From owner-freebsd-bugs@FreeBSD.ORG Mon Jan 9 23:40:10 2006 Return-Path: X-Original-To: freebsd-bugs@hub.freebsd.org Delivered-To: freebsd-bugs@hub.freebsd.org Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125]) by hub.freebsd.org (Postfix) with ESMTP id E794516A41F for ; Mon, 9 Jan 2006 23:40:09 +0000 (GMT) (envelope-from gnats@FreeBSD.org) Received: from freefall.freebsd.org (freefall.freebsd.org [216.136.204.21]) by mx1.FreeBSD.org (Postfix) with ESMTP id 9D10A43D46 for ; Mon, 9 Jan 2006 23:40:08 +0000 (GMT) (envelope-from gnats@FreeBSD.org) Received: from freefall.freebsd.org (gnats@localhost [127.0.0.1]) by freefall.freebsd.org (8.13.4/8.13.4) with ESMTP id k09Ne8er047731 for ; Mon, 9 Jan 2006 23:40:08 GMT (envelope-from gnats@freefall.freebsd.org) Received: (from gnats@localhost) by freefall.freebsd.org (8.13.4/8.13.4/Submit) id k09Ne8J1047730; Mon, 9 Jan 2006 23:40:08 GMT (envelope-from gnats) Resent-Date: Mon, 9 Jan 2006 23:40:08 GMT Resent-Message-Id: <200601092340.k09Ne8J1047730@freefall.freebsd.org> Resent-From: FreeBSD-gnats-submit@FreeBSD.org (GNATS Filer) Resent-To: freebsd-bugs@FreeBSD.org Resent-Reply-To: FreeBSD-gnats-submit@FreeBSD.org, Erik Osterholm Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125]) by hub.freebsd.org (Postfix) with ESMTP id C7F3416A41F for ; Mon, 9 Jan 2006 23:37:56 +0000 (GMT) (envelope-from nobody@FreeBSD.org) Received: from www.freebsd.org (www.freebsd.org [216.136.204.117]) by mx1.FreeBSD.org (Postfix) with ESMTP id 4D65943D58 for ; Mon, 9 Jan 2006 23:37:54 +0000 (GMT) (envelope-from nobody@FreeBSD.org) Received: from www.freebsd.org (localhost [127.0.0.1]) by www.freebsd.org (8.13.1/8.13.1) with ESMTP id k09Nbsg9057505 for ; Mon, 9 Jan 2006 23:37:54 GMT (envelope-from nobody@www.freebsd.org) Received: (from nobody@localhost) by www.freebsd.org (8.13.1/8.13.1/Submit) id k09NbsXP057504; Mon, 9 Jan 2006 23:37:54 GMT (envelope-from nobody) Message-Id: <200601092337.k09NbsXP057504@www.freebsd.org> Date: Mon, 9 Jan 2006 23:37:54 GMT From: Erik Osterholm To: freebsd-gnats-submit@FreeBSD.org X-Send-Pr-Version: www-2.3 Cc: Subject: kern/91574: bge member in if_bridge causing system crash X-BeenThere: freebsd-bugs@freebsd.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Bug reports List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 09 Jan 2006 23:40:10 -0000 >Number: 91574 >Category: kern >Synopsis: bge member in if_bridge causing system crash >Confidential: no >Severity: serious >Priority: medium >Responsible: freebsd-bugs >State: open >Quarter: >Keywords: >Date-Required: >Class: sw-bug >Submitter-Id: current-users >Arrival-Date: Mon Jan 09 23:40:07 GMT 2006 >Closed-Date: >Last-Modified: >Originator: Erik Osterholm >Release: FreeBSD 6.0-RELEASE i386 >Organization: Texas A&M University >Environment: FreeBSD erik-test.net.tamu.edu 6.0-RELEASE FreeBSD 6.0-RELEASE #0: Fri J an 6 15:53:52 UTC 2006 root@erik-test.net.tamu.edu:/usr/obj/usr/src/sys/GENERIC.poll.notxp i386 >Description: When using the bge0 driver as a member interface to bridge0 (if_bridge), the machine crashes very shortly upon coming up. Bringing down the bge0 interface prevents the crash, as does leaving it up but removing it from the bridge. We have tried two identical 3Com nics, and the problem is exhibited with both. NIC is 3Com 3C9960-SX. Chip: BCM5701KHB Other NICs are integrated Intel using the em driver. Debug output and dmesg follow: GNU gdb 6.1.1 [FreeBSD] Copyright 2004 Free Software Foundation, Inc. GDB is free software, covered by the GNU General Public License, and you are welcome to change it and/or distribute copies of it under certain conditions. Type "show copying" to see the conditions. There is absolutely no warranty for GDB. Type "show warranty" for details. This GDB was configured as "i386-marcel-freebsd". Unread portion of the kernel message buffer: Fatal trap 12: page fault while in kernel mode fault virtual address = 0xbfd0d20c fault code = supervisor read, page not present instruction pointer = 0x20:0xc07f5919 stack pointer = 0x28:0xd408ec00 frame pointer = 0x28:0xd408ec50 code segment = base 0x0, limit 0xfffff, type 0x1b = DPL 0, pres 1, def32 1, gran 1 processor eflags = interrupt enabled, resume, IOPL = 0 current process = 21 (irq10: em0) trap number = 12 panic: page fault Uptime: 9m1s Dumping 503 MB (2 chunks) chunk 0: 1MB (160 pages) ... ok chunk 1: 503MB (128752 pages) 487 471 455 439 423 407 391 375 359 343 327 311 295 279 263 247 231 215 199 183 167 151 135 119 103 87 71 55 39 23 7 #0 doadump () at pcpu.h:165 165 __asm __volatile("movl %%fs:0,%0" : "=r" (td)); (kgdb) where #0 doadump () at pcpu.h:165 #1 0xc063796a in boot (howto=260) at /usr/src/sys/kern/kern_shutdown.c:399 #2 0xc0637c00 in panic (fmt=0xc084f68c "%s") at /usr/src/sys/kern/kern_shutdown.c:555 #3 0xc0808d70 in trap_fatal (frame=0xd408ebc0, eva=3218133516) at /usr/src/sys/i386/i386/trap.c:831 #4 0xc0808adb in trap_pfault (frame=0xd408ebc0, usermode=0, eva=3218133516) at /usr/src/sys/i386/i386/trap.c:742 #5 0xc0808719 in trap (frame= {tf_fs = -1046872056, tf_es = 40, tf_ds = -1047134168, tf_edi = -1045740800, tf_esi = -1044477568, tf_ebp = -737612720, tf_isp = -737612820, tf_ebx = -1041618176, tf_edx = 0, tf_ecx = 1128804354, tf_eax = 275587, tf_trapno = 12, tf_err = 0, tf_eip = -1065395943, tf_cs = 32, tf_eflags = 590338, tf_esp = -737612784, tf_ss = -1047072384}) at /usr/src/sys/i386/i386/trap.c:432 #6 0xc07f7f0a in calltrap () at /usr/src/sys/i386/i386/exception.s:139 #7 0xc07f5919 in bus_dmamap_load (dmat=0xc1b87a80, map=0x43483, buf=0x43483002, buflen=2046, callback=0xc0503ba4 , callback_arg=0xd408ec74, flags=0) at pmap.h:200 #8 0xc050448e in em_get_buf (i=48, adapter=0xc1a50000, nmp=0x0) at /usr/src/sys/dev/em/if_em.c:2474 #9 0xc0504c5f in em_process_receive_interrupts (adapter=0xc1a50000, count=-2) at /usr/src/sys/dev/em/if_em.c:2797 #10 0xc0501eb5 in em_intr (arg=0xc1a50000) at /usr/src/sys/dev/em/if_em.c:992 #11 0xc06226b9 in ithread_loop (arg=0xc1966780) at /usr/src/sys/kern/kern_intr.c:547 #12 0xc0621940 in fork_exit (callout=0xc0622560 , arg=0xc1966780, frame=0xd408ed38) at /usr/src/sys/kern/kern_fork.c:789 #13 0xc07f7f6c in fork_trampoline () at /usr/src/sys/i386/i386/exception.s:208 (kgdb) up 7 #7 0xc07f5919 in bus_dmamap_load (dmat=0xc1b87a80, map=0x43483, buf=0x43483002, buflen=2046, callback=0xc0503ba4 , callback_arg=0xd408ec74, flags=0) at pmap.h:200 200 pa = *vtopte(va); (kgdb) p pa (kgdb) p va (kgdb) list *0xc07f5919 0xc07f5919 is in bus_dmamap_load (pmap.h:201). 196 197 if ((pa = PTD[va >> PDRSHIFT]) & PG_PS) { 198 pa = (pa & ~(NBPDR - 1)) | (va & (NBPDR - 1)); 199 } else { 200 pa = *vtopte(va); 201 pa = (pa & PG_FRAME) | (va & PAGE_MASK); 202 } 203 return pa; 204 } 205 (kgdb) dmesg: Copyright (c) 1992-2005 The FreeBSD Project. Copyright (c) 1979, 1980, 1983, 1986, 1988, 1989, 1991, 1992, 1993, 1994 The Regents of the University of California. All rights reserved. FreeBSD 6.0-RELEASE #0: Fri Jan 6 15:53:52 UTC 2006 root@erik-test.net.tamu.edu:/usr/obj/usr/src/sys/GENERIC.poll.notxp mptable_probe: MP Config Table has bad signature: \^F\^H Timecounter "i8254" frequency 1193182 Hz quality 0 CPU: Intel(R) Celeron(R) CPU 2.00GHz (2000.35-MHz 686-class CPU) Origin = "GenuineIntel" Id = 0xf29 Stepping = 9 Features=0xbfebfbff Features2=0x4400> real memory = 528416768 (503 MB) avail memory = 507748352 (484 MB) npx0: [FAST] npx0: on motherboard npx0: INT 16 interface acpi0: on motherboard acpi0: Power Button (fixed) pci_link0: irq 5 on acpi0 pci_link1: irq 12 on acpi0 pci_link2: irq 9 on acpi0 pci_link3: irq 11 on acpi0 pci_link4: irq 0 on acpi0 pci_link5: irq 0 on acpi0 pci_link6: irq 10 on acpi0 pci_link7: irq 11 on acpi0 Timecounter "ACPI-fast" frequency 3579545 Hz quality 1000 acpi_timer0: <24-bit timer at 3.579545MHz> port 0x408-0x40b on acpi0 cpu0: on acpi0 acpi_button0: on acpi0 pcib0: port 0xcf8-0xcff on acpi0 pci0: on pcib0 agp0: mem 0xe0000000-0xe7ffffff,0xec100000-0xec17ffff irq 5 at device 2.0 on pci0 agp0: detected 8060k stolen memory agp0: aperture size is 128M uhci0: port 0xb800-0xb81f irq 5 at device 29.0 on pci0 uhci0: [GIANT-LOCKED] usb0: on uhci0 usb0: USB revision 1.0 uhub0: Intel UHCI root hub, class 9/0, rev 1.00/1.00, addr 1 uhub0: 2 ports with 2 removable, self powered uhci1: port 0xb000-0xb01f irq 11 at device 29.1 on pci0 uhci1: [GIANT-LOCKED] usb1: on uhci1 usb1: USB revision 1.0 uhub1: Intel UHCI root hub, class 9/0, rev 1.00/1.00, addr 1 uhub1: 2 ports with 2 removable, self powered uhci2: port 0xb400-0xb41f irq 9 at device 29.2 on pci0 uhci2: [GIANT-LOCKED] usb2: on uhci2 usb2: USB revision 1.0 uhub2: Intel UHCI root hub, class 9/0, rev 1.00/1.00, addr 1 uhub2: 2 ports with 2 removable, self powered ehci0: mem 0xec180000-0xec1803ff irq 11 at device 29.7 on pci0 ehci0: [GIANT-LOCKED] usb3: EHCI version 1.0 usb3: companion controllers, 2 ports each: usb0 usb1 usb2 usb3: on ehci0 usb3: USB revision 2.0 uhub3: Intel EHCI root hub, class 9/0, rev 2.00/1.00, addr 1 uhub3: 6 ports with 6 removable, self powered pcib1: at device 30.0 on pci0 pci_link3: BIOS IRQ 5 does not match initial IRQ 11 pci1: on pcib1 bge0: mem 0xec040000-0xec04ffff irq 12 at device 0.0 on pci1 bge0: Ethernet address: 00:0a:5e:55:bc:d1 em0: port 0xa000-0xa03f mem 0xec000000-0xec01ffff irq 10 at device 5.0 on pci1 em0: Ethernet address: 00:30:48:43:7e:bc em0: Speed:N/A Duplex:N/A em1: port 0xa400-0xa43f mem 0xec020000-0xec03ffff irq 11 at device 6.0 on pci1 em1: Ethernet address: 00:30:48:43:7e:bd em1: Speed:N/A Duplex:N/A isab0: at device 31.0 on pci0 isa0: on isab0 atapci0: port 0x1f0-0x1f7,0x3f6,0x170-0x177,0x376,0xcc00-0xcc0f mem 0xec181000-0xec1813ff at device 31.1 on pci0 ata0: on atapci0 ata1: on atapci0 pci0: at device 31.3 (no driver attached) acpi_tz0: on acpi0 fdc0: port 0x3f0-0x3f5,0x3f7 irq 6 drq 2 on acpi0 fdc0: [FAST] sio0: <16550A-compatible COM port> port 0x3f8-0x3ff irq 4 flags 0x10 on acpi0 sio0: type 16550A, console sio1: <16550A-compatible COM port> port 0x2f8-0x2ff irq 3 on acpi0 sio1: type 16550A ppc0: port 0x378-0x37f,0x778-0x77b irq 7 on acpi0 ppc0: Generic chipset (NIBBLE-only) in COMPATIBLE mode ppbus0: on ppc0 plip0: on ppbus0 lpt0: on ppbus0 lpt0: Interrupt-driven port ppi0: on ppbus0 atkbdc0: port 0x60,0x64 irq 1 on acpi0 atkbd0: irq 1 on atkbdc0 kbd0 at atkbd0 atkbd0: [GIANT-LOCKED] pmtimer0 on isa0 sc0: at flags 0x100 on isa0 sc0: VGA <16 virtual consoles, flags=0x300> vga0: at port 0x3c0-0x3df iomem 0xa0000-0xbffff on isa0 Timecounter "TSC" frequency 2000345876 Hz quality 800 Timecounters tick every 1.000 msec ad0: DMA limited to UDMA33, controller found non-ATA66 cable ad0: 38166MB at ata0-master UDMA33 acd0: CDROM at ata1-master UDMA33 Trying to mount root from ufs:/dev/ad0s1a WARNING: / was not properly dismounted bridge0: Ethernet address: ac:de:48:5c:4d:07 bridge0: promiscuous mode enabled em0: link state changed to UP em0: link state changed to DOWN >How-To-Repeat: Create an if_bridge interface with member bge0, and send traffic through the bridge. >Fix: >Release-Note: >Audit-Trail: >Unformatted: