From owner-freebsd-current@FreeBSD.ORG Tue Mar 24 20:42:30 2009 Return-Path: Delivered-To: freebsd-current@freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:4f8:fff6::34]) by hub.freebsd.org (Postfix) with ESMTP id CFC45106564A for ; Tue, 24 Mar 2009 20:42:30 +0000 (UTC) (envelope-from mel.flynn+fbsd.current@mailing.thruhere.net) Received: from mailhub.rachie.is-a-geek.net (rachie.is-a-geek.net [66.230.99.27]) by mx1.freebsd.org (Postfix) with ESMTP id 8F8678FC1C for ; Tue, 24 Mar 2009 20:42:30 +0000 (UTC) (envelope-from mel.flynn+fbsd.current@mailing.thruhere.net) Received: from sarevok.dnr.servegame.org (gate.lan.rachie.is-a-geek.net [192.168.2.10]) by mailhub.rachie.is-a-geek.net (Postfix) with ESMTP id A344B7E818 for ; Tue, 24 Mar 2009 12:42:28 -0800 (AKDT) From: Mel Flynn To: freebsd-current@freebsd.org Date: Tue, 24 Mar 2009 21:42:27 +0100 User-Agent: KMail/1.11.0 (FreeBSD/8.0-CURRENT; KDE/4.2.0; i386; ; ) References: <200903232223.47295.mel.flynn+fbsd.current@mailing.thruhere.net> In-Reply-To: <200903232223.47295.mel.flynn+fbsd.current@mailing.thruhere.net> MIME-Version: 1.0 Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: 7bit Content-Disposition: inline Message-Id: <200903242142.27268.mel.flynn+fbsd.current@mailing.thruhere.net> Subject: Re: Panic in wpi, hard to reproduce X-BeenThere: freebsd-current@freebsd.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Discussions about the use of FreeBSD-current List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 24 Mar 2009 20:42:31 -0000 On Monday 23 March 2009 22:23:47 Mel Flynn wrote: > Hi, > > I've been bit twice now by a panic in wpi(4). It's hard to reproduce but > the panics are consistent, meaning the two panics are identical. I'm not > using wpi at the moment, but may again in the relative near future. > > At the time of the crashes the card was used as wireless g connection to an > FreeBSD hostap using ral(4), via WEP. Some additional info about it: it seems to happen after a long period of non- activity but not always, since I've had the machine up for >5 days with good nights of sleep. I tend to think it's caused by coming from "sleep mode" and desktop widgets like RSS and weather panels, at the same time requesting stuff from the net, but it's a gut feeling. I haven't found a solid reproduction scenario, not for lack of trying. > % ident /boot/kernel/if_wpi.ko > /boot/kernel/if_wpi.ko: > $FreeBSD: src/sys/dev/wpi/if_wpi.c,v 1.19 2009/02/13 16:17:05 sam Exp > $ > > Script started on Sat Mar 7 10:55:59 2009 > # kgdb /boot/kernel/kernel /var/crash/vmcore.0 > GNU gdb 6.1.1 [FreeBSD] > Copyright 2004 Free Software Foundation, Inc. > GDB is free software, covered by the GNU General Public License, and you > are welcome to change it and/or distribute copies of it under certain > conditions. Type "show copying" to see the conditions. > There is absolutely no warranty for GDB. Type "show warranty" for details. > This GDB was configured as "i386-marcel-freebsd"... > > Unread portion of the kernel message buffer: > > > Fatal trap 12: page fault while in kernel mode > cpuid = 0; apic id = 00 > fault virtual address = 0x7d1667b8 > fault code = supervisor read, page not present > instruction pointer = 0x20:0xc0688be1 > stack pointer = 0x28:0xc4aabba0 > frame pointer = 0x28:0xc4aabbb4 > code segment = base 0x0, limit 0xfffff, type 0x1b > = DPL 0, pres 1, def32 1, gran 1 > processor eflags = interrupt enabled, resume, IOPL = 0 > current process = 12 (irq16: vgapci0+++) > trap number = 12 > panic: page fault > cpuid = 0 > Uptime: 1d16h11m34s > Physical memory: 1517 MB > Dumping 287 MB: 272 256 240 224 208 192 176 160 144 128 112 96 80 64 48 32 > 16 > > Reading symbols from /boot/kernel/geom_journal.ko...Reading symbols from > /boot/kernel/geom_journal.ko.symbols...done. > done. > Loaded symbols for /boot/kernel/geom_journal.ko > Reading symbols from /boot/kernel/snd_hda.ko...Reading symbols from > /boot/kernel/snd_hda.ko.symbols...done. > done. > Loaded symbols for /boot/kernel/snd_hda.ko > Reading symbols from /boot/kernel/sound.ko...Reading symbols from > /boot/kernel/sound.ko.symbols...done. > done. > Loaded symbols for /boot/kernel/sound.ko > Reading symbols from /boot/modules/nvidia.ko...done. > Loaded symbols for /boot/modules/nvidia.ko > Reading symbols from /boot/kernel/linux.ko...Reading symbols from > /boot/kernel/linux.ko.symbols...done. > done. > Loaded symbols for /boot/kernel/linux.ko > Reading symbols from /boot/kernel/smb.ko...Reading symbols from > /boot/kernel/smb.ko.symbols...done. > done. > Loaded symbols for /boot/kernel/smb.ko > Reading symbols from /boot/kernel/linprocfs.ko...Reading symbols from > /boot/kernel/linprocfs.ko.symbols...done. > done. > Loaded symbols for /boot/kernel/linprocfs.ko > Reading symbols from /boot/kernel/wpifw.ko...Reading symbols from > /boot/kernel/wpifw.ko.symbols...done. > done. > Loaded symbols for /boot/kernel/wpifw.ko > Reading symbols from /boot/kernel/blank_saver.ko...Reading symbols from > /boot/kernel/blank_saver.ko.symbols...done. > done. > Loaded symbols for /boot/kernel/blank_saver.ko > #0 doadump () at pcpu.h:246 > 246 pcpu.h: No such file or directory. > in pcpu.h > (kgdb) bt > #0 doadump () at pcpu.h:246 > #1 0xc0637bdc in boot (howto=260) at /usr/src/sys/kern/kern_shutdown.c:420 > #2 0xc0637ea9 in panic (fmt=Variable "fmt" is not available. > ) at /usr/src/sys/kern/kern_shutdown.c:576 > #3 0xc08633cc in trap_fatal (frame=0xc4aabb60, eva=2098620344) > at /usr/src/sys/i386/i386/trap.c:929 > #4 0xc0863630 in trap_pfault (frame=0xc4aabb60, usermode=0, > eva=2098620344) at /usr/src/sys/i386/i386/trap.c:842 > #5 0xc0863fb2 in trap (frame=0xc4aabb60) at > /usr/src/sys/i386/i386/trap.c:522 #6 0xc084932b in calltrap () at > /usr/src/sys/i386/i386/exception.s:165 #7 0xc0688be1 in mb_free_ext > (m=0xc925d300) at > /usr/src/sys/kern/uipc_mbuf.c:228 > #8 0xc0689381 in m_freem (mb=0x0) at mbuf.h:524 > #9 0xc083d981 in wpi_intr (arg=0xc4e2c800) at > /usr/src/sys/dev/wpi/if_wpi.c:1589 > #10 0xc061688b in intr_event_execute_handlers (p=0xc4d2e7ec, ie=0xc4d70380) > at /usr/src/sys/kern/kern_intr.c:1134 > #11 0xc0617cab in ithread_loop (arg=0xc4eda680) at > /usr/src/sys/kern/kern_intr.c:1147 > #12 0xc06145e3 in fork_exit (callout=0xc0617c40 , > arg=0xc4eda680, > frame=0xc4aabd38) at /usr/src/sys/kern/kern_fork.c:821 > #13 0xc08493a0 in fork_trampoline () at > /usr/src/sys/i386/i386/exception.s:270 (kgdb) frame 7 > #7 0xc0688be1 in mb_free_ext (m=0xc925d300) at > /usr/src/sys/kern/uipc_mbuf.c:228 > 228 if (*(m->m_ext.ref_cnt) == 1 || > (kgdb) print m->M_dat.MH.MH_dat.MH_ext > $1 = {ext_buf = 0x6ddc9134
, ext_free = > 0x6e378c2e, > ext_arg1 = 0xc25a829, ext_arg2 = 0x6070e28f, ext_size = 2799295368, > ref_cnt = 0x7d1667b8, ext_type = 908986233} > (kgdb) print *(m->M_dat.MH.MH_dat.MH_ext.ref_cnt) > Cannot access memory at address 0x7d1667b8 > (kgdb) frame 9 > #9 0xc083d981 in wpi_intr (arg=0xc4e2c800) at > /usr/src/sys/dev/wpi/if_wpi.c:1589 > 1589 m_freem(txdata->m); > (kgdb) list > 1584 ifp->if_opackets++; > 1585 > 1586 bus_dmamap_sync(ring->data_dmat, txdata->map, BUS_DMASYNC_POSTWRITE); > 1587 bus_dmamap_unload(ring->data_dmat, txdata->map); > 1588 /* XXX handle M_TXCB? */ > 1589 m_freem(txdata->m); > 1590 txdata->m = NULL; > 1591 ieee80211_free_node(txdata->ni); > 1592 txdata->ni = NULL; > 1593 -- Mel