From owner-freebsd-current@FreeBSD.ORG Thu Feb 19 00:09:09 2004 Return-Path: Delivered-To: freebsd-current@freebsd.org Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125]) by hub.freebsd.org (Postfix) with ESMTP id B6A6016A4CE for ; Thu, 19 Feb 2004 00:09:09 -0800 (PST) Received: from arginine.spc.org (arginine.spc.org [195.206.69.236]) by mx1.FreeBSD.org (Postfix) with ESMTP id 3C2DB43D1D for ; Thu, 19 Feb 2004 00:09:09 -0800 (PST) (envelope-from bms@spc.org) Received: from localhost (localhost [127.0.0.1]) by arginine.spc.org (Postfix) with ESMTP id A650D6520F for ; Thu, 19 Feb 2004 08:09:07 +0000 (GMT) Received: from arginine.spc.org ([127.0.0.1]) by localhost (arginine.spc.org [127.0.0.1]) (amavisd-new, port 10024) with LMTP id 56402-04 for ; Thu, 19 Feb 2004 08:09:06 +0000 (GMT) Received: from saboteur.dek.spc.org (82-147-17-88.dsl.uk.rapidplay.com [82.147.17.88]) (using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits)) (No client certificate requested) by arginine.spc.org (Postfix) with ESMTP id BC1676520E for ; Thu, 19 Feb 2004 08:09:05 +0000 (GMT) Received: by saboteur.dek.spc.org (Postfix, from userid 1001) id 72A423C; Thu, 19 Feb 2004 08:09:04 +0000 (GMT) Date: Thu, 19 Feb 2004 08:09:03 +0000 From: Bruce M Simpson To: freebsd-current@FreeBSD.org Message-ID: <20040219080903.GA771@saboteur.dek.spc.org> Mail-Followup-To: freebsd-current@FreeBSD.org Mime-Version: 1.0 Content-Type: multipart/signed; micalg=pgp-sha1; protocol="application/pgp-signature"; boundary="2oS5YaxWCcQjTEyO" Content-Disposition: inline Subject: panic from Saturday's -CURRENT X-BeenThere: freebsd-current@freebsd.org X-Mailman-Version: 2.1.1 Precedence: list List-Id: Discussions about the use of FreeBSD-current List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 19 Feb 2004 08:09:09 -0000 --2oS5YaxWCcQjTEyO Content-Type: text/plain; charset=us-ascii Content-Disposition: inline Content-Transfer-Encoding: quoted-printable Witnessed whilst running HostAP on a PRISM2 card which was being used to test something else (with xmms and various ssh sessions):- saboteur# uname -a FreeBSD saboteur.dek.spc.org 5.2-CURRENT FreeBSD 5.2-CURRENT #0: Sat Feb 14= 04:34:06 GMT 2004 bms@kimchi.dek.spc.org:/usr/src/sys/i386/compile/SAB= OTEUR i386 Fatal trap 12: page fault while in kernel mode fault virtual address =3D 0x24 fault code =3D supervisor read, page not present instruction pointer =3D 0x8:0xc04e603e stack pointer =3D 0x10:0xcdadbacc frame pointer =3D 0x10:0xcdadbaec code segment =3D base 0x0, limit 0xfffff, type 0x1b =3D DPL 0, pres 1, def32 1, gran 1 processor eflags =3D resume, IOPL =3D 0 current process =3D 27 (swi1: net) trap number =3D 12 panic: page fault at line 819 in file ../../../i386/i386/trap.c Stack backtrace: backtrace(c06696d0,c06ba6c0,333,c0682b80,100) at backtrace+0x17 __panic(c0682b80,333,c067acad,c06829d8,1) at __panic+0xd4 trap_fatal(cdadba8c,24,0,c2b42c00,24) at trap_fatal+0x346 trap(18,10,10,0,c14f8000) at trap+0x123 calltrap() at calltrap+0x5 propagate_priority(c14f8000,c362b690,c04d4937,c2ce8bd0,c06bbe08) at propaga= te_pr turnstile_wait(0,c06c05cc,c362b690,14,28) at turnstile_wait+0x2f4 _mtx_lock_sleep(c06c05cc,0,0,0,c362c518) at _mtx_lock_sleep+0xd5 tcp_input(c150aa00,14,c2b4e000,1,0) at tcp_input+0x4c8 ip_input(c150aa00,df371db0,c06e2374,0,c06bde98) at ip_input+0xc79 netisr_processqueue(c06bde98,3a95b430,4515ec3b,0,c2acd080) at netisr_proces= squeu e+0xd9 swi_net(0,1,3c45c,3a044,c14f8000) at swi_net+0xc9 ithread_loop(c14f5600,cdadbd48,9b78,40bec,40aa0) at ithread_loop+0x1d8 fork_exit(c04a7360,c14f5600,cdadbd48) at fork_exit+0x78 fork_trampoline() at fork_trampoline+0x8 --- trap 0x1, eip =3D 0, esp =3D 0xcdadbd7c, ebp =3D 0 --- (kgdb) bt #0 doadump () at ../../../kern/kern_shutdown.c:240 #1 0xc04bdb22 in boot (howto=3D260) at ../../../kern/kern_shutdown.c:374 #2 0xc04bdf28 in __panic () at ../../../kern/kern_shutdown.c:552 #3 0xc063b0c6 in trap_fatal (frame=3D0xcdadebd0, eva=3D0) at ../../../i386/i386/trap.c:819 #4 0xc063a6e3 in trap (frame=3D {tf_fs =3D 24, tf_es =3D -844300272, tf_ds =3D 16, tf_edi =3D 0, tf_e= si =3D -1051754160, tf_ebp =3D -844239824, tf_isp =3D -844239876, tf_ebx = =3D -1016940912, tf_edx =3D -1066662452, tf_ecx =3D -1051754160, tf_eax =3D= 36, tf_trapno =3D 12, tf_err =3D 0, tf_eip =3D -1068605378, tf_cs =3D 8, t= f_eflags =3D 65687, tf_esp =3D -1026655280, tf_ss =3D 14}) at ../../../i386= /i386/trap.c:250 #5 0xc04e603e in propagate_priority (td=3D0xc362b690) at ../../../kern/subr_turnstile.c:230 #6 0xc04e68c4 in turnstile_wait (ts=3D0xc14f0b00, lock=3D0xc06c05cc, owner= =3D0x0) at ../../../kern/subr_turnstile.c:510 #7 0xc04b2e85 in _mtx_lock_sleep (m=3D0xc06c05cc, opts=3D0, file=3D0x0, li= ne=3D0) at ../../../kern/kern_mutex.c:536 #8 0xc0566928 in tcp_slowtimo () at ../../../netinet/tcp_timer.c:141 #9 0xc04fc0f9 in pfslowtimo (arg=3D0x0) at ../../../kern/uipc_domain.c:242 #10 0xc04d007e in softclock (dummy=3D0x0) at ../../../kern/kern_timeout.c:2= 26 #11 0xc04a7538 in ithread_loop (arg=3D0xc14f5580) at ../../../kern/kern_intr.c:547 #12 0xc04a6198 in fork_exit (callout=3D0xc04a7360 , arg=3D0x0= ,=20 frame=3D0x0) at ../../../kern/kern_fork.c:802 (kgdb) frame 8 #8 0xc0566928 in tcp_slowtimo () at ../../../netinet/tcp_timer.c:141 141 INP_INFO_WLOCK(&tcbinfo); (kgdb) print tcbinfo $1 =3D {hashbase =3D 0xc2b72000, hashmask =3D 511, porthashbase =3D 0xc2bf0= 000,=20 porthashmask =3D 511, listhead =3D 0xc06c0590, lastport =3D 49440, lastlo= w =3D 0,=20 lasthi =3D 0, ipi_zone =3D 0xc1023f00, ipi_count =3D 6, ipi_gencnt =3D 86= 4,=20 ipi_mtx =3D {mtx_object =3D {lo_class =3D 0xc069463c, lo_name =3D 0xc066f= 604 "tcp",=20 lo_type =3D 0xc066f604 "tcp", lo_flags =3D 720896, lo_list =3D { tqe_next =3D 0x0, tqe_prev =3D 0x0}, lo_witness =3D 0x0},=20 mtx_lock =3D 3278026386, mtx_recurse =3D 0}} DDB and GDB backtraces look different but appear to refer to the same lock:- (kgdb) print *((struct mtx *)0xc06c05cc) $5 =3D {mtx_object =3D {lo_class =3D 0xc069463c, lo_name =3D 0xc066f604 "tc= p",=20 lo_type =3D 0xc066f604 "tcp", lo_flags =3D 720896, lo_list =3D {tqe_nex= t =3D 0x0,=20 tqe_prev =3D 0x0}, lo_witness =3D 0x0}, mtx_lock =3D 3278026386,=20 mtx_recurse =3D 0} (kgdb) frame 5 #5 0xc04e603e in propagate_priority (td=3D0xc362b690) at ../../../kern/subr_turnstile.c:230 230 ts =3D td->td_blocked; (kgdb) print td->td_blocked $7 =3D (struct turnstile *) 0x0 (kgdb) print *td $6 =3D {td_proc =3D 0xc362a370, td_ksegrp =3D 0xc2fff500, td_plist =3D { tqe_next =3D 0x0, tqe_prev =3D 0xc362a380}, td_kglist =3D {tqe_next =3D= 0x0,=20 tqe_prev =3D 0xc2fff51c}, td_slpq =3D {tqe_next =3D 0xc40212a0,=20 tqe_prev =3D 0xc35f7a98}, td_lockq =3D {tqe_next =3D 0x0, tqe_prev =3D = 0x0},=20 td_runq =3D {tqe_next =3D 0x0, tqe_prev =3D 0xc362a388}, td_selq =3D { tqh_first =3D 0xc3679ea4, tqh_last =3D 0xc3f068fc}, td_turnstile =3D 0x= c3620d40,=20 td_flags =3D 88, td_inhibitors =3D 0, td_pflags =3D 0, td_last_kse =3D 0x= c2c03be0,=20 td_kse =3D 0xc2c03be0, td_dupfd =3D 0, td_wchan =3D 0x0, td_wmesg =3D 0x0= ,=20 td_lastcpu =3D 0 '\0', td_oncpu =3D 255 '', td_locks =3D 0, td_blocked = =3D 0x0,=20 td_ithd =3D 0x0, td_lockname =3D 0x0, td_contested =3D {lh_first =3D 0xc1= 4f0b00},=20 td_sleeplocks =3D 0x0, td_intr_nesting_level =3D 0, td_pinned =3D 0,=20 td_mailbox =3D 0x0, td_ucred =3D 0xc3e89000, td_standin =3D 0x0, td_prtic= ks =3D 0,=20 td_upcall =3D 0x0, td_sticks =3D 6, td_uuticks =3D 0, td_usticks =3D 0,= =20 td_intrval =3D 0, td_oldsigmask =3D {__bits =3D {0, 0, 0, 0}}, td_sigmask= =3D { __bits =3D {0, 0, 0, 0}}, td_siglist =3D {__bits =3D {0, 0, 0, 0}},=20 td_waitset =3D 0x0, td_umtx =3D {tqe_next =3D 0x0, tqe_prev =3D 0x0},=20 td_generation =3D 132, td_sigstk =3D {ss_sp =3D 0x0, ss_size =3D 0, ss_fl= ags =3D 4},=20 td_base_pri =3D 160 '', td_priority =3D 36 '$', td_pcb =3D 0xd30c5da0,=20 td_state =3D TDS_CAN_RUN, td_retval =3D {0, 0}, td_slpcallout =3D {c_link= s =3D { sle =3D {sle_next =3D 0xc40213a4}, tqe =3D {tqe_next =3D 0xc40213a4,= =20 tqe_prev =3D 0xc7b8b0e0}}, c_time =3D 1754632, c_arg =3D 0xc362b690= ,=20 c_func =3D 0, c_flags =3D 10}, td_frame =3D 0xd30c5d48,=20 td_kstack_obj =3D 0xc362239c, td_kstack =3D 3540795392, td_kstack_pages = =3D 2,=20 td_altkstack_obj =3D 0x0, td_altkstack =3D 0, td_altkstack_pages =3D 0,= =20 td_critnest =3D 1, td_md =3D {md_savecrit =3D 582}, td_sched =3D 0xc362b7= d4} =2E.. 231 MPASS(ts !=3D NULL); 232 tc =3D TC_LOOKUP(ts->ts_lockobj); 233 mtx_lock_spin(&tc->tc_lock); =2E.. (kgdb) print &ts->ts_lockobj $9 =3D (struct lock_object **) 0x24 Any ideas? BMS --2oS5YaxWCcQjTEyO Content-Type: application/pgp-signature Content-Disposition: inline -----BEGIN PGP SIGNATURE----- Comment: '' iD8DBQFANG8fueUpAYYNtTsRAkqoAJ978aS4J6Zgt7NoqPF6X/LAj++4qACdHcBo AkxPeSmfBhzqiGRxZQjWaT4= =iwgh -----END PGP SIGNATURE----- --2oS5YaxWCcQjTEyO--