Skip site navigation (1)Skip section navigation (2)
Date:      Wed, 20 Oct 2004 15:10:24 -0400
From:      Mike Tancsa <mike@sentex.net>
To:        freebsd-stable@freebsd.org
Subject:   Re: Repeated panics...  in the serial code ?
Message-ID:  <6.1.2.0.0.20041020150714.08cf8a80@64.7.153.2>
In-Reply-To: <6.1.2.0.0.20041014021404.04143d00@64.7.153.2>
References:  <6.1.2.0.0.20041014021404.04143d00@64.7.153.2>

next in thread | previous in thread | raw e-mail | index | archive | help

OK, I think

http://www.freebsd.org/cgi/query-pr.cgi?pr=72935

is the cause of this.

         ---Mike


At 02:14 AM 14/10/2004, Mike Tancsa wrote:

>We have a number of RELENG_4 boxes that are dumping core with crash dumps 
>generally in the same place.  Unfortunately, we are not sure just yet how 
>to repeat the dump and sometimes we do not get a full dump as the hardware 
>watchdog interrupts the dump process :(.
>
>The boxes are running a 4 port PCI serial card (lava) but we have seen a 
>similar issue with a Titan serial card as well.
>
>IdlePTD at physical address 0x003f5000
>initial pcb at physical address 0x003493c0
>panicstr: free: multiple frees
>panic messages:
>---
>panic: free: multiple frees
>
>syncing disks... 3
>done
>Uptime: 12d10h34m24s
>
>dumping to dev #ad/0x20001, offset 1575040
>dump ata0: resetting devices .. done
>
>(kgdb) bt
>#0  dumpsys () at /usr/src/sys/kern/kern_shutdown.c:487
>#1  0xc016926b in boot (howto=256) at /usr/src/sys/kern/kern_shutdown.c:316
>#2  0xc0169690 in poweroff_wait (junk=0xc02d983f, howto=4) at 
>/usr/src/sys/kern/kern_shutdown.c:595
>#3  0xc0164c87 in free (addr=0xc18f8880, type=0xc032d120) at 
>/usr/src/sys/kern/kern_malloc.c:385
>#4  0xc018371e in cblock_free_cblocks (number=22) at 
>/usr/src/sys/kern/tty_subr.c:194
>#5  0xc0183754 in clist_free_cblocks (clistp=0xc138fb38) at 
>/usr/src/sys/kern/tty_subr.c:208
>#6  0xc017e89e in ttyclose (tp=0xc138fb00) at /usr/src/sys/kern/tty.c:247
>#7  0xc02c67e9 in sioclose (dev=0xc11cc600, flag=7, mode=8192, 
>p=0xcbef8ee0) at /usr/src/sys/isa/sio.c:1669
>#8  0xc01a2f78 in spec_close (ap=0xd56a7e44) at 
>/usr/src/sys/miscfs/specfs/spec_vnops.c:591
>#9  0xc026a6d2 in ufsspec_close (ap=0xd56a7e44) at 
>/usr/src/sys/ufs/ufs/ufs_vnops.c:1854
>#10 0xc026ac99 in ufs_vnoperatespec (ap=0xd56a7e44) at 
>/usr/src/sys/ufs/ufs/ufs_vnops.c:2394
>#11 0xc019ea28 in vn_close (vp=0xd564a400, flags=7, cred=0xc0a36680, 
>p=0xcbef8ee0) at vnode_if.h:218
>#12 0xc019f353 in vn_closefile (fp=0xc134a380, p=0xcbef8ee0) at 
>/usr/src/sys/kern/vfs_vnops.c:693
>#13 0xc015ed2b in fdrop (fp=0xc134a380, p=0xcbef8ee0) at 
>/usr/src/sys/sys/file.h:218
>#14 0xc015ec74 in closef (fp=0xc134a380, p=0xcbef8ee0) at 
>/usr/src/sys/kern/kern_descrip.c:1441
>#15 0xc015ddab in close (p=0xcbef8ee0, uap=0xd56a7f80) at 
>/usr/src/sys/kern/kern_descrip.c:623
>#16 0xc02b75f5 in syscall2 (frame={tf_fs = 47, tf_es = 47, tf_ds = 
>-1078001617, tf_edi = -1077937232, tf_esi = -1077936924,
>       tf_ebp = -1077939744, tf_isp = -714440748, tf_ebx = -1077939748, 
> tf_edx = -1077936924, tf_ecx = 5, tf_eax = 6,
>       tf_trapno = 7, tf_err = 2, tf_eip = 672039156, tf_cs = 31, 
> tf_eflags = 647, tf_esp = -1077939804, tf_ss = 47})
>     at /usr/src/sys/i386/i386/trap.c:1175
>#17 0xc02ab915 in Xint0x80_syscall ()
>#18 0x804a9bf in ?? ()
>#19 0x8049412 in ?? ()
>#20 0x8048fca in ?? ()
>(kgdb) bt full
>#0  dumpsys () at /usr/src/sys/kern/kern_shutdown.c:487
>         error = 0
>#1  0xc016926b in boot (howto=256) at /usr/src/sys/kern/kern_shutdown.c:316
>         howto = 256
>#2  0xc0169690 in poweroff_wait (junk=0xc02d983f, howto=4) at 
>/usr/src/sys/kern/kern_shutdown.c:595
>         fmt = 0xc02d983f "free: multiple frees"
>         bootopt = 256
>         buf = "free: multiple frees", '\000' <repeats 235 times>
>#3  0xc0164c87 in free (addr=0xc18f8880, type=0xc032d120) at 
>/usr/src/sys/kern/kern_malloc.c:385
>         kbp = (struct kmembuckets *) 0xc02d983f
>         kup = (struct kmemusage *) 0xc0a19b2c
>         freep = (struct freelist *) 0xc18f8880
>         size = 128
>         s = 6493208
>         ksp = (struct malloc_type *) 0x100
>#4  0xc018371e in cblock_free_cblocks (number=22) at 
>/usr/src/sys/kern/tty_subr.c:194
>         number = 22
>         i = 4
>#5  0xc0183754 in clist_free_cblocks (clistp=0xc138fb38) at 
>/usr/src/sys/kern/tty_subr.c:208
>         clistp = (struct clist *) 0xc138fb38
>#6  0xc017e89e in ttyclose (tp=0xc138fb00) at /usr/src/sys/kern/tty.c:247
>         tp = (struct tty *) 0xc138fb00
>         s = 6493208
>#7  0xc02c67e9 in sioclose (dev=0xc11cc600, flag=7, mode=8192, 
>p=0xcbef8ee0) at /usr/src/sys/isa/sio.c:1669
>         com = (struct com_s *) 0xc11ce800
>         mynor = 0
>         s = 0
>         tp = (struct tty *) 0xc138fb00
>#8  0xc01a2f78 in spec_close (ap=0xd56a7e44) at 
>/usr/src/sys/miscfs/specfs/spec_vnops.c:591
>         vp = (struct vnode *) 0xd564a400
>         p = (struct proc *) 0xcbef8ee0
>         dev = 0xc11cc600
>#9  0xc026a6d2 in ufsspec_close (ap=0xd56a7e44) at 
>/usr/src/sys/ufs/ufs/ufs_vnops.c:1854
>         ap = (struct vop_close_args *) 0xd56a7e44
>         vp = (struct vnode *) 0x0
>#10 0xc026ac99 in ufs_vnoperatespec (ap=0xd56a7e44) at 
>/usr/src/sys/ufs/ufs/ufs_vnops.c:2394
>         ap = (struct vop_generic_args *) 0x0
>#11 0xc019ea28 in vn_close (vp=0xd564a400, flags=7, cred=0xc0a36680, 
>p=0xcbef8ee0) at vnode_if.h:218
>         rc = -1053514880
>         a = {a_desc = 0xc0321280, a_vp = 0xd564a400, a_fflag = 7, a_cred 
> = 0xc0a36680, a_p = 0xcbef8ee0}
>         vp = (struct vnode *) 0xd564a400
>         fflag = 0
>         cred = (struct ucred *) 0x0
>---Type <return> to continue, or q <return> to quit---
>         p = (struct proc *) 0x0
>         vp = (struct vnode *) 0xd564a400
>         flags = 0
>         cred = (struct ucred *) 0x0
>         p = (struct proc *) 0x0
>#12 0xc019f353 in vn_closefile (fp=0xc134a380, p=0xcbef8ee0) at 
>/usr/src/sys/kern/vfs_vnops.c:693
>         fp = (struct file *) 0x0
>         p = (struct proc *) 0x0
>#13 0xc015ed2b in fdrop (fp=0xc134a380, p=0xcbef8ee0) at 
>/usr/src/sys/sys/file.h:218
>         fp = (struct file *) 0xc134a380
>         fp = (struct file *) 0xc134a380
>         lf = {l_start = -4502243104899727360, l_len = 
> -4629710226642173593, l_pid = 3, l_type = 32640, l_whence = -10902}
>         vp = (struct vnode *) 0x0
>         error = -873492768
>#14 0xc015ec74 in closef (fp=0xc134a380, p=0xcbef8ee0) at 
>/usr/src/sys/kern/kern_descrip.c:1441
>         fp = (struct file *) 0xc134a380
>         p = (struct proc *) 0xcbef8ee0
>         vp = (struct vnode *) 0x0
>         lf = {l_start = -3751622871852515327, l_len = 
> -4605065915465564376, l_pid = -873492768, l_type = -23680, l_whence = -16076}
>         fdtol = (struct filedesc_to_leader *) 0x0
>#15 0xc015ddab in close (p=0xcbef8ee0, uap=0xd56a7f80) at 
>/usr/src/sys/kern/kern_descrip.c:623
>         p = (struct proc *) 0xcbef8ee0
>         uap = (struct close_args *) 0x0
>         fdp = (struct filedesc *) 0xc138d000
>         fp = (struct file *) 0xc134a380
>         fd = 0
>         error = -1053241284
>         holdleaders = 0
>#16 0xc02b75f5 in syscall2 (frame={tf_fs = 47, tf_es = 47, tf_ds = 
>-1078001617, tf_edi = -1077937232, tf_esi = -1077936924,
>       tf_ebp = -1077939744, tf_isp = -714440748, tf_ebx = -1077939748, 
> tf_edx = -1077936924, tf_ecx = 5, tf_eax = 6,
>       tf_trapno = 7, tf_err = 2, tf_eip = 672039156, tf_cs = 31, 
> tf_eflags = 647, tf_esp = -1077939804, tf_ss = 47})
>     at /usr/src/sys/i386/i386/trap.c:1175
>         params = 0xbfbff1a8 ""
>         i = 0
>         callp = (struct sysent *) 0xc0327930
>         p = (struct proc *) 0xcbef8ee0
>         orig_tf_eflags = 647
>         sticks = 22993
>         error = 0
>         narg = 1
>         args = {0, -1077938412, 3, 0, 0, 0, 0, 0}
>         have_mplock = 1
>         code = 6
>---Type <return> to continue, or q <return> to quit---
>#17 0xc02ab915 in Xint0x80_syscall ()
>No symbol table info available.
>#18 0x804a9bf in ?? ()
>No symbol table info available.
>#19 0x8049412 in ?? ()
>No symbol table info available.
>#20 0x8048fca in ?? ()
>No symbol table info available.
>(kgdb)
>
>
>And from a previous dump,
>
># gdb -k /usr/obj/usr/src/sys/gas/kernel.debug /var/crash/vmcore.0
>GNU gdb 4.18 (FreeBSD)
>Copyright 1998 Free Software Foundation, Inc.
>GDB is free software, covered by the GNU General Public License, and you are
>welcome to change it and/or distribute copies of it under certain conditions.
>Type "show copying" to see the conditions.
>There is absolutely no warranty for GDB.  Type "show warranty" for details.
>This GDB was configured as "i386-unknown-freebsd"...Deprecated bfd_read 
>called at 
>/usr/src/gnu/usr.bin/binutils/gdb/../../../../contrib/gdb/gdb/dbxread.c 
>line 2627 in elfstab_build_psymtabs
>Deprecated bfd_read called at 
>/usr/src/gnu/usr.bin/binutils/gdb/../../../../contrib/gdb/gdb/dbxread.c 
>line 933 in fill_symbuf
>
>IdlePTD at physical address 0x003f5000
>initial pcb at physical address 0x003493c0
>panicstr: free: multiple frees
>panic messages:
>---
>dmesg: kvm_read:
>---
>#0  dumpsys () at /usr/src/sys/kern/kern_shutdown.c:487
>487             if (dumping++) {
>(kgdb) bt
>#0  dumpsys () at /usr/src/sys/kern/kern_shutdown.c:487
>#1  0xc016926b in boot (howto=256) at /usr/src/sys/kern/kern_shutdown.c:316
>#2  0xc0169690 in poweroff_wait (junk=0xc02d983f, howto=0) at 
>/usr/src/sys/kern/kern_shutdown.c:595
>#3  0xc0164c87 in free (addr=0xc12b5480, type=0xc032d120) at 
>/usr/src/sys/kern/kern_malloc.c:385
>#4  0xc018371e in cblock_free_cblocks (number=11) at 
>/usr/src/sys/kern/tty_subr.c:194
>#5  0xc0183754 in clist_free_cblocks (clistp=0xc1351800) at 
>/usr/src/sys/kern/tty_subr.c:208
>#6  0xc017e8a4 in ttyclose (tp=0xc1351800) at /usr/src/sys/kern/tty.c:248
>#7  0xc02c67e9 in sioclose (dev=0xc11cc600, flag=7, mode=8192, 
>p=0xcbef8ee0) at /usr/src/sys/isa/sio.c:1669
>#8  0xc01a2f78 in spec_close (ap=0xd56a7e44) at 
>/usr/src/sys/miscfs/specfs/spec_vnops.c:591
>#9  0xc026a6d2 in ufsspec_close (ap=0xd56a7e44) at 
>/usr/src/sys/ufs/ufs/ufs_vnops.c:1854
>#10 0xc026ac99 in ufs_vnoperatespec (ap=0xd56a7e44) at 
>/usr/src/sys/ufs/ufs/ufs_vnops.c:2394
>#11 0xc019ea28 in vn_close (vp=0xd564a400, flags=7, cred=0xc0a36680, 
>p=0xcbef8ee0) at vnode_if.h:218
>#12 0xc019f353 in vn_closefile (fp=0xc134a140, p=0xcbef8ee0) at 
>/usr/src/sys/kern/vfs_vnops.c:693
>#13 0xc015ed2b in fdrop (fp=0xc134a140, p=0xcbef8ee0) at 
>/usr/src/sys/sys/file.h:218
>#14 0xc015ec74 in closef (fp=0xc134a140, p=0xcbef8ee0) at 
>/usr/src/sys/kern/kern_descrip.c:1441
>#15 0xc015ddab in close (p=0xcbef8ee0, uap=0xd56a7f80) at 
>/usr/src/sys/kern/kern_descrip.c:623
>#16 0xc02b75f5 in syscall2 (frame={tf_fs = 47, tf_es = 47, tf_ds = 
>-1078001617, tf_edi = -1077937232, tf_esi = -1077936924,
>       tf_ebp = -1077939744, tf_isp = -714440748, tf_ebx = -1077939748, 
> tf_edx = -1077936924, tf_ecx = 5, tf_eax = 6,
>       tf_trapno = 7, tf_err = 2, tf_eip = 672039156, tf_cs = 31, 
> tf_eflags = 647, tf_esp = -1077939804, tf_ss = 47})
>     at /usr/src/sys/i386/i386/trap.c:1175
>#17 0xc02ab915 in Xint0x80_syscall ()
>cannot read proc at 0xcbef8ee0
>(kgdb)
>
>
>
>
>Copyright (c) 1992-2004 The FreeBSD Project.
>Copyright (c) 1979, 1980, 1983, 1986, 1988, 1989, 1991, 1992, 1993, 1994
>         The Regents of the University of California. All rights reserved.
>FreeBSD 4.10-STABLE #5: Mon Sep 13 17:12:22 EDT 2004
>     gabor@pp-station.sentex.ca:/usr/obj/usr/src/sys/gas
>Timecounter "i8254"  frequency 1193182 Hz
>Timecounter "TSC"  frequency 2400410264 Hz
>CPU: Intel(R) Celeron(R) CPU 2.40GHz (2400.41-MHz 686-class CPU)
>   Origin = "GenuineIntel"  Id = 0xf29  Stepping = 9
> 
>Features=0xbfebfbff<FPU,VME,DE,PSE,TSC,MSR,PAE,MCE,CX8,APIC,SEP,MTRR,PGE,MCA,CMOV,PAT,PSE36,CLFLUSH,DTS,ACPI,MMX,FXSR,SSE,SSE2,SS,HTT,TM,PBE>
>real memory  = 267321344 (261056K bytes)
>config> q
>avail memory = 256217088 (250212K bytes)
>Preloaded elf kernel "kernel" at 0xc03d6000.
>Preloaded userconfig_script "/boot/kernel.conf" at 0xc03d609c.
>Warning: Pentium 4 CPU: PSE disabled
>Pentium Pro MTRR support enabled
>md0: Malloc disk
>Using $PIR table, 8 entries at 0xc00fdee0
>npx0: <math processor> on motherboard
>npx0: INT 16 interface
>pcib0: <Host to PCI bridge> on motherboard
>pci0: <PCI bus> on pcib0
>agp0: <Intel 82865G (865G GMCH) SVGA controller> port 0xd000-0xd007 mem 
>0xfa000000-0xfa07ffff,0xf0000000-0xf7ffffff irq 15 at device 2.0 on pci0
>agp0: detected 892k stolen memory
>agp0: aperture size is 128M
>uhci0: <Intel 82801EB (ICH5) USB controller USB-A> port 0xc000-0xc01f irq 
>15 at device 29.0 on pci0
>usb0: <Intel 82801EB (ICH5) USB controller USB-A> on uhci0
>usb0: USB revision 1.0
>uhub0: Intel UHCI root hub, class 9/0, rev 1.00/1.00, addr 1
>uhub0: 2 ports with 2 removable, self powered
>uhid0: APC Back-UPS ES 500 FW:801.e5.D USB FW:e5, rev 1.10/1.06, addr 2, 
>iclass 3/0
>uhci1: <Intel 82801EB (ICH5) USB controller USB-B> port 0xc400-0xc41f irq 
>5 at device 29.1 on pci0
>usb1: <Intel 82801EB (ICH5) USB controller USB-B> on uhci1
>usb1: USB revision 1.0
>uhub1: Intel UHCI root hub, class 9/0, rev 1.00/1.00, addr 1
>uhub1: 2 ports with 2 removable, self powered
>uhci2: <Intel 82801EB (ICH5) USB controller USB-C> port 0xc800-0xc81f irq 
>10 at device 29.2 on pci0
>usb2: <Intel 82801EB (ICH5) USB controller USB-C> on uhci2
>usb2: USB revision 1.0
>uhub2: Intel UHCI root hub, class 9/0, rev 1.00/1.00, addr 1
>uhub2: 2 ports with 2 removable, self powered
>uhci3: <Intel 82801EB (ICH5) USB controller USB-D> port 0xcc00-0xcc1f irq 
>15 at device 29.3 on pci0
>usb3: <Intel 82801EB (ICH5) USB controller USB-D> on uhci3
>usb3: USB revision 1.0
>uhub3: Intel UHCI root hub, class 9/0, rev 1.00/1.00, addr 1
>uhub3: 2 ports with 2 removable, self powered
>pcib1: <Intel 82801BA/BAM (ICH2) Hub to PCI bridge> at device 30.0 on pci0
>pci1: <PCI bus> on pcib1
>rl0: <RealTek 8139 10/100BaseTX> port 0xa000-0xa0ff mem 
>0xf9000000-0xf90000ff irq 15 at device 4.0 on pci1
>rl0: Ethernet address: 00:50:fc:ee:1b:34
>miibus0: <MII bus> on rl0
>rlphy0: <RealTek internal media interface> on miibus0
>rlphy0:  10baseT, 10baseT-FDX, 100baseTX, 100baseTX-FDX, auto
>puc0: <SmartLink 5634PCV SurfRider> port 0xa400-0xa407 irq 12 at device 
>5.0 on pci1
>sio2: type 16550A
>fxp0: <Intel 82801BA (D865) Pro/100 VE Ethernet> port 0xa800-0xa83f mem 
>0xf9001000-0xf9001fff irq 11 at device 8.0 on pci1
>fxp0: Ethernet address 00:01:80:54:b5:65
>inphy0: <i82562ET 10/100 media interface> on miibus1
>inphy0:  10baseT, 10baseT-FDX, 100baseTX, 100baseTX-FDX, auto
>puc1: <Lava Computers Quattro-PCI serial port> port 
>0xb000-0xb007,0xac00-0xac07 irq 10 at device 10.0 on pci1
>sio3: type 16550A
>sio4: type 16550A
>puc2: <Lava Computers Quattro-PCI serial port> port 
>0xb800-0xb807,0xb400-0xb407 irq 10 at device 10.1 on pci1
>sio5: type 16550A
>sio6: type 16550A
>isab0: <PCI to ISA bridge (vendor=8086 device=24d0)> at device 31.0 on pci0
>isa0: <ISA bus> on isab0
>atapci0: <Intel ICH5 ATA100 controller> port 
>0xf000-0xf00f,0-0x3,0-0x7,0-0x3,0-0x7 irq 0 at device 31.1 on pci0
>ata0: at 0x1f0 irq 14 on atapci0
>ata1: at 0x170 irq 15 on atapci0
>ichsmb0: <Intel 82801EB (ICH5) SMBus controller> port 0x5000-0x501f irq 12 
>at device 31.3 on pci0
>smbus0: <System Management Bus> on ichsmb0
>smb0: <SMBus general purpose I/O> on smbus0
>orm0: <Option ROM> at iomem 0xc0000-0xc9fff on isa0
>pmtimer0 on isa0
>fdc0: <NEC 72065B or clone> at port 0x3f0-0x3f5,0x3f7 irq 6 drq 2 on isa0
>fdc0: FIFO enabled, 8 bytes threshold
>atkbdc0: <Keyboard controller (i8042)> at port 0x60,0x64 on isa0
>vga0: <Generic ISA VGA> at port 0x3c0-0x3df iomem 0xa0000-0xbffff on isa0
>sc0: <System console> at flags 0x100 on isa0
>sc0: VGA <16 virtual consoles, flags=0x300>
>sio0 at port 0x3f8-0x3ff irq 4 flags 0x10 on isa0
>sio0: type 16550A
>sio1 at port 0x2f8-0x2ff irq 3 on isa0
>sio1: type 16550A
>ipfw2 initialized, divert enabled, rule-based forwarding enabled, default 
>to accept, logging limited to 100 packets/entry by default
>IPsec: Initialized Security Association Processing.
>ad0: 38166MB <ST340014A> [77545/16/63] at ata0-master UDMA100
>Mounting root from ufs:/dev/ad0s1a
>WARNING: / was not properly dismounted
>
>
>--------------------------------------------------------------------
>Mike Tancsa,                                      tel +1 519 651 3400
>Sentex Communications,                            mike@sentex.net
>Providing Internet since 1994                    www.sentex.net
>Cambridge, Ontario Canada                         www.sentex.net/mike
>
>_______________________________________________
>freebsd-stable@freebsd.org mailing list
>http://lists.freebsd.org/mailman/listinfo/freebsd-stable
>To unsubscribe, send any mail to "freebsd-stable-unsubscribe@freebsd.org"



Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?6.1.2.0.0.20041020150714.08cf8a80>