[Bug 224359] ipmi kernel panic

https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=224359

--- Comment #8 from Ray Bellis <ray@bellis.me.uk> ---
here's an extract of the output when I start `kgdb`:

<6>lo0: link state changed to UP
<6>bge0: link state changed to DOWN
ipmi0: KCS: Failed to read address
ipmi0: KCS error: 01
ipmi0: KCS: Failed to write data byte 203
ipmi0: KCS error: 01

Fatal trap 12: page fault while in kernel mode
cpuid = 3; apic id = 03
fault virtual address   = 0x200000519
fault code              = supervisor read data, page not present
instruction pointer     = 0x20:0xffffffff8213e0f6
stack pointer           = 0x28:0xfffffe00c614eea0
frame pointer           = 0x28:0xfffffe00c614eeb0
code segment            = base 0x0, limit 0xfffff, type 0x1b
                        = DPL 0, pres 1, long 1, def32 0, gran 1
processor eflags        = interrupt enabled, resume, IOPL = 0
current process         = 8 (ipmi0: kcs)
rdi: fffff80003c95000 rsi: ffffffff823b9e80 rdx: 0000000000000ca8
rcx: 0000000000000001  r8: 0000009a13a173c8  r9: fffff80035080000
rax: 0000000000000000 rbx: 0000000200000501 rbp: fffffe00c614eeb0
r10: 000000000000001d r11: 0000fff5cecfdfc5 r12: ffffffff823b9e80
r13: 0000000000000003 r14: fffff80035080000 r15: fffff80003c95110
trap number             = 12
panic: page fault
cpuid = 3
time = 1748856626
KDB: stack backtrace:
#0 0xffffffff80b8b88d at kdb_backtrace+0x5d
#1 0xffffffff80b3dc11 at vpanic+0x131
#2 0xffffffff80b3dad3 at panic+0x43
#3 0xffffffff81025a0b at trap_fatal+0x40b
#4 0xffffffff81025a56 at trap_pfault+0x46
#5 0xffffffff80ffc388 at calltrap+0x8
#6 0xffffffff8214100b at kcs_loop+0x9b
#7 0xffffffff80af760f at fork_exit+0x7f
#8 0xffffffff80ffd3ee at fork_trampoline+0xe
Uptime: 13s

(kgdb) f 8
560     TAILQ_INSERT_TAIL(&dev->ipmi_completed_requests, req, ir_link);

(kgdb) i lo
dev = 0x200000501

(kgdb) p/x *sc
$1 = {ipmi_dev = 0xfffff800039d8600, _iface = {bt = {seq = 0x0}, kcs = {<No
data fields>}, 
    smic = {<No data fields>}, ssif = {smbus = 0x0, smbus_address = 0x0}},
ipmi_io_rid = 0x0, ipmi_io_type = 0x4, 
  ipmi_io_lock = {lock_object = {lo_name = 0xffffffff82146b26, lo_flags =
0x1030000, lo_data = 0x0, 
      lo_witness = 0x0}, mtx_lock = 0x0}, ipmi_io_res = {0xfffff80003c9ce80,
0xfffff80003c9cd80, 0x0}, 
  ipmi_io_spacing = 0x1, ipmi_irq_rid = 0x0, ipmi_irq_res = 0xfffff80003c9cc80,
ipmi_irq = 0x0, 
  ipmi_detaching = 0x0, ipmi_opened = 0x0, ipmi_dev_support = 0x0, ipmi_cdev =
0x0, ipmi_pending_requests = {
    tqh_first = 0x0, tqh_last = 0xfffff80003c95088},
ipmi_pending_requests_highpri = {tqh_first = 0x0, 
    tqh_last = 0xfffff80003c95098}, ipmi_driver_requests_polled = 0x1,
ipmi_power_cycle_tag = 0x0, 
  ipmi_watchdog_tag = 0x0, ipmi_shutdown_tag = 0x0, ipmi_watchdog_active = 0x0,
ipmi_watchdog_actions = 0x0, 
  ipmi_watchdog_pretimeout = 0x0, ipmi_ich = {ich_links = {stqe_next =
0xfffffe00c630e010}, ich_state = 0x3, 
    ich_func = 0xffffffff8213e320, ich_arg = 0xfffff80003c95000},
ipmi_requests_lock = {lock_object = {
      lo_name = 0xffffffff82146c92, lo_flags = 0x1030000, lo_data = 0x0,
lo_witness = 0x0}, 
    mtx_lock = 0xfffff80035080000}, ipmi_request_added = {cv_description =
0xffffffff8214655c, cv_waiters = 0x0}, 
  ipmi_kthread = 0xfffffe00c5f20b00, ipmi_intr = 0x0, ipmi_startup =
0xffffffff82140730, 
  ipmi_enqueue_request = 0xffffffff8213e1f0, ipmi_driver_request =
0xffffffff82140780}

(kgdb) p/x *req
$5 = {ir_link = {tqe_next = 0x0, tqe_prev = 0xffffffff00000000}, ir_owner =
0x200000501, 
  ir_request = 0xffffffff81b6eb20, ir_requestlen = 0x9fffff470, ir_reply =
0xffffffff81b6e5b8, 
  ir_replybuflen = 0x103, ir_replylen = 0x81b6e5b8, ir_error = 0x5, ir_msgid =
0xffffffff823b9ee0, ir_addr = 0xdb, 
  ir_command = 0xad, ir_compcode = 0xb4, ir_ipmb = 0x80, ir_ipmb_addr = 0xff,
ir_ipmb_command = 0xff}

-- 
You are receiving this mail because:
You are the assignee for the bug.