switch to either using the base100 ethernet port (fxp) or turn off SMP. Sven