i386/112357: kernel panic (swi0: sio)

[Denis]

>Number:         112357
>Category:       i386
>Synopsis:       kernel panic (swi0: sio)
>Confidential:   no
>Severity:       critical
>Priority:       high
>Responsible:    freebsd-i386
>State:          open
>Quarter:        
>Keywords:       
>Date-Required:
>Class:          sw-bug
>Submitter-Id:   current-users
>Arrival-Date:   Wed May 02 17:20:02 GMT 2007
>Closed-Date:
>Last-Modified:
>Originator:     Denis
>Release:        6.2 RELEASE
>Organization:
>Environment:
FreeBSD radio.lepetykha.net 6.2-RELEASE FreeBSD 6.2-RELEASE #0: Sat Mar 31 10:56:44 EEST 2007     admin at mail.lepetykha.net:/usr/src/sys/i386/compile/GATE  i386
>Description:
Box is SMP (AMD Athlon X2), using 4-port RS232 multiport PCI card for dial-in.
Additional kernel options:
options	SMP
device	puc
options	MSIZE=256
options	TTYHOG=4096
options	DEVICE_POLLING
options	HZ=1000

Here the backtrace of kernel dump:
Unread portion of the kernel message buffer:


Fatal trap 12: page fault while in kernel mode
cpuid = 1; apic id = 01
fault virtual address   = 0x14
fault code              = supervisor read, page not present
instruction pointer     = 0x20:0xc070c3d6
stack pointer           = 0x28:0xd44cdc50
frame pointer           = 0x28:0xd44cdc7c
code segment            = base 0x0, limit 0xfffff, type 0x1b
                        = DPL 0, pres 1, def32 1, gran 1
processor eflags        = interrupt enabled, resume, IOPL = 0
current process         = 33 (swi0: sio)
trap number             = 12
panic: page fault
cpuid = 1
Uptime: 4h49m35s
Dumping 511 MB (2 chunks)
  chunk 0: 1MB (158 pages) ... ok
  chunk 1: 511MB (130800 pages) 495 479 463 447 431 415 399 383 367 351 335 319 303 287 271 255 239 223 207 191 175 159 143 127 111 95 79 63
47 31 15

#0  doadump () at pcpu.h:165
165             __asm __volatile("movl %%fs:0,%0" : "=r" (td));


(kgdb) bt
#0  doadump () at pcpu.h:165
#1  0xc0590fd6 in boot (howto=260) at ../../../kern/kern_shutdown.c:409
#2  0xc05912fd in panic (fmt=0xc0746dfb "%s") at ../../../kern/kern_shutdown.c:565
#3  0xc070e490 in trap_fatal (frame=0xd44cdc10, eva=20) at ../../../i386/i386/trap.c:837
#4  0xc070e1cf in trap_pfault (frame=0xd44cdc10, usermode=0, eva=20) at ../../../i386/i386/trap.c:745
#5  0xc070de29 in trap (frame=
      {tf_fs = 8, tf_es = 40, tf_ds = 40, tf_edi = -1018904244, tf_esi = 20, tf_ebp = -733160324, tf_isp = -733160388, tf_ebx = 108, tf_edx =
 108, tf_ecx = 27, tf_eax = -1018904264, tf_trapno = 12, tf_err = 0, tf_eip = -1066351658, tf_cs = 32, tf_eflags = 66070, tf_esp = 0, tf_ss =
 -1019146184}) at ../../../i386/i386/trap.c:435
#6  0xc06fa86a in calltrap () at ../../../i386/i386/exception.s:139
#7  0xc070c3d6 in generic_bcopy () at ../../../i386/i386/support.s:489
Previous frame inner to this frame (corrupt stack?)


(kgdb) list *0xc070c3d6
0xc070c3d6 is at ../../../i386/i386/support.s:490.
485             cmpl    %ecx,%eax                       /* overlapping && src < dst? */
486             jb      1f
487
488             shrl    $2,%ecx                         /* copy by 32-bit words */
489             cld                                     /* nope, copy forwards */
490             rep
491             movsl
492             movl    20(%esp),%ecx
493             andl    $3,%ecx                         /* any bytes left? */
494             rep
>How-To-Repeat:
Problem appears in random.
>Fix:

>Release-Note:
>Audit-Trail:
>Unformatted: