kern/126469: fxp(4) related kernel panic

Tue Aug 12 06:10:07 UTC 2008

>Number:         126469
>Category:       kern
>Synopsis:       fxp(4) related kernel panic
>Confidential:   no
>Severity:       serious
>Priority:       medium
>Responsible:    freebsd-bugs
>State:          open
>Quarter:        
>Keywords:       
>Date-Required:
>Class:          sw-bug
>Submitter-Id:   current-users
>Arrival-Date:   Tue Aug 12 06:10:02 UTC 2008
>Closed-Date:
>Last-Modified:
>Originator:     Rory Arms
>Release:        7.0-RELEASE
>Organization:
>Environment:
FreeBSD Tserver 7.0-RELEASE FreeBSD 7.0-RELEASE #13: Sat Mar  8 19:01:13 EST 2008     root at Tserver:/mnt/obj/usr/src/sys/TSERVER  i386

>Description:
My server had a panic today. This one I think is along the same lines as the kern/125617 PR that I reported awhile ago. Except this time the code path seemed to be on the fxp(4) driver side:

> sudo kgdb /boot/kernel/kernel vmcore.0             Password:
[GDB will not be able to debug user-mode threads: /usr/lib/libthread_db.so: Undefined symbol "ps_pglobal_lookup"]
GNU gdb 6.1.1 [FreeBSD]
Copyright 2004 Free Software Foundation, Inc.
GDB is free software, covered by the GNU General Public License, and you are
welcome to change it and/or distribute copies of it under certain conditions.
Type "show copying" to see the conditions.
There is absolutely no warranty for GDB.  Type "show warranty" for details.
This GDB was configured as "i386-marcel-freebsd".

Unread portion of the kernel message buffer:

Fatal trap 12: page fault while in kernel mode
cpuid = 1; apic id = 01
fault virtual address   = 0x10
fault code              = supervisor write, page not present
instruction pointer     = 0x20:0xc04c421f
stack pointer           = 0x28:0xe4052c48
frame pointer           = 0x28:0xe4052c84
code segment            = base 0x0, limit 0xfffff, type 0x1b
                        = DPL 0, pres 1, def32 1, gran 1
processor eflags        = interrupt enabled, resume, IOPL = 0
current process         = 23 (irq19: fxp1 uhci0)
trap number             = 12
panic: page fault
cpuid = 1
Uptime: 8d8h37m20s
Physical memory: 1015 MB
Dumping 206 MB: 191 175 159 143 127 111 95 79 63 47 31 15

#0  doadump () at pcpu.h:195
195     pcpu.h: No such file or directory.
        in pcpu.h
(kgdb) bt
#0  doadump () at pcpu.h:195
#1  0xc059fbd6 in boot (howto=260) at /usr/src/sys/kern/kern_shutdown.c:409
#2  0xc059feae in panic (fmt=Variable "fmt" is not available.
) at /usr/src/sys/kern/kern_shutdown.c:563
#3  0xc08190cc in trap_fatal (frame=0xe4052c08, eva=16)
    at /usr/src/sys/i386/i386/trap.c:899
#4  0xc081933b in trap_pfault (frame=0xe4052c08, usermode=0, eva=16)
    at /usr/src/sys/i386/i386/trap.c:812
#5  0xc0819d32 in trap (frame=0xe4052c08) at /usr/src/sys/i386/i386/trap.c:490
#6  0xc080097b in calltrap () at /usr/src/sys/i386/i386/exception.s:139
#7  0xc04c421f in fxp_add_rfabuf (sc=0xc3c52000, rxp=0xc3c5221c)
    at /usr/src/sys/dev/fxp/if_fxp.c:2272
#8  0xc04c564b in fxp_intr (xsc=0xc3c52000)
    at /usr/src/sys/dev/fxp/if_fxp.c:1655
#9  0xc058242b in ithread_loop (arg=0xc3bc2b10)
    at /usr/src/sys/kern/kern_intr.c:1036
#10 0xc057f154 in fork_exit (callout=0xc0582260 <ithread_loop>, 
    arg=0xc3bc2b10, frame=0xe4052d38) at /usr/src/sys/kern/kern_fork.c:781
#11 0xc08009f0 in fork_trampoline () at /usr/src/sys/i386/i386/exception.s:205
(kgdb) print panicstr
$1 = 0xc08f3e00 "page fault"

log entries noted just prior to panic occurring:

ath0: stuck beacon; resetting (bmiss count 4)
ath0: ath_reset: unable to reset hardware; hal status 3
ath0: device timeout
ath0: stuck beacon; resetting (bmiss count 4)
ath0: ath_reset: unable to reset hardware; hal status 3
ath0: device timeout
ath0: stuck beacon; resetting (bmiss count 4)
ath0: ath_reset: unable to reset hardware; hal status 3
ath0: device timeout

Fatal trap 12: page fault while in kernel mode
cpuid = 1; apic id = 01
fault virtual address   = 0x10
fault code              = supervisor write, page not present
instruction pointer     = 0x20:0xc04c421f
stack pointer           = 0x28:0xe4052c48
frame pointer           = 0x28:0xe4052c84
code segment            = base 0x0, limit 0xfffff, type 0x1b
                        = DPL 0, pres 1, def32 1, gran 1
processor eflags        = interrupt enabled, resume, IOPL = 0
current process         = 23 (irq19: fxp1 uhci0)
trap number             = 12
panic: page fault
cpuid = 1
Uptime: 8d8h37m20s
Physical memory: 1015 MB
Dumping 206 MB: 191 175 159 143 127 111 95 79 63 47 31 15
Dump complete
Automatic reboot in 15 seconds - press a key on the console to abort
--> Press a key on the console to reboot,

This is a dual processor server, that has two fxp(4) devices, and an ath(4) device. It is a multipurpose internet router, so fxp0 handles the WAN, fxp1 the LAN and ath0 (in hostap mode) is bridged with fxp1. Most of the panics I've had with 7.0 seem to be related to those LAN devices. not sure if it's a case that only shows up when they're bridged together, but that seems to be the case.
>How-To-Repeat:
Unknown, it seems to be random, or perhaps when there is some kind of event that happens on ath(4), I'm not quite sure. All I know is that I have ath0 & fxp1 that are a part of a bridge set, and this type of panic happens shortly after one of those two devices starts complaining about problems (lost beacon in ath0's case, or SCB timeout on fxp1)
>Fix:

>Release-Note:
>Audit-Trail:
>Unformatted: