From owner-freebsd-net@FreeBSD.ORG Thu Feb 16 20:15:16 2006 Return-Path: X-Original-To: net@FreeBSD.org Delivered-To: freebsd-net@FreeBSD.ORG Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125]) by hub.freebsd.org (Postfix) with ESMTP id 576AD16A420 for ; Thu, 16 Feb 2006 20:15:16 +0000 (GMT) (envelope-from kris@obsecurity.org) Received: from elvis.mu.org (elvis.mu.org [192.203.228.196]) by mx1.FreeBSD.org (Postfix) with ESMTP id 2331043D49 for ; Thu, 16 Feb 2006 20:15:16 +0000 (GMT) (envelope-from kris@obsecurity.org) Received: from obsecurity.dyndns.org (elvis.mu.org [192.203.228.196]) by elvis.mu.org (Postfix) with ESMTP id 009E11A3C25 for ; Thu, 16 Feb 2006 12:15:16 -0800 (PST) Received: by obsecurity.dyndns.org (Postfix, from userid 1000) id 5CC925152B; Thu, 16 Feb 2006 15:15:14 -0500 (EST) Date: Thu, 16 Feb 2006 15:15:14 -0500 From: Kris Kennaway To: net@FreeBSD.org Message-ID: <20060216201514.GA25470@xor.obsecurity.org> Mime-Version: 1.0 Content-Type: multipart/signed; micalg=pgp-sha1; protocol="application/pgp-signature"; boundary="cWoXeonUoKmBZSoM" Content-Disposition: inline User-Agent: Mutt/1.4.2.1i Cc: Subject: deadc0de panic in fxp driver X-BeenThere: freebsd-net@freebsd.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Networking and TCP/IP with FreeBSD List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 16 Feb 2006 20:15:16 -0000 --cWoXeonUoKmBZSoM Content-Type: text/plain; charset=us-ascii Content-Disposition: inline Peter Holm's stress test gave me this on an SMP machine running fresh 7.0: Fatal trap 12: page fault while in kernel mode cpuid = 0; apic id = 00 fault virtual address = 0xdeadc0de fault code = supervisor write, page not present instruction pointer = 0x20:0xc0681633 stack pointer = 0x28:0xf3bbeb88 frame pointer = 0x28:0xf3bbeb88 code segment = base 0x0, limit 0xfffff, type 0x1b = DPL 0, pres 1, def32 1, gran 1 processor eflags = interrupt enabled, resume, IOPL = 0 current process = 24 (irq17: fxp0) [thread pid 24 tid 100020 ] Stopped at trash_dtor+0x10: movl $0xdeadc0de,0(%edx) db> wh Tracing pid 24 tid 100020 td 0xcc47b1a0 trash_dtor(deadc0de,800,0,f3bbebb8,c05295bb) at trash_dtor+0x10 trash_init(deadc0de,800,1,7f,35) at trash_init+0x20 mb_zinit_pack(ccb7e100,100,1,85f,f3bbebec) at mb_zinit_pack+0x50 uma_zalloc_bucket(c1057000,1,c073d432,75d,0) at uma_zalloc_bucket+0x1f1 uma_zalloc_arg(c1057000,f3bbec4c,1,1,c072a086) at uma_zalloc_arg+0x38e fxp_add_rfabuf(cc546000,cc54604c,2,61a,cc546014) at fxp_add_rfabuf+0x35 fxp_intr_body(cc546000,cc53c000,40,ffffffff,cc53c000) at fxp_intr_body+0x115 fxp_intr(cc546000,f3bbecdc,c052aa10,c07f5c90,1) at fxp_intr+0xcf ithread_execute_handlers(cc4cccd8,cc477700,c0725a19,2f9,cc47b1a0) at ithread_execute_handlers+0x10e ithread_loop(cc539960,f3bbed38,c0725807,31a,cc539960) at ithread_loop+0x78 fork_exit(c051cdfa,cc539960,f3bbed38) at fork_exit+0xc5 fork_trampoline() at fork_trampoline+0x8 --- trap 0x1, eip = 0, esp = 0xf3bbed6c, ebp = 0 --- db> I can leave it in DDB for a little while (can't dump) in case someone needs additional debugging, but not forever. Kris --cWoXeonUoKmBZSoM Content-Type: application/pgp-signature Content-Disposition: inline -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.2 (FreeBSD) iD8DBQFD9N1RWry0BWjoQKURAmLRAKDMARIAe2Ow/jli0lIDoxOBtVRLdQCgnMui YloRSZ7mH2Nlcy8jIZ5nR7s= =k23V -----END PGP SIGNATURE----- --cWoXeonUoKmBZSoM--