Date: Wed, 3 May 1995 11:30:03 -0700 From: Heikki Suonsivu <hsu@clinet.fi> To: freebsd-bugs Subject: kern/378: vm_bounce_page_free called while no bounce bufgfers used Message-ID: <199505031830.LAA09210@freefall.cdrom.com> In-Reply-To: Your message of Wed, 3 May 1995 21:24:53 %2B0300 <199505031824.VAA04513@katiska.clinet.fi>
next in thread | previous in thread | raw e-mail | index | archive | help
>Number: 378 >Category: kern >Synopsis: (apparently) bounce buffer code gets used on 32bit bus >Confidential: no >Severity: serious >Priority: high >Responsible: freebsd-bugs (FreeBSD bugs mailing list) >State: open >Class: sw-bug >Submitter-Id: current-users >Arrival-Date: Wed May 3 11:30:01 1995 >Originator: Heikki Suonsivu >Organization: Helsinki University of Technology, Finland >Release: FreeBSD 2.1.0-Development i386 >Environment: P60 as an nntp server in addition to normal work: code segment = base 0x0, limit 0xfffff, type 0x1b = DPL 0, pres 1, def32 1, gran 1 processor eflags = interrupt enabled, resume, IOPL = 0 current process = Idle interrupt mask = bio panic: page fault dumping to dev 401, offset 344064 dump 32 31 30 29 28 27 26 25 24 23 22 21 20 19 18 17 16 15 14 13 12 11 10 9 8 7 6 5 4 3 2 1 Probing for devices on the ISA bus: sc0 at 0x60-0x6f irq 1 on motherboard sc0: VGA color <16 virtual consoles, flags=0x0> ed0 at 0x280-0x29f irq 5 maddr 0xd8000 msize 16384 on isa ed0: address 00:00:c0:7a:8d:2c, type WD8013EP (16 bit) bpf: ed0 attached lpt0 not found at 0x3bc sio0 at 0x3f8-0x3ff irq 4 on isa sio0: type 16450 sio1 not found at 0x2f8 sio2 not found at 0x3e8 sio3 not found at 0x2e8 pca0 on isa pca0: PC speaker audio driver bt0: Bt946C/ 0-PCI/EISA/VLB(32bit) bus bt0: reading board settings, busmastering, int=11 bt0: version 4.23, sync, parity, 32 mbxs, 32 ccbs bt0: targ 0 sync rate=10.00MB/s(100ns), offset=15 bt0: targ 1 sync rate=10.00MB/s(100ns), offset=15 bt0: targ 3 sync rate=10.00MB/s(100ns), offset=15 bt0: Enabling Round robin scheme bt0 at 0x330 irq 11 on isa bt0 waiting for scsi devices to settle (bt0:0:0): "IBM 0662S12 !O 2 23" type 0 fixed SCSI 2 sd0(bt0:0:0): Direct-Access 1003MB (2055035 512 byte sectors) (bt0:1:0): "SEAGATE ST32550N 0012" type 0 fixed SCSI 2 sd1(bt0:1:0): Direct-Access 2047MB (4194058 512 byte sectors) (bt0:3:0): "SEAGATE ST31200N 9348" type 0 fixed SCSI 2 sd3(bt0:3:0): Direct-Access 1011MB (2072435 512 byte sectors) aha0 not probed due to I/O address conflict with bt0 at 0x330 wdc0 not found at 0x1f0 wdc1 not found at 0x170 fdc0 at 0x3f0-0x3f7 irq 6 drq 2 on isa fdc0: NEC 765 fd0: 1.44MB 3.5in mcd0: timeout getting status mcd0 not found at 0x300 le0: no board found at 0x300 le0 not found at 0x300 npx0 on motherboard npx0: INT 16 interface matcd0 not found at 0xffffffff matcd1 not found at 0xffffffff matcd2 not found at 0xffffffff matcd3 not found at 0xffffffff bio_imask c0000840 tty_imask c0030032 net_imask c0030032 Probing for devices on the pci0 bus: configuration mode 2 allows 16 devices. pci0:0: vendor=0x10b9, device=0x1451, class=bridge [not supported] pci0:2: vendor=0x10b9, device=0x1449, class=old [not supported] pci0:3: vendor=0x104b, device=0x1040, class=storage [not supported] map(10): io(ffe4) changing root device to sd0a sd0s1: type 0xa5, start 0, end = 2055034, size 2055035 : OK sd1s1: type 0xa5, start 0, end = 4194057, size 4194058 : OK sd3s1: type 0xa5, start 0, end = 2072434, size 2072435 : OK sd0s1: type 0xa5, start 0, end = 2055034, size 2055035 : OK bpf: ds0 attached bpf: lo0 attached bpf: ppp0 attached bpf: ppp1 attached bpf: ppp2 attached bpf: ppp3 attached bpf: ppp4 attached bpf: ppp5 attached bpf: ppp6 attached bpf: ppp7 attached bpf: ppp8 attached bpf: ppp9 attached bpf: ppp10 attached bpf: ppp11 attached bpf: ppp12 attached bpf: ppp13 attached bpf: ppp14 attached bpf: ppp15 attached bpf: ppp16 attached bpf: ppp17 attached bpf: ppp18 attached bpf: ppp19 attached bpf: ppp20 attached bpf: ppp21 attached bpf: ppp22 attached bpf: ppp23 attached bpf: ppp24 attached bpf: ppp25 attached bpf: ppp26 attached bpf: ppp27 attached bpf: ppp28 attached bpf: ppp29 attached bpf: ppp30 attached bpf: ppp31 attached bpf: sl0 attached bpf: sl1 attached bpf: sl2 attached bpf: sl3 attached bpf: sl4 attached bpf: sl5 attached bpf: sl6 attached bpf: sl7 attached bpf: sl8 attached bpf: sl9 attached bpf: sl10 attached bpf: sl11 attached bpf: sl12 attached bpf: sl13 attached bpf: sl14 attached bpf: sl15 attached bpf: tun0 attached sd0s1: type 0xa5, start 0, end = 2055034, size 2055035 : OK WARNING: / was not properly dismounted sd3s1: type 0xa5, start 0, end = 2072434, size 2072435 : OK sd1s1: type 0xa5, start 0, end = 4194057, size 4194058 : OK sd1s1: type 0xa5, start 0, end = 4194057, size 4194058 : OK panic: vm_bounce_page_free: invalid bounce buffer syncing disks... Fatal trap 12: page fault while in kernel mode fault virtual address = 0xa0 fault code = supervisor read, page not present instruction pointer Current directory is /var/crash/ Reading symbol data from /var/crash/kernel.15...done. (kgdb) core vmcore.15 IdlePTD 246000 panic: vm_bounce_page_free: invalid bounce buffer current pcb at 1f7520 Reading in symbols for ../../i386/i386/machdep.c...done. (kgdb) directory /usr/src/compile/CLINETSERVER /usr/src/compile/CLINETSERVER: No such file or directory. (kgdb) directory /usr/src/sys/compile/CLINETSERVER Source directories searched: /m/katiska/news/crash:/usr/src/sys/compile/CLINETSERVER (kgdb) bt #0 boot (arghowto=260) (../../i386/i386/machdep.c line 869) #1 0xf01147c3 in panic (...) #2 0xf01b939e in trap_fatal (...) #3 0xf01b8f10 in trap_pfault (...) #4 0xf01b8bd7 in trap (...) #5 0xf01aeb81 in exception:calltrap (-227581896, 16, -267227880, 0) #6 0xf0126d4f in biowait (...) #7 0xf0125601 in bread (...) #8 0xf018f16d in ffs_update (...) #9 0xf019162a in ffs_sync (...) #10 0xf012bbfe in sync (...) #11 0xf01b10cc in boot (arghowto=256) (../../i386/i386/machdep.c line 828) #12 0xf01147c3 in panic (...) #13 0xf01ba964 in vm_bounce_page_free (...) #14 0xf01baf00 in vm_bounce_free (...) #15 0xf0126ee3 in biodone (...) #16 0xf0185184 in scsi_done (...) #17 0xf01bdedb in bt_done (...) #18 0xf01bda54 in btintr (...) #19 0xf01afaa7 in exception:Xresume11 () #20 0xf01b819c in cpu_switch () (kgdb) list Reading in symbols for ../../kern/init_main.c...done. 121 /* 122 * System startup; initialize the world, create process 0, mount root 123 * filesystem, and fork to create init and pagedaemon. Most of the 124 * hard work is done in the lower-level initialization routines including 125 * startup(), which does memory initialization and autoconfiguration. 126 */ 127 void 128 main(framep) 129 void *framep; 130 { (kgdb) up Reading in symbols for ../../kern/subr_prf.c...done. #1 0xf01147c3 in panic (fmt=(char *) 0xf01b88de "page fault") (../../kern/subr_prf.c line 128) (kgdb) list 123 kdbpanic(); 124 #endif 125 #ifdef DDB 126 Debugger ("panic"); 127 #endif 128 boot(bootopt); 129 } 130 131 /* 132 * Warn that a system table is full. (kgdb) up Reading in symbols for ../../i386/i386/trap.c...done. #2 0xf01b939e in trap_fatal (frame=(struct trapframe *) 0xf01e1d5c) (../../i386/i386/trap.c line 688) (kgdb) list 683 #ifdef DDB 684 if (kdb_trap (type, 0, frame)) 685 return; 686 #endif 687 if (type <= MAX_TRAP_MSG) 688 panic(trap_msg[type]); 689 else 690 panic("unknown/reserved trap"); 691 } 692 (kgdb) list 693 /* 694 * Compensate for 386 brain damage (missing URKR). 695 * This is a little simpler than the pagefault handler in trap() because 696 * it the page tables have already been faulted in and high addresses 697 * are thrown out early for other reasons. 698 */ 699 int trapwrite(addr) 700 unsigned addr; 701 { 702 struct proc *p; (kgdb) up #3 0xf01b8f10 in trap_pfault (frame=(struct trapframe *) 0xf01e1d5c, usermode=0) (../../i386/i386/trap.c line 610) (kgdb) print usermode $1 = 0 (kgdb) print frame $2 = (struct trapframe *) 0xf01e1d5c (kgdb) print *frame $3 = {tf_es = 16, tf_ds = 16, tf_edi = -1, tf_esi = -227581896, tf_ebp = -266461784, tf_isp = -266461820, tf_ebx = 0, tf_edx = 1073739711, tf_ecx = 0, tf_eax = -2146435056, tf_trapno = 12, tf_err = 0, tf_eip = -267317170, tf_cs = 8, tf_eflags = 66118, tf_esp = -227581896, tf_ss = -1073739712} (kgdb) print curpcb $4 = -194781184 (kgdb) print *curpcb $5 = 0 (kgdb) up #4 0xf01b8bd7 in trap (frame={tf_es = 16, tf_ds = 16, tf_edi = -1, tf_esi = -227581896, tf_ebp = -266461784, tf_isp = -266461820, tf_ebx = 0, tf_edx = 1073739711, tf_ecx = 0, tf_eax = -2146435056, tf_trapno = 12, tf_err = 0, tf_eip = -267317170, tf_cs = 8, tf_eflags = 66118, tf_esp = -227581896, tf_ss = -1073739712}) (../../i386/i386/trap.c line 290) (kgdb) print type $6 = 0 (kgdb) up #5 0xf01aeb81 in exception:calltrap (-227581896, 16, -267227880, 0) (kgdb) up Reading in symbols for ../../kern/vfs_bio.c...done. #6 0xf0126d4f in biowait (bp=(struct buf *) 0xf26f6038) (../../kern/vfs_bio.c line 1032) (kgdb) print *bp Cannot read memory: address 0x0 out of bounds. (kgdb) list 1027 biowait(register struct buf * bp) 1028 { 1029 int s; 1030 1031 s = splbio(); 1032 while ((bp->b_flags & B_DONE) == 0) 1033 tsleep((caddr_t) bp, PRIBIO, "biowait", 0); 1034 splx(s); 1035 if (bp->b_flags & B_EINTR) { 1036 bp->b_flags &= ~B_EINTR; (kgdb) frame #6 0xf0126d4f in biowait (bp=(struct buf *) 0xf26f6038) (../../kern/vfs_bio.c line 1032) (kgdb) print *(struct buf *) 0xf26f6038 $7 = {b_hash = {le_next = 0xf26e9e08, le_prev = 0xf0228c00}, b_vnbufs = {le_next = 0x0, le_prev = 0xf0a2902c}, b_freelist = {tqe_next = 0x0, tqe_prev = 0xf01f76a4}, b_actf = 0x0, b_actb = 0x0, b_proc = 0x0, b_flags = 1049104, b_qindex = 0, b_error = 0, b_bufsize = 8192, b_bcount = 8192, b_resid = 0, b_dev = 0x00000400, b_un = {b_addr = 0xf2fd8000 "\200!\001"}, b_saveaddr = 0x0, b_lblkno = 24176, b_blkno = 24176, b_iodone = 0x0, b_iodone_chain = 0x0, b_vp = 0xf0a29000, b_pfcent = 0, b_dirtyoff = 0, b_dirtyend = 0, b_rcred = 0xffffffff, b_wcred = 0xffffffff, b_validoff = 0, b_validend = 0, b_pblkno = 24176, b_savekva = 0x0, b_driver1 = 0x0, b_driver2 = 0x0, b_spc = 0x0, b_pages = {0xf02b049c, 0xf02b05a0, 0x0 <repeats 14 times>}, b_npages = 2} (kgdb) up #7 0xf0125601 in bread (vp=(struct vnode *) 0xf0a29000, blkno=24176, size=8192, cred=(struct ucred *) 0xffffffff, bpp=(struct buf **) 0xf01e1e24) (../../kern/vfs_bio.c line 183) (kgdb) print *bp $8 = {b_hash = {le_next = 0xf26e9e08, le_prev = 0xf0228c00}, b_vnbufs = {le_next = 0x0, le_prev = 0xf0a2902c}, b_freelist = {tqe_next = 0x0, tqe_prev = 0xf01f76a4}, b_actf = 0x0, b_actb = 0x0, b_proc = 0x0, b_flags = 1049104, b_qindex = 0, b_error = 0, b_bufsize = 8192, b_bcount = 8192, b_resid = 0, b_dev = 0x00000400, b_un = {b_addr = 0xf2fd8000 "\200!\001"}, b_saveaddr = 0x0, b_lblkno = 24176, b_blkno = 24176, b_iodone = 0x0, b_iodone_chain = 0x0, b_vp = 0xf0a29000, b_pfcent = 0, b_dirtyoff = 0, b_dirtyend = 0, b_rcred = 0xffffffff, b_wcred = 0xffffffff, b_validoff = 0, b_validend = 0, b_pblkno = 24176, b_savekva = 0x0, b_driver1 = 0x0, b_driver2 = 0x0, b_spc = 0x0, b_pages = {0xf02b049c, 0xf02b05a0, 0x0 <repeats 14 times>}, b_npages = 2} (kgdb) up Reading in symbols for ../../ufs/ffs/ffs_inode.c...done. #8 0xf018f16d in ffs_update (ap=(struct vop_update_args *) 0xf01e1e50) (../../ufs/ffs/ffs_inode.c line 133) (kgdb) list 128 */ 129 if (fs->fs_inodefmt < FS_44INODEFMT) { /* XXX */ 130 ip->i_din.di_ouid = ip->i_uid; /* XXX */ 131 ip->i_din.di_ogid = ip->i_gid; /* XXX */ 132 } /* XXX */ 133 error = bread(ip->i_devvp, fsbtodb(fs, ino_to_fsba(fs, ip->i_number)), 134 (int)fs->fs_bsize, NOCRED, &bp); 135 if (error) { 136 brelse(bp); 137 return (error); (kgdb) print ip $9 = (struct inode *) 0xf0aa1a00 (kgdb) print *ip $10 = {i_next = 0x0, i_prev = 0xf0a1bed4, i_vnode = 0xf0aa0980, i_devvp = 0xf0a29000, i_flag = 0x00000000, i_dev = 0x00000400, i_number = 0x00000bb5, inode_u = {fs = 0xf0a2b800, lfs = 0xf0a2b800}, i_dquot = {0x0, 0x0}, i_modrev = 0x33303f80, i_lockf = 0x0, i_lockholder = 0, i_lockwaiter = 0, i_count = 0, i_endoff = 0, i_diroff = 0, i_offset = 0, i_ino = 0x00000000, i_reclen = 0x00000000, i_lockcount = 0, i_spare = {0, 0, 0, 0, 0, 0, 0, 0, 0, 0}, i_din = {di_mode = 0x21a0, di_nlink = 1, di_u = {oldids = {0x0000, 0x0000}, inumber = 0x00000000}, di_size = 0x0, di_atime = {ts_sec = 799517567, ts_nsec = 0}, di_mtime = {ts_sec = 789934118, ts_nsec = 0}, di_ctime = {ts_sec = 791069396, ts_nsec = 0}, di_db = {3329, 0 <repeats 11 times>}, di_ib = {0, 0, 0}, di_flags = 0x00000000, di_blocks = 0, di_gen = 791069637, di_uid = 0x00000000, di_gid = 0x00000005, di_spare = {0, 0}}} (kgdb) print fs $11 = (struct fs *) 0xf0a2b800 (kgdb) print *fs $12 = {fs_link = 0x0, fs_rlink = 0x0, fs_sblkno = 16, fs_cblkno = 24, fs_iblkno = 32, fs_dblkno = 152, fs_cgoffset = 56, fs_cgmask = -8, fs_time = 799517538, fs_size = 61440, fs_dsize = 59247, fs_ncg = 16, fs_bsize = 8192, fs_fsize = 1024, fs_frag = 8, fs_minfree = 5, fs_rotdelay = 0, fs_rps = 60, fs_bmask = -8192, fs_fmask = -1024, fs_bshift = 13, fs_fshift = 10, fs_maxcontig = 1, fs_maxbpg = 2048, fs_fragshift = 3, fs_fsbtodb = 1, fs_sbsize = 2048, fs_csmask = -512, fs_csshift = 9, fs_nindir = 2048, fs_inopb = 64, fs_nspf = 2, fs_optim = 0, fs_npsect = 99, fs_interleave = 1, fs_trackskew = 0, fs_headswitch = 0, fs_trkseek = 0, fs_csaddr = 152, fs_cssize = 1024, fs_cgsize = 1024, fs_ntrak = 5, fs_nsect = 99, fs_spc = 495, fs_ncyl = 249, fs_cpg = 16, fs_ipg = 960, fs_fpg = 3960, fs_cstotal = {cs_ndir = 103, cs_nbfree = 2816, cs_nifree = 13356, cs_nffree = 500}, fs_fmod = 0, fs_clean = 0, fs_ronly = 0, fs_flags = 0, fs_fsmnt = {"/", '\000' <repeats 511 times>}, fs_cgrotor = 7! , fs_csp = {0xf0a24400, 0x0 <repeats 31 times>}, fs_cpc = 16, fs_opostbl = {{0, 0, 0, 0, 0, 0, 0, 0} <repeats 16 times>}, fs_sparecon = {0 <repeats 50 times>}, fs_contigsumsize = 0, fs_maxsymlinklen = 60, fs_inodefmt = 2, fs_maxfilesize = 0x0, fs_qbmask = 8191, fs_qfmask = 1023, fs_state = 0, fs_postblformat = 1, fs_nrpos = 1, fs_postbloff = 1376, fs_rotbloff = 1408, fs_magic = 72020, fs_space = {"\000"}} (kgdb) print fd->fs_bsiz No symbol "fd" in current context. (kgdb) print fd->fs_bsize No symbol "fd" in current context. (kgdb) print fs->fs_bsize $13 = 8192 (kgdb) up Reading in symbols for ../../ufs/ffs/ffs_vfsops.c...done. #9 0xf019162a in ffs_sync (mp=(struct mount *) 0xf0a2ac00, waitfor=2, cred=(struct ucred *) 0xf0901780, p=(struct proc *) 0xf022afb0) (./vnode_if.h line 850) 850 (./vnode_if.h) (kgdb) list ./vnode_if.h: No such file or directory. (kgdb) up Reading in symbols for ../../kern/vfs_syscalls.c...done. #10 0xf012bbfe in sync (p=(struct proc *) 0xf022afb0, uap=(struct sync_args *) 0x0, retval=(int *) 0x0) (../../kern/vfs_syscalls.c line 335) (kgdb) print mp $14 = (struct mount *) 0xf0a2ac00 (kgdb) print *mp $15 = {mnt_list = {tqe_next = 0xf0a05400, tqe_prev = 0xf02285ec}, mnt_op = 0xf01e8d90, mnt_vnodecovered = 0x0, mnt_vnodelist = {lh_first = 0xf0aaae00}, mnt_flag = 4214784, mnt_maxsymlinklen = 60, mnt_stat = {f_type = 1, f_flags = 20480, f_bsize = 1024, f_iosize = 8192, f_blocks = 59247, f_bfree = 23028, f_bavail = 20065, f_files = 15358, f_ffree = 13356, f_fsid = {val = {1024, 1}}, f_spare = {0, 0, 0, 0, 0, 0, 0, 0, 0}, f_mntonname = {"/", '\000' <repeats 89 times>}, f_mntfromname = {"/dev/sd0a", '\000' <repeats 81 times>}}, mnt_data = 0xf0a2a600, mnt_vfc = 0x0} (kgdb) list 330 */ 331 if ((mp->mnt_flag & (MNT_MLOCK|MNT_RDONLY|MNT_MPBUSY)) == 0 && 332 !vfs_busy(mp)) { 333 asyncflag = mp->mnt_flag & MNT_ASYNC; 334 mp->mnt_flag &= ~MNT_ASYNC; 335 VFS_SYNC(mp, MNT_NOWAIT, p != NULL ? p->p_ucred : NOCRED, p); 336 if (asyncflag) 337 mp->mnt_flag |= MNT_ASYNC; 338 vfs_unbusy(mp); 339 } (kgdb) up #11 0xf01b10cc in boot (arghowto=256) (../../i386/i386/machdep.c line 828) (kgdb) print proc No symbol "proc" in current context. (kgdb) print proc0 $16 = {p_forw = 0x0, p_back = 0x0, p_next = 0x0, p_prev = 0xf0a17108, p_cred = 0xf0231ccc, p_fd = 0xf01f5890, p_stats = 0xf0247288, p_limit = 0xf022fd5c, p_vmspace = 0xf01f8cac, p_sigacts = 0xf024715c, p_flag = 516, p_stat = 3, p_pad1 = {"\000\000\000"}, p_pid = 0, p_hash = 0x0, p_pgrpnxt = 0xf0a69b00, p_pptr = 0x0, p_osptr = 0x0, p_ysptr = 0x0, p_cptr = 0xf0a69b00, p_oppid = 0, p_dupfd = 0, p_estcpu = 0x00000000, p_cpticks = 0, p_pctcpu = 0x00000000, p_wchan = 0xf022afb0, p_wmesg = 0xf01a41d2 "sched", p_swtime = 0x000000f2, p_slptime = 0x00000009, p_realtimer = {it_interval = {tv_sec = 0, tv_usec = 0}, it_value = {tv_sec = 0, tv_usec = 0}}, p_rtime = {tv_sec = 0, tv_usec = 10510}, p_uticks = 0x0, p_sticks = 0x2e, p_iticks = 0x9, p_traceflag = 0, p_tracep = 0x0, p_siglist = 0, p_textvp = 0x0, p_lock = 0, p_pad2 = {"\000\000\000"}, p_spare = {0, 0}, p_sigmask = 0x00000000, p_sigignore = 0x18488000, p_sigcatch = 0x00000000, p_priority = 0x04, p_usrpri = 0x32, p_nice = 0, p_com! m = {"swapper\000\000\000\000\000\000\000\000\000\000"}, p_pgrp = 0xf022cc20, p_sysent = 0xf01e3620, p_rtprio = {type = 0x0001, prio = 0x0000}, p_thread = 0, p_addr = 0xf0247000, p_md = {md_flags = 0, md_regs = 0x0}, p_xstat = 0x0000, p_acflag = 0x0000, p_ru = 0x0} (kgdb) print panicstr $17 = (char *) 0xf01ba8e6 "vm_bounce_page_free: invalid bounce buffer" (kgdb) list 823 /* 824 * Release inodes held by texts before update. 825 */ 826 if (panicstr == 0) 827 vnode_pager_umount(NULL); 828 sync(&proc0, NULL, NULL); 829 830 for (iter = 0; iter < 20; iter++) { 831 nbusy = 0; 832 for (bp = &buf[nbuf]; --bp >= buf; ) { (kgdb) up #12 0xf01147c3 in panic (fmt=(char *) 0xf01ba8e6 "vm_bounce_page_free: invalid bounce buffer") (../../kern/subr_prf.c line 128) (kgdb) list 123 kdbpanic(); 124 #endif 125 #ifdef DDB 126 Debugger ("panic"); 127 #endif 128 boot(bootopt); 129 } 130 131 /* 132 * Warn that a system table is full. (kgdb) up Reading in symbols for ../../i386/i386/vm_machdep.c...done. #13 0xf01ba964 in vm_bounce_page_free (pa=0x00fd8000, count=1) (../../i386/i386/vm_machdep.c line 169) (kgdb) list 164 if( pa == bouncepa[index]) 165 break; 166 } 167 168 if( index == bouncepages) 169 panic("vm_bounce_page_free: invalid bounce buffer"); 170 171 allocindex = index / BITS_IN_UNSIGNED; 172 bit = index % BITS_IN_UNSIGNED; 173 (kgdb) print index $18 = 0 (kgdb) print bouncepages $19 = 128 (kgdb) print count $20 = 1 (kgdb) up #14 0xf01baf00 in vm_bounce_free (bp=(struct buf *) 0xf26e6e18) (../../i386/i386/vm_machdep.c line 452) (kgdb) list 447 */ 448 449 /* 450 printf("(kva: %x, pa: %x)", bouncekva, mybouncepa); 451 */ 452 vm_bounce_page_free(mybouncepa, 1); 453 } 454 455 origkva += copycount; 456 bouncekva += copycount; (kgdb) print mynouncepa No symbol "mynouncepa" in current context. (kgdb) print mybouncepa $21 = 0x00fd8000 (kgdb) print *mybouncepa Cannot read memory: address 0xfd8000 out of bounds. (kgdb) up #15 0xf0126ee3 in biodone (bp=(struct buf *) 0xf26e6e18) (../../kern/vfs_bio.c line 1069) (kgdb) print bp->b_flags $22 = -536870316 (kgdb) print *bp $23 = {b_hash = {le_next = 0x0, le_prev = 0x0}, b_vnbufs = {le_next = 0x87654321, le_prev = 0x0}, b_freelist = {tqe_next = 0x0, tqe_prev = 0x0}, b_actf = 0xf26e6938, b_actb = 0x0, b_proc = 0x0, b_flags = -536870316, b_qindex = 0, b_error = 0, b_bufsize = 8192, b_bcount = 8192, b_resid = 0, b_dev = 0x0000040e, b_un = {b_addr = 0xf2789000 }, b_saveaddr = 0xf0a81120, b_lblkno = 4838, b_blkno = 2292656, b_iodone = 0xf0128440, b_iodone_chain = 0x0, b_vp = 0xf0aaa380, b_pfcent = 0, b_dirtyoff = 0, b_dirtyend = 0, b_rcred = 0xffffffff, b_wcred = 0xffffffff, b_validoff = 0, b_validend = 0, b_pblkno = 2292656, b_savekva = 0xf3bd4000 , b_driver1 = 0x0, b_driver2 = 0x0, b_spc = 0x0, b_pages = {0xf02ac7ac, 0xf02b0260, 0x0 <repeats 14 times>}, b_npages = 2} (kgdb) up Reading in symbols for ../../scsi/scsi_base.c...done. #16 0xf0185184 in scsi_done (xs=(struct scsi_xfer *) 0xf0a83e00) (../../scsi/scsi_base.c line 429) (kgdb) print bp $24 = (struct buf *) 0xf26e6e18 (kgdb) print *bp $25 = {b_hash = {le_next = 0x0, le_prev = 0x0}, b_vnbufs = {le_next = 0x87654321, le_prev = 0x0}, b_freelist = {tqe_next = 0x0, tqe_prev = 0x0}, b_actf = 0xf26e6938, b_actb = 0x0, b_proc = 0x0, b_flags = -536870316, b_qindex = 0, b_error = 0, b_bufsize = 8192, b_bcount = 8192, b_resid = 0, b_dev = 0x0000040e, b_un = {b_addr = 0xf2789000 }, b_saveaddr = 0xf0a81120, b_lblkno = 4838, b_blkno = 2292656, b_iodone = 0xf0128440, b_iodone_chain = 0x0, b_vp = 0xf0aaa380, b_pfcent = 0, b_dirtyoff = 0, b_dirtyend = 0, b_rcred = 0xffffffff, b_wcred = 0xffffffff, b_validoff = 0, b_validend = 0, b_pblkno = 2292656, b_savekva = 0xf3bd4000 , b_driver1 = 0x0, b_driver2 = 0x0, b_spc = 0x0, b_pages = {0xf02ac7ac, 0xf02b0260, 0x0 <repeats 14 times>}, b_npages = 2} (kgdb) up Reading in symbols for ../../i386/isa/bt742a.c...done. #17 0xf01bdedb in bt_done (unit=0, ccb=(struct bt_ccb *) 0xf0a05000) (../../i386/isa/bt742a.c line 1087) (kgdb) print xs $26 = (struct scsi_xfer *) 0xf0a83e00 (kgdb) print *xs $27 = {next = 0xf0a83d00, flags = 0x00000831, sc_link = 0xf0901a00, retries = 0x04, spare = {"\300\255\336"}, timeout = 10000, cmd = 0xf0a83e58, cmdlen = 10, data = 0xf27a0000 , datalen = 4096, resid = 0, error = 0, bp = 0xf26f5e98, sense = {error_code = 0xde, ext = {unextended = {blockhi = 0xc0, blockmed = 0xad, blocklow = 0xde}, extended = {segment = 0xc0, flags = 0xad, info = {"\336\336\300\255"}, extra_len = 0xde, extra_bytes = {"\336\300\255\336\336\300\255\336", '\000' <repeats 16 times>}}}}, req_sense_length = 0, status = 0, cmdstore = {opcode = 0x2a, bytes = {"\000\000\"\267\220\000\000\b\000\000\000"}}} (kgdb) up #18 0xf01bda54 in btintr (unit=0) (../../i386/isa/bt742a.c line 832) (kgdb) print unit $28 = 0 (kgdb) print ccb $29 = (struct bt_ccb *) 0xf0a05000 (kgdb) print *ccb $30 = {opcode = 0x02, = 0x00, data_in = 0x00, data_out = 0x00, = 0x00, scsi_cmd_length = 0x0a, req_sense_length = 0x20, data_length = 0x00000008, data_addr = 0x0032a048, dummy = {"\000\000"}, host_stat = 0x00, target_stat = 0x00, target = 0x00, lun = 0x00, scsi_cmd = {"*\000\000\a9P\000\000\b\000\000\000"}, dummy2 = {"\000"}, link_id = 0x00, link_addr = 0x00000000, sense_ptr = 0x0032a028, scsi_sense = {error_code = 0x70, ext = {unextended = {blockhi = 0x00, blockmed = 0x05, blocklow = 0x00}, extended = {segment = 0x00, flags = 0x05, info = {"\000\000\000\000"}, extra_len = 0x18, extra_bytes = {"\000\000\000\000 \000\000\000\000\000\000\000\0010\000\000\000\000\000\000\000\000\000\000"}}}}, scat_gath = {{seg_len = 0x00001000, seg_addr = 0x0032a000}, {seg_len = 0x00001000, seg_addr = 0x00fdd000}, {seg_len = 0x00005000, seg_addr = 0x00064000}, {seg_len = 0x00001000, seg_addr = 0x00087000}, {seg_len = 0x00001000, seg_addr = 0x00fe3000}, {seg_len = 0x00002000, seg_addr = 0x0006! 5000}, {seg_len = 0x00002000, seg_addr = 0x00b67000}, {seg_len = 0x00001000, seg_addr = 0x00067000}, {seg_len = 0x00001000, seg_addr = 0x00605000}, {seg_len = 0x00001000, seg_addr = 0x00f49000}, {seg_len = 0x00001000, seg_addr = 0x00f3a000}, {seg_len = 0x00001000, seg_addr = 0x00f3f000}, {seg_len = 0x000005b0, seg_addr = 0x00e67000}, {seg_len = 0x000005b0, seg_addr = 0x00f35000}, {seg_len = 0x00000000, seg_addr = 0x00000000} <repeats 19 times>}, next = 0xf0a05c00, xfer = 0xf01f0078, mbx = 0xf090387c, flags = 1, nexthash = 0x0, hashkey = 0x0032a000} (kgdb) list 827 #endif 828 } 829 wmbi->stat = BT_MBI_FREE; 830 if (ccb) { 831 untimeout(bt_timeout, (caddr_t)ccb); 832 bt_done(unit, ccb); 833 } 834 /* Set the IN mail Box pointer for next */ bt_nextmbx(wmbi, wmbx, mbi); 835 } 836 if (!found) { (kgdb) up #19 0xf01afaa7 in exception:Xresume11 () (kgdb) up #20 0xf01b819c in cpu_switch () (kgdb) down #19 0xf01afaa7 in exception:Xresume11 () (kgdb) list 837 for (i = 0; i < BT_MBX_SIZE; i++) { 838 if (wmbi->stat != BT_MBI_FREE) { 839 found++; 840 break; 841 } 842 bt_nextmbx(wmbi, wmbx, mbi); 843 } 844 if (!found) { 845 #ifdef DEBUG 846 printf("bt%d: mbi at 0x%08x should be found, stat=%02x..resync\n", (kgdb) up #20 0xf01b819c in cpu_switch () (kgdb) up Initial frame selected; you cannot go up. (kgdb) >Description: Above panic, with 32 bit bus? >How-To-Repeat: Once this far. >Fix: Workaround might be disabling bounce buffers altogether (I would like to limit the number of different kernels in use to few as we have lots of identically configured machines). bounce buffer code shouldn't be called in this machine, doesn't it say "enabling bounce buffer code" in boot on those which need it? >Audit-Trail: >Unformatted:
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?199505031830.LAA09210>